npm - @bastani/atomic - Versions diffs - 0.8.13 → 0.8.14 - Mend

@bastani/atomic 0.8.13 → 0.8.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (355) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -2,6 +2,29 @@
 ## [Unreleased]
+## [0.8.14] - 2026-05-25
+### Changed
+- Promoted the 0.8.14 prerelease changes to a stable release.
+- Synced Atomic's coding-agent fork with upstream Pi patches since v0.75.4 and updated bundled Pi libraries to 0.75.5.
+### Fixed
+- Carried forward upstream fixes for managed extension installs, git package ref reconciliation, async file tools, export HTML escaping, OpenCode session headers, OAuth device-code login, footer path abbreviation, clipboard native loading, and collapsed read output rendering.
+- Refreshed the built-in header model label whenever the active model changes, matching the footer below the chat box.
+## [0.8.14-0] - 2026-05-25
+### Changed
+- Synced Atomic's coding-agent fork with upstream Pi patches since v0.75.4 and updated bundled Pi libraries to 0.75.5.
+### Fixed
+- Carried forward upstream fixes for managed extension installs, git package ref reconciliation, async file tools, export HTML escaping, OpenCode session headers, OAuth device-code login, footer path abbreviation, clipboard native loading, and collapsed read output rendering.
+- Refreshed the built-in header model label whenever the active model changes, matching the footer below the chat box.
 ## [0.8.13] - 2026-05-21
 ### Changed

package/dist/builtin/intercom/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.8.13",
+  "version": "0.8.14",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/host-html-template.ts CHANGED Viewed

@@ -418,7 +418,7 @@ function escapeHtml(value: string): string {
     .replace(/'/g, "&#39;");
 }
-function escapeHtmlAttribute(value: string): string {
+export function escapeHtmlAttribute(value: string): string {
   return value
     .replace(/&/g, "&amp;")
     .replace(/"/g, "&quot;")

package/dist/builtin/mcp/init.ts CHANGED Viewed

@@ -274,8 +274,21 @@ export function updateStatusBar(state: McpExtensionState): void {
     ui.setStatus("mcp", undefined);
     return;
   }
-  const connectedCount = state.manager.getAllConnections().size;
-  ui.setStatus("mcp", ui.theme.fg("accent", `MCP: ${connectedCount}/${total} servers`));
+  const connectedCount = [...state.manager.getAllConnections().values()].filter(
+    (connection) => connection.status === "connected",
+  ).length;
+  const text = `MCP: ${connectedCount}/${total} servers`;
+  ui.setStatus("mcp", colorizeStatusText(ui, text));
+}
+function colorizeStatusText(ui: NonNullable<McpExtensionState["ui"]>, text: string): string {
+  const theme = (ui as { theme?: { fg?: (color: string, text: string) => string } }).theme;
+  if (typeof theme?.fg !== "function") return text;
+  try {
+    return theme.fg("accent", text);
+  } catch {
+    return text;
+  }
 }
 export function getFailureAgeSeconds(state: McpExtensionState, serverName: string): number | null {

package/dist/builtin/mcp/mcp-callback-server.ts CHANGED Viewed

@@ -12,6 +12,7 @@ import {
   getOAuthCallbackPort,
   setOAuthCallbackPort,
 } from "./mcp-oauth-provider.ts"
+import { logger } from "./logger.ts"
 // HTML templates for callback responses
 const HTML_SUCCESS = `<!DOCTYPE html>
@@ -34,7 +35,7 @@ const HTML_SUCCESS = `<!DOCTYPE html>
 </body>
 </html>`
-const HTML_ERROR = () => `<!DOCTYPE html>
+export const renderCallbackErrorHtml = () => `<!DOCTYPE html>
 <html>
 <head>
   <title>Pi - Authorization Failed</title>
@@ -50,7 +51,7 @@ const HTML_ERROR = () => `<!DOCTYPE html>
   <div class="container">
     <h1>Authorization Failed</h1>
     <p>An error occurred during authorization.</p>
-    <div class="error">Authorization request failed.</div>
+    <div class="error">Return to Atomic and try again.</div>
   </div>
 </body>
 </html>`
@@ -78,7 +79,7 @@ interface EnsureCallbackServerOptions {
 /**
  * Handle incoming HTTP requests to the callback server.
