@uipath/skills 1.202.1 → 1.203.0-preview.889

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "uipath",
       "source": "./",
       "description": "UiPath plugin for Claude Code — custom skills, agents, hooks, and MCP servers for UiPath workflows, UI automation, UI testing and UiPath troubleshoot",
-      "version": "1.202.1",
+      "version": "1.203.0",
       "author": {
         "name": "UiPath"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "uipath",
-  "version": "1.202.1",
+  "version": "1.203.0",
   "description": "UiPath plugin for Claude Code — custom skills, agents, hooks, and MCP servers for UiPath RPA workflows, UI automation, UI testing, Python coded agents and UiPath troubleshoot",
   "author": {
     "name": "UiPath"

package/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "uipath",
   "displayName": "UiPath",
-  "version": "1.202.1",
+  "version": "1.203.0",
   "description": "UiPath plugin for Cursor — skills for building, running, testing, and deploying UiPath automations, agents, coded apps, and platform operations.",
   "author": {
     "name": "UiPath",

package/CODEOWNERS

@@ -74,6 +74,16 @@
 /tests/tasks/uipath-agents/coded/guardrails/ @apetraru-uipath @valentinabojan @ctiliescuuipath
 # Guardrails in lowcode/conversational (more specific than /lowcode/conversational/ above — wins via last-match)
 /tests/tasks/uipath-agents/lowcode/conversational/guardrails/ @apetraru-uipath @valentinabojan @ctiliescuuipath
+# Guardrail checkers relocated to _shared/ during the host-path-removal migration (test: d61fa9d52) —
+# still owned by the guardrails team, not the broader _shared/ default.
+/tests/tasks/uipath-agents/_shared/check_byog_middleware.py @apetraru-uipath @valentinabojan @ctiliescuuipath
+/tests/tasks/uipath-agents/_shared/check_escalation.py @apetraru-uipath @valentinabojan @ctiliescuuipath
+/tests/tasks/uipath-agents/_shared/check_intellectual_property_coded.py @apetraru-uipath @valentinabojan @ctiliescuuipath
+/tests/tasks/uipath-agents/_shared/check_llm_as_judge.py @apetraru-uipath @valentinabojan @ctiliescuuipath
+/tests/tasks/uipath-agents/_shared/check_pii_middleware.py @apetraru-uipath @valentinabojan @ctiliescuuipath
+/tests/tasks/uipath-agents/_shared/check_recommend_all.py @apetraru-uipath @valentinabojan @ctiliescuuipath
+/tests/tasks/uipath-agents/_shared/check_recommend_scoped.py @apetraru-uipath @valentinabojan @ctiliescuuipath
+/tests/tasks/uipath-agents/_shared/check_user_prompt_attacks_middleware.py @apetraru-uipath @valentinabojan @ctiliescuuipath
 
 # Functions skill (JS/TS → @lucarachiteanu, Python → @vldcmp-uipath; shared surfaces → both)
 /skills/uipath-functions/ @lucarachiteanu @vldcmp-uipath
@@ -140,6 +150,10 @@
 /skills/uipath-maestro-flow/references/author/plugins/data-fabric/ @UiPath/DatafabricCodingAgent @UiPath/maestro-cli-team
 /tests/tasks/uipath-maestro-flow/connector_features/ @chandusailella @mukundbayyaram @UiPath/maestro-cli-team
 /tests/tasks/uipath-maestro-flow/connector_features/datafabric_connector @UiPath/DatafabricCodingAgent @UiPath/maestro-cli-team
+# Checkers relocated to _shared/ during the host-path-removal migration (test: d61fa9d52) —
+# still owned by the connector_features team, not the broader maestro-cli-team _shared/ default.
