@bastani/atomic 0.9.19-alpha.1 → 0.9.19-alpha.11

package/docs/computer-use.md

@@ -0,0 +1,425 @@
+---
+title: "Computer use"
+description: "Use desktop apps, browsers, and terminals with Atomic on macOS, Linux, and Windows."
+---
+
+# Computer use
+
+Atomic can work in applications, not just edit code. Computer-use automation, or CUA, can create a Blender scene, build a presentation, edit a video, operate a desktop app, or move work between applications. Browser and terminal automation cover related tasks with more direct controls.
+
+This guide explains tool selection, setup, and safe operation. To test a software change and attach the results to a PR, see [Verification and evidence](/workflows/verification).
+
+Jump to [application scripting](#application-scripting-and-apis), [desktop CUA](#desktop-automation-with-pyautogui-and-uv), [browser automation](#browser-automation-with-playwright-cli), [terminal automation](#terminal-automation-with-herdr), or [creative workflows](#creative-work-and-cua-workflows). Platform setup: [macOS](#macos), [Linux](#linux), [Windows](#windows).
+
+## Choose the right tool
+
+Start with the result you need, not the application you could click through. If a library, CLI, or supported API can produce that result directly, a short script is often simpler and more token-efficient than repeated screenshots and UI actions. Use computer use when the task needs visual judgment, a UI-only operation, or verification of the interface itself. Saving tokens is useful, but not at the expense of the requested behavior or output quality.
+
+| Task | Preferred tool | When to use something else |
+| --- | --- | --- |
+| Create or edit files, such as presentations, documents, spreadsheets, or media | **A file library or CLI** | Use an app API or UI when the library cannot preserve required features, or when you need rendering or visual adjustments. |
+| Interactive terminal or TUI | **Herdr** | Use tmux on macOS/Linux or native Windows psmux when Herdr cannot be used. Ordinary shell commands need no multiplexer. |
+| Browser page or web application | **playwright-cli** | Use desktop CUA for browser chrome or OS dialogs that browser automation cannot reach. Keep existing Playwright test suites for repeatable tests. |
+| Desktop application or work across apps | **PyAutoGUI, run with uv** | Use native accessibility tools, application scripting, or a CLI when they make the task easier, safer, or more reliable. |
+
+You can combine tools without driving the whole task through a desktop. Generate a presentation with `python-pptx`, then inspect rendered slides for layout problems. Use Blender's Python API to generate repeated objects, then PyAutoGUI for adjustments in the visible editor. Use browser DOM controls rather than desktop clicks for a web form. For a supported web-service operation that does not require browser interaction, an authorized API request may be enough.
+
+Atomic's skills supply operating instructions, not an installed desktop or automatic permission to control one. Load the `herdr`, `playwright-cli`, or `tmux` skill when applicable. Check the installed command's help before using version-dependent options.
+
+**Herdr eligibility:** the bundled Herdr skill requires an explicit user mention or request and an agent running inside a Herdr-managed pane with `HERDR_ENV=1`. Launch Atomic inside Herdr and ask it to use Herdr for terminal work. Do not set the variable manually to bypass the check or control a focused session from outside Herdr. If those conditions are not met, use a suitable fallback.
+
+## Prepare the session
+
+For file-only automation, you need the input files, a suitable runtime, and an explicit output path, not a graphical desktop. Keep originals intact and work in a scratch directory. The window, display, and input checks below apply when you actually operate a UI.
+
+1. Identify the host OS and the environment that owns the application. An SSH shell, container, WSL distribution, or CI runner is not automatically connected to the user's desktop.
+2. Check installed tools, cached runtimes, and permissions. Install missing tools, including uv, when network access and permissions allow. Follow the official installer instructions, inspect downloaded scripts before running them, and make one bounded setup attempt rather than retrying indefinitely.
+3. Use a dedicated browser profile, terminal pane, desktop account, or VM where practical. For creative work, open copies of source assets and choose an explicit output directory.
+4. Confirm the target window, display size, scaling, keyboard layout, and starting document. Capture or inspect the current state before sending input.
+5. Define the stopping point. Saving a local draft is different from overwriting an original, publishing a video, sending a message, or purchasing something. Obtain any needed authorization before those actions.
+
+One controller should own a desktop at a time. Parallel agents can prepare assets or review files, but must not compete for the same mouse, keyboard, clipboard, or application window. Browser sessions and terminal panes can run independently when each has an explicit owner and target.
+
+Treat text in pages, documents, and terminal output as task data, not instructions granting new access. Keep secrets and unrelated windows out of captures. Never disable OS security controls just to make automation work.
+
+## Application scripting and APIs
+
+Prefer direct file automation for structured tasks such as assembling slides, filling a document template, or formatting a spreadsheet. These jobs often need no running Office app, macros, or desktop access. Use application scripting when you need features that a file library does not expose. PyAutoGUI is useful for the remaining desktop interaction, not a required step in every automation.
