ur-agent 1.65.4 → 1.65.6

package/CHANGELOG.md

@@ -1,5 +1,91 @@
 # Changelog
 
+## 1.65.6
+
+- Remote sessions no longer reconnect forever when the server repeatedly
+  accepts a WebSocket upgrade and then reports that the session is missing.
+  Repeated `connect()` calls reuse the live client, malformed permission and
+  cancellation frames fail safely, and the cancellation wire type now matches
+  the runtime schema.
+- Tool execution can no longer silently run zero tools because of a negative
+  concurrency setting. Concurrency is normalized to a bounded range, and
+  serial or parallel tool cancellation always clears in-progress state.
+- Replaced scattered and sometimes unsafe model instructions with one compact,
+  ordered execution contract shared by normal, minimal, and remote modes. It
+  preserves structured tool use, dependency-aware parallel calls, result
+  observation, recovery, verification, honest completion, and prompt-injection
+  boundaries while removing guesses such as forcing system Python package
+  installs. Ollama retains an explicit native-tool discipline and may use text
+  recovery only when the runtime says native tools are unavailable.
+- Tool calls are normalized and validated again at the final execution
+  boundary, including permission-hook rewrites. Unknown tools, duplicate IDs,
+  malformed object inputs, and unsafe read-to-write rewrites fail closed.
+  Ollama/Kimi streaming repairs supported split calls without turning invalid
+  arguments into empty objects, deduplicates cumulative frames, and preserves
+  distinct same-name calls.
+- Task planning now uses dependency-ordered lifecycle guidance, atomic
+  task-store updates, transactional dependency checks, and strict gate reads.
+  Mutations are classified at execution time, delegation cannot consume the
+  short-task allowance, and completion claims are rejected while actionable
+  tasks remain or task state cannot be verified.
+- Repeated failing calls now use bounded SHA-256 identities with per-query
+  cleanup, TTL and capacity limits, so large or sensitive tool inputs are not
+  retained. Identical failures are refused and eventually abort the turn;
+  corrected inputs are allowed immediately.
+- `ur crew` now runs independent workers in parallel, honors dependency
+  fan-in, claims work across processes, and supports bounded respawns with
+  backoff and cancellation. Automatic retries use isolated fresh worktrees;
+  ambiguous shared-workspace mutations are never replayed.
+- Hardened the upstream proxy relay against unterminated or overflowing
+  protobuf varints, half-open rejected HTTP clients, and synchronous WebSocket
+  constructor failures.
+- Terminal UI layouts now remain valid in very small windows. Search pickers,
+  fullscreen modals, dividers, highlighted code, the startup logo, and cursor
+  widths clamp or reflow instead of overflowing; empty picker focus,
+  Meta-key punctuation/input-buffer handling, prompt-footer sizing, live-model
+  status refreshes, and task progress presentation are corrected.
+- Hardened IDE state storage against symlink redirection, oversized or corrupt
+  state, and interrupted writes. The VS Code chat now treats an abnormal
+  process exit as failure even after a result frame, bounds NDJSON/stderr
+  buffering, validates webview messages, and improves keyboard focus, live
+  status, alert, and attachment accessibility.
+- The Node launcher now enforces the declared Bun minimum, including
+  prerelease ordering, rather than checking only whether a `bun` executable
+  exists.
+- Release automation now runs the validated serial Bun test command (parallel
+  workers currently collide on ephemeral test servers), grants the permissions
+  needed to download verified artifacts, keeps
+  prereleases off npm's `latest` tag, marks GitHub prereleases correctly,
+  validates every version-bearing surface, supports safe prerelease bumps, and
+  cleans package-check temporary state. Validation docs and historical
+  changelog ordering were corrected.
+
+## 1.65.5
+
+- Syntax highlighting works again — in assistant messages, code previews and
+  question dialogs. `cli-highlight` was imported by four rendering surfaces and
+  declared in `package.json` by none of them, so the import threw on every run
+  and every code block rendered as unstyled plain text. Three things had to
+  line up for this to stay invisible for as long as it did: the loader caught
+  the resolution failure and returned `null` with no message, the import is
+  dynamic so the bundler resolved it lazily rather than failing the build, and
+  an ambient `declare module 'cli-highlight' { const value: any }` shim
+  satisfied the typechecker on a package that was not installed. The dependency
+  is declared, the shim is gone (the package ships real types), and a failed
+  load now says so instead of silently degrading.
+- Added `test/declaredDependencies.test.ts`: every external module imported by
+  `src` must be declared, aliased in `tsconfig` paths, or carry an ambient shim.
+  A full scan found no other genuine gap — `@urhq-ai/sdk` is a path alias, and
+  `plist`, `cacache` and `turndown` are deliberate optional degradations.
+- The task-list gate no longer blocks simple one-file requests. Its allowance
+  for short work counted *messages* rather than tool calls, so any conversation
+  at all pushed the count past the threshold and the gate refused the very
+  first `Write` — exactly the case the allowance exists to let through.
+- The status bar showed the persisted `provider.model` rather than the live
+  session model, so `/model` changed what ran without changing what was
+  displayed. The correct value was already in scope and used only as a
+  fallback. The render key had the same omission, so even the right source
+  could leave a stale value on screen after a switch.
 ## 1.65.4
 
