ur-agent 1.63.0 → 1.64.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,46 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.64.1
|
|
4
|
+
|
|
5
|
+
- Fixed `npm install -g ur-agent` failing with
|
|
6
|
+
`No matching version found for playwright-core@^1.64.0`. Releases 1.61.2,
|
|
7
|
+
1.62.0, 1.63.0 and 1.64.0 were uninstallable: the version bump was a
|
|
8
|
+
`sed 's/OLD/NEW/g' package.json`, and `playwright-core` happened to sit at
|
|
9
|
+
`^1.61.1` — the same version UR was on — so the substitution rewrote the
|
|
10
|
+
dependency too, then cascaded with every later bump to a version that does
|
|
11
|
+
not exist. The built artifact and every test were fine; only `npm install`
|
|
12
|
+
failed, on other people's machines.
|
|
13
|
+
- Version bumping is now `scripts/version-bump.mjs`, which edits JSON files as
|
|
14
|
+
JSON and touches only the top-level `version` key, and uses anchored patterns
|
|
15
|
+
for text files that cannot match a dependency range.
|
|
16
|
+
- Added `test/dependencyIntegrity.test.ts`: no dependency range may equal the
|
|
17
|
+
UR version, which is the exact fingerprint of a bump that matched too much.
|
|
18
|
+
Verified it fails when the historical break is reintroduced.
|
|
19
|
+
|
|
20
|
+
## 1.64.0
|
|
21
|
+
|
|
22
|
+
- Tool-result pruning now announces itself. It changed context silently, so
|
|
23
|
+
there was no way to confirm it fired or to attribute a missing detail to it —
|
|
24
|
+
the same defect memory suggestions had when they went to stderr. A prune now
|
|
25
|
+
prints what it removed and how many tokens that freed.
|
|
26
|
+
- Corrected the fan-out drill, which tested the wrong limit. Asking for 30
|
|
27
|
+
subagents in one turn cannot reach `agents.maxConcurrent`, because
|
|
28
|
+
`MAX_CONCURRENT_TOOLS` caps a single turn at 8 — so the run reported an
|
|
29
|
+
unrelated cap and I mistook that for the governor being unreachable. It is
|
|
30
|
+
reachable by nesting: 8 roots, each spawning more, hits 20 and fires naming
|
|
31
|
+
the setting. The drill now exercises that path.
|
|
32
|
+
- Added a manual drill for tool-result pruning. It only fires inside a live
|
|
33
|
+
query loop, so no automated drill can reach it.
|
|
34
|
+
- Added opt-in signing of the memory integrity manifest via
|
|
35
|
+
`UR_MEMORY_INTEGRITY_KEY`. Unsigned, anyone who can write a memory file can
|
|
36
|
+
rewrite the manifest to match and pass verification; the HMAC raises that to
|
|
37
|
+
needing the key. Off by default because a key stored beside the data it
|
|
38
|
+
protects is theatre.
|
|
39
|
+
- `verify` exits non-zero on an invalid signature — the first implementation
|
|
40
|
+
detected forgery and still exited 0, because a forged manifest updates the
|
|
41
|
+
digests so every tamper count reads zero. A manifest that is signed but
|
|
42
|
+
unverifiable also fails, rather than passing on an unperformed check.
|
|
43
|
+
|
|
3
44
|
## 1.63.0
|
|
4
45
|
|
|
5
46
|
- Added size-triggered pruning of superseded tool results
|