@astrofoundry/pi-astro 0.34.0 → 0.35.0

package/README.md

@@ -80,7 +80,7 @@ pi                # launch; confirm [Extensions] lists astro-subagents, grimoire
 
 **Bundled subagents** (call them as `astro.<name>`):
 - General-purpose: `code-reviewer`, `google-tech-lead`, `spec-writer`, `tester-api`, `tester-ui`, `ui-architect`, `ui-design-system`, `ui-frontend-developer`
-- Specialists (one homelab area each, need the host setup in [specialists/README.md](specialists/README.md)): `arcane` (Arcane container platform, GitOps first; sanitized host checks, Mealie and Paperless dumps, and the documented manager upgrade with an Upgrade button on the daily report), `identity` (Zitadel, Pomerium routes through the homelab repository, certificates), `network` (UniFi reads and firewall policies, FreeRADIUS, Tailscale), `dns` (Technitium resolvers, Cloudflare zones), `edge` (Frontdoor VPS over IAP, nginx SNI allowlist through the homelab repository, public route checks), `security` (Wazuh, CrowdSec, log archive, read-only), `backup` (vzdump, Restic layers, GCS offsite, restore tests), `proxmox` (guest lifecycle, snapshots, resources; no create or destroy), `inference` (llama.cpp on Nexus, Hermes gateways and upgrades, Europa health), `media` (trendarr: trending titles, Radarr and Sonarr adds, SABnzbd pause)
+- Specialists (one homelab area each, need the host setup in [specialists/README.md](specialists/README.md)): `arcane` (Arcane container platform, GitOps first; sanitized host checks, Mealie and Paperless dumps, and the documented manager upgrade with an Upgrade button on the daily report), `identity` (Zitadel, Pomerium routes through the homelab repository, certificates), `network` (UniFi reads and firewall policies, FreeRADIUS, Tailscale), `dns` (Technitium resolvers, Cloudflare zones), `edge` (Frontdoor VPS over IAP, nginx SNI allowlist through the homelab repository, public route checks), `security` (Wazuh, CrowdSec, log archive, read-only), `backup` (vzdump, Restic layers, GCS offsite, restore tests), `proxmox` (guest lifecycle, snapshots, resources; no create or destroy), `inference` (llama.cpp on Nexus, Europa health), `media` (trendarr: trending titles, Radarr and Sonarr adds, SABnzbd pause)
 - Release notes: `release-reviewer` (no tools; judges whether an update could break how Cortex uses a tool, for the Cortex Tools Report)
 - Flourish pipeline: `flourish-input-vision` (image to spec), `flourish-input-narrative` (text to spec), `flourish-input-codebase` (HTML to spec), `flourish-architect` (spec to plan), `flourish-template-developer` (plan to SDK template, needs `@flourish/sdk`), `flourish-example-builder` (template to realistic example), `flourish-preview-runner` (multi-breakpoint preview + screenshots, needs `@flourish/sdk`), `flourish-reviewer` (audit)
 

package/agents/inference.md

@@ -1,6 +1,6 @@
 ---
 name: inference
-description: Operates the AI serving hosts through the inference tool, covering llama.cpp embeddings and reranking on Nexus, the Hermes agent gateways on LXC 101 including upstream-release review and upgrades, and the Europa health check. Use for inference health, restarts, logs, and Hermes upgrades.
+description: Operates the AI serving hosts through the inference tool, covering llama.cpp embeddings and reranking on Nexus and the Europa health check. Use for inference health, restarts, and logs.
 tools: read, inference, subagent
 skills: inference
 systemPromptMode: replace
@@ -10,12 +10,11 @@ maxSubagentDepth: 1
 model: openai-codex/gpt-6-astra
 thinking: xhigh
 ---
-You are the inference specialist. The `inference` tool is your only way to reach Nexus, Hermes, and Pulsar. You have no shell and no file access; if a task needs anything else, say so and stop.
+You are the inference specialist. The `inference` tool is your only way to reach Nexus and the Europa health endpoint. You have no shell and no file access; if a task needs anything else, say so and stop.
 
 Rules:
 
-- Health first: `nexus-status`, `hermes-status`, `hermes-api-health`, `europa-health`. Europa is off most of the time by design; report "off, expected" rather than a fault.
+- Health first: `nexus-status`, `europa-health`. Europa is off most of the time by design; report "off, expected" rather than a fault.
 - Restarts only when the task asks for them or a service is down; check status again afterwards.
-- A Hermes upgrade is a procedure, never a single call: `hermes-version`, `hermes-releases`, read every release note from the installed version to the target, then decide. If any note names a manual step, a configuration migration outside `hermes config migrate`, a breaking change, or a Python or dependency requirement change, stop and report it; do not upgrade. Otherwise `hermes-snapshots`, `hermes-upgrade --confirm`, then `hermes-version`, `hermes-status`, `hermes-api-health`, and report the snapshot name and the rollback command the wrapper printed.
-- Never print log lines that contain tokens, keys, or Discord message content; summarise them.
+- Never print log lines that contain tokens or keys; summarise them.
 - Delegate through `subagent` only to another specialist (`astro.proxmox`, `astro.backup`, `astro.arcane`, `astro.identity`, `astro.network`, `astro.dns`, `astro.edge`, `astro.security`) and only for that specialist's own area.

