@bastani/atomic 0.9.5-alpha.9 → 0.9.6-alpha.1

package/CHANGELOG.md

@@ -2,6 +2,120 @@
 
 ## [Unreleased]
 
+## [0.9.6-alpha.1] - 2026-07-12
+
+### Changed
+
+- Restored workflow-first Atomic guidance for non-trivial work with verifiable objectives and synchronized help/docs around rich inline TypeScript workflow authoring, including dynamic branching, fan-out, verification, candidate-selection, human-gate, child-workflow, and bounded-loop patterns.
+- Documented compositional workflow authoring in model prompts and onboarding/help surfaces, including importing bundled workflows from `@bastani/workflows/builtin`, nesting definitions with `ctx.workflow(...)`, and building deeper reusable workflow graphs within `maxDepth`.
+- Restored tool-driven bundled Intercom startup so foreground subagent launches and bridged child session startup no longer connect either session automatically; the model or user must invoke Intercom when coordination is needed.
+
+## [0.9.5] - 2026-07-11
+
+### Breaking Changes
+
+- Hardened the builtin `goal` and `ralph` review contracts against objective-drift failures: review findings now require `objective_alignment`, Goal and Ralph review decisions require `requirements_traceability`, and reviewer approval rejects empty or non-proven traceability. Consumers that parse or synthesize these structured reviewer outputs must emit the new required fields.
+
+### Added
+
+- Added model-capability-aware `max` thinking support across the CLI, settings, SDK/RPC/extension surfaces, Cursor model mapping, workflow stages, and bundled subagents; models still expose only the levels in their own capability maps ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Added request-wide `cost.tiers` support for custom `models.json` models, partial `modelOverrides`, and extension-registered providers, including complete tier validation, aggregate-input threshold selection, inherited-tier preservation for scalar overrides, and explicit tier-array replacement/clearing ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Added main-chat `fallbackModels` support for retryable provider/model failures ([#1418](https://github.com/bastani-inc/atomic/issues/1418)). Users can configure an ordered fallback chain in settings or SDK session options with per-candidate reasoning suffixes such as `:high` and `:xhigh`; normal same-model retry remains first when enabled, fallback switches are recorded as session model changes, and the UI reports fallback progress.
+- Added an internal tiered fallback ladder for automatic Verbatim Compaction when the strict `compression_ratio` target is not achievable: threshold and overflow auto-compaction now keep the standard strict planner pass as tier 1, tier 2 can accept a validated below-target result with at least one deletion when projected `tokensAfter` clears the relevant budget (`effectiveInputBudget - reserveTokens` for threshold, effective input budget for overflow), overflow commits from Atomic's internal ladder are gated on fitting the effective input budget even when the strict target is met, overflow-only tier 3 reruns the planner with critical LRU-style protected-entry eligibility for stale task-bearing user/custom/branch-summary context and an effective recent floor of `max(preserve_recent, 5)` across all compactable entries, and overflow-only tier 4 performs deterministic code-level LRU eviction without a model call or API credentials while enforcing the same effective last-5 recent floor until the effective input budget fits or no more safe deletion remains. The fallback tiers remain internal: extension hooks keep their existing shapes, extension-provided deletion requests still bypass the ladder including the overflow budget gate, and no public compaction mode API is exposed.
+- Added hard iteration caps to compaction recovery loops: planner provider turns are capped at 50 per planner run (including tool-call turns), planner nudge follow-ups are capped at 50 per planner run, and deterministic overflow eviction is capped at 50 passes, so compaction cannot spin indefinitely and terminal failures report the achieved reduction, deletion count, projected `tokensAfter`, and budget.
+- Added immutable `acceptance_criteria` to the builtin `goal` and `ralph` workflows. Goal persists it in the ledger/model-visible projection and final reports; Ralph threads it through research, orchestrator, and reviewer prompts next to the literal objective contract. Orchestrators should pass the original task text when launching follow-up Goal or Ralph runs from reviewer findings.
+- Added literal-contract prompt language shared by `goal` and `ralph`, objective-alignment arbitration for reviewer findings, non-blocking treatment for `beyond_objective`/`contradicts_objective` findings, and clause-by-clause requirements traceability so reviewer evidence must map directly back to the objective/acceptance criteria.
+- Added attempt-first E2E guidance for `goal` and `ralph`: workers/reviewers must not skip playwright-cli/tmux validation because credentials or auth are merely assumed missing, and skipped E2E must cite the exact attempted commands and observed failure output.
+
+### Changed
+
+- Synced the upstream Pi runtime dependencies (`@earendil-works/pi-agent-core`, `pi-ai`, and `pi-tui`) through `^0.80.6` across Atomic and bundled extensions, retained the same consolidated refresh's `lru-cache`, optional `@dbos-inc/dbos-sdk`, `napi`, `napi-derive`, and `tree-sitter` updates, regenerated Bun/Cargo/npm shrinkwrap metadata with mutually consistent 0.80.6 registry integrity, and kept versionless `0.0.0` Atomic manifests. This inherits signed empty Anthropic thinking preservation, request-wide GPT-5.4/5.5 long-context pricing, corrected GPT-5.6 catalogs/backend windows, and upstream retry/provider fixes while preserving Atomic's Copilot/Gemini behavior ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Replaced universal workflow/subagent routing with an intent-first least-orchestration policy across model guidance, help, and documentation. Interactive exploration stays inline, bounded specialist work may use single/chain/parallel subagents, and clearly delegated long-running autonomous work uses named, direct-shape, or custom inline TypeScript workflows when durable execution features add value. Explicit loop and stop-condition requests remain key workflow signals when the user delegates execution, so retries, evidence, and convergence are tracked.
+- Explicit bash timeouts now fail before execution when non-finite, non-positive, or greater than Atomic's 3600-second ceiling; omitting the field still uses 300 seconds, and valid fractional values retain Atomic's floor behavior instead of being silently clamped into range ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Changed the bundled `ralph` workflow review fan-out from three reviewers to two (`reviewer-a` and `reviewer-b`), removing `reviewer-c` and its GLM-led model chain while keeping unanimous approval across the remaining reviewers.
+- Improved interactive startup responsiveness by keeping footer git watcher setup out of first paint and deferring it until the first input handler is ready, while preserving lazy footer branch reads and post-frame branch-change re-rendering. Deferred extension/resource loading no longer starts on a blind post-paint timer that can freeze live typing; instead, Atomic starts it in the background once input is ready and uses a readiness gate before the first normal prompt/model turn if the background load has not settled. This keeps first-paint/typeahead responsive while ensuring the first interactive prompt sees extension tools, skills, prompt templates, resources, and extension-registered provider/model updates. Built-in slash commands stay available immediately, and bundled extension slash commands expose lightweight metadata for autocomplete before their heavy implementations load; explicitly submitted extension slash commands load the implementation on demand and then route the same command. Explicit provider/model selections stay on the synchronous startup path because they must resolve against extension-registered providers before the session is created. Changelog and first-run notice materialization now happen after the first frame, and startup/input timing probes cover raw-mode enablement, first captured raw key, first frame, input-handler callback installation, and first submit for benchmark/probe runs.
