ur-agent 1.23.3 → 1.24.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 1.24.1
+
+- Add legal multi-provider auth/provider management for subscription CLI, API-key, and local runtime access paths.
+- Add provider doctor/status/config commands, provider-aware status bar display, and explicit no-token-scraping safety policy.
+
+## 1.24.0
+
+### Added
+- Plugin marketplace capability metadata for MCP tools, executable skills,
+  templates, validators, language adapters, LSP servers, hooks, agents, and
+  commands.
+- Bundled `engineering-discipline` reference plugin with `/discipline-check`,
+  `reproducible-release`, release-verifier template, release-gate validator,
+  and Markdown language-adapter metadata.
+- Release readiness test that keeps production bundle, release, package, and
+  global-install GitHub checks behind successful Bun tests.
+
+### Changed
+- npm package now includes `plugins/` and documents the
+  marketplace surfaces in the npm README.
+- UR product positioning is documented as an autonomous engineering workflow
+  engine for plan, execute, test, verify, document, benchmark, and reproduce.
+
 ## 1.23.3
 
 ### Fixed
@@ -746,7 +769,7 @@
   agent identity, and multimodal workflows. The report includes source
   references for each trend.
 - **A2A Agent Card export.** New `ur a2a card` CLI command and `/a2a-card`
-  slash command print UR Agent Card metadata for discovery by A2A-aware tools.
+  slash command print UR-AGENT Card metadata for discovery by A2A-aware tools.
 - **Professional trend docs.** `docs/AGENT_TRENDS.md` documents the coverage
   matrix, source/trust policy, and prioritized roadmap.
 
@@ -788,7 +811,7 @@
   discovery is unavailable.
 - **Repository metadata now matches production.** Package metadata, docs, bundled
   issue links, marketplace defaults, and GitHub workflow templates now point to
-  `Maitham16/UR-mapek`.
+  `Maitham16/UR`.
 
 ### Added
 - **Release consistency gate.** `bun run release:check` verifies package,

package/CONTRIBUTING.md

@@ -0,0 +1,21 @@
+# Contributing to UR-AGENT
+
+Use the project scripts before opening a pull request:
+
+```bash
+bun install
+bun test
+bun run typecheck
+bun run lint
+bun run build
+```
+
+Keep changes scoped and update documentation for public behavior. Do not commit
+local runtime state, secrets, generated caches, or private `.ur/` data.
+
+Plugin contributions should start in `plugins/community/` or from
+`plugins/examples/command-template/`. First-party plugins that ship in releases
+belong in `plugins/core/` and must be listed in `.ur-plugin/marketplace.json`.
+
+Release work must follow `RELEASE.md` and must not claim success without command
+evidence.

package/LICENSE

@@ -1,4 +1,4 @@
-UR Agent Non-Commercial Self-Responsibility License
+UR-AGENT Non-Commercial Self-Responsibility License
 Version 1.0
 
