ur-agent 1.80.2 → 1.80.3

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.80.3
+
+- Restored visible task planning with a strict-hybrid default. Atomic,
+  low-risk requests still execute directly; requests with multiple outcomes,
+  sequencing, plan mode, delegation, project-sized work, or release/security/
+  migration/production risk must create an actionable task before the first
+  mutation. Read-only investigation remains unrestricted.
+- The task gate now uses deterministic user-turn classification instead of
+  treating conversation length as complexity. It fails closed when task state
+  is unreadable, rechecks permission-rewritten tool input, preserves active
+  interrupted boards, and never deadlocks a custom tool profile that omits
+  `TaskCreate`.
+- Operators can keep task tracking advisory with
+  `tasks.requireBeforeChanges.enabled=false`, or set `freeReads=0` to require a
+  task before every mutation. Approve All remains unchanged.
+
 ## 1.80.2
 
 - Repaired repeated `AskUserQuestion` validation loops when a model emits one

package/README.md

@@ -81,6 +81,13 @@ useful. Each task records id, order, title, description, status, dependencies,
 assigned logical agent role, input, expected output, verification criteria, file
 targets, risk level, and whether approval is required.
 
+Inside the interactive agent, task tracking uses a strict-hybrid default:
+atomic low-risk work stays direct, while multi-outcome, sequenced, planned,
+delegated, project-sized, and high-risk lifecycle work must create a visible
+task before the first mutation. Reads stay unrestricted. Configure the gate
+with `tasks.requireBeforeChanges`; `enabled=false` makes it advisory and
+`freeReads=0` requires a task before every mutation.
+
 During real `ur exec` runs the task board streams when a task status changes,
 then appears again in the final report. Quiet/non-interactive runs can suppress
 streaming while preserving the final board. Public status labels are

package/dist/cli.js

@@ -107784,7 +107784,7 @@ var init_auth = __esm(() => {
 
 // src/utils/userAgent.ts
 function getURCodeUserAgent() {
-  return `ur/${"1.80.2"}`;
+  return `ur/${"1.80.3"}`;
 }
 
 // src/utils/workloadContext.ts
@@ -107806,7 +107806,7 @@ function getUserAgent() {
   const clientApp = process.env.UR_AGENT_SDK_CLIENT_APP ? `, client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}` : "";
   const workload = getWorkload();
   const workloadSuffix = workload ? `, workload/${workload}` : "";
-  return `ur-cli/${"1.80.2"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
+  return `ur-cli/${"1.80.3"} (${process.env.USER_TYPE}, ${process.env.UR_CODE_ENTRYPOINT ?? "cli"}${agentSdkVersion}${clientApp}${workloadSuffix})`;
 }
 function getMCPUserAgent() {
   const parts = [];
@@ -107820,7 +107820,7 @@ function getMCPUserAgent() {
     parts.push(`client-app/${process.env.UR_AGENT_SDK_CLIENT_APP}`);
   }
   const suffix = parts.length > 0 ? ` (${parts.join(", ")})` : "";
-  return `ur/${"1.80.2"}${suffix}`;
+  return `ur/${"1.80.3"}${suffix}`;
 }
 function getWebFetchUserAgent() {
   return `UR-User (${getURCodeUserAgent()})`;
@@ -107958,7 +107958,7 @@ var init_user = __esm(() => {
       deviceId,
       sessionId: getSessionId(),
       email: getEmail(),
-      appVersion: "1.80.2",
+      appVersion: "1.80.3",
       platform: getHostPlatformForAnalytics(),
       organizationUuid,
       accountUuid,
@@ -115845,7 +115845,7 @@ var init_metadata = __esm(() => {
   COMPOUND_OPERATOR_REGEX = /\s*(?:&&|\|\||[;|])\s*/;
   WHITESPACE_REGEX = /\s+/;
   getVersionBase = memoize_default(() => {
-    const match = "1.80.2".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
+    const match = "1.80.3".match(/^\d+\.\d+\.\d+(?:-[a-z]+)?/);
     return match ? match[0] : undefined;
   });
   buildEnvContext = memoize_default(async () => {
@@ -115885,7 +115885,7 @@ var init_metadata = __esm(() => {
       isGithubAction: isEnvTruthy(process.env.GITHUB_ACTIONS),
       isURCodeAction: isEnvTruthy(process.env.UR_CODE_ACTION),
       isURAiAuth: isURAISubscriber(),
-      version: "1.80.2",
+      version: "1.80.3",
       versionBase: getVersionBase(),
       buildTime: "",
       deploymentEnvironment: env2.detectDeploymentEnvironment(),
@@ -116555,7 +116555,7 @@ function initialize1PEventLogging() {
   const platform2 = getPlatform();
   const attributes = {
     [import_semantic_conventions4.ATTR_SERVICE_NAME]: "ur",
-    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.80.2"
+    [import_semantic_conventions4.ATTR_SERVICE_VERSION]: "1.80.3"
   };
   if (platform2 === "wsl") {
     const wslVersion = getWslVersion();
@@ -116583,7 +116583,7 @@ function initialize1PEventLogging() {
       })
     ]
   });
-  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.80.2");
+  firstPartyEventLogger = firstPartyEventLoggerProvider.getLogger("com.urhq.ur.events", "1.80.3");
 }
 async function reinitialize1PEventLoggingIfConfigChanged() {
   if (!is1PEventLoggingEnabled() || !firstPartyEventLoggerProvider) {
@@ -119068,7 +119068,7 @@ var init_types2 = __esm(() => {
       requireBeforeChanges: exports_external.object({
         enabled: exports_external.boolean().optional(),
         freeReads: exports_external.number().optional()
-      }).optional().describe("Require a task list before any tool that changes the workspace (Edit, Write, Bash, ...). " + "Reads are never blocked, so the agent can investigate before planning; freeReads is how many " + "tool calls may run before the gate applies at all. Set enabled=false to make the task list advisory again.")
+      }).optional().describe("Require a task list before any tool that changes the workspace (Edit, Write, Bash, ...). " + "The default strict-hybrid policy enforces classified multi-step, risky, delegated, and release work " + "while allowing positively classified atomic changes to proceed directly. Reads are never blocked. " + "Set freeReads=0 to require a task before every mutation, or enabled=false to make task tracking advisory.")
     }).optional().describe("Task list behaviour."),
     context: exports_external.object({
       pruneToolResults: exports_external.object({
@@ -126542,7 +126542,7 @@ function formatAgentTrendReport(report = buildAgentTrendReport()) {
 function formatA2AAgentCard(options = {}, pretty = true) {
   return JSON.stringify(buildA2AAgentCard(options), null, pretty ? 2 : 0);
 }
-var urVersion = "1.80.2", researchSnapshotDate = "2026-08-10", coverage, priorityRoadmap;
+var urVersion = "1.80.3", researchSnapshotDate = "2026-08-10", coverage, priorityRoadmap;
 var init_trends = __esm(() => {
   init_a2aCardSignature();
   coverage = [
@@ -129432,7 +129432,7 @@ function getAttributionHeader(fingerprint) {
   if (!isAttributionHeaderEnabled()) {
     return "";
   }
-  const version2 = `${"1.80.2"}.${fingerprint}`;
+  const version2 = `${"1.80.3"}.${fingerprint}`;
   const entrypoint = process.env.UR_CODE_ENTRYPOINT ?? "unknown";
   const cch = "";
   const workload = getWorkload();
@@ -184625,7 +184625,7 @@ var init_projectSafety = __esm(() => {
 function getInstruments() {
   if (instruments)
     return instruments;
-  const meter = import_api10.metrics.getMeter("ur-agent.gen_ai", "1.80.2");
+  const meter = import_api10.metrics.getMeter("ur-agent.gen_ai", "1.80.3");
   instruments = {
     operationDuration: meter.createHistogram("gen_ai.client.operation.duration", {
       description: "GenAI operation duration.",
@@ -184723,7 +184723,7 @@ function genAiAgentAttributes() {
     "gen_ai.operation.name": GEN_AI_OPERATION_INVOKE_AGENT,
     "gen_ai.provider.name": "ur",
     "gen_ai.agent.name": "UR-Nexus",
-    "gen_ai.agent.version": "1.80.2"
+    "gen_ai.agent.version": "1.80.3"
   };
 }
 function genAiWorkflowAttributes(workflowName, workflowRunId) {
@@ -184744,7 +184744,7 @@ function genAiWorkflowAttributes(workflowName, workflowRunId) {
 function startGenAiWorkflowSpan(workflowName, workflowRunId) {
   const attributes = genAiWorkflowAttributes(workflowName, workflowRunId);
   const name = typeof attributes["gen_ai.workflow.name"] === "string" ? `invoke_workflow ${attributes["gen_ai.workflow.name"]}` : GEN_AI_OPERATION_INVOKE_WORKFLOW;
-  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.80.2").startSpan(name, { kind: import_api10.SpanKind.INTERNAL, attributes });
+  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.80.3").startSpan(name, { kind: import_api10.SpanKind.INTERNAL, attributes });
 }
 function endGenAiWorkflowSpan(span, options2 = {}) {
   try {
@@ -184782,7 +184782,7 @@ function startGenAiMemorySpan(operation, options2 = {}) {
   if (options2.recordCount !== undefined && Number.isInteger(options2.recordCount) && options2.recordCount >= 0) {
     attributes["gen_ai.memory.record.count"] = options2.recordCount;
   }
-  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.80.2").startSpan(operation, { kind: import_api10.SpanKind.INTERNAL, attributes });
+  return import_api10.trace.getTracer("ur-agent.gen_ai", "1.80.3").startSpan(operation, { kind: import_api10.SpanKind.INTERNAL, attributes });
 }
 function endGenAiMemorySpan(span, options2 = {}) {
   try {
@@ -278497,7 +278497,7 @@ function getTelemetryAttributes() {
     attributes["session.id"] = sessionId;
   }
   if (shouldIncludeAttribute("OTEL_METRICS_INCLUDE_VERSION")) {
-    attributes["app.version"] = "1.80.2";
+    attributes["app.version"] = "1.80.3";
   }
   const oauthAccount = getOauthAccountInfo();
   if (oauthAccount) {
@@ -319488,7 +319488,7 @@ function getInstallationEnv() {
   return;
 }
 function getURCodeVersion() {
-  return "1.80.2";
+  return "1.80.3";
 }
 async function getInstalledVSCodeExtensionVersion(command) {
   const { stdout } = await execFileNoThrow(command, ["--list-extensions", "--show-versions"], {
@@ -326858,7 +326858,7 @@ async function setupSdkMcpClients(sdkMcpConfigs, sendMcpMessage) {
     const client2 = new Client({
       name: "ur",
       title: "UR",
-      version: "1.80.2",
+      version: "1.80.3",
       description: "UR-Nexus autonomous engineering workflow engine",
       websiteUrl: PRODUCT_URL
     }, {
@@ -327219,7 +327219,7 @@ var init_client5 = __esm(() => {
       const client2 = new Client({
         name: "ur",
         title: "UR",
-        version: "1.80.2",
+        version: "1.80.3",
         description: "UR-Nexus autonomous engineering workflow engine",
         websiteUrl: PRODUCT_URL
       }, {
@@ -339957,7 +339957,7 @@ async function createRuntime() {
   bootstrapTelemetry();
   const resource = defaultResource().merge(detectResources({ detectors: [envDetector] })).merge(resourceFromAttributes({
     [import_semantic_conventions7.ATTR_SERVICE_NAME]: "ur-agent",
-    [import_semantic_conventions7.ATTR_SERVICE_VERSION]: "1.80.2"
+    [import_semantic_conventions7.ATTR_SERVICE_VERSION]: "1.80.3"
   }));
   const tracerProvider = exporters.traces.length > 0 ? new BasicTracerProvider({
     resource,
@@ -339990,11 +339990,11 @@ async function createRuntime() {
   setMeterProvider(meterProvider);
   setLoggerProvider(loggerProvider);
   if (meterProvider) {
-    const meter = meterProvider.getMeter("ur-agent", "1.80.2");
+    const meter = meterProvider.getMeter("ur-agent", "1.80.3");
     setMeter(meter, (name, options2) => meter.createCounter(name, options2));
   }
   if (loggerProvider) {
-    setEventLogger(loggerProvider.getLogger("ur-agent.events", "1.80.2"));
+    setEventLogger(loggerProvider.getLogger("ur-agent.events", "1.80.3"));
   }
   if (!cleanupRegistered3) {
     cleanupRegistered3 = true;
@@ -340656,9 +340656,9 @@ async function assertMinVersion() {
   if (false) {}
   try {
     const versionConfig = await getDynamicConfig_BLOCKS_ON_INIT("tengu_version_config", { minVersion: "0.0.0" });
-    if (versionConfig.minVersion && lt("1.80.2", versionConfig.minVersion)) {
+    if (versionConfig.minVersion && lt("1.80.3", versionConfig.minVersion)) {
       console.error(`
-It looks like your version of UR (${"1.80.2"}) needs an update.
+It looks like your version of UR (${"1.80.3"}) needs an update.
 A newer version (${versionConfig.minVersion} or higher) is required to continue.
 
