@bastani/atomic 0.9.10-alpha.1 → 0.9.10

package/CHANGELOG.md

@@ -2,6 +2,72 @@
 
 ## [Unreleased]
 
+## [0.9.10] - 2026-07-20
+
+### Breaking Changes
+
+- The bundled `workflow` tool no longer accepts direct one-off `task`, `tasks`, or `chain` shapes (or their direct-only top-level options), and the bundled workflow SDK no longer exports `runTask`, `runParallel`, or `runChain`. Launch named workflows with `workflow` + `inputs`, and author custom definitions with the unchanged `ctx.task`, `ctx.chain`, and `ctx.parallel` primitives.
+- Bundled workflow durability now requires DBOS/Postgres and no longer provides local JSON/SQLite persistence, runtime opt-out/backend selection, session-transcript discovery, or conversion of prior durable data.
+- Added a host-native session picker capability, `ctx.ui.hostSessionPicker(request)`, implemented first-class by every interactive host with one identical API: non-isolated interactive mode mounts the real built-in session selector directly in the terminal process (no IPC), and the isolated interactive engine routes the same capability over a new engine session-picker protocol channel (`engine_session_picker_open/update/error/close` messages and `engine_session_picker_select/cancel/delete` commands). The extension ships JSON-safe rows (`HostSessionPickerRow` — `SessionInfo` with `createdAt`/`modifiedAt` epoch millis) and only semantic events ever cross a process boundary; arrow-key navigation and search are zero-IPC and stay responsive even while the extension's event loop is busy, unlike remote-rendered `ctx.ui.custom()` components, which pay one round trip per keypress. Deletion is extension-owned: the host keeps the row until the extension replies with an update (row removed) or an error. Pickers are disposed cleanly on extension-initiated close and on engine crash/restart. The bundled `/workflow resume` picker now REQUIRES this capability — its remote-rendered `ctx.ui.custom()` selector path was removed with no fallback, and hosts without the capability fail the resume command with one actionable error. The member is absent only on non-interactive surfaces (headless RPC, print). See `docs/tui.md` and `docs/extensions.md`.
+
+### Added
+
+- Added private compaction-planner diagnostic sidecars for failed persisted-session planner calls. Malformed output, unusable ranges, provider errors, and stream failures now save the full response text plus stop reason, usage, request output budget, and non-secret model metadata beside the session JSONL with `0600` permissions where supported; the compaction error reports that path. Credentials, headers, and request prompts are excluded, while in-memory sessions and sidecar write failures preserve the original `RangePlanError` unchanged.
+- Replaced the compaction planner output format from JSON `{"d":[[start,end],...]}` with bare `start,end` records (one per line, no brackets/fences/prose). The new format is ~1% more token-efficient at equivalent range counts and enables trivial newline-based length-truncation recovery.
+- Added silent recovery of complete deletion records from length-truncated compaction planner responses. When the model output is cut by `max_tokens` (`stopReason: "length"`), a deterministic line parser recovers newline-terminated `start,end` records, discards the final unterminated fragment (never guesses multi-digit integers), and passes results through normal validation. Recovery is silent: no warning, banner, or special status—UI shows the normal `✻ Context compacted` message. A private `0600` recovery-diagnostic sidecar is written beside persisted sessions for operational observability (never surfaced in UI). The planner prompt now instructs the model to emit ranges in descending deletion confidence so the highest-priority deletions survive truncation.
+- Added six bundled, composable pattern workflow definitions — `classify-and-act`, `fan-out-and-synthesize`, `adversarial-verification`, `generate-and-filter`, `tournament`, and `loop-until-done` — with typed/defaulted inputs, dedicated artifact-aware stage prompts, declared outputs, named discovery, and `@bastani/workflows/builtin` exports for nested `ctx.workflow(...)` composition.
+- Added `ctx.ui.hostInputForm(request)`, a JSON-safe host-native structured-form capability implemented identically by isolated and non-isolated interactive hosts. The terminal host owns inline rendering, focus, validation, configured keybindings, and editing state; under engine isolation only open and submit/cancel semantic events cross the protocol boundary. Headless RPC and print surfaces omit the optional member.
+- Added `/workflows [run-id]` as a retained workflow-run alias for `/workflow resume`, with confirmed backend-aware deletion for inactive durable/completed rows that protects in-flight runs and preserves independent session transcripts.
+- Added supervised interactive-engine isolation: extension tools, hooks, commands, workflow code, and custom UI rendering now run in a child process so a synchronous busy loop cannot freeze terminal input, spinners, or rendering. A 50 ms heartbeat watchdog identifies blocked callbacks after 250 ms, exposes interrupt/termination guidance after one second, and reports terminated results as unknown without automatic retry. JSON-safe `ctx.ui.custom()` components are remotely rendered with asynchronous input forwarding; unsupported synchronous host callback APIs warn instead of falling back in-process.
+- Added a typed, allowlisted host-terminal control channel for isolated `ctx.ui.custom()` components. An overlay factory's `tui.terminal` now exposes `setMouseScrollTracking(enabled)` and `setAutowrap(enabled)` setters that the terminal host applies to the real host TTY over the engine protocol — the engine child (whose stdout is the JSONL transport, not a TTY) can enable SGR mouse-scroll reporting and Windows autowrap without ever forwarding raw child bytes to the terminal. Controls are component/generation scoped and every enabled mode is reset when the overlay hides, closes, is disposed, or the engine child crashes/restarts. See `docs/tui.md`.
+- Added live-updating, semantically colored rows to the bundled `/workflow resume` picker: completed rows render green, paused yellow, and failed/blocked/crashed red (`SessionInfo.messageColor` now also accepts `"error"`). Rows re-list on run-store changes and a bounded cross-session poll while the picker is open, and running workflows are never offered as resume targets — a fresh-heartbeat running row is hidden from every session, and only stale (crashed) ones surface, labeled `crashed`.
+- Added `atomic update --models` to force-refresh authenticated dynamic provider catalogs with bounded, provider-scoped persistence and actionable failures ([#1875](https://github.com/bastani-inc/atomic/issues/1875)).
+
+### Changed
+
+- Promoted the DBOS SDK and `embedded-postgres` to mandatory dependencies. Atomic configures and launches DBOS lazily on the first workflow action, awaits readiness before every workflow lifecycle path, and surfaces initialization or persistence failures for that action instead of continuing on another backend. Without `DBOS_SYSTEM_DATABASE_URL`, workflow durability runs on an embedded Postgres from npm-distributed binaries (detached daemon under `~/.atomic/postgres`, shared across sessions; Docker `dbos-db` container only as a platform fallback). Concurrent Atomic sessions sharing one database use per-process executor identities, owner/heartbeat metadata, and first-writer-wins resume claims so one session's live workflow cannot be double-dispatched from another.
+- Documented and enforced `/resume`-equivalent workflow-history retention: eligible runs are not filtered or garbage-collected by age/count, and the selector viewport does not limit search/navigation.
+- Kept the interactive-engine watchdog's early 250 ms blocking signal internal instead of rendering repetitive "has not yielded" warnings during ordinary slow extension/tool loading. One-second unresponsive heartbeat-watchdog diagnostics are likewise always kept internal, whether or not they attribute a callback (for example, `extension.hook tool_execution_end`); the isolated host remains responsive and still provides Escape/Ctrl+C recovery controls. Concrete engine failures such as termination and RPC errors continue to surface as chat errors.
+- Changed verbatim compaction to classify the complete active transcript except for exactly the newest `preserve_recent` context-visible messages (default `2`). The protected tail is no longer widened to a user-turn boundary, `preserve_recent: 0` now retains no ordinary message, and repeated compaction includes the prior durable verbatim summary while preserving resumable session boundaries.
+- Redesigned the `/workflow <name>` input form (shown when a named workflow is launched with required inputs missing). The form now renders inside a rounded, theme-aware panel titled `WORKFLOW INPUTS` with the workflow name and field count, matching the workflow catalogue's visual language: each field shows a focus chevron, an accent field name when active, and a right-aligned `required`/`optional` badge (required in the warning color); descriptions use the readable muted tone, validation errors render as a `✗ reason` row, the submit control is a `[ Run workflow ]` button pill (filled accent when focused), and the footer uses accent key chips. Multi-line text inputs blend their inset rules into the panel border, the panel scales to the full terminal width like the other chat surfaces, and the embedded editor cursor stays correctly positioned.
