ur-agent 1.80.2 → 1.80.4

package/docs/A2A.md

@@ -53,6 +53,14 @@ Inspect the live card:
 curl -s http://127.0.0.1:8765/.well-known/agent-card.json
 ```
 
+Preview either card without starting the server:
+
+```sh
+ur a2a card --v1                         # current A2A 1.0 card
+ur a2a card                              # legacy 0.3 compatibility card
+ur a2a card --v1 --base-url https://agent.example.com
+```
+
 Without a version header, discovery returns the v1 ProtoJSON card with
 `supportedInterfaces` for JSON-RPC, HTTP+JSON, and the legacy v0.3 binding. Use
 `A2A-Version: 0.3` to retrieve the standalone v0.3 SDK card. Both cards report

package/docs/AGENT_FEATURES.md

@@ -9,6 +9,21 @@ reproducible autonomous software engineering agent: every substantial task can
 be driven as `spec -> plan -> patch -> test -> report -> rollback`, with the
 spec as the durable source of truth and command evidence as the success gate.
 
+## v1.80.4 Additions
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Permanent-link circuit breaker | `WebFetch` | Stops repeat and alternating loops over dead 4xx URLs without disabling legitimate retries for transient network or server failures. URL identities are prompt-independent, hashed, bounded, and query-scoped. |
+| Plan/task recovery | `EnterPlanMode`, `TaskCreate` gate | Makes the distinction between an implementation plan and visible executable tasks explicit before workspace mutation. |
+| Safe CLI parity | `ur config set|get|list`, `ur a2a card --v1`, `ur session status` | Makes accessibility/editor configuration, current Agent Card preview, and conversation inspection available to scripts without weakening compatibility defaults. |
+| Complete command display hardening | Background shell details | Escapes deceptive control, invisible, and bidirectional characters before truncation. |
+
+## v1.80.3 Addition
+
+| Addition | Surface | What it adds |
+| --- | --- | --- |
+| Strict-hybrid task planning | Interactive `TaskCreate` lifecycle, `tasks.requireBeforeChanges` | Keeps atomic low-risk work direct, but requires a visible actionable task before mutation for multi-outcome, sequenced, planned, delegated, project-sized, and high-risk lifecycle work. Reads stay open, custom profiles without `TaskCreate` cannot deadlock, and operators retain advisory and fully strict modes. |
+
 ## v1.80.0 Additions
 
 | Addition | Surface | What it adds |

package/docs/AGENT_TRENDS.md

@@ -12,6 +12,7 @@ linked primary sources before acting on prerelease standards.
 ur agent-trends
 ur agent-trends --json
 ur a2a card
+ur a2a card --v1
 ur a2a card --base-url https://example.com
 ur ag-ui serve --help
 ur agent-features

package/docs/CONFIGURATION.md

@@ -17,6 +17,47 @@ Start UR with `--screen-reader`, set `UR_SCREEN_READER=1`, or use
 edits, and reduced animation. `vimEscape` accepts 2–8 printable non-whitespace
 characters or `off`.
 
+The same settings are available without starting the interactive interface,
+which is useful for CI setup and accessibility-first startup:
+
+```sh
+ur config set screenReader true
+ur config set reducedMotion true
+ur config set editor vim
+ur config set vimEscape jj
+ur config get screenReader
+ur config list --json
+```
+
+`ur config get` and `list` expose only the validated, non-secret settings that
+`ur config set` accepts. Screen-reader and reduced-motion values use the local
+workspace settings source; editor and Vim escape preferences are global.
+
+## Interactive task planning
+
+UR uses strict-hybrid task tracking by default: one atomic, low-risk outcome
+can proceed directly, while multi-outcome, sequenced, planned, delegated,
+project-sized, release, migration, security, sandbox, and production work must
+create a visible task before the first mutation. Read-only investigation is
+never blocked.
+
+```jsonc
+{
+  "tasks": {
+    "requireBeforeChanges": {
+      "enabled": true,
+      "freeReads": 3
+    }
+  }
+}
+```
+
+`freeReads` is a compatibility allowance for non-interactive integrations that
+do not carry a classified user turn; it is not a limit on investigation. Set
+it to `0` to require a task before every mutation. Set `enabled` to `false` to
+return to advisory task tracking. Profiles that omit `TaskCreate` are not
+gated, because they could not satisfy the requirement.
+
 ## Model Providers
 
 UR-Nexus supports official provider access paths only:

package/docs/GAP_ANALYSIS_2026-08-11.md

@@ -26,7 +26,7 @@ unchanged. UR does not add automated approval delegation.
 | Accessibility | Added `--screen-reader`, `screenReaderMode`, append-only plain-text rendering, edit announcements, and reduced animation. |
 | In-session configuration | Added `/config key=value`, including thinking, screen reader, reduced motion, verbose output, auto-compaction, editor mode, and Vim escape sequence. |
 | Directory automation | Added the `DirectoryAdded` hook and roots-change notification after `/add-dir`. |
-| Session lifecycle | Added `/session status|list|archive|unarchive` and `ur session list|archive|unarchive`. Archived sessions cannot appear in resume/fork discovery until restored. |
+| Session lifecycle | Added `/session status|list|archive|unarchive` and `ur session status|list|archive|unarchive`. Archived sessions cannot appear in resume/fork discovery until restored. |
 | Vim input | Added `vimEscape=<sequence>`; for example, `/config editor=vim vimEscape=jj`. |
 | Telemetry | Added privacy-safe `assistant_response` events, message/request/tool correlation, and workflow name/run identifiers. |
 | Command quality | Removed the no-op `/output-style` command and dormant `/ultraplan` registration, renamed `/debug-v2` to `/fix-bug`, removed duplicate 3D aliases, expanded protocol names in help, and added registry checks against public version jargon. |

package/docs/TROUBLESHOOTING.md

@@ -70,6 +70,27 @@ ur provider status
   Bash. A successful result confirms the harness; `/design3d doctor` alone
   validates the local slash command but does not exercise Bash execution.
 
+### Fetch repeatedly reports `404`
+
+- Likely cause: the page moved or the model generated a stale URL. A successful
+  fetch from another page proves the network path is working; retrying the same
+  missing URL cannot change its HTTP status.
+- Fix: upgrade to UR 1.80.4 or newer. WebFetch now records permanent 4xx
+  failures by normalized URL, independent of its hidden summarization prompt.
+  It refuses another network request for that URL and stops the turn if the
+  model keeps retrying. Alternating between two dead URLs is bounded as well.
+- Recovery: use WebSearch, fetch the site’s parent/index page, or choose a
+  different source. Timeouts, `408`, `409`, `425`, `429`, and `5xx` responses
+  remain retryable because they may be transient.
+
+### Plan mode says `TaskListRequired`
+
+- Likely cause: the agent entered or updated plan mode but did not create the
+  visible implementation tasks. A plan and a task list have separate roles.
+- Fix: call `TaskCreate` for the concrete outcomes before the first workspace
+  mutation. Do not disable `tasks.requireBeforeChanges` merely to bypass this
+  recovery message; the gate is preventing untracked implementation.
+
 ## Providers and models
 
 ### Provider selected but the model is unavailable

package/docs/USAGE.md

@@ -313,7 +313,8 @@ UR includes slash commands and CLI subcommands for common workflows:
   before installation.
 - `ur agents` to list configured agents
 - `ur agent-trends` to inspect coverage for current agent technology trends
-- `ur a2a card` to print UR's Agent Card metadata for A2A discovery
+- `ur a2a card` to print legacy Agent Card metadata, or
+  `ur a2a card --v1` to preview the current A2A 1.0 card
 - `ur bg ...` to run and idempotently steer detached local background agents
   with optional worktrees and PRs
 - `ur cloud ...` to run, synchronize, steer, and cancel local or managed
@@ -428,6 +429,33 @@ in dependency order. `ur exec` materializes this graph deterministically; the
 interactive agent follows the same lifecycle and its task/agent tools enforce
 the concurrency boundary.
 
+Interactive work uses a strict-hybrid task policy by default. One atomic,
+low-risk outcome can be implemented directly. Before the first mutation, UR
+requires a visible task for requests with two or more outcomes, enumerated or
+sequenced work, plan mode, delegation, dependencies, project-sized work, and
+release, publishing, deployment, migration, security, credential, permission,
+sandbox, or production risk. Read-only inspection never needs a task, so the
+agent can understand the repository before it creates the board. A custom tool
+profile without `TaskCreate` remains usable and does not deadlock.
+
+The default can be tuned in `.ur/settings.json` or user settings:
+
+```json
+{
+  "tasks": {
+    "requireBeforeChanges": {
+      "enabled": true,
+      "freeReads": 3
+    }
+  }
+}
+```
+
+Set `enabled` to `false` for advisory task tracking. Set `freeReads` to `0` for
+the fully strict policy that requires a task before every mutation, including
+an atomic change. The positive atomic classification otherwise stays direct
+regardless of how many read-only tools were needed.
+
 A user prompt does not create a placeholder task. The task panel stays quiet
 for informational conversation, direct one-step changes, acknowledgements, and
 small corrections. For genuinely multi-step work, multiple independently

package/docs/VALIDATION.md

@@ -19,7 +19,7 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.80.2 (UR-Nexus)"
+# expected for this release: "1.80.4 (UR-Nexus)"
 ```
 
