@bastani/atomic 0.9.10 → 0.9.11-alpha.1

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [0.9.11-alpha.1] - 2026-07-20
+
+### Changed
+
+- Clarified the bundled `deep-research-codebase` discovery guidance so agents reserve the heavy workflow for tasks requiring comprehensive whole-repository context ([#1925](https://github.com/bastani-inc/atomic/issues/1925)).
+
+### Fixed
+
+- Fixed newly authenticated providers remaining unavailable in the model selector until Atomic restarted. API-key and OAuth login now reload the isolated engine's credentials and refresh its authoritative model catalog immediately, including credential-dependent dynamic discovery ([#1918](https://github.com/bastani-inc/atomic/issues/1918)).
+- Added actionable `/logout` and `/login` recovery guidance when OpenAI Codex invalidates or revokes a locally unexpired OAuth token, and prevented an earlier WebSocket-to-SSE transport diagnostic from making the definitive authentication rejection retryable ([#1922](https://github.com/bastani-inc/atomic/issues/1922)).
+
 ## [0.9.10] - 2026-07-20
 
 ### Breaking Changes
@@ -34,6 +45,9 @@
 
 ### Fixed
 
+- Fixed `/logout` leaving GitHub Copilot and other providers authenticated in the isolated interactive engine until restart. Logout now invalidates the authoritative child immediately, refreshes the host model projection, prevents provider transport with the removed credential, and deletes effective legacy auth-file entries so credentials do not reappear after restart ([#1919](https://github.com/bastani-inc/atomic/issues/1919)).
+- Fixed custom project, user, and package-provided workflow names being omitted from `/workflow <name>` and `/workflow inputs <name>` argument completion under the isolated interactive engine. The host now evaluates completion callbacks in the engine child against the live workflow registry, so `/workflow reload` updates the completion popup immediately while retaining bundled administrative-command fallback completion ([#1921](https://github.com/bastani-inc/atomic/issues/1921)).
+
 - Fixed the repository `publish-release` workflow to reconcile an exact release PR merged externally while required checks are pending. It preserves identity/refs/SHA; correlates workflow-qualified Actions reruns by name plus workflow; and supports empty-workflow `StatusContext` and GitHub App `CheckRun` evidence. Linked reruns group by inferred kind/name across URL changes; linkless rows inspect both external kinds, accept all-passing candidates, block any pending/failure, and exclude nonempty-workflow Actions. Duplicate aliases reuse exact passing evidence. It rechecks after merge and validates merge/branch evidence. Tag recovery proves `verified merge → tag parent → current base`; exhaustive history avoids GitHub's 1,000-result ceiling; protected coordination retains its lock through ambiguous dispatch visibility; and recovered success requires exact-SHA integrity evidence.
 - Fixed shared extension chat compaction rendering so manual, threshold, and overflow compaction use the animated working spinner with reason-aware copy instead of a duplicate plain status row plus generic `Working...`; successful compaction now falls back to the existing typed `✻ Context compacted` message when a refreshed live session snapshot is unavailable, while preserving durable session reconstruction and avoiding duplicate boundaries.
 - Fixed workflow stage-chat `/compact` cancellation and planner/provider failures from escaping their fire-and-forget editor submission promise and terminating the CLI. The authoritative `compaction_end` event now owns the visible status, animation cleanup, and diagnostic path while the same stage remains usable for retry or follow-up.

package/dist/builtin/cursor/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.9.11-alpha.1] - 2026-07-20
+
+### Changed
+
+- Published a synchronized Atomic 0.9.11-alpha.1 prerelease for the Cursor provider package; no functional Cursor provider changes were made after 0.9.9.
+
 ## [0.9.10] - 2026-07-20
 
 ### Changed

package/dist/builtin/cursor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/cursor",
-  "version": "0.9.10",
+  "version": "0.9.11-alpha.1",
   "private": true,
   "description": "Experimental first-party Atomic extension for Cursor OAuth, model discovery, and streaming provider registration.",
   "contributors": [
@@ -40,7 +40,7 @@
     }
   },
   "dependencies": {
-    "@bastani/atomic-natives": "0.9.10",
+    "@bastani/atomic-natives": "0.9.11-alpha.1",
     "@bufbuild/protobuf": "^2.12.1",
     "@earendil-works/pi-ai": "^0.80.10"
   }