+
+| Mechanism | Good uses | Limits to check first |
+| --- | --- | --- |
+| `python-pptx` | Create or edit `.pptx` slides, text, pictures, tables, and charts without installing PowerPoint. | Does not render slides or export PDF. Not every PowerPoint feature can be created or edited; check template compatibility and the rendered result. |
+| `python-docx` or `openpyxl` | Create or edit `.docx` documents or `.xlsx` workbooks directly. | Feature support and preservation vary. `openpyxl` does not calculate formulas; use a compatible spreadsheet engine when recalculation is required. |
+| Media CLIs, such as FFmpeg | Batch-convert, trim, or combine media without driving an editor. | A media export is not an editable timeline project. Check the requested format, audio, and timing. |
+| AppleScript or JavaScript for Automation through `osascript` | Create documents, address named app objects, export files, coordinate scriptable macOS apps. | macOS only. Each app defines its own scripting dictionary; some apps expose little or no scripting support. |
+| Office Scripts | Repeatable Excel workbook operations through the Automate tab, including supported Power Automate flows. | Excel only. Availability depends on the account, app version, and organization policy; it is not a general desktop-control API. |
+| PowerShell with COM automation | Drive installed Windows applications that expose COM, including desktop Office. | Windows-specific. Do not assume unattended service execution is supported or reuse the user's active app instance without permission. |
+| VBA in desktop Excel, Word, or PowerPoint | Format ranges, update charts, assemble slides, or automate document operations through Office's object models. | Requires a supporting desktop Office app and permitted macros. Windows and Mac APIs differ; VBA does not run in Office on the web. |
+| Application APIs, such as Blender's Python API | Generate geometry, set scene properties, apply repeated edits, and render or export. | Use the API and runtime for the installed app version. Some operations depend on an active document, selection, or editor context. |
+
+Before writing a script, identify the input format, required features, output path, and library or app version. Read the relevant API reference rather than guessing methods. Start with a read-only query or a disposable copy. Save to a new path and reopen the result to check its contents; use a compatible viewer or renderer when appearance matters. Scripts still need the same authorization as UI actions to overwrite, upload, or publish files.
+
+For scripts that operate an application, also keep these application-specific checks:
+
+Before writing a script, identify the target app/version, input document, object names, and output path. Read the application's API reference or scripting dictionary rather than guessing methods. Start with a read-only query or a disposable copy, and keep a record of which operations changed the document.
+
+### macOS recipe: create a draft with osascript
+
+Open Script Editor and choose File > Open Dictionary to inspect an application's supported commands, objects, and properties. Apple's [scripting terminology guide](https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/AboutScriptingTerminology.html) explains how to read the dictionary. App scripting addresses document objects directly; `System Events` UI scripting instead drives accessible interface controls and needs Accessibility permission.
+
+Save this as `create-note.applescript`:
+
+```applescript
+on run argv
+    if (count of argv) is not 1 then error "Pass the draft text as one argument."
+    set draftText to item 1 of argv
+    tell application "TextEdit"
+        set draft to make new document with properties {text:draftText}
+        activate
+        return (text of draft) as text
+    end tell
+end run
+```
+
+Run it from a macOS shell:
+
+```sh
+osascript create-note.applescript "Draft outline for the presentation"
+```
+
+This creates a new, unsaved TextEdit document and returns its text to the shell. It does not overwrite a file. Check the returned text and inspect the document, then save to an agreed destination if required. macOS may ask permission for the launching app to control TextEdit; let the user grant it.
+
+Pass content as arguments rather than interpolating it into executable script text. For longer content, have the script read an explicit input file. JavaScript for Automation is another macOS option, invoked with `osascript -l JavaScript script.js`; it uses Apple's automation objects, not a browser DOM or Node.js APIs. Use whichever language fits the app's documentation and existing scripts.
+
+### PowerPoint recipe: create a draft with python-pptx
+
+Use [python-pptx](https://python-pptx.readthedocs.io/en/latest/user/quickstart.html) to assemble a `.pptx` directly instead of creating slides through desktop clicks or VBA. It runs on macOS, Linux, and Windows without PowerPoint or a graphical session.
+
+Save this as `create_deck.py` in a scratch directory:
+
+```python
+from pathlib import Path
+
+from pptx import Presentation
+
+deck = Presentation()
+title_slide = deck.slides.add_slide(deck.slide_layouts[0])
+title_slide.shapes.title.text = "Quarterly review"
+title_slide.placeholders[1].text = "Draft for discussion"
+
+summary = deck.slides.add_slide(deck.slide_layouts[1])
+summary.shapes.title.text = "Next steps"
+body = summary.placeholders[1].text_frame
+body.text = "Review the results"
+body.add_paragraph().text = "Agree on next quarter's priorities"
+
+output = Path("quarterly-review-draft.pptx")
+with output.open("xb") as stream:
+    deck.save(stream)
+print(f"Created {output.resolve()}")
+```
+
+Run it from that directory with [uv](https://docs.astral.sh/uv/):
+
+```sh
+uv run --no-project --with python-pptx python create_deck.py
+```
+
+`--no-project` keeps this one-off task separate from an unrelated Python project. uv may download Python and dependencies on the first run. The script creates two slides and refuses to overwrite an existing output file. Choose a new filename for another draft.
+
+This example uses the layouts and placeholder IDs in the library's default template. For a branded deck, load a copy of your `.pptx` template with `Presentation("template.pptx")` and inspect its layouts and placeholders before adapting the script. Do not assume their indices match the default template. See [working with presentations](https://python-pptx.readthedocs.io/en/latest/user/presentations.html) and [using placeholders](https://python-pptx.readthedocs.io/en/latest/user/placeholders-using.html).
+
+Reopen the saved deck to check slide count and text. Then view it in PowerPoint, LibreOffice Impress, or another compatible renderer to check clipping, fonts, and layout. `python-pptx` does not render slides or export PDF; use a compatible application for those steps. A successful save is not a visual check. If no renderer is available, hand off the draft and state that its appearance remains unchecked.
+
+For similar file-based tasks, use [python-docx](https://python-docx.readthedocs.io/en/latest/) for Word documents or [openpyxl](https://openpyxl.readthedocs.io/en/stable/) for Excel workbooks. Check feature support before editing a complex existing file. Use an app's own API when a library cannot make the required change, rather than forcing a lossy conversion. If an approved task requires macros, inspect the code and follow the organization's macro policy; never weaken security settings to run it.
+
+### Office recipe: format an Excel report with VBA
+
+For a desktop workbook, use [VBA](https://learn.microsoft.com/en-us/office/vba/library-reference/concepts/getting-started-with-vba-in-office) to change specific ranges instead of sending a long sequence of clicks. Try this on a trusted copy of a workbook with a worksheet named `Summary` and a report in `A1:D20`:
+
+1. Save the copy as an Excel Macro-Enabled Workbook, `.xlsm`, if you want to retain the macro.
