ur-agent 1.35.1 → 1.36.1

package/docs/CONFIGURATION.md

@@ -15,6 +15,15 @@ UR-AGENT supports official provider access paths only:
   vendor's official CLI using your subscription login. They are optional and
   never required for normal UR runtime.
 
+Explicit API and local/server providers are UR-native: UR owns request
+shaping, native tool-call parsing, native streaming, and the UR-run Bash/File
+tool permission, sandbox, and verifier flow. Subscription CLI providers cross
+an external vendor CLI boundary instead — UR passes prompt text to the
+official CLI and receives final text output. UR-native tool calling, streaming,
+Bash/File tool execution, and sandbox guarantees apply to UR-run tools and
+final UR output, not to actions the external CLI performs internally. See
+[Provider Guide](providers.md) for the full provider capability matrix.
+
 UR-AGENT never scrapes browser sessions, extracts OAuth refresh tokens, reads
 hidden provider auth files, bypasses provider restrictions, or proxies consumer
 web sessions as APIs.
@@ -229,11 +238,47 @@ The default policy separates command behavior into read, write, execute, and
 network permission classes. It asks before destructive operations, recommends
 sandboxing for write/execute/network commands, and denies common secret-file or
 secret-like environment exfiltration patterns before broad Bash allow rules.
+Command classification parses the shell command with an AST parser and falls
+back to a conservative heuristic when parsing fails; anything it cannot
+confidently classify is routed to the normal permission prompt instead of
+being silently allowed.
 
 Run `ur safety init` to write `.ur/safety-policy.json`. Commit it only when the
 rules are safe and useful for the whole team; keep machine-local secrets and
 local settings out of Git.
 
+## Sandbox
+
+`ur sandbox` inspects the OS-level sandbox that wraps UR-run Bash/File tool
+commands:
+
+```sh
+ur sandbox status
+ur sandbox check
+ur sandbox eval "rm -rf build"
+```
+
+UR enforces this policy before running a UR Bash/File tool call, not after.
+Sandbox behavior has three modes, controlled by `sandbox.enabled` and
+`sandbox.failIfUnavailable` in settings:
+
+- **disabled** — `sandbox.enabled: false` (default). No OS-level confinement;
+  permission checks from the safety policy still apply.
+- **recommended** — `sandbox.enabled: true`, `sandbox.failIfUnavailable: false`.
+  Commands run sandboxed when OS support is available; if it is not, UR warns
+  and continues unsandboxed rather than blocking work.
+- **required** — `sandbox.enabled: true`, `sandbox.failIfUnavailable: true`.
+  UR fails closed: it refuses to start rather than run without a working
+  sandbox.
+
+OS confinement depends on platform support: `sandbox-exec` (Seatbelt) on
+macOS, or `bwrap` (bubblewrap) on Linux/WSL2. `ur sandbox check` reports
+missing dependencies for the current platform.
+
+This sandbox covers UR-run Bash/File tool commands only. For subscription CLI
+providers, it does not extend to actions the external CLI performs internally
+— see [Provider Guide](providers.md).
+
 ## Project Context Pack
 
 `ur context-pack` writes durable architecture context and task memory:

package/docs/TROUBLESHOOTING.md

@@ -30,13 +30,19 @@ ur --version
 
 ### Bun is missing or too old
 
-- Likely cause: UR runs through Bun; source checkouts and the GitHub install
-  path need Bun (this repository pins `bun@1.3.14`).
-- Fix: install Bun, then rerun.
+- Likely cause: UR is not Node-native. Every install path — npm, GitHub, and
+  source checkouts — executes the CLI through Bun (this repository pins
+  `bun@1.3.14`). The npm-installed `bin/ur.js` launcher starts under Node
+  only to detect Bun and re-exec into it; if Bun is missing or too old, the
+  launcher prints `UR-AGENT requires Bun ... at runtime` and exits instead of
+  falling back to Node.
+- Fix: install Bun, then rerun. Set `BUN_BIN` to an absolute Bun path if
+  `bun` is installed but not on `PATH`.
 
 ```sh
 npm install -g bun   # or: curl -fsSL https://bun.sh/install | bash
 bun --version
+ur --version
 ```
 
