v0.7.0

The desktop app is updated too: Desktop v0.0.8. This release is called Overnight. Give the agent a long task, a budget and a time limit, go to sleep, and read what it did in the morning.

Overnight runs

• atomic-agent overnight "<task>". One command for a long unattended run. --budget <usd> caps the money, --hours <h> caps the time (8 by default, up to 24), --dir <path> picks the folder, --notify telegram sends the report if no desktop app or TUI is using your Telegram bot, --detach moves it to the background and prints the task id and log path. A live line per step shows the step, the time and the spend: [step 12 | 14m | $0.42 of $5.00] read src/app.ts.
• Approvals during an overnight run. By default an action that needs approval is denied; the log names each one and the summary says how many. --no-approval allows everything for that run; use it only in a folder you can throw away.
• Budgets for tasks and turns. agent.task.maxCostUsd and task create --max-cost-usd <n> --max-duration <dur>. When the cap is reached the agent writes a short summary and stops with stopped: spent $X of $Y budget. Spend is an estimate from the provider's price list and counts the main agent only, not Fusion workers, memory or compaction, so a run can end slightly over the cap. Local models count as $0.
• Tasks resume after a crash. Background tasks save a checkpoint after every step. If the agent crashes or the app restarts, the task continues from the last finished step instead of starting over (agent.task.resumeInterrupted, up to agent.task.maxResumes = 3 times). Do not count on this for a terminal atomic-agent overnight run yet.
• Done, Failed, Needs you. A finished task's Telegram report lists Done, Failed and Needs you, with the number of steps, the time and the reason it stopped. /status in Telegram shows running background tasks. Set ATOMIC_AGENT_TASKS_REPORT_QUIET_HOURS=23:00-08:00 to hold reports at night and get one morning report instead.
• /goal in the TUI. Give the chat a checklist, plus optional checks such as check: npm test, and it keeps working round after round until every item passes, it needs you, or it reaches 10 rounds. /goal status, /goal pause, /goal resume, /goal clear.
• Long normal work is no longer taken for a loop. Re-running tests after edits or polling a long build no longer trips the loop guard. Real loops are still stopped, and a deliberate poll is allowed 20 identical answers instead of 5.

Fewer approval prompts, same safety

• Always allow. Most approval prompts (TUI, CLI, Telegram, Discord, the desktop app) now also offer Always allow, which saves a rule, for example Always allow "git status" in this project. In the TUI it is ctrl+n, in the CLI the w key.
• Saved rules. Rules live in approval-rules.json in the agent's folder (allow, ask, deny) and in .atomic-agent/approval-rules.json in a project, where only ask and deny count, so a project cannot grant itself anything. Deny wins over ask, ask wins over allow. Always allow covers simple commands only (no pipes, && or redirects) and is saved by program and subcommand (git status) or by program alone (ls). Deny and ask rules also match each command inside a compound line. Dangerous commands and secret files never get an Always allow.
• Dangerous commands ask every time. rm -rf, git reset --hard, force pushes, sudo, bash -c, eval and chmod 777 now have their own category that a session grant never covers. Only the top approval level skips the question.
• More dangerous commands recognised. The shell guard now catches git -C repo push --force, git push origin +main, --force-with-lease, git clean -fdx, git checkout -- ., git branch -D, find -delete and bash <(curl …), and asks before running them.
• Risk check (opt-in). With agent.smartApproval on, a model rates ordinary actions before you are asked (agent.smartApprovalModel if set, else your local model if one is running, else the active provider). Dangerous commands, secrets and email always ask. Low-risk actions run; the rest are asked as usual. If the check does not answer in 8 seconds, you are asked.
• Fusion fan-outs are safer. Approving a fan-out no longer lets workers run destructive commands in that folder unasked, and writing .env or config.json no longer asks again and again.

Claude plugins

• Install a Claude Code plugin as is. atomic-agent plugin install <folder> reads Claude Code, Codex and Cursor plugin packages. Their skills show up as plugin:skill, their MCP servers join the agent (always behind approval) and their commands become slash commands in the TUI with $ARGUMENTS, $1 to $9.
• Marketplaces. atomic-agent plugin marketplace add <owner/repo>, then plugin install <name>, plugin update, plugin list, enable, disable, remove. Installing never runs plugin code.
• Hooks. PreToolUse and PostToolUse command hooks in Claude's hooks.json format, from ~/.atomic-agent/hooks.json or from a plugin. A hook can block a tool call or add a note after it. Matchers understand Claude's names (Bash, Read, Write, Edit, mcp__server__tool).
• Code stays off until you allow it. Every install and update is scanned; a plugin's local MCP servers and hooks run only after --accept-code or plugin allow-code <name>, and that consent is asked again when what the plugin runs changes.
• /plugins in the TUI (ctrl+g x) shows what each plugin brings and lets you switch whole plugins or single parts, allow or stop plugin code, and remove a plugin.
• Not supported yet: output styles, LSP servers, other hook events, and running a plugin's subagents.

Continue from Claude Code or Codex

• atag handoff --from claude-code (or codex). When Claude Code or Codex stops in the middle of a task, this saves its latest session (the newest one from this folder, else the newest anywhere) as an Atomic Agent chat in that session's folder, opens the TUI and sends a message to carry on. --session <id>, --list, --note "<text>", --no-open.
• Fits a local model. A long session is shortened to fit the local model's window (its configured size, else 32k; --context <tokens>): the newest steps are kept word for word, the older part becomes a short extract. No model call is needed for that.