  */
-function handleRequest(req: IncomingMessage, res: ServerResponse): void {
+export function handleRequest(req: IncomingMessage, res: ServerResponse): void {
   const url = new URL(req.url || "/", `http://${req.headers.host}`)
   // Only handle the callback path
@@ -95,9 +96,9 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
   // Enforce state parameter presence for CSRF protection
   if (!state) {
-    const errorMsg = "Missing required state parameter - potential CSRF attack"
+    logger.debug("OAuth callback rejected: missing state parameter")
     res.writeHead(400, { "Content-Type": "text/html" })
-    res.end(HTML_ERROR(errorMsg))
+    res.end(renderCallbackErrorHtml())
     return
   }
@@ -106,7 +107,7 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
     const errorMsg = errorDescription || error
     // Send HTTP response first before rejecting promise
     res.writeHead(200, { "Content-Type": "text/html" })
-    res.end(HTML_ERROR(errorMsg))
+    res.end(renderCallbackErrorHtml())
     // Reject promise after response is sent (defer to allow test to attach handler)
     if (pendingAuths.has(state)) {
       const pending = pendingAuths.get(state)!
@@ -120,15 +121,15 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
   // Require authorization code
   if (!code) {
     res.writeHead(400, { "Content-Type": "text/html" })
-    res.end(HTML_ERROR("No authorization code provided"))
+    res.end(renderCallbackErrorHtml())
     return
   }
   // Validate state parameter
   if (!pendingAuths.has(state)) {
-    const errorMsg = "Invalid or expired state parameter - potential CSRF attack"
+    logger.debug("OAuth callback rejected: invalid or expired state parameter")
     res.writeHead(400, { "Content-Type": "text/html" })
-    res.end(HTML_ERROR(errorMsg))
+    res.end(renderCallbackErrorHtml())
     return
   }

package/dist/builtin/mcp/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.8.13",
+  "version": "0.8.14",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [

package/dist/builtin/mcp/ui-session.ts CHANGED Viewed

@@ -14,6 +14,7 @@ import {
 import { logger } from "./logger.ts";
 import { startUiServer, type UiServerHandle } from "./ui-server.ts";
 import { isGlimpseAvailable, openGlimpseWindow } from "./glimpse-ui.ts";
+import { escapeHtmlAttribute } from "./host-html-template.ts";
 let activeGlimpseWindow: { close(): void } | null = null;
@@ -264,9 +265,10 @@ export async function maybeStartUiSession(
         active = false;
         cleanupStreamListener();
-        if (state.uiServer === handle) {
-          const messages = handle.getSessionMessages();
-          const stream = handle.getStreamSummary();
+        if (state.uiServer === handle && handle !== null) {
+          const completedHandle = handle;
+          const messages = completedHandle.getSessionMessages();
+          const stream = completedHandle.getStreamSummary();
           const hasContent =
             messages.prompts.length > 0 ||
             messages.intents.length > 0 ||
@@ -275,8 +277,8 @@ export async function maybeStartUiSession(
           if (hasContent) {
             state.completedUiSessions.push({
-              serverName: handle.serverName,
-              toolName: handle.toolName,
+              serverName: completedHandle.serverName,
+              toolName: completedHandle.toolName,
               completedAt: new Date(),
               reason,
               messages,
@@ -323,7 +325,8 @@ export async function maybeStartUiSession(
     if (useGlimpse) {
       try {
-        const glimpseHtml = `<!DOCTYPE html><html><head><meta charset="utf-8"><style>body{margin:0;padding:0;width:100vw;height:100vh;overflow:hidden}iframe{width:100%;height:100%;border:none}</style></head><body><iframe src="${handle.url}"></iframe></body></html>`;
+        const iframeUrl = escapeHtmlAttribute(handle.url);
+        const glimpseHtml = `<!DOCTYPE html><html><head><meta charset="utf-8"><style>body{margin:0;padding:0;width:100vw;height:100vh;overflow:hidden}iframe{width:100%;height:100%;border:none}</style></head><body><iframe src="${iframeUrl}"></iframe></body></html>`;
         activeGlimpseWindow = await openGlimpseWindow(glimpseHtml, {
           title: `MCP · ${request.serverName} · ${request.toolName}`,
           width: 1000,

package/dist/builtin/subagents/CHANGELOG.md CHANGED Viewed

@@ -12,9 +12,16 @@
 ## [Unreleased]
 ### Added
+- Synced upstream nested subagent fanout support, including child-safe nested `subagent` registration for explicitly authorized agents, nested status/control metadata, and parent-visible nested summaries.
