ur-agent 1.45.6 → 1.47.0

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # Changelog
 
+## 1.47.0
+
+- Added a secure, opt-in AG-UI HTTP/SSE adapter with official schema/encoder
+  integration, truthful capability discovery, ordered text/tool/state events,
+  cancellation, exact CORS, bearer protection for network exposure, resource
+  limits, redacted errors, and explicit rejection of unsupported capabilities.
+- Added a dual-stack A2A server: the stable v0.3 SDK binding remains available,
+  while strict v1 ProtoJSON JSON-RPC and HTTP+JSON routes provide versioned
+  discovery, pagination, artifacts, cancellation, tenant isolation, durable
+  state, and compatibility coverage against the official A2A TCK.
+- Completed the ACP v1 stdio lifecycle with private durable history,
+  `session/list`, `session/load`, `session/delete`, bounded ordered replay,
+  session modes, configuration options, available-command updates, and
+  cancellation-safe concurrent transport behavior.
+- Added an opt-in MCP 2026-07-28 stateless HTTP adapter with strict request
+  metadata, negotiated Tasks and Apps extensions, owner-isolated durable tasks,
+  schema-referenced extension headers, cache/TTL discovery metadata, CORS,
+  bearer authentication, rate/concurrency limits, and corruption quarantine.
+- Added an opt-in OpenAI Responses transport while retaining Chat Completions
+  as the default. It supports multimodal/tool translation, structured output,
+  semantic SSE streaming, background create/poll/resume/cancel, WebSocket
+  continuation, server compaction, deferred tool search, and privacy-first
+  `store: false` state handling. No paid API calls are required by its tests.
+- Added explicit OpenTelemetry OTLP/console exporters and current GenAI
+  inference, agent, workflow, tool, memory, token, cache, latency,
+  time-to-first-chunk, inter-output-chunk latency, and error semantics. Export
+  and message-content capture remain disabled by default.
+- Added strict Agent Skills validation, deterministic permission/tree digests,
+  Ed25519 signing and trusted-key verification, invocation-time integrity
+  rechecks, `ur skill verify|sign|keygen` commands, and deterministic discovery
+  from the cross-client `.agents/skills/` project/user locations.
+- Upgraded project task memory to a tamper-evident provenance chain with atomic
+  private writes, cross-process locking, legacy anchoring, fail-closed reads,
+  verification, quarantine, and rollback commands.
+- Hardened all new durable stores with bounded input/state, symlink rejection,
+  private permissions, atomic replacement, corruption handling, and focused
+  concurrency/adversarial tests.
+
+## 1.46.0
+
+- Added a stable, official-SDK ACP v1 stdio agent with resumable sessions,
+  client MCP transports and additional roots, streamed updates, native
+  permission requests, cancellation, and private persisted session identity.
+- Added an official-SDK A2A v0.3 JSON-RPC binding and hardened the separate UR
+  HTTP compatibility APIs with scoped authorization, strict media/schema
+  validation, bounded requests/responses/state, durable task identity, and
+  fail-closed permission handling.
+- Hardened OpenAI, Anthropic, and Gemini provider wire behavior, including
+  strict tool schemas, exact tool-call identity, Gemini thought signatures,
+  request correlation, bounded stdin secrets, and protocol regression tests.
+- Completed background-task management in the VS Code Actions panel and made
+  JetBrains prompt cancellation reach the running server task. Modernized and
+  verified both IDE extension builds against their supported platforms;
+  JetBrains bytecode no longer emits compatibility bridges to internal APIs.
+- Made background manifests cross-process safe, atomic, private, bounded, and
+  traversal-resistant; added bounded CLI/log handling and explicit isolated or
+  offline task-launch choices without implicit publishing or permission bypass.
+- Updated dependencies and supply-chain automation, pinned CI actions, added
+  multi-ecosystem Dependabot coverage, synchronized every release surface, and
+  expanded release, packaging, security, protocol, and integration checks.
+- Made source archives Git-ignore-aware, private-state-safe, and replacement-
+  safe; provider smoke tests now isolate their JSON reports instead of
+  rewriting the tracked diagnostic snapshot, and secret scanning covers new
+  non-ignored release files before they are committed.
+- Re-audited the agent roadmap against primary sources after the version bump;
+  corrected stale provider and dense-memory claims and recorded dated gaps for
+  A2A v1, ACP lifecycle methods, MCP Tasks/Apps, provider-native durable
+  inference, Agent Skills governance, GenAI telemetry, and memory integrity.
+
 ## 1.45.6
 
