@bastani/atomic 0.9.11-alpha.1 → 0.9.11-alpha.10

package/CHANGELOG.md

@@ -2,6 +2,246 @@
 
 ## [Unreleased]
 
+## [0.9.11-alpha.10] - 2026-08-01
+
+### Fixed
+
+- Fixed an isolated interactive-engine exit after an admitted tool call leaving that session permanently pending and unusable on resume. Reopening an inactive session now derives explicit error results for unanswered `toolUse` calls without rewriting its append-only JSONL, so the transcript can render, compact, and accept another prompt while preserving that the interrupted command's side effects are unknown. Unexpected-restart notices now also retain the bounded exit kind, code, or signal that triggered recovery while excluding child stderr.
+- Fixed Anthropic subscription login on Bun-hosted Linux sessions remaining at `Exchanging authorization code for tokens...`. Atomic's HTTP setup relied on Undici's CommonJS `install()` helper, but Bun does not expose that helper through its ESM namespace, so source-mode and compiled interactive-engine processes silently kept Bun's native `fetch` instead of the configured Undici transport. Atomic now installs the exported Undici web globals explicitly under Bun. Login completion also ends when the provider credential is persisted and publishes that provider against the already-loaded model snapshot immediately; cache restoration, ambient availability checks, and catalog discovery no longer run inside the successful credential transaction, so none can keep the login dialog open after the provider appears in `auth.json`.
+- Fixed existing authenticated users being unable to select a model, or seeing `Refreshing model catalogs…` indefinitely, after an isolated or direct `/model` refresh stalled. The frontend's 15-second abort previously never crossed the engine RPC boundary, the engine started its deadline only after an unbounded credential/availability reload, and the selector assumed refresh work would honor cancellation. The shared deadline now covers credential reload and catalog work inside the engine, the selector races that deadline itself and replaces the progress state on both timeout and rejection, and model refreshes use a concurrent correlated lane so selection remains responsive while catalogs update. Existing `auth.json` credentials remain compatible and no `~/.atomic` reset is required.
+- Fixed `/logout` timing out after it had already deleted the credential, leaving the provider in `/model` until restart and preventing the selector from reopening. Logout now publishes credential removal immediately, skips post-logout catalog refreshes, bounds the local probe for authentication that remains in the environment, and prevents a model refresh started before the mutation from overwriting the newer login or logout snapshot when it eventually settles.
+
+## [0.9.11-alpha.9] - 2026-08-01
+
+### Breaking Changes
+
+- Adopted pi 0.83.0 (`@earendil-works/pi-agent-core`, `@earendil-works/pi-ai`, `@earendil-works/pi-tui` at `^0.83.0`), which moves the bundled TypeBox to 1.3.7. TypeBox 1.3.7 **removes seven deprecated APIs**. Atomic inherits the removal exactly as upstream shipped it and does not provide a compatibility shim, so an extension, skill, workflow, or MCP schema that still calls one of these will now fail to compile and to run. Atomic's own sources use none of them; the migration below is for package authors. TypeBox 1.3.7 also fixes compiled validation of nullable array tool arguments, and — because `typebox` is pinned to a single hoisted `1.3.7` node — an Atomic-defined tool schema and a pi-defined one now validate identically in the same process.
+
+  | Removed API | Replacement | Migration |
+  | --- | --- | --- |
+  | `Type.Options(type, options)` | `Type.With(type, options)` | Straight rename; same arguments, same result. `Options` was already an alias of `With`. |
+  | `Type.Base` | `Type.Refine()` + `Type.Unsafe()` | `class DateType extends Type.Base<Date> { Check(value) { return value instanceof Date } }` becomes `const DateType = Type.Refine(Type.Unsafe<Date>({}), (value) => value instanceof Date)`. Class-instance schemas lost their prototype methods through TypeBox's clone/spread compositor, which is why the class form is gone. |
+  | `Type.Promise(item)` | none | Model the resolved value directly and validate after `await`, or hold the slot with `Type.Unsafe<Promise<T>>({})` when a schema entry is required. A promise was never checkable without settling it. |
+  | `Type.Awaited(type)` | none | Nothing is left to unwrap once `Type.Promise` is gone: use the resolved type itself where `Type.Awaited(Type.Promise(T))` appeared. |
+  | `Type.Iterator(items)` | none | Validate the materialized sequence with `Type.Array(items)` after draining the iterator, or hold the slot with `Type.Unsafe<Iterable<T>>({})`. |
+  | `Type.AsyncIterator(items)` | none | Same as `Type.Iterator`: drain first and validate with `Type.Array(items)`, or use `Type.Unsafe<AsyncIterable<T>>({})`. |
+  | `Value.Mutate(current, next)` | `Value.Patch(current, Value.Diff(current, next))` | `Patch` returns a **new** value rather than assigning into `current` in place, so code that relied on `Mutate` retaining internal references as a redraw signal must now assign the result and re-read the reference. |
+
+- The RPC `login_provider` response no longer carries the API key it just stored. `RpcLoginProviderResult` dropped its `credential` member and now reports `{ provider, cancelled: false, type: "api_key", …catalog }`. The key travelled as plaintext inside a JSON line on the same stdout the credential-export door treats as the single egress, and the host had itself supplied that key through the login input form, so nothing needed it echoed back. A host that read `data.credential` should use the value it submitted; `type` confirms which kind of credential was saved.
+
+### Added
+
+- Added `ctx.scopedModels` to the extension context: the read-only list of models scoped to the current session, resolved from the `--models` flag and the `enabledModels` setting — the same set `/scoped-models` shows. It is empty when no scoping is configured. The value resolves at access time, so it follows session replacement, and under the isolated interactive engine it reflects the engine's catalogue rather than a stale host snapshot. It reports the scope and cannot widen it: `readonly` is a compile-time claim only, so both the extension context and the hand-built context that shortcut handlers receive hand back a fresh copy on every read, and an extension that mutates what it was given changes nothing. Its types are exported too — `ScopedModel` for one entry and `ExtensionScopedModels` for the accessor — from `core/extensions/types.ts` and from the package root, so an extension can name what it reads without importing an internal module. Documented in `docs/extensions.md`.
+- Added `atomic auth print-api-key` and `atomic auth print-bearer-token`, which print one configured credential for an external client. The credential goes to stdout and nothing else — warnings, provider selection, refresh notices, and help all go to stderr — so `KEY=$(atomic auth print-api-key --model gpt-5.5)` cannot capture a diagnostic. `--model` is required, so no ambient "current model" can emit a credential you did not name. `--provider` and `--model` are the only options either subcommand accepts, enforced as an allowlist over the parsed arguments rather than a list of refusals, so a path-naming flag such as `--export` or `--session-dir` is a usage error instead of a flag this path happens to ignore; there is no file or clipboard sink. When `--provider` is omitted, eligibility comes from the runtime's resolved auth type for each provider offering that model, so a credential supplied by an environment variable or a custom resolver — which `auth.json` never sees — is exported like any other, and a provider offering both an API key and OAuth is selected by whichever one a request would actually use rather than by what it supports. `print-bearer-token` refreshes a token with less than `--min-expiry` (default `30m`, accepting `ms`/`s`/`m`/`h`, in both `--min-expiry 30m` and `--min-expiry=30m` spellings) remaining; `--min-expiry` with `print-api-key` is a usage error in either spelling rather than a silent no-op, because an API key has no expiry. Failures are distinguishable by exit code: `1` usage, `2` no credential configured, `3` provider ambiguous, `4` credential kind unsupported for that provider, `5` the OAuth refresh itself failed (the only exit that promises the stored credential is untouched, because that failure happens before anything is persisted), `6` the provider cannot mint a token that lives long enough, `7` any other OAuth failure, which makes no claim about the stored credential, `8` the credential could not be written and nothing was emitted, and `9` only part of it was written and the output should be discarded. Which of those two a failed write gets is read from `process.stdout.bytesWritten` rather than guessed: nothing flushed is `8` with stdout provably empty, the whole payload flushed is exit `0` with the failure on stderr — the caller holds what it asked for — and a partial flush is `9`, the one exit whose stdout is not empty, because those bytes cannot be recalled and reporting success over a truncated secret would be worse than saying so. One function in `src/cli/credential-print.ts` is the only place in the source tree that can read the credential wrapper and write it to stdout; a test enumerates every call in `packages/coding-agent/src` that puts a non-literal value on the real stdout, and carries a negative control that fails if the scanner stops reporting a planted egress. Documented in `docs/usage.md` and `docs/security.md`.
+
+### Changed
+
+- `ChatSessionHostCommands.prompt` now receives the submitting key's mode as a second argument, and the new `ChatSessionSubmitMode` (`"auto" | "followUp"`) type is exported alongside the other chat-session host types. A host whose idle prompt command chooses a delivery queue can now read the mode of the invocation it is serving instead of shared state a concurrent submission may still own. Existing single-argument `prompt` implementations keep working unchanged ([#2074](https://github.com/bastani-inc/atomic/issues/2074)).
+- The `/model` selector now highlights the top row whenever a filter query is typed, so the best match is the one Enter selects. Clearing the query restores the previous position, clamped to the restored list.
+- Toggling tool-output expansion now reports the new state (`Tool output: expanded` / `Tool output: collapsed`) on the status line instead of re-rendering silently.
+- The startup RESOURCES disclosure now lists `SYSTEM.md` and `APPEND_SYSTEM.md` alongside the `AGENTS.md`/`CLAUDE.md` context files, in the order they reach the prompt. Those files shape the system prompt exactly like a context file, so leaving them out of the listing hid them.
+- llama.cpp models now declare streaming usage support, so token usage is reported during a streamed response instead of only at the end.
+- A provider that ends a turn with a terminal reason the mapping does not recognise now surfaces a provider error naming the raw reason, instead of reporting an ordinary successful stop. A truncation or safety signal a provider adds after this release is therefore visible rather than arriving as a turn that looks like it finished normally; every raw reason that already mapped to a successful stop still does. Documented in `docs/providers.md`.
+- Assistant messages carry the new `pending` stop reason while they are still streaming. It is replaced by the terminal reason before the message completes, so it never reaches session JSONL, but an RPC or SDK client that switches on the stop reason of a partial message needs the case, and a custom `streamSimple` provider should start its partial message at `pending` and raise if the stream ends still holding it. Documented in `docs/providers.md`, `docs/custom-provider.md`, `docs/rpc.md`, and `docs/session-format.md`.
+- A stored OAuth token is now refreshed once fewer than five minutes of validity remain, rather than at expiry, so a long turn is no longer started on a credential that dies mid-request. The refresh runs inside the `auth.json` lock and re-checks the stored expiry after taking it, so concurrent sessions sharing one credential file refresh it once between them rather than once each. Documented in `docs/providers.md`.
+- The OpenRouter login now accepts a pasted final redirect URL, or the authorization code on its own, for remote and headless machines where the browser cannot reach the loopback callback. pi 0.83.0 added that fallback to the OpenRouter OAuth flow, which races the callback against a manual-entry prompt; Atomic's terminal only offers the input for providers whose metadata declares a callback server, so inheriting the flow alone left the prompt waiting on an input that was never shown and the login ended at the callback timeout. Documented in `docs/providers.md`.
+
+### Fixed
+
+- Fixed `/reload` re-transpiling and re-evaluating the entire transitive TypeScript graph of every extension on Windows and in single-file (compiled) builds even when nothing changed. Transformed extension evaluations now record a per-extension graph manifest mapping every file jiti reads to a SHA256 content hash, persisted under the versioned transpile cache directory. On reload, an unchanged graph — every recorded file rehashes identically and the stored manifest matches — reuses the previously evaluated factory instead of re-importing; any hash mismatch, missing file, missing or corrupt manifest, or graph-shape change falls back to a full fresh re-evaluation, which rewrites the manifest, so edited extension source is always picked up. Measured on Windows, reloading the five builtin packages drops from ~25 s cold / ~16 s warm (jiti fsCache) to ~90 ms — the cost of rehashing the recorded graph ([#2069](https://github.com/bastani-inc/atomic/issues/2069)).
+- Hardened the archive and SQLite path-selector parsers used by the read, search, and write tools against polynomial-time regex backtracking (CodeQL `js/polynomial-redos`). The ambiguous greedy `(.+\.ext)` prefixes were replaced with linear right-to-left scans; accepted selector syntax and parsing results are unchanged.
+- Fixed a failed `git` package install leaving a half-written checkout behind. Because the next install treats an existing target directory as installed, that partial clone silently suppressed the repair. A clone, checkout, or dependency install that fails now removes the target directory and prunes the host/owner directories it created.
+- Fixed the RPC `bash` command bypassing extension `user_bash` handlers. A sandbox or remote-shell extension that intercepts user shell commands now sees an RPC `bash` request exactly as it sees `user_bash`, with request-scoped ownership, streaming correlation, and result recording unchanged.
+- Fixed a startup session switch rendering every agent event twice. A session replacement that began while the startup rebind was still binding extensions produced two live agent subscriptions; the superseded rebind now returns without subscribing.
+- Fixed session-tree navigation being accepted while a response was still streaming, which stranded the in-flight turn's tool results on the abandoned branch. Navigation now rejects while streaming, the interactive tree selector stops the active response (restoring queued messages to the editor) before navigating, and a session replacement settles its active response before the outgoing session is torn down. The isolated engine's host facade deliberately does not re-enter its cooperative-abort round trip during teardown, so an unresponsive or dead engine still cannot hang a session switch.
+- Fixed a nested linked git worktree loading the repository's `AGENTS.md`/`CLAUDE.md` twice. When a worktree created inside its own main repository has its own copy of the same tracked context file, the main repository's copy is now skipped. Ordinary repositories, sibling worktrees, bare layouts, and submodules keep normal ancestor inheritance.
+- Fixed extension-contributed skills, prompt templates, and themes losing their package source metadata when they were registered after a resource reload. The reload's resolved metadata is now retained on the loader so later `extendResources` passes still resolve it.
+
+## [0.9.11-alpha.8] - 2026-07-29
+
+### Breaking Changes
+
+- Replaced Atomic's legacy extension OAuth registration bridge with provider-owned authentication from `@earendil-works/pi-ai`. Extensions must declare OAuth or API-key authentication on their provider registration. The package root no longer exports the bridge functions `registerOAuthProvider`, `resetOAuthProviders`, `getOAuthApiKey`, `getOAuthProvider`, or `getOAuthProviders`, nor the bridge and credential/status types `LegacyOAuthProvider`, `OAuthProviderDescriptor`, `ApiKeyCredential`, `AuthCredential`, `AuthStatus`, or `OAuthCredential`; import current credential types from `@earendil-works/pi-ai` and use provider-owned authentication instead. The internal legacy registration/refresh machinery and custom API-key login hooks beyond pi's provider contract were also removed.
+- Model configuration now follows pi's single-file `ModelConfig` contract. Atomic reads one `models.json` from the active Atomic agent directory (`~/.atomic/agent/models.json`, or the directory selected by `ATOMIC_CODING_AGENT_DIR`/`PI_CODING_AGENT_DIR`); it no longer reads project-scoped `.atomic/models.json`, falls back to `~/.pi/agent/models.json`, or layers and merges `.pi` and `.atomic` model configuration files. Move project-scoped custom providers and models into the active agent-directory file. The legacy `.pi` read fallback remains only for configuration surfaces that explicitly use layered paths, such as `auth.json`.
+- Model-catalog refreshes now use pi's exact timeout semantics. `modelRefreshTimeoutMs` applies only to the initial runtime creation refresh, and post-login catalog refreshes are unbounded; the interactive `/model` selector owns its 15-second refresh timeout like pi, rendering cached models immediately, aborting a slow refresh, and reporting "Model refresh timed out; showing cached models." Callers of `ModelRuntime.refresh()` that require cancellation must provide their own abort signal.
+- Extension `streamSimple` implementations are now scoped to their registered provider and `ModelRuntime`, matching pi's provider composer. Unregistering a newer provider no longer restores an older global API-owner registration; extensions that replace a provider stream must keep that provider registered for as long as the stream should remain active.
+- Remote model catalogs now publish refreshed models in memory before persisting the catalog, matching pi's ordering. If the catalog-store write fails, refresh reports the storage error but the newly refreshed in-memory catalog remains active for the current process.
+- `AuthStorage` now implements pi's asynchronous `CredentialStore` contract directly. Its synchronous compatibility methods (`get`, `set`, `remove`, `has`, `hasAuth`, `getAll`, `getAuthStatus`, `getLoadError`, `drainErrors`, and synchronous `list`), `asCredentialStore()` adapter, fallback/runtime-key helpers (`setFallbackResolver`, `getRuntimeApiKey`, `setRuntimeApiKey`, and `removeRuntimeApiKey`), and provider-auth methods (`login`, `logout`, `logoutAsync`, `getModelAuth`, `getApiKey`, and `getOAuthProviders`) were removed. Use and `await` `read`, `list`, `modify`, and `delete` for persisted credentials, call `reload` when an existing instance must reread its backing store, and use `ModelRuntime` for authentication resolution, login/logout, and runtime API-key overrides.
+- `ModelRegistry` is now constructed from a `ModelRuntime` and exposes only pi's thin compatibility-facade surface. The `create` and `inMemory` factories, public `authStorage` member, and the `canRestoreUnknownModel`, `checkAuth`, `getAuth`, `getCustomApiKeyAuth`, `getCustomApiKeyAuthProviders`, `getProviders`, `hasProvider`, `hasRegisteredStreamSimpleForApi`, `login`, and `logoutProvider` methods were removed. Instantiate and consume `ModelRuntime` for runtime-owned model/provider discovery and authentication, and pass it to `new ModelRegistry(runtime)` only where the synchronous extension-facing facade is required.
+- `CreateAgentSessionOptions` no longer accepts the public `authStorage` and `modelRegistry` overrides. Construct or supply a `ModelRuntime` through `modelRuntime` instead; when omitted, `createAgentSession()` creates the runtime from the active agent directory's `auth.json` and `models.json`.
+- Isolated interactive `ctx.ui.custom()` components that consume Ctrl+C must now pass `{ handlesCtrlC: true }`. Without that declaration the first Ctrl+C is the host escape and closes the focused component, resolving its promise with `undefined`; a declared component receives the first press and stays host-closable on the next one. This keeps a component that never resolves from trapping the keyboard. The bundled workflow and MCP surfaces were migrated; third-party extensions that bind Ctrl+C for Skip, Close, or cancel need the one-line addition.
+
+### Added
+
+- Added a `handlesCtrlC` option to `ctx.ui.custom()` for components that bind the key themselves. See the migration note under Breaking Changes for the behavior an existing component must declare to keep.
+
+### Changed
+
+- Adopted pi's provider-owned `ModelRuntime` architecture for model composition, credentials, streaming, and catalog refresh. `ModelRegistry` is now the thin synchronous extension-compatibility facade used by pi, while coding-agent, SDK, RPC, isolated-engine, workflow, and MCP internals consume `ModelRuntime` directly.
+
+### Fixed
+- Fixed physical Escape and Ctrl+C depending on the configurable `app.clear` action. With `app.clear` bound to Escape, Escape could reach the engine stop/restart branch while Ctrl+C lost the host route entirely — the opposite of the intended behavior on both keys. Both are now matched by physical key identity through pi-tui's parser (so complete CSI/OSC sequences and bracketed paste are never mistaken for a bare Escape, and Kitty key-release events never act twice), and the configured `app.clear` still governs ordinary editor clearing on whatever key it is bound to. The editor applies the same fixed Escape guard before its configurable action handlers, while keeping Escape as autocomplete cancel when autocomplete is open.
+- Fixed the remote-UI escape hatch replacing a healthy engine, and made it act on the first press. Ctrl+C behind a remote `ctx.ui.custom()` component used to need two presses and then stopped and replaced the whole engine child, discarding everything else that generation was doing. Ownership is now declared per mount: an unresponsive engine is still terminated on the first press (a wedged child cannot run a local handler either), a component that declared `handlesCtrlC` receives the press and keeps working — and is closed if it is still holding input on the next one — and an undeclared component is closed immediately through the ordinary close path, resolving its `ctx.ui.custom()` promise with `undefined` while the engine, and every other component it has mounted, keeps running.
+- Fixed an engine child that exits during the startup window leaving a live TUI bound to a dead engine. A child could report ready, let startup return, and exit before the host finished attaching its listeners; that death had no listener and recovery never ran. The terminal event is now retained and replayed to a listener that attaches afterwards, while a death belonging to an already-replaced generation is never replayed.
+- Fixed frames buffered by a dead engine generation being delivered to the host afterwards. A `ctx.ui.custom()` mount frame queued before its controller subscribed could arrive after that generation died and after teardown ran, remounting exactly the UI the teardown had just closed — and colliding with the replacement child, whose component IDs restart at the same values. Buffered engine messages and extension UI requests are now tagged with their generation, dropped when it dies, and never observed from a replaced generation; frames belonging to the live generation still replay as before.
+- Fixed two submissions whose text differs only in whitespace being able to restore each other's draft. The exact typed buffer travelled in a single shared slot that every Enter overwrote and every finished turn cleared, so a failure could put back the wrong text — or nothing. Each submission now carries its own draft end to end, through the input queue and the prompt turn, and submissions still queued behind a failed one come back with it in the order they were entered rather than being restored later in reverse.
+- Fixed a raw stream write failure still discarding submitted text. `write EPIPE`, `Cannot call write after a stream was destroyed`, and `write after end` are exactly what a dying engine produces, and none of them matched the message fragments the host used to recognize a send that never landed — so those submissions showed a red `Error: write EPIPE` and the typed text was lost. Transport failures are now classified where they happen, with an additive non-enumerable marker that leaves the error's identity and its `code`, `errno`, and `syscall` fields intact, and the queued writer, the child exit/error/stdin handlers, an explicit stop, a malformed transport, a missing writer, and a not-started client all carry it. Request timeouts after a successful write, RPC error responses, provider failures, and anything after `agent_start` are deliberately not classified and still surface as errors.
+- Fixed an idle Alt+Enter submission losing its surrounding whitespace when the send failed. Alt+Enter is an app action, so the editor never takes its own pre-trim snapshot for it and the submit handler's only draft is the value the Alt+Enter path hands over — which was the already-trimmed text. The raw expanded buffer is passed instead, so a failed idle follow-up now returns exactly what was typed while the agent still receives the same normalized prompt.
+- Fixed quiet work that the engine had already started being offered back to the editor as unsent. Ownership was inferred from the first byte of output, so `!touch marker && sleep 400` — which changes the working tree and prints nothing — looked identical to a command the child never received: killing the engine put that `!` line back in the editor, inviting a second run. The child now announces ownership of every correlated request, flushed before its handler can touch the shell, an extension, the queue, or compaction, and the host restores a draft only for a transport failure that arrived without an announcement. An accepted failure is reported as an ordinary failure instead. The interactive-engine protocol version is now `2`; a mismatched host and child do not bind rather than falling back to the old policy.
