@bastani/atomic 0.9.28-alpha.4 → 0.9.28

package/dist/builtin/intercom/broker/spawn.ts

@@ -1,9 +1,9 @@
 import { spawn } from "child_process";
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { appendFileSync, chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { createRequire } from "module";
-import net from "net";
+import { isSocketAnswering } from "./socket-liveness.js";
 import { createChildProcessEnvironment, isBunBinary } from "@bastani/atomic";
 import {
   getBrokerLogPath,
@@ -57,6 +57,12 @@ export const BROKER_POLL_INITIAL_INTERVAL_MS = 10;
 /** Upper bound for the readiness poll interval, matching the historic flat poll. */
 export const BROKER_POLL_MAX_INTERVAL_MS = 100;
 
+/** How long one spawn attempt waits for the broker socket to answer. */
+export const BROKER_READY_TIMEOUT_MS = 5000;
+
+/** Backstop only: a spawn lock normally ends when its broker is ready or the processes it names are gone. */
+export const BROKER_SPAWN_LOCK_MAX_AGE_MS = 60_000;
+
 type BrokerRuntime = "node" | "bun-source" | "bun-binary";
 
 export const INTERNAL_INTERCOM_BROKER_ARG = "--atomic-internal-intercom-broker";
@@ -257,10 +263,20 @@ export function getBrokerSpawnOptions(
   };
 }
 
-/** Truncate (or create) the broker log so each spawn starts from a bounded, current file. */
-function resetBrokerLog(logPath: string = BROKER_LOG): void {
+/**
+ * Truncate (or create) the broker log so each spawn starts from a bounded, current file. Returns false when a
+ * Windows broker that is still starting holds the log through its launcher's stderr redirect.
+ */
+function resetBrokerLog(logPath: string = BROKER_LOG): boolean {
   ensurePrivateDirectory(dirname(logPath));
-  closeSync(openSync(logPath, "w"));
+  try {
+    closeSync(openSync(logPath, "w"));
+    return true;
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM")) return false;
+    throw error;
+  }
 }
 
 /** Read at most {@link BROKER_LOG_TAIL_BYTES} trailing bytes of the broker log. */
@@ -299,19 +315,24 @@ function toError(error: unknown): Error {
   return error instanceof Error ? error : new Error(String(error));
 }
 
-export async function spawnBrokerIfNeeded(brokerCommand: string, brokerArgs: string[]): Promise<void> {
+export async function spawnBrokerIfNeeded(
+  brokerCommand: string,
+  brokerArgs: string[],
+  readyTimeoutMs: number = BROKER_READY_TIMEOUT_MS,
+): Promise<void> {
   ensurePrivateDirectory(INTERCOM_DIR);
 
   if (await isBrokerRunning()) {
     return;
   }
 
-  const ownsLock = acquireSpawnLock();
-  if (!ownsLock) {
-    await waitForBroker();
+  const lockOwner = acquireSpawnLock();
+  if (lockOwner === undefined) {
+    await waitForBroker(readyTimeoutMs);
     return;
   }
 
+  let keepLock = false;
   try {
     if (await isBrokerRunning()) {
       return;
@@ -323,7 +344,10 @@ export async function spawnBrokerIfNeeded(brokerCommand: string, brokerArgs: str
       writeWindowsHiddenLauncher(launch.launcherCommandLine, launch.launcherPath);
     }
     // Reset before spawning either way: the Windows launcher appends to this same path.
-    resetBrokerLog();
+    if (!resetBrokerLog()) {
+      await waitForBroker(readyTimeoutMs);
+      return;
+    }
     // The Windows launcher redirects the broker's own stderr, so only the direct spawn
     // needs the descriptor. Node duplicates it during spawn, so the parent copy is closed
     // immediately afterwards rather than being held open for the broker's lifetime.
@@ -358,23 +382,38 @@ export async function spawnBrokerIfNeeded(brokerCommand: string, brokerArgs: str
           reject(new Error(`Intercom broker exited before startup with signal ${signal}\n${describeBrokerLog()}`));
           return;
         }
-        reject(
-          new Error(`Intercom broker exited before startup with code ${code ?? "unknown"}\n${describeBrokerLog()}`),
-        );
+        const exitedBeforeStartup = () =>
+          new Error(`Intercom broker exited before startup with code ${code ?? "unknown"}\n${describeBrokerLog()}`);
+        if (code === 0) {
+          // A broker that finds a live broker on the socket yields with a clean exit.
+          void checkSocketConnectable().then((answering) => (answering ? resolve() : reject(exitedBeforeStartup())));
+          return;
+        }
+        reject(exitedBeforeStartup());
       };
 
