v0.14.3

What's Changed

• fix(llm): store token usage in chat_typed for eval_budget_tokens enforcement by @bug-ops in #1450
• fix(channels): make CliChannel::recv() cancel-safe via background stdin reader by @bug-ops in #1452
• feat(orchestration): wire DagScheduler into /plan confirm flow by @bug-ops in #1458
• fix(subagent): only block fenced-block calls with matching tool tags by @bug-ops in #1464
• fix(bootstrap): wire graph_config into agent construction by @bug-ops in #1465
• fix(skills): record tool call outcomes in native tool path by @bug-ops in #1462
• fix(memory): repair cross-session history restore producing orphaned tool_use blocks (#1383) by @bug-ops in #1466
• fix(mcp): allow localhost connections for statically configured HTTP servers by @bug-ops in #1469
• fix(a2a): add protocolVersion field to agent card by @bug-ops in #1470
• fix(anomaly): classify [stderr] output as AnomalyOutcome::Error by @bug-ops in #1474
• fix(orchestration): drain secret requests after tick loop exits on instant completion by @bug-ops in #1475
• fix(metrics): use API-reported output_tokens instead of byte-length estimate by @bug-ops in #1478
• fix(core): deduplicate denied secret prompts in orchestration loop by @bug-ops in #1476
• fix(skills): record usage only for embedding-matched skills by @bug-ops in #1479
• fix(security): truncate SecretRequest.reason in confirmation prompt by @bug-ops in #1482
• fix(tools): add word-boundary check in extract_fenced_blocks by @bug-ops in #1486
• fix(orchestration): use main agent inline when no sub-agents configured (#1463) by @bug-ops in #1489
• fix(feedback): classify /feedback sentiment for correct outcome type by @bug-ops in #1487
• fix(subagent): pass tool definitions to LLM API in sub-agent loop by @bug-ops in #1492
• fix(memory): deduplicate active graph edges on re-extraction by @bug-ops in #1495
• fix(graph): prioritize exact name match in /graph facts query by @bug-ops in #1493
• fix(llm): delegate context_window() in SubProvider (#1473) by @bug-ops in #1498
• fix(security): truncate secret_key in confirmation prompt by @bug-ops in #1499
• fix(orchestrator): delegate last_usage() and last_cache_usage() to last-used provider by @bug-ops in #1500
• fix(shell): detect blocked commands in backtick and process substitution by @bug-ops in #1502
• fix(tools): wire AuditLogger to WebScrapeExecutor for fetch/scrape audit trail by @bug-ops in #1504
• fix(security): wire sanitize_tool_output() into native tool_use path by @bug-ops in #1505
• fix(security): guard_memory_writes now fires for text-only injections (#1490, #1491) by @bug-ops in #1506
• fix(feedback): store feedback text in outcome_detail instead of error_context by @bug-ops in #1507
• fix(llm): delegate missing LlmProvider methods in SubProvider by @bug-ops in #1508
• fix(orchestration): include tool definitions in inline task execution by @bug-ops in #1509
• fix(orchestrator): record last_used_provider in chat_with_tools and named variants by @bug-ops in #1510
• fix(tracing): write to stderr explicitly to prevent ACP stdio log pollution by @bug-ops in #1511
• fix(orchestration): defer task to Ready on concurrency-limit spawn failure by @bug-ops in #1514
• fix(core): push ToolResult before self-reflection early return (#1512) by @bug-ops in #1518
• fix(core): prevent orphaned ToolUse when attempt_self_reflection returns Err by @bug-ops in #1520
• fix(orchestration): add backoff in DagScheduler when all tasks deferred (#1519) by @bug-ops in #1522
• release: v0.14.3 by @bug-ops in #1524

Full Changelog: v0.14.2...v0.14.3