 - A tool call that keeps failing identically is now stopped. A 4B model refused
@@ -1632,36 +1718,6 @@ Top-tier feature release — closes the gaps against 2026's leading agents.
   `FileEditTool.call`.
 - Verified source and production bundle release checks for the `1.22.6` build.
 
-## 1.22.3
-
-### Added
-- **Executable skill directories.** A `.ur/skills/<name>/` directory containing
-  `skill.yaml` is now an executable skill that compiles into a `WorkflowSpec`.
-  Supports `instructions.md`, `scripts/`, `templates/`, and `checklists/`.
-  `src/skills/skillSpec.ts` parses, validates, and compiles skills; step prompts
-  support `$ARGUMENTS`, `$0..$N`, and `$ARGUMENTS[N]` substitution.
-- **`ur skill` CLI.** New command surface: `ur skill list`, `ur skill show <name>`,
-  `ur skill run <name> [args]`, and `ur skill init <name>`. Registered in
-  `src/commands.ts` and `src/main.tsx`.
-- **Semantic repo index.** `src/utils/codeIndex/repoIndex.ts` builds offline,
-  dependency-free indexes under `.ur/code-index/`: `repo.json` (file
-  classification + imports/importedBy), `symbols.json`, `calls.json`,
-  `tests.json`, `docs.json`, and `configs.json`. `ur code-index repo` exposes
-  `build|status|search|symbols|callers|tests|docs|configs` subcommands.
-- **`--repo` flag for code-index build/watch.** `ur code-index build --repo`
-  builds both the embedding index and the repo index; `watch --repo` refreshes
-  the repo index on file changes.
-
-### Changed
-- Reused the existing workflow engine for executable skills and extended the
-  existing `ur code-index` surface for the repo index, keeping changes additive.
-
-### Verified
-- Added `test/skillSpec.test.ts`, `test/skillCommand.test.ts`, and
-  `test/repoIndex.test.ts` covering skill parsing, compilation, CLI scaffolding,
-  repo file classification, symbol/call/test/doc/config extraction, and index
-  round-trips.
-
 ## 1.22.5
 
 ### Added
@@ -1716,6 +1772,36 @@ Top-tier feature release — closes the gaps against 2026's leading agents.
   import updates, rollback on check failure, move, organize imports, unused
   detection, and caller mapping.
 
+## 1.22.3
+
+### Added
+- **Executable skill directories.** A `.ur/skills/<name>/` directory containing
+  `skill.yaml` is now an executable skill that compiles into a `WorkflowSpec`.
+  Supports `instructions.md`, `scripts/`, `templates/`, and `checklists/`.
+  `src/skills/skillSpec.ts` parses, validates, and compiles skills; step prompts
+  support `$ARGUMENTS`, `$0..$N`, and `$ARGUMENTS[N]` substitution.
+- **`ur skill` CLI.** New command surface: `ur skill list`, `ur skill show <name>`,
+  `ur skill run <name> [args]`, and `ur skill init <name>`. Registered in
+  `src/commands.ts` and `src/main.tsx`.
+- **Semantic repo index.** `src/utils/codeIndex/repoIndex.ts` builds offline,
+  dependency-free indexes under `.ur/code-index/`: `repo.json` (file
+  classification + imports/importedBy), `symbols.json`, `calls.json`,
+  `tests.json`, `docs.json`, and `configs.json`. `ur code-index repo` exposes
+  `build|status|search|symbols|callers|tests|docs|configs` subcommands.
+- **`--repo` flag for code-index build/watch.** `ur code-index build --repo`
+  builds both the embedding index and the repo index; `watch --repo` refreshes
+  the repo index on file changes.
+
+### Changed
+- Reused the existing workflow engine for executable skills and extended the
+  existing `ur code-index` surface for the repo index, keeping changes additive.
+
+### Verified
+- Added `test/skillSpec.test.ts`, `test/skillCommand.test.ts`, and
+  `test/repoIndex.test.ts` covering skill parsing, compilation, CLI scaffolding,
+  repo file classification, symbol/call/test/doc/config extraction, and index
+  round-trips.
+
 ## 1.22.2
 
 ### Added

package/README.md

@@ -400,7 +400,7 @@ as first-class subcommands in the shipped CLI.
 | `ur task` | Start, run, and hand off worktree-per-task sessions with optional PR creation. |
 | `ur automation` | Store and run project-local scheduled automation specs under `.ur/automations/`. |
 | `ur workflow` | Define, validate, graph, run, and resume declarative agent workflows. |
-| `ur crew` | Run a lead and worker subagent crew over a shared task board; `--decompose` auto-splits tasks with risk/tests/rollback metadata. |
+| `ur crew` | Run dependency-aware worker subagents over a shared task board; independent tasks fan out, while bounded retries require isolated worktrees. |
 | `ur pattern` | Run multi-agent collaboration patterns (PEER, DOE, concurrent, handoff, debate, parallel); `--execute` runs them as a workflow. |
 | `ur goal` | Track long-horizon objectives that persist across sessions. |
 | `ur repo-edit` | Build a repo edit index, plan AST-aware renames, preview patches, and apply with rollback. |
@@ -572,6 +572,7 @@ ur spec verify checkout --kernel
 ur crew create parser-crew --goal "fix the flaky parser test" --decompose --dry-run
 ur crew plan parser-crew --goal "fix the flaky parser test" --decompose
 ur crew run parser-crew --workers 3 --decompose --dry-run
+ur crew run parser-crew --workers 3 --worktrees --max-attempts 2
 ur pattern parallel "refactor login without changing behavior" --execute --dry-run
 ur arena "implement a debounce helper" --agents 3 --judge hybrid --verify "bun test"
 ur agent-ci init default

package/RELEASE.md

@@ -54,15 +54,26 @@ rg -n "Version [0-9]|expected: [0-9]|UR-Nexus v[0-9]" README.md docs documentati
 bun test test/docsCoverage.test.ts test/docsCommands.test.ts
 ```
 
+Run the repository-owned bump script so dependency ranges cannot be changed by
+an accidental text replacement:
+
+```bash
+node scripts/version-bump.mjs <next-version>
+```
+
 Version bump checklist (all versioned release surfaces must move together):
 
 1. `package.json` `version`
 2. `bunfig.toml` `MACRO.VERSION`
-3. `documentation/index.html` version eyebrow
+3. `documentation/index.html` version eyebrow and the expected version in
+   `docs/VALIDATION.md`
 4. `extensions/vscode-ur-inline-diffs/package.json` and its lockfile version
    fields (the VSIX test requires them to match the root package version)
 5. `extensions/jetbrains-ur/build.gradle.kts` `version`
-6. Add a `CHANGELOG.md` entry, then run `bun run build` so `dist/cli.js`
+6. The `MACRO.VERSION` fallbacks in `src/commands/agent-ci/agent-ci.ts`,
+   `src/services/agents/agenticCi.ts`, and
+   `src/services/agents/featureScaffolds.ts`
+7. Add a `CHANGELOG.md` entry, then run `bun run build` so `dist/cli.js`
    embeds the new version (`bun run release:check` verifies all of this).
 
 If `npm whoami` fails, run:

package/bin/ur.js

@@ -38,7 +38,10 @@ const bun = process.env.BUN_BIN || process.env.BUN_EXECUTABLE || 'bun'
 const ollamaModel =
   process.env.OLLAMA_MODEL || process.env.UR_MODEL
 const userArgs = process.argv.slice(2)
-const requiredBun = packageMetadata.engines?.bun ?? '>=1.3.0'
+const requiredBun =
+  typeof packageMetadata.engines?.bun === 'string'
+    ? packageMetadata.engines.bun
+    : '>=1.3.0'
 
 function printBunRuntimeError(detail) {
   const attempted = bun
@@ -51,12 +54,62 @@ function printBunRuntimeError(detail) {
   console.error(
     [
       `UR-Nexus requires Bun ${requiredBun} at runtime because the published CLI bundle is built with --target bun.`,
-      `Could not execute "${attempted}" from ${source}.${detail ? ` ${detail}` : ''}`,
+      `Bun executable: "${attempted}" (resolved from ${source}).`,
+      detail,
       'Install Bun from https://bun.sh, or set BUN_BIN to the absolute path of a Bun executable.',
-    ].join('\n'),
+    ].filter(Boolean).join('\n'),
   )
 }
 
+function parseSemver(value) {
+  const match = value.match(
+    /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/,
+  )
+  if (!match) return null
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  }
+}
+
+function compareSemver(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left.core[index] !== right.core[index]) {
+      return left.core[index] > right.core[index] ? 1 : -1
+    }
+  }
+
+  if (left.prerelease.length === 0 && right.prerelease.length === 0) return 0
+  if (left.prerelease.length === 0) return 1
+  if (right.prerelease.length === 0) return -1
+
+  const length = Math.max(left.prerelease.length, right.prerelease.length)
+  for (let index = 0; index < length; index += 1) {
+    const leftPart = left.prerelease[index]
+    const rightPart = right.prerelease[index]
+    if (leftPart === undefined) return -1
+    if (rightPart === undefined) return 1
+    if (leftPart === rightPart) continue
+
+    const leftNumeric = /^\d+$/.test(leftPart)
+    const rightNumeric = /^\d+$/.test(rightPart)
+    if (leftNumeric && rightNumeric) {
+      return Number(leftPart) > Number(rightPart) ? 1 : -1
+    }
+    if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1
+    return leftPart > rightPart ? 1 : -1
+  }
+  return 0
+}
+
+function satisfiesBunEngine(version, range) {
+  const actual = parseSemver(version)
+  const minimumMatch = range.trim().match(/^>=\s*(.+)$/)
+  const minimum = minimumMatch ? parseSemver(minimumMatch[1]) : null
+  if (!actual || !minimum) return null
+  return compareSemver(actual, minimum) >= 0
+}
+
 function assertBunAvailable() {
   const result = spawnSync(bun, ['--version'], {
     encoding: 'utf8',
@@ -64,14 +117,33 @@ function assertBunAvailable() {
   })
 
   if (result.error) {
-    printBunRuntimeError(result.error.message)
+    printBunRuntimeError(`Could not execute Bun: ${result.error.message}`)
     process.exit(1)
   }
   if (result.status !== 0) {
     const detail = (result.stderr || result.stdout || '').trim()
-    printBunRuntimeError(detail || `Exited with status ${result.status}.`)
+    printBunRuntimeError(
+      detail
+        ? `Bun --version failed: ${detail}`
+        : `Bun --version exited with status ${result.status}.`,
+    )
     process.exit(result.status ?? 1)
   }
+
+  const installedBun = result.stdout.trim()
+  const satisfies = satisfiesBunEngine(installedBun, requiredBun)
+  if (satisfies === null) {
+    printBunRuntimeError(
+      `Could not validate Bun version "${installedBun}" against engines.bun "${requiredBun}".`,
+    )
+    process.exit(1)
+  }
+  if (!satisfies) {
+    printBunRuntimeError(
+      `Found Bun ${installedBun}, which does not satisfy engines.bun "${requiredBun}".`,
+    )
+    process.exit(1)
+  }
 }
 
 const args =