@bastani/atomic 0.9.11-alpha.8 → 0.9.11

package/CHANGELOG.md

@@ -2,6 +2,186 @@
 
 ## [Unreleased]
 
+## [0.9.11] - 2026-08-03
+
+Cumulative release of the `0.9.11-alpha.1` – `0.9.11-alpha.12` prereleases. The summary below covers the user-visible outcome of that work; the per-change detail remains in the prerelease sections below.
+
+### Breaking Changes
+
+- Adopted pi 0.83.0 (`@earendil-works/pi-agent-core`, `pi-ai`, `pi-tui` at `^0.83.0`), which moves the bundled TypeBox to 1.3.7 and **removes seven deprecated APIs**. Atomic inherits the removal exactly as upstream shipped it with no compatibility shim, so an extension, skill, workflow, or MCP schema still calling one of these fails to compile and to run. Atomic's own sources use none of them.
+
+  | Removed API | Replacement |
+  | --- | --- |
+  | `Type.Options(type, options)` | `Type.With(type, options)` — straight rename |
+  | `Type.Base` | `Type.Refine()` + `Type.Unsafe()` |
+  | `Type.Promise(item)` | none — model the resolved value and validate after `await` |
+  | `Type.Awaited(type)` | none — use the resolved type itself |
+  | `Type.Iterator(items)` / `Type.AsyncIterator(items)` | none — drain first, then `Type.Array(items)` |
+  | `Value.Mutate(current, next)` | `Value.Patch(current, Value.Diff(current, next))` — returns a **new** value rather than assigning in place |
+
+- Replaced Atomic's legacy extension OAuth registration bridge with provider-owned authentication from `@earendil-works/pi-ai`, and adopted pi's provider-owned `ModelRuntime` architecture for model composition, credentials, streaming, and catalog refresh. The bridge functions (`registerOAuthProvider`, `getOAuthApiKey`, and the rest) and their credential/status types are gone from the package root; `AuthStorage` now implements pi's asynchronous `CredentialStore` contract, so its synchronous compatibility methods and provider-auth helpers were removed in favour of `read`, `list`, `modify`, `delete`, and `ModelRuntime`; `ModelRegistry` is now the thin synchronous extension-compatibility facade constructed as `new ModelRegistry(runtime)`; and `CreateAgentSessionOptions` takes `modelRuntime` instead of `authStorage`/`modelRegistry`. Extensions must declare OAuth or API-key authentication on their provider registration, and `streamSimple` implementations are now scoped to their registered provider.
+- Model configuration follows pi's single-file `ModelConfig` contract: Atomic reads one `models.json` from the active agent directory and no longer reads project-scoped `.atomic/models.json`, falls back to `~/.pi/agent/models.json`, or merges layered files. Move project-scoped custom providers and models into the agent-directory file. Catalog refreshes also use pi's exact timeout semantics — `modelRefreshTimeoutMs` applies only to the initial runtime creation refresh, and `/model` owns its own 15-second timeout.
+- Removed all Atomic-specific GitHub Copilot handling; `github-copilot` is now an ordinary upstream provider sourced entirely from `pi-ai`. The live CAPI catalog fetch and disk cache, enterprise/GHE base-URL routing, the Gemini tool-schema sanitizer, the Anthropic `message_stop` SSE repair, and Copilot prompt-limit guidance are all gone. Because pi's bundled context windows can exceed what Copilot's API enforces, long sessions on affected models may overrun the server-side cap instead of compacting first ([#1608](https://github.com/bastani-inc/atomic/issues/1608)).
+- Removed the short/long context-window selection feature, which upstream pi does not have: the `contextWindowOptions` / `defaultContextWindow` / `maxInputTokens` model fields, the `/model` picker, `--context-window`, the `defaultContextWindow(s)` settings, the `set_context_window` and `get_available_context_windows` RPC commands, the `context_window_changed` event, the `contextWindow` / `contextWindowStrict` SDK and workflow-stage options, the related root exports, and the `(1m)` / `(long)` token in subagent and workflow model strings. A model's `contextWindow` is now a single catalog value.
+- Isolated interactive `ctx.ui.custom()` components that consume Ctrl+C must declare `{ handlesCtrlC: true }`. Without it the first Ctrl+C is the host escape and closes the focused component, resolving its promise with `undefined`. Bundled workflow and MCP surfaces were migrated; third-party extensions binding Ctrl+C need the one-line addition.
+- Changed the published `runVerbatimCompaction` SDK export to a request object: `runVerbatimCompaction(preparation, model, { resolveAuth, signal, thinkingLevel, urgency, ...options })`. Pre-resolved credentials become a `resolveAuth(model)` callback because a borrowed fallback model needs its own credentials, and `urgency` is required with no default so only a `load_bearing` caller can reach the context-destroying fresh rung. The persisted `CompactionEntry` shape, resume, and the compaction hooks are preserved.
+- Workflow run targets now require the full 36-character run UUID; typed prefixes are no longer resolved by any command or `runId` action, and a malformed target is rejected with a diagnostic distinct from `Run not found:` so a truncated paste is diagnosable. Stage targets are matched exactly, so `build` will not select `build-check`. Every user-facing surface already prints the full id.
+- The RPC `login_provider` response no longer carries the API key it just stored. `RpcLoginProviderResult` dropped its `credential` member; `type` confirms which kind of credential was saved.
+
+### Added
+
+- Added first-class Alpine/musl Linux support for x64 and arm64, including native search and PTY bindings and the `atomic-linux-x64-musl.tar.gz` and `atomic-linux-arm64-musl.tar.gz` archives. The musl archives omit the clipboard binding and glibc-linked `@embedded-postgres/*` binaries, so Atomic falls back to Linux clipboard commands/OSC52 and durable Alpine workflows require external Postgres.
+- Added `atomic auth print-api-key` and `atomic auth print-bearer-token`, which print exactly one named credential to stdout while every warning and diagnostic goes to stderr, so `KEY=$(atomic auth print-api-key --model gpt-5.5)` cannot capture noise. `--model` is required, `--provider` and `--model` are the only accepted options, there is no file or clipboard sink, and `print-bearer-token` refreshes a token with less than `--min-expiry` (default `30m`) remaining. Failures are distinguishable by exit code 1–9, including a partial-write exit that tells you to discard the output. Documented in `docs/usage.md` and `docs/security.md`.
+- Added a compaction rung ladder so a compaction that must succeed always does. The range planner returns typed outcomes instead of ranges-or-throw; a terminal attempt borrows the next `settings.fallbackModels` entry for one planner request resolved with that candidate's own credentials, without changing the session model or history; an overflowing planner request withholds the oldest region lines and retries; and when every model is exhausted, a load-bearing compaction starts a fresh context window — a loud (`✻ Context cleared (compaction degraded)`) and durable (`details.rung: "fresh"`) model-free rung. Manual `/compact` and threshold auto-compaction may borrow a model but can never clear context. **A configured fallback model may now receive the compaction transcript.**
+- Added a built-in, hidden llama.cpp router provider with `/login llama.cpp`, `LLAMA_BASE_URL`/`LLAMA_API_KEY` configuration, loaded-model discovery, and the `/llama` manager for load, unload, reconnect, and Hugging Face GGUF download flows.
+- Added provider-metadata-driven `/login` with direct `/login <provider>` routing and autocomplete, OpenRouter PKCE and Kimi Code device subscription login, API-key login for Qwen Token Plan, Radius, and GitHub Copilot, and immediate post-login model refresh without transporting credentials to the frontend.
+- Added Claude Opus 5 to the Anthropic and Amazon Bedrock catalog paths with adaptive thinking/`xhigh`, Bedrock inference profiles, prompt caching, and strict-tool metadata.
+- Added end-to-end constrained tool sampling to extension/SDK tool definitions and model catalogs: strict JSON Schema `prefer`/`require`, OpenAI grammar tools with Lark/regex variants, and `supportsStrictMode` / `supportsStrictTools` / `supportsOpenAIGrammarTools` flags exposed through additive optional `ModelInfo.compat` ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Added execution-time session metadata to every bash execution path through `ATOMIC_SESSION_ID`, `ATOMIC_SESSION_FILE`, `ATOMIC_PROVIDER`, `ATOMIC_MODEL`, and `ATOMIC_REASONING_LEVEL` with exact `PI_*` aliases, plus request-correlated `bash_execution_update` RPC events that separate stdout from stderr and support concurrent requests and per-request cancellation ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Added `ctx.scopedModels` to the extension context: the read-only list of models scoped to the current session, resolving at access time and handing back a fresh copy on every read so an extension cannot widen its own scope. Documented in `docs/extensions.md`.
+- Added durable, searchable companion transcripts for every workflow stage that declares `output:`, run-scoped durable artifact directories under `~/.atomic/workflows/runs/<runId>/` (overridable with `ATOMIC_WORKFLOW_ARTIFACT_DIR`) with state-aware retention, explicit warnings for degenerate stage artifacts, and a real artifact-integrity probe in the shared resume predicate.
+- Added extension lifecycle hooks `before_provider_headers` and `agent_settled`, durable `entry_appended` events with `registerEntryRenderer()`, named/hidden `InlineExtension` descriptors, and the public `ModelRuntime` facade, `readStoredCredential`, and session-context conversion helpers on the SDK surface.
+- Added global `httpProxy`, duration-string and `"disabled"` HTTP idle timeouts, package `autoload: false` project deltas, `oauth: "radius"` custom gateways, global/project scope switching in `atomic config`, and the `get_available_thinking_levels` RPC command.
+- Added Ctrl+X copy-last-message, clipboard text fallback when image paste finds no image, durable cache-miss attribution with waste totals, per-model session usage and cost breakdowns including tool and summary work, and Atomic's first-run theme preview with explicit analytics opt-in (no analytics data is transmitted by this change).
+
+### Changed
+
+- Reworked interactive startup and working motion around Atomic's revision-3 identity: the ∀ banner assembles inward before its identity beat, and main and workflow-stage surfaces keep the one-cell `∀` visible on a theme-aware dark → accent → bright → accent → dark luminance ramp at 88 ms while retaining all 453 randomized working verbs. `NO_COLOR` keeps regular/bold activity without color escapes, and reduced motion keeps a static accent `∀` ([#1883](https://github.com/bastani-inc/atomic/issues/1883)).
+- Made interactive startup dramatically faster on Windows: installed builds ship the builtin workflows extension as a single prebundled ESM file instead of transpiling a ~300-file module graph per launch (~7 s → ~1.1 s on a test VM), and the CLI enables Node's persistent on-disk V8 compile cache so host and engine child reuse compiled bytecode across runs ([#1962](https://github.com/bastani-inc/atomic/issues/1962)).
+- Removed the fixed 1 MiB size limit from RPC and isolated interactive-engine JSONL transport; commands, responses, events, and render frames now pass through in full ([#1985](https://github.com/bastani-inc/atomic/issues/1985)).
+- A stored OAuth token is now refreshed once fewer than five minutes of validity remain, rather than at expiry, so a long turn is not started on a credential that dies mid-request. The refresh runs inside the `auth.json` lock, so concurrent sessions refresh it once between them.
+- The OpenRouter login now accepts a pasted final redirect URL, or the authorization code alone, for remote and headless machines where the browser cannot reach the loopback callback.
