ur-agent 1.68.17 → 1.69.0

package/CHANGELOG.md

@@ -1,600 +1,19 @@
 # Changelog
 
-## 1.68.17
-
-- Fixed false `TaskListRequired` failures for observational Bash capability
-  checks. Task tracking now has a classification distinct from permission
-  auto-approval, so an executable probe can remain permission- and
-  sandbox-sensitive without being mislabeled as a workspace change.
-- The Bash classification is category-based rather than tailored to one
-  module: known reads, exact help/version checks, command-presence checks, and
-  import-only Python probes for any module can run without reopening a
-  completed task. Arbitrary interpreter code, output writes, background
-  execution, sandbox overrides, and unknown commands remain task-gated.
-- Both the initial call and its final post-permission input are classified.
-  Hooks or permission handlers therefore cannot rewrite an observational probe
-  into an untracked mutation.
-
-## 1.68.16
-
-- First pieces of the UR Nexus visual identity, as terminal primitives rather
-  than artwork: `constants/urPalette.ts` (obsidian/bronze/electrum/lapis tokens
-  in true-colour, ANSI-256 and monochrome tiers, with depth detection),
-  `constants/urOrnament.ts` (frieze bands, the four border styles, the gate
-  brand mark), and `utils/statusBarItems.ts` (width-aware status-bar registry).
-- The ornaments are thin box-drawing strokes, not solid blocks. Heavy glyphs
-  (▟▙██) were tried first and read as chunky sprites against a design built
-  from fine line-work. Everything renders on macOS Terminal, GNOME Terminal,
-  Konsole, Alacritty, foot and over SSH — no image protocol, so no user gets a
-  degraded version of the identity.
-- Friezes tile to an exact width and truncate rather than pad: a band that
-  overshoots its column budget wraps, and a wrapped frieze reads as corruption
-  rather than decoration. The ASCII gate is cell-for-cell the same size as the
-  Unicode one so a fallback does not shift the layout.
-- Status-bar items degrade by dropping whole items, lowest priority first,
-  after trying short forms — never by truncating the assembled string, which
-  cuts through whichever number sits at the boundary.
-- Section 11 of the design spec lists context usage at priority 2 but its own
-  narrow-width example keeps `ctx` while dropping state and agents. The
-  examples win: at a glance the two things worth knowing are how far along the
-  work is and how much room is left. Drop order is now an explicit per-item
-  rank rather than emerging from zone position.
-
-## 1.68.15
-
-- Reconstructed three more stub type files, clearing 177 further errors:
-  `keybindings/types.ts` (six empty interfaces), `ink/cursor.ts`, and
-  `commands/plugin/unifiedTypes.ts`. Same defect as the MCP types in 1.68.14 —
-  an empty interface means "has no members" to TypeScript, not "shape unknown",
-  so every property access on one was an error and the consuming files carried
-  `@ts-nocheck` as a result.
-- `KeybindingBlock.bindings` is keyed by chord string, not an array. A first
-  attempt typed it `ParsedBinding[]`, which made every entry in the default
-  binding table an error — the declaration form (`'ctrl+d': 'app:exit'`) and the
-  parsed form (chord resolved into keystrokes) are different shapes, and
-  conflating them broke a file that had been fine.
-- `KeybindingAction` is a string rather than a union of known actions:
-  `defaultBindings.ts` assembles entries conditionally from feature flags, so a
-  value missing from a union would turn a working binding into an error.
-- Suppression list: 140 -> 132. Eight keybinding and ink files came off.
-- Totals for the sweep so far: 223 -> 132 files, 868 -> 563 errors, and almost
-  none of it file-by-file. Four stub files accounted for 258 errors on their
-  own.
-
-## 1.68.14
-
-- Gave the MCP settings types their real shapes. `components/mcp/types.ts`
-  declared seven **empty** interfaces under a "Stub: not included in leaked
-  source" comment. An empty interface does not mean "unknown shape" to
-  TypeScript, it means "has no members" — so every property access on one was an
-  error, and that single file produced ~221 of the 858 errors sitting behind
-  `@ts-nocheck`. The MCP menus were not wrong; their types were.
-- The shapes are reconstructed from what the components actually access, with
-  `transport` as a literal discriminant so the server union narrows on
-  `transport === 'stdio'` instead of collapsing. Fields whose internals the UI
-  never inspects are `Record<string, unknown>` rather than `any`, so a consumer
-  must still narrow before reaching inside.
