ur-agent 1.79.0 → 1.80.0

package/docs/A2A.md

@@ -12,10 +12,11 @@ surfaces:
 | UR compatibility API | `/a2a/tasks` and `/a2a/tasks/:id` | UR-specific REST-style background-task controls; not an A2A REST binding |
 
 The two protocol versions deliberately use separate schemas and handlers. The
-stable SDK remains pinned for v0.3; UR's dependency-free v1 compatibility layer
-translates strict v1 messages and tasks onto the same bounded durable execution
-engine. It is covered by UR tests and the official A2A TCK, but does not claim
-certification by the prerelease JavaScript SDK.
+stable SDK remains pinned for the older binding; UR's dependency-free final
+protocol compatibility layer translates strict messages and tasks onto the
+same bounded durable execution engine. It is covered by UR tests and the
+official A2A TCK. UR does not claim a gRPC interface or certification by the
+alpha JavaScript SDK binding.
 
 ## Start the server
 

package/docs/AGENT_FEATURES.md

@@ -9,6 +9,24 @@ reproducible autonomous software engineering agent: every substantial task can
 be driven as `spec -> plan -> patch -> test -> report -> rollback`, with the
 spec as the durable source of truth and command evidence as the success gate.
 
+## v1.80.0 Additions
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Credential-safe sandbox | `sandbox.credentials`, `sandbox.network.strictAllowlist`, `sandbox.network.tlsTerminate` | Masked file/environment credentials, JWT claims, AWS/SigV4 handling, strict unattended egress, trusted-source-only policy, and trailing-slash deny regression coverage. |
+| Permission parser hardening | `Tool(parameter:value)`, Bash/PowerShell checks | Parameter-aware wildcard rules, zsh conditional command detection, visible hidden characters, and quoted PowerShell path validation. |
+| Accessible terminal | `--screen-reader`, `/config screenReader=true` | Append-only plain output, edit announcements, and reduced animation. |
+| Current agent protocols | `ur mcp serve-web`, roots notifications, `input_required` | Final tool-input continuation results, compatibility roots, added-directory notifications, Tasks, and Apps under one professionally named web surface. |
+| Bounded observable delegation | `--forward-subagent-text`, session budgets, OpenTelemetry | Nested-agent text correlation, WebSearch session limits, advisory spawn warnings, assistant response events, and workflow/run correlation. |
+| Session and input ergonomics | `/session`, `ur session`, `/config key=value`, `DirectoryAdded`, `vimEscape` | Explicit archive/restore, direct settings, directory automation, and Vim insert escape sequences. |
+| Command cleanup | `/fix-bug`, command registry integrity | Replaces the versioned debug-skill name, removes no-op command registrations and duplicate 3D aliases, and rejects version jargon in public command descriptions. |
+
+## v1.79.1 Addition
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Self-healing Bash task output | `src/utils/Shell.ts`, `src/utils/permissions/filesystem.ts`, `test/shellExecutionIntegration.test.ts` | Uses the platform temp directory instead of assuming `/tmp`, aligns sandbox and permission roots, re-ensures temporary output storage for every launch, and atomically retries stdout/stderr creation after external directory cleanup so Bash recovers without restarting UR. |
+
 ## v1.79.0 Additions
 
 | Addition | Surface | What it adds |
@@ -91,7 +109,7 @@ trust boundaries.
 - ACP stdio now implements durable list/load/delete/resume/close, bounded exact
   history replay, modes, configuration options, and available commands in
   addition to streaming prompts, permission requests, MCP servers, and roots.
-- `ur mcp serve-http` exposes the opt-in stateless MCP 2026 compatibility
+- `ur mcp serve-web` exposes the opt-in stateless Model Context Protocol
   surface with Tasks and a self-contained Apps resource. It is loopback-only
   without authentication and enforces request metadata, capability negotiation,
   owner isolation, limits, private persistence, and corrupt-state quarantine.
@@ -237,7 +255,7 @@ automatically changes the active provider.
 | Deterministic slash registry | `src/commands.ts`, `test/commandRegistryIntegrity.test.ts` | Resolves bundled, plugin, project, workflow, and built-in commands by explicit source priority; rejects duplicate canonical tokens, removes only conflicting aliases, validates every lazy loader, and keeps the technical command catalog complete. |
 | Unified sandbox command | `/sandbox [status\|check\|init\|eval\|exclude]` | One interactive slash command now owns both the settings UI and text subcommands; the shell-facing `ur sandbox` implementation is shared rather than separately registered. |
 | Actionable CI cwd handling | `ur ci-loop --cwd <path>` | Reports the absolute execution directory, retains assertion and stack context, and stops "No tests found" after one attempt without wasting a fix-agent run. |
-| Explicit worktree completion | `/debug-v2`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`, `/batch` | Keeps changes local, asks before the final full suite, and never commits, pushes, or opens a PR unless separately requested. |
+| Explicit worktree completion | `/fix-bug`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`, `/batch` | Keeps changes local, asks before the final full suite, and never commits, pushes, or opens a PR unless separately requested. |
 
