diff --git a/.changeset/a2a-artifact-prototype-taint.md b/.changeset/a2a-artifact-prototype-taint.md deleted file mode 100644 index 74657844..00000000 --- a/.changeset/a2a-artifact-prototype-taint.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@cycgraph/orchestrator": patch ---- - -A2A artifacts named `__proto__`, `constructor`, or `prototype` are no longer used as result keys, and the delegation boundary now resolves output mappings with own-property semantics. A remote agent can no longer smuggle values into workflow memory through the prototype chain, where they would land untainted. diff --git a/.changeset/a2a-pre-aborted-race-no-floating-call.md b/.changeset/a2a-pre-aborted-race-no-floating-call.md deleted file mode 100644 index 73e03f47..00000000 --- a/.changeset/a2a-pre-aborted-race-no-floating-call.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@cycgraph/a2a": patch ---- - -An A2A delivery whose timeout or caller abort fires just as a request is issued no longer starts that request: the abort bound now takes the call as a thunk, so the aborted SDK call it used to abandon can no longer reject unhandled and crash the host process. The settle loop also re-checks the deadline after its backoff sleep instead of issuing one last doomed poll. diff --git a/.changeset/ipv6-literal-ssrf-canonicalization.md b/.changeset/ipv6-literal-ssrf-canonicalization.md deleted file mode 100644 index fa2bde1f..00000000 --- a/.changeset/ipv6-literal-ssrf-canonicalization.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@cycgraph/orchestrator": patch ---- - -The SSRF host guard now canonicalizes IPv6 literals (expanding `::`, dropping zone ids, folding IPv4-mapped/translated/compatible and NAT64 forms) before range-checking, and fails closed on any IPv6 literal it cannot canonicalize. Non-canonical spellings of loopback such as `[0:0:0:0:0:0:0:1]` or `[0:0:0:0:0:ffff:7f00:1]` are no longer accepted as public hosts by MCP transport URLs, A2A agent card URLs, or web tool fetches. diff --git a/.changeset/jail-rejects-symlink-escapes.md b/.changeset/jail-rejects-symlink-escapes.md deleted file mode 100644 index aeffb41f..00000000 --- a/.changeset/jail-rejects-symlink-escapes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@cycgraph/tools": patch ---- - -The workspace jail now resolves paths through `realpath` (or the deepest existing ancestor, for new files) and refuses any path whose real target leaves the root. A symlink planted inside a workspace — such as a linked `node_modules` — can no longer be used by `read_file`, `edit_file`, or `create_file` to read or write outside the sandbox. diff --git a/.changeset/postgres-state-node-breakdown.md b/.changeset/postgres-state-node-breakdown.md deleted file mode 100644 index 999130d0..00000000 --- a/.changeset/postgres-state-node-breakdown.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@cycgraph/orchestrator-postgres": patch ---- - -Persisted state snapshots now include `node_breakdown`, so a run resumed or forked from Postgres keeps its per-node spend instead of resetting it to `{}` — tail-cost estimates, budget enforcement on forks, and per-node spend reporting stay correct across a restart. diff --git a/.changeset/web-tools-allowlist-per-redirect-hop.md b/.changeset/web-tools-allowlist-per-redirect-hop.md deleted file mode 100644 index f7028da4..00000000 --- a/.changeset/web-tools-allowlist-per-redirect-hop.