Upgrade Atomic to the stable 0.9.43 release

apps/server/src/harness/atomic/full.test.ts

@@ -1,7 +1,7 @@
 import { afterAll, expect, test } from "bun:test";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { HarnessAgent } from "@ai-sdk/harness/agent";
 import { createJustBashNetworkSandboxSession } from "@ai-sdk/sandbox-just-bash";
 import { jsonSchema, tool } from "ai";
@@ -341,6 +341,10 @@ export default workflow({
 				let files = {
 					operator: await Bun.file(join(agentDir, "settings.json")).exists(),
 					journal: await Bun.file(journal).exists(),
+					journalDirectoryMode: await stat(dirname(journal)).then(
+						info => info.mode & 0o777,
+						() => undefined,
+					),
 					defaultJournal: await Bun.file(join(root, "workflows", "journal.sqlite")).exists(),
 					environment: process.env.ATOMIC_WORKFLOW_JOURNAL_PATH,
 					project: projectPackage
@@ -558,6 +562,8 @@ test(
 			// and through the session rather than the process-wide environment variable.
 			expect(result.files).toMatchObject({ journal: true, defaultJournal: false });
 			expect(result.files?.environment).toBeUndefined();
+			// Only the server's user can enter its directory, which also holds the worker-logs/ Atomic keeps.
+			expect(result.files?.journalDirectoryMode).toBe(0o700);
 		} finally {
 			if (environment !== undefined) process.env.NODE_ENV = environment;
 			await room.close();

docs/self-hosting.md

@@ -75,7 +75,7 @@ each owner's GitHub App user token and does not consume `HARNESS_AUTH`;
 setting `auto` on loopback passes the startup guard but does not enable host
 login in that adapter.
 
-`HARNESS=atomic` runs Atomic 0.9.42 in the Chopin server process through its
+`HARNESS=atomic` runs Atomic 0.9.43 in the Chopin server process through its
 headless SDK (`createAgentSession()`). It does not spawn the `atomic` CLI or use
 RPC mode.
 
@@ -165,6 +165,17 @@ Atomic caveats:
   [Full Atomic Planner](hosted-agent.md#full-atomic-planner)). The Docker image
   sets `XDG_STATE_HOME=/var/lib/chopin`; mount a volume there to keep runs
   and those directories when the container is replaced.
+- Local workflow worker pools stay off unless the operator's Atomic settings
+  set `workflows.localWorkers`. With a pool, Atomic 0.9.43 keeps each worker's
+  standard error in `worker-logs/` beside the journal, so under
+  `$XDG_STATE_HOME/chopin/atomic/worker-logs/<run id>/`, inside the directory
+  Chopin creates for the journal with access for the server's user only. It
+  deletes a log when its worker shuts down normally but keeps the logs of
+  workers that failed; remove them yourself. A child whose worker dies is
+  replayed on a new worker, up to three attempts; after that the run fails and
+  its card in Chat says so. The settings `workflows.localWorkers.startupTimeoutMs`
+  and `leaseMs` set how long a worker may take to start and how long an
+  unresponsive one keeps its child.
 - Atomic depends on `typebox` 1.3.27 while Chopin pins 1.3.7. Host tool schemas
   pass to Atomic as plain JSON Schema, so the two versions never meet.
 

package.json

@@ -69,7 +69,7 @@
 				"@ai-sdk/harness": "1.0.146",
 				"@ai-sdk/mcp": "2.0.72",
 				"@ai-sdk/sandbox-just-bash": "1.0.146",
-				"@bastani/atomic": "0.9.42",
+				"@bastani/atomic": "0.9.43",
 				"ai": "7.0.135",
 				"typebox": "1.3.7",
 				"zod": "4.4.3"