@astrofoundry/pi-astro 0.29.1 → 0.30.0

package/extensions/astro-discord/admin.ts

@@ -32,6 +32,7 @@ export function describeConfig(config: DiscordConfig): string {
         access.length > 0 ? "Extra access:" : "Extra access: none",
         ...access,
         `Approval timeout: ${config.approvalTimeoutMinutes} min`,
+        config.dailyReport ? `Arcane daily report: ${config.dailyReport.time} ${config.dailyReport.timeZone} in <#${config.dailyReport.channelId}>` : "Arcane daily report: off",
     ].join("\n");
 }
 

package/extensions/astro-discord/config.ts

@@ -26,6 +26,8 @@ export interface DiscordConfig {
     /** Extra users per specialist name (without the astro. prefix). */
     access: Record<string, string[]>;
     approvalTimeoutMinutes: number;
+    /** Optional scheduled Arcane version report. */
+    dailyReport?: { channelId: string; time: string; timeZone: string };
 }
 
 export const SNOWFLAKE = /^\d{17,20}$/;
@@ -90,6 +92,7 @@ export function validateConfig(raw: unknown, errors: string[]): DiscordConfig |
     }
     const timeout = r.approvalTimeoutMinutes;
     if (typeof timeout !== "number" || !Number.isInteger(timeout) || timeout < 1 || timeout > 240) errors.push("approvalTimeoutMinutes must be an integer from 1 to 240");
+    const dailyReport = r.dailyReport === undefined ? undefined : validateDailyReport(r.dailyReport, errors);
     if (errors.length > 0) return null;
     return {
         applicationId: r.applicationId as string,
@@ -99,9 +102,30 @@ export function validateConfig(raw: unknown, errors: string[]): DiscordConfig |
         owners,
         access,
         approvalTimeoutMinutes: timeout as number,
+        ...(dailyReport ? { dailyReport } : {}),
     };
 }
 
+function validateDailyReport(raw: unknown, errors: string[]): DiscordConfig["dailyReport"] | undefined {
+    const r = raw as Record<string, unknown> | null;
+    if (typeof r !== "object" || r === null) {
+        errors.push("dailyReport must be an object");
+        return undefined;
+    }
+    if (typeof r.channelId !== "string" || !SNOWFLAKE.test(r.channelId)) errors.push("dailyReport.channelId must be a Discord id");
+    if (typeof r.time !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(r.time)) errors.push("dailyReport.time must be HH:MM");
+    let zoneOk = typeof r.timeZone === "string";
+    if (zoneOk) {
+        try {
+            new Intl.DateTimeFormat("en", { timeZone: r.timeZone as string });
+        } catch {
+            zoneOk = false;
+        }
+    }
+    if (!zoneOk) errors.push("dailyReport.timeZone must be an IANA time zone such as Europe/Madrid");
+    return errors.length > 0 ? undefined : { channelId: r.channelId as string, time: r.time as string, timeZone: r.timeZone as string };
+}
+
 export function validateChannel(raw: unknown, where: string, errors: string[]): ChannelSettings | null {
     if (typeof raw !== "object" || raw === null) {
         errors.push(`${where} must be an object`);

