ur-agent 1.41.0 → 1.42.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.42.0
+
+- Project safety policy no longer hard-blocks commands. Risky or deny-matched
+  commands (package installs, destructive git operations, secret access,
+  sandbox-required commands when the sandbox is unavailable) now surface as
+  approval prompts instead of `Blocked by project safety policy` errors; the
+  user decides. `ur safety`/`ur sandbox` evaluation output is unchanged.
+
+## 1.41.1
+
+- Harden provider tests against stored API keys in the local secure storage.
+- Revert sandbox default to disabled; expose `sandbox.enabled`,
+  `sandbox.failIfUnavailable`, and `sandbox.allowUnsandboxedCommands` through
+  the `/config` tool so users can toggle the sandbox on/off explicitly.
+
 ## 1.41.0
 
 - Persist the model chosen through the interactive `/model` picker to settings

package/dist/cli.js

@@ -71146,7 +71146,7 @@ var init_auth = __esm(() => {
 
 // src/utils/userAgent.ts
 function getURCodeUserAgent() {
-  return `ur/${"1.41.0"}`;
+  return `ur/${"1.42.0"}`;
 }
 
 // src/utils/workloadContext.ts
@@ -71168,7 +71168,7 @@ function getUserAgent() {
   const clientApp = process.env.UR_AGENT_SDK_CLIENT_APP ? `, client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}` : "";
   const workload = getWorkload();
   const workloadSuffix = workload ? `, workload/${workload}` : "";
-  return `ur-cli/${"1.41.0"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
+  return `ur-cli/${"1.42.0"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
 }
 function getMCPUserAgent() {
   const parts = [];
@@ -71182,7 +71182,7 @@ function getMCPUserAgent() {
     parts.push(`client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}`);
   }
   const suffix = parts.length > 0 ? ` (${parts.join(", ")})` : "";
-  return `ur/${"1.41.0"}${suffix}`;
+  return `ur/${"1.42.0"}${suffix}`;
 }
 function getWebFetchUserAgent() {
   return `UR-User (${getURCodeUserAgent()})`;
@@ -71320,7 +71320,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "1.41.0",
+      appVersion: "1.42.0",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -77837,7 +77837,7 @@ var init_metadata = __esm(() => {
   COMPOUND_OPERATOR_REGEX = /\s*(?:&&|\|\||[;|])\s*/;
   WHITESPACE_REGEX = /\s+/;
   getVersionBase = memoize_default(() => {
-    const match = "1.41.0".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "1.42.0".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -77877,7 +77877,7 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isURCodeAction: isEnvTruthy(process.env.UR_CODE_ACTION),
       isURAiAuth: isURAISubscriber(),
-      version: "1.41.0",
+      version: "1.42.0",
       versionBase: getVersionBase(),
       buildTime: "",
       deploymentEnvironment: env2.detectDeploymentEnvironment(),
@@ -78547,7 +78547,7 @@ function initialize1PEventLogging() {
   const platform2 = getPlatform();
   const attributes = {
     [import_semantic_conventions4.ATTR_SERVICE_NAME]: "ur",
-    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.41.0"
+    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.42.0"
   };
   if (platform2 === "wsl") {
     const wslVersion = getWslVersion();
@@ -78574,7 +78574,7 @@ function initialize1PEventLogging() {
       })
     ]
   });
-  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.41.0");
