ur-agent 1.78.14 → 1.79.1

package/docs/AGENT_FEATURES.md

@@ -9,6 +9,21 @@ reproducible autonomous software engineering agent: every substantial task can
 be driven as `spec -> plan -> patch -> test -> report -> rollback`, with the
 spec as the durable source of truth and command evidence as the success gate.
 
+## v1.79.1 Addition
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Self-healing Bash task output | `src/utils/Shell.ts`, `src/utils/permissions/filesystem.ts`, `test/shellExecutionIntegration.test.ts` | Uses the platform temp directory instead of assuming `/tmp`, aligns sandbox and permission roots, re-ensures temporary output storage for every launch, and atomically retries stdout/stderr creation after external directory cleanup so Bash recovers without restarting UR. |
+
+## v1.79.0 Additions
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Cross-catalog plugin discovery | `ur plugin search\|show`, `src/utils/plugins/pluginDiscovery.ts` | Deterministic ranked discovery across managed, personal, workspace, implicit, built-in, session, and installed catalogs with source/scope provenance, capability/status filters, secret redaction, graceful catalog degradation, and JSON output. |
+| Evidence-backed deep research | `ur research init\|source\|finding\|question\|verify\|report`, `/research-pro`, `.ur/research/projects/` | Atomic source-backed projects, sanitized URLs, cited/contested/open findings, independent-publisher checks for high confidence, durable open questions, SHA-256 state digests, workspace-confined Markdown reports, and a primary-source research workflow. |
+| Compiler/graph change impact | `ur repo-edit impact`, `src/services/repoEditing/changeImpact.ts` | Combines compiler-resolved callers, import-graph dependents, definitions, focused tests, related docs/config, risk reasons, and detected package verification commands before editing. Imported aliases resolve correctly and read-only AST results retain exact references. |
+| Professional 3D and DCC/CAD automation | `ur design3d`, `/dcc-design`, `src/services/design3d/design3d.ts` | Parametric Blender Python, OpenSCAD, and 3ds Max MAXScript scaffolds; discovery for Maya, FreeCAD, Houdini, Cinema 4D, Rhino, and Khronos validation; shell-free reviewed custom adapters; bounded build execution; workspace confinement; and GLB/glTF/STL/OBJ/BLEND/MAX inspection. |
+
 ## v1.49.0 Additions
 
 - Signed A2A Agent Cards. An Agent Card is discovery metadata served over plain
@@ -245,7 +260,7 @@ automatically changes the active provider.
 
 | Addition | Surface | What it adds |
 | --- | --- | --- |
-| Plugin marketplace capability surfaces | `.ur-plugin/marketplace.json`, `src/utils/plugins/schemas.ts`, `plugins/core/engineering-discipline/` | Marketplace entries can advertise MCP tools, executable skills, templates, validators, language adapters, LSP servers, hooks, agents, and commands. The `engineering-discipline` reference plugin ships a command, reproducible-release skill, release-verifier template, release-gate validator, and Markdown adapter metadata. |
+| Plugin marketplace capability surfaces | `.ur-plugin/marketplace.json`, `src/utils/plugins/schemas.ts`, `src/utils/plugins/pluginDiscovery.ts`, `plugins/core/engineering-discipline/` | Marketplace entries can advertise MCP tools, executable skills, templates, validators, language adapters, LSP servers, hooks, agents, and commands. `ur plugin search/show` adds deterministic cross-catalog discovery, scope/source provenance, installed/enabled state, capability filters, JSON output, and graceful per-catalog failure reporting. The `engineering-discipline` reference plugin demonstrates the extension contract. |
 | Autonomous engineering workflow identity | `README.md`, `documentation/`, `plugins/core/engineering-discipline/skills/reproducible-release` | Positions UR as an autonomous engineering workflow engine: plan, execute, test, verify, document, benchmark, and reproduce, with command evidence and rollback discipline as the product promise. |
 | Release readiness guard | `.github/workflows/test.yml`, `test/releaseReadiness.test.ts` | Asserts production bundle, release, package, and global-install checks run only after the Bun test step succeeds in GitHub CI. |
 

package/docs/AGENT_TRENDS.md

@@ -2,7 +2,7 @@
 
 UR is a provider-flexible, local-first terminal coding agent. This page tracks
 how UR maps to current agent-platform trends and where future work should go
-next. The factual comparison below is a **2026-07-26 research snapshot**; run
+next. The factual comparison below is a **2026-08-10 research snapshot**; run
 `ur agent-trends` for the versioned machine-readable report and re-check the
 linked primary sources before acting on prerelease standards.
 
