@bastani/atomic 0.9.52-alpha.1 → 0.9.53-alpha.1

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## [Unreleased]
 
+## [0.9.53] - 2026-10-29
+
+Task pages show their own status lines, and a dependency security fix.
+
+- **A task's own status lines:** a subagent task's fullscreen detail and transcript pages show the extension statuses its session writes, live, and clear them when it ends ([#4103](https://github.com/bastani-inc/atomic/issues/4103))
+- **Security update:** the bundled `@hono/node-server` moves to 2.1.5, which fixes a middleware bypass on static paths ([GHSA-rmxm-3fg6-px4f](https://github.com/advisories/GHSA-rmxm-3fg6-px4f))
+
+### Fixed
+
+- A subagent task's fullscreen detail and transcript pages now show the extension status lines (such as a tokens-per-second counter) that the task's own session sets, in a row beneath the page footer that updates live and clears when the task ends. Status writes from a subagent child's extensions used to be dropped, so those pages showed no extension statuses at all; they are still kept out of the chat's own footer ([#4103](https://github.com/bastani-inc/atomic/issues/4103))
+- Updated the bundled `@hono/node-server` dependency to 2.1.5, which fixes `serveStatic` decoding a request path a second time, a way to bypass middleware on static paths ([GHSA-rmxm-3fg6-px4f](https://github.com/advisories/GHSA-rmxm-3fg6-px4f))
+
+## [0.9.53-alpha.1] - 2026-10-29
+
+Task pages show their own status lines, and a dependency security fix.
+
+- **A task's own status lines:** a subagent task's fullscreen detail and transcript pages show the extension statuses its session writes, live, and clear them when it ends ([#4103](https://github.com/bastani-inc/atomic/issues/4103))
+- **Security update:** the bundled `@hono/node-server` moves to 2.1.5, which fixes a middleware bypass on static paths ([GHSA-rmxm-3fg6-px4f](https://github.com/advisories/GHSA-rmxm-3fg6-px4f))
+
+### Fixed
+
+- A subagent task's fullscreen detail and transcript pages now show the extension status lines (such as a tokens-per-second counter) that the task's own session sets, in a row beneath the page footer that updates live and clears when the task ends. Status writes from a subagent child's extensions used to be dropped, so those pages showed no extension statuses at all; they are still kept out of the chat's own footer ([#4103](https://github.com/bastani-inc/atomic/issues/4103))
+- Updated the bundled `@hono/node-server` dependency to 2.1.5, which fixes `serveStatic` decoding a request path a second time, a way to bypass middleware on static paths ([GHSA-rmxm-3fg6-px4f](https://github.com/advisories/GHSA-rmxm-3fg6-px4f))
+
 ## [0.9.51] - 2026-10-29
 
 Windows sessions resume as printed, and stay open.

package/dist/builtin/intercom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/intercom",
-  "version": "0.9.52-alpha.1",
+  "version": "0.9.53-alpha.1",
   "private": true,
   "description": "Atomic extension providing a private coordination channel between parent and child agent sessions. Fork of: https://github.com/nicobailon/pi-intercom",
   "contributors": [

package/dist/builtin/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/mcp",
-  "version": "0.9.52-alpha.1",
+  "version": "0.9.53-alpha.1",
   "private": true,
   "description": "Atomic's pi-compatible MCP integration for server connections, OAuth, tools, resources, and terminal management.",
   "contributors": [

package/dist/builtin/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/subagents",
-  "version": "0.9.52-alpha.1",
+  "version": "0.9.53-alpha.1",
   "private": true,
   "description": "Atomic extension for delegating tasks to subagents with parallel execution. Fork of: https://github.com/nicobailon/pi-subagents",
   "contributors": [

