ur-agent 1.79.1 → 1.80.0

package/docs/A2A.md

@@ -12,10 +12,11 @@ surfaces:
 | UR compatibility API | `/a2a/tasks` and `/a2a/tasks/:id` | UR-specific REST-style background-task controls; not an A2A REST binding |
 
 The two protocol versions deliberately use separate schemas and handlers. The
-stable SDK remains pinned for v0.3; UR's dependency-free v1 compatibility layer
-translates strict v1 messages and tasks onto the same bounded durable execution
-engine. It is covered by UR tests and the official A2A TCK, but does not claim
-certification by the prerelease JavaScript SDK.
+stable SDK remains pinned for the older binding; UR's dependency-free final
+protocol compatibility layer translates strict messages and tasks onto the
+same bounded durable execution engine. It is covered by UR tests and the
+official A2A TCK. UR does not claim a gRPC interface or certification by the
+alpha JavaScript SDK binding.
 
 ## Start the server
 

package/docs/AGENT_FEATURES.md

@@ -9,6 +9,18 @@ reproducible autonomous software engineering agent: every substantial task can
 be driven as `spec -> plan -> patch -> test -> report -> rollback`, with the
 spec as the durable source of truth and command evidence as the success gate.
 
+## v1.80.0 Additions
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Credential-safe sandbox | `sandbox.credentials`, `sandbox.network.strictAllowlist`, `sandbox.network.tlsTerminate` | Masked file/environment credentials, JWT claims, AWS/SigV4 handling, strict unattended egress, trusted-source-only policy, and trailing-slash deny regression coverage. |
+| Permission parser hardening | `Tool(parameter:value)`, Bash/PowerShell checks | Parameter-aware wildcard rules, zsh conditional command detection, visible hidden characters, and quoted PowerShell path validation. |
+| Accessible terminal | `--screen-reader`, `/config screenReader=true` | Append-only plain output, edit announcements, and reduced animation. |
+| Current agent protocols | `ur mcp serve-web`, roots notifications, `input_required` | Final tool-input continuation results, compatibility roots, added-directory notifications, Tasks, and Apps under one professionally named web surface. |
+| Bounded observable delegation | `--forward-subagent-text`, session budgets, OpenTelemetry | Nested-agent text correlation, WebSearch session limits, advisory spawn warnings, assistant response events, and workflow/run correlation. |
+| Session and input ergonomics | `/session`, `ur session`, `/config key=value`, `DirectoryAdded`, `vimEscape` | Explicit archive/restore, direct settings, directory automation, and Vim insert escape sequences. |
+| Command cleanup | `/fix-bug`, command registry integrity | Replaces the versioned debug-skill name, removes no-op command registrations and duplicate 3D aliases, and rejects version jargon in public command descriptions. |
+
 ## v1.79.1 Addition
 
 | Addition | Surface | What it adds |
@@ -97,7 +109,7 @@ trust boundaries.
 - ACP stdio now implements durable list/load/delete/resume/close, bounded exact
   history replay, modes, configuration options, and available commands in
   addition to streaming prompts, permission requests, MCP servers, and roots.
-- `ur mcp serve-http` exposes the opt-in stateless MCP 2026 compatibility
+- `ur mcp serve-web` exposes the opt-in stateless Model Context Protocol
   surface with Tasks and a self-contained Apps resource. It is loopback-only
   without authentication and enforces request metadata, capability negotiation,
   owner isolation, limits, private persistence, and corrupt-state quarantine.
@@ -243,7 +255,7 @@ automatically changes the active provider.
 | Deterministic slash registry | `src/commands.ts`, `test/commandRegistryIntegrity.test.ts` | Resolves bundled, plugin, project, workflow, and built-in commands by explicit source priority; rejects duplicate canonical tokens, removes only conflicting aliases, validates every lazy loader, and keeps the technical command catalog complete. |
 | Unified sandbox command | `/sandbox [status\|check\|init\|eval\|exclude]` | One interactive slash command now owns both the settings UI and text subcommands; the shell-facing `ur sandbox` implementation is shared rather than separately registered. |
 | Actionable CI cwd handling | `ur ci-loop --cwd <path>` | Reports the absolute execution directory, retains assertion and stack context, and stops "No tests found" after one attempt without wasting a fix-agent run. |
-| Explicit worktree completion | `/debug-v2`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`, `/batch` | Keeps changes local, asks before the final full suite, and never commits, pushes, or opens a PR unless separately requested. |
+| Explicit worktree completion | `/fix-bug`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`, `/batch` | Keeps changes local, asks before the final full suite, and never commits, pushes, or opens a PR unless separately requested. |
 
 ## v1.25.x Additions
 
@@ -305,8 +317,8 @@ components instead of one giant prompt.
 | Addition | Surface | What it adds |
 | --- | --- | --- |
 | Agent skill runner | `src/services/agents/agentSkillRunner.ts` | Reusable isolated-worktree wrapper that polls to completion; PR creation is available only with explicit `createPr: true`. |
-| Worktree slash skills | `/debug-v2`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`, `/batch` | Bundled slash skills keep changes local, run focused checks, ask before the final full suite, and never publish automatically. |
-| Agent templates | `ur agent-templates install` | Adds `debug-v2`, `refactor`, `paper-implementation`, `benchmark`, `security-review`, `dockerize`, and `latex-paper` reusable agent templates under `.ur/agents/`. |
+| Worktree slash skills | `/fix-bug`, `/refactor`, `/paper-implementation`, `/benchmark`, `/security-review`, `/dockerize`, `/latex-paper`, `/batch` | Bundled slash skills keep changes local, run focused checks, ask before the final full suite, and never publish automatically. |
+| Agent templates | `ur agent-templates install` | Adds `bug-fixer`, `refactor`, `paper-implementation`, `benchmark`, `security-review`, `dockerize`, and `latex-paper` reusable agent templates under `.ur/agents/`. |
 | Worktree command | `ur worktree list\|status\|clean` | Inspect and clean up UR agent worktrees created by `ur bg` or slash skills. |
 
