@bastani/atomic 0.9.28-alpha.3 → 0.9.28-alpha.5

package/docs/computer-use.md

@@ -212,7 +212,7 @@ Report what the installer did. On macOS it places `CuaDriver.app` in `/Applicati
 
 Never loop on the installer. In a workflow stage, a refused or failed install is reported as `blocked`/`needs_human` together with the exact installer command above, not worked around with an alternative tool.
 
-If the installed driver is older than the bundled skill's `version` (`0.28.2`), run `cua-driver update --apply` once and restart the daemon with the platform's startup command below. If it is newer, proceed and note the skew in the report. `cua-driver check-update` only checks; it changes nothing.
+The bundled skill's `version` (`0.34.0`) identifies its source release, not the running daemon. Check the installed driver's advertised schema before using unfamiliar parameters; do not upgrade software or change permissions merely to make a recipe work. If an upgrade is authorized, run `cua-driver update --apply` once and restart the daemon with the platform's startup command below. `cua-driver check-update` only checks; it changes nothing.
 
 ### Turn telemetry off
 
@@ -245,18 +245,18 @@ A missing macOS Accessibility or Screen Recording grant, a non-interactive Windo
 
 ### Drive a window from the shell
 
-Load the `cua-driver` skill and follow its loop. The shape, with `CUA_DRIVER_RS_TELEMETRY_ENABLED=false` exported as above, is:
+Load the `cua-driver` skill and follow its loop. For a multi-call CLI run, choose a short, non-default session label and repeat it on every call that accepts `session`; omitting it uses a disposable implicit lease rather than preserving the prior call's state. The shape, with `CUA_DRIVER_RS_TELEMETRY_ENABLED=false` exported as above, is:
 
 ```sh
 cua-driver call list_apps
 cua-driver call list_windows '{"pid":844}'
-cua-driver call get_window_state '{"pid":844,"window_id":10725,"screenshot_out_file":"artifacts/before.png"}' > artifacts/before.json
-# Pick one element_token from before.json, then act on it in the background.
-cua-driver call click '{"pid":844,"element_token":"s0000002a:14"}'
-cua-driver call get_window_state '{"pid":844,"window_id":10725,"screenshot_out_file":"artifacts/after.png"}' > artifacts/after.json
+cua-driver call get_window_state '{"pid":844,"window_id":10725,"session":"run-1","screenshot_out_file":"artifacts/before.png"}' > artifacts/before.json
+# Pick one element_token from before.json, then act on that exact window in the background.
+cua-driver call click '{"target":{"kind":"window","pid":844,"window_id":10725},"element_token":"s0000002a:14","session":"run-1","delivery_mode":"background"}'
+cua-driver call get_window_state '{"pid":844,"window_id":10725,"session":"run-1","screenshot_out_file":"artifacts/after.png"}' > artifacts/after.json
 ```
 
-Replace the pid, window id, and token with values read from your own output; tokens are bound to the snapshot that produced them and must be re-read after any UI change. Check the postcondition in `after.json` with a bounded poll deadline, never a fixed sleep and never a repeated click. A `degraded` or `truncated` snapshot is a reason to stop and re-observe, and a refused background action is an escalation signal, not something to retry. Foreground delivery is an explicit escalation. Keep the JSON results and the `screenshot_out_file` images as evidence. When the work ends in a PR, attach the before/after PNGs to the PR body (`gh pr create --body-file body.md --attach 'before.png#Before' --attach 'after.png#After'` on supported GitHub) next to the scenario they prove, and cite the JSON by name as a local artifact; see [Verification and evidence](/workflows/verification#native-github-media).
+Replace the pid, window id, token, and session label with values for your own run; tokens are bound to the snapshot that produced them and must be re-read after any UI change. Check the postcondition in `after.json` with a bounded poll deadline, never a fixed sleep and never a repeated click. A `degraded` or `truncated` snapshot is a reason to stop and re-observe. If background delivery is refused, refresh state and ask before foreground or desktop control unless it was already authorized; do not retry automatically. End only your run with `cua-driver call end_session '{"session":"run-1"}'`, not `cua-driver stop` on a shared service. Keep the JSON results and the `screenshot_out_file` images as evidence. When the work ends in a PR, attach the before/after PNGs to the PR body (`gh pr create --body-file body.md --attach 'before.png#Before' --attach 'after.png#After'` on supported GitHub) next to the scenario they prove, and cite the JSON by name as a local artifact; see [Verification and evidence](/workflows/verification#native-github-media).
 
 ### Run a scenario from workflow code
 
@@ -264,7 +264,7 @@ When a custom workflow owns the scenario, use the `@trycua/cua-driver` TypeScrip
 
 - **Prerequisite.** `node` (preferred) or `bun` on the host. If neither is present, install one in a bounded attempt (Node via [fnm](https://github.com/Schniz/fnm) with `fnm install --lts` or the host's package manager, Bun via `curl -fsSL https://bun.sh/install | bash`) and report what the installer did; if the install is refused or fails, report that as the limitation rather than retrying.
 - **Install.** `npm install @trycua/cua-driver@<exact pin matching cua-driver --version>` into a scratch directory outside the user's repository, one bounded attempt. The package ships per-platform native optional dependencies, so it is self-contained. Pin the exact driver version: daemon-backed clients verify contract, tool-schema, capability, and protocol versions before each action and refuse on mismatch.
-- **Acquire the driver.** When `cua-driver status` reports a running daemon, use `CuaDriver.connect()` so the scenario reuses the daemon's permission identity (on macOS, `CuaDriver.app`'s grants) and the persisted telemetry-off preference; upstream describes `connect()` as a compatibility and app-hosting path, and that is exactly the role it plays here. Only when no daemon is reachable, fall back to `CuaDriver.create()`, which loads the runtime into the node process. On macOS that in-process fallback attributes Accessibility and Screen Recording to the node host, normally the terminal app, as a **separate grant**; `checkPermissions` is then read-only, and the host must fully quit and relaunch after granting.
+- **Acquire the driver.** When `cua-driver status` reports a running daemon, use `CuaDriver.connect(undefined)` so the scenario reuses the daemon's permission identity (on macOS, `CuaDriver.app`'s grants) and the persisted telemetry-off preference; upstream describes `connect()` as a compatibility and app-hosting path, and that is exactly the role it plays here. Only when no daemon is reachable, fall back to `CuaDriver.create(undefined)`, which loads the runtime into the node process. On macOS that in-process fallback attributes Accessibility and Screen Recording to the node host, normally the terminal app, as a **separate grant**; `checkPermissions` is then read-only, and the host must fully quit and relaunch after granting.
 - **Telemetry.** Set `CUA_DRIVER_RS_TELEMETRY_ENABLED=false` in the child environment before constructing the driver.
 - **Loop.** `listApps` → `listWindows` → `getWindowState` (refuse `degraded`/`truncated`) → resolve exactly one element → act by `elementToken` with `InputDeliveryMode.Background` → `getWindowState` again → bounded-poll the postcondition. `shutdown()` in `finally`, then `uniffiDestroy()` when present.
 - **Result.** Machine-readable `verified` / `refuted` / `blocked` / `unknown`; the wrapper maps anything but `verified` to a nonzero outcome. An action that times out before its response is `unknown`, resolved by the postcondition, never by replaying the mutation.
@@ -485,7 +485,7 @@ See [workflow authoring](/workflows/authoring) for stages and human-input gates.
 | `cua-driver`, uv, or another command is missing | Install it when permitted with one bounded attempt, refresh PATH, and check its version in the same shell that will launch automation. |
 | `cua-driver call` fails or `permissions status` reports `unknown` | The daemon is not running. Start it with `open -n -g -a CuaDriver --args serve` on macOS, an interactive-session `cua-driver serve` on Windows, or a foreground `cua-driver serve` inside the graphical session on Linux, then rerun `cua-driver status`. |
 | Grants look correct but actions or captures are refused | Stale TCC grants. Toggle CuaDriver off and on under Accessibility and Screen & System Audio Recording, or click **+** and re-add `/Applications/CuaDriver.app`, then fully relaunch the daemon. An in-process SDK runtime needs the node host relaunched instead. |
-| Contract, schema, or protocol mismatch | Version skew between the bundled skill (`0.28.2`), the `@trycua/cua-driver` pin, and `cua-driver --version`. Run `cua-driver update --apply` once, restart the daemon, and reinstall the SDK at the exact driver version. |
+| Contract, schema, or protocol mismatch | Version skew between the `@trycua/cua-driver` SDK pin and the running driver. Check `cua-driver --version` and reinstall the SDK at that exact version. The bundled skill (`0.34.0`) identifies its source release, not the daemon's protocol. If a driver upgrade is authorized, run `cua-driver update --apply` once and restart the daemon. |
 | Snapshot reports `degraded` or `truncated` | Do not act on it. Re-observe, narrow the query, or fall back to a pixel action from the same snapshot only where the skill allows it. |
 | Black screenshot or no desktop | Check screen permissions, display/session ownership, X11 versus Wayland, and remote-session state. |
 | Input reaches the wrong app | Stop. Confirm focus, window identity, scaling, and that no other controller shares the desktop. |