 Copyright (c) 2026 Maitham Al-rubaye

package/QUALITY.md

@@ -16,7 +16,8 @@ bun run bundle
 bun run smoke
 bun run secrets:scan
 bun run release:check
-npm pack --dry-run
+bun run package:check
+npm publish --dry-run
 ```
 
 For project-specific feature work, `ur test-first detect` shows the detected
@@ -30,7 +31,9 @@ the repo architecture and manifest-derived command set; `ur context-pack
 compress` preserves task decisions, constraints, commands, and diffs.
 
 `bun run release:check` is also wired into `prepack`, so stale bundles and
-version drift fail before packaging.
+version drift fail before packaging. The GitHub workflow must keep production
+bundle, release, package, and global-install checks after the Bun test step;
+do not tag or publish until that workflow is green.
 
 ## Documentation Gate
 

package/README.md

@@ -1,7 +1,7 @@
-# UR Agent
+# UR-AGENT
 
 <p align="center">
-  <strong>Local-first terminal coding agent for real engineering workflows.</strong>
+  <strong>Autonomous engineering workflow engine for reproducible software work.</strong>
 </p>
 
 <p align="center">
@@ -10,10 +10,13 @@
   <a href="./QUALITY.md"><img alt="quality gate" src="https://img.shields.io/badge/quality-release%20gated-brightgreen.svg"></a>
 </p>
 
-UR Agent is a Bun and TypeScript command-line coding agent: a reproducible
-autonomous software engineering agent. It opens a stateful interactive terminal
-session by default, can run one-shot prompts for scripts, and includes workflow
-commands for specification-driven development,
+UR-AGENT is a Bun and TypeScript autonomous engineering workflow engine: a
+reproducible autonomous software engineering agent built for disciplined local
+and CI-driven work. It is not only chat, autocomplete, or code edits: UR is
+built to plan, execute, test, verify, document, benchmark, and reproduce
+software work. It opens a stateful interactive terminal session by default, can
+run one-shot prompts for scripts, and includes workflow commands for
+specification-driven development,
 multi-agent execution, test-first quality loops, CI repair loops, background
 agents, MCP servers, plugins, skills, memory, permission safety policy,
 project context packing, verification, and local model routing.
@@ -52,8 +55,10 @@ handing work off to other tools or agents when needed.
 - **Verification and provenance.** Use `ur test-first`, the built-in verifier,
   `/verify`, `.ur/verify.json`, `ur artifacts`, `ur claim-ledger`, and `/trace`
   to make results easier to inspect.
-- **Extensible tool surface.** Add MCP servers, plugins, skills, role modes,
-  custom agents, IDE diff bundles, A2A endpoints, and local knowledge indexes.
+- **Extensible tool surface.** Add MCP tools, plugin marketplace entries,
+  executable skills, reusable templates, deterministic validators, language
+  adapters, LSP servers, role modes, custom agents, IDE diff bundles, A2A
+  endpoints, and local knowledge indexes.
 
 ## Quick Start
 
@@ -79,12 +84,13 @@ Install the global `ur` command:
 ```sh
 npm install -g ur-agent
 ur --version
+ur --help
 ```
 
 Install directly from GitHub when you want this repository build:
 
 ```sh
-bun add -g github:Maitham16/UR-mapek
+bun add -g github:Maitham16/UR
 ur --version
 ```
 
@@ -113,6 +119,18 @@ ur --continue
 ur --resume
 ```
 
+Check for npm updates:
+
+```sh
+ur upgrade
+```
+
+Source checkouts report:
+
+```text
+Development build detected. To update, pull latest source or install from npm.
+```
+
 Choose a model or Ollama host:
 
 ```sh
@@ -163,21 +181,59 @@ as first-class subcommands in the shipped CLI.
 | `ur model-doctor` | Inspect Ollama models and report likely agent capabilities. |
 | `ur model-route` | Recommend a local model for a task by capability fit. |
 | `ur mcp` | Configure and manage Model Context Protocol servers. |
-| `ur plugin` | Install, update, enable, disable, and validate UR plugins. |
+| `ur plugin` | Install, update, enable, disable, and validate UR plugins that can add MCP tools, skills, templates, validators, language adapters, LSP servers, agents, hooks, output styles, and commands. |
 | `ur role-mode` | Install built-in Architect, Code, Debug, and Ask role modes. |
 | `ur acp` | Start/stop/status the Agent Communication Protocol server for IDE extensions. |
 | `ur exec` | Run one or more prompts in non-interactive mode with optional concurrency. |
 | `ur ide diff` | Capture editor-readable inline diff bundles. |
-| `ur a2a card` | Print UR Agent Card metadata for agent interoperability. |
+| `ur a2a card` | Print UR-AGENT Card metadata for agent interoperability. |
 | `ur a2a serve` | Start an opt-in local A2A task server with bearer or delegation auth. |
 | `ur sdk` | Show programmatic headless usage and scaffold SDK examples. |
 
+### Status Bar
+
+Interactive sessions show a compact bottom status bar when the terminal supports
+it. It is hidden in CI, dumb terminals, non-interactive mode, and assistant
+viewer mode.
+
+Example:
+
+```text
+UR-AGENT v1.24.0 | model: qwen3-coder:480b-cloud | mode: ask | branch: main | tasks: idle | Update: 1.23.3 -> 1.24.0 available
+```
+
+If a custom status-line hook is configured, UR-AGENT uses that hook output
+instead of the built-in bar.
+
 New slash skills run agentic work in isolated git worktrees with clean commits and PR output:
 `/debug-v2`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`.
 Install matching agent templates with `ur agent-templates install`.
 
 New built-in tools (exposed through MCP and the ACP server): GitHub, API, Browser, Docker, TestRunner, Database. File-system and terminal tools are already built in (FileRead, FileEdit, FileWrite, Glob, Grep, Bash, PowerShell).
 
+### Plugin Marketplace
+
+UR plugins are trusted local extension bundles. A marketplace entry can install
+commands, MCP tools, executable skills, reusable templates, deterministic
+validators, language adapters, LSP server metadata, agents, hooks, and output
+styles. The bundled `engineering-discipline` reference plugin demonstrates the
+full extension contract with a `/discipline-check` command, a
+`reproducible-release` skill, a release-verifier template, a release-gate
+validator, and Markdown language-adapter metadata.
+
+```sh
+ur plugin list
+ur plugin install engineering-discipline@ur-plugins-official
+ur plugin install hello@ur-plugins-official
+ur plugin update <plugin>
+ur plugin disable <plugin>
+```
+
+The npm package includes `README.md`, `QUALITY.md`, `docs/`, `documentation/`,
+and `plugins/`, so the npm package page and installed artifact both carry the
+marketplace documentation, core plugins, community staging directory, and
+example plugin template. See [Plugin Guide](docs/plugins.md).
+
 UR also documents the core Cursor-style agent primitives as first-class,
 project-backed features: Agent surfaces (`ur`, `ur agents`, `ur crew`, `ur bg`),
 Rules (`AGENTS.md`, `UR.md`, `.cursor/rules/*.mdc`, `.cursorrules`, safety and
@@ -238,7 +294,6 @@ UR reads repository instructions and local runtime state from project files:
 - `UR.local.md` is for private local instructions.
 - `.ur/skills/` stores project skills.
 - `.ur/agents/` stores custom agents and role modes.
-- `.ur/specs/`, `.ur/artifacts/`, `.ur/automations/`, `.ur/test-first/`,
 - `.ur/safety-policy.json` configures project shell safety rules for read,
   write, execute, and network command classes.
 - `.ur/project-manifest.json` and `.ur/context/` hold architecture summaries,
@@ -270,7 +325,9 @@ settings, generated indexes, memory, logs, and secrets out of Git.
   agents, A2A, analytics, sync, and API integration.
 - `extensions/vscode-ur-inline-diffs/` contains the VS Code inline diff review
   extension.
-- `marketplace-plugins/` contains bundled example marketplace plugins.
+- `plugins/core/` contains first-party marketplace plugins.
+- `plugins/community/` stages contributed plugins.
+- `plugins/examples/` contains plugin templates users can copy.
 
 ## Safety Model
 
@@ -324,16 +381,22 @@ Build and verify a release:
 bun run typecheck
 bun run lint
 bun test
-bun run bundle
+bun run build
 bun run smoke
 bun run secrets:scan
 bun run release:check
+bun run package:check
 npm pack --dry-run
+npm publish --dry-run
 ```
 
 `dist/cli.js` is intentionally tracked because GitHub installs use the bundled
 CLI. Rebuild it after source, version, or macro changes.
 
+The GitHub workflow runs production bundle, smoke, release, package, and global
+install checks only after the Bun test step succeeds. Do not publish or tag a
+release until that GitHub run is green.
+
 ## Documentation
 
 - [Usage Guide](docs/USAGE.md)
@@ -346,7 +409,11 @@ CLI. Rebuild it after source, version, or macro changes.
 - [1.18.0 Upgrade Notes](docs/AGENT_UPGRADE_1.18.0.md)
 - [1.17.0 Upgrade Notes](docs/AGENT_UPGRADE_1.17.0.md)
 - [Development Guide](docs/DEVELOPMENT.md)
+- [Plugin Guide](docs/plugins.md)
 - [Validation Runbook](docs/VALIDATION.md)
+- [Release Runbook](RELEASE.md)
+- [Contributing](CONTRIBUTING.md)
+- [Security](SECURITY.md)
 - [Static Documentation Site](documentation/index.html)
 
 The `examples/` directory includes prompt and workflow examples for coding,
@@ -354,8 +421,8 @@ research, browser, image, video, MCP, memory, and agent-platform tasks.
 