package/extensions/astro-discord/daily-report.test.ts

@@ -0,0 +1,109 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { validateConfig } from "./config.ts";
+import { displayVersion, failureMessage, formatDailyReport, isDue, readReportState, REPORT_PREFIX, writeReportState, zonedNow } from "./daily-report.ts";
+
+const settings = { channelId: "1549873938140499999", time: "06:00", timeZone: "Europe/Madrid" };
+
+describe("daily report schedule", () => {
+    it("follows Madrid's daylight-saving offsets", () => {
+        expect(zonedNow("Europe/Madrid", new Date("2026-01-15T05:00:00Z"))).toEqual({ date: "2026-01-15", minutes: 360 });
+        expect(zonedNow("Europe/Madrid", new Date("2026-07-15T04:00:00Z"))).toEqual({ date: "2026-07-15", minutes: 360 });
+        expect(zonedNow("Europe/Madrid", new Date("2026-10-25T05:00:00Z"))).toEqual({ date: "2026-10-25", minutes: 360 });
+    });
+
+    it("is due once per local date, from the configured time on", () => {
+        const before = new Date("2026-07-15T03:59:00Z");
+        const at = new Date("2026-07-15T04:00:00Z");
+        const later = new Date("2026-07-15T09:30:00Z");
+        expect(isDue(settings, null, before)).toEqual({ due: false, date: "2026-07-15" });
+        expect(isDue(settings, null, at)).toEqual({ due: true, date: "2026-07-15" });
+        expect(isDue(settings, null, later).due).toBe(true);
+        expect(isDue(settings, { date: "2026-07-15", status: "sending" }, later).due).toBe(false);
+        expect(isDue(settings, { date: "2026-07-14", status: "sent" }, later).due).toBe(true);
+    });
+
+    it("keeps its state across processes", () => {
+        const dir = mkdtempSync(join(tmpdir(), "astro-report-"));
+        process.env.ASTRO_DISCORD_DIR = dir;
+        try {
+            expect(readReportState()).toBeNull();
+            writeReportState({ date: "2026-10-19", status: "sent", messageId: "1" });
+            expect(readReportState()).toEqual({ date: "2026-10-19", status: "sent", messageId: "1" });
+        } finally {
+            delete process.env.ASTRO_DISCORD_DIR;
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
+
+describe("daily report message", () => {
+    let base: Record<string, unknown>;
+    beforeEach(() => {
+        base = { checkedAt: "2026-10-19T04:00:05Z", stacks: 19, images: 44, privateImages: ["a", "b"], counts: {}, rows: [] };
+    });
+    afterEach(() => undefined);
+
+    it("lists each service as current to target, unresolved where no release tag matches", () => {
+        const report = {
+            ...base,
+            rows: [
+                { stack: "crawl4ai", service: "crawl4ai", running: "0.9.3", latest: "0.9.4", status: "update", action: "pull", note: "" },
+                { stack: "media", service: "sonarr", running: "4.0.20.3014-ls325", latest: "4.0.20.3014-ls326", status: "update", action: "pull", note: "" },
+                { stack: "qdrant", service: "volume-init", running: "older build", latest: "1.38.0", status: "update", action: "pull", note: "" },
+                { stack: "profiles", service: "profiles", running: "1.31.4-alpine", latest: "1.31.6-alpine", status: "release", action: "edit tag", note: "" },
+                { stack: "arcane", service: "arcane", running: "v2.16.1", latest: "v2.17.0", status: "update", action: "edit digest", note: "" },
+                { stack: "stirling-pdf", service: "stirling-pdf", running: "2.14.3", latest: "3.0.0", status: "update", action: "pull", note: "major version change: read its release notes before pulling" },