package/dist/builtin/subagents/src/extension/index.bundle.mjs

@@ -10864,6 +10864,8 @@ ${launch.message}` : input.task,
                 }
               } : {}
             }),
+            setExtensionStatus: context.setExtensionStatus,
+            clearExtensionStatuses: context.clearExtensionStatuses,
             bindChildSession: (session) => {
               childSession = {
                 childSessionId: session.sessionId,
@@ -13069,6 +13071,7 @@ class SubagentControlRuntime {
     let effectiveModelId = candidateModelId;
     let effectiveThinking = initialThinkingForAttempt(candidateModelId, configuredThinking);
     let transcriptManager;
+    let statusesOpen = true;
     let attemptedModels = candidateModelId ? [candidateModelId] : [];
     const selectedModel = candidate.model ?? admitted.policy.model;
     if (selectedModel)
@@ -13206,6 +13209,13 @@ class SubagentControlRuntime {
           excludedTools: admitted.policy.excludedTools ? [...admitted.policy.excludedTools] : undefined
         };
         const inherited = admitted.spec.parent?.getChildSessionOptions?.(childOptions) ?? childOptions;
+        const extensionBindings = taskHooks?.setExtensionStatus ? {
+          ...inherited.extensionBindings,
+          onStatus: (statusKey, text) => {
+            if (statusesOpen)
+              taskHooks.setExtensionStatus?.(statusKey, text);
+          }
+        } : inherited.extensionBindings;
         const agentDir = inherited.agentDir ?? getAgentDir2();
         const settingsManager = inherited.settingsManager ?? SettingsManager.create(admitted.policy.cwd, agentDir);
         const resourceLoader = new DefaultResourceLoader(inProcessChildResourceLoaderOptions({
@@ -13232,6 +13242,7 @@ class SubagentControlRuntime {
         created = {
           session: (await createAgentSession({
             ...inherited,
+            extensionBindings,
             customTools: admitted.policy.customTools ?? inherited.customTools,
             resourceLoader,
             resourceAdmissionSignal: AbortSignal.any([signals.abort, signals.interrupt]),
@@ -13486,6 +13497,8 @@ class SubagentControlRuntime {
         unsubscribe?.();
       } catch {}
       const settleTranscript = () => {
+        statusesOpen = false;
+        taskHooks?.clearExtensionStatuses?.();
         if (transcriptManager !== undefined)
           taskHooks?.bindTranscript?.(settledTranscript(transcriptManager));
       };

package/dist/builtin/web-access/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.9.52] - 2026-10-29
+
+### Fixed
+
+- `web_search` no longer ends with `Search curation cancelled (stale).` when the search curator is enabled but cannot open (for example on a machine with no desktop browser), or when the session has no human to answer it, such as a subagent or workflow stage. It returns the raw results, with a note that points to `/curator off` when the curator failed to open. When no search provider is reachable, the error now names the `EXA_API_KEY`, `PERPLEXITY_API_KEY`, and `GEMINI_API_KEY` environment variables, the `exaApiKey`, `perplexityApiKey`, and `geminiApiKey` fields in `~/.atomic/web-search.json`, and `/curator` ([#4087](https://github.com/bastani-inc/atomic/issues/4087)).
+
 ## [0.9.52-alpha.1] - 2026-10-29
 
 ### Fixed

package/dist/builtin/web-access/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/web-access",
-  "version": "0.9.52-alpha.1",
+  "version": "0.9.53-alpha.1",
   "private": true,
   "description": "Atomic extension for web search, URL fetching, GitHub repo cloning, PDF/video extraction. Fork of: https://github.com/nicobailon/pi-web-access",
   "contributors": [

package/dist/builtin/workflows/CHANGELOG.md

@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.52] - 2026-10-29
+
+Stage chats show their own status lines, and web search keeps its results.
+
+- **A stage chat's own status lines:** an attached stage chat's footer shows the extension statuses its stage's session writes, such as a tokens-per-second counter, and no longer the main session's ([#4094](https://github.com/bastani-inc/atomic/issues/4094))
+- **Web search results that arrive:** `web_search` returns its results when the search curator can't open or nobody can answer it, instead of `Search curation cancelled (stale).`, and says which keys or settings to configure when no search provider works ([#4087](https://github.com/bastani-inc/atomic/issues/4087))
+
+### Fixed
+
+- An attached stage chat's footer now shows the extension status lines (such as a tokens-per-second counter) written by that stage's own session, and no longer shows the main session's. Status writes from a stage's extensions used to be dropped, while the chat footer displayed the main chat's statuses: a sleeping stage showed a live counter driven by the main agent, and a streaming stage showed a stale one. The main chat footer keeps showing only the main session's statuses ([#4094](https://github.com/bastani-inc/atomic/issues/4094))
+
 ## [0.9.52-alpha.1] - 2026-10-29
 
 Stage chats show their own status lines, and web search keeps its results.

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.9.52-alpha.1",
+  "version": "0.9.53-alpha.1",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [

package/dist/core/agent-session-extension-bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-session-extension-bindings.d.ts","sourceRoot":"","sources":["../../src/core/agent-session-extension-bindings.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,2BAA2B,IAAI,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE9F,OAAO,EAGN,KAAK,mBAAmB,EAExB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAQ7F,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAYxD,OAAO,KAAK,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAA0B,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuBnF,cAAM,wBAAwB;IAC7B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyC;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;IAC3D,OAAO,CAAC,gBAAgB,CAAS;IACjC,QAAQ,CAAC,WAAW,cAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,SAAS,CAAS;IAE1B,YACC,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM,OAAO,EACvB,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,EAMrC;IAED,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAE9C;IAED,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAEnD;IAED,WAAW,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,IAAI,CAgBpC;IAED,eAAe,IAAI,IAAI,CAItB;IAED,mBAAmB,IAAI,IAAI,CAI1B;IAEK,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAEpC;IAEK,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAEtC;IAED,OAAO,IAAI,IAAI,CAKd;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAE7B;YAEa,OAAO;IAYrB,OAAO,CAAC,MAAM;CAOd;AA0GD,wBAAsB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCnG;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9E;AAaD,wBAAsB,6BAA6B,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnH;AAED,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GACrD,KAAK,CAAC;IACR,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;CACvB,CAAC,CAED;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAOzF;AAgBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAgBzF;AAED,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvF;AAED,wBAAsB,gCAAgC,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BxF;AAED,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,eAAe,EACvB,WAAW,CAAC,EAAE,wBAAwB,EACtC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,EACpC,cAAc,CAAC,EAAE,mBAAmB,GAClC,IAAI,CA4UN;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnG;AAiUD,qGAAqG;AACrG,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhH;AAMD;;;GAGG;AAEH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;CAYhD,CAAC"}
+{"version":3,"file":"agent-session-extension-bindings.d.ts","sourceRoot":"","sources":["../../src/core/agent-session-extension-bindings.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,2BAA2B,IAAI,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE9F,OAAO,EAGN,KAAK,mBAAmB,EAExB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAQ7F,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAYxD,OAAO,KAAK,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAA0B,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuBnF,cAAM,wBAAwB;IAC7B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyC;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;IAC3D,OAAO,CAAC,gBAAgB,CAAS;IACjC,QAAQ,CAAC,WAAW,cAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,SAAS,CAAS;IAE1B,YACC,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,YAAY,EAC1B,QAAQ,EAAE,MAAM,OAAO,EACvB,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,EAMrC;IAED,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAE9C;IAED,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAEnD;IAED,WAAW,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,IAAI,CAgBpC;IAED,eAAe,IAAI,IAAI,CAItB;IAED,mBAAmB,IAAI,IAAI,CAI1B;IAEK,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAEpC;IAEK,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAEtC;IAED,OAAO,IAAI,IAAI,CAKd;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAE7B;YAEa,OAAO;IAYrB,OAAO,CAAC,MAAM;CAOd;AA2GD,wBAAsB,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCnG;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9E;AAaD,wBAAsB,6BAA6B,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnH;AAED,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GACrD,KAAK,CAAC;IACR,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;CACvB,CAAC,CAED;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAOzF;AAgBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAiBzF;AAED,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvF;AAED,wBAAsB,gCAAgC,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BxF;AAED,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,eAAe,EACvB,WAAW,CAAC,EAAE,wBAAwB,EACtC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,EACpC,cAAc,CAAC,EAAE,mBAAmB,GAClC,IAAI,CA4UN;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnG;AAkUD,qGAAqG;AACrG,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhH;AAMD;;;GAGG;AAEH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;CAYhD,CAAC"}

package/dist/core/agent-session-extension-bindings.js

@@ -157,6 +157,7 @@ const failedExtensionStarts = new WeakSet();
 // Binding intent is session-local and survives runner reloads, even when a host object is reused.
 const humanInputBindingRevisions = new WeakMap();
 const presentationOnlyBindings = new WeakMap();
+const statusSinks = new WeakMap();
 const sessionSummaryBackfills = new WeakSet();
 function startExtensions(session, runner, loader, event, finalize) {
     const existing = extensionStarts.get(runner);
@@ -225,6 +226,8 @@ export async function bindExtensions(bindings) {
     }
     if (bindings.isPresentationOnly !== undefined)
         presentationOnlyBindings.set(this, bindings.isPresentationOnly);
+    if (bindings.onStatus !== undefined)
+        statusSinks.set(this, bindings.onStatus);
     if (bindings.commandContextActions !== undefined) {
         this._extensionCommandContextActions = bindings.commandContextActions;
     }
@@ -288,6 +291,7 @@ export function _applyExtensionBindings(runner) {
     runner.setHostBindings(this._extensionHumanInput, this._extensionDiagnosticListener, humanInputBindingRevisions.get(this));
     runner.setUIPromptObserver(uiPromptBindings.get(this));
     runner.setUIContext(this._extensionUIContext, this._extensionMode, presentationOnlyBindings.get(this) ?? false);
+    runner.setStatusSink(statusSinks.get(this));
     runner.bindCommandContext(this._extensionCommandContextActions);
     runner.bindChildSessionOptions(liveChildSessionOptions(this));
     runner.bindWorkflowJournal(this._workflowJournal, this._storageAgentDir);
@@ -870,6 +874,7 @@ async function reloadOwnedGeneration(retainedRuntimes, options) {
         this._bindExtensionCore(candidateRunner, publication, startupToolNames, startupLoadout);
         candidateRunner.setHostBindings(this._extensionHumanInput, this._extensionDiagnosticListener, humanInputBindingRevisions.get(this));
         candidateRunner.setUIContext(this._extensionUIContext, this._extensionMode, presentationOnlyBindings.get(this) ?? false);
+        candidateRunner.setStatusSink(statusSinks.get(this));
         candidateRunner.bindCommandContext(this._extensionCommandContextActions);
         candidateRunner.bindChildSessionOptions(liveChildSessionOptions(this));
         candidateRunner.bindWorkflowJournal(this._workflowJournal, this._storageAgentDir);