+- A provider that ends a turn with an unrecognised terminal reason now surfaces a provider error naming the raw reason instead of reporting an ordinary successful stop, and assistant messages carry a new `pending` stop reason while streaming. Documented in `docs/providers.md`, `docs/custom-provider.md`, `docs/rpc.md`, and `docs/session-format.md`.
+- Workflow run identifiers are shown as full UUIDs across the BACKGROUND widget, status views, run pickers, and control messages; the four-workflow BACKGROUND display cap is gone; and `workflow({ action: "status", format: "json" })` no longer includes `runIdPrefix` — read `runId`.
+- Added Orwell's six writing rules from "Politics and the English Language" to the core default system prompt's `Guidelines` section, and the startup `RESOURCES` disclosure now lists `SYSTEM.md` and `APPEND_SYSTEM.md` alongside the `AGENTS.md`/`CLAUDE.md` context files.
+- Synchronized the bundled `impeccable` skill tree with upstream 4.0.3 (four surface modes, new routing and craft-floor guidance, a `doctor` drift check, documenter and finish-reviewer agents), and verified the `playwright-cli` and `liteparse` trees against their upstream baselines.
+- Updated the bundled user documentation for the current subagent, workflow-stage, reviewer, and `prompt-engineer` prompt contracts, removing response prefilling and private-reasoning requests for GPT-5.6, Claude Opus 5, and Claude Fable 5 compatibility.
+
+### Fixed
+
+- Fixed the isolated interactive engine losing or duplicating your typed input. A submission the engine never accepted now returns to the editor exactly as typed — through every submit route, including `/atomic`, deferred slash commands, streaming steer sends, `!bash`, `/compact`, and Alt+Enter — with its own draft carried end to end so two similar submissions cannot restore each other's text, and without a misleading red transport error beside it. Work the engine *had* started is no longer offered back as unsent: the child announces ownership of every correlated request before its handler can touch the shell, so a silent `!touch marker && sleep 400` is not re-invited for a second run. The interactive-engine protocol version is now `2`.
+- Fixed a total interactive-TUI lockup when the engine generation behind a mounted remote custom UI died, which previously left components mounted forever with input trapped and required killing the process from another terminal. Engine death is now a host-local lifecycle event that closes every remote component from the dead generation, settles its promises, releases widget keys, resets terminal modes, and refocuses the editor without waiting for a replacement.
+- Fixed interrupting a tool call terminating the interactive engine and reporting `Engine terminated; … result unknown`. Escape now simply requests cooperative cancellation and waits for it — interrupting never terminates or restarts the engine and never discards in-flight tool state — and every cooperative-cancellation command (`abort`, `abort_bash`, `abort_compaction`, `abort_retry`, `cancel_login_provider`) is exempt from the generic 30-second RPC deadline.
+- Added recovery from an unexpected interactive-engine exit — one automatic replacement attempt with the calm status `Interactive engine stopped unexpectedly; restarting.` — and kept an explicit Ctrl+C escape hatch for a provably wedged engine. Reopening an inactive session after such an exit now derives explicit error results for unanswered `toolUse` calls without rewriting its append-only JSONL, so the session is usable again instead of permanently pending.
+- Fixed the interactive engine exporting its private control values (`ATOMIC_INTERACTIVE_ENGINE_CHILD`, `_HOST_PID`, `_GUARD_FILE`, `_API_KEY`) to every process it spawned, which made nested `atomic` runs start in engine mode, misdirected process guardians, disabled subagent idle watchdogs, and leaked an `--api-key` credential to every child. Those values now travel in an owner-only bootstrap file read once and unlinked by the child.
+- Fixed OAuth logins being destroyed by an unrelated model-catalog refresh. A timed-out or partially failed post-login refresh used to roll freshly acquired tokens back to the previous credential and — because providers rotate refresh tokens — could permanently strand the account behind repeating `invalid_grant` failures. Freshly persisted credentials now always survive the refresh.
+- Fixed `/model` and `/logout` hanging. The selector's 15-second abort now crosses the engine RPC boundary and covers credential reload, model refreshes run in a concurrent correlated lane so selection stays responsive, and `/logout` publishes credential removal immediately instead of timing out after it had already deleted the credential. Newly authenticated providers also appear without a restart ([#1918](https://github.com/bastani-inc/atomic/issues/1918)).
+- Fixed Anthropic subscription login on Bun-hosted Linux sessions remaining at `Exchanging authorization code for tokens...`, caused by Bun not exposing Undici's CommonJS `install()` helper through its ESM namespace, so the configured transport was silently never used.
+- Fixed RPC `save_provider_credential` writes disappearing after restart (they were stored as non-persistent runtime overrides), `ANTHROPIC_AUTH_TOKEN` header-only bearer authentication being rejected across catalog and request paths, and GitHub Copilot requests failing with `421 Misdirected Request` for `COPILOT_GITHUB_TOKEN` users on business, enterprise, and GHE tenants ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Fixed a mid-turn compaction leaving the turn unsendable, which the provider rejected with an unrecoverable `400 ... each tool_use must have a single result`. The post-tool preflight returned the agent's live internal message array, so every later turn duplicated assistant messages and tool results; it now returns its own copy, with provider-side deduplication and a descriptive pre-conversion guard as defence in depth ([#2051](https://github.com/bastani-inc/atomic/issues/2051)).
+- Fixed reasoning tokens being able to fail a compaction outright. The planner capped its own request at `0.8 × reserveTokens` — an input-side reserve reused as an output cap — so a high-reasoning session could spend the whole budget thinking and return no deletion records, killing the active turn during a mid-turn preflight. The planner now sends no `max_tokens` at all; branch summarization received the same fix.
+- Fixed compaction rebuilding the retained recent messages as structured blocks after the boundary, which could produce out-of-order provider blocks and a rejected request. The `preserve_recent` tail is now serialized with the same transcript grammar and concatenated onto the boundary, losslessly: retained tool results keep their full text and retained images stay as image blocks.
+- Fixed repeated `/compact` presses starting several overlapping compactions. `AgentSession.compact()` is now single-flight — a second manual request joins the run in flight rather than emitting a duplicate boundary — and messages queued before an automatic compaction no longer stay stuck until Escape ([#1984](https://github.com/bastani-inc/atomic/issues/1984)).
+- Fixed `/reload` re-transpiling and re-evaluating the entire transitive TypeScript graph of every extension on Windows and in compiled builds even when nothing changed. A per-extension SHA256 graph manifest now lets an unchanged graph reuse its evaluated factory; reloading the five builtin packages drops from ~25 s cold / ~16 s warm to ~90 ms ([#2069](https://github.com/bastani-inc/atomic/issues/2069)).
+- Fixed interactive startup crashing with `Interactive engine did not become ready within 5000 ms` on machines with slow cold starts; the fixed deadline is removed while a dead process or broken transport still fails fast ([#1962](https://github.com/bastani-inc/atomic/issues/1962)).
+- Fixed the external editor failing on Windows whenever the editor path, its arguments, or the temporary prompt path contained a space, and fixed the compiled package CLI crashing before TUI startup when invoked from another working directory ([#1995](https://github.com/bastani-inc/atomic/issues/1995)).
+- Fixed physical Escape and Ctrl+C depending on the configurable `app.clear` action, which could send Escape to the engine stop branch and strip Ctrl+C of its host route. Both are now matched by physical key identity, and a single Ctrl+C again dismisses the `/login` popups instead of clearing the hidden editor and risking a double-press exit.
+- Fixed session-tree navigation being accepted while a response was still streaming, which stranded the in-flight turn's tool results on the abandoned branch, and fixed a startup session switch rendering every agent event twice.
+- Fixed inherited `.pi` extensions conflicting with Atomic-bundled resources, extension-contributed skills, prompts, and themes losing their package source metadata after a resource reload, and a nested linked git worktree loading the repository's `AGENTS.md`/`CLAUDE.md` twice ([#1955](https://github.com/bastani-inc/atomic/issues/1955)).
+- Fixed workflow reliability from the parent-session side: stage `output:` no longer lost to an admitted external turn, `reads:` references fail loudly when an artifact is missing instead of handing the model an empty file, the resume picker stops offering stale or non-resumable runs, fast named workflows no longer leave a stale "still running" claim, queued work no longer escapes a controlled pause ([#1983](https://github.com/bastani-inc/atomic/issues/1983)), and tool-only workflows are no longer reported failed after their durable side effects completed ([#1991](https://github.com/bastani-inc/atomic/issues/1991)).
+- Fixed the RPC `bash` command bypassing extension `user_bash` handlers, so sandbox and remote-shell extensions see an RPC request exactly as they see `user_bash`.
+- Fixed a failed `git` package install leaving a half-written checkout that silently suppressed the next repair, and hardened the archive and SQLite path-selector parsers against polynomial-time regex backtracking (CodeQL `js/polynomial-redos`) with no change to accepted selector syntax.
+- Fixed PDF extraction dropping text and streaming `TypeError: Math.sumPrecise is not a function` on Node runtimes without `Math.sumPrecise` by exact-pinning `unpdf` to `1.7.0` instead of letting it float to 1.8.0 ([#2141](https://github.com/bastani-inc/atomic/issues/2141)).
+
+## [0.9.11-alpha.12] - 2026-08-03
+
+### Fixed
+
+- Fixed PDF extraction dropping text and streaming `TypeError: Math.sumPrecise is not a function` warnings on Node runtimes that do not implement `Math.sumPrecise`. The `unpdf` dependency was declared as the floating range `^1.6.2`, which resolves to 1.8.0 in a published or global install; that release's bundled PDF.js v6.1 dropped the guarded fallback and calls the builtin unconditionally, so extraction threw per glyph, emitted font-substitution warnings, and silently returned fewer text items. `unpdf` is now exact-pinned to `1.7.0`, the newest release that still ships the fallback, so no install can float to 1.8.0 ([#2141](https://github.com/bastani-inc/atomic/issues/2141)).
+- Upgraded the pinned `unpdf` from 1.6.2 to 1.7.0, which adds `cMapUrl` CJK font support under Node, destroys internally created document proxies and canvas resources, and preserves line breaks in `extractText` with `mergePages`.
+
+## [0.9.11-alpha.11] - 2026-08-03
+
+### Breaking Changes
+
+- Workflow run targets now require the full 36-character run UUID. Typed prefixes are no longer resolved by any command or workflow-tool action that accepts `runId`, including `status`, `stages`, `stage`, `transcript`, `send`, `pause`, `resume`, `interrupt`, and `quit`, and by `/workflow connect`, `/workflow attach`, and `/workflow resume`. A target that is not a well-formed 8-4-4-4-12 hex UUID — a prefix, a 32-character dashless id, or a same-length non-hex string — is rejected with `Run id must be a full 36-character UUID; got "339e05a4" (8 chars).`, which is deliberately distinct from `Run not found:` so a truncated paste is diagnosable as truncated rather than looking like a stale run. Since every user-facing surface already prints the full id, copy it back verbatim. Because ids are unique and now matched exactly, run-target ambiguity is unreachable and the "Ambiguous run prefix" diagnostic is gone.