+  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.42.0");
 }
 async function reinitialize1PEventLoggingIfConfigChanged() {
   if (!is1PEventLoggingEnabled() || !firstPartyEventLoggerProvider) {
@@ -83873,7 +83873,7 @@ function formatAgentTrendReport(report = buildAgentTrendReport()) {
 function formatA2AAgentCard(options = {}, pretty = true) {
   return JSON.stringify(buildA2AAgentCard(options), null, pretty ? 2 : 0);
 }
-var urVersion = "1.41.0", coverage, priorityRoadmap;
+var urVersion = "1.42.0", coverage, priorityRoadmap;
 var init_trends = __esm(() => {
   coverage = [
     {
@@ -85868,7 +85868,7 @@ function getAttributionHeader(fingerprint) {
   if (!isAttributionHeaderEnabled()) {
     return "";
   }
-  const version2 = `${"1.41.0"}.${fingerprint}`;
+  const version2 = `${"1.42.0"}.${fingerprint}`;
   const entrypoint = process.env.UR_CODE_ENTRYPOINT ?? "unknown";
   const cch = "";
   const workload = getWorkload();
@@ -127181,10 +127181,10 @@ async function detectWorktreeMainRepoPath(cwd2) {
 function getSandboxEnabledSetting() {
   try {
     const settings = getSettings_DEPRECATED();
-    return settings?.sandbox?.enabled ?? true;
+    return settings?.sandbox?.enabled ?? false;
   } catch (error40) {
     logForDebugging(`Failed to get settings for sandbox check: ${error40}`);
-    return true;
+    return false;
   }
 }
 function isAutoAllowBashIfSandboxedEnabled() {
@@ -193771,7 +193771,7 @@ function getTelemetryAttributes() {
     attributes["session.id"] = sessionId;
   }
   if (shouldIncludeAttribute("OTEL_METRICS_INCLUDE_VERSION")) {
-    attributes["app.version"] = "1.41.0";
+    attributes["app.version"] = "1.42.0";
   }
   const oauthAccount = getOauthAccountInfo();
   if (oauthAccount) {
@@ -229157,7 +229157,7 @@ function getInstallationEnv() {
   return;
 }
 function getURCodeVersion() {
-  return "1.41.0";
+  return "1.42.0";
 }
 async function getInstalledVSCodeExtensionVersion(command) {
   const { stdout } = await execFileNoThrow(command, ["--list-extensions", "--show-versions"], {
@@ -231996,7 +231996,7 @@ async function setupSdkMcpClients(sdkMcpConfigs, sendMcpMessage) {
     const client2 = new Client({
       name: "ur",
       title: "UR",
-      version: "1.41.0",
+      version: "1.42.0",
       description: "UR-Nexus autonomous engineering workflow engine",
       websiteUrl: PRODUCT_URL
     }, {
@@ -232350,7 +232350,7 @@ var init_client5 = __esm(() => {
       const client2 = new Client({
         name: "ur",
         title: "UR",
-        version: "1.41.0",
+        version: "1.42.0",
         description: "UR-Nexus autonomous engineering workflow engine",
         websiteUrl: PRODUCT_URL
       }, {
@@ -242164,9 +242164,9 @@ async function assertMinVersion() {
   if (false) {}
   try {
     const versionConfig = await getDynamicConfig_BLOCKS_ON_INIT("tengu_version_config", { minVersion: "0.0.0" });
-    if (versionConfig.minVersion && lt("1.41.0", versionConfig.minVersion)) {
+    if (versionConfig.minVersion && lt("1.42.0", versionConfig.minVersion)) {
       console.error(`
-It looks like your version of UR (${"1.41.0"}) needs an update.
+It looks like your version of UR (${"1.42.0"}) needs an update.
 A newer version (${versionConfig.minVersion} or higher) is required to continue.