+                { stack: "bigcapital", service: "gotenberg", running: "7.10.2", latest: "7.10.2", status: "up-to-date", action: "", note: "newer major 8 available (tag change)" },
+                { stack: "x", service: "y", running: "?", latest: "?", status: "unknown", action: "", note: "stale" },
+            ],
+        };
+        const { content, attachment } = formatDailyReport(report, "Europe/Madrid");
+        expect(attachment).toBeUndefined();
+        expect(content.split("\n")).toEqual([
+            `${REPORT_PREFIX} 6 updates (44 public images, 2 private excluded, checked 06:00 CEST).`,
+            "• crawl4ai: 0.9.3 → 0.9.4",
+            "• media/sonarr: 4.0.20.3014-ls325 → 4.0.20.3014-ls326",
+            "• qdrant/volume-init: unresolved → 1.38.0",
+            "• profiles: 1.31.4-alpine → 1.31.6-alpine (tag change)",
+            "• arcane: v2.16.1 → v2.17.0 (digest change)",
+            "• stirling-pdf: 2.14.3 → 3.0.0; major version change",
+            "• bigcapital/gotenberg: newer major 8 available (tag change)",
+            "• x/y: unresolved (check failed)",
+            "Checks only; nothing was updated.",
+        ]);
+        expect(content).not.toMatch(/sha256/);
+    });
+
+    it("says so when nothing needs updating, and moves a long list to an attachment", () => {
+        expect(formatDailyReport(base, "Europe/Madrid").content).toBe(`${REPORT_PREFIX} no updates (44 public images, 2 private excluded, checked 06:00 CEST).\nChecks only; nothing was updated.`);
+        const rows = Array.from({ length: 60 }, (_, i) => ({ stack: `stack-${i}`, service: `service-${i}`, running: "1.0.0", latest: "1.0.1", status: "update", action: "pull", note: "" }));
+        const long = formatDailyReport({ ...base, rows }, "Europe/Madrid");
+        expect(long.content).toContain("The full list is attached.");
+        expect(long.attachment?.split("\n")).toHaveLength(61);
+        expect(formatDailyReport({ nonsense: true }, "Europe/Madrid").content).toBe(failureMessage());
+        expect(failureMessage().startsWith(REPORT_PREFIX)).toBe(true);
+    });
+
+    it("never prints anything that is not a release tag", () => {
+        expect(displayVersion("v1.2.3")).toBe("v1.2.3");
+        expect(displayVersion("17 (older build)")).toBe("unresolved");
+        expect(displayVersion("sha256:abcdef")).toBe("unresolved");
+        expect(displayVersion(undefined)).toBe("unresolved");
+    });
+});
+
+describe("daily report config", () => {
+    const valid = { applicationId: "123456789012345678", guildId: "123456789012345678", channels: { "123456789012345678": { trigger: "always", specialists: "*" } }, adminChannelId: "123456789012345678", owners: ["123456789012345678"], access: {}, approvalTimeoutMinutes: 30 };
+    it("accepts a valid schedule and rejects a bad zone or time", () => {
+        const errors: string[] = [];
+        expect(validateConfig({ ...valid, dailyReport: settings }, errors)?.dailyReport).toEqual(settings);
+        expect(validateConfig({ ...valid, dailyReport: { ...settings, timeZone: "Mars/Olympus" } }, errors)).toBeNull();
+        expect(errors.join(" ")).toMatch(/IANA/);
+        const more: string[] = [];
+        expect(validateConfig({ ...valid, dailyReport: { ...settings, time: "6:00" } }, more)).toBeNull();
+        expect(validateConfig(valid, [])?.dailyReport).toBeUndefined();
+    });
+});