 - Deduplicated project verification approval so compile/test/lint commands are

package/QUALITY.md

@@ -15,6 +15,7 @@ bun test
 bun run bundle
 bun run smoke
 bun run secrets:scan
+bun run dependencies:audit
 bun run release:check
 bun run package:check
 npm publish --dry-run
@@ -30,8 +31,11 @@ sandbox posture, and secret exfiltration denial. `ur context-pack scan` records
 the repo architecture and manifest-derived command set; `ur context-pack
 compress` preserves task decisions, constraints, commands, and diffs.
 
-`bun run release:check` is also wired into `prepack`, so stale bundles and
-version drift fail before packaging. The GitHub workflow must keep production
+`bun run dependencies:audit` checks the committed `bun.lock`, including
+development dependencies that are compiled into `dist/cli.js`. `bun run
+release:check` repeats that audit and is also wired into `prepack`, so known
+dependency advisories, stale bundles, and version drift fail before packaging.
+The GitHub workflow must keep production
 bundle, release, package, and global-install checks after the Bun test step;
 do not tag or publish until that workflow is green.
 
@@ -80,7 +84,8 @@ Public feature releases should update the full documentation set:
 - Deep verification through the verification subagent is manual by default and
   can be enabled with `UR_VERIFIER_AUTO_SUBAGENT=1`.
 - Secrets must stay in environment variables, secure storage, or local ignored
-  settings files; tracked files are scanned by `bun run secrets:scan`.
+  settings files; tracked and untracked non-ignored release-candidate files are
+  scanned by `bun run secrets:scan`.
 
 ## Known Limits
 

package/README.md

@@ -265,6 +265,24 @@ ur config set provider.fallback ollama
 guidance. UR never switches providers automatically: inspect the failure and
 select the recovery provider explicitly with `ur config set provider <id>`.
 
+OpenAI API traffic uses Chat Completions by default. The Responses transport is
+an explicit, provider-scoped opt-in with privacy-conscious defaults:
+
+```sh
+ur config set provider openai-api
+ur config set openai_transport responses
+ur config set responses.store false
+ur config set responses.compact_threshold 20000
+ur config set responses.tool_search hosted
+```
+
+The Responses adapter supports semantic SSE streaming, background
+create/retrieve/poll/cancel, WebSocket continuation, server compaction, and
+deferred tool discovery. `store` defaults to `false`; the durable local cursor
+store records identifiers and status only. Compacted context is persisted only
+when `UR_OPENAI_RESPONSES_STATE_KEY` contains a 32-byte encryption key. Return
+to the default with `ur config set openai_transport chat-completions`.
+
 Provider config accepts canonical IDs and common aliases. Examples:
 `openai-api`, `anthropic-api`, `gemini-api`, `openrouter`, `ollama`,
 `lmstudio`, `LM Studio`, `llama.cpp`, `vllm`, and the subscription CLIs
@@ -329,8 +347,9 @@ identity line in the system prompt reflects it too:
 