@@ -17,6 +17,9 @@ ur ag-ui serve --help
 ur agent-features
 ur agent-features init
 ur agent-templates install
+ur plugin search git
+ur plugin search --capability skills --json
+ur plugin show github@ur-plugins-official
 ur model-doctor
 ur automation create nightly --schedule "0 9 * * 1-5" --prompt "Review open tasks"
 ur automation run-due
@@ -26,6 +29,12 @@ ur repo-edit index
 ur repo-edit search checkoutTotal
 ur repo-edit preview rename oldName --to newName
 ur repo-edit apply rename oldName --to newName --check "bun test"
+ur repo-edit impact checkoutTotal --depth 5
+ur research init agent-landscape --question "What capabilities shipped recently?"
+ur research verify agent-landscape
+ur design3d doctor
+ur design3d init studio-scene --engine 3dsmax --units cm --format max
+ur design3d build design3d/studio-scene --dry-run
 ur agent-task pr --create --dry-run
 ur a2a serve --dry-run
 ur semantic-memory build
@@ -84,6 +93,10 @@ Inside an interactive session:
 | Multi-agent orchestration | Covered | built-in planning, exploration, verification, and general-purpose agents; custom agents | Document reusable team patterns and role selection |
 | Long-term memory | Partial | Existing retrieval plus a provenance-rich SHA-256 task-memory chain, file/run/user/web citations, freshness resolution, private atomic writes, quarantine, and rollback | Extend citation/deletion/integrity guarantees to semantic, embedding, and legacy stores |
 | Portable Agent Skills | Covered | Native and `.agents/skills/` project/user discovery, strict validation, deterministic tree/permission digests, Ed25519 signing, trusted keys, and invocation-time integrity checks | Require registry attestations and dependency review before community one-command installation |
+| Cross-catalog plugin discovery | Covered | `ur plugin search/show` searches managed, personal, workspace, implicit, built-in, session, and installed-only sources with deterministic relevance, provenance, capability/status filters, bounded output, secret-redacted sources, graceful catalog failures, and JSON automation | Add signed registry attestations and explicit remote-catalog freshness metadata before recommending unattended installation |
+| Evidence-backed deep research | Covered | `ur research` persists sanitized sources, cited supported/contested/open findings, unresolved questions, independent corroboration warnings, SHA-256 project digests, and workspace-confined Markdown reports; `/research-pro` directs primary-source and disconfirming-evidence collection | Add authenticated source-refresh timestamps and optional archival snapshots without duplicating third-party content by default |
+| Compiler/graph change-impact planning | Covered | `ur repo-edit impact` combines TypeScript compiler references, imported-alias resolution, direct/transitive import dependents, definitions, tests, docs, config, risk reasons, and detected verification commands | Extend exact binding-aware impact to installed LSP languages beyond JavaScript/TypeScript |
+| Professional 3D and DCC/CAD workflows | Covered | `ur design3d` scaffolds and automates Blender, OpenSCAD, and Autodesk 3ds Max; discovers Maya, FreeCAD, Houdini, Cinema 4D, and Rhino; gates shell-free custom adapters; inspects common assets; and invokes Khronos glTF validation when available | Add native headless validators per optional DCC adapter and rendered visual-regression fixtures without pretending structural checks are visual review |
 | Semantic codebase retrieval | Covered | local embedding-based code index (`ur code-index`), opt-in `CodeSearch` tool, incremental re-index, auto-reindex watcher, Ollama embeddings | Add richer symbol-aware ranking |
 | Reliable repo editing | Covered | `ur repo-edit` builds a file/symbol index, performs AST-aware JS/TS identifier rename planning, previews patches before writing, and applies multi-file edits transactionally with rollback on syntax or check failure | Extend AST edits beyond identifier rename into import moves and signature-aware refactors |
 | Permission and safety policy | Covered | `ur safety`, `.ur/safety-policy.json`, pre-Bash safety evaluation, read/write/execute/network command classes, destructive-command approval, sandbox recommendations, and secret exfiltration denial | Record sandbox attestation in every risky command's evidence trail |
@@ -196,6 +209,13 @@ Professional answer requirements:
 
 ## References
 
+- OpenAI ChatGPT and Codex changelog (Agent Plugin catalogs and search): https://developers.openai.com/codex/changelog
+- Gemini CLI release notes (tool-registry discovery): https://github.com/google-gemini/gemini-cli/blob/main/docs/changelogs/index.md
+- TypeScript Project References and compiler structure: https://www.typescriptlang.org/docs/handbook/project-references
+- Blender command-line arguments: https://docs.blender.org/manual/en/latest/advanced/command_line/arguments.html
+- OpenSCAD command-line environment: https://files.openscad.org/documentation/manual/Using_OpenSCAD_in_a_command_line_environment.html
+- Autodesk 3ds Max command-line MAXScript: https://help.autodesk.com/cloudhelp/2024/ENU/MAXScript-Help/files/MAXScript-Introduction/General-MAXScript-Topics/GUID-A04C0E75-F82A-41AC-92E8-D7CB1D797430.html
+- Khronos glTF 2.0 specification and validator: https://registry.khronos.org/glTF/specs/2.0/glTF-2.0.html and https://github.com/KhronosGroup/glTF-Validator
 - OpenAI Responses background mode: https://developers.openai.com/api/docs/guides/background
 - OpenAI Responses WebSocket mode: https://developers.openai.com/api/docs/guides/websocket-mode
 - OpenAI Responses compaction: https://developers.openai.com/api/docs/guides/compaction

package/docs/CONFIGURATION.md

@@ -540,17 +540,40 @@ runtime, and output controls use the `UR_AG_UI_*` prefix. Unsupported client
 tools, multimodal/encrypted input, interrupts, and unimplemented transports are
 rejected rather than silently ignored. See the [AG-UI Guide](AG_UI.md).
 
