ur-agent 1.37.1 → 1.37.3

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 1.37.3
+
+- Version bump: align package, build macro, VS Code extension, docs eyebrow, and
+  changelog for the 1.37.3 patch release.
+
+## 1.37.2
+
+- Tightened provider reliability: API-provider calls now use a finite default
+  timeout, consistent retry handling for transient network/provider failures,
+  and safer OpenAI-compatible base URL normalization without changing streaming,
+  tool-call, multimodal, or local-provider routing behavior.
+- Hardened autonomous command safety: write, execute, and network commands now
+  require sandbox coverage in autonomous mode, unavailable sandboxes fail
+  closed unless explicit unsafe mode is set, and common secret read/exfiltration
+  patterns through pipes, redirects, and interpreter commands are denied.
+- Started real TypeScript strictness migration with a strict-core typecheck
+  stage, removed several core runtime `@ts-nocheck` suppressions by fixing the
+  underlying types, and added a lint guard against new core suppressions.
+- Improved release hygiene with package/source archive checks for dependency
+  trees, OS metadata, local env files, cache junk, logs, test output folders,
+  and nested archives; the secret scanner now works in both git checkouts and
+  extracted source archives.
+- Added reproducible benchmark report scaffolding so local eval runs can be
+  converted into versioned structured reports without claiming unmeasured
+  benchmark results.
+
 ## 1.35.1
 
 - Polished the bundled VS Code inline-diffs view with native toolbar icons,

package/RELEASE.md

@@ -23,6 +23,19 @@ npm pack --dry-run
 npm publish --dry-run
 ```
 
+If publishing or attaching a source archive, verify the actual zip artifact
+before release:
+
+```bash
+bun run release:create-source-zip
+bun run release:check-source-zip -- artifacts/source/ur-agent-$(node -p "require('./package.json').version")-source.zip
+```
+
+The source zip must contain source inputs such as `package.json`, `bun.lock`,
+`src/`, `bin/`, `scripts/`, `README.md`, `CHANGELOG.md`, and `SECURITY.md`,
+and must not contain local dependencies, runtime binaries, env files, logs,
+caches, test output folders, temp files, or nested archives.
+
 Also verify:
 
 ```bash

package/bin/ur.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { spawn, spawnSync } from 'node:child_process'
-import { existsSync, readFileSync, writeSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -113,13 +113,65 @@ const child = spawn(bun, args, {
 
 if (shouldPipeChildOutput) {
   child.stdout?.on('data', chunk => {
-    writeSync(1, chunk)
+    forwardChildOutput(child.stdout, process.stdout, chunk)
   })
   child.stderr?.on('data', chunk => {
-    writeSync(2, chunk)
+    forwardChildOutput(child.stderr, process.stderr, chunk)
   })
 }
 
+function forwardChildOutput(source, target, chunk) {
+  try {
+    const canContinue = target.write(chunk)
+    if (!canContinue) {
+      source.pause()
+      target.once('drain', () => source.resume())
+    }
+  } catch (error) {
+    if (isRetryableWriteError(error)) {
+      source.pause()
+      setTimeout(() => {
+        if (target.destroyed) return
+        try {
+          const canContinue = target.write(chunk)
+          if (canContinue) source.resume()
+          else target.once('drain', () => source.resume())
+        } catch (retryError) {
+          if (isRetryableWriteError(retryError)) {
+            forwardChildOutput(source, target, chunk)
+            return
+          }
+          if (!isBrokenPipe(retryError)) {
+            try {
+              process.stderr.write(`UR launcher output forwarding failed: ${retryError.message ?? String(retryError)}\n`)
+            } catch {
+              // Nothing sensible remains if stderr itself is unavailable.
+            }
+          }
+        }
+      }, 10)
+      return
+    }
+    if (isBrokenPipe(error)) {
+      source.destroy?.()
+      return
+    }
+    try {
+      process.stderr.write(`UR launcher output forwarding failed: ${error.message ?? String(error)}\n`)
+    } catch {
+      // Nothing sensible remains if stderr itself is unavailable.
+    }
+  }
+}
+
+function isRetryableWriteError(error) {
+  return error && (error.code === 'EAGAIN' || error.code === 'EWOULDBLOCK')
+}
+
+function isBrokenPipe(error) {
+  return error && error.code === 'EPIPE'
+}
+
 child.on('error', error => {
   if (error.code === 'ENOENT') {
     printBunRuntimeError(error.message)
@@ -136,5 +188,5 @@ child.on('close', (code, signal) => {
     return
   }
 
-  process.exit(code ?? 1)
+  process.exitCode = code ?? 1
 })