@astrofoundry/pi-astro 0.34.1 → 0.36.0

package/extensions/astro-discord/index.ts

@@ -14,7 +14,23 @@ import { CHANNEL_RULES, helpText, needsPrefixText, parseCommand } from "./comman
 import { ACTIVATION_ENV, type ChannelSettings, type DiscordConfig, type ReportName, type ReportSchedule, allowedSpecialists, canUse, channelSpecialists, isOwner, loadConfig, loadToken, reportSchedule, saveConfig } from "./config.ts";
 import { type ConversationState, type ResolvedConversation, forgetStale, loadState, newConversationId, recordAnswer, resolveConversation, saveState, sessionsRoot, startConversation } from "./conversations.ts";
 import { describeImages, downloadImages, type ImageAttachment, imageAttachments } from "./attachments.ts";
-import { failureMessage, formatDailyReport, MANAGER_BUTTON, managerButton, managerOffer, managerSummary } from "./daily-report.ts";
+import {
+    type ArcaneReport,
+    buildStacks,
+    failureMessage,
+    layoutMessages as arcaneLayout,
+    majorLines,
+    managerSummary,
+    messageComponents as arcaneComponents,
+    parseArcaneButton,
+    readPostedArcane,
+    releaseNotesFromJson,
+    type ServiceLine,
+    serviceUsage,
+    stackOutcome,
+    type StackState,
+    writePostedArcane,
+} from "./daily-report.ts";
 import { GatewayClient } from "./gateway.ts";
 import { type CommandOption, IS_COMPONENTS_V2, KeyedQueue, MEDIA, MEDIA_COMMANDS, type MediaKind, type Outcome, addOutcome, applyOutcome, commandArgs, hasActiveButton, listMessage, mediaAccess, mediaPointer, parseAddButton, parseAddReport, parseMediaList, parseQueueState, queueLine } from "./media.ts";
 import { cancelledApprovalText, interruptedTaskText, readOpenWork, type OpenWork, type StopReason, writeOpenWork } from "./open-work.ts";
@@ -35,6 +51,7 @@ import {
     notesFor,
     parseToolsButton,
     parseVerdict,
+    reviewTask,
     readPackageVersion,
     readPostedReport,
     REVIEW_SOURCES,
@@ -135,8 +152,12 @@ const PACKAGE_JSON = fileURLToPath(new URL("../../package.json", import.meta.url
 /** Upper bound for one tool update from an Update button; `brew upgrade` of everything can take a while. */
 const UPDATE_TIMEOUT_MS = 30 * 60_000;
 const REVIEWER = "astro.release-reviewer";
-/** Key of a running Arcane manager upgrade among the tool runs, which count as open work. */
-const MANAGER_RUN = "arcane-manager";
+/** Key of a running Arcane stack update or manager upgrade among the tool runs; one at a time, because all of them push to the same GitOps checkout. */
+const ARCANE_RUN = "arcane-update";
+/** Upper bound for one `stack-update`: its own worst case (sync, redeploy, and health wait, again for a rollback, plus the checks) is about 125 minutes. */
+const STACK_UPDATE_TIMEOUT_MS = 135 * 60_000;
+/** Interaction tokens last 15 minutes; a later note goes to the channel as a reply to the report. */
+const FOLLOW_UP_WINDOW_MS = 14 * 60_000;
 
 interface ActiveTask {
     specialist: string;
@@ -307,6 +328,7 @@ class Bridge {
         this.gateway = gateway;
         void this.registerMediaCommands();
         await this.closeInterruptedUpdates();
+        await this.closeInterruptedArcane();
         // Checked every minute: each report decides whether today's is due, and waiting restarts check whether their service is idle.
         this.reportTimer = setInterval(() => {
             void this.maybeReports();
@@ -423,32 +445,40 @@ class Bridge {
         }
     }
 
