ur-agent 1.18.0 → 1.19.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 1.19.0
+
+### Added
+- **Permission and safety policy (`ur safety`).** Added a project shell safety
+  evaluator that separates read, write, execute, and network command classes;
+  asks before destructive commands; recommends sandboxing for risky operations;
+  and denies common secret-file and secret-like environment exfiltration paths.
+- **Bash permission integration.** The project safety policy now runs before
+  broad Bash allow paths and sandbox auto-allow, so destructive commands still
+  require approval and secret exfiltration is blocked even when permissive
+  command rules exist.
+- **Project context pack (`ur context-pack`).** Added repo architecture
+  scanning from manifests, instruction files, Project DNA, verify gates, and
+  safety config. Task memory records decisions, constraints, commands, diffs,
+  and notes under `.ur/context/`, with compression into a durable summary.
+
+### Changed
+- **Chrome/Desktop links.** Replaced deprecated Chrome and desktop documentation
+  links in source with current `ur.ai` URLs.
+- **Version bump.** Updated from 1.18.0 to 1.19.0 across `package.json`,
+  `bunfig.toml`, the VS Code extension, and bundled CLI metadata.
+
+### Verified
+- Added focused tests for safety policy decisions, policy file creation,
+  context manifest generation, task memory compression, CLI command parsing,
+  and updated agent feature/trend inventories.
+
 ## 1.18.0
 
 ### Added
@@ -73,7 +100,7 @@
 ## 1.14.1
 
 ### Changed
-- Removed the `desktop-app` startup tip pointing to `clau.de/desktop`.
+- Removed the `desktop-app` startup tip pointing to the legacy desktop URL.
 
 ### Changed
 - **Version bump.** Updated from 1.14.0 to 1.14.1 across `package.json`, `bunfig.toml`, and bundled CLI.

package/QUALITY.md

@@ -22,6 +22,12 @@ For project-specific feature work, `ur test-first detect` shows the detected
 compile/test/lint command set. `ur test-first install` can persist that command
 set into `.ur/verify.json` so future mutating turns run the same gates.
 
+For safety-sensitive changes, `ur safety check --command "<cmd>"` previews
+read/write/execute/network permission classes, destructive-command approval,
+sandbox posture, and secret exfiltration denial. `ur context-pack scan` records
+the repo architecture and manifest-derived command set; `ur context-pack
+compress` preserves task decisions, constraints, commands, and diffs.
+
 `bun run release:check` is also wired into `prepack`, so stale bundles and
 version drift fail before packaging.
 
@@ -56,6 +62,12 @@ Public feature releases should update the full documentation set:
 - `ur test-first` stores failing compile/test/lint traces under
   `.ur/test-first/traces/` and reports success only from zero-exit command
   evidence.
+- `ur safety` asks before destructive commands, recommends sandboxing for risky
+  operations, and blocks common secret exfiltration paths before broad shell
+  allow rules.
+- `ur context-pack` keeps durable architecture summaries and task memory under
+  `.ur/context/` so decisions, constraints, commands, and diffs survive context
+  compression.
 - Deep verification through the verification subagent is manual by default and
   can be enabled with `UR_VERIFIER_AUTO_SUBAGENT=1`.
 - Secrets must stay in environment variables, secure storage, or local ignored

package/README.md

@@ -14,8 +14,8 @@ UR Agent is a Bun and TypeScript command-line coding agent. It opens a stateful
 interactive terminal session by default, can run one-shot prompts for scripts,
 and includes workflow commands for specification-driven development,
 multi-agent execution, test-first quality loops, CI repair loops, background
-agents, MCP servers, plugins, skills, memory, verification, and local model
-routing.
+agents, MCP servers, plugins, skills, memory, permission safety policy,
+project context packing, verification, and local model routing.
 