 ## v1.25.x Additions
 
@@ -299,8 +317,8 @@ components instead of one giant prompt.
 | Addition | Surface | What it adds |
 | --- | --- | --- |
 | Agent skill runner | `src/services/agents/agentSkillRunner.ts` | Reusable isolated-worktree wrapper that polls to completion; PR creation is available only with explicit `createPr: true`. |
-| Worktree slash skills | `/debug-v2`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`, `/batch` | Bundled slash skills keep changes local, run focused checks, ask before the final full suite, and never publish automatically. |
-| Agent templates | `ur agent-templates install` | Adds `debug-v2`, `refactor`, `paper-implementation`, `benchmark`, `security-review`, `dockerize`, and `latex-paper` reusable agent templates under `.ur/agents/`. |
+| Worktree slash skills | `/fix-bug`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`, `/batch` | Bundled slash skills keep changes local, run focused checks, ask before the final full suite, and never publish automatically. |
+| Agent templates | `ur agent-templates install` | Adds `bug-fixer`, `refactor`, `paper-implementation`, `benchmark`, `security-review`, `dockerize`, and `latex-paper` reusable agent templates under `.ur/agents/`. |
 | Worktree command | `ur worktree list\|status\|clean` | Inspect and clean up UR agent worktrees created by `ur bg` or slash skills. |
 
 ## v1.20.0 Additions
@@ -325,7 +343,7 @@ while keeping them project-local and manifest-backed:
 | --- | --- | --- |
 | Agent | `ur`, `ur agents`, `ur crew`, `ur bg`, `ur agent-templates` | `.ur/agents/`, `AGENTS.md`, `UR.md` |
 | Rules | `ur context-pack scan`, `ur safety`, `/guardrails`, `/hooks` | `AGENTS.md`, `UR.md`, `.cursor/rules/*.mdc`, `.cursorrules`, `.ur/safety-policy.json`, `.ur/guardrails.json`, `.ur/hooks.json` |
-| MCP | `ur mcp`, stdio mode, opt-in MCP 2026 HTTP Tasks/Apps, tools/resources | `.mcp.json`, `.ur/mcp/`, plugin manifests |
+| Model Context Protocol | `ur mcp`, standard-input mode, opt-in web Tasks/Apps, tools/resources | `.mcp.json`, `.ur/mcp/`, plugin manifests |
 | Skills | `/skills`, `/create-skill`, `ur skill verify\|sign\|keygen`, bundled/plugin skills | `.ur/skills/`, `.agents/skills/`, user skills, plugin skill folders, trusted key store |
 | CLI | `ur --help`, `ur -p`, `ur exec`, `ur acp`, workflow subcommands | `package.json` scripts, `.ur/project-manifest.json`, `.ur/verify.json` |
 | Models | `/model`, `ur model-doctor`, model router, Ollama discovery | Ollama endpoint, settings, `OLLAMA_MODEL`, model metadata cache |

package/docs/AGENT_TRENDS.md

@@ -2,7 +2,7 @@
 
 UR is a provider-flexible, local-first terminal coding agent. This page tracks
 how UR maps to current agent-platform trends and where future work should go
-next. The factual comparison below is a **2026-08-10 research snapshot**; run
+next. The factual comparison below is a **2026-08-11 research snapshot**; run
 `ur agent-trends` for the versioned machine-readable report and re-check the
 linked primary sources before acting on prerelease standards.
 
@@ -80,8 +80,8 @@ Inside an interactive session:
 | Trend | UR status | Current coverage | Professional next step |
 | --- | --- | --- | --- |
 | Provider-flexible, local-first runtime | Covered | Local Ollama; direct OpenAI, Anthropic, Gemini, OpenRouter, and OpenAI-compatible APIs; authenticated subscription-CLI adapters; explicit provider selection | Normalize capability discovery across providers and make automatic per-step routing opt-in |
-| MCP tool ecosystem | Covered | `ur mcp`, MCP OAuth/XAA/elicitation, fail-closed bounded stdio tools, and the opt-in stateless MCP 2026 HTTP adapter | Track the final 2026 spec/SDK and add independent-client fixtures before promoting the adapter |
-| MCP Tasks and MCP Apps | Covered | Negotiated Tasks lifecycle, owner-isolated durable state, and a self-contained Apps resource through `ur mcp serve-http` | Reconcile final extension schemas and broaden client interoperability tests |
+| Model Context Protocol ecosystem | Covered | `ur mcp`, OAuth/XAA, fail-closed bounded tools, final `input_required` continuation, all workspace roots with change notifications, and the opt-in stateless web server | Broaden independent-client interoperability fixtures |
+| Protocol Tasks and Apps | Covered | Negotiated Tasks lifecycle, owner-isolated durable state, and a self-contained Apps resource through `ur mcp serve-web` | Broaden independent-client interoperability fixtures |
 | A2A / Agent Card interoperability | Covered | Stable-SDK v0.3 plus strict v1 ProtoJSON JSON-RPC/HTTP+JSON, negotiated cards, tenant isolation, durable artifacts, and TCK coverage | Adopt the stable v1 SDK when released; add signed-card verification and streaming only with truthful end-to-end tests |
 | AG-UI agent-to-frontend interoperability | Covered | Official-schema HTTP/SSE adapter, truthful capabilities, ordered state/text/tool events, cancellation, exact CORS, bounded requests/output, and loopback-or-bearer security | Add independent frontend fixtures before advertising optional interrupts, binary/WebSocket transport, or client tools |
 | Durable workflows and checkpoints | Covered | resume, rewind, steerable `ur bg`/managed-cloud runs, optional worktrees/PRs, cron/workflow internals, file restore, and resumable multi-repo DAG state | Add authenticated cross-machine checkpoint replication |
@@ -104,10 +104,10 @@ Inside an interactive session:
 | AGENTS.md interoperability | Covered | `AGENTS.md` loaded as runtime project context (before `UR.md`), plus imported by the `/init` command | Keep aligned as the AGENTS.md spec evolves |
 | Browser and computer-use workflows | Covered | `/browser`, `/chrome`, Playwright-aware tasks, plus bounded Electron desktop fixtures with assertions, teardown, masked screenshots, and optional raw video/trace only when selector redaction is disabled | Add OS-native non-Electron fixtures behind equally testable drivers |
 | Provenance and citations | Partial | WebFetch source URLs, `/cite`, `/graph`, `/trace`, evidence ledgers, and task-memory citations with digest freshness | Add authenticated reopening for user citations and explicit network refresh for web/MCP citations |
-| Evals and observability | Covered | isolated eval worktrees, redacted structured trajectories, policy/outcome/cost/duration CI gates, reliability reports, dashboards, benchmark adapters, and OpenTelemetry | Publish opt-in signed versioned pass-rate snapshots by category |
-| Standard GenAI telemetry | Covered | Explicit OTLP/console exporters; GenAI inference, agent/workflow, tool, memory, token, cache, response, latency, streaming time-to-first-chunk/inter-output-chunk, and error semantics; content off by default | Add trajectory policy graders and cross-provider dashboards without increasing content capture/cardinality |
+| Evals and observability | Covered | isolated eval worktrees, redacted structured trajectories, policy/outcome/cost/duration CI gates, dashboards, nested-agent stream forwarding, and correlated OpenTelemetry assistant/workflow/tool events | Publish opt-in signed versioned pass-rate snapshots by category |
+| Standard GenAI telemetry | Covered | Explicit OTLP/console exporters; privacy-safe assistant response, message/request/tool correlation, workflow run identity, inference, token, cache, response, latency, streaming, and error semantics; content off by default | Add trajectory policy graders and cross-provider dashboards without increasing content capture/cardinality |
 | Test-first execution | Covered | `ur test-first` detects compile/test/lint commands, stores failure traces, retries through a fix agent, and installs detected commands into `.ur/verify.json` for edit-time gates | Add per-package command plans for large monorepos |
-| Security and prompt-injection resistance | Covered | allow/ask/deny permissions, shell safety analysis, secret scan, untrusted web-content guidance, OS-level execution sandbox (macOS Seatbelt, Linux bubblewrap) | Continuously test web/MCP/repository/skill/memory injection, confused-deputy, and tool-abuse cases |
+| Security and prompt-injection resistance | Covered | parameter-aware allow/ask/deny permissions, hardened Bash/PowerShell approval parsing, credential masking, TLS proxying, strict egress, secret scan, untrusted-content framing, and OS sandboxing | Continuously test web/protocol/repository/skill/memory injection, confused-deputy, and tool-abuse cases |
 | Agent identity and delegated authorization | Covered | MCP OAuth/XAA helpers, issuer-minted A2A bearer/delegation tokens, subject/audience/expiry/skill binding, local trust boundaries, permission rules | Keep delegated scopes narrow and auditable; HMAC child-token narrowing remains issuer-side |
 | Multimodal workflows | Partial | `/image`, `/video`, `/youtube`, `/voice`, browser workflows | Add model-aware multimodal capability reporting for local Ollama setups |
 | Spec-driven development | Covered | `ur spec` scaffolds requirements/design/tasks under `.ur/specs/`, tracks phase/approvals, and runs the Spec Kit / Kiro task list one task at a time | Add bidirectional sync with an external `specs/` directory |
@@ -157,10 +157,11 @@ The server refuses unauthenticated off-loopback binds and requires
 `--public-base-url` for wildcard binds so discovery never advertises
 `0.0.0.0`. Prefer `UR_A2A_TOKEN` and `UR_A2A_DELEGATION_SECRET` over argv
 secrets. Request size, prompt size, output size, submission rate, concurrent
-submissions, and active tasks are bounded by `UR_A2A_*` settings. UR's v1
-compatibility layer is covered by the official TCK while the JavaScript SDK's
-v1 line remains prerelease; the stable v0.3 path therefore stays available
-during the negotiated migration.
+submissions, and active tasks are bounded by `UR_A2A_*` settings. UR's
+final-protocol compatibility layer is covered by the official TCK. The
+official JavaScript SDK's matching binding remains alpha, so UR keeps the
+stable older SDK binding as a separately negotiated compatibility path rather
+than relabeling or silently translating it.
 
 ## Model Runtime Position
 
@@ -171,26 +172,31 @@ and model selection are explicit, credentials are resolved through the
 credential layer, and the optional fallback setting is diagnostic advice rather
 than an automatic provider switch.
 
-## v1.48 Frontier Priorities
-
-The `1.48.0` work closes the managed-worker, steering, learned-playbook,
-cited-memory, Agentic CI, trajectory-grading, desktop-QA, durable-side-chat,
-multi-repository, and model-judge gaps from the 2026-07-26 scan. The remaining
-ordered backlog keeps prerelease protocols opt-in and focuses on evidence and
-trust:
-
-1. Adopt final MCP 2026 and stable A2A v1 SDK artifacts when published, while
-   preserving dual-stack negotiation and independent-client fixtures.
-2. Add A2A signed-card verification, streaming/resubscription, and push only
-   with authenticated end-to-end conformance tests.
-3. Extend task-memory citations, deletion proofs, quarantine, and rollback to
+## 1.80 Frontier Priorities
+
+The final Model Context Protocol release is implemented, including Tasks,
+Apps, multi-round-trip tool input, roots compatibility, and strict request
+metadata. Agent-to-Agent 1.0 JSON-RPC and HTTP+JSON remain separately
+negotiated from the older stable JavaScript SDK binding. The current backlog
+focuses on proven interoperability and narrow trust boundaries:
+
+1. Broaden independent-client fixtures for final Model Context Protocol and
+   Agent-to-Agent requests before adding more advertised protocol surface.
+2. Adopt a stable official Agent-to-Agent JavaScript binding when one exists.
+   Add gRPC only for a real transport consumer with TLS/authentication and TCK
+   coverage; do not advertise it from the Agent Card before that proof exists.
+3. Keep AP2 payments outside the coding agent until UR has an explicitly
+   authorized commerce use case, mandate/signature policy, credential model,
+   and end-to-end payment conformance suite.
+4. Extend task-memory citations, deletion proofs, quarantine, and rollback to
    every semantic, embedding-backed, and legacy memory store.
-4. Publish opt-in, signed, versioned trajectory/outcome pass-rate snapshots and
+5. Publish opt-in, signed, versioned trajectory/outcome pass-rate snapshots and
    calibrate model-judge agreement without capturing prompt/tool content.
-5. Require registry attestations, dependency review, revocation, and update
+6. Require registry attestations, dependency review, revocation, and update
    transparency before one-command community skill/plugin installation.
-6. Reopen authenticated user citations, explicitly refresh web/MCP citations,
-   enforce final claim-to-source links, and complete Windows OS-sandbox parity.
+7. Reopen authenticated user citations, explicitly refresh web/protocol
+   citations, enforce final claim-to-source links, and complete Windows
+   OS-sandbox parity.
 
 ## Source And Trust Policy
 
@@ -222,7 +228,7 @@ Professional answer requirements:
 - OpenAI deferred tool search: https://developers.openai.com/api/docs/guides/tools-tool-search
 - OpenAI agent evals: https://developers.openai.com/api/docs/guides/agent-evals
 - Model Context Protocol: https://modelcontextprotocol.io/docs/getting-started/intro
-- MCP 2026-07-28 release candidate: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
+- Final Model Context Protocol 2026-07-28 release: https://blog.modelcontextprotocol.io/posts/2026-07-28/
 - MCP Tasks extension: https://tasks.extensions.modelcontextprotocol.io/
 - MCP Apps extension: https://apps.extensions.modelcontextprotocol.io/
 - ACP v1 schema: https://agentclientprotocol.com/protocol/v1/schema

package/docs/CONFIGURATION.md

@@ -2,6 +2,21 @@
 
 UR reads configuration from CLI flags, environment variables, and project or user settings files.
 
+Inside an interactive UR session, `/config` opens the settings panel and
+`/config key=value` applies common settings directly:
+
+```text
+/config thinking=false screenReader=true reducedMotion=true
+/config editor=vim vimEscape=jj
+/config verbose=true autoCompact=false
+/config --help
+```
+
+Start UR with `--screen-reader`, set `UR_SCREEN_READER=1`, or use
+`/config screenReader=true` for append-only plain-text output, announced text
+edits, and reduced animation. `vimEscape` accepts 2–8 printable non-whitespace
+characters or `off`.
+
 ## Model Providers
 
 UR-Nexus supports official provider access paths only:
@@ -427,6 +442,32 @@ This sandbox covers UR-run Bash/File tool commands only. For subscription CLI
 providers, it does not extend to actions the external CLI performs internally
 — see [Provider Guide](providers.md).
 
+Security-sensitive sandbox proxy and credential settings are accepted only
+from user, flag, or managed-policy settings. Project settings cannot opt into
+credential injection. Example user settings:
+
+```json
+{
+  "sandbox": {
+    "enabled": true,
+    "network": {
+      "allowedDomains": ["api.example.com"],
+      "strictAllowlist": true,
+      "tlsTerminate": {}
+    },
+    "credentials": {
+      "envVars": [
+        { "name": "API_TOKEN", "mode": "mask", "injectHosts": ["api.example.com"] }
+      ]
+    }
+  }
+}
+```
+
+Credential entries support `deny` or `mask`, regex extraction, JWT claim
+masking, host-scoped injection, AWS key pairs, and SigV4 rewriting. Unknown
+destinations are rejected without prompting when `strictAllowlist` is true.
+
 ## Project Context Pack
 
