@astrofoundry/pi-astro 0.28.0 → 0.28.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/skills/arcane/SKILL.md

@@ -36,7 +36,7 @@ The output is JSON with `counts`, `rows`, and `table`. Answer with the `table` f
 - `Running` and `Latest` are release tags. `older build`: the running build carries no tag any more. `new build`: no release tag names the newer build. `17 (older build)`: the running build of that major series is no longer tagged.
 - `Update`: `pull` means redeploying the stack with an image pull applies it; `edit tag` means changing the tag in the GitOps repository; `edit digest` means changing the pinned digest in the repository (`latestDigest` in the row holds it); `unknown` has its reason in the notes under the table.
 - A note "major version change" or "newer major ... available" means the update crosses a major version. Read its release notes yourself before asking anything (next section).
-- Rows marked private have no version data because the registry needs credentials; their digest result from Arcane still stands.
+- Private images (the registry refuses anonymous access, such as our own Grimoire builds) are left out of the table and the counts; the summary line counts them and `privateImages` lists them. Mention them only when the caller asks.
 
 Apply updates only when asked, one stack at a time, through the operations or GitOps procedure above, and run `update-report` again afterwards to show the result.
 

package/specialists/AGENTS.md

@@ -54,7 +54,7 @@ Wrappers ship as TypeScript and run under Node 24 type stripping: erasable synta
 - Every passthrough call writes a private per-call copy of `arcanecli.yml` with `jwt_token` set, because some `arcane-cli` commands validate the config file before reading `ARCANE_TOKEN`. The copy is removed after the call.
 - Every wrapper answers `--help` without reading config, so agents can discover subcommands before anything else is set up.
 - `main()` waits for stdout and stderr to flush before `process.exit`: on a pipe, exiting right after a write drops everything past the 64 KiB buffer, which cut large answers such as `projects list --all` until 2026-09-25 (`lib/flush.test.ts`).
-- `arcane update-report [--all]` is `lib/image-updates.ts` over `lib/registry.ts`: a fresh `images updates check --all`, then `projects list --all` for the stack and service of each image reference, then the registries' tag lists and manifest digests (anonymous bearer tokens from each registry's challenge; digests by HEAD, which Docker Hub does not count as a pull; lscr.io is read from ghcr.io). A floating or major-series tag is resolved to the release tag whose digest matches the running and the latest build, searching the newest tags of the three commonest release shapes; a fixed tag is compared with the newest tag of the same shape; a digest pin with the newest release. Checks older than one minute before the run count as stale and show as unknown. Private images keep Arcane's digest result without versions. The table is fixed-width text for a code block, because Discord renders no Markdown tables.
+- `arcane update-report [--all]` is `lib/image-updates.ts` over `lib/registry.ts`: a fresh `images updates check --all`, then `projects list --all` for the stack and service of each image reference, then the registries' tag lists and manifest digests (anonymous bearer tokens from each registry's challenge; digests by HEAD, which Docker Hub does not count as a pull; lscr.io is read from ghcr.io). A floating or major-series tag is resolved to the release tag whose digest matches the running and the latest build, searching the newest tags of the three commonest release shapes; a fixed tag is compared with the newest tag of the same shape; a digest pin with the newest release. Checks older than one minute before the run count as stale and show as unknown. Private images (anonymous access refused with 401 or 403) are excluded from rows, counts, and table, listed in `privateImages`, and counted in the summary line. The table is fixed-width text for a code block, because Discord renders no Markdown tables.
 - `arcane release-notes <stack>[/<service>]` is `lib/releases.ts`: a single-image check and `resolveRef` give the running and latest versions, `HttpRegistry.labels` reads `org.opencontainers.image.source` from the latest image (index to linux/amd64 manifest to config blob), and the anonymous GitHub releases API (60 requests an hour, up to 3 pages of 100) gives the releases in between, oldest first. `condenseNotes` keeps each release under 12,000 characters by section priority; `capTotal` drops the oldest releases past 40,000 characters in total.
 