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.11-alpha.1] - 2026-07-20
+
+### Changed
+
+- Published a synchronized Atomic 0.9.11-alpha.1 prerelease for the intercom extension; no functional intercom changes were made after 0.9.10.
+
 ## [0.9.10] - 2026-07-20
 
 ### Added

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.10",
+  "version": "0.9.11-alpha.1",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [
@@ -55,7 +55,7 @@
     }
   },
   "dependencies": {
-    "tsx": "^4.20.6",
+    "tsx": "^4.23.1",
     "typebox": "^1.3.6"
   }
 }

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.11-alpha.1] - 2026-07-20
+
+### Changed
+
+- Published a synchronized Atomic 0.9.11-alpha.1 prerelease for the MCP extension; no functional MCP changes were made after 0.9.10.
+
 ## [0.9.10] - 2026-07-20
 
 ### Added

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.10",
+  "version": "0.9.11-alpha.1",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.9.11-alpha.1] - 2026-07-20
+
+### Changed
+
+- Published a synchronized Atomic 0.9.11-alpha.1 prerelease for the subagents extension; no functional subagent changes were made after 0.9.10.
+
 ## [0.9.10] - 2026-07-20
 
 ### Added

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.10",
+  "version": "0.9.11-alpha.1",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with chains, parallel execution, and background runs. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/web-access/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.9.11-alpha.1] - 2026-07-20
+
+### Changed
+
+- Published a synchronized Atomic 0.9.11-alpha.1 prerelease for the web-access extension; no functional web-access changes were made after 0.9.10.
+
 ## [0.9.10] - 2026-07-20
 
 ### Changed

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.10",
+  "version": "0.9.11-alpha.1",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.11-alpha.1] - 2026-07-20
+
+### Added
+
+- Embedded DBOS Postgres now works when Atomic runs as root on Linux (containers, CI sandboxes, eval harnesses): PostgreSQL refuses UID 0, so Atomic resolves an unprivileged system account (`postgres`, `nobody`, or `daemon`), keeps the cluster under `/var/lib/atomic-postgres` (a root home directory is untraversable for that account), and runs `initdb`/`pg_ctl` with dropped privileges. When the embedded binaries sit under an untraversable prefix (for example a root-owned `~/.nvm` global install), the Postgres runtime is copied into the cluster directory once and reused.
+
+### Changed
+
+- Updated workflow-creation guidance to prefer `ctx.tool(...)` for workflow-owned side effects, connecting durable cached results to safe resume while distinguishing pure TypeScript computation and agent-stage internals ([#1923](https://github.com/bastani-inc/atomic/issues/1923)).
+- Clarified the built-in `deep-research-codebase` discovery guidance so agents reserve the heavy workflow for tasks requiring comprehensive whole-repository context ([#1925](https://github.com/bastani-inc/atomic/issues/1925)).
+- When no durable backend can be provisioned at all (no `DBOS_SYSTEM_DATABASE_URL`, embedded Postgres unavailable, and no Docker), workflows now degrade to a process-local in-memory backend with a loud non-durable warning instead of failing every workflow action. Degraded runs execute normally but do not survive the process, so `/workflow resume` after exit has nothing to restore; DBOS query and write failures on a provisioned backend still fail the workflow action.
+
+### Fixed
+
+- Fixed `workflow({ action: "resume", runId })` returning `Run not found` for eligible durably paused workflows after session-local run state was cleared. Explicit tool resume now resolves exact IDs and unique or ambiguous prefixes through the authoritative DBOS catalog before refusing the target, preserves original workflow IDs and checkpoint replay, and surfaces resource or durable lookup failures without making ordinary status listing hydrate durable history. ([#1924](https://github.com/bastani-inc/atomic/issues/1924))
+- Fixed session teardown crashing the process (exit code 1) after DBOS durability provisioning had failed: `shutdownDbos` re-awaited the memoized rejected configuration promise and rethrew the original provisioning error out of session dispose and the `beforeExit` hook, turning otherwise-successful `--print` runs into nonzero exits (surfacing as `NonZeroAgentExitCodeError` in eval harnesses). Shutdown is now a no-op for a backend that never reached readiness, and genuine teardown failures are logged instead of thrown.
+
 ## [0.9.10] - 2026-07-20
 
