ur-agent 1.48.0 → 1.50.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +48 -0
  2. package/dist/cli.js +796 -326
  3. package/docs/AGENT_FEATURES.md +13 -0
  4. package/docs/VALIDATION.md +1 -1
  5. package/documentation/index.html +1 -1
  6. package/extensions/jetbrains-ur/build.gradle.kts +1 -1
  7. package/extensions/vscode-ur-inline-diffs/package.json +1 -1
  8. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,53 @@
1
1
  # Changelog
2
2
 
3
+ ## 1.50.0
4
+
5
+ - Completed `/install-github-app` so `@ur <task>` works from GitHub. The
6
+ mention now triggers on issue comments, pull-request comments, inline review
7
+ comments, submitted reviews, and new issues; `/ur` remains accepted. Matching
8
+ is word-bounded and skips fenced code and quoted replies, so `@urgent`,
9
+ `me@ur.example`, and bots quoting an earlier comment no longer start runs.
10
+ - Fixed the installed workflow being inert: the installer wrote
11
+ `.github/workflows/ur.yml` but never committed `.ur/agentic-ci/default.yaml`,
12
+ so every run aborted with "Spec not found" before the agent started. Both
13
+ files now land in the same pull request.
14
+ - Added a trusted publisher so a mention produces visible feedback: an eyes
15
+ reaction and a tracking comment that is edited in place with the summary,
16
+ verification table, and proposed diff. The job that reads untrusted event
17
+ text still holds no write token — it emits the bounded hash-addressed patch
18
+ artifact, and a separate write-scoped job consumes only that artifact.
19
+ Agent-authored text reaches the publisher through `jq --rawfile`, never
20
+ through shell interpolation.
21
+ - Added opt-in `publish.mode: pull-request`, which applies the verified patch
22
+ and opens a PR. It is the only mode granting `contents: write`;
23
+ `publish.mode: artifact` restores the previous producer-only single job.
24
+ - Added the composite action at the repository root, so
25
+ `uses: Maitham16/UR@v1` resolves. `ur-review.yml` referenced it but no
26
+ `action.yml` existed, so that workflow failed immediately.
27
+ - Fixed the compiled workflow emitting an invalid folded scalar: continuation
28
+ lines of the job `if:` expression were indented below the block indent.
29
+ - Fixed the installer's secret rename only rewriting the composite-action input
30
+ form, which left the Agentic CI workflow pointing at a nonexistent
31
+ `secrets.UR_API_KEY` whenever a custom secret name was chosen.
32
+ - Restricted trigger keywords to a charset that cannot terminate a GitHub
33
+ workflow expression.
34
+
35
+ ## 1.49.0
36
+
37
+ - Added cryptographically signed A2A Agent Cards: RFC 7515 detached JWS over
38
+ the RFC 8785 canonical form of the card, using Ed25519 (`alg: "EdDSA"`).
39
+ Verification recomputes the payload with `signatures` excluded, so a card can
40
+ carry several independent signatures, and rejects algorithm substitution
41
+ rather than honoring a caller-supplied `alg`. Signing is opt-in through the
42
+ card builder's `signingKey`, so deployments without a provisioned key
43
+ continue serving byte-identical unsigned cards. Replaces the previous
44
+ `signatures: []` placeholder, which was typed so that it could never hold a
45
+ signature.
46
+ - Fixed `release:check` failing on a clean tree: `release-hygiene.mjs` forbids
47
+ `.claude/settings.local.json` in release archives, but the ignore policy did
48
+ not exclude it, so the untracked file entered the source archive candidate
49
+ through `git ls-files --others`.
50
+
3
51
  ## 1.48.0
4
52
 
5
53
  - Added managed cloud fan-out with durable, idempotent steering, owner-scoped