-    /** The Arcane version report through the specialist wrapper, without a model, posted with its prefix. */
+    /**
+     * The Arcane Daily Report through the specialist wrapper, without a model:
+     * one section per stack with updates, a release-notes review for every
+     * major-version update, and an Update button per stack that is not held.
+     */
     private async arcaneReport(schedule: ReportSchedule, date: string): Promise<void> {
         if (!loadSpecialists().config) {
             log("arcane report: specialists.json missing; no report");
             return;
         }
         log(`arcane report ${date}: running arcane update-report`);
-        let message: { content: string; attachment?: string };
-        let offer: string | null = null;
+        let report: ArcaneReport | null = null;
         try {
-            const report: unknown = JSON.parse(await this.runEntry("arcane", "daily-report", ["update-report"], 15 * 60_000));
-            message = formatDailyReport(report, schedule.timeZone);
-            offer = managerOffer(report);
+            const built = buildStacks(JSON.parse(await this.runEntry("arcane", "daily-report", ["update-report"], 15 * 60_000)));
+            if (!built) throw new Error("update-report returned an unexpected answer");
+            for (const { stack, line } of majorLines(built.stacks)) if (!this.stopping) line.review = await this.reviewMajor(stack, line);
+            report = { date, channelId: schedule.channelId, timeZone: schedule.timeZone, ...built, messages: [] };
         } catch (err) {
             log(`arcane report ${date}: check failed: ${err instanceof Error ? err.message.slice(0, 500) : String(err)}`);
-            message = { content: failureMessage() };
         }
         if (this.stopping) return;
         writeReportState("arcane", { date, status: "sending" });
-        const posted = await this.rest.createMessage(schedule.channelId, {
-            content: message.content,
-            ...(message.attachment ? { file: { name: `arcane-daily-report-${date}.txt`, content: message.attachment } } : {}),
-            ...(offer ? { components: managerButton(offer, "offer") } : {}),
-        });
-        writeReportState("arcane", { date, status: message.content === failureMessage() ? "failed" : "sent", messageId: posted.id, ...(offer ? { managerOffer: offer } : {}) });
-        log(`arcane report ${date}: posted ${posted.id}`);
+        if (!report) {
+            const posted = await this.rest.createMessage(schedule.channelId, { content: failureMessage() });
+            writeReportState("arcane", { date, status: "failed", messageId: posted.id });
+            return;
+        }
+        for (const page of arcaneLayout(report)) {
+            const posted = await this.rest.createComponentsMessage(schedule.channelId, arcaneComponents(report, page));
+            report.messages.push({ id: posted.id, ...page });
+        }
+        writePostedArcane(report);
+        writeReportState("arcane", { date, status: "sent", messageId: report.messages[0]?.id });
+        log(`arcane report ${date}: ${report.stacks.length} stack(s) in ${report.messages.length} message(s)`);
     }
 
     /** Runs a program with an argument list as this user, never through a shell; resolves even on failure. */
@@ -497,10 +527,28 @@ class Bridge {
         log(`tools report ${date}: ${report.lines.length} update(s) in ${report.messages.length} message(s)`);
     }
 
-    /** The release-notes verdict of one line from the tool-less reviewer agent; the notes reach it only as task text. */
+    /** The release-notes verdict of one tools line. */
     private async reviewLine(line: ToolLine): Promise<Review> {
         const notes = await notesFor(line, fetch);
         if (notes.notes === null) return { verdict: null, reason: notes.reason };
+        return this.review(`${line.label} ${line.installed} -> ${line.latest}`, reviewPrompt(line, notes.notes, notes.omitted));
+    }
+
+    /** The release-notes verdict of a stack service's major-version update, from the wrapper's `release-notes`. */
+    private async reviewMajor(stack: string, line: ServiceLine): Promise<Review> {
+        let notes: ReturnType<typeof releaseNotesFromJson>;
+        try {
+            notes = releaseNotesFromJson(JSON.parse(await this.runEntry("arcane", "daily-report", ["release-notes", `${stack}/${line.service}`], 5 * 60_000)));
+        } catch (err) {
+            return { verdict: null, reason: `release notes unavailable: ${(err instanceof Error ? err.message : String(err)).split("\n")[0].slice(0, 120)}` };
+        }
+        if (notes.notes === null) return { verdict: null, reason: notes.reason };
+        const subject = { label: `${stack}/${line.service}`, installed: line.running ?? "an older build", latest: line.latest ?? "a newer build", usage: serviceUsage(stack, line) };
+        return this.review(`${subject.label} ${subject.installed} -> ${subject.latest}`, reviewTask(subject, notes.notes, notes.omitted));
+    }
+
+    /** The tool-less reviewer agent's verdict on one task; the release notes reach it only as task text. */
+    private async review(subject: string, task: string): Promise<Review> {
         const agent = this.specialists().agents.find((a) => a.name === REVIEWER);
         if (!agent) return { verdict: null, reason: `${REVIEWER} is not installed` };
         const { depth } = currentDepth();
@@ -508,7 +556,7 @@ class Bridge {
             const result = await runAgent({
                 agent,
                 skills: [],
-                task: reviewPrompt(line, notes.notes, notes.omitted),
+                task,
                 cwd: process.cwd(),
                 depth,
                 remaining: 0,
@@ -516,7 +564,7 @@ class Bridge {
                 env: { [ACTIVATION_ENV]: "0" },
             });
             const verdict = isFailed(result) ? null : parseVerdict(finalOutput(result.messages));
-            log(`tools report: reviewed ${line.label} ${line.installed} -> ${line.latest}: ${verdict?.verdict ?? "no answer"}`);
+            log(`release review: ${subject}: ${verdict?.verdict ?? "no answer"}`);
             return verdict ?? { verdict: null, reason: "the review gave no usable answer; read the notes before updating" };
         } catch (err) {
             return { verdict: null, reason: `the review failed: ${err instanceof Error ? err.message.slice(0, 120) : String(err)}` };
@@ -541,6 +589,19 @@ class Bridge {
         for (const m of report.messages) await this.rest.editComponents(report.channelId, m.id, messageComponents(report, m)).catch(() => undefined);
     }
 
+    /** Stacks a crash or restart left "updating" become Retry (the manager: did not complete); the wrapper may have stopped halfway. */
+    private async closeInterruptedArcane(): Promise<void> {
+        const report = readPostedArcane();
+        const stuck = report?.stacks.filter((s) => s.state === "running") ?? [];
+        if (!report || stuck.length === 0) return;
+        for (const s of stuck) {
+            s.state = "failed";
+            s.detail = "interrupted by a bridge restart; check the stack and the GitOps repository with the arcane specialist before pressing Retry";
+        }
+        writePostedArcane(report);
+        for (const m of report.messages.filter((x) => stuck.some((s) => x.stacks.includes(s.stack)))) await this.rest.editComponents(report.channelId, m.id, arcaneComponents(report, m)).catch(() => undefined);
+    }
+
     private async redrawLine(report: ToolsReport, key: string | null): Promise<void> {
         const m = report.messages.find((x) => (key === null ? x.all : x.keys.includes(key)));
         if (m) await this.rest.editComponents(report.channelId, m.id, messageComponents(report, m)).catch((err) => log(`tools report: redraw failed: ${err instanceof Error ? err.message : String(err)}`));
@@ -659,67 +720,135 @@ class Bridge {
         if (services.length > 0) writeRestarts(addRestarts(readRestarts(), [...new Set(services)], label, new Date()));
     }
 
