ur-agent 1.45.6 → 1.46.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 1.46.0
+
+- Added a stable, official-SDK ACP v1 stdio agent with resumable sessions,
+  client MCP transports and additional roots, streamed updates, native
+  permission requests, cancellation, and private persisted session identity.
+- Added an official-SDK A2A v0.3 JSON-RPC binding and hardened the separate UR
+  HTTP compatibility APIs with scoped authorization, strict media/schema
+  validation, bounded requests/responses/state, durable task identity, and
+  fail-closed permission handling.
+- Hardened OpenAI, Anthropic, and Gemini provider wire behavior, including
+  strict tool schemas, exact tool-call identity, Gemini thought signatures,
+  request correlation, bounded stdin secrets, and protocol regression tests.
+- Completed background-task management in the VS Code Actions panel and made
+  JetBrains prompt cancellation reach the running server task. Modernized and
+  verified both IDE extension builds against their supported platforms;
+  JetBrains bytecode no longer emits compatibility bridges to internal APIs.
+- Made background manifests cross-process safe, atomic, private, bounded, and
+  traversal-resistant; added bounded CLI/log handling and explicit isolated or
+  offline task-launch choices without implicit publishing or permission bypass.
+- Updated dependencies and supply-chain automation, pinned CI actions, added
+  multi-ecosystem Dependabot coverage, synchronized every release surface, and
+  expanded release, packaging, security, protocol, and integration checks.
+- Made source archives Git-ignore-aware, private-state-safe, and replacement-
+  safe; provider smoke tests now isolate their JSON reports instead of
+  rewriting the tracked diagnostic snapshot, and secret scanning covers new
+  non-ignored release files before they are committed.
+- Re-audited the agent roadmap against primary sources after the version bump;
+  corrected stale provider and dense-memory claims and recorded dated gaps for
+  A2A v1, ACP lifecycle methods, MCP Tasks/Apps, provider-native durable
+  inference, Agent Skills governance, GenAI telemetry, and memory integrity.
+
 ## 1.45.6
 
 - Deduplicated project verification approval so compile/test/lint commands are

package/QUALITY.md

@@ -15,6 +15,7 @@ bun test
 bun run bundle
 bun run smoke
 bun run secrets:scan
+bun run dependencies:audit
 bun run release:check
 bun run package:check
 npm publish --dry-run
@@ -30,8 +31,11 @@ sandbox posture, and secret exfiltration denial. `ur context-pack scan` records
 the repo architecture and manifest-derived command set; `ur context-pack
 compress` preserves task decisions, constraints, commands, and diffs.
 
-`bun run release:check` is also wired into `prepack`, so stale bundles and
-version drift fail before packaging. The GitHub workflow must keep production
+`bun run dependencies:audit` checks the committed `bun.lock`, including
+development dependencies that are compiled into `dist/cli.js`. `bun run
+release:check` repeats that audit and is also wired into `prepack`, so known
+dependency advisories, stale bundles, and version drift fail before packaging.
+The GitHub workflow must keep production
 bundle, release, package, and global-install checks after the Bun test step;
 do not tag or publish until that workflow is green.
 
@@ -80,7 +84,8 @@ Public feature releases should update the full documentation set:
 - Deep verification through the verification subagent is manual by default and
   can be enabled with `UR_VERIFIER_AUTO_SUBAGENT=1`.
 - Secrets must stay in environment variables, secure storage, or local ignored
-  settings files; tracked files are scanned by `bun run secrets:scan`.
+  settings files; tracked and untracked non-ignored release-candidate files are
+  scanned by `bun run secrets:scan`.
 