+- Documented the built-in extension lazy-startup model: lightweight tools/commands register immediately while MCP connection warmup, workflow discovery, subagent maintenance, and web-access heavy provider loading run in the background or on explicit use.
+- Changed interactive Ctrl+C to interrupt the agent when it is busy: a single Ctrl+C now aborts the running agent turn (restoring queued messages to the editor), a running bash command, an active context compaction, or an auto-retry countdown — matching Escape and common CLI muscle memory. When idle, Ctrl+C keeps its previous behavior (first press clears the editor, a quick double-press exits), and the Ctrl+C immediately following an interrupt clears rather than exits. Escape remains the primary interrupt key.
+- Simplified first-run onboarding to a one-time verifiable-coding-agent-runtime explanation shown after any What's New notes and directly above the normal input box; Atomic no longer intercepts pasted tasks, saves pre-login seeds, routes first-run input to `goal`/`ralph`, raises reasoning for onboarding, or requires `/chat` to continue normally. The notice now reminds unauthenticated users to run `/login` first, and starting a new session with `/new` clears any rendered first-run notice state from the previous session canvas.
+- Hardened the bundled workflows extension's workflow-tool prompt guidance against inline analysis-paralysis drift: the agent must now decide and state the inline-vs-workflow execution mode before its first tool call (reconnaissance explicitly counts as inline execution), budget pre-workflow scoping to a few quick reads that only sharpen the objective and validation criteria, course-correct after roughly ten deliverable-free exploration tool calls (or repeated "let me verify one more thing" loops) by writing findings to a context file and handing off to the best-fit workflow via `reads` (named or user-defined workflows discovered with `action: "list"` first, builtin `goal`/`ralph` as fallbacks when nothing more specific fits), and treat sunk inline research as transferable via files rather than a reason to stay inline. The same "Decide before you explore" and "Course-correct instead of drifting" guidance is mirrored in `docs/workflows.md` under "When to Use Workflows".
+- Refreshed the July 2026 builtin workflow and subagent frontier model rosters bundled with Atomic: high-capacity synthesis, planning, debugging, and review paths now lead or fall back through Claude Fable 5 `:xhigh`, GPT-5.5 `:xhigh`, Opus 4.8 long-context `:xhigh`, GLM-5.2, and the valid OpenRouter Fugu Ultra mirror while keeping dominated or unsupported model IDs out of shipped chains.
+
+### Fixed
+
+- Fixed CLI resolution of unknown/custom model IDs with a recognized `:<thinking>` suffix so the suffix is applied as the thinking level instead of leaking into the synthesized model ID, while preserving registered and unrecognized colon-bearing model IDs.
+- Fixed bundled MCP readiness so failed background initialization is retryable and single-flight within the active session, stale retries cannot publish after shutdown, replacement startup waits for retired initializer/state/OAuth cleanup, and proxy/direct readiness plus lazy-connection and OAuth waits use caller-local cancellation without stopping shared producers. Direct executors reject old-state work on success and failure paths after replacement and close stale newly opened Apps views, SDK resource/tool requests receive the invocation signal, and UI-backed MCP Apps calls emit one terminal cancellation before teardown while preserving the exact host reason over SDK/notification failures.
+- Fixed bundled web-access and Intercom lazy wrappers to retire session-scoped candidates on shutdown, reject calls spanning teardown, and initialize fresh state after restart; host cancellation after web provider/curator execution now preserves its exact abort reason while explicit curator user cancellation remains a normal result.
+- Fixed bundled web-access lazy tools failing during native Bun heavy-module loading by resolving compatibility helpers from the canonical installed `@earendil-works/pi-ai/compat` package ([#1728](https://github.com/bastani-inc/atomic/issues/1728)).
+- Fixed stale pre-compaction usage estimates after a newer inserted prefix, normalized lax null or omitted content at extension, custom-message, and restored-session boundaries, and kept Atomic's Verbatim Compaction custom-message budgeting semantics intact ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed `models.json` `modelOverrides` so matching extension-registered provider models receive configured names, thinking maps, compatibility fields, context settings, and merged headers without replacing Atomic's dynamic Copilot/context-window behavior; normal CLI startup now loads layered legacy `.pi` and primary `.atomic` files, disjoint provider/model entries survive, and an exact primary entry replaces the complete legacy override with source-correct header precedence and `{}` restoration of built-in values ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed project context traversal at Windows drive roots, surfaced credential persistence failures without mutating in-memory auth first, skipped unauthenticated saved defaults, preserved missing saved IDs for authenticated custom OpenAI-compatible providers, prevented removed static catalog model IDs from being synthesized during session restore, and cleared cached label timestamps when starting a new session ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed missing exact `--session-id` handling to warn before creating the requested session, ignored rapid duplicate fork-menu selections, and kept visible custom messages emitted during streaming ordered before the live assistant row ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed standalone clipboard image support by falling back to xclip after an empty native result and packaging each matching 0.3.9 native binding beside the wrapper in Atomic's split binary archives; caller-relative `TMPDIR` values are canonicalized before directory changes, and `--skip-deps` tolerates an absent optional clipboard wrapper while strict release builds remain loud ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed Anthropic/GitHub Copilot signed-thinking replay after Verbatim Compaction by validating provider-visible logical assistant tool-use turns instead of isolated messages: the current final turn retains every `thinking`/`redacted_thinking` entry, completed historical turns retain all or omit all signed entries, complete grep batches and deterministic overflow eviction use the same invariant, and unsafe persisted plans heal in memory with exact retained blocks, signatures, and paired tool results restored without rewriting session JSONL. Provider-visible user/custom inputs, included bash executions, and non-empty branch summaries establish boundaries, task anchors, recent windows, and finite transcript token totals; provider-omitted empty or whitespace-only user/custom inputs and empty or malformed branch summaries do not, while whitespace-only branch summaries remain visible through their wrapper. Raw block visibility is retained separately from transcript display projections, future unknown typed blocks fail visible with a conservative token estimate, malformed siblings are transiently filtered before provider calls, and stale user-image deletion cannot remove the final provider-visible task. Raw `redacted_thinking` blocks are normalized in the transient, non-mutating LLM-compatible messages returned by `convertToLlm`, so retained opaque data serializes exactly without mutating durable history.