 
 To update, please run:
@@ -242382,7 +242382,7 @@ async function installGlobalPackage(specificVersion) {
     logError2(new AutoUpdaterError("Another process is currently installing an update"));
     logEvent("tengu_auto_updater_lock_contention", {
       pid: process.pid,
-      currentVersion: "1.41.0"
+      currentVersion: "1.42.0"
     });
     return "in_progress";
   }
@@ -242391,7 +242391,7 @@ async function installGlobalPackage(specificVersion) {
     if (!env2.isRunningWithBun() && env2.isNpmFromWindowsPath()) {
       logError2(new Error("Windows NPM detected in WSL environment"));
       logEvent("tengu_auto_updater_windows_npm_in_wsl", {
-        currentVersion: "1.41.0"
+        currentVersion: "1.42.0"
       });
       console.error(`
 Error: Windows NPM detected in WSL
@@ -242926,7 +242926,7 @@ function detectLinuxGlobPatternWarnings() {
 }
 async function getDoctorDiagnostic() {
   const installationType = await getCurrentInstallationType();
-  const version2 = typeof MACRO !== "undefined" ? "1.41.0" : "unknown";
+  const version2 = typeof MACRO !== "undefined" ? "1.42.0" : "unknown";
   const installationPath = await getInstallationPath();
   const invokedBinary = getInvokedBinary();
   const multipleInstallations = await detectMultipleInstallations();
@@ -243861,8 +243861,8 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
     const maxVersion = await getMaxVersion();
     if (maxVersion && gt(version2, maxVersion)) {
       logForDebugging(`Native installer: maxVersion ${maxVersion} is set, capping update from ${version2} to ${maxVersion}`);
-      if (gte("1.41.0", maxVersion)) {
-        logForDebugging(`Native installer: current version ${"1.41.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
+      if (gte("1.42.0", maxVersion)) {
+        logForDebugging(`Native installer: current version ${"1.42.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
         logEvent("tengu_native_update_skipped_max_version", {
           latency_ms: Date.now() - startTime,
           max_version: maxVersion,
@@ -243873,7 +243873,7 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
       version2 = maxVersion;
     }
   }
-  if (!forceReinstall && version2 === "1.41.0" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
+  if (!forceReinstall && version2 === "1.42.0" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
     logForDebugging(`Found ${version2} at ${executablePath}, skipping install`);
     logEvent("tengu_native_update_complete", {
       latency_ms: Date.now() - startTime,
@@ -301849,6 +301849,24 @@ var init_supportedSettings = __esm(() => {
       description: "Enable extended thinking (false to disable)",
       appStateKey: "thinkingEnabled"
     },
+    "sandbox.enabled": {
+      source: "settings",
+      type: "boolean",
+      description: "Enable the OS-level sandbox for Bash/File tool commands",
+      path: ["sandbox", "enabled"]
+    },
+    "sandbox.failIfUnavailable": {
+      source: "settings",
+      type: "boolean",
+      description: "Refuse to start when sandbox.enabled is true but the sandbox cannot start",
+      path: ["sandbox", "failIfUnavailable"]
+    },
+    "sandbox.allowUnsandboxedCommands": {
+      source: "settings",
+      type: "boolean",
+      description: "Allow commands to run unsandboxed when they explicitly request it",
+      path: ["sandbox", "allowUnsandboxedCommands"]
+    },
     "permissions.defaultMode": {
       source: "settings",
       type: "string",
@@ -311247,27 +311265,27 @@ async function bashToolHasPermission(input, context3, getCommandSubcommandPrefix
   if (safetyEvaluation.behavior === "deny") {
     const reason = safetyEvaluation.reasons.join("; ");