+- Fixed automatic recovery discarding the ownership of the work it was recovering from. An announcement can still be unparsed in the pipe when the child dies, and recovery — which starts in the same turn as the death event — detached the reader, retired the generation, and re-failed those requests with `Agent process stopped`, so already-running work was reported as never sent and offered back for a second run. A dead generation now gets a bounded settling window: its UI is torn down immediately as before, but its stdout keeps being read, only its ownership frames are honoured, its requests are classified exactly once with the error of whatever ended it, and the replacement starts only afterwards. Every terminal cause — exit, spawn error, stdin error, malformed transport, and explicit stop — goes through that one path, and a descendant that inherited stdout cannot delay recovery beyond the bound. The JSONL reader also reports completion for a stream that ends with nothing buffered, which previously left that wait to time out.
+- Fixed session teardown racing an engine replacement. A recovery attempt sits between its own stop and its spawn with no child attached, so disposal's stop found nothing to do and returned — and the attempt then started a fresh engine, plus its host initialization, after teardown had finished. Disposal now voids the in-flight restart permit and joins the attempt before returning, and a superseded restart fails as cancelled instead of quietly succeeding. Automatic single-shot recovery, the Ctrl+C rescue, and the overdue-replacement rules are unchanged; a cancelled attempt reports no failure and arms nothing.
+- Exempted every cooperative-cancellation command from the generic 30-second RPC deadline, not just `abort`. Cancelling a running `!sleep` still produced `Timeout waiting for response to abort_bash` — a red error about the host's own impatience while the engine was still working. `abort_bash`, `abort_compaction`, `abort_retry`, and `cancel_login_provider` now wait like `abort` does.
+- Fixed engine loss during an active replacement leaving the host with no engine and no way to ask for one. A newer child dying while the automatic attempt was still running was silently ignored, and once that attempt settled nothing armed Ctrl+C. The nested death now latches the escape hatch without starting a second automatic restart, so recovery stays single-shot and user-driven.
+- Fixed engine-owned line widgets surviving the generation that published them. `setWidget` writes plain host state with no component to close, so a dead generation left its lines on screen. Widget keys are now tracked against their latest writing generation and released only when that generation dies; a newer generation that rewrites the same key takes ownership and its content survives stale cleanup.
+- Fixed the restored draft being the already-trimmed submission rather than what was typed. pi-tui expands pastes, trims, and clears the editor before it calls `onSubmit`, so the callback argument could never carry the user's leading or trailing whitespace. The editor now snapshots its expanded buffer for the same input dispatch that submits it, and restoration uses that.
+- Stopped showing a red transport error next to a restored draft. A submission the engine never accepted already reports itself: the draft is back in the editor and the calm recovery status explains why. Errors that were not restored — provider failures, model errors, and any failure after the agent turn started — still surface.
+- Fixed a stream write that failed in its callback leaving its caller's promise pending forever. An EPIPE to a dying engine could hang a prompt or an abort instead of failing it; the in-flight frame is now rejected along with everything still queued.
+- Fixed the heartbeat observer consuming the buffered startup custom-UI messages. Watching heartbeats through the generic engine-message channel drained messages queued before the real controllers subscribed, so a custom UI opened during startup could be lost. Heartbeats now arrive on a dedicated callback that does not participate in that buffering.
+
+- Fixed interrupting a tool call terminating the interactive engine and reporting `Engine terminated; … result unknown; inspect side effects before retrying`. Escape raced the engine's cooperative abort against a 250 ms deadline and killed plus restarted the engine child whenever it lost that race, which any ordinary event-loop stall in the child could cause — a synchronous extension or tool callback, GC, or a large tool-output flush. Escape now simply requests the engine's cooperative cancellation and waits for it: interrupting never terminates the engine, never restarts it, never discards in-flight tool state, and the removed message no longer exists anywhere in Atomic. The wait is genuinely unbounded — `abort` is exempt from the generic 30-second RPC deadline, so a stopped or blocked child no longer turns Escape into a red `Timeout waiting for response to abort` while the engine is still working.
+- Fixed a total interactive-TUI lockup when the engine generation behind a mounted remote custom UI died. A crashed, killed, or replaced engine left the host's `ctx.ui.custom()` components mounted forever: their promises never settled, an inline mount kept the editor detached from its container, an overlay kept input focus, widget keys and terminal modes stayed claimed, and the blocking inline custom-UI depth stayed above zero, so typing, Escape, Ctrl+C, and even Ctrl+C Ctrl+C all did nothing and the process had to be killed from another terminal. Engine death is now a host-local lifecycle event that immediately closes every remote component from the dead generation, settles its promises, releases widget keys, resets terminal modes, remounts and refocuses the editor, and unwinds the inline depth to zero — without waiting for a replacement `engine_ready`, so a crash with no restart, or a hung or failed restart, recovers too. Teardown unwinds newest-first and hides each overlay through its own handle, so a nested overlay never restores focus to a layer that is already gone and never closes an unrelated native overlay, and the editor is refocused only when no surviving native modal owns input. Host `select`, `confirm`, `input`, and `editor` dialogs opened by the dead generation are now owned by it too: they used to stay on screen forever with their promise unsettled and could answer through the replacement child's writer.
+- Added recovery from an unexpected interactive-engine exit. A crashed engine previously left a live TUI bound to a dead child with no way back; Atomic now makes one automatic replacement attempt and shows the calm status `Interactive engine stopped unexpectedly; restarting.`, reports `Interactive engine restart failed: …` when the replacement cannot start, and leaves the editor mounted, focused, and usable in either case.
+- Kept an explicit escape hatch for a wedged engine, matching the watchdog's own `Esc interrupt · Ctrl+C terminate` copy, and made it reachable in every case where the key would otherwise vanish. Ctrl+C is now always handled by the host while an engine-owned `ctx.ui.custom()` component or overlay holds input — even with a healthy engine, because such a component forwards every key to the child and a component that never resolves would trap the escape key too; with a healthy engine the host closes that one component rather than touching the engine. Ctrl+C also still replaces an engine that is provably not answering: watchdog-confirmed unresponsive, a cooperative abort unanswered past the same one-second threshold, a replacement waiting for readiness past it (previously unrecoverable, since such a child emits no heartbeat and no diagnostic), or a replacement that failed outright, which now keeps Ctrl+C armed indefinitely instead of leaving the host permanently engine-less. A repeat press can stop an overdue replacement and start another; a fresh replacement is never stopped by a stray press; and host-native selectors, dialogs, input forms, and session pickers keep Ctrl+C-as-cancel whenever the engine is healthy.
+- Fixed the interactive engine exporting its private control values to every process it spawned. `ATOMIC_INTERACTIVE_ENGINE_CHILD`, `_HOST_PID`, `_GUARD_FILE`, and `_API_KEY` were set on the engine child's environment, so bash tool commands, subagent children, MCP servers, hooks, and nested Atomic runs all inherited them: a nested `atomic` started in engine mode and flooded stdout with heartbeats instead of opening a TUI, parent-process guardians watched an unrelated PID, subagent idle watchdogs never fired, and an `--api-key` credential reached every child. Deleting the variables at startup cannot fix this under Bun, where a child spawned without an explicit `env` inherits the runtime's launch-time environment; the engine is therefore now launched with an environment that never contains the values. They travel in an owner-only bootstrap file whose path is a private CLI argument, read once and unlinked by the child, and every reader uses that frozen snapshot. Legacy variables are still scrubbed from `process.env` and from subagent foreground, background-streaming, and detached-runner spawn environments as defense in depth, and extension `ctx.exec` passes an explicit environment. Bootstrap cleanup is ownership-scoped: the child unlinks exactly the file it was told to read, while recursive removal of the containing directory requires the handle the host received when it created it, so a hostile `--internal-engine-bootstrap` path cannot delete an unrelated directory. A failed publication removes its own temporary file and directory before rethrowing, so a `0600` credential file is never left behind.
+- Fixed typed input being discarded when a submission could not be sent. A prompt that failed because the engine was gone, stopping, or restarting showed only `Error: Agent process stopped` and lost the text. The submission now returns to the editor exactly as the editor handed it over, placed ahead of anything typed while the send was still pending and separated by a blank line, so neither part is lost and neither is trimmed; a pending large paste is expanded rather than reduced to a dead `[paste #1 …]` marker, which `setText` would otherwise discard. Focus returns to the editor unless a modal owns input, and the restored text is treated as a draft rather than replayed as a submission. This covers every submit route, not just Enter: `/atomic`, a deferred slash command, an extension command during compaction, a streaming steer send, `!bash`, `/compact`, and Alt+Enter all dispatch straight to the engine and previously dropped the text on their own. Text that reached a started agent turn stays in the transcript as before.
+- Fixed OAuth logins being destroyed by an unrelated model-catalog refresh, matching upstream pi's behavior. After a successful `/login`, a timed-out (aborted) or partially failed catalog refresh threw `Model refresh aborted after OAuth login` and rolled the freshly acquired tokens back to the previous credential. Because providers rotate refresh tokens, that rollback could permanently strand a server-side-invalidated credential — every send then failed with `invalid_grant` ("Refresh token not found or invalid") and every re-login was rolled back again, typically on machines with slow routes to catalog endpoints. Freshly persisted OAuth credentials now always survive the post-login refresh: per-provider refresh errors and refresh timeouts no longer fail the login in either the direct interactive or isolated-engine path, and models fall back to the cached snapshot.
+- Fixed the `/model` selector reporting `Could not refresh llama.cpp; showing cached models.` for users who never configured a llama.cpp server. The bundled llama.cpp extension now uses pi's provider-owned registration: the provider stays dormant — no refresh attempt, no error — until a server is configured through `LLAMA_BASE_URL` or a stored login, and `/login` prompts for the server URL plus optional API key exactly like pi.
+- Fixed RPC `save_provider_credential` writes disappearing after process restart. Saved API-key and OAuth credentials now persist to `auth.json` through `ModelRuntime.saveCredential()` instead of being stored as non-persistent runtime API-key overrides; the RPC command again accepts the full credential union, awaits a model-catalog refresh, and returns the refreshed catalog.
+- Fixed GitHub Copilot requests failing with `421 Misdirected Request` for users who authenticate with `COPILOT_GITHUB_TOKEN`. Upstream pi pins the `github-copilot` provider to `https://api.individual.githubcopilot.com` and only derives a per-tenant host inside its OAuth loader, so business, enterprise, and GHE tokens supplied through the environment were sent to the individual CAPI host. Atomic now resolves the endpoint for env-token auth again, highest precedence first: `COPILOT_API_TARGET` / `GITHUB_COPILOT_BASE_URL`, the token's embedded `proxy-ep` segment, `GITHUB_SERVER_URL` (`<tenant>.ghe.com` routes to `copilot-api.<tenant>.ghe.com`, other non-`github.com` hosts to `https://api.enterprise.githubcopilot.com`), and finally the public routing hub `https://api.githubcopilot.com`. A `models.json` provider `baseUrl` still overrides all of it, and the OAuth path remains exactly upstream.
+
+## [0.9.11-alpha.7] - 2026-07-28
+
+### Changed
+