 ## v1.20.0 Additions
@@ -331,7 +343,7 @@ while keeping them project-local and manifest-backed:
 | --- | --- | --- |
 | Agent | `ur`, `ur agents`, `ur crew`, `ur bg`, `ur agent-templates` | `.ur/agents/`, `AGENTS.md`, `UR.md` |
 | Rules | `ur context-pack scan`, `ur safety`, `/guardrails`, `/hooks` | `AGENTS.md`, `UR.md`, `.cursor/rules/*.mdc`, `.cursorrules`, `.ur/safety-policy.json`, `.ur/guardrails.json`, `.ur/hooks.json` |
-| MCP | `ur mcp`, stdio mode, opt-in MCP 2026 HTTP Tasks/Apps, tools/resources | `.mcp.json`, `.ur/mcp/`, plugin manifests |
+| Model Context Protocol | `ur mcp`, standard-input mode, opt-in web Tasks/Apps, tools/resources | `.mcp.json`, `.ur/mcp/`, plugin manifests |
 | Skills | `/skills`, `/create-skill`, `ur skill verify\|sign\|keygen`, bundled/plugin skills | `.ur/skills/`, `.agents/skills/`, user skills, plugin skill folders, trusted key store |
 | CLI | `ur --help`, `ur -p`, `ur exec`, `ur acp`, workflow subcommands | `package.json` scripts, `.ur/project-manifest.json`, `.ur/verify.json` |
 | Models | `/model`, `ur model-doctor`, model router, Ollama discovery | Ollama endpoint, settings, `OLLAMA_MODEL`, model metadata cache |

package/docs/AGENT_TRENDS.md

@@ -2,7 +2,7 @@
 
 UR is a provider-flexible, local-first terminal coding agent. This page tracks
 how UR maps to current agent-platform trends and where future work should go
-next. The factual comparison below is a **2026-08-10 research snapshot**; run
+next. The factual comparison below is a **2026-08-11 research snapshot**; run
 `ur agent-trends` for the versioned machine-readable report and re-check the
 linked primary sources before acting on prerelease standards.
 