     recordShellSafetyViolation(safetyEvaluation, reason);
+    const decisionReason2 = {
+      type: "other",
+      reason: `Project safety policy requires approval: ${reason}`
+    };
     return {
-      behavior: "deny",
-      message: `Blocked by project safety policy: ${reason}`,
-      decisionReason: {
-        type: "other",
-        reason: `Project safety policy denied command: ${reason}`
-      }
+      behavior: "ask",
+      decisionReason: decisionReason2,
+      message: createPermissionRequestMessage2(BashTool.name, decisionReason2),
+      suggestions: []
     };
   }
   if (safetyEvaluation.sandboxMode === "required" && !shouldUseSandbox(input)) {
-    const reason = safetyEvaluation.reasons.join("; ");
-    const unavailableReason = SandboxManager2.getSandboxUnavailableReason() ?? "sandbox is disabled, unavailable, or bypassed for this command";
-    const message = `Blocked by project safety policy: sandbox is required but unavailable. ${unavailableReason}`;
-    recordShellSafetyViolation(safetyEvaluation, `${reason}; ${unavailableReason}`);
+    const decisionReason2 = {
+      type: "other",
+      reason: `Sandbox unavailable; approval required to run unsandboxed: ${safetyEvaluation.reasons.join("; ")}`
+    };
     return {
-      behavior: "deny",
-      message,
-      decisionReason: {
-        type: "other",
-        reason: `Project safety policy requires sandbox enforcement: ${reason}; ${unavailableReason}`
-      }
+      behavior: "ask",
+      decisionReason: decisionReason2,
+      message: createPermissionRequestMessage2(BashTool.name, decisionReason2),
+      suggestions: []
     };
   }
   if (safetyEvaluation.behavior === "ask") {
@@ -340826,7 +340844,7 @@ function Feedback({
       platform: env2.platform,
       gitRepo: envInfo.isGit,
       terminal: env2.terminal,
-      version: "1.41.0",
+      version: "1.42.0",
       transcript: normalizeMessagesForAPI(messages),
       errors: sanitizedErrors,
       lastApiRequest: getLastAPIRequest(),
@@ -341018,7 +341036,7 @@ function Feedback({
                       ", ",
                       env2.terminal,
                       ", v",
-                      "1.41.0"
+                      "1.42.0"
                     ]
                   }, undefined, true, undefined, this)
                 ]
@@ -341124,7 +341142,7 @@ ${sanitizedDescription}
 ` + `**Environment Info**
 ` + `- Platform: ${env2.platform}
 ` + `- Terminal: ${env2.terminal}
-` + `- Version: ${"1.41.0"}
+` + `- Version: ${"1.42.0"}
 ` + `- Feedback ID: ${feedbackId}
 ` + `
 **Errors**
@@ -344235,7 +344253,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "1.41.0"
+    value: "1.42.0"
   }, {
     label: "Session name",
     value: nameValue
@@ -347536,7 +347554,7 @@ function Config({
         }
       }, undefined, false, undefined, this)
     }, undefined, false, undefined, this) : showSubmenu === "ChannelDowngrade" ? /* @__PURE__ */ jsx_dev_runtime177.jsxDEV(ChannelDowngradeDialog, {
-      currentVersion: "1.41.0",
+      currentVersion: "1.42.0",
       onChoice: (choice) => {
         setShowSubmenu(null);
         setTabsHidden(false);
@@ -347548,7 +347566,7 @@ function Config({
           autoUpdatesChannel: "stable"
         };
         if (choice === "stay") {
-          newSettings.minimumVersion = "1.41.0";
+          newSettings.minimumVersion = "1.42.0";
         }
         updateSettingsForSource("userSettings", newSettings);
         setSettingsData((prev_27) => ({
@@ -355618,7 +355636,7 @@ function HelpV2(t0) {
   let t6;
   if ($3[31] !== tabs) {
     t6 = /* @__PURE__ */ jsx_dev_runtime204.jsxDEV(Tabs, {
-      title: `UR v${"1.41.0"}`,
+      title: `UR v${"1.42.0"}`,
       color: "professionalBlue",
       defaultTab: "general",
