cloudposse/atmos v1.234.0-nightly.42319032044 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expand mock AWS auth provider coverage for credential expiration, expiration accessors, BuildWhoamiInfo redaction and nil handling, validation, identity metadata, provider resolution, environment preparation, credential-file paths, and persisted credential lifecycle errors.

feat: add plugin distribution and verification services @osterman (#3457)

Add plugin distribution and trust services for catalogs, discovery, installation, lockfiles, package management, signing, verification, authentication adapters, and structured output. Packages are verified before installation, archive and alias conflicts are rejected, configuration updates remain transactional, and compatible variants are preserved across installation, cache verification, signatures, and offline restores.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Add plugin bootstrap and authoring services, including configuration-driven build, scaffold, conformance, OIDC, output, and documentation support. Archive installation now preserves configured entrypoint names and permissions, rejects collisions, and retains recovery artifacts when rollback cannot complete; OIDC login recovers from expired or missing refresh credentials.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Add command-owned documentation URLs and ordered example metadata to the command registry, with backward-compatible registration options, independent inheritance, and metadata preservation for ordinary and cross-command aliases. Core stack, cloud, CI, configuration, and profile commands now register their discovery metadata.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Add documentation URLs and ordered example metadata for supporting commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands can own metadata, while commands without dedicated pages inherit their parent's documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Update the CI failure annotations changelog and policy example README with a runnable local preview, expected annotation output, intentional exit code 77, and early-admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Stabilize Quality Gate reporting by selecting the newest CI and Codecov checks, recovering unfinished reports and long-running reruns, publishing pending and final snapshots, and avoiding edits caused only by summary-URL changes. The report is organized into Readiness, Reviews, and Measures, with bounded retries and reduced dependence on external CI services.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Add runnable examples/cdk-cloudformation and examples/cdk-terraform CDK examples using the native CloudFormation and Terraform components against the local Floci AWS emulator. The examples include freshness-aware synth hooks, atmos test smoke checks, lifecycle casts, and tutorial links.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Remove incidental logging, redundant approval/init settings, and global caching auto-approval from copyable Atmos examples while retaining required settings and intentional demonstrations. Refresh quick-start guidance and snapshots for inherited Warning logging.

Reconcile bundled skills and command documentation @osterman (#3491)

Reconcile bundled skills and command documentation by correcting examples, prerequisites, terminology, supported flags, backend inspection guidance, authentication restrictions, and toolchain aliases. Unsupported vendor pull --version and component/workflow --format tree examples are removed, while executable examples now receive curated checks.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Add CodeRabbit path instructions encouraging focused extraction of touched behavior and tests into owning packages, with thin adapters where needed.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bump the Claude Code plugin to version v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release tooling now recognizes merged native-stack PRs when their merge commits are present in the verified release source range, even if GitHub retains the original parent branch as the PR base. Release-label and milestone validation still applies, and unmerged or unrelated commits continue to fail.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates quality:ready PRs whose combined head status is failure or error, even when the report is current and the commit is older than 24 hours. Pending statuses and quality:not-ready PRs are not selected, and patched website dependencies address eight Dependabot alerts.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest workflow run by creation time and run ID when multiple runs target one commit, and excludes GitHub Actions checks only when their check-suite ID identifies a superseded run. Current failures and pending runs, unknown suites, external checks, and synthetic merge-commit checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

Remove the repository root go.mod from auth-secrets plugin release inputs and bump the plugin to 1.0.1 once. Changelog posts now show a release badge from frontmatter, detected release data, or Unreleased, and the CDK hooks post gains the required cast and castTitle metadata.

docs: add plugin pages and fix CI network checks @osterman (#3575)

Add /plugins and /plugins/official documentation pages with quick-start guidance, official package details, and navigation. CI network diagnostics now allow StepSecurity up to 60 seconds to initialize and recognize exact eBPF DNS rejection events.

fix(release): group release preview issues by release-notes category @osterman (#3577)

Release preview issues now group milestone PRs under the same .github/release-notes.yml categories and order as published release notes, sorting PRs by number within each category while retaining each preview bullet's state and summary.

fix(ci): stop the Quality Gate from blocking on unapproved signal runs @osterman (#3583)

Quality Gate no longer treats Quality Gate Signal runs as CI evidence at their trigger events, and legacy blocked reports are re-evaluated once under the atmos-quality-reporter-runs-excluded:v2 marker. action_required results now direct users to approve waiting workflows rather than inspect logs.