package/extensions/astro-discord/daily-report.ts

@@ -0,0 +1,122 @@
+import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { configDir } from "./config.ts";
+
+/** Every scheduled report starts with this, so it stands apart from conversations in the same channel. */
+export const REPORT_PREFIX = "Arcane Daily Report:";
+const MESSAGE_LIMIT = 1900;
+
+/** `dailyReport` in config.json: where and when the bridge posts the Arcane version report. */
+export interface DailyReportSettings {
+    channelId: string;
+    /** Local wall-clock time, `HH:MM`, in `timeZone`. */
+    time: string;
+    /** IANA zone such as `Europe/Madrid`; daylight-saving changes follow from it. */
+    timeZone: string;
+}
+
+export interface DailyReportState {
+    /** Local date in the report's time zone, `YYYY-MM-DD`. */
+    date: string;
+    status: "sending" | "sent" | "failed";
+    messageId?: string;
+}
+
+/** Local date and minutes past midnight in a time zone. */
+export function zonedNow(timeZone: string, now: Date): { date: string; minutes: number } {
+    const parts = new Intl.DateTimeFormat("en-CA", { timeZone, year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", hourCycle: "h23" }).formatToParts(now);
+    const get = (type: string) => parts.find((p) => p.type === type)?.value ?? "";
+    return { date: `${get("year")}-${get("month")}-${get("day")}`, minutes: Number(get("hour")) * 60 + Number(get("minute")) };
+}
+
+/**
+ * Due once per local date, from the configured time on: a bridge that was down
+ * at 06:00 reports when it comes back that day. Any record for today, even a
+ * failed or interrupted send, means no second message.
+ */
+export function isDue(settings: DailyReportSettings, state: DailyReportState | null, now: Date): { due: boolean; date: string } {
+    const { date, minutes } = zonedNow(settings.timeZone, now);
+    const [h, m] = settings.time.split(":").map(Number);
+    return { due: minutes >= h * 60 + m && state?.date !== date, date };
+}
+
+function statePath(): string {
+    return join(configDir(), "daily-report.json");
+}
+
+export function readReportState(): DailyReportState | null {
+    try {
+        const raw = JSON.parse(readFileSync(statePath(), "utf-8")) as Partial<DailyReportState>;
+        return typeof raw.date === "string" && typeof raw.status === "string" ? (raw as DailyReportState) : null;
+    } catch {
+        return null;
+    }
+}
+
+export function writeReportState(state: DailyReportState): void {
+    const tmp = `${statePath()}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+    renameSync(tmp, statePath());
+}
+
+/** A release tag as reported, or "unresolved" for anything that is not one (`older build`, `new build`, `?`). Never a digest. */
+export function displayVersion(value: unknown): string {
+    return typeof value === "string" && /^v?[0-9][A-Za-z0-9.+_-]{0,100}$/.test(value) ? value : "unresolved";
+}
+
+interface ReportRow {
+    stack: string;
+    service: string;
+    running: unknown;
+    latest: unknown;
+    status: string;
+    action?: string;
+    note?: string;
+}
+
+interface UpdateReport {
+    checkedAt: string;
+    images: number;
+    privateImages: unknown[];
+    rows: ReportRow[];
+}
+
+function isReport(value: unknown): value is UpdateReport {
+    const r = value as Partial<UpdateReport> | null;
+    return !!r && typeof r.checkedAt === "string" && typeof r.images === "number" && Array.isArray(r.privateImages) && Array.isArray(r.rows);
+}
+
+function clock(iso: string, timeZone: string): string {
+    return new Intl.DateTimeFormat("en-GB", { timeZone, hour: "2-digit", minute: "2-digit", hourCycle: "h23", timeZoneName: "short" }).format(new Date(iso));
+}
+
+function name(row: ReportRow): string {
+    return row.service === row.stack ? row.stack : `${row.stack}/${row.service}`;
+}
+
+/** One line per service: current to target version, with how the update applies when it is not a plain pull. */
+function line(row: ReportRow): string | null {
+    const major = /newer major (\S+) available/.exec(row.note ?? "");
+    if (row.status === "up-to-date") return major ? `• ${name(row)}: newer major ${major[1]} available (tag change)` : null;
+    if (row.status === "unknown") return `• ${name(row)}: unresolved (check failed)`;
+    const how = row.status === "rebuild" ? " (rebuild)" : row.action === "edit tag" ? " (tag change)" : row.action === "edit digest" ? " (digest change)" : "";
+    const extra = major ? `; newer major ${major[1]} available` : /major version change/.test(row.note ?? "") ? "; major version change" : "";
+    return `• ${name(row)}: ${displayVersion(row.running)} → ${displayVersion(row.latest)}${how}${extra}`;
+}
+
+/** The Discord message for one `update-report` result; a list too long for one message moves to an attachment. */
+export function formatDailyReport(report: unknown, timeZone: string): { content: string; attachment?: string } {
+    if (!isReport(report)) return { content: failureMessage() };
+    const lines = report.rows.map(line).filter((l): l is string => l !== null);
+    const updates = report.rows.filter((r) => r.status === "update" || r.status === "release" || r.status === "rebuild").length;
+    const scope = `${report.images} public images${report.privateImages.length > 0 ? `, ${report.privateImages.length} private excluded` : ""}, checked ${clock(report.checkedAt, timeZone)}`;
+    const head = updates === 0 && lines.length === 0 ? `${REPORT_PREFIX} no updates (${scope}).` : `${REPORT_PREFIX} ${updates} update${updates === 1 ? "" : "s"} (${scope}).`;
+    const body = [head, ...lines, "Checks only; nothing was updated."].join("\n");
+    if (body.length <= MESSAGE_LIMIT) return { content: body };
+    return { content: `${head}\nThe full list is attached.\nChecks only; nothing was updated.`, attachment: [head, ...lines].join("\n") };
+}
+
+/** Sent when the check itself fails: no list, so nothing reads as up to date. */
+export function failureMessage(): string {
+    return `${REPORT_PREFIX} the version check failed today, so there is no update list. The bridge log on Cortex has the reason.`;
+}