       children: tabs
@@ -356364,7 +356382,7 @@ function buildToolUseContext(tools, readFileStateCache) {
 async function handleInitialize(options2) {
   return {
     name: "UR",
-    version: "1.41.0",
+    version: "1.42.0",
     protocolVersion: "0.1.0",
     workspaceRoot: options2.cwd,
     capabilities: {
@@ -376506,7 +376524,7 @@ function getAllReleaseNotes(changelogContent = getStoredChangelogFromMemory()) {
     return [];
   }
 }
-async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.41.0") {
+async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.42.0") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -376533,7 +376551,7 @@ async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.41.0")
     releaseNotes
   };
 }
-function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.41.0") {
+function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.42.0") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -377712,7 +377730,7 @@ function getRecentActivitySync() {
   return cachedActivity;
 }
 function getLogoDisplayData() {
-  const version2 = process.env.DEMO_VERSION ?? "1.41.0";
+  const version2 = process.env.DEMO_VERSION ?? "1.42.0";
   const serverUrl = getDirectConnectServerUrl();
   const displayPath = process.env.DEMO_VERSION ? "/code/ur" : getDisplayPath(getCwd());
   const cwd2 = serverUrl ? `${displayPath} in ${serverUrl.replace(/^https?:\/\//, "")}` : displayPath;
@@ -378501,7 +378519,7 @@ function LogoV2() {
   if ($3[2] === Symbol.for("react.memo_cache_sentinel")) {
     t2 = () => {
       const currentConfig2 = getGlobalConfig();
-      if (currentConfig2.lastReleaseNotesSeen === "1.41.0") {
+      if (currentConfig2.lastReleaseNotesSeen === "1.42.0") {
         return;
       }
       saveGlobalConfig(_temp326);
@@ -379186,12 +379204,12 @@ function LogoV2() {
   return t41;
 }
 function _temp326(current) {
-  if (current.lastReleaseNotesSeen === "1.41.0") {
+  if (current.lastReleaseNotesSeen === "1.42.0") {
     return current;
   }
   return {
     ...current,
-    lastReleaseNotesSeen: "1.41.0"
+    lastReleaseNotesSeen: "1.42.0"
   };
 }
 function _temp243(s_0) {
@@ -410814,7 +410832,7 @@ var init_code_index2 = __esm(() => {
 
 // node_modules/typescript/lib/typescript.js
 var require_typescript2 = __commonJS((exports, module) => {
-  var __dirname = "/Users/maith/Desktop/ur3-dev/UR-1.41.0/node_modules/typescript/lib", __filename = "/Users/maith/Desktop/ur3-dev/UR-1.41.0/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/sessions/friendly-inspiring-goldberg/mnt/UR-1.41.1/node_modules/typescript/lib", __filename = "/sessions/friendly-inspiring-goldberg/mnt/UR-1.41.1/node_modules/typescript/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -596348,7 +596366,7 @@ async function captureMemoryDiagnostics(trigger2, dumpNumber = 0) {
     smapsRollup,
     platform: process.platform,
     nodeVersion: process.version,
-    ccVersion: "1.41.0"
+    ccVersion: "1.42.0"
   };
 }
 async function performHeapDump(trigger2 = "manual", dumpNumber = 0) {
@@ -596934,7 +596952,7 @@ var init_bridge_kick = __esm(() => {
 var call137 = async () => {
   return {
     type: "text",
-    value: "1.41.0"
+    value: "1.42.0"
   };
 }, version2, version_default;
 var init_version = __esm(() => {
@@ -607027,7 +607045,7 @@ function generateHtmlReport(data, insights) {
 </html>`;
 }
 function buildExportData(data, insights, facets, remoteStats) {
-  const version3 = typeof MACRO !== "undefined" ? "1.41.0" : "unknown";
+  const version3 = typeof MACRO !== "undefined" ? "1.42.0" : "unknown";
   const remote_hosts_collected = remoteStats?.hosts.filter((h2) => h2.sessionCount > 0).map((h2) => h2.name);
   const facets_summary = {
     total: facets.size,