 To update, please run:
@@ -340874,7 +340874,7 @@ async function installGlobalPackage(specificVersion) {
     logError2(new AutoUpdaterError("Another process is currently installing an update"));
     logEvent("tengu_auto_updater_lock_contention", {
       pid: process.pid,
-      currentVersion: "1.80.2"
+      currentVersion: "1.80.3"
     });
     return "in_progress";
   }
@@ -340883,7 +340883,7 @@ async function installGlobalPackage(specificVersion) {
     if (!env2.isRunningWithBun() && env2.isNpmFromWindowsPath()) {
       logError2(new Error("Windows NPM detected in WSL environment"));
       logEvent("tengu_auto_updater_windows_npm_in_wsl", {
-        currentVersion: "1.80.2"
+        currentVersion: "1.80.3"
       });
       console.error(`
 Error: Windows NPM detected in WSL
@@ -341418,7 +341418,7 @@ function detectLinuxGlobPatternWarnings() {
 }
 async function getDoctorDiagnostic() {
   const installationType = await getCurrentInstallationType();
-  const version2 = typeof MACRO !== "undefined" ? "1.80.2" : "unknown";
+  const version2 = typeof MACRO !== "undefined" ? "1.80.3" : "unknown";
   const installationPath = await getInstallationPath();
   const invokedBinary = getInvokedBinary();
   const multipleInstallations = await detectMultipleInstallations();
@@ -342353,8 +342353,8 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
     const maxVersion = await getMaxVersion();
     if (maxVersion && gt(version2, maxVersion)) {
       logForDebugging(`Native installer: maxVersion ${maxVersion} is set, capping update from ${version2} to ${maxVersion}`);
-      if (gte("1.80.2", maxVersion)) {
-        logForDebugging(`Native installer: current version ${"1.80.2"} is already at or above maxVersion ${maxVersion}, skipping update`);
+      if (gte("1.80.3", maxVersion)) {
+        logForDebugging(`Native installer: current version ${"1.80.3"} is already at or above maxVersion ${maxVersion}, skipping update`);
         logEvent("tengu_native_update_skipped_max_version", {
           latency_ms: Date.now() - startTime,
           max_version: maxVersion,
@@ -342365,7 +342365,7 @@ async function updateLatest(channelOrVersion, forceReinstall = false) {
       version2 = maxVersion;
     }
   }
-  if (!forceReinstall && version2 === "1.80.2" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
+  if (!forceReinstall && version2 === "1.80.3" && await versionIsAvailable(version2) && await isPossibleURBinary(executablePath)) {
     logForDebugging(`Found ${version2} at ${executablePath}, skipping install`);
     logEvent("tengu_native_update_complete", {
       latency_ms: Date.now() - startTime,
@@ -402101,6 +402101,52 @@ function requestsRevisionOfCurrentTaskList(input) {
 function shouldKeepCurrentTaskList(input) {
   return requestsAppendToCurrentTaskList(input) || requestsContinueCurrentTaskList(input) || requestsRevisionOfCurrentTaskList(input);
 }
+function withoutCode(input) {
+  return input.replace(/```[\s\S]*?```/gu, " ").replace(/`[^`\n]*`/gu, " ");
+}
+function proseOnly(input) {
+  return withoutCode(input).replace(/\s+/gu, " ").trim();
+}
+function taskListRequirementReason(input) {
+  const text2 = proseOnly(input);
+  if (!text2)
+    return;
+  const optsOut = /\b(?:do not|don't)\s+(?:(?:create|make|maintain|show|start|use)\s+)?(?:a\s+)?(?:task|todo)(?:\s+(?:list|board))?\b/iu.test(text2) || /\bwithout\s+(?:(?:creating|making|maintaining|showing|starting|using)\s+)?(?:a\s+)?(?:task|todo)(?:\s+(?:list|board))?\b/iu.test(text2) || /\b(?:skip|no)\s+(?:the\s+|a\s+)?(?:task|todo)(?:\s+(?:list|board))?\b/iu.test(text2);
+  if (optsOut)
+    return;
+  if (/\b(?:create|make|maintain|show|start|use|keep|track|add|append|put|queue)\b[^.!?]{0,100}\b(?:task|todo)\s+(?:list|board)\b/iu.test(text2) || /\b(?:add|append|put|queue)\s+(?:this|it)?\s*(?:to|on)?\s*(?:my|the|your)?\s*(?:tasks?|todos?)\b/iu.test(text2) || /\b(?:add|append|put|queue)\s+(?:this|it)\s+(?:to|on)\s+(?:the\s+|your\s+|my\s+)?(?:current|existing)\s+list\b/iu.test(text2) || /\b(?:create|make|use|track)\s+(?:the\s+|a\s+|your\s+)?(?:tasks?|todos?)\b/iu.test(text2) || /\b(?:tasks?|todos?)\s+first\b/iu.test(text2)) {
+    return "explicit task tracking request";
+  }
+  if (/^\/plan(?:\s|$)/iu.test(text2) || /\b(?:enter|start|use|switch\s+to)\s+plan\s+mode\b/iu.test(text2) || /\bplan\s+(?:this|the\s+work|first)\b/iu.test(text2)) {
+    return "planning workflow";
+  }
+  if (/\b(?:delegate|delegation|sub[ -]?agents?|parallel\s+agents?|agent\s+team|team\s+of\s+agents?|fan[ -]?out)\b/iu.test(text2)) {
+    return "delegation or parallel agent work";
+  }
+  const hasAction = new RegExp(String.raw`\b${ACTION_WORD}\b`, "iu").test(text2);
+  if (hasAction && /\b(?:publish|release|deploy|production|migrat(?:e|ion)|database\s+schema|credentials?|secrets?|permissions?|sandbox|security|authentication|authorization|payments?|billing|version\s+bump|git\s+tag)\b/iu.test(text2)) {
+    return "release, security, migration, or production risk";
+  }
+  const structuralText = withoutCode(input);
+  const enumeratedItems = structuralText.match(/(?:^|\n)\s*(?:[-*+]\s+|\d+[.)]\s+)\S/gu);
+  const actionLines = structuralText.split(/\r?\n/gu).filter((line) => new RegExp(String.raw`\b${ACTION_WORD}\b`, "iu").test(line));
+  if ((enumeratedItems?.length ?? 0) >= 2 || actionLines.length >= 2 || SEQUENCED_ACTION_RE.test(text2)) {
+    return "multiple requested outcomes";
+  }
+  const targetList = new RegExp(String.raw`\b${ACTION_WORD}\b[^.!?]{0,120}\b(?:docs?|tests?|code|implementation|configuration|config|workflow|release notes?|technical docs?|readme|ui|api|cli|database|schema|sandbox|permissions?)\b[^.!?]{0,80}(?:,|\band\b|\bplus\b)[^.!?]{0,80}\b(?:docs?|tests?|code|implementation|configuration|config|workflow|release notes?|technical docs?|readme|ui|api|cli|database|schema|sandbox|permissions?)\b`, "iu");
+  if (targetList.test(text2))
+    return "multiple requested outcomes";
+  const projectScope = /\b(?:app|application|agent|system|platform|website|dashboard|service|integration|workflow|codebase|project|plugin|extension|3d\s+(?:scene|design|pipeline))\b/iu;
+  const projectAction = /\b(?:build(?:ing|s)?|built|creat(?:e|ed|es|ing)|design(?:ed|ing|s)?|implement(?:ed|ing|s)?|integrat(?:e|ed|es|ing)|refactor(?:ed|ing|s)?|rewrit(?:e|ing|ten)|overhaul(?:ed|ing|s)?|audit(?:ed|ing|s)?|research(?:ed|es|ing)?)\b/iu;
+  if (projectScope.test(text2) && projectAction.test(text2)) {
+    return "large project scope";
+  }
+  ACTION_RE.lastIndex = 0;
+  if (text2.length >= 600 && ACTION_RE.test(text2)) {
+    return "detailed multi-step request";
+  }
+  return;
+}
 function getTaskListRunForCommand(command, options2 = {}) {
   if (!command || command.mode !== "prompt" || command.isMeta)
     return;
@@ -402108,9 +402154,12 @@ function getTaskListRunForCommand(command, options2 = {}) {
   if (!options2.allowSlashCommand && !command.skipSlashCommands && text2.trimStart().startsWith("/")) {
     return;
   }
+  const requirementReason = taskListRequirementReason(text2);
   return {
     generationId: String(command.uuid ?? randomUUID40()),
-    appendToCurrent: shouldKeepCurrentTaskList(text2)
+    appendToCurrent: shouldKeepCurrentTaskList(text2),
+    requiresTaskList: requirementReason !== undefined,
+    ...requirementReason ? { requirementReason } : {}
   };
 }
 function getTaskListRunFromMessages(messages) {
@@ -402118,14 +402167,21 @@ function getTaskListRunFromMessages(messages) {
   if (!message || typeof message.uuid !== "string" || !message.uuid) {
     return;
   }
+  const text2 = textFromMessage(message);
+  const requirementReason = taskListRequirementReason(text2);
   return {
     generationId: message.uuid,
-    appendToCurrent: shouldKeepCurrentTaskList(textFromMessage(message))
+    appendToCurrent: shouldKeepCurrentTaskList(text2),
+    requiresTaskList: requirementReason !== undefined,
+    ...requirementReason ? { requirementReason } : {}
   };
 }
-var taskListRunStorage;
+var taskListRunStorage, ACTION_WORD, ACTION_RE, SEQUENCED_ACTION_RE;
 var init_taskListRunContext = __esm(() => {
   taskListRunStorage = new AsyncLocalStorage5;
+  ACTION_WORD = String.raw`(?:add(?:ed|ing|s)?|audit(?:ed|ing|s)?|build(?:ing|s)?|built|bump(?:ed|ing|s)?|chang(?:e|ed|es|ing)|clean(?:ed|ing|s)?|creat(?:e|ed|es|ing)|debug(?:ged|ging|s)?|delet(?:e|ed|es|ing)|deploy(?:ed|ing|s)?|design(?:ed|ing|s)?|document(?:ed|ing|s)?|fix(?:ed|es|ing)?|implement(?:ed|ing|s)?|integrat(?:e|ed|es|ing)|migrat(?:e|ed|es|ing)|publish(?:ed|es|ing)?|push(?:ed|es|ing)?|refactor(?:ed|ing|s)?|releas(?:e|ed|es|ing)|remov(?:e|ed|es|ing)|renam(?:e|ed|es|ing)|repair(?:ed|ing|s)?|research(?:ed|es|ing)?|review(?:ed|ing|s)?|secur(?:e|ed|es|ing)|test(?:ed|ing|s)?|updat(?:e|ed|es|ing)|upgrad(?:e|ed|es|ing)|verif(?:y|ied|ies|ying)|writ(?:e|es|ing)|wrote)`;
+  ACTION_RE = new RegExp(String.raw`\b${ACTION_WORD}\b`, "giu");
+  SEQUENCED_ACTION_RE = new RegExp(String.raw`\b${ACTION_WORD}\b[^.!?\n]{0,180}(?:\band\b|\bthen\b|\balso\b|\bplus\b|;|\n)[^.!?\n]{0,100}\b${ACTION_WORD}\b`, "iu");
 });
 
