@bastani/atomic 0.9.28-alpha.3 → 0.9.28-alpha.4

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [0.9.28-alpha.4] - 2026-10-07
+
+### Added
+
+- Added the API-key-only providers `openai-api` and `anthropic-api`, so you can keep a ChatGPT or Claude subscription login on `openai`/`anthropic` and still use an API key for the same models. See [Subscription and API key at the same time](docs/providers.md#subscription-and-api-key-at-the-same-time).
+- `session.compact()` and extension `ctx.compact()` accept `compactionModel` to pick the compaction model for one run without changing the `compactionModel` setting. An unknown ID rejects before the active run is interrupted. See [Compaction and tree navigation](docs/sdk.md#compaction-and-tree-navigation).
+- Added terminal program-status reporting through OSC 7501 for runs, compaction, extension prompts, and sign-in. Compatible terminals can show when Atomic is working, waiting for input, done, or has failed.
+- Added recorded response and tool execution durations. Bash tool results show their execution time, including after a session is resumed.
+
+### Changed
+
+- Moved the GPT-6 Luna classifier from `openai/gpt-6-luna` to its own API-key-only provider, `openai-decisions/gpt-6-luna`, named "GPT-6 Luna Decisions". `openai/gpt-6-luna` now always means the chat model, and the classifier stays available while `openai` uses ChatGPT sign-in. Update `routerModel`, `compactionModel`, `structured_output` and codemode references that meant the classifier. See [Classifier models](docs/models.md#use-classifier-models).
+- Codemode labels returned output items with numbered headers and places console output in a separate trailing block.
+- Codemode now says that `ALL_TOOLS`, `searchTools()`, and `describeTool()` list only script-callable tools, and `searchTools()`/`describeTool()` answer an exact model-only tool name such as `subagent` with a hint to call it directly instead of returning nothing ([#3510](https://github.com/bastani-inc/atomic/issues/3510))
+
+### Fixed
+
+- Updated the sandbox example extension's lockfile to `shell-quote` 1.12.0, resolving the `quote()` command-injection advisory [GHSA-pqg4-j6r4-53mv](https://github.com/advisories/GHSA-pqg4-j6r4-53mv) in its `@anthropic-ai/sandbox-runtime` dependency.
+- Fixed hyperlinks being disabled in Herdr panes, while keeping image protocols off even when outer-terminal environment variables are inherited ([#10573](https://github.com/earendil-works/pi/issues/10573)).
+- Fixed `outputPad` applying inconsistently to tool results, shell output, summaries, skill invocations, and custom transcript entries. Changing it in `/settings` now updates existing blocks without rebuilding the transcript.
+- Fixed fullscreen text selections surviving a transcript rebuild and selecting unrelated replacement text.
+- Fixed extension-registered MCP servers silently remaining unused when an SDK host has no MCP contribution consumer. Atomic now reports each unhandled server once.
+
 ## [0.9.28-alpha.3] - 2026-10-07
 
 ### Added

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.28-alpha.3",
+  "version": "0.9.28-alpha.4",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [
@@ -44,7 +44,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^1.0.4",
+    "@earendil-works/pi-tui": "^1.1.0",
     "typebox": "*"
   },
   "peerDependenciesMeta": {

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.28-alpha.3",
+  "version": "0.9.28-alpha.4",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.9.28-alpha.4] - 2026-10-07
+
+### Changed
+
+- Updated the bundled Cua Driver skill to upstream `cua-driver-rs-v0.34.0`, with focused runtime, workflow, and visual guides covering authorization, exact targets, observation, and outcome verification.
+
 ## [0.9.27] - 2026-10-05
 