+2. Open Developer > Visual Basic. In the copied workbook's project, choose Insert > Module and paste the macro below. If Developer is hidden, enable that tab through Excel's ribbon settings.
+3. Review the code and run `FormatSummary` through Developer > Macros, subject to your organization's macro policy.
+4. Inspect the header, number formatting, and column widths. Save only the reviewed copy.
+
+```vb
+Option Explicit
+
+Sub FormatSummary()
+    Dim report As Worksheet
+    Set report = ThisWorkbook.Worksheets("Summary")
+
+    report.Range("A1:D1").Font.Bold = True
+    report.Range("B2:D20").NumberFormat = "#,##0.00"
+    report.Range("A1:D20").Columns.AutoFit
+End Sub
+```
+
+`ThisWorkbook` is the workbook containing the macro, not whichever workbook happens to be active. Put the macro in the copied report's project, not a personal macro workbook. The example changes formatting only and does not save automatically. Its operations are documented in the [Excel VBA reference](https://learn.microsoft.com/en-us/office/vba/api/overview/excel).
+
+For other jobs, address workbook, worksheet, slide, shape, or document objects explicitly. A recorded macro can help discover operations, but replace dependence on `Selection`, `ActiveSheet`, or `ActivePresentation` with references to the intended objects before reusing it. For presentations, use PowerPoint's object model rather than treating Excel VBA as a universal Office API.
+
+Never enable all macros, weaken Trust Center settings, or enable programmatic access to the VBA project just to inject code. If policy blocks the macro, use an approved mechanism or report the restriction. VBA in a document can access more than that document, so inspect unfamiliar macros before opening or running them. If a script changes application-wide settings such as events or alerts, restore their previous values on success and error; do not suppress prompts to force a save.
+
+VBA support in desktop Excel, Word, and PowerPoint includes macOS, but Windows COM, ActiveX, and Win32-dependent code is not portable. Consult Microsoft's [Office for Mac guidance](https://learn.microsoft.com/en-us/office/vba/api/overview/office-mac) for sandbox and file-access differences. Saving as `.xlsx` cannot retain VBA; choose the output format deliberately.
+
+### Office Scripts, app runtimes, and file tools
+
+For Excel on the web or a supported desktop installation with the Automate tab, consider Office Scripts. Record a small action or create a script there, then use the `ExcelScript` workbook API for repeatable edits. These TypeScript scripts are not VBA and do not run as ordinary Node.js scripts. Check [Office Scripts versus VBA](https://learn.microsoft.com/en-us/office/dev/scripts/resources/vba-differences) for platform, licensing, and API differences. Creating a Power Automate flow can introduce scheduled runs and cloud access; do so only when that automation is part of the request.
+
+Use an application's own scripting runtime when it supplies the API. For example, Blender scripts normally run through Blender's Python Console, Text Editor, or command line. A plain uv Python environment does not automatically have the running application's `bpy` module or scene. With Blender on PATH, an existing `input.blend`, and a reviewed `scene-script.py`, a batch invocation is:
+
+```sh
+blender --background input.blend --python-exit-code 1 --python scene-script.py
+```
+
+Argument order matters. This loads the scene before running the script, and `--python-exit-code 1` makes a script exception produce a nonzero process exit. The script must explicitly save or export any intended output to a new path; exiting successfully does not imply a saved scene. See the [Blender Python quickstart](https://docs.blender.org/api/current/info_quickstart.html) and [command-line reference](https://docs.blender.org/manual/en/latest/advanced/command_line/arguments.html). Use uv for external orchestration or file-processing scripts, and Blender's runtime for Blender operations.
+
+For file-only work, a library can avoid opening the application at all. Know what it preserves: [openpyxl does not calculate Excel formulas](https://openpyxl.readthedocs.io/en/stable/simple_formulae.html), and a deck created with [python-pptx](https://python-pptx.readthedocs.io/en/latest/) still needs a layout check for clipping, fonts, and missing media. For video, FFmpeg can handle batch transforms while an editor's own scripting API can retain timeline structure. Check installed API/version or edition limits before assuming an editor exposes scripting.
+
+Combine these approaches only where they help. Generate content with a script, inspect it in a viewer, and use CUA if it needs visual adjustments or UI-only export controls. You do not need a desktop interaction just to prove that a file script ran. If the task is specifically to verify a menu, dialog, or user flow, exercise that interface too; an API call is not proof that the GUI path works.
+
+## Desktop automation with PyAutoGUI and uv
+
+[PyAutoGUI](https://pyautogui.readthedocs.io/en/latest/) controls the real mouse and keyboard and captures screenshots. It does not understand the application by itself. Atomic must inspect the screen or another reliable state source between actions.
+
+Prefer [uv](https://docs.astral.sh/uv/) to manage Python and the script's dependencies. If `uv --version` fails because uv is missing, install it using the instructions for your OS below. An existing Python environment is a fallback when uv installation is blocked, not a reason to change an unrelated repository's dependencies.
+
+### Run an isolated script
+
+Save the following as `desktop_probe.py` in a scratch directory. It takes a screenshot and reports geometry without clicking or typing:
+
+```python
+from pathlib import Path
+
+import pyautogui as gui
+
+gui.FAILSAFE = True
+gui.PAUSE = 0.25
+
+output = Path("artifacts")
+output.mkdir(exist_ok=True)
+print(f"Screen: {gui.size()}; pointer: {gui.position()}")
+gui.screenshot().save(output / "desktop-before.png")
+```
+
+Run it from that directory:
+
+```sh
+uv run --no-project --with pyautogui --with pillow python desktop_probe.py
+```
+
+`--no-project` avoids discovering or syncing an unrelated Python project. uv can download a Python runtime and dependencies if needed, so this first run may require network access. OS screenshot and accessibility dependencies still need separate setup. For a reusable script, declare dependencies in [inline script metadata](https://docs.astral.sh/uv/guides/scripts/#declaring-script-dependencies), pin versions, and use uv's script locking support. Keep scratch environments and captures out of the application's repository unless they belong in the deliverable.
