ur-agent 1.68.10 → 1.68.17

package/CHANGELOG.md

@@ -1,5 +1,131 @@
 # Changelog
 
+## 1.68.17
+
+- Fixed false `TaskListRequired` failures for observational Bash capability
+  checks. Task tracking now has a classification distinct from permission
+  auto-approval, so an executable probe can remain permission- and
+  sandbox-sensitive without being mislabeled as a workspace change.
+- The Bash classification is category-based rather than tailored to one
+  module: known reads, exact help/version checks, command-presence checks, and
+  import-only Python probes for any module can run without reopening a
+  completed task. Arbitrary interpreter code, output writes, background
+  execution, sandbox overrides, and unknown commands remain task-gated.
+- Both the initial call and its final post-permission input are classified.
+  Hooks or permission handlers therefore cannot rewrite an observational probe
+  into an untracked mutation.
+
+## 1.68.16
+
+- First pieces of the UR Nexus visual identity, as terminal primitives rather
+  than artwork: `constants/urPalette.ts` (obsidian/bronze/electrum/lapis tokens
+  in true-colour, ANSI-256 and monochrome tiers, with depth detection),
+  `constants/urOrnament.ts` (frieze bands, the four border styles, the gate
+  brand mark), and `utils/statusBarItems.ts` (width-aware status-bar registry).
+- The ornaments are thin box-drawing strokes, not solid blocks. Heavy glyphs
+  (▟▙██) were tried first and read as chunky sprites against a design built
+  from fine line-work. Everything renders on macOS Terminal, GNOME Terminal,
+  Konsole, Alacritty, foot and over SSH — no image protocol, so no user gets a
+  degraded version of the identity.
+- Friezes tile to an exact width and truncate rather than pad: a band that
+  overshoots its column budget wraps, and a wrapped frieze reads as corruption
+  rather than decoration. The ASCII gate is cell-for-cell the same size as the
+  Unicode one so a fallback does not shift the layout.
+- Status-bar items degrade by dropping whole items, lowest priority first,
+  after trying short forms — never by truncating the assembled string, which
+  cuts through whichever number sits at the boundary.
+- Section 11 of the design spec lists context usage at priority 2 but its own
+  narrow-width example keeps `ctx` while dropping state and agents. The
+  examples win: at a glance the two things worth knowing are how far along the
+  work is and how much room is left. Drop order is now an explicit per-item
+  rank rather than emerging from zone position.
+
+## 1.68.15
+
+- Reconstructed three more stub type files, clearing 177 further errors:
+  `keybindings/types.ts` (six empty interfaces), `ink/cursor.ts`, and
+  `commands/plugin/unifiedTypes.ts`. Same defect as the MCP types in 1.68.14 —
+  an empty interface means "has no members" to TypeScript, not "shape unknown",
+  so every property access on one was an error and the consuming files carried
+  `@ts-nocheck` as a result.
+- `KeybindingBlock.bindings` is keyed by chord string, not an array. A first
+  attempt typed it `ParsedBinding[]`, which made every entry in the default
+  binding table an error — the declaration form (`'ctrl+d': 'app:exit'`) and the
+  parsed form (chord resolved into keystrokes) are different shapes, and
+  conflating them broke a file that had been fine.
+- `KeybindingAction` is a string rather than a union of known actions:
+  `defaultBindings.ts` assembles entries conditionally from feature flags, so a
+  value missing from a union would turn a working binding into an error.
+- Suppression list: 140 -> 132. Eight keybinding and ink files came off.
+- Totals for the sweep so far: 223 -> 132 files, 868 -> 563 errors, and almost
+  none of it file-by-file. Four stub files accounted for 258 errors on their
+  own.
+
+## 1.68.14
+
+- Gave the MCP settings types their real shapes. `components/mcp/types.ts`
+  declared seven **empty** interfaces under a "Stub: not included in leaked
+  source" comment. An empty interface does not mean "unknown shape" to
+  TypeScript, it means "has no members" — so every property access on one was an
+  error, and that single file produced ~221 of the 858 errors sitting behind
+  `@ts-nocheck`. The MCP menus were not wrong; their types were.
+- The shapes are reconstructed from what the components actually access, with
+  `transport` as a literal discriminant so the server union narrows on
+  `transport === 'stdio'` instead of collapsing. Fields whose internals the UI
+  never inspects are `Record<string, unknown>` rather than `any`, so a consumer
+  must still narrow before reaching inside.
+- 118 errors cleared, `MCPAgentServerMenu` off the suppression list (141 -> 140).
+- Method note: of 42 files carrying exactly one error, nine shared one cause;
+  221 more came from this one stub. These cluster, so the productive next step
+  is grouping by error signature rather than opening files one at a time.
+
+## 1.68.13
+
+- Eight more files came off `@ts-nocheck` (149 -> 141) from a single fix. The
+  compiled signature of `useRegisterOverlay(id, t0)` declared two required
+  parameters while its own first statement reads
+  `const enabled = t0 === undefined ? true : t0` — the argument was optional by
+  construction and required by declaration, so every caller passing only an id
+  was a type error. Marking it optional cleared 10 errors across 10 files.
+- That is the shape worth looking for in the rest: of 42 files carrying exactly
+  one error, nine shared this one cause. The remaining suppressed files surface
+  ~858 errors, and the useful next step is grouping them by cause rather than
+  working through them file by file.
+
+## 1.68.12
+
+- The Ollama request path now reports where a request's bytes actually go —
+  tool definitions, system prompt, conversation — once per session in the debug
+  log. The fixed cost of tools plus system prompt is what decides whether a
+  small-context model has room left to work, and until now it had only been
+  estimated by summing prompt source. That estimate is wrong by construction:
+  these prompts are full of `condition ? longText : shortText`, and summing the
+  file counts both branches when only one is ever sent. The measurement is
+  taken from the serialized request, so it is what the server receives.
+- Reported as a share of the whole with the tool-definition count, because
+  "system prompt is large" and "conversation is large" call for opposite fixes
+  and are indistinguishable in a single total.
+
+## 1.68.11
+
+- Investigated turning the task-list gate advisory by default and did not do
+  it. The friction it causes is real, but the gate is also the final
+  revalidation before a tool executes, and defaulting it off removes two
+  properties nothing else provides: a permission handler or hook that rewrites
+  a read-only call into a mutating one is re-checked *after* the rewrite, and
+  task state is re-read at execution time so a plan that disappears while
+  permission is pending cannot let the mutation through. Eight tests in
+  `toolExecutionFinalInput` fail the moment enforcement is defaulted off, all
+  on those two paths. The rule and its revalidation are not separable: the
+  re-read is how the rule is applied at execution time, so with no rule there
+  is nothing to revalidate.
