@bastani/atomic 0.9.2 → 0.9.3-alpha.2

package/CHANGELOG.md

@@ -2,6 +2,72 @@
 
 ## [Unreleased]
 
+## [0.9.3-alpha.2] - 2026-06-27
+
+### Fixed
+
+- Fixed custom tool renderer disposal to honor renderer-owned cleanup callbacks, preventing stale animation registry entries after terminal workflow tool rows are finalized ([#1518](https://github.com/bastani-inc/atomic/issues/1518)).
+- Hardened session replay and LLM conversion so persisted context-compaction filters cannot leave orphaned `toolResult` messages after deleting their paired assistant `toolCall`, preventing GitHub Copilot Claude/Anthropic replay failures after repeated subagent runs ([#1527](https://github.com/bastani-inc/atomic/issues/1527)).
+
+## [0.9.3-alpha.1] - 2026-06-25
+
+### Breaking Changes
+
+- Replaced the previous exact-replacement `edit` input shape with the hashline-only `input` script schema; `path` + `edits[]` and top-level `oldText`/`newText` edit calls are no longer accepted ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Tightened the model-facing `read`, `find`, and `search` schemas to the new builtin contracts: `read` uses path selectors instead of `offset`/`limit`, `find` requires `paths`, and `search` accepts only `pattern`, `paths`, `i`, `case`, `gitignore`, and `skip` ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+
+### Added
+
+- Added one-time first-run onboarding that explains Atomic workflows, uses an onboarding editor placeholder, lets users opt into normal chat with `/chat`, preserves other slash commands, saves a pre-login pasted task in memory only, and hands the first ready ticket/spec/task to the normal coding-agent session with `goal`/`ralph` workflow-routing guidance.
+- Added first-run onboarding routing guidance that raises the parent session to high reasoning when supported, asks the coding agent to first make a text-only scope estimate from tickets/GitHub issues/specs, routes directly when the task is clearly tiny or small with high confidence, and only uses targeted read-only `codebase-locator`/`codebase-analyzer`/`codebase-pattern-finder` probing when referenced context must be read or scope is medium, large, unclear, risky, or not obviously tiny before choosing `goal` or `ralph`.
+- Excluded workflow-created (internal) sessions from the standard `/resume`, `atomic -r`, and `--continue` history by marking their `SessionHeader` with `internal: true` and optional `workflow: { runId, stageId, stageName }` linkage, while keeping them resumable via `/workflow resume`/`workflow({ action: "resume" })` and direct `--session <path>` access; added `includeInternal` opt-ins to `SessionManager.list`/`listAll`/`continueRecent`, a `markSessionInternal` method, robust full-line `readSessionHeader`, and regression tests ([#1504](https://github.com/bastani-inc/atomic/issues/1504)).
+- Added a first-class `search` built-in and exposed `find`/`search` in normal coding sessions ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Added hashline snapshot anchors across `read`, `search`, `write`, and successful `edit` results, plus hashline line-range/block/multi-section edit scripts with stale-tag safety checks and snapshot-based recovery for non-overlapping file drift, empty-replace validation, and fresh post-mutation tags for follow-up edits ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Added disabled-by-default `bashInterceptor.enabled` settings support with built-in shell anti-pattern rules, a `/settings` **Bash Interceptor** toggle, and optional `user_bash` extension routing, without changing the default local-execution behavior ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Added Rust-backed native PTY execution for `bash({ "pty": true })`, so local PTY calls run through `@bastani/atomic-natives` `PtySession` with real terminal semantics, streaming output, timeout, abort/kill, cwd, shell, and environment support ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Added native `glob`/`grep` bindings copied from oh-my-pi and wired `find`/`search` to use them when available, matching upstream hidden-file, `.gitignore`, node_modules, result-limit, context, truncation, and timeout behavior without shelling out to host tools ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+
+### Changed
+
+- Updated first-run `goal`/`ralph` workflow handoff guidance so new users see `/workflow status <id>` and `/workflow connect <id>` next steps with the run id, understand connect is where they can watch, attach, and steer, and know they can ask the current chat for status or steering at any point.
+- Removed the unused first-run onboarding scope-probe/routing-assessment subsystem and dead probe-only tests after normal-session prompt handoff became the active onboarding path.
+- Accounted for image content blocks in context-window token accounting and compaction thresholds: image tokens are now estimated through a single shared conservative estimate (1200 tokens per image) used consistently by both the heuristic context-estimate path and the transcript planner, so image-heavy conversations trigger compaction at the correct time. The deletion planner now reports image token share (`remainingImageTokens`, `imageBlockCount`, `imageTokenPercent`) via `context_compaction_budget` and is instructed to prefer deleting stale, superseded, or unrelated image content blocks when images dominate, while preserving task-relevant recent images and user text. Because Verbatim Compaction is deletion-only, compaction never reintroduces image payloads or generates image-bearing summaries ([#1500](https://github.com/bastani-inc/atomic/issues/1500)).
+- Made `context_compaction_budget` image statistics deletion-aware: the `remainingImageTokens`/`imageBlockCount`/`imageTokenPercent` fields are now recomputed from the live deletion-target set on every budget tool call, so they immediately reflect image blocks already deleted within the current compaction run instead of reporting frozen pre-deletion totals ([#1500](https://github.com/bastani-inc/atomic/issues/1500)).
+- Raised the bundled subagent and workflow-stage nesting budget to a hard maximum of five delegated levels, and documented the `0`-to-`5` recursion-guard range.
+- Extracted the schema-aware flattened-argument disambiguation into a shared canonical `unflattenArgumentsWithSchema` helper in `core/flattened-tool-arguments.ts` (exported from `@bastani/atomic`), now reused by both the GitHub Copilot Gemini per-tool normalization and the MCP `callTool` boundary so literal dotted argument keys are preserved unless the tool schema proves they are nested paths. A literal dotted top-level property (e.g. `filter.name`) is preserved verbatim even when the schema also defines a same-head container property (e.g. `filter`) (issue [#1496](https://github.com/bastani-inc/atomic/issues/1496)).
