@astrofoundry/pi-astro 0.29.0 → 0.29.1

package/extensions/specialist-gate/approvals.test.ts

@@ -13,8 +13,15 @@ describe("approvals", () => {
         expect(isRisky("identity", ["zitadel", "DELETE", "/v2/users/1"])).toBe(true);
         expect(isRisky("identity", ["dmz", "deploy-config"])).toBe(true);
         expect(isRisky("arcane", ["projects", "list"])).toBe(false);
-        expect(isRisky("arcane", ["projects", "redeploy", "mealie"])).toBe(true);
-        expect(isRisky("arcane", ["gitops", "sync", "arcane", "--yes"])).toBe(true);
+        expect(isRisky("arcane", ["projects", "redeploy", "mealie"])).toBe(false);
+        expect(isRisky("arcane", ["projects", "upgrade", "media", "sonarr", "--yes"])).toBe(false);
+        expect(isRisky("arcane", ["gitops", "sync", "arcane", "--yes"])).toBe(false);
+        expect(isRisky("arcane", ["projects", "upgrade", "--help"])).toBe(false);
+        expect(isRisky("arcane", ["projects", "down", "media"])).toBe(true);
+        expect(isRisky("arcane", ["--json", "projects", "delete", "media"])).toBe(true);
+        expect(isRisky("arcane", ["volumes", "remove", "mealie_mealie-pgdata"])).toBe(true);
+        expect(isRisky("arcane", ["system", "upgrade"])).toBe(true);
+        expect(isRisky("edge", ["vps", "reboot", "--confirm", "--help"])).toBe(false);
         expect(isRisky("proxmox", ["guests"])).toBe(false);
         expect(isRisky("proxmox", ["set", "107", "memory=768"])).toBe(true);
         expect(isRisky("proxmox", ["shutdown", "107", "--confirm"])).toBe(true);

package/extensions/specialist-gate/index.ts

@@ -20,12 +20,13 @@ export const APPROVAL_TOKEN_ENV = "ASTRO_APPROVAL_TOKEN";
  * the writes that do not need `--confirm` in a terminal session.
  */
 export const RISKY: Readonly<Record<string, readonly RegExp[]>> = {
+    // Destructive or hard to undo only: upgrades, redeploys, restarts, and syncs are routine and run on the caller's request.
     arcane: [
-        /^(projects|stacks)\s+(up|down|redeploy|restart|stop|delete|remove|rm|destroy|upgrade)\b/,
-        /^containers\s+(stop|restart|kill|remove|rm|delete)\b/,
+        /^(projects|stacks)\s+(down|delete|remove|rm|destroy)\b/,
+        /^containers\s+(remove|rm|delete)\b/,
         /^(images|volumes|networks)\s+(prune|remove|rm|delete)\b/,
         /^system\s+(prune|upgrade)\b/,
-        /^gitops\s+(sync|delete|update|import)\b/,
+        /^gitops\s+delete\b/,
     ],
     identity: [/^zitadel\s+(DELETE|POST|PUT|PATCH)\b/, /^dmz\s+(deploy-config|pomerium-restart|render|lego-renew)\b/],
     network: [/^unifi\s+policy-(create|update|delete)\b/],
@@ -37,8 +38,11 @@ export const RISKY: Readonly<Record<string, readonly RegExp[]>> = {
 };
 
 export function isRisky(service: string, args: readonly string[]): boolean {
+    // A help lookup prints usage and changes nothing, whatever command it names.
+    if (args.includes("--help") || args.includes("-h")) return false;
     if (args.includes("--confirm")) return true;
-    const joined = args.join(" ");
+    // Flags placed before the command (`--json projects delete x`) must not hide it from the patterns.
+    const joined = args.filter((a) => !a.startsWith("-")).join(" ");
     return (RISKY[service] ?? []).some((pattern) => pattern.test(joined));
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/specialists/AGENTS.md

@@ -73,7 +73,7 @@ Wrappers ship as TypeScript and run under Node 24 type stripping: erasable synta
 
 ## Chat bridges
 
-`extensions/astro-discord/` runs specialists for Discord messages through `runAgent` and passes `ASTRO_APPROVAL_URL`/`ASTRO_APPROVAL_TOKEN` to the child. The gate consults `RISKY` in `extensions/specialist-gate/index.ts` and blocks on a ticket until an owner decides; keep `RISKY` in step with the wrappers when a new interrupting or destructive command appears (every `--confirm` command is covered by construction).
+`extensions/astro-discord/` runs specialists for Discord messages through `runAgent` and passes `ASTRO_APPROVAL_URL`/`ASTRO_APPROVAL_TOKEN` to the child. The gate consults `RISKY` in `extensions/specialist-gate/index.ts` and blocks on a ticket until an owner decides (`--help`/`-h` never counts; flags are ignored when matching, so they cannot hide a command; Arcane lists only destructive actions since 2026-09-26, because a routine upgrade the caller asked for made them approve the same thing twice); keep `RISKY` in step with the wrappers when a new interrupting or destructive command appears (every `--confirm` command is covered by construction).
 