       child.once("error", onError);
       child.once("exit", onExit);
-      waitForBroker().then(() => {
+      waitForBroker(readyTimeoutMs).then(() => {
         cleanup();
         resolve();
       }, (error) => {
         cleanup();
+        // A broker still starting keeps the lock, so later spawners wait for it instead of starting another.
+        // Only now does the lock name the broker: until this hand-off it follows this live spawner, so no other
+        // spawner can judge it stale and replace it while this one may still release it.
+        // The Windows launcher hides the broker's pid, so its lock could only follow this live spawner and would
+        // block every later spawn; there the broker's own live-socket check is what prevents a takeover.
+        keepLock =
+          launch.kind === "direct" &&
+          child.exitCode === null &&
+          child.signalCode === null &&
+          handSpawnLockToBroker(child.pid, lockOwner);
         reject(toError(error));
       });
     });
   } finally {
-    releaseSpawnLock();
+    if (!keepLock) releaseSpawnLock(lockOwner);
   }
 }
 
@@ -397,39 +436,37 @@ async function isBrokerRunning(): Promise<boolean> {
 }
 
 function checkSocketConnectable(): Promise<boolean> {
-  return new Promise((resolve) => {
-    const socket = net.connect(BROKER_SOCKET);
-    const finish = (isConnected: boolean) => {
-      clearTimeout(timeout);
-      socket.off("connect", onConnect);
-      socket.off("error", onError);
-      resolve(isConnected);
-    };
-    const onConnect = () => {
-      // end() starts a half-close; a reset can still arrive before close. Keep a handler until then.
-      socket.on("error", () => {});
-      socket.end();
-      finish(true);
-    };
-    const onError = () => {
-      socket.destroy();
-      finish(false);
-    };
-    socket.on("connect", onConnect);
-    socket.on("error", onError);
-    const timeout = setTimeout(() => {
-      socket.destroy();
-      finish(false);
-    }, 1000);
-  });
+  return isSocketAnswering(BROKER_SOCKET);
+}
+
+/** Records the still-starting broker on the lock so staleness follows that process instead of the spawner. */
+function handSpawnLockToBroker(pid: number | undefined, owner: string): boolean {
+  if (pid === undefined || !ownsSpawnLock(owner)) return false;
+  try {
+    appendFileSync(BROKER_SPAWN_LOCK, `${pid}\n`);
+    return true;
+  } catch {
+    // The startup error must still reach the caller; an unrecorded lock is released like any other.
+    return false;
+  }
 }
 
-function acquireSpawnLock(): boolean {
+function ownsSpawnLock(owner: string, lockPath: string = BROKER_SPAWN_LOCK): boolean {
+  try {
+    return readFileSync(lockPath, "utf-8").startsWith(owner);
+  } catch {
+    return false;
+  }
+}
+
+/** Returns the header this spawner wrote, which proves ownership on release, or undefined when another spawner holds the lock. */
+function acquireSpawnLock(): string | undefined {
   const maxRetries = 5;
   for (let attempt = 0; attempt < maxRetries; attempt++) {
+    const owner = `${process.pid}\n${Date.now()}\n`;
     try {
-      writeFileSync(BROKER_SPAWN_LOCK, `${process.pid}\n${Date.now()}\n`, { flag: "wx" });
-      return true;
+      writeFileSync(BROKER_SPAWN_LOCK, owner, { flag: "wx" });
+      return owner;
     } catch (error) {
       if (!(error instanceof Error) || (error as NodeJS.ErrnoException).code !== "EEXIST") {
         throw error;
@@ -442,42 +479,50 @@ function acquireSpawnLock(): boolean {
         }
         continue;
       }
-      return false;
+      return undefined;
     }
   }
-  return false;
+  return undefined;
+}
+
+function isProcessAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "EPERM";
+  }
 }
 
