Batch 2026-10-05 (big): 30 PRs combined

.dagger/src/index.ts

@@ -542,6 +542,11 @@ export class AtomicServer {
           dag.cacheVolume('flutter-pub-cache'),
         )
         .withDirectory('/workspace/flutter', this.source.directory('flutter'))
+        // `flutter/pubspec.yaml` points at ../packages/atomic_flutter.
+        .withDirectory(
+          '/workspace/packages',
+          this.source.directory('packages'),
+        )
         .withWorkdir('/workspace/flutter')
         .withExec([
           'bash',
@@ -818,6 +823,11 @@ export class AtomicServer {
         ])
         .withDirectory('/workspace/lib', this.source.directory('lib'))
         .withDirectory('/workspace/flutter', this.source.directory('flutter'))
+        // `flutter/pubspec.yaml` points at ../packages/atomic_flutter.
+        .withDirectory(
+          '/workspace/packages',
+          this.source.directory('packages'),
+        )
         .withMountedCache('/workspace/flutter/rust/target', flutterRustTarget, {
           sharing: CacheSharingMode.Locked,
         })

.github/workflows/atomic-flutter.yml

@@ -0,0 +1,22 @@
+name: Atomic Flutter package
+on:
+  pull_request:
+    paths: ['packages/atomic_flutter/**', 'flutter/**', '.github/workflows/atomic-flutter.yml']
+  push:
+    paths: ['packages/atomic_flutter/**', 'flutter/**', '.github/workflows/atomic-flutter.yml']
+jobs:
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: subosito/flutter-action@v2
+        with:
+          flutter-version: '3.44.7'
+          channel: stable
+          cache: true
+      - run: flutter pub get
+        working-directory: packages/atomic_flutter
+      - run: flutter analyze
+        working-directory: packages/atomic_flutter
+      - run: flutter test
+        working-directory: packages/atomic_flutter

.gitignore

@@ -19,6 +19,7 @@ server/assets_tmp
 # Same, for the plugin assets `build.rs` stages before embedding them.
 server/integrations_assets_tmp
 server/js-build.log
+server/js-inputs.hash
 .netlify
 scratchpad
 # Local Claude Code state stays out; the shared cloud-session hook is tracked.

AGENTS.md

@@ -153,6 +153,17 @@ second writer on tracked files. Four ways that has cost real time:
   `browser/data-browser` and commit the `.po` files. A component whose strings
   never made it into the catalogs renders them blank in a production build,
   and only e2e notices. Check the diff doesn't drop real translations.
+  With large removals `git diff` can show a kept entry (say "AI chat") as
+  removed in one place and added in another, so compare msgids, not lines,
+  before concluding a live string was lost. The dev server only marks unused
+  entries obsolete (`#~`) and never removes them, so `--clean` also drops the
+  obsolete entries that piled up since the last settle; that part is expected.
+- **Extraction bugs are fixed in `browser/patches/wuchale@*.patch`.** Wuchale
+  0.25 dropped markup inside JSX expressions, such as `{a && <p>{x}</p>}`
+  followed by more markup: the text rendered but never reached the catalogs.
+  If a visible string is missing from `en.po` after `pnpm clean-translations`
+  and has no `@wc-ignore`, suspect the extractor before adding entries by
+  hand; hand-added entries are removed by the next clean.
 
 Strings a model reads — tool descriptions, prompts, instructions — must be
 `@wc-ignore`d. A translated tool name is not a tool name. See
@@ -162,6 +173,15 @@ After touching anything that renders text, read the `.po` diff by hand: a
 guarded element can silently drop sibling strings, and entries re-key when an
 icon moves into a message.
 
+## Running a branch for another device
+
+`scripts/run-branch.sh <branch> [--tunnel]` builds a branch in its own worktree and target dir and serves it on 0.0.0.0.
+
+- The app needs a secure origin (OPFS). Plain http works on `http://localhost` only; from a phone or tablet over `http://<lan-ip>` it fails with "This browser could not open local storage". Use `--tunnel` (cloudflared quick tunnel, public while it runs) or the Chrome flag `unsafely-treat-insecure-origin-as-secure`.
+- The server derives the origin it accepts logins for from `ATOMIC_DOMAIN` (+ port, http). Behind a tunnel set `ATOMIC_DOMAIN` to the public host, otherwise the websocket auth fails with "does not name this server". `ATOMIC_SERVER_URL` is not read.
+- Do not use tunnelto: it drops the websocket and the app stays on "Loading".
+- A global `build-dir` in `~/.cargo/config.toml` is shared by every repo and carries one lock. A running `cargo run` then blocks every other cargo (also the one inside `wasm-pack`) silently at 0% CPU, which looks like a hung build. Set `CARGO_BUILD_BUILD_DIR` to a private dir, as the script and `build:wasm` do.
+
 ## Quick Dev Setup
 
 Use the Charlotte MCP server and navigate to `http://localhost:6747/app/dev-drive` to instantly create a fresh agent.

CHANGELOG.md

@@ -7,6 +7,7 @@ See [STATUS.md](server/STATUS.md) to learn more about which features will remain
 
 ## UNRELEASED
 
+- `--served-domain-suffix` / `ATOMIC_SERVED_DOMAIN_SUFFIX` takes a comma-separated list (`atomicserver.eu,atomic.place`), so a node can answer under two domains while it moves from one to the other.
 - Forms (beta): guests can fill in a form without an account, and each answer
   becomes a row in a Table. New default ontology `forms`
   (`lib/defaults/forms.json`: `Form`, `FormPage`, `FormField`, `FormHeading`,
@@ -38,6 +39,13 @@ See [STATUS.md](server/STATUS.md) to learn more about which features will remain
   recipient could hold. Read rights are checked per subscriber against the
   resource when it is sent, and a connection already reached through the
   resource or its drive doesn't get it twice.
+- End-to-end encrypted conversations. `atomic_lib::conversation` derives an
+  agent's X25519 `encryptionKey`, keeps a conversation's keys in a keyring
+  wrapped to each member, and seals and opens messages; the WASM build exports
+  it. New default ontology `conversations` (`lib/defaults/conversations.json`)
+  with the `Conversation` and `SealedMessage` classes. New endpoint
+  `/conversations` lists the conversations on the server the requesting agent
+  is a member of. See `planning/encrypted-conversations.md`.
 
 - New default ontology `notifications` (`lib/defaults/notifications.json`):
   the `Inbox` and `Notification` classes, and an `inbox` property the private

TESTING_COVERAGE.md

@@ -1979,6 +1979,13 @@ discard a readable product attachment or abort context preparation.
 subsequent reads of its error placeholder. Existing gap-recovery and ingress
 tests cover missing-history and snapshot recovery; these are not proof that
 every resource in a user's live session has recovered.
+`sync-delta-local-base.test.ts` covers a sync delta for a resource the local
+query hydrated from JSON-AD (no Loro history): it is replayed on the local
+database's snapshot without a server round trip, and the rebuilt doc is not
+written back over that history (#1905).
+`useDriveApps.localBase.test.tsx` covers the "+ Add view" case of it: an app's
+edit arriving that way while the menu is open (#1846). Editing a resource that
+is still without its history (it is saved from the rebuilt doc) is not covered.
 
 `toolHistory.test.ts` checks interrupted tool calls remain explicitly unknown
 in outgoing model history, completed calls retain results, and persisted tool
@@ -2580,3 +2587,13 @@ refused subscribe is dropped.
 - The paired SaaS `portal/e2e/onboarding.spec.ts` closes the original context,
   downloads the vault into a fresh browser, verifies the saved document and
   profile, requires a clean console, and budgets metadata reads after reload.
+
+## Flutter account package (draft)
+
+`packages/atomic_flutter/test/account_test.dart` covers device approval, provider
+origin binding, redirect refusal, account/backup mismatch, authenticated discovery,
+AES-GCM envelope compatibility with an independently generated Node fixture,
+tamper rejection, and closing during a pending request. Atomic Audio additionally
+checks isolated native identity installation and actual bidirectional iroh/Loro
+with BLAKE3 files introduced after pairing. Production account approval, Vault
+transport and recovery on a physical device are not covered by these tests.

browser/CHANGELOG.md

@@ -4,6 +4,7 @@ This changelog covers all five packages, as they are (for now) updated as a whol
 
 ## UNRELEASED
 
+- Invites: opening an invite link uses the server in the link instead of whichever server the browser had saved, so an invitee with a stale saved server no longer gets "Unrecognized token '<'". When the link points at a host that runs no server, a plain message says so. Creating a link for a drive whose server runs no node fails up front.
 - Forms (beta): build a form or survey and share a link; guests fill it in
   without an account and each answer becomes a table row. Create one with
   New > Form, or from a table with "Create form from this table" (pick its
@@ -25,7 +26,29 @@ This changelog covers all five packages, as they are (for now) updated as a whol
   edit.
 - Fix: uploaded SVG files display in the data browser.
 
+- The per-group summary under a table has column headings, such as "Sum of Plus ones" and "Rows", so a bare number says what it measures.
+- Tables: deleting a row you typed in the same session no longer shows its
+  neighbour twice until you reload.
+- Sidebar: notifications and sync have their own icon buttons next to Settings
+  (they stay in the account menu too), in the same muted color as the menu's
+  items, with an unread dot on the bell. The dividers in the menu are gone.
+- Share: names under "People with access" open that person's profile.
+- Error toasts: long subject URLs are shortened in the message. Copy still
+  copies the full text.
+- Tables: right-click a row's number to get the same menu as right-clicking one
+  of its cells. Select several cells with shift+click or by dragging and
+  right-click them for a menu that acts on all of them: clear the values, set
+  one value in all of them, or delete the rows they touch. Delete is one undo
+  step.
+- Tables: drag a view's tab to change the order of the views.
+- Tables: tick rows to delete several at once. Hover a row's number (or look
+  left of it on a touch screen) for a checkbox. Once one row is ticked every
+  row shows its checkbox, and the toolbar next to the filter button shows how
+  many are ticked with a delete button. Undo brings all of them back at once.
+
 - Signing in with an account whose identity is stored under the older `atomic:agent:` spelling no longer fails to keep the previous identity on this device ("no stored key for ..."). The same agent is now recognised in either spelling.
+- A link or mention that points at a table View now opens the table with that view selected, instead of the view's configuration.
+- A Number column's total or average no longer shows a small nonzero value as 0, and a Number filter typed as `2.5e-5` or with trailing zeros finds the same rows as the plain number.
 - The shared sign-in card no longer says "This browser does not support passkeys".
   Where a passkey cannot work it shows no passkey option at all, and the
   portal and the app now decide that the same way.
@@ -73,6 +96,23 @@ This changelog covers all five packages, as they are (for now) updated as a whol
   list), and leaves the drive channel alone when it can't read the drive. One
   tab is one session across channels (`Store.presenceSessionId`), so nobody
   shows up twice.
+- Signed in to a hosted account, the app now links its identity to that
+  account (`/api/agent-link`), once per session and only after the identity
+  check has settled on it. Services that only ever see a signature, like the
+  integration proxy, can then tell which account a request is for, also when
+  the account has no drive or paid plan. An account service without agent
+  links, an email that was never confirmed, or an identity linked to another
+  account are left alone. Builds that know no account service make no
+  requests for it.
+- Messages: send someone a direct message that only the two of you can
+  read. Pick "Message" on anyone's avatar, or start one from the new Messages
+  section in the sidebar with their Atomic ID. The server that holds the
+  conversation stores it encrypted. It can see who talks to whom and when,
+  not what is said. Someone who has never opened the app since this release
+  has no key yet, and the app says so.
+- `@tomic/lib`: the `conversations` ontology, and `Store.subscribeLive` to
+  keep a resource outside the open drive live.
+
 - Notifications are less noisy. The Notifications page shows one row per
   conversation ("Sanne and Polle: 3 new messages in Team chat") with names and
   titles as they are now, in your language. Coming back to the window while
@@ -138,6 +178,10 @@ This changelog covers all five packages, as they are (for now) updated as a whol
   demo that does finish after the notice sends a second, informational report
   with its total time. The notice fires at a fixed 45 seconds, so until now a
   slow machine and a stuck one looked the same in Sentry (`ATOMIC-BROWSER-1J`).
+- Settings → Integrations: the proxy and plugin catalog URL fields only show
+  a Save button below them. Resetting to the default is now a small Reset
+  button at the end of the field, shown only while the value differs from the
+  default.
 
