# Unity CLI v1.0.0-beta.15 ### Added - `unity bug` can file an issue against a plugin: `--area` takes a plugin's name, such as `ugs` or `plastic`, and on a terminal the area question offers each plugin you have installed. A plugin area attaches that plugin's newest log files, redacted like the other logs, and every report now lists your installed plugins and their versions. - `unity doctor` names where each installed plugin writes its logs, under the external components, and as `logDirectories` in `--format json`. - `unity license server health` asks your floating license server how it is, directly on its `/v1/status` endpoint. It needs no sign-in and no licensing client. It prints the server's status and version, and exits `0` when the server is Healthy or Degraded, `4` when no server is configured, and `6` when it is unreachable or unhealthy. - Plugins now receive what `unity` knows when it runs them: the output format, whether they may prompt, the current Unity project and its Editor version, the active Unity Cloud organization and project, the signed-in user (never a token), whether a person, a CI system or an AI agent is running it, and the analytics and crash-report settings, as `UNITY_CLI_CTX_*` environment variables and one `UNITY_CLI_CTX_JSON` document. `UNITY_CLI_INVOKED_AS` and `UNITY_CLI_CORE_VERSION` now reach every plugin, not only built-in tools. - `unity projects audit` opens Project Auditor in your project's running Editor, ready for you to run the analysis. It first installs or updates Project Auditor and its rules package when the Editor needs them, then opens the window on the page for `--workflow` (`upgrade` by default, or `optimization`, `urp` or `coreclr`). Pass `--report` to open a saved report instead. It needs Unity 6 or later. - `unity setup qwen` installs Unity's agent plugin into Qwen Code by running `qwen extensions install Unity-Technologies/unity-agent-plugin:unity --consent`, then `qwen extensions enable unity`. Like `unity setup codex`, it reports an existing install instead of reinstalling (one Qwen Code has disabled for the current folder counts as not installed, and is turned back on), takes `--dry-run` and every output format, and fails with `QWEN_NOT_FOUND` when `qwen` isn't on your PATH. `unity setup all` now sets up Qwen Code too. Qwen Code sessions get the tip to run `unity setup qwen`, and analytics counts Qwen Code as its own agent. - `unity skill install opencode` installs the Unity skills into OpenCode, in `~/.config/opencode/skills`, or `.opencode/skills` with `--local`. OpenCode also loads `.claude/skills` and `.agents/skills`, so when one of those already holds a skill, it warns and skips it rather than loading two copies; pass `--yes` to install it anyway. - `unity install --download-only` downloads and verifies an Editor and its modules into the Hub's download folder without installing anything. With `--operating-system`, it can fetch another operating system's Editor, which `unity install` refused before. - `unity auth token` prints an access token from your CLI sign-in, alone on stdout, so a script or another tool can call Unity services without its own sign-in flow: `TOKEN=$(unity auth token)`. An expired token is refreshed first, a service account gets a token for its credentials, and `--json` adds the expiry. Signed out, it prints nothing and exits `3`. `--audience` and `--scope` are refused for now: Unity's token service can't narrow a token yet. - `unity mcp --cli-tools` adds read-only tools for status, installed editors, projects, releases and doctor to the MCP server, so a client with no shell, such as Claude Desktop, can call them with no Editor running. Each answers with the command's JSON output. - `unity mcp` lists four tools for detached Editor jobs next to the Editor's own, so an agent can run work that takes longer than a tool call may wait: `job_start` starts one of the Editor's tools as a job, the way `unity command --detach` does, `job_status` reads the job, `job_wait` waits up to `timeout` seconds (30 by default, at most 45) and says whether it is still running, and `job_cancel` asks the Editor to cancel it. `--exclude-tools "job_*"` hides them. - `install.sh` and `install.ps1` now set up the coding agents they find on your machine right after installing, then show your account, license and Unity Editors. In an interactive terminal they first list the agents found, all selected, so you can untick any to leave alone. Set `UNITY_CLI_SKIP_SETUP=1` to skip setup; it's also skipped when `CI` is set. - `unity skill install ` installs the `new-unity-project` skill beside `unity-cli`, so clients that read only skills can guide a new project from an idea to a running one. A client whose plugin already provides `unity-cli` keeps leaving `new-unity-project` to the plugin too when that plugin also ships it, unless you pass `--yes`. `--skill ` installs just `unity-cli` or `new-unity-project`, and `unity skill refresh` keeps both up to date. - `unity setup all` sets up every coding agent it finds, bare `unity setup` on a terminal lets you pick which ones from a checklist, and both finish with a state block showing your account, license, editors and connectivity, with the next command for anything blocking (machine formats carry each blocker as a `notifications` entry). - `unity projects create --install-editor` installs the Editor version when it isn't installed, waits for the install, then creates the project. `--module` and `--accept-eula` pass modules and their license agreements to that install. If the install fails, no project is created. - `unity projects create` adds Cinemachine to every new 3D project, at the newest release that supports the project's Unity version. 2D projects and templates that already include it are left as they are. `--bare` leaves it out. - `unity projects create` turns on Run In Background in the new project's Player settings, so Play mode keeps running while the Editor is not focused. `--bare` leaves it out. - `unity projects create` sets up anonymous player sign-in when it links the project to Unity Cloud. It adds the Authentication package and a startup script that signs the player in before the first scene loads, so cloud save, telemetry and other services have a player ID. `--bare` and `--no-cloud` leave it out. - `unity docs cache add` downloads a version's documentation as Markdown for offline use: the manual by default, and the scripting API reference too with `--api`. `unity docs --content` then reads cached pages without the network, and `unity docs toc` and topic lookup use the cached page list when docs.unity.com can't be reached. `unity docs cache` shows what is cached and `unity docs cache clear` deletes it. - `unity setup copilot` installs Unity's agent plugin, with its Unity skills, into GitHub Copilot CLI by running `copilot plugin marketplace add Unity-Technologies/unity-agent-plugin`, then `copilot plugin install unity@unity-agent-plugin`. Like `unity setup codex`, it reports an existing install instead of reinstalling, and takes `--dry-run`. When the Copilot CLI's agent runs `unity` without the plugin, the CLI's tip now points it to `unity setup copilot`. - `unity assets import --include ` imports only part of a package: the entries whose path matches, everything under a matching folder, and the folders above them. Repeat `--include` to select more, with a glob (`*` and `?` stay inside one folder, `**` spans folders) or a plain path such as `Assets/Art/Hero.png`. A pattern that matches nothing stops the import before the Editor starts, and `--format json`, `ndjson` and `tsv` list the entries that were selected. - The `--help` of every `unity collaboration` command now ends with examples you can copy. - The `--help` of every `unity vcs` and `unity pipeline` command now ends with examples you can copy. - The Linux deb and rpm packages now install a `unity` man page, so `man unity` lists every command, its options and the exit codes. Each release also publishes it next to its downloads as `unity.1.gz`. The AppImage carries the page too, but it is not on `MANPATH`. - `unity commands --json` now reports each command's `stability`: `stable`, `preview` or `deprecated`. A bare command group's `--json` answer carries it too. Every command is `stable` for now; when one becomes preview or deprecated, its `--help` and its row in its parent's help say so. - A project can pin the unity CLI versions it supports with `cli.version` in `ProjectSettings/UnityCliConfig.json`, an npm-style range such as `"^1.0.0"`. A command run in the project with a CLI outside that range prints a warning, and in CI it stops before doing anything, with exit code 1 and error code `CLI_VERSION_OUT_OF_RANGE`. `unity upgrade`, `unity doctor`, `unity config` and `unity version` always run, so you can update the CLI or change the pin. - `unity assets inspect` says whether a package is signed: `signed` in `--format json` and `ndjson`, and a `Signed:` line in the human output. It checks that a signature is present, not that it is valid. - `unity assets import` warns when a package has no signature and reports `signed` in `--format json` and `ndjson`. Pass `--require-signed` to refuse an unsigned package before the Editor starts. - `unity mcp configure` now finds entries left by the deprecated Unity MCP server from the AI Assistant package and offers to replace them, so the client keeps one Unity server. `--replace-legacy` replaces them without asking, `--dry-run` shows what would change, and `claude-code` prints the `claude mcp remove` command to run. - `unity install --set-default` makes the installed Editor the default once the install succeeds, so `unity install latest --set-default` replaces running `unity install latest` and then `unity editors default latest`. The json and ndjson result report the stored version as `data.defaultVersion`. Under `sudo` the flag is refused up front, since the setting would be written as root; run the install without `sudo`. - `unity doctor --ci --skip-license` skips the license check, for runners that get a license another way. - On macOS, each release now also publishes a notarized installer, `unity-darwin-arm64.pkg` and `unity-darwin-x64.pkg`, with the notarization ticket attached. It is the installer the Homebrew cask will use, and the cask moves to it in a follow-up. A first run after installing from it no longer asks Apple's servers, so it opens behind a VPN, a proxy that inspects HTTPS, or offline, instead of showing "Apple could not verify" with no Open button. - `unity plugin install` and `unity plugin upgrade` show a plugin's license terms and ask you to accept them before anything downloads, for a plugin that has terms. A run that cannot ask, such as one with `--non-interactive`, stops with an error that names `--accept-eula`. An accepted version is remembered, so an upgrade asks again only when the terms change. Both commands also take `--dry-run` to show the terms and what would change without downloading. - `unity setup claude`, `unity setup codex`, `unity setup grok` and `unity setup copilot` offer to install the Unity skills instead when the agent's CLI is missing or its plugin can't be installed. `--yes` installs them without asking. The json result names the skills folder and adds `installedVia` and `skillsToLoad`. - `unity skill install ` installs every Unity skill from the Unity-Technologies/skills repository, at the commit this CLI release pins, beside the `unity-cli` skill. Each skill is checked against the pin before anything is written, and the source can't be redirected. `--skill` can be repeated or given a comma list to install only some of them. Offline, the command installs the two skills built into the CLI, names the ones it couldn't install, and still succeeds. `--format json` records gain `source` and `commit`, and `unity skill install --list` shows the pinned commit. - `unity skill show --skill new-unity-project` prints the new-unity-project skill the CLI embeds, the same way `unity skill show` prints the unity-cli skill. `--path` and `--list` work with it too. - `unity pipeline cloud-build` and `unity pipeline automation` now start, follow and act on work: `builds start`, `cancel`, `steps`, `failures`, `artifacts`, `log --follow` and `download`, and `pipelines trigger`, `jobs watch`, `logs`, `terminate`, `resume`, `approve` and `reject`. `builds cancel`, `jobs terminate` and `jobs reject` ask first unless you pass `--yes`. A waited or watched build or job that ends unsuccessfully exits `15` (`16` when a job waits on a person), and Ctrl-C stops only the local wait, leaving the build or job running. ### Changed - `unity command` reaches the Editor through the Pipeline package's own connection when the Editor offers one, and over HTTP otherwise. An Editor whose Pipeline HTTP server is turned off now answers too. - `unity status` reports an Editor whose Pipeline HTTP server is turned off instead of showing it as unreachable, and `unity pipeline editors` shows each way to reach the Editor, with a `pipelineServer.endpoints` array in its JSON. - `unity pipeline upgrade` now moves a project to the Pipeline package's latest published version, so a new release is available as soon as it is published, without a CLI update. `unity pipeline install`, `unity pipeline list-versions`, `unity pipeline editors` and the Pipeline step of `unity projects create` resolve versions the same way. A version Unity withdraws for a known problem is skipped: `list-versions` leaves it out, `install` and `upgrade` take the newest version below it, `install --package-version` refuses it with the reason, and `upgrade` moves a project already on it to the newest usable version. When a newer version only needs a newer CLI, `upgrade` names it, says why, and points to `unity self-update`. - When `unity cloud org`, `unity cloud project` or `unity cloud status` fails, it now prints the usual error details (the error code, the log file, and how to get more detail) and records the failure in the log, so it shows up in `unity logs` and `unity bug`. JSON output and exit codes are unchanged. - When a `unity collab` command fails, it now prints the usual error details in `--format human` (the error code, the log file, and how to get more detail) and records the failure in the log, so it shows up in `unity logs` and `unity bug`. JSON output and exit codes are unchanged. - When `unity pipeline automation` or `unity pipeline cloud-build` fails, it now prints the usual error details (the error code, the log file, and how to get more detail) and records the failure in the log, so it shows up in `unity logs` and `unity bug`. JSON output and exit codes are unchanged. - `unity skill install` now recommends `unity setup all` to set up every agent client on the machine, in place of `npx skills add Unity-Technologies/skills`. - Without `--editor-version`, `unity projects create` uses the default Editor version, else the newest installed Editor, else the latest Unity release when no Editor is installed. `--editor-version latest` and `lts` now name the newest official and LTS releases rather than the newest installed Editor. A version with no installed Editor fails with `ENGINE_NOT_INSTALLED`, and under `--format json` or `ndjson` a run on an older Editor notes the newer release with an `ENGINE_UPDATE_AVAILABLE` notification. - `unity projects create` checks its prerequisites before it asks anything, downloads a template or starts the Editor: an active license always, and, while the project links to Unity Cloud, a signed-in account, a reachable network and a chosen organization when you belong to several (pass `--cloud-org` to choose). `--no-cloud` removes the Unity Cloud ones; `--bare` does not. Each unmet prerequisite is a `notifications` entry in the json output with its code and the command that fixes it. Two results change for scripts that read the old output: `--cloud` with no organization now fails with `ORGANIZATION_CHOICE_REQUIRED` where it returned `CLOUD_NEEDS_ACTIVE_ORG` (both exit 4), and an unattended create with several organizations and no default now exits 4 and creates nothing, where it created the project, reported the failed link as a warning and exited 0. - `unity auth login` now ends with a short summary of your machine: your account, organization, license, installed Editors and the next command to run. With `--format json` or `--format ndjson`, anything that blocks you from creating a project, such as no installed Editor or an unreachable network, is listed in the result's `notifications`. `--format ndjson` now ends every successful login, a service-account one with `--no-store` included, with a result line, as `--format json` does. A service-account login used to print its success sentence there. - More commands take the project as `--project-path`: `assets export`, `assets import` and `auth default` take it instead of `--project`, and `templates create`, `templates pack`, `projects link`, `projects unlink` and the `vcs` commands that act on a project accept it next to their path argument. These commands, and `recompile`, also read `UNITY_PROJECT_PATH` when no path is given. `close`, `projects unlink cloud`, `mcp configure` and `ci init` don't read it, so `projects unlink cloud` always needs its path. - `build run` takes the build to launch with `--build-path`, and `projects clone` takes the folder of the project to register with `--subpath`. - `pipeline install` and `pipeline upgrade` report a folder that isn't a Unity project with the same message as the other commands that connect to an Editor. - `unity templates`, `unity templates info`, `delete` and `edit` take the Editor version as `--editor-version`, like the rest of the CLI, and resolve `lts` and `latest` through the release catalog as `unity install` does. - `unity pipeline cloud-build targets`, `tooling os` and `tooling platforms` filter by Editor version with `--editor-version`. - `-e` means `--editor-path` on every command. `unity vcs merge-setup` and `unity vcs resolve` now accept it too. - `UNITY_EDITOR_VERSION` sets the Editor version on every command that takes `--editor-version`: `build`, `docs`, `install-modules`, `projects create`, `templates`, `vcs merge-setup` and `vcs resolve` now read it as well. The `pipeline cloud-build` filters don't. - An exported `UNITY_EDITOR_VERSION` or `UNITY_ARCHITECTURE` now steers `unity build`, as it already steered `run` and `test`: the flag wins, then the variable, then the project's version. `build` prints one line naming the variable when it does. - Passing a version to `--editor-path` fails with a hint to use `--editor-version`. - `releases` and `cloud projects` take `--offset ` to start a page part way through the results, the spelling every offset-paged list uses. The `releases` footer now says `Use --offset to see more`. - Every short flag now means one option on every command: `-f` is `--force`, `-i` is `--installed`, `-l` is `--list`, `-m` is `--module`, `-o` is `--output` and `-r` is `--releases`. Options that used those letters for something else show only their long name in help: `--follow`, `--input`, `--log-file`, `--modified`, `--reset` and `--output-path`. The old short spellings still work and warn that they are deprecated, so use the long names in scripts. - Every `--format ndjson` stream now ends with one `{"type":"result"}` frame. Single-record commands such as `unity env`, `unity doctor`, `unity context current`, `unity editors default`, `unity install-path` and `unity diagnose update` answer with that frame alone, its `data` the same as `--format json`, and listings such as `unity logs`, `unity skills`, `unity command` and `unity install-modules --list` write their rows and then the frame. - Every row in an ndjson listing now starts with `"type":"row"`, so a script can tell a row from a `progress` or `result` frame. `unity templates` rows keep their own `type` (the template type) and carry no `"row"` marker. - Under `--format tsv`, the default when stdout is redirected, single-record commands such as `unity env`, `unity doctor`, `unity config proxy`, `unity install-path` and `unity editors default` print a `keyvalue` table with one row per field, named as in `--format json`. A script that reads `unity install-path` from a pipe now gets that table, with the path on the `path` row; use `--format json` and read `data.path` instead. `unity cache key` still prints the bare key. - `unity logs --format tsv` and `unity skills --format tsv` now start with a header row, and `unity skills --format tsv` lists your installs instead of printing nothing. - The `command` field of `--format json` and `--format ndjson` output is now the full command path, such as `projects list` or `cloud org list`, the same in both formats and on success and failure. A script that matched on the old short names, such as `projects` or `proxy`, needs the full path instead. A run that matches no command, such as an unknown one, reports an empty `command`. - Every listing now returns its rows in one shape. In `--format json`, `data` holds the rows as `items`, with `total` (`null` when the service doesn't report one), `nextPage` or `nextCursor` for the next page (`null` on the last), and `partial` (`true` when the listing stopped before it finished). In `--format ndjson`, the rows stream one per line and the final `result` line carries `count` and the same paging fields. Listings that returned a bare array, such as `unity editors`, `unity projects`, `unity releases` and `unity templates`, now return this object, and `unity releases` reports the next `--offset` value as `nextPage` instead of a warning. Listings that already returned an object keep their old keys for now, such as `instances`, `entries` and `results`, which are deprecated: read `items` instead. - `unity doctor`, `unity env`, `unity diagnose proxy`, `unity diagnose accelerator` and `unity diagnose update` show their status as aligned label and value lines, in every language. The copy that `unity diagnose proxy` writes to the logs directory keeps its layout. - `unity pipeline editors` lists the open Unity Editors in a table, with any notes and the next step under it. When no Editor is open, it says so and suggests what to do. - With `--format tsv`, which is also the default when output is redirected, `unity cache info` prints one `key` and `value` line per field, named like its JSON fields, and `unity license status` prints the active licenses as a table with a header row, instead of sentences. - `unity cache info`, `unity auth status`, `unity license status`, `unity analytics status`, `unity config update-check`, `unity config proxy` and `unity language` show their status as aligned label and value lines, in every language. `unity license status` lists active licenses in a table, and `unity language` lists the available languages in one. - `unity projects` prints a table with a header in human output, also when its output is redirected with `--format human`. The columns that `--verbose`, `--editor-version`, `--modified`, `--cloud`, `--pipeline` and `--vcs` turn on are now table columns. When no project is registered, or none matches the pattern, it says so and suggests what to run next. - The anonymous once-per-run usage ping now stops when you turn analytics off (`unity analytics opt-out`, answering no at the first-run prompt, or turning it off in the Hub while signed in) and when `DO_NOT_TRACK` is set to any value but empty, `0` or `false`. `UNITY_NO_CLI_INVOKED_TELEMETRY` still stops it too. `unity analytics status` says whether the ping is on and, when it is off, why. - The install scripts now install the latest stable release and no longer fall back to the latest beta. To install a beta, set `UNITY_CLI_CHANNEL=beta` before running the installer. - `unity self-update` keeps the last 3 versions it replaced instead of only one, and `unity self-update --rollback ` restores a specific one. `--rollback` on its own still restores the most recent. On macOS and Linux, a rollback uses up the version it restores, so running it again goes one version further back. Set `UNITY_CLI_ROLLBACK_KEEP` (1 to 10) to keep more or fewer. - `unity projects create`, `unity projects link` and the `unity language` picker no longer ask questions under `--non-interactive`, with `UNITY_NON_INTERACTIVE` set, or in CI, even on a terminal. `unity projects create --vcs uvcs` without `--vcs-region` then fails with an error naming `--vcs-region` instead of showing the region picker. - On a terminal, `unity editors upgrade` with no Editor named asks again which installed Editor to upgrade, `unity editor module add` asks you to accept a module's license terms (as `unity install-modules` does), `unity open` and `unity projects open` ask which project or Editor to use when several match, and the `unity collab` delete commands ask you to confirm. In CI nothing asks, even on a terminal: `unity install-modules` and `unity editor module add` then need `--accept-eula`, and a collab delete needs `--non-interactive`. - `unity mcp` now lists a title and MCP behavior hints for every Unity tool, so an agent client can run reads such as `scene get_hierarchy` without asking and still ask before anything destructive. A tool that deletes or clears data, takes `confirm`, saves a capture to a path you pick, or runs your code (`script eval`, `script eval_file`, `script run`) is marked destructive. - Unity CLI now tells you once, on its first run, that it sends crash reports and an anonymous usage ping, how to turn each off, and where to read the privacy policy. Runs in CI, scripts and agents get the same notice as one line on stderr. The first-run analytics question now asks whether to turn usage analytics on, and `unity analytics opt-in` and `unity analytics opt-out` confirm that it was turned on or off. - Listing no longer needs a `list` word: `unity projects`, `unity templates`, `unity config`, `unity modules ` and `unity editors modules ` list on their own, with the same options and output, where they used to print their help. Bare `unity modules` and `unity editors module` now exit 2 with the missing `` error instead of printing help at exit 0. Groups named in the singular take a plural spelling for this: `unity plugins`, `unity skills`, `unity contexts`, `unity licenses` and `unity license servers`. Each group's `--help` now shows its listing's options too. - The same goes for `unity auth accounts` (the stored accounts), `unity pipeline editors` (the running Editors), `unity cloud orgs`, `unity cloud projects`, `unity docs cache`, `unity vcs uvcs reviews`, `unity collab annotations`, `unity collab attachments `, `unity collab jira issues`, and the `unity pipeline automation` and `unity pipeline cloud-build` listings, such as `unity pipeline automation jobs` and `unity pipeline cloud-build builds`. Bare `unity collab attachments` now exits 2 with the missing `` error. - `unity projects link cloud` now describes itself as linking or connecting a local project to Unity Cloud, so `unity commands --grep "connect project cloud"` and `unity command --query "connect project cloud"` find it first. - A search that finds nothing (`unity commands --grep` and `unity command --query`) now ends with a line saying that multi-step workflows are documented in the `unity-cli` skill, and that `unity skill show` reads it. `--format json` carries the line in `hint`, and the exit code stays 0. - `unity recompile --format json` and `--format ndjson` now write the top-level `errors` and `warnings` arrays every other command writes. Each error is `{code, message}` with the compiler code (such as `CS1002`), and each warning is a `file(line,col): message` string, so a script can read compile results the same way for every command. A failed run always has at least one error. The per-diagnostic details, with `file`, `line` and `column`, stay under `data.errors` and `data.warnings`, which are unchanged. - `unity projects create` no longer adds the Pipeline package on Unity 6000.5.0 to 6000.5.2, where it can't start, and tells you to update the Editor to 6000.5.3f1 or later. `unity status` on a project open in one of those Editors says the same instead of telling you to wait. - `unity plugin install` and `unity plugin upgrade` now install the agent skill a plugin ships into every AI client that already has the Unity skill, from `unity skill install` or the Unity agent plugin. Before, they only printed a hint to run `unity skill install`. Clients without the Unity skill are left alone. - `unity setup all` gives clients that take only skills the full set of Unity skills, not just `unity-cli`. ### Deprecated - `--project` on `assets export`, `assets import` and `auth default`, `--path` on `build run`, and `--project-path` on `projects clone` still work, and print a warning naming the new spelling. - `--editor` and `-e` on `unity templates`, `-e` on `unity install-modules`, and `--unity-version` on the `pipeline cloud-build` filters still work, and print a warning naming `--editor-version`. In `--format json` the warning is in the envelope's `warnings`. - `--skip` on `releases` and `cloud projects` still works, and prints a warning naming `--offset`. In `--format json` the warning is in the envelope's `warnings`. ### Removed - The `list` subcommand of these groups is gone. `unity projects list`, `unity editors list`, `unity cloud org list` and the rest now fail as an unknown command, exit 2, and suggest the bare group instead. `unity auth list` and `unity auth ls` suggest `unity auth accounts`, and its `--format json` and `ndjson` output reports `command` as `auth accounts list`. - **Breaking:** `unity projects new` is removed. Use `unity projects create --no-cloud`, which also never links to Unity Cloud. Pass `--path`, `--editor-version` and `--template` for a run that never prompts, and `--bare` to leave out the Pipeline package as `new` did. - **Breaking:** `unity list` is removed. Use `unity command`, which lists the tools the connected Editor offers. `unity list` now fails as an unknown command, exit 2, and suggests `unity command`. ### Fixed - `unity auth login` now stays signed in on a Linux container or headless machine that has no Secret Service and blocks the kernel keyring, such as a Docker container with the default seccomp profile. The CLI saves the sign-in to a protected file in your user data directory, readable only by your user, and tells you once when it does. `unity doctor` names this store and why it was chosen, and the keyring save error on Linux now points to `unity doctor`. - The Windows file properties, the Linux deb and rpm packages and the npm packages now name Unity Technologies as the copyright holder and carry the Unity Terms of Service license. - On a machine without Unity Hub, a `cloudConfig.json` left by an older Hub or CLI no longer leaves the Editor on built-in default service URLs (the `environment-mismatch` warning in the CLI log). The CLI now tags and refills a cache that has no environment tag, keeping any keys it does not know. A cache tagged by a Hub is still never touched. - `unity open` and the other Editor-launching commands now give the Editor the `seatinfourl`, `unauthenticatedurl`, `perf-events` and `socialdashboard` service entries, as Unity Hub does. The CLI used to refuse them as unsafe URLs even though Unity's own service config serves them that way. Other sites outside the Unity and Heyplay domains are still refused. - While the Editor service is running, the CLI now fetches Unity's service config again every 15 minutes, as Unity Hub does, so the `cloudConfig.json` it wrote on a machine without Hub no longer goes stale. A cache Unity Hub wrote is still never touched. - `unity cloud orgs`, `unity cloud org set-default` and `unity cloud projects` no longer fail with "Unity-token exchange failed (Request failed with status code 401)" for a signed-in user whose access token the server stopped accepting before it expired. The CLI now refreshes the session and tries once more, and only asks you to run `unity auth login` when that fails too. - `unity vcs conflicts` no longer lets color or hide codes inside a file path change how the human and tsv tables look. The codes are removed from the path. - `unity shell --protocol ndjson` answers a request line with a repeated key or an unpaired surrogate escape with a `BAD_REQUEST` frame and keeps reading, instead of ending the session with an error. - Commands no longer pause for up to two seconds on their way out when usage data is turned on and the network is slow or unreachable. Sending usage data now gives up after half a second, and `DO_NOT_TRACK` skips it entirely. - `unity skill install claude-code` and `unity skill install codex` now install the skills your installed plugins ship even when an agent plugin already provides the Unity CLI skill. Before, a non-interactive run, such as an agent's headless mode, skipped those skills without saying so. - `unity shell` on a terminal remembers your commands across sessions again: press Up to recall them. Secret option values and secrets in URLs are never saved. - `unity shell` on a terminal completes commands, options and values with Tab again (press Tab twice to list the choices), and suspends with Ctrl-Z on macOS and Linux. - `unity install` refuses a module whose install or rename paths point outside the Editor's install folder, and an Editor version that is not a single folder name. A catalog can no longer make an install write or delete elsewhere. - Catalog, manifest and API responses over 64 MB are refused instead of being read into memory, and the Android license page is scanned in one pass. - `unity build`, `unity run`, `unity test`, `unity assets export`, `unity assets import`, `unity templates create` and `unity templates pack` no longer refuse a project as already open because of a leftover `Library/EditorInstance.json` whose process ID now belongs to another program, which happened in containers after an Editor was killed. When the refusal comes from that file, the message names it so you can delete it if no Editor is running. - `unity build` and `unity batch build` no longer run programs named by a project's git configuration (`core.fsmonitor`, hooks, the pager, file filters other than Git LFS, and an ssh command reached by fetching objects a partial clone lacks) when they read its revision and version. They never fetch, and they check each submodule with the same safe read, so a submodule at an unrecorded commit or with uncommitted edits still counts as a change. These reads, and the CLI's other local git reads, also no longer receive provider tokens such as `GH_TOKEN`. - With usage analytics turned on, creating a project from a downloaded or custom template no longer reports the template's file path. It reports the template's package name, or `custom` when the template has none. - On Linux, `unity vcs` conflict and diff staging, UVCS check-ins, and `unity publish` now keep their temporary files readable only by you, and refuse a folder or link another account planted in the shared temp directory. - `unity install --download-directory` and `unity install-modules --download-directory` on Windows now use an absolute path such as `C:\ws\editor` or `C:/ws/editor` as given, instead of joining it onto the current folder. - `unity build --create-profile` reads `UNITY_ARCHITECTURE` when `--architecture` isn't given, and refuses an architecture it doesn't know with the same usage error as the flag, instead of starting the Editor. - `unity --version` honors a `--format` or `--json` typed after it, as `unity version` does: `unity --version --format ndjson` now prints one result frame instead of the bare version line. - `unity docs --package --content` prints the package's local Markdown, the same as `unity docs --content`, instead of trying to open a browser. - On a machine licensed by a floating license server, `unity license status` and `unity doctor --ci` no longer report that no license is available before the Editor has leased a seat. When the server answers as healthy, both succeed and say the Editor leases a seat when it starts. - `unity license server status` reports a floating license server as reachable when the server answers as healthy but the licensing client cannot read its seat usage, which happens when nobody is signed in. - A successful `unity build` no longer lists the Editor's "Access token is unavailable" licensing line as an error. - `unity command --query` with a listing option such as `--limit` and no connected Editor now ends `--format ndjson` output with its result frame, which carries the search hints. It used to print nothing. - `unity mcp` now lists every Editor tool under a name of its own: the full command name with each space and dot written as `_`, such as `settings_player_get` and `script_eval`. On `com.unity.pipeline` 0.9, several groups shared one name (`get`, `set`, `add`), so clients dropped tools, a call could fail with "names several commands", and some clients rejected the whole server. A call under the name a tool had before, such as `script eval`, still reaches it, and `--tools` and `--exclude-tools` match the new names too. - `unity close` now explains why it could not close an Editor when its output is redirected, for example that the project needs the `com.unity.pipeline` package or `--force`, instead of reporting only that the Editor was not closed. - A `cloud`, `collab`, `pipeline automation` or `pipeline cloud-build` command that fails because the server rejected your input (HTTP 400, 404, 409 or 422) no longer sends a crash report or points you at `unity bug`. The error message, the exit code and the json and ndjson output are unchanged. - A command that fails because you are signed out or your session expired no longer sends a crash report. The error message, the sign-in hint and the exit code are unchanged. - `unity projects` and `unity recompile` JSON and NDJSON output now escapes the C1 control characters (U+0080 to U+009F) like the other control characters, so a project path or compiler message cannot send an escape sequence to a terminal that honors them. Parsed values are unchanged. - `unity pipeline` no longer reports a Unity token exchange that returned an empty token, or got no answer, as being signed out. An empty token, or an answer it could not read, now offers the `unity bug` report like any other unexpected failure. - `unity plugins` no longer shows an out-of-date version for a plugin such as `ugs` when its saved copy of the plugin registry is more than a week old and this CLI already knows a newer version. The CLI's background refresh now also renews that saved copy once a week when no plugin is installed. - On Windows, `unity` now sends a crash report when it crashes, as it does on macOS and Linux. It was silent there before, so Windows crashes never reached us. The report is scrubbed the same way, and `UNITY_NO_CRASH_REPORT` turns it off. - `unity projects info` shows the active platform for projects saved by Unity 6000.7 betas and newer Editors. Before, the platform was missing for those projects. - On Windows, `unity` stays signed in after a restart when the Hub you first signed in with was 3.21 or older. - `unity build` now shows why a player build failed, such as an output path that already exists as a folder, instead of listing only licensing log lines. - On Linux, `unity status`, `unity editors running` and `unity pipeline editors` list an Editor that Unity Hub 3.21 or older started through its per-version launch link. - `unity projects export --format ndjson` prints one JSON line with `"type":"result"`, so an ndjson reader can parse the export. - `unity install-modules` with no Editor installed now points you to `unity install ` instead of a command that does not exist. - `unity releases --limit` and `--offset` now refuse a value that is not a whole number, such as `1.5` or `5abc`, with a usage error instead of reading it as 1 or 5. ### Security - Linking a project to Unity Version Control now sends the repository request only to the organization it names, even when the organization's name contains a slash, a question mark or dots. - The CLI no longer runs a program found through a relative `PATH` entry such as `node_modules/.bin`. Only absolute `PATH` entries are searched, so a cloned repository cannot put its own `unity`, `claude`, `zip` or `tar` ahead of the real one. - Skill installs and refreshes (global and `--local`) now refuse a skill folder that contains a symbolic link or junction as a subfolder, on every platform. Before, a repository could use one to make the install write or delete files outside the project. - `unity install --resume` no longer resumes a paused Editor download on Windows, or as root (for example under `sudo`), when the current Unity release data doesn't list that Editor or gives no checksum for it. Start a fresh install instead. - `unity install-modules`, `unity editor module add` and `unity install --resume` now check a module's download against the current Unity release data before installing it on Windows, and on every platform when the module runs its own installer command. A module that can't be checked, for example while offline, isn't installed. A resumed module download now always uses the Editor's own module list, and a paused download that list doesn't name stays paused. - `unity install --resume` now takes a paused Editor download's address from the current Unity release data when it lists that version, and on Windows doesn't resume one it can't check. - `unity install` and `unity install-modules` no longer reuse or resume a file already in the download folder for a download the release data gives no checksum for. They download it again from the start, so a file someone else placed there is never installed in its place. - `sudo unity install` and `sudo unity install-modules` on macOS and Linux now check and install a copy of each download kept in a folder only root can open, so another program running as you can no longer swap the file between the checksum check and the install. As root, archives no longer restore their own file owners or permissions, and `tar` and `unzip` come only from the system folders, never from your `PATH`. - `unity ci init` workflows now run `unity license activate` with the serial in the step environment, and mask it in the GitHub Actions log, so the serial no longer appears in the process list. The service-account secrets are set only on the steps that use them, not on the whole job. - `unity build` reads the Android keystore and key alias passwords from `UNITY_ANDROID_KEYSTORE_PASSWORD` and `UNITY_ANDROID_KEY_ALIAS_PASSWORD` when you pass no `--android-keystore-password` or `--android-key-alias-password`. The flags still work and take precedence. The Unity Editor itself still receives the passwords on its command line. - The Unity Editor that `unity build`, `unity test` and other batch commands start no longer inherits `UNITY_GITHUB_TOKEN` or `UNITY_GITLAB_TOKEN`. - Crash reports no longer include your account name, your project's name, or the folders of a file outside your home directory. A path outside your home keeps only its file name, and your home directory reads as `~` wherever it is. - `unity mcp` now cleans every text in the tool schemas it passes from the Unity Editor to your AI agent, not only the tool descriptions, and caps their size. It also refuses a call to a tool the Editor did not list, and stops reading an oversized tool catalog. - Unity Version Control workspace names made from a repository name now replace control characters and drop leading dashes, so a crafted repository name can no longer be read as a command option.