-function isSpawnLockStale(): boolean {
-  if (!existsSync(BROKER_SPAWN_LOCK)) {
+/**
+ * A lock is stale once the broker it recorded is gone, or, while no broker is recorded, once its
+ * spawner is gone. A live broker keeps the lock even if its spawner died, until the age backstop.
+ */
+export function isSpawnLockStale(lockPath: string = BROKER_SPAWN_LOCK, nowMs: number = Date.now()): boolean {
+  if (!existsSync(lockPath)) {
     return false;
   }
 
   try {
-    const [pidLine = "", createdAtLine = "0"] = readFileSync(BROKER_SPAWN_LOCK, "utf-8").trim().split("\n");
-    const pid = Number.parseInt(pidLine, 10);
+    const [spawnerLine = "", createdAtLine = "", brokerLine = ""] = readFileSync(lockPath, "utf-8").trim().split("\n");
+    const spawnerPid = Number.parseInt(spawnerLine, 10);
     const createdAt = Number.parseInt(createdAtLine, 10);
-    const ageMs = Date.now() - createdAt;
-
-    if (Number.isFinite(pid)) {
-      try {
-        process.kill(pid, 0);
-      } catch {
-        // The process that created the lock is gone.
-        return true;
-      }
-    }
+    const brokerPid = Number.parseInt(brokerLine, 10);
 
-    return !Number.isFinite(createdAt) || ageMs > 10_000;
+    if (!Number.isFinite(spawnerPid) || !Number.isFinite(createdAt)) return true;
+    if (nowMs - createdAt > BROKER_SPAWN_LOCK_MAX_AGE_MS) return true;
+    return !isProcessAlive(Number.isFinite(brokerPid) ? brokerPid : spawnerPid);
   } catch {
     // Unreadable lock contents are treated as stale so a new broker can start.
     return true;
   }
 }
 
-function releaseSpawnLock(): void {
+/** Removes the lock only while it is still the one `owner` wrote; a spawner that replaced a stale lock keeps its own. */
+export function releaseSpawnLock(owner: string, lockPath: string = BROKER_SPAWN_LOCK): void {
+  if (!ownsSpawnLock(owner, lockPath)) return;
   try {
-    unlinkSync(BROKER_SPAWN_LOCK);
+    unlinkSync(lockPath);
   } catch {
     // Another cleanup path may already have removed the lock.
   }
@@ -488,7 +533,7 @@ function releaseSpawnLock(): void {
  * Startup is tens of milliseconds, so the previous flat 100 ms sleep dominated it; the
  * overall timeout semantics are unchanged.
  */
-export async function waitForBroker(timeoutMs = 5000): Promise<void> {
+export async function waitForBroker(timeoutMs = BROKER_READY_TIMEOUT_MS): Promise<void> {
   const start = Date.now();
   let interval = BROKER_POLL_INITIAL_INTERVAL_MS;
   while (Date.now() - start < timeoutMs) {

package/dist/builtin/intercom/index.bundle.mjs

@@ -1406,13 +1406,43 @@ var init_client = __esm(() => {
   };
 });
 
