ur-agent 1.24.0 → 1.25.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.25.0
+
+- Add legal multi-provider auth/provider management for subscription CLI, API-key, and local runtime access paths.
+- Add provider doctor/status/config commands, provider-aware status bar display, and explicit no-token-scraping safety policy.
+- Relax plan-mode clarification choices so professional redesign prompts do not fail when more than four options are supplied.
+
 ## 1.24.0
 
 ### Added
@@ -13,7 +19,7 @@
   global-install GitHub checks behind successful Bun tests.
 
 ### Changed
-- npm package now includes `marketplace-plugins/` and documents the
+- npm package now includes `plugins/` and documents the
   marketplace surfaces in the npm README.
 - UR product positioning is documented as an autonomous engineering workflow
   engine for plan, execute, test, verify, document, benchmark, and reproduce.
@@ -764,7 +770,7 @@
   agent identity, and multimodal workflows. The report includes source
   references for each trend.
 - **A2A Agent Card export.** New `ur a2a card` CLI command and `/a2a-card`
-  slash command print UR Agent Card metadata for discovery by A2A-aware tools.
+  slash command print UR-AGENT Card metadata for discovery by A2A-aware tools.
 - **Professional trend docs.** `docs/AGENT_TRENDS.md` documents the coverage
   matrix, source/trust policy, and prioritized roadmap.
 
@@ -806,7 +812,7 @@
   discovery is unavailable.
 - **Repository metadata now matches production.** Package metadata, docs, bundled
   issue links, marketplace defaults, and GitHub workflow templates now point to
-  `Maitham16/UR-mapek`.
+  `Maitham16/UR`.
 
 ### Added
 - **Release consistency gate.** `bun run release:check` verifies package,

package/CONTRIBUTING.md

@@ -0,0 +1,21 @@
+# Contributing to UR-AGENT
+
+Use the project scripts before opening a pull request:
+
+```bash
+bun install
+bun test
+bun run typecheck
+bun run lint
+bun run build
+```
+
+Keep changes scoped and update documentation for public behavior. Do not commit
+local runtime state, secrets, generated caches, or private `.ur/` data.
+
+Plugin contributions should start in `plugins/community/` or from
+`plugins/examples/command-template/`. First-party plugins that ship in releases
+belong in `plugins/core/` and must be listed in `.ur-plugin/marketplace.json`.
+
+Release work must follow `RELEASE.md` and must not claim success without command
+evidence.

package/LICENSE

@@ -1,4 +1,4 @@
-UR Agent Non-Commercial Self-Responsibility License
+UR-AGENT Non-Commercial Self-Responsibility License
 Version 1.0
 
 Copyright (c) 2026 Maitham Al-rubaye

package/README.md

@@ -1,4 +1,4 @@
-# UR Agent
+# UR-AGENT
 
 <p align="center">
   <strong>Autonomous engineering workflow engine for reproducible software work.</strong>
@@ -10,7 +10,7 @@
   <a href="./QUALITY.md"><img alt="quality gate" src="https://img.shields.io/badge/quality-release%20gated-brightgreen.svg"></a>
 </p>
 
-UR Agent is a Bun and TypeScript autonomous engineering workflow engine: a
+UR-AGENT is a Bun and TypeScript autonomous engineering workflow engine: a
 reproducible autonomous software engineering agent built for disciplined local
 and CI-driven work. It is not only chat, autocomplete, or code edits: UR is
 built to plan, execute, test, verify, document, benchmark, and reproduce
@@ -21,9 +21,9 @@ multi-agent execution, test-first quality loops, CI repair loops, background
 agents, MCP servers, plugins, skills, memory, permission safety policy,
 project context packing, verification, and local model routing.
 
-UR sends model requests through the configured local Ollama app. That app can
-serve local models or Ollama Cloud-backed models, while UR itself stays out of
-provider API key management.
+UR-AGENT integrates official model access paths only: subscription CLIs,
+explicit API-key mode, and local OpenAI-compatible runtimes. It never scrapes
+browser sessions, extracts OAuth tokens, or bypasses provider restrictions.
 