+- Stage targets are now matched exactly. A `stageId` resolves by exact stage id — a bare UUID at the root, the full `runId:stageId` composite for a stage inside a nested `ctx.workflow(...)` import, or `tool:<argsHash>` for a `ctx.tool` node — or by exact stage or tool name. Prefixes and partial names no longer resolve, so `build` will not select `build-check`. Stage ids are deliberately **not** held to the 36-character rule, because nested and tool identifiers are legitimately longer or differently shaped; nested-stage and tool-node targeting are unchanged. Two stages sharing an exact name still return the existing ambiguity diagnostic.
+
+### Changed
+
+- Removed the four-workflow display cap from the BACKGROUND widget so every qualifying top-level run is rendered.
+- Moved durable workflow run artifacts—including goal ledgers, Ralph implementation notes, QA evidence video paths, and worktree task outputs—from per-invocation OS temp directories to the run-scoped durable root under the Atomic config directory (`~/.atomic/workflows/runs/<runId>/`, overridable with `ATOMIC_WORKFLOW_ARTIFACT_DIR`), so they survive OS temp purges and follow state-aware retention.
+- Toggling tool-output expansion (`ctrl+o`) no longer prints a `Tool output: expanded` / `Tool output: collapsed` status line. The chat re-renders in the new state, which is the same information without the extra line.
+
+- Workflow run identifiers are now shown as full UUIDs across the BACKGROUND widget, status and detail views, run pickers, control messages, and awaiting-input attribution banners. BACKGROUND cards use a two-line identity layout at 80 columns and wider, while narrow chat surfaces wrap full ids without cutting them or breaking their borders. The public `workflow({ action: "status", format: "json" })` payload no longer includes `runIdPrefix`; read `runId` instead, which now carries the full id. The `/workflow connect` run picker now shows five runs at a time and scrolls to additional retained runs with the arrow keys or mouse wheel. The picker's type-to-filter box still narrows by name substring or id prefix, since that selects a row from a list rather than resolving a typed id.
+
+### Fixed
+
+- Fixed Escape aborts restoring queued steering and follow-up messages to the editor in the main interactive chat and attached workflow-stage chats instead of leaving them stuck in the pending-message queue.
+- Fixed `/model <model_name>` waiting indefinitely when a model-catalog refresh never settles; it now stops after the interactive 15-second deadline and searches cached models.
+- Quit workflow cards now expire from the BACKGROUND widget after the same recent-run window as finished cards while remaining resumable and discoverable through workflow status; the header count now matches the rendered cards after expiry.
+- Fixed detached foreground subagent completion notifications rendering as an unstyled dump of the full child output. They now use the same structured, collapsed notification UI as background completions while preserving the distinct detached-task wording, and persisted notifications with custom labels remain parseable.
+- Fixed workflow-stage re-attach status falling back to `Working...` while context compaction is still active; the active compaction reason now survives host remounts so manual compaction, threshold auto-compaction, and overflow recovery retain their factual status labels.
+- Fixed workflow stage file output being lost when an admitted external turn (for example an async subagent completion) arrived while the stage was still running: the deterministic `output:` write re-derived its content from session state at close time, so a trailing acknowledgement could overwrite the stage's real deliverable. Every stage that declares `output:` now also gets a durable, searchable companion transcript outside the repository tree, and the receipt names both paths with the intended access pattern, so the work remains recoverable regardless of which turn was persisted. The runner does not attempt to infer which turn was the intended deliverable; it writes the stage's final assistant message, and the receipt reports one fact only — an empty artifact.
+- Fixed the workflow resume picker offering stale or non-resumable runs. Picker and command paths now share one resumability predicate and revalidate durable state before displaying a target, while explicit ids retain their explanatory rejection.
+- Fixed workflow `reads:` references to fail loudly when an artifact path no longer exists instead of handing the model an empty, silently missing context file.
+- Fixed relayed terminal subagent results retaining their stable stage-admission identity when delivered through the intercom ordering barrier, so an acknowledgement turn cannot arrive without the admission marker that identifies it in a running stage's companion transcript.
+- Fixed a failed companion-transcript write reporting a bogus `Output file error` for an output artifact that was written correctly, and returning the full stage text under `outputMode: "file-only"` instead of the compact reference. A transcript failure now degrades to a warning naming the transcript path while the saved-output reference is unchanged, and artifact-retention pruning failures no longer propagate into the stage receipt.
+- Fixed `createWorkflowArtifactDirectory()` attributing artifacts to the ambient most-recently-started run rather than the workflow that created them, and returning one shared directory whose fixed artifact filenames could overwrite each other. Every builtin call site now passes its owning run id, and each call receives a unique directory beneath that run.
+- Fixed the workflow resume picker re-offering a live run as a durable row after the shared resumability predicate rejected it for missing artifacts or checkpoints. Rejected non-running snapshots are now suppressed from live and durable resumable rows, while completed inspection rows remain available; active-running snapshots retain their existing durable fallback.
+
+### Added
+- Added first-class Alpine/musl Linux support for x64 and arm64, including native search and PTY bindings and the `atomic-linux-x64-musl.tar.gz` and `atomic-linux-arm64-musl.tar.gz` release archives. The musl archives omit the clipboard native binding and glibc-linked `@embedded-postgres/*` binaries: Atomic falls back to Linux clipboard commands/OSC52, while durable Alpine workflows require external Postgres via `DBOS_SYSTEM_DATABASE_URL` or Docker; otherwise the existing loud non-durable in-memory fallback applies.
+- Added state-aware retention for durable workflow artifact directories: only terminal or unowned runs older than `WORKFLOW_ARTIFACT_RETENTION_MS` are pruned, while running, paused, quit, blocked, and awaiting-input runs keep live resume dependencies. Aging out a terminal run now deletes its durable entry first and removes the artifact directory only when that deletion succeeds, so a surviving durable record can never reference deleted files.
+- Added durable, searchable companion transcripts for every workflow stage that declares `output:`. The caller's receipt names both the artifact and transcript paths and says to search with `rg`, read narrow line ranges, and never read the transcript whole; under `outputMode: "file-only"`, that receipt is the entire handoff.
+- Added explicit warnings for degenerate stage artifacts instead of silently persisting them: an empty write or a write that only points to its own output path directs the reader to the companion transcript.
+- Added a real artifact-integrity probe to the shared resume predicate. A run whose snapshot references a run-scoped artifact path is offered for resume only while that run directory still exists, and durable-checkpoint eligibility is supplied from the authoritative loadable check, so `/workflow resume` matches the documented behaviour instead of relying on flags no caller set.
+
+## [0.9.11-alpha.10] - 2026-08-01
+
+### Fixed
+
+- Fixed an isolated interactive-engine exit after an admitted tool call leaving that session permanently pending and unusable on resume. Reopening an inactive session now derives explicit error results for unanswered `toolUse` calls without rewriting its append-only JSONL, so the transcript can render, compact, and accept another prompt while preserving that the interrupted command's side effects are unknown. Unexpected-restart notices now also retain the bounded exit kind, code, or signal that triggered recovery while excluding child stderr.
+- Fixed Anthropic subscription login on Bun-hosted Linux sessions remaining at `Exchanging authorization code for tokens...`. Atomic's HTTP setup relied on Undici's CommonJS `install()` helper, but Bun does not expose that helper through its ESM namespace, so source-mode and compiled interactive-engine processes silently kept Bun's native `fetch` instead of the configured Undici transport. Atomic now installs the exported Undici web globals explicitly under Bun. Login completion also ends when the provider credential is persisted and publishes that provider against the already-loaded model snapshot immediately; cache restoration, ambient availability checks, and catalog discovery no longer run inside the successful credential transaction, so none can keep the login dialog open after the provider appears in `auth.json`.
+- Fixed existing authenticated users being unable to select a model, or seeing `Refreshing model catalogs…` indefinitely, after an isolated or direct `/model` refresh stalled. The frontend's 15-second abort previously never crossed the engine RPC boundary, the engine started its deadline only after an unbounded credential/availability reload, and the selector assumed refresh work would honor cancellation. The shared deadline now covers credential reload and catalog work inside the engine, the selector races that deadline itself and replaces the progress state on both timeout and rejection, and model refreshes use a concurrent correlated lane so selection remains responsive while catalogs update. Existing `auth.json` credentials remain compatible and no `~/.atomic` reset is required.
+- Fixed `/logout` timing out after it had already deleted the credential, leaving the provider in `/model` until restart and preventing the selector from reopening. Logout now publishes credential removal immediately, skips post-logout catalog refreshes, bounds the local probe for authentication that remains in the environment, and prevents a model refresh started before the mutation from overwriting the newer login or logout snapshot when it eventually settles.
+
+## [0.9.11-alpha.9] - 2026-08-01
+
+### Breaking Changes
+
+- Adopted pi 0.83.0 (`@earendil-works/pi-agent-core`, `@earendil-works/pi-ai`, `@earendil-works/pi-tui` at `^0.83.0`), which moves the bundled TypeBox to 1.3.7. TypeBox 1.3.7 **removes seven deprecated APIs**. Atomic inherits the removal exactly as upstream shipped it and does not provide a compatibility shim, so an extension, skill, workflow, or MCP schema that still calls one of these will now fail to compile and to run. Atomic's own sources use none of them; the migration below is for package authors. TypeBox 1.3.7 also fixes compiled validation of nullable array tool arguments, and — because `typebox` is pinned to a single hoisted `1.3.7` node — an Atomic-defined tool schema and a pi-defined one now validate identically in the same process.
+
+  | Removed API | Replacement | Migration |
+  | --- | --- | --- |
+  | `Type.Options(type, options)` | `Type.With(type, options)` | Straight rename; same arguments, same result. `Options` was already an alias of `With`. |
+  | `Type.Base` | `Type.Refine()` + `Type.Unsafe()` | `class DateType extends Type.Base<Date> { Check(value) { return value instanceof Date } }` becomes `const DateType = Type.Refine(Type.Unsafe<Date>({}), (value) => value instanceof Date)`. Class-instance schemas lost their prototype methods through TypeBox's clone/spread compositor, which is why the class form is gone. |
+  | `Type.Promise(item)` | none | Model the resolved value directly and validate after `await`, or hold the slot with `Type.Unsafe<Promise<T>>({})` when a schema entry is required. A promise was never checkable without settling it. |
+  | `Type.Awaited(type)` | none | Nothing is left to unwrap once `Type.Promise` is gone: use the resolved type itself where `Type.Awaited(Type.Promise(T))` appeared. |
+  | `Type.Iterator(items)` | none | Validate the materialized sequence with `Type.Array(items)` after draining the iterator, or hold the slot with `Type.Unsafe<Iterable<T>>({})`. |
+  | `Type.AsyncIterator(items)` | none | Same as `Type.Iterator`: drain first and validate with `Type.Array(items)`, or use `Type.Unsafe<AsyncIterable<T>>({})`. |
+  | `Value.Mutate(current, next)` | `Value.Patch(current, Value.Diff(current, next))` | `Patch` returns a **new** value rather than assigning into `current` in place, so code that relied on `Mutate` retaining internal references as a redraw signal must now assign the result and re-read the reference. |
+
+- The RPC `login_provider` response no longer carries the API key it just stored. `RpcLoginProviderResult` dropped its `credential` member and now reports `{ provider, cancelled: false, type: "api_key", …catalog }`. The key travelled as plaintext inside a JSON line on the same stdout the credential-export door treats as the single egress, and the host had itself supplied that key through the login input form, so nothing needed it echoed back. A host that read `data.credential` should use the value it submitted; `type` confirms which kind of credential was saved.
+
+### Added
+
+- Added `ctx.scopedModels` to the extension context: the read-only list of models scoped to the current session, resolved from the `--models` flag and the `enabledModels` setting — the same set `/scoped-models` shows. It is empty when no scoping is configured. The value resolves at access time, so it follows session replacement, and under the isolated interactive engine it reflects the engine's catalogue rather than a stale host snapshot. It reports the scope and cannot widen it: `readonly` is a compile-time claim only, so both the extension context and the hand-built context that shortcut handlers receive hand back a fresh copy on every read, and an extension that mutates what it was given changes nothing. Its types are exported too — `ScopedModel` for one entry and `ExtensionScopedModels` for the accessor — from `core/extensions/types.ts` and from the package root, so an extension can name what it reads without importing an internal module. Documented in `docs/extensions.md`.
+- Added `atomic auth print-api-key` and `atomic auth print-bearer-token`, which print one configured credential for an external client. The credential goes to stdout and nothing else — warnings, provider selection, refresh notices, and help all go to stderr — so `KEY=$(atomic auth print-api-key --model gpt-5.5)` cannot capture a diagnostic. `--model` is required, so no ambient "current model" can emit a credential you did not name. `--provider` and `--model` are the only options either subcommand accepts, enforced as an allowlist over the parsed arguments rather than a list of refusals, so a path-naming flag such as `--export` or `--session-dir` is a usage error instead of a flag this path happens to ignore; there is no file or clipboard sink. When `--provider` is omitted, eligibility comes from the runtime's resolved auth type for each provider offering that model, so a credential supplied by an environment variable or a custom resolver — which `auth.json` never sees — is exported like any other, and a provider offering both an API key and OAuth is selected by whichever one a request would actually use rather than by what it supports. `print-bearer-token` refreshes a token with less than `--min-expiry` (default `30m`, accepting `ms`/`s`/`m`/`h`, in both `--min-expiry 30m` and `--min-expiry=30m` spellings) remaining; `--min-expiry` with `print-api-key` is a usage error in either spelling rather than a silent no-op, because an API key has no expiry. Failures are distinguishable by exit code: `1` usage, `2` no credential configured, `3` provider ambiguous, `4` credential kind unsupported for that provider, `5` the OAuth refresh itself failed (the only exit that promises the stored credential is untouched, because that failure happens before anything is persisted), `6` the provider cannot mint a token that lives long enough, `7` any other OAuth failure, which makes no claim about the stored credential, `8` the credential could not be written and nothing was emitted, and `9` only part of it was written and the output should be discarded. Which of those two a failed write gets is read from `process.stdout.bytesWritten` rather than guessed: nothing flushed is `8` with stdout provably empty, the whole payload flushed is exit `0` with the failure on stderr — the caller holds what it asked for — and a partial flush is `9`, the one exit whose stdout is not empty, because those bytes cannot be recalled and reporting success over a truncated secret would be worse than saying so. One function in `src/cli/credential-print.ts` is the only place in the source tree that can read the credential wrapper and write it to stdout; a test enumerates every call in `packages/coding-agent/src` that puts a non-literal value on the real stdout, and carries a negative control that fails if the scanner stops reporting a planted egress. Documented in `docs/usage.md` and `docs/security.md`.
+
+### Changed
+
+- `ChatSessionHostCommands.prompt` now receives the submitting key's mode as a second argument, and the new `ChatSessionSubmitMode` (`"auto" | "followUp"`) type is exported alongside the other chat-session host types. A host whose idle prompt command chooses a delivery queue can now read the mode of the invocation it is serving instead of shared state a concurrent submission may still own. Existing single-argument `prompt` implementations keep working unchanged ([#2074](https://github.com/bastani-inc/atomic/issues/2074)).
+- The `/model` selector now highlights the top row whenever a filter query is typed, so the best match is the one Enter selects. Clearing the query restores the previous position, clamped to the restored list.
+- Toggling tool-output expansion now reports the new state (`Tool output: expanded` / `Tool output: collapsed`) on the status line instead of re-rendering silently.
+- The startup RESOURCES disclosure now lists `SYSTEM.md` and `APPEND_SYSTEM.md` alongside the `AGENTS.md`/`CLAUDE.md` context files, in the order they reach the prompt. Those files shape the system prompt exactly like a context file, so leaving them out of the listing hid them.
+- llama.cpp models now declare streaming usage support, so token usage is reported during a streamed response instead of only at the end.
+- A provider that ends a turn with a terminal reason the mapping does not recognise now surfaces a provider error naming the raw reason, instead of reporting an ordinary successful stop. A truncation or safety signal a provider adds after this release is therefore visible rather than arriving as a turn that looks like it finished normally; every raw reason that already mapped to a successful stop still does. Documented in `docs/providers.md`.
+- Assistant messages carry the new `pending` stop reason while they are still streaming. It is replaced by the terminal reason before the message completes, so it never reaches session JSONL, but an RPC or SDK client that switches on the stop reason of a partial message needs the case, and a custom `streamSimple` provider should start its partial message at `pending` and raise if the stream ends still holding it. Documented in `docs/providers.md`, `docs/custom-provider.md`, `docs/rpc.md`, and `docs/session-format.md`.
+- A stored OAuth token is now refreshed once fewer than five minutes of validity remain, rather than at expiry, so a long turn is no longer started on a credential that dies mid-request. The refresh runs inside the `auth.json` lock and re-checks the stored expiry after taking it, so concurrent sessions sharing one credential file refresh it once between them rather than once each. Documented in `docs/providers.md`.
+- The OpenRouter login now accepts a pasted final redirect URL, or the authorization code on its own, for remote and headless machines where the browser cannot reach the loopback callback. pi 0.83.0 added that fallback to the OpenRouter OAuth flow, which races the callback against a manual-entry prompt; Atomic's terminal only offers the input for providers whose metadata declares a callback server, so inheriting the flow alone left the prompt waiting on an input that was never shown and the login ended at the callback timeout. Documented in `docs/providers.md`.
+
+### Fixed
+
+- Fixed `/reload` re-transpiling and re-evaluating the entire transitive TypeScript graph of every extension on Windows and in single-file (compiled) builds even when nothing changed. Transformed extension evaluations now record a per-extension graph manifest mapping every file jiti reads to a SHA256 content hash, persisted under the versioned transpile cache directory. On reload, an unchanged graph — every recorded file rehashes identically and the stored manifest matches — reuses the previously evaluated factory instead of re-importing; any hash mismatch, missing file, missing or corrupt manifest, or graph-shape change falls back to a full fresh re-evaluation, which rewrites the manifest, so edited extension source is always picked up. Measured on Windows, reloading the five builtin packages drops from ~25 s cold / ~16 s warm (jiti fsCache) to ~90 ms — the cost of rehashing the recorded graph ([#2069](https://github.com/bastani-inc/atomic/issues/2069)).
+- Hardened the archive and SQLite path-selector parsers used by the read, search, and write tools against polynomial-time regex backtracking (CodeQL `js/polynomial-redos`). The ambiguous greedy `(.+\.ext)` prefixes were replaced with linear right-to-left scans; accepted selector syntax and parsing results are unchanged.
+- Fixed a failed `git` package install leaving a half-written checkout behind. Because the next install treats an existing target directory as installed, that partial clone silently suppressed the repair. A clone, checkout, or dependency install that fails now removes the target directory and prunes the host/owner directories it created.
+- Fixed the RPC `bash` command bypassing extension `user_bash` handlers. A sandbox or remote-shell extension that intercepts user shell commands now sees an RPC `bash` request exactly as it sees `user_bash`, with request-scoped ownership, streaming correlation, and result recording unchanged.
+- Fixed a startup session switch rendering every agent event twice. A session replacement that began while the startup rebind was still binding extensions produced two live agent subscriptions; the superseded rebind now returns without subscribing.
+- Fixed session-tree navigation being accepted while a response was still streaming, which stranded the in-flight turn's tool results on the abandoned branch. Navigation now rejects while streaming, the interactive tree selector stops the active response (restoring queued messages to the editor) before navigating, and a session replacement settles its active response before the outgoing session is torn down. The isolated engine's host facade deliberately does not re-enter its cooperative-abort round trip during teardown, so an unresponsive or dead engine still cannot hang a session switch.
+- Fixed a nested linked git worktree loading the repository's `AGENTS.md`/`CLAUDE.md` twice. When a worktree created inside its own main repository has its own copy of the same tracked context file, the main repository's copy is now skipped. Ordinary repositories, sibling worktrees, bare layouts, and submodules keep normal ancestor inheritance.
+- Fixed extension-contributed skills, prompt templates, and themes losing their package source metadata when they were registered after a resource reload. The reload's resolved metadata is now retained on the loader so later `extendResources` passes still resolve it.
+
 ## [0.9.11-alpha.8] - 2026-07-29
 