fix(release): resolve merge-queue commits GitHub left unmerged @osterman (#3613)

Release milestone checks and release planning can resolve a landed merge-queue commit whose PR GitHub left unmerged by using the (#N) subject of a GitHub-signed web-flow commit targeting the default branch. Direct, unsigned, unrelated, and unresolvable commits still fail closed.

chore(docs): refresh CLI screengrab casts, batch 2 of 3 @osterman (#3628)

Regenerate the second batch of 138 CLI screengrab casts so the docs player types > atmos <command> and reflects current help output.

fix(cast): validate screengrab casts record the program name @osterman (#3629)

Regenerate the final 136 CLI screengrab casts and make atmos --chdir=demo/casts casts validate screengrabs cli reject cast headers whose command does not match the manifest command, with allowances for --help=all and atmos about --help. The help page player title now matches the recorded atmos --help command.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

Add VHS tape interpretation for type: cast steps using inline tape: or tape_file:, with steps and PTY-backed session modes, supported VHS directives, shell setup handling, screenshots, and safe output behavior. Add atmos cast record <input.tape> with --output, --format, --mode, --shell, and --shell-init, plus configurable session shell initialization through cast.session.shell_init.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Add dependency-aware atmos stack plan and stack test, shared selectors for lifecycle commands, CI reporting, introspection commands (stack list, stack describe, and stack instances), and multi-stack stack create --target directory scaffolding. Selectors support --stack, repeated or comma-separated --component, --all, --affected, tags, labels, and interactive pickers; --dry-run previews operations without executing them.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Add cast.recorder(...) for Starlark scripts, combining command execution, recording, interactive PTY blocks, assertions, policies, replacements, and fingerprint-based validation. Add local source: files for script steps, fix session waits and hidden output handling, and add cast validation to CI.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Add dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create with planning, hooks, validation, rollback, and recovery guidance. Hook declarations are validated against registered lifecycle events for unpinned projects and editions from 2026-10-19, while older editions retain arbitrary hook names.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Add safe Doctor migrations from legacy naming patterns and tokens to templates, gated by production before/after identity checks. Improve nested error rendering, preserve terminal color through wrappers, support global workspace templates, and move hook dispatch logs to Debug.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enable experimental native plugin commands, startup integration, built-in OCI identity, OIDC authentication, policy checks, and plugin build --platform/--all-platforms with environment bindings and partial-success reporting. Preserve policy output compatibility, including shorthand formats, canonical environment variables, JSON field names, omitted fields, and embedded objects.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Add native OPA and JSON Schema policy engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version/FIPS, calendar, and CI evidence across all four engines. Add deployment and authentication guardrails and shared version/date checks.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Require explicit YAML function tags for unpinned configurations and editions from 2026-10-20, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Quoted strings such as "!env SOMETHING" remain literal, while legacy behavior is retained with edition: "2026-10-19".

feat(cli): add --docs and --example command discovery @osterman (#3468)

Add command discovery flags: --docs prints or opens a command's documentation URL, --docs=md/--docs=markdown fetches and renders Markdown, and --example selects an example and reuses atmos init. Discovery works before ordinary validation, including outside an Atmos project, while preserving aliases, --chdir, custom flag ownership, initialization safeguards, and relative links in fetched Markdown.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Add Fogg migration, AWS CDK, and CDK Terrain guides, plus CloudFormation synthesis improvements. Synthesis hooks run before generated files are read, and inherited region and duration-based timeout settings now include Doctor migrations and legacy-minute enforcement.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Add conditional stack imports with when, allowing labels and tags to select optional mixins and identify component instances for selectors such as atmos list instances --tags pci and --labels pci:true. Preserve import-order precedence, native tag merge semantics, authentication-discovery parity, and literal metadata before template and YAML-function evaluation; also fix deferred rendering beneath YAML function overrides.

Validate merged stack auth and preserve secret discovery safety @osterman (#3487)

Add auth validate --stack with optional --component to validate each selected component's merged authentication configuration while retaining strict global validation. Secret discovery remains lazy, GCP ADC is supported, and the first SOPS write after key generation is repaired.