@@ -611307,7 +611325,7 @@ var init_sessionStorage = __esm(() => {
   init_settings2();
   init_slowOperations();
   init_uuid();
-  VERSION5 = typeof MACRO !== "undefined" ? "1.41.0" : "unknown";
+  VERSION5 = typeof MACRO !== "undefined" ? "1.42.0" : "unknown";
   MAX_TOMBSTONE_REWRITE_BYTES = 50 * 1024 * 1024;
   SKIP_FIRST_PROMPT_PATTERN = /^(?:\s*<[a-z][\w-]*[\s>]|\[Request interrupted by user[^\]]*\])/;
   EPHEMERAL_PROGRESS_TYPES = new Set([
@@ -612512,7 +612530,7 @@ var init_filesystem = __esm(() => {
   });
   getBundledSkillsRoot = memoize_default(function getBundledSkillsRoot2() {
     const nonce = randomBytes18(16).toString("hex");
-    return join202(getURTempDir(), "bundled-skills", "1.41.0", nonce);
+    return join202(getURTempDir(), "bundled-skills", "1.42.0", nonce);
   });
   getResolvedWorkingDirPaths = memoize_default(getPathsForPermissionCheck);
 });
@@ -618801,7 +618819,7 @@ function computeFingerprint(messageText2, version3) {
 }
 function computeFingerprintFromMessages(messages) {
   const firstMessageText = extractFirstMessageText(messages);
-  return computeFingerprint(firstMessageText, "1.41.0");
+  return computeFingerprint(firstMessageText, "1.42.0");
 }
 var FINGERPRINT_SALT = "59cf53e54c78";
 var init_fingerprint = () => {};
@@ -620675,7 +620693,7 @@ async function sideQuery(opts) {
     betas.push(STRUCTURED_OUTPUTS_BETA_HEADER);
   }
   const messageText2 = extractFirstUserMessageText(messages);
-  const fingerprint2 = computeFingerprint(messageText2, "1.41.0");
+  const fingerprint2 = computeFingerprint(messageText2, "1.42.0");
   const attributionHeader = getAttributionHeader(fingerprint2);
   const systemBlocks = [
     attributionHeader ? { type: "text", text: attributionHeader } : null,
@@ -625412,7 +625430,7 @@ function buildSystemInitMessage(inputs) {
     slash_commands: inputs.commands.filter((c4) => c4.userInvocable !== false).map((c4) => c4.name),
     apiKeySource: getURHQApiKeyWithSource().source,
     betas: getSdkBetas(),
-    ur_version: "1.41.0",
+    ur_version: "1.42.0",
     output_style: outputStyle2,
     agents: inputs.agents.map((agent) => agent.agentType),
     skills: inputs.skills.filter((s) => s.userInvocable !== false).map((skill2) => skill2.name),
@@ -640040,7 +640058,7 @@ var init_useVoiceEnabled = __esm(() => {
 function getSemverPart(version3) {
   return `${import_semver13.major(version3, { loose: true })}.${import_semver13.minor(version3, { loose: true })}.${import_semver13.patch(version3, { loose: true })}`;
 }
-function useUpdateNotification(updatedVersion, initialVersion = "1.41.0") {
+function useUpdateNotification(updatedVersion, initialVersion = "1.42.0") {
   const [lastNotifiedSemver, setLastNotifiedSemver] = import_react226.useState(() => getSemverPart(initialVersion));
   if (!updatedVersion) {
     return null;
@@ -640089,7 +640107,7 @@ function AutoUpdater({
       return;
     }
     if (false) {}
-    const currentVersion = "1.41.0";
+    const currentVersion = "1.42.0";
     const channel = getInitialSettings()?.autoUpdatesChannel ?? "latest";
     let latestVersion = await getLatestVersion(channel);
     const isDisabled = isAutoUpdaterDisabled();
@@ -640318,12 +640336,12 @@ function NativeAutoUpdater({
     logEvent("tengu_native_auto_updater_start", {});
     try {
       const maxVersion = await getMaxVersion();
-      if (maxVersion && gt("1.41.0", maxVersion)) {
+      if (maxVersion && gt("1.42.0", maxVersion)) {
         const msg = await getMaxVersionMessage();
         setMaxVersionIssue(msg ?? "affects your version");
       }
       const result = await installLatest(channel);
-      const currentVersion = "1.41.0";
+      const currentVersion = "1.42.0";
       const latencyMs = Date.now() - startTime;