+- Synchronized the complete bundled `impeccable` skill tree with pbakaus/impeccable at `14c27e43af190cbed3793d0b76e33feea4a8859a` (previously `630fc2682a5bd39b25a8e61f74b6b3f14f2b1e21`). Impeccable 4.0.3 replaces the brand/product register split with four surface modes (Persuade, Operate, Read, Experience), routes work through new `routing.md`, `new-work.md`, and mandatory `craft-floor.md` guidance in place of the deprecated `craft` ownership model, adds a `doctor` drift check with repair steps, adds documenter and finish-reviewer agents with degraded-mode reference fallbacks, adds surface briefs plus concept/composition catalogs, staleness checks, and image generation, and expands live review with generation preflight, source search and locking, poll lanes, and TanStack support alongside updated detector rules, static-HTML analysis, hooks, and platform guidance. Atomic's divergences are preserved: scanner-based HTML/script/style/comment filtering, argument-separated `git check-ignore`, backslash-safe live-preview selector escaping, the CodeQL CSS-property fix, and no removed-editor hook/provider compatibility.
+- Verified the complete bundled `playwright-cli` skill tree against microsoft/playwright-cli at `eee5a185c98e6b04d88f580d45a854e9692ab50b` (previously `793cfb32572733cbcb401e6f28d05a7a914ce408`). Every bundled file is already byte-identical to that commit, so its browser, session, tracing, and test-generation guidance is unchanged.
+- Verified the complete bundled `liteparse` skill tree against run-llama/llamaparse-agent-skills `main` at `2dcef7c62417bd2ec4671fce4621bb1e8cce48d0`, which is still the previously recorded baseline. Its `SKILL.md` and `scripts/search.py` helper are the only upstream files, the helper is byte-identical, and LiteParse's parse-once workflow, bounded search windows, BM25 fallback search, OCR, and page-screenshot guidance are unchanged. Atomic keeps two deliberate divergences: the public `LiteParse` heading and a package-relative `scripts/search.py` invocation instead of upstream's stale `Effective LiteParse` heading and `.claude/skills/effective-liteparse/` path. The skill still resolves only as `liteparse`.
+
+### Fixed
+
+- Stopped a broad Python packaging ignore rule from excluding `scripts/lib/` files inside bundled upstream skill trees, so a synchronized skill ships its complete set of modules instead of silently losing part of the tree.
+- Fixed the main and workflow-stage chats losing the automatic-compaction activity indicator after a tool result. When a tool call (for example a subagent) expanded the context enough to trigger post-tool compaction, the follow-up turn that Pi opens before compaction finishes replaced the factual `Auto-compacting...` status with a generic Working spinner, and the compaction's own cleanup then removed that spinner too — leaving the main chat with no activity at all for the rest of the continuing stream until the next user message. Compaction now keeps the status surface until its own completion event, ordinary Working resumes automatically when the same stream continues (including a successful compaction that had nothing to compact), and the attached workflow-stage chat paints its compaction status from the start event instead of waiting for an animation frame. Cancelled and failed compactions still stop all activity; the main chat keeps its existing cancellation receipt, while failures retain event-provided error text.
+- Fixed attached workflow-stage chats missing Working during workflow-authored idle follow-ups, including while a saved stage session restores or a chat attaches mid-startup. Working persists through prompt startup and pre-turn compaction; live-turn queueing and factual status precedence remain intact, and late events cannot restart it after the final retained delivery settles.
+
+## [0.9.11-alpha.6] - 2026-07-28
+
+### Added
+
+- Added execution-time session metadata to built-in, SDK/factory, direct, workflow-stage, and isolated bash execution through `ATOMIC_SESSION_ID`, `ATOMIC_SESSION_FILE`, `ATOMIC_PROVIDER`, `ATOMIC_MODEL`, and `ATOMIC_REASONING_LEVEL`, with exact `PI_*` compatibility aliases and safe omission of unsaved session files. Direct RPC bash now emits request-correlated, ordered `bash_execution_update` events that distinguish stdout from stderr, supports concurrent requests and per-request cancellation, and keeps streaming, cancellation, one terminal response, and exactly-once starting-session persistence intact across new/switch/import/fork/clone session replacement and RPC shutdown ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Added end-to-end constrained tool sampling to public extension/SDK tool definitions, wrappers, inspection, isolated transport, and model catalogs: strict JSON Schema supports `prefer`/`require`, OpenAI grammar tools support Lark/regex variants, omitted versus explicitly present optional properties remain distinguishable, and `supportsStrictMode`, `supportsStrictTools`, canonical `supportsOpenAIGrammarTools`, plus Atomic's `supportsGrammarTools` alias prevent false enforcement claims. Typed RPC model listings expose these flags through additive optional `ModelInfo.compat` ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Added Claude Opus 5 to Anthropic and Amazon Bedrock catalog paths with catalog-advertised adaptive thinking/`xhigh`, Bedrock inference profiles, prompt caching, strict-tool metadata, and preserved AWS validation errors. Custom message renderers now receive `outputPad` in normal and isolated-engine paths ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Added a compaction rung ladder so a compaction that must succeed always does. The range planner now returns typed outcomes (`ranked`, `recovered`, `rateLimited`, `unusable`, `overflowed`, `providerError`) instead of ranges-or-throw, and reasoning starvation is a distinct `starved` diagnostic category rather than an untyped empty plan. When a planner attempt ends terminally, Atomic borrows the next entry from `settings.fallbackModels` for one planner request, resolved with that candidate's own API key, headers, and base URL; borrowing is planner-only and never changes the session model, thinking level, model history, or main-chat fallback bookkeeping, and never calls `agent.continue()`. A planner request that itself overflows now withholds the oldest region lines and retries the same model until no strictly smaller view remains, with the withheld head recorded as a deterministic deletion and each trimmed view deriving its own keep target from `compression_ratio`. Silent overflows that arrive as an ordinary `stop` or `length` completion are classified before the response text is parsed, so valid-looking records cannot mask them. When every configured model is exhausted, a load-bearing compaction (overflow recovery, post-tool preflight) starts a fresh context window: a total, model-free rung that discards the compactable region and prior summary, keeps explicit protected spans, and keeps the `preserve_recent` tail unless retaining it would still exceed the provider hard input limit. That rung is loud (`✻ Context cleared (compaction degraded)`) and durable (`details.rung: "fresh"`), and a borrowed planner is recorded in `details.plannerModel` and on `compaction_end`. Manual `/compact` and threshold auto-compaction remain recoverable: they may borrow a model but can never clear context. Diagnostics gain `starved`, `rate_limited`, and `context_overflow` categories plus `rateLimitExhausted`, which separates spent retry backoff from quota/billing exhaustion, and a borrowed planned success writes a `compaction-success` sidecar naming the model that ranked the lines. Every sidecar filename now carries a per-attempt identifier and is created exclusively, so two attempts inside one millisecond keep separate durable evidence instead of overwriting each other. Generic usage-limit wording is classified as quota exhaustion rather than transient throttling, because pi-ai never schedules a backoff for it. Unavailable credentials advance the ladder instead of ending the compaction, so a fallback with its own credentials can still rank the lines and a load-bearing caller still reaches the fresh rung. A compactable region below the planner minimum reaches the fresh rung only when the context is already known not to fit — overflow recovery, or a post-tool preflight over the provider hard input limit — so one oversized tool result can no longer strand a mid-turn preflight while a threshold crossing that still fits stays a safe no-op instead of clearing context. The fallback walk is one monotonic pass over the configured list, so no position is inspected twice and the order cannot rewind. Quota exhaustion is now typed and recorded separately from transient throttling (`PlannerOutcome.rateLimited.category`, and a `quota` diagnostic category), independently of whether a retry was actually scheduled. The fresh rung keeps the `preserve_recent` tail unless the tail alone exceeds the hard input limit. `rateLimited.exhausted` and the `rateLimitExhausted` sidecar field are now derived from observed retry activity rather than assumed, and the whole HTTP `5xx` class is classified as rate limiting. A `fresh` boundary is no longer swallowed by an earlier `planned` boundary with identical text, because rung identity is part of boundary deduplication. **A configured fallback model may now receive the compaction transcript.**
+
+### Breaking Changes
+
+- Removed all Atomic-specific GitHub Copilot handling. `github-copilot` is now an ordinary upstream provider sourced entirely from `@earendil-works/pi-ai`'s `githubCopilotProvider()`, matching pi exactly. Dropped: the live CAPI `GET /models` catalog fetch and its 30-minute disk cache, the bundled static CAPI limit snapshot, dynamic Copilot model synthesis, `COPILOT_API_TARGET` / `GITHUB_COPILOT_BASE_URL` / `GITHUB_SERVER_URL` enterprise and GHE base-URL routing, the `X-GitHub-Api-Version: 2026-06-01` header, the Copilot Gemini tool-schema sanitizer, the Copilot Anthropic `message_stop` SSE repair, the Copilot Gemini reasoning-details interceptor, flattened Copilot Gemini tool-argument normalization, and Copilot prompt-limit error guidance. Model metadata now comes verbatim from the bundled pi catalog, and `COPILOT_GITHUB_TOKEN` is read by upstream's own env-key auth. Because pi's bundled context windows can exceed what Copilot's API enforces, long sessions on affected models may overrun the server-side cap instead of compacting first ([#1608](https://github.com/bastani-inc/atomic/issues/1608)).
+- Removed the short/long context-window selection feature, which upstream pi does not have. Dropped: the `contextWindowOptions` / `defaultContextWindow` / `maxInputTokens` model fields and their `Model<Api>` augmentation, the `/model` context-window picker, the `--context-window` CLI flag, the `defaultContextWindow` and `defaultContextWindows` settings, the `set_context_window` and `get_available_context_windows` RPC commands, the `context_window_changed` event, the `context_window_change` session-journal entry, the `contextWindow` / `contextWindowStrict` SDK and workflow-stage options with their `contextWindowWarning` / `contextWindowError` results, `AgentSession.setContextWindow()` / `getAvailableContextWindows()` / `supportsContextWindowSelection()`, the `parseContextWindowValue` / `formatContextWindow` / `selectContextWindow` / `getSupportedContextWindows` / `getModelDefaultContextWindow` / `withContextWindowOptions` / `normalizeContextWindowOptions` / `validateContextWindowValue` root exports, and the `(1m)` / `(long)` context token in subagent and workflow model strings. A model's `contextWindow` is now a single value taken from its catalog entry.
+- Changed the published `runVerbatimCompaction` SDK export to a request object. Positional `apiKey`, `headers`, `signal`, `thinkingLevel`, and `options` collapse into `runVerbatimCompaction(preparation, model, { resolveAuth, signal, thinkingLevel, urgency, ...options })`. Pre-resolved credentials become a `resolveAuth(model)` callback because a borrowed fallback model needs its own credentials, and `urgency` is required with no default so only a `load_bearing` caller can reach the context-destroying fresh rung. Migrate with `await runVerbatimCompaction(prep, model, { resolveAuth: options.resolvePlannerAuth, signal, urgency: "recoverable", ...options })`. The internal `planDeletedLineRanges` signature and return type also changed; it is not exported from the package root. Compaction settings, `reserveTokens` semantics and defaults, the auto-compaction threshold, `settings.retry` behavior, the persisted `CompactionEntry` shape, resume, and the `session_before_compact`/`session_compact` hooks are all preserved; `details.rung` widens additively to a third value and `details` gains one optional field.
+
+### Changed
+
+- Reworked interactive startup and ordinary working motion around Atomic's revision-3 identity system: the ∀ banner assembles inward in whole-column steps before its identity and manifesto beat land; main and workflow-stage work surfaces keep the exact one-cell `∀` visible while following a pronounced, theme-aware dark → accent → bright/bold → accent → dark luminance ramp at an 88ms cadence and retaining all 453 original randomized whimsical working verbs. Optional partial theme palettes can specify any phase exactly—including the approved Catppuccin Mocha prototype and terminal indices 0–255—while omitted tones derive from semantic selected-surface, accent, and text roles. `NO_COLOR` retains regular/bold activity without foreground-color escapes; reduced motion keeps a static regular accent `∀`; extension indicator frame and interval values remain verbatim while their phase/cadence restarts each turn; and factual status/prompt/receipt surfaces keep precedence. The inline icon and longest message fit tested standard/64-column layouts ([#1883](https://github.com/bastani-inc/atomic/issues/1883)).