 ### Fixed
-- Smooth live subagent widget animation by requesting redraws on spinner ticks without remounting the widget, preserving 250ms async status polling while reducing flicker.
+- Include selected direct MCP tool names in explicit child tool allowlists when metadata cache/config resolution is available.
+- Bound nested fanout control inbox retry/dedupe state and clean stale nested event/run directories during extension startup.
+- Serialize nested registry projection and expand the processed-event replay guard to avoid concurrent sidecar write races and active-session replay churn.
+- Write async runner config files with owner-only permissions so nested route capability tokens are not exposed through permissive umasks.
+- Treat provider-coerced single-run `output: "false"` the same as boolean `false`, preventing literal `false` output files.
+- Respect read-only completion guard overrides and document `completionGuard: false` as a user-authored frontmatter escape hatch.
+- Suppress flashing console windows when spawning child processes on Windows (`windowsHide: true`).
 - Append the current user-selected model as the final subagent fallback candidate, so retryable provider/model failures still get one last attempt after configured `fallbackModels` are exhausted.
 - Keep subagent running glyphs stable between live animation ticks by deriving their base frame from progress state.
 - Treat intermediate child provider/tool errors as recovered when a later clean assistant response succeeds, for both foreground and async subagent runs.

package/dist/builtin/subagents/README.md CHANGED Viewed

@@ -1,24 +1,28 @@
 <p>
-  <img src="https://raw.githubusercontent.com/nicobailon/pi-subagents/main/banner.png" alt="pi-subagents" width="1100">
+  <img src="https://raw.githubusercontent.com/nicobailon/pi-subagents/main/banner.png" alt="Atomic subagents" width="1100">
 </p>
-# pi-subagents
+# @bastani/subagents
-`pi-subagents` lets Pi delegate work to focused child agents. Use it for code review, scouting, implementation, parallel audits, saved workflows, background jobs, and anything else that benefits from a second or third set of model eyes.
+`@bastani/subagents` lets Atomic delegate work to focused child agents. It is Atomic's bundled adaptation of upstream `pi-subagents`; use it for code review, scouting, implementation, parallel audits, saved workflows, background jobs, and anything else that benefits from a second or third set of model eyes.
 https://github.com/user-attachments/assets/702554ec-faaf-4635-80aa-fb5d6e292fd1
 ## Installation
+Atomic bundles this extension through `@bastani/atomic`; no separate install is required for Atomic users.
+For upstream Pi installs, use:
 ```bash
 pi install npm:pi-subagents
 ```
-That is the only required step. You can add optional pieces later.
+You can add optional pieces later.
 ## Try this first
-You do not need to create agents, write config, or learn slash commands. After installing, ask Pi for delegation in plain language:
+You do not need to create agents, write config, or learn slash commands. Ask Atomic for delegation in plain language:
 ```text
 Use reviewer to review this diff.
@@ -141,7 +145,7 @@ For a persistent override, edit settings. This example pins the reviewer everywh
 }
 ```
-Use `~/.pi/agent/settings.json` for a user override or `.pi/settings.json` for a project override. The same `agentOverrides` block can change `tools`, `skills`, inherited context, prompt text, or disable a builtin. If you want a totally different agent, create a user or project agent with the same name; for normal tweaks, prefer overrides.
+Use `~/.atomic/agent/settings.json` for a user override or `.atomic/settings.json` for a project override; legacy `~/.pi/agent/settings.json` and `.pi/settings.json` paths are also checked for compatibility. The same `agentOverrides` block can change `tools`, `skills`, inherited context, prompt text, or disable a builtin. If you want a totally different agent, create a user or project agent with the same name; for normal tweaks, prefer overrides.
 ## Where running subagents show up
@@ -181,7 +185,7 @@ Use the optional prompt shortcuts below when you want the pattern to be repeatab
 Packaged `planner`, `worker`, and `oracle` default to forked context when a launch omits `context`; pass `context: "fresh"` when you intentionally want a fresh child run.