+// dist/builtin/intercom/broker/socket-liveness.ts
+import net2 from "net";
+function isSocketAnswering(socketPath, timeoutMs = SOCKET_PROBE_TIMEOUT_MS) {
+  return new Promise((resolve) => {
+    const socket = net2.connect(socketPath);
+    const finish = (isConnected) => {
+      clearTimeout(timeout);
+      socket.off("connect", onConnect);
+      socket.off("error", onError);
+      resolve(isConnected);
+    };
+    const onConnect = () => {
+      socket.on("error", () => {});
+      socket.end();
+      finish(true);
+    };
+    const onError = () => {
+      socket.destroy();
+      finish(false);
+    };
+    socket.on("connect", onConnect);
+    socket.on("error", onError);
+    const timeout = setTimeout(() => {
+      socket.destroy();
+      finish(false);
+    }, timeoutMs);
+  });
+}
+var SOCKET_PROBE_TIMEOUT_MS = 1000;
+var init_socket_liveness = () => {};
+
 // dist/builtin/intercom/broker/spawn.ts
 import { spawn } from "child_process";
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { appendFileSync, chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { join as join2, dirname } from "path";
 import { fileURLToPath } from "url";
 import { createRequire } from "module";
-import net2 from "net";
 import { createChildProcessEnvironment, isBunBinary } from "@bastani/atomic";
 function isIntercomPackageRoot(dir) {
   return existsSync(join2(dir, "package.json")) && existsSync(join2(dir, "broker"));
@@ -1537,7 +1567,15 @@ function getBrokerSpawnOptions(extensionDir = EXTENSION_DIR, stderr = "ignore")
 }
 function resetBrokerLog(logPath = BROKER_LOG) {
   ensurePrivateDirectory(dirname(logPath));
-  closeSync(openSync(logPath, "w"));
+  try {
+    closeSync(openSync(logPath, "w"));
+    return true;
+  } catch (error) {
+    const code = error.code;
+    if (process.platform === "win32" && (code === "EBUSY" || code === "EPERM"))
+      return false;
+    throw error;
+  }
 }
 function readBrokerLogTail(logPath = BROKER_LOG, maxBytes = BROKER_LOG_TAIL_BYTES) {
   let fd;
@@ -1571,16 +1609,17 @@ ${tail}`;
 function toError2(error) {
   return error instanceof Error ? error : new Error(String(error));
 }
-async function spawnBrokerIfNeeded(brokerCommand, brokerArgs) {
+async function spawnBrokerIfNeeded(brokerCommand, brokerArgs, readyTimeoutMs = BROKER_READY_TIMEOUT_MS) {
   ensurePrivateDirectory(INTERCOM_DIR);
   if (await isBrokerRunning()) {
     return;
   }
-  const ownsLock = acquireSpawnLock();
-  if (!ownsLock) {
-    await waitForBroker();
+  const lockOwner = acquireSpawnLock();
+  if (lockOwner === undefined) {
+    await waitForBroker(readyTimeoutMs);
     return;
   }
+  let keepLock = false;
   try {
     if (await isBrokerRunning()) {
       return;
@@ -1590,7 +1629,10 @@ async function spawnBrokerIfNeeded(brokerCommand, brokerArgs) {
     if (launch.kind === "windows-launcher") {
       writeWindowsHiddenLauncher(launch.launcherCommandLine, launch.launcherPath);
     }
-    resetBrokerLog();
+    if (!resetBrokerLog()) {
+      await waitForBroker(readyTimeoutMs);
+      return;
+    }
     const logFd = launch.kind === "direct" ? openSync(BROKER_LOG, "a") : undefined;
     let child;
     try {
@@ -1620,21 +1662,28 @@ ${describeBrokerLog()}`, { cause: error }));
 ${describeBrokerLog()}`));
           return;
         }
-        reject(new Error(`Intercom broker exited before startup with code ${code ?? "unknown"}
-${describeBrokerLog()}`));
+        const exitedBeforeStartup = () => new Error(`Intercom broker exited before startup with code ${code ?? "unknown"}
+${describeBrokerLog()}`);