package/docs/custom-provider/streaming.md

@@ -24,6 +24,10 @@ Per-vendor provider configurations (base URLs, auth, model catalogs) live under
 
 All providers follow the same pattern:
 
+Return a stream from `createAssistantMessageEventStream()` or construct `AssistantMessageEventStream` directly. A plain `EventStream` subclass does not satisfy the response stream type.
+
+The stream sets optional `durationMs` on the final assistant message using a monotonic clock. Set `timestamp` when the request starts. Existing durations are preserved; messages whose timestamps predate the stream, such as fetched deferred results, remain untimed.
+
 ```typescript
 import {
   type AssistantMessage,

package/docs/environment-variables.md

@@ -21,6 +21,8 @@ Atomic accepts environment variables for configuration, provider credentials, an
 
 The renderer also owns `PI_HYPERLINKS`, `PI_IMAGE_PROTOCOL`, and `PI_TRUE_COLOR`. `PI_HYPERLINKS=1|0|auto` and `PI_TRUE_COLOR=1|0|auto` override or preserve detection; `PI_IMAGE_PROTOCOL=kitty|iterm2|none|auto` selects, disables, or preserves image-protocol detection. Explicit JSON values under `terminal.hyperlinks`, `terminal.images`, and `terminal.trueColor` take precedence. These renderer-owned names intentionally have no `ATOMIC_*` aliases.
 
+`PI_PROGRAM_STATUS=1` forces OSC 7501 program-status reports; `0` disables them. Otherwise Atomic reports only after the terminal confirms support. This renderer-owned variable has no `ATOMIC_*` alias. See [Program status](/terminal-setup#program-status).
+
 ## Prompt-cache retention
 
 Atomic defaults to **long** prompt-cache retention in main chat, workflow stages, and subagents wherever the provider/model supports it. `PI_CACHE_RETENTION` intentionally has no `ATOMIC_*` alias. Set it before launching Atomic to choose `short`, `none`, or `long`:

package/docs/extensions/api-reference.md

@@ -185,7 +185,7 @@ if (usage && usage.tokens > 100_000) {
 
 ### ctx.compact()
 
-Trigger Atomic's verbatim line compactor without awaiting completion. The planner emits numbered deleted-line ranges only; Atomic validates them and reconstructs retained text mechanically. Use `compression_ratio` (fraction of compactable lines to keep), client-side `preserve_recent` (an exact context-visible message count), and `query` to tune the run, and `onComplete`/`onError` for follow-up actions.
+Trigger Atomic's verbatim line compactor without awaiting completion. The planner emits numbered deleted-line ranges only; Atomic validates them and reconstructs retained text mechanically. Use `compression_ratio` (fraction of compactable lines to keep), client-side `preserve_recent` (an exact context-visible message count), and `query` to tune the run, `compactionModel` to pick an exact compaction model for this run without changing settings, and `onComplete`/`onError` for follow-up actions.
 
 ```typescript
 ctx.compact({

package/docs/extensions/authoring.md

@@ -628,6 +628,8 @@ pi.registerTool({
 - `lastComponent` - the previously returned component for that slot, if any
 - `invalidate()` - request a rerender of this tool row
 - `toolCallId`, `cwd`, `executionStarted`, `argsComplete`, `isPartial`, `expanded`, `showImages`, `isError`
+- `durationMs` - recorded execution time of the final result; `undefined` while running, when the tool did not run, or for older saved results
+- `outputPad` - configured horizontal padding; renderers with `renderShell: "self"` apply it themselves
 
 Use `context.state` for cross-slot shared state. Keep slot-local caches on the returned component instance when you want to reuse and mutate the same component across renders.
 

package/docs/extensions/events.md

@@ -260,10 +260,13 @@ Fired before a started session runtime is torn down. Use this to clean up resour
 pi.on("session_shutdown", async (event, ctx) => {
   // event.reason - "quit" | "reload" | "new" | "resume" | "fork"
   // event.targetSessionFile - destination session for session replacement flows
+  // event.fromSignal - true when a "quit" came from a host SIGTERM/SIGHUP, not an explicit quit
   // Cleanup, save state, etc.
 });
 ```
 
+`fromSignal` is set only on `reason: "quit"`. Ctrl+D and `/quit` leave it unset. Use it to tell a deliberate exit from the host stopping the process, for example to keep externally registered state that a restart can resume from.
+
 ### Agent Events
 
 #### before_agent_start
@@ -312,6 +315,8 @@ Inside `before_agent_start`, `event.systemPrompt` and `ctx.getSystemPrompt()` bo
 
 `agent_start` begins a low-level run. `agent_end` fires when that run ends, but Atomic may still retry, compact and retry, or deliver queued follow-ups. `agent_before_settle` is the final actionable boundary: it can append session entries and request one continuation. `agent_settled` is final and notification-only; use it when a status integration needs to know Atomic has no automatic continuation left, including a chain of repeated output-cap continuations. Silence during a provider request or between these runs is not settlement.
 
+`agent_settled` includes `aborted: true` when the prompt was cancelled, including cancellation during `agent_before_settle`. Otherwise it is `false`. Use this field to distinguish cancellation from normal completion; an aborted prompt still emits the final settlement notification.
+
 ```typescript
 pi.on("agent_start", async (_event, ctx) => {});
 pi.on("agent_end", async (event, ctx) => {
@@ -459,10 +464,12 @@ pi.on("tool_execution_update", async (event, ctx) => {
 });
 