 ### Invalid or corrupted settings
@@ -156,12 +162,17 @@ ur -p --allowed-tools "Read,Edit,Bash(git:*)" "run the task"
 ### Permission or sandbox issues
 
 - Likely cause: the requested command is classified as write/execute/network
-  and requires approval, or sandbox dependencies are missing.
-- Fix: inspect the policy and the sandbox status.
+  and requires approval; OS sandbox dependencies (`sandbox-exec` on macOS,
+  `bwrap` on Linux/WSL2) are missing; or `sandbox.failIfUnavailable` (required
+  mode) is set and UR refused to start without a working sandbox.
+- Fix: inspect the policy and the sandbox status; install missing sandbox
+  dependencies, or relax `sandbox.enabled`/`sandbox.failIfUnavailable` in
+  settings if required mode is not intended.
 
 ```sh
 ur safety check --command "<the command>"
 ur sandbox status
+ur sandbox check
 ```
 
 ### Tests fail after an agent edit

package/docs/USAGE.md

@@ -122,6 +122,14 @@ using your subscription login (`ur auth <provider>`). The generic
 `subscription` entry is an internal placeholder and is hidden from listings;
 UR does not list fake subscription models.
 
+Subscription CLI providers have an explicit external-CLI boundary. UR passes
+prompt text to the official CLI and receives final text output. UR-native tool
+calling, UR Bash/File tool execution, UR-native streaming, local command
+permissions, sandbox guarantees, and verifier/done-gate checks apply to UR-run
+tools/final UR output, not to actions the external CLI performs internally.
+Use `ur provider status` or `ur provider doctor <provider>` to see provider
+kind, external CLI usage, native tool/streaming support, and the boundary text.
+
 Provider values accept canonical IDs and common aliases. For example,
 `openai-api`, `anthropic-api`, `gemini-api`, `openrouter`, `ollama`,
 `lmstudio`, `llama.cpp`, and `vllm` are UR-native runtime providers, and

package/docs/VALIDATION.md

@@ -12,7 +12,8 @@ You need:
 - A second Ollama server on the LAN if you want to test network discovery.
 - UR installed globally (`npm install -g ur-agent`) or this repo installed
   globally (`bun add -g github:Maitham16/UR`) or a
-  local checkout (`bun run dev`).
+  local checkout (`bun run dev`). Bun is required at runtime for every path —
+  the npm launcher detects and execs Bun automatically; UR is not Node-native.
 
 ## 0. Smoke
 

package/docs/providers.md

@@ -2,11 +2,12 @@
 
 UR-AGENT integrates official model access paths only. API-key providers, local
 runtimes, and OpenAI-compatible servers are UR-native backends: UR owns the
-conversation loop, tool loop, streaming, errors, and output. Subscription CLI
-providers (Codex CLI, Claude Code, Gemini CLI, Antigravity) are external app
-bridges: they are first-class in `/model` and dispatch each turn through the
-vendor's official CLI using your subscription login. They are optional, never
-required dependencies, and never used as a silent fallback.
+conversation loop, native tool-call parsing, streaming, errors, and UR-run tool
+execution. Subscription CLI providers (Codex CLI, Claude Code, Gemini CLI,
+Antigravity) are external app bridges: they are first-class in `/model` and
+dispatch each turn through the vendor's official CLI using your subscription
+login. They are optional, never required dependencies, and never used as a
+silent fallback.
 
 ## Legal auth policy
 
@@ -25,21 +26,59 @@ variables only when the user explicitly selects API mode.
 
 ## Provider matrix
 
-| Provider | Access type | Runtime kind | Runtime backend | Legal path |
-| --- | --- | --- | --- | --- |
-| Subscription | subscription | unavailable until configured | `subscription:unconfigured` | independent subscription runtime only |
-| OpenAI API | API | UR-native | `api:openai` | `OPENAI_API_KEY` |
-| Claude API | API | UR-native | `api:anthropic` | `ANTHROPIC_API_KEY` |
-| Gemini API | API | UR-native | `api:gemini` | `GEMINI_API_KEY` |
-| OpenRouter | API/router | UR-native | `api:openrouter` | `OPENROUTER_API_KEY` |
-| Ollama | local | UR-native | `ollama` | localhost Ollama runtime |
-| LM Studio | local/server | UR-native | `openai-compatible:lmstudio` | local OpenAI-compatible server |
-| llama.cpp | local/server | UR-native | `openai-compatible:llama.cpp` | local OpenAI-compatible server |
-| vLLM | local/server | UR-native | `openai-compatible:vllm` | OpenAI-compatible server |
-| Codex CLI | subscription | external app bridge | `subscription-cli:codex` | official Codex CLI login |
-| Claude Code | subscription | external app bridge | `subscription-cli:claude-code` | official Claude Code CLI login |
-| Gemini CLI | subscription | external app bridge | `subscription-cli:gemini` | official Gemini Code Assist login |
-| Antigravity | subscription | external app bridge | `subscription-cli:antigravity` | official Antigravity CLI login, where supported |
+Concise capability matrix — provider kind, native tool calls, native streaming,
+multimodal input, external CLI boundary, and sandbox scope:
+
+| Provider | Access type | Provider kind | External CLI | Native tools | Native streaming | Multimodal input | Sandbox scope | Runtime backend | Legal path |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| Subscription | subscription | subscription-placeholder | no | no | no | n/a | n/a (no runtime) | `subscription:unconfigured` | independent subscription runtime only |
+| OpenAI API | API | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `api:openai` | `OPENAI_API_KEY` |
+| Claude API | API | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `api:anthropic` | `ANTHROPIC_API_KEY` |
+| Gemini API | API | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `api:gemini` | `GEMINI_API_KEY` |
+| OpenRouter | API/router | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `api:openrouter` | `OPENROUTER_API_KEY` |
+| Ollama | local | UR-native | no | yes | yes | yes* | UR Bash/File sandbox | `ollama` | localhost Ollama runtime |
+| LM Studio | local/server | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `openai-compatible:lmstudio` | local OpenAI-compatible server |
+| llama.cpp | local/server | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `openai-compatible:llama.cpp` | local OpenAI-compatible server |
+| vLLM | local/server | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `openai-compatible:vllm` | OpenAI-compatible server |
+| Codex CLI | subscription | subscription-cli | yes | no | no | no† | UR-run tools/output only† | `subscription-cli:codex` | official Codex CLI login |
+| Claude Code | subscription | subscription-cli | yes | no | no | no† | UR-run tools/output only† | `subscription-cli:claude-code` | official Claude Code CLI login |
+| Gemini CLI | subscription | subscription-cli | yes | no | no | no† | UR-run tools/output only† | `subscription-cli:gemini` | official Gemini Code Assist login |
+| Antigravity | subscription | subscription-cli | yes | no | no | no† | UR-run tools/output only† | `subscription-cli:antigravity` | official Antigravity CLI login, where supported |
+
+\* Ollama forwards images only to models that advertise vision support;
+unsupported models get a text placeholder instead of the image.
+
+† External vendor CLI boundary (see below): UR passes prompt text only to the
+official CLI, so image blocks are not forwarded, and UR-native tool/streaming/
+sandbox guarantees stop at UR-run tools and final UR output.
+
+Native tools and native streaming mean UR's own request/response loop parses
+tool calls and streams tokens for that provider. Multimodal input means UR
+preserves image content blocks (resized/normalized with `sharp`) into that
+provider's wire format instead of stripping them. Sandbox scope states what
+UR's OS-level sandbox (macOS `sandbox-exec`, Linux `bwrap`) actually covers
+for that provider — see [Sandbox](CONFIGURATION.md#sandbox) for mode
+details.
+
+## Runtime boundary
+
+UR-native providers use UR's provider adapters and tool loop. For those
+providers, UR owns request shaping (including multimodal image-block mapping),
+native tool-call parsing, native streaming, and the UR-run Bash/File tool
+permission, sandbox, and verifier flow.
+
+Subscription CLI providers use a different boundary:
+
+> External vendor CLI boundary: UR passes prompt text to the official CLI and
+> receives final text output. UR-native tool calling, UR Bash/File tool
+> execution, UR-native streaming, local command permissions, sandbox guarantees,
+> and verifier/done-gate checks apply to UR-run tools/final UR output, not to
+> actions the external CLI performs internally.
+
+That means the external CLI may have its own tool use, streaming, filesystem
+access, network access, permissions, and safety behavior. UR reports CLI
+failures as provider-scoped errors and does not fabricate assistant text or
+silently switch to another provider.
 