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@cycgraph/tools": patch ---- - -`web_fetch` and `http_request` now re-check `allowedHosts` on every redirect hop and drop operator `defaultHeaders` (plus `authorization`, `cookie`, and `proxy-authorization`) once a hop changes origin, so an allowed host can no longer 302 configured credentials to another host. Requests that redirect off the allowlist fail with `HostNotAllowedError` instead of being followed. diff --git a/package-lock.json b/package-lock.json index a5463ed3..0a2847fa 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14594,7 +14594,7 @@ }, "packages/a2a": { "name": "@cycgraph/a2a", - "version": "1.1.7", + "version": "1.1.8", "license": "Apache-2.0", "dependencies": { "@a2a-js/sdk": "^1.0.1" @@ -14936,7 +14936,7 @@ }, "packages/orchestrator": { "name": "@cycgraph/orchestrator", - "version": "1.4.0", + "version": "1.4.1", "license": "Apache-2.0", "dependencies": { "@ai-sdk/anthropic": "^4.0.36", @@ -14998,7 +14998,7 @@ }, "packages/orchestrator-postgres": { "name": "@cycgraph/orchestrator-postgres", - "version": "4.1.3", + "version": "4.1.4", "license": "Apache-2.0", "dependencies": { "dotenv": "^17.3.1", @@ -15007,7 +15007,7 @@ }, "devDependencies": { "@cycgraph/memory": "^0.8.2", - "@cycgraph/orchestrator": "^1.3.10", + "@cycgraph/orchestrator": "^1.4.1", "@types/pg": "^8.18.0", "drizzle-kit": "^0.31.10", "drizzle-orm": "^0.45.1", @@ -15364,7 +15364,7 @@ }, "packages/tools": { "name": "@cycgraph/tools", - "version": "1.5.1", + "version": "1.5.2", "license": "Apache-2.0", "dependencies": { "htmlparser2": "^10.0.0", @@ -15373,7 +15373,7 @@ }, "devDependencies": { "@cycgraph/memory": "^0.8.0", - "@cycgraph/orchestrator": "^1.4.0", + "@cycgraph/orchestrator": "^1.4.1", "typescript": "7.0.2", "vitest": "^4.0.18" }, diff --git a/packages/a2a/CHANGELOG.md b/packages/a2a/CHANGELOG.md index 0e70a1a2..3524a84f 100644 --- a/packages/a2a/CHANGELOG.md +++ b/packages/a2a/CHANGELOG.md @@ -1,5 +1,11 @@ # @cycgraph/a2a +## 1.1.8 + +### Patch Changes + +- 791a1ca: An A2A delivery whose timeout or caller abort fires just as a request is issued no longer starts that request: the abort bound now takes the call as a thunk, so the aborted SDK call it used to abandon can no longer reject unhandled and crash the host process. The settle loop also re-checks the deadline after its backoff sleep instead of issuing one last doomed poll. + ## 1.1.7 ### Patch Changes diff --git a/packages/a2a/package.json b/packages/a2a/package.json index 7868e262..194be55d 100644 --- a/packages/a2a/package.json +++ b/packages/a2a/package.json @@ -1,6 +1,6 @@ { "name": "@cycgraph/a2a", - "version": "1.1.7", + "version": "1.1.8", "description": "Official Agent2Agent (A2A) adapter for @cycgraph/orchestrator.", "type": "module", "main": "./dist/index.js", diff --git a/packages/orchestrator-postgres/CHANGELOG.md b/packages/orchestrator-postgres/CHANGELOG.md index 1d15574d..73561ed3 100644 --- a/packages/orchestrator-postgres/CHANGELOG.md +++ b/packages/orchestrator-postgres/CHANGELOG.md @@ -1,5 +1,11 @@ # @cycgraph/orchestrator-postgres +## 4.1.4 + +### Patch Changes + +- e14c00f: Persisted state snapshots now include `node_breakdown`, so a run resumed or forked from Postgres keeps its per-node spend instead of resetting it to `{}` — tail-cost estimates, budget enforcement on forks, and per-node spend reporting stay correct across a restart. + ## 4.1.3 ### Patch Changes diff --git a/packages/orchestrator-postgres/package.json b/packages/orchestrator-postgres/package.json index 75a1b8fc..3266be96 100644 --- a/packages/orchestrator-postgres/package.json +++ b/packages/orchestrator-postgres/package.json @@ -1,6 +1,6 @@ { "name": "@cycgraph/orchestrator-postgres", - "version": "4.1.3", + "version": "4.1.4", "description": "PostgreSQL