 // src/tools/TaskCreateTool/prompt.ts
@@ -402141,9 +402197,11 @@ It also helps the user understand the progress of the task and overall progress
 
 Use this tool proactively in these scenarios:
 
-- Complex multi-step tasks - When a request requires 3 or more distinct steps or actions
+- Multi-outcome work - When a request has 2 or more distinct requested outcomes, deliverables, or sequenced actions
 - Non-trivial and complex tasks - Tasks that require careful planning or multiple operations${teammateContext}
 - Multiple independently verifiable outcomes, dependency ordering, delegation, or parallel work
+- High-risk lifecycle work - Releases, publishing, deployment, migrations, security, credentials, permissions, sandboxing, or production changes
+- Project-sized builds, integrations, workflows, refactors, and audits
 - Plan mode - When using plan mode, create a task list to track the work
 - User explicitly requests todo list - When the user directly asks you to use the todo list
 - User asks to queue work - When the user says "add to your tasks", "add this to your task list", "put this on the list", "queue this up", or anything similar, IMMEDIATELY call this tool with that request \u2014 even if you are in the middle of other work and even if the item sounds small. The user is watching the live task panel and expects the item to appear there right away. Acknowledge briefly and continue what you were doing unless asked to switch.
@@ -402154,7 +402212,7 @@ Use this tool proactively in these scenarios:
 
 Skip using this tool when:
 - The task is purely conversational or informational
-- The request is one direct, low-risk action that can be completed and verified as one operation
+- The request is one genuinely atomic, low-risk action with one outcome that can be completed and verified directly
 - The user sends a short acknowledgement, correction, or clarification that does not add a distinct outcome to an existing board
 
 Do not create a task merely because a user sent a message or because the request is actionable. Task subjects must describe concrete outcomes chosen after understanding the work; never copy the raw prompt into a task title.
@@ -412385,7 +412443,7 @@ function isAnyTracingEnabled() {
   return isTelemetryEnabled() || isEnhancedTelemetryEnabled() || isBetaTracingEnabled();
 }
 function getTracer() {
-  return import_api39.trace.getTracer("ur-agent.gen_ai", "1.80.2");
+  return import_api39.trace.getTracer("ur-agent.gen_ai", "1.80.3");
 }
 function createSpanAttributes(spanType, customAttributes = {}) {
   const baseAttributes = getTelemetryAttributes();
@@ -413066,6 +413124,8 @@ function checkTaskListGate(input) {
   const config3 = input.config ?? getTaskListGateConfig();
   if (!config3.enabled)
     return { allowed: true };
+  if (input.taskListWriterAvailable === false)
+    return { allowed: true };
   if (isTaskListGateExempt(input.toolName))
     return { allowed: true };
   const isMutating = input.isMutating ?? isMutatingTool2(input.toolName);
@@ -413074,23 +413134,29 @@ function checkTaskListGate(input) {
   if (input.taskCount !== null && input.taskCount > 0) {
     return { allowed: true };
   }
+  const inherentlyRequiresTaskList = input.isSubagent || ALWAYS_REQUIRE_PLAN_TOOLS.has(input.toolName);
+  const classifiedRequirement = input.requiresTaskList === true;
+  const forceEveryMutation = config3.freeReads === 0;
+  const unclassifiedAllowanceExpired = input.requiresTaskList === undefined && input.readsSoFar >= config3.freeReads;
+  const gateRequired = inherentlyRequiresTaskList || classifiedRequirement || forceEveryMutation || unclassifiedAllowanceExpired;
+  const requirementContext = input.requirementReason ? ` This turn requires task tracking because it contains ${input.requirementReason}.` : "";
   if (input.taskCount === null) {
     return {
       allowed: false,
-      reason: `The task list could not be read, so ${input.toolName} was not allowed ` + `to change state without a verifiable plan. Retry TaskList or ` + `TaskCreate, then retry this call. Disable with ` + `tasks.requireBeforeChanges.enabled=false in settings.`
+      reason: `The task list could not be read, so ${input.toolName} was not allowed ` + `to change state without a verifiable plan.${requirementContext} Retry TaskList or ` + `TaskCreate, then retry this call. Disable with ` + `tasks.requireBeforeChanges.enabled=false in settings.`
     };
   }
-  if (input.isSubagent || ALWAYS_REQUIRE_PLAN_TOOLS.has(input.toolName)) {
+  if (!gateRequired)
+    return { allowed: true };
+  if (inherentlyRequiresTaskList) {
     return {
       allowed: false,
       reason: `No actionable parent task exists for ${input.toolName}. Call ` + `TaskCreate before delegating or changing state, then retry this call. ` + `Disable with tasks.requireBeforeChanges.enabled=false in settings.`
     };
   }
-  if (input.readsSoFar < config3.freeReads)
-    return { allowed: true };
   return {
     allowed: false,
-    reason: `No task list exists, and ${input.toolName} changes the workspace. ` + `Call TaskCreate first with the steps you intend to take, then retry ` + `this call. Reads are unrestricted, so investigate as much as you need ` + `before writing the list. ` + `Disable with tasks.requireBeforeChanges.enabled=false in settings.`
+    reason: `No task list exists, and ${input.toolName} changes the workspace. ` + `${requirementContext.trim()}${requirementContext ? " " : ""}` + `Call TaskCreate first with the steps you intend to take, then retry ` + `this call. Reads are unrestricted, so investigate as much as you need ` + `before writing the list. ` + `Disable with tasks.requireBeforeChanges.enabled=false in settings.`
   };
 }
 var TASK_LIST_GATE_DEFAULTS, KNOWN_MUTATING_TOOLS, GATE_EXEMPT_TOOLS, ALWAYS_REQUIRE_PLAN_TOOLS;
@@ -413098,7 +413164,7 @@ var init_taskListGate = __esm(() => {
   init_settings2();
   init_tasks();
   TASK_LIST_GATE_DEFAULTS = {
-    enabled: false,
+    enabled: true,
     freeReads: 3
   };
   KNOWN_MUTATING_TOOLS = new Set([
@@ -414638,12 +414704,16 @@ async function checkPermissionsAndCallTool(tool, toolUseID, input, toolUseContex
   } catch {
     isMutating = true;
   }
+  const taskListRun = getTaskListRunContext() ?? (toolUseContext.agentId ? undefined : getTaskListRunFromMessages(toolUseContext.messages ?? []));
   const gate = checkTaskListGate({
     toolName: tool.name,
     taskCount: await countTasksForGate(),
     readsSoFar: countToolCallsBeforeCurrent(toolUseContext.messages, assistantMessage, toolUseID),
     isSubagent: Boolean(toolUseContext.agentId),
-    isMutating
+    isMutating,
+    requiresTaskList: taskListRun?.requiresTaskList,
+    requirementReason: taskListRun?.requirementReason,
+    taskListWriterAvailable: toolUseContext.options.tools.some((candidate) => candidate.name === "TaskCreate")
   });
   if (gate.allowed === false) {
     recordCallFailure(callSig);
@@ -415000,7 +415070,10 @@ async function checkPermissionsAndCallTool(tool, toolUseID, input, toolUseContex
       taskCount: await countTasksForGate(),
       readsSoFar: countToolCallsBeforeCurrent(toolUseContext.messages, assistantMessage, toolUseID),
       isSubagent: Boolean(toolUseContext.agentId),
-      isMutating: finalIsMutating
+      isMutating: finalIsMutating,
+      requiresTaskList: taskListRun?.requiresTaskList,
+      requirementReason: taskListRun?.requirementReason,
+      taskListWriterAvailable: toolUseContext.options.tools.some((candidate) => candidate.name === "TaskCreate")
     });
     if (finalGate.allowed === false) {
       recordCallFailure(callSig);
@@ -415438,6 +415511,7 @@ var init_toolExecution = __esm(() => {
   init_genAiSemantics();
   init_toolErrors();
   init_toolResultStorage();
+  init_taskListRunContext();
   init_toolSearch();
   init_taskListGate();
   init_repeatedFailureGuard();
@@ -442817,7 +442891,7 @@ function Feedback({
       platform: env2.platform,
       gitRepo: envInfo.isGit,
       terminal: env2.terminal,
-      version: "1.80.2",
+      version: "1.80.3",
       transcript: normalizeMessagesForAPI(messages),
       errors: sanitizedErrors,
       lastApiRequest: getLastAPIRequest(),
@@ -443009,7 +443083,7 @@ function Feedback({
                       ", ",
                       env2.terminal,
                       ", v",
-                      "1.80.2"
+                      "1.80.3"
                     ]
                   }, undefined, true, undefined, this)
                 ]
@@ -443115,7 +443189,7 @@ ${sanitizedDescription}
 ` + `**Environment Info**
 ` + `- Platform: ${env2.platform}
 ` + `- Terminal: ${env2.terminal}
-` + `- Version: ${"1.80.2"}
+` + `- Version: ${"1.80.3"}
 ` + `- Feedback ID: ${feedbackId}
 ` + `
 **Errors**
@@ -446225,7 +446299,7 @@ function buildPrimarySection() {
   }, undefined, false, undefined, this);
   return [{
     label: "Version",
-    value: "1.80.2"
+    value: "1.80.3"
   }, {
     label: "Session name",
     value: nameValue
@@ -449607,7 +449681,7 @@ function Config({
         }
       }, undefined, false, undefined, this)
     }, undefined, false, undefined, this) : showSubmenu === "ChannelDowngrade" ? /* @__PURE__ */ jsx_dev_runtime179.jsxDEV(ChannelDowngradeDialog, {
-      currentVersion: "1.80.2",
+      currentVersion: "1.80.3",
       onChoice: (choice) => {
         setShowSubmenu(null);
         setTabsHidden(false);
@@ -449619,7 +449693,7 @@ function Config({
           autoUpdatesChannel: "stable"
         };
         if (choice === "stay") {