-    /** The Arcane Daily Report's Upgrade button: owners only, the offer of the newest report only, one upgrade at a time. */
-    private async onManagerButton(interaction: Interaction, customId: string): Promise<void> {
-        const match = MANAGER_BUTTON.exec(customId);
+    /**
+     * The Arcane Daily Report's Update and Upgrade Arcane buttons: owners only,
+     * stacks the newest report still offers, one Arcane update at a time. The
+     * run is marked before the first await, so a second click cannot start
+     * another one.
+     */
+    private async onArcaneButton(interaction: Interaction, customId: string): Promise<void> {
+        const button = parseArcaneButton(customId);
         const userId = interaction.member?.user?.id ?? interaction.user?.id ?? "";
         this.refreshConfig();
-        if (!match) {
+        if (!button) {
             await this.rest.ephemeralReply(interaction.id, interaction.token, "This button is no longer active.");
             return;
         }
         if (!isOwner(this.config, userId)) {
-            await this.rest.ephemeralReply(interaction.id, interaction.token, "Only owners upgrade Arcane.");
+            await this.rest.ephemeralReply(interaction.id, interaction.token, button.kind === "manager" ? "Only owners upgrade Arcane." : "Only owners update stacks.");
             return;
         }
         if (this.stopping) {
             await this.rest.ephemeralReply(interaction.id, interaction.token, "The bridge is restarting; try again in a minute.");
             return;
         }
-        const state = readReportState("arcane");
-        if (!state || state.messageId !== interaction.message?.id || state.managerOffer !== match[1]) {
+        const stack = button.kind === "manager" ? "arcane" : button.stack;
+        const report = readPostedArcane();
+        const page = report?.messages.find((m) => m.id === interaction.message?.id && m.stacks.includes(stack));
+        const entry = page ? report?.stacks.find((s) => s.stack === stack && s.actionable && (button.kind === "stack" || s.manager === button.version)) : undefined;
+        if (!report || !entry) {
             await this.rest.ephemeralReply(interaction.id, interaction.token, "This offer is outdated; use the newest Arcane Daily Report.");
             return;
         }
-        if (this.toolRuns.has(MANAGER_RUN)) {
-            await this.rest.ephemeralReply(interaction.id, interaction.token, "The Arcane upgrade is already running.");
+        if (entry.state !== "offered" && !(entry.state === "failed" && button.kind === "stack")) {
+            await this.rest.ephemeralReply(interaction.id, interaction.token, "This update already ran; its line in the report says how it ended.");
             return;
         }
-        await this.rest.deferUpdate(interaction.id, interaction.token);
-        const message = { channelId: interaction.channel_id ?? "", id: interaction.message?.id ?? "", content: interaction.message?.content ?? "" };
-        await this.toolClicks.run(MANAGER_RUN, () => this.runManagerUpgrade(message, match[1], userId)).catch((err) => log(`arcane upgrade failed: ${err instanceof Error ? err.message : String(err)}`));
+        const running = this.toolRuns.get(ARCANE_RUN);
+        if (running) {
+            await this.rest.ephemeralReply(interaction.id, interaction.token, `An Arcane update is already running (${running.label}); try again when it finishes.`);
+            return;
+        }
+        this.toolRuns.set(ARCANE_RUN, { channelId: report.channelId, label: button.kind === "manager" ? `the Arcane manager to v${button.version}` : `the ${stack} stack` });
+        this.saveOpenWork();
+        const click = { token: interaction.token, at: Date.now(), userId };
+        try {
+            await this.rest.deferUpdate(interaction.id, interaction.token);
+            if (button.kind === "manager") await this.runManagerUpgrade(report, button.version, click);
+            else await this.runStackUpdate(report, stack, click);
+        } catch (err) {
+            log(`arcane: ${stack} update failed: ${err instanceof Error ? err.message : String(err)}`);
+        } finally {
+            this.toolRuns.delete(ARCANE_RUN);
+            this.saveOpenWork();
+        }
+    }
+
+    /**
+     * Sets one stack's state in the posted report and redraws its message
+     * through the bot's own route, which outlives the interaction token. A run
+     * from an older report changes only that report's message.
+     */
+    private async markArcane(report: ArcaneReport, stack: string, state: StackState, detail?: string): Promise<void> {
+        const current = readPostedArcane();
+        const target = current && current.date === report.date ? current : report;
+        const entry = target.stacks.find((s) => s.stack === stack);
+        if (entry) {
+            entry.state = state;
+            entry.detail = detail;
+        }
+        if (target === current) writePostedArcane(target);
+        const page = target.messages.find((m) => m.stacks.includes(stack));
+        if (page) await this.rest.editComponents(target.channelId, page.id, arcaneComponents(target, page)).catch((err) => log(`arcane report: redraw failed: ${err instanceof Error ? err.message : String(err)}`));
+    }
+
+    /** A note only the clicking owner sees while the interaction token lives; after that, a reply to the report in the channel. */
+    private async arcaneNote(report: ArcaneReport, stack: string, click: { token: string; at: number }, content: string): Promise<void> {
+        if (Date.now() - click.at < FOLLOW_UP_WINDOW_MS) {
+            try {
+                await this.rest.followUp(this.config.applicationId, click.token, { content, flags: EPHEMERAL });
+                return;
+            } catch (err) {
+                log(`arcane: ephemeral note failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        const page = report.messages.find((m) => m.stacks.includes(stack)) ?? report.messages[0];
+        await this.rest.createMessage(report.channelId, { content, ...(page ? { replyTo: page.id } : {}) }).catch(() => undefined);
+    }
+
+    /** One stack's `stack-update`, which edits, commits, redeploys, checks, and rolls back on its own; the button shows how it ended. */
+    private async runStackUpdate(report: ArcaneReport, stack: string, click: { token: string; at: number; userId: string }): Promise<void> {
+        await this.markArcane(report, stack, "running");
+        log(`arcane: updating stack ${stack} for ${click.userId}`);
+        let outcome: { state: StackState; detail: string };
+        try {
+            // The owner saw the major-version lines and their review in the report; a major that appeared since is refused.
+            const shown = report.stacks.find((s) => s.stack === stack)?.lines.some((l) => l.major) ?? false;
+            const args = ["stack-update", stack, ...(shown ? ["--confirm"] : [])];
+            outcome = stackOutcome(JSON.parse(await this.runEntry("arcane", `discord-${click.userId}`, args, STACK_UPDATE_TIMEOUT_MS)) as Record<string, unknown>);
+        } catch (err) {
+            outcome = { state: "failed", detail: `failed: ${(err instanceof Error ? err.message : String(err)).split("\n")[0].slice(0, 300)}` };
+        }
+        await this.markArcane(report, stack, outcome.state, outcome.detail);
+        log(`arcane: ${stack} ${outcome.detail}`);
+        if (outcome.state !== "updated") await this.arcaneNote(report, stack, click, `${stack}: ${outcome.detail}`);
     }
 
