@bastani/atomic 0.9.19-alpha.8 → 0.9.19

package/CHANGELOG.md

@@ -2,6 +2,111 @@
 
 ## [Unreleased]
 
+## [0.9.19] - 2026-09-13
+
+Cumulative release of the `0.9.19-alpha.1` through `0.9.19-alpha.12` prereleases. Per-change details remain in the unchanged prerelease sections below.
+
+### Breaking Changes
+
+- Overwriting an existing file with `write` requires this session to have observed the exact content being replaced. Missing or stale observations return typed `FILE_MUTATION_CONFLICT` errors with requester identity and recovery guidance. Creating files and overwriting files the session has read, written or edited remain supported ([#2329](https://github.com/bastani-inc/atomic/issues/2329)).
+- `WriteOperations` requires `readFile`, returning `undefined` only for absence, and `writeFile` accepts optional `WriteFileOptions`. Custom/remote implementations supply reads for generated-file and observation checks; existing writers may ignore the options but lose exclusive-create semantics ([#2329](https://github.com/bastani-inc/atomic/issues/2329)).
+- Workflow controls use `/workflow pause`, `/workflow quit` and `/workflow resume`; lifecycle pause events use `action: "pause"`. The workflow tool supports run, stage and durable-tool pause targets.
+- Bundled subagent terminal control is now `kill`, not `interrupt`, including calls using `runId`. Killed children cannot resume; launch a fresh child for follow-up work.
+- Bundled `code_search` requires `repoName` in `owner/repo` format and uses DeepWiki MCP without an Exa fallback. `fetch_content` requires a nonempty `urls` array instead of singular `url`; update existing calls. `web_search` is unchanged.
+- Intercom removed model-facing `retryToken` fields and owns bounded reconnect retries. Explicit `replyTo` selectors reject invalid or stale threads rather than falling back; use `action: "pending"` to select an unresolved question.
+
+### Added
+
+- Added owner-bound background shell and agent tasks with one execution per admitted attempt, observation-only yielding, retained output/transcripts, owner-scoped cancellation and independent cleanup. SDK contexts expose trusted task adapters, snapshot subscriptions and replay-safe completion delivery ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Added per-call Bash/PowerShell foreground-first or background observation, `{ action: "wait", id, budgetMs }` for existing tasks, and `kill({ id })` for owned background shell tasks. Observation does not extend execution timeout or owner lifetime; unsupported background requests fail before execution.
+- Added shared `/tasks` inspection with a compact inline picker, fullscreen detail/transcript/input pages, paging, confirmed cancellation and stable selection. Main and attached stage chats show background counts below the composer and readable completion notifications.
+- Added a searchable `/agents` catalog with source grouping and configuration details.
+- Added supervised Windows ConPTY execution with Job Object containment before resume and confirmed cleanup, without an unsupervised fallback. The command SDK accepts direct-executable `shell: { program, args }` and `inheritEnv` controls.
+- Added workflow activity observers and typed lifecycle, activity, stage-completion and heartbeat hooks with ordered snapshots, bounded queues and reload-safe leases. The built-in Herdr reporter combines agent/task activity, workflow execution and approval waits, supports `herdr.enabled` opt-out, and reports parent session identity ([#2891](https://github.com/bastani-inc/atomic/issues/2891)).
+- Added `reason: "project_trust"` to UI prompt lifecycle events, including paired isolated-engine notifications, so integrations can observe trust decisions ([#2873](https://github.com/bastani-inc/atomic/issues/2873)).
+- Editable workflow-stage chats discover source-qualified skills and expand submissions once through stage admission. Graph cards show effective model/thinking identity, including fast suffixes and live fallbacks ([#1859](https://github.com/bastani-inc/atomic/pull/1859) by [@sina85](https://github.com/sina85)).
+- Added per-model compaction overrides for `reserveTokens` and `preserve_recent`, with non-negative safe-integer validation and fallback to ordinary settings/defaults across manual, automatic and post-tool compaction.
+- Extension widgets can opt into height-capped fullscreen viewports with local wheel scrolling, overflow-only scrollbars and scroll-position feedback. The workflow list uses local scrolling with configurable Alt+K/J shortcuts, labeled Option on macOS, while retaining Alt+PageUp/PageDown aliases and editor-binding precedence.
+
+### Changed
+
+- Built-in read, edit, write and shell tools prefer strict JSON-schema sampling where supported; other experimental hints remain opt-in.
+- Task receipts and details display resolved model/reasoning, grouped counts, themed status, recent activity, bounded previews and narrow-terminal layouts. Only active background work contributes to the footer; retained results remain in `/tasks`.
+- Native Windows owner-bound shell calls automatically yield after the owner's observation budget, normally ten seconds. PowerShell uses encoded transport; execution timeouts remain separate, and unsupported owned WSL bash stdin transport remains refused. Suspend opens a PowerShell subshell without freezing background tasks.
+- Guidance routes user questions through structured question tools when available, favors normal shell observation budgets over repeated short polls, and keeps blocking work local while overlapping independent delegation. Requests to work "quickly" select inline execution without hidden workflows or skipped validation.
+- Model-choice guidance consults eval documentation and Artificial Analysis; automation guidance uses PyAutoGUI for desktop, playwright-cli for browsers, and Herdr with supported fallbacks for terminals.
+- Open Claude Design starts with Fable 5.1 at medium, followed by Copilot Fable 5.1 and Astra at medium, with Fable-first OpenRouter fallbacks. Debugger uses Astra/Fable at medium and Sol at high; Goal/Ralph reviewers use Astra/Sol at high, and orchestration/research/design fallbacks use Fable at medium and Sol at high.
+- Intercom lists lead with exact session IDs and workflow paths. Sends and asks interrupt working recipients within the same task/generation, retaining ordered messages and completed side effects rather than restarting work.
+
+### Fixed
+
+- Restored offline embedded PostgreSQL discovery in compiled archives and all eight target-selected archive/npm runtimes, retaining scriptless installs and existing v18 clusters. Windows ARM64 still requires Windows 11 x64 emulation.
+- Embedded Postgres starts on Windows administrative accounts using restricted tokens while retaining exact-process shutdown. Early startup exit reports actual logs; Unicode environments, executable lookup, batch/explicit-command launchers and safe verbatim paths work without handle leaks or cross-process stream inheritance.
+- Rejected edits no longer authorize themselves on retry by recording a new snapshot tag. Drift, deletion, unreadable targets and permission changes return typed conflicts with exact requester identity and recovery guidance. Writes exclusively claim new paths, preserve observations after cancellation that follows a completed write, and retain standalone `local://` observations ([#2329](https://github.com/bastani-inc/atomic/issues/2329)).
+- Bounded noisy engine diagnostic history and routed stderr/MuPDF diagnostics through deferred, terminal-safe status output, preserving split Unicode and failure details without corrupting fullscreen or RPC JSON output ([#2964](https://github.com/bastani-inc/atomic/issues/2964)).
+- Fixed npm-installed task supervisor class initialization and missing upstream AI imports. First-load and Windows-reloaded TypeScript extensions share live host classes/singletons, including the upstream-compatible import, without losing dependency edits.
+- Workflow fallback releases failed-attempt Intercom ownership before replacement. Repeated nested workflow calls no longer collide during fallback ([#3020](https://github.com/bastani-inc/atomic/issues/3020)).
+- Foreground subagent waits yield to parent steering and Intercom messages without cancelling children. Parallel coordination preserves active/queued siblings, same-child messages precede completion, and queued-child cancellation cleans up unused worktrees and branches.
+- Task completion retries retain delivery identity without relaunching work, including restored outboxes, native shell settlement and `/tasks` cancellations. Foreground-only shells do not create duplicate background notifications or model turns.
+- Fixed yielded shell waits replaying the first output page, honored owner wait policies, disclosed retained output gaps, and bounded output pages to 1 MiB under a shared disk cap ([#2972](https://github.com/bastani-inc/atomic/pull/2972), [#2905](https://github.com/bastani-inc/atomic/pull/2905)).
+- Live transcripts stream updates without reopening, preserve historical paging and configured shortcuts, and reject stale task-detail results after selection changes. Long Windows transcripts reuse unchanged rendering to reduce CPU without dropping history.
+- Isolated sessions use the engine's task owner and inspector, with `/tasks` autocomplete and live metrics. Task rows reattach after transcript replacement, old owners clear on session switches, and inspection failures remain retryable instead of rejecting unhandled.
+- Stage pause cancels owned admitted/active tasks and waits for cleanup while preserving messages and sibling work; ordinary chat interruption leaves background tasks running. Explicit subagent kill and grouped cancellation outcomes remain consistent through parent-cancellation races.
+- Corrected SDK task Results, cursors, opaque leases, wait policies and cleanup races. Subscription disposal/overflow and throwing callbacks are contained; exact strings/numbers, bounded activity replay and protected settlement IDs survive native conversion, and NaN waits no longer panic ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Fixed macOS cleanup failing immediately on temporary unreaped process-group zombies while retaining bounded, confirmed cleanup.
+- Herdr registration survives reload and session replacement without stale runners or child shutdown clearing parent ownership. Failed identity reports retry, background tasks prevent false idle, output-cap continuations remain working, and settled workflow failures retain attention without a false active wait.
+- Navigation through `/tasks`, `/agents` and workflow graphs no longer creates false Herdr approval blocks. Answered prompts and acknowledged workflow blocks clear correctly even with slow observers; genuine pending approvals remain blocked.
+- Concurrent inline approvals retain the surviving prompt and input focus. Task navigation does not cancel queued questionnaires, isolated cancellation removes loading placeholders, and background counts coexist with questions and MCP context on narrow terminals.
+- Filled theme backgrounds survive nested resets and truncation, including completion cards. Workflow lists retain row caps and viewed-run anchors through clipping, live changes and resize.
+- Resume trust is prepared before disposing the outgoing session and retained on failed preflight. Startup and isolated trust waits reach eligible lifecycle observers without loading untrusted extensions or replaying dialogs ([#2873](https://github.com/bastani-inc/atomic/issues/2873)).
+- Internal-URL expansion rejects unsafe shell syntax while safely quoting bare resolved URLs; PowerShell apostrophes remain literal. Commands without resolved URLs are unchanged.
+- Intercom excludes non-agent routing/prompt/tool connections without hiding busy agents or invalidating connected aliases. Roster updates synchronize with broker acceptance; targeted replies keep exact correlation, and delivery retries preserve FIFO order without duplicate cards ([#2895](https://github.com/bastani-inc/atomic/pull/2895)).
+- Capped retry backoff with `retry.maxAgentDelayMs`, defaulting to 60 seconds, while preserving provider limits. Retry countdowns use Atomic's themed indicator ([#8826](https://github.com/earendil-works/pi/issues/8826)).
+- Fixed Anthropic object-union schemas and Grok acceptance of the bundled bash command/wait schema while local validation still rejects mixed inputs. Extension registration rejects missing or nonobject schema containers ([#2190](https://github.com/bastani-inc/atomic/pull/2190) by [@elefthei](https://github.com/elefthei), [#3031](https://github.com/bastani-inc/atomic/issues/3031), [#9300](https://github.com/earendil-works/pi/issues/9300)).
+- Updated patched Hono/js-yaml dependencies and provider SDKs; Google's consecutive tool-call limit returns an error. Extension model registries expose authenticated custom-provider streams, and Radius login chooses an available discovered model.
+- Settings writes preserve inherited `.pi` provenance, concurrent primary edits and explicit Atomic overrides instead of copying inherited values into `.atomic` ([#2299](https://github.com/bastani-inc/atomic/issues/2299)).
+- Direct steering/follow-up calls run extension input handlers before admission, preserving transformed text/images and RPC attribution. Tree navigation refuses active compaction/summarization without disturbing the current branch.
+- Stage skill autocomplete reuses shared attachment without repeated checkpoints, ended recoverable blocks resume rather than return snapshot-only success, and cancelled stage-chat pause avoids unhandled rejection.
+- Released unused alternate-folder Git watchers and timers without disturbing other chat footers ([#2926](https://github.com/bastani-inc/atomic/pull/2926)).
+- Restored the Gondolin example after legacy grep API removal, keeping search on the host and guest-only searches in the routed shell ([#2482](https://github.com/bastani-inc/atomic/pull/2482)).
+
+## [0.9.19-alpha.12] - 2026-09-13
+
+### Fixed
+
+- Grok accepts the bundled bash tool schema for command execution and task waits, while local validation still rejects mixed inputs ([#3031](https://github.com/bastani-inc/atomic/issues/3031)).
+
+## [0.9.19-alpha.11] - 2026-09-13
+
+### Fixed
+
+- Repeated nested `ctx.workflow()` invocations no longer collide on Intercom route ownership during model fallback.
+
+## [0.9.19-alpha.10] - 2026-09-13
+
+### Added
+
+- Extension widgets can opt into a height-capped fullscreen viewport with widget-local wheel scrolling, an overflow-only scrollbar, and scroll-position feedback in both in-process and isolated-engine sessions. Existing widgets retain their default behavior.
+- The main-chat workflow list supports local wheel scrolling with an overflow-only slim scrollbar and configurable Alt+K/J shortcuts, labeled Option on macOS. Alt+PageUp/PageDown remain aliases, configured editor bindings take precedence, and the list keeps its row cap and run anchors through clipping and resize.
+
+### Fixed
+
+- Workflow model fallback cleans up the failed attempt's Intercom ownership before registering its replacement, preventing duplicate live-stage ownership warnings without weakening route protections ([#3020](https://github.com/bastani-inc/atomic/issues/3020)).
+
+## [0.9.19-alpha.9] - 2026-09-12
+
+### Breaking Changes
+
+- Explicit Intercom `action: "reply"` selectors reject stale, unknown, empty, or sender-mismatched threads instead of falling back. Use `action: "pending"` and `replyTo: "<pending-ask-id>"` for unresolved questions.
+
+### Changed
+
+- Intercom agent lists put exact copyable session IDs and workflow paths first, with useful metadata and meaningful names secondary rather than redundant generated aliases.
+
+### Fixed
+
+- Intercom targeted replies now complete the requested ask when an unrelated message is active, rather than delivering a response with the wrong thread ID or refusing it.
+
 ## [0.9.19-alpha.7] - 2026-09-12
 
 ### Fixed

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.19] - 2026-09-13
+
+Cumulative release of the `0.9.19-alpha.2` through `0.9.19-alpha.9` prereleases. Per-change details remain in the unchanged prerelease sections below.
+
+### Breaking Changes
+
+- Removed the model-facing `retryToken` parameter and result field. Intercom owns bounded reconnect retries; each new tool call remains a distinct operation, including identical messages.
+- Explicit `replyTo` selectors reject stale, unknown, empty or sender-mismatched threads instead of falling back. Use `pending` to select the exact unresolved question.
+
+### Changed
+
+- Agent lists lead with copyable full session IDs and canonical workflow paths, followed by meaningful names, status, working directory and future queued counts. Live/terminal reply capability is separate from idle activity; closed workflow generations report post-mortem-only or unavailable routing.
+
+### Fixed
+
+- `send` and `ask` interrupt a working subagent or live workflow stage's current model call or cancellable tool and process messages in the same execution. Arrival order, persistence retries, duplicate suppression and exact reply correlation survive cancellation without replaying completed side effects.
+- Targeted replies complete the requested ask even when an unrelated message is active. Cancelled turns without a reply retain the pending ask's context.
+- Recoverable disconnects retry up to three times within one invocation with the same delivery identity. Cancellation stops retries; unresolved outcomes warn against automatic resending, and client retry state is released on exit.
+- Broker refusals reject outstanding registered-client requests with the actual reason instead of timing out or reporting a generic disconnect. Lazy initialization, relay and cleanup diagnostics use the owning interactive session's notifications rather than raw console output.
+- Recipient discovery excludes workflow routing/control connections and model-less prompt/tool nodes. Malformed purposes are rejected, legacy omitted purposes remain supported, and roster updates wait for broker processing. Same-name non-agent nodes do not hide genuine duplicate agents or invalidate connected aliases ([#2895](https://github.com/bastani-inc/atomic/pull/2895)).
+- Terminal noninteractive children reject asks promptly, including socket-write races. Retained connected workflow stages preserve reply correlation after leaving the active roster; closed stages without post-mortem routing return lifecycle guidance.
+- Busy noninteractive refusals return correlated delivery errors without starting another parent turn. Owner-bound completion waits for same-child messages in order, retries failed delivery, and never repeats task execution.
+- Parallel child-to-parent requests use correlated replies without ending siblings, preserving empty questions, omitted decision notes and ordered attachments. Sends and progress remain nonblocking; single-child claimed handoffs are unchanged.
+
+## [0.9.19-alpha.9] - 2026-09-12
+
+### Breaking Changes
+
+- Explicit `reply` selectors now fail closed: stale, unknown, empty, or sender-mismatched `replyTo` values no longer fall back to another active or pending thread. Use `pending` to select the exact unresolved question.
+
+### Changed
+
+- Agent-visible Intercom lists lead with copyable full session IDs and canonical workflow paths, keeping status, working directory, meaningful names, and future queued counts without redundant generated aliases.
+
+### Fixed
+
+- Targeted replies select the requested sender's pending ask even when an unrelated message triggered the current turn, so a delivered reply no longer leaves that ask waiting on the wrong thread.
+
 ## [0.9.19-alpha.6] - 2026-09-11
 
 ### Fixed

package/dist/builtin/intercom/README.md

@@ -57,7 +57,7 @@ A session becomes intercom-connected when all of these are true:
 
 The session list, ALT+M picker, and group counts include connected agent sessions only. Internal workflow routing/control connections, model-less `ctx.ui` prompts, and `ctx.tool` nodes are hidden and cannot receive ordinary messages, even by a known ID or through a supervisor route. This includes run-level prompts and retained completed synthetic prompt stages. An agent executing a tool, including `tool:workflow`, or awaiting human input remains visible and messageable.
 
-If a session is unnamed, intercom exposes a runtime-only fallback alias like `subagent-chat-1a2b3c4d-1111-4222-8333-123456789abc` so other sessions can still target it. That alias is not persisted as the session title, so resume pickers can keep showing the transcript snippet instead of a generic `session-...` name.
+Unnamed sessions retain a runtime-only alias such as `subagent-chat-1a2b3c4d-1111-4222-8333-123456789abc` for name lookup. Agent lists omit this redundant alias and lead with the copyable full session ID. Meaningful names remain secondary metadata; resume titles are unchanged.
 
 ## Quick Start
 
@@ -76,10 +76,10 @@ The agent can list sessions and send messages using the `intercom` tool. Tool ca
 ```typescript
 // List active sessions
 intercom({ action: "list" })
-// → **Current session:**
-// → • executor (20d43841-1111-4222-8333-123456789abc) — ~/projects/api (claude-sonnet-4) [self, idle]
-// → **Other sessions:**
-// → • research (6332faab-1111-4222-8333-123456789abc) — ~/projects/api (claude-sonnet-4) [same cwd, thinking]
+// → **Current session** (groups: default):
+// → - `20d43841-1111-4222-8333-123456789abc` [self, idle] ~/projects/api (claude-sonnet-4) name: executor
+// → **Other visible sessions and workflow stages:**
+// → - `6332faab-1111-4222-8333-123456789abc` [same cwd, thinking] ~/projects/api (claude-sonnet-4) name: research
 
 // Add a named membership (it is created if no session is there yet)
 intercom({ action: "join", group: "api-review" })
@@ -156,7 +156,7 @@ Verify they see each other from either session:
 
 ```typescript
 intercom({ action: "list" })
-// → • worker — ~/projects/api (claude-sonnet-4) [idle]
+// → - `6332faab-1111-4222-8333-123456789abc` [same cwd, idle] ~/projects/api (claude-sonnet-4) name: worker
 ```
 
 ### The Conversation
@@ -383,7 +383,7 @@ When multiple live agent stages share a name, `ask` refuses the ambiguous target
 
 **`ask`** — Sends a message and waits for a live recipient to reply (10-minute timeout). Invocation control supports a live ask into an owned isolated subgroup, and the exact broker-recorded reply resolves the waiting tool call at the asker without opening reverse or lateral group access. Ask to an uninitialized stage remains refused with `pending_stage_ask_unsupported`; use queued `send` instead, because holding a reply waiter until a stage eventually starts would be unbounded. A recipient disconnect after live delivery fails only that peer's exact wait promptly; the timeout remains the backstop while the recipient stays connected. Up to `maxPendingAsks` blocking asks (default: 6) may run concurrently, including same-target and mixed-target fan-out. Replies resolve by exact sender and message ID, so out-of-order replies cannot cross-settle another call. When capacity is full, new asks receive a structured refusal.
 
-**`reply`** — Replies to the current intercom-triggered message if there is one. Otherwise it falls back to the single unresolved inbound ask. If multiple asks are pending, pass an exact name/full session ID in `to`, or the listed message ID in `replyTo`; use `pending` to inspect them first. `replyTo` also disambiguates multiple asks from the same sender. Under the hood this is still a normal `send` with the exact `replyTo` value.
+**`reply`** without selectors replies to the current intercom-triggered message, or otherwise the single unresolved inbound ask. Explicit `to` selects a pending ask from that exact name/full session ID, even during another sender's turn. If that sender has multiple asks, use `pending` and pass the exact message ID as `replyTo`. Explicit `replyTo` selects only that pending ask or the exact active ordinary message; stale, unknown, or empty IDs fail instead of falling back. When both selectors are supplied, the sender must match the selected thread. A successful reply keeps that sender/thread pair across internal retries.
 
 **`pending`** — Lists unresolved inbound asks with sender, message ID, elapsed time, and a short preview. Useful when replying after the original triggered turn.
 

package/dist/builtin/intercom/broker/client.ts

@@ -38,6 +38,8 @@ export interface SendOptions {
   logicalTarget?: string;
   /** Public reply must use the broker's exact pending reverse question route. */
   requirePendingReply?: true;
+  /** An explicit reply selector must resolve to this frozen recipient, never a namesake. */
+  expectedRecipientId?: string;
   /** Broker-authorized identity for a canonical-path ask, delivered before its recipient can reply. */
   onReplyTarget?: (sessionId: string) => void;
 }
@@ -1004,6 +1006,7 @@ export class IntercomClient extends EventEmitter {
 			transportTarget: to,
 			logicalSignature: buildSendSignature(options.logicalTarget ?? to, options),
 			requirePendingReply: options.requirePendingReply ?? false,
+			...(options.expectedRecipientId === undefined ? {} : { expectedRecipientId: options.expectedRecipientId }),
 		});
 		acquired = this.pendingSends.acquire(messageId, pendingSignature, 10000);
     } catch (error) {
@@ -1028,6 +1031,7 @@ export class IntercomClient extends EventEmitter {
 			to,
 			...(options.logicalTarget === undefined ? {} : { logicalTarget: options.logicalTarget }),
 			...(options.requirePendingReply === undefined ? {} : { requirePendingReply: options.requirePendingReply }),
+			...(options.expectedRecipientId === undefined ? {} : { expectedRecipientId: options.expectedRecipientId }),
       ...(options.onReplyTarget === undefined ? {} : { resolveReplyTarget: true as const }),
 			message,
 			attemptId: acquired.attempt.attemptId,

package/dist/builtin/intercom/broker/send-handler.ts

@@ -143,6 +143,12 @@ export function handleBrokerSend(
     return;
   }
   const requirePendingReply = clientMessage.requirePendingReply === true;
+  const hasExpectedRecipientId = Object.prototype.hasOwnProperty.call(clientMessage, "expectedRecipientId");
+  if (hasExpectedRecipientId && (typeof clientMessage.expectedRecipientId !== "string" || !clientMessage.expectedRecipientId.trim())) {
+    write(socket, { type: "delivery_failed", messageId, attemptId, reason: "Invalid expectedRecipientId format" });
+    return;
+  }
+  const expectedRecipientId = hasExpectedRecipientId ? clientMessage.expectedRecipientId as string : undefined;
   if (Object.prototype.hasOwnProperty.call(clientMessage, "channel")) {
     write(socket, { type: "delivery_failed", messageId: message.id, attemptId, reason: "Invalid channel" });
     return;
@@ -152,6 +158,10 @@ export function handleBrokerSend(
     write(socket, { type: "delivery_failed", messageId, attemptId, reason: "Invalid requirePendingReply message" });
     return;
   }
+  if (expectedRecipientId !== undefined && (supervisorSend || message.replyTo === undefined || message.expectsReply === true)) {
+    write(socket, { type: "delivery_failed", messageId, attemptId, reason: "Invalid expectedRecipientId message" });
+    return;
+  }
 
 
   const fromSession = currentId ? sessions.get(currentId) : undefined;
@@ -161,7 +171,8 @@ export function handleBrokerSend(
   }
 	const senderIdentity = fromSession.registrationReturnAddress ?? fromSession.info.id;
 	const logicalTarget = typeof clientMessage.logicalTarget === "string" ? clientMessage.logicalTarget : clientMessage.to;
-	const baseSignature = buildMessageSendSignature(logicalTarget, message, senderIdentity);
+	const messageSignature = buildMessageSendSignature(logicalTarget, message, senderIdentity);
+	const baseSignature = expectedRecipientId === undefined ? messageSignature : JSON.stringify({ expectedRecipientId, messageSignature });
 	const signature = requirePendingReply
 		? JSON.stringify({
 				requirePendingReply: true,
@@ -221,6 +232,12 @@ export function handleBrokerSend(
   const resolution = exactIdTarget
     ? ({ kind: "resolved", session: exactIdTarget.info } as const)
     : resolveSessionTarget(candidates, trimmedTo);
+  if (expectedRecipientId !== undefined && (resolution.kind !== "resolved" || resolution.session.id !== expectedRecipientId)) {
+    write(socket, { type: "delivery_failed", messageId, attemptId,
+      reason: resolution.kind === "resolved" ? "Reply target does not match the expected recipient" : sessionTargetFailureReason(clientMessage.to, resolution),
+    });
+    return;
+  }
   if (resolution.kind === "resolved") {
     const target = sessions.get(resolution.session.id);
     if (!target) {

package/dist/builtin/intercom/index.bundle.mjs

@@ -1247,7 +1247,8 @@ var init_client = __esm(() => {
         const pendingSignature = JSON.stringify({
           transportTarget: to,
           logicalSignature: buildSendSignature(options.logicalTarget ?? to, options),
-          requirePendingReply: options.requirePendingReply ?? false
+          requirePendingReply: options.requirePendingReply ?? false,
+          ...options.expectedRecipientId === undefined ? {} : { expectedRecipientId: options.expectedRecipientId }
         });
         acquired = this.pendingSends.acquire(messageId, pendingSignature, 1e4);
       } catch (error) {
@@ -1273,6 +1274,7 @@ var init_client = __esm(() => {
           to,
           ...options.logicalTarget === undefined ? {} : { logicalTarget: options.logicalTarget },
           ...options.requirePendingReply === undefined ? {} : { requirePendingReply: options.requirePendingReply },
+          ...options.expectedRecipientId === undefined ? {} : { expectedRecipientId: options.expectedRecipientId },
           ...options.onReplyTarget === undefined ? {} : { resolveReplyTarget: true },
           message,
           attemptId: acquired.attempt.attemptId,
@@ -2008,22 +2010,22 @@ class ReplyTracker {
   }
   resolveReplyTarget(options, now = Date.now()) {
     this.pruneExpired(now);
-    if (options.replyTo) {
-      const exact = this.pendingAsks.get(options.replyTo);
-      if (exact) {
-        if (options.to) {
-          const resolution = resolveSessionTarget([exact.from], options.to);
-          if (resolution.kind !== "resolved")
-            throw new Error(`Pending ask "${options.replyTo}" is not from "${options.to}"`);
-        }
-        return exact;
+    if (options.replyTo !== undefined) {
+      const exact = this.pendingAsks.get(options.replyTo) ?? (this.currentTurnContext?.message.id === options.replyTo && !this.currentTurnContext.message.expectsReply ? this.currentTurnContext : undefined);
+      if (!exact)
+        throw new Error(`No reply context for "${options.replyTo}"`);
+      if (options.to !== undefined) {
+        const resolution = resolveSessionTarget([exact.from], options.to);
+        if (resolution.kind !== "resolved")
+          throw new Error(`Reply context "${options.replyTo}" is not from "${options.to}"`);
       }
+      return exact;
     }
-    if (this.currentTurnContext) {
+    if (options.to === undefined && this.currentTurnContext) {
       return this.currentTurnContext;
     }
     const pending = Array.from(this.pendingAsks.values());
-    if (options.to) {
+    if (options.to !== undefined) {
       const senders = [...new Map(pending.map((context) => [context.from.id, context.from])).values()];
       const resolution = resolveSessionTarget(senders, options.to);
       if (resolution.kind !== "resolved") {
@@ -2446,13 +2448,13 @@ function formatSessionLabel(session, duplicates) {
   return duplicates.has(session.name.toLowerCase()) ? `${session.name} (${session.id})` : session.name;
 }
 function formatSessionListRow(session, currentCwd, isSelf) {
-  const name = session.name || "Unnamed session";
+  const name = session.name && session.name !== session.id && session.name !== resolveIntercomPresenceName(undefined, session.id) ? ` name: ${session.name}` : "";
   const normalizedGroup = normalizeGroup(session.group);
   const groupTag = normalizedGroup !== DEFAULT_GROUP ? `group: ${normalizedGroup}` : undefined;
   const capabilityTag = session.replyCapability === undefined ? undefined : `replyCapability: ${session.replyCapability}`;
   const tags = [isSelf ? "self" : session.cwd === currentCwd ? "same cwd" : undefined, session.status, capabilityTag, groupTag].filter((tag) => Boolean(tag));
   const suffix = tags.length ? ` [${tags.join(", ")}]` : "";
-  return `• ${name} (${session.id}) — ${session.cwd} (${session.model})${suffix}`;
+  return `- \`${session.id}\`${suffix} ${session.cwd} (${session.model})${name}`;
 }
 function previewText(value, maxLength = 72) {
   if (typeof value !== "string") {
@@ -3192,10 +3194,10 @@ async function resolveReplySender(client, logicalTarget, sendTarget) {
   return { kind: "unresolved" };
 }
 function formatWorkflowStageRow(stage) {
-  return `- **${stage.stageName}** — workflow stage [${stage.lifecycle.toUpperCase()}] — target: \`${stage.target}\`${stage.sessionId === undefined ? "" : ` — intercom session: ${stage.sessionId}`}`;
+  return `- \`${stage.target}\` [${stage.lifecycle.toUpperCase()}] workflow stage: ${stage.stageName}${stage.sessionId === undefined ? "" : ` session: \`${stage.sessionId}\``}`;
 }
 function formatWorkflowFutureStageRow(stage) {
-  return `- future workflow stage \`${stage.target}\` — ${stage.queuedCount} queued message${stage.queuedCount === 1 ? "" : "s"}`;
+  return `- \`${stage.target}\` [future] ${stage.queuedCount} queued message${stage.queuedCount === 1 ? "" : "s"}`;
 }
 function registerIntercomTool(pi, deps) {
   const retryIdentities = new RetryIdentityReservations({ maxEntries: deps.retryIdentityMaxEntries });
@@ -3949,12 +3951,13 @@ ${replyText}${replyAttachments}` }],
                 messageId: replyMessageId,
                 logicalTarget: replyLogicalTarget,
                 ...route.expectsReply ? { requirePendingReply: true } : {},
+                ...to === undefined && replyTo === undefined ? {} : { expectedRecipientId: route.senderId },
                 text: message,
                 attachments,
                 replyTo: route.messageId
               });
               let result = await sendReply(replySendTo);
-              if (to === undefined && result.delivered === false && result.reasonCode === "session_not_found" && route.senderName !== undefined) {
+              if (to === undefined && replyTo === undefined && result.delivered === false && result.reasonCode === "session_not_found" && route.senderName !== undefined) {
                 result = await sendReply(route.senderName);
               }
               if (result.queued === true) {

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.19-alpha.8",
+  "version": "0.9.19",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/intercom/skills/intercom/SKILL.md

@@ -67,11 +67,11 @@ intercom({
 
 ### Pattern 2: Quick Status Check
 
-Before sending, verify who's connected. The full session ID printed by `list` is directly usable by `send`, `ask`, and targeted `reply`:
+Before sending, verify who's connected. Each list row leads with a copyable full session ID or canonical workflow path. Names are secondary; redundant generated aliases are omitted from the list but remain valid targets.
 
 ```typescript
 intercom({ action: "list" })
-// → • planner (6332faab-1111-4222-8333-123456789abc) — /workspace (model) [idle]
+// → - `6332faab-1111-4222-8333-123456789abc` [idle] /workspace (model) name: planner
 intercom({ action: "ask", to: "6332faab-1111-4222-8333-123456789abc", message: "Which option should I use?" })
 ```
 
@@ -128,7 +128,7 @@ intercom({ action: "pending" })
 intercom({ action: "reply", to: "planner", message: "Use exponential backoff starting at 100ms." })
 ```
 
-`reply` still preserves exact threading under the hood by sending the response with the original `replyTo` value.
+Explicit `to` selects that sender's pending ask even if another message triggered the current turn. Use `pending` and an exact `replyTo` when the sender has several asks. Stale, unknown, empty, or sender-mismatched explicit selectors fail without replying to another thread. Omit both selectors only when you intend to reply to the active message, or otherwise the single pending ask.
 
 ### Pattern 4: Broadcast to Multiple Workers
 

package/dist/builtin/intercom/types.ts

@@ -124,7 +124,7 @@ export type ClientMessage =
 	| { type: "join_group"; requestId: string; group: string }
 	| { type: "leave_group"; requestId: string; group?: string }
   | { type: "authorize_supervisor"; requestId: string; childName: string; capability?: string }
-  | { type: "send" | "supervisor_send"; to: string; logicalTarget?: string; requirePendingReply?: true; resolveReplyTarget?: true; message: Message; attemptId?: string }
+  | { type: "send" | "supervisor_send"; to: string; logicalTarget?: string; requirePendingReply?: true; expectedRecipientId?: string; resolveReplyTarget?: true; message: Message; attemptId?: string }
 	| {
 			type: "send_pending_stage_notification";
 			runId: string;

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.19] - 2026-09-13
+
+Cumulative release of the `0.9.19-alpha.2` prerelease. Per-change details remain in the unchanged prerelease section below.
+
+### Fixed
+
+- MCP call headers identify the server before results arrive, including pending direct tools and gateway calls with explicit or unambiguous targets.
+
 ## [0.9.19-alpha.2] - 2026-09-08
 
 ### Fixed

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.19-alpha.8",
+  "version": "0.9.19",
   "private": true,
   "description": "Atomic extension that adapts MCP (Model Context Protocol) servers into the coding agent. Fork of: https://github.com/nicobailon/pi-mcp-adapter",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 ## [Unreleased]
 
+## [0.9.19] - 2026-09-13
+
+Cumulative release of the `0.9.19-alpha.2` through `0.9.19-alpha.6` prereleases. Per-change details remain in the unchanged prerelease sections below.
+
+### Breaking Changes
+
+- Renamed terminal control action `interrupt` to `kill`, including calls using `runId`. Replace `subagent({ action: "interrupt", id })` with `subagent({ action: "kill", id })`. The old action is rejected; killed children cannot resume and follow-up work requires a fresh launch.
+
+### Added
+
+- Added a searchable `/agents` catalog grouped by source with model, tool, description and prompt details.
+- Added the builtin Herdr skill from upstream v0.9.0 with managed-pane safety checks and CLI guidance.
+
+### Changed
+
+- Session-bound launches return owner-bound task observations immediately by default. Explicit foreground observation and `action: "wait"` observe the same execution; yielding does not cancel children or consume additional execution slots ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Reduced default top-level parallel concurrency from 4 to 3. Explicit overrides remain honored; the per-parent native turn cap remains 4.
+- Launch receipts, compact themed status cards and task details show readable outcomes, activity, elapsed time, tool/token counts and resolved model/reasoning settings, retaining identity through fallback and completion. Live transcripts subscribe to session events.
+- Locator and pattern-finding agents use GPT-5.6 Luna at xhigh with Grok fallbacks at medium. Other agents explicitly select xhigh for OpenRouter Grok fallbacks. Debugger uses Astra and Fable at medium and Sol at high, preserving its fallback order.
+- Delegation guidance keeps immediately blocking work local unless specialist expertise, isolation or an explicit request warrants a child. Parents overlap independent work and wait on dependencies rather than poll. Requests to work "quickly" select inline execution without hidden workflows or skipped validation.
+
+### Fixed
+
+- Intercom sends and asks interrupt working children and handle input in the same execution, including startup, preflight and settlement races, without relaunching or losing messages. Explicit abort and owner cancellation remain terminal.
+- Parallel requests wait for correlated replies in the original requester without ending siblings or discarding queued work. Parent observation yielding does not change execution concurrency; exact group commits release foreground observations without replacing executions ([#2884](https://github.com/bastani-inc/atomic/pull/2884)).
+- Published terminal state before child disposal so completed children reject asks they cannot answer. Bound transcripts retain exact Intercom targets, and same-child messages precede completion delivery.
+- Fixed queued-child worktree and branch cleanup on cancellation or owner closure without removing live siblings' worktrees early.
+- Preserved explicit kill during capacity waiting and parent-cancellation races, including grouped Intercom status. Status and kill accept returned owner-bound task IDs.
+- Background cards display known model/reasoning settings at admission without guessing unresolved values. Browsing `/agents` is navigation and no longer reports a false approval or Herdr block.
+
 ## [0.9.19-alpha.6] - 2026-09-11
 
 ### Changed

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.19-alpha.8",
+  "version": "0.9.19",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/web-access/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.9.19] - 2026-09-13
+
+Cumulative release of the `0.9.19-alpha.6` through `0.9.19-alpha.9` prereleases. Per-change details remain in the unchanged prerelease sections below.
+
+### Breaking Changes
+
+- `fetch_content` requires a nonempty `urls` array of nonempty strings. Replace `{ url: "..." }` with `{ urls: ["..."] }`. Invalid shapes and unrecognized fields are rejected before fetching; `get_search_content` selectors are unchanged.
+- `code_search` requires `repoName` in `owner/repo` format alongside `query` and uses DeepWiki MCP for public-repository questions instead of Exa. Update query-only calls to include the repository. No API key is required and there is no Exa fallback; `maxTokens` remains a best-effort output bound and `web_search` is unchanged.
+
+### Fixed
+
+- Failed `fetch_content` batches show each URL's error and recovery steps. Retained partial content is labeled incomplete rather than absent.
+- Video frame options are ignored for non-video inputs, preventing video-only errors for webpages and mixed batches. Tool descriptions distinguish page fetching, video analysis and frame extraction.
+
+## [0.9.19-alpha.9] - 2026-09-12
+
+### Fixed
+
+- `fetch_content` ignores video frame options for non-video inputs, so webpages and mixed batches no longer fail with video-only errors. Tool and parameter descriptions now distinguish ordinary page fetching, video analysis, and frame extraction.
+
 ## [0.9.19-alpha.7] - 2026-09-12
 
 ### Fixed