 ## Gate

package/specialists/lib/image-updates.test.ts

@@ -100,7 +100,7 @@ describe("resolveRef", () => {
     });
 
     it("falls back to the digest result for private images and marks bad checks unknown", async () => {
-        expect(await resolveRef("ghcr.io/astrofoundry/app:main", entry("A1", "A2"), registry, NOW)).toMatchObject({ status: "update", latest: "new build", note: "versions unavailable: private image, the registry needs credentials" });
+        expect(await resolveRef("ghcr.io/astrofoundry/app:main", entry("A1", "A2"), registry, NOW)).toMatchObject({ status: "update", latest: "new build", private: true });
         expect(await resolveRef("nginx:1.31.4-alpine", undefined, registry, NOW)).toMatchObject({ status: "unknown", note: "not in the fresh check" });
         expect(await resolveRef("nginx:1.31.4-alpine", entry("N", "N", { checkTime: "2026-09-24T00:00:00Z" }), registry, NOW)).toMatchObject({ status: "unknown", note: expect.stringContaining("stale") });
         expect(await resolveRef("nginx:1.31.4-alpine", entry("N", "N", { error: "timeout" }), registry, NOW)).toMatchObject({ status: "unknown", note: "check failed: timeout" });
@@ -120,17 +120,21 @@ describe("buildUpdateReport", () => {
                 { name: "profiles", status: "running", updateInfo: { serviceUpdates: { profiles: { imageRef: "nginx:1.31.4-alpine" } } } },
                 { name: "canary", status: "stopped", updateInfo: { serviceUpdates: { canary: { imageRef: "busybox:latest" } } } },
                 { name: "empty", status: "running" },
+                { name: "ours", status: "running", updateInfo: { serviceUpdates: { api: { imageRef: "ghcr.io/astrofoundry/app:main" }, worker: { imageRef: "ghcr.io/astrofoundry/app:main" } } } },
             ],
         };
         const check = {
             "lscr.io/linuxserver/prowlarr:latest": entry("D1", "D2"),
             "nginx:1.31.4-alpine": entry("N", "N"),
             "busybox:latest": entry("B", "B"),
+            "ghcr.io/astrofoundry/app:main": entry("A1", "A2"),
         };
         const report = await buildUpdateReport({ check, projects, registry, startedAt: NOW, all: false });
         expect(report.counts).toEqual({ update: 1, release: 0, rebuild: 0, unknown: 1, "up-to-date": 2 });
         expect(report.rows.map((r) => `${r.stack}/${r.service}:${r.status}`)).toEqual(["media/prowlarr:update", "empty/empty:unknown"]);
-        expect(report.table).toMatch(/^Fresh check 2026-09-25T18:30:00Z: 4 services in 4 stacks, 3 images\./);
+        expect(report.table).toMatch(/^Fresh check 2026-09-25T18:30:00Z: 4 services in 5 stacks, 3 images\. 1 private images \(2 services\) excluded\./);
+        expect(report.privateImages).toEqual(["ghcr.io/astrofoundry/app:main"]);
+        expect(report.rows.some((r) => r.stack === "ours")).toBe(false);
         expect(report.table).toContain("media/prowlarr  prowlarr  2.0.5.5160-ls123  2.1.0.5190-ls124  pull");
         expect(report.table).toContain("* empty: Arcane lists no images for this stack");
         const all = await buildUpdateReport({ check, projects, registry, startedAt: NOW, all: true });

package/specialists/lib/image-updates.ts

@@ -34,6 +34,8 @@ export interface UpdateReport {
     checkedAt: string;
     stacks: number;
     images: number;
+    /** Private image references, excluded from `rows`, `counts`, and the table. */
+    privateImages: string[];
     counts: Record<UpdateStatus, number>;
     rows: UpdateRow[];
     table: string;
@@ -150,6 +152,8 @@ interface Resolution {
     action: string;
     note: string;
     latestDigest?: string;
+    /** The registry refused anonymous access: an image of our own, left out of the report. */
+    private?: boolean;
 }
 