-Child-safety boundaries are enforced at runtime. Spawned child sessions do not register the `subagent` tool, do not receive the bundled `pi-subagents` skill, and receive explicit boundary instructions that they are not the parent orchestrator and must not propose or run subagents. Forked child context filtering also removes parent-only subagent artifacts (including old hidden orchestration-instruction messages, slash/status/control messages, and prior parent `subagent` tool-call/tool-result history) while preserving ordinary prose and unrelated tool calls/results.
+Child-safety boundaries are enforced at runtime. Spawned child sessions do not register the `subagent` tool or receive the bundled `pi-subagents` skill unless the parent intentionally selected an explicit fanout agent whose resolved builtin `tools` includes `subagent`. Non-fanout children receive boundary instructions that they are not the parent orchestrator and must not propose or run subagents; authorized fanout children get a narrower boundary that limits nested delegation to the assigned fanout. Forked child context filtering also removes parent-only subagent artifacts (including old hidden orchestration-instruction messages, slash/status/control messages, and prior parent `subagent` tool-call/tool-result history) while preserving ordinary prose and unrelated tool calls/results.
 ## Optional shortcuts
@@ -199,15 +203,15 @@ The package includes reusable prompt templates for common workflows. You do not
 Add `autofix` to `/parallel-review` or `/parallel-cleanup` to apply only the synthesized fixes worth doing now after reviewers return.
-## Optional pi-intercom companion
+## Optional intercom companion
-`pi-subagents` works without `pi-intercom`. Install `pi-intercom` only if you want child agents to talk back to the parent Pi session while they are running.
+Atomic subagents work without intercom. Atomic bundles `@bastani/intercom`; upstream Pi users can install `pi-intercom` if they want child agents to talk back to the parent session while they are running.
 ```bash
 pi install npm:pi-intercom
 ```
-Most users do not call `intercom` directly. After `pi-intercom` is installed, `pi-subagents` can automatically give child agents a private coordination channel back to the parent session. The bridge recognizes the normal `pi install npm:pi-intercom` package install as well as legacy local extension checkouts.
+Most users do not call `intercom` directly. When the intercom companion is available, subagents can automatically give child agents a private coordination channel back to the parent session. The bridge recognizes Atomic's bundled intercom package, the normal upstream `pi install npm:pi-intercom` package install, and legacy local extension checkouts.
 Use it for work where the child might need a decision instead of guessing:
@@ -351,19 +355,19 @@ Picker screens use `↑↓`, `Enter`, `Escape`, and type-to-filter. The full-scr
 ## Agents and chains
-Agents are markdown files with YAML frontmatter and a system prompt body. They define the specialist that will run in the child Pi process.
+Agents are markdown files with YAML frontmatter and a system prompt body. They define the specialist that will run in the child Atomic process.
 Agent locations, lowest to highest priority:
 | Scope | Path |
 |-------|------|
-| Builtin | `~/.pi/agent/extensions/subagent/agents/` |
-| User | `~/.pi/agent/agents/**/*.md` |
-| Project | `.pi/agents/**/*.md` |
+| Builtin | bundled with `@bastani/atomic` / `~/.atomic/agent/extensions/subagent/agents/` |
+| User | `~/.atomic/agent/agents/**/*.md` |
+| Project | `.atomic/agents/**/*.md` |
-Project discovery also reads legacy `.agents/**/*.md` files. Nested subdirectories are discovered recursively. `.chain.md` files do not define agents. If both `.agents/` and `.pi/agents/` define the same parsed runtime agent name, `.pi/agents/` wins. Use `agentScope: "user" | "project" | "both"` to control discovery; `both` is the default and project definitions win runtime-name collisions.
+Project discovery also reads legacy `.agents/**/*.md` and `.pi/agents/**/*.md` files. Nested subdirectories are discovered recursively. `.chain.md` files do not define agents. If primary Atomic and legacy paths define the same parsed runtime agent name, the primary `.atomic/agents/` definition wins. Use `agentScope: "user" | "project" | "both"` to control discovery; `both` is the default and project definitions win runtime-name collisions.
-Builtin agents load at the lowest priority, so a user or project agent with the same name overrides them. They do not pin a provider model; they inherit your current Pi default model unless you set `subagents.agentOverrides.<name>.model`. `oracle` is an advisory reviewer that critiques direction and proposes an execution prompt without editing files. `worker` is the implementation agent for normal tasks and approved oracle handoffs.