 pi.on("tool_execution_end", async (event, ctx) => {
-  // event.toolCallId, event.toolName, event.result, event.isError
+  // event.toolCallId, event.toolName, event.result, event.isError, event.durationMs
 });
 ```
 
+`durationMs` is the time spent in the tool's `execute()`, measured with a monotonic clock. It is absent when the tool did not run.
+
 #### context
 
 Fired before each LLM call. Modify messages non-destructively. See [Session Format](/session-format) for message types. When tool output crosses the buffered compaction threshold, the post-tool compaction preflight finishes before this hook runs for the follow-up call, so `event.messages` contains the rebuilt compacted context.

package/docs/getting-started/first-session.md

@@ -120,7 +120,7 @@ Skills are reusable expert instructions. Trigger one with `/skill:<name>` follow
 | `liteparse` | Pull text, tables, or values out of PDF, DOCX, PPTX, XLSX, and image files locally. | `/skill:liteparse` |
 | `show-me` | Explain a topic visually with concise diagrams, code-shape sketches, or focused HTML artifacts. HumanLayer, MIT licensed. | `/skill:show-me` |
 
-Impeccable 4.3.1 runs its commands (`context`, `live`, `detect`, hooks, and the rest) through a self-contained engine binary instead of Node scripts. The bundled launcher, `scripts/impeccable` (`impeccable.cmd` on Windows), looks for a binary next to itself, then in `~/.impeccable/bin/`, and otherwise downloads the pinned engine release for your platform into `~/.impeccable/bin/<version>/` and verifies it against its published SHA-256 before running it, so the first use needs network access. Point `IMPECCABLE_BIN` at a preinstalled engine or set `IMPECCABLE_HOME` to a writable cache when that is not possible. Atomic's launcher keeps the engine's anonymous concept-roll ping and its `npx impeccable update` check switched off, since the skill ships with each Atomic release. Live sessions resolve to the selected app root and support SvelteKit, Nuxt, TanStack Start, Astro, Next.js, Vite, and static HTML injection. The image fallback runs only with `OPENAI_API_KEY`, sends prompts and optional reference images to OpenAI, and spends that account's API credit. Generated image prompts are embedded in the image or a sidecar, so do not include secrets.
+Impeccable 4.5.0 runs its commands (`context`, `live`, `detect`, hooks, and the rest) through a self-contained engine binary instead of Node scripts. The bundled launcher, `scripts/impeccable` (`impeccable.cmd` on Windows), looks for a binary next to itself, then in `~/.impeccable/bin/`, and otherwise downloads the pinned engine release for your platform into `~/.impeccable/bin/<version>/` and verifies it against its published SHA-256 before running it, so the first use needs network access. Point `IMPECCABLE_BIN` at a preinstalled engine or set `IMPECCABLE_HOME` to a writable cache when that is not possible. Atomic's launcher keeps the engine's anonymous concept-roll ping and its `npx impeccable update` check switched off, since the skill ships with each Atomic release. Live sessions resolve to the selected app root and support SvelteKit, Nuxt, TanStack Start, Astro, Next.js, Vite, and static HTML injection. The image fallback runs only with `OPENAI_API_KEY`, sends prompts and optional reference images to OpenAI, and spends that account's API credit. Generated image prompts are embedded in the image or a sidecar, so do not include secrets.
 
 Use `/skill:research-codebase` for a focused subsystem or question. For repository-wide research, use `fan-out-and-synthesize` with distinct repository partitions and an artifact synthesis barrier. Use Goal for ledger-backed bounded orchestration and Ralph for research-first delegated implementation with iterative review; task size alone does not select either workflow.
 

package/docs/herdr.md

@@ -24,6 +24,15 @@ Opening `/tasks`, `/agents`, or `/workflow connect` does not count as an approva
 
 A failed workflow can remain marked blocked in Atomic after its execution ends, while the pane returns to Idle. Check the workflow details for its result; the pane indicator is not a success or failure verdict. Sending a message acknowledges existing workflow attention for the indicator, but does not resume the workflow or approve a budget increase.
 
+## Restore after a Herdr restart
+
+With Herdr 0.9.2 or newer, Atomic also reports the command that reopens the current session, so Herdr can restart Atomic in the same pane with the same conversation after a Herdr server restart. Atomic does not restore anything itself. To turn this off in Herdr, set `[session] resume_agents_on_restore = false` in Herdr's config.
+
+- The command is `atomic --session <id>`, with `--session-dir` added when you use a custom session directory. A session ID that `--session` would read as a file path, such as one ending in `.jsonl`, is reopened by its session file instead, still with any custom `--session-dir`. A new session is reopened only once it has been saved, so a session with no messages yet may not be found when Herdr tries to restore it.
+- Sessions that are not saved (`--no-session`) are reported without a resume command.
+- Quitting Atomic yourself, with Ctrl+D or `/quit`, clears the resume command, so the pane is not reopened. When Herdr or the system stops Atomic with `SIGTERM` or `SIGHUP`, the command stays registered so the session can be restored.
+- Herdr 0.8.2 to 0.9.1 still show status but do not restore sessions.
+
 ## Disable the integration
 
 Add this to `~/.atomic/agent/settings.json` or trusted project `.atomic/settings.json`, then reload or restart Atomic:
@@ -36,7 +45,7 @@ Add this to `~/.atomic/agent/settings.json` or trusted project `.atomic/settings
 }
 ```
 
-Reporting is enabled by default. Project settings follow the normal [settings precedence](/settings).
+Reporting is enabled by default, and disabling it also stops resume reporting. Project settings follow the normal [settings precedence](/settings).
 
 ## Troubleshooting
 
@@ -53,4 +62,4 @@ Reloading or compacting a session should not remove Atomic from the pane. If sta
 
 ## Privacy
 
-Atomic sends status, generic attention messages, and the parent session's ID and local session path to the local Herdr server. It does not send prompt text, tool arguments, transcripts, or workflow output. Session reporting alone does not guarantee automatic session restoration in Herdr.
+Atomic sends status, generic attention messages, the parent session's ID and local session path, and the resume command to the local Herdr server. The resume command contains only `atomic --session` with the session ID (or, for an ID that reads as a path, the session file) and, for a custom session directory, the `--session-dir` path. Atomic does not send prompt text, tool arguments, transcripts, or workflow output.