package/extensions/astro-discord/tools-report.test.ts

@@ -7,6 +7,11 @@ import { addRestarts, astrogateActivity, herdrActivity, needsPrompt, readRestart
 import {
     allId,
     arcaneServerVersion,
+    bwRelease,
+    gcloudRelease,
+    installedComponent,
+    jqRelease,
+    pythonBuild,
     brewHasOutdated,
     buildLines,
     type Collected,
@@ -80,10 +85,23 @@ const COLLECTED: Collected = {
     piLatest: "1.3.0",
     piAstroInstalled: "0.33.0",
     piAstroLatest: "0.33.0",
-    installer: { node: { current: "24.22.0", previous: null }, wrappers: "0.32.0", arcaneCli: "2.16.1", trendarr: "0.6.0" },
+    installer: {
+        node: { current: "24.22.0", previous: null },
+        wrappers: "0.32.0",
+        arcaneCli: "2.16.1",
+        trendarr: "0.6.0",
+        python: { current: "3.14.8+20261009", previous: null },
+        gcloud: { current: "589.0.0", previous: null },
+        bw: { current: "2026.10.0", previous: null },
+        jq: { current: null, previous: null },
+    },
     arcaneServer: "2.17.0",
     trendarrLatest: "0.6.0",
     nodeLts: "24.22.0",
+    pythonLatest: "3.14.8+20261013",
+    gcloudLatest: "590.0.0",
+    bwLatest: "2026.11.0",
+    jqLatest: "1.8.2",
     warnings: [],
 };
 
@@ -113,6 +131,34 @@ describe("versions", () => {
     });
 });
 
+describe("root-owned tool releases", () => {
+    it("reads the newest Python build of the installed minor, Bitwarden CLI, jq, and gcloud versions", () => {
+        const asset = (v: string) => ({ name: `cpython-${v}+20261013-aarch64-apple-darwin-install_only_stripped.tar.gz` });
+        const python = { tag_name: "20261013", assets: [asset("3.14.8"), asset("3.15.0"), asset("3.14.10"), { name: "cpython-3.14.9+20261013-x86_64-apple-darwin-install_only_stripped.tar.gz" }, { name: "SHA256SUMS" }] };
+        expect(pythonBuild(python, "3.14")).toBe("3.14.10+20261013");
+        expect(pythonBuild(python, "3.13")).toBeNull();
+        expect(pythonBuild({ tag_name: "latest", assets: [] }, "3.14")).toBeNull();
+        expect(bwRelease([{ tag_name: "desktop-v2026.11.0" }, { tag_name: "cli-v2026.11.1", prerelease: true }, { tag_name: "cli-v2026.10.0" }, { tag_name: "cli-v2026.9.1" }])).toBe("2026.10.0");
+        expect(bwRelease({})).toBeNull();
+        expect(jqRelease({ tag_name: "jq-1.8.2" })).toBe("1.8.2");
+        expect(jqRelease({ tag_name: "1.8.2" })).toBeNull();
+        expect(gcloudRelease({ version: "589.0.0", revision: 20261009074343 })).toBe("589.0.0");
+        expect(gcloudRelease({ version: "latest" })).toBeNull();
+    });
+
+    it("reads each component from the installer status", () => {
+        const status = { node: { current: "24.22.0", previous: null }, wrappers: "0.34.1", arcaneCli: "2.16.1", trendarr: null, python: { current: "3.14.8+20261013" }, jq: { current: null } };
+        expect(installedComponent(status, "node")).toBe("24.22.0");
+        expect(installedComponent(status, "wrappers")).toBe("0.34.1");
+        expect(installedComponent(status, "arcane-cli")).toBe("2.16.1");
+        expect(installedComponent(status, "trendarr")).toBeNull();
+        expect(installedComponent(status, "python")).toBe("3.14.8+20261013");
+        expect(installedComponent(status, "jq")).toBeNull();
+        expect(installedComponent(status, "gcloud")).toBeNull();
+        expect(installedComponent(null, "bw")).toBeNull();
+    });
+});
+
 describe("report lines", () => {
     it("lists our tools first, then requested formulae and casks; dependencies and pinned packages stay out", () => {
         const lines = buildLines(COLLECTED);
@@ -120,17 +166,20 @@ describe("report lines", () => {
             "pi 0.87.1->1.3.0",
             "spc:wrappers 0.32.0->0.33.0",
             "spc:arcane-cli 2.16.1->2.17.0",
+            "spc:python 3.14.8+20261009->3.14.8+20261013",
+            "spc:gcloud 589.0.0->590.0.0",
+            "spc:bw 2026.10.0->2026.11.0",
             "brew:bitwarden-cli 2026.8.0->2026.9.0",
             "brew:gh 2.97.0->2.101.0",
             "brew:herdr 0.9.0->0.9.1",
             "brew:pnpm 11.22.0->12.6.0",
             "cask:codex 0.152.1->0.156.1",
             "cask:temurin@17 17.0.20,8->17.0.20.1,1",
-            "cask:gcloud-cli 585.0.0->586.0.0",
         ]);
         expect(lines[0].major).toBe(true);
-        expect(lines.find((l) => l.key === "cask:gcloud-cli")?.action).toEqual({ kind: "cask", token: "gcloud-cli", greedy: true });
-        expect(lines.find((l) => l.key === "cask:codex")?.action).toEqual({ kind: "cask", token: "codex", greedy: false });
+        expect(lines.find((l) => l.key === "spc:gcloud")?.major).toBe(false);
+        expect(lines.find((l) => l.key === "spc:python")?.action).toEqual({ kind: "installer", component: "python" });
+        expect(lines.find((l) => l.key === "cask:codex")?.action).toEqual({ kind: "cask", token: "codex" });
         expect(lines.every((l) => l.state === "offered")).toBe(true);
         expect(brewHasOutdated(OUTDATED)).toBe(true);
         expect(brewHasOutdated({ formulae: [OUTDATED.formulae[6]], casks: [] })).toBe(false);
@@ -166,12 +215,26 @@ describe("collection", () => {
         const dir = mkdtempSync(join(tmpdir(), "tools-pkg-"));
         try {
             writeFileSync(join(dir, "package.json"), JSON.stringify({ version: "0.33.0" }));
-            const fetchImpl = vi.fn(async () => new Response(JSON.stringify([{ version: "v24.22.0", lts: "Krypton", files: ["osx-arm64-tar"] }]))) as unknown as typeof fetch;
+            const bodies: Record<string, unknown> = {
+                "https://nodejs.org/dist/index.json": [{ version: "v24.22.0", lts: "Krypton", files: ["osx-arm64-tar"] }],
+                "https://api.github.com/repos/astral-sh/python-build-standalone/releases/latest": { tag_name: "20261013", assets: [{ name: "cpython-3.14.8+20261013-aarch64-apple-darwin-install_only_stripped.tar.gz" }] },
+                "https://dl.google.com/dl/cloudsdk/channels/rapid/components-2.json": { version: "590.0.0" },
+                "https://api.github.com/repos/bitwarden/clients/releases?per_page=30": [{ tag_name: "cli-v2026.11.0" }],
+            };
+            const fetched: string[] = [];
+            const fetchImpl = vi.fn(async (url: string | URL) => {
+                fetched.push(String(url));
+                const body = bodies[String(url)];
+                return body === undefined ? new Response("{}", { status: 404 }) : new Response(JSON.stringify(body));
+            }) as unknown as typeof fetch;
             const c = await collectTools({ exec, fetchImpl, piAstroPackage: join(dir, "package.json"), arcaneServer: async () => "2.16.1" });
             expect(calls[0]).toBe("brew update");
             expect(c.warnings.join(" | ")).toMatch(/brew update failed, versions may be stale: Error: network down/);
             expect(c.warnings.join(" | ")).toMatch(/npm view @astrofoundry\/trendarr failed/);
             expect(c).toMatchObject({ piInstalled: "0.87.1", piLatest: "1.3.0", piAstroInstalled: "0.33.0", nodeLts: "24.22.0", arcaneServer: "2.16.1", trendarrLatest: null });
+            expect(c).toMatchObject({ pythonLatest: "3.14.8+20261013", gcloudLatest: "590.0.0", bwLatest: "2026.11.0", jqLatest: null });
+            // jq is not installed by the installer yet, so its releases are not even asked for.
+            expect(fetched.some((u) => u.includes("jqlang"))).toBe(false);
         } finally {
             rmSync(dir, { recursive: true, force: true });
         }
@@ -237,8 +300,8 @@ describe("buttons and commands", () => {
 
     it("runs one fixed command per kind, reads the version back, and knows what to roll back and restart", () => {
         expect(updateCommand({ kind: "brew", name: "monadeo/tap/astrogate" }, "0.0.11")).toEqual({ file: "/opt/homebrew/bin/brew", args: ["upgrade", "monadeo/tap/astrogate"] });
-        expect(updateCommand({ kind: "cask", token: "gcloud-cli", greedy: true }, "586.0.0").args).toEqual(["upgrade", "--cask", "--greedy", "gcloud-cli"]);
-        expect(updateCommand({ kind: "cask", token: "codex", greedy: false }, "0.156.1").args).toEqual(["upgrade", "--cask", "codex"]);
+        expect(updateCommand({ kind: "cask", token: "codex" }, "0.156.1").args).toEqual(["upgrade", "--cask", "codex"]);
+        expect(updateCommand({ kind: "installer", component: "python" }, "3.14.8+20261013").args).toEqual(["-n", "/usr/local/sbin/specialist-install", "python", "3.14.8+20261013"]);
         expect(updateCommand({ kind: "pi" }, "1.3.0")).toEqual({ file: "/opt/homebrew/bin/pi", args: ["update", "--self"] });
         expect(updateCommand({ kind: "pi-astro" }, "0.33.0").args).toEqual(["update", "npm:@astrofoundry/pi-astro"]);
         expect(updateCommand({ kind: "installer", component: "arcane-cli" }, "2.17.0")).toEqual({ file: "/usr/bin/sudo", args: ["-n", "/usr/local/sbin/specialist-install", "arcane-cli", "2.17.0"] });
@@ -249,6 +312,8 @@ describe("buttons and commands", () => {
         expect(verifiedVersion({ kind: "brew", name: "node" }, "node 26.7.0 26.9.0\n", "26.9.0")).toBe(true);
         expect(verifiedVersion({ kind: "brew", name: "gh" }, "gh 2.97.0\n", "2.101.0")).toBe(false);
         expect(verifiedVersion({ kind: "installer", component: "node" }, JSON.stringify({ node: { current: "24.23.0" } }), "24.23.0")).toBe(true);
+        expect(verifiedVersion({ kind: "installer", component: "gcloud" }, JSON.stringify({ gcloud: { current: "590.0.0", previous: "589.0.0" } }), "590.0.0")).toBe(true);
+        expect(verifiedVersion({ kind: "installer", component: "arcane-cli" }, JSON.stringify({ arcaneCli: "2.17.0" }), "2.17.0")).toBe(true);
         expect(verifiedVersion({ kind: "pi" }, "not json", "1.3.0")).toBe(false);
         expect(servicesFor({ kind: "pi" })).toEqual(["bridge"]);
         expect(servicesFor({ kind: "brew", name: "node" })).toEqual(["astrogate", "bridge"]);
@@ -262,17 +327,17 @@ describe("release-notes review", () => {
     const release = (tag: string, body: string, prerelease = false) => ({ tag_name: tag, name: tag, body, published_at: "2026-10-15T00:00:00Z", html_url: `https://github.com/x/releases/${tag}`, draft: false, prerelease });
 