+/tests/tasks/uipath-maestro-flow/_shared/check_databricks_query.py @chandusailella @mukundbayyaram @UiPath/maestro-cli-team
+/tests/tasks/uipath-maestro-flow/_shared/check_generic_dynamic_node.py @chandusailella @mukundbayyaram @UiPath/maestro-cli-team
 
 # IXP
 /skills/uipath-maestro-flow/references/author/plugins/ixp/ @UiPath/communications-mining @constantinmuraru @vlad-crisan @UiPath/maestro-cli-team

package/README.md

@@ -105,10 +105,10 @@ Every skill's maturity is tracked in [`assets/skill-status.json`](assets/skill-s
 | `uipath-admin` | Stable |
 | `uipath-agents` | Stable |
 | `uipath-aops` | Preview |
-| `uipath-api-workflow` | In-development |
+| `uipath-api-workflow` | Stable |
 | `uipath-automation-discovery` | Preview |
 | `uipath-automationhub` | Stable |
-| `uipath-coded-apps` | Preview |
+| `uipath-coded-apps` | Stable |
 | `uipath-connector-builder` | In-development |
 | `uipath-feedback` | Stable |
 | `uipath-functions` | Preview |
@@ -117,8 +117,8 @@ Every skill's maturity is tracked in [`assets/skill-status.json`](assets/skill-s
 | `uipath-insights` | Preview |
 | `uipath-ixp` | Stable |
 | `uipath-maestro-bpmn` | In-development |
-| `uipath-maestro-case` | In-development |
-| `uipath-maestro-flow` | In-development |
+| `uipath-maestro-case` | Preview |
+| `uipath-maestro-flow` | Stable |
 | `uipath-mcp-servers` | In-development |
 | `uipath-planner` | Stable |
 | `uipath-platform` | Stable |
@@ -128,7 +128,7 @@ Every skill's maturity is tracked in [`assets/skill-status.json`](assets/skill-s
 | `uipath-solution` | Stable |
 | `uipath-tasks` | Stable |
 | `uipath-test` | Preview |
-| `uipath-troubleshoot` | Stable |
+| `uipath-troubleshoot` | Preview |
 
 **Status legend:**
 - **Stable** — Stable, production-ready surface; safe for production.
@@ -181,17 +181,25 @@ codex plugin marketplace add UiPath/skills --ref main
 codex plugin add uipath@uipath-marketplace
 ```
 
-The marketplace entry currently uses a `plugins/uipath` symlink so Codex can load the repository root as the plugin root; remove it once [openai/codex#17066](https://github.com/openai/codex/issues/17066) is resolved.
+> **Codex prerequisite:** Use Codex CLI 0.142.0 or later. This repository uses the repository root as the plugin root, supported since [openai/codex#17066](https://github.com/openai/codex/issues/17066) was resolved.
 
 > **Windows users:** This repo uses git symlinks. Clone with symlinks enabled:
 > ```bash
 > git clone -c core.symlinks=true https://github.com/UiPath/skills
 > ```
+>
 > If you've already cloned without symlink support, re-enable and re-checkout:
 > ```bash
 > git config core.symlinks true
 > git checkout -- .
 > ```
+>
+> If you encounter a `Filename too long` or `MAX_PATH` error during
+> checkout, enable Git long-path support:
+> ```bash
+> git config --global core.longpaths true
+> ```
+> Then retry the clone or checkout.
 
 ### Cursor IDE
 

package/assets/skill-status.json

@@ -42,7 +42,7 @@
       "last_synced": null
     },
     "uipath-api-workflow": {
-      "status": "in-development",
+      "status": "stable",
       "confluence": {
         "page_id": null,
         "url": null
@@ -66,7 +66,7 @@
       "last_synced": null
     },
     "uipath-coded-apps": {
-      "status": "preview",
+      "status": "stable",
       "confluence": {
         "page_id": null,
         "url": null
@@ -138,7 +138,7 @@
       "last_synced": null
     },
     "uipath-maestro-case": {
-      "status": "in-development",
+      "status": "preview",
       "confluence": {
         "page_id": null,
         "url": null
@@ -146,7 +146,7 @@
       "last_synced": null
     },
     "uipath-maestro-flow": {
-      "status": "in-development",
+      "status": "stable",
       "confluence": {
         "page_id": null,
         "url": null
@@ -226,7 +226,7 @@
       "last_synced": null
     },
     "uipath-troubleshoot": {
-      "status": "stable",
+      "status": "preview",
       "confluence": {
         "page_id": null,
         "url": null

package/assets/uip-catalog-snapshot.json

@@ -1,6 +1,6 @@
 {
-  "generated_at": "2026-09-05T04:06:55Z",
-  "cli_version": "1.202.0-dev.8548",