 ### Breaking Changes

package/dist/builtin/workflows/README.md

@@ -62,6 +62,10 @@ When a stage human-in-the-loop prompt is answered from the workflow TUI/stage ch
 
 ## Authoring API
 
+### Workflow-owned side effects
+
+Prefer `ctx.tool(name, args, fn)` for workflow-owned TypeScript operations with side effects, including filesystem writes, network mutations, external API actions, and similar deterministic operations orchestrated directly by the workflow definition. Atomic durably caches a completed call's serializable result, so resume returns that result without rerunning `fn` or repeating the side effect. Keep pure computation and side-effect-free transformations as ordinary TypeScript. Do not wrap agent-stage internals or every function call indiscriminately.
+
 ### Example 1 — Single task
 
 ```typescript
@@ -573,11 +577,11 @@ Prompt answer replay is live-memory only. `StageSnapshot.promptAnswerState` repo
 ```json
 {
   "name": "workflow",
-  "description": "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; discover with list/get/inputs, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, send prompt answers or steering, pause/resume/interrupt/quit runs, and reload workflow resources. For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, quote the exact path without rewriting separators (Windows backslashes are valid), then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview.",
+  "description": "Run named builtin, project, user, or package workflows; custom definitions may import reusable project/package workflows or builtin definitions from @bastani/workflows/builtin and nest them with ctx.workflow(...), including deeper composition within the configured maxDepth; when workflow execution fits but another shape would better achieve the task, author a custom TypeScript workflow({...}) inline with normal coding tools, reload it, and run it; discover with list/get/inputs/models, list session runs with status (no runId; statusFilter narrows the list), inspect status/stages/stage details, send prompt answers or steering, pause/resume/interrupt/quit runs, and reload workflow resources. For large stage handoffs, write context to files/artifacts, pass paths via reads, and prompt downstream agents to 'Read the file at <path>...' instead of injecting large previous text. For transcripts, prefer status/stages/stage to get sessionFile/transcriptPath, quote the exact path without rewriting separators (Windows backslashes are valid), then search it with rg/grep and read small ranges; transcript is path-only by default when sessionFile/transcriptPath exists, explicit tail/limit returns bounded previews, and missing transcript paths fall back to a small preview. Use action 'models' to inspect models in the configured catalog; the result is a configured-auth snapshot showing what's present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. When authoring a workflow that should dynamically select a model, first call workflow({ action: 'models' }) to inspect the configured catalog, then select from the returned provider/id entries considering the isCurrent marker and available thinking levels.",
   "parameters": {
     "workflow": "string (optional) — workflow ID or normalized name",
     "inputs": "object (optional) — key/value map of workflow inputs",
-    "action": "'run' | 'list' | 'get' | 'inputs' | 'status' | 'stages' | 'stage' | 'transcript' | 'send' | 'pause' | 'interrupt' | 'quit' | 'resume' | 'reload'",
+    "action": "'run' | 'list' | 'get' | 'inputs' | 'models' | 'status' | 'stages' | 'stage' | 'transcript' | 'send' | 'pause' | 'interrupt' | 'quit' | 'resume' | 'reload'",
     "runId": "optional run id or unique prefix; control actions default to the active run where safe; use '--all' or all:true for pause/interrupt/quit all",