+
+Open the captured image and confirm it shows the intended desktop. A successful import is not proof that screenshots or input work. Test a harmless action in a disposable document before running a longer sequence.
+
+### Observe, act, and check
+
+- Use short action sequences. Inspect the result after opening a menu, changing focus, or switching applications.
+- Prefer named accessibility controls or application APIs where available. If using coordinates, derive them from the current screen rather than an old screenshot.
+- Keep the target on the primary monitor. PyAutoGUI's multi-monitor support is limited. Retina and DPI scaling can make screenshot pixels differ from input coordinates; compare screenshot dimensions with `gui.size()` before clicking.
+- `gui.write()` sends keystrokes to the focused window and is not a general Unicode text-insertion API. For non-ASCII content, prefer app scripting or a controlled clipboard paste. Clipboard contents may be sensitive, so preserve and restore them when appropriate.
+- For image matching, crop to the relevant region and use fixtures from the same theme and scaling. Handle a missing image as a failed observation, not a reason to click a default location. PyAutoGUI's `confidence` option requires OpenCV in the Python environment.
+- Wait for an observable result with a deadline. A fixed sleep alone does not prove a render, export, or save has finished.
+
+See PyAutoGUI's [keyboard controls](https://pyautogui.readthedocs.io/en/latest/keyboard.html), [mouse controls](https://pyautogui.readthedocs.io/en/latest/mouse.html), and [screenshot functions](https://pyautogui.readthedocs.io/en/latest/screenshot.html) for API details.
+
+### Stop and recover safely
+
+Keep `FAILSAFE` enabled and leave a pause between calls. Moving the pointer to a corner of the primary monitor causes a subsequent PyAutoGUI call to raise `FailSafeException`. Keep a separate way to interrupt the automation process available too.
+
+Prefer complete actions such as `press`, `hotkey`, and `click` over holding input across several steps. If a script must hold a key or mouse button, track what it holds and release it in cleanup. An interrupt or failsafe can itself prevent PyAutoGUI cleanup calls. Stop the script, check for held input, and release it manually or through a safe native mechanism before resuming. Do not disable the failsafe in order to keep clicking.
+
+After a timeout or interruption, inspect the current document and any output files. A save or export may have completed even if its acknowledgement was lost. Do not repeat destructive actions blindly.
+
+## Browser automation with playwright-cli
+
+For tasks that require browser interaction, prefer [playwright-cli](https://github.com/microsoft/playwright-cli) for websites and web apps on all three desktop platforms. Its snapshots expose page structure and element references, so automation can use actual controls rather than screen coordinates. For data retrieval or batch operations, consider a supported API first when it meets the request and you have permission to use it.
+
+### Setup and first session
+
+Load the `playwright-cli` skill and check `playwright-cli --help`. If the command is unavailable, check whether the project's installed Playwright exposes `npx --no-install playwright cli --help`. Otherwise install the CLI when permitted:
+
+```sh
+npm install -g @playwright/cli@latest
+playwright-cli --help
+```
+
+Use the installed CLI's browser setup guidance if a browser is missing. Do not add browser automation dependencies to an unrelated project just to run a one-off task.
+
+Create a uniquely named session, replacing `desktop-demo` if that name is already in use:
+
+```sh
+playwright-cli -s=desktop-demo open https://example.com --headed
+playwright-cli -s=desktop-demo snapshot
+playwright-cli -s=desktop-demo screenshot --filename=browser-before.png
+playwright-cli -s=desktop-demo close
+```
+
+For a real task, act between the snapshot and final capture. Read element references from the current snapshot, then use `click`, `fill`, `select`, or `press`. Do not reuse an example reference such as `e5` without discovering what it points to. Refresh the snapshot after navigation or substantial UI changes.
+
+### Best practices
+
+- Keep the same session name on every command. Close only sessions you created, not every browser on the machine.
+- Prefer a fresh profile. Attach to an existing personal browser only when authorized; stored sessions can expose private tabs and credentials.
+- Use headed mode for visual work. Headless mode can verify DOM behavior, but does not establish that desktop integration or native dialogs work.
+- Inspect visible results and relevant console/network output. Use semantic locators and assertions in a maintained Playwright test for repeatable regression coverage.
+- Use `upload` for supported file inputs rather than driving an OS file picker. Switch to CUA or native tooling only for UI outside the page, and then recheck focus before returning to browser control.
+- Treat cookies, saved authentication state, traces, and network logs as sensitive. Do not commit or attach a browser profile as evidence.
+- Browser mobile emulation tests a web viewport, not a native Android or iOS application.
+
+For verification captures and recordings, see [browser evidence](/workflows/verification#browser-changes).
+
+## Terminal automation with Herdr
+
+Prefer Herdr for interactive terminal work on macOS, Linux, and Windows, subject to the [eligibility requirements](#choose-the-right-tool). Use ordinary shell execution for builds, scripts, or commands that do not need interactive input. A long-running command alone is not a reason to add a multiplexer.
+
+### Setup and a dedicated pane
+
+Check `herdr --version` and `herdr --help`. Install missing Herdr using its [official installation guide](https://github.com/herdrdev/herdr/tree/v0.9.0#install) when permitted. macOS supports `brew install herdr`; macOS/Linux and Windows also have official shell and PowerShell installers. Inspect downloaded scripts before executing them.
+
+Once inside an eligible managed pane, check `herdr status` for client/server compatibility. Do not stop or replace an active server just to obtain a new feature. Atomic's automatic status reporting is documented separately in [Herdr integration](/herdr).