@@ -80,8 +80,8 @@ Inside an interactive session:
 | Trend | UR status | Current coverage | Professional next step |
 | --- | --- | --- | --- |
 | Provider-flexible, local-first runtime | Covered | Local Ollama; direct OpenAI, Anthropic, Gemini, OpenRouter, and OpenAI-compatible APIs; authenticated subscription-CLI adapters; explicit provider selection | Normalize capability discovery across providers and make automatic per-step routing opt-in |
-| MCP tool ecosystem | Covered | `ur mcp`, MCP OAuth/XAA/elicitation, fail-closed bounded stdio tools, and the opt-in stateless MCP 2026 HTTP adapter | Track the final 2026 spec/SDK and add independent-client fixtures before promoting the adapter |
-| MCP Tasks and MCP Apps | Covered | Negotiated Tasks lifecycle, owner-isolated durable state, and a self-contained Apps resource through `ur mcp serve-http` | Reconcile final extension schemas and broaden client interoperability tests |
+| Model Context Protocol ecosystem | Covered | `ur mcp`, OAuth/XAA, fail-closed bounded tools, final `input_required` continuation, all workspace roots with change notifications, and the opt-in stateless web server | Broaden independent-client interoperability fixtures |
+| Protocol Tasks and Apps | Covered | Negotiated Tasks lifecycle, owner-isolated durable state, and a self-contained Apps resource through `ur mcp serve-web` | Broaden independent-client interoperability fixtures |
 | A2A / Agent Card interoperability | Covered | Stable-SDK v0.3 plus strict v1 ProtoJSON JSON-RPC/HTTP+JSON, negotiated cards, tenant isolation, durable artifacts, and TCK coverage | Adopt the stable v1 SDK when released; add signed-card verification and streaming only with truthful end-to-end tests |
 | AG-UI agent-to-frontend interoperability | Covered | Official-schema HTTP/SSE adapter, truthful capabilities, ordered state/text/tool events, cancellation, exact CORS, bounded requests/output, and loopback-or-bearer security | Add independent frontend fixtures before advertising optional interrupts, binary/WebSocket transport, or client tools |
 | Durable workflows and checkpoints | Covered | resume, rewind, steerable `ur bg`/managed-cloud runs, optional worktrees/PRs, cron/workflow internals, file restore, and resumable multi-repo DAG state | Add authenticated cross-machine checkpoint replication |
@@ -104,10 +104,10 @@ Inside an interactive session:
 | AGENTS.md interoperability | Covered | `AGENTS.md` loaded as runtime project context (before `UR.md`), plus imported by the `/init` command | Keep aligned as the AGENTS.md spec evolves |
 | Browser and computer-use workflows | Covered | `/browser`, `/chrome`, Playwright-aware tasks, plus bounded Electron desktop fixtures with assertions, teardown, masked screenshots, and optional raw video/trace only when selector redaction is disabled | Add OS-native non-Electron fixtures behind equally testable drivers |
 | Provenance and citations | Partial | WebFetch source URLs, `/cite`, `/graph`, `/trace`, evidence ledgers, and task-memory citations with digest freshness | Add authenticated reopening for user citations and explicit network refresh for web/MCP citations |
-| Evals and observability | Covered | isolated eval worktrees, redacted structured trajectories, policy/outcome/cost/duration CI gates, reliability reports, dashboards, benchmark adapters, and OpenTelemetry | Publish opt-in signed versioned pass-rate snapshots by category |
-| Standard GenAI telemetry | Covered | Explicit OTLP/console exporters; GenAI inference, agent/workflow, tool, memory, token, cache, response, latency, streaming time-to-first-chunk/inter-output-chunk, and error semantics; content off by default | Add trajectory policy graders and cross-provider dashboards without increasing content capture/cardinality |
+| Evals and observability | Covered | isolated eval worktrees, redacted structured trajectories, policy/outcome/cost/duration CI gates, dashboards, nested-agent stream forwarding, and correlated OpenTelemetry assistant/workflow/tool events | Publish opt-in signed versioned pass-rate snapshots by category |
+| Standard GenAI telemetry | Covered | Explicit OTLP/console exporters; privacy-safe assistant response, message/request/tool correlation, workflow run identity, inference, token, cache, response, latency, streaming, and error semantics; content off by default | Add trajectory policy graders and cross-provider dashboards without increasing content capture/cardinality |
 | Test-first execution | Covered | `ur test-first` detects compile/test/lint commands, stores failure traces, retries through a fix agent, and installs detected commands into `.ur/verify.json` for edit-time gates | Add per-package command plans for large monorepos |
-| Security and prompt-injection resistance | Covered | allow/ask/deny permissions, shell safety analysis, secret scan, untrusted web-content guidance, OS-level execution sandbox (macOS Seatbelt, Linux bubblewrap) | Continuously test web/MCP/repository/skill/memory injection, confused-deputy, and tool-abuse cases |
+| Security and prompt-injection resistance | Covered | parameter-aware allow/ask/deny permissions, hardened Bash/PowerShell approval parsing, credential masking, TLS proxying, strict egress, secret scan, untrusted-content framing, and OS sandboxing | Continuously test web/protocol/repository/skill/memory injection, confused-deputy, and tool-abuse cases |
 | Agent identity and delegated authorization | Covered | MCP OAuth/XAA helpers, issuer-minted A2A bearer/delegation tokens, subject/audience/expiry/skill binding, local trust boundaries, permission rules | Keep delegated scopes narrow and auditable; HMAC child-token narrowing remains issuer-side |
 | Multimodal workflows | Partial | `/image`, `/video`, `/youtube`, `/voice`, browser workflows | Add model-aware multimodal capability reporting for local Ollama setups |
 | Spec-driven development | Covered | `ur spec` scaffolds requirements/design/tasks under `.ur/specs/`, tracks phase/approvals, and runs the Spec Kit / Kiro task list one task at a time | Add bidirectional sync with an external `specs/` directory |
@@ -157,10 +157,11 @@ The server refuses unauthenticated off-loopback binds and requires
 `--public-base-url` for wildcard binds so discovery never advertises
 `0.0.0.0`. Prefer `UR_A2A_TOKEN` and `UR_A2A_DELEGATION_SECRET` over argv
 secrets. Request size, prompt size, output size, submission rate, concurrent
-submissions, and active tasks are bounded by `UR_A2A_*` settings. UR's v1
-compatibility layer is covered by the official TCK while the JavaScript SDK's
-v1 line remains prerelease; the stable v0.3 path therefore stays available
-during the negotiated migration.
+submissions, and active tasks are bounded by `UR_A2A_*` settings. UR's
+final-protocol compatibility layer is covered by the official TCK. The
+official JavaScript SDK's matching binding remains alpha, so UR keeps the
+stable older SDK binding as a separately negotiated compatibility path rather
+than relabeling or silently translating it.
 
 ## Model Runtime Position
 
@@ -171,26 +172,31 @@ and model selection are explicit, credentials are resolved through the
 credential layer, and the optional fallback setting is diagnostic advice rather
 than an automatic provider switch.
 
-## v1.48 Frontier Priorities
-
-The `1.48.0` work closes the managed-worker, steering, learned-playbook,
-cited-memory, Agentic CI, trajectory-grading, desktop-QA, durable-side-chat,
-multi-repository, and model-judge gaps from the 2026-07-26 scan. The remaining
-ordered backlog keeps prerelease protocols opt-in and focuses on evidence and
-trust:
-
-1. Adopt final MCP 2026 and stable A2A v1 SDK artifacts when published, while
-   preserving dual-stack negotiation and independent-client fixtures.
-2. Add A2A signed-card verification, streaming/resubscription, and push only
-   with authenticated end-to-end conformance tests.
-3. Extend task-memory citations, deletion proofs, quarantine, and rollback to
+## 1.80 Frontier Priorities
+
+The final Model Context Protocol release is implemented, including Tasks,
+Apps, multi-round-trip tool input, roots compatibility, and strict request
+metadata. Agent-to-Agent 1.0 JSON-RPC and HTTP+JSON remain separately
+negotiated from the older stable JavaScript SDK binding. The current backlog
+focuses on proven interoperability and narrow trust boundaries:
+
+1. Broaden independent-client fixtures for final Model Context Protocol and
+   Agent-to-Agent requests before adding more advertised protocol surface.
+2. Adopt a stable official Agent-to-Agent JavaScript binding when one exists.
+   Add gRPC only for a real transport consumer with TLS/authentication and TCK
+   coverage; do not advertise it from the Agent Card before that proof exists.
+3. Keep AP2 payments outside the coding agent until UR has an explicitly
+   authorized commerce use case, mandate/signature policy, credential model,
+   and end-to-end payment conformance suite.
+4. Extend task-memory citations, deletion proofs, quarantine, and rollback to
    every semantic, embedding-backed, and legacy memory store.
-4. Publish opt-in, signed, versioned trajectory/outcome pass-rate snapshots and
+5. Publish opt-in, signed, versioned trajectory/outcome pass-rate snapshots and
    calibrate model-judge agreement without capturing prompt/tool content.
-5. Require registry attestations, dependency review, revocation, and update
+6. Require registry attestations, dependency review, revocation, and update
    transparency before one-command community skill/plugin installation.
-6. Reopen authenticated user citations, explicitly refresh web/MCP citations,
-   enforce final claim-to-source links, and complete Windows OS-sandbox parity.
+7. Reopen authenticated user citations, explicitly refresh web/protocol
+   citations, enforce final claim-to-source links, and complete Windows
+   OS-sandbox parity.
 