 ### Breaking Changes
@@ -14,13 +194,41 @@
 - `AuthStorage` now implements pi's asynchronous `CredentialStore` contract directly. Its synchronous compatibility methods (`get`, `set`, `remove`, `has`, `hasAuth`, `getAll`, `getAuthStatus`, `getLoadError`, `drainErrors`, and synchronous `list`), `asCredentialStore()` adapter, fallback/runtime-key helpers (`setFallbackResolver`, `getRuntimeApiKey`, `setRuntimeApiKey`, and `removeRuntimeApiKey`), and provider-auth methods (`login`, `logout`, `logoutAsync`, `getModelAuth`, `getApiKey`, and `getOAuthProviders`) were removed. Use and `await` `read`, `list`, `modify`, and `delete` for persisted credentials, call `reload` when an existing instance must reread its backing store, and use `ModelRuntime` for authentication resolution, login/logout, and runtime API-key overrides.
 - `ModelRegistry` is now constructed from a `ModelRuntime` and exposes only pi's thin compatibility-facade surface. The `create` and `inMemory` factories, public `authStorage` member, and the `canRestoreUnknownModel`, `checkAuth`, `getAuth`, `getCustomApiKeyAuth`, `getCustomApiKeyAuthProviders`, `getProviders`, `hasProvider`, `hasRegisteredStreamSimpleForApi`, `login`, and `logoutProvider` methods were removed. Instantiate and consume `ModelRuntime` for runtime-owned model/provider discovery and authentication, and pass it to `new ModelRegistry(runtime)` only where the synchronous extension-facing facade is required.
 - `CreateAgentSessionOptions` no longer accepts the public `authStorage` and `modelRegistry` overrides. Construct or supply a `ModelRuntime` through `modelRuntime` instead; when omitted, `createAgentSession()` creates the runtime from the active agent directory's `auth.json` and `models.json`.
+- Isolated interactive `ctx.ui.custom()` components that consume Ctrl+C must now pass `{ handlesCtrlC: true }`. Without that declaration the first Ctrl+C is the host escape and closes the focused component, resolving its promise with `undefined`; a declared component receives the first press and stays host-closable on the next one. This keeps a component that never resolves from trapping the keyboard. The bundled workflow and MCP surfaces were migrated; third-party extensions that bind Ctrl+C for Skip, Close, or cancel need the one-line addition.
+
+### Added
+
+- Added a `handlesCtrlC` option to `ctx.ui.custom()` for components that bind the key themselves. See the migration note under Breaking Changes for the behavior an existing component must declare to keep.
 