+
+### Fixed
+
+- Fixed extension loading in Windows package tests by lazy-initializing compiled-binary virtual modules, avoiding eager source-barrel resolution before Jiti aliases are installed.
+- Fixed the first-run onboarding input placeholder so it uses muted TUI text and still renders a visible cursor while empty, making the startup composer read as an editable field instead of static copy.
+- Fixed `@` file-reference autocomplete in the first-run onboarding editor before the asynchronous `fd` readiness check completes by falling back to the built-in synchronous path completer while preserving `@` prefixes and quoted paths.
+- Fixed workflow config/discovery isolation so `ATOMIC_CODING_AGENT_DIR` prevents home-global workflows from shadowing the bundled first-run onboarding `goal` and `ralph` targets.
+- Fixed first-run onboarding returning-user detection so existing Atomic users with prior changelog state are marked onboarded and do not see the first-run CTA/placeholder when upgrading to a build that includes onboarding, while auth-only fresh installs and unfinished onboarding sessions still see the first-run flow.
+- Fixed first-run onboarding so multiline absolute path seeds with `:line[:column]` plus notes are saved or handed off with the full original text instead of being mistaken for slash commands.
+- Fixed successful `/import <jsonl>` during first-run onboarding so the imported session exits onboarding UI/interception state instead of treating the next normal message as a fresh onboarding seed.
+- Fixed first-run onboarding so a task saved before the session is ready resumes after successful `/model` selection, including the context-window follow-up step when required.
+- Fixed `/new` during first-run onboarding so the replacement session remains in onboarding but drops any previously saved in-memory task seed instead of resuming stale work later.
+- Fixed `context_compaction_budget` `imageTokenPercent` denominator so image share is computed against the remaining (post-deletion) context total rather than the original pre-deletion total. The budget text said “of remaining context” but the value used the original transcript size; deleting non-image text now correctly increases the reported image share while deleting image blocks decreases it ([#1500](https://github.com/bastani-inc/atomic/issues/1500)).
+- Fixed delete-context pruning for old user-pasted image attachments: stale, non-recent user `image` content blocks can now be deleted while preserving user text, old image-only user entries can be deleted when another task-bearing entry remains, multi-image-only user matches are canonicalized to a safe entry deletion during `[image]` grep-delete batches, and recent user images remain protected ([#1500](https://github.com/bastani-inc/atomic/issues/1500)).
+- Fixed `find` and `search` glob entries in `paths`, restored `search.skip` file-page pagination for filesystem and resource-backed matches (including SQLite text primary keys with spaces), surfaced skip pagination hints across multiple pages when filesystem, archive, SQLite, internal, explicit-path, and ranged-selector search pages are full, avoided false continuation hints when later explicit targets do not match, kept `search` line-selector context inside the requested ranges for native and non-native fallback search, searched ranged single-file selectors without dropping matches beyond the internal raw grep cap while preserving backend regex semantics such as inline `(?i)`/`(?m)`/`(?x)`, normalized copied quoted/empty path inputs including `paths: []`, split delimiter-joined glob search/find/resource paths only after preserving exact filesystem paths with spaces or delimiter characters, awaited async internal-resource find resolvers and continued to fallback resolvers when earlier async resolvers returned `undefined`, resolved `local://`/router-backed find paths before filesystem normalization, preserved trailing slashes for directory find matches, stopped exact-file and exact-limit glob find hits from reporting false limit truncation while reporting real truncation when exact files fill the page before later targets, enforced custom find backend result limits without fabricating empty directory matches, made `find.timeout` return a partial timed-out result instead of accepting an ignored option, ensured custom find backends receive/enforce `hidden:false`, and ensured `gitignore:false` plus explicit `node_modules` globs include `node_modules` in native find/search scans ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Fixed copied hashline output passed to `write` by stripping `[PATH#TAG]` headers, directory banners, continuation/truncation footers, and `LINE:` prefixes only for known current-session snapshots, including bounded/truncated read and search snippets, while preserving literal hashline-looking user content and rejecting unknown/stale tags from other snapshot stores; successful hashline edits now return compact refreshed-anchor metadata instead of the full post-edit file, `insert tail` now appends exactly once for trailing-newline, no-final-newline, and empty files, line-anchored edits on empty hashline snapshots no longer silently no-op, and multi-file hashline edits preflight all stale tags before writing any file ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Fixed additional builtin parity gaps by removing the archive selector dependency on host `python3`, bounding oversized archive/internal/URL/SQLite/local-document reads like file reads while preserving oversized-read details for collapsed renderers, truncating resource-backed and SQLite search lines, aligning archive/internal/SQLite resource search regex semantics with filesystem search, avoiding inflation of unrelated zip members for selected reads/searches/writes, routing internal-resource selectors through a session router when available, preserving custom read/find backends that do not map to local files, filtering direct MCP tool allowlists that collide with the new builtin `search`, and expanding supported internal URLs in bash command/cwd/env inputs before execution ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Fixed read/write parity for URL/internal-resource line selectors, `:raw` URL bypasses, archive members named `raw`, `conflicts`, numeric/L-prefixed names, suffix-looking paths such as `raw:notes.txt`, and archive member `:raw`/`:conflicts` suffixes with or without line ranges, reference-context bounded ranges, raw multi-range sorting/merging, invalid open-ended `+` selectors, no-conflict sentinel output, read-registered `conflict://<id>` plus `conflict://*` splicing with `@ours`/`@theirs`/`@base` and fresh resolved-file snapshot headers, read-only conflict side scopes, generated-file overwrite protection, archive directory-write rejection, reader-style HTML/notebook extraction plus `markit-ai` document conversion for PDF/Office/RTF/EPUB formats, SQLite row/search/pagination/schema selectors, SQLite table `{}` default-value inserts, SQLite JSON5 object validation and query-param rejection for writes, JSON5 writes that preserve quoted hex-like strings, non-SQLite `.db` fallback, and conflict-only hashline line numbers; async bash job polling now surfaces stored execution errors, async and headless `pty:true` requests get a real PTY, PTY execution preserves configured shell