+- Migrated model authentication and refresh to Pi's provider-owned APIs while preserving Atomic's public `AuthStorage`, `ModelRegistry`, SDK options, legacy extension OAuth registration, complete request headers, and credential-specific enterprise endpoints. The model picker now shows cached models immediately and reports concise success, partial-error, and timeout status ([#1875](https://github.com/bastani-inc/atomic/issues/1875)).
+
+### Fixed
+
+- Fixed the repository `publish-release` workflow to reconcile an exact release PR merged externally while required checks are pending. It preserves identity/refs/SHA; correlates workflow-qualified Actions reruns by name plus workflow; and supports empty-workflow `StatusContext` and GitHub App `CheckRun` evidence. Linked reruns group by inferred kind/name across URL changes; linkless rows inspect both external kinds, accept all-passing candidates, block any pending/failure, and exclude nonempty-workflow Actions. Duplicate aliases reuse exact passing evidence. It rechecks after merge and validates merge/branch evidence. Tag recovery proves `verified merge → tag parent → current base`; exhaustive history avoids GitHub's 1,000-result ceiling; protected coordination retains its lock through ambiguous dispatch visibility; and recovered success requires exact-SHA integrity evidence.
+- Fixed shared extension chat compaction rendering so manual, threshold, and overflow compaction use the animated working spinner with reason-aware copy instead of a duplicate plain status row plus generic `Working...`; successful compaction now falls back to the existing typed `✻ Context compacted` message when a refreshed live session snapshot is unavailable, while preserving durable session reconstruction and avoiding duplicate boundaries.
+- Fixed workflow stage-chat `/compact` cancellation and planner/provider failures from escaping their fire-and-forget editor submission promise and terminating the CLI. The authoritative `compaction_end` event now owns the visible status, animation cleanup, and diagnostic path while the same stage remains usable for retry or follow-up.
+- Fixed OpenAI Responses, Codex Responses, and OpenAI Completions context accounting to sum their normalized uncached and cached input partitions even when the values are nearly equal. Anthropic Messages retains its mirrored-cache guard, preventing missed auto-compaction thresholds, understated footer usage, and negative persisted reduction percentages on Codex sessions.
+- Fixed workflow-stage message admission races by adding a linearizable AgentSession generation boundary. Intercom traffic and async bash/subagent completions received before close now use native queued steering/follow-up delivery and drain before terminal stage publication; close-winning detached results route once to the main chat without reopening or mutating the completed stage. Detached producers remain non-blocking, stable producer identities prevent duplicate delivery, and explicit `StageContext.sendUserMessage` plus post-mortem stage chat remain available.
+- Fixed asynchronous extension custom-message admission to return its delivery promise through `pi.sendMessage()` and `pi.sendMessages()`, allowing workflow late-message routers to propagate main-chat failures and release stable producer keys for retry instead of treating rejected routes as successful.
+- Fixed bundled workflow stages freezing when an active foreground subagent used Intercom or blocking `contact_supervisor`. Busy stages give the exact child owner's acknowledged detach handshake first refusal before model-visible stage-session queue insertion; owner loss between probe/commit falls back instead of dropping the broker message. In parallel foreground groups, one accepted commit releases aggregate supervision for all active siblings while their child processes and eventual result/status recovery remain owned; run-owned worktrees are retained until every detached child closes and their diffs are captured.
+- Fixed bundled workflow-stage `intercom.ask` delivery when the target sibling is mid-turn in an in-flight tool call. The open generation now owns the ask before asynchronous foreground-owner coordination begins, waits for its native queue insertion, and drains it before terminal publication; genuinely failed destination admission returns a correlated actionable error rather than consuming the full reply timeout.
+- Fixed `/workflow <name>` input forms becoming non-responsive under interactive-engine isolation. The RPC extension surface advertised `setEditorComponent` as a callable compatibility stub even though it could not install a host editor, so the workflow command waited on an editor that was never mounted while Tab and Escape stayed routed to the ordinary prompt. Named workflow forms now prefer the host-native input-form channel, keeping Tab/Shift+Tab, arrows, editing, configured keybindings, Enter, Escape, and Ctrl+C local and responsive in both interactive modes; cancellation does not dispatch the workflow, inline bottom-editor geometry is preserved, and legacy custom-editor/`ctx.ui.custom()` fallbacks remain available for older hosts.
+- Fixed Ctrl+O (`app.tools.expand`) being consumed without expanding tool and workflow-node detail in attached workflow stage chats under interactive-engine isolation. The child RPC UI facade retains one expansion state shared by its getter and chat render settings, and the remote custom-UI bridge now filters Kitty key-release events unless the child component explicitly opts into them, preventing one physical Ctrl+O press from immediately toggling expansion back off. Repeated expand/collapse toggles match main chat across active and completed runs, single/parallel/chain views, and narrow terminals without changing prompt, custom-UI, or unrelated key ownership.
+- Fixed bundled workflow-stage `intercom.ask` calls hanging when the addressed sibling stage had already completed. Atomic now schedules a post-mortem turn in the completed target's retained conversation, preserves the exact child-to-child reply thread, prevents parent or unrelated sessions from satisfying it, and returns bounded actionable errors for unavailable or non-resumable retained targets. Production workflow and Intercom late-message listeners preserve the first owner's completion promise regardless of registration order, so later or duplicate listeners cannot turn revival failures into silent no-ops ([#1854](https://github.com/bastani-inc/atomic/issues/1854)).
+- Fixed tool results being able to push the active Pi loop past Atomic's buffered compaction threshold before its next provider request. Atomic now performs one ordinary verbatim compaction preflight after tool results enter the prospective next-turn context, returns the rebuilt protocol-valid context to the same loop without scheduling `agent.continue()`, leaves below-threshold turns unchanged, surfaces compaction cancellation/failure, and blocks a follow-up request that remains known to exceed the provider hard input limit.
+- Fixed the interactive TUI dropping its working spinner after successful post-tool autocompaction while the same agent stream continued. The normal working indicator is now restored immediately at the mid-turn compaction boundary, without waiting for the user's next interaction.
+- Fixed bundled workflow stage messaging to distinguish idle sessions from active streams: idle `followUp`/eligible `auto` sends now start a real prompt and report `prompt`, streaming follow-ups queue and steering stays in-turn, paused idle-chat `resume(message)` starts exactly one recorded turn, and interrupted-turn resume, abort/exit guards, and at-most-once continuation behavior remain intact ([#1850](https://github.com/bastani-inc/atomic/issues/1850)).
+- Fixed Escape during isolated-engine compaction timing out with `Timeout waiting for response to abort_compaction`. RPC input now keeps ordinary commands FIFO while validated cancellation and host-response control frames use an independent lane, so `abort_compaction` reaches the active engine session before the pending `compact` request settles; duplicate and late aborts remain harmless, and ordinary command ordering is preserved.
+- Fixed interactive non-schema workflow stages treating typed/freeform `ask_user_question` chat answers as an invisible implicit “stay”. The conversational acknowledgement now completes first, then a real brokered readiness gate exposes `awaiting_input`/`inputRequest.kind: "readiness_gate"`; in that chat flow, Not ready permits another stage-chat turn and re-prompts, while Ready releases dependents. Structured-option behavior remains unchanged, and successful schema finalization stays terminal. ([#1849](https://github.com/bastani-inc/atomic/issues/1849))
+- Fixed the bundled workflow `BACKGROUND` panel's elapsed timer remaining at `0s` until the user switched to the orchestrator. Visible running cards now repaint their existing mounted component on exact one-second boundaries from workflow start, without panel navigation or widget remounting; paused timers remain frozen and ended cards retain their one-shot expiry lifecycle.