 ### Changed
 
 - Adopted pi's provider-owned `ModelRuntime` architecture for model composition, credentials, streaming, and catalog refresh. `ModelRegistry` is now the thin synchronous extension-compatibility facade used by pi, while coding-agent, SDK, RPC, isolated-engine, workflow, and MCP internals consume `ModelRuntime` directly.
 
 ### Fixed
-
+- Fixed physical Escape and Ctrl+C depending on the configurable `app.clear` action. With `app.clear` bound to Escape, Escape could reach the engine stop/restart branch while Ctrl+C lost the host route entirely — the opposite of the intended behavior on both keys. Both are now matched by physical key identity through pi-tui's parser (so complete CSI/OSC sequences and bracketed paste are never mistaken for a bare Escape, and Kitty key-release events never act twice), and the configured `app.clear` still governs ordinary editor clearing on whatever key it is bound to. The editor applies the same fixed Escape guard before its configurable action handlers, while keeping Escape as autocomplete cancel when autocomplete is open.
+- Fixed the remote-UI escape hatch replacing a healthy engine, and made it act on the first press. Ctrl+C behind a remote `ctx.ui.custom()` component used to need two presses and then stopped and replaced the whole engine child, discarding everything else that generation was doing. Ownership is now declared per mount: an unresponsive engine is still terminated on the first press (a wedged child cannot run a local handler either), a component that declared `handlesCtrlC` receives the press and keeps working — and is closed if it is still holding input on the next one — and an undeclared component is closed immediately through the ordinary close path, resolving its `ctx.ui.custom()` promise with `undefined` while the engine, and every other component it has mounted, keeps running.
+- Fixed an engine child that exits during the startup window leaving a live TUI bound to a dead engine. A child could report ready, let startup return, and exit before the host finished attaching its listeners; that death had no listener and recovery never ran. The terminal event is now retained and replayed to a listener that attaches afterwards, while a death belonging to an already-replaced generation is never replayed.
+- Fixed frames buffered by a dead engine generation being delivered to the host afterwards. A `ctx.ui.custom()` mount frame queued before its controller subscribed could arrive after that generation died and after teardown ran, remounting exactly the UI the teardown had just closed — and colliding with the replacement child, whose component IDs restart at the same values. Buffered engine messages and extension UI requests are now tagged with their generation, dropped when it dies, and never observed from a replaced generation; frames belonging to the live generation still replay as before.
+- Fixed two submissions whose text differs only in whitespace being able to restore each other's draft. The exact typed buffer travelled in a single shared slot that every Enter overwrote and every finished turn cleared, so a failure could put back the wrong text — or nothing. Each submission now carries its own draft end to end, through the input queue and the prompt turn, and submissions still queued behind a failed one come back with it in the order they were entered rather than being restored later in reverse.
+- Fixed a raw stream write failure still discarding submitted text. `write EPIPE`, `Cannot call write after a stream was destroyed`, and `write after end` are exactly what a dying engine produces, and none of them matched the message fragments the host used to recognize a send that never landed — so those submissions showed a red `Error: write EPIPE` and the typed text was lost. Transport failures are now classified where they happen, with an additive non-enumerable marker that leaves the error's identity and its `code`, `errno`, and `syscall` fields intact, and the queued writer, the child exit/error/stdin handlers, an explicit stop, a malformed transport, a missing writer, and a not-started client all carry it. Request timeouts after a successful write, RPC error responses, provider failures, and anything after `agent_start` are deliberately not classified and still surface as errors.
+- Fixed an idle Alt+Enter submission losing its surrounding whitespace when the send failed. Alt+Enter is an app action, so the editor never takes its own pre-trim snapshot for it and the submit handler's only draft is the value the Alt+Enter path hands over — which was the already-trimmed text. The raw expanded buffer is passed instead, so a failed idle follow-up now returns exactly what was typed while the agent still receives the same normalized prompt.
+- Fixed quiet work that the engine had already started being offered back to the editor as unsent. Ownership was inferred from the first byte of output, so `!touch marker && sleep 400` — which changes the working tree and prints nothing — looked identical to a command the child never received: killing the engine put that `!` line back in the editor, inviting a second run. The child now announces ownership of every correlated request, flushed before its handler can touch the shell, an extension, the queue, or compaction, and the host restores a draft only for a transport failure that arrived without an announcement. An accepted failure is reported as an ordinary failure instead. The interactive-engine protocol version is now `2`; a mismatched host and child do not bind rather than falling back to the old policy.
+- Fixed automatic recovery discarding the ownership of the work it was recovering from. An announcement can still be unparsed in the pipe when the child dies, and recovery — which starts in the same turn as the death event — detached the reader, retired the generation, and re-failed those requests with `Agent process stopped`, so already-running work was reported as never sent and offered back for a second run. A dead generation now gets a bounded settling window: its UI is torn down immediately as before, but its stdout keeps being read, only its ownership frames are honoured, its requests are classified exactly once with the error of whatever ended it, and the replacement starts only afterwards. Every terminal cause — exit, spawn error, stdin error, malformed transport, and explicit stop — goes through that one path, and a descendant that inherited stdout cannot delay recovery beyond the bound. The JSONL reader also reports completion for a stream that ends with nothing buffered, which previously left that wait to time out.
+- Fixed session teardown racing an engine replacement. A recovery attempt sits between its own stop and its spawn with no child attached, so disposal's stop found nothing to do and returned — and the attempt then started a fresh engine, plus its host initialization, after teardown had finished. Disposal now voids the in-flight restart permit and joins the attempt before returning, and a superseded restart fails as cancelled instead of quietly succeeding. Automatic single-shot recovery, the Ctrl+C rescue, and the overdue-replacement rules are unchanged; a cancelled attempt reports no failure and arms nothing.
+- Exempted every cooperative-cancellation command from the generic 30-second RPC deadline, not just `abort`. Cancelling a running `!sleep` still produced `Timeout waiting for response to abort_bash` — a red error about the host's own impatience while the engine was still working. `abort_bash`, `abort_compaction`, `abort_retry`, and `cancel_login_provider` now wait like `abort` does.
+- Fixed engine loss during an active replacement leaving the host with no engine and no way to ask for one. A newer child dying while the automatic attempt was still running was silently ignored, and once that attempt settled nothing armed Ctrl+C. The nested death now latches the escape hatch without starting a second automatic restart, so recovery stays single-shot and user-driven.
+- Fixed engine-owned line widgets surviving the generation that published them. `setWidget` writes plain host state with no component to close, so a dead generation left its lines on screen. Widget keys are now tracked against their latest writing generation and released only when that generation dies; a newer generation that rewrites the same key takes ownership and its content survives stale cleanup.
+- Fixed the restored draft being the already-trimmed submission rather than what was typed. pi-tui expands pastes, trims, and clears the editor before it calls `onSubmit`, so the callback argument could never carry the user's leading or trailing whitespace. The editor now snapshots its expanded buffer for the same input dispatch that submits it, and restoration uses that.
+- Stopped showing a red transport error next to a restored draft. A submission the engine never accepted already reports itself: the draft is back in the editor and the calm recovery status explains why. Errors that were not restored — provider failures, model errors, and any failure after the agent turn started — still surface.
+- Fixed a stream write that failed in its callback leaving its caller's promise pending forever. An EPIPE to a dying engine could hang a prompt or an abort instead of failing it; the in-flight frame is now rejected along with everything still queued.
+- Fixed the heartbeat observer consuming the buffered startup custom-UI messages. Watching heartbeats through the generic engine-message channel drained messages queued before the real controllers subscribed, so a custom UI opened during startup could be lost. Heartbeats now arrive on a dedicated callback that does not participate in that buffering.
+
+- Fixed interrupting a tool call terminating the interactive engine and reporting `Engine terminated; … result unknown; inspect side effects before retrying`. Escape raced the engine's cooperative abort against a 250 ms deadline and killed plus restarted the engine child whenever it lost that race, which any ordinary event-loop stall in the child could cause — a synchronous extension or tool callback, GC, or a large tool-output flush. Escape now simply requests the engine's cooperative cancellation and waits for it: interrupting never terminates the engine, never restarts it, never discards in-flight tool state, and the removed message no longer exists anywhere in Atomic. The wait is genuinely unbounded — `abort` is exempt from the generic 30-second RPC deadline, so a stopped or blocked child no longer turns Escape into a red `Timeout waiting for response to abort` while the engine is still working.
+- Fixed a total interactive-TUI lockup when the engine generation behind a mounted remote custom UI died. A crashed, killed, or replaced engine left the host's `ctx.ui.custom()` components mounted forever: their promises never settled, an inline mount kept the editor detached from its container, an overlay kept input focus, widget keys and terminal modes stayed claimed, and the blocking inline custom-UI depth stayed above zero, so typing, Escape, Ctrl+C, and even Ctrl+C Ctrl+C all did nothing and the process had to be killed from another terminal. Engine death is now a host-local lifecycle event that immediately closes every remote component from the dead generation, settles its promises, releases widget keys, resets terminal modes, remounts and refocuses the editor, and unwinds the inline depth to zero — without waiting for a replacement `engine_ready`, so a crash with no restart, or a hung or failed restart, recovers too. Teardown unwinds newest-first and hides each overlay through its own handle, so a nested overlay never restores focus to a layer that is already gone and never closes an unrelated native overlay, and the editor is refocused only when no surviving native modal owns input. Host `select`, `confirm`, `input`, and `editor` dialogs opened by the dead generation are now owned by it too: they used to stay on screen forever with their promise unsettled and could answer through the replacement child's writer.
+- Added recovery from an unexpected interactive-engine exit. A crashed engine previously left a live TUI bound to a dead child with no way back; Atomic now makes one automatic replacement attempt and shows the calm status `Interactive engine stopped unexpectedly; restarting.`, reports `Interactive engine restart failed: …` when the replacement cannot start, and leaves the editor mounted, focused, and usable in either case.
+- Kept an explicit escape hatch for a wedged engine, matching the watchdog's own `Esc interrupt · Ctrl+C terminate` copy, and made it reachable in every case where the key would otherwise vanish. Ctrl+C is now always handled by the host while an engine-owned `ctx.ui.custom()` component or overlay holds input — even with a healthy engine, because such a component forwards every key to the child and a component that never resolves would trap the escape key too; with a healthy engine the host closes that one component rather than touching the engine. Ctrl+C also still replaces an engine that is provably not answering: watchdog-confirmed unresponsive, a cooperative abort unanswered past the same one-second threshold, a replacement waiting for readiness past it (previously unrecoverable, since such a child emits no heartbeat and no diagnostic), or a replacement that failed outright, which now keeps Ctrl+C armed indefinitely instead of leaving the host permanently engine-less. A repeat press can stop an overdue replacement and start another; a fresh replacement is never stopped by a stray press; and host-native selectors, dialogs, input forms, and session pickers keep Ctrl+C-as-cancel whenever the engine is healthy.
+- Fixed the interactive engine exporting its private control values to every process it spawned. `ATOMIC_INTERACTIVE_ENGINE_CHILD`, `_HOST_PID`, `_GUARD_FILE`, and `_API_KEY` were set on the engine child's environment, so bash tool commands, subagent children, MCP servers, hooks, and nested Atomic runs all inherited them: a nested `atomic` started in engine mode and flooded stdout with heartbeats instead of opening a TUI, parent-process guardians watched an unrelated PID, subagent idle watchdogs never fired, and an `--api-key` credential reached every child. Deleting the variables at startup cannot fix this under Bun, where a child spawned without an explicit `env` inherits the runtime's launch-time environment; the engine is therefore now launched with an environment that never contains the values. They travel in an owner-only bootstrap file whose path is a private CLI argument, read once and unlinked by the child, and every reader uses that frozen snapshot. Legacy variables are still scrubbed from `process.env` and from subagent foreground, background-streaming, and detached-runner spawn environments as defense in depth, and extension `ctx.exec` passes an explicit environment. Bootstrap cleanup is ownership-scoped: the child unlinks exactly the file it was told to read, while recursive removal of the containing directory requires the handle the host received when it created it, so a hostile `--internal-engine-bootstrap` path cannot delete an unrelated directory. A failed publication removes its own temporary file and directory before rethrowing, so a `0600` credential file is never left behind.
+- Fixed typed input being discarded when a submission could not be sent. A prompt that failed because the engine was gone, stopping, or restarting showed only `Error: Agent process stopped` and lost the text. The submission now returns to the editor exactly as the editor handed it over, placed ahead of anything typed while the send was still pending and separated by a blank line, so neither part is lost and neither is trimmed; a pending large paste is expanded rather than reduced to a dead `[paste #1 …]` marker, which `setText` would otherwise discard. Focus returns to the editor unless a modal owns input, and the restored text is treated as a draft rather than replayed as a submission. This covers every submit route, not just Enter: `/atomic`, a deferred slash command, an extension command during compaction, a streaming steer send, `!bash`, `/compact`, and Alt+Enter all dispatch straight to the engine and previously dropped the text on their own. Text that reached a started agent turn stays in the transcript as before.
 - Fixed OAuth logins being destroyed by an unrelated model-catalog refresh, matching upstream pi's behavior. After a successful `/login`, a timed-out (aborted) or partially failed catalog refresh threw `Model refresh aborted after OAuth login` and rolled the freshly acquired tokens back to the previous credential. Because providers rotate refresh tokens, that rollback could permanently strand a server-side-invalidated credential — every send then failed with `invalid_grant` ("Refresh token not found or invalid") and every re-login was rolled back again, typically on machines with slow routes to catalog endpoints. Freshly persisted OAuth credentials now always survive the post-login refresh: per-provider refresh errors and refresh timeouts no longer fail the login in either the direct interactive or isolated-engine path, and models fall back to the cached snapshot.
 - Fixed the `/model` selector reporting `Could not refresh llama.cpp; showing cached models.` for users who never configured a llama.cpp server. The bundled llama.cpp extension now uses pi's provider-owned registration: the provider stays dormant — no refresh attempt, no error — until a server is configured through `LLAMA_BASE_URL` or a stored login, and `/login` prompts for the server URL plus optional API key exactly like pi.
 - Fixed RPC `save_provider_credential` writes disappearing after process restart. Saved API-key and OAuth credentials now persist to `auth.json` through `ModelRuntime.saveCredential()` instead of being stored as non-persistent runtime API-key overrides; the RPC command again accepts the full credential union, awaits a model-catalog refresh, and returns the refreshed catalog.