-- 118 errors cleared, `MCPAgentServerMenu` off the suppression list (141 -> 140).
-- Method note: of 42 files carrying exactly one error, nine shared one cause;
-  221 more came from this one stub. These cluster, so the productive next step
-  is grouping by error signature rather than opening files one at a time.
-
-## 1.68.13
-
-- Eight more files came off `@ts-nocheck` (149 -> 141) from a single fix. The
-  compiled signature of `useRegisterOverlay(id, t0)` declared two required
-  parameters while its own first statement reads
-  `const enabled = t0 === undefined ? true : t0` — the argument was optional by
-  construction and required by declaration, so every caller passing only an id
-  was a type error. Marking it optional cleared 10 errors across 10 files.
-- That is the shape worth looking for in the rest: of 42 files carrying exactly
-  one error, nine shared this one cause. The remaining suppressed files surface
-  ~858 errors, and the useful next step is grouping them by cause rather than
-  working through them file by file.
-
-## 1.68.12
-
-- The Ollama request path now reports where a request's bytes actually go —
-  tool definitions, system prompt, conversation — once per session in the debug
-  log. The fixed cost of tools plus system prompt is what decides whether a
-  small-context model has room left to work, and until now it had only been
-  estimated by summing prompt source. That estimate is wrong by construction:
-  these prompts are full of `condition ? longText : shortText`, and summing the
-  file counts both branches when only one is ever sent. The measurement is
-  taken from the serialized request, so it is what the server receives.
-- Reported as a share of the whole with the tool-definition count, because
-  "system prompt is large" and "conversation is large" call for opposite fixes
-  and are indistinguishable in a single total.
-
-## 1.68.11
-
-- Investigated turning the task-list gate advisory by default and did not do
-  it. The friction it causes is real, but the gate is also the final
-  revalidation before a tool executes, and defaulting it off removes two
-  properties nothing else provides: a permission handler or hook that rewrites
-  a read-only call into a mutating one is re-checked *after* the rewrite, and
-  task state is re-read at execution time so a plan that disappears while
-  permission is pending cannot let the mutation through. Eight tests in
-  `toolExecutionFinalInput` fail the moment enforcement is defaulted off, all
-  on those two paths. The rule and its revalidation are not separable: the
-  re-read is how the rule is applied at execution time, so with no rule there
-  is nothing to revalidate.
-- The friction had two causes and both are already fixed forward: the
-  allowance counted messages instead of tool calls, so the gate fired on the
-  first Write (1.65.5), and the TodoWrite prompt had lost its worked examples,
-  so smaller models stopped producing task lists at all (1.68.0). The gate is
-  reached far less often as a result. `tasks.requireBeforeChanges.enabled`
-  remains available for anyone who wants it off knowingly.
-
-## 1.68.10
-
-- `ToolSearchTool` no longer registers on runtimes where it cannot work. Its
-  purpose is fetching schemas for tools whose definitions were deferred, and
-  deferral needs the runtime to expand `tool_reference` blocks — an
-  Anthropic-native beta shape that no UR runtime supports (UR runs on Ollama,
-  OpenAI-compatible servers and vendor CLIs). `isEnabled()` consulted only
-  `isToolSearchEnabledOptimistic()`, which reads the mode, and the mode
-  defaults to `'tst'` (on). The tool therefore registered on every run: its
-  description shipped with each request, and the model was offered a tool that
-  could not function, because nothing was ever deferred for it to fetch.
-- Audit note on the surface as a whole: 168 commands, of which 8 touch a
-  feature flag that is not compiled in, and in each case the flag gates a
-  sub-feature rather than the command. 89 of 91 flags are absent from shipped
-  builds. Two of those (`CONTEXT_COLLAPSE`, `REACTIVE_COMPACT`) would have
-  failed on the first turn if enabled and were fixed in 1.68.2.
-
-## 1.68.9
-
-- Narrowed that allowlist entry from `ur.com` to `ur.com/docs`. Replacing a
-  docs-only host with a bare domain widened what WebFetch retrieves without
-  asking, on a list whose own header warns that broad entries are dangerous
-  where a host may serve user-supplied content — and the domain in question
-  does not exist yet, so whatever ends up hosted there would have inherited
-  that trust. The matcher enforces path-segment boundaries, so `/docs-evil/x`
-  does not match. Caught by `apiTool`, which asserted the old entry.