       if (result.lockFailed) {
         logEvent("tengu_native_auto_updater_lock_contention", {
@@ -640460,17 +640478,17 @@ function PackageManagerAutoUpdater(t0) {
       const maxVersion = await getMaxVersion();
       if (maxVersion && latest && gt(latest, maxVersion)) {
         logForDebugging(`PackageManagerAutoUpdater: maxVersion ${maxVersion} is set, capping update from ${latest} to ${maxVersion}`);
-        if (gte("1.41.0", maxVersion)) {
-          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.41.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
+        if (gte("1.42.0", maxVersion)) {
+          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.42.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
           setUpdateAvailable(false);
           return;
         }
         latest = maxVersion;
       }
-      const hasUpdate = latest && !gte("1.41.0", latest) && !shouldSkipVersion(latest);
+      const hasUpdate = latest && !gte("1.42.0", latest) && !shouldSkipVersion(latest);
       setUpdateAvailable(!!hasUpdate);
       if (hasUpdate) {
-        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.41.0"} -> ${latest}`);
+        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.42.0"} -> ${latest}`);
       }
     };
     $3[0] = t1;
@@ -640504,7 +640522,7 @@ function PackageManagerAutoUpdater(t0) {
       wrap: "truncate",
       children: [
         "currentVersion: ",
-        "1.41.0"
+        "1.42.0"
       ]
     }, undefined, true, undefined, this);
     $3[3] = verbose;
@@ -652956,7 +652974,7 @@ function buildStatusLineCommandInput(permissionMode, exceeds200kTokens, settings
       project_dir: getOriginalCwd(),
       added_dirs: addedDirs
     },
-    version: "1.41.0",
+    version: "1.42.0",
     output_style: {
       name: outputStyleName
     },
@@ -653039,7 +653057,7 @@ function StatusLineInner({
   const taskValues = Object.values(tasks2);
   const taskRunningCount = taskValues.filter((task2) => task2.status === "running" || task2.status === "pending").length;
   const defaultStatusLineText = buildDefaultStatusBar({
-    version: "1.41.0",
+    version: "1.42.0",
     providerLabel: providerRuntime.providerLabel,
     authMode: providerRuntime.authLabel,
     model: providerRuntime.model ?? renderModelName(mainLoopModel),
@@ -664527,7 +664545,7 @@ async function submitTranscriptShare(messages, trigger2, appearanceId) {
     } catch {}
     const data = {
       trigger: trigger2,
-      version: "1.41.0",
+      version: "1.42.0",
       platform: process.platform,
       transcript,
       subagentTranscripts: Object.keys(subagentTranscripts).length > 0 ? subagentTranscripts : undefined,
@@ -676412,7 +676430,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "1.41.0"
+              "1.42.0"
             ]
           }, undefined, true, undefined, this)
         ]
@@ -677672,7 +677690,7 @@ function completeOnboarding() {
   saveGlobalConfig((current) => ({
     ...current,
     hasCompletedOnboarding: true,
-    lastOnboardingVersion: "1.41.0"
+    lastOnboardingVersion: "1.42.0"
   }));
 }
 function showDialog(root2, renderer) {
@@ -682709,7 +682727,7 @@ function appendToLog(path24, message) {
     cwd: getFsImplementation().cwd(),
     userType: process.env.USER_TYPE,
     sessionId: getSessionId(),
-    version: "1.41.0"
+    version: "1.42.0"
   };
   getLogWriter(path24).write(messageWithTimestamp);
 }
@@ -686803,8 +686821,8 @@ async function getEnvLessBridgeConfig() {
 }
 async function checkEnvLessBridgeMinVersion() {
   const cfg = await getEnvLessBridgeConfig();
-  if (cfg.min_version && lt("1.41.0", cfg.min_version)) {
-    return `Your version of UR (${"1.41.0"}) is too old for Remote Control.
