ur-agent 1.82.0 → 1.82.2

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 1.82.2
+
+- Saved custom base URLs independently for every provider, including Ollama,
+  llama.cpp, vLLM, LM Studio, and Unsloth. Switching through `/provider`,
+  `/model`, or CLI configuration now restores each provider's last endpoint,
+  with automatic migration from the legacy single-address setting.
+- Fixed Ollama graded reasoning discovery and transport. The model picker now
+  reads the focused model's `/api/show` capability before selection, Left/Right
+  cycles its real effort ladder, and requests send the chosen native `think`
+  value; Kimi K3 supports `low`, `high`, and `max`, while GPT-OSS safely caps at
+  `high`.
+- Audited direct OpenAI, Anthropic, Gemini, OpenRouter, llama.cpp, and generic
+  OpenAI-compatible provider effort handling. Live model discovery retains
+  documented model-specific ladders, Gemini serializes `thinkingLevel`, and
+  providers without authoritative graded metadata no longer receive invented
+  levels.
+
+## 1.82.1
+
+- Added a mandatory execution/trust kernel to every main, custom, and subagent
+  prompt; repository files, tool output, recalled memory, and MCP instructions
+  are now explicitly provenance-wrapped as untrusted evidence rather than
+  authority. A per-process canary, presentation-boundary redaction, and a final
+  post-hook input check prevent hidden-instruction and canary exfiltration.
+- Added provenance-aware authorization for suspicious evidence, regression-safe
+  prompt optimization, exact prompt/tool/context/model fingerprints, stronger
+  deterministic eval fixtures, hidden behavior checks, and least-privilege
+  generated agent specifications with explicit tools, permissions, turn limits,
+  and evaluation cases.
+- Added Unsloth as an authenticated, provider-only OpenAI-compatible runtime
+  with live model discovery, native streaming, and standard function calls.
+  UR never manages Unsloth and forces `enable_tools: false` so all execution
+  remains inside UR's permission, sandbox, provenance, and verifier boundary.
+
 ## 1.82.0
 
 - Restored the complete UR agent prompt, conversation history, tools, and

package/README.md

@@ -284,6 +284,7 @@ ur config set provider openai-api
 ur config set provider anthropic-api
 ur config set provider gemini-api
 ur config set provider openrouter
+ur config set provider unsloth
 ur config set model qwen2.5-coder:7b
 ur provider select-model ollama qwen2.5-coder:7b --json
 ur config set base_url http://localhost:11434
@@ -294,6 +295,12 @@ ur config set provider.fallback ollama
 guidance. UR never switches providers automatically: inspect the failure and
 select the recovery provider explicitly with `ur config set provider <id>`.
 
+`base_url` belongs to the provider that is active when it is set. UR remembers
+each provider's address independently, so switching among Ollama, LM Studio,
+llama.cpp, vLLM, Unsloth, or another compatible endpoint restores that
+provider's last URL automatically. Existing single-URL settings are migrated
+to the previously active provider on the first switch.
+
 OpenAI API traffic uses Chat Completions by default. The Responses transport is
 an explicit, provider-scoped opt-in with privacy-conscious defaults:
 
@@ -314,7 +321,7 @@ to the default with `ur config set openai_transport chat-completions`.
 
 Provider config accepts canonical IDs and common aliases. Examples:
 `openai-api`, `anthropic-api`, `gemini-api`, `openrouter`, `ollama`,
-`lmstudio`, `LM Studio`, `llama.cpp`, `vllm`, and the subscription CLIs
+`lmstudio`, `LM Studio`, `llama.cpp`, `vllm`, `unsloth` (`Unsloth Studio`), and the subscription CLIs
 `codex-cli` (`chatgpt`), `claude-code-cli` (`claude`), `gemini-cli` (`gemini`),
 and `antigravity-cli` (`agy`). Use quotes for shell values with spaces.
 
@@ -337,6 +344,7 @@ ur connect logout openai-api          # clear a stored key
 | LM Studio | local/server | UR-native | local OpenAI-compatible server |
 | llama.cpp | local/server | UR-native | local OpenAI-compatible server |
 | vLLM | local/server | UR-native | OpenAI-compatible server |
+| Unsloth | local/server | UR-native | authenticated user-run Unsloth Studio endpoint (`UNSLOTH_API_KEY`) |
 | Codex CLI | subscription | external app bridge | official Codex CLI login (`ur auth chatgpt`) |
 | Claude Code | subscription | external app bridge | official Claude Code login (`ur auth claude`) |
 | Gemini CLI | subscription | external app bridge | official Gemini Code Assist login (`ur auth gemini`) |
@@ -353,7 +361,7 @@ In the interactive app, `/model` is a two-step, provider-first picker:
 2. **Choose a model.** Only the selected provider's models are shown, labelled
    by source: `live` (discovered from the endpoint), `cache` (last discovery),
    or `static` (predefined). Local/server providers (Ollama, LM Studio,
-   llama.cpp, vLLM) and OpenAI-compatible endpoints are discovered live; API
+   llama.cpp, vLLM, Unsloth) and OpenAI-compatible endpoints are discovered live; API
    providers use live discovery from their `/models` endpoint once a key is
    connected (with a curated fallback list before that). Subscription CLIs show
    their curated model list because the official CLIs expose no models API. The
@@ -365,7 +373,9 @@ In the interactive app, `/model` is a two-step, provider-first picker:
    resolved visibly to that model's actual `max`, `xhigh`, or `high` ceiling,
    and the resolved value is the value sent to the provider. llama.cpp models
    are checked lazily through their model-scoped `/props` capability while the
-   cursor moves. OpenRouter additionally
+   cursor moves. Ollama models are checked through `/api/show`; Kimi K3 exposes
+   `low`, `high`, and `max`, and the chosen level is sent through Ollama's
+   native `think` field. OpenRouter additionally
    shows compact model names, FREE/PAID tier, context size, tool/reasoning
    support, and the full untruncated ID immediately below the focused entry.
    Its catalog is fetched fresh every time it opens and never falls back to a
@@ -394,7 +404,10 @@ identity line in the system prompt reflects it too:
   selected, Gemini `x-goog-api-key` on `:generateContent`, and OpenRouter on its
   OpenAI-compatible chat endpoint.
 - **Local/server** providers call the configured endpoint (`/v1/chat/completions`
-  for LM Studio/llama.cpp/vLLM; the native API for Ollama).
+  for LM Studio/llama.cpp/vLLM/Unsloth; the native API for Ollama). Unsloth is
+  provider-only: UR never starts, installs, updates, trains, or loads models in
+  Unsloth. UR sends `enable_tools: false` so only UR's permissioned native tools
+  can execute.
 - **Subscription CLIs** (Codex, Claude Code, Gemini, Antigravity) are external
   app bridges: selecting one dispatches the turn through the vendor's official
   CLI using your subscription. Log in with `ur auth <provider>`. UR-native

package/RELEASE.md

@@ -72,7 +72,8 @@ Version bump checklist (all versioned release surfaces must move together):
 5. `extensions/jetbrains-ur/build.gradle.kts` `version`
 6. The `MACRO.VERSION` fallbacks in `src/commands/agent-ci/agent-ci.ts`,
    `src/services/agents/agenticCi.ts`, and
-   `src/services/agents/featureScaffolds.ts`
+   `src/services/agents/featureScaffolds.ts`, and
+   `src/services/agents/trends.ts`
 7. Add a `CHANGELOG.md` entry, then run `bun run build` so `dist/cli.js`
    embeds the new version (`bun run release:check` verifies all of this).