+## Research and 3D Project State
+
+`ur research` stores private, atomic project ledgers under
+`.ur/research/projects/<id>.json`. Source URLs are restricted to HTTP(S),
+embedded credentials and common secret query parameters are removed, input
+sizes/counts are bounded, and `report --out` may write only inside the current
+workspace. High-confidence supported findings warn unless they cite two
+independent publishers.
+
+`ur design3d init` writes reviewable source plus `design3d.json` under
+`design3d/<name>/`. Source and output paths are confined to that project.
+Blender, OpenSCAD, and 3ds Max use fixed native argv; custom DCC/CAD adapters
+receive separate argv values, never a shell string, and require
+`--allow-custom` after a dry-run review. Builds are time/output bounded and
+refuse to replace existing output without `--force`.
+
 ## Plugins and Skills
 
 Plugins can add commands, tools, and skills:
 
 ```sh
 ur plugin list
+ur plugin search [query] [--capability <name>] [--marketplace <name>] [--installed] [--json]
+ur plugin show <name-or-name@marketplace> [--json]
 ur plugin install <plugin>
 ur plugin update <plugin>
 ur plugin disable <plugin>
 ```
 
+Search reads all configured catalogs with graceful per-catalog failure handling,
+uses deterministic relevance ranking, and labels each result with catalog scope,
+source kind, capabilities, and installed/enabled state. It does not install,
+update, or enable anything.
+
 Skills can be stored in `.ur/skills/` for project-specific workflows or in
 `~/.ur/skills/` for personal workflows. UR also discovers the cross-client
 `.agents/skills/` and `~/.agents/skills/` locations from the Agent Skills