-          newSettings.minimumVersion = "1.80.2";
+          newSettings.minimumVersion = "1.80.3";
         }
         updateSettingsForSource("userSettings", newSettings);
         setSettingsData((prev_27) => ({
@@ -457877,7 +457951,7 @@ function HelpV2(t0) {
   let t6;
   if ($2[31] !== tabs) {
     t6 = /* @__PURE__ */ jsx_dev_runtime206.jsxDEV(Tabs, {
-      title: `UR v${"1.80.2"}`,
+      title: `UR v${"1.80.3"}`,
       color: "professionalBlue",
       defaultTab: "general",
       children: tabs
@@ -458810,7 +458884,7 @@ function buildToolUseContext(tools, readFileStateCache, toolPermissionContext, a
 async function handleInitialize(options2) {
   return {
     name: "UR",
-    version: "1.80.2",
+    version: "1.80.3",
     protocolVersion: "0.1.0",
     workspaceRoot: options2.cwd,
     capabilities: {
@@ -475918,7 +475992,7 @@ function getAllReleaseNotes(changelogContent = getStoredChangelogFromMemory()) {
     return [];
   }
 }
-async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.80.2") {
+async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.80.3") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -475945,7 +476019,7 @@ async function checkForReleaseNotes(lastSeenVersion, currentVersion = "1.80.2")
     releaseNotes
   };
 }
-function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.80.2") {
+function checkForReleaseNotesSync(lastSeenVersion, currentVersion = "1.80.3") {
   if (process.env.USER_TYPE === "ant") {
     const changelog = "";
     if (changelog) {
@@ -478850,7 +478924,7 @@ function getRecentActivitySync() {
   return cachedActivity;
 }
 function getLogoDisplayData() {
-  const version2 = process.env.DEMO_VERSION ?? "1.80.2";
+  const version2 = process.env.DEMO_VERSION ?? "1.80.3";
   const serverUrl = getDirectConnectServerUrl();
   const displayPath = process.env.DEMO_VERSION ? "/code/ur" : getDisplayPath(getCwd());
   const cwd2 = serverUrl ? `${displayPath} in ${serverUrl.replace(/^https?:\/\//, "")}` : displayPath;
@@ -479718,7 +479792,7 @@ function LogoV2() {
   if ($2[2] === Symbol.for("react.memo_cache_sentinel")) {
     t2 = () => {
       const currentConfig = getGlobalConfig();
-      if (currentConfig.lastReleaseNotesSeen === "1.80.2") {
+      if (currentConfig.lastReleaseNotesSeen === "1.80.3") {
         return;
       }
       saveGlobalConfig(_temp325);
@@ -480403,12 +480477,12 @@ function LogoV2() {
   return t41;
 }
 function _temp325(current) {
-  if (current.lastReleaseNotesSeen === "1.80.2") {
+  if (current.lastReleaseNotesSeen === "1.80.3") {
     return current;
   }
   return {
     ...current,
-    lastReleaseNotesSeen: "1.80.2"
+    lastReleaseNotesSeen: "1.80.3"
   };
 }
 function _temp241(s_0) {
@@ -496500,7 +496574,7 @@ function compileAgenticCiWorkflow(specName = "default", options2 = {}) {
   if (spec.name !== specName) {
     throw new Error("Agentic CI workflow spec name does not match");
   }
-  const packageVersion = options2.packageVersion ?? (typeof MACRO !== "undefined" ? "1.80.2" : "1.80.2");
+  const packageVersion = options2.packageVersion ?? (typeof MACRO !== "undefined" ? "1.80.3" : "1.80.3");
   if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(packageVersion)) {
     throw new Error("invalid ur-agent package version");
   }
@@ -497493,7 +497567,7 @@ runner; \`ur trigger\` is the inbound parser that decides what to run.
       path: ".github/workflows/ur.yml",
       root: "project",
       content: compileAgenticCiWorkflow("default", {
-        packageVersion: typeof MACRO !== "undefined" ? "1.80.2" : "1.80.2"
+        packageVersion: typeof MACRO !== "undefined" ? "1.80.3" : "1.80.3"
       })
     },
     {
@@ -497556,7 +497630,7 @@ function value(tokens, flag) {
   return index2 >= 0 ? tokens[index2 + 1] : undefined;
 }
 function cliVersion() {
-  return typeof MACRO !== "undefined" ? "1.80.2" : "1.80.2";
+  return typeof MACRO !== "undefined" ? "1.80.3" : "1.80.3";
 }
 function workflowPath(cwd2) {
   return join168(cwd2, ".github", "workflows", "ur-agentic-ci.yml");
@@ -503412,7 +503486,7 @@ function createAcpStdioApp(deps) {
       }
     },
     authMethods: [],
-    agentInfo: { name: "UR-Nexus", version: "1.80.2" }
+    agentInfo: { name: "UR-Nexus", version: "1.80.3" }
   })).onRequest("authenticate", () => ({})).onRequest("session/new", async (context6) => {
     const result = runtime2.newSession(context6.params.cwd, context6.params.mcpServers, context6.params.additionalDirectories);
     await runtime2.announce({
@@ -503509,7 +503583,7 @@ function createAcpStdioAgent(deps) {
               }
             },
             authMethods: [],
-            agentInfo: { name: "UR-Nexus", version: "1.80.2" }
+            agentInfo: { name: "UR-Nexus", version: "1.80.3" }
           });
           return;
         case "authenticate":
@@ -714735,7 +714809,7 @@ async function captureMemoryDiagnostics(trigger2, dumpNumber = 0) {
     smapsRollup,
     platform: process.platform,
     nodeVersion: process.version,
-    ccVersion: "1.80.2"
+    ccVersion: "1.80.3"
   };
 }
 async function performHeapDump(trigger2 = "manual", dumpNumber = 0) {
@@ -715324,7 +715398,7 @@ var init_bridge_kick = __esm(() => {
 var call154 = async () => {
   return {
     type: "text",
-    value: "1.80.2"
+    value: "1.80.3"
   };
 }, version2, version_default;
 var init_version = __esm(() => {
@@ -726567,7 +726641,7 @@ function generateHtmlReport(data, insights) {
 </html>`;
 }
 function buildExportData(data, insights, facets, remoteStats) {
-  const version3 = typeof MACRO !== "undefined" ? "1.80.2" : "unknown";
+  const version3 = typeof MACRO !== "undefined" ? "1.80.3" : "unknown";
   const remote_hosts_collected = remoteStats?.hosts.filter((h2) => h2.sessionCount > 0).map((h2) => h2.name);
   const facets_summary = {
     total: facets.size,
@@ -730880,7 +730954,7 @@ var init_sessionStorage = __esm(() => {
   init_settings2();
   init_slowOperations();
   init_uuid();
-  VERSION7 = typeof MACRO !== "undefined" ? "1.80.2" : "unknown";
+  VERSION7 = typeof MACRO !== "undefined" ? "1.80.3" : "unknown";
   MAX_TOMBSTONE_REWRITE_BYTES = 50 * 1024 * 1024;
   SKIP_FIRST_PROMPT_PATTERN = /^(?:\s*<[a-z][\w-]*[\s>]|\[Request interrupted by user[^\]]*\])/;
   EPHEMERAL_PROGRESS_TYPES = new Set([
@@ -732095,7 +732169,7 @@ var init_filesystem = __esm(() => {
   });
   getBundledSkillsRoot = memoize_default(function getBundledSkillsRoot2() {
     const nonce = randomBytes24(16).toString("hex");
-    return join243(getURTempDir(), "bundled-skills", "1.80.2", nonce);
+    return join243(getURTempDir(), "bundled-skills", "1.80.3", nonce);
   });
   getResolvedWorkingDirPaths = memoize_default(getPathsForPermissionCheck);
 });
@@ -737551,13 +737625,13 @@ function getTaskToolGuidance(enabledTools) {
   const canUpdate = enabledTools.has(TASK_UPDATE_TOOL_NAME);
   const canList = enabledTools.has(TASK_LIST_TOOL_NAME);
   if (canCreate && canUpdate) {
-    return `For a request with 3+ distinct steps, multiple independently verifiable outcomes, delegation, dependency ordering, or an explicit user request for a task list, you MUST use ${TASK_CREATE_TOOL_NAME} to maintain the visible task list. Do not create a task merely because a message is actionable: a direct one-step change, informational answer, acknowledgement, or small correction can proceed without a board. Decompose a large request into 2-8 bounded outcomes (never more than 12), each with one observable result, likely file scope, and acceptance evidence; never copy the raw user prompt as a task title. Create tasks first without guessed or forward dependency IDs. After each real ID is returned, use ${TASK_UPDATE_TOOL_NAME} to add dependencies only to tasks that already exist; never reference a future task, and never create a self-dependency. Keep the final graph dependency-ordered; independent branches stay dependency-free. If the user interrupts while tasks are pending or in progress, inspect the active list, preserve still-relevant work, update the affected task, add a task only for a genuinely distinct new outcome, and mark superseded work skipped rather than starting from an empty list. Mark each unblocked task in_progress when work starts and completed immediately after implementation and relevant verification succeed; use failed for attempted work that did not finish, skipped only for explicitly inapplicable work, and leave dependency-blocked work open with its blocker recorded.${canList ? ` Use ${TASK_LIST_TOOL_NAME} after every interruption and to select the next unblocked task; when all work succeeds, show the final list with every task completed before finishing.` : ""}`;
+    return `UR uses a strict-hybrid task policy. Before the first mutation, you MUST use ${TASK_CREATE_TOOL_NAME} for 2+ distinct requested outcomes, enumerated or sequenced work, multiple independently verifiable deliverables, plan-mode implementation, delegation or parallel agents, dependency ordering, project-sized builds/refactors, and release, publishing, deployment, migration, security, credential, permission, sandbox, production, or other high-risk work. An explicit user request for tasks always wins. Only a genuinely atomic, low-risk change with one outcome may proceed directly; informational answers, acknowledgements, and small corrections need no board. Read-only investigation is always allowed before planning. Decompose tracked work into 2-8 bounded outcomes (never more than 12), each with one observable result, likely file scope, and acceptance evidence; never copy the raw user prompt as a task title. Create tasks first without guessed or forward dependency IDs. After each real ID is returned, use ${TASK_UPDATE_TOOL_NAME} to add dependencies only to tasks that already exist; never reference a future task, and never create a self-dependency. Keep the final graph dependency-ordered; independent branches stay dependency-free. If the user interrupts while tasks are pending or in progress, inspect the active list, preserve still-relevant work, update the affected task, add a task only for a genuinely distinct new outcome, and mark superseded work skipped rather than starting from an empty list. Mark each unblocked task in_progress when work starts and completed immediately after implementation and relevant verification succeed; use failed for attempted work that did not finish, skipped only for explicitly inapplicable work, and leave dependency-blocked work open with its blocker recorded.${canList ? ` Use ${TASK_LIST_TOOL_NAME} after every interruption and to select the next unblocked task; when all work succeeds, show the final list with every task completed before finishing.` : ""}`;
   }
   if (canUpdate) {
     return `Keep assigned tasks current with ${TASK_UPDATE_TOOL_NAME}: mark the task in_progress when starting, completed only after implementation and relevant verification succeed, and leave blocked or partial work open with its blocker recorded.${canList ? ` Use ${TASK_LIST_TOOL_NAME} to select the next unblocked task.` : ""}`;
   }
   if (canCreate) {
-    return `Use ${TASK_CREATE_TOOL_NAME} for 3+ distinct steps, multiple independently verifiable outcomes, delegation, dependency ordering, or an explicit user request for a task list. A large request should have 2-8 bounded outcomes (never more than 12). Do not create a task merely because a message is actionable; skip a board for direct one-step work, informational answers, acknowledgements, and small corrections. Never copy the raw prompt as a task title. Create tasks without guessed or forward IDs; dependencies may name only tasks whose real IDs have already been returned. Preserve pending or in-progress work after an interruption, update affected work, and add only genuinely distinct new outcomes.`;
+    return `Use ${TASK_CREATE_TOOL_NAME} before mutation for 2+ distinct outcomes, sequenced work, project-sized changes, delegation, dependencies, releases/deployments/migrations, security-sensitive work, or an explicit task-list request. Only a genuinely atomic low-risk change may proceed directly. A tracked request should have 2-8 bounded outcomes (never more than 12). Never copy the raw prompt as a task title. Create tasks without guessed or forward IDs; dependencies may name only tasks whose real IDs have already been returned. Preserve pending or in-progress work after an interruption, update affected work, and add only genuinely distinct new outcomes.`;
   }
   if (enabledTools.has(TODO_WRITE_TOOL_NAME)) {
     return `Track multi-step work with ${TODO_WRITE_TOOL_NAME}. Keep items dependency-ordered and mark each item completed immediately after its implementation and relevant verification succeed.`;
@@ -738484,7 +738558,7 @@ function computeFingerprint(messageText2, version3) {
 }
 function computeFingerprintFromMessages(messages) {
   const firstMessageText = extractFirstMessageText(messages);
-  return computeFingerprint(firstMessageText, "1.80.2");
+  return computeFingerprint(firstMessageText, "1.80.3");
 }
 var FINGERPRINT_SALT = "59cf53e54c78";
 var init_fingerprint = () => {};
@@ -740409,7 +740483,7 @@ async function sideQuery(opts) {
     betas.push(STRUCTURED_OUTPUTS_BETA_HEADER);
   }
   const messageText2 = extractFirstUserMessageText(messages);
-  const fingerprint2 = computeFingerprint(messageText2, "1.80.2");
+  const fingerprint2 = computeFingerprint(messageText2, "1.80.3");
   const attributionHeader = getAttributionHeader(fingerprint2);
   const systemBlocks = [
     attributionHeader ? { type: "text", text: attributionHeader } : null,
@@ -745243,7 +745317,7 @@ function buildSystemInitMessage(inputs) {
     slash_commands: inputs.commands.filter((c4) => c4.userInvocable !== false).map((c4) => c4.name),
     apiKeySource: getURHQApiKeyWithSource().source,
     betas: getSdkBetas(),
-    ur_version: "1.80.2",
+    ur_version: "1.80.3",
     output_style: outputStyle,
     agents: inputs.agents.map((agent2) => agent2.agentType),
     skills: inputs.skills.filter((s) => s.userInvocable !== false).map((skill2) => skill2.name),
@@ -759079,7 +759153,7 @@ var init_useVoiceEnabled = __esm(() => {
 function getSemverPart(version3) {
   return `${import_semver13.major(version3, { loose: true })}.${import_semver13.minor(version3, { loose: true })}.${import_semver13.patch(version3, { loose: true })}`;
 }
-function useUpdateNotification(updatedVersion, initialVersion = "1.80.2") {
+function useUpdateNotification(updatedVersion, initialVersion = "1.80.3") {
   const [lastNotifiedSemver, setLastNotifiedSemver] = import_react225.useState(() => getSemverPart(initialVersion));
   if (!updatedVersion) {
     return null;
@@ -759128,7 +759202,7 @@ function AutoUpdater({
       return;
     }
     if (false) {}
-    const currentVersion = "1.80.2";
+    const currentVersion = "1.80.3";
     const channel = getInitialSettings()?.autoUpdatesChannel ?? "latest";
     let latestVersion = await getLatestVersion(channel);
     const isDisabled = isAutoUpdaterDisabled();
@@ -759357,12 +759431,12 @@ function NativeAutoUpdater({
     logEvent("tengu_native_auto_updater_start", {});
     try {