     "stageId": "optional stage id, prefix, or name for stage-scoped actions; cannot be combined with all:true",
     "statusFilter": "optional filter for stages or the no-runId status run listing: pending/running/awaiting_input/paused/blocked/completed/failed/skipped/cancelled/killed/all; for the status listing, run statuses match directly and awaiting_input selects runs with a pending human prompt",
@@ -601,6 +605,7 @@ Prompt answer replay is live-memory only. `StageSnapshot.promptAnswerState` repo
 - **`transcript`** — path-only by default when a transcript file exists: use `status`, `stages`, or `stage` to identify the stage and its `sessionFile`/`transcriptPath`, quote the exact path without changing platform separators (for example, preserve Windows backslashes), then search that file with `rg`/`grep` for targeted terms and read only small surrounding ranges. Default text results include JSON-escaped `sessionFileJson`/`transcriptPathJson` lines for copy-safe path literals plus a `lazyReadPrompt`, with `entries: not inlined` so transcript bodies and tool outputs stay out of model context. Passing explicit `tail` or `limit` opts into a bounded inline preview for quick context checks. If no transcript path is available, the action falls back to a bounded preview of up to 5 recent entries with a `fallbackNote`. A registered live stage handle is used when one exists, even before live messages arrive; otherwise the action falls back to stored stage snapshots. Snapshot entries are ordered chronologically before `tail`/`limit` is applied, with terminal result/error entries kept after tool entries when timestamps are missing or tied. `includeToolOutput` applies only to inlined snapshot previews or no-path fallback previews; live session transcripts may not expose tool output.
 - **`send`** — answers pending primitive/structured stage prompts only when `text`, `response`, or `message` is present; an explicit empty string is a valid answer, while an omitted payload is a no-op. Follow-ups to eligible terminal agent stages revive an interactive **post-mortem chat** through the shared resolver: on a live-handle miss the stage's retained `sessionFile` is validated (existing, readable, context-bearing) and reopened as a detached, single-flight handle so the message is delivered as a conversational follow-up appended in place — the same path used by `/workflow attach`, restored/replayed durable snapshots, and completed-workflow inspection — without resuming, retrying, or re-dispatching workflow execution. If no valid retained session exists, the follow-up is refused (`No live handle for stage.`) instead of silently resetting or exposing a handle-less non-terminal session. Arbitrary `ctx.ui.custom<T>` widget prompts require the interactive workflow graph and return a clear unsupported message when targeted through `send`. `delivery: "auto"` answers pending prompts first, then resumes paused stages, steers streaming stages, or queues a follow-up.
 - **`reload`** — refreshes workflow resources directly in-process instead of queuing a literal `/workflow reload` chat follow-up.
+- **`models`** — returns safe model-catalog metadata from the configured registry. Each entry contains `provider` (e.g. `openai`), `id` (e.g. `gpt-4`), `fullId` (e.g. `openai/gpt-4`), `isCurrent` (whether this is the active model), and `availableThinkingLevels`, canonically derived from the registry model's `reasoning` and `thinkingLevelMap` metadata. The result is a configured-auth snapshot: it shows which models are present in the registry with configured authentication, not proof of credentials, entitlements, OAuth freshness, or live provider access. No secrets, tokens, or authentication details are returned.
 