Generalize component executable overrides and execution flags @osterman (#3488)

Add consistent --command executable overrides to Terraform, Helmfile, Packer, and Ansible while preserving compatibility flags and precedence. Repair Helmfile dry-run, global-option, and stderr forwarding behavior and update command/configuration documentation.

Fix source handling and add backend and alias inspection @osterman (#3490)

Add atmos toolchain aliases to list effective built-in and configured aliases in sorted table, JSON, or YAML form without registry lookup or installation. Add static atmos terraform backend list and describe inspection of merged local configuration, and repair related init, registry, vendor, Git, version, OCI, and source-query behaviors.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Replace the pre-commit framework with shared YAML/Starlark Git hooks and repository check, format, CI, and autofix commands using native Git sandboxes and atomic writes. Staged and unstaged edits are preserved when fixes are applied, and hook launchers are backed up before forced replacement.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Add module.load(path) and struct(**fields) to automation scripts with cached, frozen, cancellable, parallel module loading and cycle detection. Add typed YAML/JSON configuration loading and validation with schemas, defaults, bounds, optional fields, lists, enums, immutable records, source diagnostics, and config1.merge(config2) using Atmos merge semantics.

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Add public OCI plugin releases and catalog discovery, with cloudposse/auth-secrets as the first independently versioned package. Native plugin release, release plan, test --build --coverprofile, verify-public, and catalog sync --inventory commands replace Python release scripts, while secrets/store and secrets/env provide scoped secret-store access and masked environment projection.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Add stdin= to exec.run, component.exec, and atmos.* wrappers, sending exact bytes without shell or argument interpolation and replaying input on retries. Add the predeclared os module with environment, directory, platform, and architecture controls, plus fs.write_file(path, content, overwrite=False, mode=0o600) with exclusive creation and permission-preserving overwrite.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Add settings.functions.exec.max_concurrency to bound concurrent ordinary !exec evaluation, defaulting to serial execution with 1. Results retain their document positions, outstanding commands are cancelled after failure, policy checks run before launch, and masked stderr is attributed to each expression path.

Add conditional retries for component error events @osterman (#3542)

Add conditional action: retry policies with scalar, list, wildcard, predicate, budget, alias, schema, and diagnostic support across supported components and emulators, including Terraform/OpenTofu lifecycle and SDK calls. Also serialize AWS configuration and credential updates on Windows and stage screengrab recordings on the destination filesystem for atomic publication.

feat: native Vault identities and explicit credential templates @noeljackson (#3557)

Add native Vault and OpenBao identity support through configured VAULT_TOKEN credentials, plus explicit auth-secrets credential templates using store, path, optional field, and spec.env. Templates render only after authentication, remain literal unless explicitly templated, reject unsafe or oversized values, mask source and rendered credentials, and do not alter the process environment.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now obtain provider model names from each provider's DefaultModel, including the Anthropic hint, instead of maintaining a separate hardcoded list. This keeps hints aligned with the models accepted by the providers.

fix(include): resolve base_path before the working directory @djal (#3426)

Resolve bare !include and !include.raw paths relative to base_path before the process working directory, while ./ and ../ paths remain relative only to the including manifest. Bare paths still fall back to the working directory, but missing manifest-relative paths no longer fall through to base_path.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

Document terraform_workspace_template as valid stack-wide metadata and add coverage showing that it propagates into Terraform component metadata.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Establish the shared Atmos API, standalone native plugin SDK, protocol bindings, transport, manifest/configuration primitives, and Starlark cast integration while preserving deprecated pkg/automation imports through aliases. Native plugin CPU variants now match immutable Atmos build metadata deterministically without OS or architecture fallback.

fix: unify credential handling and OCI registry access @osterman (#3456)

Add shared extension descriptors, OCI registry support, credential handling, and policy/configuration primitives for native plugins. Credential publication and logout cleanup are serialized, nested registry-auth deadlocks are prevented, GHCR token priority is preserved, and large race-instrumented packages receive bounded CI test budgets.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Restore Terraform destroy, bulk init/test, and per-component lifecycle hooks, running them in prepared workdirs with resolved paths and credentials available to after-hooks. Tool-version discovery is scoped to each project's configuration, and test fixtures can start before authentication without being overwritten.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Preserve Helm repository credentials, TLS options, and credential-forwarding policy across native Helm operations and chart lookup. Populate AWS ambient authentication context while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

Preserve literal values and diagnose YAML function scope @osterman (#3486)

Preserve literal YAML values through loading, merging, templates, and output, enable stack random/cwd evaluation, and diagnose functions used in unsupported locations. Raw YAML shielding is limited to YAML documents, while decoded command arguments and import paths continue to render normally.

Fix runtime evaluation and command execution boundaries @osterman (#3489)

Preserve saved plans during inspection and restore single-component destroy CI output, while correcting custom-command boundaries, devcontainer settings, MCP exports, schema-directory flags, Ansible and workflow paths, retry defaults, SBOM discovery, and native Helm handling. CI-mode detection now synchronizes configuration access with theme environment binding.

fix(helmfile): colorize diff output by default on a TTY @STiFLeR7 (#3498)

atmos helmfile diff now enables Helm diff color automatically when Atmos detects a color-capable terminal, while respecting NO_COLOR, other Atmos color settings, and an explicit HELM_DIFF_COLOR value from the component environment or shell.

fix: upgrade Node.js to 24.22.1 and Go to 1.26.10 for CVEs @osterman (#3502)

Upgrade the AWS SAML Playwright runtime to Node.js 24.22.1, move the website to the Node 24 LTS line, patch website dependency overrides, and update Go to 1.26.10 for the crypto/x509 security advisory.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Resolve inherited metadata.component before backend generation while preserving explicit overrides, legacy selection, and disabled metadata inheritance. This fixes mismatches where descriptions showed the module path but execution used the instance name.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Streamline releases by reducing published targets, centralizing Go setup, pinning workflow runners, and supporting atmos release cut --resume for unfinished production releases. Quality Gate now uses current release-policy and commit-status evidence, Git sandboxes preserve merge metadata, and shared Git hooks select the current checkout's build/atmos executable.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Propagate --skip options such as --skip=secret through nested Terraform output and state lookups, and partition caches by skip list so dependency evaluation does not contact skipped secret providers.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, allowing provider-free test modules to run without a backend_type. Existing backend files are preserved.

fix(secret): honor scoped providers during key generation @osterman (#3515)

secret keygen -s <stack> now resolves stack, component, and type-scoped providers without evaluating secret values, including provider-only stacks. Ambiguous overrides are rejected, registered component types participate in filtering and description, and explicit selections still fail when no matching component exists.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now finds nested .sops.yaml recipient files from the encrypted file and generates matching repository-relative rules for relative and absolute paths on Unix and Windows. Omitted spec.file derives a wildcard rule from the configured secrets directory.

fix(secret): allow stack secrets without a component @osterman (#3517)

atmos secret set and atmos secret validate now support stack/global declarations without requiring an unrelated component. Stack-scoped writes and validation work without --component, while instance-scoped operations retain the component requirement.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom type: atmos steps now pass their rendered stack to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit forms such as -sprod.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes configurations that replace container.ports without retaining the 6443/tcp API port mapping.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Terminal email autolinks are rendered once instead of being duplicated. Documentation now clarifies --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from an existing age private key without changing private key material, while preserving existing rules and explicit recipients and rejecting ambiguous multiple identities.

fix(ui): don't mangle list markers and emails in ui.* messages @osterman (#3524)

Starlark ui.info, ui.success, and ui.warning now preserve Markdown list markers, nested indentation, and wrapped layout while rendering terminal email addresses once. The no-color renderer retains list styling, and users can escape literal markers such as 1\..

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Add shared duration.Format formatting for resource-usage summaries: durations under a minute retain millisecond/second output, while longer values use compact forms such as 34m 47s or 1h 2m 3s, omitting zero units and rounding 59.96s to 1m.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Suppress Semgrep false positives for same-repository actions, report security backlogs by scanner, patch Go and JavaScript dependencies, and restore Terraform hook test-state isolation.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Add AuthenticateIsolated to authenticate an identity on a separate manager without changing the caller's chain, stack information, or credentials. Store authentication for AWS, Azure, and GCP now uses this isolated context, preventing secret resolution from replacing the component identity used by later state reads.

fix(ai): default Gemini to gemini-3.8-flash @pcbeingused333 (#3553)

Change the Gemini provider default model to gemini-3.8-flash; the TUI fallback list, setup hints, function-calling hint, documentation, and default assertions follow the provider default.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Support oci://host/repo:tag//path imports in stack manifests and atmos.yaml, including files, directories, globs, and nested_imports: remote. OCI artifacts are pulled once into the XDG stack-imports cache with imports.ttl, and missing paths return ErrOCIImportMissingPath; shared cache fixes also correct Git subdirectory imports.

fix(ai): report cached prompt tokens for OpenAI-compatible providers @pcbeingused333 (#3565)

OpenAI-compatible providers now report cached prompt tokens from usage.prompt_tokens_details.cached_tokens through atmos ai usage output and types.Usage.CacheReadTokens.

fix(ai): send max_completion_tokens for OpenAI o-series and gpt-6 models @pcbeingused333 (#3566)

OpenAI-compatible requests now use max_completion_tokens for all o-series models and gpt-6* models, while names such as ollama and other non-model identifiers beginning with o continue to use max_tokens.

fix(ai): apply max_tokens to Gemini requests @pcbeingused333 (#3567)

Gemini requests now send ai.providers.gemini.max_tokens as generationConfig.maxOutputTokens across standard, history, and tool-calling requests. A zero value leaves the model default in use.

fix: stabilize CI and clarify script failures @osterman (#3569)

Stabilize CI and runtime behavior by preserving workflow environments, recognizing StepSecurity eBPF enforcement, warming native CI caches with Floci, refreshing website deployment credentials, handling merged milestone entries, synchronizing CI-mode reads, and clarifying Starlark failure and formatting guidance.

Restore bulk Terraform plan summaries and enforce size limits @osterman (#3580)

Restore template-based summaries for every executed bulk Terraform plan component, including no-change runs, and use shared duration formatting. Aggregate reports and masked summary-file writes are size-bounded, with a deduplicated warning recommending --tags or --labels when output exceeds available space.

fix: upgrade regressions in YAML functions, store hooks, custom flags @osterman (#3584)

YAML function values inside templates now resolve correctly, including values such as name: "app-{{ .vars.region }}"; unsupported map/list or rewritten-function cases now return clear errors. Store hooks skip missing Terraform outputs on destroy with a warning, and custom commands can declare --example and --docs flags of any type.

fix(ai): default Anthropic and Bedrock to Claude Sonnet 5 @pcbeingused333 (#3585)

Change the default Anthropic model to claude-sonnet-5 and the default Bedrock model to global.anthropic.claude-sonnet-5. Requests no longer send a thinking override, allowing model defaults to apply.

fix(terraform): inject Atmos Auth credentials into terraform shell @osterman (#3604)

atmos terraform shell now runs the Atmos Auth Terraform pre-hook during setup, injecting identity credential variables such as AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE, and region settings into backend initialization, workspace selection, and the interactive shell.

fix: repair plugin publication and AI release previews @osterman (#3605)

Plugin publication now uploads packages and catalogs before --verify-public, with actionable GHCR visibility guidance and safe retries. Milestone release previews now use AI summaries, forward the API key through the trusted workflow, and reuse unchanged previews.

fix(terraform): show Terraform's error when workspace setup fails @osterman (#3610)

Terraform workspace setup errors now include Terraform's output from both workspace select -or-create and the workspace new fallback, along with the workspace name, backend credential/permission guidance, and an ATMOS_LOGS_LEVEL=debug hint.

fix(list): escape CSV/TSV cells in list vendor output @pcbeingused333 (#3616)

atmos list vendor --format csv|tsv now escapes delimiters, quotes, and newlines using encoding/csv, preventing multi-valued tags and other cell contents from shifting or corrupting output columns.

fix(secret): run every secret command on stack-scoped secrets @osterman (#3618)

Secret commands including get, delete, import, pull, push, exec, and shell now accept --stack alone for stack-scoped and global secrets. Whole-stack operations exclude instance secrets unless --component is supplied, while named operations require a consistent shared declaration and otherwise prompt on a terminal or report why --component is required.

fix(pro): keep the error message in reported exceptions @osterman (#3619)

Exceptions reported to Atmos Pro now retain the masked failure message, prefixed with the failed command and limited to 8 KiB on a rune boundary; nil event information no longer panics. Remove obsolete Trivy hosts from the runner-hardening allowlist.

fix(auth): retry the GitHub OIDC token request and reuse the JWT per process @mtb-xt (#3621)

GitHub OIDC token requests now retry transport errors, timeouts, HTTP 429, and HTTP 5xx responses up to four times with exponential backoff. Within one Atmos process, valid JWTs are reused across identities when their exp claim is more than 60 seconds away; tokens are kept only in memory and keyed by request URL, bearer token, and audience.

fix(cast): record the program name in cast headers @osterman (#3627)

Auto-recorded cast headers now include the program name, so commands such as atmos --help render correctly in the docs player instead of appearing as --help. Refresh the first CLI screengrab batch and update stacked-branch file-limit comparison for later cast batches.

feat(website): render GitHub-style alerts as admonitions @osterman (#3631)

Convert GitHub-style Markdown alerts such as > [!NOTE], > [!TIP], > [!IMPORTANT], > [!WARNING], and > [!CAUTION] into native Docusaurus admonitions in documentation and changelog pages; CAUTION uses the danger style.

fix(ai): count Gemini thinking tokens in output usage @pcbeingused333 (#3632)

Gemini usage accounting now adds thoughtsTokenCount to candidatesTokenCount for both streaming responses and vision calls, so completion-token usage includes thinking tokens.

fix(ci): find the merged PR's stored plan when deploying a squash commit @osterman (#3636)

atmos terraform deploy now looks for a stored plan for the deployed commit first, then on GitHub Actions resolves the merged pull request associated with that commit and checks the plan stored for the PR head. The fallback validates the merged commit, skips fast-forward merges, and warns when pull-requests: read permission is missing.

fix: regressions found in v1.234.0-rc.1 @osterman (#3637)

Restore performance for describe stacks, describe affected, and list instances by caching edition behavior and reusing stateless template namespaces. Deprecation notices for atmos stack get|set|delete|format now go to stderr, include errors identify exact paths, and !ci.labels [list] works again inside locals:.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4.

chore(deps): update dependency @types/node to v22.20.5 @renovate[bot] (#3422)

Bump @types/node from 22.20.4 to 22.20.5.

chore(deps): update dependency tsx to v4.23.15 @renovate[bot] (#3423)

Bump tsx from 4.23.13 to 4.23.15.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): update dependency prettier to v3.9.10 @renovate[bot] (#3507)

Bump Prettier from 3.9.9 to 3.9.10.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Bump golang.org/x/tools from 0.51.0 to 0.52.0 in tools/lintroller.

chore(deps): bump golang from 1.27.1 to 1.27.2 in /.devcontainer @dependabot[bot] (#3558)

Bump the / .devcontainer Go image from 1.27.1 to 1.27.2.

chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3 @dependabot[bot] (#3559)

Bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3.

chore(deps): bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0 @dependabot[bot] (#3560)

Bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0, adding the top-level goquery.Text helper and performance improvements.

fix(deps): update github.com/cyberphone/json-canonicalization digest to 32a4819 @renovate[bot] (#3572)

Update the github.com/cyberphone/json-canonicalization dependency digest from 19d51d7 to 32a4819.

chore(deps): update actions/upload-artifact action to v7.0.2 @renovate[bot] (#3574)

Bump actions/upload-artifact from v7.0.1 to v7.0.2, improving artifact-download retries for HTTP 429 responses and honoring valid Retry-After headers.

chore(deps): bump github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi from 1.39.0 to 1.41.4 @dependabot[bot] (#3597)

Bump github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi from 1.39.0 to 1.41.4.

chore(deps): update step-security/harden-runner action to v2.22.1 @renovate[bot] (#3601)

Bump step-security/harden-runner from v2.22.0 to v2.22.1, fixing GHES self-hosted initialization and GHES connectivity in block mode.

fix(deps): update module github.com/agnivade/levenshtein to v1.2.2 - abandoned @renovate[bot] (#3608)

Update github.com/agnivade/levenshtein from v1.2.1 to v1.2.2.

chore(deps): update step-security/harden-runner action to v2.22.2 @renovate[bot] (#3612)

Bump step-security/harden-runner from v2.22.1 to v2.22.2, fixing macOS ingress classification and Linux endpoint handling while improving network and DNS tracing.

fix(deps): update module github.com/bmatcuk/doublestar/v4 to v4.10.3 @renovate[bot] (#3615)

Bump github.com/bmatcuk/doublestar/v4 from v4.10.0 to v4.10.3, fixing case-insensitive character ranges and improving Windows junction traversal.

fix(deps): update go.starlark.net digest to 4f4267f @renovate[bot] (#3622)

Update the go.starlark.net dependency digest from d7438c5 to 4f4267f.