       const maxVersion = await getMaxVersion();
-      if (maxVersion && gt("1.80.2", maxVersion)) {
+      if (maxVersion && gt("1.80.3", maxVersion)) {
         const msg = await getMaxVersionMessage();
         setMaxVersionIssue(msg ?? "affects your version");
       }
       const result = await installLatest(channel);
-      const currentVersion = "1.80.2";
+      const currentVersion = "1.80.3";
       const latencyMs = Date.now() - startTime;
       if (result.lockFailed) {
         logEvent("tengu_native_auto_updater_lock_contention", {
@@ -759499,17 +759573,17 @@ function PackageManagerAutoUpdater(t0) {
       const maxVersion = await getMaxVersion();
       if (maxVersion && latest && gt(latest, maxVersion)) {
         logForDebugging(`PackageManagerAutoUpdater: maxVersion ${maxVersion} is set, capping update from ${latest} to ${maxVersion}`);
-        if (gte("1.80.2", maxVersion)) {
-          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.80.2"} is already at or above maxVersion ${maxVersion}, skipping update`);
+        if (gte("1.80.3", maxVersion)) {
+          logForDebugging(`PackageManagerAutoUpdater: current version ${"1.80.3"} is already at or above maxVersion ${maxVersion}, skipping update`);
           setUpdateAvailable(false);
           return;
         }
         latest = maxVersion;
       }
-      const hasUpdate = latest && !gte("1.80.2", latest) && !shouldSkipVersion(latest);
+      const hasUpdate = latest && !gte("1.80.3", latest) && !shouldSkipVersion(latest);
       setUpdateAvailable(!!hasUpdate);
       if (hasUpdate) {
-        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.80.2"} -> ${latest}`);
+        logForDebugging(`PackageManagerAutoUpdater: Update available ${"1.80.3"} -> ${latest}`);
       }
     };
     $2[0] = t1;
@@ -759543,7 +759617,7 @@ function PackageManagerAutoUpdater(t0) {
       wrap: "truncate",
       children: [
         "currentVersion: ",
-        "1.80.2"
+        "1.80.3"
       ]
     }, undefined, true, undefined, this);
     $2[3] = verbose;
@@ -770396,7 +770470,7 @@ function buildStatusLineCommandInput(permissionMode, exceeds200kTokens, settings
       project_dir: getOriginalCwd(),
       added_dirs: addedDirs
     },
-    version: "1.80.2",
+    version: "1.80.3",
     output_style: {
       name: outputStyleName
     },
@@ -770531,7 +770605,7 @@ function StatusLineInner({
   const attention = customStatusError ?? taskAttention;
   const terminalSize = React133.useContext(TerminalSizeContext);
   const defaultStatusLineText = buildDefaultStatusBar({
-    version: "1.80.2",
+    version: "1.80.3",
     providerLabel: providerRuntime.providerLabel,
     authMode: providerRuntime.authLabel,
     model: renderModelName(mainLoopModel) || providerRuntime.model || "",
@@ -782786,7 +782860,7 @@ async function submitTranscriptShare(messages, trigger2, appearanceId) {
     } catch {}
     const data = {
       trigger: trigger2,
-      version: "1.80.2",
+      version: "1.80.3",
       platform: process.platform,
       transcript,
       subagentTranscripts: Object.keys(subagentTranscripts).length > 0 ? subagentTranscripts : undefined,
@@ -795155,7 +795229,7 @@ function WelcomeV2() {
             dimColor: true,
             children: [
               "v",
-              "1.80.2"
+              "1.80.3"
             ]
           }, undefined, true, undefined, this)
         ]
@@ -796415,7 +796489,7 @@ function completeOnboarding() {
   saveGlobalConfig((current) => ({
     ...current,
     hasCompletedOnboarding: true,
-    lastOnboardingVersion: "1.80.2"
+    lastOnboardingVersion: "1.80.3"
   }));
 }
 function showDialog(root2, renderer) {
@@ -801561,7 +801635,7 @@ function appendToLog(path28, message) {
     cwd: getFsImplementation().cwd(),
     userType: process.env.USER_TYPE,
     sessionId: getSessionId(),
-    version: "1.80.2"
+    version: "1.80.3"
   };
   getLogWriter(path28).write(messageWithTimestamp);
 }
@@ -805725,8 +805799,8 @@ async function getEnvLessBridgeConfig() {
 }
 async function checkEnvLessBridgeMinVersion() {
   const cfg = await getEnvLessBridgeConfig();
-  if (cfg.min_version && lt("1.80.2", cfg.min_version)) {
-    return `Your version of UR (${"1.80.2"}) is too old for Remote Control.
+  if (cfg.min_version && lt("1.80.3", cfg.min_version)) {
+    return `Your version of UR (${"1.80.3"}) is too old for Remote Control.
 Version ${cfg.min_version} or higher is required. Run \`ur update\` to update.`;
   }
   return null;
@@ -806200,7 +806274,7 @@ async function initBridgeCore(params) {
   const rawApi = createBridgeApiClient({
     baseUrl,
     getAccessToken,
-    runnerVersion: "1.80.2",
+    runnerVersion: "1.80.3",
     onDebug: logForDebugging,
     onAuth401,
     getTrustedDeviceToken
@@ -815673,7 +815747,7 @@ function getAgUiCapabilities() {
       name: "UR-Nexus",
       type: "ur-nexus",
       description: "Provider-flexible, local-first autonomous engineering workflow agent.",
-      version: "1.80.2",
+      version: "1.80.3",
       provider: "UR",
       documentationUrl: "https://github.com/Maitham16/UR/blob/master/docs/AG_UI.md"
     },
@@ -816804,7 +816878,7 @@ function createMCPServer(cwd4, debug2, verbose) {
   };
   const server2 = new Server({
     name: "ur-nexus",
-    version: "1.80.2"
+    version: "1.80.3"
   }, {
     capabilities: {
       tools: {}
@@ -818008,7 +818082,7 @@ function thrownResponse(error40) {
 }
 async function createUrMcp2026Runtime(options5) {
   const server2 = createMCPServer(options5.cwd, options5.debug === true, options5.verbose === true);
-  const client2 = new Client({ name: "ur-mcp-2026-adapter", version: "1.80.2" }, { capabilities: {} });
+  const client2 = new Client({ name: "ur-mcp-2026-adapter", version: "1.80.3" }, { capabilities: {} });
   const [clientTransport, serverTransport] = createLinkedTransportPair();
   try {
     await server2.connect(serverTransport);
@@ -818019,7 +818093,7 @@ async function createUrMcp2026Runtime(options5) {
   }
   const runtime2 = new Mcp2026Runtime({
     cwd: options5.cwd,
-    version: "1.80.2",
+    version: "1.80.3",
     backend: {
       listTools: async () => {
         const listed = await client2.listTools();
@@ -820621,7 +820695,7 @@ async function update() {
   logEvent("tengu_update_check", {});
   const diagnostic2 = await getDoctorDiagnostic();
   const result = await checkUpgradeStatus({
-    currentVersion: "1.80.2",
+    currentVersion: "1.80.3",
     packageName: UR_AGENT_PACKAGE_NAME,
     installationType: diagnostic2.installationType,
     latestVersion: () => getLatestNpmPackageVersion(UR_AGENT_PACKAGE_NAME)
@@ -821949,7 +822023,7 @@ ${customInstructions}` : customInstructions;
       }
     }
     logForDiagnosticsNoPII("info", "started", {
-      version: "1.80.2",
+      version: "1.80.3",
       is_native_binary: isInBundledMode()
     });
     registerCleanup(async () => {
@@ -822736,7 +822810,7 @@ Usage: ur --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("1.80.2 (UR-Nexus)", "-v, --version", "Output the version number");
+  }).version("1.80.3 (UR-Nexus)", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {
@@ -823844,7 +823918,7 @@ if (false) {}
 async function main2() {
   const args = process.argv.slice(2);
   if (args.length === 1 && (args[0] === "--version" || args[0] === "-v" || args[0] === "-V")) {
-    console.log(`${"1.80.2"} (UR-Nexus)`);
+    console.log(`${"1.80.3"} (UR-Nexus)`);
     return;
   }
   if (args[0] === "a2a" && args[1] === "serve" && !args.includes("--help") && !args.includes("-h")) {

