wmcmahan · github-actions · Sep 20, 2026
diff --git a/.changeset/a2a-artifact-prototype-taint.md b/.changeset/a2a-artifact-prototype-taint.md
diff --git a/.changeset/a2a-pre-aborted-race-no-floating-call.md b/.changeset/a2a-pre-aborted-race-no-floating-call.md
diff --git a/.changeset/ipv6-literal-ssrf-canonicalization.md b/.changeset/ipv6-literal-ssrf-canonicalization.md
diff --git a/.changeset/jail-rejects-symlink-escapes.md b/.changeset/jail-rejects-symlink-escapes.md
diff --git a/.changeset/postgres-state-node-breakdown.md b/.changeset/postgres-state-node-breakdown.md
diff --git a/.changeset/web-tools-allowlist-per-redirect-hop.md b/.changeset/web-tools-allowlist-per-redirect-hop.md
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/a2a/CHANGELOG.md b/packages/a2a/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @cycgraph/a2a
 
+## 1.1.8
+
+### Patch Changes
+
+- 791a1ca: An A2A delivery whose timeout or caller abort fires just as a request is issued no longer starts that request: the abort bound now takes the call as a thunk, so the aborted SDK call it used to abandon can no longer reject unhandled and crash the host process. The settle loop also re-checks the deadline after its backoff sleep instead of issuing one last doomed poll.
+
 ## 1.1.7
 
 ### Patch Changes

diff --git a/packages/a2a/package.json b/packages/a2a/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cycgraph/a2a",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "description": "Official Agent2Agent (A2A) adapter for @cycgraph/orchestrator.",
   "type": "module",
   "main": "./dist/index.js",

diff --git a/packages/orchestrator-postgres/CHANGELOG.md b/packages/orchestrator-postgres/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @cycgraph/orchestrator-postgres
 
+## 4.1.4
+
+### Patch Changes
+
+- e14c00f: Persisted state snapshots now include `node_breakdown`, so a run resumed or forked from Postgres keeps its per-node spend instead of resetting it to `{}` — tail-cost estimates, budget enforcement on forks, and per-node spend reporting stay correct across a restart.
+
 ## 4.1.3
 
 ### Patch Changes

diff --git a/packages/orchestrator-postgres/package.json b/packages/orchestrator-postgres/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cycgraph/orchestrator-postgres",
-  "version": "4.1.3",
+  "version": "4.1.4",
   "description": "PostgreSQL persistence adapter for @cycgraph/orchestrator with Drizzle ORM, pgvector, and event sourcing.",
   "keywords": [
     "orchestrator",
@@ -68,7 +68,7 @@
     "dotenv": "^17.3.1"
   },
   "devDependencies": {
-    "@cycgraph/orchestrator": "^1.3.10",
+    "@cycgraph/orchestrator": "^1.4.1",
     "@cycgraph/memory": "^0.8.2",
     "@types/pg": "^8.18.0",
     "drizzle-kit": "^0.31.10",

diff --git a/packages/orchestrator/CHANGELOG.md b/packages/orchestrator/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cycgraph/orchestrator
 
+## 1.4.1
+
+### Patch Changes
+
+- b47bd71: A2A artifacts named `__proto__`, `constructor`, or `prototype` are no longer used as result keys, and the delegation boundary now resolves output mappings with own-property semantics. A remote agent can no longer smuggle values into workflow memory through the prototype chain, where they would land untainted.
+- 9b24d23: The SSRF host guard now canonicalizes IPv6 literals (expanding `::`, dropping zone ids, folding IPv4-mapped/translated/compatible and NAT64 forms) before range-checking, and fails closed on any IPv6 literal it cannot canonicalize. Non-canonical spellings of loopback such as `[0:0:0:0:0:0:0:1]` or `[0:0:0:0:0:ffff:7f00:1]` are no longer accepted as public hosts by MCP transport URLs, A2A agent card URLs, or web tool fetches.
+
 ## 1.4.0
 
 ### Minor Changes

diff --git a/packages/orchestrator/package.json b/packages/orchestrator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cycgraph/orchestrator",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Self-improving agent workflows: every run distills lessons into memory, and future runs retrieve them automatically. Cyclic graph engine with durable execution, per-node budgets, taint tracking, and human-in-the-loop gates.",
   "keywords": [
     "agents",

diff --git a/packages/tools/CHANGELOG.md b/packages/tools/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cycgraph/tools
 
+## 1.5.2
+
+### Patch Changes
+
+- 7081052: The workspace jail now resolves paths through `realpath` (or the deepest existing ancestor, for new files) and refuses any path whose real target leaves the root. A symlink planted inside a workspace — such as a linked `node_modules` — can no longer be used by `read_file`, `edit_file`, or `create_file` to read or write outside the sandbox.
+- f29ecf9: `web_fetch` and `http_request` now re-check `allowedHosts` on every redirect hop and drop operator `defaultHeaders` (plus `authorization`, `cookie`, and `proxy-authorization`) once a hop changes origin, so an allowed host can no longer 302 configured credentials to another host. Requests that redirect off the allowlist fail with `HostNotAllowedError` instead of being followed.
+
 ## 1.5.1
 
 ### Patch Changes

diff --git a/packages/tools/package.json b/packages/tools/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cycgraph/tools",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Curated, plug-in tools for @cycgraph/orchestrator: SSRF-guarded web access and pure data utilities, built on defineTool.",
   "keywords": [
     "cycgraph",
@@ -90,7 +90,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@cycgraph/orchestrator": "^1.4.0",
+    "@cycgraph/orchestrator": "^1.4.1",
     "@cycgraph/memory": "^0.8.0",
     "typescript": "7.0.2",
     "vitest": "^4.0.18"