package/docs/json.md

@@ -32,6 +32,7 @@ Events are defined in [`AgentSessionEvent`](https://github.com/bastani-inc/atomi
 ```typescript
 type AgentSessionEvent =
   | AgentEvent
+  | { type: "agent_settled"; aborted: boolean }
   | { type: "queue_update"; steering: readonly string[]; followUp: readonly string[] }
   | { type: "compaction_start"; reason: "manual" | "threshold" | "overflow" }
   | { type: "session_info_changed"; name: string | undefined }
@@ -48,6 +49,8 @@ type AgentSessionEvent =
 
 `queue_update` emits the full pending steering and follow-up queues whenever they change. `session_info_changed`, `model_changed`, and `thinking_level_changed` report interactive session metadata changes. `compaction_start` and `compaction_end` cover manual and automatic verbatim line compaction: the model emits deleted ranges and Atomic mechanically reconstructs retained text.
 
+`agent_end` closes one low-level agent run; retries, compaction recovery, or queued work may still continue. `agent_settled` means no automatic work remains for the session-level run. Its `aborted` field is `true` when the run was cancelled.
+
 For automatic compaction, `compaction_end.willRetry === true` means the interrupted turn will retry; `AgentSession.prompt()` waits for that continuation. This includes overflow and retry-worthy threshold recovery, such as output-token truncation or OpenAI Responses output-budget underflow. Generic `invalid_request_body` failures still use `willRetry: false` when threshold compaction is warranted.
 
 If same-model compact-and-retry recovery is exhausted, `unresolvedOverflow: true` and `errorMessage` let integrations choose another model rather than treating the prompt as successful.
@@ -73,9 +76,11 @@ type AgentEvent =
   // Tool execution
   | { type: "tool_execution_start"; toolCallId: string; toolName: string; args: any }
   | { type: "tool_execution_update"; toolCallId: string; toolName: string; args: any; partialResult: any }
-  | { type: "tool_execution_end"; toolCallId: string; toolName: string; result: any; isError: boolean };
+  | { type: "tool_execution_end"; toolCallId: string; toolName: string; result: any; isError: boolean; durationMs?: number };
 ```
 
+Final assistant and tool-result messages include optional `durationMs` timing. On `tool_execution_end`, it records how long the tool's `execute()` took using a monotonic clock; it is absent when the tool did not run.
+
 On the wire, each `message_update` record carries:
 
 - The streaming delta in `assistantMessageEvent`, with its cumulative `partial` field stripped.

package/docs/models/evals.md

@@ -5,7 +5,7 @@ description: "Primary-source benchmark facts used by Atomic automatic model rout
 
 # Evals
 
-Last Accessed: 2026-09-25.
+Last Accessed: 2026-10-07 (Claude Haiku 5.5 additions; earlier rows retain their snapshot dates below).
 
 Key:
 
@@ -46,12 +46,19 @@ Key:
 
 ## Artificial Analysis Intelligence Index v4.3.2
 
-Table: the 673 models on the Artificial Analysis leaderboard as of 2026-09-25, including models with no published scores, plus 5 Claude Sonnet 5.5 rows accessed 2026-09-28 and 5 GPT-6.1 Sol rows accessed 2026-09-29.
+Table: the 673 models on the Artificial Analysis leaderboard as of 2026-09-25, including models with no published scores, plus 5 Claude Sonnet 5.5 rows accessed 2026-09-28, 5 GPT-6.1 Sol rows accessed 2026-09-29, and 5 Claude Haiku 5.5 rows accessed 2026-10-07.
 
 GPT-6.1 Sol's five effort rows were accessed 2026-09-29 from the [leaderboard](https://artificialanalysis.ai/leaderboards/models) and [model page](https://artificialanalysis.ai/models/gpt-6-1-sol). The release date is not an evaluation run date; run dates are unpublished. AA's [methodology](https://artificialanalysis.ai/methodology/intelligence-benchmarking) uses mini-swe-agent for TB4, all 66 tasks, pass@1 averaged over three repeats, a 500-step cap and no context compaction.
 
+Claude Haiku 5.5 rows were accessed 2026-10-07 from the [leaderboard](https://artificialanalysis.ai/leaderboards/models) and the [max](https://artificialanalysis.ai/models/claude-haiku-5-5), [xhigh](https://artificialanalysis.ai/models/claude-haiku-5-5-xhigh), [high](https://artificialanalysis.ai/models/claude-haiku-5-5-high), [medium](https://artificialanalysis.ai/models/claude-haiku-5-5-medium), and [low](https://artificialanalysis.ai/models/claude-haiku-5-5-low) model pages. AA labels these configurations "with fallback". All five pages publish non-estimated indices and twelve component measurements in their public structured data, although their text rendering says "Not publicly available". Evaluation run dates are unpublished; the release date is not an evaluation run date. These are AA measurements, not Anthropic's launch-table results. Missing `ONH` remains unknown; the published hallucination rate is a different metric.
+
 | slug | Model | Release date | idx | Brief | Gn | Auto | TB4 | Sci | HLE | PDF | Crit | OA | ONH | LCR | Omni | GPQA | TB21 | TBh | IF | MMMU | tau2 | tauB | Analyst | ITB | Apex | AIME | LCB | Harvey | MLCR | Open | Ent |
 | --- | --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| claude-haiku-5-5 | Claude Haiku 5.5 (Adaptive Reasoning, Max Effort, With Fallback) | 2026-10-07 | 43.4 | 53.9 | 56.0 | 35.4 | 32.8 | 55.0 | 44.4 | 20.8 | 18.9 | 36.4 | ∅ | 82.7 | 10.7 | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | 89.9 | ∅ | ∅ | ∅ |
+| claude-haiku-5-5-xhigh | Claude Haiku 5.5 (Adaptive Reasoning, Xhigh Effort, With Fallback) | 2026-10-07 | 41.2 | 51.6 | 50.5 | 36.0 | 29.3 | 51.7 | 42.7 | 18.2 | 22.6 | 35.0 | ∅ | 78.3 | 6.1 | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | 89.9 | ∅ | ∅ | ∅ |
+| claude-haiku-5-5-high | Claude Haiku 5.5 (Adaptive Reasoning, High Effort, With Fallback) | 2026-10-07 | 37.8 | 47.1 | 46.0 | 33.7 | 21.7 | 48.7 | 37.3 | 17.2 | 18.6 | 34.8 | ∅ | 77.3 | 5.8 | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | 89.5 | ∅ | ∅ | ∅ |
+| claude-haiku-5-5-medium | Claude Haiku 5.5 (Adaptive Reasoning, Medium Effort, With Fallback) | 2026-10-07 | 34.5 | 43.6 | 38.8 | 28.6 | 15.2 | 49.0 | 33.8 | 15.2 | 12.9 | 34.0 | ∅ | 77.3 | 4.5 | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | 89.2 | ∅ | ∅ | ∅ |
+| claude-haiku-5-5-low | Claude Haiku 5.5 (Adaptive Reasoning, Low Effort, With Fallback) | 2026-10-07 | 29.4 | 30.6 | 31.2 | 22.9 | 12.6 | 49.2 | 27.0 | 11.2 | 9.1 | 33.3 | ∅ | 72.0 | 3.3 | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | 87.9 | ∅ | ∅ | ∅ |
 | gpt-6-1-sol | GPT-6.1 Sol (max) | 2026-09-29 | 51.8 | 53.2 | 53.8 | 64.9 | 56.1 | 54.2 | 52.9 | 31 | 31.7 | 62.1 | 45.7 | 83 | 41.5 | ∅ | ∅ | ∅ | ∅ | 86 | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | 33.9 | ∅ | ∅ |
 | gpt-6-1-sol-xhigh | GPT-6.1 Sol (xhigh) | 2026-09-29 | 51 | 50.3 | 50.5 | 66.6 | 54 | 55.7 | 52.6 | 31.8 | 31.7 | 60.8 | 49.1 | 79.7 | 40.9 | ∅ | ∅ | ∅ | ∅ | 85.1 | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ |
 | gpt-6-1-sol-high | GPT-6.1 Sol (high) | 2026-09-29 | 50.2 | 48.6 | 49.3 | 64.5 | 51.5 | 55.8 | 51.4 | 32 | 30 | 60.8 | 50.6 | 82.3 | 41.5 | ∅ | ∅ | ∅ | ∅ | 84.9 | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ | ∅ |
@@ -780,6 +787,8 @@ Source: [FrontierCode leaderboard](https://cognition.com/frontiercode) by Cognit
 
 GPT-6.1 Sol was added 2026-09-29 and accessed that day in the [primary JSON](https://cognition.com/data/frontiercode-leaderboard/data.json). Its best score on both sets is medium effort under the `codex` harness. The Codex revision and run date are unpublished. Main averages 11,365 output tokens and 14.42 minutes per rollout.
 