 /** Resolves one image reference to running and latest versions from the fresh check and the registry's tags. */
@@ -175,7 +179,8 @@ export async function resolveRef(refText: string, entry: CheckEntry | undefined,
         tags = (await registry.tags(ref)).map(parseTag).filter((t): t is TagVersion => t !== null);
     } catch (err) {
         const status = err instanceof RegistryError ? err.status : 0;
-        return digestOnly(status === 401 || status === 403 ? "private image, the registry needs credentials" : err instanceof Error ? err.message : String(err));
+        if (status === 401 || status === 403) return { ...digestOnly("private image, the registry needs credentials"), private: true };
+        return digestOnly(err instanceof Error ? err.message : String(err));
     }
 
     const digests = new Map<string, string | null>();
@@ -243,7 +248,7 @@ export async function resolveRef(refText: string, entry: CheckEntry | undefined,
         const sameShape = tags.filter((t) => shapeKey(t) === shapeKey(r)).sort(byVersionDesc).slice(0, PER_SHAPE);
         latest = (await findTag(entry.latestDigest, sameShape)) ?? latest;
     }
-    return { kind, running, latest, status: "update", action: "pull", note: majorChange(running, latest) ? "major version change: check the release notes before pulling" : "" };
+    return { kind, running, latest, status: "update", action: "pull", note: majorChange(running, latest) ? "major version change: read its release notes before pulling" : "" };
 }
 
 async function mapLimit<T, R>(items: readonly T[], limit: number, fn: (item: T) => Promise<R>): Promise<R[]> {
@@ -347,7 +352,9 @@ export async function buildUpdateReport(input: { check: unknown; projects: unkno
     await mapLimit(refs, CONCURRENCY, async (ref) => {
         resolved.set(ref, await resolveRef(ref, entries[ref], registry, input.startedAt));
     });
-    const rows: UpdateRow[] = services.map((s) => {
+    const privateImages = refs.filter((ref) => resolved.get(ref)?.private === true);
+    const listed = services.filter((s) => s.ref === null || !privateImages.includes(s.ref));
+    const rows: UpdateRow[] = listed.map((s) => {
         if (s.ref === null) return { stack: s.stack, service: s.service, ref: "", image: "?", kind: "floating", running: "?", latest: "?", status: "unknown", action: "", note: "Arcane lists no images for this stack" };
         const r = resolved.get(s.ref) as Resolution & { kind: RefKind };
         const note = [r.note, s.stopped ? "stack is stopped" : ""].filter(Boolean).join("; ");
@@ -359,9 +366,10 @@ export async function buildUpdateReport(input: { check: unknown; projects: unkno
     const shown = input.all ? rows : rows.filter((r) => r.status !== "up-to-date" || r.note.includes("newer major"));
     const checkedAt = new Date(input.startedAt).toISOString().replace(/\.\d+Z$/, "Z");
     const stacks = new Set(services.map((s) => s.stack)).size;
+    const excluded = privateImages.length === 0 ? "" : ` ${privateImages.length} private images (${services.length - listed.length} services) excluded.`;
     const summary =
-        `Fresh check ${checkedAt}: ${services.length} services in ${stacks} stacks, ${refs.length} images. ` +
+        `Fresh check ${checkedAt}: ${listed.length} services in ${stacks} stacks, ${refs.length - privateImages.length} images.${excluded} ` +
         `${counts.update} new builds, ${counts.release} new releases, ${counts.rebuild} rebuilds, ${counts.unknown} unknown, ${counts["up-to-date"]} up to date` +
         (input.all ? "." : " (not listed unless a newer major exists).");
-    return { checkedAt, stacks, images: refs.length, counts, rows: shown, table: renderTable(shown, summary) };
+    return { checkedAt, stacks, images: refs.length - privateImages.length, privateImages, counts, rows: shown, table: renderTable(shown, summary) };
 }