package/extensions/astro-discord/index.ts

@@ -1,3 +1,4 @@
+import { execFile } from "node:child_process";
 import { promises as fs } from "node:fs";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { loadConfig as loadSpecialists } from "../specialist-gate/config.ts";
@@ -12,6 +13,7 @@ import { CHANNEL_RULES, helpText, needsPrefixText, parseCommand } from "./comman
 import { ACTIVATION_ENV, type ChannelSettings, type DiscordConfig, allowedSpecialists, canUse, channelSpecialists, isOwner, loadConfig, loadToken, saveConfig } from "./config.ts";
 import { type ConversationState, type ResolvedConversation, forgetStale, loadState, newConversationId, recordAnswer, resolveConversation, saveState, sessionsRoot, startConversation } from "./conversations.ts";
 import { describeImages, downloadImages, type ImageAttachment, imageAttachments } from "./attachments.ts";
+import { failureMessage, formatDailyReport, isDue, readReportState, writeReportState } from "./daily-report.ts";
 import { GatewayClient } from "./gateway.ts";
 import { cancelledApprovalText, interruptedTaskText, readOpenWork, type OpenWork, type StopReason, writeOpenWork } from "./open-work.ts";
 import { type Quote, type QuotedMessage, withQuotes } from "./quote.ts";
@@ -123,6 +125,8 @@ class Bridge {
     private readonly approvalMessages = new Map<string, { channelId: string; messageId: string; userMessage: ActiveTask }>();
     private gateway: GatewayClient | undefined;
     private stopping = false;
+    private reportRunning = false;
+    private reportTimer: NodeJS.Timeout | undefined;
     private readonly since = new Date().toISOString();
     private config: DiscordConfig;
     private conversations: ConversationState;
@@ -196,6 +200,7 @@ class Bridge {
     async shutdown(): Promise<void> {
         if (this.stopping) return;
         this.stopping = true;
+        clearInterval(this.reportTimer);
         this.gateway?.stop();
         const work = this.openWork();
         for (const task of this.active.values()) task.abort?.abort();
@@ -225,6 +230,10 @@ class Bridge {
         });
         gateway.start();
         this.gateway = gateway;
+        // Checked every minute; the report itself decides whether today's is due.
+        this.reportTimer = setInterval(() => void this.maybeDailyReport(), 60_000);
+        this.reportTimer.unref();
+        void this.maybeDailyReport();
         log(`connected as ${me.username} (${me.id}); channels ${Object.keys(this.config.channels).join(", ")}; specialists ${this.specialists().names.join(", ")}`);
     }
 
@@ -308,7 +317,8 @@ class Bridge {
         );
         if (!conversation.resumed) this.conversations = startConversation(this.conversations, conversation.key, conversation.id, now);
         saveState(this.conversations);
-        const quotes = this.quotesFor(message, conversation.resumed);
+        const known = conversation.resumed ? (this.conversations.conversations[conversation.key]?.messageIds ?? []) : [];
+        const quotes = this.quotesFor(message, (id) => known.includes(id));
         const images = imageAttachments([message, ...quotes.map((q) => q.message)]);
         const task: ActiveTask = { specialist: command.specialist, channelId: message.channel_id, messageId: message.id, userId, startedAt: now, conversation, images };
         const taskText = withQuotes(command.task, quotes);
@@ -317,14 +327,61 @@ class Bridge {
         this.queues.set(command.specialist, next);
     }
 