+Builtin agents load at the lowest priority, so a user or project agent with the same name overrides them. They do not pin a provider model; they inherit your current Atomic default model unless you set `subagents.agentOverrides.<name>.model`. `oracle` is an advisory reviewer that critiques direction and proposes an execution prompt without editing files. `worker` is the implementation agent for normal tasks and approved oracle handoffs.
 The `researcher` builtin uses `web_search`, `fetch_content`, and `get_search_content`; those require [pi-web-access](https://github.com/nicobailon/pi-web-access):
@@ -375,8 +379,8 @@ pi install npm:pi-web-access
 You can override selected builtin fields without copying the whole agent. Overrides live in settings:
-- User: `~/.pi/agent/settings.json`
-- Project: `.pi/settings.json`
+- User: `~/.atomic/agent/settings.json` (legacy: `~/.pi/agent/settings.json`)
+- Project: `.atomic/settings.json` (legacy: `.pi/settings.json`)
 Example:
@@ -459,6 +463,7 @@ Important fields:
 | `defaultReads` | Files to read before running in chain/parallel behavior. |
 | `defaultProgress` | Maintain `progress.md`. |
 | `interactive` | Parsed for compatibility but not enforced in v1. |
+| `completionGuard` | Set to `false` to intentionally opt this agent out of automatic completion-guard reminders. Use sparingly for user-authored read-only/review agents whose prompt already prevents premature completion. |
 | `maxSubagentDepth` | Tightens nested delegation for this agent’s children. |
 ### Tool and extension selection
@@ -493,8 +498,8 @@ Chains are reusable `.chain.md` workflows stored separately from agent files.
 | Scope | Path |
 |-------|------|
-| User | `~/.pi/agent/chains/**/*.chain.md` |
-| Project | `.pi/chains/**/*.chain.md` |
+| User | `~/.atomic/agent/chains/**/*.chain.md` |
+| Project | `.atomic/chains/**/*.chain.md` |
 Nested subdirectories are discovered recursively. If user and project scopes define the same parsed runtime chain name, the project chain wins. Chains support the same optional `package` frontmatter as agents; `name: review-flow` plus `package: code-analysis` runs as `code-analysis.review-flow`.
@@ -555,13 +560,15 @@ Skills are `SKILL.md` files injected into an agent’s system prompt.
 Discovery uses project-first precedence:
-1. `.pi/skills/{name}/SKILL.md`
+1. `.atomic/skills/{name}/SKILL.md`
 2. Project packages and project settings packages via `package.json -> pi.skills`
 3. Current task cwd package via `package.json -> pi.skills`
-4. `.pi/settings.json -> skills`
-5. `~/.pi/agent/skills/{name}/SKILL.md`
+4. `.atomic/settings.json -> skills`
+5. `~/.atomic/agent/skills/{name}/SKILL.md`
 6. User packages and user settings packages via `package.json -> pi.skills`
-7. `~/.pi/agent/settings.json -> skills`
+7. `~/.atomic/agent/settings.json -> skills`
+Legacy `.pi` and `~/.pi/agent` skill/settings paths are also checked for compatibility.
 Use agent defaults, override them at runtime, or disable them:
@@ -585,7 +592,7 @@ Missing skills do not fail execution. The result summary shows a warning.
 ### Bundled skill
-The package bundles a `pi-subagents` skill that is automatically available to the parent agent when the extension is installed. It is for the orchestrating parent only: child subagents never receive it, and their context is explicitly filtered to strip parent-only orchestration instructions.
+The package bundles a `subagent` skill that is automatically available to the parent agent when the extension is installed. It is for the orchestrating parent only: child subagents never receive it unless explicitly authorized for fanout, and their context is filtered to strip parent-only orchestration instructions.
 What the bundled skill covers:
 - **Delegation patterns**: when to launch which agent, whether to use single, parallel, chain, or async mode, and whether to use fresh or forked context
@@ -775,7 +782,7 @@ After a worktree parallel step completes, per-agent diff stats are appended to t
 ## Configuration
-`pi-subagents` reads optional JSON config from `~/.pi/agent/extensions/subagent/config.json`.