+- Fixed the interactive TUI crashing with `Rendered line N exceeds terminal width` (uncaught exception in pi-tui `doRender`) when the terminal was resized — most visibly when shrinking an active session with chat history (e.g. 112 → 83 columns) or fuzz-resizing mid-turn. Under the isolated interactive engine, tool cards and custom messages render out-of-process and asynchronously: after a resize they kept replaying the previous frame wrapped for the old width until the engine child delivered a re-wrapped one, so pi-tui's differential renderer could see lines wider than the terminal and abort the whole session. Remote frames are now defensively clamped to the current render width while the engine catches up, so grow/shrink resizing (including rapid adversarial flapping) never emits an overflowing line; properly re-wrapped frames still replace the clamped ones as soon as they arrive.
+- Fixed the startup banner logo wrapping and shredding into misaligned art on narrow terminals: the identity header is now width-aware, keeping the side-by-side logo/meta layout only when every combined row fits, stacking the identity text (version, provider/model, cwd) under the logo when the meta column would wrap, and dropping the logo art entirely when the terminal is narrower than the logo itself. The layout re-adapts on every terminal resize.
+- Fixed adjacent assistant thinking blocks rendering as separate sections, Windows package checks leaving npm's terminal title behind, standalone Bun binaries omitting interactive OAuth adapters, and clone/fork attempts before the first assistant response returning an unhelpful failure ([#1875](https://github.com/bastani-inc/atomic/issues/1875)).
+- Stopped the isolated interactive engine's extension-level `requestRender()` from invalidating hidden remote overlay components ([#1856](https://github.com/bastani-inc/atomic/issues/1856)). The broadcast now skips components whose remote OverlayHandle is hidden (`setHidden(true)`/`hide()`), so widget-local updates do not trigger host render work for hidden graph/stage frames; shown-again components rejoin the broadcast immediately.
+- Reduced keypress latency for all remotely rendered extension custom UI (workflow inputs forms, graph overlays, and other `ctx.ui.custom()` components) under the isolated interactive engine. The host now pipelines a fresh frame request directly behind every forwarded keypress — engine commands are delivered in order, so the returned frame always reflects the applied input. This cuts the previous input → child-invalidate → render-request → frame path to a single round trip and repaints components that change state on input without self-invalidating.
+- Fixed the mouse wheel scrolling native/main-chat scrollback instead of the workflow graph when a durable workflow overlay was resumed under the isolated interactive engine. The overlay adapter runs inside the engine child, whose stdout is the JSONL transport rather than a TTY, so its `process.stdout` mouse-tracking escape sequences never put the real host terminal into mouse-reporting mode. The overlay now enables host mouse-scroll reporting (and Windows autowrap) through the new typed host-terminal control channel, so wheel gestures reach the remote `GraphView` and change graph scroll offsets while a visible overlay captures the mouse; keyboard navigation, stage-chat wheel capture, and Ctrl+T copy mode are unchanged. Resume selection deterministically disposes the inline picker before the fullscreen overlay mounts and takes focus, so a late picker cleanup can no longer steal focus or leave the graph as an inline/bottom component. Non-isolated hosts keep their local `process.stdout` behavior.
+- Fixed `/resume` and `/workflow resume` intermittently failing with `Timeout waiting for response to prompt` when the picker (or any long-lived interactive prompt) stayed open past 30 seconds. The isolated-engine RPC client now exempts long-lived interactive commands — prompts and custom-UI pickers, queued `steer`/`follow-up` sends, long shell and compaction work, `fork`/`clone`, session `switch`/`new`/`import`, tree navigation, and shortcut invocation — from the generic 30-second request deadline. Process exit, transport violations, abort, and generation replacement still reject pending requests immediately, and bounded metadata/control requests keep a (now injectable) deadline, so real failure detection is unchanged.
+- Made the `/resume` session selector mount and paint its header, search, and loading state on the very first frame, then discover and parse sessions off the host UI loop. Directory scans run in bounded cooperative batches and a single very large transcript is parsed in yielding chunks, so input, search, and cancel stay responsive and one large session can no longer visibly freeze the picker. Closing the selector now cancels in-flight loads and ignores stale results, preventing late list updates after close, scope switch, or a newer load.
+- Fixed a startup input race where typing a command-like draft such as a bare `/` before the header finished loading was reclassified as a submitted cooked-mode command and sent automatically. Raw startup capture now remains authoritative: only Enter-terminated submissions replay, while unfinished slash/bash drafts stay in the editor.
+- Fixed startup changelog and first-run onboarding notices being gated behind the deferred extension reload — and, when a prompt was typed immediately at launch, behind the entire first agent turn. They now render right after the input handler is ready (milliseconds after first paint), matching pi's behavior; the RESOURCES disclosure still waits for the actual extension load it reports on.
+- Reduced deferred extension-load stalls by yielding to the event loop between extension loads only when the current turn has actually run long (≥16 ms) instead of unconditionally — the previous unconditional yields cost a full macrotask turn (~100 ms each while the TUI is live) per bundled extension (~0.5 s of the deferred load).
+- Hardened the isolated interactive engine's runtime and transport. Best-effort RPC rejections are now centrally contained so a fire-and-forget path can no longer crash the host; Escape/cancel recovery is generation-fenced so a cancelled turn survives, the host stays alive, and the engine child is cleanly restarted. The child is the sole authoritative writer of transcript/settings state (host snapshots are side-effect-free, and model/thinking/name operations persist exactly once), and a guardian tracks the full process tree so forced host death leaves no orphaned engine or detached grandchild.
+- Hardened the interactive-engine JSONL transport against unbounded growth and frame loss. Framing is UTF-8 byte-bounded (not UTF-16 char counts), writers in both directions are byte-accounted with backpressure, update coalescing happens before serialization, and terminal/correlated frames are either delivered or fail immediately with an explicit protocol error and same-id rejection instead of a 30-second timeout.
+- Fixed the isolated interactive engine omitting extension slash commands (`/workflow`, its `/workflows` alias, `/run`, `/mcp`, and others) from autocomplete. Because the host session loads no extensions in the interactive-engine child model, those commands live only in the engine child; the host now fetches the child's command catalog asynchronously after engine bind (never delaying first paint or input), merges it into autocomplete with built-in names reserved and locally-present prompts/skills deduped, and re-fetches after engine restart, reload, and new/resume/fork. Command execution continues to route through the child with no duplicate host handling.
+- Fixed expandable skill, resource, built-in tool, MCP, and subagent headers losing their effective keybinding in the isolated interactive engine (for example, `[skill] tmux ( Expand)`). Child rendering and injected custom UI now share one reloadable Atomic keybinding manager, so the default displays `ctrl+o`, remaps display the configured key, and intentionally unbound expansion omits the unavailable shortcut affordance without malformed punctuation.
+- Fixed the TUI flickering with rapid full repaints (~58 Hz, plus idle CPU burn on both processes) whenever a tool card rendered under the isolated interactive engine during a streaming turn — most visibly when the `workflow` tool's `quit`/`pause` action ran while a workflow stage was streaming, though any tool call (e.g. a plain `bash` echo) reproduced it. The engine child's remote tool-card renderer disposed and recreated the `ToolExecutionComponent` on every `engine_tool_render` request, and re-seeding the fresh component unconditionally scheduled a render on its off-screen TUI whose terminal write emitted `engine_custom_invalidate` back to the host, which marked the card dirty and re-sent the render request — forever. The engine render service now reuses the cached component per remote component id (applying args/result/expansion/image-option updates in place) and the seeding setters (`markExecutionStarted`/`setArgsComplete`) are idempotent, so the loop converges after at most one invalidate round trip while legitimate async invalidations (such as image format conversion) still repaint.
+
 ## [0.9.10-alpha.1] - 2026-07-19
 