     it("reads only the tool's own releases in a shared repository, between the two versions", async () => {
-        const fetchImpl = vi.fn(async () => new Response(JSON.stringify([release("cli-v2026.9.0", "bw: new list flag"), release("desktop-v2026.9.0", "desktop only"), release("cli-v2026.8.0", "old")]))) as unknown as typeof fetch;
-        const line = buildLines(COLLECTED).find((l) => l.key === "brew:bitwarden-cli") as ToolLine;
+        const fetchImpl = vi.fn(async () => new Response(JSON.stringify([release("cli-v2026.11.0", "bw: new list flag"), release("desktop-v2026.11.0", "desktop only"), release("cli-v2026.10.0", "old")]))) as unknown as typeof fetch;
+        const line = buildLines(COLLECTED).find((l) => l.key === "spc:bw") as ToolLine;
         const notes = await notesFor(line, fetchImpl);
-        expect(notes.notes?.map((n) => n.tag)).toEqual(["v2026.9.0"]);
+        expect(notes.notes?.map((n) => n.tag)).toEqual(["v2026.11.0"]);
         const prompt = reviewPrompt(line, notes.notes ?? [], []);
         expect(prompt).toMatch(/How Cortex uses it: specialist-cli provision runs bw/);
-        expect(prompt).toMatch(/<<<RELEASE NOTES\n### v2026\.9\.0 \(2026-10-15\)\nbw: new list flag\nRELEASE NOTES>>>/);
+        expect(prompt).toMatch(/<<<RELEASE NOTES\n### v2026\.11\.0 \(2026-10-15\)\nbw: new list flag\nRELEASE NOTES>>>/);
     });
 
     it("says why there is nothing to review", async () => {
-        const gcloud = buildLines(COLLECTED).find((l) => l.key === "cask:gcloud-cli") as ToolLine;
+        const gcloud = buildLines(COLLECTED).find((l) => l.key === "spc:gcloud") as ToolLine;
         expect(await notesFor(gcloud, fetch)).toEqual({ notes: null, reason: "no release notes to review here; see https://cloud.google.com/sdk/docs/release-notes" });
         const trendarr: ToolLine = { key: "spc:trendarr", label: "trendarr", installed: "0.6.0", latest: "0.7.0", major: false, action: { kind: "installer", component: "trendarr" }, state: "offered" };
         const notFound = vi.fn(async () => new Response("{}", { status: 404 })) as unknown as typeof fetch;

package/extensions/astro-discord/tools-report.ts

@@ -17,14 +17,11 @@ const PI_ASTRO = "@astrofoundry/pi-astro";
 const TRENDARR = "@astrofoundry/trendarr";
 /** Homebrew's own search path plus the system one; Homebrew and npm scripts start with `#!/usr/bin/env node`. */
 export const TOOL_PATH = "/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin";
-/** Casks that update themselves, which `brew outdated` skips unless greedy, but which a specialist depends on. */
-const TRACKED_SELF_UPDATING = ["gcloud-cli"];
-
-export type Component = "node" | "wrappers" | "arcane-cli" | "trendarr";
+export type Component = "node" | "wrappers" | "arcane-cli" | "trendarr" | "python" | "gcloud" | "bw" | "jq";
 
 export type UpdateAction =
     | { kind: "brew"; name: string }
-    | { kind: "cask"; token: string; greedy: boolean }
+    | { kind: "cask"; token: string }
     | { kind: "pi" }
     | { kind: "pi-astro" }
     | { kind: "installer"; component: Component };
@@ -121,6 +118,12 @@ export interface Collected {
     arcaneServer: string | null;
     trendarrLatest: string | null;
     nodeLts: string | null;
+    /** python-build-standalone's newest build of the installed minor, as `x.y.z+YYYYMMDD`. */
+    pythonLatest: string | null;
+    /** The version of Google's rapid channel. */
+    gcloudLatest: string | null;
+    bwLatest: string | null;
+    jqLatest: string | null;
     warnings: string[];
 }
 
@@ -130,13 +133,6 @@ interface BrewInfoFormula {
     installed?: { installed_on_request?: unknown }[];
 }
 
-interface BrewInfoCask {
-    token?: unknown;
-    installed?: unknown;
-    version?: unknown;
-    auto_updates?: unknown;
-}
-
 interface OutdatedEntry {
     name?: unknown;
     installed_versions?: unknown;
@@ -173,10 +169,30 @@ function str(v: unknown): string | null {
     return typeof v === "string" && v.length > 0 ? v : null;
 }
 
-const COMPONENT_LABEL: Record<Component, string> = { node: "specialist Node", wrappers: "specialist wrappers", "arcane-cli": "arcane-cli", trendarr: "trendarr" };
+const COMPONENT_LABEL: Record<Component, string> = {
+    node: "specialist Node",
+    wrappers: "specialist wrappers",
+    "arcane-cli": "arcane-cli",
+    trendarr: "trendarr",
+    python: "specialist Python",
+    gcloud: "specialist gcloud",
+    bw: "specialist bw",
+    jq: "specialist jq",
+};
+
+/** gcloud raises its first version number with every release, so a change there says nothing. */
+const NO_MAJOR_FLAG: readonly string[] = ["spc:gcloud"];
 
 function line(key: string, label: string, installed: string, latest: string, action: UpdateAction): ToolLine {
-    return { key, label, installed, latest, major: majorChange(installed, latest), action, state: "offered" };
+    return { key, label, installed, latest, major: !NO_MAJOR_FLAG.includes(key) && majorChange(installed, latest), action, state: "offered" };
+}
+
+/** What `specialist-install status` reports for one component. */
+export function installedComponent(status: unknown, component: Component): string | null {
+    const s = (status ?? {}) as Record<string, unknown>;
+    const field = component === "arcane-cli" ? s.arcaneCli : s[component];
+    const value = typeof field === "object" && field !== null ? (field as { current?: unknown }).current : field;
+    return str(value);
 }
 
 /** Only real updates: the offered version must be newer than the installed one. */
@@ -189,12 +205,19 @@ export function buildLines(c: Collected): ToolLine[] {
     const lines: ToolLine[] = [];
     if (newer(c.piInstalled, c.piLatest)) lines.push(line("pi", "Pi", c.piInstalled as string, c.piLatest, { kind: "pi" }));
     if (newer(c.piAstroInstalled, c.piAstroLatest)) lines.push(line("pi-astro", "pi-astro", c.piAstroInstalled as string, c.piAstroLatest, { kind: "pi-astro" }));
-    const status = (c.installer ?? {}) as { node?: { current?: unknown }; wrappers?: unknown; arcaneCli?: unknown; trendarr?: unknown };
-    const installedOf: Record<Component, string | null> = { node: str(status.node?.current), wrappers: str(status.wrappers), "arcane-cli": str(status.arcaneCli), trendarr: str(status.trendarr) };
     // The wrappers follow the pi-astro release Pi has installed; arcane-cli follows the Arcane server.
-    const targetOf: Record<Component, string | null> = { node: c.nodeLts, wrappers: c.piAstroInstalled, "arcane-cli": c.arcaneServer, trendarr: c.trendarrLatest };
-    for (const component of ["wrappers", "arcane-cli", "trendarr", "node"] as const) {
-        const installed = installedOf[component];
+    const targetOf: Record<Component, string | null> = {
+        node: c.nodeLts,
+        wrappers: c.piAstroInstalled,
+        "arcane-cli": c.arcaneServer,
+        trendarr: c.trendarrLatest,
+        python: c.pythonLatest,
+        gcloud: c.gcloudLatest,
+        bw: c.bwLatest,
+        jq: c.jqLatest,
+    };
+    for (const component of ["wrappers", "arcane-cli", "trendarr", "node", "python", "gcloud", "bw", "jq"] as const) {
+        const installed = installedComponent(c.installer, component);
         const target = targetOf[component];
         if (newer(installed, target)) lines.push(line(`spc:${component}`, COMPONENT_LABEL[component], installed as string, target, { kind: "installer", component }));
     }
@@ -207,14 +230,7 @@ export function buildLines(c: Collected): ToolLine[] {
     const casks = outdatedEntries(c.brewOutdated, "casks");
     for (const k of casks.sort((a, b) => a.name.localeCompare(b.name))) {
         if (k.pinned) continue;
-        lines.push(line(`cask:${k.name}`, k.name, k.installed, k.latest, { kind: "cask", token: k.name, greedy: false }));
-    }
-    const infoCasks = (c.brewInfo as { casks?: BrewInfoCask[] } | null)?.casks;
-    for (const k of Array.isArray(infoCasks) ? infoCasks : []) {
-        if (typeof k.token !== "string" || !TRACKED_SELF_UPDATING.includes(k.token) || casks.some((o) => o.name === k.token)) continue;
-        const installed = str(k.installed);
-        const latest = str(k.version);
-        if (newer(installed, latest)) lines.push(line(`cask:${k.token}`, k.token, installed as string, latest, { kind: "cask", token: k.token, greedy: true }));
+        lines.push(line(`cask:${k.name}`, k.name, k.installed, k.latest, { kind: "cask", token: k.name }));
     }
     return lines;
 }
@@ -240,6 +256,42 @@ export function arcaneServerVersion(json: unknown): string | null {
     return typeof v === "string" && /^v?\d+(\.\d+)+$/.test(v) ? v.replace(/^v/, "") : null;
 }
 