 ### F2 keyboard shortcut
 
@@ -689,7 +694,7 @@ The parent can consume `fixes.outputs`, `verification.outputs`, and `convergence
 
 ### `deep-research-codebase`
 
-Scout + research-history chain → two parallel specialist waves → aggregator. Ideal for deep investigation of a codebase topic across locator, pattern, analyzer, and ecosystem angles.
+Heavy research for tasks requiring comprehensive, whole-repository context.
 
 ```text
 /workflow deep-research-codebase prompt="How does session persistence work?"

package/dist/builtin/workflows/builtin/deep-research-codebase.ts

@@ -18,7 +18,7 @@ import { runDeepResearchCodebase } from "./deep-research-codebase-runner.js";
 
 export default workflow({
   name: "deep-research-codebase",
-  description: "Scout + research-history chain → parallel specialist waves → aggregator for deep codebase research.",
+  description: "Heavy research for tasks requiring comprehensive, whole-repository context.",
   inputs: {
     prompt: Type.String({ description: "Research question or investigation focus for the codebase." }),
     max_partitions: Type.Number({

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.10",
+  "version": "0.9.11-alpha.1",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [

package/dist/builtin/workflows/src/durable/backend.ts

@@ -37,7 +37,7 @@ export type DurableInactiveDeleteResult =
   | { readonly ok: true }
   | { readonly ok: false; readonly reason: "not_found" | "running" };
 
-/** DBOS is the sole persistent implementation. In-memory is an explicit test seam. */
+/** DBOS is the sole persistent implementation. In-memory is a test seam and the non-durable last-resort fallback. */
 export interface DurableWorkflowBackend {
   /** Whether state survives the current process. */
   readonly persistent: boolean;
@@ -156,7 +156,7 @@ function checkpointKey(c: DurableCheckpoint): string {
   return `${c.kind}:${c.checkpointId}`;
 }
 
-/** Process-local current-interface backend for explicit test injection. */
+/** Process-local backend: explicit test injection and the loud non-durable fallback when DBOS cannot be provisioned. */
 export class InMemoryDurableBackend implements DurableWorkflowBackend {
   public readonly persistent: boolean = false;
   private readonly workflows = new Map<string, InMemoryWorkflowRecord>();

package/dist/builtin/workflows/src/durable/dbos-embedded-postgres-root.ts

@@ -0,0 +1,173 @@
+/**
+ * Root-execution support for the embedded DBOS Postgres.
+ *
+ * PostgreSQL categorically refuses to run `initdb`/`postgres` as UID 0, so a
+ * root Atomic process (common in containers, CI sandboxes, and eval harnesses)
+ * cannot provision the embedded cluster directly. On Linux we instead resolve
+ * an unprivileged system account, keep the cluster under a root-safe base
+ * directory (`/root` is mode 0700 and untraversable by that account), and run
+ * every Postgres command with dropped privileges.
+ *
+ * Privilege dropping is strategy-probed at runtime: Node honors the child
+ * process `uid`/`gid` spawn options, but Bun currently ignores them, so we
+ * verify the drop actually happens (`id -u` must report the owner) and fall
+ * back to `setpriv`, `runuser`, or `su` wrappers when it does not.
+ *
+ * The embedded binaries themselves may also live under an untraversable
+ * prefix (for example a root-owned `~/.nvm` global install), so the caller can
+ * probe them as the unprivileged owner and fall back to a one-time copy into
+ * the cluster base directory.
+ */
+
+import { cpSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { runLocalCommand, type LocalCommandResult } from "./local-command.js";
+
+export interface EmbeddedPostgresOwner {
+  readonly uid: number;
+  readonly gid: number;
+  readonly name: string;
+}
+
+export interface EmbeddedPostgresRunContext {
+  /** Directory that holds the cluster, log file, and setup locks. */
+  readonly baseDir: string;
+  /** Present only when commands must drop privileges (Linux root). */
+  readonly owner?: EmbeddedPostgresOwner;
+  /** Runs a command as the owner; identity pass-through when no owner. */
+  readonly runAsOwner: LocalCommandRunner;
+}
+
+export interface EmbeddedPostgresBinaryPaths {
+  readonly pg_ctl: string;
+  readonly initdb: string;
+}
+
+export type LocalCommandRunner = (
+  command: string,
+  args: readonly string[],
+  options?: { readonly uid?: number; readonly gid?: number },
+) => Promise<LocalCommandResult>;
+
+/** Root-safe cluster location: system path, traversable by system accounts. */
+export const ROOT_EMBEDDED_BASE_DIR = "/var/lib/atomic-postgres";