+  "generated_at": "2026-09-21T04:07:18Z",
+  "cli_version": "1.203.0-dev.8750",
   "verbs": [
     "admin",
     "admin audit",
@@ -175,6 +175,8 @@
     "agent model list",
     "agent refresh",
     "agent review",
+    "agent review-history",
+    "agent review-history add",
     "agent tool",
     "agent tool list",
     "agent validate",
@@ -341,6 +343,7 @@
     "codedagent run",
     "codedagent setup",
     "codedapp",
+    "codedapp delete",
     "codedapp deploy",
     "codedapp init",
     "codedapp pack",
@@ -412,6 +415,40 @@
     "df records update",
     "docsai",
     "docsai ask",
+    "eval",
+    "eval eval-set",
+    "eval eval-set create",
+    "eval eval-set delete",
+    "eval eval-set get",
+    "eval eval-set list",
+    "eval eval-set update",
+    "eval evaluation",
+    "eval evaluation create",
+    "eval evaluation delete",
+    "eval evaluation get",
+    "eval evaluation list",
+    "eval evaluation update",
+    "eval evaluator",
+    "eval evaluator create",
+    "eval evaluator delete",
+    "eval evaluator get",
+    "eval evaluator list",
+    "eval evaluator update",
+    "eval execute-and-evaluate",
+    "eval run",
+    "eval run get",
+    "eval run list",
+    "eval run results",
+    "eval schedule",
+    "eval schedule create",
+    "eval schedule delete",
+    "eval schedule get",
+    "eval schedule list",
+    "eval schedule pause",
+    "eval schedule resume",
+    "eval schedule update",
+    "eval simulatable-components",
+    "eval simulatable-components list",
     "feedback",
     "feedback send",
     "function",
@@ -501,6 +538,9 @@
     "insights filter-processes list",
     "insights filter-queues",
     "insights filter-queues list",
+    "insights groups",
+    "insights groups get",
+    "insights groups list",
     "insights jobs",
     "insights jobs completed-timeline",
     "insights jobs failure-details",
@@ -509,7 +549,11 @@
     "insights jobs summary",
     "insights jobs top-failures",
     "insights jobs uncompleted-timeline",
+    "insights roles",
+    "insights roles get",
+    "insights roles list",
     "insights users",
+    "insights users get",
     "insights users list",
     "is",
     "is activities",
@@ -590,6 +634,7 @@
     "is resources run get",
     "is resources run list",
     "is resources run replace",
+    "is resources run script",
     "is resources run update",
     "is triggers",
     "is triggers describe",
@@ -657,6 +702,9 @@
     "llm-gateway",
     "llm-gateway models",
     "login",
+    "login profiles",
+    "login profiles delete",
+    "login profiles list",
     "login refresh",
     "login status",
     "login tenant",
@@ -736,6 +784,8 @@
     "maestro bpmn update-metadata",
     "maestro bpmn validate",
     "maestro case",
+    "maestro case bindings",
+    "maestro case bindings sync",
     "maestro case case-exit-conditions",
     "maestro case case-exit-conditions get",
     "maestro case cases",
@@ -746,6 +796,7 @@
     "maestro case decompile",
     "maestro case edges",
     "maestro case edges get",
+    "maestro case format",
     "maestro case incident",
     "maestro case incident get",
     "maestro case incident summary",
@@ -775,6 +826,7 @@
     "maestro case job",
     "maestro case job status",
     "maestro case job traces",
+    "maestro case merge",
     "maestro case pack",
     "maestro case process",
     "maestro case process get",
@@ -996,38 +1048,6 @@
     "or credential-stores",
     "or credential-stores get",
     "or credential-stores list",
-    "or eval",
-    "or eval eval-set",
-    "or eval eval-set create",
-    "or eval eval-set delete",
-    "or eval eval-set get",
-    "or eval eval-set list",
-    "or eval eval-set update",
-    "or eval evaluation",
-    "or eval evaluation create",
-    "or eval evaluation delete",
-    "or eval evaluation get",
-    "or eval evaluation list",
-    "or eval evaluation update",
-    "or eval evaluator",
-    "or eval evaluator create",
-    "or eval evaluator delete",
-    "or eval evaluator get",
-    "or eval evaluator list",
-    "or eval evaluator update",
-    "or eval execute-and-evaluate",
-    "or eval run",
-    "or eval run get",