 ## Why UR
 
@@ -38,6 +38,10 @@ handing work off to other tools or agents when needed.
   `ur -p` for automation-friendly output.
 - **Local model runtime.** Use any model exposed by Ollama, set a specific host
   with `--ollama-host`, or discover LAN Ollama servers with `--discover-ollama`.
+- **Legal provider routing.** Use `ur provider`, `ur auth chatgpt`,
+  `ur auth claude`, `ur auth gemini`, `ur auth antigravity`, and safe
+  `ur config set ...` commands to select official subscription, API, or local
+  providers without storing secrets in UR settings.
 - **Agent workflows.** Use `ur spec`, `ur arena`, `ur test-first`,
   `ur ci-loop`, `ur bg`, `ur workflow`, `ur crew`, and `ur automation` for
   structured work beyond a single chat turn.
@@ -84,12 +88,13 @@ Install the global `ur` command:
 ```sh
 npm install -g ur-agent
 ur --version
+ur --help
 ```
 
 Install directly from GitHub when you want this repository build:
 
 ```sh
-bun add -g github:Maitham16/UR-mapek
+bun add -g github:Maitham16/UR
 ur --version
 ```
 
@@ -118,6 +123,18 @@ ur --continue
 ur --resume
 ```
 
+Check for npm updates:
+
+```sh
+ur upgrade
+```
+
+Source checkouts report:
+
+```text
+Development build detected. To update, pull latest source or install from npm.
+```
+
 Choose a model or Ollama host:
 
 ```sh
@@ -130,6 +147,47 @@ Model selection precedence is `OLLAMA_MODEL`, then `UR_MODEL`, then the model
 router over the configured Ollama host. If model discovery fails, the built-in
 fallback is `qwen3-coder:480b-cloud`.
 
+### Legal Provider Auth
+
+UR-AGENT stores only safe provider preferences: provider name, model name,
+base URL, command path, fallback preference, and non-secret settings. API keys
+must stay in environment variables and subscription providers must authenticate
+through their official CLIs.
+
+```sh
+ur provider list
+ur provider status
+ur provider doctor
+ur auth chatgpt
+ur auth claude
+ur auth gemini
+ur auth antigravity
+ur config set provider codex-cli
+ur config set model qwen3-coder:480b-cloud
+ur config set base_url http://localhost:11434
+ur config set provider.fallback ollama
+```
+
+| Provider | Access type | Legal path |
+| --- | --- | --- |
+| ChatGPT/Codex | subscription | official Codex CLI login |
+| Claude Code | subscription | official Claude Code login |
+| Gemini CLI | subscription | official Gemini Code Assist login |
+| Antigravity | subscription | official Antigravity login, where supported |
+| OpenAI | API | `OPENAI_API_KEY` |
+| Anthropic Claude | API | `ANTHROPIC_API_KEY` |
+| Gemini | API | `GEMINI_API_KEY` |
+| OpenRouter | API/router | `OPENROUTER_API_KEY` |
+| Ollama | local | localhost Ollama runtime |
+| LM Studio | local | local OpenAI-compatible server |
+| llama.cpp | local | local OpenAI-compatible server |
+| vLLM | local/server | OpenAI-compatible server |
+
+Security policy: UR-AGENT never scrapes browser sessions, extracts OAuth
+tokens, bypasses subscription/quota/region/organization restrictions, proxies a
+consumer web session as an API, or claims support for a provider unless the
+official CLI/API path works. See [Provider Guide](docs/providers.md).
+
 ## Command Surface
 
 Run `ur --help` for the complete CLI reference. These commands are implemented
@@ -167,16 +225,37 @@ as first-class subcommands in the shipped CLI.
 | `ur eval bench` | Import local SWE-bench, Terminal-Bench, or Aider Polyglot exports. |
 | `ur model-doctor` | Inspect Ollama models and report likely agent capabilities. |
 | `ur model-route` | Recommend a local model for a task by capability fit. |
+| `ur provider` | List, check, and diagnose legal model provider adapters. |
+| `ur auth chatgpt` | Launch the official Codex CLI login for ChatGPT subscription access. |
+| `ur auth claude` | Launch the official Claude Code login flow. |
+| `ur auth gemini` | Use the official Gemini CLI login flow where supported. |
+| `ur auth antigravity` | Use the official Antigravity CLI login flow where supported. |
+| `ur config set` | Persist safe non-secret provider settings such as provider, model, base URL, command path, and fallback. |
 | `ur mcp` | Configure and manage Model Context Protocol servers. |
 | `ur plugin` | Install, update, enable, disable, and validate UR plugins that can add MCP tools, skills, templates, validators, language adapters, LSP servers, agents, hooks, output styles, and commands. |
 | `ur role-mode` | Install built-in Architect, Code, Debug, and Ask role modes. |
 | `ur acp` | Start/stop/status the Agent Communication Protocol server for IDE extensions. |
 | `ur exec` | Run one or more prompts in non-interactive mode with optional concurrency. |
 | `ur ide diff` | Capture editor-readable inline diff bundles. |
-| `ur a2a card` | Print UR Agent Card metadata for agent interoperability. |
+| `ur a2a card` | Print UR-AGENT Card metadata for agent interoperability. |
 | `ur a2a serve` | Start an opt-in local A2A task server with bearer or delegation auth. |
 | `ur sdk` | Show programmatic headless usage and scaffold SDK examples. |
 
