@bastani/atomic 0.9.43-alpha.1 → 0.9.44-alpha.1

package/CHANGELOG.md

@@ -2,6 +2,51 @@
 
 ## [Unreleased]
 
+## [0.9.44-alpha.1] - 2026-10-24
+
+Large agent swarms and local workflow fan-outs now run without freezing the TUI or losing their Intercom routes, and background completion notices survive a restart.
+
+- **A responsive TUI under heavy fan-out:** local worker pools run under their own coordinator process, journals no longer grow on every heartbeat, and `/workflow status` and resume handle roots whose children failed or were skipped ([#3905](https://github.com/bastani-inc/atomic/pull/3905))
+- **Intercom that keeps working during fan-out:** pooled stages wait for their run's route instead of failing with `Live workflow-stage route has no registered workflow owner`, all runs of one invocation share one broker connection, and a refused route no longer drops the other runs' routes ([#3907](https://github.com/bastani-inc/atomic/pull/3907), [#3915](https://github.com/bastani-inc/atomic/pull/3915))
+- **Peer-to-peer swarms by default:** subagents and workflow stages talk to each other directly, subagent `parallel.*` limits and workflow `defaultConcurrency` default to 1000, and workflow `maxDepth` now defaults to 3; set them lower to throttle ([#3912](https://github.com/bastani-inc/atomic/pull/3912))
+- **Completion notices after a restart:** background subagent and shell completions reach the parent conversation after a session resumes in a new process ([#3909](https://github.com/bastani-inc/atomic/pull/3909))
+- **Faster large tool calls:** streamed tool-call arguments are parsed once per delta, so large `write` calls no longer cost quadratic CPU and memory or re-render on every delta ([#3910](https://github.com/bastani-inc/atomic/pull/3910))
+- **Sturdier startup and providers:** Atomic starts when a configured package fails to install, Claude effort limits, Kimi K3.1 Pro, and Gemini `const` schemas work, and MCP sign-in accepts only `http:` and `https:` OAuth URLs ([#3910](https://github.com/bastani-inc/atomic/pull/3910))
+- **Cua Driver approves its own permission prompts on macOS:** the agent clicks Cua Driver's Accessibility and Screen Recording prompts itself when VNC credentials are available; set `ATOMIC_CUA_AUTO_APPROVE=0` to keep asking you ([#3911](https://github.com/bastani-inc/atomic/pull/3911))
+
+**Breaking change:** `appendGrammarToolInputJsonDelta()` in `@bastani/pi-ai` now takes only the new input delta and no longer closes the input; call `closeGrammarToolInputJson()` when the input is complete ([#3910](https://github.com/bastani-inc/atomic/pull/3910))
+
+### Added
+
+- `/model` and `/scoped-models` now show a model's name next to its ID when the name adds words the ID lacks, such as a renamed `models.json` override ([pi #5916](https://github.com/earendil-works/pi/issues/5916), [pi #11347](https://github.com/earendil-works/pi/pull/11347))
+
+### Fixed
+
+- Fixed background subagent and shell completion notices never reaching the parent conversation after the session was restarted or resumed in a new process: the new process numbers its tasks from the start again, so a completion matched an earlier one already acknowledged in the session history and was silently dropped. Each completion now carries an identity unique to its process generation, and every settled task still delivers exactly one notice ([#3908](https://github.com/bastani-inc/atomic/issues/3908))
+- Atomic now starts when a package configured in `settings.json` fails to install (for example when npm cannot reach the registry), instead of crashing with an uncaught error. It skips that package, warns with the `atomic remove` command that drops it (`--local` for project packages), and tries again on the next start or `/reload`. `--help`, `--list-models` and `atomic config` show the warning too ([pi #11088](https://github.com/earendil-works/pi/issues/11088))
+- `pi.exec()` no longer corrupts multi-byte UTF-8 characters split across output chunks, which came back as `�` replacement characters ([pi #11312](https://github.com/earendil-works/pi/issues/11312))
+- Automatic `fd` and `rg` downloads no longer fetch x86-64 binaries on ARM32 and other architectures without a prebuilt release. Atomic now warns and recommends installing the tool with the system package manager ([pi #11209](https://github.com/earendil-works/pi/issues/11209))
+- Streamed tool calls no longer re-run their call renderer on every argument delta; the interactive mode renders the latest arguments once per frame, so a large streamed `write` no longer re-highlights its whole content per delta ([pi #9265](https://github.com/earendil-works/pi/issues/9265))
+
+## [0.9.43] - 2026-10-24
+
+Local workflow worker pools now survive slow, busy, and crashed workers, and large workflow journals open without running out of memory.
+
+- **Pools that recover instead of failing:** a worker that dies mid-run is replaced and its child replays from the last checkpoint instead of crashing the root with `EPIPE`, a resumed root releases children leased to workers that died with the host, unconfirmed worker exits are retried rather than failing every waiting child, and a replayed child no longer leaves an `Intercom event relay failed` error in the session ([#3891](https://github.com/bastani-inc/atomic/pull/3891), [#3893](https://github.com/bastani-inc/atomic/pull/3893), [#3895](https://github.com/bastani-inc/atomic/pull/3895))
+- **Leases that follow worker liveness:** a busy root no longer fences healthy workers with `Stale work lease`, and the new `workflows.localWorkers.leaseMs` setting controls how long an unresponsive worker keeps its child (30000 ms by default) ([#3894](https://github.com/bastani-inc/atomic/pull/3894))
+- **Retry decisions you can make in code:** `WorkflowInfrastructureError` and `isRetryableWorkflowError` tell retryable pool and runtime faults apart from failures of a child's own logic ([#3895](https://github.com/bastani-inc/atomic/pull/3895))
+- **Faster startup on long journals:** workers become ready without reading the whole journal, the readiness timeout is configurable with `workflows.localWorkers.startupTimeoutMs`, and sessions, `/workflow status`, and the `/workflow resume` picker read each run's latest state instead of every event, so large journals no longer exhaust the heap ([#3891](https://github.com/bastani-inc/atomic/pull/3891), [#3896](https://github.com/bastani-inc/atomic/pull/3896))
+- **Easier worker diagnosis:** each worker's standard error is kept under `worker-logs/` next to the journal, and startup and retry-limit errors name the log file and show the end of its output ([#3891](https://github.com/bastani-inc/atomic/pull/3891))
+
+### Added
+
+- Added `WorkflowInfrastructureError` and `isRetryableWorkflowError` to `@bastani/atomic/workflows`, so workflows can tell local worker pool and runtime faults (which are safe to retry) from failures of a child workflow's own logic ([#3889](https://github.com/bastani-inc/atomic/issues/3889))
+- Added the `workflows.localWorkers.leaseMs` setting: how long, in milliseconds, a local workflow worker that is still running but has stopped responding keeps its child before the child is replayed on another worker (30000 by default, at least 2000) ([#3888](https://github.com/bastani-inc/atomic/issues/3888))
+
+### Fixed
+
+- Local workflow worker pools no longer fail with `Local worker startup timed out` when workers are slow to become ready, for example on a workflow journal with a long history. The readiness timeout is now configurable with the `workflows.localWorkers.startupTimeoutMs` setting (30000 ms by default) ([#3887](https://github.com/bastani-inc/atomic/issues/3887))
+
 ## [0.9.43-alpha.1] - 2026-10-24
 
 Local workflow worker pools now survive slow, busy, and crashed workers, and large workflow journals open without running out of memory.

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.44-alpha.1] - 2026-10-24
+
+### Changed
+
+- The `intercom` skill now presents unlimited peer-to-peer (swarm) coordination as the default, with a broadcast example and guidance for agents to discover and talk to peers proactively. It also covers scaling a swarm to hundreds or thousands of agents organized into teams.
+
+### Fixed
+
+- Workflow stages that start while their run's Intercom route is still registering, or is registering again after its connection dropped, no longer fail every Intercom call with `Live workflow-stage route has no registered workflow owner`. The stage waits for the route to come back before it uses Intercom, instead of giving up after a few quick retries ([#3904](https://github.com/bastani-inc/atomic/issues/3904))
+- Workflow route owners now register the routes of every run in a workflow invocation over one broker connection instead of opening one connection per run. The connection is per workflow invocation rather than per host because the broker grants route ownership per invocation group. All child runs of one root share that connection, whatever the fan-out size, so a large fan-out of child workflows no longer builds a connection backlog at the broker, and a run whose route moves to a new capability keeps the connection the other runs use. A run whose route the broker refuses moves to a connection of its own, so it cannot take the other runs' routes down with it. Only refused runs get such a connection, so the number of extra connections is bounded by the refused runs, not by the number of runs ([#3904](https://github.com/bastani-inc/atomic/issues/3904))
+- When the Intercom broker refuses one workflow run's route, for example a route that another session owns, it now refuses that route on its own and keeps the shared route connection open, so the routes of the other runs in the same workflow invocation are no longer dropped for a reconnect. Authorization is unchanged: the same registrations are refused for the same reasons. The route owner retries only the refused run, on its own backoff. With an older broker, which still ends the connection, the refused run still moves to a connection of its own. Clients that do not ask for this, including older ones, keep the previous behavior ([#3906](https://github.com/bastani-inc/atomic/issues/3906))
+
+## [0.9.43] - 2026-10-24
+
+### Fixed
+
+- Fixed `Intercom event relay failed (atomic:workflow-pending-stage-route): Intercom runtime no longer active` appearing in the session after a local workflow worker died and its child was replayed. Route updates that arrive while a run's previous route connection is still closing or opening, as they do when the run's route is replaced, no longer race each other: the newest route is registered over one connection and an update the replacement made obsolete ends quietly. A route connection abandoned because the session itself shut down is still reported ([#3887](https://github.com/bastani-inc/atomic/issues/3887))
+
 ## [0.9.43-alpha.1] - 2026-10-24
 