+- Fixed bundled foreground subagent coordination so `intercom.ask` and `contact_supervisor need_decision` surface while the parent tool is active, detach only their exact child, resume through threaded replies, and expose the retained detached-to-terminal child status and actual output through public status queries; progress/send and background execution remain nonblocking and unchanged ([#1727](https://github.com/bastani-inc/atomic/issues/1727)).
+- Register bridged foreground/background children with bundled Intercom before agent work and lazily gate interactive foreground launches on parent broker readiness, while disabled, unavailable, unused-parent, and management-only paths remain lazy and broker-free.
+- Fixed Windows native filesystem watchers to canonicalize watched paths before calling `fs.watch`, reject unresolved 8.3 short-name paths, and fall back to polling for unsafe watcher paths. This prevents libuv fs-event assertion crashes when temp, session, footer, or theme paths contain short-name components such as `USERNA~1`.
+- Fixed responses truncated at the output-token cap (`stopReason: "length"`) dead-ending the model's work with a "maximum output token limit" error when the context was still below the auto-compaction threshold. Previously auto-continuation only happened as a side effect of threshold compaction, so a length truncation with input room to spare left the task half-finished. Length-truncated turns now continue directly without compacting: the incomplete assistant is removed from retry context and the generation resumes automatically so the model finishes where it left off, bounded by a small consecutive-continuation cap so a turn that keeps exceeding the per-turn output cap still terminates. Compaction-driven `willRetry: true` continuations are now consistently tracked through the normal prompt lifecycle, so `AgentSession.prompt()` waits for threshold length-stop continuation before resolving instead of treating it as fire-and-forget.
+- Fixed auto-compaction after OpenAI Responses output-budget underflow errors such as `Invalid 'max_output_tokens': integer below minimum value. Expected a value >= 16, but got 1 instead.` Atomic now classifies that specific context-pressure failure as retry-worthy when the live context crosses the compaction threshold, removes the empty error assistant from retry context after compaction, and automatically continues from the preceding work anchor instead of waiting for the user to type `Continue`. Generic `invalid_request_body` errors such as malformed tool schemas are still not auto-retried, OpenAI Responses payload sanitization now prevents `max_output_tokens` values below the provider minimum of 16 from being sent, and repeated output-budget underflow continuation is capped at one compact-and-retry attempt so an unrecoverable context terminates visibly instead of looping or stalling.
+- Fixed bundled workflow durable resume for reusable `git_worktree_dir` worktrees so resumed runs reuse the original invocation repository/cwd and report slow Git subprocess timeouts as Git timeouts instead of repository-detection failures.
+- Removed the queued-message restore success status from the interactive UI so restoring queued messages silently returns them to the editor without showing transient restore copy.
+- Fixed bundled MCP proxy metadata paths so explicit cold-cache `search`, `describe`, and server-list requests hydrate lazy server metadata on demand without reconnecting all lazy servers during startup.
+- Fixed provider context-window overflow recovery so an exhausted overflow auto-compaction attempt emits an explicit unresolved-overflow signal instead of silently leaving callers to retry the same model, and planner calls that themselves overflow now degrade through the deterministic overflow-eviction ladder rather than throwing before non-model reduction can run. Planner overflow is now recognized whether it is returned as an assistant error message or thrown by the provider stream before `agent.prompt()` completes, so overflow recovery skips the critical planner retry and goes directly to deterministic non-model reduction in both forms.
+- Fixed overflow auto-compaction retry reliability so `AgentSession.prompt()` now waits for the `willRetry: true` post-compaction continuation before resolving. Late unresolved-overflow signals from that continuation are observed by workflow callers before they can mark the original prompt successful.
+- Fixed normal interactive TTY startup so typing before the prompt box is fully mounted is captured instead of being invisibly blocked by deferred resource initialization. Atomic now starts a short-lived raw input buffer only on the existing deferred-startup fast path, keeps it active until the TUI input handler is mounted, replays draft text into the editor, queues only ordinary Enter-submitted prompts for the prompt loop, and preserves command-like early submissions such as `/settings` or `!pwd` as standalone editor submissions so normal command routing handles them after mount. Once a command-like startup submission is captured, later captured submissions wait behind it and replay in original input order after that command is routed, preventing a later ordinary prompt from leapfrogging the earlier command without merging commands and following prompts into one draft. The capture now restores terminal raw mode across early startup exits/signals and ignores split escape sequences so partial arrow-key/protocol bytes never become draft text. Trust prompts, explicit resource flags, metadata commands, non-TTY modes, and explicit provider/model selection stay on the synchronous startup path.
+- Fixed the bundled intercom extension to keep broker runtime files under the active Atomic agent directory, including custom `ATOMIC_CODING_AGENT_DIR` values and the legacy `PI_CODING_AGENT_DIR` alias, while documenting the `~/.atomic/agent/intercom/` primary path and `~/.pi/agent/intercom/` fallback. The default pi-compatible `npx --no-install tsx` broker sentinel is now hardened to launch through the current runtime (`process.execPath`): Node-based installs use a resolved `tsx` CLI with a bundled `jiti` fallback, Bun source-checkout runs use the current Bun executable directly, and standalone Atomic Bun binaries use a narrow internal split-launcher broker handoff, so default startup does not depend on `npx`, `tsx`, or `bun` being on `PATH`; explicit custom broker configs remain supported.
+- Fixed GitHub Copilot Claude/Anthropic Messages streams that cleanly report a terminal stop reason but omit the required `message_stop` SSE event. Atomic now adds that single terminal event only for closed, non-error Copilot `/v1/messages` event streams before provider parsing, including complete final SSE frames that reach EOF without a trailing blank-line separator and GitHub Enterprise/GHE tenant routing hosts such as `copilot-api.<enterprise>.ghe.com`, while leaving malformed, truncated, already well-formed, non-Copilot, look-alike host, non-SSE, Gemini, and OpenAI-style streams to the normal parser/retry behavior.
+- Fixed bundled workflow durable resume hydration so replayed parallel reviewer fanout preserves branch structure and completed workflow stages restore persisted summaries, durations, session/model metadata, and checkpoint contents in status and graph views.
+- Fixed a noticeable delay before the working spinner appeared after submitting a prompt: the interactive input loop now mounts the spinner immediately on submit (respecting extension `workingVisible` suppression) and yields once so it paints before prompt preflight — extension input hooks, template/skill expansion, auth and compaction checks, and deferred startup completion — runs. Previously the spinner was created only when the agent emitted `agent_start`, so the status row stayed empty during preflight, making Ctrl+C feel unresponsive until the spinner finally appeared. Submissions that resolve without starting an agent turn (e.g. extension slash-commands) clear the pre-shown spinner when idle so it never lingers.
+- Fixed post-context-compaction provider requests so retained pre-compaction assistant usage is scrubbed from the provider-bound context clone. This keeps durable billing history intact while preventing stale high token counts from shrinking `max_output_tokens` to an invalid one-token budget on the first turn after compaction.
+- Fixed auto-compaction continuation for OpenAI Responses providers by normalizing replayed `function_call.id` values to valid `fc_*` item identifiers while preserving `call_id` pairing. This prevents the opaque `400 {"code":"invalid_request_body"}` failure that could appear immediately after compaction even though a manual `Continue` message succeeded.
+- Fixed auto-compaction stalling after a response reaches the maximum output-token limit: length-stopped assistant turns now compact as incomplete work, remove the truncated assistant from retry context, and automatically continue without requiring the user to type `Continue` ([#1662](https://github.com/bastani-inc/atomic/issues/1662)).
+- Reduced Windows compiled-binary interactive cold-start latency by shipping release archives with a small launcher plus a sidecar app bundle instead of one monolithic executable, and by extending the deferred TUI fast path beyond extension module imports. Normal interactive TTY startup now paints and installs the input loop before bundled package/resource discovery scans skills, prompts, themes, context files, and system-prompt files. Deferred loading now uses async filesystem discovery and async file reads for package resources, skills, prompts, themes, and extension-discovered resources, with cooperative yields so Enter, Ctrl+C, rendering, and the normal prompt spinner remain responsive when a submitted prompt needs resources. Startup no longer shows a resource-loading spinner before the user submits a prompt; explicit resource flags, system-prompt inputs, unknown extension flags, model/provider selection, metadata commands, non-TTY modes, and unresolved project-trust prompts stay on the synchronous path.
+- Fixed Windows compiled-binary keyboard responsiveness by avoiding invisible typeahead buffering in normal interactive startup, keeping terminal input attached to the visible editor, handling Ctrl+C globally with a SIGINT fallback, bounding Ctrl+C shutdown input draining to 250ms, and packaging the Windows console-mode helper used by the TUI for virtual-terminal input.
+- Fixed the Anthropic subscription extra-usage warning racing ahead of the startup `RESOURCES` disclosure on the deferred TUI fast path: the warning is now held until after the resource summary line renders (at deferred-startup completion, agent-end disclosure flushes, or the post-prompt flush), so the `RESOURCES` line always appears first.
+- Fixed deferred-startup TUI chat ordering so `RESOURCES`, changelog, update/package/tmux/subscription startup notices, and queued user prompts render in request order instead of completion order. Startup notices now use a stable block above session messages, queued inputs wait for their later `message_start`, and failed pre-prompt echoes are removed from the chat.
+- Fixed Windows release archives to avoid Bun's `--bytecode` standalone executable startup crash and every runtime path that decodes the split-launcher sidecar's macOS build-machine `import.meta.url` on Windows. Windows binaries remain compiled standalone launchers but now ship the source payload instead of embedded bytecode until Bun's Windows bytecode-alignment fix is available. A centralized split-launcher helper (`ATOMIC_CODING_AGENT` + executable path detection) now resolves package assets, built-in package discovery, and — critically — the jiti resolution base next to `atomic.exe`, so the bundled built-in extensions (`mcp`, `web-access`, `intercom`, `cursor`, `workflows`, `subagents`) all load on Windows instead of failing with `File URL path must be an absolute path`.
+- Fixed deferred TUI extension loading so the editor keeps accepting and echoing keystrokes after first paint: startup now yields cooperatively between extension/resource-loading chunks, preserves text typed during completion, and safely queues Enter submissions made before the main prompt loop is ready.
+- Fixed a warm-start TUI first-paint regression where persisted `enabledModels` or `--models` patterns forced all extensions to load synchronously before the first frame. Interactive startup now keeps the deferred-extension fast path and reapplies the model scope after extensions finish loading, preserving extension-registered provider matches and unmatched-pattern warnings without blocking paint.
+- Fixed project trust prompts for bare projects that only create inert `.atomic/` or `.pi/` state: state-only directories such as `todos/` and `sessions/` no longer count as trust inputs or disable deferred extension startup, while trust-requiring config continues to prompt until the user makes an explicit persistent decision and implicit trust is persisted only by the `/reload` path.
+- Fixed a security regression that could silently persist project trust at shutdown or deferred-startup completion after trust-requiring config appeared mid-session; Atomic now preserves the startup trust prompt unless the user explicitly saves a decision or the existing `/reload` implicit-trust flow applies.
+- Fixed BOM-prefixed JSON state files being treated as parse failures: settings and project trust JSON readers now strip a leading UTF-8 BOM before parsing, so Windows-authored `settings.json` and `trust.json` files load the same as BOM-less files instead of silently ignoring user settings.
+- Fixed the bundled workflows documentation to reflect that attached workflow stage chats render live `subagent` widgets for single, parallel, and chain calls, keep them live across attach/re-attach cycles, and let Ctrl+O expand live detail for every child. ([#1643](https://github.com/bastani-inc/atomic/issues/1643))
+- Fixed a Windows `waitForChildProcess` exit-code race where the process-alive poll could report a fast-dying child as gone before Node emitted the real `exit` event, causing bash commands such as `exit 1` to be reported as successful with a fabricated exit code 0 ([#1647](https://github.com/bastani-inc/atomic/issues/1647)).
+- Fixed overflow auto-compaction silently no-oping when planner authentication was unavailable or when the current branch has no preparable compactable transcript: overflow recovery now either skips model tiers and runs deterministic no-auth LRU eviction directly through the existing validation pipeline, or surfaces a terminal error that nothing more was safely deletable.
+- Fixed feasible partial compaction results being discarded solely because they missed the strict ratio target: automatic threshold and overflow compaction now commit validated below-target deletions when their projected `tokensAfter` clears the trigger/budget boundary, including partial deletion state salvaged after a provider context-overflow error.
+
+## [0.9.5-alpha.10] - 2026-07-11
+
+### Added
+
+- Added model-capability-aware `max` thinking support across the CLI, settings, SDK/RPC/extension surfaces, Cursor model mapping, workflow stages, and bundled subagents; models still expose only the levels in their own capability maps ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Added request-wide `cost.tiers` support for custom `models.json` models, partial `modelOverrides`, and extension-registered providers, including complete tier validation, aggregate-input threshold selection, inherited-tier preservation for scalar overrides, and explicit tier-array replacement/clearing ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+