package/docs/GAP_ANALYSIS_2026-08-11.md

@@ -0,0 +1,180 @@
+# UR Gap Analysis — 2026-08-11 Research Snapshot
+
+Baseline: UR `ur-agent@1.79.1`, HEAD `6faed11`, 186 slash commands, 60 tools.
+Upstream references: Claude Code 2.1.226 (2026-08-08), Codex CLI (Aug 2026),
+Gemini CLI v0.53.0 (2026-07-28), MCP spec `2026-07-28`, A2A v1.0 (Apr 2026).
+
+Every "missing" row below was verified absent by grep over `src/`, and every
+"present" row by a concrete file reference. Re-check primary sources before
+acting: prerelease standards move weekly.
+
+---
+
+## 1. Already at parity — no action
+
+UR is closer to the frontier than the trend doc implies. Confirmed present:
+
+| Upstream feature | UR implementation |
+|---|---|
+| MCP `2026-07-28` stateless core | `src/services/mcp/mcp2026.ts` (`MCP_2026_PROTOCOL_VERSION = '2026-07-28'`) |
+| MCP Tasks extension (`tasks/get`, `tasks/update`, `tasks/cancel`) | `src/entrypoints/mcp2026.ts`, `src/services/mcp/mcp2026.ts` |
+| MCP Apps (sandboxed HTML UI) | `ui/initialize`, `ui/resourceUri` in `mcp2026.ts` |
+| MCP Extensions namespacing | `io.modelcontextprotocol/protocolVersion` header + `_meta` cross-check |
+| A2A v1.0 signed Agent Cards | `src/services/agents/a2aCardSignature.ts` (Ed25519 detached JWS), `a2aV1.ts` |
+| ACP / AG-UI servers | `src/services/agents/acpServer.ts`, `agUi.ts` |
+| Cross-session agent messaging | `SendMessageTool`, `ListPeersTool` |
+| Nested subagents with depth/concurrency caps | `src/tools/AgentTool/fanOutLimits.ts`, `fanOutSettings.ts` |
+| Self-hosted runner | `src/self-hosted-runner/main.js`, gated by `feature('SELF_HOSTED_RUNNER')` |
+| `--teleport`-style local continuation | `src/main.tsx`, `src/assistant/sessionHistory.ts` |
+| `AGENTS.md` interop | `src/utils/agentmd.ts`, `memoryFileDetection.ts` |
+| OpenTelemetry instrumentation | `src/utils/telemetry/instrumentation.ts` |
+| Headless spend cap | `--max-budget-usd` in `src/main.tsx` |
+| Plugin marketplace + search/show | `ur plugin search|show` (1.79.0) |
+| Codex `/plan`, `/goal`, `/fork`, `/diff`, `/review` equivalents | `src/commands/{plan,goal,diff,review}` |
+
+Notable divergence, deliberate or not: Anthropic **removed** `ultraplan` in
+Claude Code 2.1.222 (2026-08-04). UR still ships `/ultraplan`. Worth deciding
+whether that is a differentiator or dead weight.
+
+---
+
+## 2. Missing — ranked by value
+
+### P0 — security correctness
+
+**1. Sandbox credential masking / TLS-terminating egress proxy.**
+Claude Code 2.1.221–2.1.224 added `sandbox.credentials` masking with
+`mode: "mask"` sentinel files, `extract` regex spans, `decode: "jwt"` +
+`maskClaims`, and `awsPairs`/`sigv4` re-signing behind `network.tlsTerminate`.
+UR's sandbox is filesystem-scope only — `src/utils/sandbox/sandboxProfile.ts`
+implements `denyRead`/`denyWrite` and nothing else. A sandboxed Bash command in
+UR that can read `~/.aws/credentials` exfiltrates the real secret.
+*Likely same bug present:* upstream patched a trailing-slash bypass where
+`denyRead: "~/.aws/"` was silently ignorable. UR's `normalizedPaths()`
+(`sandboxProfile.ts:51`) dedupes and calls `normalizePath()` but performs no
+trailing-slash stripping of its own — verify `normalizePath` handles it, and add
+a regression test for both `~/.aws` and `~/.aws/`.
+
+**2. `sandbox.network.strictAllowlist` (partial gap).** UR *does* have a network
+allowlist — `sandbox.network.allowedDomains`, `allowManagedDomainsOnly`,
+`allowUnixSockets` in `src/utils/sandbox/sandbox-adapter.ts`. What's absent is
+the strict mode: deny non-allowlisted hosts outright instead of prompting.
+Under automation (`ur exec`, `ur bg`, agentic CI) a prompt is not an answer, so
+today an unattended run either stalls or falls through. One settings key plus a
+branch in the egress decision path.
+
+**3. `Tool(param:value)` permission-rule syntax.** `permissionRuleParser.ts`
+supports only `Tool(content)`. Upstream added input-parameter matching with
+wildcards — e.g. `Agent(model:opus)` to block expensive subagents,
+`Bash(timeout:*)`. Without it, policies cannot constrain *how* a tool is called,
+only which paths it touches.
+
+**4. Bash permission-check hardening.** Upstream shipped three separate bypass
+fixes in Aug 2026: zsh hidden commands inside `[[ ]]` regex conditionals,
+commands padded with tabs/invisible Unicode hiding text from the approval
+dialog, and PowerShell paths containing quote characters. These are parser
+classes, not one-off bugs — audit UR's command splitter against all three.
+
+### P1 — runaway-loop containment
+
+**5. Per-session budgets, not just per-turn limits.** UR caps subagent depth and
+concurrency but has no session totals. Upstream added a WebSearch cap
+(default 200, `CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION`) and a subagent-spawn
+cap, then *removed* the spawn cap once long sessions started failing — so ship
+the search budget, and make the spawn budget advisory rather than fatal.
+
+**6. `--forward-subagent-text` for stream-json.** UR has `--include-hook-events`
+and `--include-partial-messages` but no way to surface subagent text/thinking in