 ### Fixed

package/dist/builtin/intercom/broker/broker.ts

@@ -38,6 +38,7 @@ import type {
 	WorkflowPossibleStageAnnouncement,
 	WorkflowFutureStageRosterEntry,
 	WorkflowRunParentAnnouncement,
+	PendingStageRouteRefusalCode,
 } from "../types.js";
 import {
 	formatWorkflowStageTarget,
@@ -1622,6 +1623,7 @@ class IntercomBroker {
             ...(supervisorId ? { supervisorSessionId: supervisorId } : {}),
             ...(clientMessage.acknowledgesReceipt === true ? { acknowledgesReceipt: true as const } : {}),
             acknowledgesPendingStageRoutes: true as const,
+            refusesPendingStageRoutesInPlace: true as const,
             brokerStatus: true as const,
           });
           if (isAgentRecipient(info)) this.broadcastToMemberships({ type: "session_joined", session: info }, sessionGroups(info), id);
@@ -1833,6 +1835,28 @@ class IntercomBroker {
             writeMessageIfOpen(socket, { type: "pending_stage_route_registered", requestId: routeRequestId });
           }
         };
+        // #3906: a client whose connection carries the routes of many runs asks for a refusal of one of them to be
+        // answered on its own. Authorization is the same either way; only whether the refusal ends the connection differs.
+        const refusesInPlace = routeRequestId !== undefined && clientMessage.refusalKeepsConnection === true;
+        // #3904: the refusal names the registration it answers, so a connection carrying many runs' routes knows which one.
+        const refuseRoute = (code: PendingStageRouteRefusalCode, reason: string): void => {
+          if (refusesInPlace) {
+            writeMessageIfOpen(socket, {
+              type: "pending_stage_route_refused",
+              requestId: routeRequestId,
+              runId: clientMessage.runId,
+              code,
+              reason,
+            });
+            return;
+          }
+          writeMessageIfOpen(socket, {
+            type: "registration_failed",
+            reason,
+            ...(routeRequestId === undefined ? {} : { requestId: routeRequestId }),
+          });
+          this.endRefusedConnection(socket, currentId, setId);
+        };
         const owner = this.sessions.get(currentId);
         const existing = this.pendingStageRoutes.get(clientMessage.runId);
         const ownerGroup = normalizeGroup(owner?.registrationGroup);
@@ -1851,14 +1875,16 @@ class IntercomBroker {
             ? liveExisting
             : undefined;
         const activeExisting = yieldedDormant === undefined ? liveExisting : undefined;
+        // #3904: the owning session may move its own route to a new capability. One connection carries
+        // the routes of many runs, so refusing a rotation would end the connection and drop all of them.
         if (
           owner === undefined ||
           normalizeGroup(clientMessage.group) !== ownerGroup ||
           (activeExisting !== undefined &&
-            (activeExisting.capability !== clientMessage.capability || activeExisting.group !== ownerGroup))
+            (activeExisting.group !== ownerGroup ||
+              (activeExisting.capability !== clientMessage.capability && activeExisting.sessionId !== currentId)))
         ) {
-          writeMessageIfOpen(socket, { type: "registration_failed", reason: "Pending-stage route is not authorized" });
-          this.endRefusedConnection(socket, currentId, setId);
+          refuseRoute("not_authorized", "Pending-stage route is not authorized");
           return;
         }
         if (
@@ -1870,8 +1896,7 @@ class IntercomBroker {
           ) ||
             !clientMessage.stages.every((stage) => invocationOwnsGroup(ownerGroup, stage.group)))
         ) {
-          writeMessageIfOpen(socket, { type: "registration_failed", reason: "Invalid workflow-stage roster" });
-          this.endRefusedConnection(socket, currentId, setId);
+          refuseRoute("invalid_stage_roster", "Invalid workflow-stage roster");
           return;
         }
         if (
@@ -1882,8 +1907,7 @@ class IntercomBroker {
             normalizeGroup(clientMessage.group),
           )
         ) {
-          writeMessageIfOpen(socket, { type: "registration_failed", reason: "Invalid workflow possible-stage roster" });
-          this.endRefusedConnection(socket, currentId, setId);
+          refuseRoute("invalid_possible_stage_roster", "Invalid workflow possible-stage roster");
           return;
         }
         // D7 (slice 4): presence replaces, absence keeps — a terminal root publishes `[]`

package/dist/builtin/intercom/broker/client.ts

@@ -17,6 +17,7 @@ import type {
 	WorkflowFutureStageRosterEntry,
 	WorkflowPossibleStageAnnouncement,
 	WorkflowRunParentAnnouncement,
+	PendingStageRouteRefusalCode,
 } from "../types.js";
 import { buildSendSignature, PendingSendRegistry, PendingSendTimeoutError } from "./pending-send-registry.js";
 import { readSubagentMessageSource } from "../source-ownership.js";
@@ -61,6 +62,11 @@ export interface IntercomClientOptions {
 	readonly acknowledgesReceipt?: true;
 	/** Registration answer bound for `connect()`; defaults to `BROKER_CONNECT_TIMEOUT_MS`. */
 	readonly connectTimeoutMs?: number;
+	/**
+	 * #3906: this connection carries the pending-stage routes of many runs, so it asks a broker that supports it to
+	 * refuse one run's route on its own and keep the connection open for the others.
+	 */
+	readonly multiplexesPendingStageRoutes?: true;
 }
 
 export interface SendResult {
@@ -168,6 +174,28 @@ function isWorkflowStageRosterEntries(value: unknown): value is WorkflowStageRos
 	);
 }
 
+/** The broker refused this pending-stage route registration itself, not the connection it was sent on (#3904). */
+export class IntercomPendingStageRouteRefusedError extends Error {
+	/**
+	 * #3906: the broker answered this refusal on its own and kept the connection, with the route of every other run on
+	 * it. When false, the broker (an older one) ended the connection with the refusal.
+	 */
+	readonly connectionKept: boolean;
+	readonly code: PendingStageRouteRefusalCode | undefined;
+	constructor(reason: string, refusal: { readonly connectionKept: boolean; readonly code?: PendingStageRouteRefusalCode } = { connectionKept: false }) {
+		super(reason);
+		this.name = "IntercomPendingStageRouteRefusedError";
+		this.connectionKept = refusal.connectionKept;
+		this.code = refusal.code;
+	}
+}
+
+const PENDING_STAGE_ROUTE_REFUSAL_CODES: ReadonlySet<string> = new Set<PendingStageRouteRefusalCode>([
+	"not_authorized",
+	"invalid_stage_roster",
+	"invalid_possible_stage_roster",
+]);
+
 export class IntercomClient extends EventEmitter {
 	private readonly returnAddress: string;
 	private readonly preferredSessionId: string | undefined;
@@ -177,6 +205,9 @@ export class IntercomClient extends EventEmitter {
 	private brokerAcknowledgesReceipt = false;
 	/** The broker of the current registration answers a pending-stage route registration that carries a `requestId`. */
 	private brokerAcknowledgesPendingStageRoutes = false;
+	private readonly multiplexesPendingStageRoutes: boolean;
+	/** #3906: the broker of the current registration refuses a pending-stage route without ending the connection. */
+	private brokerRefusesPendingStageRoutesInPlace = false;
 	private brokerAnswersStatus = false;
   private socket: net.Socket | null = null;
   private _sessionId: string | null = null;
@@ -251,6 +282,7 @@ export class IntercomClient extends EventEmitter {
 		this.preferredSessionId = options.preferredSessionId;
 		this.acknowledgesReceipt = options.acknowledgesReceipt === true;
 		this.connectTimeoutMs = options.connectTimeoutMs ?? BROKER_CONNECT_TIMEOUT_MS;
+		this.multiplexesPendingStageRoutes = options.multiplexesPendingStageRoutes === true;
 	}
 
   private failPending(error: Error): void {
@@ -376,6 +408,7 @@ export class IntercomClient extends EventEmitter {
         this._supervisorSessionId = null;
         this.brokerAcknowledgesReceipt = false;
         this.brokerAcknowledgesPendingStageRoutes = false;
+        this.brokerRefusesPendingStageRoutesInPlace = false;
         this.brokerAnswersStatus = false;
         this._messageSource = undefined;
         this.disconnectError = null;
@@ -486,6 +519,7 @@ export class IntercomClient extends EventEmitter {
           || (brokerMessage.supervisorSessionId !== undefined && typeof brokerMessage.supervisorSessionId !== "string")
           || (brokerMessage.acknowledgesReceipt !== undefined && brokerMessage.acknowledgesReceipt !== true)
           || (brokerMessage.acknowledgesPendingStageRoutes !== undefined && brokerMessage.acknowledgesPendingStageRoutes !== true)
+          || (brokerMessage.refusesPendingStageRoutesInPlace !== undefined && brokerMessage.refusesPendingStageRoutesInPlace !== true)
           || (brokerMessage.brokerStatus !== undefined && brokerMessage.brokerStatus !== true)) {
           throw new Error("Invalid registered message");
         }
@@ -500,6 +534,7 @@ export class IntercomClient extends EventEmitter {
         // #3761: a broker from before receipts never echoes the capability and drops a client that sends `received`.
         this.brokerAcknowledgesReceipt = this.acknowledgesReceipt && brokerMessage.acknowledgesReceipt === true;
         this.brokerAcknowledgesPendingStageRoutes = brokerMessage.acknowledgesPendingStageRoutes === true;
+        this.brokerRefusesPendingStageRoutesInPlace = brokerMessage.refusesPendingStageRoutesInPlace === true;
         this.brokerAnswersStatus = brokerMessage.brokerStatus === true;
         this.emit("_registered", { type: "registered", sessionId: brokerMessage.sessionId });
         break;
@@ -528,6 +563,12 @@ export class IntercomClient extends EventEmitter {
         // disconnect cause, settle outstanding work with it, and destroy the socket
         // so no new work is accepted while we wait for the peer FIN. `onClose`
         // still owns session/socket teardown and the `disconnected` emission.
+        const refusedRouteId = typeof brokerMessage.requestId === "string" ? brokerMessage.requestId : "";
+        const refusedRoute = this.pendingStageRouteRegistrations.get(refusedRouteId);
+        if (refusedRoute !== undefined) {
+          this.pendingStageRouteRegistrations.delete(refusedRouteId);
+          refusedRoute.reject(new IntercomPendingStageRouteRefusedError(brokerMessage.reason));
+        }
         this.disconnectError ??= refusal;
         this.failPending(this.disconnectError);
         this.socket?.destroy();
@@ -679,6 +720,27 @@ export class IntercomClient extends EventEmitter {
 			this.emit("pending_stage_route_revoked", { runId });
 			break;
 		}
+      case "pending_stage_route_refused": {
+        const { requestId, runId, code, reason } = brokerMessage;
+        if (
+          typeof requestId !== "string" ||
+          typeof runId !== "string" ||
+          typeof reason !== "string" ||
+          typeof code !== "string"
+        ) {
+          throw new Error("Invalid pending-stage route refusal");
+        }
+        const pending = this.pendingStageRouteRegistrations.get(requestId);
+        if (!pending) return;
+        this.pendingStageRouteRegistrations.delete(requestId);
+        pending.reject(
+          new IntercomPendingStageRouteRefusedError(reason, {
+            connectionKept: true,
+            ...(PENDING_STAGE_ROUTE_REFUSAL_CODES.has(code) ? { code: code as PendingStageRouteRefusalCode } : {}),
+          }),
+        );
+        break;
+      }
       case "pending_stage_route_registered": {
         const { requestId } = brokerMessage;
         if (typeof requestId !== "string") throw new Error("Invalid pending-stage route registration acknowledgement");
@@ -1197,6 +1259,9 @@ export class IntercomClient extends EventEmitter {
 					possibleStages,
 					...(parent === undefined ? {} : { parent }),
 					...(dormant === true ? { dormant: true as const } : {}),
+					...(this.multiplexesPendingStageRoutes && this.brokerRefusesPendingStageRoutesInPlace
+						? { refusalKeepsConnection: true as const }
+						: {}),
 				});
 			} catch (error) {
 				clearTimeout(timeout);