     /**
      * The upgrade runs through the wrapper (arcane/AGENTS.md "Manager upgrades")
      * and can take longer than an interaction token lives, so the report and the
-     * reply go through the bot's own message routes. Counted as open work, so no
-     * bridge restart lands in the middle.
+     * reply go through the bot's own message routes.
      */
-    private async runManagerUpgrade(message: { channelId: string; id: string; content: string }, version: string, userId: string): Promise<void> {
-        await this.rest.editMessage(message.channelId, message.id, message.content, managerButton(version, "running")).catch(() => undefined);
-        this.toolRuns.set(MANAGER_RUN, { channelId: message.channelId, label: `the Arcane manager to v${version}` });
-        this.saveOpenWork();
-        log(`arcane: manager upgrade to ${version} for ${userId}`);
-        let ok = false;
+    private async runManagerUpgrade(report: ArcaneReport, version: string, click: { userId: string }): Promise<void> {
+        await this.markArcane(report, "arcane", "running");
+        log(`arcane: manager upgrade to ${version} for ${click.userId}`);
+        let state: StackState = "failed";
         let summary: string;
         try {
-            const out = JSON.parse(await this.runEntry("arcane", `discord-${userId}`, ["manager-upgrade", version], 80 * 60_000)) as Record<string, unknown>;
-            ok = out.status === "upgraded";
+            const out = JSON.parse(await this.runEntry("arcane", `discord-${click.userId}`, ["manager-upgrade", version], 80 * 60_000)) as Record<string, unknown>;
+            state = out.status === "upgraded" ? "updated" : out.status === "rolled back" ? "rolled back" : "failed";
             summary = managerSummary(out);
-            if (ok) {
+            if (state === "updated") {
                 const cli = await this.execTool("/usr/bin/sudo", ["-n", INSTALLER, "arcane-cli", version], { timeoutMs: 10 * 60_000 });
                 summary += cli.code === 0 ? ` arcane-cli ${version} is installed for the specialists.` : ` arcane-cli ${version} was not installed (${cli.stderr.trim().split("\n").pop()?.slice(0, 200) ?? `exit ${cli.code}`}); the Cortex Tools Report offers it.`;
             }
         } catch (err) {
             summary = `❌ The Arcane upgrade to v${version} did not finish: ${(err instanceof Error ? err.message : String(err)).split("\n")[0].slice(0, 300)}. Check the manager with the arcane specialist before retrying.`;
-        } finally {
-            this.toolRuns.delete(MANAGER_RUN);
-            this.saveOpenWork();
         }
-        await this.rest.editMessage(message.channelId, message.id, message.content, managerButton(version, ok ? "upgraded" : "failed")).catch(() => undefined);
-        await this.rest.createMessage(message.channelId, { content: summary, replyTo: message.id }).catch(() => undefined);
-        log(`arcane: manager upgrade to ${version} ${ok ? "done" : "did not complete"}`);
+        await this.markArcane(report, "arcane", state);
+        const page = report.messages.find((m) => m.stacks.includes("arcane")) ?? report.messages[0];
+        await this.rest.createMessage(report.channelId, { content: summary, ...(page ? { replyTo: page.id } : {}) }).catch(() => undefined);
+        log(`arcane: manager upgrade to ${version} ${state === "updated" ? "done" : "did not complete"}`);
     }
 
     private async brewNodeVersion(): Promise<string> {
@@ -1109,8 +1238,8 @@ class Bridge {
             await this.onToolsButton(interaction, customId);
             return;
         }
-        if (customId.startsWith("arcane:manager:")) {
-            await this.onManagerButton(interaction, customId);
+        if (customId.startsWith("arcane:")) {
+            await this.onArcaneButton(interaction, customId);
             return;
         }
         const match = /^apr:([0-9a-f-]{36}):(approve|deny)$/.exec(customId);

package/extensions/astro-discord/reports.ts

@@ -7,8 +7,6 @@ export interface ReportState {
     date: string;
     status: "sending" | "sent" | "failed";
     messageId?: string;
-    /** Arcane report only: the manager release its Upgrade button offers, `2.17.0`. */
-    managerOffer?: string;
 }
 