+/** The newest `cpython-<minor>.N+<build>` install-only build for macOS arm64 in a python-build-standalone release. */
+export function pythonBuild(release: unknown, minor: string): string | null {
+    const r = release as { tag_name?: unknown; assets?: { name?: unknown }[] } | null;
+    if (!r || typeof r.tag_name !== "string" || !/^\d{8}$/.test(r.tag_name) || !Array.isArray(r.assets)) return null;
+    const prefix = `cpython-${minor}.`;
+    const suffix = `+${r.tag_name}-aarch64-apple-darwin-install_only_stripped.tar.gz`;
+    const versions = r.assets
+        .map((a) => (typeof a.name === "string" && a.name.startsWith(prefix) && a.name.endsWith(suffix) ? a.name.slice("cpython-".length, -suffix.length) : null))
+        .filter((v): v is string => v !== null && /^\d+\.\d+\.\d+$/.test(v))
+        .sort((a, b) => compareLoose(b, a));
+    return versions[0] ? `${versions[0]}+${r.tag_name}` : null;
+}
+
+/** The newest Bitwarden CLI release, from a page of bitwarden/clients releases (tags `cli-vX.Y.Z`). */
+export function bwRelease(releases: unknown): string | null {
+    if (!Array.isArray(releases)) return null;
+    const versions = (releases as { tag_name?: unknown; prerelease?: unknown; draft?: unknown }[])
+        .filter((r) => typeof r.tag_name === "string" && r.prerelease !== true && r.draft !== true)
+        .map((r) => /^cli-v(\d+\.\d+\.\d+)$/.exec(r.tag_name as string)?.[1] ?? null)
+        .filter((v): v is string => v !== null)
+        .sort((a, b) => compareLoose(b, a));
+    return versions[0] ?? null;
+}
+
+/** `jq-X.Y.Z` of jqlang/jq's latest release. */
+export function jqRelease(release: unknown): string | null {
+    const tag = (release as { tag_name?: unknown } | null)?.tag_name;
+    return typeof tag === "string" ? (/^jq-(\d+\.\d+\.\d+)$/.exec(tag)?.[1] ?? null) : null;
+}
+
+/** `version` of Google's components snapshot. */
+export function gcloudRelease(snapshot: unknown): string | null {
+    const v = (snapshot as { version?: unknown } | null)?.version;
+    return typeof v === "string" && /^\d+\.\d+\.\d+$/.test(v) ? v : null;
+}
+
 export function npmGlobalVersion(json: unknown, pkg: string): string | null {
     const v = (json as { dependencies?: Record<string, { version?: unknown }> } | null)?.dependencies?.[pkg]?.version;
     return typeof v === "string" ? v : null;
@@ -323,6 +375,25 @@ export async function collectTools(options: CollectOptions): Promise<Collected>
     } catch (err) {
         warnings.push(`nodejs.org index failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+    const fetchJson = async (url: string, what: string): Promise<unknown> => {
+        try {
+            const res = await options.fetchImpl(url, { headers: { accept: "application/json", "user-agent": "pi-astro-tools-report" }, signal: AbortSignal.timeout(30_000) });
+            if (!res.ok) {
+                warnings.push(`${what} answered ${res.status}`);
+                return null;
+            }
+            return await res.json();
+        } catch (err) {
+            warnings.push(`${what} failed: ${err instanceof Error ? err.message : String(err)}`);
+            return null;
+        }
+    };
+    // Only for tools the installer manages; the first install of each is a manual step.
+    const python = installedComponent(installer, "python");
+    const pythonLatest = python ? pythonBuild(await fetchJson("https://api.github.com/repos/astral-sh/python-build-standalone/releases/latest", "python-build-standalone"), python.split(".").slice(0, 2).join(".")) : null;
+    const gcloudLatest = installedComponent(installer, "gcloud") ? gcloudRelease(await fetchJson("https://dl.google.com/dl/cloudsdk/channels/rapid/components-2.json", "the gcloud release snapshot")) : null;
+    const bwLatest = installedComponent(installer, "bw") ? bwRelease(await fetchJson("https://api.github.com/repos/bitwarden/clients/releases?per_page=30", "bitwarden/clients releases")) : null;
+    const jqLatest = installedComponent(installer, "jq") ? jqRelease(await fetchJson("https://api.github.com/repos/jqlang/jq/releases/latest", "jqlang/jq releases")) : null;
     let arcaneServer: string | null = null;
     try {
         arcaneServer = await options.arcaneServer();
@@ -341,6 +412,10 @@ export async function collectTools(options: CollectOptions): Promise<Collected>
         arcaneServer,
         trendarrLatest: await npmLatest(exec, TRENDARR, warnings),
         nodeLts,
+        pythonLatest,
+        gcloudLatest,
+        bwLatest,
+        jqLatest,
         warnings,
     };
 }
@@ -380,11 +455,11 @@ export const REVIEW_SOURCES: Record<string, ReviewSource> = {
         repo: "astrofoundry/trendarr",
         usage: "The media wrapper runs trendarr trending, search, add-movies, add-series and sabnzbd status|pause|resume with --json and parses that JSON; it writes ~/.trendarr/config.json for each call.",
     },
-    "cask:gcloud-cli": {
+    "spc:gcloud": {
         notesUrl: "https://cloud.google.com/sdk/docs/release-notes",
-        usage: "The edge specialist runs gcloud auth activate-service-account --key-file and gcloud compute start-iap-tunnel <instance> 22 --local-host-port, with CLOUDSDK_CONFIG and CLOUDSDK_PYTHON set.",
+        usage: "The edge specialist runs gcloud auth activate-service-account --key-file and gcloud compute start-iap-tunnel <instance> 22 --local-host-port, with CLOUDSDK_CONFIG and CLOUDSDK_PYTHON set; gcloud runs on the specialist Python from python-build-standalone.",
     },
-    "brew:bitwarden-cli": {
+    "spc:bw": {
         repo: "bitwarden/clients",
         tagPrefix: "cli-",
         usage: "specialist-cli provision runs bw status, config server, login --apikey, unlock --passwordfile --raw, sync, list collections, list items --collectionid, and lock, parsing the JSON with jq.",
@@ -464,7 +539,7 @@ export function updateCommand(action: UpdateAction, version: string): Command {
         case "brew":
             return { file: BREW, args: ["upgrade", action.name] };
         case "cask":
-            return { file: BREW, args: ["upgrade", "--cask", ...(action.greedy ? ["--greedy"] : []), action.token] };
+            return { file: BREW, args: ["upgrade", "--cask", action.token] };
         case "pi":
             return { file: PI, args: ["update", "--self"] };
         case "pi-astro":
@@ -507,11 +582,7 @@ export function verifiedVersion(action: UpdateAction, stdout: string, version: s
         return false;
     }
     if (action.kind === "pi") return npmGlobalVersion(json, PI_PACKAGE) === version;
-    if (action.kind === "installer") {
-        const s = json as { node?: { current?: unknown }; wrappers?: unknown; arcaneCli?: unknown; trendarr?: unknown };
-        const now = action.component === "node" ? s.node?.current : action.component === "wrappers" ? s.wrappers : action.component === "arcane-cli" ? s.arcaneCli : s.trendarr;
-        return now === version;
-    }
+    if (action.kind === "installer") return installedComponent(json, action.component) === version;
     return false;
 }
 