-
-## 1.68.8
-
-- The bundled `ur-guide` agent no longer answers UR questions out of another
-  product's documentation. It instructed the model to fetch
-  `https://docs.claude.com/llms.txt` and present it to users as "UR SDK docs"
-  and "UR API docs", including the line "Agent SDK docs are part of the UR API
-  documentation at the same URL". Its other source, `docs.ur.dev`, was never
-  served. Both now resolve to `https://ur.com/docs`.
-- Replaced the remaining 33 `docs.ur.dev` links across MCP help, the security
-  dialog, keybindings, settings validation tips, preflight checks and the
-  feedback survey. Two sandbox dialogs had been pointing their href at the new
-  domain while still displaying the old one.
-- `docs.ur.dev` in the WebFetch preapproved-host allowlist now points at
-  ur.com. Changed on its own: it is a hostname the fetch tool trusts, not a
-  link.
-- `KNOWN_AGENTS` listed `ur-code-guide`; the registered agent type is
-  `ur-guide`. A workflow naming the real agent was warned as unknown, while the
-  listed name would have been accepted despite resolving to nothing.
-- Removed a dead `UR_CODE_DOCS_MAP_URL` export from `constants/prompts.ts` —
-  a duplicate of the live constant, imported by nothing.
-- Added `test/docsUrlIntegrity.test.ts`, including a check that a link's
-  displayed text matches where it actually goes.
-
-## 1.68.7
-
-- Corrected the ur.ai -> ur.com replacement, which had rewritten identifiers as
-  well as URLs. `'ur.ai'` served two roles in this codebase: a domain in links
-  such as `https://ur.ai/settings/billing`, and a discriminant value in
-  `authTokenSource === 'ur.ai'`, `authMethod = 'ur.ai'` and
-  `source: 'ur.ai' as const`. A blanket replace changed both, which typechecked
-  and looked internally consistent but altered command availability — one
-  command that should have been hidden became visible, caught by
-  `commandRegistryIntegrity`. The 39 URLs now point at ur.com; the 11 auth
-  discriminants are back to their original values, which also keeps any
-  `"ur.ai"` already persisted in a user's auth state matching.
-
-## 1.68.6
-
-- An oversized Ollama request now recovers instead of only explaining itself.
-  1.68.3 reported "this request was 19.6 MB" clearly and then left the user to
-  run /compact by hand. UR already had both halves of the fix — `isMediaSizeError`
-  and `stripImagesFromMessages` — but both were wired to reactive compact's
-  retry, and REACTIVE_COMPACT is not compiled into any shipped build, so neither
-  was reachable. `isMediaSizeError` and `isMediaSizeErrorMessage` had no callers
-  at all outside their own file.
-- On a body-size rejection the request is retried once with images from earlier
-  turns removed, keeping the most recent one. Stale attachments are the usual
-  bulk and the least valuable part of it: only the newest is normally still
-  under discussion.
-- The retry is announced with both sizes and says to re-attach an earlier image
-  if it is needed. Dropping a user's attachments silently would be the same
-  invisible behaviour being fixed everywhere else.
-- No retry is attempted when there is at most one image-bearing message, since
-  it would resend identical bytes and fail identically.
-
-## 1.68.5
-
-- Replaced every `ur.ai` reference in `src/` with `ur.com` (202 sites, 0 left).
-  Note what these are: most are upstream URL structures carried into the fork —
-  `/settings/billing`, `/settings/connectors`, `/upgrade/max`, `/chrome`,
-  `/chrome/reconnect`, `/admin-settings/usage`, and desktop auto-update
-  redirects like `/api/desktop/darwin/universal/dmg/latest/redirect`. Changing
-  the domain does not make those endpoints exist; it moves them to a domain UR
-  will control. The features behind them still need a backend or removal.
-- `test/tipsAreReal.test.ts` still forbids `ur.ai` and `ur.com` in tips, since
-  the domain is not serving yet. Relax that deliberately once it is.
-- Corrected a comment in that test which claimed both domains "have no DNS
-  records". That came from a lookup run where `github.com` and `example.com`
-  fail identically — the environment had no DNS — so it was never evidence.
-
-## 1.68.4
-
-- The status line now reports subagents running in the current turn:
-  `agents: 2 running`, separate from the existing background `tasks:` count.
-  `isBackgroundTask()` excludes foreground entries on purpose — it was narrowed
-  to stop stale ratios like `tasks: 0/4 active` outliving the work — but nothing
-  counted them instead, so while subagents ran the bar said nothing at all,
-  which is the one moment the number matters.
-- Counted conservatively on purpose: a pending agent is not reported as running,
-  a backgrounded agent is not counted twice across both numbers, a foreground
-  shell is not labelled an agent, and zero renders nothing rather than
-  `agents: 0`. A wrong number in a status line is worse than a missing one.
-- No tool count was added. A `toolCount` field was drafted and then removed
-  rather than shipped unpopulated; a meaningful count of in-flight tool calls
-  needs hooks into tool execution, and a static "tools registered" total is
-  noise.
-
-## 1.68.3
-
-- `Ollama request failed (400): http: request body too large` now explains
-  itself. That string comes from Go's `net/http` MaxBytesReader rejecting the
-  payload on **byte size**, which is a different limit from the model's context
-  window — so the token-based context warning added in 1.66.2 never fires for
-  it, and a couple of screenshots can breach it while the token estimate still
-  looks comfortable. The request body is now measured at the send site, and the
-  error reports its actual size, names images as the usual cause (base64 adds
-  roughly a third, and every image persists in the transcript on later turns),
-  offers `/compact` or a fresh session, and notes that a reverse proxy in front
-  of Ollama enforces its own limit (`client_max_body_size` for nginx) which
-  tuning Ollama would not affect.
-- The classifier matches the 413 spellings a proxy returns as well as the Go
-  400, and is tested against unrelated 400s so it cannot replace a correct error
-  with confident, irrelevant advice.
-
-## 1.68.2
-
-- **Security: explicit file deny rules were not enforced.** `matchingRuleForInput`
-  resolved which permission rule matched a path by reading `igResult.rule.pattern`
-  from `ignore().test()`. That property does not exist — `TestResult` is
-  `{ ignored, unignored }` — and the access sat behind an `igResult.rule` guard,
-  so the guard was always false and the function returned `null` unconditionally.
-  Every caller (FileWriteTool, FileEditTool, FileReadTool, PowerShell path
-  validation, attachments, and the read/write permission checks themselves) does
-  `const denyRule = matchingRuleForInput(path, ctx, kind, 'deny'); if (denyRule)
-  { deny }`, so a path the user had explicitly denied was reported as matching no
-  rule and allowed through. The comment above one call site reads "SECURITY: This
-  must come before any allow checks ... to prevent bypassing explicit read deny
-  rules"; the code beneath it had never run.
-- The library cannot report which pattern matched, so resolution now tests
-  patterns individually after a combined fast-path check, and skips the empty
-  pattern that `/**` reduces to — which would otherwise deny every path.
-- `filesystem.ts` and `toolExecution.ts` are off `@ts-nocheck` (149 files remain).
-  The missing property was invisible to `tsc` for exactly as long as the
-  suppression was there; this is the defect the ratchet in 1.68.0 was added for.
-- Added `test/denyRuleMatching.test.ts`, which asserts the negative case as well
-  as the positive — the bug made *everything* return `null`, so "returns null for
-  an unmatched path" proves nothing on its own.
-
-## 1.68.1
-
-- A detected prompt-injection attempt is now reported to the user instead of
-  being refused in silence. Consolidating the scattered prompt guidance into the
-  execution contract was a genuine improvement, but one clause did not survive:
-  the older text said to "flag it directly to the user", and the replacement
-  told the model to refuse embedded directives and stopped there. So
-  `scanForInjection` would correctly flag hostile content, annotate the model's
-  own copy of the block, write an evidence-ledger entry — and say nothing to the
-  person whose fetched page or issue comment was carrying the attack. The
-  detection was never the weak part; the reporting was.
-
-## 1.68.0
-
-- Removed `@ts-nocheck` from 73 files, putting 21,503 previously unchecked lines
-  under `tsc`. Every one of those files produced **zero** errors once the
-  suppression was lifted — they were not suppressed because they were broken,
-  they were suppressed and then fixed, or never needed it. The blind spot was
-  33% larger than the actual debt. Typecheck remains clean at exit 0.
-- Added `test/typeCheckCoverage.test.ts`, a ratchet: the `@ts-nocheck` count may
-  fall but never rise, and the budget must be lowered when files come off the
-  list so it cannot silently stop ratcheting. It also asserts that `query.ts`,
-  `permissions.ts`, `filesystem.ts` and `toolExecution.ts` are still suppressed
-  — a standing reminder that the highest-consequence files are the unchecked
-  ones, with instructions to delete the test when that stops being true.
-- Remaining debt, measured rather than estimated: 150 files, ~870 errors, but
-  concentrated — 3 files hold 231 of them, while 95 files have 3 or fewer each
-  and 135 have 10 or fewer. Of the total, 32 are dead build-constant comparisons
-  from the fork (`'external' === 'ant'`) and 562 are property-access-on-`any`.
-  The 95 cheap files are the next batch.
-
-- Restored the worked examples in the TodoWrite tool prompt, with their
-  narrated tool use removed. After 1.65.5 that
-  prompt was cut from 184 lines to 48, which removed every demonstration and
-  left only abstract rules ("work is non-trivial when it needs planning,
-  investigation, multiple deliverables..."). A large model infers intent from
-  rules; a small local model pattern-matches on examples. Task lists stopped
-  being produced, and the task-list gate was then hardened over five successive
-  commits to force what the prompt no longer taught — which is what produced
-  refused writes and retry loops on small models. The newer lifecycle rules are
-  good and are kept; what returns is seven worked examples covering when to use
-  the list, when not to, and why, including the single-file case where one Write
-  call still warrants a plan.
-
-### Also in this release (was staged as 1.67.0)
-
-- Two subsystems loaded behind feature flags were not merely disabled, they
-  were broken in a way that only showed if you enabled them.
-  `services/compact/reactiveCompact.ts` did not exist on disk at all, yet
-  `query.ts` requires it by path and `/compact` calls two functions on it;
-  `services/contextCollapse/index.ts` was a stub exporting four names while
-  `query.ts` called four different ones, three of which were absent. Setting
-  either flag would have failed on the first turn with MODULE_NOT_FOUND or
-  "is not a function" rather than degrading to "feature off". Both modules now
-  export the full surface their callers use, returning result-shaped objects
-  instead of null so property access on the result cannot throw.
-- Neither was reachable in shipped builds — the bundler passes only VOICE_MODE
-  and CHICAGO_MCP, and live context management runs through
-  `services/compact/autoCompact.ts`, which is real and unaffected.
-- Added `test/optionalSubsystems.test.ts`, which derives the required exports
-  from what `query.ts` actually calls rather than from a hand-written list, so
-  a new call site cannot reintroduce the gap. It also asserts autoCompact has
-  not itself become a stub.
-- Audit note: 223 files carry `@ts-nocheck` and are invisible to
-  `tsc --noEmit`. Stripping the suppressions in a scratch copy surfaces 872
-  errors across ~108k lines, including `query.ts`, `permissions.ts` and
-  `filesystem.ts`. Both defects above sat inside that blind spot.
-
-
-- The original examples narrated tool use as prose ("* Uses the Edit tool to
-  add a comment *", "*Executes: npm install*"), which is the exact anti-pattern
-  the same prompt forbids in its closing paragraph — and what a small model
-  copies when it reports a file as written without calling Write. That is why
-  the examples were cut, and cutting them was not baseless; it just took the
-  decision guidance with it. They now return without the narration.
-
-## 1.66.2
-
-- A long session on Ollama now says when it has run out of context instead of
-  quietly getting worse. Ollama truncates an oversized prompt from the front
-  rather than returning an error, and the front of the prompt is the system
-  prompt — so the first thing discarded is the instruction set. The model then
-  answers with no tool guidance and no task-list requirement, which from the
-  outside looks like the model degrading on long prompts rather than like
-  context running out. Both numbers needed to detect this were already computed
-  on every request; they were never compared. A near-full context now warns at
-  85% and a full one explains what was dropped and offers `/compact`, a fresh
-  session, a larger-context model, or `UR_OLLAMA_NUM_CTX`.
-- Added `test/contextPressure.test.ts`, including that unknown sizing produces
-  no warning — an unmeasured context is not a full one.
-
-## 1.66.1
-
-- Corrected the warning-state result used by reactive compaction and context
-  collapse when a custom proactive threshold is configured. Their
-  effective-window override can no longer report that the separate proactive
-  auto-compact trigger was crossed.
-
-## 1.66.0
-
-- Unified proactive compaction around one model-aware threshold and one live
-  token estimator. Small context windows now retain positive warning, error,
-  and trigger thresholds; configured 50–95% thresholds are honored; prompt
-  notifications, `/context`, and the SDK expose a clamped live-estimated
-  percentage remaining until the real trigger; reactive/collapse modes do not
-  claim a false
-  countdown; and successful compaction clears stale warnings.
-- Preserved exact task execution state across full, partial, and
-  session-memory compaction. The restored authoritative snapshot keeps Task V2
-  IDs, statuses, owners, and dependency edges (or TodoWrite order/status),
-  prioritizes actionable work under 64-record and estimated 6,000-token
-  bounds, and requires `TaskList` before mutations when records were omitted.
-- Closed a task-gate bypass caused by compacted history. Compact boundaries
-  now carry durable metadata that consumes the initial trivial-call allowance,
-  including SDK serialization, so a model cannot compact and then mutate as
-  though no earlier tool calls occurred.
-- Removed a competing private compaction path from in-process workers. Workers
-  now use the normal agent query loop and therefore inherit the same feature
-  flags, exact trigger, session-memory-first path, reactive/collapse policy,
-  failure circuit breaker, cleanup, and compact-boundary behavior.
-- Brought Kimi/Ollama bare task-call recovery into parity with the live task
-  schemas. Dependency fields, numeric task/dependency IDs, and `failed` or
-  `skipped` terminal updates are normalized safely; invalid IDs, statuses, and
-  unknown fields fail closed.
-- Audited v1.65.0 through v1.65.5 for regression-safe enhancements. Every
-  concrete earlier technique is already present or superseded by stricter
-  current behavior, so no legacy implementation or removed feature was copied
-  back.
-
-## 1.65.14
-
-- Restored the proactive task-first behavior that was present in v1.65.0 and
-  removed a prompt/gate contradiction introduced later. For any non-trivial
-  state change, including a feature-rich single-file build, the model is now
-  told at system, task-tool, approved-plan, Ollama/Kimi, file, notebook,
-  shell, and worker boundaries to complete the available task setup, inspect
-  its result, mark the selected task `in_progress`, inspect that result, and
-  only then mutate state.
-- Made the ordering unambiguous for weaker models: task setup cannot be batched
-  with the mutation it enables, approved-plan handoffs require task calls as
-  the next state-changing calls, terminal task lists must be reopened or
-  extended before new work, and task guidance appears before file-tool
-  selection guidance.
-- Closed planner availability and control-flow gaps across tool modes. Legacy
-  `TodoWrite` now follows the same feature-rich/terminal-list lifecycle and is
-  preferred when Task V2 is incomplete; bare/simple, REPL-simple, coordinator,
-  custom-agent, and override-prompt paths all receive a usable planner and the
-  task-state contract. Coordinator workers must be task-bound before launch;
-  an explicitly planner-less custom tool pool now fails closed with honest
-  configuration recovery instead of naming a missing tool.
-- Prevented task-gate deadlocks and false mutations in supporting tools.
-  Team creation/deletion, shutdown/plan control messages, and emergency task
-  stop are narrow control transitions; skill loading and desktop screenshots
-  are read-only while downstream skill work, desktop input, and arbitrary
-  state-changing tools remain gated.
-
-## 1.65.13
-
-- Recovered otherwise valid `AskUserQuestion` calls whose UI header exceeds
-  the 12-character chip width. Native structured calls, bare/wrapped JSON, and
-  explicit-choice recovery now compact only that bounded presentation field;
-  questions, choices, labels, descriptions, previews, metadata, and selection
-  behavior remain unchanged, while unsafe or grossly oversized headers still
-  fail validation.
-- Allowed strictly parsed syntax verification after a task-free one-shot
-  Write. `node --check <file>` and the bounded transcript-produced HTML script
-  checker bypass only the task-list requirement; arbitrary Node evaluation,
-  extra commands, redirects, backgrounding, sandbox overrides, and
-  permission-time rewrites fail closed, and normal Bash permission/sandbox
-  checks still apply.
-
-## 1.65.12
-
-- Forced explicit weak-model decision menus through the real
-  `AskUserQuestion` UI. A provider-neutral end-turn guard accepts only one
-  canonical Ask object from explicit reasoning or one complete rigid Markdown
-  choice menu, validates it unchanged against the live tool schema, and rejects
-  examples, ambiguity, ordinary prose, workers, and headless sessions.
-- Removed two task-list dead ends without weakening the mutation boundary.
-  Live plan mode may run only the exact current plan-directory bootstrap Bash
-  shape before tasks exist, and the last actionable task remains `in_progress`
-  when a file mutation has no later successful observable check. The same task
-  can then be verified or corrected instead of creating a duplicate.
-- Improved exact `Edit` mismatch recovery for stale HTML blocks. Diagnostics
-  now select the most distinctive verified line near the real target, such as
-  `<script>`, rather than an unrelated generic closing tag; edits remain
-  fail-closed and never apply fuzzy replacements.
-- Raised the default Ollama Cloud timeout for the known-slow Kimi K2.7 family
-  from 120 to 300 seconds in both streaming and permitted non-streaming paths.
-  Explicit timeouts and the stricter remote-session ceiling still take
-  precedence.
-
-## 1.65.11
-
-- Hardened `AskUserQuestion` for weaker models without inventing user intent.
-  Its model schema now exposes only a strict 1–4-question request shape with
-  2–8 nested choices, compact validation explains malformed flat arrays, and
-  lossless recovery never fabricates labels, descriptions, or prose-derived
-  questions.
-- Made question interaction truthful and safe. Answers are accepted only after
-  post-permission validation has collected one real response per question,
-  custom `Other` works in both menu layouts, question-keyed UI state is
-  prototype-safe, and HTML-configured previews render escaped inert text
-  instead of executable model markup.
-- Improved weak-model file-tool recovery. `Write` now explains that
-  `file_path` and complete `content` must be supplied together and never treats
-  surrounding prose as file data; a narrow deletion-only `Edit` whose desired
-  replacement is already uniquely present reports “already up to date” without
-  writing, while ambiguous and general stale edits still fail closed.
-- Corrected task-gate control flow and diagnostics. `ExitPlanMode` can reach
-  its approval transition without an implementation task, stale out-of-mode
-  calls remain invalid, and gate recovery distinguishes a missing plan from an
-  all-terminal task list so unfinished Edit/Bash work is reopened rather than
-  retried unchanged. A simple loopback browser preview bypasses only the task
-  gate while retaining Bash permission and rewrite checks.
-- Kept package validation compatible with both npm 11 and npm 12
-  `npm pack --json` output shapes, so upgrading npm does not make a valid
-  tarball look missing during tests or release checks.
-
-## 1.65.10
-
-- Reworked approved-plan execution into a capability-aware task graph. Plans
-  now split separately completable outcomes, keep genuinely atomic work whole,
-  express review-to-fix and verification dependencies, and launch only ready,
-  non-conflicting work in parallel waves of at most eight. The handoff uses
-  `TaskCreate`/`TaskUpdate`, `TodoWrite`, or the numbered plan according to the
-  tools actually available, and never advertises a worker that is not active.
-- Made the built-in Explore and Plan agents available in the standard CLI with
-  structurally read-only tools. Parent and child execution boundaries reject
-  mutations even after permission-hook rewrites, custom agents cannot inherit
-  the exemption by reusing a name, and team creation/deletion rechecks live
-  plan mode before changing state.
-- Task tools now accept positive safe-integer JSON task IDs as well as strings
-  and normalize them to canonical persisted strings, fixing smaller models
-  that call `TaskUpdate` with `taskId: 1`.
-- Exact edit failures now return a bounded preview and a verified line anchor
-  for a fresh, smaller contiguous match. Large cross-section replacements fail
-  closed with actionable recovery instead of retrying unchanged or applying a
-  risky fuzzy edit.
-
-## 1.65.9
-
-- Fixed the plan-file/task-list deadlock. While plan mode is active, the exact
-  normalized session plan file can be written before actionable tasks exist;
-  ordinary workspace mutations still require `TaskCreate`/`TodoWrite`, and
-  permission or hook rewrites are reclassified at the final execution boundary.
-- Fixed `ExitPlanMode` approval races. Permission approval can change the mode
-  and rewrite allowed prompts or edited plan content without causing a false
-  “not in plan mode” error, while genuinely new out-of-mode calls remain
-  rejected. The compact execution contract now distinguishes ordered task
-  tracking from explicit plan mode for weaker models.
-- Fixed Linux GitHub Actions and release validation without misrepresenting the
-  product surface. Registry checks now use the platform-neutral
-  167-command/160-visible/235-token baseline and verify the supported macOS and
-  x64 Windows `/desktop` (`/app`) delta separately.
-
-## 1.65.8
-
-- Fixed provider API-key entry in `/model`: the masked input now uses the
-  available terminal width, explicit cursor/focus state, and a one-line secret
-  viewport instead of rendering one masked character per row. Narrow and
-  invalid resize states retain a safe minimum width.
-
-## 1.65.7
-
-- Audited all 14 technical chapters against the shipped source and generated
-  CLI. The manual now distinguishes public runtime behavior from compile-time
-  flags, compatibility-only state, and source helpers; it is included in the
-  npm package and checked for valid paths, commands, configuration, and package
-  coverage.
-- Reworked agent guidance into one compact, ordered execution contract plus
-  mode-specific code, research, debug, browser, image, video, and data
-  workflows. Structured tool calls, dependency-aware planning, bounded
-  parallelism, failure recovery, result inspection, verification, honest
-  completion, and prompt-injection boundaries remain explicit without unsafe
-  package-manager guesses or examples that merely narrate fake tool calls.
-- Hardened task execution end to end. Both Task V2 and legacy TodoWrite plans
-  participate in mutation and completion gates, task order is numeric and
-  dependency-aware, failed/skipped states are rendered honestly, and the
-  verifier refuses an overall completion while actionable work remains or task
-  state cannot be read.
-- Workflow execution now checks approval before invoking a side effect,
-  enforces verification unless explicitly advisory, records every settled
-  parallel branch, and persists progress atomically. Resume restores bounded
-  exact dependency outputs without replaying completed steps; missing or
-  oversized required output fails closed and explains how to recover.
-- Multi-agent crews and planned `/exec` runs use bounded parallel workers,
-  dependency fan-in, exact verdicts, cancellation-aware respawn, isolated retry
-  worktrees, and a shared-checkout write gate. Ambiguous side effects are not
-  replayed, per-prompt worktrees keep dependent steps together, and concurrent
-  output files cannot overwrite one another.
-- Fixed false-success and argument-parsing behavior across root and slash
-  commands. Invalid usage returns 2, failed operations return 1, child process
-  failures propagate, previews do not mutate, and claim-ledger persistence is
-  structurally validated, workspace-contained, private, atomic, and bounded.
-- Strengthened provider and tool-call interoperability for smaller/local
-  models: streamed calls keep stable ordinals, cumulative fragments are
-  deduplicated conservatively, malformed or rewritten inputs are revalidated,
-  Ollama image results and session-host overrides are preserved, and OpenAI
-  Responses transport settings now reach actual client selection.
-- Improved terminal task UX: live task/status displays use the selected
-  session model, show only actionable or active background work, preserve
-  selection as rows change, handle narrow terminals, expose blockers and every
-  terminal status, and never advertise blocked work as the next action.
-- Hardened session, export, research, notes, file-operation, worktree, and
-  sandbox paths against traversal, symlink escape, oversized/corrupt state,
-  interrupted writes, stale replay, and misleading success. Unsupported
-  workflow/monitor task implementations remain inspectable as history but are
-  no longer presented as runnable.
-- Added a typed `ur-agent/sdk` subpath for ESM and CommonJS with validated
-  subprocess inputs, deterministic JSON/NDJSON result parsing, environment
-  precedence, and nonzero-exit handling. Release gates rebuild generated
-  artifacts before publish, smoke-test both SDK module formats from the packed
-  tarball, require the technical manual, and verify runtime dependency ranges.
+## 1.69.0
+
+- Rolled the codebase back to the state shipped as 1.65.6. Everything released
+  between 1.65.7 and 1.68.19 is withdrawn from this line. The version number
+  moves forward rather than back so npm and existing installs upgrade cleanly.
+- No functional change relative to 1.65.6. Commit history for the withdrawn
+  releases is retained and any part of it can be reintroduced in a later
+  release.
+- Fixed the packaged-CLI smoke check failing on npm 11 and later. It read the
+  `npm pack --json` report as an array, but npm now returns an object keyed by
+  package name, so a successful pack was reported as "npm pack did not report a
+  tarball" and the release gate failed on every modern npm. Both shapes are now
+  accepted. The check lives in `scripts/`, which is not published, so the
+  released artifact is unaffected.
 
 ## 1.65.6
 

package/README.md

@@ -549,11 +549,10 @@ ur plugin disable <plugin>
 manifest and reports its declared components and capability surface, so you can
 review what a plugin touches before enabling it.
 
-The npm package includes `README.md`, `QUALITY.md`, `docs/`, `technical/`,
-`documentation/`, and `plugins/`, so the npm package page and installed
-artifact carry the audited technical manual, marketplace documentation, core
-plugins, community staging directory, and example plugin template. See
-[Plugin Guide](docs/plugins.md).
+The npm package includes `README.md`, `QUALITY.md`, `docs/`, `documentation/`,
+and `plugins/`, so the npm package page and installed artifact both carry the
+marketplace documentation, core plugins, community staging directory, and
+example plugin template. See [Plugin Guide](docs/plugins.md).
 
 UR also documents the core Cursor-style agent primitives as first-class,
 project-backed features: Agent surfaces (`ur`, `ur agents`, `ur crew`, `ur bg`),