 ### Breaking Changes

package/dist/builtin/cursor/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.9.10] - 2026-07-20
+
+### Changed
+
+- Published the stable Atomic 0.9.10 release for the Cursor provider package; no functional Cursor provider changes were made after 0.9.9.
+
 ## [0.9.10-alpha.1] - 2026-07-19
 
 ### Changed

package/dist/builtin/cursor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/cursor",
-  "version": "0.9.10-alpha.1",
+  "version": "0.9.10",
   "private": true,
   "description": "Experimental first-party Atomic extension for Cursor OAuth, model discovery, and streaming provider registration.",
   "contributors": [
@@ -40,7 +40,7 @@
     }
   },
   "dependencies": {
-    "@bastani/atomic-natives": "0.9.10-alpha.1",
+    "@bastani/atomic-natives": "0.9.10",
     "@bufbuild/protobuf": "^2.12.1",
     "@earendil-works/pi-ai": "^0.80.10"
   }

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.10] - 2026-07-20
+
+### Added
+
+- Added intercom **groups** for broker-enforced session isolation. Every session belongs to exactly one group (implicitly `"default"` when unset), resolved with precedence `orchestrationContext.intercomGroup` (per-session workflow-stage injection) > env `ATOMIC_INTERCOM_GROUP` (legacy `PI_INTERCOM_GROUP`) > intercom `config.json` `"group"` > `"default"`. A session in group G can only message peers in G: cross-group sends are rejected at the broker (unresolvable by name via group-scoped candidate resolution, and rejected by an exact-id defense-in-depth check with reason "Target session is in a different intercom group"), not merely hidden from discovery. `session_joined`/`session_left`/`presence_update` broadcasts and `intercom list` are group-scoped, so a session never sees peers outside its group. The `intercom` tool gains an optional `group` parameter: read-only for `list`/`status` (peek who is in a named group and see your own group), while `send`/`ask` stay locked to your own group and error clearly on a differing group. The subagent-only `contact_supervisor` path uses a dedicated broker protocol plus a supervisor-issued child capability, and only an exact broker-recorded reverse reply may cross back, so isolated children retain their supervisor link without granting peer traffic a general bypass.
+
+### Fixed
+
+- Fixed busy workflow-stage messages being retained solely in Intercom's private wait-until-idle queue. Stage-targeted traffic is now admitted synchronously through the AgentSession generation boundary with stable message IDs, preserving native follow-up ordering and exactly-once delivery; close-winning late traffic is surfaced through the parent/main chat without mutating the terminal stage. Existing non-stage idle batching, terminal barriers, reply correlation, and shutdown generation cleanup are unchanged.
+- Fixed closed workflow-stage Intercom routing to avoid source-side pre-admission, reserve destination dedupe entries until main-chat delivery succeeds, roll back reply context on failure, propagate asynchronous route rejection, and permit a failed stable-key delivery to retry without duplicate parent-chat messages. A final retry survives source-stage retirement, and hosts without batch admission now commit successful fallback members individually so a partial failure retries only the undelivered suffix.
+- Fixed a cross-group isolation bypass where any registered raw client could forge `channel: "supervisor"` on an ordinary `send` frame. Ordinary sends now reject client-authored channel markers; the broker issues child-scoped supervisor capabilities, binds validated registrations to the issuing supervisor, derives the only authorized cross-group destination, and adds the trusted relay marker itself. Wrong targets/tokens, fabricated `replyTo` values, and ordinary peer sends remain isolated, while legitimate child requests and exact supervisor replies continue to cross groups. Parent-held capability state is restored after broker reconnects, the child uses the broker-confirmed current supervisor ID, and the lightweight wrapper lazy-loads the authorization provider before spawn. Claimed provider failures propagate; hosts without a provider omit supervisor metadata rather than launching a silently broken `contact_supervisor` channel.
+- Fixed workflow stages freezing when their active foreground subagent sent Intercom traffic or blocking `contact_supervisor`. Busy open stages give the exact foreground owner probe/commit detach handshake first refusal before model-visible queue insertion; unclaimed traffic and owner loss between probe/commit fall back to normal insertion instead of dropping a broker-delivered message. A commit from one parallel child releases aggregate foreground supervision for all active siblings while their processes and eventual results remain owned.
+- Fixed `intercom.ask` hanging when one workflow stage targeted a sibling stage that had already completed. Blocking late asks now retain their exact sender/thread correlation while the workflow runtime schedules the target's retained conversation for a post-mortem turn; only that target's correlated `intercom.reply` resolves the caller. The production workflow and Intercom listeners now preserve the first owner's completion promise regardless of registration order, preventing the lightweight Intercom relay or duplicate listeners from replacing or double-delivering a claimed revival. Missing, deleted, non-resumable, or failed-to-reopen targets return a bounded actionable tool error instead of waiting for the normal ask timeout, while ordinary late notifications retain their existing parent-chat route ([#1854](https://github.com/bastani-inc/atomic/issues/1854)).
+- Fixed blocking `intercom.ask` delivery to a sibling workflow stage that is mid-turn. Busy targets now reserve the message synchronously in the open AgentSession generation before awaiting foreground-owner detach, then drain the eventual native queue insertion before terminal snapshot publication. Destination-side admission failures return an exact-thread actionable tool error instead of leaving the asker blocked for the 10-minute reply timeout.
+
 ## [0.9.10-alpha.1] - 2026-07-19
 
 ### Added

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.10-alpha.1",
+  "version": "0.9.10",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.10] - 2026-07-20
+
+### Added
+
+- Added validated per-server MCP tool-call inactivity timeouts for local and remote servers, with progress-aware timer resets, user-readable timeout errors, and preserved host cancellation.
+
+### Fixed
+
+- Fixed collapsed MCP results showing a malformed or unavailable expand shortcut when `app.tools.expand` is remapped or unbound.
+- Preserved credential-specific `baseUrl` overrides for MCP sampling requests so enterprise/provider-owned endpoints are used alongside dynamic API keys and headers ([#1875](https://github.com/bastani-inc/atomic/issues/1875)).
+
 ## [0.9.10-alpha.1] - 2026-07-19
 
 ### Added

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.10-alpha.1",
+  "version": "0.9.10",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [0.9.10] - 2026-07-20
+
+### Added
+
+- Added a `group` option on subagent tasks, parallel/chain items, and the top-level call that sets the intercom home group for spawned children so same-group subagents can intercom each other while staying isolated from other groups. A named string joins that group; `true` auto-generates one shared UUID group per parallel set (shared across all items in the set). Precedence is `explicit subagent group > inherited current-session (stage) group > env ATOMIC_INTERCOM_GROUP > config > "default"`. When a subagent does not specify a group it inherits its launching session's group — read race-safely from the session's `orchestrationContext.intercomGroup` rather than global env — so subagents spawned by a grouped workflow stage join that stage's group by default. The child group env (`ATOMIC_INTERCOM_GROUP`) is written only when the child actually has intercom access (the peer `intercom` tool or the `contact_supervisor` tool); a child without intercom is never placed into a group. `contact_supervisor` retains cross-group supervisor access through a broker-issued child capability rather than a client-authored channel marker.
+
+### Changed
+
+- Reworked isolated parallel worktrees to use the canonical main repository's `.atomic/worktrees/` directory, `worktree-*` branches, remote-default/`HEAD` base resolution, local-settings/hooks/`.worktreeinclude` post-creation setup, and force-remove plus branch-delete cleanup, including setup-failure cleanup from linked-worktree invocations.
+
+### Fixed
+
+- Fixed async subagent completion notices racing workflow-stage finalization. Completion notifications now carry stable admission identities, join already-claimed terminal preludes as one stage batch when received before close, and route externally without terminal transcript mutation when close wins. Successful-notification deduplication, retry acknowledgement, terminal ordering, and detached non-blocking execution remain intact.
+- Fixed asynchronous terminal dispatch to defer its acknowledgement and successful-notification dedupe until custom-message admission settles. Rejected batch routes now restore claimed Intercom preludes and return a failed acknowledgement so the durable result watcher can retry the same stable notification ID.
+- Fixed foreground subagent supervisor coordination deadlocking when launched inside a busy workflow stage, including parallel foreground groups where a long-running sibling kept the aggregate tool call active after the asking child detached. The workflow parent now honors the exact-owner probe/commit handshake before stage AgentSession admission; one accepted parallel commit releases foreground supervision for all active siblings while retaining their process lifecycle and eventual result recovery, and tasks still queued behind the concurrency limit are skipped without launching unsupervised. Run-owned direct and chain-parallel worktrees remain alive until all detached children close, when diffs are captured before cleanup instead of deleting active execution roots. Blocking decisions and interviews can receive replies while direct single execution, background execution, cancellation, and status/result recovery remain intact.
+- Secured foreground, background, parallel, chain, revived, and bounded dynamic-fanout supervisor communication by requesting broker-issued authorizations before child spawn and passing each grant through dedicated child environment metadata. Foreground/single-child paths use exact child scopes; asynchronous chains use bounded per-child slots so dynamic fanout index shifts cannot invalidate later children. Descendants without a fresh grant explicitly clear inherited capability metadata, parent-held grants are restored after reconnects, and the lightweight Intercom wrapper lazy-loads authorization on demand. Claimed provider failures abort launch; hosts without a provider suppress supervisor metadata instead of leaving `contact_supervisor` silently unusable.
+- Fixed subagent live-detail and full-notification hints to use the effective `app.tools.expand` binding and omit the shortcut affordance when it is unbound.
+- Fixed completion-notification header parsing to avoid polynomial regular-expression behavior on long malformed agent/task text while preserving accepted notification formats.
+- Fixed session startup stalling on background-job hydration when the subagents run directory has accumulated many historical runs. Active-job hydration is now deferred off the `session_start` hot path and only eagerly reconciles runs touched within the last 7 days (older runs are skipped with two `stat` calls instead of a full per-run status read and reconciliation), so the jobs widget populates moments after startup without blocking first input.
+- Fixed a host-process crash from the background-job tracker's timers using a stale extension context. Deferred hydration, poller ticks, and cleanup timers hold onto contexts that become invalid after `ctx.newSession()`, `ctx.fork()`, `ctx.switchSession()`, or `ctx.reload()`; every context read in those timer paths is now probed defensively and a stale retained UI context is dropped instead of throwing an unhandled "extension ctx is stale" error out of an unref'd timer.
+
 ## [0.9.10-alpha.1] - 2026-07-19
 
 ### Added

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.10-alpha.1",
+  "version": "0.9.10",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with chains, parallel execution, and background runs. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/web-access/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.9.10] - 2026-07-20
+
+### Changed
+
+- Converted the reachable synchronous subprocess paths in video/YouTube extraction and the Glimpse browser-curator probe to a shared asynchronous Bun subprocess helper (`runBunSubprocess`). `ffmpeg` frame capture, `ffprobe`/`yt-dlp` duration and stream probes, and the global `npm root -g` lookup no longer block the event loop via `execFileSync`: each child now streams stdout/stderr concurrently into byte-capped buffers (binary-safe for JPEG frame output), enforces a timeout with `SIGTERM`→`SIGKILL` escalation, honors an optional caller `AbortSignal` with the same tree-kill escalation, and maps timeout/abort/non-zero-exit/`ENOENT`/output-overflow into typed errors that preserve the existing user-facing `ffmpeg`/`ffprobe`/`yt-dlp` failure messages. Video and YouTube extraction functions now thread an optional `AbortSignal` from callers that already own one, and the Glimpse module resolver caches a single in-flight global-root probe so concurrent curator opens never spawn duplicate `npm` processes.
+
+### Fixed
+
+- Fixed collapsed web-search results hardcoding `CTRL+O`; the line-count hint now uses the effective `app.tools.expand` binding and keeps its factual counts when expansion is unbound.
+- Preserved provider-owned null header suppression and credential-specific `baseUrl` overrides for search-query rewriting and summary generation ([#1875](https://github.com/bastani-inc/atomic/issues/1875)).
+
 ## [0.9.10-alpha.1] - 2026-07-19
 