+- Removed the fixed 1 MiB size limit from RPC and isolated interactive-engine JSONL transport. Commands, responses, events, queued writes, and render frames now pass through in full instead of being rejected, dropped, or truncated; clients remain responsible for the memory and latency cost of large records ([#1985](https://github.com/bastani-inc/atomic/issues/1985)).
+- Added OpenRouter PKCE and Kimi Code device subscription login to Atomic's provider-metadata-driven `/login` flow, including direct provider routing, isolated engine-owned extension OAuth discovery/acquisition, correlated UI callbacks and cancellation, transactional persistence/rollback, automatic Kimi refresh, logout, and immediate post-login model refresh without transporting credentials or executable provider functions to the frontend ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Updated all active Pi runtime declarations and resolved artifacts to 0.82.1. Dynamic pi.dev catalogs now revalidate with ETags and retain cached data on empty `304` responses; newer bundled catalogs beat stale overlays; llama.cpp catalogs persist across restarts, remain selectable while a failed first online refresh reports its original error, and use loaded context as their output limit; and `/model` reloads layered `.pi` then `.atomic` model configuration on every open ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Updated the bundled user documentation for the current subagent, workflow-stage, reviewer, and `prompt-engineer` prompt contracts: outcome-first agent and stage structure, evidence-grounded reporting, query-last artifact ordering, selective delegation, deterministic `stop_review_loop` derivation, explicit output/stop rules, and the removal of response prefilling and private-reasoning requests for current GPT-5.6, Claude Opus 5, and Claude Fable 5 compatibility.
+
+### Fixed
+
+- Fixed a mid-turn compaction leaving the turn unsendable, which the provider rejected with an unrecoverable `400 ... each tool_use must have a single result. Found multiple tool_result blocks with id ...`. The post-tool compaction preflight returned the agent's live internal message array, so the agent loop adopted it as the working context for the rest of the run; from the next turn on, both the loop and the message reducer appended to that one array and duplicated every assistant message and tool result. The preflight now returns its own copy. As defence in depth, provider conversion additionally keeps only the first tool result for each announced `tool_use` id, alongside the existing orphan-result repair, and a structural guard runs immediately before conversion and fails with a descriptive Atomic-side error naming any `tool_use` id that appears in more than one assistant message rather than letting the request 400 ([#2051](https://github.com/bastani-inc/atomic/issues/2051)).
+- Fixed compaction repairs from the rung-ladder review: manual `/compact` now projects only compaction parameters, so no runtime property on a caller-supplied object can raise its urgency to `load_bearing` and reach the context-destroying rung; a committed `fresh` boundary stays visible in main and attached workflow stage chat even when the following provider hard-input-limit gate reports its own error, because `compaction_end` carries `result` and `errorMessage` independently; and a post-tool threshold crossing whose context still fits ends as a successful no-op rather than raising "no compactable transcript entries were available" and killing the active turn.
+- Fixed compaction rebuilding the retained recent messages as structured message blocks after the boundary. The `preserve_recent` tail is now serialized with the same transcript grammar as the compacted region and concatenated onto the end of the boundary string, so a compacted context reaches the provider as one message. A kept tail that started or ended mid-turn — an unpaired tool result, or a trailing tool call whose result was compacted away — can no longer produce out-of-order provider blocks and a rejected request. Tail serialization is lossless: retained tool results keep their full text rather than being truncated at 16k characters, and retained images stay as image blocks on the boundary message instead of collapsing to an `[image]` marker. Applies to manual, automatic, mid-turn post-tool, and extension-supplied compaction, and to sessions resumed from existing boundaries.
+- Fixed shared, main, and workflow-stage Atomic working animation lifecycle safety. Every agent/turn starts from phase zero on a fresh cadence, restoring the ordinary indicator after an extension override resets its phase/cadence, and turn, interrupt/pause, terminal, error, replacement, and disposal cleanup fence both built-in and delegated timer callbacks without leaks or stale repaint. Reduced motion remains a static regular accent `∀` without a timer ([#1883](https://github.com/bastani-inc/atomic/issues/1883)).
+- Fixed Windows and limited-color branding fidelity: caller-supplied workflow palettes now honor the detected terminal color mode, partial ANSI-index palettes derive omitted tones from indices 0–15, and Catppuccin Mocha starts its pulse at readable truecolor and 256-color contrast. Startup now honors `NO_COLOR` across the mark, metadata, and manifesto, remains nonblank below the mark width, and settles through the real input chain before Ctrl+C is consumed. Bundled themes declare and validate against Atomic's rebranded local schema, standalone binaries link to Atomic releases, and reachable startup/crash diagnostics use Atomic branding while legacy `.pi` paths, `PI_*` aliases, migrations, and service integrations remain compatible ([#1883](https://github.com/bastani-inc/atomic/issues/1883)).
+- Fixed inherited `.pi` extensions conflicting with Atomic-bundled resources: exact-name tool, command, prompt, flag, and shortcut overlaps now keep Atomic's bundled registration without disabling unrelated extension features, interactive startup consolidates overlaps into one warning, and isolated TUI discovery again matches print/RPC while preserving explicit `.atomic` overrides and agent-directory isolation ([#1955](https://github.com/bastani-inc/atomic/issues/1955)).
+- Fixed fast named workflows leaving a stale “still running” parent-chat claim when a terminal lifecycle notice arrives before the launch result or during final text. The opt-in lifecycle path now commits one context-excluded display card before send admission, preserves the assistant call → `status=running` result order, and delivers a separate hidden reconciliation at a native safe boundary; queue clearing, ordinary aborts, stage-session transfer, persistence retries, and fail-closed session teardown retain that reconciliation without interrupting unrelated active text, invalidating a session too early, or duplicating the lifecycle card.
+- Fixed the bundled workflow UI and control surfaces after fresh-process nested resume: input-bound child boundaries now retain stable graph identity, ordering, edges, lifecycle state, and true child-owner targets even when parallel dispatch order reverses; malformed or aliased topology and non-atomic boundary histories fail closed before routing. Completed inspection stays available without a retained chat, retained child follow-up remains detached from execution, and colliding child-local ids or names are reported as ambiguous instead of routing to the first stage.
+- Fixed queued steering, follow-up, trigger-turn custom/batched/interrupt messages, async deliveries, and user prompts escaping an interactive or workflow pause. Escape/Ctrl+C and controlled workflow pause now synchronously hold every raw queued item before abort, preserve content, optional data, duplicates, message type, display state, and per-queue order across fallback session transfer, gate late arrivals and continuation, serialize pause/resume with abort settlement, and release exactly once through the existing explicit resume boundary. `AgentSession` now publicly exposes `queuedMessagesPaused`, `pauseQueuedMessages()`, and `resumeQueuedMessages(): Promise<boolean>`; resume reports whether raw held work was released but never starts a turn. Clearing or restoring the final visible item leaves the pause gate closed, rejected abort boundaries block one release attempt before an explicit retry, and transferred interrupt turns serialize on the live owner. Paused protected reconciliation is persisted directly during shutdown without a model turn, while non-paused protocol-sensitive disposal remains fail-closed. Idle Ctrl+C clear/double-press exit and explicit final dequeue remain reachable without silently releasing held work; completed post-mortem stage chat releases its conversation-only hold on the next ordinary submission without changing terminal workflow state ([#1983](https://github.com/bastani-inc/atomic/issues/1983)).
+- Fixed tool-only workflows being reported failed after durable `ctx.tool()` side effects had completed. Root finalization now waits for admitted tools, promotes failures left by a fulfilled body with an explicit selected tool-node origin, and preserves ordinary body rejections without guessing a tool origin from indistinguishable native-promise values; the workflow graph and completed-run inspector show non-attachable tool nodes including cached replay state, and reopening completed history remains lifecycle-silent while preserving live declared outputs and preventing duplicate side effects. Retained `ctx.tool` calls made after any terminal executor path now reject safely before side effects, transient legacy child-topology migration failures no longer fail cached replay or later DBOS flush, nested child tools appear in no-target status with owning-run metadata, and completed retained-session stage chat is again reachable from graph keyboard, mouse, switcher, and hint surfaces without making tools attachable ([#1991](https://github.com/bastani-inc/atomic/issues/1991)).
+- Fixed reusable extension chat hosts to show and animate Atomic's Working indicator immediately when an idle prompt is submitted, preserving it across prompt attachment and agent startup while still stopping cleanly when no agent turn begins. This keeps retained terminal workflow-stage chats visibly active throughout follow-up processing ([#1982](https://github.com/bastani-inc/atomic/issues/1982)).
+- Fixed messages queued before automatic compaction remaining stuck afterward until Escape was pressed; successful compaction now resumes queued input automatically once active work settles ([#1984](https://github.com/bastani-inc/atomic/issues/1984)).
+- Fixed a workflow lifecycle card surviving a crash or a failed prompt start while its hidden reconciliation turn was lost. The durable card now carries its recovery marker in the same atomic session append, a rejected prompt start requeues only the hidden turn, and the next session start replays exactly one unresolved correction without duplicating the visible card. Physical session appends also roll back a partial single-entry or initial-batch write to the exact prior file length, so a later retry cannot inherit a malformed JSONL tail, duplicate id, or phantom parent ([#2021](https://github.com/bastani-inc/atomic/issues/2021)).
+- Fixed compaction status surfaces using the generic braille spinner instead of Atomic's `∀` identity. Main-session auto/manual compaction, summarization retry attempts, and workflow-stage compaction now pulse the one-cell `∀` on the shared 88ms luminance ramp, and the workflow-stage message carries the same `(esc Cancel)` hint as the main session.
+- Fixed Anthropic `ANTHROPIC_AUTH_TOKEN` header-only bearer authentication across catalog availability, direct/default/restored model selection, cycling, RPC/isolated model listings, ordinary requests, custom headers, branch summaries, and Verbatim Compaction without synthesizing an API key or `x-api-key`; also inherited Radius gateway OAuth routing and underlying model-auth cause details ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Fixed intentional OAuth cancellation surfacing as login failure. Escape/Ctrl+C, native `AbortError`, exact signal reasons, nested abort causes, and the legacy exact cancellation error now restore the interactive editor quietly for built-in and extension OAuth in direct and isolated sessions, while denial, timeout, network/protocol, token exchange, persistence, and refresh failures remain visible ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Fixed the remaining applicable Pi 0.82.1 coding-agent parity issues: complete literal model IDs win before thinking-suffix or glob parsing, unavailable scoped models remain removable, TUI logs honor the configured Atomic/Pi agent directory, the shared async Ctrl+G/extension editor uses private exact-file storage without temp scans and honors configured/environment/platform editor precedence, sibling package resources display relative paths, explicit self-update bypasses startup skip flags, summaries use fresh routing IDs without prompt-cache writes, Wayland copy falls back after `wl-copy` failure, and context discovery skips directories named like context files ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Fixed the compiled Atomic package CLI crashing before TUI startup when invoked from another working directory after standalone assets had placed `package.json` in `dist/`. Built-in themes, interactive images, and HTML-export templates now resolve from the actual `src/` or `dist/` module layout without producing a duplicated `dist/dist` path, while package-directory overrides and standalone adjacent assets remain supported ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Fixed the external editor failing on Windows whenever the editor path, its arguments, or the temporary prompt path contained a space. Node does not quote arguments when spawning through a shell, so `cmd.exe` split values such as `C:\Program Files\Microsoft VS Code\Code.exe` into separate arguments; each token is now quoted with the Windows command-line rules before launch.