+
+/** Unprivileged accounts tried in order; `postgres` wins when present. */
+const OWNER_CANDIDATES = ["postgres", "nobody", "daemon"] as const;
+
+export function defaultEmbeddedBaseDir(): string {
+  return join(homedir(), ".atomic", "postgres");
+}
+
+/**
+ * Resolve where and as whom the embedded cluster should run. Non-root (and
+ * every non-Linux platform) keeps the historical home-directory layout. Linux
+ * root without a resolvable unprivileged account, or without any working
+ * privilege-drop mechanism, also falls through to the default context so
+ * PostgreSQL's own root refusal surfaces with full detail.
+ */
+export async function resolveEmbeddedRunContext(
+  runner: LocalCommandRunner = runLocalCommand,
+  euid: number | undefined = process.getuid?.(),
+  platform: NodeJS.Platform = process.platform,
+): Promise<EmbeddedPostgresRunContext> {
+  if (platform !== "linux" || euid !== 0) {
+    return { baseDir: defaultEmbeddedBaseDir(), runAsOwner: runner };
+  }
+  for (const name of OWNER_CANDIDATES) {
+    const owner = await lookupOwner(runner, name);
+    if (owner === undefined) continue;
+    const runAsOwner = await resolvePrivilegeDrop(runner, owner);
+    if (runAsOwner === undefined) continue;
+    return { baseDir: ROOT_EMBEDDED_BASE_DIR, owner, runAsOwner };
+  }
+  return { baseDir: defaultEmbeddedBaseDir(), runAsOwner: runner };
+}
+
+/**
+ * Return a runner that verifiably executes commands as the owner, or
+ * `undefined` when no drop mechanism works. Each strategy is validated by
+ * running `id -u` through it and requiring the owner's uid on stdout — the
+ * spawn `uid`/`gid` options in particular are silently ignored by Bun.
+ */
+export async function resolvePrivilegeDrop(
+  runner: LocalCommandRunner,
+  owner: EmbeddedPostgresOwner,
+): Promise<LocalCommandRunner | undefined> {
+  const strategies: readonly LocalCommandRunner[] = [
+    (command, args) => runner(command, args, { uid: owner.uid, gid: owner.gid }),
+    (command, args) => runner("setpriv", [
+      `--reuid=${owner.uid}`, `--regid=${owner.gid}`, "--clear-groups", "--", command, ...args,
+    ]),
+    (command, args) => runner("runuser", ["-u", owner.name, "--", command, ...args]),
+    (command, args) => runner("su", ["-s", "/bin/sh", "-c", shellCommand(command, args), owner.name]),
+  ];
+  for (const strategy of strategies) {
+    const probe = await strategy("id", ["-u"]).catch(() => undefined);
+    if (probe !== undefined && probe.exitCode === 0 && probe.stdout.trim() === String(owner.uid)) {
+      return strategy;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Ensure the embedded binaries are executable by the drop-privilege owner.
+ * Probes `initdb --version` as the owner; on failure (typically an
+ * untraversable ancestor such as `/root`) copies the package's `native` tree
+ * into the cluster base directory once and reuses it afterwards.
+ */
+export async function prepareBinariesForOwner(
+  binaries: EmbeddedPostgresBinaryPaths,
+  context: EmbeddedPostgresRunContext,
+  runner: LocalCommandRunner = runLocalCommand,
+): Promise<EmbeddedPostgresBinaryPaths> {
+  const owner = context.owner;
+  if (owner === undefined) return binaries;
+
+  const probe = await context.runAsOwner(binaries.initdb, ["--version"]).catch(() => undefined);
+  if (probe !== undefined && probe.exitCode === 0) return binaries;
+
+  // `<packageRoot>/native/bin/initdb` → copy the whole `native` tree so the
+  // binaries keep their relative `../lib` runtime library references.
+  const nativeDir = dirname(dirname(binaries.initdb));
+  const copiedNativeDir = join(context.baseDir, "pg-runtime", "native");
+  const copied: EmbeddedPostgresBinaryPaths = {
+    pg_ctl: join(copiedNativeDir, "bin", "pg_ctl"),
+    initdb: join(copiedNativeDir, "bin", "initdb"),
+  };
+  if (!existsSync(copied.initdb)) {
+    cpSync(nativeDir, copiedNativeDir, { recursive: true });
+  }
+  const chown = await runner("chown", ["-R", `${owner.uid}:${owner.gid}`, join(context.baseDir, "pg-runtime")]);
+  if (chown.exitCode !== 0) {
+    throw new Error(
+      `Could not hand the copied embedded Postgres runtime to ${owner.name}: ${chown.stderr.trim() || chown.stdout.trim() || `exit ${chown.exitCode}`}`,
+    );
+  }
+  return copied;
+}
+
+async function lookupOwner(runner: LocalCommandRunner, name: string): Promise<EmbeddedPostgresOwner | undefined> {
+  const uid = await lookupId(runner, ["-u", name]);
+  const gid = await lookupId(runner, ["-g", name]);
+  if (uid === undefined || gid === undefined || uid === 0) return undefined;
