@bastani/atomic 0.9.44-alpha.2 → 0.9.44-alpha.3

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [0.9.44-alpha.3] - 2026-10-25
+
+Chatty workflow swarms stay fast and their journals stay small, and Atomic picks up a round of dependency security fixes.
+
+- **Pattern sends at fan-out scale:** stages that message each other through `workflow:<rootRunId>/...` patterns no longer saturate the workflow host or time out their sends, so every send in a 150-child fan-out is delivered ([#3931](https://github.com/bastani-inc/atomic/issues/3931), [#3932](https://github.com/bastani-inc/atomic/pull/3932))
+- **Journals that grow with the work, not the message count:** journal events record only what changed in a run's pending messages instead of the whole list ([#3929](https://github.com/bastani-inc/atomic/issues/3929), [#3930](https://github.com/bastani-inc/atomic/pull/3930))
+- **Security updates:** `undici` 8.12.3, `zod` 4.6.7, `fast-uri` 3.1.9, `body-parser` 2.4.0 and `tokio` 1.54.1 close the published advisories against them ([#3935](https://github.com/bastani-inc/atomic/pull/3935))
+
+### Fixed
+
+- Updated `undici`, which Atomic uses for HTTP requests, to 8.12.3. A server can no longer crash Atomic by sending more than five `Content-Encoding` values ([GHSA-xjj6-f33q-929c](https://github.com/advisories/GHSA-xjj6-f33q-929c)), Server-Sent Events streams can no longer grow parser memory without bound ([GHSA-4qv8-2p9j-2685](https://github.com/advisories/GHSA-4qv8-2p9j-2685)), and Subresource Integrity checks no longer skip uppercase algorithm names ([GHSA-f72v-6w45-q472](https://github.com/advisories/GHSA-f72v-6w45-q472)).
+- Updated the MCP SDK dependencies in the published lockfile to `zod` 4.6.7 ([GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5)), `fast-uri` 3.1.9 ([GHSA-w74x-v6f9-j3xg](https://github.com/advisories/GHSA-w74x-v6f9-j3xg), [GHSA-wjr9-j795-jxcr](https://github.com/advisories/GHSA-wjr9-j795-jxcr), [GHSA-xhq7-xmqj-769h](https://github.com/advisories/GHSA-xhq7-xmqj-769h), [GHSA-333x-w4r6-6crp](https://github.com/advisories/GHSA-333x-w4r6-6crp)), and `body-parser` 2.4.0 ([GHSA-27r3-jxmh-p828](https://github.com/advisories/GHSA-27r3-jxmh-p828)).
+- Updated the native module's `tokio` crate to 1.54.1, replacing the yanked 1.54.0 release and its `Interval` race ([GHSA-5wjr-9356-4wc8](https://github.com/advisories/GHSA-5wjr-9356-4wc8)).
+- Updated the gondolin example extension's lockfile to `undici` 6.29.1, resolving [GHSA-xjj6-f33q-929c](https://github.com/advisories/GHSA-xjj6-f33q-929c) and [GHSA-4qv8-2p9j-2685](https://github.com/advisories/GHSA-4qv8-2p9j-2685) in its `@earendil-works/gondolin` dependency.
+
 ## [0.9.44-alpha.2] - 2026-10-24
 
 Workflow swarms now message each other without cancelling each other's work, and stages, replies and session exits behave reliably under fan-out.

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.44-alpha.3] - 2026-10-25
+
+### Fixed
+
+- Intercom `send` and `ask` to a workflow-stage target (`workflow:<rootRunId>/...`, including patterns) no longer fetch the whole session list before sending. The broker resolves those targets itself, so the extra request only added load, and when many stages sent at once some sends failed with `List sessions timeout` ([#3931](https://github.com/bastani-inc/atomic/issues/3931))
+- Receiving a large Intercom message (for example a big workflow roster) no longer copies its data again for every chunk that arrives, which made large frames cost quadratic time ([#3931](https://github.com/bastani-inc/atomic/issues/3931))
+
 ## [0.9.44-alpha.2] - 2026-10-24
 