-    /** Replied-to and forwarded messages to show the specialist; the bot's own answer only when the conversation holding it is not resumed. */
-    private quotesFor(message: IncomingMessage, resumed: boolean): Quote[] {
+    /**
+     * Runs the Arcane version report through the specialist wrapper, without a
+     * model, and posts it with the prefix. One message per local date: the date
+     * is recorded before the post, so a crash during delivery never repeats it.
+     */
+    private async maybeDailyReport(): Promise<void> {
+        if (this.reportRunning || this.stopping) return;
+        this.refreshConfig();
+        const settings = this.config.dailyReport;
+        if (!settings) return;
+        const { due, date } = isDue(settings, readReportState(), new Date());
+        if (!due) return;
+        const gate = loadSpecialists().config;
+        if (!gate) {
+            log("daily report: specialists.json missing; no report");
+            return;
+        }
+        this.reportRunning = true;
+        try {
+            log(`daily report ${date}: running arcane update-report`);
+            let message: { content: string; attachment?: string };
+            try {
+                const stdout = await new Promise<string>((resolve, reject) =>
+                    execFile("/usr/bin/sudo", ["-n", "-u", gate.user, "-H", gate.entry, "arcane", "--caller", "daily-report", "--", "update-report"], { timeout: 15 * 60_000, maxBuffer: 20 * 1024 * 1024 }, (err, out, errOut) =>
+                        err ? reject(new Error(errOut.trim() || err.message)) : resolve(out),
+                    ),
+                );
+                message = formatDailyReport(JSON.parse(stdout), settings.timeZone);
+            } catch (err) {
+                log(`daily report ${date}: check failed: ${err instanceof Error ? err.message.slice(0, 500) : String(err)}`);
+                message = { content: failureMessage() };
+            }
+            if (this.stopping) return;
+            writeReportState({ date, status: "sending" });
+            const posted = await this.rest.createMessage(settings.channelId, {
+                content: message.content,
+                ...(message.attachment ? { file: { name: `arcane-daily-report-${date}.txt`, content: message.attachment } } : {}),
+            });
+            writeReportState({ date, status: message.content === failureMessage() ? "failed" : "sent", messageId: posted.id });
+            log(`daily report ${date}: posted ${posted.id}`);
+        } catch (err) {
+            log(`daily report ${date}: delivery failed: ${err instanceof Error ? err.message : String(err)}`);
+        } finally {
+            this.reportRunning = false;
+        }
+    }
+
+    /** Replied-to and forwarded messages to show the specialist; a bot message only when the resumed conversation does not already hold it. */
+    private quotesFor(message: IncomingMessage, inContext: (id: string) => boolean): Quote[] {
         const quotes: Quote[] = [];
         const replied = message.referenced_message;
         if (replied) {
             const mine = replied.author?.id === this.botUserId;
             if (!mine) quotes.push({ label: `Replied-to message from ${replied.author?.username ?? replied.author?.id ?? "an unknown author"}`, message: replied });
-            else if (!resumed) quotes.push({ label: "My earlier answer, which this message replies to", message: replied });
+            else if (!(replied.id && inContext(replied.id))) quotes.push({ label: "My earlier message, which this message replies to", message: replied });
         }
         for (const snapshot of message.message_snapshots ?? []) quotes.push({ label: "Forwarded message", message: snapshot.message });
         return quotes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.29.1",
+  "version": "0.30.0",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/skills/arcane/SKILL.md

@@ -38,6 +38,8 @@ The output is JSON with `counts`, `rows`, and `table`. Answer with the `table` f
 - A note "major version change" or "newer major ... available" means the update crosses a major version. Read its release notes yourself before asking anything (next section).
 - Private images (the registry refuses anonymous access, such as our own Grimoire builds) are left out of the table and the counts; the summary line counts them and `privateImages` lists them. Mention them only when the caller asks.
 
+Messages that start with "Arcane Daily Report:" are the bridge's scheduled report, built from `update-report` every morning without you. When the caller replies to one, its list is the context ("update these", "why is this unresolved"); run `update-report` again only when the caller wants fresh data or before applying anything.
+
 Apply updates only when asked, one stack at a time, through the operations or GitOps procedure above, and run `update-report` again afterwards to show the result.
 
 ## Release notes

package/specialists/README.md

@@ -105,7 +105,7 @@ Check: `sudo -n -u specialist -H /usr/local/bin/specialist-cli arcane --caller t
 
 The `astro-discord` extension gives Discord users access to the specialists from a channel. It runs in a headless Pi host on Cortex (LaunchAgent `com.astrofoundry.astro-discord`, user `cortex`), never in interactive sessions.
 