 `ur context-pack` writes durable architecture context and task memory:
@@ -480,7 +521,7 @@ ur mcp get <name>
 ur mcp add-json <name> '<json>'
 ur mcp remove <name>
 ur mcp serve
-UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-http --port 8976
+UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-web --port 8976
 ```
 
 MCP servers may execute code or access external services. Only enable servers you trust, and keep credentials out of committed config.
@@ -492,7 +533,7 @@ adjusted with `UR_MCP_MAX_CALLS_PER_MINUTE`,
 `UR_MCP_MAX_CONCURRENT_CALLS`, `UR_MCP_TOOL_TIMEOUT_MS`,
 `UR_MCP_MAX_INPUT_CHARS`, and `UR_MCP_MAX_OUTPUT_CHARS`.
 
-`serve-http` is a separate, opt-in MCP 2026-07-28 compatibility surface at
+`serve-web` is the separate, opt-in stateless Model Context Protocol web surface at
 `POST /mcp`. It is stateless at the transport layer and exposes capability-
 negotiated Tasks and a self-contained overview App backed by UR's real MCP
 tool registry. Every call must supply matching protocol/method/name metadata.

package/docs/GAP_ANALYSIS_2026-08-11.md

@@ -0,0 +1,64 @@
+# UR Gap Analysis — 2026-08-11 Implemented Release Audit
+
+Baseline audited: `ur-agent@1.79.1`, commit `6faed11`. Release target: `1.80.0`.
+Primary references were rechecked before implementation: Claude Code
+2.1.221–2.1.224, the final Model Context Protocol specification dated
+2026-07-28, and the Agent2Agent 1.0 release.
+
+## Result
+
+All recommended gaps that strengthen UR without weakening its operator trust
+boundary are implemented. “Approve all”/`autoApprove` remains available and
+unchanged. UR does not add automated approval delegation.
+
+| Area | Release result |
+|---|---|
+| Credential-safe sandboxing | Added the official sandbox runtime, trusted-source-only `sandbox.credentials`, file/environment masking, regex extraction, JWT claim masking, AWS credential pairs, SigV4 rewriting, and `network.tlsTerminate`. |
+| Strict egress | Added trusted `sandbox.network.strictAllowlist`; non-allowlisted destinations are denied instead of prompting. |
+| Filesystem deny regression | Verified canonical path normalization handles both `~/.aws` and `~/.aws/`; regression tests cover both forms. |
+| Parameter-aware permissions | Added `Tool(parameter:value)` matching with wildcards, including rules such as `Agent(model:opus)` and `Bash(timeout:*)`. |
+| Shell approval hardening | Added tree-sitter enforcement for production Bash, zsh `[[ ... ]]` command-substitution detection, visible rendering for tabs/control/zero-width/bidirectional characters, and PowerShell quote-path validation. |
+| Session containment | Added a 200-search default WebSearch session budget (`UR_MAX_WEB_SEARCHES_PER_SESSION`) and a non-fatal subagent-spawn advisory (`UR_SUBAGENT_SPAWN_ADVISORY_PER_SESSION`). |
+| Headless subagents | Added `--forward-subagent-text` for nested assistant output in `stream-json`, correlated to the spawning tool-use ID. |
+| Model Context Protocol | Added final `input_required` results and codes while retaining older elicitation compatibility. Existing roots support now includes all added directories plus `notifications/roots/list_changed`. |
+| Agent-to-Agent cards | Audit disproved the reported mismatch: `protocolVersion: 0.3.0` belongs to the deliberately retained legacy card; the negotiated modern card is produced separately and signed correctly. No false version change was made. |
+| Accessibility | Added `--screen-reader`, `screenReaderMode`, append-only plain-text rendering, edit announcements, and reduced animation. |
+| In-session configuration | Added `/config key=value`, including thinking, screen reader, reduced motion, verbose output, auto-compaction, editor mode, and Vim escape sequence. |
+| Directory automation | Added the `DirectoryAdded` hook and roots-change notification after `/add-dir`. |
+| Session lifecycle | Added `/session status|list|archive|unarchive` and `ur session list|archive|unarchive`. Archived sessions cannot appear in resume/fork discovery until restored. |
+| Vim input | Added `vimEscape=<sequence>`; for example, `/config editor=vim vimEscape=jj`. |
+| Telemetry | Added privacy-safe `assistant_response` events, message/request/tool correlation, and workflow name/run identifiers. |
+| Command quality | Removed the no-op `/output-style` command and dormant `/ultraplan` registration, renamed `/debug-v2` to `/fix-bug`, removed duplicate 3D aliases, expanded protocol names in help, and added registry checks against public version jargon. |
+
+## Corrected findings and deliberate omissions
+
+- `roots/list` was not absent. UR already served the initial working directory;
+  this release extends it to added directories and change notifications.
+- The old and modern Agent-to-Agent cards are separate negotiated compatibility
+  representations. The old card’s version is truthful and must not be relabeled.
+- gRPC transport and AP2 payments are optional integrations, not correctness
+  requirements for UR’s local coding-agent surface. Shipping either without a
+  real transport consumer, payment policy, credential model, and end-to-end
+  conformance suite would add attack surface without useful capability, so they
+  are deliberately omitted.
+- Anthropic removed `ultraplan` in Claude Code 2.1.222. UR’s registered command
+  was also permanently disabled, so the registration was removed as dead public
+  weight. Shared remote-planning internals used by active features remain.
+- `EndConversation`, managed-gateway spend UX, `/dataviz`, and automated
+  approval delegation remain intentionally omitted. They either duplicate
+  existing controls, are content rather than capability, or weaken the explicit
+  operator trust boundary.
+
+## Primary sources
+
+- [Claude Code 2.1.221](https://github.com/anthropics/claude-code/releases/tag/v2.1.221)
+- [Claude Code 2.1.222](https://github.com/anthropics/claude-code/releases/tag/v2.1.222)
+- [Claude Code 2.1.223](https://github.com/anthropics/claude-code/releases/tag/v2.1.223)
+- [Claude Code 2.1.224](https://github.com/anthropics/claude-code/releases/tag/v2.1.224)
+- [Anthropic sandboxing documentation](https://code.claude.com/docs/en/sandboxing)
+- [Model Context Protocol 2026-07-28 release](https://blog.modelcontextprotocol.io/posts/2026-07-28/)
+- [Model Context Protocol final schema](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/schema/2026-07-28/schema.ts)
+- [Agent2Agent 1.0 changes](https://a2a-protocol.org/latest/whats-new-v1/)
+- [Agent2Agent 1.0 specification](https://a2a-protocol.org/latest/specification/)
+- [Agent Payments Protocol reference repository](https://github.com/google-agentic-commerce/AP2)
+- [OpenTelemetry generative-AI attributes](https://opentelemetry.io/docs/specs/semconv/registry/attributes/gen-ai/)

package/docs/TROUBLESHOOTING.md

@@ -56,6 +56,20 @@ ur config set provider ollama
 ur provider status
 ```
 