+### Status Bar
+
+Interactive sessions show a compact bottom status bar when the terminal supports
+it. It is hidden in CI, dumb terminals, non-interactive mode, and assistant
+viewer mode.
+
+Example:
+
+```text
+UR-AGENT v1.25.0 | Provider: Ollama | Auth: local | model: qwen3-coder:480b-cloud | mode: ask | branch: main | tasks: idle | Update: 1.24.0 -> 1.25.0 available
+```
+
+If a custom status-line hook is configured, UR-AGENT uses that hook output
+instead of the built-in bar.
+
 New slash skills run agentic work in isolated git worktrees with clean commits and PR output:
 `/debug-v2`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`.
 Install matching agent templates with `ur agent-templates install`.
@@ -202,8 +281,9 @@ ur plugin disable <plugin>
 ```
 
 The npm package includes `README.md`, `QUALITY.md`, `docs/`, `documentation/`,
-and `marketplace-plugins/`, so the npm package page and installed artifact both
-carry the marketplace documentation.
+and `plugins/`, so the npm package page and installed artifact both carry the
+marketplace documentation, core plugins, community staging directory, and
+example plugin template. See [Plugin Guide](docs/plugins.md).
 
 UR also documents the core Cursor-style agent primitives as first-class,
 project-backed features: Agent surfaces (`ur`, `ur agents`, `ur crew`, `ur bg`),
@@ -265,7 +345,6 @@ UR reads repository instructions and local runtime state from project files:
 - `UR.local.md` is for private local instructions.
 - `.ur/skills/` stores project skills.
 - `.ur/agents/` stores custom agents and role modes.
-- `.ur/specs/`, `.ur/artifacts/`, `.ur/automations/`, `.ur/test-first/`,
 - `.ur/safety-policy.json` configures project shell safety rules for read,
   write, execute, and network command classes.
 - `.ur/project-manifest.json` and `.ur/context/` hold architecture summaries,
@@ -297,7 +376,9 @@ settings, generated indexes, memory, logs, and secrets out of Git.
   agents, A2A, analytics, sync, and API integration.
 - `extensions/vscode-ur-inline-diffs/` contains the VS Code inline diff review
   extension.
-- `marketplace-plugins/` contains bundled example marketplace plugins.
+- `plugins/core/` contains first-party marketplace plugins.
+- `plugins/community/` stages contributed plugins.
+- `plugins/examples/` contains plugin templates users can copy.
 
 ## Safety Model
 
@@ -351,11 +432,12 @@ Build and verify a release:
 bun run typecheck
 bun run lint
 bun test
-bun run bundle
+bun run build
 bun run smoke
 bun run secrets:scan
 bun run release:check
 bun run package:check
+npm pack --dry-run
 npm publish --dry-run
 ```
 
@@ -378,7 +460,11 @@ release until that GitHub run is green.
 - [1.18.0 Upgrade Notes](docs/AGENT_UPGRADE_1.18.0.md)
 - [1.17.0 Upgrade Notes](docs/AGENT_UPGRADE_1.17.0.md)
 - [Development Guide](docs/DEVELOPMENT.md)
+- [Plugin Guide](docs/plugins.md)
 - [Validation Runbook](docs/VALIDATION.md)
+- [Release Runbook](RELEASE.md)
+- [Contributing](CONTRIBUTING.md)
+- [Security](SECURITY.md)
 - [Static Documentation Site](documentation/index.html)
 
 The `examples/` directory includes prompt and workflow examples for coding,
@@ -386,8 +472,8 @@ research, browser, image, video, MCP, memory, and agent-platform tasks.
 