 ### Changed

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.10-alpha.1",
+  "version": "0.9.10",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,82 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.10] - 2026-07-20
+
+### Breaking Changes
+
+- Removed the workflow tool's direct one-off `task`, `tasks`, and `chain` execution shapes and the corresponding `runTask`, `runParallel`, and `runChain` SDK entry points. The tool now accepts only named workflow execution (`workflow` + `inputs`), discovery, inspection, messaging, run control, and reload; direct-only top-level stage/session, worktree, output, concurrency, fail-fast, grouping, async, and Intercom arguments are rejected. Author reusable or task-specific definitions and use the unchanged in-workflow `ctx.task`, `ctx.chain`, and `ctx.parallel` primitives instead.
+- Workflow persistence now requires DBOS/Postgres. Removed the local JSON/SQLite backend, user opt-out/backend selection, session-JSONL discovery, and support for prior durable formats; existing local or older DBOS workflow data is not converted.
+- The `/workflow resume` picker is now host-native ONLY and requires the host session-picker capability (`ctx.ui.hostSessionPicker`, Atomic's interactive hosts — both isolated and non-isolated — expose it with one identical API). The picker mounts the real built-in session selector directly in the terminal process, so arrow-key navigation and search never cross the host⇄extension boundary and stay instant even while the extension's event loop is busy (e.g. during catalog hydration or run-store refreshes); this also removes the per-keypress render round trip the remote-rendered picker paid under engine isolation. The previous remote-rendered `ctx.ui.custom()` selector path was deleted with no fallback: on a host without the capability, `/workflow resume` (picker form) now fails with one actionable error suggesting `/workflow resume <id>` instead of degrading. All picker semantics carry over unchanged — live rows seed the first frame, the durable/completed catalog hydrates once and merges into the open picker, watch/poll refreshes push row updates, deletion remains extension-owned with live rows protected ("Cannot delete an in-flight workflow run"), and the resolved catalog is still returned for the follow-on resume. The headless/non-interactive printed-list flow is unaffected.
+
+### Added
+
+- Unified workflow **post-mortem stage chat** across every inspection surface. Any eligible terminal agent stage with a valid retained session now reopens as an interactive follow-up conversation — not only completed-workflow inspection (#1758), but also generic `/workflow attach` / `/workflow connect`, restored/replayed durable snapshots after a process restart, and `workflow({ action: "send" })`. A shared runtime resolver (`ensurePostMortemStageHandle`) validates the retained session is an existing, readable, context-bearing Atomic transcript, then lazily reopens it through a detached, single-flight stage-control handle keyed by the real `{ runId, stageId }` (including nested/expanded child stages). Follow-up turns are appended in place to the retained session and the agent keeps its ordinary tools, while run/stage status, results, timings, checkpoints, replay metadata, and graph topology remain immutable — post-mortem chat can never resume, retry, rewind, pause, or re-dispatch workflow execution. Explicit `workflow send` delivery modes `resume` and `steer` on a completed post-mortem stage return a structured `noop` with follow-up guidance and do not append the supplied text. Stages without a valid retained agent session (prompt/HIL and boundary/summary nodes, skipped nodes, non-terminal handle-less stages, and missing/malformed/deleted session files) keep the existing read-only transcript, and recoverably failed stages retain their execution-resume semantics. `workflow send` now revives such a stage on a registry miss and delivers the message as a conversational follow-up instead of reporting `No live handle for stage.` ([#1811](https://github.com/bastani-inc/atomic/issues/1811))
+- Added resumable `/workflow quit [run-id|--all]` and `workflow({ action: "quit" })` controls, preserving exact run-id, unique-prefix, active-run default, bulk, terminal, and ambiguity handling.
+- Added six composable builtin pattern workflows: `classify-and-act` (structured confidence routing with human fallback), `fan-out-and-synthesize` (bounded artifact fan-out and evidence synthesis), `adversarial-verification` (fresh-context rubric verification with bounded repair), `generate-and-filter` (candidate generation, dedupe, filtering, and optional judging), `tournament` (balanced pairwise comparison and auditable bracket reduction), and `loop-until-done` (durable progress ledger with explicit completion and inspectable bound exhaustion). Each ships with bounded typed/defaulted inputs, dedicated stage prompts, parent-consumable declared outputs, and an export from `@bastani/workflows/builtin` for nested `ctx.workflow(...)` composition.
+- Added a `group` option to workflow stages, tasks, parallel steps, and run-level defaults (`context`/`stage`/`task`/`parallel`) that sets each stage session's intercom home group so orchestrated stages can be isolated into coordination groups. A named string joins that group; `true` auto-generates one shared UUID group per parallel set (minted once and shared across every item in the set, never per-item) so a whole level lands in the same isolated group. Precedence is most-specific-first (`parallel-item > task/stage > parallel-step > run-level`), resolved into a per-session `orchestrationContext.intercomGroup` that is race-safe across concurrently running in-process stages (no global env mutation) and stable across model-fallback session replacement. Group assignment is gated on intercom capability: a stage with `noTools`, a `tools` allowlist omitting `intercom`, or `excludedTools` containing `intercom` is never placed into a group. Subagents spawned by a grouped stage inherit that stage's group by default (overridable per subagent), so a reviewer level and its helper subagents form one isolated group. The builtin `goal` and `ralph` workflows now isolate each reviewer level into its own group (`goal-reviewers-turn-N` / `ralph-reviewers-iter-N`): same-level reviewers can intercom each other but cannot reach the worker, orchestrator, parent chat, or other levels, which also keeps reviewer intercom chatter out of the main/parent context window.
+- Added `/workflows [run-id]` as a retained-run alias for `/workflow resume`, plus confirmed Ctrl+D deletion for non-live durable/completed rows. Deletion rechecks same-process activity and authoritative status, atomically refuses `running` workflows, updates the catalog, and leaves host/stage session transcripts untouched.
+- Added zero-configuration workflow durability: when no `DBOS_SYSTEM_DATABASE_URL` is set, Atomic runs DBOS against its own embedded Postgres built from npm-distributed binaries (`embedded-postgres` platform packages) — no Docker daemon or system Postgres install required. The cluster lives under `~/.atomic/postgres/v18` on dedicated port 5439, is initialized once, started as a detached daemon via `pg_ctl` (surviving Atomic exit and shared across concurrent sessions, never stopped by Atomic), and native lib symlinks are hydrated at runtime so `--ignore-scripts`/Bun installs work. DBOS's reusable `dbos-db` Docker container remains only as a fallback when the embedded binaries are unavailable for the platform; if both are unusable, the workflow action fails with one actionable message instead of a raw connection dump, and DBOS internal logging is routed to a silent logger so connection probes cannot spam the TUI.
+- Added multi-session coordination for concurrent Atomic processes sharing one DBOS database: each process launches DBOS with a unique executor id; running root workflows carry owner/heartbeat metadata (refreshed by the ≤30s stage-timing checkpoints); another session's fresh-running workflow is hidden from the resume picker and refused by direct `/workflow resume <id>` with an actionable message until its owner pauses, quits, or its heartbeat goes stale; and contended paused→running transitions are decided by a durable first-writer-wins claim record so exactly one session dispatches the resumed run. Hydration preserves the authoritative `updatedAt` heartbeat instead of stamping local time.
+- Made the `/workflow resume` picker live-updating: rows re-list on local run-store changes (debounced) and through a bounded cross-session poll (default 5s) while the picker stays open, so a workflow that pauses, fails, or completes appears — and a freshly running one disappears — without reopening. Watchers and timers stop when the picker closes, and a failed refresh keeps the previous rows.
+- Running workflows are no longer resume targets anywhere: a running row with a fresh ownership heartbeat is hidden from the picker and the catalog regardless of which session owns it, eliminating double-dispatch of one workflow from two sessions. Only stale-heartbeat running workflows surface, presented as red `crashed` rows rather than `running`. Picker rows now carry semantic colors: completed green, paused yellow, failed/blocked/crashed red.
+- Refined the workflow tool's `status` action into a first-class session run listing. `workflow({ action: "status" })` without a `runId` now returns concise per-run summaries alongside the full snapshots: run id and abbreviated prefix, workflow/run name, run status, started/ended timing plus pause-adjusted elapsed time, currently active stages, and awaiting-input details (count plus the stage, prompt id, kind, and message for each pending human prompt) — everything needed to feed `pause`/`resume`/`interrupt`/`quit`/`send` directly. In-flight runs are listed first. The agent-visible text output is now a concise per-run summary list instead of a raw snapshot dump, and `format: "json"` returns the structured listing.
+- Added `statusFilter` support to the `status` run listing: run statuses (`pending`/`running`/`paused`/`blocked`/`completed`/`failed`/`skipped`/`cancelled`/`killed`) filter runs directly, `awaiting_input` selects runs with at least one stage awaiting input or pending human prompt, and `all` (the default) includes everything. The `cancelled` and `killed` filter values are newly accepted, and the tool schema descriptions for `action`, `runId`, `statusFilter`, and `format` now document the no-`runId` listing mode so agents can discover it.
+
+### Changed
+
+- Changed workflow hierarchy navigation to an unconditional Ctrl+X chord: attached stage chats now preserve composer and prompt drafts and pending custom questions while returning to the graph, and graph overlays return to main chat even with switchers or legacy prompts open. Ctrl+D retains ordinary editor/prompt behavior, `q` remains printable in text-owning prompts, workflow surfaces take Ctrl+X precedence over configurable actions, and graph/stage guidance now states the destination explicitly.
+- Reworded workflow-start guidance around actionable `/workflow connect <run-id>` commands so users know they can see agents working and chat with or steer each stage.