+### Changed
+
+- Synced the upstream Pi runtime dependencies (`@earendil-works/pi-agent-core`, `pi-ai`, and `pi-tui`) through `^0.80.6` across Atomic and bundled extensions, retained the same consolidated refresh's `lru-cache`, optional `@dbos-inc/dbos-sdk`, `napi`, `napi-derive`, and `tree-sitter` updates, regenerated Bun/Cargo/npm shrinkwrap metadata with mutually consistent 0.80.6 registry integrity, and kept versionless `0.0.0` Atomic manifests. This inherits signed empty Anthropic thinking preservation, request-wide GPT-5.4/5.5 long-context pricing, corrected GPT-5.6 catalogs/backend windows, and upstream retry/provider fixes while preserving Atomic's Copilot/Gemini behavior ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Replaced universal workflow/subagent routing with an intent-first least-orchestration policy across model guidance, help, and documentation. Interactive exploration stays inline, bounded specialist work may use single/chain/parallel subagents, and clearly delegated long-running autonomous work uses named, direct-shape, or custom inline TypeScript workflows when durable execution features add value. Explicit loop and stop-condition requests remain key workflow signals when the user delegates execution, so retries, evidence, and convergence are tracked.
+
+- Explicit bash timeouts now fail before execution when non-finite, non-positive, or greater than Atomic's 3600-second ceiling; omitting the field still uses 300 seconds, and valid fractional values retain Atomic's floor behavior instead of being silently clamped into range ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+
+- Changed the bundled `ralph` workflow review fan-out from three reviewers to two (`reviewer-a` and `reviewer-b`), removing `reviewer-c` and its GLM-led model chain while keeping unanimous approval across the remaining reviewers.
+
+### Fixed
+
+- Fixed CLI resolution of unknown/custom model IDs with a recognized `:<thinking>` suffix so the suffix is applied as the thinking level instead of leaking into the synthesized model ID, while preserving registered and unrecognized colon-bearing model IDs.
+- Fixed bundled MCP readiness so failed background initialization is retryable and single-flight within the active session, stale retries cannot publish after shutdown, replacement startup waits for retired initializer/state/OAuth cleanup, and proxy/direct readiness plus lazy-connection and OAuth waits use caller-local cancellation without stopping shared producers. Direct executors reject old-state work on success and failure paths after replacement and close stale newly opened Apps views, SDK resource/tool requests receive the invocation signal, and UI-backed MCP Apps calls emit one terminal cancellation before teardown while preserving the exact host reason over SDK/notification failures.
+- Fixed bundled web-access and Intercom lazy wrappers to retire session-scoped candidates on shutdown, reject calls spanning teardown, and initialize fresh state after restart; host cancellation after web provider/curator execution now preserves its exact abort reason while explicit curator user cancellation remains a normal result.
+- Fixed bundled web-access lazy tools failing during native Bun heavy-module loading by resolving compatibility helpers from the canonical installed `@earendil-works/pi-ai/compat` package ([#1728](https://github.com/bastani-inc/atomic/issues/1728)).
+- Fixed stale pre-compaction usage estimates after a newer inserted prefix, normalized lax null or omitted content at extension, custom-message, and restored-session boundaries, and kept Atomic's Verbatim Compaction custom-message budgeting semantics intact ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed `models.json` `modelOverrides` so matching extension-registered provider models receive configured names, thinking maps, compatibility fields, context settings, and merged headers without replacing Atomic's dynamic Copilot/context-window behavior; normal CLI startup now loads layered legacy `.pi` and primary `.atomic` files, disjoint provider/model entries survive, and an exact primary entry replaces the complete legacy override with source-correct header precedence and `{}` restoration of built-in values ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed project context traversal at Windows drive roots, surfaced credential persistence failures without mutating in-memory auth first, skipped unauthenticated saved defaults, preserved missing saved IDs for authenticated custom OpenAI-compatible providers, prevented removed static catalog model IDs from being synthesized during session restore, and cleared cached label timestamps when starting a new session ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed missing exact `--session-id` handling to warn before creating the requested session, ignored rapid duplicate fork-menu selections, and kept visible custom messages emitted during streaming ordered before the live assistant row ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed standalone clipboard image support by falling back to xclip after an empty native result and packaging each matching 0.3.9 native binding beside the wrapper in Atomic's split binary archives; caller-relative `TMPDIR` values are canonicalized before directory changes, and `--skip-deps` tolerates an absent optional clipboard wrapper while strict release builds remain loud ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Fixed Anthropic/GitHub Copilot signed-thinking replay after Verbatim Compaction by validating provider-visible logical assistant tool-use turns instead of isolated messages: the current final turn retains every `thinking`/`redacted_thinking` entry, completed historical turns retain all or omit all signed entries, complete grep batches and deterministic overflow eviction use the same invariant, and unsafe persisted plans heal in memory with exact retained blocks, signatures, and paired tool results restored without rewriting session JSONL. Provider-visible user/custom inputs, included bash executions, and non-empty branch summaries establish boundaries, task anchors, recent windows, and finite transcript token totals; provider-omitted empty or whitespace-only user/custom inputs and empty or malformed branch summaries do not, while whitespace-only branch summaries remain visible through their wrapper. Raw block visibility is retained separately from transcript display projections, future unknown typed blocks fail visible with a conservative token estimate, malformed siblings are transiently filtered before provider calls, and stale user-image deletion cannot remove the final provider-visible task. Raw `redacted_thinking` blocks are normalized in the transient, non-mutating LLM-compatible messages returned by `convertToLlm`, so retained opaque data serializes exactly without mutating durable history.
+- Fixed bundled foreground subagent coordination so `intercom.ask` and `contact_supervisor need_decision` surface while the parent tool is active, detach only their exact child, resume through threaded replies, and expose the retained detached-to-terminal child status and actual output through public status queries; progress/send and background execution remain nonblocking and unchanged ([#1727](https://github.com/bastani-inc/atomic/issues/1727)).
+- Register bridged foreground/background children with bundled Intercom before agent work and lazily gate interactive foreground launches on parent broker readiness, while disabled, unavailable, unused-parent, and management-only paths remain lazy and broker-free.
+
 ## [0.9.5-alpha.9] - 2026-07-09
 