persistence adapter for @cycgraph/orchestrator with Drizzle ORM, pgvector, and event sourcing.", "keywords": [ "orchestrator", @@ -68,7 +68,7 @@ "dotenv": "^17.3.1" }, "devDependencies": { - "@cycgraph/orchestrator": "^1.3.10", + "@cycgraph/orchestrator": "^1.4.1", "@cycgraph/memory": "^0.8.2", "@types/pg": "^8.18.0", "drizzle-kit": "^0.31.10", diff --git a/packages/orchestrator/CHANGELOG.md b/packages/orchestrator/CHANGELOG.md index f20822e2..84f7d50e 100644 --- a/packages/orchestrator/CHANGELOG.md +++ b/packages/orchestrator/CHANGELOG.md @@ -1,5 +1,12 @@ # @cycgraph/orchestrator +## 1.4.1 + +### Patch Changes + +- b47bd71: A2A artifacts named `__proto__`, `constructor`, or `prototype` are no longer used as result keys, and the delegation boundary now resolves output mappings with own-property semantics. A remote agent can no longer smuggle values into workflow memory through the prototype chain, where they would land untainted. +- 9b24d23: The SSRF host guard now canonicalizes IPv6 literals (expanding `::`, dropping zone ids, folding IPv4-mapped/translated/compatible and NAT64 forms) before range-checking, and fails closed on any IPv6 literal it cannot canonicalize. Non-canonical spellings of loopback such as `[0:0:0:0:0:0:0:1]` or `[0:0:0:0:0:ffff:7f00:1]` are no longer accepted as public hosts by MCP transport URLs, A2A agent card URLs, or web tool fetches. + ## 1.4.0 ### Minor Changes diff --git a/packages/orchestrator/package.json b/packages/orchestrator/package.json index 51fa269d..6a25d21f 100644 --- a/packages/orchestrator/package.json +++ b/packages/orchestrator/package.json @@ -1,6 +1,6 @@ { "name": "@cycgraph/orchestrator", - "version": "1.4.0", + "version": "1.4.1", "description": "Self-improving agent workflows: every run distills lessons into memory, and future runs retrieve them automatically. Cyclic graph engine with durable execution, per-node budgets, taint tracking, and human-in-the-loop gates.", "keywords": [ "agents", diff --git a/packages/tools/CHANGELOG.md b/packages/tools/CHANGELOG.md index 7ac6c032..1e661bcd 100644 --- a/packages/tools/CHANGELOG.md +++ b/packages/tools/CHANGELOG.md @@ -1,5 +1,12 @@ # @cycgraph/tools +## 1.5.2 + +### Patch Changes + +- 7081052: The workspace jail now resolves paths through `realpath` (or the deepest existing ancestor, for new files) and refuses any path whose real target leaves the root. A symlink planted inside a workspace — such as a linked `node_modules` — can no longer be used by `read_file`, `edit_file`, or `create_file` to read or write outside the sandbox. +- f29ecf9: `web_fetch` and `http_request` now re-check `allowedHosts` on every redirect hop and drop operator `defaultHeaders` (plus `authorization`, `cookie`, and `proxy-authorization`) once a hop changes origin, so an allowed host can no longer 302 configured credentials to another host. Requests that redirect off the allowlist fail with `HostNotAllowedError` instead of being followed. + ## 1.5.1 ### Patch Changes diff --git a/packages/tools/package.json b/packages/tools/package.json index b4850cd5..6a355c7f 100644 --- a/packages/tools/package.json +++ b/packages/tools/package.json @@ -1,6 +1,6 @@ { "name": "@cycgraph/tools", - "version": "1.5.1", + "version": "1.5.2", "description": "Curated, plug-in tools for @cycgraph/orchestrator: SSRF-guarded web access and pure data utilities, built on defineTool.", "keywords": [ "cycgraph", @@ -90,7 +90,7 @@ "zod": "^4.3.6" }, "devDependencies": { - "@cycgraph/orchestrator": "^1.4.0", + "@cycgraph/orchestrator": "^1.4.1", "@cycgraph/memory": "^0.8.0", "typescript": "7.0.2", "vitest": "^4.0.18"