 ## 0.1 First-workspace model selection (1.45.4)
@@ -316,6 +316,15 @@ Expected: after the 3rd identical Bash call, the agent receives a "stop
 repeating the same call" reminder and switches strategy (or asks for
 clarification).
 
+### 3.1 Permanent WebFetch loop stops
+
+Ask the agent to fetch one known-missing public URL repeatedly while changing
+the WebFetch prompt. Expected: the first request reports the permanent HTTP
+4xx response, the next is refused without network I/O, and another unchanged
+attempt stops the turn. Repeat with two missing URLs in alternating order; the
+same bounded behavior applies independently to both. A `429` or `5xx` fixture
+must remain retryable.
+
 ## 4. Project gate from `.ur/verify.json`
 
 Create one:

package/documentation/index.html

@@ -45,7 +45,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.80.2</p>
+          <p class="eyebrow">Version 1.80.4</p>
           <h1>UR-Nexus Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-Nexus.</p>
         </div>

package/extensions/jetbrains-ur/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 }
 
 group = "dev.urnexus"
-version = "1.80.2"
+version = "1.80.4"
 
 repositories {
     mavenCentral()

package/extensions/vscode-ur-inline-diffs/package.json

@@ -2,7 +2,7 @@
   "name": "ur-inline-diffs",
   "displayName": "UR Inline Diffs",
   "description": "Review, apply, and reject UR inline diff bundles from .ur/ide/diffs inside VS Code.",
-  "version": "1.80.2",
+  "version": "1.80.4",
   "publisher": "ur-nexus",
   "engines": {
     "vscode": "^1.92.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ur-agent",
-  "version": "1.80.2",
+  "version": "1.80.4",
   "description": "UR-Nexus — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",