@@ -534,7 +605,7 @@ const SECONDARY = 2;
 const SUCCESS = 3;
 const DANGER = 4;
 const CUSTOM_ID_MAX = 100;
-const KEY = /^(pi|pi-astro|spc:(?:node|wrappers|arcane-cli|trendarr)|(?:brew|cask):[A-Za-z0-9@._/+-]{1,60})$/;
+const KEY = /^(pi|pi-astro|spc:(?:node|wrappers|arcane-cli|trendarr|python|gcloud|bw|jq)|(?:brew|cask):[A-Za-z0-9@._/+-]{1,60})$/;
 const VERSION = /^[A-Za-z0-9._,+-]{1,40}$/;
 
 export function updateId(line: ToolLine): string {

package/extensions/specialist-gate/approvals.test.ts

@@ -31,7 +31,7 @@ describe("approvals", () => {
         expect(isRisky("proxmox", ["set", "107", "memory=768"])).toBe(true);
         expect(isRisky("proxmox", ["shutdown", "107", "--confirm"])).toBe(true);
         expect(isRisky("security", ["decisions"])).toBe(false);
-        expect(isRisky("inference", ["hermes-restart", "api"])).toBe(true);
+        expect(isRisky("inference", ["nexus-restart", "embed"])).toBe(true);
         expect(isRisky("backup", ["restic-snapshots"])).toBe(false);
         expect(isRisky("backup", ["vzdump-run", "107"])).toBe(true);
         expect(isRisky("media", ["add-movies", "tt1160419"])).toBe(false);

package/extensions/specialist-gate/index.ts

@@ -37,7 +37,7 @@ export const RISKY: Readonly<Record<string, readonly RegExp[]>> = {
     edge: [/^vps\s+deploy-nginx\b/],
     backup: [/^(vzdump-run|host-backup-run|arcane-backup-run|gcs-run|restic-check-run|restic-restore|restore-clean)\b/],
     proxmox: [/^(set|snapshot-create|start)\b/],
-    inference: [/^(nexus-restart|nexus-start|hermes-restart)\b/],
+    inference: [/^(nexus-restart|nexus-start)\b/],
     // media has no entry: trendarr cannot delete anything, and adds and queue toggles run on the caller's request.
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/skills/edge/SKILL.md

@@ -13,7 +13,7 @@ Fetches `https://auth.37pla.net/.well-known/openid-configuration` through the VP
 
 ## `route-probe [name...]`
 
-HTTP status of the public routes of services on the Arcane VM, from Cortex through public DNS, the way users reach them: no credentials, no redirect followed. Without names it checks all of them: `supabase-auth-settings` (expects 401: it wants an API key), `supabase-jwks`, `supabase-openid`, `supabase-oauth-discovery`, `supabase-studio` (expects a redirect to the Pomerium sign-in), `grimoire-public`, `grimoire-public-health`, `mealie-public` (200). Each row has `httpCode`, `expected`, `ok`, `seconds`. A status says the route answered; it does not prove the application works or that a browser login succeeds. A failing route with a passing `probe` points at that service's route or container; ask `astro.identity` (Pomerium route) or `astro.arcane` (container) for their side.
+HTTP status of the public routes of services on the Arcane VM, from Cortex through public DNS, the way users reach them: no credentials, no redirect followed. Without names it checks all of them: `supabase-auth-settings` (expects 401: it wants an API key), `supabase-jwks`, `supabase-openid`, `supabase-oauth-discovery` (expects 404 while the Supabase Auth OAuth server is off), `supabase-studio` (expects a redirect to the Pomerium sign-in), `grimoire-public`, `grimoire-public-health` (200), `mealie-public` (expects a redirect to the Pomerium sign-in; checked 2026-10-19). Supabase Auth serves the OAuth discovery document only when its OAuth server is enabled; if it is turned on, change that expectation to 200. Each row has `httpCode`, `expected`, `ok`, `seconds`. A status says the route answered; it does not prove the application works or that a browser login succeeds. A failing route with a passing `probe` points at that service's route or container; ask `astro.identity` (Pomerium route) or `astro.arcane` (container) for their side.
 
 ## `vps <command>`
 

package/skills/inference/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: inference
-description: How the inference specialist operates llama.cpp on Nexus, Hermes on LXC 101, and the Europa health check through the inference tool.
+description: How the inference specialist operates llama.cpp on Nexus and the Europa health check through the inference tool.
 ---
 
 # Inference specialist
 
-Three hosts serve AI workloads. Nexus (Mac Studio, `10.0.40.38`, user `nexus`) runs two llama.cpp LaunchAgents: `com.nexus.llama-embed` (Qwen3-Embedding-8B, port 8081, `/v1/embeddings`) and `com.nexus.llama-rerank` (Qwen3-Reranker-4B, port 8082, `/v1/rerank`); Pomerium publishes them as `embed.37pla.net` and `rerank.37pla.net`. Hermes (LXC 101, `10.0.40.31`, user `hermes`) runs two systemd user services: `hermes-gateway.service` (Discord) and `hermes-gateway-api.service` (OpenAI-compatible API on 8650, published as `openai.37pla.net`). Europa (`10.0.60.5`, Windows, RTX 5090) runs an on-demand embedding server on 8081 and is off most of the time by design. `["--help"]` lists every command.
+Two hosts serve AI workloads. Nexus (Mac Studio, `10.0.40.38`, user `nexus`) runs two llama.cpp LaunchAgents: `com.nexus.llama-embed` (Qwen3-Embedding-8B, port 8081, `/v1/embeddings`) and `com.nexus.llama-rerank` (Qwen3-Reranker-4B, port 8082, `/v1/rerank`); Pomerium publishes them as `embed.37pla.net` and `rerank.37pla.net`. Europa (`10.0.60.5`, Windows, RTX 5090) runs an on-demand embedding server on 8081 and is off most of the time by design. `["--help"]` lists every command.
 
 ## Nexus
 
@@ -20,35 +20,11 @@ Three hosts serve AI workloads. Nexus (Mac Studio, `10.0.40.38`, user `nexus`) r
 
 A model load after restart takes up to a minute; `health=503` during that time is loading, not failure.
 