 UR sends model requests through the configured local Ollama app. That app can
 serve local models or Ollama Cloud-backed models, while UR itself stays out of
@@ -36,6 +36,9 @@ handing work off to other tools or agents when needed.
   structured work beyond a single chat turn.
 - **Reliable repo editing.** Use `ur repo-edit` for indexed search,
   AST-aware rename plans, patch previews, and rollback-safe multi-file apply.
+- **Permission and context control.** Use `ur safety` and `ur context-pack` to
+  inspect command risk, initialize project safety policy, summarize repository
+  architecture, and preserve task decisions, constraints, commands, and diffs.
 - **Verification and provenance.** Use `ur test-first`, the built-in verifier,
   `/verify`, `.ur/verify.json`, `ur artifacts`, `ur claim-ledger`, and `/trace`
   to make results easier to inspect.
@@ -126,6 +129,8 @@ as first-class subcommands in the shipped CLI.
 | `ur arena` | Run multiple agents on the same task in isolated worktrees and surface the winning diff. |
 | `ur ci-loop` | Run a build or test command, hand failures to a fix agent, and retry with a bounded budget. |
 | `ur test-first` | Detect the project stack, run compile/test/lint commands, store failure traces, and install edit-time verify gates. |
+| `ur safety` | Inspect or initialize project shell safety policy and evaluate command risk before execution. |
+| `ur context-pack` | Write project architecture context, task memory, and compressed context under `.ur/`. |
 | `ur bg` | Run and manage detached local background agents with optional worktrees and PR creation. |
 | `ur automation` | Store and run project-local scheduled automation specs under `.ur/automations/`. |
 | `ur workflow` | Define, validate, graph, run, and resume declarative agent workflows. |
@@ -159,6 +164,10 @@ ur escalate run "refactor the cache layer" --force-oracle --dry-run
 ur test-first detect
 ur test-first --dry-run
 ur test-first install
+ur safety check --command "rm -rf build"
+ur context-pack scan
+ur context-pack remember --decision "Use package scripts before ad hoc commands"
+ur context-pack compress
 ur ci-loop --command "bun test" --max-attempts 3 --dry-run
 ur bg run "fix the flaky parser test" --worktree --dry-run
 ur automation create nightly --schedule "0 9 * * 1-5" --prompt "Review open tasks"
@@ -177,6 +186,11 @@ UR reads repository instructions and local runtime state from project files:
 - `UR.local.md` is for private local instructions.
 - `.ur/skills/` stores project skills.
 - `.ur/agents/` stores custom agents and role modes.
+- `.ur/specs/`, `.ur/artifacts/`, `.ur/automations/`, `.ur/test-first/`,
+- `.ur/safety-policy.json` configures project shell safety rules for read,
+  write, execute, and network command classes.
+- `.ur/project-manifest.json` and `.ur/context/` hold architecture summaries,
+  task memory, compressed context, and command/constraint decisions.
 - `.ur/specs/`, `.ur/artifacts/`, `.ur/automations/`, `.ur/test-first/`,
   `.ur/memory/`, and `.ur/index/` hold workflow state, review artifacts,
   scheduled jobs, failure traces, memory, and indexes.
@@ -198,8 +212,8 @@ settings, generated indexes, memory, logs, and secrets out of Git.
 - `src/tools/` contains tool implementations for file editing, shell execution,
   MCP resources, task management, and agent delegation.
 - `src/services/` contains runtime services for MCP, verification, memory,
-  code indexing, model routing, background agents, A2A, analytics, sync, and
-  API integration.
+  code indexing, safety policy, context manifests, model routing, background
+  agents, A2A, analytics, sync, and API integration.
 - `extensions/vscode-ur-inline-diffs/` contains the VS Code inline diff review
   extension.
 - `marketplace-plugins/` contains bundled example marketplace plugins.
@@ -219,6 +233,13 @@ the permission boundary matters.
 - Project gates can be configured in `.ur/verify.json`.
 - `ur test-first install` writes detected compile/test/lint commands into
   `.ur/verify.json` so mutating turns have command evidence before completion.
+- `ur safety check --command "<cmd>"` classifies read, write, execute, and
+  network permissions, asks before destructive commands, recommends sandboxing
+  for risky operations, and blocks common secret exfiltration paths.
+- `ur safety init` writes `.ur/safety-policy.json` for project-specific safety
+  rules.
+- `ur context-pack scan` writes a repo architecture manifest from package
+  scripts, instruction files, `.ur/verify.json`, and safety config.
 - The deep verification subagent is available through `/verify` and can be
   auto-enabled with `UR_VERIFIER_AUTO_SUBAGENT=1`.
 - OS-level sandbox support is available on macOS and Linux through UR's
@@ -264,6 +285,7 @@ CLI. Rebuild it after source, version, or macro changes.
 - [Configuration](docs/CONFIGURATION.md)
 - [Agent Feature Expansion](docs/AGENT_FEATURES.md)
 - [Agent Trend Coverage](docs/AGENT_TRENDS.md)
+- [1.19.0 Upgrade Notes](docs/AGENT_UPGRADE_1.19.0.md)
 - [1.18.0 Upgrade Notes](docs/AGENT_UPGRADE_1.18.0.md)
 - [1.17.0 Upgrade Notes](docs/AGENT_UPGRADE_1.17.0.md)
 - [Development Guide](docs/DEVELOPMENT.md)