 ## License
 
-UR Agent is released under the
-[UR Agent Non-Commercial Self-Responsibility License](LICENSE).
+UR-AGENT is released under the
+[UR-AGENT Non-Commercial Self-Responsibility License](LICENSE).
 
 Personal, educational, research, evaluation, and other non-commercial use is
 permitted. Commercial use requires prior written permission from Maitham

package/RELEASE.md

@@ -0,0 +1,54 @@
+# UR-AGENT release runbook
+
+Release target:
+
+- GitHub: `https://github.com/Maitham16/UR.git`
+- npm package: `ur-agent`
+- CLI binary: `ur`
+
+## Required checks
+
+Run from the repository root:
+
+```bash
+bun install
+bun test
+bun run typecheck
+bun run lint
+bun run build
+node ./bin/ur.js --version
+node ./bin/ur.js --help
+node ./bin/ur.js upgrade
+npm pack --dry-run
+npm publish --dry-run
+```
+
+Also verify:
+
+```bash
+git remote -v
+npm whoami
+npm view ur-agent@$(node -p "require('./package.json').version") version
+```
+
+If `npm whoami` fails, run:
+
+```bash
+npm login
+```
+
+Do not publish if the package version already exists on npm.
+
+## Publish
+
+Only after every check passes and the working tree is clean:
+
+```bash
+git add .
+git commit -m "chore: polish UR-AGENT production release"
+git push origin master
+npm publish
+```
+
+If the remote default branch is not `master`, push the checked-out release
+branch instead.

package/SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+Report security issues privately to the maintainer before opening a public
+issue.
+
+## Supported release
+
+Only the latest npm release of `ur-agent` is supported for security fixes.
+
+## Handling secrets
+
+Do not commit API keys, tokens, private URLs, credentials, local `.ur/` run
+state, shell history, or generated logs. Run the repository secret scan before
+release:
+
+```bash
+bun run secrets:scan
+```
+
+UR-AGENT can execute commands and load plugins. Treat plugins as trusted code,
+review MCP server configuration before enabling it, and use permission modes or
+sandboxes for risky workflows.

package/bin/ur.js

@@ -33,7 +33,7 @@ const packageName =
 const issuesUrl =
   typeof packageMetadata.bugs?.url === 'string'
     ? packageMetadata.bugs.url
-    : 'https://github.com/Maitham16/UR-mapek/issues'
+    : 'https://github.com/Maitham16/UR/issues'
 
 const bun = process.env.BUN_BIN || process.env.BUN_EXECUTABLE || 'bun'
 const ollamaModel =
@@ -72,13 +72,13 @@ function readJson(req) {
 function buildAgentCard(baseUrl) {
   return {
     protocolVersion: '0.3.0',
-    name: 'UR Agent',
+    name: 'UR-AGENT',
     description:
       'Local-first terminal coding agent powered through the local Ollama app, with MCP tools, custom agents, browser workflows, memory, verifier gates, and permission controls.',
     url: `${baseUrl}/a2a`,
     version,
     documentationUrl:
-      'https://github.com/Maitham16/UR-mapek/blob/master/docs/AGENT_TRENDS.md',
+      'https://github.com/Maitham16/UR/blob/master/docs/AGENT_TRENDS.md',
     capabilities: {
       streaming: true,
       pushNotifications: false,
@@ -88,7 +88,7 @@ function buildAgentCard(baseUrl) {
     defaultOutputModes: ['text/plain', 'text/markdown', 'application/json'],
     provider: {
       organization: 'Maitham Al-rubaye',
-      url: 'https://github.com/Maitham16/UR-mapek',
+      url: 'https://github.com/Maitham16/UR',
     },
     skills: [
       {
@@ -258,7 +258,7 @@ const child = spawn(bun, args, {
 child.on('error', error => {
   if (error.code === 'ENOENT') {
     console.error(
-      'Ur requires Bun to run. Install Bun from https://bun.sh, then retry.',
+      'UR-AGENT requires Bun to run. Install Bun from https://bun.sh, then retry.',
     )
     process.exit(1)
   }