 - **API** providers call each service in its native wire format — Anthropic
   `x-api-key` + `anthropic-version` on `/v1/messages`, OpenAI `Bearer` on
-  `/v1/chat/completions`, Gemini `x-goog-api-key` on `:generateContent`,
-  OpenRouter on its OpenAI-compatible chat endpoint.
+  `/v1/chat/completions` by default or `/v1/responses` when explicitly
+  selected, Gemini `x-goog-api-key` on `:generateContent`, and OpenRouter on its
+  OpenAI-compatible chat endpoint.
 - **Local/server** providers call the configured endpoint (`/v1/chat/completions`
   for LM Studio/llama.cpp/vLLM; the native API for Ollama).
 - **Subscription CLIs** (Codex, Claude Code, Gemini, Antigravity) are external
@@ -369,7 +388,7 @@ as first-class subcommands in the shipped CLI.
 | `ur test-first` | Detect the project stack, run compile/test/lint commands, store failure traces, and install edit-time verify gates. |
 | `ur safety` | Inspect or initialize project shell safety policy and evaluate command risk before execution. |
 | `ur sandbox` | Inspect and manage the sandbox/permission architecture: status, dependency check, policy init, and command approval levels. |
-| `ur context-pack` | Write project architecture context, task memory, and compressed context under `.ur/`. Supports memory kinds `decision`, `constraint`, `command`, `diff`, `note`, `architecture`, `preference`, `attempt`, `accepted`, and `rejected`. |
+| `ur context-pack` | Write project architecture context, tamper-evident task memory, and compressed context under `.ur/`; verify, quarantine, or roll back the memory chain. |
 | `/hooks` | Inspect lifecycle hooks (`BeforeEdit`, `AfterEdit`, `BeforeCommand`, `AfterCommand`, `BeforeCommit`, `OnFailure`) configured via settings files. |
 | `ur bg` | Run and manage detached local background agents with optional worktrees and PR creation. |
 | `ur worktree` | List, inspect, and clean up UR agent worktrees. |
@@ -402,14 +421,16 @@ as first-class subcommands in the shipped CLI.
 | `ur auth gemini` | Use the official Gemini CLI login flow where supported. |
 | `ur auth antigravity` | Use the official Antigravity CLI login flow where supported. |
 | `ur config set` | Persist safe non-secret provider settings such as provider, model, base URL, command path, and fallback. |
-| `ur mcp` | Configure and manage Model Context Protocol servers. |
+| `ur mcp` | Configure MCP servers, expose fail-closed built-in tools over stdio, or run the opt-in stateless MCP 2026 HTTP adapter with Tasks and Apps. |
+| `ur skill` | Initialize, run, strictly verify, Ed25519-sign, and create trusted signing keys for portable skills. |
+| `ur ag-ui serve` | Start the secure AG-UI HTTP/SSE adapter for user-facing applications with truthful capability discovery. |
 | `ur plugin` | Install, update, enable, disable, and validate UR plugins that can add MCP tools, skills, templates, validators, language adapters, LSP servers, agents, hooks, output styles, and commands. |
 | `ur role-mode` | Install built-in Architect, Code, Debug, and Ask role modes. |
-| `ur acp` | Start/stop/status the Agent Communication Protocol server for IDE extensions. |
+| `ur acp` | Run official-SDK ACP v1 over stdio, or manage the separate UR HTTP JSON-RPC server. |
 | `ur exec` | Run one or more prompts in non-interactive mode with optional concurrency. |
 | `ur ide diff` | Capture editor-readable inline diff bundles. |
-| `ur a2a card` | Print UR Card metadata for agent interoperability. |
-| `ur a2a serve` | Start an opt-in local A2A task server with bearer or delegation auth. |
+| `ur a2a card` | Print the v0.3 Agent Card preview; the live server negotiates a separate strict v1 card. |
+| `ur a2a serve` | Start opt-in A2A v0.3 plus v1 JSON-RPC/HTTP+JSON bindings and the separate UR compatibility task API. |
 | `ur sdk` | Show programmatic headless usage and scaffold SDK examples. |
 | `ur trigger` | Parse a GitHub/Slack webhook payload and optionally launch a headless UR run. |
 | `ur agent-templates` | List or install reusable project agent templates. |
@@ -468,7 +489,7 @@ contract — see the [IDE Guide](docs/IDE.md) for the full feature list.
 Inspect and configure integration per editor:
 
 ```sh
-ur ide status               # workspace, ACP server, provider/model, sandbox/verifier mode, plugin count
+ur ide status               # workspace, UR HTTP server, provider/model, sandbox/verifier mode, plugin count
 ur ide doctor               # pass/warn/fail checks; reports missing config clearly
 ur ide config zed           # print the .zed/settings.json ACP block
 ur ide config vscode        # VS Code / Cursor / Windsurf setup
@@ -478,7 +499,7 @@ VS Code, Cursor, and Windsurf connect through the UR Inline Diffs extension;
 Zed and ACP-capable Neovim clients connect through the stdio Agent Client
 Protocol. The experimental bundled JetBrains plugin under
 `extensions/jetbrains-ur` uses project-scoped JSON-RPC sessions over the
-loopback HTTP ACP endpoint and is installable from its Gradle `buildPlugin`
+loopback UR HTTP compatibility endpoint and is installable from its Gradle `buildPlugin`
 zip. Start an ACP surface with:
 