 ## Next
 

package/specialists/README.md

@@ -107,7 +107,7 @@ The `astro-discord` extension gives Discord users access to the specialists from
 
 - Channels are configured one by one (`channels.<id>`): `trigger` is `always` (every message that names a specialist counts) or `mention` (only messages that start with `@Cortex` or reply to the bot); `specialists` is `*` or a list. A channel with one specialist needs no prefix: every message there is a task for it. In a channel with several, `dns list the zones` names the specialist; an addressed message without a name gets a reply asking for one. Threads inherit their parent channel's entry; unlisted channels are ignored. The bot replies at once with "<specialist> is working on your task" and shows the typing indicator until the answer replaces that reply. Reactions on your message: ⏳ running, 🔒 waiting for an owner's approval, ✅ done, ❌ failed. `help` shows the specialists you may use in that channel and the commands (`status` lists running tasks; owners in the admin channel also see the `config` commands). Each channel and specialist has one conversation: a reply to the bot's answer, or another task for that specialist within 30 minutes, continues it with everything the specialist saw before; otherwise a new one starts, and a task beginning with `new` forces that. Replied-to and forwarded messages (text, embeds, attachment names) travel with the task, so "check this" on a forwarded alert works. Image attachments on the message or on what it quotes (up to 4, 8 MiB each) are downloaded and passed to the specialist, which sees them; other file types are named only. Sessions live under `~/.config/astro-discord/sessions/<specialist>/` and are deleted after 7 days. Long answers arrive as a `.md` attachment. When the bridge restarts, open approval requests are marked cancelled and running tasks interrupted in Discord; ask again.
 - Access: `owners` may use every specialist and decide approvals; `access.<specialist>` lists extra users for that specialist; everyone else gets no reply. Owners change the configuration from the admin channel (`adminChannelId`) without a shell: `config show`, `config channel <#channel> <always|mention> <*|dns,edge>`, `config channel <#channel> remove`, `config access <specialist> add|remove <@user>`; the bot writes `~/.config/astro-discord/config.json` on Cortex, which is also editable by hand and re-read on every message. Deny the bot's role View Channel on channels it must never read; that is the boundary the map cannot provide.
-- Approvals: a risky call (anything with `--confirm`, plus writes such as record or zone deletes, Zitadel changes, Pomerium deploys, Arcane redeploys, service restarts) pauses the specialist and posts Approve/Deny buttons; only owners' clicks count; no decision within `approvalTimeoutMinutes` denies it. The specialist then reports the denial. Ambiguous tasks get a question back instead of an action.
+- Approvals: a risky call (anything with `--confirm`, plus writes such as record or zone deletes, Zitadel changes, Pomerium deploys, service restarts, and on Arcane only destructive actions: `down`, deletes, prunes, image, volume, or network removal, `system upgrade`, `gitops delete`; help lookups never ask) pauses the specialist and posts Approve/Deny buttons; only owners' clicks count; no decision within `approvalTimeoutMinutes` denies it. The specialist then reports the denial. Ambiguous tasks get a question back instead of an action.
 - Setup, as `cortex`: `d=$(mktemp -d) && cp ~/.pi/agent/npm/node_modules/@astrofoundry/pi-astro/extensions/astro-discord/*.ts "$d" && node --disable-warning=ExperimentalWarning "$d/setup.ts"` (Node does not strip types inside `node_modules`, so the files are copied first) prompts for the bot token and the ids, checks each against Discord, and writes `~/.config/astro-discord/{token,config.json,run.sh}` and the LaunchAgent; it prints the `launchctl bootstrap` line. After a pi-astro update restart the bridge with `launchctl kickstart -k gui/$(id -u)/com.astrofoundry.astro-discord`. Log: `~/Library/Logs/astro-discord.log`.
 - Discord side: application `Cortex` with a bot, Message Content Intent enabled, invited with scopes `bot` and `applications.commands` and permissions View Channel, Send Messages, Attach Files, Read Message History, Add Reactions.