+  if (cfg.min_version && lt("1.42.0", cfg.min_version)) {
+    return `Your version of UR (${"1.42.0"}) is too old for Remote Control.
 Version ${cfg.min_version} or higher is required. Run \`ur update\` to update.`;
   }
   return null;
@@ -687278,7 +687296,7 @@ async function initBridgeCore(params) {
   const rawApi = createBridgeApiClient({
     baseUrl,
     getAccessToken,
-    runnerVersion: "1.41.0",
+    runnerVersion: "1.42.0",
     onDebug: logForDebugging,
     onAuth401,
     getTrustedDeviceToken
@@ -692960,7 +692978,7 @@ async function startMCPServer(cwd3, debug2, verbose) {
   setCwd(cwd3);
   const server2 = new Server({
     name: "ur/tengu",
-    version: "1.41.0"
+    version: "1.42.0"
   }, {
     capabilities: {
       tools: {}
@@ -695002,7 +695020,7 @@ async function update() {
   logEvent("tengu_update_check", {});
   const diagnostic = await getDoctorDiagnostic();
   const result = await checkUpgradeStatus({
-    currentVersion: "1.41.0",
+    currentVersion: "1.42.0",
     packageName: UR_AGENT_PACKAGE_NAME,
     installationType: diagnostic.installationType,
     latestVersion: () => getLatestNpmPackageVersion(UR_AGENT_PACKAGE_NAME)
@@ -696248,7 +696266,7 @@ ${customInstructions}` : customInstructions;
       }
     }
     logForDiagnosticsNoPII("info", "started", {
-      version: "1.41.0",
+      version: "1.42.0",
       is_native_binary: isInBundledMode()
     });
     registerCleanup(async () => {
@@ -697034,7 +697052,7 @@ Usage: ur --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("1.41.0 (UR-Nexus)", "-v, --version", "Output the version number");
+  }).version("1.42.0 (UR-Nexus)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -697949,7 +697967,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"1.41.0"} (UR-Nexus)`);
+    console.log(`${"1.42.0"} (UR-Nexus)`);
     return;
   }
   if (args[0] === "a2a" && args[1] === "serve" && !args.includes("--help") && !args.includes("-h")) {

package/docs/CONFIGURATION.md

@@ -365,6 +365,15 @@ Sandbox behavior has three modes, controlled by `sandbox.enabled` and
   UR fails closed: it refuses to start rather than run without a working
   sandbox.
 
+To turn the sandbox on or off, use the `/config` tool or run:
+
+```sh
+ur config set sandbox.enabled true
+ur config set sandbox.enabled false
+```
+
+You can also inspect the current state with `ur sandbox status`.
+
 OS confinement depends on platform support: `sandbox-exec` (Seatbelt) on
 macOS, or `bwrap` (bubblewrap) on Linux/WSL2. `ur sandbox check` reports
 missing dependencies for the current platform.

package/documentation/index.html

@@ -44,7 +44,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.41.0</p>
+          <p class="eyebrow">Version 1.42.0</p>
           <h1>UR-Nexus Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-Nexus.</p>
         </div>

package/extensions/vscode-ur-inline-diffs/package.json

@@ -2,7 +2,7 @@
   "name": "ur-inline-diffs",
   "displayName": "UR Inline Diffs",
   "description": "Review, apply, and reject UR inline diff bundles from .ur/ide/diffs inside VS Code.",
-  "version": "1.41.0",
+  "version": "1.42.0",
   "publisher": "ur-nexus",
   "engines": {
     "vscode": "^1.92.0"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ur-agent",
-  "version": "1.41.0",
-  "description": "UR-Nexus — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
+  "version": "1.42.0",
+  "description": "UR-Nexus \u2014 autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",
   "engines": {