+
+Use the Herdr skill to discover the current pane and create a dedicated sibling without changing the user's focus. For example, in a POSIX shell inside Herdr:
+
+```sh
+herdr pane split --current --direction right --cwd "$PWD" --no-focus
+```
+
+Choose the split direction to suit the available space. Read the new pane ID from the creation response. In the commands below, replace `<pane-id>` with that returned ID and `<command>` with the intended command:
+
+```text
+herdr pane run <pane-id> "<command>"
+herdr pane wait-output <pane-id> --match "<expected output>" --timeout 10000
+herdr pane read <pane-id> --source visible
+```
+
+`pane run` sends text and Enter. `pane send-text` alone does not submit. `wait-output` can match text already on the screen, so use a fresh pane or a run-specific marker and inspect the result. The appearance of a marker is not a substitute for checking the command's exit status or the application's final state.
+
+For ordinary logs, `--source recent-unwrapped --lines 120` avoids soft-wrapped lines. For layout, inspect `visible` at the intended terminal dimensions. Alternate-screen content that has scrolled away may not be recoverable from host scrollback. Capture important states as they occur.
+
+### tmux and psmux fallbacks
+
+When Herdr is unavailable, cannot be installed, or has no eligible managed session, use tmux on macOS/Linux or [psmux](https://github.com/psmux/psmux) for native Windows terminals. Record the reason when it affects the requested coverage. Do not take over an unrelated pane to satisfy the preference.
+
+Load the tmux skill and check the installed help. tmux and psmux share familiar commands, but supported flags and behavior can differ. Herdr has a different CLI entirely.
+
+For tmux, create a dedicated session with a unique name, then discover its actual pane ID:
+
+```sh
+tmux new-session -d -s atomic-demo
+tmux list-panes -t atomic-demo -F '#{pane_id}'
+```
+
+Substitute the returned ID for `<pane-id>`:
+
+```text
+tmux send-keys -t <pane-id> -l -- "<command>"
+tmux send-keys -t <pane-id> Enter
+tmux capture-pane -p -t <pane-id>
+```
+
+Use literal text and a separate Enter to avoid interpreting arbitrary text as key names. On psmux, inspect `psmux list-panes` and use `psmux capture-pane -p -t <pane-id>` as documented in its [scripting guide](https://github.com/psmux/psmux/blob/master/docs/scripting.md). Discover IDs rather than assuming `%0` is your pane. Clean up only the session or pane created for the task. Never use a global server-kill command as routine cleanup.
+
+For modified-key setup in Atomic, see [tmux setup](/tmux). For behavioral checks and recordings, see [terminal evidence](/workflows/verification#terminal-changes).
+
+## macOS
+
+### Desktop and native tools
+
+- Install missing uv with `brew install uv` when Homebrew is available, or use the reviewed macOS installer from [uv installation](https://docs.astral.sh/uv/getting-started/installation/). Confirm `uv --version` in the launching shell.
+- Allow the application launching automation, such as Terminal or your IDE, in System Settings > Privacy & Security > Accessibility. Screenshot capture also needs Screen Recording permission, which may be labelled Screen & System Audio Recording on newer macOS versions. Relaunch the affected app if macOS requests it.
+- AppleScript automation may also prompt for Automation permission to control another app. Let the user grant permissions; do not script around consent dialogs.
+- PyAutoGUI depends on native Python bindings on macOS. If import or capture fails, check the installed release's [installation requirements](https://pyautogui.readthedocs.io/en/latest/install.html) before adding dependencies to the uv environment.
+- Check Retina scaling and keep the target on the primary display. A black or incomplete capture usually needs permission or display troubleshooting, not more clicks.
+
+Use `osascript` for AppleScript or JavaScript for Automation when an app's scripting dictionary exposes the operation you need. See [application scripting and recipes](#application-scripting-and-apis) for a runnable example and Office automation choices. `System Events` UI scripting and native accessibility APIs can address menus and controls more reliably than coordinates; consult Apple's [UI scripting guide](https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/AutomatetheUserInterface.html).
+
+`screencapture` is useful for native screenshots; Screenshot or QuickTime Player can record the screen or a selected area. Check permissions and the selected recording region before capture.
+
+### Browser and terminal
+
+playwright-cli uses its own browser session. WebKit coverage is not proof of every Safari-specific desktop behavior. Use an actual target browser when that distinction matters.
+
+Herdr is the first choice for interactive terminals when eligible. Homebrew provides Herdr and tmux. Preserve the shell, terminal dimensions, and keyboard behavior relevant to the task rather than silently changing them to make a scenario pass.
+
+## Linux
+
+### Desktop and native tools
+
+- Install missing uv through the [official Linux installer](https://docs.astral.sh/uv/getting-started/installation/) or an available distribution package. Review the installer before executing it, then confirm `uv --version`.
+- PyAutoGUI's Linux input backend uses X11. Run in an accessible graphical X11 session with the correct `DISPLAY` and authorization. Installing Python packages does not create a desktop session.
+- Check the distribution's screenshot and Python support packages. PyAutoGUI documents `scrot` and Python Tk/development packages for Linux; the required capture backend varies with the installed Pillow/PyScreeze versions. Use the distribution package manager with permission, not guessed cross-distribution commands.
+- A Wayland session is not equivalent to X11. XWayland does not grant access to every native Wayland app. Prefer compositor-supported capture/input tools, desktop portals, or native accessibility APIs when they support the operation. Do not weaken session security or claim PyAutoGUI has full Wayland support.
+- For unattended X11 work, a dedicated virtual display such as Xvfb can be useful. It does not prove behavior on a real Wayland desktop, GPU configuration, or physical display. Creative applications may require working graphics acceleration.
+
+[AT-SPI](https://gnome.pages.gitlab.gnome.org/at-spi2-core/) can expose named controls in accessible applications. `xdotool` and `wmctrl` can help with focus and window placement on X11; they are not general Wayland replacements. On Wayland, choose tools for the actual compositor and inspect their permission requirements. Use app APIs where custom canvases do not expose useful accessibility controls.
+
+For recordings, use a supported desktop recorder or OBS with the appropriate display or portal source. Confirm the saved file contains the intended window, not a blank capture.
+
+### Browser and terminal
+
+playwright-cli may need browser binaries and system libraries on a minimal Linux install. A headed browser needs a display. Headless browsing remains useful on SSH or CI hosts but does not grant desktop access.