+headless output, including nested (depth-2+) agents keyed by spawning
+`tool_use` id. This blocks CI observability of delegated work.
+
+### P2 — protocol currency
+
+**7. MCP `InputRequiredResult`.** The `2026-07-28` spec deprecates
+server-initiated elicitation and sampling in favor of `InputRequiredResult`.
+UR implements the old `Elicitation`/`ElicitationResult` hooks (`src/types/hooks.ts`)
+and has zero `InputRequired` references. Ship the new shape alongside the old.
+
+**8. MCP `roots/list` + `notifications/roots/list_changed`.** Absent entirely.
+Deprecated in `2026-07-28` (SEP-2577), but pre-2026 servers still expect it, and
+upstream wires additional working directories into it. Low effort, moderate
+compatibility win.
+
+**9. A2A gaps.** Two items: (a) `src/services/agents/trends.ts:666` advertises
+`protocolVersion: '0.3.0'` in the Agent Card while `a2aV1.ts` implements v1.0
+signing — the card lies about its own version; (b) no gRPC transport and no AP2
+payments extension, both part of the v1.0 surface.
+
+### P3 — accessibility and ergonomics
+
+**10. Screen-reader mode.** Zero hits for `axScreenReader`/`--ax-screen-reader`.
+Upstream shipped opt-in plain-text rendering plus per-keystroke and
+per-deletion echo announcements. UR's Ink UI is unusable with a screen reader
+today. This is the single largest addressable-user gap in the list.
+
+**11. `/config key=value` from the prompt.** `src/commands/config/` exposes only
+the interactive panel. Upstream's `/config thinking=false` works in interactive,
+`-p`, and remote modes, with `/config --help` listing shorthand keys — the only
+way to change a setting inside a headless run.
+
+**12. `DirectoryAdded` hook.** UR has `CwdChanged` and `WorktreeCreate` but
+fires nothing on `/add-dir`. Blocks per-directory setup automation.
+
+**13. Explicit `ur session archive` / `unarchive`.** `archiveSession` exists only
+in `src/bridge/`. Codex exposes `/archive` in the TUI and `codex archive` in the
+CLI, with archived sessions protected from resume/fork. UR's session list grows
+without bound.
+
+**14. Vim insert-mode remaps.** `vimInsertModeRemaps` (e.g. `jj` → Escape) is a
+one-setting change against UR's existing `src/vim/`.
+
+**15. Telemetry completeness.** No `assistant_response` OTel log event, no
+`message.uuid`/`client_request_id`/`tool_source` correlation attributes, no
+`workflow.run_id`/`workflow.name`. UR has workflows and multi-agent runs but
+cannot reconstruct a run from OTel data.
+
+---
+
+## 3. Explicitly not recommended
+
+- **`EndConversation` tool.** Abuse-termination for a consumer chat product;
+  irrelevant to a local terminal agent the operator already controls.
+- **Gateway spend-limit UX.** Presupposes Anthropic's managed gateway. UR's
+  `--max-budget-usd` covers the local equivalent.
+- **`/dataviz` skill.** Content, not capability. Ship as a plugin if wanted.
+- **Codex `--approve-for-me`.** Routes approvals through automated review —
+  directly opposed to UR's explicit-trust-boundary stance in
+  `docs/FRONTIER_AGENT_FEATURES.md`.
+
+---
+
+## 4. Suggested sequencing
+
+1. Credential masking + strict network allowlist (#1, #2) — same subsystem.
+2. Bash permission parser audit (#4) + `Tool(param:value)` (#3).
+3. Screen-reader mode (#10) — self-contained in `src/ink/`.
+4. MCP `InputRequiredResult` + `roots/list` (#7, #8); fix the A2A card version (#9a).
+5. Session budgets (#5), `--forward-subagent-text` (#6), OTel attributes (#15).
+6. Ergonomics batch: `/config key=value`, `DirectoryAdded`, session archive,
+   vim remaps (#11–14).
+
+Then update `docs/AGENT_TRENDS.md` — its snapshot line still reads
+`2026-08-10` and the coverage matrix predates the `2026-07-28` MCP final spec.
+
+---
+
+## Sources
+
+- [Claude Code changelog](https://code.claude.com/docs/en/changelog)
+- [Enabling Claude Code to work more autonomously — Anthropic](https://www.anthropic.com/news/enabling-claude-code-to-work-more-autonomously)
+- [The 2026-07-28 MCP Specification](https://blog.modelcontextprotocol.io/posts/2026-07-28/)
+- [The 2026-07-28 MCP Specification Release Candidate](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/)
+- [The 2026 MCP Roadmap](https://blog.modelcontextprotocol.io/posts/2026-mcp-roadmap/)
+- [MCP 2026-07-28 spec: every breaking change, with fixes](https://stacktr.ee/blog/mcp-2026-spec-changes)
+- [Codex CLI in 2026: What's New, What's Changed](https://codex.danielvaughan.com/2026/03/27/codex-cli-in-2026-whats-new/)
+- [Codex Slash Commands: Complete CLI Reference (2026)](https://explainx.ai/blog/codex-slash-commands-complete-reference-guide-2026)
+- [Gemini CLI changelog v0.53.0](https://geminicli.com/docs/changelogs/latest/)
+- [Gemini CLI `/plan` command PR #17698](https://github.com/google-gemini/gemini-cli/pull/17698)
+- [A2A Protocol Guide 2026](https://rapidclaw.dev/blog/a2a-protocol-complete-guide-2026)
+- [MCP vs A2A vs AG-UI: Agent Protocols Guide 2026](https://nextpj.net/blog/mcp-a2a-ag-ui-ai-agent-protocols-guide-2026)
+- [The 2026 Guide to Coding CLI Tools: 15 AI Agents Compared](https://www.tembo.io/blog/coding-cli-tools-comparison)

package/docs/TROUBLESHOOTING.md

@@ -56,6 +56,20 @@ ur config set provider ollama
 ur provider status
 ```
 
+### Every Bash call fails with `ENOENT .../tasks/<id>.output`
+
+- Likely cause: the operating system or a cleanup process reclaimed UR's
+  session task-output directory, or the conventional Unix `/tmp` path is
+  unavailable. The command itself never started; identical failure from
+  `echo ok` distinguishes this harness failure from an application error.
+- Fix: upgrade to UR 1.79.1 or newer. UR now uses `os.tmpdir()`, ensures the
+  output directory for every launch, and automatically recreates and retries
+  when it disappears. Restarting an older session is only a temporary
+  workaround.
+- Verification: start a new UR session and ask it to run `echo ok` through
+  Bash. A successful result confirms the harness; `/design3d doctor` alone
+  validates the local slash command but does not exercise Bash execution.
+
 ## Providers and models
 
 ### Provider selected but the model is unavailable

package/docs/USAGE.md

@@ -277,7 +277,10 @@ UR includes slash commands and CLI subcommands for common workflows:
   allowed user-facing application
 - `ur plugin ...` to manage plugins and marketplaces. Marketplace plugins can
   add MCP tools, commands, executable skills, templates, validators, language
-  adapters, LSP servers, agents, hooks, and output styles.
+  adapters, LSP servers, agents, hooks, and output styles. Use
+  `ur plugin search [query]` for ranked cross-catalog discovery and
+  `ur plugin show <name@marketplace>` to inspect provenance and capabilities
+  before installation.
 - `ur agents` to list configured agents
 - `ur agent-trends` to inspect coverage for current agent technology trends
 - `ur a2a card` to print UR's Agent Card metadata for A2A discovery
@@ -291,7 +294,12 @@ UR includes slash commands and CLI subcommands for common workflows:
 - `ur workspace ...` to coordinate dependency-aware changes across repositories
 - `ur learn playbooks ...` to mine and explicitly approve reusable workflows
 - `/btw ...` to create or continue private durable tool-free side chats
-- `ur repo-edit ...` to index the repo, plan AST-aware renames, preview patches, and apply with rollback
+- `ur repo-edit ...` to index the repo, map compiler/graph change impact, plan AST-aware edits, preview patches, and apply with rollback
+- `ur research ...` to create evidence-backed workspaces with sanitized sources,
+  cited findings, open questions, corroboration checks, and Markdown reports
+- `ur design3d ...` to discover installed DCC/CAD apps and create, plan, build,
+  inspect, or validate Blender, OpenSCAD, Autodesk 3ds Max, and reviewed custom
+  application projects
 - `ur safety ...` to inspect project shell safety policy and preview command risk
 - `ur context-pack ...` to summarize architecture and persist project memory (decisions, constraints, commands, diffs, architecture, preferences, attempts, accepted, rejected)
 - `ur code-index watch` to keep the local semantic code index fresh
@@ -508,6 +516,18 @@ ur repo-edit index
 ur repo-edit plan rename oldName --to newName
 ur repo-edit preview rename oldName --to newName
 ur repo-edit apply rename oldName --to newName --check "bun test"
+ur repo-edit impact checkoutTotal --depth 5
+ur research init current-tools --question "What changed in current coding agents?"
+ur research source current-tools --url https://example.com/changelog --title "Official changelog"
+ur research finding current-tools --text "Tool discovery shipped." --cite S1
+ur research verify current-tools
+ur research report current-tools --out docs/research/current-tools.md
+ur design3d doctor
+ur design3d init web-model --engine blender --units m --format glb
+ur design3d init printable-part --engine openscad --units mm --format stl
+ur design3d init max-scene --engine 3dsmax --units cm --format max
+ur design3d build design3d/web-model --dry-run
+ur design3d validate design3d/web-model
 ur ide diff capture --title "Working tree review"
 ur eval bench list
 ur eval run starter --dry-run --json

package/docs/VALIDATION.md

@@ -19,7 +19,7 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.78.14 (UR-Nexus)"
+# expected for this release: "1.79.1 (UR-Nexus)"
 ```
 
 ## 0.1 First-workspace model selection (1.45.4)

package/docs/plugins.md

@@ -99,6 +99,8 @@ isolated to that plugin.
 
 ```sh
 ur plugin list [--json]          # installed plugins
+ur plugin search [query]         # ranked discovery across configured catalogs
+ur plugin show <name-or-id>      # provenance, capabilities, status, install hint
 ur plugin doctor [--json]        # validate manifests + capability report
 ur plugin validate <path>        # validate a single manifest
 ur plugin install <name>         # install from a marketplace
@@ -109,6 +111,39 @@ ur plugin uninstall <name>
 
 Disabled plugins are not loaded. Enable/disable state persists in user settings.
 
+## Discover plugins
+
+Search is read-only and covers every configured marketplace plus installed,
+built-in, and `--plugin-dir` session plugins. Marketplace declaration scope is
+reported as managed, personal, workspace, or implicit; source kind identifies
+whether its catalog came from GitHub, git, URL, npm, a directory, a file, or
+settings. Broken catalogs do not hide healthy results and are reported as
+bounded warnings.
+
+```sh
+ur plugin search
+ur plugin search git
+ur plugin search review --capability validators
+ur plugin search --marketplace ur-plugins-official --limit 50
+ur plugin search --installed
+ur plugin search mcp --json
+ur plugin show obsidian@ur-plugins-official
+ur plugin show obsidian --json
+```
+
+Queries use case-insensitive AND-token matching over plugin ID, name,
+marketplace, category, tags, capabilities, and description. Exact IDs and names
+rank first, followed by name, tag, category, capability, marketplace, and
+description matches. Ties are deterministic. The default result limit is 20
+and the maximum is 100. Unqualified names must resolve to exactly one catalog;
+when two catalogs contain the same name, `plugin show` requires the full
+`name@marketplace` ID.
+
+Discovery never installs or enables a plugin. Source URLs have embedded HTTP
+credentials redacted before display. Use the exact install command printed in
+the search/detail output after reviewing the plugin's provenance and capability
+surface.
+
 ## Permissions
 
 UR's declarative model grants only what a plugin declares. Components run in the
@@ -126,4 +161,3 @@ before enabling it.
   (field path + message).
 - **Command not found after install:** ensure the manifest `commands` path
   points at existing markdown files; re-run `ur plugin doctor`.
-

package/documentation/app.js

@@ -31,9 +31,15 @@ const featureGroups = [
   },
   {
     title: 'Reliable repo editing',
-    tags: ['index', 'AST', 'preview', 'rollback'],
-    text: 'File and symbol indexing, indexed search, AST-aware JavaScript/TypeScript identifier rename plans, patch previews before writes, and rollback-safe multi-file apply.',
-    commands: ['ur repo-edit index', 'ur repo-edit search', 'ur repo-edit preview rename', 'ur repo-edit apply rename --check'],
+    tags: ['index', 'AST', 'impact', 'preview', 'rollback'],
+    text: 'Compiler/graph change-impact maps, file and symbol indexing, AST-aware JavaScript/TypeScript edits, patch previews before writes, and rollback-safe multi-file apply.',
+    commands: ['ur repo-edit impact', 'ur repo-edit index', 'ur repo-edit search', 'ur repo-edit preview rename', 'ur repo-edit apply rename --check'],
+  },
+  {
+    title: 'Professional 3D and DCC/CAD',
+    tags: ['Blender', 'OpenSCAD', '3ds Max', 'glTF'],
+    text: 'Unit-aware parametric projects, installed-app discovery, shell-free reviewed custom adapters, bounded builds, common 3D format inspection, and optional Khronos glTF validation for Blender, OpenSCAD, 3ds Max, Maya, FreeCAD, Houdini, Cinema 4D, and Rhino workflows.',
+    commands: ['ur design3d doctor', 'ur design3d init', 'ur design3d build --dry-run', 'ur design3d validate'],
   },
   {
     title: 'Automation and triggers',
@@ -44,8 +50,8 @@ const featureGroups = [
   {
     title: 'Knowledge and memory',
     tags: ['retrieval', 'provenance', 'citations'],
-    text: 'Durable memory, semantic memory, curated knowledge sources, lexical or embedding retrieval, digest-validated file/run citations, explicitly unverifiable user/web citations, claim ledgers, and research graph primitives.',
-    commands: ['ur knowledge', 'ur semantic-memory', 'ur context-pack remember --cite-file', 'ur context-pack memory revalidate', 'ur claim-ledger'],
+    text: 'Durable memory, source-backed research workspaces, independent corroboration checks, semantic memory, curated knowledge sources, lexical or embedding retrieval, digest-validated citations, claim ledgers, and research graph primitives.',
+    commands: ['ur research', '/research-pro', 'ur knowledge', 'ur semantic-memory', 'ur context-pack remember --cite-file', 'ur context-pack memory revalidate', 'ur claim-ledger'],
   },
   {
     title: 'Evaluation and verification',
@@ -361,12 +367,19 @@ const commands = [
     summary: 'List, inspect, install, save, or execute multi-agent collaboration patterns such as PEER, DOE, concurrent, handoff, and debate.',
     examples: ['ur pattern list', 'ur pattern show peer', 'ur pattern run peer "Implement and review auth"', 'ur pattern run concurrent "Audit docs" --execute --dry-run'],
   },
+  {
+    name: 'design3d',
+    category: 'Media',
+    aliases: ['three-d', 'design-3d'],
+    summary: 'Create, plan, build, inspect, and validate Blender, OpenSCAD, Autodesk 3ds Max, and reviewed custom DCC/CAD projects.',
+    examples: ['ur design3d doctor', 'ur design3d init product --engine blender --units mm --format glb', 'ur design3d init studio --engine 3dsmax --units cm --format max', 'ur design3d build design3d/product --dry-run', 'ur design3d validate design3d/product'],
+  },
   {
     name: 'plugin',
     category: 'Interop',
     aliases: ['plugins'],
     summary: 'Manage UR plugins and marketplaces for MCP tools, skills, templates, validators, language adapters, LSP servers, agents, hooks, output styles, and commands.',
-    examples: ['ur plugin list', 'ur plugin install hello@ur-plugins-official', 'ur plugin install engineering-discipline@ur-plugins-official', 'ur plugin update <plugin>', 'ur plugin disable <plugin>'],
+    examples: ['ur plugin search git', 'ur plugin search --capability skills --json', 'ur plugin show github@ur-plugins-official', 'ur plugin list', 'ur plugin install hello@ur-plugins-official', 'ur plugin update <plugin>'],
   },
   {
     name: 'provider',
@@ -379,8 +392,15 @@ const commands = [
     name: 'repo-edit',
     category: 'Delivery',
     aliases: ['repoedit', 'reliable-edit'],
-    summary: 'Reliable repo editing with a local file/symbol index, AST-aware JS/TS rename plans, patch previews, and rollback-safe multi-file apply.',
-    examples: ['ur repo-edit index', 'ur repo-edit search checkoutTotal', 'ur repo-edit plan rename oldName --to newName', 'ur repo-edit preview rename oldName --to newName', 'ur repo-edit apply rename oldName --to newName --check "bun test"'],