+- Reworked runner-managed Git worktrees to use Claude Code's git-native lifecycle: canonical main-root anchoring, `.atomic/worktrees/` locations, `worktree-*` branches with default-remote base resolution, local-settings/hooks/ignored-file setup, configurable `worktree.symlinkDirectories`, and force-remove plus branch-delete cleanup. Reusable `gitWorktreeDir` creation is now anchored at the canonical main root while retaining its existing path, validation, and cache semantics.
+- DBOS is configured, registered, and launched lazily on the first workflow action (never during CLI/session startup), reused process-wide, and readiness is awaited across workflow execution, control, resume, inspection, and deletion paths. Initialization and persistence failures fail the workflow action; no alternate backend is selected.
+- Debounced durable stage-session timing checkpoints into 30-second buckets. Duration-only progress no longer forces a full durable state read-merge-rewrite on every prompt/steer event; session identity changes (session id/file/start) still persist immediately, so cross-process resume continues from the same retained session with at most a 30-second loss of accumulated timing precision.
+- Matched coding-agent `/resume` retention semantics for workflow history: all eligible durable runs remain searchable regardless of age or count, with no automatic history GC; the 10-row selector viewport remains display-only.
+
+### Fixed
+
+- Fixed live workflow stages abandoning their objective after a user-queued message across every delivery path: attached-stage-chat steering (Enter) and follow-up (Ctrl+F), including the chat host's SDK-direct `AgentSession.prompt(..., { streamingBehavior })` bypass; `workflow({ action: "send" })` `steer`/`followUp`; and workflow-author `StageContext.steer()`, `followUp()`, or streaming `sendUserMessage()`. Workflows now detect when the SDK actually consumes queued user messages and inject the exact deterministic continuation prompt ("Continue where you left off. If you believe you are finished with your original task (or a redefined task if the user told you), stop.") once after the consuming turn, even when the readiness gate is disabled. Multiple consumed messages coalesce into one injection, initial/idle and injected continuation prompts cannot re-arm the mechanism, aborted/finalized/fail-fast-skipped stages remain suppressed, and pause→resume continuation still requires the readiness gate.
+- Fixed session-boundary races in lazy post-mortem stage-chat attachment so every host session replacement or shutdown (`new`, `resume`, `fork`, `reload`, and `quit`) synchronously invalidates detached handles; a retained-session creation that finishes after the boundary is disposed and its already-submitted prompt is rejected instead of executing in the replacement session or leaking an unowned SDK session.
+- Fixed explicit `/workflow attach <root-run> <nested-stage>` commands to resolve expanded child stages through their owning nested run, preserve that owner through overlay retargeting when sibling child runs reuse the same local stage ID, and retain post-mortem resolver failure reasons so invalid or unavailable sessions render a complete actionable `SESSION UNAVAILABLE` explanation—even at the supported 40-column minimum—instead of a misleading archived-transcript label. Reopened nested terminal stages now restore cwd from their durable root workflow metadata (preferring the resolved workflow cwd, then the original invocation cwd) rather than silently falling back to the current review checkout.
+- Hardened repository release recovery so externally merged PRs require exact current identity, refs, SHA, checks, merge evidence, and retained branch state. Workflow-qualified Actions reruns use name plus workflow; empty-workflow external statuses and GitHub App checks support linked kind/name grouping and linkless cross-kind inspection. All-passing linkless candidates and duplicate aliases are accepted, while any pending/failure blocks and nonempty-workflow Actions remain excluded. Checks refresh after merge, tag recovery proves `verified merge → tag parent → current base`, protected dispatch coordination retains its lock through ambiguous acceptance visibility, and recovered success is bound to the exact integrity-job tag SHA.
+- Fixed workflow stage-chat compaction to show one reason-aware animated spinner for manual, automatic-threshold, and overflow compaction, retain the normal expandable `✻ Context compacted` boundary when the live session snapshot is temporarily unavailable, and contain `/compact` cancellation or planner/provider rejection after its authoritative `compaction_end` event so the CLI and stage remain usable.
+- Fixed workflow stage finalization to atomically close the AgentSession notification-admission boundary before publishing terminal snapshots. Already-admitted Intercom and async completion turns are drained and reflected in the terminal result, while late detached traffic cannot mutate/reopen the stage and is routed externally. The boundary does not wait for producers that are still running and preserves deliberate post-completion `sendUserMessage` and post-mortem chat.
+- Fixed live in-process workflow resume so quitting a chain stage mid-turn and resuming without a message re-drives the interrupted stage with the continuation prompt before result harvesting, preventing partial assistant text from being durably checkpointed or handed to downstream `{previous}` stages while preserving explicit-message and cross-process durable resume behavior. ([#1829](https://github.com/bastani-inc/atomic/issues/1829))
+- Made graceful quit wait for live stage pause acknowledgement before persisting resumable state, report runs with no controllable stage as still active, propagate rejected pauses instead of claiming success, and reconcile session-restored running snapshots with authoritative paused durability so `/workflow resume` legally redispatches them.
+- Made bulk quit settle every run and report per-run failures, made pause/resume state follow asynchronous control acknowledgements, synchronized successful resume back to durable state, and shared paused/orphaned-running durable shadow recovery across slash and workflow-tool resume.
+- Made graceful `/workflow quit` propagate durable backend failures for workflows that are durably tracked: `markDurableQuit` now swallows errors only while discovering whether a run has durable state, and lets a failed paused-status transition or flush (for example an unwritable/unknown default file-backend state) surface instead of masking it as `not_needed`. Quit no longer records a resumable pause or reports success when the persistent backend never captured the paused state, so a follow-up process cannot be left with nothing to `/workflow resume`.
+- Made graceful quit recognize live/synthetic awaiting-input and already-paused states without cancelling prompts, persist race-safe unresolved prompt counts across file/in-memory/DBOS backends, and hold answered quit prompts behind explicit resume before checkpointing.
+- Made durable resume shadows use the authoritative progress predicate, leaving zero-progress restored orphans untouched, and made multi-stage resume settle every acknowledgement, reconcile truthful partial-running durability, retain failed paused stages, and report aggregated run/stage failures.
+- Fixed prompt replay/reservation identity and cross-instance atomicity for scoped, file, and DBOS durability; refreshed prompt pause barriers on every quit; reconciled late resume outcomes and durable-write failures from visible state without reviving terminal runs; and added connect guidance to direct asynchronous accepted results.
+- Made prompt releases consume one identity-owned reservation generation at most once, with persisted file/DBOS release tombstones and saturating legacy-scalar migration; made author callsites stable across process working-directory changes; composed nested parent/child checkpoint scopes; and made later resume requests retry a paused durable handle after local resume already succeeded.
+- Made resume-shadow reads and conditional lifecycle writes use one authoritative durable generation, preventing stale file instances from reviving terminal workflows; reconciled fulfilled quit controls and nested child resume progress through aggregate root Store/durability; preserved DBOS prompt-token ownership across workflow re-registration; and made mixed bulk quit outcomes report ordered partial successes.
+- Reported fulfilled resume acknowledgements whose controls finish before aggregate root finalization as successful progress instead of falsely claiming that no paused stages existed.
+- Made DBOS conditional lifecycle transitions terminal-absorbing under concurrent metadata writes, made legacy custom backends without an atomic transition primitive refuse safely, and distinguished omitted prompt counts from explicit new reservation-ledger baselines during DBOS re-registration.
+- Fixed attached stage-chat footers at the supported 40-column minimum to keep truncated provider/model context separated from the compact Ctrl+X/Copy Mode controls instead of merging both segments into corrupted text.
+- Fixed stage-less named workflow body failures such as a throwing `ctx.tool()` being misclassified as killed instead of retained as failed with their concrete startup error.
+- Fixed busy workflow stages deadlocking when a foreground subagent waited on Intercom or blocking `contact_supervisor`. Exact foreground-owner detach now completes before the request enters the stage generation boundary, owner loss before commit falls back to normal open-stage admission, and parallel foreground groups release aggregate supervision while retaining every child's lifecycle and result recovery. Native workflow messaging and terminal close semantics remain unchanged.
+- Fixed Ctrl+O (`app.tools.expand`) being consumed without expanding tool and workflow-node detail in attached workflow stage chats under Atomic's isolated interactive engine. The remote workflow pane now preserves pi-tui's key-release opt-in contract, so Kitty terminals cannot deliver both the press and release as two expansion toggles that cancel each other. Repeated expand/collapse toggles match main chat across active and completed runs, single/parallel/chain views, and narrow terminals while prompts, custom questions, and unrelated keybindings retain input ownership.
+- Fixed authored `ctx.parallel(...)` calls treating string auto-group sentinels such as `group: "auto"` as literal group names. The engine now normalizes trimmed, case-insensitive `"auto"`/`"true"` values at both set and per-step levels before deciding whether to mint one shared UUID for the parallel set. Separate sets still receive distinct UUIDs, boolean `true` remains supported, and named groups stay literal.
+- Fixed `/workflow <name>` forms hanging under Atomic's isolated interactive engine when required inputs were missing. The command now prefers the host-native input-form capability, so the form is mounted and focused in the terminal host and Tab/Shift+Tab, arrows, text editing, configured keybindings, Enter, Escape, and Ctrl+C remain responsive without per-keypress engine traffic. Escape/Ctrl+C cancel without dispatch, supplied/default values and typed coercion are preserved, and the existing inline-editor and remote-custom paths remain compatibility fallbacks for older hosts.