 /** Local date and minutes past midnight in a time zone. */

package/extensions/astro-discord/tools-report.test.ts

@@ -7,6 +7,11 @@ import { addRestarts, astrogateActivity, herdrActivity, needsPrompt, readRestart
 import {
     allId,
     arcaneServerVersion,
+    bwRelease,
+    gcloudRelease,
+    installedComponent,
+    jqRelease,
+    pythonBuild,
     brewHasOutdated,
     buildLines,
     type Collected,
@@ -80,10 +85,23 @@ const COLLECTED: Collected = {
     piLatest: "1.3.0",
     piAstroInstalled: "0.33.0",
     piAstroLatest: "0.33.0",
-    installer: { node: { current: "24.22.0", previous: null }, wrappers: "0.32.0", arcaneCli: "2.16.1", trendarr: "0.6.0" },
+    installer: {
+        node: { current: "24.22.0", previous: null },
+        wrappers: "0.32.0",
+        arcaneCli: "2.16.1",
+        trendarr: "0.6.0",
+        python: { current: "3.14.8+20261009", previous: null },
+        gcloud: { current: "589.0.0", previous: null },
+        bw: { current: "2026.10.0", previous: null },
+        jq: { current: null, previous: null },
+    },
     arcaneServer: "2.17.0",
     trendarrLatest: "0.6.0",
     nodeLts: "24.22.0",
+    pythonLatest: "3.14.8+20261013",
+    gcloudLatest: "590.0.0",
+    bwLatest: "2026.11.0",
+    jqLatest: "1.8.2",
     warnings: [],
 };
 
@@ -113,6 +131,34 @@ describe("versions", () => {
     });
 });
 