argv/stdin transport and live writes instead of forcing a login shell, the bash interceptor now checks commands before configured prefixes are prepended, exact absolute `find` targets outside the workspace render as valid relative paths, native grep file searches emit callbacks, and native `find` bypasses stale scan caches after shell/external mutations ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Completed remaining oh-my-pi builtin parity for source-backed `local://` reads/searches/writes with filesystem hashline labels, richer `find`/`search` result details, streaming `find` progress updates, oh-my-pi-shaped `bash` async metadata, write `resolvedPath`/`madeExecutable`/SQLite source metadata, native in-memory resource search usage, expanded direct `grep` native options, reference-shaped edit success headers, `bash` leading-`cd` rewrite/interceptor ordering, and implicit `find` `**/*` directory patterns ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Aligned oh-my-pi SQLite/notebook/metadata parity: SQLite query default limit is 20 with a 500 cap, raw `?q=` rows cap at 1000, table lists cap at 500 and exclude `sqlite_%` system tables; `.ipynb` cells use 0-based `cell:N` IDs; resource-backed search honors `search.contextBefore`/`search.contextAfter` settings; and successful `read` results across filesystem, URL, SQLite, archive, internal-resource, document, and directory paths consistently return `details.meta.source`/`sourcePath` (plus truncation/limits where applicable), matching the referenced `details.meta` contract ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Tightened the final oh-my-pi builtin parity pass by restoring upstream output caps (3,000 shared read lines, 512-character search lines, 64 MiB archive members), preserving plain URL-read truncation metadata from the fetch pipeline, and aligning the oversized URL test expectation with oh-my-pi's truncating URL behavior ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Hardened oh-my-pi parity code paths flagged by GitHub code-quality and advanced-security review by replacing ambiguous regex parsing in `bash`, `edit`, `find`, read selectors, and HTML document extraction with linear parsers and by removing stale local analysis warnings ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Fixed compiled release binary builds by externalizing `mupdf` during Bun compilation so the `markit-ai` document reader can keep its runtime dependency with top-level await in copied `node_modules` instead of being inlined into the executable ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Hardened URL and `local://` resource reads/writes by blocking private/metadata URL fetch targets by default, revalidating manual redirects, and rejecting `local://` paths that escape the workspace root ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Addressed the PR review hardening pass for oh-my-pi parity: built-in bash interception now checks raw, expanded, prefix, and leading-`cd`-normalized commands; hashline edit batches route writes through the vendored patcher with duplicate canonical-path rejection and partial-write reporting; URL reads pin DNS-validated addresses and cap streamed bodies; async bash jobs support cancellation/eviction; native PTY cleanup joins reader threads; native worker panics and poisoned locks are converted to errors; and find/search/native cache paths received additional caps and nonblocking safeguards ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Closed the remaining oh-my-pi parity and PR review gaps for builtin tools: directory reads now use recency-sorted capped trees, comma/semicolon find/search path lists split when at least one path resolves, search pagination exposes `fileLimitReached` details, line-range search renders context around in-range matches, plain writes return compact fresh headers and note copied-hashline stripping, generated-file guards scan a larger header window, notebooks preserve unknown top-level fields, SQLite raw reads match oh-my-pi's readonly raw-query behavior, `bash` leading-`cd` handles `~`, async bash job timeouts render human-readable errors, native/fallback grep count and multiline behavior are aligned, macOS variant-resolved read snapshots can be edited, native Rust grep tests compile through an `rlib`, and selector/URL security hardening now rejects numeric private-IP URL forms plus archive/SQLite/skill/local symlink escapes ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Followed up on the post-push oh-my-pi audit by matching additional SQLite and discovery semantics: SQLite table listings now avoid full table-count scans with bounded row-count probes, raw `?q=` reads stop after 1000 rows while iterating, structured `where=` validation ignores quoted keywords but rejects control clauses such as `INTERSECT`, SQLite writes validate table columns and scalar values before binding, directory reads prune `.git`/`node_modules`, and broad `find` scans keep `node_modules` pruned even with `gitignore:false` unless explicitly requested ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Addressed the follow-up PR review by validating raw SQLite `?q=` selectors as single safe `SELECT` statements, rejecting raw access to `sqlite_%` internals and dangerous statements such as `ATTACH`, bounds-checking zip central-directory/local-entry offsets before reads or inflates, extending URL SSRF guards to NAT64/6to4 private-address forms and documenting `ATOMIC_ALLOW_PRIVATE_URL_READS` as dev-only, wrapping native block/PTY/Cursor HTTP2 entrypoints in panic guards, ensuring PTY error paths still clean up readers/children, documenting generated Rust split wrappers, bounding uncached native grep streaming accumulation, and correcting the direct-`grep` native-cache docs to match the fresh-by-default implementation ([#1483](https://github.com/bastani-inc/atomic/issues/1483)).
+- Fixed cross-platform package test execution by preparing native bindings and LFS fixtures in CI, running the coding-agent Vitest suite under Bun, making self-update/home-directory detection respect live Bun environments, and hardening Windows path/color/process-spawn test coverage ([#1490](https://github.com/bastani-inc/atomic/pull/1490)).
+- Addressed follow-up PR review findings by making hashline snapshot collision handling compare full snapshot text before treating 4-hex tags as identities, extending URL SSRF detection to the full IPv6 link-local `fe80::/10` range plus IPv4-compatible IPv6 forms, re-checking bash interceptor rules after `spawnHook` rewrites, surfacing search pagination collection caps without duplicate continuation banners, preserving truncated async bash output in a recoverable `fullOutputPath`, and passing per-path native search-cache invalidations through to the native binding ([#1490](https://github.com/bastani-inc/atomic/pull/1490)).
+- Addressed the latest PR review hardening pass by counting multi-file search per-file caps by match lines instead of context lines, making native filesystem scan cache insertion generation-aware so in-flight scans cannot repopulate after invalidation, rejecting SQLite raw-query `pragma_*` table-valued functions and double-quoted internal-name splices, and bounds-checking zip central-directory offsets during selective archive writes ([#1490](https://github.com/bastani-inc/atomic/pull/1490)).