+- Fixed repeated `/compact` presses starting several overlapping compactions and the resumed-session prompt showing no progress before the compaction spinner appeared. `AgentSession.compact()` is now single-flight: a second manual request joins the run already in flight and receives its result instead of starting another model call, emitting a duplicate `compaction_start`/`compaction_end` pair, or appending a second compaction boundary; a manual request made while an automatic compaction is running fails fast with a clear message rather than racing it; and only the owning call clears the abort controller and reconnects agent events, so `esc` still cancels the live run for every waiter. In the interactive TUI, `/compact` typed while a compaction is already running now warns instead of starting or queueing another one, a repeated `compaction_start` releases the previous spinner and keeps the original Escape handler, and the working indicator stays visible continuously from prompt submit through deferred extension startup and prompt preflight until the agent turn or compaction indicator takes over.
+- Fixed interactive startup output ordering so the `RESOURCES` disclosure remains above extension notifications and every other startup warning or notice on eager, deferred, and immediate-prompt paths.
+- Fixed reasoning tokens being able to fail a compaction outright. The planner used to cap its own request at `0.8 × reserveTokens` — an input-side reserve reused as an output cap — so a high-reasoning session could spend the entire budget thinking and return no deletion records, producing `Compaction range planning produced no usable deleted ranges`; during a mid-turn post-tool preflight that killed the active turn. The planner now sends no `max_tokens` at all, leaving the provider's own context clamp as the only bound, and `PlannerBudget.maxTokens` is typed `undefined` so the cap cannot be reintroduced without changing the type. The session reasoning level is still inherited and is never modified between attempts. A starved or rate-limited planner response no longer ends compaction: it advances the rung ladder to a configured fallback model and, for a load-bearing compaction, to a fresh context window. Branch summarization received the same budget fix — its `2048` output cap is removed and it now inherits the session thinking level, while its input-side `reserveTokens` behavior is unchanged. Fallback borrowing is now a single ordered pass: a candidate whose credentials are unavailable is consumed rather than re-inspected, so no candidate has its auth resolved twice and the configured order cannot rewind. `startNewContextWindow` returns exactly a `CompactedTranscript`; the tail decision it used to expose is runner bookkeeping and travels on `CompactionRungResult.keptTail`. Zero-usable-ranges output is still rejected: no unvalidated model output ever becomes a compaction boundary, and every retained line stays byte-identical on every rung.
+
+## [0.9.11-alpha.5] - 2026-07-23
+
+### Changed
+
+- Added Orwell's six writing rules from “Politics and the English Language” to the core default system prompt's `Guidelines` section so every standard Atomic session receives them, while removing the bundled workflow guidance's requirement to announce an inline-or-workflow mode before the first tool call.
+
+## [0.9.11-alpha.4] - 2026-07-23
+
+### Changed
+
+- Installed builds now ship the builtin workflows extension as a single prebundled ESM file. Loading it previously resolved and transpiled a ~300-file TypeScript module graph per launch, which dominated interactive-engine startup on Windows (~7 s on a test VM, now ~1.1 s, ~6x faster) ([#1962](https://github.com/bastani-inc/atomic/issues/1962)). Source checkouts still load the raw TypeScript sources.
+- Interactive TUI startup on Windows is dramatically faster: the CLI now enables Node's persistent on-disk V8 compile cache (Node >= 22.8) and flushes it before spawning the isolated interactive engine, so both the host and the engine child reuse compiled module bytecode across runs and within the same launch ([#1962](https://github.com/bastani-inc/atomic/issues/1962)).
+
+### Fixed
+
+- Fixed interactive startup crashing with `Interactive engine did not become ready within 5000 ms` on machines with slow cold starts (commonly Windows PowerShell with npm-global installs). The fixed readiness deadline is removed; the host now waits until the engine reports ready and still fails fast if the engine process exits or the transport breaks ([#1962](https://github.com/bastani-inc/atomic/issues/1962)).
+- Fixed positional prompts beginning with `-`, `--`, or `@` being parsed as options or file arguments by supporting the conventional `--` end-of-options terminator ([#1950](https://github.com/bastani-inc/atomic/issues/1950)).
+- Fixed embedded extension UIs in isolated interactive mode receiving an empty placeholder from `ctx.ui.getFooterDataProvider()`. The engine session now exposes its live extension statuses and cached, watched Git branch so synchronous renderers such as workflow stage chat can match the main footer without RPC calls or per-render Git processes.
+
+## [0.9.11-alpha.3] - 2026-07-21
+
+### Added
+
+- Added a built-in, hidden llama.cpp router provider with `/login llama.cpp`, `LLAMA_BASE_URL`/`LLAMA_API_KEY` configuration, loaded-model discovery, and the `/llama` manager for load, unload, cancellation, reconnect, and Hugging Face GGUF download workflows.
+- Added provider-metadata-driven `/login` choices, direct `/login <provider>` routing and autocomplete, provider-owned login information links, API-key login for Qwen Token Plan, Radius, and GitHub Copilot, plus preferred defaults for Radius, NVIDIA, and ZAI Coding Plan China.
+- Added global `httpProxy`, duration-string and `"disabled"` HTTP idle timeouts, package `autoload: false` project deltas, Kimi deferred-tool compatibility, `oauth: "radius"` custom gateways, and global/project scope switching in `atomic config` (`-l` starts in project scope).
+- Added extension lifecycle hooks `before_provider_headers` and `agent_settled`, durable `entry_appended` events and `registerEntryRenderer()`, complete native `Provider` registration, and named/hidden `InlineExtension` descriptors.
+- Added the public `ModelRuntime` facade and associated option types, `readStoredCredential`, `InlineExtension`, entry-renderer/event types, and session context conversion helpers to the SDK/package-root surface. Atomic intentionally continues to expose Search rather than adding obsolete grep compatibility aliases.
+- Added Ctrl+X copy-last-message, clipboard text fallback when image paste finds no image, restored footer branch/session/experimental/extension-status segments, Output padding and Cache miss notices settings, and clear-on-shrink idle placeholders.
+- Added durable cache-miss attribution and waste totals, complete per-model session usage/cost breakdowns including tool and summary work, and optional live/resumed cache-miss transcript notices.
+- Added Atomic's first-run theme preview and explicit analytics opt-in. Analytics settings and a local tracking identifier are persisted only when selected; this change does not transmit analytics data.
+
+### Changed
+
+- Login provider discovery now follows registered provider authentication capabilities instead of using display names as an allowlist, so newly installed native providers automatically expose their supported OAuth and API-key methods.
+- Dynamic provider catalogs, including Radius `pi-messages`, are restored and refreshed through the provider-owned model store; documentation now distinguishes generic custom-provider APIs from the broader installed native API surface.
+- Package self-update now honors advisory release notes, pins the exact advertised package and version, reports version transitions, and cleans stale Windows native-dependency quarantine data during ordinary startup.
+- Interactive session diagnostics now show cache hit rate, wasted cache cost, and provider/model usage costs; the footer includes usage spent by tool results and summaries.
+
+### Fixed
+
+- Fixed Qwen Token Plan global/China, Radius API-key, and GitHub Copilot token methods being hidden from first-time `/login`, which kept otherwise installed models out of `/model` and `--list-models`.
+- Fixed package-manager self-update helpers rejecting the legacy string target form while retaining exact-version install targets.
+- Fixed `/login` omitting extension-registered custom-auth providers in isolated interactive mode. Provider metadata now synchronizes from the engine child, and provider-owned login prompts, credential persistence, cancellation, and post-login model refresh execute across the existing isolated-engine bridge.
+- Fixed project package overrides being unable to selectively subtract or include resources from a matching global package without replacing the complete declaration.
+- Fixed Ctrl+V reporting an image error when the clipboard contained usable text, and made Ctrl+X invoke the same copy-last-assistant behavior as `/copy`.
+- Fixed a single Ctrl+C not dismissing the `/login` popups (auth-method selector, provider selector, and login dialogs), even though Escape worked and the on-screen hint promised `esc/ctrl+c cancel`. The global Ctrl+C clear/exit handler consumed the key before the focused popup could see it, so the first press silently cleared the hidden editor and a second press within the double-press window exited the entire CLI. The global handler now defers whenever an inline popup owns input (and its overlay/custom-UI guards are evaluated live instead of once at startup), so Ctrl+C reaches the focused component and cancels exactly like Escape while editor clearing and double-press exit continue to work when the editor has focus.
+
+## [0.9.11-alpha.2] - 2026-07-21
+
+### Added
+
+- Added Qwen Token Plan and Qwen Token Plan China to Atomic's built-in provider defaults and credential guidance, inherited from `pi-ai` 0.81.1 ([#6858](https://github.com/earendil-works/pi/pull/6858)).
+- Added the `get_available_thinking_levels` RPC command and `RpcClient.getAvailableThinkingLevels()` so headless clients can discover the active model's exact supported cycle order ([#6865](https://github.com/earendil-works/pi/pull/6865)).
+- Exported message and tool-execution lifecycle event types from the Atomic package root for extension and SDK consumers ([#6772](https://github.com/earendil-works/pi/pull/6772)).
+
+### Changed
+
+- Updated `@earendil-works/pi-agent-core`, `pi-ai`, and `pi-tui` to 0.81.1, inheriting provider, transport, model-catalog, Kimi K3 thinking, OpenAI Responses retry, Codex request-ID, terminal rendering, and queue fixes from Pi 0.81.0–0.81.1 while retaining Atomic's branding, bundled packages, Verbatim Compaction, and versionless release flow.
+- Restored persisted model catalogs without network access during service creation, then moved automatic network refresh into running interactive and RPC modes. Interactive startup computes its first footer provider count from the restored snapshot and starts network refresh only after TUI initialization.
+
+### Fixed
+
+- Fixed transient provider failures aborting Verbatim Compaction planning or branch summarization. Both now honor the configured retry policy and publish `summarization_retry_scheduled`, `summarization_retry_attempt_start`, and `summarization_retry_finished` lifecycle events to interactive, JSON, RPC, and SDK consumers ([#6901](https://github.com/earendil-works/pi/pull/6901)).
+- Fixed persisted remote model catalogs overriding newer bundled catalogs after an upgrade by comparing catalog modification times and treating legacy undated overlays as stale ([upstream commit](https://github.com/earendil-works/pi/commit/54fad505b9d8cbc8922ff55d7e2938f70cbf6a3d)).
+- Fixed steering and follow-up delivery modes being lost when queued messages were flushed as compaction finished ([#6730](https://github.com/earendil-works/pi/pull/6730)).
+- Fixed read-tool errors being syntax-highlighted as though they were successful file contents ([#6731](https://github.com/earendil-works/pi/pull/6731)).
+- Fixed `${@:-default}` and `${ARGUMENTS:-default}` prompt-template defaults, while retaining Atomic's bounded default-value parser ([#6695](https://github.com/earendil-works/pi/issues/6695)).
+- Fixed persisted sessions being read and parsed twice when opened, and adopted the shared UUIDv7 generator for new session IDs ([#6793](https://github.com/earendil-works/pi/pull/6793), [#6834](https://github.com/earendil-works/pi/pull/6834)).
+- Fixed Kimi Coding usage costs being shown without the subscription estimate indicator.
+
 ## [0.9.11-alpha.1] - 2026-07-20
 