 ### Changed

package/README.md

@@ -517,7 +517,7 @@ cat README.md | atomic -p "Summarize this text"
 | `--provider <name>` | Provider (anthropic, openai, google, etc.) |
 | `--model <pattern>` | Model pattern or ID (supports `provider/id` and optional `:<thinking>`) |
 | `--api-key <key>` | API key (overrides env vars) |
-| `--thinking <level>` | `off`, `minimal`, `low`, `medium`, `high`, `xhigh` |
+| `--thinking <level>` | `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max` (subject to model capabilities) |
 | `--models <patterns>` | Comma-separated patterns for CTRL+P cycling |
 | `--list-models [search]` | List available models |
 
@@ -528,7 +528,7 @@ cat README.md | atomic -p "Summarize this text"
 | `-c`, `--continue` | Continue most recent session |
 | `-r`, `--resume` | Browse and select session |
 | `--session <path\|id>` | Use specific session file or partial UUID |
-| `--session-id <id>` | Use an exact project session ID, creating it if missing |
+| `--session-id <id>` | Use an exact project session ID; warn and create it when missing |
 | `--fork <path\|id>` | Fork specific session file or partial UUID into a new session |
 | `--session-dir <dir>` | Custom session storage directory |
 | `--name <name>`, `-n <name>` | Set the session display name |

package/dist/builtin/cursor/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+## [0.9.6-alpha.1] - 2026-07-12
+
+### Changed
+
+- Published a synchronized Atomic 0.9.6-alpha.1 prerelease for the Cursor provider package; no functional Cursor provider changes were made after 0.9.5.
+
+## [0.9.5] - 2026-07-11
+
+### Changed
+
+- Aligned the Cursor provider dependency with upstream `pi-ai` `^0.80.6` and mapped the new `max` thinking level to Cursor's advertised effort variants while preserving per-model capability filtering ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+
+## [0.9.5-alpha.10] - 2026-07-11
+
+### Changed
+
+- Aligned the Cursor provider dependency with upstream `pi-ai` `^0.80.6` and mapped the new `max` thinking level to Cursor's advertised effort variants while preserving per-model capability filtering ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+
 ## [0.9.4] - 2026-07-03
 
 ### Changed

package/dist/builtin/cursor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/cursor",
-  "version": "0.9.5-alpha.9",
+  "version": "0.9.6-alpha.1",
   "private": true,
   "description": "Experimental first-party Atomic extension for Cursor OAuth, model discovery, and streaming provider registration.",
   "contributors": [
@@ -40,8 +40,8 @@
     }
   },
   "dependencies": {
-    "@bastani/atomic-natives": "0.9.5-alpha.9",
+    "@bastani/atomic-natives": "0.9.6-alpha.1",
     "@bufbuild/protobuf": "^2.12.1",
-    "@earendil-works/pi-ai": "^0.80.3"
+    "@earendil-works/pi-ai": "^0.80.6"
   }
 }

package/dist/builtin/cursor/src/model-mapper.ts

@@ -61,13 +61,14 @@ interface CursorVariantGroup {
 const CURSOR_FALLBACK_RAW_MODELS = rawFallbackModels satisfies readonly CursorUsableModel[];
 const PARSEABLE_EFFORTS: readonly Exclude<CursorEffort, "default">[] = ["none", "low", "medium", "high", "xhigh", "max"];
 const EFFORT_ORDER: readonly CursorEffort[] = ["none", "low", "default", "medium", "high", "xhigh", "max"];
-const THINKING_LEVELS: readonly ThinkingLevel[] = ["minimal", "low", "medium", "high", "xhigh"];
+const THINKING_LEVELS: readonly ThinkingLevel[] = ["minimal", "low", "medium", "high", "xhigh", "max"];
 const THINKING_LEVEL_EFFORT_PREFERENCES: Record<ThinkingLevel, readonly CursorEffort[]> = {
 	minimal: ["none", "low", "default"],
 	low: ["low", "none", "default"],
 	medium: ["medium", "default", "low"],
 	high: ["high", "medium", "default"],
 	xhigh: ["max", "xhigh"],
+	max: ["max"],
 };
 
 const ESTIMATED_CONTEXT_WINDOW = 200_000;
@@ -277,7 +278,7 @@ function buildCursorThinkingLevelMap(group: CursorVariantGroup, effortVariants:
 	// minimal/least-effort variant because `off` means minimum reasoning.
 	const hasRealBaseId = group.variants.some((variant) => variant.id === group.primaryId);
 	if (!hasRealBaseId) {
-		const defaultVariant = map.minimal ?? map.low ?? map.medium ?? map.high ?? map.xhigh ?? null;
+		const defaultVariant = map.minimal ?? map.low ?? map.medium ?? map.high ?? map.xhigh ?? map.max ?? null;
 		if (defaultVariant) map.off = defaultVariant;
 	}
 	return map;
@@ -289,8 +290,10 @@ function buildThinkingLevelMap(effortVariants: ReadonlyMap<CursorEffort, string>
 		low: chooseEffortVariant(effortVariants, THINKING_LEVEL_EFFORT_PREFERENCES.low, primaryId),
 		medium: chooseEffortVariant(effortVariants, THINKING_LEVEL_EFFORT_PREFERENCES.medium, primaryId),
 		high: chooseEffortVariant(effortVariants, THINKING_LEVEL_EFFORT_PREFERENCES.high, primaryId),
-		// `xhigh` should only be offered when Cursor advertises a true xhigh/max variant.
+		// `xhigh` can use Cursor's strongest advertised xhigh/max variant, while
+		// `max` is distinct and must not be synthesized from an xhigh-only group.
 		xhigh: chooseCursorXhighVariant(effortVariants),
+		max: effortVariants.get("max") ?? null,
 	};
 }
 

package/dist/builtin/intercom/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to the `pi-intercom` extension will be documented in this fi
 