+### Every Bash call fails with `ENOENT .../tasks/<id>.output`
+
+- Likely cause: the operating system or a cleanup process reclaimed UR's
+  session task-output directory, or the conventional Unix `/tmp` path is
+  unavailable. The command itself never started; identical failure from
+  `echo ok` distinguishes this harness failure from an application error.
+- Fix: upgrade to UR 1.79.1 or newer. UR now uses `os.tmpdir()`, ensures the
+  output directory for every launch, and automatically recreates and retries
+  when it disappears. Restarting an older session is only a temporary
+  workaround.
+- Verification: start a new UR session and ask it to run `echo ok` through
+  Bash. A successful result confirms the harness; `/design3d doctor` alone
+  validates the local slash command but does not exercise Bash execution.
+
 ## Providers and models
 
 ### Provider selected but the model is unavailable

package/docs/USAGE.md

@@ -25,8 +25,29 @@ ur --add-dir ../other-project
 ur --permission-mode ask
 ur --continue
 ur --resume
+ur --screen-reader
 ```
 
+Useful commands from inside UR:
+
+```text
+/config thinking=false screenReader=true
+/config editor=vim vimEscape=jj
+/session list
+/session archive
+/session unarchive <session-id>
+/fix-bug describe the failure and reproduction steps
+/research init current-tools --question "What changed?"
+/design3d doctor
+/design3d init product-shot --engine blender --units mm --format blend
+/design3d init studio-scene --engine 3dsmax --units cm --format max
+```
+
+`/design3d doctor` reports installed applications. `MISSING` means that optional
+application is not installed or is not on `PATH`; it is not a UR failure. On
+macOS, Autodesk 3ds Max is expected to be missing because it is a Windows
+application. Use Blender locally, or run the 3ds Max project on a Windows host.
+
 When UR needs a focused clarification, it uses the `AskUserQuestion` dialog.
 Professional clarification prompts can provide up to eight concrete options;
 UR also accepts custom "Other" answers when the dialog includes one.
@@ -49,8 +70,13 @@ Output formats:
 ur -p --output-format text "explain src/main.tsx"
 ur -p --output-format json "return a JSON summary of this repo"
 ur -p --output-format stream-json "stream progress while answering"
+ur -p --output-format stream-json --forward-subagent-text "delegate and stream nested results"
 ```
 
+WebSearch allows 200 provider searches per session by default. Set
+`UR_MAX_WEB_SEARCHES_PER_SESSION` to another positive integer, or to
+`unlimited` only for a trusted long-running job.
+
 Structured output can be validated with a JSON schema:
 
 ```sh
@@ -264,6 +290,8 @@ hooks:
 ```
 
 Hooks are advisory by default. A `BeforeEdit`/`BeforeCommand`/`BeforeCommit` hook can block the action by returning `{"decision":"block","reason":"..."}` or exit code 2. `AfterEdit` and `OnFailure` hooks can return `{"hookSpecificOutput":{"hookEventName":"...","memory":{"kind":"accepted","text":"..."}}}` to append project memory automatically.
+`DirectoryAdded` fires after `/add-dir` authorizes and adds a directory, so
+plugins and project automation can initialize directory-specific state.
 