+  return { uid, gid, name };
+}
+
+async function lookupId(runner: LocalCommandRunner, args: readonly string[]): Promise<number | undefined> {
+  try {
+    const result = await runner("id", args);
+    if (result.exitCode !== 0) return undefined;
+    const value = Number.parseInt(result.stdout.trim(), 10);
+    return Number.isInteger(value) && value > 0 ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Single-quote a command line for `su -c`; arguments never embed user input. */
+function shellCommand(command: string, args: readonly string[]): string {
+  return [command, ...args].map((part) => `'${part.replaceAll("'", "'\\''")}'`).join(" ");
+}

package/dist/builtin/workflows/src/durable/dbos-embedded-postgres.ts

@@ -10,12 +10,23 @@
  * is started with `pg_ctl`, which daemonizes the server into its own session:
  * it survives Atomic exiting and is shared by every concurrent Atomic session.
  * Atomic never stops it.
+ *
+ * PostgreSQL refuses to run as UID 0, so a root Atomic process (containers,
+ * CI sandboxes, eval harnesses) resolves an unprivileged system account, keeps
+ * the cluster under `/var/lib/atomic-postgres` instead (a root home directory
+ * is untraversable for that account), and runs every Postgres command with
+ * dropped privileges. See dbos-embedded-postgres-root.ts.
  */
 
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { chmodSync, chownSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { dirname, join, relative } from "node:path";
-import { commandFailureDetail, delay, runLocalCommand, tcpReachable } from "./local-command.js";
+import {
+  prepareBinariesForOwner,
+  resolveEmbeddedRunContext,
+  type EmbeddedPostgresRunContext,
+} from "./dbos-embedded-postgres-root.js";
+import { commandFailureDetail, delay, tcpReachable } from "./local-command.js";
 
 const EMBEDDED_HOST = "127.0.0.1";
 const EMBEDDED_PORT = 5439;
@@ -47,17 +58,20 @@ export function ensureEmbeddedDbosPostgres(): Promise<void> {
 
 async function ensure(): Promise<void> {
   if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
-  const binaries = await loadEmbeddedPostgresBinaries();
-  hydrateBinaryLibraryLinks(binaries.pg_ctl);
-  const root = join(homedir(), ".atomic", "postgres");
+  const loaded = await loadEmbeddedPostgresBinaries();
+  hydrateBinaryLibraryLinks(loaded.pg_ctl);
+  const context = await resolveEmbeddedRunContext();
+  const root = context.baseDir;
   const dataDir = join(root, `v${EMBEDDED_PG_MAJOR}`);
   const logFile = join(root, `v${EMBEDDED_PG_MAJOR}.log`);
   mkdirSync(root, { recursive: true, mode: 0o700 });
+  if (context.owner !== undefined) chownSync(root, context.owner.uid, context.owner.gid);
+  const binaries = await prepareBinariesForOwner(loaded, context);
 
   await withSetupLock(join(root, `v${EMBEDDED_PG_MAJOR}.setup-lock`), async () => {
     if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
-    if (!existsSync(join(dataDir, "PG_VERSION"))) await initializeCluster(binaries.initdb, dataDir);
-    await startCluster(binaries.pg_ctl, dataDir, logFile);
+    if (!existsSync(join(dataDir, "PG_VERSION"))) await initializeCluster(binaries.initdb, dataDir, context);
+    await startCluster(binaries.pg_ctl, dataDir, logFile, context);
   });
 
   for (let attempt = 0; attempt < READY_ATTEMPTS; attempt += 1) {
@@ -67,11 +81,16 @@ async function ensure(): Promise<void> {
   throw new Error(`Embedded Postgres started but never accepted connections on ${EMBEDDED_HOST}:${EMBEDDED_PORT}; see ${logFile}.`);
 }
 
-async function initializeCluster(initdb: string, dataDir: string): Promise<void> {
+async function initializeCluster(
+  initdb: string,
+  dataDir: string,
+  context: EmbeddedPostgresRunContext,
+): Promise<void> {
   const passwordFile = join(tmpdir(), `atomic-pg-pw-${process.pid}-${crypto.randomUUID().slice(0, 8)}`);
   writeFileSync(passwordFile, `${EMBEDDED_PASSWORD}\n`, { mode: 0o600 });
   try {
-    const result = await runLocalCommand(initdb, [
+    if (context.owner !== undefined) chownSync(passwordFile, context.owner.uid, context.owner.gid);
+    const result = await context.runAsOwner(initdb, [
       "-D", dataDir,
       "-U", EMBEDDED_USER,
       "-A", "password",
@@ -87,8 +106,13 @@ async function initializeCluster(initdb: string, dataDir: string): Promise<void>
   }
 }
 
-async function startCluster(pgCtl: string, dataDir: string, logFile: string): Promise<void> {
-  const result = await runLocalCommand(pgCtl, [
+async function startCluster(
+  pgCtl: string,
+  dataDir: string,
+  logFile: string,