 ## Commands
 
@@ -78,8 +117,9 @@ through that provider's backend:
 - **Local/server providers** connect to the configured local or OpenAI-compatible endpoint (`/v1/chat/completions` for LM Studio, llama.cpp and vLLM; the native tags/chat API for Ollama)
 - **Subscription CLI providers** (Codex CLI, Claude Code, Gemini CLI,
   Antigravity) dispatch the turn through the vendor's official CLI using your
-  subscription login. Failures remain provider-scoped and never fall back to
-  Ollama or any other provider.
+  subscription login. They do not use UR-native tool calling, UR-native
+  streaming, or UR Bash/File tool execution inside the external CLI. Failures
+  remain provider-scoped and never fall back to Ollama or any other provider.
 - The generic **`subscription`** entry is an internal placeholder with no
   models and no backend; it is hidden from listings. Choose a specific
   subscription CLI, API, or local/server provider instead.
@@ -108,6 +148,8 @@ You see all configured providers with:
 - Credential type: `cli-login`, `api-key`, `local-runtime`, or `openai-compatible-endpoint`
 - Short status message (e.g., "OPENAI_API_KEY found", "CLI not found", "localhost reachable")
 - Runtime kind: `UR-native` or `external app bridge`
+- Provider kind and boundary: `ur-native`, `subscription-cli`, or
+  `subscription-placeholder`
 
 **Step 2: Model Selection**
 
@@ -124,6 +166,9 @@ After selecting a model, the confirmation shows:
 - Selected model name
 - Model source (live/cache/static)
 - Runtime backend
+- Provider status and doctor output also show provider kind, whether an
+  external CLI is used, whether UR-native tool calls/streaming are supported,
+  and the exact safety boundary.
 - Effort level (if applicable)
 - Thinking status (if enabled)
 
@@ -173,7 +218,7 @@ ur config set provider anthropic-api
 | API providers (openai-api, anthropic-api, gemini-api, openrouter) | Live discovery from the provider's `/models` endpoint using your connected key (curated fallback until connected) | live |
 | Local/server providers (ollama, lmstudio, llama.cpp, vllm) | Dynamic discovery from the selected provider endpoint | live |
 | OpenAI-compatible | Dynamic discovery from configured endpoint | live |
-| Subscription CLIs (codex-cli, claude-code-cli, gemini-cli, antigravity-cli) | Curated list (the official CLIs expose no models API); first-class in `/model`, dispatched via the official CLI. Log in with `ur auth <provider>` | static |
+| Subscription CLIs (codex-cli, claude-code-cli, gemini-cli, antigravity-cli) | Curated list (the official CLIs expose no models API); first-class in `/model`, dispatched via the official CLI. External CLI behavior depends on the vendor CLI. Log in with `ur auth <provider>` | static |
 
