Changelog
What changed, and when you can install it
A version appears here once the stable installer is actually serving it. A build that finished is not a release you can download, so this page tracks the second thing.
Stable is serving 1.22.0. Reviewed 2026-08-04
1.22.0
2026-08-04current stableAtlas can now drive your command-line tools directly, with permissions scoped to the individual command rather than the whole binary.
Per-verb permissions for your CLIs
Until now, approving a command-line tool meant approving the tool. Atlas derived its permission pattern from the binary name, so allowing one Supabase command could allow every Supabase command, including the ones that drop a production database. Atlas 1.22 reads a manifest that classifies each verb on its own. Reads run without interrupting you. Writes ask. And a verb marked destructive asks every single time, with no setting anywhere that can turn that off.
$ atlas toolchain PROVIDER VERSION VERBS LEARNED STATE gh 2.63.2 16 4 ready supabase 2.105.0 10 2 ready $ atlas toolchain doctor supabase supabase ready bin /usr/local/bin/supabase ok version 2.105.0, minimum 2.0.0 ok auth ok ok
Read-only commands stop interrupting you
Listing pull requests, viewing a run, or reading a migration history is classified as a read and runs without a prompt. The interruptions move to the commands that can actually change something.
Destructive commands cannot be silenced
Dispatching a release, pushing a production schema, or deleting a repository asks every time. There is no always-allow for these and no configuration file that can grant one.
Atlas tells you which tools are usable
`atlas toolchain` lists every configured CLI with its version, whether it is authenticated, and whether it is ready. `atlas toolchain doctor` names the exact failure and the exact fix, and never tries to run an interactive login on your behalf.
It stops re-learning the same mistake
When a command fails and the next one succeeds, Atlas records what changed. The next session gets that lesson before its first call, so a flag you had to discover once does not have to be discovered again.
Teach Atlas a new tool without writing code
`atlas toolchain learn <tool>` walks the tool's own help output and drafts a manifest for you to review. Against the GitHub CLI it classified 129 subcommands in one pass and flagged the ones it was unsure about.
Credentials are stripped from tool output
Tokens matching a provider's declared patterns are redacted before the output reaches the model, your transcript, or disk.
Atlas prefers the tool over a raw shell command
Running a configured CLI through the shell, or calling an API with curl when a tool already holds the credentials for it, is redirected to the tool path so the call gets classified. Pipelines still go to the shell. Set ATLAS_DISABLE_TOOLCHAIN_REDIRECT=1 to turn this off.
Local model capabilities are read from Ollama
Atlas asks Ollama what a local model actually supports instead of inferring it from the name.
The status line and permission prompt stay in the prompt dock
A published no-adaptive answer now beats the registry default
Already installed?
Run atlas upgrade to move to 1.22.0, or check what you are on with atlas --version.