 ```sh
@@ -496,7 +517,7 @@ commit, push, or create PRs unless explicitly requested:
 `/debug-v2`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`.
 Install matching agent templates with `ur agent-templates install`.
 
-New built-in tools (exposed through MCP and the ACP server): GitHub, API, Browser, Docker, TestRunner, Database. File-system and terminal tools are already built in (FileRead, FileEdit, FileWrite, Glob, Grep, Bash, PowerShell).
+New built-in tools (exposed through MCP and the UR HTTP compatibility API): GitHub, API, Browser, Docker, TestRunner, Database. File-system and terminal tools are already built in (FileRead, FileEdit, FileWrite, Glob, Grep, Bash, PowerShell).
 
 ### Plugin Marketplace
 
@@ -558,6 +579,9 @@ ur context-pack remember --preference "Use bun test over jest"
 ur context-pack remember --accepted "Use p-map for bounded concurrency" --scope project
 ur context-pack remember --rejected "Switch to esbuild" --alternative-to "Keep bun bundle"
 ur context-pack remember --attempt "Tried Deno runtime" --status superseded
+ur context-pack memory verify
+ur context-pack memory quarantine
+ur context-pack memory rollback --to <entry-id>
 ur context-pack compress
 ur ci-loop --command "bun test" --cwd . --max-attempts 3 --dry-run
 ur bg run "fix the flaky parser test" --worktree --dry-run
@@ -569,6 +593,10 @@ ur code-index repo build
 ur code-index repo search "rate limiter"
 ur skill init security-review
 ur skill run security-review "src/auth.ts"
+ur skill verify security-review --require-trusted
+ur skill keygen release --out ~/.ur/keys/release.pem
+ur skill sign security-review --key ~/.ur/keys/release.pem --key-id release
+UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-http --port 8976
 ur artifacts capture-tests --command "bun test"
 ur artifacts serve --port 4180
 ur agent-task pr --create --dry-run
@@ -585,14 +613,18 @@ UR reads repository instructions and local runtime state from project files:
 
 - `AGENTS.md` and `UR.md` provide shared project instructions.
 - `UR.local.md` is for private local instructions.
-- `.ur/skills/` stores project skills.
+- `.ur/skills/` stores native project skills; `.agents/skills/` is the
+  cross-client Agent Skills location. User equivalents live under `~/.ur/skills/`
+  and `~/.agents/skills/`, with deterministic project/native precedence.
 - `.ur/agents/` stores custom agents and role modes.
 - `.ur/safety-policy.json` configures project shell safety rules for read,
   write, execute, and network command classes.
 - `.ur/project-manifest.json` and `.ur/context/` hold architecture summaries,
   task memory, compressed context, and project memory including architecture
-  decisions, preferred commands, failed attempts, accepted patterns, and rejected
-  approaches.
+  decisions, preferred commands, failed attempts, accepted patterns, and
+  rejected approaches. Task-memory v2 entries include provenance and an
+  integrity chain; corrupt tails can be quarantined without discarding the
+  verified prefix.
 - `.ur/specs/`, `.ur/artifacts/`, `.ur/automations/`, `.ur/test-first/`,
   `.ur/memory/`, and `.ur/index/` hold workflow state, review artifacts,
   scheduled jobs, failure traces, memory, and indexes.
@@ -624,6 +656,26 @@ settings, generated indexes, memory, logs, and secrets out of Git.
 - `plugins/community/` stages contributed plugins.
 - `plugins/examples/` contains plugin templates users can copy.
 