+    summary: 'Reliable repo editing with compiler/graph impact analysis, a local file/symbol index, AST-aware JS/TS plans, patch previews, and rollback-safe multi-file apply.',
+    examples: ['ur repo-edit impact checkoutTotal', 'ur repo-edit index', 'ur repo-edit search checkoutTotal', 'ur repo-edit plan rename oldName --to newName', 'ur repo-edit preview rename oldName --to newName', 'ur repo-edit apply rename oldName --to newName --check "bun test"'],
+  },
+  {
+    name: 'research',
+    category: 'Knowledge',
+    aliases: ['deep-research'],
+    summary: 'Build source-backed research workspaces with sanitized sources, cited findings, open questions, corroboration verification, and Markdown reports.',
+    examples: ['ur research init landscape --question "What changed?"', 'ur research source landscape --url https://example.com --title "Primary source"', 'ur research finding landscape --text "A feature shipped." --cite S1', 'ur research verify landscape', 'ur research report landscape --out docs/research/landscape.md'],
   },
   {
     name: 'role-mode',
@@ -537,8 +557,8 @@ const slashGroups = [
   },
   {
     title: 'Media and research',
-    items: ['/research', '/paper', '/cite', '/image', '/video', '/youtube', '/browser', '/chrome'],
-    text: 'Handle research notes, citations, multimodal files, browser workflows, and video metadata/transcripts.',
+    items: ['/research', '/research-pro', '/dcc-design', '/design3d', '/paper', '/cite', '/image', '/video', '/youtube', '/browser', '/chrome'],
+    text: 'Build evidence-backed research reports, automate professional 3D/DCC/CAD projects, manage citations and multimodal files, and run browser/video workflows.',
   },
   {
     title: 'Preferences and environment',

package/documentation/index.html

@@ -45,7 +45,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.78.14</p>
+          <p class="eyebrow">Version 1.79.1</p>
           <h1>UR-Nexus Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-Nexus.</p>
         </div>
@@ -84,7 +84,15 @@
           </article>
           <article>
             <strong>Reliable repo editing</strong>
-            <span><code>ur repo-edit</code> indexes files and symbols, plans AST-aware renames, previews patches, and rolls back failed multi-file applies.</span>
+            <span><code>ur repo-edit</code> maps compiler/graph change impact, indexes files and symbols, plans AST-aware edits, previews patches, and rolls back failed multi-file applies.</span>
+          </article>
+          <article>
+            <strong>Evidence-backed research</strong>
+            <span><code>ur research</code> persists sanitized sources, cited findings, open questions, independent corroboration checks, and reviewable reports.</span>
+          </article>
+          <article>
+            <strong>Professional 3D workflows</strong>
+            <span><code>ur design3d</code> automates Blender, OpenSCAD, Autodesk 3ds Max, and reviewed custom DCC/CAD applications with dry-run plans, bounded builds, inspection, and glTF validation.</span>
           </article>
           <article>
             <strong>Test-first execution</strong>
@@ -92,7 +100,7 @@
           </article>
           <article>
             <strong>Deterministic commands</strong>
-            <span>The external runtime exposes 150 commands and 217 unique slash tokens; registry tests reject ambiguous names, broken loaders, and undocumented visible commands.</span>
+            <span>The external runtime exposes 172 commands and 253 unique slash tokens; registry tests reject ambiguous names, broken loaders, and undocumented visible commands.</span>
           </article>
           <article>
             <strong>Safety and context</strong>
@@ -328,11 +336,30 @@ ur workflow run release --live --concurrency 2</code></pre>
               <li>Apply transactionally with a validation command that triggers rollback on failure.</li>
             </ol>
             <pre><code>ur repo-edit index
+ur repo-edit impact checkoutTotal --depth 5
 ur repo-edit search checkoutTotal
 ur repo-edit preview rename oldName --to newName
 ur repo-edit apply rename oldName --to newName --check "bun test"</code></pre>
           </article>
 
+          <article>
+            <h3>Research with a verifiable evidence map</h3>
+            <pre><code>ur research init landscape --question "Which capabilities shipped?"
+ur research source landscape --url https://example.com/spec --title "Primary source"
+ur research finding landscape --text "A capability shipped." --cite S1
+ur research verify landscape
+ur research report landscape --out docs/research/landscape.md</code></pre>
+          </article>
+
+          <article>
+            <h3>Build a reproducible 3D project</h3>
+            <pre><code>ur design3d doctor
+ur design3d init product --engine blender --units mm --format glb
+ur design3d init studio --engine 3dsmax --units cm --format max
+ur design3d build design3d/product --dry-run
+ur design3d validate design3d/product</code></pre>
+          </article>
+
           <article>
             <h3>Run test-first command evidence</h3>
             <ol>
@@ -569,8 +596,10 @@ ur mcp serve-http --port 8976
 ur skill verify &lt;name-or-directory&gt;
 ur ag-ui serve --help
 ur plugin list
+ur plugin search git
+ur plugin show github@ur-plugins-official
 ur plugin install &lt;plugin&gt;</code></pre>
-            <p>The opt-in stateless MCP HTTP adapter exposes negotiated Tasks and Apps. Portable skills load from native and cross-client roots with strict validation and Ed25519 provenance. AG-UI provides a bounded, opt-in frontend stream. Treat MCP servers and plugins as trusted code.</p>
+            <p>The opt-in stateless MCP HTTP adapter exposes negotiated Tasks and Apps. Portable skills load from native and cross-client roots with strict validation and Ed25519 provenance. Plugin search provides ranked cross-catalog discovery with provenance and capability metadata. AG-UI provides a bounded, opt-in frontend stream. Treat MCP servers and plugins as trusted code.</p>
           </article>
           <article>
             <h3>IDE inline diffs</h3>

package/examples/coding_task.md

@@ -7,8 +7,8 @@
 UR plans, reads files, edits, and can run tests. Safety + stability:
 
 - Repo-wide identifier refactors can use `ur repo-edit`: build an index,
-  preview the AST-aware patch, then apply with a check command that rolls back
-  touched files on failure.
+  map compiler/graph change impact, preview the AST-aware patch, then apply
+  with a check command that rolls back touched files on failure.
 - Stack-aware quality loops can use `ur test-first`: detect compile/test/lint
   commands, store failed command traces, and install the same commands as
   after-edit verifier gates.
@@ -26,6 +26,7 @@ UR plans, reads files, edits, and can run tests. Safety + stability:
 
 ```sh
 ur repo-edit index
+ur repo-edit impact healthHandler --depth 5
 ur repo-edit preview rename oldName --to newName
 ur repo-edit apply rename oldName --to newName --check "bun test"
 ur test-first detect