 ## [Unreleased]
 
+## [0.9.6-alpha.1] - 2026-07-12
+
+### Changed
+
+- Restored fully tool-driven Intercom connections: parent and bridged child sessions no longer import or connect to the broker merely because a subagent starts. The runtime now connects only when the model or user invokes an Intercom tool, command, shortcut, or relay.
+
+## [0.9.5] - 2026-07-11
+
+### Added
+
+- Added preferred `atomic` package manifest metadata alongside the legacy `pi` manifest metadata so Atomic package discovery uses Atomic-branded metadata without breaking pi-compatible installs.
+
+### Changed
+
+- Aligned the intercom extension peer dependency with upstream `pi-tui` `^0.80.6` as part of the consolidated Pi sync; no intercom source behavior changed ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+- Updated intercom documentation to describe Atomic's `~/.atomic/agent/intercom/` primary config/runtime path and legacy `~/.pi/agent/intercom/` fallback.
+- Updated the registered intercom tool description and prompt snippet to use Atomic/Pi-neutral local agent session wording instead of hard-coding Pi-branded session names in model-visible text.
+
+### Fixed
+
+- Made lazy Intercom lifecycle replay generation-safe, session-leased, and serialized with live lifecycle forwarding, so matching end events and newer model selections cannot be overtaken by a blocked stale replay. Shutdown waits for retired replay/initializer cleanup before replacement, calls spanning teardown reject, and failed or invalidated attempts cannot leak stale resources.
+- Recover from rejected lazy and delegated-child background initialization and later-generation session replay; later callers retry before executing, and concurrent retries share one initialization or replay attempt while normal sessions remain lazy.
+- Made acknowledged subagent result delivery idempotent end to end: lazy initialization failure and retired relay generations emit definitive negative acknowledgements, stable completion request IDs become broker message IDs, concurrent identical client sends coalesce onto one attempt, and a bounded TTL cache confirms identical successful retries without forwarding twice. Canonical target/payload/options signatures reject conflicting ID reuse even after success and across sender sessions, while transport attempt IDs and timestamps remain retry-insensitive. Brokers reject malformed present attempt IDs instead of unsafely downgrading them, and clients accept attempt-less legacy responses only for an ID's original active generation so a delayed legacy acknowledgement cannot settle a timeout/disconnect replacement.
+- Fixed foreground `intercom.ask`, `intercom.send`, and supervisor coordination to use an exact-owner probe/reservation plus an acknowledged, generation-scoped detach commit before model-visible steering delivery. This breaks parent/child ask deadlocks, promptly releases supervision for fire-and-forget progress/send, preserves threaded decision replies, leaves unmatched/background messages queued until idle, and prevents orphaned, stale, or duplicate delivery after cancellation or replacement. Interactive parents now await lazy Intercom broker/inbound-handler initialization before a foreground child launches ([#1727](https://github.com/bastani-inc/atomic/issues/1727)).
+- Register bridged foreground/background children with Intercom before agent work begins and gate interactive foreground launches on lazy parent broker readiness, while preserving single-flight heavy loading, replacement/shutdown cleanup, and no startup work for unused parents, disabled sessions, or definition/control-only subagent actions. Optional import/broker/connection failures diagnose and degrade without aborting parent or child launch, while later calls retain retry behavior. Adapted from `nicobailon/pi-intercom` commits `3cb5b9c`, `02a6897`, and `9f23b97` while retaining Atomic's lazy proxy and issue #1727 detach protocol.
+- Fixed Atomic intercom broker runtime paths to derive from the active Atomic agent directory, so `ATOMIC_CODING_AGENT_DIR` moves the broker socket, PID, spawn lock, and Windows launcher together while the legacy `PI_CODING_AGENT_DIR` alias remains supported.
+- Fixed raw TypeScript intercom imports to use the bundled `@earendil-works/pi-tui` package name, matching Atomic's runtime dependency while preserving the public intercom API.
+- Hardened default intercom broker startup so the pi-compatible `npx --no-install tsx` sentinel launches through the current runtime (`process.execPath`): Node-based installs use a resolved `tsx` CLI with a bundled `jiti` fallback, Bun source-checkout runs use the current Bun executable directly, and standalone Atomic Bun binaries re-enter the split launcher through a narrow internal broker handoff instead of treating the Atomic executable as a generic Bun interpreter; explicit custom `brokerCommand`/`brokerArgs` configs remain pass-through overrides.
+
+## [0.9.5-alpha.10] - 2026-07-11
+
+### Changed
+
+- Aligned the intercom extension peer dependency with upstream `pi-tui` `^0.80.6` as part of the consolidated Pi sync; no intercom source behavior changed ([#1703](https://github.com/bastani-inc/atomic/issues/1703)).
+
+### Fixed
+
+- Made lazy Intercom lifecycle replay generation-safe, session-leased, and serialized with live lifecycle forwarding, so matching end events and newer model selections cannot be overtaken by a blocked stale replay. Shutdown waits for retired replay/initializer cleanup before replacement, calls spanning teardown reject, and failed or invalidated attempts cannot leak stale resources.
+- Recover from rejected lazy and delegated-child background initialization and later-generation session replay; later callers retry before executing, and concurrent retries share one initialization or replay attempt while normal sessions remain lazy.
+- Made acknowledged subagent result delivery idempotent end to end: lazy initialization failure and retired relay generations emit definitive negative acknowledgements, stable completion request IDs become broker message IDs, concurrent identical client sends coalesce onto one attempt, and a bounded TTL cache confirms identical successful retries without forwarding twice. Canonical target/payload/options signatures reject conflicting ID reuse even after success and across sender sessions, while transport attempt IDs and timestamps remain retry-insensitive. Brokers reject malformed present attempt IDs instead of unsafely downgrading them, and clients accept attempt-less legacy responses only for an ID's original active generation so a delayed legacy acknowledgement cannot settle a timeout/disconnect replacement.
+- Fixed foreground `intercom.ask`, `intercom.send`, and supervisor coordination to use an exact-owner probe/reservation plus an acknowledged, generation-scoped detach commit before model-visible steering delivery. This breaks parent/child ask deadlocks, promptly releases supervision for fire-and-forget progress/send, preserves threaded decision replies, leaves unmatched/background messages queued until idle, and prevents orphaned, stale, or duplicate delivery after cancellation or replacement. Interactive parents now await lazy Intercom broker/inbound-handler initialization before a foreground child launches ([#1727](https://github.com/bastani-inc/atomic/issues/1727)).
+- Register bridged foreground/background children with Intercom before agent work begins and gate interactive foreground launches on lazy parent broker readiness, while preserving single-flight heavy loading, replacement/shutdown cleanup, and no startup work for unused parents, disabled sessions, or definition/control-only subagent actions. Optional import/broker/connection failures diagnose and degrade without aborting parent or child launch, while later calls retain retry behavior. Adapted from `nicobailon/pi-intercom` commits `3cb5b9c`, `02a6897`, and `9f23b97` while retaining Atomic's lazy proxy and issue #1727 detach protocol.
+
 ## [0.9.5-alpha.8] - 2026-07-08
 
 ### Added

package/dist/builtin/intercom/README.md

@@ -24,7 +24,7 @@ Intercom also integrates with delegated subagents: child agents get a child-only
 
 ## In One Minute
 
-Each Atomic/pi session that has intercom loaded and enabled connects to a tiny local broker over a local IPC transport. The broker keeps track of connected sessions and routes direct messages to the one you target by name or session ID. The extension gives you both a tool (`intercom`) and a small overlay UI (`/intercom` or `ALT+M`). Incoming messages are rendered inline inside the recipient session, can trigger a turn immediately, and are also stored in session history as extension entries.
+Intercom connections are tool-driven. Parent and delegated child sessions keep the lightweight wrapper unloaded until the model or user invokes an Intercom tool, `/intercom`, or the `ALT+M` overlay. A bridged child receives its deterministic Intercom identity and `contact_supervisor` tool at startup, but invoking that tool establishes its broker connection; merely launching a foreground or background child does not connect either session. Concurrent first-use callers share one import and connection attempt, and lazy broker state is leased to the active session generation and cleaned up on shutdown or replacement.
 
