Wave 1: merge the checked fix PRs into rel/xp-build

.github/workflows/audit.yml

@@ -0,0 +1,47 @@
+# Known security advisories in the packages we ship (ATO-1415).
+#
+# Reads only the lockfile against the npm advisory database, so it needs no install. Dev-only
+# packages (vitest, esbuild, ...) are left out: they never reach users. A high or critical
+# advisory fails the check; fix it with a patch-level bump or an `overrides` entry in
+# package.json, the way PR #1079 did.
+#
+# Kept out of the Test workflow on purpose. The advisory database changes on its own, so a
+# check on every PR would turn unrelated PRs red the day a new advisory lands. On PRs it runs
+# only when the dependency files change; new advisories against main are caught by the push
+# and weekly runs instead.
+
+name: Audit
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - package.json
+      - package-lock.json
+      - .github/workflows/audit.yml
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: npm audit (production dependencies)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "25.7"
+          check-latest: true
+
+      - name: Audit the lockfile
+        run: npm audit --package-lock-only --omit=dev --audit-level=high

.github/workflows/desktop-smoke-windows.yml

@@ -38,10 +38,18 @@ on:
   pull_request:
     branches:
       - rel/xp-build
+    # Everything that goes into the app the smoke launches. Workflow files are
+    # all listed, not just this one: a PR that only edits desktop.yml or
+    # release.yml (like #841) changes how the app is built and shipped, and
+    # used to get no checks at all (ATO-916).
     paths:
       - "desktop/**"
       - "src/**"
-      - ".github/workflows/desktop-smoke-windows.yml"
+      - "scripts/**"
+      - "package.json"
+      - "package-lock.json"
+      - "tsconfig*.json"
+      - ".github/workflows/**"
 
 concurrency:
   group: desktop-smoke-windows-${{ github.event.pull_request.number || github.ref }}-${{ inputs.tasks || 'all' }}

.github/workflows/test.yml

@@ -21,7 +21,9 @@ name: Test
 
 on:
   pull_request:
-    branches: [main]
+    # rel/xp-build is the desktop release branch. It carries the same agent
+    # code as main, so PRs into it get the same checks (ATO-916).
+    branches: [main, rel/xp-build]
   push:
     branches: [main]
 