package/README.md

@@ -79,7 +79,7 @@ atomic
 
 Then just talk to Atomic. By default, Atomic gives the model six coding tools: `read`, `write`, `edit`, `bash`, `find`, and `search`. The model uses these to fulfill your requests. `read`, `search`, `write`, and successful `edit` calls emit session-scoped hashline anchors (`[path#TAG]` plus `LINE:text`) so the model can make stale-safe line edits; see [docs/tools.md](docs/tools.md). Add capabilities via [skills](#skills), [prompt templates](#prompt-templates), [extensions](#extensions), or [Atomic packages](#atomic-packages).
 
-**Platform notes:** [Windows](docs/windows.md) | [Termux (Android)](docs/termux.md) | [tmux](docs/tmux.md) | [Terminal setup](docs/terminal-setup.md) | [Shell aliases](docs/shell-aliases.md)
+**Platform notes:** [Windows](docs/windows.md) | [Alpine/musl Linux](docs/index.md#alpine-and-musl-linux-archives) | [Termux (Android)](docs/termux.md) | [tmux](docs/tmux.md) | [Terminal setup](docs/terminal-setup.md) | [Shell aliases](docs/shell-aliases.md)
 
 ---
 

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.11] - 2026-08-03
+
+### Changed
+
+- Released with Atomic 0.9.11. No functional intercom changes since 0.9.10; the extension now runs under the reworked isolated-engine and workflow-group behaviour shipped by the host.
+
 ## [0.9.11-alpha.1] - 2026-07-20
 
 ### Changed

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.11-alpha.8",
+  "version": "0.9.11",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [
@@ -44,7 +44,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.82.1"
+    "@earendil-works/pi-tui": "^0.83.0"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {
@@ -56,6 +56,6 @@
   },
   "dependencies": {
     "tsx": "^4.23.1",
-    "typebox": "^1.3.6"
+    "typebox": "^1.3.7"
   }
 }

package/dist/builtin/intercom/subagent-relay.ts

@@ -33,6 +33,7 @@ async function dispatchRelayFallback(
   pi: ExtensionAPI,
   prefix: Array<{ customType: string; content: string; display: boolean; details?: unknown }>,
   terminalMessage: { customType: string; content: string; display: boolean; details?: unknown },
+  stageAdmissionKey: string,
 ): Promise<void> {
   let delivered = 0;
   try {
@@ -40,7 +41,7 @@ async function dispatchRelayFallback(
       await pi.sendMessage(message, { deliverAs: "steer" });
       delivered += 1;
     }
-    await pi.sendMessage(terminalMessage, { triggerTurn: true });
+    await pi.sendMessage(terminalMessage, { triggerTurn: true, stageAdmissionKey });
   } catch (error) {
     const failure = new Error(error instanceof Error ? error.message : String(error), { cause: error });
     Object.assign(failure, { terminalPreludeDelivered: delivered });
@@ -57,6 +58,7 @@ export function registerSubagentRelay(pi: ExtensionAPI, deps: SubagentRelayDeps)
     status: string,
     messageText: string,
     terminalBarrier?: { runId: string; terminalId?: string; sourceSessionTargets: string[] },
+    requestId?: string,
   ): Promise<void> {
     const now = Date.now();
     const entry = {
@@ -82,10 +84,11 @@ export function registerSubagentRelay(pi: ExtensionAPI, deps: SubagentRelayDeps)
             display: true,
             details: entry,
           };
+          const stageAdmissionKey = `intercom:${requestId ?? entry.message.id}`;
           if (typeof pi.sendMessages === "function") {
-            return pi.sendMessages([...prefix, terminalMessage], { triggerTurn: true });
+            return pi.sendMessages([...prefix, terminalMessage], { triggerTurn: true, stageAdmissionKey });
           }
-          return dispatchRelayFallback(pi, prefix, terminalMessage);
+          return dispatchRelayFallback(pi, prefix, terminalMessage, stageAdmissionKey);
         },
       };
       Object.defineProperty(payload, "terminalOwner", { value: pi });
@@ -139,13 +142,13 @@ export function registerSubagentRelay(pi: ExtensionAPI, deps: SubagentRelayDeps)
           void delivery.catch(() => {});
           localDeliveriesInFlight.set(parsed.requestId, { signature, completion: delivery });
           try {
-            void deliverLocalSubagentRelayMessage(options.sender, options.status, parsed.message, options.terminalBarrier).then(deferred.resolve, deferred.reject);
+            void deliverLocalSubagentRelayMessage(options.sender, options.status, parsed.message, options.terminalBarrier, parsed.requestId).then(deferred.resolve, deferred.reject);
           } catch (error) {
             deferred.reject(error);
           }
           void delivery.finally(() => { localDeliveriesInFlight.delete(parsed.requestId!); }).catch(() => {});
         } else if (!delivery) {
-          delivery = deliverLocalSubagentRelayMessage(options.sender, options.status, parsed.message, options.terminalBarrier);
+          delivery = deliverLocalSubagentRelayMessage(options.sender, options.status, parsed.message, options.terminalBarrier, parsed.requestId);
         }
         await delivery;
         if (parsed.requestId) localDeliveries.record(parsed.requestId, signature);

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.11] - 2026-08-03
+
+### Removed
+
+- Removed Cursor MCP configuration discovery and the `cursor` compatibility import kind ([#1994](https://github.com/bastani-inc/atomic/issues/1994)).
+
+### Fixed
+
+- Declared `handlesCtrlC` on the `/mcp` panel, the `/mcp setup` panel, and the MCP OAuth panel, so Ctrl+C still reaches each panel's own handler — and its cancel and cleanup work — in isolated interactive sessions.
+
+## [0.9.11-alpha.9] - 2026-08-01
+
+### Fixed
+
+- Declared `handlesCtrlC` on the `/mcp` panel, the `/mcp setup` panel, and the MCP OAuth panel. In isolated interactive sessions the terminal host now closes an undeclared remote `ctx.ui.custom()` component on the first Ctrl+C, which would have bypassed each panel's own Ctrl+C handler along with its cancel and cleanup work. The declaration keeps that handler running.
+
 ## [0.9.11-alpha.6] - 2026-07-28
 
 ### Removed

package/dist/builtin/mcp/commands.ts

@@ -292,7 +292,9 @@ export async function openMcpSetup(
           resolve({ configChanged });
         });
       },
-      { overlay: true, overlayOptions: { anchor: "center", width: 92 } },
+      // handlesCtrlC: the setup panel binds Ctrl+C for its own cancel/cleanup,
+      // so the host must forward the key instead of closing the panel itself.
+      { overlay: true, handlesCtrlC: true, overlayOptions: { anchor: "center", width: 92 } },
     );
   });
 }
@@ -369,7 +371,8 @@ export async function openMcpPanel(
           resolve();
         }, { noticeLines });
       },
-      { overlay: true, overlayOptions: { anchor: "center", width: 82 } },
+      // handlesCtrlC: the panel binds Ctrl+C for its own cancel/cleanup.
+      { overlay: true, handlesCtrlC: true, overlayOptions: { anchor: "center", width: 82 } },
     );
   });
 
@@ -412,7 +415,8 @@ export async function openMcpAuthPanel(
           noticeLines: ["Select OAuth MCP Server. Enter/CTRL+A Authenticate."],
         });
       },
-      { overlay: true, overlayOptions: { anchor: "center", width: 82 } },
+      // handlesCtrlC: the panel binds Ctrl+C for its own cancel/cleanup.
+      { overlay: true, handlesCtrlC: true, overlayOptions: { anchor: "center", width: 82 } },
     );
   });
 

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.11-alpha.8",
+  "version": "0.9.11",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [
@@ -32,8 +32,8 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-ai": "^0.82.1",
-    "@earendil-works/pi-tui": "^0.82.1",
+    "@earendil-works/pi-ai": "^0.83.0",
+    "@earendil-works/pi-tui": "^0.83.0",
     "zod": "^3.25.0 || ^4.0.0"
   },
   "peerDependenciesMeta": {
@@ -48,10 +48,10 @@
     }
   },
   "dependencies": {
-    "@modelcontextprotocol/ext-apps": "^1.7.4",
-    "@modelcontextprotocol/sdk": "^1.25.1",
+    "@modelcontextprotocol/ext-apps": "^1.7.5",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "open": "^11.0.0",
-    "typebox": "^1.3.6",
+    "typebox": "^1.3.7",
     "zod": "^3.25.0 || ^4.0.0"
   }
 }