Zero setup, then a bigger model

• No key on first run. The TUI's first run offers the 1.3 GB starter model to start right away, then downloads the best model this computer can run in the background and moves to it when it lands.
• atomic-agent models recommend shows what the machine has and a fast, balanced and quality pick. atomic-agent models upgrade downloads the quality pick in the background without switching. For example: 16 GB Mac, Qwen 3.5 9B; 32 GB Mac, Gemma 4 26B A4B; 64 GB Mac, Qwen 3.6 35B A3B.

Readable output

• Finished turns fold into one line, Used 6 tools · 40s ▸. /expand opens the last turn (/expand all opens every turn), /collapse folds them back, /steps on keeps steps open (tui.showSteps).
• Steps read as words: "Read config.ts", "Ran npm test · failed", "Used github: create issue", in the TUI and in the Telegram progress message.
• A live plan. The agent keeps a checklist above the composer (plan 3/7) and updates it with the new plan.update tool. It survives a restart.
• Cost and limits beside the context gauge, for example $0.31 · 17% left, resets 15:00. /usage (or /cost) shows the breakdown. Local models show local.
• /status shows what a running turn is doing, in the TUI and in Telegram, where a long turn's progress message becomes one status card that updates in place.
• Answers fit where you read them. They start with the result; Telegram gets one message without tables. Before a reply reaches you, unclosed code fences are closed and filler lines and repeated paragraphs are removed (ATOMIC_AGENT_REPLY_POLISH=0 turns this off).
• Code blocks are drawn without the ``` fences, so copying code copies only code.

Small local models

• A compact prompt for small windows. With a context window of 64K or less, the agent sends a shorter version of its own instructions and leaves more room for your task (agent.prompt.compact: auto by default, on, off).
• Compaction works on 16K and 32K windows. From a 32K window up, local models without prompt reuse get a summary written by the model instead of an extract.
• No more empty tool calls. The grammar now requires the arguments of the tools small models use most (edit, move, list, grep, glob, web search and fetch, HTTP, memory).
• Local thinking models keep their reasoning between the tool steps of one turn.
• Nemotron 3.5 Bolt E4B and other Gemma 4 fine-tunes are recognised by their chat template.
• On 24 GB GPUs and 32 GB Macs the automatic window accounts for the server's real buffers; if layers still land on the CPU, the model restarts once with a smaller window.

Fusion

• Steer one worker. /worker steer <id> <note> sends a note to one running worker; /worker stop <id> and /worker escalate <id> act on one worker without stopping the rest. Worker rows show tokens and cost as they run.
• Resume a cut-off run. Fusion saves each run as it goes. After a crash or a restart, /fusion resume picks up the unfinished part and keeps what was done; steps with side effects are not repeated unless you confirm them.
• Honest cost and caps. Cached tokens are now counted at the cached price. llm.runMode.fusion.turnBudgetUsd and turnTimeBudgetMs cap one Fusion turn.
• New options, all off by default: models by role (llm.runMode.fusion.roles: plan, build, review, explore, utility), a task tree where a worker proposes a split (taskTree.enabled), each worker in its own git worktree with an automatic merge (isolation: "worktree"), a judge that closes a task only on a green checklist (judge), automatic replanning (autoReplan) and asking a stronger model when a worker is stuck (escalation).
• If the local model server stops answering after a worker was cut off, the next part fails at once with a restart hint instead of waiting.

Screen

• The agent shows you where to click (macOS, desktop app). os.screen.point draws arrows, boxes and numbered steps over your screen instead of clicking for you. It only draws; it never clicks or types. On by default with tools.screen.point.
• Snapshot one window. os.screen.capture takes app, window and text: true to capture one app's window, even under other windows, and read its text (macOS, with screen control on). Password managers and system sign-in windows are refused.

Models and providers

• No silent switch to a local model. When a cloud provider fails, you see the reason and one next step instead of being moved to a local model you did not pick (llm.fallback.appendLocal is now off by default).
• Says when it switched. A long rate-limit cooldown is no longer spent on retries in place: the agent waits it out or moves to your fallback chain and tells you, for example "OpenRouter is rate-limited, switched to Gemini (gemini-2.5-flash)."
• Cheap, Balanced and Best come first in the TUI model pickers for OpenRouter and AI/ML API (in the desktop app also for Gemini).
• Kimi K3.1 gets the temperature it accepts (1), OpenAI reasoning models get none, and a 400 that names the only allowed temperature is retried once with it.
• A claude or codex CLI installed with npm or Homebrew now finds node when the agent starts from the desktop app, once the app has found the CLI.

Fixed

• verify.run commands now go through the shell guard, so dangerous ones are blocked or asked about.
• Windows: the CLI no longer crashes on exit with a UV_HANDLE_CLOSING assertion.
• Windows x64: a cancelled model load no longer moves you to the slow CPU build.
• An older terminal no longer crashes when a newer desktop app wrote the local engine's session record.
• Your own llama-server with --api-key: the error now names ATOMIC_AGENT_LLAMA_API_KEY instead of telling you to restart the model.
• A model that fills every argument with 0 no longer turns off the shell timeout. timeoutMs: -1 now means no limit.
• Fusion: removing a provider used as the escalation or judge model no longer breaks the config; a worker that leaves a placeholder in its file is no longer reported as ok; workers no longer wait on a sibling's unwritten file or run browser code under node.
• DO_NOT_TRACK=1 turns off analytics and crash reports.
• 16 of 21 production dependency advisories closed, including both critical ones.
• Qwen 3.8: mixed spellings of a tool name no longer leak raw tool-call text into the chat.

Also

• An older build no longer breaks on settings written by a newer one, and no longer overwrites them.
• Local connection refusals are reported with the engine and its state, so we can tell a crashed engine from one that never started.
• Desktop and terminal installs from one shared folder are counted separately.