+- Addressed the final PR review hardening pass by restoring header-only copied-hashline writes to their snapshot content instead of emptying files, decoding and sanitizing async bash output with a streaming UTF-8 decoder, cleaning up async bash temp output files on eviction/TTL, invalidating native search caches after bash commands, keeping URL protocol validation outside the private-read escape hatch, documenting single-file search skip handling, preserving CR-only hashline edit line endings, rejecting selective zip writes that would drop data descriptors, and exposing `search` in extension `tool_call`/`tool_result` type guards like other builtins ([#1490](https://github.com/bastani-inc/atomic/pull/1490)).
+
 ## [0.9.2] - 2026-06-23
 
 ### Changed

package/README.md

@@ -77,7 +77,7 @@ atomic
 /login  # Then select provider
 ```
 
-Then just talk to Atomic. By default, Atomic gives the model four tools: `read`, `write`, `edit`, and `bash`. The model uses these to fulfill your requests. Add capabilities via [skills](#skills), [prompt templates](#prompt-templates), [extensions](#extensions), or [Atomic packages](#atomic-packages).
+Then just talk to Atomic. By default, Atomic gives the model six coding tools: `read`, `write`, `edit`, `bash`, `find`, and `search`. The model uses these to fulfill your requests. `read`, `search`, `write`, and successful `edit` calls emit session-scoped hashline anchors (`[path#TAG]` plus `LINE:text`) so the model can make stale-safe line edits; see [docs/tools.md](docs/tools.md). Add capabilities via [skills](#skills), [prompt templates](#prompt-templates), [extensions](#extensions), or [Atomic packages](#atomic-packages).
 
 **Platform notes:** [Windows](docs/windows.md) | [Termux (Android)](docs/termux.md) | [tmux](docs/tmux.md) | [Terminal setup](docs/terminal-setup.md) | [Shell aliases](docs/shell-aliases.md)
 
@@ -543,7 +543,7 @@ cat README.md | atomic -p "Summarize this text"
 | `--no-builtin-tools`, `-nbt` | Disable built-in tools by default but keep extension/custom tools enabled |
 | `--no-tools`, `-nt` | Disable all tools by default |
 
-Default built-in tools: `read`, `bash`, `edit`, `write`, `ask_user_question`, `todo`. Additional built-in read-only tools are available through tool options: `grep`, `find`, `ls`. Use `--exclude-tools` to disable one or more tools while leaving the rest available.
+Default built-in tools: `read`, `bash`, `edit`, `write`, `find`, `search`, `ask_user_question`, `todo`. `find.paths` accepts directories, files, or glob paths such as `*.ts` and honors `timeout`; `search` accepts `pattern`, `paths`, `i`, `gitignore`, and `skip` for regex content-search pagination. `read`/`search`/`write`/`edit` share session-scoped hashline snapshot tags for stale-safe line edits; copied hashline output is stripped by `write` only when it matches a known current-session snapshot. Archive selectors are Bun-native, and internal-resource selectors use the session router when available. Use `--exclude-tools` to disable one or more tools while leaving the rest available.
 
 ### Project Trust Options
 

package/dist/builtin/cursor/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [0.9.3-alpha.2] - 2026-06-27
+
+### Added
+
+- Added scoped Cursor image-input support for known multimodal Claude, Composer, Gemini, GPT, and Kimi model families (`claude-`, `composer-`, `gemini-`, `gpt-`, `kimi-`), plus `cursor/grok-4.3`, including selected-image request serialization and mixed text/image MCP tool-result serialization.
+- Added `cursor/grok-4.3` to the estimated fallback catalog.
+
+### Fixed
+
+- Rejected empty or malformed base64 image payloads during Cursor selected-image and MCP image serialization with sanitized local errors, while accepting valid MIME-wrapped base64 with line whitespace.
+
+### Removed
+
+- Removed outdated Cursor Grok 4.20 entries from the estimated fallback catalog and no longer advertise Grok-family Cursor IDs as image-capable.
+
 ## [0.9.2] - 2026-06-23
 
 ### Changed

package/dist/builtin/cursor/README.md

@@ -12,7 +12,8 @@ The unavoidable Atomic-specific integration difference is the provider surface:
 
 ## Limitations
 
-- Text input only. Vision/image content is rejected.
+- Image input is supported only for known multimodal Cursor Claude, Composer, Gemini, GPT, and Kimi model families (IDs beginning `claude-`, `composer-`, `gemini-`, `gpt-`, or `kimi-`), plus `grok-4.3`; text-only Cursor models still reject images.
+- User images and mixed text/image MCP tool results are serialized for image-capable Cursor models. Image payloads must be non-empty standard base64; MIME-style line wrapping whitespace is accepted and stripped before serialization.
 - Cursor's private API may change without notice.
 - HTTP/2 transport requires the bundled `@bastani/atomic-natives` Rust/N-API native client for the current platform.
 - Credentials are OAuth-only. Do not pass Cursor tokens via command-line args, environment variables, logs, or local proxy processes.