 ## Source And Trust Policy
 
@@ -222,7 +228,7 @@ Professional answer requirements:
 - OpenAI deferred tool search: https://developers.openai.com/api/docs/guides/tools-tool-search
 - OpenAI agent evals: https://developers.openai.com/api/docs/guides/agent-evals
 - Model Context Protocol: https://modelcontextprotocol.io/docs/getting-started/intro
-- MCP 2026-07-28 release candidate: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
+- Final Model Context Protocol 2026-07-28 release: https://blog.modelcontextprotocol.io/posts/2026-07-28/
 - MCP Tasks extension: https://tasks.extensions.modelcontextprotocol.io/
 - MCP Apps extension: https://apps.extensions.modelcontextprotocol.io/
 - ACP v1 schema: https://agentclientprotocol.com/protocol/v1/schema

package/docs/CONFIGURATION.md

@@ -2,6 +2,21 @@
 
 UR reads configuration from CLI flags, environment variables, and project or user settings files.
 
+Inside an interactive UR session, `/config` opens the settings panel and
+`/config key=value` applies common settings directly:
+
+```text
+/config thinking=false screenReader=true reducedMotion=true
+/config editor=vim vimEscape=jj
+/config verbose=true autoCompact=false
+/config --help
+```
+
+Start UR with `--screen-reader`, set `UR_SCREEN_READER=1`, or use
+`/config screenReader=true` for append-only plain-text output, announced text
+edits, and reduced animation. `vimEscape` accepts 2–8 printable non-whitespace
+characters or `off`.
+
 ## Model Providers
 
 UR-Nexus supports official provider access paths only:
@@ -427,6 +442,32 @@ This sandbox covers UR-run Bash/File tool commands only. For subscription CLI
 providers, it does not extend to actions the external CLI performs internally
 — see [Provider Guide](providers.md).
 
+Security-sensitive sandbox proxy and credential settings are accepted only
+from user, flag, or managed-policy settings. Project settings cannot opt into
+credential injection. Example user settings:
+
+```json
+{
+  "sandbox": {
+    "enabled": true,
+    "network": {
+      "allowedDomains": ["api.example.com"],
+      "strictAllowlist": true,
+      "tlsTerminate": {}
+    },
+    "credentials": {
+      "envVars": [
+        { "name": "API_TOKEN", "mode": "mask", "injectHosts": ["api.example.com"] }
+      ]
+    }
+  }
+}
+```
+
+Credential entries support `deny` or `mask`, regex extraction, JWT claim
+masking, host-scoped injection, AWS key pairs, and SigV4 rewriting. Unknown
+destinations are rejected without prompting when `strictAllowlist` is true.
+
 ## Project Context Pack
 
 `ur context-pack` writes durable architecture context and task memory:
@@ -480,7 +521,7 @@ ur mcp get <name>
 ur mcp add-json <name> '<json>'
 ur mcp remove <name>
 ur mcp serve
-UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-http --port 8976
+UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-web --port 8976
 ```
 
 MCP servers may execute code or access external services. Only enable servers you trust, and keep credentials out of committed config.
@@ -492,7 +533,7 @@ adjusted with `UR_MCP_MAX_CALLS_PER_MINUTE`,
 `UR_MCP_MAX_CONCURRENT_CALLS`, `UR_MCP_TOOL_TIMEOUT_MS`,
 `UR_MCP_MAX_INPUT_CHARS`, and `UR_MCP_MAX_OUTPUT_CHARS`.
 
-`serve-http` is a separate, opt-in MCP 2026-07-28 compatibility surface at
+`serve-web` is the separate, opt-in stateless Model Context Protocol web surface at
 `POST /mcp`. It is stateless at the transport layer and exposes capability-
 negotiated Tasks and a self-contained overview App backed by UR's real MCP
 tool registry. Every call must supply matching protocol/method/name metadata.

package/docs/GAP_ANALYSIS_2026-08-11.md

@@ -1,180 +1,64 @@
-# UR Gap Analysis — 2026-08-11 Research Snapshot
+# UR Gap Analysis — 2026-08-11 Implemented Release Audit
 
-Baseline: UR `ur-agent@1.79.1`, HEAD `6faed11`, 186 slash commands, 60 tools.
-Upstream references: Claude Code 2.1.226 (2026-08-08), Codex CLI (Aug 2026),
-Gemini CLI v0.53.0 (2026-07-28), MCP spec `2026-07-28`, A2A v1.0 (Apr 2026).
+Baseline audited: `ur-agent@1.79.1`, commit `6faed11`. Release target: `1.80.0`.
+Primary references were rechecked before implementation: Claude Code
+2.1.221–2.1.224, the final Model Context Protocol specification dated
+2026-07-28, and the Agent2Agent 1.0 release.
 
-Every "missing" row below was verified absent by grep over `src/`, and every
-"present" row by a concrete file reference. Re-check primary sources before
-acting: prerelease standards move weekly.
+## Result
 
----
+All recommended gaps that strengthen UR without weakening its operator trust
+boundary are implemented. “Approve all”/`autoApprove` remains available and
+unchanged. UR does not add automated approval delegation.
 
-## 1. Already at parity — no action
-
-UR is closer to the frontier than the trend doc implies. Confirmed present:
-
-| Upstream feature | UR implementation |
+| Area | Release result |
 |---|---|
-| MCP `2026-07-28` stateless core | `src/services/mcp/mcp2026.ts` (`MCP_2026_PROTOCOL_VERSION = '2026-07-28'`) |
-| MCP Tasks extension (`tasks/get`, `tasks/update`, `tasks/cancel`) | `src/entrypoints/mcp2026.ts`, `src/services/mcp/mcp2026.ts` |
-| MCP Apps (sandboxed HTML UI) | `ui/initialize`, `ui/resourceUri` in `mcp2026.ts` |
-| MCP Extensions namespacing | `io.modelcontextprotocol/protocolVersion` header + `_meta` cross-check |
-| A2A v1.0 signed Agent Cards | `src/services/agents/a2aCardSignature.ts` (Ed25519 detached JWS), `a2aV1.ts` |
-| ACP / AG-UI servers | `src/services/agents/acpServer.ts`, `agUi.ts` |
-| Cross-session agent messaging | `SendMessageTool`, `ListPeersTool` |
-| Nested subagents with depth/concurrency caps | `src/tools/AgentTool/fanOutLimits.ts`, `fanOutSettings.ts` |
-| Self-hosted runner | `src/self-hosted-runner/main.js`, gated by `feature('SELF_HOSTED_RUNNER')` |
-| `--teleport`-style local continuation | `src/main.tsx`, `src/assistant/sessionHistory.ts` |
-| `AGENTS.md` interop | `src/utils/agentmd.ts`, `memoryFileDetection.ts` |
-| OpenTelemetry instrumentation | `src/utils/telemetry/instrumentation.ts` |
-| Headless spend cap | `--max-budget-usd` in `src/main.tsx` |
-| Plugin marketplace + search/show | `ur plugin search|show` (1.79.0) |
-| Codex `/plan`, `/goal`, `/fork`, `/diff`, `/review` equivalents | `src/commands/{plan,goal,diff,review}` |
-
-Notable divergence, deliberate or not: Anthropic **removed** `ultraplan` in
-Claude Code 2.1.222 (2026-08-04). UR still ships `/ultraplan`. Worth deciding
-whether that is a differentiator or dead weight.
-
----
-
-## 2. Missing — ranked by value
-
-### P0 — security correctness
-
-**1. Sandbox credential masking / TLS-terminating egress proxy.**
-Claude Code 2.1.221–2.1.224 added `sandbox.credentials` masking with
-`mode: "mask"` sentinel files, `extract` regex spans, `decode: "jwt"` +
-`maskClaims`, and `awsPairs`/`sigv4` re-signing behind `network.tlsTerminate`.
-UR's sandbox is filesystem-scope only — `src/utils/sandbox/sandboxProfile.ts`
-implements `denyRead`/`denyWrite` and nothing else. A sandboxed Bash command in
-UR that can read `~/.aws/credentials` exfiltrates the real secret.
-*Likely same bug present:* upstream patched a trailing-slash bypass where
-`denyRead: "~/.aws/"` was silently ignorable. UR's `normalizedPaths()`
-(`sandboxProfile.ts:51`) dedupes and calls `normalizePath()` but performs no
-trailing-slash stripping of its own — verify `normalizePath` handles it, and add
-a regression test for both `~/.aws` and `~/.aws/`.
-
-**2. `sandbox.network.strictAllowlist` (partial gap).** UR *does* have a network
-allowlist — `sandbox.network.allowedDomains`, `allowManagedDomainsOnly`,
-`allowUnixSockets` in `src/utils/sandbox/sandbox-adapter.ts`. What's absent is
-the strict mode: deny non-allowlisted hosts outright instead of prompting.
-Under automation (`ur exec`, `ur bg`, agentic CI) a prompt is not an answer, so
-today an unattended run either stalls or falls through. One settings key plus a
-branch in the egress decision path.
-
-**3. `Tool(param:value)` permission-rule syntax.** `permissionRuleParser.ts`
-supports only `Tool(content)`. Upstream added input-parameter matching with
-wildcards — e.g. `Agent(model:opus)` to block expensive subagents,
-`Bash(timeout:*)`. Without it, policies cannot constrain *how* a tool is called,
-only which paths it touches.
-
-**4. Bash permission-check hardening.** Upstream shipped three separate bypass
-fixes in Aug 2026: zsh hidden commands inside `[[ ]]` regex conditionals,
-commands padded with tabs/invisible Unicode hiding text from the approval
-dialog, and PowerShell paths containing quote characters. These are parser
-classes, not one-off bugs — audit UR's command splitter against all three.
-
-### P1 — runaway-loop containment
-
-**5. Per-session budgets, not just per-turn limits.** UR caps subagent depth and
-concurrency but has no session totals. Upstream added a WebSearch cap
-(default 200, `CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION`) and a subagent-spawn
-cap, then *removed* the spawn cap once long sessions started failing — so ship
-the search budget, and make the spawn budget advisory rather than fatal.
-
-**6. `--forward-subagent-text` for stream-json.** UR has `--include-hook-events`
-and `--include-partial-messages` but no way to surface subagent text/thinking in
-headless output, including nested (depth-2+) agents keyed by spawning
-`tool_use` id. This blocks CI observability of delegated work.
-
-### P2 — protocol currency
-
-**7. MCP `InputRequiredResult`.** The `2026-07-28` spec deprecates
-server-initiated elicitation and sampling in favor of `InputRequiredResult`.
-UR implements the old `Elicitation`/`ElicitationResult` hooks (`src/types/hooks.ts`)
-and has zero `InputRequired` references. Ship the new shape alongside the old.
-
-**8. MCP `roots/list` + `notifications/roots/list_changed`.** Absent entirely.
-Deprecated in `2026-07-28` (SEP-2577), but pre-2026 servers still expect it, and
-upstream wires additional working directories into it. Low effort, moderate
-compatibility win.
-
-**9. A2A gaps.** Two items: (a) `src/services/agents/trends.ts:666` advertises
-`protocolVersion: '0.3.0'` in the Agent Card while `a2aV1.ts` implements v1.0
-signing — the card lies about its own version; (b) no gRPC transport and no AP2
-payments extension, both part of the v1.0 surface.
-
-### P3 — accessibility and ergonomics
-
-**10. Screen-reader mode.** Zero hits for `axScreenReader`/`--ax-screen-reader`.
-Upstream shipped opt-in plain-text rendering plus per-keystroke and
-per-deletion echo announcements. UR's Ink UI is unusable with a screen reader
-today. This is the single largest addressable-user gap in the list.
-
-**11. `/config key=value` from the prompt.** `src/commands/config/` exposes only
-the interactive panel. Upstream's `/config thinking=false` works in interactive,
-`-p`, and remote modes, with `/config --help` listing shorthand keys — the only
-way to change a setting inside a headless run.
-
-**12. `DirectoryAdded` hook.** UR has `CwdChanged` and `WorktreeCreate` but
-fires nothing on `/add-dir`. Blocks per-directory setup automation.
-