 ### API vs Subscription distinction
 
@@ -220,7 +265,9 @@ ur connect logout openai-api           # clear a stored key
 - **Subscription providers** (`codex-cli`, `claude-code-cli`, `gemini-cli`,
   `antigravity-cli`) connect through their official CLI login using your own
   account; the session is persisted by that CLI. UR never scrapes or copies
-  those tokens.
+  those tokens. UR-native tools, sandbox guarantees, local command permissions,
+  and verifier/done-gate checks apply to UR-run tools/final UR output, not to
+  internal actions performed by the external CLI.
 - **API providers** (`openai-api`, `anthropic-api`, `gemini-api`, `openrouter`)
   store the key in your OS keychain (macOS Keychain, with an encrypted file
   fallback) — the same secure store UR uses for its own credentials. At runtime
@@ -268,8 +315,9 @@ ur provider status
 - Run `ur provider doctor <provider>` to check CLI presence and login status
 - Install the vendor's official CLI if it is missing, then log in with
   `ur auth <chatgpt|claude|gemini|antigravity>`
-- Remember these run through the external vendor CLI; UR-native behavior
-  (API/local/server providers) does not require them
+- Remember these run through the external vendor CLI; UR-native tool calls,
+  UR-native streaming, Bash/File tool semantics, sandbox guarantees, and local
+  command permissions do not apply to what the external CLI does internally
 
 **Provider shows "unavailable":**
 - Check API key: `echo $OPENAI_API_KEY`

package/documentation/index.html

@@ -44,7 +44,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.35.1</p>
+          <p class="eyebrow">Version 1.36.1</p>
           <h1>UR-AGENT Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-AGENT.</p>
         </div>
@@ -159,7 +159,7 @@ ur config set provider.fallback ollama</code></pre>
           </article>
           <article>
             <h3>Status bar and updates</h3>
-            <pre><code>Ollama | llama3 | ask | main | update 1.35.1 available</code></pre>
+            <pre><code>Ollama | llama3 | ask | main | update 1.36.1 available</code></pre>
             <p>The interactive status bar shows only important runtime state: provider, model, mode, branch, active tasks, checks status when known, and update availability. It is hidden in CI, dumb terminals, and non-interactive mode.</p>
           </article>
         </div>

package/extensions/vscode-ur-inline-diffs/package.json

@@ -2,7 +2,7 @@
   "name": "ur-inline-diffs",
   "displayName": "UR Inline Diffs",
   "description": "Review, apply, and reject UR inline diff bundles from .ur/ide/diffs inside VS Code.",
-  "version": "1.35.1",
+  "version": "1.36.1",
   "publisher": "ur-agent",
   "engines": {
     "vscode": "^1.92.0"

package/package.json

@@ -1,9 +1,13 @@
 {
   "name": "ur-agent",
-  "version": "1.35.1",
+  "version": "1.36.1",
   "description": "UR-AGENT — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",
+  "engines": {
+    "node": ">=18.18",
+    "bun": ">=1.3.0"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Maitham16/UR.git"
@@ -53,7 +57,9 @@
     "package:check": "node scripts/package-check.mjs",
     "prepack": "bun run release:check"
   },
-  "dependencies": {},
+  "dependencies": {
+    "sharp": "^0.35.1"
+  },
   "devDependencies": {
     "@alcalzone/ansi-tokenize": "^0.1.0",
     "@aws-sdk/credential-provider-node": "^3.972.58",
@@ -117,7 +123,6 @@
     "react-compiler-runtime": "^1.0.0",
     "react-reconciler": "^0.33.0",
     "semver": "^7.6.0",
-    "sharp": "^0.35.1",
     "shell-quote": "^1.8.0",
     "signal-exit": "^4.1.0",
     "stack-utils": "^2.0.0",