 ## Commands
 
@@ -272,7 +300,7 @@ UR includes slash commands and CLI subcommands for common workflows:
 - `/help` or `ur --help` for command discovery
 - `ur connect ...` to connect provider accounts (subscription login or stored API key)
 - `ur mcp ...` to configure MCP servers, run the stdio server, or start the
-  opt-in stateless MCP 2026 Tasks/Apps adapter with `ur mcp serve-http`
+  opt-in stateless Model Context Protocol Tasks/Apps server with `ur mcp serve-web`
 - `ur ag-ui serve` to expose the secure AG-UI HTTP/SSE adapter to an explicitly
   allowed user-facing application
 - `ur plugin ...` to manage plugins and marketplaces. Marketplace plugins can
@@ -319,7 +347,7 @@ UR includes slash commands and CLI subcommands for common workflows:
 - `ur artifacts ...` to capture reviewable diffs, test runs, notes, feedback,
   and bounded non-symlink attachments with safe download headers/MIME fallback
 - `ur ide diff ...` to capture editor-readable inline diff bundles
-- `ur acp stdio` for the official-SDK ACP v1 editor transport with durable
+- `ur acp stdio` for the standard Agent Client Protocol editor transport with durable
   list/load/delete/resume, modes, config options, and commands; and
   `ur acp serve|stop|status` for the separate UR HTTP JSON-RPC API
 - `ur exec ...` to run prompts in non-interactive mode with optional concurrency
@@ -372,7 +400,7 @@ UR includes slash commands and CLI subcommands for common workflows:
   money column is omitted rather than printing a wall of `$0.00`. Add `--json`
   for the raw rows.
 - `ur role-mode ...` to install built-in Architect, Code, Debug, and Ask role modes
-- `ur a2a ...` for negotiated v1 JSON-RPC/HTTP+JSON, the stable v0.3 SDK
+- `ur a2a ...` for a negotiated Agent-to-Agent server with automatic compatibility
   binding, scoped delegation tokens, durable protocol state, and separate UR
   compatibility task routes
 - `ur sdk ...` to scaffold TS/Python headless SDK examples
@@ -501,7 +529,7 @@ ur context-pack remember --decision "Keep streaming" --cite-file src/parser.ts -
 ur context-pack memory verify
 ur context-pack memory revalidate
 ur context-pack compress
-UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-http --port 8976
+UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-web --port 8976
 ur acp serve --port 8123
 ur exec "add tests for the parser" --concurrency 4 --json
 ur ci-loop --command "bun test" --cwd . --dry-run

package/docs/VALIDATION.md

@@ -19,7 +19,7 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.79.0 (UR-Nexus)"
+# expected for this release: "1.80.0 (UR-Nexus)"
 ```
 
 ## 0.1 First-workspace model selection (1.45.4)

package/documentation/index.html

@@ -45,7 +45,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.79.0</p>
+          <p class="eyebrow">Version 1.80.0</p>
           <h1>UR-Nexus Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-Nexus.</p>
         </div>

package/extensions/jetbrains-ur/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 }
 
 group = "dev.urnexus"
-version = "1.79.0"
+version = "1.80.0"
 
 repositories {
     mavenCentral()

package/extensions/vscode-ur-inline-diffs/package.json

@@ -2,7 +2,7 @@
   "name": "ur-inline-diffs",
   "displayName": "UR Inline Diffs",
   "description": "Review, apply, and reject UR inline diff bundles from .ur/ide/diffs inside VS Code.",
-  "version": "1.79.0",
+  "version": "1.80.0",
   "publisher": "ur-nexus",
   "engines": {
     "vscode": "^1.92.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ur-agent",
-  "version": "1.79.0",
+  "version": "1.80.0",
   "description": "UR-Nexus — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",
@@ -84,6 +84,7 @@
     "@a2a-js/sdk": "0.3.14",
     "@ag-ui/core": "0.0.57",
     "@ag-ui/encoder": "0.0.57",
+    "@anthropic-ai/sandbox-runtime": "0.0.71",
     "diff2html": "^3.4.56",
     "playwright-core": "^1.61.1",
     "sharp": "^0.35.3"

package/plugins/bunBundleDev.ts

@@ -3,8 +3,8 @@
  *
  * In production, Bun's bundler statically replaces `feature()` calls at compile
  * time. During development (running unbundled with `bun run`), this plugin
- * intercepts `bun:bundle` imports and returns a stub where every feature flag
- * is `false` by default.
+ * intercepts `bun:bundle` imports and returns a stub. Security-critical flags
+ * mirror production by default; optional product flags remain disabled.
  *
  * To enable specific flags during dev, set the env var FEATURE_FLAGS as a
  * comma-separated list:
@@ -13,9 +13,10 @@
  */
 import { plugin } from 'bun'
 
-const enabledFlags = new Set(
-  (process.env.FEATURE_FLAGS ?? '').split(',').filter(Boolean),
-)
+const enabledFlags = new Set([
+  'TREE_SITTER_BASH',
+  ...(process.env.FEATURE_FLAGS ?? '').split(',').filter(Boolean),
+])
 
 plugin({
   name: 'bun-bundle-dev',