ur-agent 1.78.13 → 1.79.0

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 1.79.0
+
+- Plugin discovery now searches managed, personal, workspace, implicit,
+  built-in, session, and installed catalogs with deterministic relevance,
+  provenance, capability/status filters, secret-redacted source metadata,
+  exact detail views, graceful per-catalog failure handling, and structured
+  JSON through `ur plugin search` and `ur plugin show`.
+- Research is now evidence-backed rather than a notes-only surface. `ur
+  research` creates durable workspaces, records sanitized sources and atomic
+  findings, tracks open questions and contested evidence, requires citations,
+  warns when high-confidence claims lack independent corroboration, and emits
+  verified Markdown reports. The bundled `research-pro` workflow steers the
+  agent through current primary-source research and disconfirming evidence.
+- Coding change planning now combines TypeScript compiler-resolved callers,
+  import-graph blast radius, definitions, focused tests, related docs/config,
+  risk reasons, and detected verification scripts through `ur repo-edit
+  impact`. Read-only caller/unused results retain exact references, and
+  imported-alias caller resolution now compares both sides of the binding.
+- `ur design3d` adds reproducible Blender Python, OpenSCAD, and Autodesk 3ds
+  Max MAXScript projects plus an explicitly reviewed, shell-free adapter for
+  Maya, FreeCAD, Houdini, Cinema 4D, Rhino, and other DCC/CAD applications.
+  It discovers installed apps, validates workspace-confined manifests, plans
+  fixed argv, gates custom execution, builds with bounded time/output, inspects
+  GLB/glTF/STL/OBJ/BLEND/MAX assets, and uses the Khronos glTF Validator when
+  installed. The bundled `dcc-design` workflow adds unit, scale, parametric,
+  interoperability, manufacturing, and native-application verification rules.
+
+## 1.78.14
+
+- Interactive prompts no longer create the synthetic `Planning requested work`
+  task before the model understands the request. The task surface stays quiet
+  for conversation, one-step changes, acknowledgements, and small corrections;
+  concrete task boards remain available for multi-step, dependent, delegated,
+  or explicitly tracked work. Existing explicit tasks still survive
+  interruptions, while legacy automatic placeholders are hidden immediately
+  and removed at the next generation boundary without reusing their IDs.
+- Task guidance no longer demands one task for every actionable message. Large
+  prompts still decompose into bounded outcome-based tasks, and follow-ups
+  update relevant tracked work instead of copying the user's reply into a new
+  task title.
+- Security dependency floors now include patched `fast-uri`, `hono`,
+  `ip-address`, `undici`, `@hono/node-server`, and MCP SDK releases after new
+  registry advisories made the prior lockfile fail the release audit.
+
 ## 1.78.13
 
 - The release workflow now publishes its downloaded tarball with an explicit

package/README.md

@@ -46,7 +46,15 @@ handing work off to other tools or agents when needed.
   `ur workspace`, `ur test-first`, `ur ci-loop`, `ur bg`, `ur workflow`,
   `ur crew`, and `ur automation` for structured work beyond a single chat turn.
 - **Reliable repo editing.** Use `ur repo-edit` for indexed search,
-  AST-aware rename plans, patch previews, and rollback-safe multi-file apply.
+  compiler/graph change-impact maps, AST-aware rename plans, patch previews,
+  and rollback-safe multi-file apply.
+- **Evidence-backed research.** Use `ur research` to persist sanitized sources,
+  cited findings, open questions, independent-corroboration checks, and
+  reviewable Markdown reports instead of relying on an unstructured note list.
+- **Professional 3D workflows.** Use `ur design3d` for scriptable Blender,
+  OpenSCAD, Autodesk 3ds Max, and reviewed custom DCC/CAD app pipelines with
+  real-world units, dry-run argv, bounded builds, format inspection, and glTF
+  validation.
 - **Permission and context control.** Use `ur safety` and `ur context-pack` to
   inspect command risk, initialize project safety policy, summarize repository
   architecture, and preserve task decisions, constraints, commands, diffs,
@@ -403,7 +411,9 @@ as first-class subcommands in the shipped CLI.
 | `ur crew` | Run dependency-aware worker subagents over a shared task board; independent tasks fan out, while bounded retries require isolated worktrees. |
 | `ur pattern` | Run multi-agent collaboration patterns (PEER, DOE, concurrent, handoff, debate, parallel); `--execute` runs them as a workflow. |
 | `ur goal` | Track long-horizon objectives that persist across sessions. |
-| `ur repo-edit` | Build a repo edit index, plan AST-aware renames, preview patches, and apply with rollback. |
+| `ur repo-edit` | Build a repo edit index, map symbol/file blast radius and verification targets, plan AST-aware edits, preview patches, and apply with rollback. |
+| `ur research` | Create source-backed research workspaces, add cited findings/open questions, verify corroboration, and emit Markdown reports. |
+| `ur design3d` | Discover 3D apps and create, plan, build, inspect, or validate Blender, OpenSCAD, 3ds Max, and custom DCC/CAD projects. |
 | `ur code-index` | Build, query, or watch a local semantic code index using Ollama embeddings; `ur code-index repo` adds files/symbols/calls/tests/docs/configs. |
 | `ur semantic-memory` | Build and search a project-local memory index. |
 | `ur memory retention` | Configure and apply local memory retention policies (TTL, max entries, decay). |
@@ -538,6 +548,9 @@ validator, and Markdown language-adapter metadata.
 
 ```sh
 ur plugin list
+ur plugin search git
+ur plugin search --capability skills --json
+ur plugin show github@ur-plugins-official
 ur plugin doctor
 ur plugin install engineering-discipline@ur-plugins-official
 ur plugin install hello@ur-plugins-official
@@ -545,9 +558,15 @@ ur plugin update <plugin>
 ur plugin disable <plugin>
 ```
 
