ur-agent 1.54.1 → 1.56.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,59 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.56.0
|
|
4
|
+
|
|
5
|
+
- Added a subagent fan-out governor. Agents could spawn agents with no depth or
|
|
6
|
+
concurrency bound, and `/crew`, `/arena`, `/bg fanout` and `/pattern` all
|
|
7
|
+
spawn several at once, so a single prompt could expand into an unbounded tree
|
|
8
|
+
until the machine wedged. Spawning is now refused past a nesting depth of 3
|
|
9
|
+
or 20 concurrent agents, checked before any work starts so a refusal is free.
|
|
10
|
+
The slot is released in the existing `finally`, so an aborted or crashed
|
|
11
|
+
agent cannot strand the budget.
|
|
12
|
+
- Limits are configurable through `agents.maxDepth` and `agents.maxConcurrent`,
|
|
13
|
+
clamped to hard ceilings of 10 and 100. A settings file cannot disable the
|
|
14
|
+
governor, and out-of-range or non-numeric values clamp rather than switching
|
|
15
|
+
it off. Refusal messages name the limit that fired and the setting that
|
|
16
|
+
raises it.
|
|
17
|
+
- Added `src/security/promptInjection.ts`: detection of injection phrasing
|
|
18
|
+
(instruction override, role reassignment, exfiltration, tool coercion, forged
|
|
19
|
+
system turns, secrecy demands, boundary forgery), removal of zero-width and
|
|
20
|
+
bidirectional characters used to hide payloads from human review, a
|
|
21
|
+
nonce-bound content boundary that untrusted text cannot close because it
|
|
22
|
+
cannot predict the nonce, and canary tokens that prove whether a boundary was
|
|
23
|
+
crossed. Framed as detection and privilege separation rather than filtering,
|
|
24
|
+
because no reliable injection classifier exists.
|
|
25
|
+
- Added `denyByDefault` to the Seatbelt profile builder. Without a read
|
|
26
|
+
allowlist the profile previously fell back to `(allow default)` plus targeted
|
|
27
|
+
denials — a blocklist rather than a sandbox, and the shape behind the 2026
|
|
28
|
+
Seatbelt escape write-ups. Opt-in for back-compatibility, since it can break
|
|
29
|
+
agents that read outside the standard runtime roots.
|
|
30
|
+
|
|
31
|
+
## 1.55.0
|
|
32
|
+
|
|
33
|
+
- Narrowed `APIProvider` to the two values `getAPIProvider()` can actually
|
|
34
|
+
return, `'foundry' | 'ollama'`, and let the compiler find every dead branch.
|
|
35
|
+
It surfaced 66 errors across 25 files; all are now resolved and the
|
|
36
|
+
typechecker prevents the class of bug from returning. Comparisons against
|
|
37
|
+
`'firstParty'`, `'bedrock'` and `'vertex'` had been silently false since the
|
|
38
|
+
provider rewrite, which is what disabled `--effort` and `/fast`.
|
|
39
|
+
- Added `DeploymentKey` for the legacy per-deployment lookup tables in
|
|
40
|
+
`configs.ts`, `deprecation.ts` and `modelStrings.ts`. Those tables are data
|
|
41
|
+
rather than runtime state: they legitimately carry rows for deployments this
|
|
42
|
+
build cannot select, and deleting the rows would have deleted real
|
|
43
|
+
configuration.
|
|
44
|
+
- Replaced the dead comparisons with the named predicates
|
|
45
|
+
`isFirstPartyRuntime()`, `isBedrockRuntime()` and `isVertexRuntime()` instead
|
|
46
|
+
of deleting the branches. Behaviour is identical — all three return false —
|
|
47
|
+
but the intent is now greppable rather than hidden in an impossible
|
|
48
|
+
comparison, and re-enabling a deployment is a one-line change.
|
|
49
|
+
- Fixed one such comparison in `toolSearch.ts` that the compiler could not
|
|
50
|
+
reach because the file carries `@ts-nocheck`. Found by grep after the
|
|
51
|
+
typechecker was clean; it was the only one.
|
|
52
|
+
- `/memory-suggest` now seeds its dedup set from stored memory — the
|
|
53
|
+
`/remember` notes store, `UR.md`, `UR.local.md` and the auto-memory
|
|
54
|
+
entrypoint — so a fact already recorded is no longer proposed back. Each
|
|
55
|
+
source is best-effort; an unreadable one narrows dedup rather than failing.
|
|
56
|
+
|
|
3
57
|
## 1.54.1
|
|
4
58
|
|
|
5
59
|
- Fixed `/speak`, `/computer`, `/memory-suggest`, `/import-session` and
|