+Claude Haiku 5.5 was added and accessed 2026-10-07 in the [primary JSON](https://cognition.com/data/frontiercode-leaderboard/data.json). Its best score on both sets is max effort under the Claude Code harness; the run date is unpublished. No unfair-internet-use flag rate is recorded here. Mean cost per Main rollout is $1.33.
+
 Key:
 
 - FrontierCode: mergeability of agent-written pull requests on tasks built by open-source maintainers, graded by rubrics, unit tests and other verifiers for correctness, test quality, scope discipline, style and codebase conventions. Runs that consult solution-bearing sources such as the original pull request score zero.
@@ -802,6 +811,7 @@ Key:
 | grok-4-7 | Grok 4.7 | high | 47.6 | 53.1 | 59.4 | 65.2 | 1.3 | $6.65 |
 | gpt-5-6-sol | GPT-5.6 Sol | max | 47.5 | 52.9 | 60.6 | 66.6 | 0.0 | $5.19 |
 | claude-opus-4-8 | Opus 4.8 | max | 46.5 | 51.6 | 59.6 | 65.5 | 0.6 | $9.62 |
+| claude-haiku-5-5 | Haiku 5.5 | max | 46.4 | 51.7 | 58.4 | 64.7 | ∅ | $1.33 |
 | kimi-k3 | Kimi K3 | ∅ | 44.2 | 48.9 | 58.2 | 63.6 | 0.2 | $3.82 |
 | gemini-3-7-flash | Gemini 3.7 Flash | medium | 43.6 | 48.9 | 56.3 | 62.3 | 0.0 | $1.82 |
 | gpt-5-5 | GPT-5.5 | xhigh | 43.0 | 48.2 | 56.7 | 62.8 | 0.4 | $4.03 |
@@ -834,7 +844,7 @@ Key:
 
 ## Published benchmark results
 
-Scores published by model vendors and benchmark owners for recent frontier models, accessed 2026-09-25; Claude Sonnet 5.5 rows accessed 2026-09-28. Values are percent. Each row names its source; the same benchmark can appear once per source because vendors run different harnesses, grading and effort levels. Internal vendor evaluations are excluded.
+Scores published by model vendors and benchmark owners for recent frontier models, accessed 2026-09-25; Claude Sonnet 5.5 rows accessed 2026-09-28 and Claude Haiku 5.5 rows accessed 2026-10-07. Values are percent unless the setting names another unit. Each row names its source; the same benchmark can appear once per source because vendors run different harnesses, grading and effort levels. Internal vendor evaluations are excluded.
 
 Sources: OpenAI = [GPT-6 Astra announcement](https://openai.com/index/gpt-6-astra/); Anthropic = [Claude Fable 5.1 announcement](https://www.anthropic.com/claude-fable-and-mythos-5-1), [Claude Sonnet 5.5 announcement](https://www.anthropic.com/claude-sonnet-5-5) and [system card](https://www.anthropic.com/claude-sonnet-5-5-system-card); Google = [Gemini 3.8 Flash model card](https://deepmind.google/models/model-cards/gemini-3-8-flash/); ARC Prize = [arcprize.org results](https://arcprize.org/results/google-gemini-3-8-flash); TB-Science leaderboard = [terminal-bench-science.ai](https://www.terminal-bench-science.ai/); Zapier = [AutomationBench leaderboard](https://zapier.com/benchmarks).
 
@@ -842,10 +852,18 @@ GPT-6.1 Sol rows were accessed 2026-09-29. OpenAI = [Sol 6.1 announcement](https
 
 No matching Sol 6.1 row was retrieved from the DeepSWE, TB-Science, Zapier, Surge GDP.pdf, OSWorld or ARC Prize owner leaderboards on that date. These gaps are unknown, not zero. No `minimal` effort is measured here, and no Fast or Ultrafast tier has a separate benchmark or latency measurement for any model. Atomic's derived `-fast` and `-ultrafast` routes use explicit base-model metadata to reuse capability evidence, not a separately measured tier score or latency result.
 
+Claude Haiku 5.5: Anthropic = [launch announcement](https://www.anthropic.com/claude-haiku-5-5), published and accessed 2026-10-07. These launch-table results are vendor-reported; effort, harness revisions, and evaluation run dates are not stated unless shown in the setting. GDPval-AA and AA-Briefcase are raw Elo, not the normalized AA columns above. No Haiku 5.5 result was published on the checked [DeepSWE leaderboard](https://deepswe.datacurve.ai/) on 2026-10-07; no row is added to that table.
+
+Artificial Analysis independently measures Haiku 5.5 Terminal-Bench-Science in its **with-fallback** configuration. Sources accessed 2026-10-07: effort-specific model pages for [max](https://artificialanalysis.ai/models/claude-haiku-5-5), [xhigh](https://artificialanalysis.ai/models/claude-haiku-5-5-xhigh), [high](https://artificialanalysis.ai/models/claude-haiku-5-5-high), [medium](https://artificialanalysis.ai/models/claude-haiku-5-5-medium), and [low](https://artificialanalysis.ai/models/claude-haiku-5-5-low), the [evaluation page](https://artificialanalysis.ai/evaluations/terminal-bench-science), and [AA's general methodology](https://artificialanalysis.ai/methodology/intelligence-benchmarking). That methodology specifies version 0.1.0, 70 tasks, mini-swe-agent, pass@1 averaged over three repeats, and a 1,000-step cap. These are AA's general settings, not a separately documented Haiku-specific harness revision. Evaluation run dates are unpublished; these are not Anthropic launch-table results.
+
 Key:
 
 - `DSWE`: DeepSWE v1.1, vendor-reported software-engineering results; distinct from Datacurve's independent table above.
 - `GDPpdf`: GDP.pdf All-pass, satisfying every criterion on professional-document tasks.
+- `GDPElo`, `BriefElo`: GDPval-AA v2.1 and AA-Briefcase v1.1, raw Elo ratings.
+- `OSW21`: OSWorld 2.1, computer-use workflows; the Haiku result covers the offline subset.
+- `FC11`: FrontierCode 1.1 Main, weighted rubric score; distinct from all-blocking-criteria pass rate.
+- `Chart`: Chartography, chart understanding without tools.
 