-**13. Explicit `ur session archive` / `unarchive`.** `archiveSession` exists only
-in `src/bridge/`. Codex exposes `/archive` in the TUI and `codex archive` in the
-CLI, with archived sessions protected from resume/fork. UR's session list grows
-without bound.
-
-**14. Vim insert-mode remaps.** `vimInsertModeRemaps` (e.g. `jj` → Escape) is a
-one-setting change against UR's existing `src/vim/`.
-
-**15. Telemetry completeness.** No `assistant_response` OTel log event, no
-`message.uuid`/`client_request_id`/`tool_source` correlation attributes, no
-`workflow.run_id`/`workflow.name`. UR has workflows and multi-agent runs but
-cannot reconstruct a run from OTel data.
-
----
-
-## 3. Explicitly not recommended
-
-- **`EndConversation` tool.** Abuse-termination for a consumer chat product;
-  irrelevant to a local terminal agent the operator already controls.
-- **Gateway spend-limit UX.** Presupposes Anthropic's managed gateway. UR's
-  `--max-budget-usd` covers the local equivalent.
-- **`/dataviz` skill.** Content, not capability. Ship as a plugin if wanted.
-- **Codex `--approve-for-me`.** Routes approvals through automated review —
-  directly opposed to UR's explicit-trust-boundary stance in
-  `docs/FRONTIER_AGENT_FEATURES.md`.
-
----
-
-## 4. Suggested sequencing
-
-1. Credential masking + strict network allowlist (#1, #2) — same subsystem.
-2. Bash permission parser audit (#4) + `Tool(param:value)` (#3).
-3. Screen-reader mode (#10) — self-contained in `src/ink/`.
-4. MCP `InputRequiredResult` + `roots/list` (#7, #8); fix the A2A card version (#9a).
-5. Session budgets (#5), `--forward-subagent-text` (#6), OTel attributes (#15).
-6. Ergonomics batch: `/config key=value`, `DirectoryAdded`, session archive,
-   vim remaps (#11–14).
-
-Then update `docs/AGENT_TRENDS.md` — its snapshot line still reads
-`2026-08-10` and the coverage matrix predates the `2026-07-28` MCP final spec.
-
----
-
-## Sources
-
-- [Claude Code changelog](https://code.claude.com/docs/en/changelog)
-- [Enabling Claude Code to work more autonomously — Anthropic](https://www.anthropic.com/news/enabling-claude-code-to-work-more-autonomously)
-- [The 2026-07-28 MCP Specification](https://blog.modelcontextprotocol.io/posts/2026-07-28/)
-- [The 2026-07-28 MCP Specification Release Candidate](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/)
-- [The 2026 MCP Roadmap](https://blog.modelcontextprotocol.io/posts/2026-mcp-roadmap/)
-- [MCP 2026-07-28 spec: every breaking change, with fixes](https://stacktr.ee/blog/mcp-2026-spec-changes)
-- [Codex CLI in 2026: What's New, What's Changed](https://codex.danielvaughan.com/2026/03/27/codex-cli-in-2026-whats-new/)
-- [Codex Slash Commands: Complete CLI Reference (2026)](https://explainx.ai/blog/codex-slash-commands-complete-reference-guide-2026)
-- [Gemini CLI changelog v0.53.0](https://geminicli.com/docs/changelogs/latest/)
-- [Gemini CLI `/plan` command PR #17698](https://github.com/google-gemini/gemini-cli/pull/17698)
-- [A2A Protocol Guide 2026](https://rapidclaw.dev/blog/a2a-protocol-complete-guide-2026)
-- [MCP vs A2A vs AG-UI: Agent Protocols Guide 2026](https://nextpj.net/blog/mcp-a2a-ag-ui-ai-agent-protocols-guide-2026)
-- [The 2026 Guide to Coding CLI Tools: 15 AI Agents Compared](https://www.tembo.io/blog/coding-cli-tools-comparison)
+| Credential-safe sandboxing | Added the official sandbox runtime, trusted-source-only `sandbox.credentials`, file/environment masking, regex extraction, JWT claim masking, AWS credential pairs, SigV4 rewriting, and `network.tlsTerminate`. |
+| Strict egress | Added trusted `sandbox.network.strictAllowlist`; non-allowlisted destinations are denied instead of prompting. |
+| Filesystem deny regression | Verified canonical path normalization handles both `~/.aws` and `~/.aws/`; regression tests cover both forms. |
+| Parameter-aware permissions | Added `Tool(parameter:value)` matching with wildcards, including rules such as `Agent(model:opus)` and `Bash(timeout:*)`. |
+| Shell approval hardening | Added tree-sitter enforcement for production Bash, zsh `[[ ... ]]` command-substitution detection, visible rendering for tabs/control/zero-width/bidirectional characters, and PowerShell quote-path validation. |
+| Session containment | Added a 200-search default WebSearch session budget (`UR_MAX_WEB_SEARCHES_PER_SESSION`) and a non-fatal subagent-spawn advisory (`UR_SUBAGENT_SPAWN_ADVISORY_PER_SESSION`). |
+| Headless subagents | Added `--forward-subagent-text` for nested assistant output in `stream-json`, correlated to the spawning tool-use ID. |
+| Model Context Protocol | Added final `input_required` results and codes while retaining older elicitation compatibility. Existing roots support now includes all added directories plus `notifications/roots/list_changed`. |
+| Agent-to-Agent cards | Audit disproved the reported mismatch: `protocolVersion: 0.3.0` belongs to the deliberately retained legacy card; the negotiated modern card is produced separately and signed correctly. No false version change was made. |
+| Accessibility | Added `--screen-reader`, `screenReaderMode`, append-only plain-text rendering, edit announcements, and reduced animation. |
+| In-session configuration | Added `/config key=value`, including thinking, screen reader, reduced motion, verbose output, auto-compaction, editor mode, and Vim escape sequence. |
+| Directory automation | Added the `DirectoryAdded` hook and roots-change notification after `/add-dir`. |
+| Session lifecycle | Added `/session status|list|archive|unarchive` and `ur session list|archive|unarchive`. Archived sessions cannot appear in resume/fork discovery until restored. |
+| Vim input | Added `vimEscape=<sequence>`; for example, `/config editor=vim vimEscape=jj`. |
+| Telemetry | Added privacy-safe `assistant_response` events, message/request/tool correlation, and workflow name/run identifiers. |
+| Command quality | Removed the no-op `/output-style` command and dormant `/ultraplan` registration, renamed `/debug-v2` to `/fix-bug`, removed duplicate 3D aliases, expanded protocol names in help, and added registry checks against public version jargon. |
+
+## Corrected findings and deliberate omissions
+
+- `roots/list` was not absent. UR already served the initial working directory;
+  this release extends it to added directories and change notifications.
+- The old and modern Agent-to-Agent cards are separate negotiated compatibility
+  representations. The old card’s version is truthful and must not be relabeled.
+- gRPC transport and AP2 payments are optional integrations, not correctness
+  requirements for UR’s local coding-agent surface. Shipping either without a
+  real transport consumer, payment policy, credential model, and end-to-end
+  conformance suite would add attack surface without useful capability, so they
+  are deliberately omitted.
+- Anthropic removed `ultraplan` in Claude Code 2.1.222. UR’s registered command
+  was also permanently disabled, so the registration was removed as dead public
+  weight. Shared remote-planning internals used by active features remain.
+- `EndConversation`, managed-gateway spend UX, `/dataviz`, and automated
+  approval delegation remain intentionally omitted. They either duplicate
+  existing controls, are content rather than capability, or weaken the explicit
+  operator trust boundary.
+
+## Primary sources
+
+- [Claude Code 2.1.221](https://github.com/anthropics/claude-code/releases/tag/v2.1.221)
+- [Claude Code 2.1.222](https://github.com/anthropics/claude-code/releases/tag/v2.1.222)
+- [Claude Code 2.1.223](https://github.com/anthropics/claude-code/releases/tag/v2.1.223)
+- [Claude Code 2.1.224](https://github.com/anthropics/claude-code/releases/tag/v2.1.224)
+- [Anthropic sandboxing documentation](https://code.claude.com/docs/en/sandboxing)
+- [Model Context Protocol 2026-07-28 release](https://blog.modelcontextprotocol.io/posts/2026-07-28/)
+- [Model Context Protocol final schema](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/schema/2026-07-28/schema.ts)
+- [Agent2Agent 1.0 changes](https://a2a-protocol.org/latest/whats-new-v1/)
+- [Agent2Agent 1.0 specification](https://a2a-protocol.org/latest/specification/)
+- [Agent Payments Protocol reference repository](https://github.com/google-agentic-commerce/AP2)
+- [OpenTelemetry generative-AI attributes](https://opentelemetry.io/docs/specs/semconv/registry/attributes/gen-ai/)

package/docs/USAGE.md

@@ -25,8 +25,29 @@ ur --add-dir ../other-project
 ur --permission-mode ask
 ur --continue
 ur --resume
+ur --screen-reader
 ```
 
+Useful commands from inside UR:
+
+```text
+/config thinking=false screenReader=true
+/config editor=vim vimEscape=jj
+/session list
+/session archive
+/session unarchive <session-id>
+/fix-bug describe the failure and reproduction steps
+/research init current-tools --question "What changed?"
+/design3d doctor
+/design3d init product-shot --engine blender --units mm --format blend
+/design3d init studio-scene --engine 3dsmax --units cm --format max
+```
+
+`/design3d doctor` reports installed applications. `MISSING` means that optional
+application is not installed or is not on `PATH`; it is not a UR failure. On
+macOS, Autodesk 3ds Max is expected to be missing because it is a Windows
+application. Use Blender locally, or run the 3ds Max project on a Windows host.
+
 When UR needs a focused clarification, it uses the `AskUserQuestion` dialog.
 Professional clarification prompts can provide up to eight concrete options;
 UR also accepts custom "Other" answers when the dialog includes one.
@@ -49,8 +70,13 @@ Output formats:
 ur -p --output-format text "explain src/main.tsx"
 ur -p --output-format json "return a JSON summary of this repo"
 ur -p --output-format stream-json "stream progress while answering"
+ur -p --output-format stream-json --forward-subagent-text "delegate and stream nested results"
 ```
 
+WebSearch allows 200 provider searches per session by default. Set
+`UR_MAX_WEB_SEARCHES_PER_SESSION` to another positive integer, or to
+`unlimited` only for a trusted long-running job.
+
 Structured output can be validated with a JSON schema:
 