-- Channels are configured one by one (`channels.<id>`): `trigger` is `always` (every message that names a specialist counts) or `mention` (only messages that start with `@Cortex` or reply to the bot); `specialists` is `*` or a list. A channel with one specialist needs no prefix: every message there is a task for it. In a channel with several, `dns list the zones` names the specialist; an addressed message without a name gets a reply asking for one. Threads inherit their parent channel's entry; unlisted channels are ignored. The bot replies at once with "<specialist> is working on your task" and shows the typing indicator until the answer replaces that reply. Reactions on your message: ⏳ running, 🔒 waiting for an owner's approval, ✅ done, ❌ failed. `help` shows the specialists you may use in that channel and the commands (`status` lists running tasks; owners in the admin channel also see the `config` commands). Each channel and specialist has one conversation: a reply to the bot's answer, or another task for that specialist within 30 minutes, continues it with everything the specialist saw before; otherwise a new one starts, and a task beginning with `new` forces that. Replied-to and forwarded messages (text, embeds, attachment names) travel with the task, so "check this" on a forwarded alert works. Image attachments on the message or on what it quotes (up to 4, 8 MiB each) are downloaded and passed to the specialist, which sees them; other file types are named only. Sessions live under `~/.config/astro-discord/sessions/<specialist>/` and are deleted after 7 days. Long answers arrive as a `.md` attachment. When the bridge restarts, open approval requests are marked cancelled and running tasks interrupted in Discord; ask again.
+- Channels are configured one by one (`channels.<id>`): `trigger` is `always` (every message that names a specialist counts) or `mention` (only messages that start with `@Cortex` or reply to the bot); `specialists` is `*` or a list. A channel with one specialist needs no prefix: every message there is a task for it. In a channel with several, `dns list the zones` names the specialist; an addressed message without a name gets a reply asking for one. Threads inherit their parent channel's entry; unlisted channels are ignored. The bot replies at once with "<specialist> is working on your task" and shows the typing indicator until the answer replaces that reply. Reactions on your message: ⏳ running, 🔒 waiting for an owner's approval, ✅ done, ❌ failed. `help` shows the specialists you may use in that channel and the commands (`status` lists running tasks; owners in the admin channel also see the `config` commands). Each channel and specialist has one conversation: a reply to the bot's answer, or another task for that specialist within 30 minutes, continues it with everything the specialist saw before; otherwise a new one starts, and a task beginning with `new` forces that. Replied-to and forwarded messages (text, embeds, attachment names) travel with the task, so "check this" on a forwarded alert works. Image attachments on the message or on what it quotes (up to 4, 8 MiB each) are downloaded and passed to the specialist, which sees them; other file types are named only. Sessions live under `~/.config/astro-discord/sessions/<specialist>/` and are deleted after 7 days. Long answers arrive as a `.md` attachment. When the bridge restarts, open approval requests are marked cancelled and running tasks interrupted in Discord; ask again. With `dailyReport` in the config, the bridge posts an "Arcane Daily Report:" message every morning in that channel: each service with an update as current to target version, from a fresh `update-report`; replying to it asks the arcane specialist with the report as context.
 - Access: `owners` may use every specialist and decide approvals; `access.<specialist>` lists extra users for that specialist; everyone else gets no reply. Owners change the configuration from the admin channel (`adminChannelId`) without a shell: `config show`, `config channel <#channel> <always|mention> <*|dns,edge>`, `config channel <#channel> remove`, `config access <specialist> add|remove <@user>`; the bot writes `~/.config/astro-discord/config.json` on Cortex, which is also editable by hand and re-read on every message. Deny the bot's role View Channel on channels it must never read; that is the boundary the map cannot provide.
 - Approvals: a risky call (anything with `--confirm`, plus writes such as record or zone deletes, Zitadel changes, Pomerium deploys, service restarts, and on Arcane only destructive actions: `down`, deletes, prunes, image, volume, or network removal, `system upgrade`, `gitops delete`; help lookups never ask) pauses the specialist and posts Approve/Deny buttons; only owners' clicks count; no decision within `approvalTimeoutMinutes` denies it. The specialist then reports the denial. Ambiguous tasks get a question back instead of an action.
 - Setup, as `cortex`: `d=$(mktemp -d) && cp ~/.pi/agent/npm/node_modules/@astrofoundry/pi-astro/extensions/astro-discord/*.ts "$d" && node --disable-warning=ExperimentalWarning "$d/setup.ts"` (Node does not strip types inside `node_modules`, so the files are copied first) prompts for the bot token and the ids, checks each against Discord, and writes `~/.config/astro-discord/{token,config.json,run.sh}` and the LaunchAgent; it prints the `launchctl bootstrap` line. After a pi-astro update restart the bridge with `launchctl kickstart -k gui/$(id -u)/com.astrofoundry.astro-discord`. Log: `~/Library/Logs/astro-discord.log`.