+
+Herdr is preferred when eligible; tmux is a practical fallback on local or remote POSIX shells. An SSH terminal can run terminal scenarios without access to the remote desktop. Record which host owns the pane and application.
+
+## Windows
+
+### Desktop and native tools
+
+- Install missing uv with `winget install --id=astral-sh.uv -e` or use the reviewed PowerShell installer from [uv installation](https://docs.astral.sh/uv/getting-started/installation/). Open a new shell if PATH changed, then run `uv --version`.
+- Run PyAutoGUI and uv in the Windows graphical session that owns the app. Running them inside WSL does not automatically control native Windows windows.
+- Keep the session unlocked and available during automation. A disconnected or minimized Remote Desktop session can change rendering or input behavior; verify the actual remote-session setup before relying on it.
+- Use a consistent display scale and primary monitor. Check coordinates again after moving a window between displays with different DPI settings.
+- Standard-user automation cannot reliably drive elevated apps or the UAC secure desktop. Stop for the user or choose an authorized non-elevated path rather than escalating just to force input through.
+
+[Windows UI Automation](https://learn.microsoft.com/en-us/dotnet/framework/ui-automation/ui-automation-overview) exposes controls by name and automation ID. Tools such as [pywinauto](https://pywinauto.readthedocs.io/en/latest/) can be easier than pixel matching for accessible Windows apps. For structured document operations, start with [file libraries and app scripting](#application-scripting-and-apis). Use PyAutoGUI for the remaining visual interactions.
+
+Snipping Tool or OBS can capture desktop evidence. Check the selected window and saved recording before sharing it.
+
+### Browser and terminal
+
+Use native Windows playwright-cli when the task depends on Windows browsers, downloads, or desktop dialogs. Quote paths and URLs for the shell actually in use; do not paste POSIX shell syntax into PowerShell.
+
+Prefer native Herdr when eligible. In PowerShell, check `$env:HERDR_ENV -eq '1'`, use `(Get-Location).Path` for the working directory, and read pane IDs from CLI responses. If Herdr cannot be used, install psmux through its documented Windows installation options and inspect its help. WSL tmux is useful for Linux programs, but is not native Windows ConPTY coverage.
+
+See [Windows setup](/windows) for Atomic's shell requirements.
+
+## Creative work and CUA workflows
+
+Choose the deliverable first. A library or application API may produce it without computer use at all. Add visual interaction when it helps create or inspect the result.
+
+| Task | Practical approach | Useful deliverables |
+| --- | --- | --- |
+| Blender 3D modeling | Use Blender Python for repeatable geometry or scene setup; use PyAutoGUI for visible editor operations and visual inspection. | Editable `.blend` file, exported model if requested, preview render. |
+| Presentations | Generate structured slides with `python-pptx`, inspect them in a compatible viewer, and use CUA for visual refinements or slideshow interaction when needed. | Editable deck plus PDF or slide previews exported through a compatible application. |
+| Video editing | Use the editor's scripting API or media CLI for repetitive operations; use CUA to adjust the timeline, inspect transitions, and review playback. | Editable project, required source references, final export. |
+| Work across applications | Use native scripting for named windows and file operations; use PyAutoGUI where the task needs visual interaction. | Saved documents and a concise record of completed steps. |
+
+Do not substitute a screenshot for the editable project or final export the user requested. Reopen saved files, check missing assets and fonts, and inspect the actual export. For video, check audio and timing as well as a still frame. Keep originals intact and use explicit save paths. Rendering, uploading, or exporting through a paid service may need separate authorization.
+
+When the user specifically wants a CUA workflow, include PyAutoGUI in the stage that operates the desktop. For artifact-only requests, keep script-based work outside the desktop session and omit UI stages that add no useful operation or check. A desktop sequence is:
+
+1. Prepare assets and confirm the intended application, output formats, and permissions.
+2. Open the dedicated desktop and inspect its starting state.
+3. Create or edit with PyAutoGUI and suitable native/app APIs, saving checkpoints.
+4. Reopen and inspect the deliverables, then make bounded corrections if needed.
+5. Hand off local files. Publish or upload only to an authorized target.
+
+Pass scripts, project files, and artifact paths between stages rather than long click transcripts. Give one stage exclusive desktop ownership and use finite deadlines for renders and exports. Stop on unexpected dialogs, lost focus, missing permissions, or failed observations. On resume, inspect the app and files before repeating an action.
+
+See [workflow authoring](/workflows/authoring) for stages and human-input gates. Use durable `ctx.tool` calls for workflow-owned external operations, with finite timeouts and cancellation; model stages can use the appropriate automation tools to operate the app. If the user asks to work inline, keep the same safety and deliverable checks without creating a workflow.
+
+## Troubleshooting
+
+| Symptom | What to check |
+| --- | --- |
+| uv or another command is missing | Install it when permitted, refresh PATH, and check its version in the same shell that will launch automation. |
+| Black screenshot or no desktop | Check screen permissions, display/session ownership, X11 versus Wayland, and remote-session state. |
+| Input reaches the wrong app | Stop. Confirm focus, window identity, scaling, and that no other controller shares the desktop. |
+| Browser element reference no longer works | Take a fresh snapshot and locate the current control. |
+| Herdr binary exists but control is unavailable | Check explicit request, managed-pane context, and client/server compatibility. Use a fallback rather than replacing the server. |
+| Save/export timed out | Inspect the file and app state before retrying. Preserve partial output for diagnosis. |
+| Install or graphical access is blocked | Continue work that can be done safely with available APIs or shell tools, and state what remains unverified or unfinished. |
+
+A tool being unavailable is a reason to choose another supported mechanism or report a limitation, not to invent a successful interaction.

package/docs/containerization.md

@@ -6,11 +6,13 @@ There are two general options. You can either
 1. run the whole `atomic` process inside an isolated environment, or
 2. run `atomic` on the host and route tool execution into an isolated environment.