+Atomic subagents read optional JSON config from `~/.atomic/agent/extensions/subagent/config.json` and still check the legacy `~/.pi/agent/extensions/subagent/config.json` path for compatibility.
 ### `asyncByDefault`
@@ -809,7 +816,7 @@ Forces depth-0 single, parallel, and chain runs into background mode and bypasse
 ### `defaultSessionDir`
 ```json
-{ "defaultSessionDir": "~/.pi/agent/sessions/subagent/" }
+{ "defaultSessionDir": "~/.atomic/agent/sessions/subagent/" }
 ```
 Session directory precedence is: `params.sessionDir`, then `config.defaultSessionDir`, then a directory derived from the parent session. Sessions are always enabled.
@@ -838,9 +845,9 @@ Controls whether subagents receive runtime intercom coordination instructions an
 Fields:
 - `mode`: default `always`; use `fork-only` to inject only for forked runs, or `off` to disable the bridge.
-- `instructionFile`: optional Markdown template replacing the default bridge instructions. `{orchestratorTarget}` is interpolated. Relative paths resolve from `~/.pi/agent/extensions/subagent/`.
+- `instructionFile`: optional Markdown template replacing the default bridge instructions. `{orchestratorTarget}` is interpolated. Relative paths resolve from `~/.atomic/agent/extensions/subagent/` (or the legacy `~/.pi/agent/extensions/subagent/` path when used).
-Bridge activation also requires `pi-intercom` to be installed and enabled through `pi install npm:pi-intercom` or a legacy local extension checkout, a targetable current session name or fallback alias, and `pi-intercom` in any explicit agent `extensions` allowlist.
+Bridge activation also requires the Atomic intercom companion (or upstream `pi-intercom` installed through `pi install npm:pi-intercom` / a legacy local extension checkout), a targetable current session name or fallback alias, and the intercom extension in any explicit agent `extensions` allowlist.
 The default injected guidance tells children to use `contact_supervisor` with `reason: "need_decision"` when blocked or needing a decision, `reason: "progress_update"` only for meaningful blocked/progress updates, generic `intercom` as fallback plumbing, and avoid routine completion handoffs.
@@ -868,7 +875,7 @@ stdin is a JSON object with `repoRoot`, `worktreePath`, `agentCwd`, `branch`, `i
 Each chain run creates a user-scoped temp directory like:
 ```text
-<tmpdir>/pi-subagents-<scope>/chain-runs/{runId}/
+<tmpdir>/atomic-subagents-<scope>/chain-runs/{runId}/
 ```
 It may contain files such as `context.md`, `plan.md`, `progress.md`, and `parallel-{stepIndex}/.../output.md`. Directories older than 24 hours are cleaned up on extension startup.
@@ -889,7 +896,7 @@ Async completions notify only the originating session. The result watcher emits
 Async runs write:
 ```text
-<tmpdir>/pi-subagents-<scope>/async-subagent-runs/<id>/
+<tmpdir>/atomic-subagents-<scope>/async-subagent-runs/<id>/
   status.json
   events.jsonl
   output-<n>.log
@@ -924,7 +931,7 @@ By default, nesting is limited to two levels: main session → subagent → sub-
 Configure the limit with:
-1. `PI_SUBAGENT_MAX_DEPTH` before starting Pi
+1. `ATOMIC_SUBAGENT_MAX_DEPTH` (or legacy `PI_SUBAGENT_MAX_DEPTH`) before starting Atomic
 2. `config.maxSubagentDepth`
 3. `maxSubagentDepth` in agent frontmatter, which can only tighten the inherited limit

package/dist/builtin/subagents/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.8.13",
+  "version": "0.8.14",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with chains, parallel execution, and TUI clarification. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/subagents/skills/subagent/SKILL.md CHANGED Viewed

@@ -159,8 +159,8 @@ For implementation handoffs to `debugger` or `code-simplifier`, name the approve
 Settings locations:
-- User scope: `~/.pi/agent/settings.json`
-- Project scope: `.pi/settings.json`
+- User scope: `~/.atomic/agent/settings.json` (legacy: `~/.pi/agent/settings.json`)
+- Project scope: `.atomic/settings.json` (legacy: `.pi/settings.json`)
 Direct settings example:
@@ -184,14 +184,14 @@ Useful override fields: `model`, `fallbackModels`, `thinking`, `systemPromptMode
 Agent files can live in:
-- `~/.pi/agent/agents/**/*.md` — user scope
-- `.pi/agents/**/*.md` — canonical project scope
-- legacy `.agents/**/*.md` — still read for compatibility, but `.pi/agents/` wins on conflicts
+- `~/.atomic/agent/agents/**/*.md` — user scope
+- `.atomic/agents/**/*.md` — canonical project scope
+- legacy `.agents/**/*.md` and `.pi/agents/**/*.md` — still read for compatibility, but `.atomic/agents/` wins on conflicts
 Chains live in:
-- `~/.pi/agent/chains/**/*.chain.md` — user scope
-- `.pi/chains/**/*.chain.md` — project scope
+- `~/.atomic/agent/chains/**/*.chain.md` — user scope
+- `.atomic/chains/**/*.chain.md` — project scope
 Discovery is recursive. `.chain.md` files do not define agents. Agents and chains can set optional frontmatter `package: code-analysis`; `name: codebase-analyzer` plus `package: code-analysis` registers as runtime name `code-analysis.codebase-analyzer` while serialization keeps `name` and `package` separate.