 - `ALE`: [Agents' Last Exam](https://agents-last-exam.org/), long-horizon professional tasks in real software, from financial modeling to engineering and media production.
 - `OSW2`, `OSW2s`: [OSWorld 2.0](https://osworld-v2.xlang.ai/), long-horizon computer-use workflows operating desktop applications through the screen; partial credit and strict all-pass scoring.
@@ -864,6 +882,19 @@ Key:
 
 | slug | Model | Benchmark | Score | Setting | Source |
 | --- | --- | --- | ---: | --- | --- |
+| claude-haiku-5-5 | Claude Haiku 5.5 | GDPElo | 1620 | v2.1; raw Elo; effort not stated | Anthropic |
+| claude-haiku-5-5 | Claude Haiku 5.5 | BriefElo | 1578 | v1.1; raw Elo; effort not stated | Anthropic |
+| claude-haiku-5-5 | Claude Haiku 5.5 | OSW21 | 72.4 | v2.1, offline subset; effort not stated | Anthropic |
+| claude-haiku-5-5 | Claude Haiku 5.5 | HLE | 45.9 | no tools; effort not stated | Anthropic |
+| claude-haiku-5-5 | Claude Haiku 5.5 | HLEt | 57.4 | with tools; effort not stated | Anthropic |
+| claude-haiku-5-5 | Claude Haiku 5.5 | TB4 | 39.2 | v4.0; effort not stated | Anthropic |
+| claude-haiku-5-5 | Claude Haiku 5.5 | FC11 | 46.4 | v1.1 Main; effort not stated in launch table | Anthropic |
+| claude-haiku-5-5 | Claude Haiku 5.5 | Chart | 46.4 | no tools; effort not stated | Anthropic |
+| claude-haiku-5-5 | Claude Haiku 5.5 | TBSci | 20.0 | max effort; with-fallback; AA general settings above | Artificial Analysis |
+| claude-haiku-5-5-xhigh | Claude Haiku 5.5 | TBSci | 18.1 | xhigh effort; with-fallback; AA general settings above | Artificial Analysis |
+| claude-haiku-5-5-high | Claude Haiku 5.5 | TBSci | 10.0 | high effort; with-fallback; AA general settings above | Artificial Analysis |
+| claude-haiku-5-5-medium | Claude Haiku 5.5 | TBSci | 7.1 | medium effort; with-fallback; AA general settings above | Artificial Analysis |
+| claude-haiku-5-5-low | Claude Haiku 5.5 | TBSci | 1.9 | low effort; with-fallback; AA general settings above | Artificial Analysis |
 | gpt-6-1-sol | GPT-6.1 Sol | TBSci | 58.1 | max effort; v0.1.0, 70 tasks, mini-swe-agent, pass@1 over 3 repeats, 1000-step cap | Artificial Analysis |
 | gpt-6-1-sol-low | GPT-6.1 Sol | DSWE | 64.4 | low effort; v1.1; OpenAI-reported, harness not stated | OpenAI |
 | gpt-6-1-sol-medium | GPT-6.1 Sol | DSWE | 73 | medium effort; v1.1; OpenAI-reported, harness not stated | OpenAI |

package/docs/models.md

@@ -25,7 +25,7 @@ For choosing which model to use rather than how to declare one, see [Model selec
 
 Classifier models answer typed questions about JSON state instead of chatting. They do not appear in `/model`. Enable [codemode](/tools#codemode), list them with `models.getAvailableOfType("classifier")`, and call `models.classify(model, { state, questions })`. See [Codemode](/codemode#classify) for question and answer shapes.
 
-OpenAI's `gpt-6-luna` classifier uses the [Decisions API](https://developers.openai.com/api/docs/guides/decisions) and requires `OPENAI_API_KEY`. Sign in with ChatGPT credentials do not work with it. While `openai` uses `/login` credentials, the classifier is not listed as available, even if the environment key is set. Log out of `openai` to use the API key.
+OpenAI's GPT-6 Luna Decisions classifier is `openai-decisions/gpt-6-luna`. It uses the [Decisions API](https://developers.openai.com/api/docs/guides/decisions), which needs an OpenAI API key. It has no `/login` entry of its own and reuses the first key it finds, in this order: a key saved for `openai-api`, a key saved for `openai`, then `OPENAI_API_KEY`. ChatGPT sign-in on `openai` does not work with it and is skipped, so with only a ChatGPT sign-in the classifier stays unavailable until you save an API key with `/login openai-api` or set `OPENAI_API_KEY`. `openai/gpt-6-luna` always means the chat model.
 
 GPT-6 Luna accepts up to 128 image blocks through `images`, alongside the JSON state. Other classifiers reject images unless their catalog input and API support them. Refused answers produce an error result. The endpoint rejects inputs above 922K tokens; very large inputs, currently above roughly 600K tokens, can hit its gateway time limit. These 504 responses are not retried, so reduce the input before trying again.
 

package/docs/providers.md

@@ -67,6 +67,14 @@ Complete the browser callback, or paste the full callback URL into the login dia
 
 Apps using `@bastani/pi-ai` directly can pass `{ agentName: "my-app" }` as the fourth argument to `models.login()` to set the OpenAI ChatGPT name hint or Codex browser-login originator. ChatGPT sign-in keeps `Atomic` as its default name.
 
+### Subscription and API key at the same time
+
+`openai` and `anthropic` hold one credential each, so a subscription login there replaces the API key. To keep both, use the API-key-only providers `openai-api` and `anthropic-api`. They list the same chat models, send requests to the same endpoints, and read `OPENAI_API_KEY` or `ANTHROPIC_API_KEY` unless you save a key with `/login openai-api` or `/login anthropic-api`. They never offer subscription sign-in, and `anthropic-api` ignores `ANTHROPIC_OAUTH_TOKEN` and `ANTHROPIC_AUTH_TOKEN`.
+
+For example, sign in with ChatGPT under `openai` and select `openai/gpt-6-sol` for subscription chat, while a workflow stage pinned to `openai-api/gpt-6-sol` bills the API key.
+
+The GPT-6 Luna Decisions classifier (`openai-decisions`) has no login of its own. It uses the key saved for `openai-api`, then a key saved for `openai`, then `OPENAI_API_KEY`, and ignores a ChatGPT sign-in. See [Classifier models](/models#use-classifier-models).
+
 ### OpenAI Codex
 
 - Requires ChatGPT Plus or Pro subscription
@@ -218,9 +226,11 @@ Catalog failures preserve the last usable models for each provider. See [catalog
 | Provider                           | Environment Variable                                                      | `auth.json` key              |
 | ---------------------------------- | ------------------------------------------------------------------------- | ---------------------------- |
 | Anthropic                          | `ANTHROPIC_API_KEY` or bearer-only `ANTHROPIC_AUTH_TOKEN`                 | `anthropic`                  |
+| Anthropic (API key only)           | `ANTHROPIC_API_KEY`                                                       | `anthropic-api`              |
 | Ant Ling                           | `ANT_LING_API_KEY`                                                        | `ant-ling`                   |
 | Azure                              | `AZURE_OPENAI_API_KEY`                                                    | `azure`                      |
 | OpenAI                             | `OPENAI_API_KEY`                                                          | `openai`                     |
+| OpenAI (API key only)              | `OPENAI_API_KEY`                                                          | `openai-api`                 |
 | DeepSeek                           | `DEEPSEEK_API_KEY`                                                        | `deepseek`                   |
 | NVIDIA NIM                         | `NVIDIA_API_KEY`                                                          | `nvidia`                     |
 | Google Gemini                      | `GEMINI_API_KEY`                                                          | `google`                     |

package/docs/sdk.md

@@ -420,7 +420,7 @@ interface AgentSession {
   navigateTree(targetId: string, options?: { summarize?: boolean; customInstructions?: string; replaceInstructions?: boolean; label?: string }): Promise<{ editorText?: string; cancelled: boolean; aborted?: boolean; summaryEntry?: BranchSummaryEntry }>;
 
   // Verbatim line compaction
-  compact(options?: Partial<VerbatimCompactionParameters>): Promise<VerbatimCompactionResult>;
+  compact(options?: SessionCompactOptions): Promise<VerbatimCompactionResult>; // Partial<VerbatimCompactionParameters> & { compactionModel?: string }
   abortCompaction(): void;
 
   // Abort current operation
@@ -475,7 +475,7 @@ Shared loaders, event buses, settings, and `SessionManager` instances do not sha
 
 #### Session replacement and deferred cleanup
 
-`await runtime.dispose()` refuses new replacements and waits for pending factories, startup, and cleanup. No successor is published after closure. Host callbacks must settle independently of disposal.
+`await runtime.dispose()` refuses new replacements and waits for pending factories, startup, and cleanup. No successor is published after closure. Host callbacks must settle independently of disposal. Call `runtime.dispose({ fromSignal: true })` when the host is shutting down because of `SIGTERM` or `SIGHUP`, so `session_shutdown` handlers receive `fromSignal: true` and can tell it from an explicit quit.
 
 An extension command may await `ctx.newSession()`, `ctx.fork()`, `ctx.switchSession()`, or `session.reload()`. Its old generation remains owned until the command continuation finishes, and final disposal waits for that cleanup. Do not await disposal inside the continuation it must drain. Concurrent replacements are supported, and deferred cleanup failures remain visible.
 
@@ -493,6 +493,12 @@ Caller-supplied `executeBash()` IDs remain correlation IDs, not unique operation
 
 `compact()` removes selected older transcript lines without asking the model to rewrite retained text. It appends a durable `compaction` entry with `details.strategy: "verbatim-lines"` and respects the configured recent-message count. See [Compaction](/compaction) for controls and [Session format](/session-format#compactionentry) for persisted fields.
 
+Pass `compactionModel` to choose the compaction model for one call without changing settings. It accepts the same exact `provider/model` IDs as the [`compactionModel` setting](/compaction#compaction-model): a chat model, a registered classifier, or `morph/morph-compactor`. An unknown ID rejects before the active run is interrupted. A call made while another manual compaction is running joins that run and uses its model.
+
+```typescript
+await session.compact({ compactionModel: "typesafe/jev-latest", query: "keep the auth decisions" });
+```
+
 `session.navigateTree()` rejects during streaming, compaction, or branch summarization rather than queueing the navigation. The active branch stays unchanged. Wait for the operation to finish before retrying.
 
 Session replacement APIs such as new-session, resume, fork, and import live on `AgentSessionRuntime`, not on `AgentSession`.

package/docs/settings.md

@@ -19,7 +19,7 @@ This page is the exhaustive settings reference: every field, its default, and it
 
 On interactive startup, Atomic asks before trusting a project folder that contains trust-gated project inputs and has no saved decision for the folder or a parent folder in `~/.atomic/agent/trust.json`. Trusting a project allows Atomic to load project-local `.atomic/settings.json` and `.atomic` resources, legacy `.pi/settings.json` and `.pi` resources, project-local context files, install missing project packages, and execute project extensions.
 
-Project resources and borrowed project-local code stay blocked until authorized. The trust dialog does not require a model request. Trusted global and explicitly authorized CLI extensions can report the wait.
+The startup prompt appears on its own, before the interface paints, and the interface appears once you choose. If you decline, the transcript warns that project resources are ignored; if you trust the project, it does not. Project resources and borrowed project-local code stay blocked until authorized. The trust dialog does not require a model request. Trusted global and explicitly authorized CLI extensions can report the wait.
 
 Non-interactive modes (`-p`, `--mode json`, and `--mode rpc`) do not show a trust prompt. Without an applicable saved trust decision, they use `defaultProjectTrust` from global settings: `ask` (default) and `never` ignore trust-gated project inputs, while `always` trusts them. Pass `--approve`/`-a` or `--no-approve`/`-na` to override project trust for one run.
 
@@ -201,7 +201,7 @@ See [Providers](/providers#fast-models) for which providers publish fast variant
 | `doubleEscapeAction` | string | `"tree"` | Action for double-escape: `"tree"`, `"fork"`, or `"none"` |
 | `treeFilterMode` | string | `"default"` | Default filter for `/tree`: `"default"`, `"no-tools"`, `"user-only"`, `"labeled-only"`, `"all"` |
 | `editorPaddingX` | number | `0` | Horizontal padding for input editor (0-3) |
-| `outputPad` | number | `1` | Horizontal padding for chat message output (user messages, assistant messages, thinking blocks). `0` or `1` |
+| `outputPad` | number | `1` | Horizontal transcript padding for messages, tool output, `!` command output, and summary blocks. `0` or `1` |
 | `externalEditor` | string | - | Command for the Ctrl+G external editor; takes precedence over `$VISUAL`/`$EDITOR`. Defaults to Notepad on Windows and `nano` elsewhere |
 | `autocompleteMaxVisible` | number | `5` | Max visible items in the default editor and custom editors installed through `ctx.ui.setEditorComponent()` (3-20) |
 | `showHardwareCursor` | boolean | `false` | Show the terminal cursor while TUI positions it for IME support |

package/docs/skills.md

@@ -117,7 +117,7 @@ Offline, `qlty metrics` and `qlty smells` still work through built-in static ana
 
 Load `/skill:agent-browser` first for anything it covers: websites and web apps in Chrome/Chromium, Mobile Safari in the iOS Simulator (`agent-browser -p ios`), Electron and other apps that expose a CDP port, Slack, and cloud browsers. Its text snapshots cost far fewer tokens than screenshot-driven CUA. For everything else, including native desktop apps, native iOS apps in the Simulator, Android emulators, OS dialogs, and desktop Safari or other non-Chromium browsers, load `/skill:cua-driver` and drive the exact window with one-shot `cua-driver call <tool>` commands; when a custom workflow's TypeScript owns the scenario, use the `@trycua/cua-driver` SDK inside `ctx.tool` instead. See [what agent-browser covers](/computer-use#what-agent-browser-covers) for the full split, and [Computer use](/computer-use#desktop-automation-with-cua-driver) for installing the Cua Driver executable, turning telemetry off, readiness, and permissions. For terminal automation/testing, prefer `/skill:herdr` on macOS, Linux and Windows. Install Herdr if missing when network access and permissions permit; fall back to `/skill:tmux` or native Windows psmux when installation or use is not possible. Preserve the upstream skill's explicit-request and managed-pane requirements. These are separate interfaces, not interchangeable command names. See [verification and desktop safety](/workflows/verification) for installation, permissions, dedicated sessions and evidence.
 
-The bundled [Cua Driver skill](https://github.com/trycua/cua/tree/cua-driver-rs-v0.28.2/libs/cua-driver/rust/Skills/cua-driver) is upstream's `libs/cua-driver/rust/Skills/cua-driver` at tag `cua-driver-rs-v0.28.2`, vendored verbatim with all three platform guides (`MACOS.md`, `WINDOWS.md`, `LINUX.md`) plus `BROWSER.md`, `RECORDING.md`, and `EMBEDDING.md`; only the `SKILL.md` frontmatter is Atomic-owned. MIT licensed, © 2025 Cua AI, Inc. It teaches the snapshot → act → fresh snapshot → verify loop for the `cua-driver` CLI; it does not install the `cua-driver` executable, grant permissions, or turn telemetry off, and Atomic never runs `cua-driver skills install`. Chromium browsers, Mobile Safari, and CDP-exposing apps stay with `agent-browser` even though the vendored `BROWSER.md` describes upstream's browser route; that route applies only to browsers agent-browser cannot reach, such as desktop Safari or Firefox.
+The bundled [Cua Driver skill](https://github.com/trycua/cua/tree/cua-driver-rs-v0.34.0/libs/cua-driver/rust/Skills/cua-driver) is upstream's `libs/cua-driver/rust/Skills/cua-driver` at tag `cua-driver-rs-v0.34.0`, vendored verbatim with all three platform guides (`MACOS.md`, `WINDOWS.md`, `LINUX.md`) plus `WORKFLOW.md`, `RUNTIME.md`, `VISUAL.md`, `BROWSER.md`, `RECORDING.md`, and `EMBEDDING.md`; only the `SKILL.md` frontmatter is Atomic-owned. MIT licensed, © 2025 Cua AI, Inc. Its core guide routes to focused references for authorization, exact targets, observation, and outcome verification. It does not install the `cua-driver` executable, grant permissions, or turn telemetry off, and Atomic never runs `cua-driver skills install`. Chromium browsers, Mobile Safari, and CDP-exposing apps stay with `agent-browser` even though the vendored `BROWSER.md` describes upstream's browser route; that route applies only to browsers agent-browser cannot reach, such as desktop Safari or Firefox.
 
 The bundled [Herdr skill](https://github.com/herdrdev/herdr/blob/v0.9.0/skills/herdr/SKILL.md) requires an explicit Herdr mention or request and `HERDR_ENV=1`; it stops outside a Herdr-managed pane. It does not install Herdr or authorize control of unrelated panes. Use returned pane IDs, and check completion separately from command submission.
 

package/docs/terminal-setup.md

@@ -182,3 +182,17 @@ The built-in terminal has limited escape sequence support. SHIFT+Enter cannot be
 If you want the hardware cursor visible, set `ATOMIC_HARDWARE_CURSOR=1` before running Atomic. The legacy `PI_HARDWARE_CURSOR=1` alias also works; the hardware cursor is disabled by default for compatibility.
 
 Consider using a dedicated terminal emulator for the best experience.
+
+## Program status
+
+Atomic reports its state with the [Program Status Protocol (OSC 7501)](https://www.superlogical.com/rex/docs/build/program-status), so supporting terminals and dashboards can show whether it is working, waiting for you, done, or failed:
+
+| State | When |
+|---|---|
+| `working` | An agent run or compaction is in progress. The message is the session name, or `Compacting context`. |
+| `blocked` | An extension dialog or login waits for you. The message is the dialog title. |
+| `done` | A run finished. The message is the session name. |
+| `error` | A run ended with an error that is not retried. The message is the first line of the error. |
+| `idle` | Atomic started, or you cancelled the run. |
+
+Reports never contain prompts or model output. Atomic sends them only after the terminal answers the protocol's support query; tmux and screen do not forward them. Set `PI_PROGRAM_STATUS=1` to send reports without asking, or `PI_PROGRAM_STATUS=0` to disable reports.

package/docs/workflows/authoring.md

@@ -529,11 +529,11 @@ Prerequisites and setup, each as one bounded attempt:
 
 - `node` (preferred) or `bun` on the host. If neither is present, install one in a bounded attempt (Node via [fnm](https://github.com/Schniz/fnm) with `fnm install --lts` or the host's package manager, Bun via `curl -fsSL https://bun.sh/install | bash`) and report what the installer did; if the install is refused or fails, report that as the limitation rather than retrying.
 - The `cua-driver` executable (`cua-driver --version`), installed with upstream's one-line installer if missing, followed by `cua-driver telemetry disable` once.
-- The SDK installed at the exact driver version into a scratch directory outside the user's repository, for example `npm install @trycua/cua-driver@0.28.2 --prefix ~/.cache/atomic-cua`. The package ships per-platform native optional dependencies. Daemon-backed clients verify contract, tool-schema, capability, and protocol versions before each action and refuse on mismatch, so the pin must match `cua-driver --version`.
+- The SDK installed at the exact driver version into a scratch directory outside the user's repository, for example `npm install @trycua/cua-driver@0.34.0 --prefix ~/.cache/atomic-cua`. The package ships per-platform native optional dependencies. Daemon-backed clients verify contract, tool-schema, capability, and protocol versions before each action and refuse on mismatch, so the pin must match `cua-driver --version`.
 
 The executable installer does not install an agent skill. Atomic bundles the skill, so skip upstream's optional `cua-driver skills install`, `cua-driver skills update`, and `clawhub install @cua/driver` steps; leave existing user-level skills alone.
 
-The scenario itself is a small script in that scratch directory. It acquires the driver with `CuaDriver.connect()` when a daemon is running, so it reuses the daemon's permission identity (on macOS, `CuaDriver.app`'s Accessibility and Screen Recording grants) and the persisted telemetry-off preference; upstream describes `connect()` as a compatibility and app-hosting path, which is exactly the role it plays here. Only when no daemon is reachable does it fall back to `CuaDriver.create()`, which loads the runtime into the node process. On macOS that in-process fallback attributes permissions to the node host, normally the terminal app, as a **separate grant** from the app's; `checkPermissions` is then read-only, and the host must fully quit and relaunch after granting. Save it as `~/.cache/atomic-cua/verify-counter.mjs`:
+The scenario itself is a small script in that scratch directory. It acquires the driver with `CuaDriver.connect(undefined)` when a daemon is running, so it reuses the daemon's permission identity (on macOS, `CuaDriver.app`'s Accessibility and Screen Recording grants) and the persisted telemetry-off preference; upstream describes `connect()` as a compatibility and app-hosting path, which is exactly the role it plays here. Only when no daemon is reachable does it fall back to `CuaDriver.create(undefined)`, which loads the runtime into the node process. On macOS that in-process fallback attributes permissions to the node host, normally the terminal app, as a **separate grant** from the app's; `checkPermissions` is then read-only, and the host must fully quit and relaunch after granting. Save it as `~/.cache/atomic-cua/verify-counter.mjs`:
 
 ```js
 // Reads {"daemon":true|false,"artifactsDir":"..."} from argv[2]; prints one JSON result line.
@@ -558,7 +558,7 @@ const finish = (result, detail) => {
 
 // The wrapper already set CUA_DRIVER_RS_TELEMETRY_ENABLED=false in this process's environment
 // before the driver was constructed; the SDK is one of the faces that reports telemetry by default.
-const driver = daemon ? await CuaDriver.connect() : CuaDriver.create(undefined);
+const driver = daemon ? CuaDriver.connect(undefined) : CuaDriver.create(undefined);
 try {
   const apps = await driver.listApps(ListAppsInput.new({}));
   const app = unique(apps.apps.filter((a) => a.name === "Window Demo" && a.running), "app");

package/examples/extensions/sandbox/package-lock.json

@@ -68,9 +68,9 @@
       "license": "MIT"
     },
     "node_modules/shell-quote": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz",
-      "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==",
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.12.0.tgz",
+      "integrity": "sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"