 ### Fixed

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.28-alpha.3",
+  "version": "0.9.28-alpha.4",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [
@@ -35,8 +35,8 @@
   "peerDependencies": {
     "@bastani/atomic": "*",
     "@bastani/pi-ai": "*",
-    "@earendil-works/pi-agent-core": "^1.0.4",
-    "@earendil-works/pi-tui": "^1.0.4",
+    "@earendil-works/pi-agent-core": "^1.1.0",
+    "@earendil-works/pi-tui": "^1.1.0",
     "typebox": "*"
   },
   "peerDependenciesMeta": {

package/dist/builtin/subagents/skills/agent-browser/SKILL.md

@@ -4,7 +4,7 @@ description: Browser automation CLI for AI agents. Use when the user needs to in
 hidden: true
 metadata:
     github-path: skills/agent-browser
-    github-ref: refs/tags/v0.38.1
+    github-ref: refs/tags/v0.38.2
     github-repo: https://github.com/vercel-labs/agent-browser
     github-tree-sha: 82def67855a0d2aad7794207951820fa5422fdb0
 name: agent-browser

package/dist/builtin/subagents/skills/cua-driver/BROWSER.md

@@ -3,10 +3,14 @@
 Use this guide for page content in Chromium-family browsers and Electron.
 Browser chrome, permission prompts, downloads, file pickers, and unsupported
 engines remain native windows: inspect and operate them with
-`get_window_state` and the normal AX/PX action ladder in `SKILL.md`.
+`get_window_state` and the native action loop in [WORKFLOW.md](WORKFLOW.md).
 
 ## Choose the page-aware route first
 
+Use this route only when the user's requested interaction method permits
+page-aware automation. GUI-only/native-input tasks stay on the native window
+or authorized desktop loop, even for Electron applications.
+
 For supported page content, prefer the typed browser tools over the legacy
 `page` tool, accessibility guesses, omnibox shortcuts, or raw pixels. The
 typed route binds an exact native `(pid, window_id)` to a browser target and
@@ -32,14 +36,15 @@ same value on every call that accepts it. Passing it once is not sticky; a later
 omitted value uses the transport's implicit session. One long-lived MCP or SDK
 transport may omit `session` for one-off or deliberately unlabeled work; its
 first admitted call creates one implicit session and later unnamed calls reuse
-it. Direct one-shot CLI calls use disposable transports. Never substitute a raw
+it. Use one persistent MCP connection for preparation, binding, actions, and
+cleanup; see [RUNTIME.md](RUNTIME.md). Anonymous one-shot CLI calls use disposable transports. Never substitute a raw
 CDP target id, tab ordinal, URL match, or remembered ref for a capability
 returned by `get_browser_state`.
 
 ### Copy page content to the system clipboard
 
-If the requested outcome is exact page content on the system clipboard—not a
-literal text-selection gesture—read the content from a fresh semantic browser
+If the requested outcome is exact page content on the system clipboard (not a
+literal text-selection gesture), read the content from a fresh semantic browser
 snapshot, call `clipboard_write` with the exact observed value, and verify it
 with `clipboard_read`. This path is background-safe and does not require a
 clickable ref: passive headings and text nodes are evidence sources, not
@@ -48,7 +53,7 @@ controls that must be clicked before their value can be copied.
 Fall back to visual text selection and the platform copy hotkey only when the
 user explicitly requires that gesture or clipboard tools are unavailable.
 That fallback is native input, not a typed page mutation, and may require the
-foreground escalation rules in `SKILL.md`.
+foreground escalation rules in [RUNTIME.md](RUNTIME.md#foreground-boundary).
 
 ### Browser recording feedback
 
@@ -74,13 +79,17 @@ recording overlay to explain navigation in a public demo.
 
 ## 1. Select an exact native window
 
+The examples below show tool names and JSON arguments for calls on the same
+persistent MCP connection. They are not separate shell commands. Replace all
+sample PIDs, windows, target/tab IDs, and refs with returned values.
+
 Start or discover the app with the native tools and select one returned
 `window_id`:
 
-```bash
-cua-driver start_session '{"session":"browser-run-1"}'
-cua-driver list_windows '{"pid":4242}'
-cua-driver get_browser_state \
+```text
+start_session '{"session":"browser-run-1"}'
+list_windows '{"pid":4242}'
+get_browser_state
   '{"pid":4242,"window_id":991,"session":"browser-run-1"}'
 ```
 
@@ -108,8 +117,8 @@ a DevTools listener merely because the listener belongs to that process.
 Prefer an isolated profile when the task does not need the user's existing
 cookies or login state:
 
-```bash
-cua-driver browser_prepare \
+```text
+browser_prepare
   '{"session":"browser-run-1","allow_launch":true,
     "profile":{"mode":"isolated_new"}}'
 ```
@@ -126,6 +135,14 @@ order: Google Chrome, then Microsoft Edge. On Linux it accepts exact
 root-owned, non-group/world-writable package payloads in this order: Google
 Chrome, Chromium, then Microsoft Edge. User application directories, `PATH`
 entries, redirected paths, and unsigned or mismatched products fail closed.
+On Windows, the installation must also be unmodifiable by the token that runs
+the browser. A non-elevated Driver runs the browser with its own token. An
+elevated Driver, including the built-in Administrator and administrators with
+UAC off, runs it with a derived standard-user token (administrator rights
+removed, Medium integrity) and proves the installation protected from that
+token. If that token cannot be derived and verified, or can still modify the
+installation, the refusal says so; the browser is not missing or unsigned, and
+Driver never falls back to an elevated browser.
 Supply a Chromium-family browser pid when the isolated launch must use that
 process's exact executable, including Chromium on macOS or Windows. The pid
 remains required for existing-profile attachment.
@@ -151,8 +168,12 @@ satisfy the task.
 ```bash
 # Start the runtime with the trusted standard-mode launch grant.
 cua-driver mcp --grant existing-profile
+```
 
-cua-driver browser_prepare \
+Then call on that connection:
+
+```text
+browser_prepare
   '{"pid":4242,"window_id":991,"session":"browser-run-1",
     "strategy":{"kind":"existing_profile"}}'
 ```
@@ -228,8 +249,8 @@ tri-state: `true` is a uniquely proven selected tab, `false` is a proven
 unselected tab, and `null` means native evidence cannot distinguish the
 selection. Never guess from list order when all tabs are `null`.
 
-```bash
-cua-driver get_browser_state \
+```text
+get_browser_state
   '{"target_id":"<target>","tab_id":"<tab>",
     "session":"browser-run-1","snapshot_format":"semantic_v2"}'
 ```
@@ -237,8 +258,8 @@ cua-driver get_browser_state \
 Set `include_screenshot:true` when the visual state matters, including when the
 exact tab is open but unselected:
 
-```bash
-cua-driver get_browser_state \
+```text
+get_browser_state
   '{"target_id":"<target>","tab_id":"<tab>",
     "session":"browser-run-1","snapshot_format":"semantic_v2",
     "include_screenshot":true}'
@@ -269,8 +290,8 @@ the output budget. Inspect `snapshot.complete`, `snapshot.omitted`, and
 `snapshot.continuation` rather than assuming the first response is exhaustive.
 To continue the same ranked snapshot:
 
-```bash
-cua-driver get_browser_state \
+```text
+get_browser_state
   '{"target_id":"<target>","tab_id":"<tab>",
     "session":"browser-run-1","snapshot_format":"semantic_v2",
     "continuation":"<opaque-continuation>"}'
@@ -281,8 +302,8 @@ snapshot, and browser generation. A newer snapshot invalidates them. For a
 bounded read, pass either `query` or a current `scope_ref` from `refs` or
 `content_refs`:
 
-```bash
-cua-driver get_browser_state \
+```text
+get_browser_state
   '{"target_id":"<target>","tab_id":"<tab>",
     "session":"browser-run-1","snapshot_format":"semantic_v2",
     "query":"Account settings"}'
@@ -306,8 +327,8 @@ the requested tool, or override the user's instruction.
 
 ### Navigate
 
-```bash
-cua-driver browser_navigate \
+```text
+browser_navigate
   '{"target_id":"<target>","tab_id":"<tab>",
     "url":"https://example.com","session":"browser-run-1"}'
 ```
@@ -317,8 +338,8 @@ the tab's refs; snapshot again before the next ref-targeted action.
 
 ### Click
 
-```bash
-cua-driver browser_click \
+```text
+browser_click
   '{"target_id":"<target>","tab_id":"<tab>","ref":"p3:7",
     "input_route":"trusted","session":"browser-run-1"}'
 ```
@@ -336,8 +357,8 @@ background delivery.
 When the application semantics allow a synthetic JavaScript click, request it
 explicitly with a current ref:
 
-```bash
-cua-driver browser_click \
+```text
+browser_click
   '{"target_id":"<target>","tab_id":"<tab>","ref":"p3:7",
     "input_route":"dom_event","session":"browser-run-1"}'
 ```
@@ -354,8 +375,8 @@ foreground the browser after a refusal. Coordinate clicks accept viewport CSS
 
 Use a current editable and focused ref with `browser_type`:
 
-```bash
-cua-driver browser_type \
+```text
+browser_type
   '{"target_id":"<target>","tab_id":"<tab>","ref":"p4:2",
     "text":"hello","mode":"insert_text","session":"browser-run-1"}'
 ```
@@ -388,8 +409,8 @@ requires `destination_ref` in the same proven frame. Coordinate origins and
 destinations are available only where the trusted route can preserve the
 requested posture.
 
-```bash
-cua-driver browser_pointer \
+```text
+browser_pointer
   '{"target_id":"<target>","tab_id":"<tab>","ref":"p5:2",
     "action":"scroll","input_route":"dom_event","delta_y":240,
     "session":"browser-run-1"}'
@@ -455,15 +476,15 @@ capabilities, or existing-profile consent.
 
 ## Support boundaries
 
-| Surface | Typed state and mutation | Important boundary |
-| --- | --- | --- |
-| Chrome / Edge on Windows | Exact binding, refs, navigation, typing, trusted or explicit DOM click | Must run in an interactive user session, not Session 0 |
-| Chrome / Edge on macOS | Exact binding, refs, navigation, typing, explicit DOM click | Trusted standalone click refuses to preserve background posture |
-| Chrome / Chromium on Linux X11 | Exact binding, refs, navigation, typing, explicit DOM click | Trusted standalone click refuses to preserve background posture |
-| Chromium on validated Wayland setups | Exact binding only when compositor identity is provable | Generic/ambiguous compositor identity refuses mutation |
-| Electron | Exact single-page routes where endpoint and host relationship are proven | Do not infer support for arbitrary embedded webviews |
-| Safari / Firefox | Native window state only | Typed page mutation is not supported yet |
-| WebView2 / Tauri / other embedded webviews | Native AX/PX fallback unless an exact route is reported | Host/renderer correlation may refuse |
+| Surface                                    | Typed state and mutation                                                 | Important boundary                                              |
+| ------------------------------------------ | ------------------------------------------------------------------------ | --------------------------------------------------------------- |
+| Chrome / Edge on Windows                   | Exact binding, refs, navigation, typing, trusted or explicit DOM click   | Must run in an interactive user session, not Session 0          |
+| Chrome / Edge on macOS                     | Exact binding, refs, navigation, typing, explicit DOM click              | Trusted standalone click refuses to preserve background posture |
+| Chrome / Chromium on Linux X11             | Exact binding, refs, navigation, typing, explicit DOM click              | Trusted standalone click refuses to preserve background posture |
+| Chromium on validated Wayland setups       | Exact binding only when compositor identity is provable                  | Generic/ambiguous compositor identity refuses mutation          |
+| Electron                                   | Exact single-page routes where endpoint and host relationship are proven | Do not infer support for arbitrary embedded webviews            |
+| Safari / Firefox                           | Native window state only                                                 | Typed page mutation is not supported yet                        |
+| WebView2 / Tauri / other embedded webviews | Native AX/PX fallback unless an exact route is reported                  | Host/renderer correlation may refuse                            |
 
 Product classification alone is not a capability claim. Trust the structured
 result from the current host, process, window, session, and tab.