 ## Known Limits
 

package/README.md

@@ -402,14 +402,14 @@ as first-class subcommands in the shipped CLI.
 | `ur auth gemini` | Use the official Gemini CLI login flow where supported. |
 | `ur auth antigravity` | Use the official Antigravity CLI login flow where supported. |
 | `ur config set` | Persist safe non-secret provider settings such as provider, model, base URL, command path, and fallback. |
-| `ur mcp` | Configure and manage Model Context Protocol servers. |
+| `ur mcp` | Configure MCP servers or expose fail-closed, schema-validated built-in tools over stdio. |
 | `ur plugin` | Install, update, enable, disable, and validate UR plugins that can add MCP tools, skills, templates, validators, language adapters, LSP servers, agents, hooks, output styles, and commands. |
 | `ur role-mode` | Install built-in Architect, Code, Debug, and Ask role modes. |
-| `ur acp` | Start/stop/status the Agent Communication Protocol server for IDE extensions. |
+| `ur acp` | Run official-SDK ACP v1 over stdio, or manage the separate UR HTTP JSON-RPC server. |
 | `ur exec` | Run one or more prompts in non-interactive mode with optional concurrency. |
 | `ur ide diff` | Capture editor-readable inline diff bundles. |
-| `ur a2a card` | Print UR Card metadata for agent interoperability. |
-| `ur a2a serve` | Start an opt-in local A2A task server with bearer or delegation auth. |
+| `ur a2a card` | Print an A2A Agent Card preview. |
+| `ur a2a serve` | Start the opt-in official-SDK A2A v0.3 JSON-RPC binding and UR compatibility task API. |
 | `ur sdk` | Show programmatic headless usage and scaffold SDK examples. |
 | `ur trigger` | Parse a GitHub/Slack webhook payload and optionally launch a headless UR run. |
 | `ur agent-templates` | List or install reusable project agent templates. |
@@ -468,7 +468,7 @@ contract — see the [IDE Guide](docs/IDE.md) for the full feature list.
 Inspect and configure integration per editor:
 
 ```sh
-ur ide status               # workspace, ACP server, provider/model, sandbox/verifier mode, plugin count
+ur ide status               # workspace, UR HTTP server, provider/model, sandbox/verifier mode, plugin count
 ur ide doctor               # pass/warn/fail checks; reports missing config clearly
 ur ide config zed           # print the .zed/settings.json ACP block
 ur ide config vscode        # VS Code / Cursor / Windsurf setup
@@ -478,7 +478,7 @@ VS Code, Cursor, and Windsurf connect through the UR Inline Diffs extension;
 Zed and ACP-capable Neovim clients connect through the stdio Agent Client
 Protocol. The experimental bundled JetBrains plugin under
 `extensions/jetbrains-ur` uses project-scoped JSON-RPC sessions over the
-loopback HTTP ACP endpoint and is installable from its Gradle `buildPlugin`
+loopback UR HTTP compatibility endpoint and is installable from its Gradle `buildPlugin`
 zip. Start an ACP surface with:
 
 ```sh
@@ -496,7 +496,7 @@ commit, push, or create PRs unless explicitly requested:
 `/debug-v2`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`.
 Install matching agent templates with `ur agent-templates install`.
 
-New built-in tools (exposed through MCP and the ACP server): GitHub, API, Browser, Docker, TestRunner, Database. File-system and terminal tools are already built in (FileRead, FileEdit, FileWrite, Glob, Grep, Bash, PowerShell).
+New built-in tools (exposed through MCP and the UR HTTP compatibility API): GitHub, API, Browser, Docker, TestRunner, Database. File-system and terminal tools are already built in (FileRead, FileEdit, FileWrite, Glob, Grep, Bash, PowerShell).
 
 ### Plugin Marketplace
 
@@ -746,6 +746,7 @@ release until that GitHub run is green.
 - [Development Guide](docs/DEVELOPMENT.md)
 - [IDE Guide](docs/IDE.md)
 - [ACP Guide](docs/ACP.md)
+- [A2A Guide](docs/A2A.md)
 - [Plugin Guide](docs/plugins.md)
 - [Validation Runbook](docs/VALIDATION.md)
 - [Release Runbook](RELEASE.md)

package/RELEASE.md

@@ -11,11 +11,13 @@ Release target:
 Run from the repository root:
 
 ```bash
-bun install
+bun ci
+bun run dependencies:audit
 bun test
 bun run typecheck
 bun run lint
 bun run build
+bun run release:check
 node ./bin/ur.js --version
 node ./bin/ur.js --help
 node ./bin/ur.js upgrade
@@ -28,7 +30,7 @@ before release:
 
 ```bash
 bun run release:create-source-zip
-bun run release:check-source-zip -- artifacts/source/ur-agent-$(node -p "require('./package.json').version")-source.zip
+bun run release:check-source-zip -- artifacts/source/ur-nexus-$(node -p "require('./package.json').version")-source.zip
 ```
 
 The source zip must contain source inputs such as `package.json`, `bun.lock`,
@@ -52,14 +54,15 @@ rg -n "Version [0-9]|expected: [0-9]|UR-Nexus v[0-9]" README.md docs documentati
 bun test test/docsCoverage.test.ts test/docsCommands.test.ts
 ```
 
-Version bump checklist (all three must move together):
+Version bump checklist (all versioned release surfaces must move together):
 
 1. `package.json` `version`
 2. `bunfig.toml` `MACRO.VERSION`
 3. `documentation/index.html` version eyebrow
-4. `extensions/vscode-ur-inline-diffs/package.json` `version` (the VSIX test
-   requires it to match the root package version)
-5. Add a `CHANGELOG.md` entry, then run `bun run build` so `dist/cli.js`
+4. `extensions/vscode-ur-inline-diffs/package.json` and its lockfile version
+   fields (the VSIX test requires them to match the root package version)
+5. `extensions/jetbrains-ur/build.gradle.kts` `version`
+6. Add a `CHANGELOG.md` entry, then run `bun run build` so `dist/cli.js`
    embeds the new version (`bun run release:check` verifies all of this).
 
 If `npm whoami` fails, run: