ur-agent 1.78.11 → 1.78.14

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## 1.78.14
+
+- Interactive prompts no longer create the synthetic `Planning requested work`
+  task before the model understands the request. The task surface stays quiet
+  for conversation, one-step changes, acknowledgements, and small corrections;
+  concrete task boards remain available for multi-step, dependent, delegated,
+  or explicitly tracked work. Existing explicit tasks still survive
+  interruptions, while legacy automatic placeholders are hidden immediately
+  and removed at the next generation boundary without reusing their IDs.
+- Task guidance no longer demands one task for every actionable message. Large
+  prompts still decompose into bounded outcome-based tasks, and follow-ups
+  update relevant tracked work instead of copying the user's reply into a new
+  task title.
+- Security dependency floors now include patched `fast-uri`, `hono`,
+  `ip-address`, `undici`, `@hono/node-server`, and MCP SDK releases after new
+  registry advisories made the prior lockfile fail the release audit.
+
+## 1.78.13
+
+- The release workflow now publishes its downloaded tarball with an explicit
+  `./dist-release/...` filesystem path. npm interpreted the previous bare
+  `dist-release/...` value as GitHub shorthand and attempted to clone
+  `github.com/dist-release/ur-agent-<version>.tgz` over SSH even though the
+  verified artifact existed. A release-readiness regression assertion prevents
+  the local-path prefix from being removed again.
+
+## 1.78.12
+
+- Completed or failed automatic `Planning tasks` seeds no longer remain in the
+  task panel or status bar after a simple turn finishes. Pending and
+  in-progress seeds remain visible for honest interruption recovery, while the
+  terminal snapshot stays internal so a corrective follow-up can reopen it
+  without turning the user's reply into a task title.
+- The active checkout now keeps benchmark evidence only for its current
+  package version. Superseded 1.37.2 result snapshots, an obsolete release
+  audit, and a superseded root IDE design draft were removed; the benchmark
+  guide now derives comparison paths from `package.json`. Historical evidence
+  remains available from immutable Git tags and releases instead of being
+  duplicated in the current tree.
+- Release publication now preflights `NPM_TOKEN` before creating a GitHub
+  Release whenever the version is not already on npm. A missing credential
+  fails the workflow explicitly instead of reporting success after publishing
+  only half of the release, and release-readiness tests lock in the dependency
+  ordering.
+- Repository maintenance removed stale generated archives, caches, logs,
+  duplicate/FUSE/Finder files, abandoned worktree records, redundant local
+  helper branches, and unreachable Git objects. Remote branches, tags, and all
+  reachable history are preserved. The safety-matrix executable guard now
+  compares canonical paths, so `bun run safety:matrix -- --check` still runs
+  under Bun when `argv[1]` is relative, and benchmark schema tests no longer
+  depend on a deleted historical placeholder.
+
 ## 1.78.11
 
 - Provider-reported context overflow now triggers one bounded automatic

package/RELEASE.md

@@ -90,6 +90,15 @@ GitHub Actions publishes the exact tarball that passes the release workflow.
 Do not run `npm publish` separately and do not create a tag before the release
 commit is on the remote branch.
 
+The repository secret `NPM_TOKEN` must be configured before tagging a version
+that is not already published. The workflow checks this before it creates the
+GitHub Release, preventing a partial GitHub-only release from being reported as
+successful. Treat a failed credential preflight as a release blocker; configure
+the secret and re-run the same immutable tag rather than publishing manually.
+The npm publish step uses `./dist-release/<tarball>.tgz`: the explicit relative
+path marker prevents npm from interpreting the artifact name as GitHub
+`owner/repository` shorthand.
+
 Only after every check passes, commit the complete release and push it:
 
 ```bash