ur-agent 1.37.4 → 1.40.1

package/CHANGELOG.md

@@ -1,9 +1,36 @@
 # Changelog
 
-## 1.37.4
+## 1.40.1
+
+- Pin `diff` to ^7 and OpenTelemetry packages to 2.6.1/0.214.0 to match the
+  source API, fixing type errors from accidental dependency bumps, and rebuild
+  the shipped bundle against these versions.
+- Update branding and A2A delegation tests for the `ur-agent` package name.
+
+## 1.40.0
+
+- Version bump: align package, build macro, VS Code extension, docs eyebrow, and
+  changelog for the 1.40.0 release.
+
+## 1.37.5
 
 - Version bump: align package, build macro, VS Code extension, docs eyebrow, and
-  changelog for the 1.37.4 patch release.
+  changelog for the 1.37.5 patch release.
+- Rename user-facing product/package branding to UR-Nexus while preserving the
+  `ur` CLI entrypoint and legacy configuration compatibility.
+- Add a typed prompt-planning layer with deterministic task decomposition,
+  task-board rendering, dependency-aware parallel scheduling, file-lock
+  serialization, and verification checks for unsupported file/command claims.
+- Wire prompt planning into real `ur exec` execution with task-board progress,
+  dependency-aware parallel scheduling, file-lock serialization, evidence-based
+  final reports, and compatibility flags for direct legacy prompt execution.
+- Add live task-board streaming during real planned execution, workspace
+  before/after file evidence, verified versus unverified command reporting,
+  strict/non-strict verification policy, and final reports generated from
+  observed execution evidence.
+- Fix project safety policy handling so projects that remove `network` from
+  `sandboxRequiredFor` can run user-controlled localhost network checks without
+  a hard sandbox-unavailable denial.
 
 ## 1.37.3
 
@@ -264,7 +291,7 @@
 ## 1.25.2
 
 - Refresh public documentation so README, docs, static site, validation runbook,
-  and code inventory all describe the current UR-AGENT feature set.
+  and code inventory all describe the current UR-Nexus feature set.
 - Document the recent provider auth, status bar, bundled VS Code extension,
   `ur upgrade`, and AskUserQuestion schema fixes as first-class release
   behavior.
@@ -273,7 +300,7 @@
 
 ## 1.25.1
 
-- Fix VS Code extension installation to use the bundled UR-AGENT inline-diffs extension instead of the stale unpublished `urhq.ur` marketplace ID.
+- Fix VS Code extension installation to use the bundled UR-Nexus inline-diffs extension instead of the stale unpublished `urhq.ur` marketplace ID.
 - Harden AskUserQuestion normalization for description-only option objects and keep the eight-option schema in the production bundle.
 
 ## 1.25.0
@@ -876,7 +903,7 @@
 
 ### Verified
 - Rebuilt `dist/cli.js` at 1.13.5 and prepared npm package metadata for
-  `ur-agent@1.13.5`.
+  `ur-nexus@1.13.5`.
 
 ## 1.13.4
 
@@ -932,7 +959,7 @@
 
 ### Verified
 - Rebuilt `dist/cli.js` at 1.13.3 and prepared npm package metadata for
-  `ur-agent@1.13.3`.
+  `ur-nexus@1.13.3`.
 
 ## 1.13.2
 
@@ -954,7 +981,7 @@
 
 ### Verified
 - Rebuilt `dist/cli.js` at 1.13.2 and verified npm package metadata resolves
-  to `ur-agent@1.13.2`.
+  to `ur-nexus@1.13.2`.
 
 ## 1.13.1
 
@@ -1046,7 +1073,7 @@
   agent identity, and multimodal workflows. The report includes source
   references for each trend.
 - **A2A Agent Card export.** New `ur a2a card` CLI command and `/a2a-card`
-  slash command print UR-AGENT Card metadata for discovery by A2A-aware tools.
+  slash command print UR-Nexus Card metadata for discovery by A2A-aware tools.
 - **Professional trend docs.** `docs/AGENT_TRENDS.md` documents the coverage
   matrix, source/trust policy, and prioritized roadmap.
 
@@ -1075,7 +1102,7 @@
 
 ### Changed
 - **Npm publication docs.** README installation guidance now reflects that
-  `ur-agent` is published on npm, while keeping the GitHub install path for
+  `ur-nexus` is published on npm, while keeping the GitHub install path for
   source-based installs.
 