package/docs/AGENT_FEATURES.md

@@ -9,6 +9,12 @@ reproducible autonomous software engineering agent: every substantial task can
 be driven as `spec -> plan -> patch -> test -> report -> rollback`, with the
 spec as the durable source of truth and command evidence as the success gate.
 
+## v1.80.3 Addition
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Strict-hybrid task planning | Interactive `TaskCreate` lifecycle, `tasks.requireBeforeChanges` | Keeps atomic low-risk work direct, but requires a visible actionable task before mutation for multi-outcome, sequenced, planned, delegated, project-sized, and high-risk lifecycle work. Reads stay open, custom profiles without `TaskCreate` cannot deadlock, and operators retain advisory and fully strict modes. |
+
 ## v1.80.0 Additions
 
 | Addition | Surface | What it adds |

package/docs/CONFIGURATION.md

@@ -17,6 +17,31 @@ Start UR with `--screen-reader`, set `UR_SCREEN_READER=1`, or use
 edits, and reduced animation. `vimEscape` accepts 2–8 printable non-whitespace
 characters or `off`.
 
+## Interactive task planning
+
+UR uses strict-hybrid task tracking by default: one atomic, low-risk outcome
+can proceed directly, while multi-outcome, sequenced, planned, delegated,
+project-sized, release, migration, security, sandbox, and production work must
+create a visible task before the first mutation. Read-only investigation is
+never blocked.
+
+```jsonc
+{
+  "tasks": {
+    "requireBeforeChanges": {
+      "enabled": true,
+      "freeReads": 3
+    }
+  }
+}
+```
+
+`freeReads` is a compatibility allowance for non-interactive integrations that
+do not carry a classified user turn; it is not a limit on investigation. Set
+it to `0` to require a task before every mutation. Set `enabled` to `false` to
+return to advisory task tracking. Profiles that omit `TaskCreate` are not
+gated, because they could not satisfy the requirement.
+
 ## Model Providers
 
 UR-Nexus supports official provider access paths only:

package/docs/USAGE.md

@@ -428,6 +428,33 @@ in dependency order. `ur exec` materializes this graph deterministically; the
 interactive agent follows the same lifecycle and its task/agent tools enforce
 the concurrency boundary.
 
+Interactive work uses a strict-hybrid task policy by default. One atomic,
+low-risk outcome can be implemented directly. Before the first mutation, UR
+requires a visible task for requests with two or more outcomes, enumerated or
+sequenced work, plan mode, delegation, dependencies, project-sized work, and
+release, publishing, deployment, migration, security, credential, permission,
+sandbox, or production risk. Read-only inspection never needs a task, so the
+agent can understand the repository before it creates the board. A custom tool
+profile without `TaskCreate` remains usable and does not deadlock.
+
+The default can be tuned in `.ur/settings.json` or user settings:
+
+```json
+{
+  "tasks": {
+    "requireBeforeChanges": {
+      "enabled": true,
+      "freeReads": 3
+    }
+  }
+}
+```
+
+Set `enabled` to `false` for advisory task tracking. Set `freeReads` to `0` for
+the fully strict policy that requires a task before every mutation, including
+an atomic change. The positive atomic classification otherwise stays direct
+regardless of how many read-only tools were needed.
+
 A user prompt does not create a placeholder task. The task panel stays quiet
 for informational conversation, direct one-step changes, acknowledgements, and
 small corrections. For genuinely multi-step work, multiple independently

package/docs/VALIDATION.md

@@ -19,7 +19,7 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.80.2 (UR-Nexus)"
+# expected for this release: "1.80.3 (UR-Nexus)"
 ```
 
 ## 0.1 First-workspace model selection (1.45.4)

package/documentation/index.html

@@ -45,7 +45,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.80.2</p>
+          <p class="eyebrow">Version 1.80.3</p>
           <h1>UR-Nexus Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-Nexus.</p>
         </div>

package/extensions/jetbrains-ur/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 }
 
 group = "dev.urnexus"
-version = "1.80.2"
+version = "1.80.3"
 
 repositories {
     mavenCentral()

package/extensions/vscode-ur-inline-diffs/package.json

@@ -2,7 +2,7 @@
   "name": "ur-inline-diffs",
   "displayName": "UR Inline Diffs",
   "description": "Review, apply, and reject UR inline diff bundles from .ur/ide/diffs inside VS Code.",
-  "version": "1.80.2",
+  "version": "1.80.3",
   "publisher": "ur-nexus",
   "engines": {
     "vscode": "^1.92.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ur-agent",
-  "version": "1.80.2",
+  "version": "1.80.3",
   "description": "UR-Nexus — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",