How do I install the Fleet Infra Fixes skill?

Run npx skillmds@latest add s3yed/fleet-infra-fixes in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Fleet Infra Fixes safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Fleet Infra Fixes?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Fleet Infra Fixes free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Fleet Infra Fixes?

S3YED (@s3yed) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Fleet Infra Fixes by s3yed — Agent Skill

Name: Fleet Infra Fixes
Author: S3YED

File contents

fleet-infra-fixes Skill

Purpose

Recurring operational fixes and credential patterns for the Appie fleet, so any agent can resolve them fast instead of re-deriving. Captured 2026-06-03.

node / simdjson breakage (macOS)

Homebrew node (25.x/26.x) can break when simdjson upgrades the dylib (libsimdjson.29 missing), breaking codex/vercel/default-node. Symptom: dyld error or "Named export not found". Fix: brew upgrade node (-> 26) or use node@22 at /opt/homebrew/opt/node@22/bin. Default to node@22 for Mission Control + Next builds.

pnpm purge-without-TTY

pnpm install in a merged repo may abort: ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY (wants to purge node_modules). Do NOT run casual installs in Mission Control. If a dep is genuinely missing, install deliberately and restart the dev server when not in use. reagraph/three are already present; r3f/drei are not.

Single-repo git access for a bot = SSH deploy key, NOT a token

Vercel/GitHub account tokens are scope-wide. To give a bot write access to ONLY one repo: generate an SSH deploy key ON the bot's machine (ssh-keygen -t ed25519 -N "" -f ~/.ssh/<repo>_deploy), add an ssh config alias (Host github-<repo> -> IdentityFile that key, IdentitiesOnly yes), and add the PUBLIC key in the repo Settings > Deploy keys (Allow write access). Private key never leaves the box, never goes in chat. Vercel single-project isolation needs a dedicated Vercel TEAM + team-scoped token (project-level RBAC is Enterprise only).

Secrets discipline

Never echo secrets to Telegram or any chat (they are logged server-side). Secrets live in $SECRETS_VAULT_DIR/.env or the agent's config. Tailscale serve cert/key must be gitignored (*.ts.net.crt/.key) and kept out of repos.

Token re-auth (the common blocker)

When GitHub/Vercel ops fail with Bad credentials, the appie-1 tokens are expired (gh keyring + vault GH_TOKEN/GITHUB_TOKEN/VERCEL_TOKEN). SSH to github as S3YED works (key appie-brain). Fix needs the human: gh auth login + vercel login. Do not try to mint tokens; document and wait.

Browser automation on modern Chrome

Chrome 148 app-bound cookie encryption defeats profile-copy session reuse; Chrome 136+ blocks CDP on the real profile. So you cannot reuse a logged-in GitHub session from a copied profile. For an authenticated headed render (e.g. screenshots of WebGL views), log in via the app's own API in the Playwright context, use channel:'chrome', headless:false, --use-gl=angle.

Tailscale serve (Mission Control)

Expose tailnet-only, NEVER funnel: tailscale serve --bg 3000 -> https://<tailnet-host>.ts.net. Disable: tailscale serve --https=443 off. The cert/key land in the cwd; move them to $SECRETS_VAULT_DIR/ts-certs/.

Local models

STT: faster-whisper (small, int8). Embeddings: ollama bge-m3. TTS: local Kokoro/Piper. Image gen: fal.ai Nano Banana. Heavy/bulk work dispatches to Spark Atlas or via ~/bin/dispatch-appie.sh.

---name: fleet-infra-fixesdescription: Resolve recurring Appie fleet infrastructure issues including Node/Homebrew breakage, pnpm install blockers, deploy keys, secrets, browser auth, Tailscale serve, and local model routing.---# fleet-infra-fixes Skill## PurposeRecurring operational fixes and credential patterns for the Appie fleet, so any agent can resolve them fast instead of re-deriving. Captured 2026-06-03.## node / simdjson breakage (macOS)Homebrew `node` (25.x/26.x) can break when simdjson upgrades the dylib (libsimdjson.29 missing), breaking codex/vercel/default-node. Symptom: dyld error or "Named export not found". Fix: `brew upgrade node` (-> 26) or use `node@22` at `/opt/homebrew/opt/node@22/bin`. Default to node@22 for Mission Control + Next builds.## pnpm purge-without-TTY`pnpm install` in a merged repo may abort: `ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY` (wants to purge node_modules). Do NOT run casual installs in Mission Control. If a dep is genuinely missing, install deliberately and restart the dev server when not in use. reagraph/three are already present; r3f/drei are not.## Single-repo git access for a bot = SSH deploy key, NOT a tokenVercel/GitHub account tokens are scope-wide. To give a bot write access to ONLY one repo: generate an SSH deploy key ON the bot's machine (`ssh-keygen -t ed25519 -N "" -f ~/.ssh/<repo>_deploy`), add an ssh config alias (`Host github-<repo>` -> IdentityFile that key, IdentitiesOnly yes), and add the PUBLIC key in the repo Settings > Deploy keys (Allow write access). Private key never leaves the box, never goes in chat. Vercel single-project isolation needs a dedicated Vercel TEAM + team-scoped token (project-level RBAC is Enterprise only).## Secrets disciplineNever echo secrets to Telegram or any chat (they are logged server-side). Secrets live in `$SECRETS_VAULT_DIR/.env` or the agent's config. Tailscale serve cert/key must be gitignored (`*.ts.net.crt/.key`) and kept out of repos.## Token re-auth (the common blocker)When GitHub/Vercel ops fail with Bad credentials, the appie-1 tokens are expired (gh keyring + vault GH_TOKEN/GITHUB_TOKEN/VERCEL_TOKEN). SSH to github as S3YED works (key `appie-brain`). Fix needs the human: `gh auth login` + `vercel login`. Do not try to mint tokens; document and wait.## Browser automation on modern ChromeChrome 148 app-bound cookie encryption defeats profile-copy session reuse; Chrome 136+ blocks CDP on the real profile. So you cannot reuse a logged-in GitHub session from a copied profile. For an authenticated headed render (e.g. screenshots of WebGL views), log in via the app's own API in the Playwright context, use `channel:'chrome'`, `headless:false`, `--use-gl=angle`.## Tailscale serve (Mission Control)Expose tailnet-only, NEVER funnel: `tailscale serve --bg 3000` -> `https://<tailnet-host>.ts.net`. Disable: `tailscale serve --https=443 off`. The cert/key land in the cwd; move them to `$SECRETS_VAULT_DIR/ts-certs/`.## Local modelsSTT: faster-whisper (`small`, int8). Embeddings: ollama `bge-m3`. TTS: local Kokoro/Piper. Image gen: fal.ai Nano Banana. Heavy/bulk work dispatches to Spark Atlas or via `~/bin/dispatch-appie.sh`.

Frequently asked questions

Fleet Infra Fixes