 ## 1.11.0

package/CONTRIBUTING.md

@@ -1,4 +1,4 @@
-# Contributing to UR-AGENT
+# Contributing to UR-Nexus
 
 Use the project scripts before opening a pull request:
 

package/LICENSE

@@ -1,4 +1,4 @@
-UR-AGENT Non-Commercial Self-Responsibility License
+UR-Nexus Non-Commercial Self-Responsibility License
 Version 1.0
 
 Copyright (c) 2026 Maitham Al-rubaye

package/README.md

@@ -1,4 +1,4 @@
-# UR-AGENT
+# UR-Nexus
 
 <p align="center">
   <strong>Autonomous engineering workflow engine for reproducible software work.</strong>
@@ -10,7 +10,7 @@
   <a href="./QUALITY.md"><img alt="quality gate" src="https://img.shields.io/badge/quality-release%20gated-brightgreen.svg"></a>
 </p>
 
-UR-AGENT is a Bun and TypeScript autonomous engineering workflow engine: a
+UR-Nexus is a Bun and TypeScript autonomous engineering workflow engine: a
 reproducible autonomous software engineering agent built for disciplined local
 and CI-driven work. It is not only chat, autocomplete, or code edits: UR is
 built to plan, execute, test, verify, document, benchmark, and reproduce
@@ -21,7 +21,7 @@ multi-agent execution, test-first quality loops, CI repair loops, background
 agents, MCP servers, plugins, skills, memory, permission safety policy,
 project context packing, verification, and local model routing.
 
-UR-AGENT integrates official model access paths only: subscription CLIs,
+UR-Nexus integrates official model access paths only: subscription CLIs,
 explicit API-key mode, and local OpenAI-compatible runtimes. It never scrapes
 browser sessions, extracts OAuth tokens, or bypasses provider restrictions.
 
@@ -64,13 +64,63 @@ handing work off to other tools or agents when needed.
   adapters, LSP servers, role modes, custom agents, IDE diff bundles, A2A
   endpoints, and local knowledge indexes.
 
+## Prompt Planning and Task Board
+
+UR-Nexus can decompose short or long `ur exec` prompts into small executable
+task units before work starts. Each task records an id, title, description, status,
+dependencies, assigned logical agent role, input, expected output, and
+verification criteria. Simple prompts stay compact; complex prompts are split
+only when the wording or ordering makes separate tasks useful.
+
+During real `ur exec` runs the task board streams when a task status changes,
+then appears again in the final report. Quiet/non-interactive runs can suppress
+streaming while preserving the final board. Tasks move through `pending`,
+`ready`, `running`, `blocked`, `finished`, and `failed`:
+
+```text
+[UR-Nexus Task Board]
+
+1. ready    | executor | Update CLI branding
+2. running  | executor | Update README references
+3. blocked  | verifier | Validate release archive
+
+Progress: 0/3 finished, 1 running, 1 blocked, 0 failed
+```
+
+Before a task runs, UR-Nexus checks that required files/resources exist and
+that assumptions are explicit. After a task runs, verification compares the
+executor's claims with evidence from workspace snapshots and observed command
+records. Strict verification rejects unsupported file-change and command claims;
+non-strict verification records them as warnings.
+Independent tasks can run through parallel logical workers, while tasks that
+depend on another task or target the same file are serialized.
+At the end of execution, `ur exec` reports task counts, finished/failed/blocked
+tasks, actual changed files, unreported changed files, verified commands,
+unverified command claims, verification failures, warnings, and remaining
+limitations. Command tracking is limited to commands surfaced by the task
+runner; provider-internal or detached activity is reported as unverified unless
+the executor exposes it as observed evidence. Use `--no-task-planning` to keep
+the legacy direct prompt execution path for a run.
+
+Planning defaults are safe and can be configured with:
+
+```json
+{
+  "taskPlanning": true,
+  "parallelAgents": true,
+  "maxAgents": 3,
+  "showTaskBoard": true,
+  "strictVerification": true
+}
+```
+
 ## Quick Start
 
 ### Requirements
 
 - Bun `>=1.3.0` (this repository pins `bun@1.3.14`). Bun is mandatory: every
   install path — npm, GitHub, or source checkout — runs the CLI through Bun,
-  not Node. UR-AGENT is not Node-native.
+  not Node. UR-Nexus is not Node-native.
 - Node.js `>=18.18` only to start the npm-installed launcher script
   (`bin/ur.js`), which immediately checks for Bun and re-execs into it. If Bun
   is missing, the launcher errors out instead of falling back to Node.
@@ -159,7 +209,7 @@ requests use that provider backend; they do not fall back to Ollama unless
 
 ### Legal Provider Auth
 
-UR-AGENT stores only safe provider preferences: provider name, model name,
+UR-Nexus stores only safe provider preferences: provider name, model name,
 base URL, fallback preference, and non-secret settings. API keys must stay in
 environment variables. API, local, and OpenAI-compatible server providers are
 UR-native runtimes and behave like Ollama: UR owns the conversation loop, tool
@@ -273,7 +323,7 @@ fallback: if dispatch fails, UR reports the selected provider, model, and runtim
 backend. Use `ur provider status` (or `ur provider doctor <id>`) to inspect the
 active provider, model, access type, and backend.
 