+- The friction had two causes and both are already fixed forward: the
+  allowance counted messages instead of tool calls, so the gate fired on the
+  first Write (1.65.5), and the TodoWrite prompt had lost its worked examples,
+  so smaller models stopped producing task lists at all (1.68.0). The gate is
+  reached far less often as a result. `tasks.requireBeforeChanges.enabled`
+  remains available for anyone who wants it off knowingly.
+
 ## 1.68.10
 
 - `ToolSearchTool` no longer registers on runtimes where it cannot work. Its

package/dist/cli.js

@@ -57524,6 +57524,7 @@ __export(exports_ollama, {
   getOllamaModelDefaultTimeoutMs: () => getOllamaModelDefaultTimeoutMs,
   getEffectiveOllamaBaseUrl: () => getEffectiveOllamaBaseUrl,
   dropStaleImagesFromRequest: () => dropStaleImagesFromRequest,
+  describeRequestComposition: () => describeRequestComposition,
   describeOversizedOllamaRequest: () => describeOversizedOllamaRequest,
   describeImageRetry: () => describeImageRetry,
   createOllamaURHQClient: () => createOllamaURHQClient,
@@ -57596,6 +57597,7 @@ async function fetchOllamaChat(params, stream4, controller, options, baseUrl = g
     const textToolFallbackAllowed = (params.tools?.length ?? 0) > 0 && !modelCapabilityEnabled(capabilities, "tools");
     const chatRequest = toOllamaChatRequest(params, stream4, capabilities, baseUrl);
     const requestBody = JSON.stringify(chatRequest);
+    logRequestComposition(chatRequest, requestBody.length);
     let response = await fetch(`${baseUrl}/api/chat`, {
       method: "POST",
       headers: buildOllamaHeaders(),
@@ -57647,6 +57649,19 @@ async function fetchOllamaChat(params, stream4, controller, options, baseUrl = g
 function isOllamaRequestTooLarge(status, message) {
   return (status === 400 || status === 413) && /request body too large|payload too large|entity too large/i.test(message);
 }
+function describeRequestComposition(request, totalBytes) {
+  const toolBytes = request.tools ? JSON.stringify(request.tools).length : 0;
+  const systemBytes = request.messages.filter((message) => message.role === "system").reduce((sum, message) => sum + JSON.stringify(message).length, 0);
+  const conversationBytes = Math.max(0, totalBytes - toolBytes - systemBytes);
+  const pct = (n2) => totalBytes > 0 ? `${Math.round(100 * n2 / totalBytes)}%` : "0%";
+  return `request ${formatBytes(totalBytes)} = ` + `tools ${formatBytes(toolBytes)} (${pct(toolBytes)}, ` + `${request.tools?.length ?? 0} defs) + ` + `system ${formatBytes(systemBytes)} (${pct(systemBytes)}) + ` + `conversation ${formatBytes(conversationBytes)} (${pct(conversationBytes)})`;
+}
+function logRequestComposition(request, totalBytes) {
+  if (loggedComposition)
+    return;
+  loggedComposition = true;
+  logForDebugging(`[ollama] ${describeRequestComposition(request, totalBytes)}`);
+}
 function formatBytes(bytes) {
   if (bytes >= 1024 * 1024)
     return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
@@ -58682,7 +58697,7 @@ function parseToolInput(input) {
   }
   return normalized;
 }
-var DEFAULT_OLLAMA_REQUEST_TIMEOUT_MS = 300000, REMOTE_OLLAMA_REQUEST_TIMEOUT_MS = 120000, CLOUD_OLLAMA_REQUEST_TIMEOUT_MS = 120000, KIMI_CLOUD_REQUEST_TIMEOUT_MS = 300000, OLLAMA_GATEWAY_TIMEOUT_MESSAGE = "Ollama gateway timed out while waiting for the model to respond. Check the selected Ollama endpoint or increase API_TIMEOUT_MS if the model needs more time.", ollamaModelCapabilitiesCache, warnedToolsUnsupportedModels, TEXT_TOOL_CALL_HINT, pendingProviderNotice = null, LEVELED_THINK_MODEL_RE;
+var DEFAULT_OLLAMA_REQUEST_TIMEOUT_MS = 300000, REMOTE_OLLAMA_REQUEST_TIMEOUT_MS = 120000, CLOUD_OLLAMA_REQUEST_TIMEOUT_MS = 120000, KIMI_CLOUD_REQUEST_TIMEOUT_MS = 300000, OLLAMA_GATEWAY_TIMEOUT_MESSAGE = "Ollama gateway timed out while waiting for the model to respond. Check the selected Ollama endpoint or increase API_TIMEOUT_MS if the model needs more time.", ollamaModelCapabilitiesCache, loggedComposition = false, warnedToolsUnsupportedModels, TEXT_TOOL_CALL_HINT, pendingProviderNotice = null, LEVELED_THINK_MODEL_RE;
 var init_ollama = __esm(() => {
   init_urhq_sdk();
   init_ollamaModels();
@@ -75702,7 +75717,7 @@ var init_auth = __esm(() => {
 
 // src/utils/userAgent.ts
 function getURCodeUserAgent() {
-  return `ur/${"1.68.10"}`;
+  return `ur/${"1.68.17"}`;
 }
 
 // src/utils/workloadContext.ts
@@ -75724,7 +75739,7 @@ function getUserAgent() {
   const clientApp = process.env.UR_AGENT_SDK_CLIENT_APP ? `, client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}` : "";
   const workload = getWorkload();
   const workloadSuffix = workload ? `, workload/${workload}` : "";
-  return `ur-cli/${"1.68.10"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
+  return `ur-cli/${"1.68.17"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
 }
 function getMCPUserAgent() {
   const parts = [];
@@ -75738,7 +75753,7 @@ function getMCPUserAgent() {
     parts.push(`client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}`);
   }
   const suffix = parts.length > 0 ? ` (${parts.join(", ")})` : "";
-  return `ur/${"1.68.10"}${suffix}`;
+  return `ur/${"1.68.17"}${suffix}`;
 }
 function getWebFetchUserAgent() {
   return `UR-User (${getURCodeUserAgent()})`;
@@ -75876,7 +75891,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "1.68.10",
+      appVersion: "1.68.17",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -84076,7 +84091,7 @@ var init_metadata = __esm(() => {
   COMPOUND_OPERATOR_REGEX = /\s*(?:&&|\|\||[;|])\s*/;
   WHITESPACE_REGEX = /\s+/;
   getVersionBase = memoize_default(() => {
-    const match = "1.68.10".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "1.68.17".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -84116,7 +84131,7 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isURCodeAction: isEnvTruthy(process.env.UR_CODE_ACTION),
       isURAiAuth: isURAISubscriber(),
-      version: "1.68.10",
+      version: "1.68.17",
       versionBase: getVersionBase(),
       buildTime: "",
       deploymentEnvironment: env2.detectDeploymentEnvironment(),
@@ -84786,7 +84801,7 @@ function initialize1PEventLogging() {
   const platform2 = getPlatform();
   const attributes = {
     [import_semantic_conventions4.ATTR_SERVICE_NAME]: "ur",
-    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.68.10"
+    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.68.17"
   };
   if (platform2 === "wsl") {
     const wslVersion = getWslVersion();
@@ -84814,7 +84829,7 @@ function initialize1PEventLogging() {
       })
     ]
   });
-  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.68.10");
+  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.68.17");
 }
 async function reinitialize1PEventLoggingIfConfigChanged() {
   if (!is1PEventLoggingEnabled() || !firstPartyEventLoggerProvider) {
@@ -94702,7 +94717,7 @@ function formatAgentTrendReport(report = buildAgentTrendReport()) {
 function formatA2AAgentCard(options = {}, pretty = true) {
   return JSON.stringify(buildA2AAgentCard(options), null, pretty ? 2 : 0);
 }
-var urVersion = "1.68.10", researchSnapshotDate = "2026-07-15", coverage, priorityRoadmap;
+var urVersion = "1.68.17", researchSnapshotDate = "2026-07-15", coverage, priorityRoadmap;
 var init_trends = __esm(() => {
   init_a2aCardSignature();
   coverage = [
@@ -97505,7 +97520,7 @@ function getAttributionHeader(fingerprint) {
   if (!isAttributionHeaderEnabled()) {
     return "";
   }
-  const version2 = `${"1.68.10"}.${fingerprint}`;
+  const version2 = `${"1.68.17"}.${fingerprint}`;
   const entrypoint = process.env.UR_CODE_ENTRYPOINT ?? "unknown";
   const cch = "";
   const workload = getWorkload();
@@ -155383,7 +155398,7 @@ var init_projectSafety = __esm(() => {
 function getInstruments() {
   if (instruments)
     return instruments;
-  const meter = import_api10.metrics.getMeter("ur-agent.gen_ai", "1.68.10");
+  const meter = import_api10.metrics.getMeter("ur-agent.gen_ai", "1.68.17");
   instruments = {
     operationDuration: meter.createHistogram("gen_ai.client.operation.duration", {
       description: "GenAI operation duration.",
@@ -155481,7 +155496,7 @@ function genAiAgentAttributes() {
     "gen_ai.operation.name": GEN_AI_OPERATION_INVOKE_AGENT,
     "gen_ai.provider.name": "ur",
     "gen_ai.agent.name": "UR-Nexus",
-    "gen_ai.agent.version": "1.68.10"
+    "gen_ai.agent.version": "1.68.17"
   };
 }
 function genAiWorkflowAttributes(workflowName) {
@@ -155497,7 +155512,7 @@ function genAiWorkflowAttributes(workflowName) {
 function startGenAiWorkflowSpan(workflowName) {
   const attributes = genAiWorkflowAttributes(workflowName);
   const name = typeof attributes["gen_ai.workflow.name"] === "string" ? `invoke_workflow ${attributes["gen_ai.workflow.name"]}` : GEN_AI_OPERATION_INVOKE_WORKFLOW;
-  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.68.10").startSpan(name, { kind: import_api10.SpanKind.INTERNAL, attributes });
+  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.68.17").startSpan(name, { kind: import_api10.SpanKind.INTERNAL, attributes });
 }
 function endGenAiWorkflowSpan(span, options2 = {}) {
   try {
@@ -155535,7 +155550,7 @@ function startGenAiMemorySpan(operation, options2 = {}) {
   if (options2.recordCount !== undefined && Number.isInteger(options2.recordCount) && options2.recordCount >= 0) {
     attributes["gen_ai.memory.record.count"] = options2.recordCount;
   }
-  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.68.10").startSpan(operation, { kind: import_api10.SpanKind.INTERNAL, attributes });
+  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.68.17").startSpan(operation, { kind: import_api10.SpanKind.INTERNAL, attributes });
 }
 function endGenAiMemorySpan(span, options2 = {}) {
   try {
@@ -249018,7 +249033,7 @@ function getTelemetryAttributes() {
     attributes["session.id"] = sessionId;
   }
   if (shouldIncludeAttribute("OTEL_METRICS_INCLUDE_VERSION")) {
-    attributes["app.version"] = "1.68.10";
+    attributes["app.version"] = "1.68.17";
   }
   const oauthAccount = getOauthAccountInfo();
   if (oauthAccount) {
@@ -295498,7 +295513,7 @@ function getInstallationEnv() {
   return;
 }
 function getURCodeVersion() {
-  return "1.68.10";
+  return "1.68.17";
 }
 async function getInstalledVSCodeExtensionVersion(command) {
   const { stdout } = await execFileNoThrow(command, ["--list-extensions", "--show-versions"], {
@@ -302829,7 +302844,7 @@ async function setupSdkMcpClients(sdkMcpConfigs, sendMcpMessage) {
     const client2 = new Client({
       name: "ur",
       title: "UR",
-      version: "1.68.10",
+      version: "1.68.17",
       description: "UR-Nexus autonomous engineering workflow engine",
       websiteUrl: PRODUCT_URL
     }, {
@@ -303189,7 +303204,7 @@ var init_client5 = __esm(() => {
       const client2 = new Client({
         name: "ur",
         title: "UR",
-        version: "1.68.10",
+        version: "1.68.17",
         description: "UR-Nexus autonomous engineering workflow engine",
         websiteUrl: PRODUCT_URL
       }, {
@@ -315728,7 +315743,7 @@ async function createRuntime() {
   bootstrapTelemetry();
   const resource = defaultResource().merge(detectResources({ detectors: [envDetector] })).merge(resourceFromAttributes({
     [import_semantic_conventions7.ATTR_SERVICE_NAME]: "ur-agent",
-    [import_semantic_conventions7.ATTR_SERVICE_VERSION]: "1.68.10"
+    [import_semantic_conventions7.ATTR_SERVICE_VERSION]: "1.68.17"
   }));
   const tracerProvider = exporters.traces.length > 0 ? new BasicTracerProvider({
     resource,
@@ -315761,11 +315776,11 @@ async function createRuntime() {
   setMeterProvider(meterProvider);
   setLoggerProvider(loggerProvider);
   if (meterProvider) {
-    const meter = meterProvider.getMeter("ur-agent", "1.68.10");
+    const meter = meterProvider.getMeter("ur-agent", "1.68.17");
     setMeter(meter, (name, options2) => meter.createCounter(name, options2));
   }
   if (loggerProvider) {
-    setEventLogger(loggerProvider.getLogger("ur-agent.events", "1.68.10"));
+    setEventLogger(loggerProvider.getLogger("ur-agent.events", "1.68.17"));
   }
   if (!cleanupRegistered2) {
     cleanupRegistered2 = true;
@@ -316427,9 +316442,9 @@ async function assertMinVersion() {
   if (false) {}
   try {
     const versionConfig = await getDynamicConfig_BLOCKS_ON_INIT("tengu_version_config", { minVersion: "0.0.0" });
-    if (versionConfig.minVersion && lt("1.68.10", versionConfig.minVersion)) {
+    if (versionConfig.minVersion && lt("1.68.17", versionConfig.minVersion)) {
       console.error(`
-It looks like your version of UR (${"1.68.10"}) needs an update.
+It looks like your version of UR (${"1.68.17"}) needs an update.
 A newer version (${versionConfig.minVersion} or higher) is required to continue.
 
 To update, please run:
@@ -316645,7 +316660,7 @@ async function installGlobalPackage(specificVersion) {
     logError2(new AutoUpdaterError("Another process is currently installing an update"));
     logEvent("tengu_auto_updater_lock_contention", {
       pid: process.pid,
-      currentVersion: "1.68.10"
+      currentVersion: "1.68.17"
     });
     return "in_progress";
   }
@@ -316654,7 +316669,7 @@ async function installGlobalPackage(specificVersion) {
     if (!env2.isRunningWithBun() && env2.isNpmFromWindowsPath()) {
       logError2(new Error("Windows NPM detected in WSL environment"));
       logEvent("tengu_auto_updater_windows_npm_in_wsl", {
-        currentVersion: "1.68.10"
+        currentVersion: "1.68.17"
       });
       console.error(`
 Error: Windows NPM detected in WSL
@@ -317189,7 +317204,7 @@ function detectLinuxGlobPatternWarnings() {
 }
 async function getDoctorDiagnostic() {
   const installationType = await getCurrentInstallationType();
-  const version2 = typeof MACRO !== "undefined" ? "1.68.10" : "unknown";
+  const version2 = typeof MACRO !== "undefined" ? "1.68.17" : "unknown";
   const installationPath = await getInstallationPath();
   const invokedBinary = getInvokedBinary();
   const multipleInstallations = await detectMultipleInstallations();
@@ -318124,8 +318139,8 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
     const maxVersion = await getMaxVersion();
     if (maxVersion && gt(version2, maxVersion)) {
       logForDebugging(`Native installer: maxVersion ${maxVersion} is set, capping update from ${version2} to ${maxVersion}`);
-      if (gte("1.68.10", maxVersion)) {
-        logForDebugging(`Native installer: current version ${"1.68.10"} is already at or above maxVersion ${maxVersion}, skipping update`);
+      if (gte("1.68.17", maxVersion)) {
+        logForDebugging(`Native installer: current version ${"1.68.17"} is already at or above maxVersion ${maxVersion}, skipping update`);
         logEvent("tengu_native_update_skipped_max_version", {
           latency_ms: Date.now() - startTime,
           max_version: maxVersion,
@@ -318136,7 +318151,7 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
       version2 = maxVersion;
     }
   }
-  if (!forceReinstall && version2 === "1.68.10" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
+  if (!forceReinstall && version2 === "1.68.17" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
     logForDebugging(`Found ${version2} at ${executablePath}, skipping install`);
     logEvent("tengu_native_update_complete", {
       latency_ms: Date.now() - startTime,
@@ -385622,6 +385637,59 @@ var init_prompt22 = __esm(() => {
   init_prompt2();
 });
 
+// src/tools/BashTool/taskListReadOnly.ts
+function isPurePythonImportScript(script) {
+  const statements = script.split(";").map((statement) => statement.trim()).filter(Boolean);
+  return statements.length > 0 && statements.every((statement) => IMPORT_STATEMENT.test(statement) || FROM_IMPORT_STATEMENT.test(statement));
+}
+function isCapabilityProbeCommand(command) {
+  const parsed = tryParseShellCommand(command);
+  if (!parsed.success || parsed.tokens.some((token) => typeof token !== "string")) {
+    return false;
+  }
+  const argv = parsed.tokens;
+  if (argv.length === 2) {
+    const [executable2, flag] = argv;
+    if (executable2 && /^[A-Za-z0-9_./+-]+$/.test(executable2) && ["--help", "--version", "-h", "-V", "-v"].includes(flag ?? "")) {
+      return true;
+    }
+  }
+  if (argv.length >= 3 && argv[0] === "command" && (argv[1] === "-v" || argv[1] === "-V") && argv.slice(2).every((name) => /^[A-Za-z0-9_.+-]+$/.test(name))) {
+    return true;
+  }
+  if (argv.length !== 3 || argv[1] !== "-c")
+    return false;
+  const executable = argv[0]?.split("/").pop();
+  return Boolean(executable && /^python(?:\d+(?:\.\d+)*)?$/.test(executable) && isPurePythonImportScript(argv[2] ?? ""));
+}
+function isBashTaskListReadOnly(input) {
+  if (typeof input.command !== "string" || input.command.trim() === "" || input.run_in_background === true || input.dangerouslyDisableSandbox === true || input._simulatedSedEdit !== undefined || /[\0\r\n]/.test(input.command)) {
+    return false;
+  }
+  const output = extractOutputRedirections(input.command);
+  if (output.hasDangerousRedirection || output.redirections.some(({ target }) => target !== "/dev/null")) {
+    return false;
+  }
+  const subcommands = splitCommand_DEPRECATED(input.command);
+  if (subcommands.length === 0)
+    return false;
+  return subcommands.every((command) => {
+    const readOnly = checkReadOnlyConstraints({ command }, false);
+    return readOnly.behavior === "allow" || isCapabilityProbeCommand(command);
+  });
+}
+var IDENTIFIER = "[A-Za-z_][A-Za-z0-9_]*", DOTTED_NAME, IMPORT_ITEM, FROM_IMPORT_ITEM, IMPORT_STATEMENT, FROM_IMPORT_STATEMENT;
+var init_taskListReadOnly = __esm(() => {
+  init_commands();
+  init_shellQuote();
+  init_readOnlyValidation();
+  DOTTED_NAME = `${IDENTIFIER}(?:\\.${IDENTIFIER})*`;
+  IMPORT_ITEM = `${DOTTED_NAME}(?:[ \\t]+as[ \\t]+${IDENTIFIER})?`;
+  FROM_IMPORT_ITEM = `(?:${IDENTIFIER}|\\*)(?:[ \\t]+as[ \\t]+${IDENTIFIER})?`;
+  IMPORT_STATEMENT = new RegExp(`^import[ \\t]+${IMPORT_ITEM}(?:[ \\t]*,[ \\t]*${IMPORT_ITEM})*$`);
+  FROM_IMPORT_STATEMENT = new RegExp(`^from[ \\t]+${DOTTED_NAME}[ \\t]+import[ \\t]+` + `(?:${FROM_IMPORT_ITEM}(?:[ \\t]*,[ \\t]*${FROM_IMPORT_ITEM})*|` + `\\([ \\t]*${FROM_IMPORT_ITEM}` + `(?:[ \\t]*,[ \\t]*${FROM_IMPORT_ITEM})*[ \\t]*\\))$`);
+});
+
 // src/tools/BashTool/BashTool.tsx
 import { copyFile as copyFile6, stat as fsStat2, truncate as fsTruncate2, link as link5 } from "fs/promises";
 function isSearchOrReadBashCommand(command) {
@@ -386067,6 +386135,7 @@ var init_BashTool = __esm(() => {
   init_readOnlyValidation();
   init_sedEditParser();
   init_shouldUseSandbox();
+  init_taskListReadOnly();
   init_UI6();
   init_utils9();
   jsx_dev_runtime154 = __toESM(require_jsx_dev_runtime(), 1);
@@ -386166,6 +386235,9 @@ For commands that are harder to parse at a glance (piped commands, obscure flags
       const result = checkReadOnlyConstraints(input, compoundCommandHasCd);
       return result.behavior === "allow";
     },
+    isTaskListReadOnly(input) {
+      return isBashTaskListReadOnly(input);
+    },
     toAutoClassifierInput(input) {
       return input.command;
     },
@@ -388347,7 +388419,7 @@ function isAnyTracingEnabled() {
   return isTelemetryEnabled() || isEnhancedTelemetryEnabled() || isBetaTracingEnabled();
 }
 function getTracer() {
-  return import_api39.trace.getTracer("ur-agent.gen_ai", "1.68.10");
+  return import_api39.trace.getTracer("ur-agent.gen_ai", "1.68.17");
 }
 function createSpanAttributes(spanType, customAttributes = {}) {
   const baseAttributes = getTelemetryAttributes();
@@ -390996,10 +391068,16 @@ async function checkPermissionsAndCallTool(tool, toolUseID, input, toolUseContex
     isMutating = true;
   }
   const isPlanArtifactMutation = isCurrentPlanArtifactMutation(tool.name, parsedInput.data, toolUseContext);
+  let isTaskListReadOnly = false;
+  try {
+    isTaskListReadOnly = Boolean(tool.isTaskListReadOnly?.(parsedInput.data));
+  } catch {
+    isTaskListReadOnly = false;
+  }
   const isTaskListGatedMutation = isMutationRequiringTaskList({
     toolName: tool.name,
     toolInput: parsedInput.data,
-    isMutating
+    isMutating: isMutating && !isTaskListReadOnly
   });
   if (isMutating && isBuiltInReadOnlyPlanningSubagent(toolUseContext)) {
     recordCallFailure(callSig);
@@ -391383,10 +391461,16 @@ async function checkPermissionsAndCallTool(tool, toolUseID, input, toolUseContex
     finalIsMutating = true;
   }
   const finalIsPlanArtifactMutation = isCurrentPlanArtifactMutation(tool.name, finalParsedInput.data, toolUseContext);
+  let finalIsTaskListReadOnly = false;
+  try {
+    finalIsTaskListReadOnly = Boolean(tool.isTaskListReadOnly?.(finalParsedInput.data));
+  } catch {
+    finalIsTaskListReadOnly = false;
+  }
   const finalIsTaskListGatedMutation = isMutationRequiringTaskList({
     toolName: tool.name,
     toolInput: finalParsedInput.data,
-    isMutating: finalIsMutating
+    isMutating: finalIsMutating && !finalIsTaskListReadOnly
   });
   if (finalIsMutating && isBuiltInReadOnlyPlanningSubagent(toolUseContext)) {
     recordCallFailure(callSig);
@@ -419591,7 +419675,7 @@ function Feedback({
       platform: env2.platform,
       gitRepo: envInfo.isGit,
       terminal: env2.terminal,
-      version: "1.68.10",
+      version: "1.68.17",
       transcript: normalizeMessagesForAPI(messages),
       errors: sanitizedErrors,
       lastApiRequest: getLastAPIRequest(),
@@ -419783,7 +419867,7 @@ function Feedback({
                       ", ",
                       env2.terminal,
                       ", v",
-                      "1.68.10"
+                      "1.68.17"
                     ]
                   }, undefined, true, undefined, this)
                 ]
@@ -419889,7 +419973,7 @@ ${sanitizedDescription}
 ` + `**Environment Info**
 ` + `- Platform: ${env2.platform}
 ` + `- Terminal: ${env2.terminal}
-` + `- Version: ${"1.68.10"}
+` + `- Version: ${"1.68.17"}
 ` + `- Feedback ID: ${feedbackId}
 ` + `
 **Errors**
@@ -422999,7 +423083,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "1.68.10"
+    value: "1.68.17"
   }, {
     label: "Session name",
     value: nameValue
@@ -426329,7 +426413,7 @@ function Config({
         }
       }, undefined, false, undefined, this)
     }, undefined, false, undefined, this) : showSubmenu === "ChannelDowngrade" ? /* @__PURE__ */ jsx_dev_runtime179.jsxDEV(ChannelDowngradeDialog, {
-      currentVersion: "1.68.10",
+      currentVersion: "1.68.17",
       onChoice: (choice) => {
         setShowSubmenu(null);
         setTabsHidden(false);
@@ -426341,7 +426425,7 @@ function Config({
           autoUpdatesChannel: "stable"
         };
         if (choice === "stay") {
-          newSettings.minimumVersion = "1.68.10";
+          newSettings.minimumVersion = "1.68.17";
         }
         updateSettingsForSource("userSettings", newSettings);
         setSettingsData((prev_27) => ({
@@ -434415,7 +434499,7 @@ function HelpV2(t0) {
   let t6;
   if ($2[31] !== tabs) {
     t6 = /* @__PURE__ */ jsx_dev_runtime206.jsxDEV(Tabs, {
-      title: `UR v${"1.68.10"}`,
+      title: `UR v${"1.68.17"}`,
       color: "professionalBlue",
       defaultTab: "general",
       children: tabs
@@ -435348,7 +435432,7 @@ function buildToolUseContext(tools, readFileStateCache, toolPermissionContext, a
 async function handleInitialize(options2) {
   return {
     name: "UR",
-    version: "1.68.10",
+    version: "1.68.17",
     protocolVersion: "0.1.0",
     workspaceRoot: options2.cwd,
     capabilities: {
@@ -452456,7 +452540,7 @@ function getAllReleaseNotes(changelogContent = getStoredChangelogFromMemory()) {
     return [];
   }
 }
-async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.68.10") {
+async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.68.17") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -452483,7 +452567,7 @@ async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.68.10")
     releaseNotes
   };
 }
-function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.68.10") {
+function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.68.17") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -455349,7 +455433,7 @@ function getRecentActivitySync() {
   return cachedActivity;
 }
 function getLogoDisplayData() {
-  const version2 = process.env.DEMO_VERSION ?? "1.68.10";
+  const version2 = process.env.DEMO_VERSION ?? "1.68.17";
   const serverUrl = getDirectConnectServerUrl();
   const displayPath = process.env.DEMO_VERSION ? "/code/ur" : getDisplayPath(getCwd());
   const cwd2 = serverUrl ? `${displayPath} in ${serverUrl.replace(/^https?:\/\//, "")}` : displayPath;
@@ -456216,7 +456300,7 @@ function LogoV2() {
   if ($2[2] === Symbol.for("react.memo_cache_sentinel")) {
     t2 = () => {
       const currentConfig2 = getGlobalConfig();
-      if (currentConfig2.lastReleaseNotesSeen === "1.68.10") {
+      if (currentConfig2.lastReleaseNotesSeen === "1.68.17") {
         return;
       }
       saveGlobalConfig(_temp325);
@@ -456901,12 +456985,12 @@ function LogoV2() {
   return t41;
 }
 function _temp325(current) {
-  if (current.lastReleaseNotesSeen === "1.68.10") {
+  if (current.lastReleaseNotesSeen === "1.68.17") {
     return current;
   }
   return {
     ...current,
-    lastReleaseNotesSeen: "1.68.10"
+    lastReleaseNotesSeen: "1.68.17"
   };
 }
 function _temp241(s_0) {
@@ -473852,7 +473936,7 @@ function compileAgenticCiWorkflow(specName = "default", options2 = {}) {
   if (spec.name !== specName) {
     throw new Error("Agentic CI workflow spec name does not match");
   }
-  const packageVersion = options2.packageVersion ?? (typeof MACRO !== "undefined" ? "1.68.10" : "1.68.10");
+  const packageVersion = options2.packageVersion ?? (typeof MACRO !== "undefined" ? "1.68.17" : "1.68.17");
   if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(packageVersion)) {
     throw new Error("invalid ur-agent package version");
   }
@@ -474845,7 +474929,7 @@ runner; \`ur trigger\` is the inbound parser that decides what to run.
       path: ".github/workflows/ur.yml",
       root: "project",
       content: compileAgenticCiWorkflow("default", {
-        packageVersion: typeof MACRO !== "undefined" ? "1.68.10" : "1.68.10"
+        packageVersion: typeof MACRO !== "undefined" ? "1.68.17" : "1.68.17"
       })
     },
     {
@@ -474915,7 +474999,7 @@ function value(tokens, flag) {
   return index2 >= 0 ? tokens[index2 + 1] : undefined;
 }
 function cliVersion() {
-  return typeof MACRO !== "undefined" ? "1.68.10" : "1.68.10";
+  return typeof MACRO !== "undefined" ? "1.68.17" : "1.68.17";
 }
 function workflowPath(cwd2) {
   return join159(cwd2, ".github", "workflows", "ur-agentic-ci.yml");
@@ -480780,7 +480864,7 @@ function createAcpStdioApp(deps) {
       }
     },
     authMethods: [],
-    agentInfo: { name: "UR-Nexus", version: "1.68.10" }
+    agentInfo: { name: "UR-Nexus", version: "1.68.17" }
   })).onRequest("authenticate", () => ({})).onRequest("session/new", async (context6) => {
     const result = runtime2.newSession(context6.params.cwd, context6.params.mcpServers, context6.params.additionalDirectories);
     await runtime2.announce({
@@ -480877,7 +480961,7 @@ function createAcpStdioAgent(deps) {
               }
             },
             authMethods: [],
-            agentInfo: { name: "UR-Nexus", version: "1.68.10" }
+            agentInfo: { name: "UR-Nexus", version: "1.68.17" }
           });
           return;
         case "authenticate":
@@ -692037,7 +692121,7 @@ async function captureMemoryDiagnostics(trigger2, dumpNumber = 0) {
     smapsRollup,
     platform: process.platform,
     nodeVersion: process.version,
-    ccVersion: "1.68.10"
+    ccVersion: "1.68.17"
   };
 }
 async function performHeapDump(trigger2 = "manual", dumpNumber = 0) {
@@ -692617,7 +692701,7 @@ var init_bridge_kick = __esm(() => {
 var call153 = async () => {
   return {
     type: "text",
-    value: "1.68.10"
+    value: "1.68.17"
   };
 }, version2, version_default;
 var init_version = __esm(() => {
@@ -703797,7 +703881,7 @@ function generateHtmlReport(data, insights) {
 </html>`;
 }
 function buildExportData(data, insights, facets, remoteStats) {
-  const version3 = typeof MACRO !== "undefined" ? "1.68.10" : "unknown";
+  const version3 = typeof MACRO !== "undefined" ? "1.68.17" : "unknown";
   const remote_hosts_collected = remoteStats?.hosts.filter((h2) => h2.sessionCount > 0).map((h2) => h2.name);
   const facets_summary = {
     total: facets.size,
@@ -708124,7 +708208,7 @@ var init_sessionStorage = __esm(() => {
   init_settings2();
   init_slowOperations();
   init_uuid();
-  VERSION7 = typeof MACRO !== "undefined" ? "1.68.10" : "unknown";
+  VERSION7 = typeof MACRO !== "undefined" ? "1.68.17" : "unknown";
   MAX_TOMBSTONE_REWRITE_BYTES = 50 * 1024 * 1024;
   SKIP_FIRST_PROMPT_PATTERN = /^(?:\s*<[a-z][\w-]*[\s>]|\[Request interrupted by user[^\]]*\])/;
   EPHEMERAL_PROGRESS_TYPES = new Set([
@@ -709341,7 +709425,7 @@ var init_filesystem = __esm(() => {
   });
   getBundledSkillsRoot = memoize_default(function getBundledSkillsRoot2() {
     const nonce = randomBytes20(16).toString("hex");
-    return join230(getURTempDir(), "bundled-skills", "1.68.10", nonce);
+    return join230(getURTempDir(), "bundled-skills", "1.68.17", nonce);
   });
   getResolvedWorkingDirPaths = memoize_default(getPathsForPermissionCheck);
 });
@@ -715647,7 +715731,7 @@ function computeFingerprint(messageText2, version3) {
 }
 function computeFingerprintFromMessages(messages) {
   const firstMessageText = extractFirstMessageText(messages);
-  return computeFingerprint(firstMessageText, "1.68.10");
+  return computeFingerprint(firstMessageText, "1.68.17");
 }
 var FINGERPRINT_SALT = "59cf53e54c78";
 var init_fingerprint = () => {};
@@ -717546,7 +717630,7 @@ async function sideQuery(opts) {
     betas.push(STRUCTURED_OUTPUTS_BETA_HEADER);
   }
   const messageText2 = extractFirstUserMessageText(messages);
-  const fingerprint2 = computeFingerprint(messageText2, "1.68.10");
+  const fingerprint2 = computeFingerprint(messageText2, "1.68.17");
   const attributionHeader = getAttributionHeader(fingerprint2);
   const systemBlocks = [
     attributionHeader ? { type: "text", text: attributionHeader } : null,
@@ -722333,7 +722417,7 @@ function buildSystemInitMessage(inputs) {
     slash_commands: inputs.commands.filter((c4) => c4.userInvocable !== false).map((c4) => c4.name),
     apiKeySource: getURHQApiKeyWithSource().source,
     betas: getSdkBetas(),
-    ur_version: "1.68.10",
+    ur_version: "1.68.17",
     output_style: outputStyle2,
     agents: inputs.agents.map((agent2) => agent2.agentType),
     skills: inputs.skills.filter((s) => s.userInvocable !== false).map((skill2) => skill2.name),
@@ -736284,7 +736368,7 @@ var init_useVoiceEnabled = __esm(() => {
 function getSemverPart(version3) {
   return `${import_semver13.major(version3, { loose: true })}.${import_semver13.minor(version3, { loose: true })}.${import_semver13.patch(version3, { loose: true })}`;
 }
-function useUpdateNotification(updatedVersion, initialVersion = "1.68.10") {
+function useUpdateNotification(updatedVersion, initialVersion = "1.68.17") {
   const [lastNotifiedSemver, setLastNotifiedSemver] = import_react222.useState(() => getSemverPart(initialVersion));
   if (!updatedVersion) {
     return null;
@@ -736333,7 +736417,7 @@ function AutoUpdater({
       return;
     }
     if (false) {}
-    const currentVersion = "1.68.10";
+    const currentVersion = "1.68.17";
     const channel = getInitialSettings()?.autoUpdatesChannel ?? "latest";
     let latestVersion = await getLatestVersion(channel);
     const isDisabled = isAutoUpdaterDisabled();
@@ -736562,12 +736646,12 @@ function NativeAutoUpdater({
     logEvent("tengu_native_auto_updater_start", {});
     try {
       const maxVersion = await getMaxVersion();
-      if (maxVersion && gt("1.68.10", maxVersion)) {
+      if (maxVersion && gt("1.68.17", maxVersion)) {
         const msg = await getMaxVersionMessage();
         setMaxVersionIssue(msg ?? "affects your version");
       }
       const result = await installLatest(channel);
-      const currentVersion = "1.68.10";
+      const currentVersion = "1.68.17";
       const latencyMs = Date.now() - startTime;
       if (result.lockFailed) {
         logEvent("tengu_native_auto_updater_lock_contention", {
@@ -736704,17 +736788,17 @@ function PackageManagerAutoUpdater(t0) {
       const maxVersion = await getMaxVersion();
       if (maxVersion && latest && gt(latest, maxVersion)) {
         logForDebugging(`PackageManagerAutoUpdater: maxVersion ${maxVersion} is set, capping update from ${latest} to ${maxVersion}`);
-        if (gte("1.68.10", maxVersion)) {
-          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.68.10"} is already at or above maxVersion ${maxVersion}, skipping update`);
+        if (gte("1.68.17", maxVersion)) {
+          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.68.17"} is already at or above maxVersion ${maxVersion}, skipping update`);
           setUpdateAvailable(false);
           return;
         }
         latest = maxVersion;
       }
-      const hasUpdate = latest && !gte("1.68.10", latest) && !shouldSkipVersion(latest);
+      const hasUpdate = latest && !gte("1.68.17", latest) && !shouldSkipVersion(latest);
       setUpdateAvailable(!!hasUpdate);
       if (hasUpdate) {
-        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.68.10"} -> ${latest}`);
+        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.68.17"} -> ${latest}`);
       }
     };
     $2[0] = t1;
@@ -736748,7 +736832,7 @@ function PackageManagerAutoUpdater(t0) {
       wrap: "truncate",
       children: [
         "currentVersion: ",
-        "1.68.10"
+        "1.68.17"
       ]
     }, undefined, true, undefined, this);
     $2[3] = verbose;
@@ -747458,7 +747542,7 @@ function buildStatusLineCommandInput(permissionMode, exceeds200kTokens, settings
       project_dir: getOriginalCwd(),
       added_dirs: addedDirs
     },
-    version: "1.68.10",
+    version: "1.68.17",
     output_style: {
       name: outputStyleName
     },
@@ -747537,7 +747621,7 @@ function StatusLineInner({
   const taskRunningCount = countActiveBackgroundTasks(taskValues);
   const agentRunningCount = countActiveForegroundAgents(taskValues);
   const defaultStatusLineText = buildDefaultStatusBar({
-    version: "1.68.10",
+    version: "1.68.17",
     providerLabel: providerRuntime.providerLabel,
     authMode: providerRuntime.authLabel,
     model: renderModelName(mainLoopModel) || providerRuntime.model || "",
@@ -759718,7 +759802,7 @@ async function submitTranscriptShare(messages, trigger2, appearanceId) {
     } catch {}
     const data = {
       trigger: trigger2,
-      version: "1.68.10",
+      version: "1.68.17",
       platform: process.platform,
       transcript,
       subagentTranscripts: Object.keys(subagentTranscripts).length > 0 ? subagentTranscripts : undefined,
@@ -772086,7 +772170,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "1.68.10"
+              "1.68.17"
             ]
           }, undefined, true, undefined, this)
         ]
@@ -773346,7 +773430,7 @@ function completeOnboarding() {
   saveGlobalConfig((current) => ({
     ...current,
     hasCompletedOnboarding: true,
-    lastOnboardingVersion: "1.68.10"
+    lastOnboardingVersion: "1.68.17"
   }));
 }
 function showDialog(root2, renderer) {
@@ -778390,7 +778474,7 @@ function appendToLog(path24, message) {
     cwd: getFsImplementation().cwd(),
     userType: process.env.USER_TYPE,
     sessionId: getSessionId(),
-    version: "1.68.10"
+    version: "1.68.17"
   };
   getLogWriter(path24).write(messageWithTimestamp);
 }
@@ -782554,8 +782638,8 @@ async function getEnvLessBridgeConfig() {
 }
 async function checkEnvLessBridgeMinVersion() {
   const cfg = await getEnvLessBridgeConfig();
-  if (cfg.min_version && lt("1.68.10", cfg.min_version)) {
-    return `Your version of UR (${"1.68.10"}) is too old for Remote Control.
+  if (cfg.min_version && lt("1.68.17", cfg.min_version)) {
+    return `Your version of UR (${"1.68.17"}) is too old for Remote Control.
 Version ${cfg.min_version} or higher is required. Run \`ur update\` to update.`;
   }
   return null;
@@ -783029,7 +783113,7 @@ async function initBridgeCore(params) {
   const rawApi = createBridgeApiClient({
     baseUrl,
     getAccessToken,
-    runnerVersion: "1.68.10",
+    runnerVersion: "1.68.17",
     onDebug: logForDebugging,
     onAuth401,
     getTrustedDeviceToken
@@ -792502,7 +792586,7 @@ function getAgUiCapabilities() {
       name: "UR-Nexus",
       type: "ur-nexus",
       description: "Provider-flexible, local-first autonomous engineering workflow agent.",
-      version: "1.68.10",
+      version: "1.68.17",
       provider: "UR",
       documentationUrl: "https://github.com/Maitham16/UR/blob/master/docs/AG_UI.md"
     },
@@ -793642,7 +793726,7 @@ function createMCPServer(cwd4, debug2, verbose) {
   };
   const server2 = new Server({
     name: "ur-nexus",
-    version: "1.68.10"
+    version: "1.68.17"
   }, {
     capabilities: {
       tools: {}
@@ -794800,7 +794884,7 @@ function thrownResponse(error40) {
 }
 async function createUrMcp2026Runtime(options4) {
   const server2 = createMCPServer(options4.cwd, options4.debug === true, options4.verbose === true);
-  const client2 = new Client({ name: "ur-mcp-2026-adapter", version: "1.68.10" }, { capabilities: {} });
+  const client2 = new Client({ name: "ur-mcp-2026-adapter", version: "1.68.17" }, { capabilities: {} });
   const [clientTransport, serverTransport] = createLinkedTransportPair();
   try {
     await server2.connect(serverTransport);
@@ -794811,7 +794895,7 @@ async function createUrMcp2026Runtime(options4) {
   }
   const runtime2 = new Mcp2026Runtime({
     cwd: options4.cwd,
-    version: "1.68.10",
+    version: "1.68.17",
     backend: {
       listTools: async () => {
         const listed = await client2.listTools();
@@ -796944,7 +797028,7 @@ async function update() {
   logEvent("tengu_update_check", {});
   const diagnostic2 = await getDoctorDiagnostic();
   const result = await checkUpgradeStatus({
-    currentVersion: "1.68.10",
+    currentVersion: "1.68.17",
     packageName: UR_AGENT_PACKAGE_NAME,
     installationType: diagnostic2.installationType,
     latestVersion: () => getLatestNpmPackageVersion(UR_AGENT_PACKAGE_NAME)
@@ -798260,7 +798344,7 @@ ${customInstructions}` : customInstructions;
       }
     }
     logForDiagnosticsNoPII("info", "started", {
-      version: "1.68.10",
+      version: "1.68.17",
       is_native_binary: isInBundledMode()
     });
     registerCleanup(async () => {
@@ -799046,7 +799130,7 @@ Usage: ur --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("1.68.10 (UR-Nexus)", "-v, --version", "Output the version number");
+  }).version("1.68.17 (UR-Nexus)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -800105,7 +800189,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"1.68.10"} (UR-Nexus)`);
+    console.log(`${"1.68.17"} (UR-Nexus)`);
     return;
   }
   if (args[0] === "a2a" && args[1] === "serve" && !args.includes("--help") && !args.includes("-h")) {

package/docs/VALIDATION.md

@@ -19,7 +19,7 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.68.10 (UR-Nexus)"
+# expected for this release: "1.68.17 (UR-Nexus)"
 ```
 
 ## 0.1 First-workspace model selection (1.45.4)

package/documentation/index.html

@@ -45,7 +45,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.68.10</p>
+          <p class="eyebrow">Version 1.68.17</p>
           <h1>UR-Nexus Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-Nexus.</p>
         </div>

package/extensions/jetbrains-ur/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 }
 
 group = "dev.urnexus"
-version = "1.68.10"
+version = "1.68.17"
 
 repositories {
     mavenCentral()

package/extensions/vscode-ur-inline-diffs/package.json

@@ -2,7 +2,7 @@
   "name": "ur-inline-diffs",
   "displayName": "UR Inline Diffs",
   "description": "Review, apply, and reject UR inline diff bundles from .ur/ide/diffs inside VS Code.",
-  "version": "1.68.10",
+  "version": "1.68.17",
   "publisher": "ur-nexus",
   "engines": {
     "vscode": "^1.92.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ur-agent",
-  "version": "1.68.10",
+  "version": "1.68.17",
   "description": "UR-Nexus — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",

package/technical/01-architecture.md

@@ -60,7 +60,9 @@ This is enforced beyond prompt wording:
 
 - `src/services/tools/taskListGate.ts` blocks state-changing calls once the initial
   lightweight allowance is consumed unless an actionable task exists. Delegation and
-  subagent mutations always require a parent task. Reads remain unrestricted.
+  subagent mutations always require a parent task. Reads remain unrestricted. Tool
+  implementations can classify task-only observation separately from stricter
+  permission auto-approval; both classifications are re-evaluated after rewrites.
 - `src/services/tools/repeatedFailureGuard.ts` tracks canonicalized failing calls, refuses
   repeated identical failures, then aborts the stuck turn at a bounded threshold.
 - the tool execution boundary revalidates the final input after hook rewrites; a hook cannot

package/technical/04-tools.md

@@ -140,6 +140,17 @@ expansion, backgrounding, sandbox overrides, and permission-time rewrites do
 not qualify. Node remains non-read-only for Bash permission and sandbox
 purposes, so this compatibility path cannot become a general execution bypass.
 
+Task tracking no longer equates "not safe to auto-approve" with "changes the
+workspace." Tools may expose a separate `isTaskListReadOnly` classification;
+permissions, sandboxing, concurrency, and read-only planning agents still use
+the stricter `isReadOnly` result. Bash uses the task-only classification for
+known read commands and generic capability inspection: exact help/version
+queries, `command -v`/`which`-style presence checks, and import-only Python
+probes for any syntactically valid module name. This is category-based rather
+than a module allowlist. Arbitrary interpreter statements, output redirects
+outside `/dev/null`, background execution, sandbox overrides, simulated edits,
+unknown commands, and permission-time rewrites to mutations remain gated.
+
 Task completion also protects that lifecycle boundary. When the final
 actionable `in_progress` task has a successful `Write`/`Edit`/`MultiEdit`/
 `NotebookEdit` after its recorded start but no later successful inspection,

package/technical/README.md

@@ -1,6 +1,6 @@
 # UR-Nexus — Technical Specifications
 
-> Audited against the executable source and tests for `ur-agent` v1.68.10.
+> Audited against the executable source and tests for `ur-agent` v1.68.17.
 > Command, tool, flag, provider, and setting claims are checked against the
 > implementation rather than copied from product prose. Release validation
 > keeps this version synchronized and packages the complete `technical/`