 ## Install
 
@@ -34,7 +34,7 @@ Atomic bundles `@bastani/intercom` as a first-party extension; no separate insta
 pi install npm:pi-intercom
 ```
 
-Then restart Atomic or Pi. The extension auto-connects to the broker on startup and registers the bundled `intercom` skill for common coordination patterns.
+Then restart Atomic or Pi. The extension registers the bundled `intercom` skill and lightweight tools at startup, but it does not connect the session until the model or user invokes Intercom.
 
 **Recommended:** Add this snippet to your project's `AGENTS.md` to help agents understand when to coordinate across sessions:
 
@@ -53,7 +53,7 @@ Coordinate with other local Atomic/pi sessions on related codebases. Use `/skill
 A session becomes intercom-connected when all of these are true:
 - the intercom extension is installed/bundled and loaded in that session
 - `enabled` is not set to `false` in `~/.atomic/agent/intercom/config.json` (Atomic) or the legacy `~/.pi/agent/intercom/config.json` fallback
-- the session has started or reloaded after the extension was installed
+- the model or user has invoked an Intercom tool, `/intercom`, or the `ALT+M` overlay in that session
 - the local broker is running or can be auto-started
 
 The session list only shows intercom-connected sessions, not every open Pi process on the machine.
@@ -241,6 +241,8 @@ If any are missing, the session falls back to the regular `intercom` tool.
 
 Do not use `contact_supervisor` for routine completion handoffs. Return the final subagent result normally through `pi-subagents`.
 
+During a foreground subagent run, Atomic probes for an exact live foreground owner before delivery. The matching child reserves the request, accepts a generation-scoped detach commit, and acknowledges the commit before asks, sends, decisions, interviews, and progress updates enter the parent's model-visible steering queue. Blocking calls remain alive until the parent sends the exact threaded reply; fire-and-forget calls create no reply waiter. Background and unmatched messages keep their queued-until-idle behavior, and cancellation/replacement invalidates stale handshakes.
+
 ### Example: Blocked Subagent Asks for Guidance
 
 ```typescript

package/dist/builtin/intercom/broker/broker.ts

@@ -3,70 +3,15 @@ import { writeFileSync, unlinkSync, mkdirSync } from "fs";
 import { randomUUID } from "crypto";
 import { writeMessage, createMessageReader } from "./framing.js";
 import { getBrokerPidPath, getBrokerSocketPath, getIntercomDirPath } from "./paths.js";
-import type { SessionInfo, Message, Attachment, BrokerMessage } from "../types.js";
+import type { SessionInfo, BrokerMessage } from "../types.js";
+import { DeliveredMessageCache } from "./delivered-message-cache.js";
+import { handleBrokerSend, type BrokerConnectedSession } from "./send-handler.js";
 
 const INTERCOM_DIR = getIntercomDirPath();
 const SOCKET_PATH = getBrokerSocketPath();
 const PID_PATH = getBrokerPidPath();
 
-interface ConnectedSession {
-  socket: net.Socket;
-  info: SessionInfo;
-}
-
-function isAttachment(value: unknown): value is Attachment {
-  if (typeof value !== "object" || value === null) {
-    return false;
-  }
-
-  const attachment = value as Record<string, unknown>;
-
-  if (
-    attachment.type !== "file"
-    && attachment.type !== "snippet"
-    && attachment.type !== "context"
-  ) {
-    return false;
-  }
-
-  if (typeof attachment.name !== "string" || typeof attachment.content !== "string") {
-    return false;
-  }
-
-  return attachment.language === undefined || typeof attachment.language === "string";
-}
-
-function isMessage(value: unknown): value is Message {
-  if (typeof value !== "object" || value === null) {
-    return false;
-  }
-
-  const message = value as Record<string, unknown>;
-
-  if (typeof message.id !== "string" || typeof message.timestamp !== "number") {
-    return false;
-  }
-
-  if (message.replyTo !== undefined && typeof message.replyTo !== "string") {
-    return false;
-  }
-
-  if (message.expectsReply !== undefined && typeof message.expectsReply !== "boolean") {
-    return false;
-  }
-
-  if (typeof message.content !== "object" || message.content === null) {
-    return false;
-  }
-
-  const content = message.content as Record<string, unknown>;
-  if (typeof content.text !== "string") {
-    return false;
-  }
-
-  return content.attachments === undefined
-    || (Array.isArray(content.attachments) && content.attachments.every(isAttachment));
-}
+type ConnectedSession = BrokerConnectedSession;
 
 function isSessionRegistration(value: unknown): value is Omit<SessionInfo, "id"> {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -96,6 +41,7 @@ class IntercomBroker {
   private sessions = new Map<string, ConnectedSession>();
   private server: net.Server;
   private shutdownTimer: NodeJS.Timeout | null = null;
+  private deliveredMessages = new DeliveredMessageCache();
 
   constructor() {
     mkdirSync(INTERCOM_DIR, { recursive: true });
@@ -217,52 +163,7 @@ class IntercomBroker {
       }
 
       case "send": {
-        const message = clientMessage.message;
-        const messageId = isMessage(message) ? message.id : "unknown";
-
-        if (typeof clientMessage.to !== "string" || !isMessage(message)) {
-          writeMessage(socket, {
-            type: "delivery_failed",
-            messageId,
-            reason: "Invalid message format",
-          });
-          break;
-        }
-
-        const targets = this.findSessions(clientMessage.to);
-        if (targets.length === 1) {
-          const fromSession = this.sessions.get(currentId);
-          if (!fromSession) {
-            writeMessage(socket, {
-              type: "delivery_failed",
-              messageId: message.id,
-              reason: "Sender session not found",
-            });
-            break;
-          }
-          writeMessage(targets[0].socket, {
-            type: "message",
-            from: fromSession.info,
-            message,
-          });
-          writeMessage(socket, { type: "delivered", messageId: message.id });
-          break;
-        }
-
-        if (targets.length > 1) {
-          writeMessage(socket, {
-            type: "delivery_failed",
-            messageId: message.id,
-            reason: `Multiple sessions named \"${clientMessage.to}\" are connected. Use the session ID instead.`,
-          });
-          break;
-        }
-
-        writeMessage(socket, {
-          type: "delivery_failed",
-          messageId: message.id,
-          reason: "Session not found",
-        });
+        handleBrokerSend(socket, clientMessage, currentId, this.sessions, this.deliveredMessages, writeMessage);
         break;
       }
 
@@ -298,15 +199,6 @@ class IntercomBroker {
     }
   }
 
-  private findSessions(nameOrId: string): ConnectedSession[] {
-    const byId = this.sessions.get(nameOrId);
-    if (byId) {
-      return [byId];
-    }
-
-    const lowerName = nameOrId.toLowerCase();
-    return Array.from(this.sessions.values()).filter(session => session.info.name?.toLowerCase() === lowerName);
-  }
 
   private broadcast(msg: BrokerMessage, exclude?: string): void {
     for (const [id, session] of this.sessions) {