+        if (code === 0) {
+          checkSocketConnectable().then((answering) => answering ? resolve() : reject(exitedBeforeStartup()));
+          return;
+        }
+        reject(exitedBeforeStartup());
       };
       child.once("error", onError);
       child.once("exit", onExit);
-      waitForBroker().then(() => {
+      waitForBroker(readyTimeoutMs).then(() => {
         cleanup();
         resolve();
       }, (error) => {
         cleanup();
+        keepLock = launch.kind === "direct" && child.exitCode === null && child.signalCode === null && handSpawnLockToBroker(child.pid, lockOwner);
         reject(toError2(error));
       });
     });
   } finally {
-    releaseSpawnLock();
+    if (!keepLock)
+      releaseSpawnLock(lockOwner);
   }
 }
 async function isBrokerRunning() {
@@ -1654,39 +1703,35 @@ async function isBrokerRunning() {
   }
 }
 function checkSocketConnectable() {
-  return new Promise((resolve) => {
-    const socket = net2.connect(BROKER_SOCKET2);
-    const finish = (isConnected) => {
-      clearTimeout(timeout);
-      socket.off("connect", onConnect);
-      socket.off("error", onError);
-      resolve(isConnected);
-    };
-    const onConnect = () => {
-      socket.on("error", () => {});
-      socket.end();
-      finish(true);
-    };
-    const onError = () => {
-      socket.destroy();
-      finish(false);
-    };
-    socket.on("connect", onConnect);
-    socket.on("error", onError);
-    const timeout = setTimeout(() => {
-      socket.destroy();
-      finish(false);
-    }, 1000);
-  });
+  return isSocketAnswering(BROKER_SOCKET2);
+}
+function handSpawnLockToBroker(pid, owner) {
+  if (pid === undefined || !ownsSpawnLock(owner))
+    return false;
+  try {
+    appendFileSync(BROKER_SPAWN_LOCK, `${pid}
+`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function ownsSpawnLock(owner, lockPath = BROKER_SPAWN_LOCK) {
+  try {
+    return readFileSync(lockPath, "utf-8").startsWith(owner);
+  } catch {
+    return false;
+  }
 }
 function acquireSpawnLock() {
   const maxRetries = 5;
   for (let attempt = 0;attempt < maxRetries; attempt++) {
-    try {
-      writeFileSync(BROKER_SPAWN_LOCK, `${process.pid}
+    const owner = `${process.pid}
 ${Date.now()}
-`, { flag: "wx" });
-      return true;
+`;
+    try {
+      writeFileSync(BROKER_SPAWN_LOCK, owner, { flag: "wx" });
+      return owner;
     } catch (error) {
       if (!(error instanceof Error) || error.code !== "EEXIST") {
         throw error;
@@ -1697,39 +1742,46 @@ ${Date.now()}
         } catch {}
         continue;
       }
-      return false;
+      return;
     }
   }
-  return false;
+  return;
 }
-function isSpawnLockStale() {
-  if (!existsSync(BROKER_SPAWN_LOCK)) {
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function isSpawnLockStale(lockPath = BROKER_SPAWN_LOCK, nowMs = Date.now()) {
+  if (!existsSync(lockPath)) {
     return false;
   }
   try {
-    const [pidLine = "", createdAtLine = "0"] = readFileSync(BROKER_SPAWN_LOCK, "utf-8").trim().split(`
+    const [spawnerLine = "", createdAtLine = "", brokerLine = ""] = readFileSync(lockPath, "utf-8").trim().split(`
 `);
-    const pid = Number.parseInt(pidLine, 10);
+    const spawnerPid = Number.parseInt(spawnerLine, 10);
     const createdAt = Number.parseInt(createdAtLine, 10);
-    const ageMs = Date.now() - createdAt;
-    if (Number.isFinite(pid)) {
-      try {
-        process.kill(pid, 0);
-      } catch {
-        return true;
-      }
-    }
-    return !Number.isFinite(createdAt) || ageMs > 1e4;
+    const brokerPid = Number.parseInt(brokerLine, 10);
+    if (!Number.isFinite(spawnerPid) || !Number.isFinite(createdAt))
+      return true;
+    if (nowMs - createdAt > BROKER_SPAWN_LOCK_MAX_AGE_MS)
+      return true;
+    return !isProcessAlive(Number.isFinite(brokerPid) ? brokerPid : spawnerPid);
   } catch {
     return true;
   }
 }
-function releaseSpawnLock() {
+function releaseSpawnLock(owner, lockPath = BROKER_SPAWN_LOCK) {
+  if (!ownsSpawnLock(owner, lockPath))
+    return;
   try {
-    unlinkSync(BROKER_SPAWN_LOCK);
+    unlinkSync(lockPath);
   } catch {}
 }
-async function waitForBroker(timeoutMs = 5000) {
+async function waitForBroker(timeoutMs = BROKER_READY_TIMEOUT_MS) {
   const start = Date.now();
   let interval = BROKER_POLL_INITIAL_INTERVAL_MS;
   while (Date.now() - start < timeoutMs) {
@@ -1742,8 +1794,9 @@ async function waitForBroker(timeoutMs = 5000) {
   throw new Error(`Broker failed to start within timeout
 ${describeBrokerLog()}`);
 }
-var INTERCOM_DIR, EXTENSION_DIR, BROKER_SOCKET2, BROKER_PID, BROKER_SPAWN_LOCK, BROKER_LOG, BROKER_LOG_TAIL_BYTES, BROKER_POLL_INITIAL_INTERVAL_MS = 10, BROKER_POLL_MAX_INTERVAL_MS = 100, INTERNAL_INTERCOM_BROKER_ARG = "--atomic-internal-intercom-broker";
+var INTERCOM_DIR, EXTENSION_DIR, BROKER_SOCKET2, BROKER_PID, BROKER_SPAWN_LOCK, BROKER_LOG, BROKER_LOG_TAIL_BYTES, BROKER_POLL_INITIAL_INTERVAL_MS = 10, BROKER_POLL_MAX_INTERVAL_MS = 100, BROKER_READY_TIMEOUT_MS = 5000, BROKER_SPAWN_LOCK_MAX_AGE_MS = 60000, INTERNAL_INTERCOM_BROKER_ARG = "--atomic-internal-intercom-broker";
 var init_spawn = __esm(() => {
+  init_socket_liveness();
   init_paths();
   INTERCOM_DIR = getIntercomDirPath();
   EXTENSION_DIR = resolveIntercomPackageRoot(import.meta.url);
@@ -6393,7 +6446,7 @@ __export(exports_index_heavy, {
   default: () => piIntercomExtension
 });
 import { APP_NAME, sessionScopedExtensionState } from "@bastani/atomic";
-import { appendFileSync } from "node:fs";
+import { appendFileSync as appendFileSync2 } from "node:fs";
 function isPendingStageUndeliverableEvent(value) {
   if (typeof value !== "object" || value === null)
     return false;
@@ -7352,7 +7405,7 @@ var init_index_heavy = __esm(() => {
     process.env.ATOMIC_INTERCOM_HEAVY_IMPORTED = "1";
   }
   if (process.env.ATOMIC_TEST_LAZY_IMPORT_SENTINEL_FILE) {
-    appendFileSync(process.env.ATOMIC_TEST_LAZY_IMPORT_SENTINEL_FILE, `intercom
+    appendFileSync2(process.env.ATOMIC_TEST_LAZY_IMPORT_SENTINEL_FILE, `intercom
 `);
   }
   INTERCOM_SESSION_ID_ENV = `${APP_NAME.toUpperCase()}_INTERCOM_SESSION_ID`;

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.28-alpha.4",
+  "version": "0.9.28",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.28] - 2026-10-08
+
+### Fixed
+
+- Fixed MCP OAuth dynamic registration omitting `application_type`, which caused redirect URI rejections on OpenID Connect servers ([#10493](https://github.com/earendil-works/pi/issues/10493)).
+
 ## [0.9.28-alpha.1] - 2026-10-05
 
 ### Fixed

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.28-alpha.4",
+  "version": "0.9.28",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.9.28] - 2026-10-08
+
+### Changed
+
+- Updated the bundled Cua Driver skill to upstream `cua-driver-rs-v0.34.0`, with focused runtime, workflow, and visual guides covering authorization, exact targets, observation, and outcome verification.
+
 ## [0.9.28-alpha.4] - 2026-10-07
 
 ### Changed

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.28-alpha.4",
+  "version": "0.9.28",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.28-alpha.4",
+  "version": "0.9.28",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [