ur-agent 1.48.0 → 1.50.0

package/dist/cli.js

@@ -75079,7 +75079,7 @@ var init_auth = __esm(() => {
 
 // src/utils/userAgent.ts
 function getURCodeUserAgent() {
-  return `ur/${"1.48.0"}`;
+  return `ur/${"1.50.0"}`;
 }
 
 // src/utils/workloadContext.ts
@@ -75101,7 +75101,7 @@ function getUserAgent() {
   const clientApp = process.env.UR_AGENT_SDK_CLIENT_APP ? `, client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}` : "";
   const workload = getWorkload();
   const workloadSuffix = workload ? `, workload/${workload}` : "";
-  return `ur-cli/${"1.48.0"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
+  return `ur-cli/${"1.50.0"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
 }
 function getMCPUserAgent() {
   const parts = [];
@@ -75115,7 +75115,7 @@ function getMCPUserAgent() {
     parts.push(`client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}`);
   }
   const suffix = parts.length > 0 ? ` (${parts.join(", ")})` : "";
-  return `ur/${"1.48.0"}${suffix}`;
+  return `ur/${"1.50.0"}${suffix}`;
 }
 function getWebFetchUserAgent() {
   return `UR-User (${getURCodeUserAgent()})`;
@@ -75253,7 +75253,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "1.48.0",
+      appVersion: "1.50.0",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -83453,7 +83453,7 @@ var init_metadata = __esm(() => {
   COMPOUND_OPERATOR_REGEX = /\s*(?:&&|\|\||[;|])\s*/;
   WHITESPACE_REGEX = /\s+/;
   getVersionBase = memoize_default(() => {
-    const match = "1.48.0".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "1.50.0".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -83493,7 +83493,7 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isURCodeAction: isEnvTruthy(process.env.UR_CODE_ACTION),
       isURAiAuth: isURAISubscriber(),
-      version: "1.48.0",
+      version: "1.50.0",
       versionBase: getVersionBase(),
       buildTime: "",
       deploymentEnvironment: env2.detectDeploymentEnvironment(),
@@ -84163,7 +84163,7 @@ function initialize1PEventLogging() {
   const platform2 = getPlatform();
   const attributes = {
     [import_semantic_conventions4.ATTR_SERVICE_NAME]: "ur",
-    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.48.0"
+    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.50.0"
   };
   if (platform2 === "wsl") {
     const wslVersion = getWslVersion();
@@ -84191,7 +84191,7 @@ function initialize1PEventLogging() {
       })
     ]
   });
-  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.48.0");
+  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.50.0");
 }
 async function reinitialize1PEventLoggingIfConfigChanged() {
   if (!is1PEventLoggingEnabled() || !firstPartyEventLoggerProvider) {
@@ -93709,6 +93709,62 @@ var init_a2aV1 = __esm(() => {
   };
 });
 
+// src/services/agents/a2aCardSignature.ts
+import {
+  createHash as createHash8,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  sign as cryptoSign,
+  verify as cryptoVerify
+} from "crypto";
+function base64url3(value) {
+  return (typeof value === "string" ? Buffer.from(value, "utf8") : value).toString("base64url");
+}
+function canonicalizeJson(value) {
+  if (value === null)
+    return "null";
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error("cannot canonicalize a non-finite number");
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string")
+    return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => canonicalizeJson(entry === undefined ? null : entry)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const source = value;
+    const keys2 = Object.keys(source).filter((key) => source[key] !== undefined).sort();
+    const members = keys2.map((key) => `${JSON.stringify(key)}:${canonicalizeJson(source[key])}`);
+    return `{${members.join(",")}}`;
+  }
+  throw new Error(`cannot canonicalize value of type ${typeof value}`);
+}
+function signingPayload(card) {
+  const { signatures: _signatures, ...rest } = card;
+  return base64url3(canonicalizeJson(rest));
+}
+function signAgentCard(card, key) {
+  const privateKey = createPrivateKey(key.privateKeyPem);
+  if (privateKey.asymmetricKeyType !== "ed25519") {
+    throw new Error("Agent Card signing requires an Ed25519 private key");
+  }
+  const header = { alg: A2A_CARD_SIGNATURE_ALG };
+  if (key.kid)
+    header.kid = key.kid;
+  const protectedHeader = base64url3(canonicalizeJson(header));
+  const signingInput = `${protectedHeader}.${signingPayload(card)}`;
+  const signature = cryptoSign(null, Buffer.from(signingInput, "utf8"), privateKey);
+  return { protected: protectedHeader, signature: signature.toString("base64url") };
+}
+var A2A_CARD_SIGNATURE_ALG = "EdDSA";
+var init_a2aCardSignature = () => {};
+
 // src/services/agents/trends.ts
 var exports_trends = {};
 __export(exports_trends, {
@@ -93853,7 +93909,7 @@ function buildA2AV1AgentCard(options = {}) {
     securityRequirements.push({ schemes: { delegation: [] } });
   }
   const legacy = buildA2AAgentCard(options);
-  return {
+  const card = {
     name: legacy.name,
     description: legacy.description,
     supportedInterfaces: [
@@ -93904,6 +93960,9 @@ function buildA2AV1AgentCard(options = {}) {
     })),
     signatures: []
   };
+  if (!options.signingKey)
+    return card;
+  return { ...card, signatures: [signAgentCard(card, options.signingKey)] };
 }
 function buildAgentTrendReport(options = {}) {
   return {
@@ -93948,8 +94007,9 @@ function formatAgentTrendReport(report = buildAgentTrendReport()) {
 function formatA2AAgentCard(options = {}, pretty = true) {
   return JSON.stringify(buildA2AAgentCard(options), null, pretty ? 2 : 0);
 }
-var urVersion = "1.48.0", researchSnapshotDate = "2026-07-15", coverage, priorityRoadmap;
+var urVersion = "1.50.0", researchSnapshotDate = "2026-07-15", coverage, priorityRoadmap;
 var init_trends = __esm(() => {
+  init_a2aCardSignature();
   coverage = [
     {
       id: "local-runtime",
@@ -94357,7 +94417,7 @@ __export(exports_a2aServer, {
   handleA2ARequest: () => handleA2ARequest,
   authorizeRequest: () => authorizeRequest
 });
-import { createHash as createHash8, randomUUID as randomUUID18 } from "crypto";
+import { createHash as createHash9, randomUUID as randomUUID18 } from "crypto";
 import {
   existsSync as existsSync12,
   mkdirSync as mkdirSync11,
@@ -94420,7 +94480,7 @@ function a2aV1RestResponse(status, body) {
 }
 function agentCardResponse(card, version2, request) {
   const payload = JSON.stringify(card, null, 2);
-  const etag = `"${createHash8("sha256").update(payload).digest("base64url")}"`;
+  const etag = `"${createHash9("sha256").update(payload).digest("base64url")}"`;
   const notModified = request?.headers.get("if-none-match") === etag;
   return new Response(notModified ? null : payload, {
     status: notModified ? 304 : 200,
@@ -96464,7 +96524,7 @@ var init_config2 = __esm(() => {
 });
 
 // src/services/analytics/datadog.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function camelToSnakeCase(str) {
   return str.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
 }
@@ -96672,7 +96732,7 @@ var init_datadog = __esm(() => {
   });
   getUserBucket = memoize_default(() => {
     const userId = getOrCreateUserID();
-    const hash2 = createHash9("sha256").update(userId).digest("hex");
+    const hash2 = createHash10("sha256").update(userId).digest("hex");
     return parseInt(hash2.slice(0, 8), 16) % NUM_USER_BUCKETS;
   });
 });
@@ -96748,7 +96808,7 @@ function getAttributionHeader(fingerprint) {
   if (!isAttributionHeaderEnabled()) {
     return "";
   }
-  const version2 = `${"1.48.0"}.${fingerprint}`;
+  const version2 = `${"1.50.0"}.${fingerprint}`;
   const entrypoint = process.env.UR_CODE_ENTRYPOINT ?? "unknown";
   const cch = "";
   const workload = getWorkload();
@@ -143035,7 +143095,7 @@ var init_systemDirectories = __esm(() => {
 });
 
 // src/utils/plugins/mcpbHandler.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { chmod, writeFile as writeFile4 } from "fs/promises";
 import { dirname as dirname25, join as join46 } from "path";
 function manifestAuthorName(manifest) {
@@ -143055,13 +143115,13 @@ function isUrl2(source) {
   return source.startsWith("http://") || source.startsWith("https://");
 }
 function generateContentHash(data) {
-  return createHash10("sha256").update(data).digest("hex").substring(0, 16);
+  return createHash11("sha256").update(data).digest("hex").substring(0, 16);
 }
 function getMcpbCacheDir(pluginPath) {
   return join46(pluginPath, ".mcpb-cache");
 }
 function getMetadataPath(cacheDir, source) {
-  const sourceHash = createHash10("md5").update(source).digest("hex").substring(0, 8);
+  const sourceHash = createHash11("md5").update(source).digest("hex").substring(0, 8);
   return join46(cacheDir, `${sourceHash}.metadata.json`);
 }
 function serverSecretsKey(pluginId, serverName) {
@@ -143409,7 +143469,7 @@ async function loadMcpbFile(source, pluginPath, pluginId, onProgress, providedUs
   let mcpbData;
   let mcpbFilePath;
   if (isUrl2(source)) {
-    const sourceHash = createHash10("md5").update(source).digest("hex").substring(0, 8);
+    const sourceHash = createHash11("md5").update(source).digest("hex").substring(0, 8);
     mcpbFilePath = join46(cacheDir, `${sourceHash}.mcpb`);
     mcpbData = await downloadMcpb(source, mcpbFilePath, onProgress);
   } else {
@@ -154433,7 +154493,7 @@ var init_projectSafety = __esm(() => {
 function getInstruments() {
   if (instruments)
     return instruments;
-  const meter = import_api10.metrics.getMeter("ur-agent.gen_ai", "1.48.0");
+  const meter = import_api10.metrics.getMeter("ur-agent.gen_ai", "1.50.0");
   instruments = {
     operationDuration: meter.createHistogram("gen_ai.client.operation.duration", {
       description: "GenAI operation duration.",
@@ -154531,7 +154591,7 @@ function genAiAgentAttributes() {
     "gen_ai.operation.name": GEN_AI_OPERATION_INVOKE_AGENT,
     "gen_ai.provider.name": "ur",
     "gen_ai.agent.name": "UR-Nexus",
-    "gen_ai.agent.version": "1.48.0"
+    "gen_ai.agent.version": "1.50.0"
   };
 }
 function genAiWorkflowAttributes(workflowName) {
@@ -154547,7 +154607,7 @@ function genAiWorkflowAttributes(workflowName) {
 function startGenAiWorkflowSpan(workflowName) {
   const attributes = genAiWorkflowAttributes(workflowName);
   const name = typeof attributes["gen_ai.workflow.name"] === "string" ? `invoke_workflow ${attributes["gen_ai.workflow.name"]}` : GEN_AI_OPERATION_INVOKE_WORKFLOW;
-  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.48.0").startSpan(name, { kind: import_api10.SpanKind.INTERNAL, attributes });
+  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.50.0").startSpan(name, { kind: import_api10.SpanKind.INTERNAL, attributes });
 }
 function endGenAiWorkflowSpan(span, options2 = {}) {
   try {
@@ -154585,7 +154645,7 @@ function startGenAiMemorySpan(operation, options2 = {}) {
   if (options2.recordCount !== undefined && Number.isInteger(options2.recordCount) && options2.recordCount >= 0) {
     attributes["gen_ai.memory.record.count"] = options2.recordCount;
   }
-  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.48.0").startSpan(operation, { kind: import_api10.SpanKind.INTERNAL, attributes });
+  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.50.0").startSpan(operation, { kind: import_api10.SpanKind.INTERNAL, attributes });
 }
 function endGenAiMemorySpan(span, options2 = {}) {
   try {
@@ -154701,7 +154761,7 @@ var init_genAiSemantics = __esm(() => {
 });
 
 // src/services/context/memoryCitations.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import {
   existsSync as existsSync19,
   lstatSync as lstatSync6,
@@ -154710,7 +154770,7 @@ import {
 } from "fs";
 import { relative as relative10, resolve as resolve23 } from "path";
 function digest(value) {
-  return `sha256:${createHash11("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash12("sha256").update(value).digest("hex")}`;
 }
 function validDate3(value) {
   return typeof value === "string" && Number.isFinite(Date.parse(value));
@@ -155023,7 +155083,7 @@ import {
   writeSync as writeSync4,
   writeFileSync as writeFileSync14
 } from "fs";
-import { createHash as createHash12, randomUUID as randomUUID19 } from "crypto";
+import { createHash as createHash13, randomUUID as randomUUID19 } from "crypto";
 import { dirname as dirname28, join as join52, relative as relative11 } from "path";
 function contextDir(cwd2) {
   return join52(cwd2, ".ur", "context");
@@ -155184,7 +155244,7 @@ function formatArchitectureSummary(manifest, cwd2) {
 `);
 }
 function hash2(value) {
-  return createHash12("sha256").update(value).digest("hex");
+  return createHash13("sha256").update(value).digest("hex");
 }
 function stableJson(value) {
   if (Array.isArray(value))
@@ -155775,7 +155835,7 @@ var init_projectContextManifest = __esm(() => {
       this.verification = verification;
     }
   };
-  TASK_MEMORY_GENESIS = createHash12("sha256").update("ur-task-memory-genesis-v2").digest("hex");
+  TASK_MEMORY_GENESIS = createHash13("sha256").update("ur-task-memory-genesis-v2").digest("hex");
   TASK_MEMORY_STATUSES = new Set([
     "proposed",
     "accepted",
@@ -155797,11 +155857,11 @@ var init_projectContextManifest = __esm(() => {
 });
 
 // src/services/api/dumpPrompts.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { promises as fs2 } from "fs";
 import { dirname as dirname29, join as join53 } from "path";
 function hashString3(str) {
-  return createHash13("sha256").update(str).digest("hex");
+  return createHash14("sha256").update(str).digest("hex");
 }
 function clearDumpState(agentIdOrSessionId) {
   dumpState.delete(agentIdOrSessionId);
@@ -156251,7 +156311,7 @@ var init_ledger = __esm(() => {
 });
 
 // src/services/verifier/loopDetector.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 
 class LoopDetector {
   recent = new Map;
@@ -156292,7 +156352,7 @@ class LoopDetector {
 function hashCall(toolName, input) {
   const normalized = normalize8(input);
   const payload = `${toolName}\x00${JSON.stringify(normalized)}`;
-  return createHash14("sha1").update(payload).digest("hex");
+  return createHash15("sha1").update(payload).digest("hex");
 }
 function normalize8(value) {
   if (value === null || value === undefined)
@@ -206104,7 +206164,7 @@ function getTelemetryAttributes() {
     attributes["session.id"] = sessionId;
   }
   if (shouldIncludeAttribute("OTEL_METRICS_INCLUDE_VERSION")) {
-    attributes["app.version"] = "1.48.0";
+    attributes["app.version"] = "1.50.0";
   }
   const oauthAccount = getOauthAccountInfo();
   if (oauthAccount) {
@@ -209341,7 +209401,7 @@ __export(exports_commitAttribution, {
   buildSurfaceKey: () => buildSurfaceKey,
   attributionRestoreStateFromLog: () => attributionRestoreStateFromLog
 });
-import { createHash as createHash15, randomUUID as randomUUID20 } from "crypto";
+import { createHash as createHash16, randomUUID as randomUUID20 } from "crypto";
 import { stat as stat15 } from "fs/promises";
 import { isAbsolute as isAbsolute14, join as join57, relative as relative13, sep as sep12 } from "path";
 function getAttributionRepoRoot() {
@@ -209374,7 +209434,7 @@ function buildSurfaceKey(surface, model) {
   return `${surface}/${getCanonicalName(model)}`;
 }
 function computeContentHash(content) {
-  return createHash15("sha256").update(content).digest("hex");
+  return createHash16("sha256").update(content).digest("hex");
 }
 function normalizeFilePath(filePath) {
   const fs3 = getFsImplementation();
@@ -247679,7 +247739,7 @@ var init_config3 = __esm(() => {
 });
 
 // src/services/mcp/utils.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { join as join64 } from "path";
 function filterToolsByServer(tools, serverName) {
   const prefix = `mcp__${normalizeNameForMCP(serverName)}__`;
@@ -247719,7 +247779,7 @@ function hashMcpConfig(config2) {
     }
     return v;
   });
-  return createHash16("sha256").update(stable).digest("hex").slice(0, 16);
+  return createHash17("sha256").update(stable).digest("hex").slice(0, 16);
 }
 function excludeStalePluginClients(mcp, configs) {
   const stale = mcp.clients.filter((c4) => {
@@ -248468,7 +248528,7 @@ var init_xaaIdpLogin = __esm(() => {
 });
 
 // src/services/mcp/auth.ts
-import { createHash as createHash17, randomBytes as randomBytes5, randomUUID as randomUUID23 } from "crypto";
+import { createHash as createHash18, randomBytes as randomBytes5, randomUUID as randomUUID23 } from "crypto";
 import { mkdir as mkdir7 } from "fs/promises";
 import { createServer as createServer3 } from "http";
 import { join as join65 } from "path";
@@ -248582,7 +248642,7 @@ function getServerKey(serverName, serverConfig) {
     url: serverConfig.url,
     headers: serverConfig.headers || {}
   });
-  const hash3 = createHash17("sha256").update(configJson).digest("hex").substring(0, 16);
+  const hash3 = createHash18("sha256").update(configJson).digest("hex").substring(0, 16);
   return `${serverName}|${hash3}`;
 }
 function hasMcpDiscoveryButNoToken(serverName, serverConfig) {
@@ -252355,7 +252415,7 @@ function getInstallationEnv() {
   return;
 }
 function getURCodeVersion() {
-  return "1.48.0";
+  return "1.50.0";
 }
 async function getInstalledVSCodeExtensionVersion(command) {
   const { stdout } = await execFileNoThrow(command, ["--list-extensions", "--show-versions"], {
@@ -259686,7 +259746,7 @@ async function setupSdkMcpClients(sdkMcpConfigs, sendMcpMessage) {
     const client2 = new Client({
       name: "ur",
       title: "UR",
-      version: "1.48.0",
+      version: "1.50.0",
       description: "UR-Nexus autonomous engineering workflow engine",
       websiteUrl: PRODUCT_URL
     }, {
@@ -260046,7 +260106,7 @@ var init_client5 = __esm(() => {
       const client2 = new Client({
         name: "ur",
         title: "UR",
-        version: "1.48.0",
+        version: "1.50.0",
         description: "UR-Nexus autonomous engineering workflow engine",
         websiteUrl: PRODUCT_URL
       }, {
@@ -264327,7 +264387,7 @@ var init_types6 = __esm(() => {
 });
 
 // src/services/policyLimits/index.ts
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 import { readFileSync as fsReadFileSync } from "fs";
 import { unlink as unlink7, writeFile as writeFile10 } from "fs/promises";
 import { join as join74 } from "path";
@@ -264373,7 +264433,7 @@ function sortKeysDeep2(obj) {
 function computeChecksum(restrictions) {
   const sorted = sortKeysDeep2(restrictions);
   const normalized = jsonStringify(sorted);
-  const hash3 = createHash18("sha256").update(normalized).digest("hex");
+  const hash3 = createHash19("sha256").update(normalized).digest("hex");
   return `sha256:${hash3}`;
 }
 function isPolicyLimitsEligible() {
@@ -266145,7 +266205,7 @@ var init_types7 = __esm(() => {
 });
 
 // src/services/remoteManagedSettings/index.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 import { open as open7, unlink as unlink8 } from "fs/promises";
 function initializeRemoteManagedSettingsLoadingPromise() {
   if (loadingCompletePromise2) {
@@ -266183,7 +266243,7 @@ function sortKeysDeep3(obj) {
 function computeChecksumFromSettings(settings) {
   const sorted = sortKeysDeep3(settings);
   const normalized = jsonStringify(sorted);
-  const hash3 = createHash19("sha256").update(normalized).digest("hex");
+  const hash3 = createHash20("sha256").update(normalized).digest("hex");
   return `sha256:${hash3}`;
 }
 function isEligibleForRemoteManagedSettings() {
@@ -272647,7 +272707,7 @@ async function createRuntime() {
   bootstrapTelemetry();
   const resource = defaultResource().merge(detectResources({ detectors: [envDetector] })).merge(resourceFromAttributes({
     [import_semantic_conventions7.ATTR_SERVICE_NAME]: "ur-agent",
-    [import_semantic_conventions7.ATTR_SERVICE_VERSION]: "1.48.0"
+    [import_semantic_conventions7.ATTR_SERVICE_VERSION]: "1.50.0"
   }));
   const tracerProvider = exporters.traces.length > 0 ? new BasicTracerProvider({
     resource,
@@ -272680,11 +272740,11 @@ async function createRuntime() {
   setMeterProvider(meterProvider);
   setLoggerProvider(loggerProvider);
   if (meterProvider) {
-    const meter = meterProvider.getMeter("ur-agent", "1.48.0");
+    const meter = meterProvider.getMeter("ur-agent", "1.50.0");
     setMeter(meter, (name, options2) => meter.createCounter(name, options2));
   }
   if (loggerProvider) {
-    setEventLogger(loggerProvider.getLogger("ur-agent.events", "1.48.0"));
+    setEventLogger(loggerProvider.getLogger("ur-agent.events", "1.50.0"));
   }
   if (!cleanupRegistered2) {
     cleanupRegistered2 = true;
@@ -273014,7 +273074,7 @@ var init_auth_code_listener = __esm(() => {
 });
 
 // src/services/oauth/crypto.ts
-import { createHash as createHash20, randomBytes as randomBytes8 } from "crypto";
+import { createHash as createHash21, randomBytes as randomBytes8 } from "crypto";
 function base64URLEncode(buffer) {
   return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
@@ -273022,7 +273082,7 @@ function generateCodeVerifier() {
   return base64URLEncode(randomBytes8(32));
 }
 function generateCodeChallenge(verifier) {
-  const hash3 = createHash20("sha256");
+  const hash3 = createHash21("sha256");
   hash3.update(verifier);
   return base64URLEncode(hash3.digest());
 }
@@ -273346,9 +273406,9 @@ async function assertMinVersion() {
   if (false) {}
   try {
     const versionConfig = await getDynamicConfig_BLOCKS_ON_INIT("tengu_version_config", { minVersion: "0.0.0" });
-    if (versionConfig.minVersion && lt("1.48.0", versionConfig.minVersion)) {
+    if (versionConfig.minVersion && lt("1.50.0", versionConfig.minVersion)) {
       console.error(`
-It looks like your version of UR (${"1.48.0"}) needs an update.
+It looks like your version of UR (${"1.50.0"}) needs an update.
 A newer version (${versionConfig.minVersion} or higher) is required to continue.
 
 To update, please run:
@@ -273564,7 +273624,7 @@ async function installGlobalPackage(specificVersion) {
     logError2(new AutoUpdaterError("Another process is currently installing an update"));
     logEvent("tengu_auto_updater_lock_contention", {
       pid: process.pid,
-      currentVersion: "1.48.0"
+      currentVersion: "1.50.0"
     });
     return "in_progress";
   }
@@ -273573,7 +273633,7 @@ async function installGlobalPackage(specificVersion) {
     if (!env2.isRunningWithBun() && env2.isNpmFromWindowsPath()) {
       logError2(new Error("Windows NPM detected in WSL environment"));
       logEvent("tengu_auto_updater_windows_npm_in_wsl", {
-        currentVersion: "1.48.0"
+        currentVersion: "1.50.0"
       });
       console.error(`
 Error: Windows NPM detected in WSL
@@ -274108,7 +274168,7 @@ function detectLinuxGlobPatternWarnings() {
 }
 async function getDoctorDiagnostic() {
   const installationType = await getCurrentInstallationType();
-  const version2 = typeof MACRO !== "undefined" ? "1.48.0" : "unknown";
+  const version2 = typeof MACRO !== "undefined" ? "1.50.0" : "unknown";
   const installationPath = await getInstallationPath();
   const invokedBinary = getInvokedBinary();
   const multipleInstallations = await detectMultipleInstallations();
@@ -274226,7 +274286,7 @@ function getUserBinDir(options2) {
 var init_xdg = () => {};
 
 // src/utils/nativeInstaller/download.ts
-import { createHash as createHash21 } from "crypto";
+import { createHash as createHash22 } from "crypto";
 import { chmod as chmod4, writeFile as writeFile13 } from "fs/promises";
 import { join as join80 } from "path";
 async function getLatestVersionFromArtifactory(tag2 = "latest") {
@@ -274412,7 +274472,7 @@ async function downloadAndVerifyBinary(binaryUrl, expectedChecksum, binaryPath,
         ...requestConfig
       });
       clearStallTimer();
-      const hash3 = createHash21("sha256");
+      const hash3 = createHash22("sha256");
       hash3.update(response.data);
       const actualChecksum = hash3.digest("hex");
       if (actualChecksum !== expectedChecksum) {
@@ -275043,8 +275103,8 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
     const maxVersion = await getMaxVersion();
     if (maxVersion && gt(version2, maxVersion)) {
       logForDebugging(`Native installer: maxVersion ${maxVersion} is set, capping update from ${version2} to ${maxVersion}`);
-      if (gte("1.48.0", maxVersion)) {
-        logForDebugging(`Native installer: current version ${"1.48.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
+      if (gte("1.50.0", maxVersion)) {
+        logForDebugging(`Native installer: current version ${"1.50.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
         logEvent("tengu_native_update_skipped_max_version", {
           latency_ms: Date.now() - startTime,
           max_version: maxVersion,
@@ -275055,7 +275115,7 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
       version2 = maxVersion;
     }
   }
-  if (!forceReinstall && version2 === "1.48.0" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
+  if (!forceReinstall && version2 === "1.50.0" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
     logForDebugging(`Found ${version2} at ${executablePath}, skipping install`);
     logEvent("tengu_native_update_complete", {
       latency_ms: Date.now() - startTime,
@@ -295756,11 +295816,11 @@ var init_skillUsageTracking = __esm(() => {
 });
 
 // src/utils/telemetry/pluginTelemetry.ts
-import { createHash as createHash22 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 import { sep as sep14 } from "path";
 function hashPluginId(name, marketplace) {
   const key = marketplace ? `${name}@${marketplace.toLowerCase()}` : name;
-  return createHash22("sha256").update(key + PLUGIN_ID_HASH_SALT).digest("hex").slice(0, 16);
+  return createHash23("sha256").update(key + PLUGIN_ID_HASH_SALT).digest("hex").slice(0, 16);
 }
 function getTelemetryPluginScope(name, marketplace, managedNames) {
   if (marketplace === BUILTIN_MARKETPLACE_NAME2)
@@ -298154,7 +298214,7 @@ var init_sessionIngress = __esm(() => {
 });
 
 // src/utils/fileHistory.ts
-import { createHash as createHash23 } from "crypto";
+import { createHash as createHash24 } from "crypto";
 import {
   chmod as chmod6,
   copyFile as copyFile3,
@@ -298578,7 +298638,7 @@ async function computeDiffStatsForFile(originalFile, backupFileName) {
   };
 }
 function getBackupFileName(filePath, version2) {
-  const fileNameHash = createHash23("sha256").update(filePath).digest("hex").slice(0, 16);
+  const fileNameHash = createHash24("sha256").update(filePath).digest("hex").slice(0, 16);
   return `${fileNameHash}@v${version2}`;
 }
 function resolveBackupPath(backupFileName, sessionId) {
@@ -301184,11 +301244,11 @@ var init_filesApi = __esm(() => {
 });
 
 // src/utils/tempfile.ts
-import { createHash as createHash24, randomUUID as randomUUID29 } from "crypto";
+import { createHash as createHash25, randomUUID as randomUUID29 } from "crypto";
 import { tmpdir as tmpdir6 } from "os";
 import { join as join91 } from "path";
 function generateTempFilePath(prefix = "ur-prompt", extension = ".md", options2) {
-  const id = options2?.contentHash ? createHash24("sha256").update(options2.contentHash).digest("hex").slice(0, 16) : randomUUID29();
+  const id = options2?.contentHash ? createHash25("sha256").update(options2.contentHash).digest("hex").slice(0, 16) : randomUUID29();
   return join91(tmpdir6(), `${prefix}-${id}${extension}`);
 }
 var init_tempfile = () => {};
@@ -317108,16 +317168,16 @@ import {
   writeFileSync as writeFileSync17
 } from "fs";
 import {
-  createHash as createHash25,
-  createPrivateKey,
-  createPublicKey,
+  createHash as createHash26,
+  createPrivateKey as createPrivateKey2,
+  createPublicKey as createPublicKey2,
   randomUUID as randomUUID33,
   sign as sign2,
   verify
 } from "crypto";
 import { basename as basename25, join as join95, relative as relative20, sep as sep18 } from "path";
 function sha256(value) {
-  return createHash25("sha256").update(value).digest("hex");
+  return createHash26("sha256").update(value).digest("hex");
 }
 function stableJson2(value) {
   if (Array.isArray(value))
@@ -317288,7 +317348,7 @@ function canonicalSignaturePayload(input) {
   }), "utf8");
 }
 function keyFingerprint(key) {
-  const der = createPublicKey(key).export({ type: "spki", format: "der" });
+  const der = createPublicKey2(key).export({ type: "spki", format: "der" });
   return sha256(der);
 }
 function trustedSkillKeysPath() {
@@ -317313,7 +317373,7 @@ function loadTrustedSkillKeys(path13 = trustedSkillKeysPath()) {
     if (!KEY_ID.test(keyId) || typeof value !== "string") {
       throw new Error("Trusted skill key store contains an invalid key entry");
     }
-    createPublicKey(value);
+    createPublicKey2(value);
     keys2[keyId] = value;
   }
   return keys2;
@@ -317372,7 +317432,7 @@ function verifyManifest(skillDir, name, tree, permissionDigest, trustedKeys) {
     if (signature.length !== 64) {
       return { status: "invalid", ...base2, reason: "Ed25519 signature length is invalid" };
     }
-    const valid = verify(null, canonicalSignaturePayload(manifest), createPublicKey(candidate), signature);
+    const valid = verify(null, canonicalSignaturePayload(manifest), createPublicKey2(candidate), signature);
     if (!valid)
       return { status: "invalid", ...base2, reason: "signature verification failed" };
     return { status: trustedKey ? "verified" : "verified-untrusted", ...base2 };
@@ -317432,11 +317492,11 @@ function signSkillDirectory(options2) {
   if (inspected.tree.hasSymlinks) {
     throw new Error("Cannot sign a skill directory containing symlinks");
   }
-  const privateKey = createPrivateKey(options2.privateKey);
+  const privateKey = createPrivateKey2(options2.privateKey);
   if (privateKey.asymmetricKeyType !== "ed25519") {
     throw new Error("Skill signing requires an Ed25519 private key");
   }
-  const publicKey = createPublicKey(privateKey).export({
+  const publicKey = createPublicKey2(privateKey).export({
     type: "spki",
     format: "pem"
   });
@@ -318398,12 +318458,12 @@ var init_diff2 = __esm(() => {
 });
 
 // src/utils/fileOperationAnalytics.ts
-import { createHash as createHash26 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 function hashFilePath(filePath) {
-  return createHash26("sha256").update(filePath).digest("hex").slice(0, 16);
+  return createHash27("sha256").update(filePath).digest("hex").slice(0, 16);
 }
 function hashFileContent(content) {
-  return createHash26("sha256").update(content).digest("hex");
+  return createHash27("sha256").update(content).digest("hex");
 }
 function logFileOperation(params) {
   const metadata = {
@@ -329149,7 +329209,7 @@ var init_embeddings = __esm(() => {
 });
 
 // src/utils/codeIndex/store.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 import { mkdir as mkdir22, readFile as readFile26, writeFile as writeFile22 } from "fs/promises";
 import { dirname as dirname44, join as join104 } from "path";
 function codeIndexDir(root2) {
@@ -329159,7 +329219,7 @@ function indexPath(root2) {
   return join104(codeIndexDir(root2), "index.json");
 }
 function sha1(content) {
-  return createHash27("sha1").update(content).digest("hex");
+  return createHash28("sha1").update(content).digest("hex");
 }
 function cosineSimilarity(a2, b) {
   if (a2.length === 0 || a2.length !== b.length) {
@@ -329708,11 +329768,11 @@ var init_graph = __esm(() => {
 });
 
 // src/utils/codeIndex/repoIndex.ts
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 import { existsSync as existsSync26, mkdirSync as mkdirSync18, readFileSync as readFileSync29, writeFileSync as writeFileSync19 } from "fs";
 import { join as join106, posix as posix7 } from "path";
 function sha12(content) {
-  return createHash28("sha1").update(content).digest("hex");
+  return createHash29("sha1").update(content).digest("hex");
 }
 function posixExt(file2) {
   const dot = file2.lastIndexOf(".");
@@ -344545,7 +344605,7 @@ var init_stream3 = __esm(() => {
 });
 
 // src/utils/telemetry/betaSessionTracing.ts
-import { createHash as createHash29 } from "crypto";
+import { createHash as createHash30 } from "crypto";
 function clearBetaTracingState() {
   seenHashes.clear();
   lastReportedMessageHash.clear();
@@ -344572,7 +344632,7 @@ function truncateContent(content, maxSize = MAX_CONTENT_SIZE) {
   };
 }
 function shortHash(content) {
-  return createHash29("sha256").update(content).digest("hex").slice(0, 12);
+  return createHash30("sha256").update(content).digest("hex").slice(0, 12);
 }
 function hashSystemPrompt(systemPrompt) {
   return `sp_${shortHash(systemPrompt)}`;
@@ -344848,7 +344908,7 @@ function isAnyTracingEnabled() {
   return isTelemetryEnabled() || isEnhancedTelemetryEnabled() || isBetaTracingEnabled();
 }
 function getTracer() {
-  return import_api39.trace.getTracer("ur-agent.gen_ai", "1.48.0");
+  return import_api39.trace.getTracer("ur-agent.gen_ai", "1.50.0");
 }
 function createSpanAttributes(spanType, customAttributes = {}) {
   const baseAttributes = getTelemetryAttributes();
@@ -353440,7 +353500,7 @@ var init_toolSearch = __esm(() => {
 });
 
 // src/services/vcr.ts
-import { createHash as createHash30, randomUUID as randomUUID37 } from "crypto";
+import { createHash as createHash31, randomUUID as randomUUID37 } from "crypto";
 import { mkdir as mkdir24, readFile as readFile33, writeFile as writeFile24 } from "fs/promises";
 import { dirname as dirname46, join as join111 } from "path";
 function shouldUseVCR() {
@@ -353454,7 +353514,7 @@ async function withFixture(input, fixtureName, f) {
   if (!shouldUseVCR()) {
     return await f();
   }
-  const hash3 = createHash30("sha1").update(jsonStringify(input)).digest("hex").slice(0, 12);
+  const hash3 = createHash31("sha1").update(jsonStringify(input)).digest("hex").slice(0, 12);
   const filename = join111(process.env.UR_CODE_TEST_FIXTURES_ROOT ?? getCwd(), `fixtures/${fixtureName}-${hash3}.json`);
   try {
     const cached5 = jsonParse(await readFile33(filename, { encoding: "utf8" }));
@@ -353489,7 +353549,7 @@ async function withVCR(messages, f) {
     return true;
   }));
   const dehydratedInput = mapMessages(messagesForAPI.map((_) => _.message.content), dehydrateValue);
-  const filename = join111(process.env.UR_CODE_TEST_FIXTURES_ROOT ?? getCwd(), `fixtures/${dehydratedInput.map((_) => createHash30("sha1").update(jsonStringify(_)).digest("hex").slice(0, 6)).join("-")}.json`);
+  const filename = join111(process.env.UR_CODE_TEST_FIXTURES_ROOT ?? getCwd(), `fixtures/${dehydratedInput.map((_) => createHash31("sha1").update(jsonStringify(_)).digest("hex").slice(0, 6)).join("-")}.json`);
   try {
     const cached5 = jsonParse(await readFile33(filename, { encoding: "utf8" }));
     cached5.output.forEach(addCachedCostToTotalSessionCost);
@@ -360416,7 +360476,7 @@ var init_managedPlugins = __esm(() => {
 });
 
 // src/utils/plugins/pluginVersioning.ts
-import { createHash as createHash31 } from "crypto";
+import { createHash as createHash32 } from "crypto";
 async function calculatePluginVersion(pluginId, source, manifest, installPath, providedVersion, gitCommitSha) {
   if (manifest?.version) {
     logForDebugging(`Using manifest version for ${pluginId}: ${manifest.version}`);
@@ -360430,7 +360490,7 @@ async function calculatePluginVersion(pluginId, source, manifest, installPath, p
     const shortSha = gitCommitSha.substring(0, 12);
     if (typeof source === "object" && source.source === "git-subdir") {
       const normPath = source.path.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
-      const pathHash = createHash31("sha256").update(normPath).digest("hex").substring(0, 8);
+      const pathHash = createHash32("sha256").update(normPath).digest("hex").substring(0, 8);
       const v = `${shortSha}-${pathHash}`;
       logForDebugging(`Using git-subdir SHA+path version for ${pluginId}: ${v} (path=${normPath})`);
       return v;
@@ -369650,14 +369710,14 @@ var init_terminalSetup = __esm(() => {
 });
 
 // src/utils/pasteStore.ts
-import { createHash as createHash32 } from "crypto";
+import { createHash as createHash33 } from "crypto";
 import { mkdir as mkdir28, readdir as readdir22, readFile as readFile39, stat as stat37, unlink as unlink17, writeFile as writeFile30 } from "fs/promises";
 import { join as join126 } from "path";
 function getPasteStoreDir() {
   return join126(getURConfigHomeDir(), PASTE_STORE_DIR);
 }
 function hashPastedText(content) {
-  return createHash32("sha256").update(content).digest("hex").slice(0, 16);
+  return createHash33("sha256").update(content).digest("hex").slice(0, 16);
 }
 function getPastePath(hash3) {
   return join126(getPasteStoreDir(), `${hash3}.txt`);
@@ -373290,11 +373350,11 @@ var init_sideQuestion = __esm(() => {
 });
 
 // src/services/sideChats/sideChatStore.ts
-import { createHash as createHash33, randomUUID as randomUUID41 } from "crypto";
+import { createHash as createHash34, randomUUID as randomUUID41 } from "crypto";
 import { existsSync as existsSync29, lstatSync as lstatSync9, readdirSync as readdirSync6 } from "fs";
 import { join as join129 } from "path";
 function digest2(value) {
-  return `sha256:${createHash33("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash34("sha256").update(value).digest("hex")}`;
 }
 function stableJson3(value) {
   if (Array.isArray(value))
@@ -373511,7 +373571,7 @@ var init_sideChatStore = __esm(() => {
   MAX_CONTENT_BYTES = 64 * 1024;
   ID_RE2 = /^[a-zA-Z0-9._-]{1,200}$/;
   DIGEST_RE2 = /^sha256:[a-f0-9]{64}$/;
-  GENESIS = `sha256:${createHash33("sha256").update("ur-side-chat-genesis-v1").digest("hex")}`;
+  GENESIS = `sha256:${createHash34("sha256").update("ur-side-chat-genesis-v1").digest("hex")}`;
 });
 
 // src/commands/btw/btw.tsx
@@ -373942,7 +374002,7 @@ function Feedback({
       platform: env2.platform,
       gitRepo: envInfo.isGit,
       terminal: env2.terminal,
-      version: "1.48.0",
+      version: "1.50.0",
       transcript: normalizeMessagesForAPI(messages),
       errors: sanitizedErrors,
       lastApiRequest: getLastAPIRequest(),
@@ -374134,7 +374194,7 @@ function Feedback({
                       ", ",
                       env2.terminal,
                       ", v",
-                      "1.48.0"
+                      "1.50.0"
                     ]
                   }, undefined, true, undefined, this)
                 ]
@@ -374240,7 +374300,7 @@ ${sanitizedDescription}
 ` + `**Environment Info**
 ` + `- Platform: ${env2.platform}
 ` + `- Terminal: ${env2.terminal}
-` + `- Version: ${"1.48.0"}
+` + `- Version: ${"1.50.0"}
 ` + `- Feedback ID: ${feedbackId}
 ` + `
 **Errors**
@@ -377351,7 +377411,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "1.48.0"
+    value: "1.50.0"
   }, {
     label: "Session name",
     value: nameValue
@@ -380681,7 +380741,7 @@ function Config({
         }
       }, undefined, false, undefined, this)
     }, undefined, false, undefined, this) : showSubmenu === "ChannelDowngrade" ? /* @__PURE__ */ jsx_dev_runtime178.jsxDEV(ChannelDowngradeDialog, {
-      currentVersion: "1.48.0",
+      currentVersion: "1.50.0",
       onChoice: (choice) => {
         setShowSubmenu(null);
         setTabsHidden(false);
@@ -380693,7 +380753,7 @@ function Config({
           autoUpdatesChannel: "stable"
         };
         if (choice === "stay") {
-          newSettings.minimumVersion = "1.48.0";
+          newSettings.minimumVersion = "1.50.0";
         }
         updateSettingsForSource("userSettings", newSettings);
         setSettingsData((prev_27) => ({
@@ -388763,7 +388823,7 @@ function HelpV2(t0) {
   let t6;
   if ($2[31] !== tabs) {
     t6 = /* @__PURE__ */ jsx_dev_runtime205.jsxDEV(Tabs, {
-      title: `UR v${"1.48.0"}`,
+      title: `UR v${"1.50.0"}`,
       color: "professionalBlue",
       defaultTab: "general",
       children: tabs
@@ -389680,7 +389740,7 @@ function buildToolUseContext(tools, readFileStateCache, toolPermissionContext, a
 async function handleInitialize(options2) {
   return {
     name: "UR",
-    version: "1.48.0",
+    version: "1.50.0",
     protocolVersion: "0.1.0",
     workspaceRoot: options2.cwd,
     capabilities: {
@@ -392383,7 +392443,7 @@ var init_guardrails = __esm(() => {
 });
 
 // src/services/agents/agenticCi.ts
-import { createHash as createHash34, randomUUID as randomUUID44 } from "crypto";
+import { createHash as createHash35, randomUUID as randomUUID44 } from "crypto";
 import {
   existsSync as existsSync32,
   mkdtempSync,
@@ -392403,6 +392463,49 @@ function stringArray2(value) {
 function isAssociation(value) {
   return TRUSTED_GITHUB_ASSOCIATIONS.includes(value);
 }
+function isTriggerEvent(value) {
+  return AGENTIC_CI_TRIGGER_EVENTS.includes(value);
+}
+function triggerKeywords(spec) {
+  const config3 = spec.trigger?.issueComment;
+  const keyword = config3?.keyword?.trim() || AGENTIC_CI_DEFAULT_KEYWORD;
+  const aliases = config3?.aliases ?? [...AGENTIC_CI_DEFAULT_ALIASES];
+  const unique = [];
+  for (const candidate of [keyword, ...aliases]) {
+    const trimmed = candidate?.trim();
+    if (!trimmed)
+      continue;
+    if (!unique.some((item) => item.toLowerCase() === trimmed.toLowerCase())) {
+      unique.push(trimmed);
+    }
+  }
+  return unique.sort((a2, b) => b.length - a2.length);
+}
+function triggerEvents(spec) {
+  const configured = spec.trigger?.issueComment?.events;
+  return configured?.length ? configured.filter(isTriggerEvent) : [...AGENTIC_CI_TRIGGER_EVENTS];
+}
+function findTriggerMention(body, keywords) {
+  const scannable = stripQuotedAndFenced(body);
+  for (const keyword of keywords) {
+    const pattern = new RegExp(`(^|[^\\w@/#-])${escapeRegExp3(keyword)}(?![\\w@/-])`, "i");
+    const match = pattern.exec(scannable);
+    if (!match)
+      continue;
+    const start = match.index + (match[1]?.length ?? 0) + keyword.length;
+    return { keyword, prompt: scannable.slice(start).trim() };
+  }
+  return;
+}
+function escapeRegExp3(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function stripQuotedAndFenced(body) {
+  const withoutFences = body.replace(/```[\s\S]*?```/g, " ").replace(/~~~[\s\S]*?~~~/g, " ").replace(/`[^`\n]*`/g, " ");
+  return withoutFences.split(`
+`).filter((line) => !/^\s*>/.test(line)).join(`
+`);
+}
 function validateAgenticCiSpec(spec) {
   const errors4 = [];
   const warnings = [];
@@ -392424,11 +392527,26 @@ function validateAgenticCiSpec(spec) {
     errors4.push("runner.timeoutMinutes must be an integer between 1 and 120");
   }
   const issue2 = spec.trigger?.issueComment;
-  if (issue2?.keyword !== undefined) {
-    if (!issue2.keyword.trim() || issue2.keyword.length > 64 || /[\0\r\n]/.test(issue2.keyword)) {
-      errors4.push("trigger.issueComment.keyword is invalid");
+  if (issue2?.keyword !== undefined && !KEYWORD_RE.test(issue2.keyword)) {
+    errors4.push("trigger.issueComment.keyword is invalid");
+  }
+  for (const alias of issue2?.aliases ?? []) {
+    if (!KEYWORD_RE.test(alias)) {
+      errors4.push(`trigger.issueComment.aliases contains "${alias}"`);
+    }
+  }
+  for (const event of issue2?.events ?? []) {
+    if (!isTriggerEvent(event)) {
+      errors4.push(`trigger.issueComment.events contains "${event}"`);
     }
   }
+  const publishMode = spec.publish?.mode;
+  if (publishMode !== undefined && !AGENTIC_CI_PUBLISH_MODES.includes(publishMode)) {
+    errors4.push(`publish.mode must be one of ${AGENTIC_CI_PUBLISH_MODES.join(", ")}`);
+  }
+  if (publishMode === "pull-request") {
+    warnings.push('publish.mode "pull-request" grants the publisher job contents:write');
+  }
   for (const association of issue2?.allowedAssociations ?? []) {
     if (!isAssociation(association)) {
       errors4.push(`trigger.issueComment.allowedAssociations contains "${association}"`);
@@ -392489,6 +392607,7 @@ function parseAgenticCiSpec(text) {
   const workspace = value.workspace ?? {};
   const verification = value.verification ?? {};
   const outputs = value.outputs ?? {};
+  const publish = value.publish ?? {};
   const commands = Array.isArray(verification.commands) ? verification.commands.map((item) => {
     const command5 = item && typeof item === "object" ? item : {};
     return {
@@ -392506,7 +392625,9 @@ function parseAgenticCiSpec(text) {
       manual: trigger.manual === true,
       issueComment: issue2 ? {
         keyword: typeof issue2.keyword === "string" ? issue2.keyword : undefined,
-        allowedAssociations: stringArray2(issue2.allowedAssociations)
+        aliases: Array.isArray(issue2.aliases) ? stringArray2(issue2.aliases) : undefined,
+        allowedAssociations: stringArray2(issue2.allowedAssociations),
+        events: Array.isArray(issue2.events) ? stringArray2(issue2.events) : undefined
       } : undefined
     },
     runner: {
@@ -392527,7 +392648,9 @@ function parseAgenticCiSpec(text) {
       maxSummaryChars: typeof outputs.maxSummaryChars === "number" ? outputs.maxSummaryChars : undefined,
       maxPatchBytes: typeof outputs.maxPatchBytes === "number" ? outputs.maxPatchBytes : undefined
     },
-    publish: { mode: "artifact" }
+    publish: {
+      mode: typeof publish.mode === "string" ? publish.mode : "comment"
+    }
   };
   const validation = validateAgenticCiSpec(spec);
   if (!validation.valid) {
@@ -392558,89 +392681,179 @@ function decideAgenticCiEvent(spec, payload, explicitEventName) {
         reason: "manual trigger is disabled"
       };
     }
-    const prompt = boundedPrompt(asRecord(root2.inputs).prompt) ?? boundedPrompt(asRecord(root2.workflow_dispatch).prompt);
+    const prompt2 = boundedPrompt(asRecord(root2.inputs).prompt) ?? boundedPrompt(asRecord(root2.workflow_dispatch).prompt);
     return {
       accepted: true,
       source: "manual",
       reason: "trusted manual dispatch",
-      prompt
+      prompt: prompt2
     };
   }
-  if (eventName === "issue_comment" || root2.comment !== undefined) {
-    const config3 = spec.trigger?.issueComment;
-    if (!config3) {
-      return {
-        accepted: false,
-        source: "issue_comment",
-        reason: "issue-comment trigger is disabled"
-      };
-    }
-    if (typeof root2.action === "string" && root2.action !== "created") {
-      return {
-        accepted: false,
-        source: "issue_comment",
-        reason: `unsupported issue_comment action "${root2.action}"`
-      };
-    }
-    const comment = asRecord(root2.comment);
-    const actor = typeof asRecord(comment.user).login === "string" ? String(asRecord(comment.user).login) : undefined;
-    const association = typeof comment.author_association === "string" ? comment.author_association.toUpperCase() : "";
-    const allowed = config3.allowedAssociations?.length ? config3.allowedAssociations : [...TRUSTED_GITHUB_ASSOCIATIONS];
-    if (!allowed.includes(association)) {
-      return {
-        accepted: false,
-        source: "issue_comment",
-        reason: `actor association "${association || "NONE"}" is not allowed`,
-        actor,
-        association
-      };
-    }
-    const body = boundedPrompt(comment.body);
-    const keyword = config3.keyword?.trim() || "/ur";
-    if (!body) {
-      return {
-        accepted: false,
-        source: "issue_comment",
-        reason: "comment body is empty or too large",
-        actor,
-        association
-      };
-    }
-    const index2 = body.toLowerCase().indexOf(keyword.toLowerCase());
-    if (index2 < 0) {
-      return {
-        accepted: false,
-        source: "issue_comment",
-        reason: `comment does not contain "${keyword}"`,
-        actor,
-        association
-      };
-    }
-    const prompt = boundedPrompt(body.slice(index2 + keyword.length));
-    if (!prompt) {
-      return {
-        accepted: false,
-        source: "issue_comment",
-        reason: "trigger contains no bounded task text",
-        actor,
-        association
-      };
-    }
+  const mention = normalizeMentionEvent(root2, eventName);
+  if (!mention) {
     return {
-      accepted: true,
-      source: "issue_comment",
-      reason: "trusted actor used the configured keyword",
+      accepted: false,
+      source: "none",
+      reason: "event type is not enabled"
+    };
+  }
+  const { source } = mention;
+  const config3 = spec.trigger?.issueComment;
+  if (!config3) {
+    return { accepted: false, source, reason: "mention trigger is disabled" };
+  }
+  if (!triggerEvents(spec).includes(source)) {
+    return {
+      accepted: false,
+      source,
+      reason: `event "${source}" is not enabled for this spec`
+    };
+  }
+  if (mention.action && !mention.acceptedActions.includes(mention.action)) {
+    return {
+      accepted: false,
+      source,
+      reason: `unsupported ${source} action "${mention.action}"`
+    };
+  }
+  const { actor, association, issueNumber, commentId, isPullRequest } = mention;
+  const allowed = config3.allowedAssociations?.length ? config3.allowedAssociations : [...TRUSTED_GITHUB_ASSOCIATIONS];
+  if (!allowed.includes(association)) {
+    return {
+      accepted: false,
+      source,
+      reason: `actor association "${association || "NONE"}" is not allowed`,
       actor,
       association,
-      prompt
+      issueNumber,
+      commentId,
+      isPullRequest
+    };
+  }
+  const body = boundedPrompt(mention.body);
+  if (!body) {
+    return {
+      accepted: false,
+      source,
+      reason: "comment body is empty or too large",
+      actor,
+      association,
+      issueNumber,
+      commentId,
+      isPullRequest
+    };
+  }
+  const keywords = triggerKeywords(spec);
+  const match = findTriggerMention(body, keywords);
+  if (!match) {
+    return {
+      accepted: false,
+      source,
+      reason: `comment does not mention ${keywords.map((k2) => `"${k2}"`).join(" or ")}`,
+      actor,
+      association,
+      issueNumber,
+      commentId,
+      isPullRequest
+    };
+  }
+  const prompt = boundedPrompt(match.prompt);
+  if (!prompt) {
+    return {
+      accepted: false,
+      source,
+      reason: "trigger contains no bounded task text",
+      actor,
+      association,
+      issueNumber,
+      commentId,
+      isPullRequest
     };
   }
   return {
-    accepted: false,
-    source: "none",
-    reason: "event type is not enabled"
+    accepted: true,
+    source,
+    reason: `trusted actor mentioned "${match.keyword}"`,
+    actor,
+    association,
+    prompt,
+    issueNumber,
+    commentId,
+    isPullRequest
   };
 }
+function login(value) {
+  const candidate = asRecord(value).login;
+  return typeof candidate === "string" ? candidate : undefined;
+}
+function association(value) {
+  const candidate = asRecord(value).author_association;
+  return typeof candidate === "string" ? candidate.toUpperCase() : "";
+}
+function numeric(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function normalizeMentionEvent(root2, eventName) {
+  const action3 = typeof root2.action === "string" ? root2.action : undefined;
+  const issue2 = asRecord(root2.issue);
+  const pull = asRecord(root2.pull_request);
+  const comment = asRecord(root2.comment);
+  const review = asRecord(root2.review);
+  if (eventName === "pull_request_review_comment") {
+    return {
+      source: "pull_request_review_comment",
+      acceptedActions: ["created"],
+      action: action3,
+      body: comment.body,
+      actor: login(comment.user),
+      association: association(comment),
+      issueNumber: numeric(pull.number),
+      commentId: numeric(comment.id),
+      isPullRequest: true
+    };
+  }
+  if (eventName === "pull_request_review") {
+    return {
+      source: "pull_request_review",
+      acceptedActions: ["submitted", "edited"],
+      action: action3,
+      body: review.body,
+      actor: login(review.user),
+      association: association(review),
+      issueNumber: numeric(pull.number),
+      commentId: numeric(review.id),
+      isPullRequest: true
+    };
+  }
+  if (eventName === "issues") {
+    return {
+      source: "issues",
+      acceptedActions: ["opened", "edited", "assigned", "labeled"],
+      action: action3,
+      body: [issue2.title, issue2.body].filter((part) => typeof part === "string").join(`
+
+`),
+      actor: login(issue2.user),
+      association: association(issue2),
+      issueNumber: numeric(issue2.number),
+      isPullRequest: false
+    };
+  }
+  if (eventName === "issue_comment" || root2.comment !== undefined) {
+    return {
+      source: "issue_comment",
+      acceptedActions: ["created"],
+      action: action3,
+      body: comment.body,
+      actor: login(comment.user),
+      association: association(comment),
+      issueNumber: numeric(issue2.number),
+      commentId: numeric(comment.id),
+      isPullRequest: issue2.pull_request !== undefined
+    };
+  }
+  return;
+}
 function loadAgenticCiEventFile(path17) {
   const bytes = readFileSync33(path17);
   if (bytes.byteLength > AGENTIC_CI_MAX_EVENT_BYTES) {
@@ -392714,7 +392927,7 @@ function boundedTail(text, maxChars = AGENTIC_CI_MAX_LOG_CHARS) {
   return value.length <= maxChars ? value : value.slice(-maxChars);
 }
 function sha2562(value) {
-  return createHash34("sha256").update(value).digest("hex");
+  return createHash35("sha256").update(value).digest("hex");
 }
 function containsPath(base2, candidate) {
   const rel = relative35(resolve49(base2), resolve49(candidate));
@@ -392885,6 +393098,7 @@ async function runAgenticCi(options2) {
   const runId = `${Date.now().toString(36)}-${randomUUID44().slice(0, 8)}`;
   const manifestPath5 = manifestPathFor(outputRoot, runId);
   const eventDecision = options2.event !== undefined ? decideAgenticCiEvent(options2.spec, options2.event, options2.eventName) : undefined;
+  const publishContract = buildPublishContract(options2.spec, eventDecision);
   if (eventDecision && !eventDecision.accepted) {
     const blocked = {
       version: 1,
@@ -392894,7 +393108,8 @@ async function runAgenticCi(options2) {
       summary: eventDecision.reason,
       checks: [],
       violations: [eventDecision.reason],
-      manifestPath: manifestPath5
+      manifestPath: manifestPath5,
+      publish: publishContract
     };
     writeAgenticCiResult(blocked);
     return blocked;
@@ -392916,7 +393131,8 @@ async function runAgenticCi(options2) {
       summary: "Dry run: validated spec and event; no worktree or model was started.",
       checks: [],
       violations: [],
-      manifestPath: manifestPath5
+      manifestPath: manifestPath5,
+      publish: publishContract
     };
     writeAgenticCiResult(dry);
     rmSync9(verificationHome, { recursive: true, force: true });
@@ -393084,11 +393300,25 @@ async function runAgenticCi(options2) {
     patch,
     checks: checks4,
     violations,
-    manifestPath: manifestPath5
+    manifestPath: manifestPath5,
+    publish: publishContract
   };
   writeAgenticCiResult(result);
   return result;
 }
+function buildPublishContract(spec, decision) {
+  const mode = spec.publish?.mode ?? "comment";
+  if (mode === "artifact")
+    return;
+  return {
+    mode,
+    source: decision?.source ?? "manual",
+    actor: decision?.actor,
+    issueNumber: decision?.issueNumber,
+    commentId: decision?.commentId,
+    isPullRequest: decision?.isPullRequest ?? false
+  };
+}
 function defaultAgenticCiSpec(name = "default") {
   return {
     version: 1,
@@ -393097,8 +393327,10 @@ function defaultAgenticCiSpec(name = "default") {
     trigger: {
       manual: true,
       issueComment: {
-        keyword: "/ur",
-        allowedAssociations: [...TRUSTED_GITHUB_ASSOCIATIONS]
+        keyword: AGENTIC_CI_DEFAULT_KEYWORD,
+        aliases: [...AGENTIC_CI_DEFAULT_ALIASES],
+        allowedAssociations: [...TRUSTED_GITHUB_ASSOCIATIONS],
+        events: [...AGENTIC_CI_TRIGGER_EVENTS]
       }
     },
     runner: { maxTurns: 20, timeoutMinutes: 30 },
@@ -393122,7 +393354,7 @@ function defaultAgenticCiSpec(name = "default") {
       maxSummaryChars: AGENTIC_CI_MAX_SUMMARY_CHARS,
       maxPatchBytes: AGENTIC_CI_MAX_PATCH_BYTES
     },
-    publish: { mode: "artifact" }
+    publish: { mode: "comment" }
   };
 }
 function agenticCiDir(cwd2) {
@@ -393160,56 +393392,127 @@ function compileAgenticCiWorkflow(specName = "default", options2 = {}) {
   if (spec.name !== specName) {
     throw new Error("Agentic CI workflow spec name does not match");
   }
-  const packageVersion = options2.packageVersion ?? (typeof MACRO !== "undefined" ? "1.48.0" : "1.48.0");
+  const packageVersion = options2.packageVersion ?? (typeof MACRO !== "undefined" ? "1.50.0" : "1.50.0");
   if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(packageVersion)) {
     throw new Error("invalid ur-agent package version");
   }
+  const issue2 = spec.trigger?.issueComment;
+  const keywords = triggerKeywords(spec);
+  const events2 = triggerEvents(spec);
+  const publishMode = spec.publish?.mode ?? "comment";
+  const publishes = publishMode !== "artifact";
+  const associations = issue2?.allowedAssociations?.length ? issue2.allowedAssociations : [...TRUSTED_GITHUB_ASSOCIATIONS];
+  const trustedActors = `contains(fromJSON('${JSON.stringify(associations)}'), `;
+  const quoted = (value) => `'${value.replaceAll("'", "''")}'`;
+  const mentions = (expression) => keywords.map((word) => `contains(${expression}, ${quoted(word)})`).join(" || ");
+  const gate = (eventName, bodyExpressions, associationExpression) => [
+    "(",
+    `  github.event_name == '${eventName}' &&`,
+    `  (${bodyExpressions.map(mentions).join(" || ")}) &&`,
+    `  ${trustedActors}${associationExpression})`,
+    ")"
+  ].join(`
+`);
+  const foldExpression = (text, indent = "      ") => text.split(`
+`).map((line, index2) => index2 === 0 ? line : `${indent}${line}`).join(`
+`);
   const conditions = [];
+  const onBlocks = [];
   if (spec.trigger?.manual) {
     conditions.push("github.event_name == 'workflow_dispatch'");
-  }
-  const issue2 = spec.trigger?.issueComment;
-  if (issue2) {
-    const keyword = (issue2.keyword?.trim() || "/ur").replaceAll("'", "''");
-    const associations = issue2.allowedAssociations?.length ? issue2.allowedAssociations : [...TRUSTED_GITHUB_ASSOCIATIONS];
-    conditions.push([
-      "(",
-      "  github.event_name == 'issue_comment' &&",
-      `  contains(github.event.comment.body, '${keyword}') &&`,
-      `  contains(fromJSON('${JSON.stringify(associations)}'), github.event.comment.author_association)`,
-      ")"
+    onBlocks.push([
+      "  workflow_dispatch:",
+      "    inputs:",
+      "      prompt:",
+      "        description: Bounded task for the isolated agent",
+      "        required: false",
+      "        type: string"
     ].join(`
 `));
   }
-  const jobCondition = conditions.length > 0 ? conditions.join(` ||
-      `) : "false";
-  return `name: UR Agentic CI
-
-on:
-  workflow_dispatch:
-    inputs:
-      prompt:
-        description: Bounded task for the isolated agent
-        required: false
-        type: string
-  issue_comment:
-    types: [created]
-
-permissions:
-  contents: read
-  issues: read
-  pull-requests: read
-
-concurrency:
-  group: ur-agentic-ci-\${{ github.repository }}-\${{ github.event.issue.number || github.run_id }}
-  cancel-in-progress: false
-
-jobs:
-  agent:
+  if (issue2) {
+    if (events2.includes("issue_comment")) {
+      onBlocks.push(`  issue_comment:
+    types: [created]`);
+      conditions.push(gate("issue_comment", ["github.event.comment.body"], "github.event.comment.author_association"));
+    }
+    if (events2.includes("pull_request_review_comment")) {
+      onBlocks.push(`  pull_request_review_comment:
+    types: [created]`);
+      conditions.push(gate("pull_request_review_comment", ["github.event.comment.body"], "github.event.comment.author_association"));
+    }
+    if (events2.includes("pull_request_review")) {
+      onBlocks.push(`  pull_request_review:
+    types: [submitted]`);
+      conditions.push(gate("pull_request_review", ["github.event.review.body"], "github.event.review.author_association"));
+    }
+    if (events2.includes("issues")) {
+      onBlocks.push(`  issues:
+    types: [opened, assigned]`);
+      conditions.push(gate("issues", ["github.event.issue.body", "github.event.issue.title"], "github.event.issue.author_association"));
+    }
+  }
+  const jobCondition = conditions.length > 0 ? foldExpression(conditions.join(` ||
+`)) : "false";
+  const artifactName = "ur-agentic-ci-${{ github.run_id }}-${{ github.run_attempt }}";
+  const runUrl = "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}";
+  const acknowledgeJob = `  acknowledge:
     if: >-
       ${jobCondition}
     runs-on: ubuntu-latest
-    timeout-minutes: 35
+    timeout-minutes: 5
+    permissions:
+      issues: write
+      pull-requests: write
+    outputs:
+      issue-number: \${{ steps.track.outputs.issue-number }}
+      comment-id: \${{ steps.track.outputs.comment-id }}
+    steps:
+      - name: React and open a tracking comment
+        id: track
+        env:
+          GH_TOKEN: \${{ github.token }}
+          GH_REPO: \${{ github.repository }}
+          RUN_URL: ${runUrl}
+        run: |
+          set -euo pipefail
+          number="$(jq -r '.issue.number // .pull_request.number // empty' "$GITHUB_EVENT_PATH")"
+          comment="$(jq -r '.comment.id // empty' "$GITHUB_EVENT_PATH")"
+          printf 'issue-number=%s\\n' "$number" >> "$GITHUB_OUTPUT"
+          if [ -z "$number" ]; then
+            printf 'comment-id=\\n' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          case "$GITHUB_EVENT_NAME" in
+            issue_comment)
+              [ -z "$comment" ] || gh api --silent --method POST \\
+                "repos/$GH_REPO/issues/comments/$comment/reactions" \\
+                -f content=eyes || true ;;
+            pull_request_review_comment)
+              [ -z "$comment" ] || gh api --silent --method POST \\
+                "repos/$GH_REPO/pulls/comments/$comment/reactions" \\
+                -f content=eyes || true ;;
+            issues)
+              gh api --silent --method POST \\
+                "repos/$GH_REPO/issues/$number/reactions" \\
+                -f content=eyes || true ;;
+          esac
+          body="UR is working on this. [Follow the run]($RUN_URL)."
+          id="$(jq -n --arg body "$body" '{body: $body}' \\
+            | gh api "repos/$GH_REPO/issues/$number/comments" --input - --jq '.id')"
+          printf 'comment-id=%s\\n' "$id" >> "$GITHUB_OUTPUT"
+
+`;
+  const agentJob = `  agent:
+${publishes ? `    needs: acknowledge
+` : ""}    if: >-
+      ${jobCondition}
+    runs-on: ubuntu-latest
+    timeout-minutes: ${spec.runner?.timeoutMinutes ?? 30}
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     steps:
       - name: Checkout trusted base
         uses: actions/checkout@${CHECKOUT_SHA} # v7.0.0
@@ -393239,13 +393542,139 @@ jobs:
         if: always()
         uses: actions/upload-artifact@${UPLOAD_ARTIFACT_SHA} # v4.6.2
         with:
-          name: ur-agentic-ci-\${{ github.run_id }}-\${{ github.run_attempt }}
+          name: ${artifactName}
           path: \${{ runner.temp }}/ur-agentic-ci
           if-no-files-found: error
           retention-days: 7
 `;
+  const pullRequestSteps = `      - name: Checkout for patch application
+        uses: actions/checkout@${CHECKOUT_SHA} # v7.0.0
+        with:
+          fetch-depth: 0
+      - name: Open a pull request from the verified patch
+        id: pr
+        env:
+          GH_TOKEN: \${{ github.token }}
+          BASE_BRANCH: \${{ github.event.repository.default_branch }}
+          RUN_URL: ${runUrl}
+        run: |
+          set -euo pipefail
+          manifest="$(find "$RUNNER_TEMP/ur-agentic-ci-out" -name manifest.json -print -quit 2>/dev/null || true)"
+          if [ -z "$manifest" ]; then exit 0; fi
+          if [ "$(jq -r '.status' "$manifest")" != "passed" ]; then exit 0; fi
+          relative="$(jq -r '.patch.path // empty' "$manifest")"
+          if [ -z "$relative" ]; then exit 0; fi
+          patch="$(dirname "$manifest")/$relative"
+          run_id="$(jq -r '.runId' "$manifest")"
+          branch="ur/agentic-ci-$run_id"
+          git config user.name 'ur-agent[bot]'
+          git config user.email 'ur-agent[bot]@users.noreply.github.com'
+          git checkout -b "$branch" "$(jq -r '.baseSha' "$manifest")"
+          git apply --index --whitespace=nowarn "$patch"
+          git commit -m "UR: apply verified Agentic CI patch ($run_id)"
+          git push origin "HEAD:$branch"
+          jq -r '.summary' "$manifest" > "$RUNNER_TEMP/ur-pr-body.md"
+          printf '\\nPatch sha256: \`%s\`\\n\\n[Run](%s)\\n' \\
+            "$(jq -r '.patch.sha256' "$manifest")" "$RUN_URL" \\
+            >> "$RUNNER_TEMP/ur-pr-body.md"
+          url="$(gh pr create --base "$BASE_BRANCH" --head "$branch" \\
+            --title "UR: verified patch from run $run_id" \\
+            --body-file "$RUNNER_TEMP/ur-pr-body.md")"
+          printf 'url=%s\\n' "$url" >> "$GITHUB_OUTPUT"
+`;
+  const publishJob = `  publish:
+    needs: [acknowledge, agent]
+    if: always() && needs.acknowledge.outputs.comment-id != ''
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: ${publishMode === "pull-request" ? "write" : "read"}
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Download agent outputs
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/ur-agentic-ci-out"
+          gh run download "$GITHUB_RUN_ID" \\
+            --name "${artifactName}" \\
+            --dir "$RUNNER_TEMP/ur-agentic-ci-out" || true
+${publishMode === "pull-request" ? pullRequestSteps : ""}      - name: Report the result in the thread
+        if: always()
+        env:
+          GH_TOKEN: \${{ github.token }}
+          GH_REPO: \${{ github.repository }}
+          COMMENT_ID: \${{ needs.acknowledge.outputs.comment-id }}
+          AGENT_RESULT: \${{ needs.agent.result }}
+          PR_URL: ${publishMode === "pull-request" ? "${{ steps.pr.outputs.url }}" : ""}
+          RUN_URL: ${runUrl}
+        run: |
+          set -euo pipefail
+          manifest="$(find "$RUNNER_TEMP/ur-agentic-ci-out" -name manifest.json -print -quit 2>/dev/null || true)"
+          out="$RUNNER_TEMP/ur-comment.md"
+          if [ -z "$manifest" ]; then
+            {
+              printf '### UR\\n\\n'
+              printf 'The agent job finished as \`%s\` without producing a manifest.\\n\\n' "$AGENT_RESULT"
+              printf '[Inspect the run](%s)\\n' "$RUN_URL"
+            } > "$out"
+          else
+            status="$(jq -r '.status' "$manifest")"
+            case "$status" in
+              passed) icon='PASSED' ;;
+              failed) icon='FAILED' ;;
+              blocked) icon='BLOCKED' ;;
+              *) icon="$status" ;;
+            esac
+            {
+              printf '### UR \u2014 %s\\n\\n' "$icon"
+              jq -r '.summary' "$manifest"
+              printf '\\n'
+              if [ "$(jq -r '.checks | length' "$manifest")" -gt 0 ]; then
+                printf '\\n| Check | Exit | Duration |\\n| --- | --- | --- |\\n'
+                jq -r '.checks[] | "| \\(.name) | \`\\(.exitCode)\` | \\(.durationMs)ms |"' "$manifest"
+              fi
+              if [ "$(jq -r '.violations // [] | length' "$manifest")" -gt 0 ]; then
+                printf '\\n**Policy violations**\\n\\n'
+                jq -r '.violations[] | "- \\(.)"' "$manifest"
+              fi
+              relative="$(jq -r '.patch.path // empty' "$manifest")"
+              if [ -n "$relative" ]; then
+                printf '\\n<details><summary>Proposed patch (%s bytes, sha256 %s)</summary>\\n\\n' \\
+                  "$(jq -r '.patch.bytes' "$manifest")" "$(jq -r '.patch.sha256' "$manifest")"
+                printf '\\n\`\`\`diff\\n'
+                head -c 30000 "$(dirname "$manifest")/$relative" | sed 's/^\`\`\`/ \`\`\`/'
+                printf '\\n\`\`\`\\n\\n</details>\\n'
+              fi
+              if [ -n "\${PR_URL:-}" ]; then
+                printf '\\nOpened %s\\n' "$PR_URL"
+              fi
+              printf '\\n[Full run and artifacts](%s)\\n' "$RUN_URL"
+            } > "$out"
+          fi
+          jq -n --rawfile body "$out" '{body: $body}' \\
+            | gh api --silent --method PATCH \\
+              "repos/$GH_REPO/issues/comments/$COMMENT_ID" --input -
+`;
+  return `name: UR Agentic CI
+
+on:
+${onBlocks.join(`
+`)}
+
+permissions: {}
+
+concurrency:
+  group: ur-agentic-ci-\${{ github.repository }}-\${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+${publishes ? acknowledgeJob : ""}${agentJob}${publishes ? `
+${publishJob}` : ""}`;
 }
-var import_yaml2, AGENTIC_CI_MAX_EVENT_BYTES, AGENTIC_CI_MAX_PROMPT_CHARS, AGENTIC_CI_MAX_SUMMARY_CHARS, AGENTIC_CI_MAX_PATCH_BYTES, AGENTIC_CI_MAX_LOG_CHARS, TRUSTED_GITHUB_ASSOCIATIONS, NAME_RE, SAFE_PATH_RE, SECRET_NAME_RE, CHILD_FORBIDDEN_ENV_RE, HEADLESS_PROVIDER_SECRET_RE, defaultExec2 = async (file2, args, cwd2, timeoutMs, env4) => {
+var import_yaml2, AGENTIC_CI_MAX_EVENT_BYTES, AGENTIC_CI_MAX_PROMPT_CHARS, AGENTIC_CI_MAX_SUMMARY_CHARS, AGENTIC_CI_MAX_PATCH_BYTES, AGENTIC_CI_MAX_LOG_CHARS, TRUSTED_GITHUB_ASSOCIATIONS, AGENTIC_CI_DEFAULT_KEYWORD = "@ur", AGENTIC_CI_DEFAULT_ALIASES, AGENTIC_CI_TRIGGER_EVENTS, AGENTIC_CI_PUBLISH_MODES, NAME_RE, SAFE_PATH_RE, KEYWORD_RE, SECRET_NAME_RE, CHILD_FORBIDDEN_ENV_RE, HEADLESS_PROVIDER_SECRET_RE, defaultExec2 = async (file2, args, cwd2, timeoutMs, env4) => {
   const result = await execFileNoThrowWithCwd(file2, args, {
     cwd: cwd2,
     timeout: timeoutMs ?? 10 * 60000,
@@ -393280,15 +393709,28 @@ var init_agenticCi = __esm(() => {
     "MEMBER",
     "COLLABORATOR"
   ];
+  AGENTIC_CI_DEFAULT_ALIASES = ["/ur"];
+  AGENTIC_CI_TRIGGER_EVENTS = [
+    "issue_comment",
+    "pull_request_review_comment",
+    "pull_request_review",
+    "issues"
+  ];
+  AGENTIC_CI_PUBLISH_MODES = [
+    "artifact",
+    "comment",
+    "pull-request"
+  ];
   NAME_RE = /^[a-z0-9][a-z0-9-_]{0,63}$/i;
   SAFE_PATH_RE = /^[^\0\r\n]{1,512}$/;
+  KEYWORD_RE = /^[A-Za-z0-9@/_+#:.-]{1,64}$/;
   SECRET_NAME_RE = /(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|CREDENTIAL|AUTH)/i;
   CHILD_FORBIDDEN_ENV_RE = /^(?:GITHUB_TOKEN|GH_TOKEN|ACTIONS_ID_TOKEN_REQUEST_TOKEN|ACTIONS_ID_TOKEN_REQUEST_URL|ACTIONS_RUNTIME_TOKEN|ACTIONS_RUNTIME_URL|SSH_AUTH_SOCK)$/;
   HEADLESS_PROVIDER_SECRET_RE = /^(?:URHQ_API_KEY|UR_CODE_OAUTH_TOKEN|URHQ_AUTH_TOKEN|URHQ_FOUNDRY_API_KEY|OPENAI_API_KEY|ANTHROPIC_API_KEY|GEMINI_API_KEY|OPENROUTER_API_KEY|OPENAI_COMPATIBLE_API_KEY|AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN|AWS_BEARER_TOKEN_BEDROCK|AZURE_CLIENT_SECRET|AZURE_CLIENT_CERTIFICATE_PATH|GOOGLE_APPLICATION_CREDENTIALS)$/;
 });
 
 // src/constants/github-app.ts
-var PR_TITLE = "Add UR GitHub Workflow", GITHUB_ACTION_SETUP_DOCS_URL = "https://github.com/Maitham16/UR", urVersion2, WORKFLOW_CONTENT, PR_BODY = `## Installing UR GitHub App
+var import_yaml3, PR_TITLE = "Add UR GitHub Workflow", GITHUB_ACTION_SETUP_DOCS_URL = "https://github.com/Maitham16/UR", urVersion2, WORKFLOW_CONTENT, AGENTIC_CI_SPEC_PATH = ".ur/agentic-ci/default.yaml", AGENTIC_CI_SPEC_CONTENT, PR_BODY = `## Installing UR GitHub App
 
 This PR adds a GitHub Actions workflow that enables UR integration in our repository.
 
@@ -393304,26 +393746,45 @@ This PR adds a GitHub Actions workflow that enables UR integration in our reposi
 
 ### How it works
 
-Once this PR is merged, trusted collaborators can interact with UR by using \`/ur\` in an issue or pull-request comment.
-Once the workflow is triggered, UR will analyze the comment and surrounding context, and execute on the request in a GitHub action.
+Once this PR is merged, trusted collaborators can summon UR by writing \`@ur\` followed by a task:
+
+- an issue comment or pull-request comment
+- an inline review comment on a diff
+- a submitted pull-request review
+- the body or title of a new issue
+
+UR reacts with \uD83D\uDC40, posts a tracking comment, works in an isolated checkout, and
+then edits that comment with the summary, verification results, and the proposed
+patch. The legacy \`/ur\` form still works.
+
+### Files in this PR
+
+- \`.github/workflows/ur.yml\` \u2014 the workflow
+- \`.ur/agentic-ci/default.yaml\` \u2014 the policy spec that governs the run
+
+Edit the spec to change the keyword, the trusted associations, which events are
+allowed, the verification commands, or the writable path allowlist.
 
 ### Important Notes
 
 - **This workflow won't take effect until this PR is merged**
-- The workflow runs for manual dispatches and trusted issue comments containing \`/ur\`
 - Event text is passed as data, never interpolated into shell source
+- \`@urgent\` and mentions inside code fences or quoted replies do not trigger a run
 
 ### Security
 
 - The API key is securely stored as a GitHub Actions secret
-- Only owners, members, and collaborators can trigger comment runs
+- Only owners, members, and collaborators can trigger runs
 - All UR runs are stored in the GitHub Actions run history
-- The agent receives read-only GitHub permissions, runs in a detached worktree,
-  and emits a bounded hash-addressed patch artifact for trusted review
+- The job that reads untrusted comment text holds **no write token**. It runs in
+  a detached worktree and emits a bounded, hash-addressed patch artifact
+- A separate publisher job holds the write scopes and only ever consumes that
+  artifact, so untrusted input and write access never share a job
+- Opening pull requests is opt-in: set \`publish.mode: pull-request\` in the spec
 
 There's more information in the [UR repository](https://github.com/Maitham16/UR).
 
-After merging this PR, try \`/ur investigate this\` in a comment to get started.`, CODE_REVIEW_PLUGIN_WORKFLOW_CONTENT = `name: UR Review
+After merging this PR, try \`@ur investigate this\` in a comment to get started.`, CODE_REVIEW_PLUGIN_WORKFLOW_CONTENT = `name: UR Review
 
 on:
   pull_request:
@@ -393356,10 +393817,12 @@ jobs:
 `;
 var init_github_app = __esm(() => {
   init_agenticCi();
-  urVersion2 = typeof MACRO !== "undefined" ? "1.48.0" : "1.48.0";
+  import_yaml3 = __toESM(require_dist4(), 1);
+  urVersion2 = typeof MACRO !== "undefined" ? "1.50.0" : "1.50.0";
   WORKFLOW_CONTENT = compileAgenticCiWorkflow("default", {
     packageVersion: urVersion2
   });
+  AGENTIC_CI_SPEC_CONTENT = import_yaml3.stringify(defaultAgenticCiSpec("default"));
 });
 
 // src/commands/install-github-app/ApiKeyStep.tsx
@@ -395362,11 +395825,13 @@ async function createWorkflowFile(repoName, branchName, workflowPath, workflowCo
   if (checkFileResult.code === 0) {
     fileSha = checkFileResult.stdout.trim();
   }
+  const ACTION_INPUT = /ur_api_key: \$\{\{ secrets\.UR_API_KEY \}\}/g;
+  const ENV_VAR = /URHQ_API_KEY: \$\{\{ secrets\.UR_API_KEY \}\}/g;
   let content = workflowContent;
   if (secretName === "UR_CODE_OAUTH_TOKEN") {
-    content = workflowContent.replace(/ur_api_key: \$\{\{ secrets\.UR_API_KEY \}\}/g, `ur_oauth_token: \${{ secrets.UR_CODE_OAUTH_TOKEN }}`);
+    content = content.replace(ACTION_INPUT, `ur_oauth_token: \${{ secrets.UR_CODE_OAUTH_TOKEN }}`).replace(ENV_VAR, `UR_CODE_OAUTH_TOKEN: \${{ secrets.UR_CODE_OAUTH_TOKEN }}`);
   } else if (secretName !== "UR_API_KEY") {
-    content = workflowContent.replace(/ur_api_key: \$\{\{ secrets\.UR_API_KEY \}\}/g, `ur_api_key: \${{ secrets.${secretName} }}`);
+    content = content.replace(ACTION_INPUT, `ur_api_key: \${{ secrets.${secretName} }}`).replace(ENV_VAR, `URHQ_API_KEY: \${{ secrets.${secretName} }}`);
   }
   const base64Content = Buffer.from(content).toString("base64");
   const apiParams = [
@@ -395492,6 +395957,11 @@ async function setupGitHubActions(repoName, apiKeyOrOAuthToken, secretName, upda
           content: WORKFLOW_CONTENT,
           message: "UR PR Assistant workflow"
         });
+        workflows.push({
+          path: AGENTIC_CI_SPEC_PATH,
+          content: AGENTIC_CI_SPEC_CONTENT,
+          message: "UR Agentic CI policy spec"
+        });
       }
       if (selectedWorkflows.includes("ur-review")) {
         workflows.push({
@@ -411347,7 +411817,7 @@ function getAllReleaseNotes(changelogContent = getStoredChangelogFromMemory()) {
     return [];
   }
 }
-async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.48.0") {
+async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.50.0") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -411374,7 +411844,7 @@ async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.48.0")
     releaseNotes
   };
 }
-function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.48.0") {
+function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.50.0") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -414231,7 +414701,7 @@ function getRecentActivitySync() {
   return cachedActivity;
 }
 function getLogoDisplayData() {
-  const version2 = process.env.DEMO_VERSION ?? "1.48.0";
+  const version2 = process.env.DEMO_VERSION ?? "1.50.0";
   const serverUrl = getDirectConnectServerUrl();
   const displayPath = process.env.DEMO_VERSION ? "/code/ur" : getDisplayPath(getCwd());
   const cwd2 = serverUrl ? `${displayPath} in ${serverUrl.replace(/^https?:\/\//, "")}` : displayPath;
@@ -415115,7 +415585,7 @@ function LogoV2() {
   if ($2[2] === Symbol.for("react.memo_cache_sentinel")) {
     t2 = () => {
       const currentConfig2 = getGlobalConfig();
-      if (currentConfig2.lastReleaseNotesSeen === "1.48.0") {
+      if (currentConfig2.lastReleaseNotesSeen === "1.50.0") {
         return;
       }
       saveGlobalConfig(_temp327);
@@ -415800,12 +416270,12 @@ function LogoV2() {
   return t41;
 }
 function _temp327(current) {
-  if (current.lastReleaseNotesSeen === "1.48.0") {
+  if (current.lastReleaseNotesSeen === "1.50.0") {
     return current;
   }
   return {
     ...current,
-    lastReleaseNotesSeen: "1.48.0"
+    lastReleaseNotesSeen: "1.50.0"
   };
 }
 function _temp243(s_0) {
@@ -431301,7 +431771,7 @@ runner; \`ur trigger\` is the inbound parser that decides what to run.
       path: ".github/workflows/ur.yml",
       root: "project",
       content: compileAgenticCiWorkflow("default", {
-        packageVersion: typeof MACRO !== "undefined" ? "1.48.0" : "1.48.0"
+        packageVersion: typeof MACRO !== "undefined" ? "1.50.0" : "1.50.0"
       })
     },
     {
@@ -431364,7 +431834,7 @@ function value(tokens, flag) {
   return index2 >= 0 ? tokens[index2 + 1] : undefined;
 }
 function cliVersion() {
-  return typeof MACRO !== "undefined" ? "1.48.0" : "1.48.0";
+  return typeof MACRO !== "undefined" ? "1.50.0" : "1.50.0";
 }
 function workflowPath(cwd2) {
   return join155(cwd2, ".github", "workflows", "ur-agentic-ci.yml");
@@ -437220,7 +437690,7 @@ function createAcpStdioApp(deps) {
       }
     },
     authMethods: [],
-    agentInfo: { name: "UR-Nexus", version: "1.48.0" }
+    agentInfo: { name: "UR-Nexus", version: "1.50.0" }
   })).onRequest("authenticate", () => ({})).onRequest("session/new", async (context6) => {
     const result = runtime2.newSession(context6.params.cwd, context6.params.mcpServers, context6.params.additionalDirectories);
     await runtime2.announce({
@@ -437317,7 +437787,7 @@ function createAcpStdioAgent(deps) {
               }
             },
             authMethods: [],
-            agentInfo: { name: "UR-Nexus", version: "1.48.0" }
+            agentInfo: { name: "UR-Nexus", version: "1.50.0" }
           });
           return;
         case "authenticate":
@@ -438065,7 +438535,7 @@ var init_connect2 = __esm(() => {
 });
 
 // src/services/agents/scheduler.ts
-import { createHash as createHash35 } from "crypto";
+import { createHash as createHash36 } from "crypto";
 import { existsSync as existsSync39, mkdirSync as mkdirSync30, unlinkSync as unlinkSync8, writeFileSync as writeFileSync30 } from "fs";
 import { homedir as homedir31 } from "os";
 import { join as join157 } from "path";
@@ -438073,7 +438543,7 @@ function defaultBin() {
   return { file: process.execPath, args: [process.argv[1] ?? ""] };
 }
 function schedulerLabel(cwd2) {
-  const hash3 = createHash35("sha1").update(cwd2).digest("hex").slice(0, 8);
+  const hash3 = createHash36("sha1").update(cwd2).digest("hex").slice(0, 8);
   return `com.ur.automation.${hash3}`;
 }
 function detectPlatform() {
@@ -440450,7 +440920,7 @@ function statePath(cwd2, name) {
 }
 function parseWorkflowText(text) {
   const trimmed = text.trim();
-  const parsed = trimmed.startsWith("{") ? safeParseJSON(trimmed, false) : import_yaml4.parse(trimmed);
+  const parsed = trimmed.startsWith("{") ? safeParseJSON(trimmed, false) : import_yaml5.parse(trimmed);
   if (!parsed || typeof parsed !== "object") {
     throw new Error("Workflow is not an object");
   }
@@ -440632,7 +441102,7 @@ function saveWorkflow(cwd2, spec, options2 = {}) {
   if (existsSync44(path22) && options2.force !== true) {
     return { path: path22, created: false };
   }
-  writeFileSync34(path22, `${import_yaml4.stringify(spec)}`);
+  writeFileSync34(path22, `${import_yaml5.stringify(spec)}`);
   return { path: path22, created: true };
 }
 function loadRunState(cwd2, name) {
@@ -440758,10 +441228,10 @@ function formatRunPlan(plan) {
   return lines.join(`
 `);
 }
-var import_yaml4, KNOWN_AGENTS, NAME_RE2, GATE_LABEL;
+var import_yaml5, KNOWN_AGENTS, NAME_RE2, GATE_LABEL;
 var init_workflows = __esm(() => {
   init_json();
-  import_yaml4 = __toESM(require_dist4(), 1);
+  import_yaml5 = __toESM(require_dist4(), 1);
   KNOWN_AGENTS = [
     "general-purpose",
     "worker",
@@ -442258,7 +442728,7 @@ function normalizeSkillStep(raw, index2) {
 }
 function parseSkillYaml(text) {
   const trimmed = text.trim();
-  const parsed = trimmed.startsWith("{") ? safeParseJSON(trimmed, false) : import_yaml5.parse(trimmed);
+  const parsed = trimmed.startsWith("{") ? safeParseJSON(trimmed, false) : import_yaml6.parse(trimmed);
   if (!parsed || typeof parsed !== "object") {
     throw new Error("Skill spec is not an object");
   }
@@ -442515,12 +442985,12 @@ Executable skill for ${name}.
   };
 }
 function stringifySkillYaml(spec) {
-  return import_yaml5.stringify(spec);
+  return import_yaml6.stringify(spec);
 }
-var import_yaml5, SKILL_YAML_FILE = "skill.yaml", SKILL_INSTRUCTIONS_FILE = "instructions.md", NAME_RE3;
+var import_yaml6, SKILL_YAML_FILE = "skill.yaml", SKILL_INSTRUCTIONS_FILE = "instructions.md", NAME_RE3;
 var init_skillSpec = __esm(() => {
   init_json();
-  import_yaml5 = __toESM(require_dist4(), 1);
+  import_yaml6 = __toESM(require_dist4(), 1);
   NAME_RE3 = /^[a-z0-9][a-z0-9-_]{0,63}$/i;
 });
 
@@ -442529,7 +442999,7 @@ var exports_skill = {};
 __export(exports_skill, {
   call: () => call66
 });
-import { generateKeyPairSync, randomUUID as randomUUID47 } from "crypto";
+import { generateKeyPairSync as generateKeyPairSync2, randomUUID as randomUUID47 } from "crypto";
 import {
   chmodSync as chmodSync8,
   existsSync as existsSync47,
@@ -442697,7 +443167,7 @@ var VALUE_OPTIONS, call66 = async (args) => {
       if (existingKeys[name]) {
         throw new Error(`Trusted key ID already exists: ${name}`);
       }
-      const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+      const { privateKey, publicKey } = generateKeyPairSync2("ed25519");
       const privatePem = privateKey.export({ type: "pkcs8", format: "pem" });
       const publicPem = publicKey.export({ type: "spki", format: "pem" }).toString();
       mkdirSync37(dirname68(privatePath), { recursive: true, mode: 448 });
@@ -443069,11 +443539,11 @@ var init_worktree2 = __esm(() => {
 });
 
 // src/services/agents/auditExport.ts
-import { createHash as createHash36 } from "crypto";
+import { createHash as createHash37 } from "crypto";
 import { existsSync as existsSync48, readFileSync as readFileSync48 } from "fs";
 import { join as join168 } from "path";
 function chainHash(prev, payload) {
-  return createHash36("sha256").update(prev).update(JSON.stringify(payload)).digest("hex");
+  return createHash37("sha256").update(prev).update(JSON.stringify(payload)).digest("hex");
 }
 function readActionsLedger(cwd2) {
   const path22 = join168(cwd2, ".ur", "actions.jsonl");
@@ -443540,7 +444010,7 @@ var init_recipe2 = __esm(() => {
 });
 
 // src/services/agents/arena.ts
-import { createHash as createHash37, randomUUID as randomUUID48 } from "crypto";
+import { createHash as createHash38, randomUUID as randomUUID48 } from "crypto";
 import {
   existsSync as existsSync52,
   mkdirSync as mkdirSync39,
@@ -443989,7 +444459,7 @@ async function removeWorktree(cwd2, worktree2) {
   rmSync12(worktree2, { recursive: true, force: true });
 }
 function sha2563(value2) {
-  return createHash37("sha256").update(value2).digest("hex");
+  return createHash38("sha256").update(value2).digest("hex");
 }
 function sanitizeCandidate(candidate, retainWorktree = false) {
   return {
@@ -444401,7 +444871,7 @@ function createDefaultManagedCloudClient() {
 var init_cloudManagedRunner = () => {};
 
 // src/services/agents/cloudTasks.ts
-import { createHash as createHash38, randomUUID as randomUUID50 } from "crypto";
+import { createHash as createHash39, randomUUID as randomUUID50 } from "crypto";
 import { spawn as spawn14 } from "child_process";
 import {
   appendFileSync as appendFileSync6,
@@ -444434,8 +444904,8 @@ function ensureCloudDirectory(cwd2) {
   assertSafeStateNode(directory, "directory");
 }
 function boundedInteger(value2, fallback, minimum, maximum) {
-  const numeric = typeof value2 === "number" ? value2 : typeof value2 === "string" && /^\d+$/u.test(value2.trim()) ? Number(value2) : Number.NaN;
-  return Number.isSafeInteger(numeric) && numeric >= minimum ? Math.min(numeric, maximum) : fallback;
+  const numeric2 = typeof value2 === "number" ? value2 : typeof value2 === "string" && /^\d+$/u.test(value2.trim()) ? Number(value2) : Number.NaN;
+  return Number.isSafeInteger(numeric2) && numeric2 >= minimum ? Math.min(numeric2, maximum) : fallback;
 }
 function secretValues() {
   return Object.entries(process.env).filter(([name, value2]) => isSecretLikeSubprocessEnvName(name) && (value2?.length ?? 0) >= 6).map(([, value2]) => value2).sort((left, right) => right.length - left.length);
@@ -445065,7 +445535,7 @@ async function steerCloudTask(cwd2, id, message, options2 = {}) {
       reason: "message must be between 1 byte and 64 KiB"
     };
   }
-  const messageSha256 = createHash38("sha256").update(trimmed).digest("hex");
+  const messageSha256 = createHash39("sha256").update(trimmed).digest("hex");
   const reservation = withManifestMutation(cwd2, (manifest) => {
     const task = manifest.tasks.find((candidate) => candidate.id === id);
     if (!task)
@@ -449809,7 +450279,7 @@ var init_escalate2 = __esm(() => {
 });
 
 // src/services/agents/learnedPlaybooks.ts
-import { createHash as createHash39 } from "crypto";
+import { createHash as createHash40 } from "crypto";
 import {
   chmodSync as chmodSync10,
   existsSync as existsSync66,
@@ -449824,7 +450294,7 @@ function storePath(cwd2) {
   return join185(learningDir2(cwd2), "playbooks.json");
 }
 function digest3(value2) {
-  return `sha256:${createHash39("sha256").update(JSON.stringify(value2)).digest("hex")}`;
+  return `sha256:${createHash40("sha256").update(JSON.stringify(value2)).digest("hex")}`;
 }
 function emptyStore() {
   return { version: 1, candidates: [] };
@@ -450029,7 +450499,7 @@ function mineLearnedPlaybooks(cwd2, options2 = {}) {
     }));
     generated.push({
       version: 1,
-      id: `lp-${createHash39("sha256").update(fingerprint2).digest("hex").slice(0, 16)}`,
+      id: `lp-${createHash40("sha256").update(fingerprint2).digest("hex").slice(0, 16)}`,
       name,
       status: "candidate",
       revision: 1,
@@ -453996,7 +454466,7 @@ var init_sdk2 = __esm(() => {
 });
 
 // src/services/agents/trajectory.ts
-import { createHash as createHash40 } from "crypto";
+import { createHash as createHash41 } from "crypto";
 function record3(value2) {
   return value2 && typeof value2 === "object" ? value2 : {};
 }
@@ -454009,7 +454479,7 @@ function normalizeTrajectoryTool(value2) {
 function opaqueId(value2) {
   if (typeof value2 !== "string" || !value2)
     return;
-  return createHash40("sha256").update(value2).digest("hex").slice(0, 16);
+  return createHash41("sha256").update(value2).digest("hex").slice(0, 16);
 }
 function contentBlocks(message) {
   const content = record3(message).content;
@@ -456950,7 +457420,7 @@ var init_os2 = __esm(() => {
 });
 
 // src/services/agents/workspaceCoordinator.ts
-import { createHash as createHash41, randomUUID as randomUUID53 } from "crypto";
+import { createHash as createHash42, randomUUID as randomUUID53 } from "crypto";
 import { existsSync as existsSync76, lstatSync as lstatSync18, realpathSync as realpathSync15, rmSync as rmSync17 } from "fs";
 import { tmpdir as tmpdir13 } from "os";
 import { dirname as dirname72, isAbsolute as isAbsolute42, join as join195, relative as relative46, resolve as resolve63 } from "path";
@@ -456970,7 +457440,7 @@ function assertId(value2, label) {
     throw new Error(`Invalid ${label}: ${value2}`);
 }
 function hash3(value2) {
-  return `sha256:${createHash41("sha256").update(value2).digest("hex")}`;
+  return `sha256:${createHash42("sha256").update(value2).digest("hex")}`;
 }
 function stableJson4(value2) {
   if (Array.isArray(value2))
@@ -458055,7 +458525,7 @@ var init_project2 = __esm(() => {
 });
 
 // src/ur/notes.ts
-import { createHash as createHash42 } from "crypto";
+import { createHash as createHash43 } from "crypto";
 import { appendFileSync as appendFileSync7, existsSync as existsSync77, mkdirSync as mkdirSync57, readFileSync as readFileSync72, writeFileSync as writeFileSync58 } from "fs";
 import { dirname as dirname73, join as join196 } from "path";
 function readJsonl(file2) {
@@ -458079,7 +458549,7 @@ function append2(file2, rec) {
 }
 function memorySlug(text) {
   const words = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").split("-").filter(Boolean).slice(0, 8).join("-");
-  const hash4 = createHash42("sha1").update(text).digest("hex").slice(0, 8);
+  const hash4 = createHash43("sha1").update(text).digest("hex").slice(0, 8);
   return `${words || "remembered-note"}-${hash4}`;
 }
 function yamlSingleQuote(value2) {
@@ -459076,7 +459546,7 @@ var init_code_index2 = __esm(() => {
 
 // node_modules/typescript/lib/typescript.js
 var require_typescript2 = __commonJS((exports, module) => {
-  var __dirname = "/Users/maith/Desktop/ur3-dev/UR-1.43.3/node_modules/typescript/lib", __filename = "/Users/maith/Desktop/ur3-dev/UR-1.43.3/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/sessions/great-laughing-cerf/mnt/UR-1.49.0/node_modules/typescript/lib", __filename = "/sessions/great-laughing-cerf/mnt/UR-1.49.0/node_modules/typescript/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -590216,7 +590686,7 @@ ${newComment.split(`
           }
         }
         return result;
-        function escapeRegExp3(str2) {
+        function escapeRegExp4(str2) {
           return str2.replace(/[-[\]/{}()*+?.\\^$|]/g, "\\$&");
         }
         function getTodoCommentsRegExp() {
@@ -590224,7 +590694,7 @@ ${newComment.split(`
           const multiLineCommentStart = /(?:\/\*+\s*)/.source;
           const anyNumberOfSpacesAndAsterisksAtStartOfLine = /(?:^(?:\s|\*)*)/.source;
           const preamble = "(" + anyNumberOfSpacesAndAsterisksAtStartOfLine + "|" + singleLineCommentStart + "|" + multiLineCommentStart + ")";
-          const literals = "(?:" + map3(descriptors2, (d3) => "(" + escapeRegExp3(d3.text) + ")").join("|") + ")";
+          const literals = "(?:" + map3(descriptors2, (d3) => "(" + escapeRegExp4(d3.text) + ")").join("|") + ")";
           const endOfLineOrEndOfComment = /(?:$|\*\/)/.source;
           const messageRemainder = /(?:.*?)/.source;
           const messagePortion = "(" + literals + messageRemainder + ")";
@@ -609484,14 +609954,14 @@ ${content}
     function getOrganizeImportsUnicodeStringComparer(ignoreCase, preferences) {
       const resolvedLocale = getOrganizeImportsLocale(preferences);
       const caseFirst = preferences.organizeImportsCaseFirst ?? false;
-      const numeric = preferences.organizeImportsNumericCollation ?? false;
+      const numeric2 = preferences.organizeImportsNumericCollation ?? false;
       const accents = preferences.organizeImportsAccentCollation ?? true;
       const sensitivity = ignoreCase ? accents ? "accent" : "base" : accents ? "variant" : "case";
       const collator = new Intl.Collator(resolvedLocale, {
         usage: "sort",
         caseFirst: caseFirst || "false",
         sensitivity,
-        numeric
+        numeric: numeric2
       });
       return collator.compare;
     }
@@ -644796,7 +645266,7 @@ async function captureMemoryDiagnostics(trigger2, dumpNumber = 0) {
     smapsRollup,
     platform: process.platform,
     nodeVersion: process.version,
-    ccVersion: "1.48.0"
+    ccVersion: "1.50.0"
   };
 }
 async function performHeapDump(trigger2 = "manual", dumpNumber = 0) {
@@ -645382,7 +645852,7 @@ var init_bridge_kick = __esm(() => {
 var call145 = async () => {
   return {
     type: "text",
-    value: "1.48.0"
+    value: "1.50.0"
   };
 }, version2, version_default;
 var init_version = __esm(() => {
@@ -656500,7 +656970,7 @@ function generateHtmlReport(data, insights) {
 </html>`;
 }
 function buildExportData(data, insights, facets, remoteStats) {
-  const version3 = typeof MACRO !== "undefined" ? "1.48.0" : "unknown";
+  const version3 = typeof MACRO !== "undefined" ? "1.50.0" : "unknown";
   const remote_hosts_collected = remoteStats?.hosts.filter((h2) => h2.sessionCount > 0).map((h2) => h2.name);
   const facets_summary = {
     total: facets.size,
@@ -660833,7 +661303,7 @@ var init_sessionStorage = __esm(() => {
   init_settings2();
   init_slowOperations();
   init_uuid();
-  VERSION7 = typeof MACRO !== "undefined" ? "1.48.0" : "unknown";
+  VERSION7 = typeof MACRO !== "undefined" ? "1.50.0" : "unknown";
   MAX_TOMBSTONE_REWRITE_BYTES = 50 * 1024 * 1024;
   SKIP_FIRST_PROMPT_PATTERN = /^(?:\s*<[a-z][\w-]*[\s>]|\[Request interrupted by user[^\]]*\])/;
   EPHEMERAL_PROGRESS_TYPES = new Set([
@@ -662048,7 +662518,7 @@ var init_filesystem = __esm(() => {
   });
   getBundledSkillsRoot = memoize_default(function getBundledSkillsRoot2() {
     const nonce = randomBytes19(16).toString("hex");
-    return join224(getURTempDir(), "bundled-skills", "1.48.0", nonce);
+    return join224(getURTempDir(), "bundled-skills", "1.50.0", nonce);
   });
   getResolvedWorkingDirPaths = memoize_default(getPathsForPermissionCheck);
 });
@@ -667900,7 +668370,7 @@ var init_prompts4 = __esm(() => {
 });
 
 // src/utils/api.ts
-import { createHash as createHash43 } from "crypto";
+import { createHash as createHash44 } from "crypto";
 function filterSwarmFieldsFromSchema(toolName, schema) {
   const fieldsToRemove = SWARM_FIELDS_BY_TOOL[toolName];
   if (!fieldsToRemove || fieldsToRemove.length === 0) {
@@ -667990,7 +668460,7 @@ function logAPIPrefix(systemPrompt) {
   logEvent("tengu_sysprompt_block", {
     snippet: firstSystemPrompt?.slice(0, 20),
     length: firstSystemPrompt?.length ?? 0,
-    hash: firstSystemPrompt ? createHash43("sha256").update(firstSystemPrompt).digest("hex") : ""
+    hash: firstSystemPrompt ? createHash44("sha256").update(firstSystemPrompt).digest("hex") : ""
   });
 }
 function splitSysPromptPrefix(systemPrompt, options4) {
@@ -668316,7 +668786,7 @@ var init_api3 = __esm(() => {
 });
 
 // src/utils/fingerprint.ts
-import { createHash as createHash44 } from "crypto";
+import { createHash as createHash45 } from "crypto";
 function extractFirstMessageText(messages) {
   const firstUserMessage = messages.find((msg) => msg.type === "user");
   if (!firstUserMessage) {
@@ -668338,12 +668808,12 @@ function computeFingerprint(messageText2, version3) {
   const indices = [4, 7, 20];
   const chars = indices.map((i3) => messageText2[i3] || "0").join("");
   const fingerprintInput = `${FINGERPRINT_SALT}${chars}${version3}`;
-  const hash4 = createHash44("sha256").update(fingerprintInput).digest("hex");
+  const hash4 = createHash45("sha256").update(fingerprintInput).digest("hex");
   return hash4.slice(0, 3);
 }
 function computeFingerprintFromMessages(messages) {
   const firstMessageText = extractFirstMessageText(messages);
-  return computeFingerprint(firstMessageText, "1.48.0");
+  return computeFingerprint(firstMessageText, "1.50.0");
 }
 var FINGERPRINT_SALT = "59cf53e54c78";
 var init_fingerprint = () => {};
@@ -670239,7 +670709,7 @@ async function sideQuery(opts) {
     betas.push(STRUCTURED_OUTPUTS_BETA_HEADER);
   }
   const messageText2 = extractFirstUserMessageText(messages);
-  const fingerprint2 = computeFingerprint(messageText2, "1.48.0");
+  const fingerprint2 = computeFingerprint(messageText2, "1.50.0");
   const attributionHeader = getAttributionHeader(fingerprint2);
   const systemBlocks = [
     attributionHeader ? { type: "text", text: attributionHeader } : null,
@@ -675010,7 +675480,7 @@ function buildSystemInitMessage(inputs) {
     slash_commands: inputs.commands.filter((c4) => c4.userInvocable !== false).map((c4) => c4.name),
     apiKeySource: getURHQApiKeyWithSource().source,
     betas: getSdkBetas(),
-    ur_version: "1.48.0",
+    ur_version: "1.50.0",
     output_style: outputStyle2,
     agents: inputs.agents.map((agent2) => agent2.agentType),
     skills: inputs.skills.filter((s) => s.userInvocable !== false).map((skill2) => skill2.name),
@@ -688870,7 +689340,7 @@ var init_useVoiceEnabled = __esm(() => {
 function getSemverPart(version3) {
   return `${import_semver13.major(version3, { loose: true })}.${import_semver13.minor(version3, { loose: true })}.${import_semver13.patch(version3, { loose: true })}`;
 }
-function useUpdateNotification(updatedVersion, initialVersion = "1.48.0") {
+function useUpdateNotification(updatedVersion, initialVersion = "1.50.0") {
   const [lastNotifiedSemver, setLastNotifiedSemver] = import_react228.useState(() => getSemverPart(initialVersion));
   if (!updatedVersion) {
     return null;
@@ -688919,7 +689389,7 @@ function AutoUpdater({
       return;
     }
     if (false) {}
-    const currentVersion = "1.48.0";
+    const currentVersion = "1.50.0";
     const channel = getInitialSettings()?.autoUpdatesChannel ?? "latest";
     let latestVersion = await getLatestVersion(channel);
     const isDisabled = isAutoUpdaterDisabled();
@@ -689148,12 +689618,12 @@ function NativeAutoUpdater({
     logEvent("tengu_native_auto_updater_start", {});
     try {
       const maxVersion = await getMaxVersion();
-      if (maxVersion && gt("1.48.0", maxVersion)) {
+      if (maxVersion && gt("1.50.0", maxVersion)) {
         const msg = await getMaxVersionMessage();
         setMaxVersionIssue(msg ?? "affects your version");
       }
       const result = await installLatest(channel);
-      const currentVersion = "1.48.0";
+      const currentVersion = "1.50.0";
       const latencyMs = Date.now() - startTime;
       if (result.lockFailed) {
         logEvent("tengu_native_auto_updater_lock_contention", {
@@ -689290,17 +689760,17 @@ function PackageManagerAutoUpdater(t0) {
       const maxVersion = await getMaxVersion();
       if (maxVersion && latest && gt(latest, maxVersion)) {
         logForDebugging(`PackageManagerAutoUpdater: maxVersion ${maxVersion} is set, capping update from ${latest} to ${maxVersion}`);
-        if (gte("1.48.0", maxVersion)) {
-          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.48.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
+        if (gte("1.50.0", maxVersion)) {
+          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.50.0"} is already at or above maxVersion ${maxVersion}, skipping update`);
           setUpdateAvailable(false);
           return;
         }
         latest = maxVersion;
       }
-      const hasUpdate = latest && !gte("1.48.0", latest) && !shouldSkipVersion(latest);
+      const hasUpdate = latest && !gte("1.50.0", latest) && !shouldSkipVersion(latest);
       setUpdateAvailable(!!hasUpdate);
       if (hasUpdate) {
-        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.48.0"} -> ${latest}`);
+        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.50.0"} -> ${latest}`);
       }
     };
     $2[0] = t1;
@@ -689334,7 +689804,7 @@ function PackageManagerAutoUpdater(t0) {
       wrap: "truncate",
       children: [
         "currentVersion: ",
-        "1.48.0"
+        "1.50.0"
       ]
     }, undefined, true, undefined, this);
     $2[3] = verbose;
@@ -693673,7 +694143,7 @@ var require_version_check = __commonJS((exports) => {
 
 // node_modules/qrcode/lib/core/regex.js
 var require_regex = __commonJS((exports) => {
-  var numeric = "[0-9]+";
+  var numeric2 = "[0-9]+";
   var alphanumeric = "[A-Z $%*+\\-./:]+";
   var kanji = "(?:[u3000-u303F]|[u3040-u309F]|[u30A0-u30FF]|" + "[uFF00-uFFEF]|[u4E00-u9FAF]|[u2605-u2606]|[u2190-u2195]|u203B|" + "[u2010u2015u2018u2019u2025u2026u201Cu201Du2225u2260]|" + "[u0391-u0451]|[u00A7u00A8u00B1u00B4u00D7u00F7])+";
   kanji = kanji.replace(/u/g, "\\u");
@@ -693682,10 +694152,10 @@ var require_regex = __commonJS((exports) => {
   exports.KANJI = new RegExp(kanji, "g");
   exports.BYTE_KANJI = new RegExp("[^A-Z0-9 $%*+\\-./:]+", "g");
   exports.BYTE = new RegExp(byte, "g");
-  exports.NUMERIC = new RegExp(numeric, "g");
+  exports.NUMERIC = new RegExp(numeric2, "g");
   exports.ALPHANUMERIC = new RegExp(alphanumeric, "g");
   var TEST_KANJI = new RegExp("^" + kanji + "$");
-  var TEST_NUMERIC = new RegExp("^" + numeric + "$");
+  var TEST_NUMERIC = new RegExp("^" + numeric2 + "$");
   var TEST_ALPHANUMERIC = new RegExp("^[A-Z0-9 $%*+\\-./:]+$");
   exports.testKanji = function testKanji(str2) {
     return TEST_KANJI.test(str2);
@@ -700031,7 +700501,7 @@ function buildStatusLineCommandInput(permissionMode, exceeds200kTokens, settings
       project_dir: getOriginalCwd(),
       added_dirs: addedDirs
     },
-    version: "1.48.0",
+    version: "1.50.0",
     output_style: {
       name: outputStyleName
     },
@@ -700114,7 +700584,7 @@ function StatusLineInner({
   const taskValues = Object.values(tasks2);
   const taskRunningCount = taskValues.filter((task2) => task2.status === "running" || task2.status === "pending").length;
   const defaultStatusLineText = buildDefaultStatusBar({
-    version: "1.48.0",
+    version: "1.50.0",
     providerLabel: providerRuntime.providerLabel,
     authMode: providerRuntime.authLabel,
     model: providerRuntime.model ?? renderModelName(mainLoopModel),
@@ -712257,7 +712727,7 @@ async function submitTranscriptShare(messages, trigger2, appearanceId) {
     } catch {}
     const data = {
       trigger: trigger2,
-      version: "1.48.0",
+      version: "1.50.0",
       platform: process.platform,
       transcript,
       subagentTranscripts: Object.keys(subagentTranscripts).length > 0 ? subagentTranscripts : undefined,
@@ -724543,7 +725013,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "1.48.0"
+              "1.50.0"
             ]
           }, undefined, true, undefined, this)
         ]
@@ -725803,7 +726273,7 @@ function completeOnboarding() {
   saveGlobalConfig((current) => ({
     ...current,
     hasCompletedOnboarding: true,
-    lastOnboardingVersion: "1.48.0"
+    lastOnboardingVersion: "1.50.0"
   }));
 }
 function showDialog(root2, renderer) {
@@ -730847,7 +731317,7 @@ function appendToLog(path24, message) {
     cwd: getFsImplementation().cwd(),
     userType: process.env.USER_TYPE,
     sessionId: getSessionId(),
-    version: "1.48.0"
+    version: "1.50.0"
   };
   getLogWriter(path24).write(messageWithTimestamp);
 }
@@ -735006,8 +735476,8 @@ async function getEnvLessBridgeConfig() {
 }
 async function checkEnvLessBridgeMinVersion() {
   const cfg = await getEnvLessBridgeConfig();
-  if (cfg.min_version && lt("1.48.0", cfg.min_version)) {
-    return `Your version of UR (${"1.48.0"}) is too old for Remote Control.
+  if (cfg.min_version && lt("1.50.0", cfg.min_version)) {
+    return `Your version of UR (${"1.50.0"}) is too old for Remote Control.
 Version ${cfg.min_version} or higher is required. Run \`ur update\` to update.`;
   }
   return null;
@@ -735481,7 +735951,7 @@ async function initBridgeCore(params) {
   const rawApi = createBridgeApiClient({
     baseUrl,
     getAccessToken,
-    runnerVersion: "1.48.0",
+    runnerVersion: "1.50.0",
     onDebug: logForDebugging,
     onAuth401,
     getTrustedDeviceToken
@@ -744829,7 +745299,7 @@ __export(exports_agUi, {
   getAgUiCapabilities: () => getAgUiCapabilities,
   createAgUiHttpHandler: () => createAgUiHttpHandler
 });
-import { createHash as createHash45 } from "crypto";
+import { createHash as createHash46 } from "crypto";
 function isLoopback4(host) {
   const normalized = host.toLowerCase();
   return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1" || normalized === "0:0:0:0:0:0:0:1";
@@ -744886,7 +745356,7 @@ function authenticate(request, token) {
   }
   return {
     ok: true,
-    owner: `bearer:${createHash45("sha256").update(supplied).digest("base64url")}`
+    owner: `bearer:${createHash46("sha256").update(supplied).digest("base64url")}`
   };
 }
 function allowedOrigin(request, allowedOrigins) {
@@ -744950,7 +745420,7 @@ function getAgUiCapabilities() {
       name: "UR-Nexus",
       type: "ur-nexus",
       description: "Provider-flexible, local-first autonomous engineering workflow agent.",
-      version: "1.48.0",
+      version: "1.50.0",
       provider: "UR",
       documentationUrl: "https://github.com/Maitham16/UR/blob/master/docs/AG_UI.md"
     },
@@ -746090,7 +746560,7 @@ function createMCPServer(cwd4, debug2, verbose) {
   };
   const server2 = new Server({
     name: "ur-nexus",
-    version: "1.48.0"
+    version: "1.50.0"
   }, {
     capabilities: {
       tools: {}
@@ -747103,7 +747573,7 @@ __export(exports_mcp2026, {
   createUrMcp2026Runtime: () => createUrMcp2026Runtime,
   createMcp2026HttpHandler: () => createMcp2026HttpHandler
 });
-import { createHash as createHash46 } from "crypto";
+import { createHash as createHash47 } from "crypto";
 function isRecord7(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
@@ -747144,7 +747614,7 @@ function authenticate2(request, token) {
   }
   return {
     ok: true,
-    owner: `bearer:${createHash46("sha256").update(supplied).digest("base64url")}`
+    owner: `bearer:${createHash47("sha256").update(supplied).digest("base64url")}`
   };
 }
 function response(status2, body, origin2, extraHeaders = {}) {
@@ -747248,7 +747718,7 @@ function thrownResponse(error40) {
 }
 async function createUrMcp2026Runtime(options4) {
   const server2 = createMCPServer(options4.cwd, options4.debug === true, options4.verbose === true);
-  const client2 = new Client({ name: "ur-mcp-2026-adapter", version: "1.48.0" }, { capabilities: {} });
+  const client2 = new Client({ name: "ur-mcp-2026-adapter", version: "1.50.0" }, { capabilities: {} });
   const [clientTransport, serverTransport] = createLinkedTransportPair();
   try {
     await server2.connect(serverTransport);
@@ -747259,7 +747729,7 @@ async function createUrMcp2026Runtime(options4) {
   }
   const runtime2 = new Mcp2026Runtime({
     cwd: options4.cwd,
-    version: "1.48.0",
+    version: "1.50.0",
     backend: {
       listTools: async () => {
         const listed = await client2.listTools();
@@ -749392,7 +749862,7 @@ async function update() {
   logEvent("tengu_update_check", {});
   const diagnostic2 = await getDoctorDiagnostic();
   const result = await checkUpgradeStatus({
-    currentVersion: "1.48.0",
+    currentVersion: "1.50.0",
     packageName: UR_AGENT_PACKAGE_NAME,
     installationType: diagnostic2.installationType,
     latestVersion: () => getLatestNpmPackageVersion(UR_AGENT_PACKAGE_NAME)
@@ -750708,7 +751178,7 @@ ${customInstructions}` : customInstructions;
       }
     }
     logForDiagnosticsNoPII("info", "started", {
-      version: "1.48.0",
+      version: "1.50.0",
       is_native_binary: isInBundledMode()
     });
     registerCleanup(async () => {
@@ -751494,7 +751964,7 @@ Usage: ur --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("1.48.0 (UR-Nexus)", "-v, --version", "Output the version number");
+  }).version("1.50.0 (UR-Nexus)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -752510,7 +752980,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"1.48.0"} (UR-Nexus)`);
+    console.log(`${"1.50.0"} (UR-Nexus)`);
     return;
   }
   if (args[0] === "a2a" && args[1] === "serve" && !args.includes("--help") && !args.includes("-h")) {