package/dist/builtin/cursor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/cursor",
-  "version": "0.9.2",
+  "version": "0.9.3-alpha.2",
   "private": true,
   "description": "Experimental first-party Atomic extension for Cursor OAuth, model discovery, and streaming provider registration.",
   "contributors": [
@@ -40,7 +40,7 @@
     }
   },
   "dependencies": {
-    "@bastani/atomic-natives": "0.9.2",
+    "@bastani/atomic-natives": "0.9.3-alpha.2",
     "@bufbuild/protobuf": "^2.0.0"
   }
 }

package/dist/builtin/cursor/src/cursor-models-raw.json

@@ -560,15 +560,8 @@
     "maxTokens": 64000
   },
   {
-    "id": "grok-4-20",
-    "name": "Grok 4.20",
-    "reasoning": false,
-    "contextWindow": 200000,
-    "maxTokens": 64000
-  },
-  {
-    "id": "grok-4-20-thinking",
-    "name": "Grok 4.20 Thinking",
+    "id": "grok-4.3",
+    "name": "Grok 4.3",
     "reasoning": false,
     "contextWindow": 200000,
     "maxTokens": 64000

package/dist/builtin/cursor/src/model-mapper.ts

@@ -22,6 +22,8 @@ export interface CursorModelCatalog {
 	readonly models: readonly CursorUsableModel[];
 }
 
+export type CursorModelInput = ["text"] | ["text", "image"];
+
 export interface CursorProviderModelDefinition {
 	readonly id: string;
 	readonly name: string;
@@ -29,7 +31,7 @@ export interface CursorProviderModelDefinition {
 	readonly baseUrl?: string;
 	readonly reasoning: boolean;
 	readonly thinkingLevelMap?: ThinkingLevelMap;
-	readonly input: ["text"];
+	readonly input: CursorModelInput;
 	readonly cost: { readonly input: number; readonly output: number; readonly cacheRead: number; readonly cacheWrite: number };
 	readonly contextWindow: number;
 	readonly maxTokens: number;
@@ -95,7 +97,7 @@ export function mapCursorCatalogToProviderModels(catalog: CursorModelCatalog): C
 			baseUrl: CURSOR_API_BASE_URL,
 			reasoning: supportsReasoning,
 			thinkingLevelMap: supportsEffort ? buildThinkingLevelMap(effortVariants, group.primaryId) : undefined,
-			input: ["text"],
+			input: cursorModelInput(group.primaryId),
 			cost: subscriptionCost(),
 			contextWindow: chooseLargestNumber(group.variants.map((variant) => variant.contextWindow)) ?? ESTIMATED_CONTEXT_WINDOW,
 			maxTokens: chooseLargestNumber(group.variants.map((variant) => variant.maxTokens)) ?? ESTIMATED_MAX_TOKENS,
@@ -250,11 +252,20 @@ function chooseDisplayName(variants: readonly CursorVariant[], baseId: string, p
 		?? titleCaseModelId(baseId);
 }
 
+function cursorModelInput(id: string): CursorModelInput {
+	return supportsImageInputModelId(id) ? ["text", "image"] : ["text"];
+}
+
+function supportsImageInputModelId(id: string): boolean {
+	const variant = parseCursorVariant({ id });
+	return variant.baseId === "grok-4.3" || /^(claude|composer|gemini|gpt|kimi)(-|$)/iu.test(variant.baseId);
+}
+
 function supportsReasoningModelId(id: string): boolean {
 	const variant = parseCursorVariant({ id });
 	if (variant.effort || variant.thinking) return true;
 	if (variant.baseId === "default") return true;
-	return /^(claude|composer|gemini|gpt|grok|kimi)(-|$)/iu.test(variant.baseId);
+	return /^(claude|composer|gemini|gpt|kimi)(-|$)/iu.test(variant.baseId);
 }
 
 function titleCaseModelId(id: string): string {

package/dist/builtin/cursor/src/proto/protobuf-codec-base64.ts

@@ -0,0 +1,22 @@
+export interface CursorImageBase64Context {
+	readonly kind: string;
+	readonly mimeType: string;
+	readonly index?: number;
+}
+
+// Cursor image protobuf serialization accepts canonical standard base64 after MIME line wrapping is removed.
+const BASE64_WHITESPACE_PATTERN = /[\t\n\f\r ]+/gu;
+const STANDARD_BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;
+
+export function decodeStrictBase64ImageData(data: string, context: CursorImageBase64Context): Uint8Array {
+	const normalized = data.replace(BASE64_WHITESPACE_PATTERN, "");
+	if (normalized.length === 0 || normalized.length % 4 !== 0 || !STANDARD_BASE64_PATTERN.test(normalized)) {
+		throwInvalidBase64ImageData(context);
+	}
+	return Buffer.from(normalized, "base64");
+}
+
+function throwInvalidBase64ImageData(context: CursorImageBase64Context): never {
+	const index = context.index === undefined ? "" : ` at index ${context.index}`;
+	throw new Error(`Invalid ${context.kind} base64 image data${index} for MIME type ${context.mimeType}`);
+}

package/dist/builtin/cursor/src/proto/protobuf-codec-request.ts

@@ -1,7 +1,8 @@
 import { createHash, randomUUID } from "node:crypto";
 import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
+import type { ImageContent } from "@earendil-works/pi-ai";
 import { parseJsonObject, type JsonObject } from "../config.js";
-import type { CursorRunRequest } from "../transport.js";
+import type { CursorRunRequest, CursorToolResultContent } from "../transport.js";
 import {
 	AgentClientMessageSchema,
 	AgentConversationTurnStructureSchema,
@@ -16,14 +17,17 @@ import {
 	McpToolDefinitionSchema,
 	ModelDetailsSchema,
 	SelectedContextSchema,
+	SelectedImageSchema,
 	ToolCallSchema,
 	UserMessageActionSchema,
 	UserMessageSchema,
 	type ConversationStateStructure,
 	type McpToolDefinition,
+	type SelectedImage,
 	type UserMessage,
 } from "./agent_pb.js";
 import { encodeMcpArgsMap, encodeProtobufValue, serializableJsonValue } from "./protobuf-codec-json.js";
+import { decodeStrictBase64ImageData } from "./protobuf-codec-base64.js";
 import { createMcpToolCallResult } from "./protobuf-codec-wire.js";
 
 export interface ParsedAssistantTextStep {
@@ -36,13 +40,14 @@ export interface ParsedToolCallStep {
 	readonly toolCallId: string;
 	readonly toolName: string;
 	readonly arguments: JsonObject;
-	result?: { readonly content: string; readonly isError: boolean };
+	result?: { readonly content: string | readonly CursorToolResultContent[]; readonly isError: boolean; readonly fallbackText?: string };
 }
 
 export type ParsedTurnStep = ParsedAssistantTextStep | ParsedToolCallStep;
 
 export interface ParsedTurn {
 	readonly userText: string;
+	readonly userImages: readonly ImageContent[];
 	readonly steps: ParsedTurnStep[];
 }
 
@@ -69,6 +74,7 @@ export function buildCursorRequest(
 	conversationId: string,
 	checkpoint: Uint8Array | null,
 	existingBlobStore?: Map<string, Uint8Array>,
+	userImages: readonly ImageContent[] = [],
 ): { readonly requestBytes: Uint8Array; readonly blobStore: Map<string, Uint8Array> } {
 	const blobStore = new Map<string, Uint8Array>(existingBlobStore ?? []);
 	const systemBlobId = storeAsBlob(textEncoder.encode(JSON.stringify({ role: "system", content: systemPrompt })), blobStore);
@@ -76,7 +82,7 @@ export function buildCursorRequest(
 	const conversationState = checkpoint
 		? fromBinary(ConversationStateStructureSchema, checkpoint)
 		: buildConversationState(turns, blobStore, systemBlobId, selectedContextBlob);
-	const userMessage = createUserMessage(userText, selectedContextBlob);
+	const userMessage = createUserMessage(userText, selectedContextBlob, userImages);
 	const action = create(ConversationActionSchema, {
 		action: { case: "userMessageAction", value: create(UserMessageActionSchema, { userMessage }) },
 	});
@@ -96,7 +102,7 @@ function buildConversationState(
 ): ConversationStateStructure {
 	const turnBlobIds: Uint8Array[] = [];
 	for (const turn of turns) {
-		const userMessage = createUserMessage(turn.userText, selectedContextBlob);
+		const userMessage = createUserMessage(turn.userText, selectedContextBlob, turn.userImages);
 		const userMessageBlobId = storeAsBlob(toBinary(UserMessageSchema, userMessage), blobStore);
 		const stepBlobIds = turn.steps.map((step) => storeAsBlob(buildTurnStepBytes(step), blobStore));
 		const agentTurn = create(AgentConversationTurnStructureSchema, {
@@ -127,18 +133,39 @@ function buildConversationState(
 	});
 }
 
-function createUserMessage(text: string, selectedContextBlob: Uint8Array): UserMessage {
+function createUserMessage(text: string, selectedContextBlob: Uint8Array, images: readonly ImageContent[] = []): UserMessage {
 	const messageId = randomUUID();
+	const selectedImages = images.map((image, index) => createSelectedImage(image, index));
 	return create(UserMessageSchema, {
 		text,
 		messageId,
-		selectedContext: create(SelectedContextSchema, {}),
+		selectedContext: create(SelectedContextSchema, { selectedImages }),
 		mode: 1,
 		selectedContextBlob,
 		correlationId: messageId,
 	});
 }
 
+function createSelectedImage(image: ImageContent, index: number): SelectedImage {
+	const data = decodeStrictBase64ImageData(image.data, { kind: "selected image", mimeType: image.mimeType, index });
+	const hash = createHash("sha256").update(data).digest("hex").slice(0, 16);
+	return create(SelectedImageSchema, {
+		uuid: randomUUID(),
+		path: `/atomic/inline-images/${hash}-${index}.${extensionForMimeType(image.mimeType)}`,
+		mimeType: image.mimeType,
+		dataOrBlobId: { case: "data", value: data },
+	});
+}
+
+function extensionForMimeType(mimeType: string): string {
+	const normalized = mimeType.toLowerCase();
+	if (normalized === "image/jpeg" || normalized === "image/jpg") return "jpg";
+	if (normalized === "image/png") return "png";
+	if (normalized === "image/gif") return "gif";
+	if (normalized === "image/webp") return "webp";
+	return "img";
+}
+
 function buildTurnStepBytes(step: ParsedTurnStep): Uint8Array {
 	if (step.kind === "assistantText") {
 		return toBinary(ConversationStepSchema, create(ConversationStepSchema, {
@@ -154,7 +181,7 @@ function buildTurnStepBytes(step: ParsedTurnStep): Uint8Array {
 			providerIdentifier: CURSOR_PROTO_CLIENT_NAME,
 			toolName,
 		}),
-		...(step.result ? { result: createMcpToolCallResult(step.result.content, step.result.isError) } : {}),
+		...(step.result ? { result: createMcpToolCallResult(step.result.content, step.result.isError, step.result.fallbackText ?? "") } : {}),
 	});
 	return toBinary(ConversationStepSchema, create(ConversationStepSchema, {
 		message: {
@@ -166,20 +193,22 @@ function buildTurnStepBytes(step: ParsedTurnStep): Uint8Array {
 
 export function parseHistoricalTurns(messages: readonly CursorRunRequest["context"]["messages"][number][]): readonly ParsedTurn[] {
 	const turns: ParsedTurn[] = [];
-	let currentTurn: { userText: string; steps: ParsedTurnStep[]; toolCallById: Map<string, ParsedToolCallStep> } | undefined;
-	const ensureTurn = (): { userText: string; steps: ParsedTurnStep[]; toolCallById: Map<string, ParsedToolCallStep> } => {
-		currentTurn ??= { userText: "", steps: [], toolCallById: new Map() };
+	let currentTurn: { userText: string; userImages: readonly ImageContent[]; steps: ParsedTurnStep[]; toolCallById: Map<string, ParsedToolCallStep> } | undefined;
+	const ensureTurn = (): { userText: string; userImages: readonly ImageContent[]; steps: ParsedTurnStep[]; toolCallById: Map<string, ParsedToolCallStep> } => {
+		currentTurn ??= { userText: "", userImages: [], steps: [], toolCallById: new Map() };
 		return currentTurn;
 	};
 	const flushTurn = (): void => {
 		if (!currentTurn) return;
-		if (currentTurn.userText || currentTurn.steps.length > 0) turns.push({ userText: currentTurn.userText, steps: currentTurn.steps });
+		if (currentTurn.userText || currentTurn.userImages.length > 0 || currentTurn.steps.length > 0) {
+			turns.push({ userText: currentTurn.userText, userImages: currentTurn.userImages, steps: currentTurn.steps });
+		}
 		currentTurn = undefined;
 	};
 	for (const message of messages) {
 		if (message.role === "user") {
 			flushTurn();
-			currentTurn = { userText: textFromMessage(message), steps: [], toolCallById: new Map() };
+			currentTurn = { userText: textFromMessage(message), userImages: imagesFromUserMessage(message), steps: [], toolCallById: new Map() };
 		} else if (message.role === "assistant") {
 			const turn = ensureTurn();
 			for (const part of message.content) {
@@ -199,7 +228,7 @@ export function parseHistoricalTurns(messages: readonly CursorRunRequest["contex
 				turn.steps.push(step);
 				turn.toolCallById.set(step.toolCallId, step);
 			}
-			step.result = { content: rawToolResultText(message), isError: message.isError };
+			step.result = { content: message.content, isError: message.isError, fallbackText: rawToolResultText(message) };
 		}
 	}
 	flushTurn();
@@ -221,6 +250,17 @@ export function extractCurrentActionText(request: CursorRunRequest): string {
 	return last ? textFromMessage(last) : "";
 }
 
+export function extractCurrentActionImages(request: CursorRunRequest): readonly ImageContent[] {
+	const last = request.context.messages.at(-1);
+	if (!last || last.role !== "user") return [];
+	return imagesFromUserMessage(last);
+}
+
+function imagesFromUserMessage(message: Extract<CursorRunRequest["context"]["messages"][number], { readonly role: "user" }>): readonly ImageContent[] {
+	if (typeof message.content === "string") return [];
+	return message.content.filter((part): part is ImageContent => part.type === "image");
+}
+
 function rawToolResultText(message: Extract<CursorRunRequest["context"]["messages"][number], { readonly role: "toolResult" }>): string {
 	return message.content.flatMap((part) => part.type === "text" ? [part.text] : []).join("\n");
 }

package/dist/builtin/cursor/src/proto/protobuf-codec-wire.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { create, toBinary } from "@bufbuild/protobuf";
-import type { CursorControlMessage, CursorProtocolMessage, CursorServerMessage } from "../transport.js";
+import type { CursorControlMessage, CursorProtocolMessage, CursorServerMessage, CursorToolResultContent } from "../transport.js";
 import {
 	AgentClientMessageSchema,
 	BackgroundShellSpawnResultSchema,
@@ -17,6 +17,7 @@ import {
 	LsRejectedSchema,
 	LsResultSchema,
 	McpErrorSchema,
+	McpImageContentSchema,
 	McpResultSchema,
 	McpSuccessSchema,
 	McpTextContentSchema,
@@ -40,6 +41,7 @@ import {
 	type KvServerMessage,
 	type McpToolDefinition,
 } from "./agent_pb.js";
+import { decodeStrictBase64ImageData } from "./protobuf-codec-base64.js";
 import { decodeMcpArgsMap } from "./protobuf-codec-json.js";
 
 const NATIVE_EXEC_REJECT_REASON = "Tool not available in this environment. Use the MCP tools provided instead.";
@@ -203,29 +205,44 @@ export function encodeExecClientMessage(execNumericId: number | undefined, execI
 	return toBinary(AgentClientMessageSchema, clientMessage);
 }
 
-export function createMcpToolResult(text: string, isError: boolean): ReturnType<typeof create<typeof McpResultSchema>> {
+export function createMcpToolResult(content: string | readonly CursorToolResultContent[], isError: boolean, fallbackText = ""): ReturnType<typeof create<typeof McpResultSchema>> {
+	const text = typeof content === "string" ? content : fallbackText;
 	if (isError) {
 		return create(McpResultSchema, { result: { case: "error", value: create(McpErrorSchema, { error: text }) } });
 	}
 	return create(McpResultSchema, {
 		result: {
 			case: "success",
-			value: createMcpSuccess(text),
+			value: createMcpSuccess(content, fallbackText),
 		},
 	});
 }
 
-export function createMcpToolCallResult(text: string, isError: boolean): ReturnType<typeof create<typeof McpToolResultSchema>> {
+export function createMcpToolCallResult(content: string | readonly CursorToolResultContent[], isError: boolean, fallbackText = ""): ReturnType<typeof create<typeof McpToolResultSchema>> {
+	const text = typeof content === "string" ? content : fallbackText;
 	if (isError) {
 		return create(McpToolResultSchema, { result: { case: "error", value: create(McpToolErrorSchema, { error: text }) } });
 	}
-	return create(McpToolResultSchema, { result: { case: "success", value: createMcpSuccess(text) } });
+	return create(McpToolResultSchema, { result: { case: "success", value: createMcpSuccess(content, fallbackText) } });
 }
 
-function createMcpSuccess(text: string): ReturnType<typeof create<typeof McpSuccessSchema>> {
+function createMcpSuccess(content: string | readonly CursorToolResultContent[], fallbackText: string): ReturnType<typeof create<typeof McpSuccessSchema>> {
+	const items = typeof content === "string"
+		? [createTextContentItem(content)]
+		: content.map((part, index) => part.type === "text" ? createTextContentItem(part.text) : createImageContentItem(part.data, part.mimeType, index));
 	return create(McpSuccessSchema, {
-		content: [create(McpToolResultContentItemSchema, { content: { case: "text", value: create(McpTextContentSchema, { text }) } })],
+		content: items.length > 0 ? items : [createTextContentItem(fallbackText)],
 		isError: false,
 	});
 }
 
+function createTextContentItem(text: string): ReturnType<typeof create<typeof McpToolResultContentItemSchema>> {
+	return create(McpToolResultContentItemSchema, { content: { case: "text", value: create(McpTextContentSchema, { text }) } });
+}
+
+function createImageContentItem(data: string, mimeType: string, index: number): ReturnType<typeof create<typeof McpToolResultContentItemSchema>> {
+	return create(McpToolResultContentItemSchema, {