 
+Containerization is the outer boundary, not the only one. [Security](/security) covers the project-trust prompt that gates which project-scoped extensions, skills, and settings load in the first place; read it alongside this page when you are deciding what an untrusted repository is allowed to do.
+
 ## Choose a pattern
 
 | Pattern | What is isolated | Best for | Notes |
 | --- | --- | --- | --- |
-| Gondolin extension | Built-in tools and `!` commands | Local micro-VM isolation while keeping auth on host | See [`examples/extensions/gondolin/`](https://github.com/bastani-inc/atomic/tree/main/packages/coding-agent/examples/extensions/gondolin). |
+| Gondolin extension | Selected file tools, shell execution, and `!` commands | Local micro-VM tool routing while keeping auth on host | Other tools, including `search`, remain on the host. See [`examples/extensions/gondolin/`](https://github.com/bastani-inc/atomic/tree/main/packages/coding-agent/examples/extensions/gondolin). |
 | Plain Docker | Whole `atomic` process in a local container | Simple local isolation | Provider API keys enter the container. |
 | OpenShell | Whole `atomic` process in a policy-controlled sandbox | Local or remote managed sandbox | Requires an OpenShell gateway. |
 
@@ -19,14 +21,14 @@ Extensions run wherever the `atomic` process runs. If you run host `atomic` with
 ## Gondolin
 
 [Gondolin](https://github.com/earendil-works/gondolin) is a local Linux micro-VM.
-Use the [example extension](https://github.com/bastani-inc/atomic/tree/main/packages/coding-agent/examples/extensions/gondolin) when you want `atomic` on the host but all built-in tools routed into the VM.
+Use the [example extension](https://github.com/bastani-inc/atomic/tree/main/packages/coding-agent/examples/extensions/gondolin) when you want `atomic` on the host with selected file tools and shell execution routed into the VM. This is not isolation for the entire session.
 
 Setup:
 
 ```bash
 cp -R packages/coding-agent/examples/extensions/gondolin ~/.atomic/agent/extensions/gondolin
 cd ~/.atomic/agent/extensions/gondolin
-bun install --ignore-scripts
+npm ci --ignore-scripts
 ```
 
 Run from the project you want mounted:
@@ -36,11 +38,13 @@ cd /path/to/project
 atomic -e ~/.atomic/agent/extensions/gondolin
 ```
 
-The extension mounts the host cwd at `/workspace` in the VM and overrides `read`, `write`, `edit`, `bash`, `find`, and `search` so the default coding tools operate inside the VM.
+The extension mounts the host cwd at `/workspace` in the VM and overrides `read`, `write`, `edit`, `bash`, `find`, and `ls`.
 User `!` commands are routed into the VM, as well.
 File changes under `/workspace` write through to the host.
 
-Requirements: Bun for dependency installation, Node.js >= 23.6.0 for `@earendil-works/gondolin`, plus QEMU (requires installation through your package manager).
+`search` remains a host tool; it is not redirected into the VM. The removed `grep` tool is not registered. For guest-only content searches, use a shell command through the routed `bash` tool or `!` command. To expose only these routed tools, start with `atomic --tools read,write,edit,bash,find,ls -e ~/.atomic/agent/extensions/gondolin`; other loaded extensions can still supply host-side tools. Use whole-process isolation instead when host filesystem access must be prevented.
+
+Requirements: npm for dependency installation, Node.js >= 23.6.0 for `@earendil-works/gondolin`, plus QEMU (requires installation through your package manager).
 
 ## Plain Docker
 

package/docs/custom-provider/api-reference.md

@@ -0,0 +1,145 @@
+---
+title: Provider API reference
+description: Provider config and model definition contracts.
+---
+
+# Provider API reference
+
+## Config Reference
+
+```typescript
+interface ProviderConfig {
+  /** Display name for the provider in UI such as /login. */
+  name?: string;
+
+  /** API endpoint URL. Required when defining models. */
+  baseUrl?: string;
+
+  /** API key literal or config value (for env vars use "$ENV_VAR" or "${ENV_VAR}"). Required when defining models (unless oauth). */
+  apiKey?: string;
+
+  /** API type for streaming. Required at provider or model level when defining models. */
+  api?: Api;
+
+  /** Custom streaming implementation for non-standard APIs. */
+  streamSimple?: (
+    model: Model<Api>,
+    context: Context,
+    options?: SimpleStreamOptions
+  ) => AssistantMessageEventStream;
+
+  /** Custom headers to include in requests. Values use the same config-value syntax as apiKey. */
+  headers?: Record<string, string>;
+
+  /** If true, adds Authorization: Bearer header with the resolved API key. */
+  authHeader?: boolean;
+
+  /** Models to register. If provided, replaces all existing models for this provider. */
+  models?: ProviderModelConfig[];
+
+  /** OAuth provider for /login support. */
+  oauth?: {
+    name: string;
+    login(callbacks: OAuthLoginCallbacks, signal: AbortSignal): Promise<OAuthCredentials>;
+    refreshToken(credentials: OAuthCredentials, signal: AbortSignal | undefined): Promise<OAuthCredentials>;
+    getApiKey(credentials: OAuthCredentials): string;
+    modifyModels?(models: Model<Api>[], credentials: OAuthCredentials): Model<Api>[];
+  };
+}
+```
+
+## Model Definition Reference
+
+```typescript
+interface ProviderModelConfig {
+  /** Model ID (e.g., "claude-sonnet-4-5"). */
+  id: string;
+
+  /** Display name (e.g., "Claude Sonnet 4.5"). */
+  name: string;
+
+  /** API type override for this specific model. */
+  api?: Api;
+
+  /** API endpoint URL override for this specific model. */
+  baseUrl?: string;
+
+  /** Whether the model supports extended thinking. */
+  reasoning: boolean;
+
+  /** Maps Atomic thinking levels to provider/model-specific values; null marks a level unsupported. */