+describe("root-owned tool releases", () => {
+    it("reads the newest Python build of the installed minor, Bitwarden CLI, jq, and gcloud versions", () => {
+        const asset = (v: string) => ({ name: `cpython-${v}+20261013-aarch64-apple-darwin-install_only_stripped.tar.gz` });
+        const python = { tag_name: "20261013", assets: [asset("3.14.8"), asset("3.15.0"), asset("3.14.10"), { name: "cpython-3.14.9+20261013-x86_64-apple-darwin-install_only_stripped.tar.gz" }, { name: "SHA256SUMS" }] };
+        expect(pythonBuild(python, "3.14")).toBe("3.14.10+20261013");
+        expect(pythonBuild(python, "3.13")).toBeNull();
+        expect(pythonBuild({ tag_name: "latest", assets: [] }, "3.14")).toBeNull();
+        expect(bwRelease([{ tag_name: "desktop-v2026.11.0" }, { tag_name: "cli-v2026.11.1", prerelease: true }, { tag_name: "cli-v2026.10.0" }, { tag_name: "cli-v2026.9.1" }])).toBe("2026.10.0");
+        expect(bwRelease({})).toBeNull();
+        expect(jqRelease({ tag_name: "jq-1.8.2" })).toBe("1.8.2");
+        expect(jqRelease({ tag_name: "1.8.2" })).toBeNull();
+        expect(gcloudRelease({ version: "589.0.0", revision: 20261009074343 })).toBe("589.0.0");
+        expect(gcloudRelease({ version: "latest" })).toBeNull();
+    });
+
+    it("reads each component from the installer status", () => {
+        const status = { node: { current: "24.22.0", previous: null }, wrappers: "0.34.1", arcaneCli: "2.16.1", trendarr: null, python: { current: "3.14.8+20261013" }, jq: { current: null } };
+        expect(installedComponent(status, "node")).toBe("24.22.0");
+        expect(installedComponent(status, "wrappers")).toBe("0.34.1");
+        expect(installedComponent(status, "arcane-cli")).toBe("2.16.1");
+        expect(installedComponent(status, "trendarr")).toBeNull();
+        expect(installedComponent(status, "python")).toBe("3.14.8+20261013");
+        expect(installedComponent(status, "jq")).toBeNull();
+        expect(installedComponent(status, "gcloud")).toBeNull();
+        expect(installedComponent(null, "bw")).toBeNull();
+    });
+});
+
 describe("report lines", () => {
     it("lists our tools first, then requested formulae and casks; dependencies and pinned packages stay out", () => {
         const lines = buildLines(COLLECTED);
@@ -120,17 +166,20 @@ describe("report lines", () => {
             "pi 0.87.1->1.3.0",
             "spc:wrappers 0.32.0->0.33.0",
             "spc:arcane-cli 2.16.1->2.17.0",
+            "spc:python 3.14.8+20261009->3.14.8+20261013",
+            "spc:gcloud 589.0.0->590.0.0",
+            "spc:bw 2026.10.0->2026.11.0",
             "brew:bitwarden-cli 2026.8.0->2026.9.0",
             "brew:gh 2.97.0->2.101.0",
             "brew:herdr 0.9.0->0.9.1",
             "brew:pnpm 11.22.0->12.6.0",
             "cask:codex 0.152.1->0.156.1",
             "cask:temurin@17 17.0.20,8->17.0.20.1,1",
-            "cask:gcloud-cli 585.0.0->586.0.0",
         ]);
         expect(lines[0].major).toBe(true);
-        expect(lines.find((l) => l.key === "cask:gcloud-cli")?.action).toEqual({ kind: "cask", token: "gcloud-cli", greedy: true });
-        expect(lines.find((l) => l.key === "cask:codex")?.action).toEqual({ kind: "cask", token: "codex", greedy: false });
+        expect(lines.find((l) => l.key === "spc:gcloud")?.major).toBe(false);
+        expect(lines.find((l) => l.key === "spc:python")?.action).toEqual({ kind: "installer", component: "python" });
+        expect(lines.find((l) => l.key === "cask:codex")?.action).toEqual({ kind: "cask", token: "codex" });
         expect(lines.every((l) => l.state === "offered")).toBe(true);
         expect(brewHasOutdated(OUTDATED)).toBe(true);
         expect(brewHasOutdated({ formulae: [OUTDATED.formulae[6]], casks: [] })).toBe(false);
@@ -166,12 +215,26 @@ describe("collection", () => {
         const dir = mkdtempSync(join(tmpdir(), "tools-pkg-"));
         try {
             writeFileSync(join(dir, "package.json"), JSON.stringify({ version: "0.33.0" }));
-            const fetchImpl = vi.fn(async () => new Response(JSON.stringify([{ version: "v24.22.0", lts: "Krypton", files: ["osx-arm64-tar"] }]))) as unknown as typeof fetch;
+            const bodies: Record<string, unknown> = {
+                "https://nodejs.org/dist/index.json": [{ version: "v24.22.0", lts: "Krypton", files: ["osx-arm64-tar"] }],
+                "https://api.github.com/repos/astral-sh/python-build-standalone/releases/latest": { tag_name: "20261013", assets: [{ name: "cpython-3.14.8+20261013-aarch64-apple-darwin-install_only_stripped.tar.gz" }] },
+                "https://dl.google.com/dl/cloudsdk/channels/rapid/components-2.json": { version: "590.0.0" },
+                "https://api.github.com/repos/bitwarden/clients/releases?per_page=30": [{ tag_name: "cli-v2026.11.0" }],
+            };
+            const fetched: string[] = [];
+            const fetchImpl = vi.fn(async (url: string | URL) => {
+                fetched.push(String(url));
+                const body = bodies[String(url)];
+                return body === undefined ? new Response("{}", { status: 404 }) : new Response(JSON.stringify(body));
+            }) as unknown as typeof fetch;
             const c = await collectTools({ exec, fetchImpl, piAstroPackage: join(dir, "package.json"), arcaneServer: async () => "2.16.1" });
             expect(calls[0]).toBe("brew update");
             expect(c.warnings.join(" | ")).toMatch(/brew update failed, versions may be stale: Error: network down/);
             expect(c.warnings.join(" | ")).toMatch(/npm view @astrofoundry\/trendarr failed/);
             expect(c).toMatchObject({ piInstalled: "0.87.1", piLatest: "1.3.0", piAstroInstalled: "0.33.0", nodeLts: "24.22.0", arcaneServer: "2.16.1", trendarrLatest: null });
+            expect(c).toMatchObject({ pythonLatest: "3.14.8+20261013", gcloudLatest: "590.0.0", bwLatest: "2026.11.0", jqLatest: null });
+            // jq is not installed by the installer yet, so its releases are not even asked for.
+            expect(fetched.some((u) => u.includes("jqlang"))).toBe(false);
         } finally {
             rmSync(dir, { recursive: true, force: true });
         }
@@ -237,8 +300,8 @@ describe("buttons and commands", () => {
 
