ur-agent 1.68.16 → 1.68.18

package/docs/VALIDATION.md

@@ -19,7 +19,7 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.68.16 (UR-Nexus)"
+# expected for this release: "1.68.18 (UR-Nexus)"
 ```
 
 ## 0.1 First-workspace model selection (1.45.4)

package/documentation/index.html

@@ -45,7 +45,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.68.16</p>
+          <p class="eyebrow">Version 1.68.18</p>
           <h1>UR-Nexus Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-Nexus.</p>
         </div>

package/extensions/jetbrains-ur/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 }
 
 group = "dev.urnexus"
-version = "1.68.16"
+version = "1.68.18"
 
 repositories {
     mavenCentral()

package/extensions/vscode-ur-inline-diffs/package.json

@@ -2,7 +2,7 @@
   "name": "ur-inline-diffs",
   "displayName": "UR Inline Diffs",
   "description": "Review, apply, and reject UR inline diff bundles from .ur/ide/diffs inside VS Code.",
-  "version": "1.68.16",
+  "version": "1.68.18",
   "publisher": "ur-nexus",
   "engines": {
     "vscode": "^1.92.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ur-agent",
-  "version": "1.68.16",
+  "version": "1.68.18",
   "description": "UR-Nexus — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",

package/technical/01-architecture.md

@@ -60,7 +60,9 @@ This is enforced beyond prompt wording:
 
 - `src/services/tools/taskListGate.ts` blocks state-changing calls once the initial
   lightweight allowance is consumed unless an actionable task exists. Delegation and
-  subagent mutations always require a parent task. Reads remain unrestricted.
+  subagent mutations always require a parent task. Reads remain unrestricted. Tool
+  implementations can classify task-only observation separately from stricter
+  permission auto-approval; both classifications are re-evaluated after rewrites.
 - `src/services/tools/repeatedFailureGuard.ts` tracks canonicalized failing calls, refuses
   repeated identical failures, then aborts the stuck turn at a bounded threshold.
 - the tool execution boundary revalidates the final input after hook rewrites; a hook cannot

package/technical/04-tools.md

@@ -140,6 +140,17 @@ expansion, backgrounding, sandbox overrides, and permission-time rewrites do
 not qualify. Node remains non-read-only for Bash permission and sandbox
 purposes, so this compatibility path cannot become a general execution bypass.
 
+Task tracking no longer equates "not safe to auto-approve" with "changes the
+workspace." Tools may expose a separate `isTaskListReadOnly` classification;
+permissions, sandboxing, concurrency, and read-only planning agents still use
+the stricter `isReadOnly` result. Bash uses the task-only classification for
+known read commands and generic capability inspection: exact help/version
+queries, `command -v`/`which`-style presence checks, and import-only Python
+probes for any syntactically valid module name. This is category-based rather
+than a module allowlist. Arbitrary interpreter statements, output redirects
+outside `/dev/null`, background execution, sandbox overrides, simulated edits,
+unknown commands, and permission-time rewrites to mutations remain gated.
+
 Task completion also protects that lifecycle boundary. When the final
 actionable `in_progress` task has a successful `Write`/`Edit`/`MultiEdit`/
 `NotebookEdit` after its recorded start but no later successful inspection,

package/technical/README.md

@@ -1,6 +1,6 @@
 # UR-Nexus — Technical Specifications
 
-> Audited against the executable source and tests for `ur-agent` v1.68.16.
+> Audited against the executable source and tests for `ur-agent` v1.68.18.
 > Command, tool, flag, provider, and setting claims are checked against the
 > implementation rather than copied from product prose. Release validation
 > keeps this version synchronized and packages the complete `technical/`