chore: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@cycgraph/a2a@1.1.8

Patch Changes

• 791a1ca: An A2A delivery whose timeout or caller abort fires just as a request is issued no longer starts that request: the abort bound now takes the call as a thunk, so the aborted SDK call it used to abandon can no longer reject unhandled and crash the host process. The settle loop also re-checks the deadline after its backoff sleep instead of issuing one last doomed poll.

@cycgraph/orchestrator@1.4.1

Patch Changes

• b47bd71: A2A artifacts named __proto__, constructor, or prototype are no longer used as result keys, and the delegation boundary now resolves output mappings with own-property semantics. A remote agent can no longer smuggle values into workflow memory through the prototype chain, where they would land untainted.
• 9b24d23: The SSRF host guard now canonicalizes IPv6 literals (expanding ::, dropping zone ids, folding IPv4-mapped/translated/compatible and NAT64 forms) before range-checking, and fails closed on any IPv6 literal it cannot canonicalize. Non-canonical spellings of loopback such as [0:0:0:0:0:0:0:1] or [0:0:0:0:0:ffff:7f00:1] are no longer accepted as public hosts by MCP transport URLs, A2A agent card URLs, or web tool fetches.

@cycgraph/orchestrator-postgres@4.1.4

Patch Changes

• e14c00f: Persisted state snapshots now include node_breakdown, so a run resumed or forked from Postgres keeps its per-node spend instead of resetting it to {} — tail-cost estimates, budget enforcement on forks, and per-node spend reporting stay correct across a restart.

@cycgraph/tools@1.5.2

Patch Changes

• 7081052: The workspace jail now resolves paths through realpath (or the deepest existing ancestor, for new files) and refuses any path whose real target leaves the root. A symlink planted inside a workspace — such as a linked node_modules — can no longer be used by read_file, edit_file, or create_file to read or write outside the sandbox.
• f29ecf9: web_fetch and http_request now re-check allowedHosts on every redirect hop and drop operator defaultHeaders (plus authorization, cookie, and proxy-authorization) once a hop changes origin, so an allowed host can no longer 302 configured credentials to another host. Requests that redirect off the allowlist fail with HostNotAllowedError instead of being followed.