SECURITY.md

@@ -0,0 +1,65 @@
+# Security Policy
+
+Atomic Agent runs shell commands, edits files and drives a browser on your machine, so we treat security reports as our top priority. Thank you for helping keep users safe.
+
+## Reporting a vulnerability
+
+Please do not open a public issue, pull request or Discord post for a security problem.
+
+Report it privately in one of two ways:
+
+1. **GitHub private vulnerability reporting (preferred).** Open [Security → Report a vulnerability](https://github.com/AtomicBot-ai/atomic-agent/security/advisories/new) in this repository. Only the maintainers can see the report, and we can work on the fix and the advisory with you there.
+2. **E-mail:** [support@atomicbot.ai](mailto:support@atomicbot.ai). Put `SECURITY` at the start of the subject line.
+
+Please include:
+
+- the version (`atomic-agent --version`, or the desktop release you installed) and your OS;
+- what an attacker can do, and what they need first (a malicious web page, a crafted repository, a hostile MCP server, local access, and so on);
+- steps to reproduce, ideally a minimal proof of concept;
+- any logs or traces, with your own keys removed.
+
+## What happens next
+
+- We confirm we received the report within 3 business days.
+- We send a first assessment (whether we can reproduce it and how severe we think it is) within 10 business days.
+- We keep you updated until it is fixed, and we tell you before anything is published.
+- Once a fix is released, we publish a GitHub security advisory and credit you by name or handle, unless you ask us not to.
+
+Please give us a reasonable time to ship a fix before you disclose the issue publicly. We aim to fix critical issues within 30 days.
+
+## Supported versions
+
+We fix security issues in the latest release of:
+
+- the terminal agent (`v0.x` releases, installed with the install script or a Linux package);
+- the desktop app (`desktop-v0.x` releases).
+
+Both update in place. Please check that a problem still happens on the latest release before you report it.
+
+## Scope
+
+In scope, for example:
+
+- a way to run a command, write or delete a file, send a message or submit a form **without the approval prompt** the action should show;
+- a prompt injection (from a web page, a file, a repository, an e-mail or an MCP tool result) that gets around an approval, a blocked command or a read-scope check;
+- a way to read the agent's own secrets (`<stateDir>/.env`, `config.json`, provider keys) without the prompt that should guard them, or to get them past the masking of secrets in tool output;
+- a way for a project folder to grant itself permissions it should not have;
+- data leaving the machine in a way the [README](README.md#privacy-and-egress) does not describe, including through analytics or crash reports;
+- problems in the installer, the update flow, or the signing and checksums of release files.
+
+Out of scope:
+
+- actions you approved, or that run unasked because you chose a higher approval level, a session grant or an "always allow" rule;
+- at approval level 5 (full trust), or in an overnight run started with `--no-approval`, the agent doing what it is asked;
+- what a skill, a shell command or an MCP server you installed and allowed does on its own;
+- a model giving wrong or harmful answers without crossing a security boundary;
+- issues in third-party services (model providers, MCP servers, websites) that are not caused by Atomic Agent;
+- the atomicagent.io website, unless it affects the agent or its downloads (report those to the same contacts, and we will route them).
+
+## Safe harbor
+
+We will not take legal action against research done in good faith under this policy: test only on your own machine and accounts, do not access other people's data, do not degrade our services, and give us time to fix the issue before you disclose it.
+
+## More
+
+How the agent protects you (approvals, Trash instead of delete, blocked commands, telemetry and signed builds) is described at [atomicagent.io/security](https://atomicagent.io/security) and in the [Safety and Observability](README.md#safety-and-observability) section of the README.

desktop/ANALYTICS.md

@@ -55,6 +55,8 @@ and `preload/preload.ts` (`window.atomic.track` / `window.atomic.reportError`).
 | `ATOMIC_AGENT_ANALYTICS` | `off` on a test or dev run, when the terminal opt-out is inherited, or under `DO_NOT_TRACK=1` |
 | `ATOMIC_AGENT_INSTALL_ID_FILE` | `<desktop state dir>/install-id` on a test or dev run; otherwise inherited unchanged |
 
+`ATOMIC_AGENT_TEAM` is not set here, it is inherited: with it (`1` / `true` / `yes` / `on`), or with a file `~/.atomic-agent-team`, the machine is one of ours (ATO-1247). The desktop and the agent still send their events, each tagged `test_run: true` with the person property `atomic_team: true`, so PostHog can leave them out of the metrics.
+
 ## Global properties (every event)
 