-    "or eval run list",
-    "or eval run results",
-    "or eval schedule",
-    "or eval schedule create",
-    "or eval schedule delete",
-    "or eval schedule get",
-    "or eval schedule list",
-    "or eval schedule pause",
-    "or eval schedule resume",
-    "or eval schedule update",
     "or feeds",
     "or feeds list",
     "or folders",
@@ -1069,6 +1089,7 @@
     "or machines unassign",
     "or machines update",
     "or packages",
+    "or packages delete",
     "or packages download",
     "or packages entry-points",
     "or packages get",
@@ -1314,8 +1335,11 @@
     "rpa remote",
     "rpa remote configure",
     "rpa remote download-file",
+    "rpa remote echo",
     "rpa remote exec",
-    "rpa remote show",
+    "rpa remote start",
+    "rpa remote status",
+    "rpa remote stop",
     "rpa remote upload-file",
     "rpa restore",
     "rpa run",
@@ -1507,10 +1531,10 @@
     "tm testcases create",
     "tm testcases delete",
     "tm testcases link-automation",
+    "tm testcases link-package",
     "tm testcases list",
     "tm testcases list-automations",
     "tm testcases list-result-history",
-    "tm testcases list-steps",
     "tm testcases list-testsets",
     "tm testcases remove",
     "tm testcases run",
@@ -1528,6 +1552,7 @@
     "tm testsets delete",
     "tm testsets list",
     "tm testsets list-testcases",
+    "tm testsets playwright-context",
     "tm testsets run",
     "tm testsets update",
     "tm teststeplog",

package/hooks/send-telemetry.ps1

@@ -39,8 +39,9 @@
 #   ENVELOPE (top-level)  -> toolName, toolUseId, permissionMode,
 #                            durationMs, effortLevel (effort.level), agentType,
 #                            source (-> session_source), reason (session-end),
-#                            model (-> agent_model; Claude sends it on
-#                            SessionStart, Codex on every event)
+#                            model (-> agent_model; string or {id,display_name}.
+#                            Claude Code omits it on most events, so the
+#                            transcript is the fallback -- PILOT-7497)
 #   tool_input            -> skillName, uipSubcommand (command), fileExtension
 #                            (file_path), subagentType (subagent_type, or
 #                            agent_type for a Codex spawn_agent call)
@@ -65,14 +66,16 @@
 # values ever leave the machine.
 #
 # Non-blocking by contract: registered as an async hook in hooks.json
-# ("async": true) on every event EXCEPT SessionEnd, so Claude Code runs it in
-# the background and never waits for it. SessionEnd is registered
-# SYNCHRONOUSLY (30s timeout): async hooks still running at session teardown
-# are killed after a short grace window — shorter than this hook's PowerShell
-# + `uip track` startup — which would silently drop the session-end event.
-# Always exits 0 and swallows every error. Runs under Windows PowerShell 5.1
-# and PowerShell 7+ (pwsh) on Windows, macOS, and Linux — no jq, node, or
-# python.
+# ("async": true) on every event EXCEPT SessionEnd, so the agent runs it in the
+# background and never waits for it. SessionEnd is registered SYNCHRONOUSLY
+# (30s timeout): async hooks still running at session teardown are killed after
+# a short grace window — shorter than this hook's PowerShell + `uip track`
+# startup — which would silently drop the session-end event. The hand-off
+# therefore runs INLINE on every event: the HOST owns non-blocking dispatch, and
+# detaching it here would defeat the synchronous SessionEnd registration by
+# letting the hook return before `uip track` has flushed. Always exits 0 and
+# swallows every error. Runs under Windows PowerShell 5.1 and PowerShell 7+
+# (pwsh) on Windows, macOS, and Linux — no jq, node, or python.
 #
 # Structure: pure helpers (below), driven by Main (bottom). Configuration is
 # env only:
@@ -101,7 +104,8 @@ $SCHEMA_VERSION = 3
 function Get-Prop($Obj, [string]$Name) {
   if ($null -eq $Obj) { return $null }
   $p = $Obj.PSObject.Properties[$Name]
-  if ($p) { return $p.Value }
+  # Unary comma stops PowerShell unrolling a single-element array on return.
+  if ($p) { return ,$p.Value }
   return $null
 }
 
@@ -109,6 +113,53 @@ function Test-JsonObject($Value) {
   return ($Value -is [System.Management.Automation.PSCustomObject])
 }
 
+# JSON strings only; any other shape -> ''. A [string] cast would render
+# 'True' / '@{id=...}' where the .sh twin yields ''.
+function ConvertTo-JsonString($Value) {
+  if ($Value -is [string]) { return $Value }
+  return ''
+}
+
+# Fallback when the envelope carried no `model` (PILOT-7497). Reads the LAST
+# assistant entry, so a mid-session /model switch is tracked. Subagent turns go
+# to <session>/subagents/agent-<id>.jsonl, so this yields the main-loop model.
+# 256KB tail: the last assistant entry is within ~28KB of EOF even at 5MB.
+# An absent, unreadable or not-yet-written transcript resolves to empty.
+# FileShare::ReadWrite: the agent still holds the file open.
+function Resolve-AgentModel([string]$TranscriptPath) {
+  if ([string]::IsNullOrEmpty($TranscriptPath)) { return '' }
+  if (-not (Test-Path -LiteralPath $TranscriptPath -PathType Leaf)) { return '' }
+  $text = ''
+  try {
+    $fs = [System.IO.File]::Open(
+      $TranscriptPath,
+      [System.IO.FileMode]::Open,
+      [System.IO.FileAccess]::Read,
+      [System.IO.FileShare]::ReadWrite)
+    try {
+      if ($fs.Length -gt 262144) {
+        [void]$fs.Seek(-262144, [System.IO.SeekOrigin]::End)
+      }
+      $sr = New-Object System.IO.StreamReader($fs, [System.Text.Encoding]::UTF8)
+      try { $text = $sr.ReadToEnd() } finally { $sr.Dispose() }
+    }
+    finally { $fs.Dispose() }
+  }
+  catch { return '' }
+  $model = ''
+  foreach ($line in ($text -split "`n")) {
+    # Whitespace-tolerant: the transcript format is undocumented.
+    if (-not [regex]::IsMatch($line, '"type"[ \t\r]*:[ \t\r]*"assistant"')) { continue }
+    $m = [regex]::Match($line, '"model"[ \t\r]*:[ \t\r]*"([^"]*)"')
+    if ($m.Success) {
+      $v = $m.Groups[1].Value
+      # <synthetic> is a local turn (interrupt/error), not a model id.
+      if ($v -and $v -ne '<synthetic>') { $model = $v }
+    }
+  }
+  return $model
+}
+
 # JSON booleans -> the literal strings 'true'/'false'; everything else -> ''.
 function ConvertTo-BoolString($Value) {
   if ($Value -is [bool]) { if ($Value) { return 'true' } return 'false' }
@@ -275,32 +326,46 @@ function Main {
   if (-not (Test-JsonObject $payload)) { exit 0 }
 
   # ENVELOPE region.
-  $hookEvent      = [string](Get-Prop $payload 'hook_event_name')
-  $tool           = [string](Get-Prop $payload 'tool_name')
-  $toolUseId      = [string](Get-Prop $payload 'tool_use_id')
-  $permissionMode = [string](Get-Prop $payload 'permission_mode')
+  $hookEvent      = ConvertTo-JsonString (Get-Prop $payload 'hook_event_name')
+  $tool           = ConvertTo-JsonString (Get-Prop $payload 'tool_name')
+  $toolUseId      = ConvertTo-JsonString (Get-Prop $payload 'tool_use_id')
+  $permissionMode = ConvertTo-JsonString (Get-Prop $payload 'permission_mode')
   $durationMs     = Get-Prop $payload 'duration_ms'
-  $agentType      = [string](Get-Prop $payload 'agent_type')
-  $sessionSource  = [string](Get-Prop $payload 'source')
-  $reason         = [string](Get-Prop $payload 'reason')
-  $agentModel     = [string](Get-Prop $payload 'model')
+  $agentType      = ConvertTo-JsonString (Get-Prop $payload 'agent_type')
+  $sessionSource  = ConvertTo-JsonString (Get-Prop $payload 'source')
+  $reason         = ConvertTo-JsonString (Get-Prop $payload 'reason')
+  # String, or object with id preferred over display_name.
+  $agentModel = ''
+  $modelRaw = Get-Prop $payload 'model'
+  if (Test-JsonObject $modelRaw) {
+    $agentModel = ConvertTo-JsonString (Get-Prop $modelRaw 'id')
+    if (-not $agentModel) {
+      $agentModel = ConvertTo-JsonString (Get-Prop $modelRaw 'display_name')
+    }
+  }
+  else {
+    $agentModel = ConvertTo-JsonString $modelRaw
+  }
+  if (-not $agentModel) {
+    $agentModel = Resolve-AgentModel (ConvertTo-JsonString (Get-Prop $payload 'transcript_path'))
+  }
 
   $effortLevel = ''
   $effort = Get-Prop $payload 'effort'
-  if (Test-JsonObject $effort) { $effortLevel = [string](Get-Prop $effort 'level') }
+  if (Test-JsonObject $effort) { $effortLevel = ConvertTo-JsonString (Get-Prop $effort 'level') }
 
   # tool_input region.
   $skill = ''; $command = ''; $filePath = ''; $subagentType = ''
   $toolInput = Get-Prop $payload 'tool_input'
   if (Test-JsonObject $toolInput) {
-    $skill        = [string](Get-Prop $toolInput 'skill')
-    $command      = [string](Get-Prop $toolInput 'command')
-    $filePath     = [string](Get-Prop $toolInput 'file_path')
-    $subagentType = [string](Get-Prop $toolInput 'subagent_type')
+    $skill        = ConvertTo-JsonString (Get-Prop $toolInput 'skill')
+    $command      = ConvertTo-JsonString (Get-Prop $toolInput 'command')
+    $filePath     = ConvertTo-JsonString (Get-Prop $toolInput 'file_path')
+    $subagentType = ConvertTo-JsonString (Get-Prop $toolInput 'subagent_type')
     # Codex spawn_agent carries the spawned type in tool_input.agent_type;
     # normalize it to subagentType so it lands in the same field as Claude and
     # never collides with the envelope agent_type (agentType).
-    if (-not $subagentType) { $subagentType = [string](Get-Prop $toolInput 'agent_type') }
+    if (-not $subagentType) { $subagentType = ConvertTo-JsonString (Get-Prop $toolInput 'agent_type') }
   }
 
   # tool_response region. Presence of the KEY (any value shape) marks the
@@ -312,7 +377,7 @@ function Main {
   if (Test-JsonObject $toolResponse) {
     $interrupted   = ConvertTo-BoolString (Get-Prop $toolResponse 'interrupted')
     $success       = ConvertTo-BoolString (Get-Prop $toolResponse 'success')
-    $resolvedModel = [string](Get-Prop $toolResponse 'resolvedModel')
+    $resolvedModel = ConvertTo-JsonString (Get-Prop $toolResponse 'resolvedModel')
   }
 
   # Map the hook event to a canonical eventName; drop unrecognized events.
@@ -392,11 +457,13 @@ function Main {
   # disappears). Send no envelope, no `source` (the CLI overrides it), and no
   # session id (the CLI resolves its own and drops a payload one).
   #
-  # `uip track` is never-fail (exits 0, emits nothing when telemetry is opted
-  # out); piping to it is harmless even if the CLI is absent (the catch
-  # swallows the command-not-found error). The hook is registered async in
-  # hooks.json (sync with a 30s timeout on SessionEnd — see header), so the
-  # agent never waits on this call mid-session.
+  # INLINE, never detached: hooks.json registers this hook async on every event
+  # except SessionEnd (see header), so the host — not this script — owns
+  # non-blocking dispatch. A detached hand-off would return before `uip track`
+  # flushed, silently dropping the very session-end event the synchronous
+  # SessionEnd registration exists to protect. `uip track` is never-fail (exits
+  # 0, emits nothing when telemetry is opted out); piping to it is harmless even
+  # if the CLI is absent (the catch swallows the command-not-found error).
   try { $json | & uip track *> $null } catch { }
 
   exit 0