 ## License
 
-UR Agent is released under the
-[UR Agent Non-Commercial Self-Responsibility License](LICENSE).
+UR-AGENT is released under the
+[UR-AGENT Non-Commercial Self-Responsibility License](LICENSE).
 
 Personal, educational, research, evaluation, and other non-commercial use is
 permitted. Commercial use requires prior written permission from Maitham

package/RELEASE.md

@@ -0,0 +1,54 @@
+# UR-AGENT release runbook
+
+Release target:
+
+- GitHub: `https://github.com/Maitham16/UR.git`
+- npm package: `ur-agent`
+- CLI binary: `ur`
+
+## Required checks
+
+Run from the repository root:
+
+```bash
+bun install
+bun test
+bun run typecheck
+bun run lint
+bun run build
+node ./bin/ur.js --version
+node ./bin/ur.js --help
+node ./bin/ur.js upgrade
+npm pack --dry-run
+npm publish --dry-run
+```
+
+Also verify:
+
+```bash
+git remote -v
+npm whoami
+npm view ur-agent@$(node -p "require('./package.json').version") version
+```
+
+If `npm whoami` fails, run:
+
+```bash
+npm login
+```
+
+Do not publish if the package version already exists on npm.
+
+## Publish
+
+Only after every check passes and the working tree is clean:
+
+```bash
+git add .
+git commit -m "chore: polish UR-AGENT production release"
+git push origin master
+npm publish
+```
+
+If the remote default branch is not `master`, push the checked-out release
+branch instead.

package/SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+Report security issues privately to the maintainer before opening a public
+issue.
+
+## Supported release
+
+Only the latest npm release of `ur-agent` is supported for security fixes.
+
+## Handling secrets
+
+Do not commit API keys, tokens, private URLs, credentials, local `.ur/` run
+state, shell history, or generated logs. Run the repository secret scan before
+release:
+
+```bash
+bun run secrets:scan
+```
+
+UR-AGENT can execute commands and load plugins. Treat plugins as trusted code,
+review MCP server configuration before enabling it, and use permission modes or
+sandboxes for risky workflows.

package/bin/ur.js

@@ -33,7 +33,7 @@ const packageName =
 const issuesUrl =
   typeof packageMetadata.bugs?.url === 'string'
     ? packageMetadata.bugs.url
-    : 'https://github.com/Maitham16/UR-mapek/issues'
+    : 'https://github.com/Maitham16/UR/issues'
 
 const bun = process.env.BUN_BIN || process.env.BUN_EXECUTABLE || 'bun'
 const ollamaModel =
@@ -72,13 +72,13 @@ function readJson(req) {
 function buildAgentCard(baseUrl) {
   return {
     protocolVersion: '0.3.0',
-    name: 'UR Agent',
+    name: 'UR-AGENT',
     description:
       'Local-first terminal coding agent powered through the local Ollama app, with MCP tools, custom agents, browser workflows, memory, verifier gates, and permission controls.',
     url: `${baseUrl}/a2a`,
     version,
     documentationUrl:
-      'https://github.com/Maitham16/UR-mapek/blob/master/docs/AGENT_TRENDS.md',
+      'https://github.com/Maitham16/UR/blob/master/docs/AGENT_TRENDS.md',
     capabilities: {
       streaming: true,
       pushNotifications: false,
@@ -88,7 +88,7 @@ function buildAgentCard(baseUrl) {
     defaultOutputModes: ['text/plain', 'text/markdown', 'application/json'],
     provider: {
       organization: 'Maitham Al-rubaye',
-      url: 'https://github.com/Maitham16/UR-mapek',
+      url: 'https://github.com/Maitham16/UR',
     },
     skills: [
       {
@@ -258,7 +258,7 @@ const child = spawn(bun, args, {
 child.on('error', error => {
   if (error.code === 'ENOENT') {
     console.error(
-      'Ur requires Bun to run. Install Bun from https://bun.sh, then retry.',
+      'UR-AGENT requires Bun to run. Install Bun from https://bun.sh, then retry.',
     )
     process.exit(1)
   }