 `surface: desktop`, `platform`, `arch`, `arm64_translation`, `desktop_version`,
@@ -76,7 +78,7 @@ send `ui` events.
 | Group | Main process | Renderer |
 |---|---|---|
 | Lifecycle | `app_opened`, `app_ready`, `agent_start_failed`, `agent_restarted` (manual / switch / auto / setup_finished / workspace_change / import / telegram / other), `window_crashed`, `app_closed`, `debug_report_saved`, `analytics_disabled` | |
-| Setup | `provider_key_checked` (ok / rejected / unreachable / payment_required), `model_configured` | `onboarding_step`, `onboarding_skipped`, `model_picked`, `provider_setup_started`, `provider_setup_failed` (… / catalog_empty / server_unreachable / certificate / timed_out / key_rejected / provider_error / list_failed; `provider_preset`), `custom_endpoint_tested` |
+| Setup | `provider_key_checked` (ok / rejected / unreachable / payment_required), `model_configured` | `onboarding_step`, `onboarding_skipped`, `model_picked`, `provider_setup_started`, `provider_setup_failed` (… / catalog_empty / server_unreachable / certificate / timed_out / key_rejected / provider_error / agent_crashed / not_json / no_binary / list_failed; `provider_preset`, `kind` cloud / custom, as in `model_configured`), `custom_endpoint_tested`, `subscription_login_clicked`, `subscription_terminal_opened` (opened; terminal or reason), `subscription_login_succeeded` (seconds_to_sign_in) |
 | Models and backend | `model_download_started`, `model_download_finished`, `hf_lookup`, `llama_runtime_updated`, `local_backend_started`, `local_backend_supervised`, `local_backend_crashed`, `engine_recovery_shown`, `backend_switched`, `model_switched`, `fusion_configured` | |
 | Chat | `chat_turn_ui` (outcome completed / stopped_early (step or time limit, no progress, out of credit) / failed / cancelled; `error_category`, `http_status` on a failure) | `message_action`, `approval_answered`, `approval_closed` (stopped / expired / replaced / not_waiting), `coding_mode_changed`, `plan_handoff`, `attachment_added` (image / document; size bucket; button / drop / paste) |
 | Features | `voice_used`, `voice_setup`, `task_created`, `task_action`, `overnight_started` (has_budget, hours, notify_telegram), `skill_installed`, `skill_action`, `telegram_setup` (enable / token_saved / token_cleared / owner_cleared), `composio_setup` (key_saved / key_removed / key_checked / enable / disable; ok / unverified / rejected / error), `import_run`, `workspace_chosen` | `ui_action`, `slash_command_used`, `settings_pane_viewed`, `session_action`, `mcp_server_added`, `mcp_server_action` |
@@ -157,6 +159,10 @@ Notes on specific properties:
   `settings` (Settings' model list), `selector` (the composer's picker),
   `first_run` (the starter model), `spotlight` (the chat's "New: <name>" card,
   Download and switch), or `other`.
+- `model_download_started.projector_only` (also on `model_download_finished`):
+  the weights were already on disk and only the vision projector downloaded
+  (Get vision files, or a Retry after the projector failed). Not a new model
+  download: filter it out when counting those.
 - `llama_runtime_updated.trigger`: `setup` (the first-run runtime phase),
   `settings` (Settings' engine install or update, and Download again), or
   `launch` (the launch installing Atomic Core's backend before it starts the
@@ -206,7 +212,11 @@ no agent is running).
   `kind` / `reason` / `exit_code` enums. `RenderProcessGone` also carries
   `recovered` (`yes`: main reloaded the page; `no`: it crashed more than
   twice in a minute and the person was asked instead, ATO-765). At most 30 reports per session,
-  3 per signature.
+  3 per signature, and across launches at most 10 identical events (same
+  fingerprint and same message, numbers, paths and ids aside) per install
+  per rolling hour (ATO-1286, `main/sentry/rate-limit.ts`; the count is kept
+  as key hashes and timestamps in `sentry-rate-limit-desktop.json` in the
+  state dir).
 - An unexpected agent exit also carries `auto_restart_attempt`: 0 when the
   agent that ended was not started by an automatic restart, else which of
   the three attempts started it (ATO-767, `main/agent-auto-restart.ts`).

desktop/README.md

@@ -422,6 +422,14 @@ Real, driven by the running agent:
   `setActiveText` — its route lands on `local-llama` only because a fresh
   install has no `llm` block — so on the TUI the same choice on such an
   install leaves the cloud route active until the composer chip is used.
+- the choose screen has three cards that do not mix (ATO-816): **Local
+  models** downloads a model, **Cloud models** lists API keys and
+  subscriptions only, and **Custom** lists what you already run: the apps on
+  this Mac (Atomic Chat, Ollama, LM Studio), a **llama.cpp server** (the URL
+  step, `custom_chat_url`) and any OpenAI-compatible URL. Both lists are the
+  same provider step (`cloud`); Back from the URL step returns to the Custom
+  list. A click scenario that wants Ollama clicks **Custom**, not
+  **Cloud models**. The terminal's own wizard is unchanged.
 - the add-provider wizard: the TUI's kind list (nothing preselected) → key /
   base URL → verification by listing the provider's models under that key →
   saved, activated, and a default model picked
@@ -657,7 +665,7 @@ Honestly degraded, and labelled as such in the UI:
   the two surfaces cannot disagree. `atag models list` prints no description
   and no RAM figures and has no `--json`, so `desktop/main/model-catalog.ts`
   vendors `description` / `minRamGb` / `recommendedRamGb` / `fileSizeGb` /
-  `supportsVision` / `recommendRank` / `tag` / `uncensored` from `src/local-llm/models-catalog.ts`
+  `supportsVision` / `recommendRank` / `tag` / `uncensored` from `src/local-llm/catalog/models-catalog.ts`
   and `modelsList()` joins them on by id. `app:hostRam` (`os.totalmem()`) is
   the other input. A model whose `recommendedRamGb` the machine meets runs
   comfortably; between `minRamGb` and `recommendedRamGb` it is a tight fit and
@@ -672,8 +680,17 @@ Honestly degraded, and labelled as such in the UI:
   plainly that it is small and will get more wrong, which on a weak machine is
   exactly the model being recommended. An id the vendored table does not know
   — every `custom-…` model added from Hugging Face — renders with no blurb and
-  with its RAM figure labelled an estimate; nothing is invented for it, and
+  with its RAM figure labelled an estimate (the agent's own size rule,
+  `ramEstimateFromSize`); nothing is invented for it, and
   the smoke asserts the two id lists agree so the copy cannot rot in silence.
+  ATO-1410: a bare "Needs N GB" is always `recommendedRamGb`, the figure the
+  terminal prints too, and a model is named by its catalogue name without
+  the "GGUF" tail in both clients. Those rules are
+  `main/model-memory-words.ts`, a byte-for-byte copy of the agent's
+  `src/local-llm/catalog/model-memory-words.ts`;
+  `test/model-catalog-drift.test.mjs` compares that copy and every vendored
+  field (names and both RAM figures included) with the agent's source, and the
+  smoke compares names and RAM figures with `atag models recommend --json`.
   Driven on three machine sizes by `npm run drive:models` (68 GB real, 8 GB
   and 4 GB simulated with the test-only `--fake-ram`).
 - **A model under `minRamGb` asks first** (ATO-337, `modelRamWarning` in

desktop/main/agent-auto-restart-wire.ts

@@ -18,12 +18,15 @@ export interface AutoRestartHost {
   say: (line: string) => void;
   /** Off in a smoke run, whose checks end agents on purpose. */
   armed: boolean;
+  /** ATO-1285: the exiting agent's last error in plain words, or null. */
+  cause?: () => string | null;
 }
 
 export function wireAgentAutoRestart(client: AgentClient, host: AutoRestartHost): AgentAutoRestart {
   const tagAttempt = (n: number) => setSourceTags("agent-exit", { auto_restart_attempt: n });
   tagAttempt(0);
   const restarter = new AgentAutoRestart({
+    ...(host.cause ? { cause: host.cause } : {}),
     start: (attempt) => {
       // The agent this attempt brings up reports its exit as started by it.
       tagAttempt(attempt);
@@ -37,7 +40,7 @@ export function wireAgentAutoRestart(client: AgentClient, host: AutoRestartHost)
       } else if (notice.kind === "restarted") {
         host.say(`[desktop] the agent is running again after an automatic restart (attempt ${notice.attempt})`);
       } else if (notice.kind === "gave_up") {
-        host.say(`[desktop] the agent exited unexpectedly again after ${notice.attempts} automatic restarts; not restarting it until asked`);
+        host.say(`[desktop] the agent exited unexpectedly again after ${notice.attempts} automatic restarts; not restarting it until asked${notice.cause ? ` (${notice.cause})` : ""}`);
       }
       host.send("agent:autoRestart", notice);
     },