-Security policy: UR-AGENT never scrapes browser sessions, extracts OAuth
+Security policy: UR-Nexus never scrapes browser sessions, extracts OAuth
 tokens, bypasses subscription/quota/region/organization restrictions, proxies a
 consumer web session as an API, or claims support for a provider unless the
 official CLI/API path works. See [Provider Guide](docs/providers.md).
@@ -333,7 +383,7 @@ as first-class subcommands in the shipped CLI.
 | `ur acp` | Start/stop/status the Agent Communication Protocol server for IDE extensions. |
 | `ur exec` | Run one or more prompts in non-interactive mode with optional concurrency. |
 | `ur ide diff` | Capture editor-readable inline diff bundles. |
-| `ur a2a card` | Print UR-AGENT Card metadata for agent interoperability. |
+| `ur a2a card` | Print UR Card metadata for agent interoperability. |
 | `ur a2a serve` | Start an opt-in local A2A task server with bearer or delegation auth. |
 | `ur sdk` | Show programmatic headless usage and scaffold SDK examples. |
 | `ur trigger` | Parse a GitHub/Slack webhook payload and optionally launch a headless UR run. |
@@ -344,7 +394,7 @@ as first-class subcommands in the shipped CLI.
 | `ur agent-trends` | Show UR coverage for current agent technology trends. |
 | `ur agents` | List configured agents. |
 | `ur doctor` | Check the health of the UR installation and auto-updater. |
-| `ur update` | Check npm for UR-AGENT updates (`ur upgrade` is an alias). |
+| `ur update` | Check npm for UR-Nexus updates (`ur upgrade` is an alias). |
 
 ### Status Bar
 
@@ -361,7 +411,7 @@ Ollama | llama3 | ask | main
 The bar reflects the active in-session provider/model immediately after a
 `/model`, `/model <model>`, or `/provider` change — it does not wait for
 persisted settings to reload. If a custom status-line hook is configured,
-UR-AGENT uses that hook output instead of the built-in bar.
+UR-Nexus uses that hook output instead of the built-in bar.
 
 ### IDE Integration
 
@@ -369,7 +419,7 @@ The professional UR IDE integration is the **UR Inline Diffs** VS Code
 extension: a chat panel, inline diff review, an actions panel, an agent
 status card, a searchable command palette, and an agent options panel for VS
 Code, Cursor, and Windsurf. It is bundled inside this repository and
-packaged as a local VSIX when installed from UR-AGENT; the public install
+packaged as a local VSIX when installed from UR-Nexus; the public install
 path does not depend on an unpublished marketplace extension ID. The
 extension never talks to a model provider or network service directly —
 every AI request goes through your local `ur` CLI, same as in a terminal.
@@ -670,8 +720,8 @@ research, browser, image, video, MCP, memory, and agent-platform tasks.
 
 ## License
 
-UR-AGENT is released under the
-[UR-AGENT Non-Commercial Self-Responsibility License](LICENSE).
+UR-Nexus is released under the
+[UR-Nexus Non-Commercial Self-Responsibility License](LICENSE).
 
 Personal, educational, research, evaluation, and other non-commercial use is
 permitted. Commercial use requires prior written permission from Maitham

package/RELEASE.md

@@ -1,4 +1,4 @@
-# UR-AGENT release runbook
+# UR-Nexus release runbook
 
 Release target:
 
@@ -48,7 +48,7 @@ Before committing a release, verify the public docs match the current feature
 set and version:
 
 ```bash
-rg -n "Version [0-9]|expected: [0-9]|UR-AGENT v[0-9]" README.md docs documentation
+rg -n "Version [0-9]|expected: [0-9]|UR-Nexus v[0-9]" README.md docs documentation
 bun test test/docsCoverage.test.ts test/docsCommands.test.ts
 ```
 
@@ -76,7 +76,7 @@ Only after every check passes and the working tree is clean:
 
 ```bash
 git add .
-git commit -m "chore: polish UR-AGENT production release"
+git commit -m "chore: polish UR-Nexus production release"
 git push origin master
 npm publish
 ```

package/SECURITY.md

@@ -5,7 +5,7 @@ issue.
 
 ## Supported release
 
-Only the latest npm release of `ur-agent` is supported for security fixes.
+Only the latest npm release of `ur-nexus` is supported for security fixes.
 
 ## Handling secrets
 
@@ -17,6 +17,6 @@ release:
 bun run secrets:scan
 ```
 
-UR-AGENT can execute commands and load plugins. Treat plugins as trusted code,
+UR-Nexus can execute commands and load plugins. Treat plugins as trusted code,
 review MCP server configuration before enabling it, and use permission modes or
 sandboxes for risky workflows.

package/bin/ur.js

@@ -28,7 +28,7 @@ const version =
     ? packageMetadata.version
     : '0.0.0-dev'
 const packageName =
-  typeof packageMetadata.name === 'string' ? packageMetadata.name : 'ur-agent'
+  typeof packageMetadata.name === 'string' ? packageMetadata.name : 'ur-nexus'
 const issuesUrl =
   typeof packageMetadata.bugs?.url === 'string'
     ? packageMetadata.bugs.url
@@ -50,7 +50,7 @@ function printBunRuntimeError(detail) {
         : 'PATH'
   console.error(
     [
-      `UR-AGENT requires Bun ${requiredBun} at runtime because the published CLI bundle is built with --target bun.`,
+      `UR-Nexus requires Bun ${requiredBun} at runtime because the published CLI bundle is built with --target bun.`,
       `Could not execute "${attempted}" from ${source}.${detail ? ` ${detail}` : ''}`,
       'Install Bun from https://bun.sh, or set BUN_BIN to the absolute path of a Bun executable.',
     ].join('\n'),