-## Hermes
-
-| Command | Effect |
-|---|---|
-| `hermes-status` | both user services |
-| `hermes-journal <since>` | user journal of both services |
-| `hermes-errors` | `hermes logs errors` |
-| `hermes-restart <gateway|api>` | restart one service |
-| `hermes-api-health` | `/health` (expect 200) and `/v1/models` (expect 401: the endpoint is up and requires the backend key) |
-| `hermes-version` | installed version |
-| `hermes-guest-status`, `hermes-snapshots` | LXC 101 state and snapshots (Pulsar) |
-| `hermes-releases [n]` | upstream releases of `NousResearch/hermes-agent`, notes cut at 6000 characters |
-| `hermes-release <tag>` | one release with its complete notes |
-| `hermes-upgrade --confirm` | Pulsar wrapper: snapshot `preupgrade<timestamp>`, `hermes update`, `hermes config migrate`, restart both gateways, wait for a Discord connection and API 401, keep the two newest snapshots |
-
-## Hermes upgrade procedure
-
-1. `hermes-version` and `hermes-releases 10`.
-2. Read every release from the installed version up to the target; use `hermes-release <tag>` for any note the list cut off. Stop and report when a note mentions a manual step, a configuration change beyond `hermes config migrate`, a breaking change, a new Python or system dependency, or a required intermediate version. Quote the sentence.
-3. `hermes-status` and `hermes-api-health` must be healthy before the upgrade; `hermes-snapshots` shows the existing snapshots.
-4. `hermes-upgrade --confirm` (up to 20 minutes). The wrapper prints the rollback command when a step fails; repeat it verbatim in your report and do not roll back yourself.
-5. `hermes-version`, `hermes-status`, `hermes-api-health`. Report old and new version, the snapshot name, and the health results.
-
 ## Europa
 
 `europa-health` returns `ok: false` with `httpCode: null` when Europa is off. That is the normal state; report it as expected unless the task says Europa should be running. Starting or stopping Europa is an operator task.
 
 ## When to stop and report
 
-- A release note requires a manual step or the installed version is more than one release behind with breaking changes in between.
 - A Nexus service stays at `health=503` or `000` for more than two minutes after a restart: report the last log lines (without any key material).
-- The task asks for model, port, or configuration changes: those are edits to the tracked plists in the homelab repository (`04-nexus-macstudio/llama.cpp/launchagents/`) or to Hermes profiles, both operator tasks.
+- The task asks for model, port, or configuration changes: those are edits to the tracked plists in the homelab repository (`04-nexus-macstudio/llama.cpp/launchagents/`), an operator task.

package/skills/proxmox/SKILL.md

@@ -5,7 +5,7 @@ description: How the proxmox specialist operates Proxmox VE on Pulsar through th
 
 # Proxmox specialist
 
-Pulsar (`10.0.10.37`, Proxmox VE 9 on Debian 13, node name `pulsar`) runs every guest: VM 100 `arcane` (Docker platform), LXC 101 `hermes`, LXC 102 `backup` (GCS pusher), VM 103 `identity` (Zitadel), VM 104 `dmz` (Pomerium), LXC 105 `tailscale`, VM 106 `observability`, LXC 107 `technitium2`, LXC 108 `radius`. Storage `local-lvm` holds the disks, `unas-backup` the vzdump archives. The `proxmox` tool talks to the API with a token whose role allows audit everywhere and, on guests, power, snapshots, and CPU/memory/option/network settings; nothing else. `["--help"]` lists the commands.
+Pulsar (`10.0.10.37`, Proxmox VE 9 on Debian 13, node name `pulsar`) runs every guest: VM 100 `arcane` (Docker platform), LXC 101 `hermes` (being retired by the operator; no specialist operates it), LXC 102 `backup` (GCS pusher), VM 103 `identity` (Zitadel), VM 104 `dmz` (Pomerium), LXC 105 `tailscale`, VM 106 `observability`, LXC 107 `technitium2`, LXC 108 `radius`. Storage `local-lvm` holds the disks, `unas-backup` the vzdump archives. The `proxmox` tool talks to the API with a token whose role allows audit everywhere and, on guests, power, snapshots, and CPU/memory/option/network settings; nothing else. `["--help"]` lists the commands.
 
 ## API commands
 
@@ -27,7 +27,7 @@ Power actions and snapshot changes return `{ upid, exitstatus }`; `OK` means don
 ```json
 { "args": ["guests"] }
 { "args": ["guest", "106"] }
-{ "args": ["snapshot-create", "101", "pre-change", "before Hermes config edit"] }
+{ "args": ["snapshot-create", "107", "pre-change", "before Technitium config edit"] }
 { "args": ["shutdown", "107", "--confirm"] }
 { "args": ["set", "107", "memory=768"] }
 ```

package/skills/security/SKILL.md

@@ -48,10 +48,10 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 | Wazuh agent | Host | Specialist that operates it |
 |---|---|---|
 | `frontdoor-1337` | Frontdoor VPS, Debian 13 | `astro.edge` |
-| `arcane` | VM 102, Docker host | `astro.arcane` for containers |
+| `arcane` | VM 100, Docker host | `astro.arcane` for containers |
 | `identity` | VM 103, ZITADEL | `astro.identity` |
 | `dmz` | VM 104, Pomerium and nginx | `astro.identity` |
-| `hermes` | LXC 109, Hermes | `astro.inference` |
+| `hermes` | LXC 101, Hermes (being retired) | none; the operator |
 | `NEXUS` | Mac Studio | `astro.inference` |
 | `CORTEX`, `tailscale` | Mac mini, LXC 105 | none; the operator |