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## [Unreleased]
 
+## [0.9.11] - 2026-08-03
+
+### Changed
+
+- Adopted Claude Opus 5 across every builtin subagent `fallbackModels` policy and normalized provider ordering: each Anthropic family lists its direct `anthropic/...` candidate ahead of the `github-copilot/...` mirror, Opus 5 leads the Anthropic group (`:high` for the debugger, `:low` elsewhere), and `claude-fable-5` gains its missing Copilot mirror.
+- Reworked all nine bundled agent system prompts and all seven chain task templates for GPT-5.6, Claude Opus 5, and Claude Fable 5. Agent bodies are outcome-first with explicit success, evidence, output, escalation, and stop contracts, shrinking from 1,418 to 561 lines. Removing repeated self-verification and requests to reproduce internal reasoning also avoids Claude Fable 5 `reasoning_extraction` refusals that could force model fallback. Frontmatter and exported behaviour are unchanged.
+- Made the builtin debugger write-capable with the same tool list as `worker`, so it applies the smallest in-scope fix after proving the root cause, and gave it the `tdd`, `playwright-cli`, and `tmux` skills plus Intercom coordination.
+- Generalized orchestration guidance across parent chats and workflow stages: orchestrators preserve each agent's declared model and fallback policy by default, explicit overrides require a user request or documented need, and every invocation shares one invocation-specific Intercom group while retaining `contact_supervisor` escalation.
+
+### Removed
+
+- Removed Cursor MCP compatibility imports from delegated direct-tool resolution and Cursor model candidates from every builtin subagent fallback policy ([#1994](https://github.com/bastani-inc/atomic/issues/1994)).
+- Removed the `(1m)` context-window token from every builtin fallback policy; candidates now use the model's catalog context window (`github-copilot/claude-opus-4.8:medium`).
+
+### Fixed
+
+- Fixed startup artifact cleanup escaping isolated agent directories, and made it far cheaper: the global scan now stays inside a host-provided sessions root, runs at most once per 24 hours per root behind a `.last-cleanup` marker and an exclusive `.cleanup.lock`, is deferred ten minutes after startup, and stops at the first entry newer than the cutoff instead of recursively stat-ing whole subtrees — eliminating tens of thousands of synchronous fs calls on long-lived machines ([#2070](https://github.com/bastani-inc/atomic/issues/2070)).
+- Fixed worktree setup hooks being reported as failed when they never read their stdin. A hook that exited before the JSON input flushed made `spawnSync` report `EPIPE` and tore down the whole worktree even though the hook had completed; the child's exit status and output are now authoritative. Timeouts and other spawn errors stay fatal.
+- Fixed foreground subagent runs that detached for intercom coordination completing silently. A detached single, chain, or parallel child now delivers a "Detached subagent task" completion, failure, or paused notice to the parent session through the same deduplicated, turn-triggering pipeline as background completions, including per-child `(n/m)` attribution.
+
+## [0.9.11-alpha.9] - 2026-08-01
+
+### Fixed
+
+- Fixed startup artifact cleanup escaping isolated agent directories. When the host provides a non-default session directory (for example an isolated programmatic `agentDir` used by tests and embedders), the global artifact scan now stays inside that sessions root; the real global and legacy `~/.pi` sessions roots are only scanned when no host-provided root is available ([#2070](https://github.com/bastani-inc/atomic/issues/2070)).
+- Fixed every extension activation rescanning all historical session directories for stale subagent artifacts. The global scan now runs at most once per 24 hours per sessions root via a root-level `.last-cleanup` marker, takes an exclusive `.cleanup.lock` so concurrent activations never race the same scan, and is deferred ten minutes after startup instead of running on the activation macrotask; the deferral stays unref'd and is cancelled by extension shutdown ([#2070](https://github.com/bastani-inc/atomic/issues/2070)).
+- Fixed startup maintenance walking every file under the nested subagent runtime directories on each activation. The stale-directory scan now stops at the first entry newer than the cleanup cutoff instead of recursively stat-ing whole subtrees to compute the true newest mtime, eliminating tens of thousands of synchronous fs calls on long-lived machines ([#2070](https://github.com/bastani-inc/atomic/issues/2070)).
+- Fixed subagent worktree setup hooks being reported as failed when they never read their stdin. The hook's JSON input is written to its stdin, but nothing requires a hook to consume it; a hook that exited before that write flushed made `spawnSync` report `EPIPE` and the whole worktree creation was torn down, even though the hook had run to completion and its stdout was captured in full. The child's exit status and output are now authoritative, so only a spawn that never produced a status is treated as a hook failure. Timeouts and every other spawn error stay fatal as before. This race was lost far more often on loaded machines, making it look intermittent.
+
 ## [0.9.11-alpha.6] - 2026-07-28
 
 ### Changed

package/dist/builtin/subagents/agents/code-simplifier.md

@@ -8,8 +8,8 @@ description: |
   - Production-quality refinement of a working draft ("ugly but working CSV parser").
   - Code that has gotten messy after several iterations.
 tools: read, edit, write, search, find, ls, bash, todo
-model: openai-codex/gpt-5.6-sol:medium
-fallbackModels: github-copilot/gpt-5.6-sol:medium, openai/gpt-5.6-sol:medium, anthropic/claude-opus-5:low, github-copilot/claude-opus-5:low, openai-codex/gpt-5.5:medium, github-copilot/gpt-5.5:medium, openai/gpt-5.5:medium, anthropic/claude-fable-5:low, github-copilot/claude-fable-5:low, anthropic/claude-opus-4-8:medium, github-copilot/claude-opus-4.8:medium, xai/grok-4.5:high, zai/glm-5.2:high, zai-coding-cn/glm-5.2:high, openrouter/openai/gpt-5.6-sol:medium, openrouter/anthropic/claude-opus-5:low, openrouter/openai/gpt-5.5:medium, openrouter/anthropic/claude-fable-5:low, openrouter/anthropic/claude-opus-4-8:medium, openrouter/x-ai/grok-4.5, openrouter/z-ai/glm-5.2:xhigh
+model: openai-codex/gpt-5.6-luna:max
+fallbackModels: github-copilot/gpt-5.6-luna:max, openai/gpt-5.6-luna:max, anthropic/claude-opus-5:low, github-copilot/claude-opus-5:low, openai-codex/gpt-5.5:medium, github-copilot/gpt-5.5:medium, openai/gpt-5.5:medium, anthropic/claude-fable-5:low, github-copilot/claude-fable-5:low, anthropic/claude-opus-4-8:medium, github-copilot/claude-opus-4.8:medium, xai/grok-4.5:high, zai/glm-5.2:high, zai-coding-cn/glm-5.2:high, openrouter/openai/gpt-5.6-luna:max, openrouter/anthropic/claude-opus-5:low, openrouter/openai/gpt-5.5:medium, openrouter/anthropic/claude-fable-5:low, openrouter/anthropic/claude-opus-4-8:medium, openrouter/x-ai/grok-4.5, openrouter/z-ai/glm-5.2:xhigh
 skills: tdd, playwright-cli, tmux
 ---
 

package/dist/builtin/subagents/agents/codebase-analyzer.md

@@ -2,8 +2,8 @@
 name: codebase-analyzer
 description: Analyzes codebase implementation details. Call the codebase-analyzer agent when you need to find detailed information about specific components.
 tools: read, search, find, ls, todo
-model: openai-codex/gpt-5.6-sol:medium
-fallbackModels: github-copilot/gpt-5.6-sol:medium, openai/gpt-5.6-sol:medium, anthropic/claude-opus-5:low, github-copilot/claude-opus-5:low, openai-codex/gpt-5.5:medium, github-copilot/gpt-5.5:medium, openai/gpt-5.5:medium, anthropic/claude-fable-5:low, github-copilot/claude-fable-5:low, anthropic/claude-opus-4-8:medium, github-copilot/claude-opus-4.8:medium, xai/grok-4.5:high, zai/glm-5.2:high, zai-coding-cn/glm-5.2:high, openrouter/openai/gpt-5.6-sol:medium, openrouter/anthropic/claude-opus-5:low, openrouter/openai/gpt-5.5:medium, openrouter/anthropic/claude-fable-5:low, openrouter/anthropic/claude-opus-4-8:medium, openrouter/x-ai/grok-4.5, openrouter/z-ai/glm-5.2:xhigh
+model: openai-codex/gpt-5.6-luna:max
+fallbackModels: github-copilot/gpt-5.6-luna:max, openai/gpt-5.6-luna:max, anthropic/claude-opus-5:low, github-copilot/claude-opus-5:low, openai-codex/gpt-5.5:medium, github-copilot/gpt-5.5:medium, openai/gpt-5.5:medium, anthropic/claude-fable-5:low, github-copilot/claude-fable-5:low, anthropic/claude-opus-4-8:medium, github-copilot/claude-opus-4.8:medium, xai/grok-4.5:high, zai/glm-5.2:high, zai-coding-cn/glm-5.2:high, openrouter/openai/gpt-5.6-luna:max, openrouter/anthropic/claude-opus-5:low, openrouter/openai/gpt-5.5:medium, openrouter/anthropic/claude-fable-5:low, openrouter/anthropic/claude-opus-4-8:medium, openrouter/x-ai/grok-4.5, openrouter/z-ai/glm-5.2:xhigh
 skills: tdd, playwright-cli, tmux
 ---