@@ -390,7 +390,7 @@ subagent({
 ## Subagent + Intercom Coordination
-`pi-subagents` works without `pi-intercom`. When `pi-intercom` is installed and enabled, the intercom bridge can automatically give child agents a private coordination channel back to the parent session.
+Atomic subagents work without intercom. When Atomic's bundled intercom companion or upstream `pi-intercom` is installed and enabled, the intercom bridge can automatically give child agents a private coordination channel back to the parent session.
 The builtin specialists in this skill do not declare the `intercom` tool, so they finish their pass and return without coordinating. They cannot pause to ask the parent for a decision mid-run; if you need that, write a custom agent that lists `intercom` (or that the runtime bridge can inject `contact_supervisor` into).
@@ -419,7 +419,7 @@ Message conventions:
 - `reason: "need_decision"` waits for the parent reply and returns it to the child.
 - `reason: "progress_update"` is non-blocking and should stay concise.
-- Child-side routine completion handoffs are not expected. With the intercom bridge active, parent-side `pi-subagents` sends grouped completion results through `pi-intercom`: one grouped message per foreground parent run and one per completed async result file. Acknowledged foreground delivery returns a compact receipt with artifact/session paths; if unacknowledged, the normal full output is preserved.
+- Child-side routine completion handoffs are not expected. With the intercom bridge active, parent-side subagents send grouped completion results through the intercom companion: one grouped message per foreground parent run and one per completed async result file. Acknowledged foreground delivery returns a compact receipt with artifact/session paths; if unacknowledged, the normal full output is preserved.
 Most agents should not call generic `intercom` directly unless bridge instructions provide a target and `contact_supervisor` is unavailable. Do not invent a target.
@@ -510,7 +510,7 @@ For many customizations, builtin overrides in settings are lower-friction than c
 The package includes prompt shortcuts for common workflows: `/parallel-review`, `/review-loop`, `/parallel-research`, `/parallel-context-build`, `/parallel-handoff-plan`, `/gather-context-and-clarify`, and `/parallel-cleanup`. Use them when the user wants repeatable review, review/fix loops, research, context handoff, implementation handoff, clarification, or cleanup-review patterns. `/parallel-review autofix` launches a `debugger` or `code-simplifier` writer (depending on feedback shape) to apply the synthesized fixes worth doing now. `/parallel-cleanup autofix` launches one `code-simplifier` writer to apply the synthesized cleanup fixes. Parent agents can also apply the same recipes directly with `subagent(...)` when the user describes the workflow in natural language instead of invoking a slash command.
-If `pi-prompt-template-model` is installed, additional user prompt templates can delegate into `pi-subagents`. This is useful when a slash command should always run through a particular agent or with forked context.
+If a prompt-template extension is installed, additional user prompt templates can delegate into subagents. This is useful when a slash command should always run through a particular agent or with forked context.
 ## Important Constraints
@@ -607,7 +607,7 @@ For complex work, risky changes, broad refactors, or many changed lines, increas
 For very large work, split into serial milestones instead of launching a swarm of writers. Each milestone gets one writer, a validation contract, fresh-context review, a fix pass, and parent acceptance before the next milestone starts. Use parallel subagents inside a milestone for read-only context, research, and review only.