-`ur plugin doctor` validates every installed, project, and bundled plugin
-manifest and reports its declared components and capability surface, so you can
-review what a plugin touches before enabling it.
+`ur plugin search` discovers plugins across managed, personal, workspace,
+implicit, built-in, and session catalogs. Results use deterministic relevance
+ranking, show catalog/source provenance and installation state, support
+capability/marketplace/installed filters, and remain available as structured
+JSON for scripts. `ur plugin show` prints one plugin's complete discovery
+metadata and an exact install command. `ur plugin doctor` validates every
+installed, project, and bundled plugin manifest and reports its declared
+components and capability surface, so you can review what a plugin touches
+before enabling it.
 
 The npm package includes `README.md`, `QUALITY.md`, `docs/`, `documentation/`,
 and `plugins/`, so the npm package page and installed artifact both carry the
@@ -606,6 +625,17 @@ ur desktop-qa validate .ur/desktop-qa/fixtures/smoke.json
 ur automation create nightly --schedule "0 9 * * 1-5" --prompt "Review open tasks"
 ur repo-edit preview rename oldName --to newName
 ur repo-edit apply rename oldName --to newName --check "bun test"
+ur repo-edit impact checkoutTotal --depth 5
+ur research init agent-landscape --question "Which capabilities shipped in 2026?"
+ur research source agent-landscape --url https://example.com/spec --title "Primary specification"
+ur research finding agent-landscape --text "The feature shipped." --cite S1,S2 --confidence high
+ur research verify agent-landscape
+ur research report agent-landscape --out docs/research/agent-landscape.md
+ur design3d doctor
+ur design3d init product-shot --engine blender --units mm --format glb
+ur design3d init studio-scene --engine 3dsmax --units cm --format max
+ur design3d build design3d/product-shot --dry-run
+ur design3d validate design3d/product-shot
 ur code-index search "where is the rate limiter configured"
 ur code-index repo build
 ur code-index repo search "rate limiter"

package/RELEASE.md

@@ -90,15 +90,31 @@ GitHub Actions publishes the exact tarball that passes the release workflow.
 Do not run `npm publish` separately and do not create a tag before the release
 commit is on the remote branch.
 
-The repository secret `NPM_TOKEN` must be configured before tagging a version
-that is not already published. The workflow checks this before it creates the
-GitHub Release, preventing a partial GitHub-only release from being reported as
-successful. Treat a failed credential preflight as a release blocker; configure
-the secret and re-run the same immutable tag rather than publishing manually.
+Configure npm trusted publishing for package `ur-agent` before tagging a version
+that is not already published. In npm package settings, select GitHub Actions
+with owner `Maitham16`, repository `UR`, workflow `release.yml`, no environment,
+and allow `npm publish`. The publish job uses GitHub OIDC (`id-token: write`), so
+it needs no long-lived `NPM_TOKEN` and cannot stall on interactive 2FA. The
+GitHub Release waits for npm publication, preventing a registry authentication
+failure from creating a new partial GitHub-only release. Treat a failed publish
+as a release blocker; fix trusted-publisher configuration and dispatch the same
+immutable tag rather than publishing manually.
 The npm publish step uses `./dist-release/<tarball>.tgz`: the explicit relative
 path marker prevents npm from interpreting the artifact name as GitHub
 `owner/repository` shorthand.
 
+If an immutable tag failed only during publication, fix the trusted-publisher
+configuration and retry that tag through the default branch workflow:
+
+```bash
+gh workflow run release.yml -f tag=v$(node -p "require('./package.json').version")
+```
+
+Do not move or recreate the tag. Once OIDC publication succeeds, the workflow
+updates or creates the matching GitHub Release from the verified tarball.
+After a successful migration, remove the obsolete `NPM_TOKEN` repository secret
+and revoke that npm token so CI has no dormant long-lived publish credential.
+
 Only after every check passes, commit the complete release and push it:
 
 ```bash