 ```sh
@@ -264,6 +290,8 @@ hooks:
 ```
 
 Hooks are advisory by default. A `BeforeEdit`/`BeforeCommand`/`BeforeCommit` hook can block the action by returning `{"decision":"block","reason":"..."}` or exit code 2. `AfterEdit` and `OnFailure` hooks can return `{"hookSpecificOutput":{"hookEventName":"...","memory":{"kind":"accepted","text":"..."}}}` to append project memory automatically.
+`DirectoryAdded` fires after `/add-dir` authorizes and adds a directory, so
+plugins and project automation can initialize directory-specific state.
 
 ## Commands
 
@@ -272,7 +300,7 @@ UR includes slash commands and CLI subcommands for common workflows:
 - `/help` or `ur --help` for command discovery
 - `ur connect ...` to connect provider accounts (subscription login or stored API key)
 - `ur mcp ...` to configure MCP servers, run the stdio server, or start the
-  opt-in stateless MCP 2026 Tasks/Apps adapter with `ur mcp serve-http`
+  opt-in stateless Model Context Protocol Tasks/Apps server with `ur mcp serve-web`
 - `ur ag-ui serve` to expose the secure AG-UI HTTP/SSE adapter to an explicitly
   allowed user-facing application
 - `ur plugin ...` to manage plugins and marketplaces. Marketplace plugins can
@@ -319,7 +347,7 @@ UR includes slash commands and CLI subcommands for common workflows:
 - `ur artifacts ...` to capture reviewable diffs, test runs, notes, feedback,
   and bounded non-symlink attachments with safe download headers/MIME fallback
 - `ur ide diff ...` to capture editor-readable inline diff bundles
-- `ur acp stdio` for the official-SDK ACP v1 editor transport with durable
+- `ur acp stdio` for the standard Agent Client Protocol editor transport with durable
   list/load/delete/resume, modes, config options, and commands; and
   `ur acp serve|stop|status` for the separate UR HTTP JSON-RPC API
 - `ur exec ...` to run prompts in non-interactive mode with optional concurrency
@@ -372,7 +400,7 @@ UR includes slash commands and CLI subcommands for common workflows:
   money column is omitted rather than printing a wall of `$0.00`. Add `--json`
   for the raw rows.
 - `ur role-mode ...` to install built-in Architect, Code, Debug, and Ask role modes
-- `ur a2a ...` for negotiated v1 JSON-RPC/HTTP+JSON, the stable v0.3 SDK
+- `ur a2a ...` for a negotiated Agent-to-Agent server with automatic compatibility
   binding, scoped delegation tokens, durable protocol state, and separate UR
   compatibility task routes
 - `ur sdk ...` to scaffold TS/Python headless SDK examples
@@ -501,7 +529,7 @@ ur context-pack remember --decision "Keep streaming" --cite-file src/parser.ts -
 ur context-pack memory verify
 ur context-pack memory revalidate
 ur context-pack compress
-UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-http --port 8976
+UR_MCP_HTTP_TOKEN='<secret>' ur mcp serve-web --port 8976
 ur acp serve --port 8123
 ur exec "add tests for the parser" --concurrency 4 --json
 ur ci-loop --command "bun test" --cwd . --dry-run

package/docs/VALIDATION.md

@@ -19,7 +19,7 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.79.1 (UR-Nexus)"
+# expected for this release: "1.80.0 (UR-Nexus)"
 ```
 
 ## 0.1 First-workspace model selection (1.45.4)