     it("runs one fixed command per kind, reads the version back, and knows what to roll back and restart", () => {
         expect(updateCommand({ kind: "brew", name: "monadeo/tap/astrogate" }, "0.0.11")).toEqual({ file: "/opt/homebrew/bin/brew", args: ["upgrade", "monadeo/tap/astrogate"] });
-        expect(updateCommand({ kind: "cask", token: "gcloud-cli", greedy: true }, "586.0.0").args).toEqual(["upgrade", "--cask", "--greedy", "gcloud-cli"]);
-        expect(updateCommand({ kind: "cask", token: "codex", greedy: false }, "0.156.1").args).toEqual(["upgrade", "--cask", "codex"]);
+        expect(updateCommand({ kind: "cask", token: "codex" }, "0.156.1").args).toEqual(["upgrade", "--cask", "codex"]);
+        expect(updateCommand({ kind: "installer", component: "python" }, "3.14.8+20261013").args).toEqual(["-n", "/usr/local/sbin/specialist-install", "python", "3.14.8+20261013"]);
         expect(updateCommand({ kind: "pi" }, "1.3.0")).toEqual({ file: "/opt/homebrew/bin/pi", args: ["update", "--self"] });
         expect(updateCommand({ kind: "pi-astro" }, "0.33.0").args).toEqual(["update", "npm:@astrofoundry/pi-astro"]);
         expect(updateCommand({ kind: "installer", component: "arcane-cli" }, "2.17.0")).toEqual({ file: "/usr/bin/sudo", args: ["-n", "/usr/local/sbin/specialist-install", "arcane-cli", "2.17.0"] });
@@ -249,6 +312,8 @@ describe("buttons and commands", () => {
         expect(verifiedVersion({ kind: "brew", name: "node" }, "node 26.7.0 26.9.0\n", "26.9.0")).toBe(true);
         expect(verifiedVersion({ kind: "brew", name: "gh" }, "gh 2.97.0\n", "2.101.0")).toBe(false);
         expect(verifiedVersion({ kind: "installer", component: "node" }, JSON.stringify({ node: { current: "24.23.0" } }), "24.23.0")).toBe(true);
+        expect(verifiedVersion({ kind: "installer", component: "gcloud" }, JSON.stringify({ gcloud: { current: "590.0.0", previous: "589.0.0" } }), "590.0.0")).toBe(true);
+        expect(verifiedVersion({ kind: "installer", component: "arcane-cli" }, JSON.stringify({ arcaneCli: "2.17.0" }), "2.17.0")).toBe(true);
         expect(verifiedVersion({ kind: "pi" }, "not json", "1.3.0")).toBe(false);
         expect(servicesFor({ kind: "pi" })).toEqual(["bridge"]);
         expect(servicesFor({ kind: "brew", name: "node" })).toEqual(["astrogate", "bridge"]);
@@ -262,17 +327,17 @@ describe("release-notes review", () => {
     const release = (tag: string, body: string, prerelease = false) => ({ tag_name: tag, name: tag, body, published_at: "2026-10-15T00:00:00Z", html_url: `https://github.com/x/releases/${tag}`, draft: false, prerelease });
 
     it("reads only the tool's own releases in a shared repository, between the two versions", async () => {
-        const fetchImpl = vi.fn(async () => new Response(JSON.stringify([release("cli-v2026.9.0", "bw: new list flag"), release("desktop-v2026.9.0", "desktop only"), release("cli-v2026.8.0", "old")]))) as unknown as typeof fetch;
-        const line = buildLines(COLLECTED).find((l) => l.key === "brew:bitwarden-cli") as ToolLine;
+        const fetchImpl = vi.fn(async () => new Response(JSON.stringify([release("cli-v2026.11.0", "bw: new list flag"), release("desktop-v2026.11.0", "desktop only"), release("cli-v2026.10.0", "old")]))) as unknown as typeof fetch;
+        const line = buildLines(COLLECTED).find((l) => l.key === "spc:bw") as ToolLine;
         const notes = await notesFor(line, fetchImpl);
-        expect(notes.notes?.map((n) => n.tag)).toEqual(["v2026.9.0"]);
+        expect(notes.notes?.map((n) => n.tag)).toEqual(["v2026.11.0"]);
         const prompt = reviewPrompt(line, notes.notes ?? [], []);
-        expect(prompt).toMatch(/How Cortex uses it: specialist-cli provision runs bw/);
-        expect(prompt).toMatch(/<<<RELEASE NOTES\n### v2026\.9\.0 \(2026-10-15\)\nbw: new list flag\nRELEASE NOTES>>>/);
+        expect(prompt).toMatch(/How we use it: specialist-cli provision runs bw/);
+        expect(prompt).toMatch(/<<<RELEASE NOTES\n### v2026\.11\.0 \(2026-10-15\)\nbw: new list flag\nRELEASE NOTES>>>/);
     });
 
     it("says why there is nothing to review", async () => {
-        const gcloud = buildLines(COLLECTED).find((l) => l.key === "cask:gcloud-cli") as ToolLine;
+        const gcloud = buildLines(COLLECTED).find((l) => l.key === "spc:gcloud") as ToolLine;
         expect(await notesFor(gcloud, fetch)).toEqual({ notes: null, reason: "no release notes to review here; see https://cloud.google.com/sdk/docs/release-notes" });
         const trendarr: ToolLine = { key: "spc:trendarr", label: "trendarr", installed: "0.6.0", latest: "0.7.0", major: false, action: { kind: "installer", component: "trendarr" }, state: "offered" };
         const notFound = vi.fn(async () => new Response("{}", { status: 404 })) as unknown as typeof fetch;