 - Pasting an agent secret that opens a different agent than the signed-in
   account no longer signs that account out on its own. The app now says which

browser/data-browser/index.html

@@ -7,7 +7,7 @@
       content="width=device-width, initial-scale=1.0, viewport-fit=cover, interactive-widget=resizes-content"
     />
     <meta
-      content="The easiest way to create, share and model Linked Atomic Data."
+      content="__APP_DESCRIPTION__"
       name="description"
     />
     <link href="/app_data/images/icon.png?v=place-inside-1" rel="icon" type="image/png" />
@@ -120,7 +120,7 @@
       href="https://fonts.googleapis.com/css2?family=Montserrat:wght@700&family=Open+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap"
       rel="stylesheet"
     />
-    <title>Atomic Place</title>
+    <title>__APP_NAME__</title>
     <style>
       :root {
         --text-splash: black;
@@ -321,7 +321,7 @@
           </svg>
         </span>
       </span>
-      <p class="boot-caption">Loading Atomic Place…</p>
+      <p class="boot-caption">Loading __APP_NAME__…</p>
     </div>
     <div id="root"></div>
 

browser/data-browser/package.json

@@ -146,7 +146,7 @@
     "build:website-runtime": "node scripts/build-website-runtime.mjs",
     "build": "if [ \"$SKIP_WASM_BUILD\" = \"1\" ]; then echo 'SKIP_WASM_BUILD=1, skipping wasm-pack'; else pnpm build:wasm; fi && vite build",
     "build:tauri": "pnpm --filter \"@tomic/lib\" --filter \"@tomic/react\" run build && pnpm build:wasm && TAURI=1 vite build",
-    "build:wasm": "cd ../../wasm && export CARGO_TARGET_DIR=../target/wasm-pack && cargo run -q --package cargo-bin -- wasm-pack --version && env -u CARGO_ENCODED_RUSTFLAGS -u RUSTFLAGS cargo run -q --package cargo-bin -- wasm-pack build --target web --out-dir pkg && cp pkg/atomic_wasm.js pkg/atomic_wasm_bg.wasm ../browser/data-browser/public/wasm/",
+    "build:wasm": "cd ../../wasm && export CARGO_TARGET_DIR=../target/wasm-pack CARGO_BUILD_BUILD_DIR=../target/wasm-pack/build && cargo run -q --package cargo-bin -- wasm-pack --version && env -u CARGO_ENCODED_RUSTFLAGS -u RUSTFLAGS cargo run -q --package cargo-bin -- wasm-pack build --target web --out-dir pkg && cp pkg/atomic_wasm.js pkg/atomic_wasm_bg.wasm ../browser/data-browser/public/wasm/",
     "dev": "vite",
     "dev:tauri": "pnpm --filter \"@tomic/lib\" --filter \"@tomic/react\" run build && TAURI=1 vite",
     "format-check": "oxfmt -c ../.oxfmtrc.json --check ./src",

browser/data-browser/src/actions/resourceActions.tsx

@@ -2,6 +2,7 @@ import toast from 'react-hot-toast';
 import { canvas, core, dataBrowser, forks, server } from '@tomic/react';
 import {
   FaArrowUpRightFromSquare,
+  FaChartPie,
   FaClock,
   FaCode,
   FaCodeBranch,
@@ -335,6 +336,17 @@ export const resourceActions: ActionDefinition[] = [
     toolName: 'show_history',
     run: ctx => ctx.navigate(historyURL(ctx.subject)),
   },
+  {
+    id: 'space-usage',
+    scope: 'resource',
+    section: 'action',
+    label: () => 'Space usage',
+    helper: () => 'See how much space this resource and what is in it take up.',
+    keywords: ['storage', 'size', 'space', 'disk', 'bytes', 'quota'],
+    icon: () => <FaChartPie />,
+    run: ctx =>
+      ctx.navigate(`${paths.storage}?at=${encodeURIComponent(ctx.subject)}`),
+  },
   {
     id: 'parent',
     scope: 'resource',

browser/data-browser/src/bootstrap.ts

@@ -4,6 +4,7 @@ import defaultStore from '@repo-lib-defaults/default_store.json';
 import tableDefaults from '@repo-lib-defaults/table.json';
 import dashboardDefaults from '@repo-lib-defaults/dashboard.json';
 import chatroomDefaults from '@repo-lib-defaults/chatroom.json';
+import conversationsDefaults from '@repo-lib-defaults/conversations.json';
 import ontologiesDefaults from '@repo-lib-defaults/ontologies.json';
 import aiDefaults from '@repo-lib-defaults/ai.json';
 import meetingDefaults from '@repo-lib-defaults/meeting.json';
@@ -84,6 +85,7 @@ export function bootstrap(store: Store): void {
     addBootstrapped(tableDefaults);
     addBootstrapped(dashboardDefaults);
     addBootstrapped(chatroomDefaults);
+    addBootstrapped(conversationsDefaults);
     addBootstrapped(ontologiesDefaults);
     addBootstrapped(aiDefaults);
     addBootstrapped(meetingDefaults);