 ### Changed
@@ -13,6 +253,7 @@
 - Fixed newly authenticated providers remaining unavailable in the model selector until Atomic restarted. API-key and OAuth login now reload the isolated engine's credentials and refresh its authoritative model catalog immediately, including credential-dependent dynamic discovery ([#1918](https://github.com/bastani-inc/atomic/issues/1918)).
 - Added actionable `/logout` and `/login` recovery guidance when OpenAI Codex invalidates or revokes a locally unexpired OAuth token, and prevented an earlier WebSocket-to-SSE transport diagnostic from making the definitive authentication rejection retryable ([#1922](https://github.com/bastani-inc/atomic/issues/1922)).
 
+
 ## [0.9.10] - 2026-07-20
 
 ### Breaking Changes

package/README.md

@@ -91,6 +91,8 @@ For each built-in provider, Atomic maintains a list of tool-capable models, upda
 - Anthropic Claude Pro/Max
 - OpenAI ChatGPT Plus/Pro (Codex)
 - GitHub Copilot
+- OpenRouter (browser PKCE, optional key minting)
+- Kimi Code (device authorization with token refresh)
 
 **API keys:**
 - Anthropic
@@ -123,6 +125,8 @@ For each built-in provider, Atomic maintains a list of tool-capable models, upda
 
 See [docs/providers.md](docs/providers.md) for detailed setup instructions.
 
+Atomic's Pi 0.82.1 model/runtime surface includes Claude Opus 5 on Anthropic and Bedrock, model-capability-aware strict JSON-schema and OpenAI Lark/regex tool sampling, ETag-revalidated cached catalogs, persisted llama.cpp models, and live layered `.pi`/`.atomic` `models.json` reload whenever `/model` opens. A populated `ANTHROPIC_AUTH_TOKEN` makes Anthropic models available/selectable while sending header-only bearer auth—with no synthesized API key or `x-api-key`—across chat and summary/compaction requests. Typed RPC model listings expose constrained-sampling flags through optional `ModelInfo.compat`; capability flags are enforcement claims, so unsupported `require` constraints fail instead of being silently weakened. See [models](docs/models.md), [providers](docs/providers.md), [RPC](docs/rpc.md#get_available_models), and [extensions](docs/extensions.md#constrained-sampling).
+
 **Custom providers & models:** Add providers via `~/.atomic/agent/models.json` (legacy `~/.pi/agent/models.json` also works) if they speak a supported API (OpenAI, Anthropic, Google). For custom APIs or OAuth, use extensions. See [docs/models.md](docs/models.md) and [docs/custom-provider.md](docs/custom-provider.md).
 
 ---
@@ -187,15 +191,16 @@ See `/hotkeys` for the full list. Customize via `~/.atomic/agent/keybindings.jso
 
 | Key | Action |
 |-----|--------|
-| CTRL+C | Clear editor |
-| CTRL+C twice | Quit |
-| Escape | Cancel/abort |
+| CTRL+C | Interrupt active or queued work; when idle, clear editor |
+| CTRL+C twice while idle | Quit |
+| Escape | Abort active work and hold queued messages |
 | Escape twice | Open `/tree` |
 | CTRL+L | Open model selector |
 | CTRL+P / SHIFT+CTRL+P | Cycle scoped models forward/backward |
 | SHIFT+Tab | Cycle thinking level |
 | CTRL+O | Collapse/expand tool output |
 | CTRL+T | Collapse/expand thinking blocks |
+| CTRL+G | Edit chat or extension-editor text through the configured, environment, or platform external editor |
 
 ### Message Queue
 
@@ -203,8 +208,8 @@ Submit messages while the agent is working:
 
 - **Enter** queues a *steering* message, delivered after the current assistant turn finishes executing its tool calls
 - **ALT+Enter** queues a *follow-up* message, delivered only after the agent finishes all work
-- **Escape** aborts and restores queued messages to editor
-- **ALT+Up** retrieves queued messages back to editor
+- **Escape** or **Ctrl+C** aborts active/queued work and pauses queued messages in place; submitting the next ordinary chat message resumes them once in their original per-queue order. After the abort settles, a later idle Ctrl+C still clears the editor and a second quick idle press quits without dequeuing the hold
+- **ALT+Up** explicitly retrieves queued messages back to the editor instead of resuming them
 
 On Windows Terminal, `ALT+Enter` is fullscreen by default. Remap it in [docs/terminal-setup.md](docs/terminal-setup.md) so Atomic can receive the follow-up shortcut.
 
@@ -424,14 +429,12 @@ See [docs/packages.md](docs/packages.md).
 ### SDK
 
 ```typescript
-import { AuthStorage, createAgentSession, ModelRegistry, SessionManager } from "@bastani/atomic";
+import { createAgentSession, SessionManager } from "@bastani/atomic";
 
-const authStorage = AuthStorage.create();
-const modelRegistry = ModelRegistry.create(authStorage);
+// By default, createAgentSession builds a ModelRuntime from the active agent
+// directory's auth.json and models.json.
 const { session } = await createAgentSession({
   sessionManager: SessionManager.inMemory(),
-  authStorage,
-  modelRegistry,
 });
 
 await session.prompt("What files are in the current directory?");
@@ -636,6 +639,8 @@ atomic --thinking high "Solve this complex problem"
 | `PI_CACHE_RETENTION` | Provider/upstream-specific prompt-cache retention knob; set to `long` where supported. This is not an `ATOMIC_*` alias and has no Atomic-prefixed equivalent. |
 | `VISUAL`, `EDITOR` | External editor for CTRL+G |
 
+Bash commands also receive an execution-time session snapshot through `ATOMIC_SESSION_ID`, `ATOMIC_SESSION_FILE` (omitted for unsaved sessions), `ATOMIC_PROVIDER`, `ATOMIC_MODEL`, and `ATOMIC_REASONING_LEVEL`. The exact `PI_SESSION_ID`, `PI_SESSION_FILE`, `PI_PROVIDER`, `PI_MODEL`, and `PI_REASONING_LEVEL` aliases carry identical values. Unrelated inherited or caller-supplied environment variables are preserved.
+
 ---
 
 ## Contributing & Development

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.11-alpha.1",
+  "version": "0.9.11-alpha.10",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [
@@ -44,7 +44,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.80.10"
+    "@earendil-works/pi-tui": "^0.83.0"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {
@@ -56,6 +56,6 @@
   },
   "dependencies": {
     "tsx": "^4.23.1",
-    "typebox": "^1.3.6"
+    "typebox": "^1.3.7"
   }
 }

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.11-alpha.9] - 2026-08-01
+
+### Fixed
+
+- Declared `handlesCtrlC` on the `/mcp` panel, the `/mcp setup` panel, and the MCP OAuth panel. In isolated interactive sessions the terminal host now closes an undeclared remote `ctx.ui.custom()` component on the first Ctrl+C, which would have bypassed each panel's own Ctrl+C handler along with its cancel and cleanup work. The declaration keeps that handler running.
+
+## [0.9.11-alpha.6] - 2026-07-28
+
+### Removed
+
+- Removed Cursor MCP configuration discovery and the `cursor` compatibility import kind ([#1994](https://github.com/bastani-inc/atomic/issues/1994)).
+
 ## [0.9.11-alpha.1] - 2026-07-20
 
 ### Changed

package/dist/builtin/mcp/README.md

@@ -31,7 +31,7 @@ The adapter reads standard MCP files automatically. No extra setup needed if you
 | You already have... | What happens |
 |---------------------|--------------|
 | `.mcp.json` or `~/.config/mcp/mcp.json` | Pi uses it immediately. The first time you open `/mcp`, you'll see a short heads-up explaining which file Pi detected and that Pi only writes adapter-specific overrides to its own files. |
-| Host-specific configs (Cursor, Claude Code, Codex, etc.) but no standard MCP files | Run `/mcp setup` to adopt those host configs into Pi. The setup flow shows exactly what it found, lets you pick which ones to import, and previews the exact file changes before writing. |
+| Host-specific configs (Claude Code, Codex, etc.) but no standard MCP files | Run `/mcp setup` to adopt those host configs into Pi. The setup flow shows exactly what it found, lets you pick which ones to import, and previews the exact file changes before writing. |
 | Nothing configured yet | Run `/mcp setup` to scaffold a minimal `.mcp.json`, quick-add RepoPrompt, or inspect what the adapter discovered on your machine. |
 
 If you prefer the terminal, you can also run `pi-mcp-adapter init` after install to scan for host-specific configs and add missing compatibility imports to the Pi agent dir (`~/.pi/agent/mcp.json` by default, or `$PI_CODING_AGENT_DIR/mcp.json` when set).
@@ -315,12 +315,12 @@ Shared MCP files are loaded automatically. Use `imports` only for host-specific
 
 ```json
 {
-  "imports": ["cursor", "claude-code", "claude-desktop"],
+  "imports": ["claude-code", "claude-desktop"],
   "mcpServers": { }
 }
 ```
 
-Supported compatibility imports: `cursor`, `claude-code`, `claude-desktop`, `vscode`, `windsurf`, `codex`
+Supported compatibility imports: `claude-code`, `claude-desktop`, `vscode`, `windsurf`, `codex`
 
 `pi-mcp-adapter init` detects these host-specific configs and adds missing imports to the Pi agent dir config for you.
 

package/dist/builtin/mcp/cli.js

@@ -29,7 +29,6 @@ const PROJECT_PI_CONFIG_PATH = path.resolve(process.cwd(), CONFIG_DIR_NAME, "mcp
 const PROJECT_PI_CONFIG_READ_PATHS = getProjectConfigPaths(process.cwd(), "mcp.json");
 
 const IMPORT_PATHS = {
-  cursor: [path.join(HOME, ".cursor", "mcp.json")],
   "claude-code": [
     path.join(HOME, ".claude", "mcp.json"),
     path.join(HOME, ".claude.json"),

package/dist/builtin/mcp/commands.ts

@@ -292,7 +292,9 @@ export async function openMcpSetup(
           resolve({ configChanged });
         });
       },
-      { overlay: true, overlayOptions: { anchor: "center", width: 92 } },
+      // handlesCtrlC: the setup panel binds Ctrl+C for its own cancel/cleanup,
+      // so the host must forward the key instead of closing the panel itself.
+      { overlay: true, handlesCtrlC: true, overlayOptions: { anchor: "center", width: 92 } },
     );
   });
 }
@@ -369,7 +371,8 @@ export async function openMcpPanel(
           resolve();
         }, { noticeLines });
       },
-      { overlay: true, overlayOptions: { anchor: "center", width: 82 } },
+      // handlesCtrlC: the panel binds Ctrl+C for its own cancel/cleanup.
+      { overlay: true, handlesCtrlC: true, overlayOptions: { anchor: "center", width: 82 } },
     );
   });
 
@@ -412,7 +415,8 @@ export async function openMcpAuthPanel(
           noticeLines: ["Select OAuth MCP Server. Enter/CTRL+A Authenticate."],
         });
       },
-      { overlay: true, overlayOptions: { anchor: "center", width: 82 } },
+      // handlesCtrlC: the panel binds Ctrl+C for its own cancel/cleanup.
+      { overlay: true, handlesCtrlC: true, overlayOptions: { anchor: "center", width: 82 } },
     );
   });
 

package/dist/builtin/mcp/config.ts

@@ -15,7 +15,6 @@ const PROJECT_PI_CONFIG_NAME = `${CONFIG_DIR_NAME}/mcp.json`;
 const REPOPROMPT_BINARY_CANDIDATES = [join(homedir(), "RepoPrompt", "repoprompt_cli"), "/Applications/Repo Prompt.app/Contents/MacOS/repoprompt-mcp"];
 
 const IMPORT_PATHS: Record<ImportKind, string[]> = {
-  cursor: [join(homedir(), ".cursor", "mcp.json")],
   "claude-code": [
     join(homedir(), ".claude", "mcp.json"),
     join(homedir(), ".claude.json"),
@@ -309,7 +308,6 @@ function extractServers(config: unknown, kind: ImportKind): Record<string, Serve
     case "codex":
       servers = obj.mcpServers;
       break;
-    case "cursor":
     case "windsurf":
     case "vscode":
       servers = obj.mcpServers ?? obj["mcp-servers"];