+- Fixed named workflow startup feedback so pre-body setup failures, including a `goal` run whose `git_worktree_dir` points inside the invoking checkout, return immediately from the original workflow tool call as a structured failed result with the concrete setup error and allocated run id instead of first claiming background acceptance and relying on a later lifecycle notice. Successful named runs still return promptly after startup admission without waiting for workflow completion; failed admission now cleans job, cancellation, store, and durable state, and continuation/durable-resume launches preserve resumability while reporting their startup error.
+- Fixed named background workflows that stopped on a recoverable provider, authentication, or rate-limit failure without notifying the invoking chat. Top-level active/resumable blocks now emit one deduplicated `WORKFLOW BLOCKED` lifecycle card per blocked occurrence (keyed by run id and blocked timestamp, so a resumed workflow that hits another recoverable block re-notifies), delivered through native idle-prompt admission when the parent chat is idle or persisted directly to the transcript when it is streaming; status/headless surfaces report blocked; and durable state retains blocked/resumable discovery across session boundaries and exposes the run in the resume picker. Lifecycle delivery commits dedupe only after admission succeeds and retains the original payload with capped-backoff retries while the invoking chat remains active, including across run-state changes and notification reinstallations; session replacement cancels and clears those attempts. Resuming an active block dispatches a fresh-ID continuation that replays completed stages and re-runs the failed one; the durable source is left untouched (stays blocked/resumable for crash recoverability, including zero-checkpoint first-stage blocks) and the local source snapshot is killed so the same session will not re-resume it; a process-local claim prevents concurrent same-session double-dispatch. Historical restore seeding, headless duplicate suppression, nested workflows, and human-input prompts remain non-notifying.
+- Fixed completed workflow stages being visible to Intercom but unable to process a sibling's blocking `intercom.ask`. The late-message handoff now carries exact run/stage ownership into the shared post-mortem resolver, serializes wakeups per retained conversation, reopens only eligible completed sessions without mutating workflow execution, and reports deleted, invalid, non-resumable, or failed revival targets within a bounded interval. Claimed completions now have single-owner semantics across the production workflow and Intercom listeners, so listener registration order and duplicate listeners cannot replace or double-deliver the authoritative revival result. Exact child-to-child reply correlation remains isolated from parent and unrelated sessions ([#1854](https://github.com/bastani-inc/atomic/issues/1854)).
+- Fixed interactive non-schema stages treating typed/freeform `ask_user_question` chat answers as an invisible implicit “stay”. The conversational acknowledgement now precedes a brokered readiness gate; in that chat flow, Not ready allows a genuine chat turn before readiness is asked again and Ready releases dependents. Structured-option behavior remains unchanged, and schema-finalized stages remain terminal. ([#1849](https://github.com/bastani-inc/atomic/issues/1849))
+- Fixed idle live workflow-stage messaging so `workflow send` `followUp` and eligible `auto` deliveries start a real prompt instead of stranding an unconsumable queue item, while streaming follow-ups remain queued and steering remains in-turn. Send results now report the action actually taken. Paused idle stage-chat waits resumed with a non-empty message start exactly one recorded prompt, while interrupted streaming resumes preserve their existing nonduplicating loop and lifecycle/abort guards prevent late prompt creation. Custom `AgentSessionAdapter` implementations now have a typed public `agent_start`/`agent_end` subscription contract for asynchronous ownership through both native `sendUserMessage()` and the optional-method `prompt()` fallback. Serialized admission retains generation-correlated logical turn ownership after `agent_start`, preventing a second idle prompt when an adapter's public `isStreaming` state publication lags its lifecycle event. Untagged synchronous replay snapshots no longer consume a current end; adapters whose replayed turn may end after a newer turn starts can provide a stable `turnId` for exact old-end correlation. Late terminal events, older promise settlement, rejection, and abort cannot clear a newer turn. Stage-chat input handled by an extension remains accepted if the stage becomes terminal during handling instead of reporting rejection after the side effect ([#1850](https://github.com/bastani-inc/atomic/issues/1850)).
+- Fixed durable `/workflow resume` restarting workflow timers: the resumed run's total duration in the main-chat dashboard and status surfaces now inherits the elapsed time accumulated before the quit/failure (prior sessions + current session) instead of resetting to zero, and a resumed mid-running stage's timer continues from its previously accumulated elapsed time. The run's total accumulated elapsed is persisted durably alongside the existing 30-second stage-timing checkpoints, exactly at graceful quit and recoverable-failure boundaries, and round-trips through DBOS hydration and session-entry restore. In-process continuation resumes of failed runs inherit the source run's total the same way.
+- Fixed background workflow activity flickering the main-chat tail and snapping native terminal scrollback back to the live bottom after wheel-scrolling away ([#1856](https://github.com/bastani-inc/atomic/issues/1856)). The below-editor workflow companion remains one long-lived mounted component: semantic changes and elapsed-clock updates repaint it in place without `setWidget` dispose/remount churn, byte-identical store mutations do not broadcast redundant host renders, and hidden workflow graph/stage overlays do not request host renders on store updates. A visible running workflow's elapsed label now advances continuously from `0s` on exact one-second boundaries without requiring an orchestrator-panel switch; paused labels stay frozen, and ended cards retain only their one-shot ~30-second expiry timer.
+- Normalized `DBOS_SYSTEM_DATABASE_URL` handling: the URL is trimmed before being handed to DBOS, so values injected from secrets managers or env files with trailing whitespace/newlines connect cleanly, and a whitespace-only value is treated as unset. Explicit-URL precedence is unchanged — when the variable is set, Atomic never provisions its embedded Postgres or Docker fallback, including on connection failures, which surface as actionable errors against the configured database.
+- Fixed completed and in-progress workflows disappearing from `/workflow resume` in a fresh Atomic process. Stage-session timing checkpoint writers omit topology; the in-memory mirror defaulted it on write but the DBOS persist path encoded the raw checkpoint, so cross-process hydration classified those records as foreign and suppressed the whole workflow. Topology is now normalized at the shared encode boundary, making the durable record identical to the mirror (regression-tested through a full write→fresh-hydrate round trip). Runs persisted before this fix keep their topology-less records and remain hidden; re-run or delete them.
+- Fixed DBOS step/metadata writes returning before the underlying checkpoint workflow completed: `recordStepOutput` now awaits the stored result (resolving duplicates to the first durable record), so a passed `flush()` boundary guarantees the write is durable and readable — required for correct cross-process claim reads and crash-safe checkpoint exposure.
+- Fixed the resumed workflow graph overlay ignoring the mouse wheel (wheel gestures scrolled native/main-chat scrollback) under Atomic's isolated interactive engine. The graph overlay adapter runs inside the engine child, whose stdout is the JSONL transport rather than a TTY, so writing mouse-tracking escape sequences to its local `process.stdout` was a no-op and the host TTY never entered mouse-reporting mode. The adapter now prefers the host's typed remote terminal-control capability exposed on the factory TUI's `terminal` (`setMouseScrollTracking`/`setAutowrap`) so the real host TTY enters mouse-reporting (and Windows autowrap) mode, routing wheel input to the remote `GraphView` scroll offsets while a visible overlay captures the mouse; stage-chat wheel capture and Ctrl+T copy mode continue to work, and main-chat scrollback no longer moves while a visible overlay owns the mouse. Non-isolated hosts and existing test seams keep the local `process.stdout` fallback. Modes are reset on overlay hide/close/dispose and on engine crash/restart, and `/workflow resume` selection deterministically disposes the inline picker before the fullscreen overlay mounts and is focused.
+- Made `/workflow resume` mount its picker before loading workflow resources or the durable/completed catalog. Eligible live runs seed the first rendered frame and the durable/completed catalog now hydrates asynchronously, merging its rows into the open picker on resolve instead of blocking the slash command until the scan finishes. Catalog errors render inside the still-usable picker when live rows are present, closing the picker cancels late hydration and ignores stale results, and the resolved catalog is reused for the follow-on resume so there is no second scan. Together with the coding-agent long-lived-RPC timeout fix, this removes the `Timeout waiting for response to prompt` failure when opening `/workflow resume`.
+- Hardened the durable workflow catalog against cross-process races: rebuild publication now serializes its final signature/marker verification with incremental writers and never consumes a marker created after scanning began; one-row updates no longer bless unrelated external additions, deletions, or edits; and automatic terminal-file pruning rechecks the authoritative status under the per-workflow lock so a concurrently resumed `running` workflow survives.
+- Prevented blocking workflow author/stage code from freezing the Atomic terminal by running the interactive agent engine and bundled workflows extension in the supervised engine child. Workflow commands, tools, custom graph/picker components, and stage callbacks retain child-owned closure state while the terminal host continues input and render ticks; watchdog diagnostics identify the active callback and interrupted results remain explicitly unknown until resumed from an authoritative checkpoint.
+- Fixed the host TUI flickering (rapid full repaints at ~58 Hz) when the `workflow` tool's `quit`/`pause` action ran while a workflow stage was actively streaming. The root cause was not in the workflows extension: under Atomic's isolated interactive engine, rendering the first tool card of a turn (typically the `workflow` quit/pause call, but any tool call reproduced it) entered a self-sustaining host⇄engine render ping-pong in the remote tool-card renderer, which fought the still-streaming turn. The renderer fix ships in `@bastani/atomic` (see the coding-agent changelog); quitting or pausing a streaming workflow now renders its tool card once and stays quiet.
+
+### Removed
+
+- Removed public workflow `kill` slash/tool actions, completions, picker shortcuts, confirmations, renderers, and help/docs while retaining internal cancellation machinery used by engine and session lifecycle paths.
+
 ## [0.9.10-alpha.1] - 2026-07-19
 
