ur-agent 1.85.0 → 1.85.1

package/docs/CONFIGURATION.md

@@ -172,6 +172,22 @@ Anthropic's supported cache-control shape. Streaming requests also set
 arrive as Claude generates them instead of waiting for server-side buffering.
 Both behaviors use Anthropic's documented native fields and require no setting.
 
+An Anthropic identity-linked API key can act across more than one workspace and
+requires `anthropic-workspace-id` on every API call. Set its non-secret Console
+workspace ID once:
+
+```sh
+ur config set anthropic.workspace_id wrkspc_...
+# environment-only alternative
+export ANTHROPIC_WORKSPACE_ID=wrkspc_...
+```
+
+The selected ID is applied consistently to `/v1/models`, `/v1/messages`,
+streaming messages, `/v1/messages/count_tokens`, and provider diagnostics.
+Workspace-scoped keys need no extra setting. Clear the saved value with
+`ur config set anthropic.workspace_id auto`. When adding a key and workspace
+together, use `ur connect anthropic-api --workspace-id wrkspc_...`.
+
 Anthropic fast mode is a separate, premium research-preview tier. It is off by
 default and can be requested explicitly:
 
@@ -273,6 +289,7 @@ it in the environment when you explicitly choose API mode:
 OPENAI_API_KEY=...
 OPENAI_COMPATIBLE_API_KEY=...
 ANTHROPIC_API_KEY=...
+ANTHROPIC_WORKSPACE_ID=wrkspc_... # identity-linked Anthropic keys only
 GEMINI_API_KEY=...
 OPENROUTER_API_KEY=...
 NVIDIA_API_KEY=...
@@ -335,6 +352,11 @@ opaque compacted window, set `UR_OPENAI_RESPONSES_STATE_KEY` to exactly 32
 bytes encoded as 64 hexadecimal characters or base64. Without that key UR
 refuses to persist compacted context.
 
+HTTP 429 remains retryable for real transient rate limits. Machine-readable
+account, billing, and exhausted-quota failures such as `billing_not_active` and
+`insufficient_quota` are permanent for the unchanged request, so UR reports
+them immediately instead of spending the retry window in `requesting`.
+
 ### Reconfiguring the Ollama host
 
 The endpoint can be changed from UR in four ways, in order of precedence:

package/docs/TROUBLESHOOTING.md

@@ -211,6 +211,35 @@ from `OPENAI_API_KEY`. NVIDIA Agentic/Special use one key stored with
 `ur connect nvidia-nim` or `ur connect nvidia-special`; Agentic keeps any
 custom `base_url` scoped to that provider.
 
+### Anthropic says `anthropic-workspace-id is required`
+
+- Cause: the API key is identity-linked and can act across workspaces. Anthropic
+  requires the target workspace on model discovery and every runtime request.
+- Fix: copy the `wrkspc_...` ID from Claude Console → Settings → Workspaces,
+  then configure it and re-run doctor. The workspace ID is not the API key.
+
+```sh
+ur config set anthropic.workspace_id wrkspc_...
+ur provider doctor anthropic-api
+```
+
+`ANTHROPIC_WORKSPACE_ID` is the environment-only alternative. If the key was
+created inside one workspace and is already workspace-scoped, no header is
+needed. `auto` clears an incorrect saved selection. UR cannot safely infer the
+Default Workspace ID because Anthropic omits that workspace from its list API.
+
+### OpenAI stays on `requesting` and then reports a billing 429
+
+- Cause: older retry classification treated every HTTP 429 as a temporary rate
+  limit. OpenAI also uses 429 for permanent request-state failures such as
+  `billing_not_active` and `insufficient_quota`.
+- Current behavior: UR reads the machine error code, reports permanent account
+  or billing failures immediately, and still retries genuine transient rate
+  limits. The same rule applies to Chat Completions and Responses.
+- Fix for `billing_not_active`: activate API billing for the project/account or
+  connect a key belonging to an active billed project. Changing models or
+  transports cannot activate the account.
+
 ### NVIDIA lists a model but inference returns `Function … Not found for account`
 
 - Cause: the card is documented by NVIDIA, but its backing function is not

package/docs/USAGE.md

@@ -186,6 +186,7 @@ ur config set openrouter.preferred_min_throughput 40
 ur config set openrouter.preferred_max_latency 3
 ur config set openrouter.service_tier priority
 ur config set openrouter.speed fast
+ur config set anthropic.workspace_id wrkspc_...
 ```
 
 `auto` is the recommended default. `priority`/`fast` are optional paid upstream
@@ -195,6 +196,17 @@ throughput-, price-, or tool-quality-first virtual route.
 
 Direct Anthropic sessions preserve prompt-cache breakpoints and stream large
 tool arguments with Anthropic's per-tool `eager_input_streaming` control.
+If Anthropic identifies the key as identity-linked, select the Console
+workspace before refreshing models or sending a turn:
+
+```sh
+ur config set anthropic.workspace_id wrkspc_...
+# or: export ANTHROPIC_WORKSPACE_ID=wrkspc_...
+```
+
+The selection is shared by discovery, doctor, inference, streaming, and token
+counting. Workspace-scoped keys require no extra value; use
+`ur config set anthropic.workspace_id auto` to clear it.
 Accounts admitted to Anthropic's premium fast-mode research preview can opt in
 for its supported Opus models:
 
@@ -216,6 +228,9 @@ background/poll/cancel support, WebSocket continuation, server compaction, and
 deferred tool search. Remote storage is off by default. Local state contains
 only bounded identifiers/status/cursors unless a 32-byte
 `UR_OPENAI_RESPONSES_STATE_KEY` is supplied for AES-256-GCM compacted context.
+Permanent billing/account 429s are shown immediately on both OpenAI transports;
+UR retries only responses that can plausibly succeed without configuration or
+billing changes.
 
 In the interactive app, `/model` chooses a provider first and then a model from
 that provider only. The saved pair controls the runtime backend for the next
@@ -249,7 +264,9 @@ and `antigravity-cli` (`agy`) are subscription CLI providers.
 API modes are explicit. Keys are read from a key stored via
 `ur connect <provider>` (OS keychain) or from the environment variables
 `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`,
-`OPENROUTER_API_KEY`, `NVIDIA_API_KEY`, and `UNSLOTH_API_KEY`. Subscription CLIs are optional, never required
+`OPENROUTER_API_KEY`, `NVIDIA_API_KEY`, and `UNSLOTH_API_KEY`.
+`ANTHROPIC_WORKSPACE_ID` selects a workspace for identity-linked Anthropic
+keys. Subscription CLIs are optional, never required
 dependencies, and never used as a silent fallback. UR-Nexus never scrapes
 browser sessions, extracts OAuth tokens, or bypasses provider restrictions.
 OpenAI-compatible local or cloud endpoints use `base_url` plus `model`.

package/docs/VALIDATION.md

@@ -19,7 +19,7 @@ You need:
 
 ```sh
 ur --version
-# expected for this release: "1.85.0 (UR-Nexus)"
+# expected for this release: "1.85.1 (UR-Nexus)"
 ```
 
 ### 0.0 Redteam mode and Reverse Skills (1.81.0)
@@ -136,6 +136,18 @@ Opus 5/4.8 must receive `speed="fast"` and
 Opus versions must receive neither. A non-stream response must retain
 `usage.speed`.
 
+With an identity-linked test key, first omit the workspace. Discovery and
+doctor must preserve Anthropic's `anthropic-workspace-id is required` detail
+and show the `anthropic.workspace_id` fix. Then configure a `wrkspc_...` value
+and verify the same header on model pagination, streaming/non-streaming
+Messages, and token counting. A workspace-scoped key must remain valid with no
+workspace setting.
+
+For OpenAI retry classification, mock a 429 `billing_not_active` streaming body
+and verify exactly one transport call plus the provider's actionable message.
+A 429 `rate_limit_exceeded` fixture must remain retryable. The deterministic
+coverage is in `test/providerReliability.test.ts`.
+
 Deterministic coverage:
 
 ```sh

package/docs/providers.md

@@ -34,7 +34,7 @@ multimodal input, external CLI boundary, and sandbox scope:
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | Subscription | subscription | subscription-placeholder | no | no | no | n/a | n/a (no runtime) | `subscription:unconfigured` | independent subscription runtime only |
 | OpenAI API | API | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `api:openai` | `OPENAI_API_KEY` |
-| Claude API | API | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `api:anthropic` | `ANTHROPIC_API_KEY` |
+| Claude API | API | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `api:anthropic` | `ANTHROPIC_API_KEY`; identity-linked keys also select `ANTHROPIC_WORKSPACE_ID` |
 | Gemini API | API | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `api:gemini` | `GEMINI_API_KEY` |
 | OpenRouter | API/router | UR-native | no | yes | yes | yes | UR Bash/File sandbox | `api:openrouter` | `OPENROUTER_API_KEY` |
 | NVIDIA Agentic | hosted/server API | UR-native | no | yes | yes | model-dependent | UR Bash/File sandbox | `api:nvidia-nim` | `NVIDIA_API_KEY`; public per-card endpoints or configurable NIM gateway |
@@ -173,6 +173,8 @@ explicit opt-in to the native Responses adapter; it defaults to `store=false`
 and supports semantic streaming, background polling/cancellation, WebSocket
 continuation, server compaction, and deferred tool search. It does not change
 OpenAI-compatible, OpenRouter, local, or subscription-CLI providers.
+Both transports fail immediately for machine-readable permanent account or
+billing 429s; ordinary transient rate limits still honor provider retry timing.
 
 ## Provider-scoped model selection
 
@@ -281,7 +283,18 @@ remain authoritative. See OpenRouter's
 Direct Anthropic requests retain supported prompt-cache breakpoints and enable
 per-tool `eager_input_streaming` on streaming turns. This reduces repeated
 prefill work and avoids waiting for a complete large tool argument before its
-deltas arrive. Anthropic's premium fast tier remains explicit:
+deltas arrive.
+
+Identity-linked Anthropic keys additionally need a workspace selection. UR
+accepts `provider.anthropic.workspaceId` through
+`ur config set anthropic.workspace_id wrkspc_...` or
+`ANTHROPIC_WORKSPACE_ID`, validates the `wrkspc_` resource ID, partitions the
+model cache by workspace, and sends `anthropic-workspace-id` on model
+discovery, doctor, message, streaming, and token-count requests. A provider
+400 that names this requirement is preserved with the exact configuration fix
+instead of being reduced to an unverifiable model-list failure.
+
+Anthropic's premium fast tier remains explicit:
 
 ```sh
 ur config set anthropic.speed fast
@@ -291,6 +304,8 @@ UR sends `speed: "fast"` with the `fast-mode-2026-02-01` beta only for Claude
 Opus 5 and Opus 4.8, and retains `usage.speed` so accounting can distinguish the
 tier actually served. Enabled account access is still required. Unsupported
 models stay on standard speed. See Anthropic's
+[authentication](https://platform.claude.com/docs/en/manage-claude/authentication),
+[workspace management](https://platform.claude.com/docs/en/manage-claude/workspaces),
 [prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching),
 [fine-grained tool streaming](https://platform.claude.com/docs/en/agents-and-tools/tool-use/fine-grained-tool-streaming),
 and [fast mode](https://platform.claude.com/docs/en/build-with-claude/fast-mode).
@@ -480,7 +495,8 @@ provider's successful live catalog remains authoritative for that account.
 
 **API providers** require environment variable with API key:
 - `openai-api` — requires `OPENAI_API_KEY`
-- `anthropic-api` — requires `ANTHROPIC_API_KEY`
+- `anthropic-api` — requires `ANTHROPIC_API_KEY`; identity-linked keys also
+  select `ANTHROPIC_WORKSPACE_ID` (or saved `anthropic.workspace_id`)
 - `gemini-api` — requires `GEMINI_API_KEY`
 - `openrouter` — requires `OPENROUTER_API_KEY`
 - `nvidia-nim` / `nvidia-special` — share `NVIDIA_API_KEY`; Agentic's enterprise endpoint is configurable, while Special routes each public model to its card-specific contract
@@ -656,6 +672,7 @@ API providers require explicit user selection and environment keys:
 OPENAI_API_KEY=...
 OPENAI_COMPATIBLE_API_KEY=...
 ANTHROPIC_API_KEY=...
+ANTHROPIC_WORKSPACE_ID=wrkspc_... # identity-linked Anthropic keys only
 GEMINI_API_KEY=...
 OPENROUTER_API_KEY=...
 NVIDIA_API_KEY=...
@@ -803,7 +820,7 @@ Required variables:
 | NVIDIA Agentic | `NVIDIA_API_KEY`, `NVIDIA_MODEL` | `NVIDIA_BASE_URL` (defaults to `https://integrate.api.nvidia.com/v1`) |
 | OpenAI | `OPENAI_API_KEY`, `OPENAI_MODEL` | `OPENAI_BASE_URL` |
 | OpenRouter | `OPENROUTER_API_KEY`, `OPENROUTER_MODEL` | `OPENROUTER_BASE_URL` |
-| Anthropic | `ANTHROPIC_API_KEY`, `ANTHROPIC_MODEL` | `ANTHROPIC_BASE_URL` |
+| Anthropic | `ANTHROPIC_API_KEY`, `ANTHROPIC_MODEL` | `ANTHROPIC_BASE_URL`; `ANTHROPIC_WORKSPACE_ID` for identity-linked keys |
 | Gemini | `GEMINI_API_KEY`, `GEMINI_MODEL` | `GEMINI_BASE_URL` |
 | Ollama | `OLLAMA_MODEL` | `OLLAMA_BASE_URL` or `OLLAMA_HOST`; `OLLAMA_API_KEY` when required |
 | LM Studio | `LMSTUDIO_BASE_URL`, `LMSTUDIO_MODEL` | `LMSTUDIO_API_KEY` |

package/documentation/index.html

@@ -45,7 +45,7 @@
     <main id="content" class="content">
       <header class="topbar">
         <div>
-          <p class="eyebrow">Version 1.85.0</p>
+          <p class="eyebrow">Version 1.85.1</p>
           <h1>UR-Nexus Documentation</h1>
           <p class="lead">A practical, tutorial-style reference for installing, configuring, automating, extending, and operating UR-Nexus.</p>
         </div>

package/extensions/jetbrains-ur/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 }
 
 group = "dev.urnexus"
-version = "1.85.0"
+version = "1.85.1"
 
 repositories {
     mavenCentral()

package/extensions/vscode-ur-inline-diffs/package.json

@@ -2,7 +2,7 @@
   "name": "ur-inline-diffs",
   "displayName": "UR Inline Diffs",
   "description": "Review, apply, and reject UR inline diff bundles from .ur/ide/diffs inside VS Code.",
-  "version": "1.85.0",
+  "version": "1.85.1",
   "publisher": "ur-nexus",
   "engines": {
     "vscode": "^1.92.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ur-agent",
-  "version": "1.85.0",
+  "version": "1.85.1",
   "description": "UR-Nexus — autonomous engineering workflow engine (plan, execute, test, verify, document, benchmark, reproduce)",
   "type": "module",
   "packageManager": "bun@1.3.14",