+		content: { case: "image", value: create(McpImageContentSchema, { data: decodeStrictBase64ImageData(data, { kind: "MCP image", mimeType, index }), mimeType }) },
+	});
+}
+

package/dist/builtin/cursor/src/proto/protobuf-codec.ts

@@ -15,7 +15,7 @@ import {
 	type McpToolDefinition,
 	type ModelDetails,
 } from "./agent_pb.js";
-import { blobKey, buildCursorRequest, buildMcpToolDefinitions, extractCurrentActionText, parseHistoricalTurns } from "./protobuf-codec-request.js";
+import { blobKey, buildCursorRequest, buildMcpToolDefinitions, extractCurrentActionImages, extractCurrentActionText, parseHistoricalTurns } from "./protobuf-codec-request.js";
 import { createMcpToolResult, decodeAgentServerMessage, encodeExecClientMessage, encodeKvClientMessage, encodeNativeExecRejection, encodeRequestContextResult } from "./protobuf-codec-wire.js";
 
 // Cursor protocol codec intentionally follows the MIT-licensed
@@ -67,6 +67,7 @@ export class CursorProtobufProtocolCodec implements CursorProtocolCodec {
 			conversationIdValue,
 			storedState?.checkpoint ?? null,
 			storedState?.blobStore,
+			extractCurrentActionImages(request),
 		);
 		this.#blobStores.set(request.requestId, payload.blobStore);
 		this.#toolDefinitions.set(request.requestId, buildMcpToolDefinitions(request));
@@ -141,7 +142,7 @@ export class CursorProtobufProtocolCodec implements CursorProtocolCodec {
 	}
 
 	encodeToolResult(result: CursorToolResultMessage): Uint8Array {
-		const mcpResult = createMcpToolResult(result.text, result.isError);
+		const mcpResult = createMcpToolResult(result.content ?? result.text, result.isError, result.text);
 		return encodeExecClientMessage(result.execNumericId, result.execId, "mcpResult", mcpResult);
 	}
 

package/dist/builtin/cursor/src/stream.ts

@@ -88,8 +88,8 @@ export class CursorStreamAdapter {
 			if (!options?.apiKey) {
 				throw new Error("Cursor OAuth credentials are required. Run /login and select Cursor.");
 			}
-			if (hasImageInput(context)) {
-				throw new Error("Cursor provider currently supports text input only; vision/image content is unsupported.");
+			if (hasImageInput(context) && !model.input.includes("image")) {
+				throw new Error(`Cursor model ${model.id} does not support image input.`);
 			}
 			if (options.signal?.aborted) {
 				throw new CursorStreamAbortError();
@@ -216,16 +216,10 @@ export class CursorStreamAdapter {
 	}
 }
 class CursorStreamAbortError extends Error {
-	constructor() {
-		super("Cursor stream aborted.");
-		this.name = "CursorStreamAbortError";
-	}
+	constructor() { super("Cursor stream aborted."); this.name = "CursorStreamAbortError"; }
 }
 class CursorStreamTimeoutError extends Error {
-	constructor() {
-		super("Cursor stream timed out while waiting for provider output.");
-		this.name = "CursorStreamTimeoutError";
-	}
+	constructor() { super("Cursor stream timed out while waiting for provider output."); this.name = "CursorStreamTimeoutError"; }
 }
 interface CursorPendingMessageRead {
 	readonly promise: Promise<IteratorResult<CursorServerMessage>>;
@@ -329,7 +323,7 @@ function getTrailingToolResults(context: Context): CursorToolResultMessage[] {
 	for (let index = context.messages.length - 1; index >= 0; index--) {
 		const message = context.messages[index];
 		if (!message || message.role !== "toolResult") break;
-		results.unshift({ toolCallId: message.toolCallId, toolName: message.toolName, text: textFromToolResult(message), isError: message.isError });
+		results.unshift({ toolCallId: message.toolCallId, toolName: message.toolName, text: textFromToolResult(message), content: message.content, isError: message.isError });
 	}
 	return results;
 }

package/dist/builtin/cursor/src/transport-types.ts

@@ -47,10 +47,13 @@ export type CursorControlMessage =
 
 export type CursorProtocolMessage = CursorServerMessage | CursorControlMessage;
 
+export type CursorToolResultContent = Extract<Context["messages"][number], { role: "toolResult" }>["content"][number];
+
 export interface CursorToolResultMessage {
 	readonly toolCallId: string;
 	readonly toolName: string;
 	readonly text: string;
+	readonly content?: readonly CursorToolResultContent[];
 	readonly isError: boolean;
 	readonly execId?: string;
 	readonly execNumericId?: number;

package/dist/builtin/cursor/src/transport.ts

@@ -18,6 +18,7 @@ export type {
 	CursorRunStream,
 	CursorServerMessage,
 	CursorToolCallMessage,
+	CursorToolResultContent,
 	CursorToolResultMessage,
 	CursorTransportLifecycleSnapshot,
 	CursorWriteOptions,

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.2",
+  "version": "0.9.3-alpha.2",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.3-alpha.1] - 2026-06-25
+
+### Fixed
+
+- `unflattenToolArguments` is now schema-aware and no longer corrupts literal dotted top-level argument keys (issue [#1496](https://github.com/bastani-inc/atomic/issues/1496)). Bracket-indexed keys (`ids[0]`, `files[0].path`) are always reconstructed, but a purely dotted key (`filter.name`) is only split into a nested path when the tool's `inputSchema` proves its head segment is an object/array container property **and** the schema does not declare the full dotted key as a literal top-level property. The latter guard preserves a literal property such as `filter.name` verbatim even when the schema also defines a same-head container (e.g. `filter`). The tool `inputSchema` is now threaded through from both the direct-tool and proxy/gateway `callTool` paths. The schema-aware disambiguation is shared with the host runtime via a new canonical `unflattenArgumentsWithSchema` helper in `@bastani/atomic`, so the two paths cannot drift.
+
 ## [0.9.2] - 2026-06-23
 
 ### Changed