 ### Breaking Changes

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.10-alpha.1",
+  "version": "0.9.10",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [

package/npm-shrinkwrap.json

@@ -1,15 +1,15 @@
 {
 	"name": "@bastani/atomic",
-	"version": "0.9.10-alpha.1",
+	"version": "0.9.10",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@bastani/atomic",
-			"version": "0.9.10-alpha.1",
+			"version": "0.9.10",
 			"license": "MIT",
 			"dependencies": {
-				"@bastani/atomic-natives": "0.9.10-alpha.1",
+				"@bastani/atomic-natives": "0.9.10",
 				"@bufbuild/protobuf": "^2.12.1",
 				"@dbos-inc/dbos-sdk": "4.23.6",
 				"@earendil-works/pi-agent-core": "^0.80.10",
@@ -516,16 +516,16 @@
 			}
 		},
 		"node_modules/@bastani/atomic-natives": {
-			"version": "0.9.10-alpha.1",
-			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives/-/atomic-natives-0.9.10-alpha.1.tgz",
+			"version": "0.9.10",
+			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives/-/atomic-natives-0.9.10.tgz",
 			"license": "MIT",
 			"optionalDependencies": {
-				"@bastani/atomic-natives-darwin-arm64": "0.9.10-alpha.1",
-				"@bastani/atomic-natives-darwin-x64": "0.9.10-alpha.1",
-				"@bastani/atomic-natives-linux-arm64-gnu": "0.9.10-alpha.1",
-				"@bastani/atomic-natives-linux-x64-gnu": "0.9.10-alpha.1",
-				"@bastani/atomic-natives-win32-arm64-msvc": "0.9.10-alpha.1",
-				"@bastani/atomic-natives-win32-x64-msvc": "0.9.10-alpha.1"
+				"@bastani/atomic-natives-darwin-arm64": "0.9.10",
+				"@bastani/atomic-natives-darwin-x64": "0.9.10",
+				"@bastani/atomic-natives-linux-arm64-gnu": "0.9.10",
+				"@bastani/atomic-natives-linux-x64-gnu": "0.9.10",
+				"@bastani/atomic-natives-win32-arm64-msvc": "0.9.10",
+				"@bastani/atomic-natives-win32-x64-msvc": "0.9.10"
 			},
 			"engines": {
 				"bun": ">=1.3.14",
@@ -533,8 +533,8 @@
 			}
 		},
 		"node_modules/@bastani/atomic-natives-darwin-arm64": {
-			"version": "0.9.10-alpha.1",
-			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-darwin-arm64/-/atomic-natives-darwin-arm64-0.9.10-alpha.1.tgz",
+			"version": "0.9.10",
+			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-darwin-arm64/-/atomic-natives-darwin-arm64-0.9.10.tgz",
 			"license": "MIT",
 			"os": [
 				"darwin"
@@ -545,8 +545,8 @@
 			"optional": true
 		},
 		"node_modules/@bastani/atomic-natives-darwin-x64": {
-			"version": "0.9.10-alpha.1",
-			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-darwin-x64/-/atomic-natives-darwin-x64-0.9.10-alpha.1.tgz",
+			"version": "0.9.10",
+			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-darwin-x64/-/atomic-natives-darwin-x64-0.9.10.tgz",
 			"license": "MIT",
 			"os": [
 				"darwin"
@@ -557,8 +557,8 @@
 			"optional": true
 		},
 		"node_modules/@bastani/atomic-natives-linux-arm64-gnu": {
-			"version": "0.9.10-alpha.1",
-			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-linux-arm64-gnu/-/atomic-natives-linux-arm64-gnu-0.9.10-alpha.1.tgz",
+			"version": "0.9.10",
+			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-linux-arm64-gnu/-/atomic-natives-linux-arm64-gnu-0.9.10.tgz",
 			"license": "MIT",
 			"os": [
 				"linux"
@@ -572,8 +572,8 @@
 			"optional": true
 		},
 		"node_modules/@bastani/atomic-natives-linux-x64-gnu": {
-			"version": "0.9.10-alpha.1",
-			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-linux-x64-gnu/-/atomic-natives-linux-x64-gnu-0.9.10-alpha.1.tgz",
+			"version": "0.9.10",
+			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-linux-x64-gnu/-/atomic-natives-linux-x64-gnu-0.9.10.tgz",
 			"license": "MIT",
 			"os": [
 				"linux"
@@ -587,8 +587,8 @@
 			"optional": true
 		},
 		"node_modules/@bastani/atomic-natives-win32-arm64-msvc": {
-			"version": "0.9.10-alpha.1",
-			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-win32-arm64-msvc/-/atomic-natives-win32-arm64-msvc-0.9.10-alpha.1.tgz",
+			"version": "0.9.10",
+			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-win32-arm64-msvc/-/atomic-natives-win32-arm64-msvc-0.9.10.tgz",
 			"license": "MIT",
 			"os": [
 				"win32"
@@ -599,8 +599,8 @@
 			"optional": true
 		},
 		"node_modules/@bastani/atomic-natives-win32-x64-msvc": {
-			"version": "0.9.10-alpha.1",
-			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-win32-x64-msvc/-/atomic-natives-win32-x64-msvc-0.9.10-alpha.1.tgz",
+			"version": "0.9.10",
+			"resolved": "https://registry.npmjs.org/@bastani/atomic-natives-win32-x64-msvc/-/atomic-natives-win32-x64-msvc-0.9.10.tgz",
 			"license": "MIT",
 			"os": [
 				"win32"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/atomic",
-  "version": "0.9.10-alpha.1",
+  "version": "0.9.10",
   "description": "Atomic coding agent CLI with read, bash, edit, write tools and session management",
   "type": "module",
   "atomicConfig": {
@@ -77,7 +77,7 @@
     "prepublishOnly": "bun run clean && bun run build && bun run shrinkwrap"
   },
   "dependencies": {
-    "@bastani/atomic-natives": "0.9.10-alpha.1",
+    "@bastani/atomic-natives": "0.9.10",
     "@bufbuild/protobuf": "^2.12.1",
     "@dbos-inc/dbos-sdk": "4.23.6",
     "@earendil-works/pi-agent-core": "^0.80.10",