+  context: EmbeddedPostgresRunContext,
+): Promise<void> {
+  const result = await context.runAsOwner(pgCtl, [
     "-D", dataDir,
     "-l", logFile,
     "-o", `-p ${EMBEDDED_PORT} -c listen_addresses=${EMBEDDED_HOST}`,

package/dist/builtin/workflows/src/durable/dbos-lifecycle.ts

@@ -119,10 +119,16 @@ export function getReadyDbosBackendSync(): DbosDurableBackend | undefined {
 
 export async function shutdownDbos(): Promise<void> {
   if (shutdownPromise !== undefined) return await shutdownPromise;
-  if (configured === undefined) return;
+  const configuredPromise = configured;
+  if (configuredPromise === undefined) return;
   shutdownPromise = (async () => {
-    const durability = await configured;
-    if (launchPromise !== undefined) await launchPromise;
+    // A backend that never reached "ready" has nothing to flush or stop.
+    // `configured`/`launchPromise` memoize rejections, so re-awaiting them
+    // unguarded would rethrow the original provisioning failure out of every
+    // session dispose — crashing otherwise-successful runs at process exit.
+    const durability = await configuredPromise.catch(() => undefined);
+    if (durability === undefined) return;
+    if (launchPromise !== undefined) await launchPromise.catch(() => undefined);
     if (state !== "ready") return;
     state = "shutting_down";
     await durability.backend.flush();

package/dist/builtin/workflows/src/durable/factory.ts

@@ -1,4 +1,4 @@
-/** DBOS-only durable backend factory and internal test injection seam. */
+/** DBOS-first durable backend factory with a non-durable last-resort fallback. */
 
 import { InMemoryDurableBackend, type DurableWorkflowBackend } from "./backend.js";
 import {
@@ -9,8 +9,9 @@ import {
 
 let injectedBackend: DurableWorkflowBackend | undefined;
 let initializedBackend: DurableWorkflowBackend | undefined;
+let initializing: Promise<DurableWorkflowBackend> | undefined;
 
-/** Return the injected test backend or the process-wide ready DBOS backend. */
+/** Return the injected test backend or the process-wide initialized backend. */
 export function getDurableBackend(): DurableWorkflowBackend {
   const backend = injectedBackend ?? initializedBackend ?? getReadyDbosBackendSync();
   if (backend === undefined) throw new DbosNotReadyError();
@@ -20,7 +21,10 @@ export function getDurableBackend(): DurableWorkflowBackend {
 /** Internal injection seam. Production initialization uses DBOS. */
 export function setDurableBackend(backend: DurableWorkflowBackend | undefined): void {
   injectedBackend = backend;
-  if (backend === undefined) initializedBackend = undefined;
+  if (backend === undefined) {
+    initializedBackend = undefined;
+    initializing = undefined;
+  }
 }
 
 /** Create an isolated current-interface backend for tests only. */
@@ -28,9 +32,34 @@ export function createInMemoryTestBackend(): InMemoryDurableBackend {
   return new InMemoryDurableBackend();
 }
 
-/** Configure, register, launch, and install the mandatory DBOS backend. */
+/**
+ * Configure, register, launch, and install the DBOS backend.
+ *
+ * When no durable backend can be provisioned (no `DBOS_SYSTEM_DATABASE_URL`,
+ * embedded Postgres unavailable — e.g. running as root without an
+ * unprivileged account — and no Docker), workflows degrade to a process-local
+ * in-memory backend with a loud warning instead of refusing to run at all.
+ * Non-durable runs execute normally but do not survive the process:
+ * `/workflow resume` after exit has nothing to restore.
+ */
 export async function initializeDurableBackend(): Promise<DurableWorkflowBackend> {
   if (injectedBackend !== undefined) return injectedBackend;
-  initializedBackend ??= await getReadyDbosBackend();
-  return initializedBackend;
+  if (initializedBackend !== undefined) return initializedBackend;
+  initializing ??= getReadyDbosBackend()
+    .catch((error: unknown) => degradeToNonDurableBackend(error))
+    .then((backend) => {
+      initializedBackend = backend;
+      return backend;
+    });
+  return await initializing;
+}
+
+function degradeToNonDurableBackend(error: unknown): DurableWorkflowBackend {
+  const detail = error instanceof Error ? error.message : String(error);
+  console.error(
+    "atomic-workflows: durable backend unavailable — continuing NON-DURABLY with an in-memory backend. "
+    + "Workflow runs will execute, but their state will not survive this process and `/workflow resume` "
+    + `after exit will not work. Restore durability by fixing Postgres provisioning: ${detail}`,
+  );
+  return new InMemoryDurableBackend();
 }