+  thinkingLevelMap?: Partial<Record<"off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max", string | null>>;
+
+  /** Supported input types. */
+  input: ("text" | "image")[];
+
+  /** Base cost per million tokens plus optional request-wide long-context tiers. */
+  cost: {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+    tiers?: Array<{
+      /** Tier applies only when input + cacheRead + cacheWrite strictly exceeds this value. */
+      inputTokensAbove: number;
+      input: number;
+      output: number;
+      cacheRead: number;
+      cacheWrite: number;
+    }>;
+  };
+
+  /** Default/effective context window size in tokens. */
+  contextWindow: number;
+
+  /** Maximum output tokens. */
+  maxTokens: number;
+  /** Default sampling parameters merged into OpenAI-compatible request bodies. */
+  samplingParams?: Record<string, unknown>;
+
+  /** Custom headers for this specific model. */
+  headers?: Record<string, string>;
+
+  /** API-specific provider compatibility settings. */
+  compat?: {
+    supportsStore?: boolean;
+    supportsDeveloperRole?: boolean;
+    supportsReasoningEffort?: boolean;
+    supportsUsageInStreaming?: boolean;
+    supportsFinishReason?: boolean;
+    supportsThinkingTokenBudget?: boolean;
+    supportsStrictMode?: boolean;
+    supportsOpenAIGrammarTools?: boolean;
+    /** Atomic alias for supportsOpenAIGrammarTools. */
+    supportsGrammarTools?: boolean;
+    maxTokensField?: "max_completion_tokens" | "max_tokens";
+    requiresToolResultName?: boolean;
+    requiresAssistantAfterToolResult?: boolean;
+    requiresThinkingAsText?: boolean;
+    requiresReasoningContentOnAssistantMessages?: boolean;
+    thinkingFormat?: "openai" | "openrouter" | "deepseek" | "together" | "baseten" | "zai" | "qwen" | "chat-template" | "qwen-chat-template" | "string-thinking" | "ant-ling";
+    supportsStrictTools?: boolean;
+    chatTemplateKwargs?: Record<string, string | number | boolean | null | { "$var": "thinking.enabled" | "thinking.effort" | "thinking.budget"; omitWhenOff?: boolean }>;
+    chatTemplateArgs?: Record<string, string | number | boolean | null | { "$var": "thinking.enabled" | "thinking.effort" | "thinking.budget"; omitWhenOff?: boolean }>;
+    thinkingTokenBudgetField?: "thinking_token_budget" | "thinking_budget" | "thinking_budget_tokens";
+    cacheControlFormat?: "anthropic";
+    sendSessionAffinityHeaders?: boolean;
+    sessionAffinityFormat?: "openai" | "openai-nosession" | "openrouter";
+    supportsLongCacheRetention?: boolean;
+    vllmPriority?: number;
+    supportsToolSearch?: boolean;
+    supportsMaxOutputTokens?: boolean;
+  };
+}
+```
+
+The `cost` shape is equivalent to `Model<Api>["cost"]`. Base rates and every tier are complete rate sets. When multiple thresholds match, `calculateCost()` uses the highest threshold and applies that tier to all four cost buckets for the request.
+
+`openrouter` sends `reasoning: { effort }`. `deepseek` sends `thinking: { type: "enabled" | "disabled" }` and `reasoning_effort` when enabled. `together` sends `reasoning: { enabled }` and also `reasoning_effort` when `supportsReasoningEffort` is enabled. `qwen` is for DashScope-style top-level `enable_thinking`. Use `qwen-chat-template` for local Qwen-compatible servers that read `chat_template_kwargs.enable_thinking` and need `preserve_thinking`. Use `chat-template` for configurable `chat_template_kwargs`, for example DeepSeek V3.x behind vLLM with `chatTemplateKwargs: { "thinking": { "$var": "thinking.enabled" } }`. Use `thinkingFormat: "baseten"` with `chatTemplateArgs` when the provider expects toggle values under `chat_template_args` and optionally supports top-level `reasoning_effort`.
+`thinkingTokenBudgetField` sends a clamped per-level thinking budget as a top-level request field (`thinking_token_budget` on vLLM, `thinking_budget` on Qwen/SGLang, `thinking_budget_tokens` on llama.cpp). `supportsThinkingTokenBudget: true` is an alias for the vLLM field name. Do not combine it with `reasoning_effort` on DashScope Qwen models.
+`vllmPriority` sends a top-level `priority` request field for `openai-completions` providers. Lower values are scheduled earlier and the vLLM server default is `0`, so it only takes effect when vLLM runs with `--scheduling-policy priority`. Set it on a background or batch model so its long prefills queue behind interactive sessions. Unset by default and never set on the generated catalog.
+`cacheControlFormat: "anthropic"` applies Anthropic-style `cache_control` markers to the system prompt, last tool definition, and last user, assistant, or tool-result text content.
+
+Capability flags are enforcement claims, not preferences. `supportsStrictMode` controls strict JSON-schema tools for OpenAI-compatible APIs; Anthropic/Bedrock use `supportsStrictTools`; `supportsOpenAIGrammarTools` controls OpenAI Lark/regex custom tools. Atomic also accepts `supportsGrammarTools` as a compatibility alias and synchronizes it to the canonical OpenAI name; when both disagree, the canonical field wins. Leave these fields unset/false unless the endpoint and selected model actually preserve and enforce the corresponding request shape. See [Extensions](/extensions/authoring#constrained-sampling) for exact `constrainedSampling` modes.
+
+For `openai-responses` providers, set `compat.sessionAffinityFormat` to `"openai"` for `session_id` plus `x-client-request-id`, `"openai-nosession"` to omit `session_id` while retaining `x-client-request-id`, or `"openrouter"` for `x-session-id`. Responses-compatible providers may also set `supportsToolSearch` when they support deferred tool loading. `supportsMaxOutputTokens` defaults to `true`; set it to `false` for OpenAI Responses-compatible gateways such as Codex-protocol proxies that reject `max_output_tokens` with a 400, and Atomic omits the parameter from those requests.