-Keep orchestration authority in the parent session. Child subagents should not launch more subagents, read this skill, or run their own orchestration loops. Spawned subagents do not receive the `subagent` skill, parent-only status/control/slash messages, prior parent `subagent` tool-call/tool-result artifacts, or the `subagent` extension tool. Child context filtering also strips old hidden orchestration-instruction messages when they appear in inherited history. Every child also receives a boundary instruction that says the parent owns orchestration, the child must not propose or run subagents, and writer children must call real edit/write tools instead of printing pseudo tool calls. Pass children concrete role-specific work instead.
+Keep orchestration authority in the parent session. Child subagents should not launch more subagents, read this skill, or run their own orchestration loops unless the parent intentionally selected an explicit fanout agent whose resolved builtin `tools` includes `subagent` for that assigned fanout. Spawned non-fanout subagents do not receive the `subagent` skill, parent-only status/control/slash messages, prior parent `subagent` tool-call/tool-result artifacts, or the `subagent` extension tool. Child context filtering also strips old hidden orchestration-instruction messages when they appear in inherited history. Every child also receives a boundary instruction that says the parent owns orchestration, the child must not propose or run subagents unless explicitly authorized for fanout, and writer children must call real edit/write tools instead of printing pseudo tool calls. Pass children concrete role-specific work instead.
 1. Clarify first. Gather code context with `codebase-locator`, `codebase-analyzer`, `codebase-pattern-finder`, and prior research specialists; add `codebase-online-researcher` only when external evidence matters; then ask the user clarifying questions with `interview` until scope, acceptance criteria, constraints, and non-goals are clear.
 2. Define the validation contract. State what done means before implementation: expected behavior, checks to run, user flows to exercise, and evidence required in the writer handoff. For UI, CLI, integration, or workflow changes, include at least one validator angle that uses the product the way a user would rather than only reading code.

package/dist/builtin/subagents/src/agents/agent-management.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { CONFIG_DIR_NAME } from "@bastani/atomic";
 import type { AgentToolResult } from "@earendil-works/pi-agent-core";
+import { CONFIG_DIR_NAME } from "@bastani/atomic";
 import type { ExtensionContext } from "@bastani/atomic";
 import {
 	type AgentConfig,
@@ -298,6 +298,10 @@ function applyAgentConfig(target: AgentConfig, cfg: Record<string, unknown>): st
 			target.maxSubagentDepth = cfg.maxSubagentDepth;
 		} else return "config.maxSubagentDepth must be an integer >= 0 or false when provided.";
 	}
+	if (hasKey(cfg, "completionGuard")) {
+		if (typeof cfg.completionGuard !== "boolean") return "config.completionGuard must be a boolean when provided.";
+		target.completionGuard = cfg.completionGuard;
+	}
 	return undefined;
 }
@@ -367,6 +371,7 @@ function formatAgentDetail(agent: AgentConfig): string {
 	if (agent.defaultReads?.length) lines.push(`Reads: ${agent.defaultReads.join(", ")}`);
 	if (agent.defaultProgress) lines.push("Progress: true");
 	if (agent.maxSubagentDepth !== undefined) lines.push(`Max subagent depth: ${agent.maxSubagentDepth}`);
+	if (agent.completionGuard === false) lines.push("Completion guard: false");
 	if (agent.systemPrompt.trim()) lines.push("", "System Prompt:", agent.systemPrompt);
 	return lines.join("\n");
 }

package/dist/builtin/subagents/src/agents/agent-serializer.ts CHANGED Viewed

@@ -21,6 +21,7 @@ export const KNOWN_FIELDS = new Set([
 	"defaultProgress",
 	"interactive",
 	"maxSubagentDepth",
+	"completionGuard",
 ]);
 function joinComma(values: string[] | undefined): string | undefined {
@@ -70,6 +71,7 @@ export function serializeAgent(config: AgentConfig): string {
 	if (typeof maxSubagentDepth === "number" && Number.isInteger(maxSubagentDepth) && maxSubagentDepth >= 0) {
 		lines.push(`maxSubagentDepth: ${maxSubagentDepth}`);
 	}
+	if (config.completionGuard === false) lines.push("completionGuard: false");
 	if (config.extraFields) {
 		for (const [key, value] of Object.entries(config.extraFields)) {