 ### Changed

package/dist/builtin/intercom/broker/framing.ts

@@ -27,14 +27,31 @@ export function createMessageReader(
   onError: (error: Error) => void,
 ) {
   let buffer = Buffer.alloc(0);
+  // Chunks of a frame still arriving: joined once the frame is complete, not on every
+  // chunk, so a large frame costs linear rather than quadratic copying.
+  let pending: Buffer[] = [];
+  let pendingLength = 0;
+  let awaitedLength = 0;
 
   return (data: Buffer) => {
-    buffer = Buffer.concat([buffer, data]);
+    if (pendingLength + data.length < awaitedLength) {
+      pending.push(data);
+      pendingLength += data.length;
+      return;
+    }
+    buffer = pending.length === 0 ? Buffer.concat([buffer, data]) : Buffer.concat([...pending, data]);
+    pending = [];
+    pendingLength = 0;
+    awaitedLength = 0;
 
     while (buffer.length >= 4) {
       const length = buffer.readUInt32BE(0);
       
       if (buffer.length < 4 + length) {
+        pending = [buffer];
+        pendingLength = buffer.length;
+        awaitedLength = 4 + length;
+        buffer = Buffer.alloc(0);
         break;
       }
 

package/dist/builtin/intercom/index.bundle.mjs

@@ -565,11 +565,26 @@ function writeMessage(socket, msg, callback) {
 }
 function createMessageReader(onMessage, onError) {
   let buffer = Buffer.alloc(0);
+  let pending = [];
+  let pendingLength = 0;
+  let awaitedLength = 0;
   return (data) => {
-    buffer = Buffer.concat([buffer, data]);
+    if (pendingLength + data.length < awaitedLength) {
+      pending.push(data);
+      pendingLength += data.length;
+      return;
+    }
+    buffer = pending.length === 0 ? Buffer.concat([buffer, data]) : Buffer.concat([...pending, data]);
+    pending = [];
+    pendingLength = 0;
+    awaitedLength = 0;
     while (buffer.length >= 4) {
       const length = buffer.readUInt32BE(0);
       if (buffer.length < 4 + length) {
+        pending = [buffer];
+        pendingLength = buffer.length;
+        awaitedLength = 4 + length;
+        buffer = Buffer.alloc(0);
         break;
       }
       const payload = buffer.subarray(4, 4 + length);
@@ -4073,6 +4088,7 @@ function registerIntercomTool(pi, deps) {
   const retryIdentities = new RetryIdentityReservations({ maxEntries: deps.retryIdentityMaxEntries });
   const { childOrchestratorMetadata, ensureConnected, syncPresenceIdentity, beginReplyWait } = deps;
   const resolveTarget = deps.resolveSessionTarget ?? resolveSessionTargetId;
+  const resolveRecipient = async (client, target) => parseWorkflowStageTarget(target) === undefined ? await resolveTarget(client, target) ?? target : target;
   const getMetadata = typeof childOrchestratorMetadata === "function" ? childOrchestratorMetadata : () => childOrchestratorMetadata ?? null;
   const activeReplyTracker = () => typeof deps.replyTracker === "function" ? deps.replyTracker() : deps.replyTracker;
   pi.registerTool({
@@ -4440,7 +4456,7 @@ ${message}${attachmentText}`);
                   details: { error: true, delivered: false, reason: goneChild }
                 };
               }
-              const sendTo = await resolveTarget(connectedClient, to) ?? to;
+              const sendTo = await resolveRecipient(connectedClient, to);
               if (_signal?.aborted) {
                 const retained = retainInconclusiveRetry(retryIdentities, retryIdentity);
                 retryIdentity = undefined;
@@ -4614,8 +4630,7 @@ ${message}${attachmentText}`);
                   details: { error: true, delivered: false, reason: goneChild }
                 };
               }
-              const listedTarget = await resolveTarget(connectedClient, to);
-              const sendTo = listedTarget ?? to;
+              const sendTo = await resolveRecipient(connectedClient, to);
               if (_signal?.aborted) {
                 const retained = retryIdentity === undefined ? undefined : retainInconclusiveRetry(retryIdentities, retryIdentity);
                 retryIdentity = undefined;

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.44-alpha.2",
+  "version": "0.9.44-alpha.3",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.44-alpha.2",
+  "version": "0.9.44-alpha.3",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.44-alpha.2",
+  "version": "0.9.44-alpha.3",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [