Deploy the ssh extra, from one place

update.sh installed `[search]` only, so the release that added agent
connections shipped without asyncssh and the feature offered an install
hint on a machine that had just been told to install it.

The extras are now one variable, spelled the same way in install.sh and
update.sh, with a comment in both saying they have to stay in step. That is
the whole failure mode: an extra added to one of them is an extra existing
deployments silently miss.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/install.sh

@@ -76,9 +76,13 @@ if [[ ! -x "$VENV/bin/python" ]]; then
   sudo -u "$SERVICE_USER" python -m venv "$VENV"
 fi
 sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet --upgrade pip
-# With the `search` extra: DuckDuckGo is the default web search provider and is
+# The extras a deployment gets. `search` because DuckDuckGo is the default web
-# meant to work with no setup at all.
+# search provider and is meant to need no setup; `ssh` because agent chats reach
-sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[search]"
+# their machine over it and a deployment without it offers the feature with an
+# install hint instead. Listed here AND in update.sh -- an extra added to only
+# one of them means existing deployments silently miss it.
+LEMBAS_EXTRAS="${LEMBAS_EXTRAS:-search,ssh}"
+sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[$LEMBAS_EXTRAS]"
 
 echo "== environment =="
 # Generated once and never regenerated: rotating LEMBAS_SECRET_KEY signs every

deploy/update.sh

@@ -37,11 +37,14 @@ else
 fi
 
 # Cheap and idempotent; catches a dependency added since the last deploy.
-# The `search` extra is included because DuckDuckGo is the default web search
+# The extras a deployment gets. `search` because DuckDuckGo is the default web
-# provider and is meant to need no setup -- a deployment without it offers a
+# search provider and is meant to need no setup; `ssh` because agent chats reach
-# provider that fails on every call.
+# their machine over it and a deployment without it offers the feature with an
+# install hint instead. Listed here AND in install.sh -- an extra added to only
+# one of them means existing deployments silently miss it.
+LEMBAS_EXTRAS="${LEMBAS_EXTRAS:-search,ssh}"
 echo "== dependencies =="
-sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[search]"
+sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[$LEMBAS_EXTRAS]"
 
 # The unit is NOT reinstalled automatically. An installed unit usually carries
 # host-specific lines the template cannot know about -- an ordering dependency