+## OpenTelemetry
+
+Telemetry export is off unless an operator explicitly configures a signal:
+
+```sh
+OTEL_TRACES_EXPORTER=otlp \
+OTEL_METRICS_EXPORTER=otlp \
+OTEL_LOGS_EXPORTER=otlp \
+OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4318 \
+ur
+```
+
+UR emits bounded OpenTelemetry GenAI inference, agent, workflow, tool, and
+memory spans plus duration, token, streaming time-to-first-chunk, and
+inter-output-chunk latency metrics. Raw prompts, system instructions, tool
+arguments/results, and memory records are omitted by default; set
+`OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true` only inside an
+appropriately secured telemetry environment. `OTEL_SDK_DISABLED=true` is the
+global kill switch.
+
 ## Safety Model
 
 UR can read files, edit code, execute commands, and call configured tools, so
@@ -746,6 +798,8 @@ release until that GitHub run is green.
 - [Development Guide](docs/DEVELOPMENT.md)
 - [IDE Guide](docs/IDE.md)
 - [ACP Guide](docs/ACP.md)
+- [A2A Guide](docs/A2A.md)
+- [AG-UI Guide](docs/AG_UI.md)
 - [Plugin Guide](docs/plugins.md)
 - [Validation Runbook](docs/VALIDATION.md)
 - [Release Runbook](RELEASE.md)

package/RELEASE.md

@@ -11,11 +11,13 @@ Release target:
 Run from the repository root:
 
 ```bash
-bun install
+bun ci
+bun run dependencies:audit
 bun test
 bun run typecheck
 bun run lint
 bun run build
+bun run release:check
 node ./bin/ur.js --version
 node ./bin/ur.js --help
 node ./bin/ur.js upgrade
@@ -28,7 +30,7 @@ before release:
 
 ```bash
 bun run release:create-source-zip
-bun run release:check-source-zip -- artifacts/source/ur-agent-$(node -p "require('./package.json').version")-source.zip
+bun run release:check-source-zip -- artifacts/source/ur-nexus-$(node -p "require('./package.json').version")-source.zip
 ```
 
 The source zip must contain source inputs such as `package.json`, `bun.lock`,
@@ -52,14 +54,15 @@ rg -n "Version [0-9]|expected: [0-9]|UR-Nexus v[0-9]" README.md docs documentati
 bun test test/docsCoverage.test.ts test/docsCommands.test.ts
 ```
 
-Version bump checklist (all three must move together):
+Version bump checklist (all versioned release surfaces must move together):
 
 1. `package.json` `version`
 2. `bunfig.toml` `MACRO.VERSION`
 3. `documentation/index.html` version eyebrow
-4. `extensions/vscode-ur-inline-diffs/package.json` `version` (the VSIX test
-   requires it to match the root package version)
-5. Add a `CHANGELOG.md` entry, then run `bun run build` so `dist/cli.js`
+4. `extensions/vscode-ur-inline-diffs/package.json` and its lockfile version
+   fields (the VSIX test requires them to match the root package version)
+5. `extensions/jetbrains-ur/build.gradle.kts` `version`
+6. Add a `CHANGELOG.md` entry, then run `bun run build` so `dist/cli.js`
    embeds the new version (`bun run release:check` verifies all of this).
 
 If `npm whoami` fails, run: