v0.2.18

0.2.18 (2026-10-05)

Upgrade notes

• Check tool-name patterns before upgrading, because an invalid one now stops startup. Patterns in mcp_filter (agent and worker), [hitl].require_approval, client_tool_filter and [mcp.servers.<key>.scratchpad] keys are parsed when the config loads. Remove spaces and other characters outside a-z A-Z 0-9 _ - / ., drop empty patterns, and split any literal run longer than 64 characters. In mcp_filter, a:b, [abc] and {a,b} used to be literal text and now mean a namespace scope, a character class and an alternation. (#700, #705, #725)
• If two MCP servers expose the same tool name, confirm which one you now get. The server whose [mcp.servers.<key>] sorts first always wins; in v0.2.17 the winner could change from run to run. The startup log names every collision. To use a different server, scope mcp_filter to it, for example ["other-server:*"]. (#713)
• Allow for longer startup when MCP servers are slow or unreachable. The web server connects to each agent's MCP servers once before it starts listening, to report tool-name collisions, and each server can take up to [mcp].connect_timeout_secs. Check that startup and readiness probes leave room for this. The check sends only static headers, so a server that authenticates through headers_from_request logs a connection warning at boot. (#713)
• Raise [mcp].connect_timeout_secs if any MCP server needs more than 30 seconds to connect and list tools. Servers slower than the timeout are now marked Failed instead of being waited on. Don't set it to 0: that fails every server instead of disabling the timeout. (#305)
• Expect finish_reason: "length" on some orchestrated responses. Orchestrated responses now report real token usage instead of zeros. finish_reason compares that total with max_tokens, so a request that sets max_tokens can report "length" on a complete answer. (#625)
• Plan for new skill-invocation records in your Redis or file session store. Redis keys follow {p}:skills:{uuid5(agent_id)}:{session_id}, and the file backend writes one .jsonl file per session and agent under the store root's skills/ directory. Set AURA_SESSION_STORE_SKILLS_TTL_SECS to control expiry; the default is 86400 (24h) and 0 disables expiry. (#396)
• Update any MCP-server dashboards or allowlists that match on the rmcp client name. AURA now announces itself as aura/<version> unless [mcp].user_agent says otherwise. (#670)
• Review alerts that match on shutdown or cancellation log lines. The server no longer logs All in-flight requests completed, shutting down early. Every shutdown now ends with shutdown complete, which carries clean_shutdown and unaborted_tasks fields. A cancelled orchestration run logs Run cancelled for <id> instead of External cancellation triggered for <id>. (#305, #625)

Added

• Tool-name patterns can be scoped to one MCP server with <namespace>:<name>.
  • Where it works: mcp_filter (agent and worker) and [hitl].require_approval.
  • Syntax: the namespace is the [mcp.servers.<key>] config key, and both segments accept globs, for example github:*. The first : is the delimiter.
  • Matching: a namespaced pattern never matches a tool with no MCP server, such as a filesystem or client-side tool.
  • Visibility: the model never sees the namespace. It does appear as tool_namespace on approval events and webhook payloads, as the tool.namespace attribute on MCP tool-call spans, and as namespace on each governance catalog entry. (#712)
• Skills an agent loads now stay loaded across chat turns, stored in the session store. This is on whenever an agent has local skills configured.
  • Recording: each successful load_skill or read_skill_file call is recorded under the conversation's chat_session_id and the serving agent, then replayed into the next turn's history.
  • Storage: records hold only the invocation, never skill content, so replay re-reads skill files from the agent config on disk.
  • Limits: a log holds at most 64 distinct invocations, and each turn replays at most 256 KiB of content, newest first. Replayed skills count toward the context window on every turn.
  • Reporting: restored skills are reported over SSE as aura.skills_rehydrated. (#396)
• Orchestration tool-completion frames now name the worker in worker_id. Before, a completion could only be tied to its worker by matching tool_call_id against the start frame. The field defaults to empty when absent, so typed consumers still parse frames from older servers. (#724)
• MCP servers now see AURA's identity through a configurable [mcp].user_agent.
  • Default: aura/<version>. It is sent as the HTTP User-Agent on streamable HTTP and SSE, and as clientInfo.name/version on every transport including stdio. Before, the handshake announced clientInfo.name = "rmcp".
  • Per-server override: each server table accepts its own user_agent. A per-server User-Agent header entry still takes precedence, but only for the HTTP header.
  • Validation: invalid values, such as empty or non-printable-ASCII tokens, are rejected when the config loads. (#670)
• An example config is added for Checkly incident response via Checkly's hosted MCP server. It uses Streamable HTTP at https://api.checklyhq.com/mcp with API-key bearer auth.

Changed

• Every tool-name pattern is checked against one grammar when the config loads. This covers mcp_filter, [hitl].require_approval, client_tool_filter and scratchpad keys.
  • Before: a pattern outside the grammar was accepted and silently matched nothing. mcp_filter used to understand only * and ?.
  • Now: it fails config load with invalid tool name pattern.
  • Literals: characters are limited to a-z A-Z 0-9 _ - / ., and a run of plain characters may be at most 64 long.
  • Constructs: *, ?, [abc]/[!abc], {a,b} and the <namespace>:<name> scope.
  • Matching: case-sensitive and anchored at both ends. (#700, #705)
• When MCP servers share a tool name, the same server always wins. Registration walks servers in sorted id order across all transports, and the first server whose tool passes mcp_filter claims the name; before, the winner depended on map order. At startup and on governance sync, each collision logs MCP tool '<name>' is advertised by N servers (...); only '<winner>' will be reachable. (#713)
• The SRE example configs and quickstart default telemetry queries to the last 5 minutes. Their coordinator and worker prompts inspect metrics, logs, traces and alerts over a 5-minute lookback unless the user asks for a different window. This avoids unbounded queries during live incident triage. Configs you wrote yourself are unaffected. (#697)
• Run events, approvals and tool-call tracking are scoped to each run instead of process-wide registries.
  • Delivery: tool lifecycle, MCP progress, usage and approvals now travel on a channel owned by the run, so per-request state lives and dies with it.
  • Wire format: the SSE schema is unchanged, and approvals still reach clients when AURA_CUSTOM_EVENTS is off.
  • Usage: an orchestrated run's final response carries the run's accumulated usage and cache split instead of zeros. (#626, #625, #624, #623)
• Tool and progress SSE events name the agent that emitted them, and progress text renders cleanly.
  • aura.tool_usage carries the emitting agent's context.
  • aura.tool_requested, aura.tool_start and aura.progress are attributed to the agent each MCP call acts for.
  • A progress notification without its own message reads Progress: 50/100 instead of Progress: 50/Some(100.0). (#618, #620, #625)

Fixed

• A hung MCP server no longer blocks request handling or graceful shutdown indefinitely. Connect, initialize and tool discovery for each server are now bounded by [mcp].connect_timeout_secs, which defaults to 30. A server that times out is marked Failed with Connection timed out after {n}s, like any other connect error. Before, only a SIGKILL ended the hang, which also dropped buffered OTel spans. (#305)
• Text-fallback tool calls now honor mcp_filter. Fallback tool parsing used to call the first server advertising a name, even one the agent's mcp_filter excluded or that registration shadowed. It now resolves the same winner as registration. (#713)
• An orchestration plan nested too deeply is rejected back to the coordinator instead of crashing the run. A plan with a chain inside a chain was reported as created, then crashed the run and cut the stream off mid-run. The flattening error now comes back as the plan tool's result, so the model can retry, and the decision is not recorded.
• --streaming-timeout-secs 0 now disables the run timeout as documented.
  • Before: a zero value expired on its first check, so a server configured this way served nothing.
  • Streaming at 0: nothing caps total run length. The first-chunk window stops once output starts, and the inactivity window only bounds gaps between items.
  • Non-streaming at 0: these requests have neither window, so they're unbounded. (#715)
• Runs are cancelled when their consumer goes away, and A2A cancelTask works while an agent is still being built.
  • Orchestration: dropping a run's stream now cancels it, so an orchestration run stops spending provider turns after its caller disconnects.
  • A2A: a task now registers for cancellation before the agent build and history fetch, so a cancelTask sent during them takes effect. A task cancelled by cancelTask no longer also reports Completed after reporting Canceled. (#625)
• aura flushes telemetry on SIGTERM in one-shot and REPL modes. SIGTERM used to hit the OS default and skip the tracer shutdown, so every buffered OTel span was lost. The CLI now prints warning: received SIGTERM, flushing telemetry before exit, flushes for up to about 7s, and exits with code 143. (#305)
• Web server shutdown now ends straggling requests so their OTel spans are exported. After the --shutdown-timeout-secs grace period and a further 5s for streams to end, any request task still running is aborted before telemetry is flushed. An orchestration run whose caller goes away is cancelled instead of left running past the OTel flush. The server logs Stream shutdown grace period expired, aborting stragglers when it aborts tasks. (#305)
• The 64-character literal limit in tool-name patterns is enforced consistently and reported accurately.
  • The bug: a wildcard anywhere in a pattern used to lift the limit, so a 65-character literal followed by * was accepted.
  • The error: it now names the run's full length and column, instead of a misleading character-class complaint.
  • Classes: a bracket class counts as one character and ends the literal run. An unclosed [ is reported as a parse error. (#725)

Known issues

• [mcp].connect_timeout_secs = 0 fails every MCP server instead of disabling the timeout. Use a large value if you need a long wait.
• [hitl].require_approval gates only MCP tools. A pattern naming a native tool, such as a CLI local tool, never requires approval. (#764)
• A tool call denied by an approver reports success: true on its completion event. (#735)
• In orchestration, MCP progress events name the coordinator instead of the worker. (#734)
• An A2A cancelTask that arrives just as a task finishes can record it as Canceled. (#737)
• Graceful shutdown doesn't wait for requests still connecting to their MCP servers. (#736)
• The HTTP-only CLI build (--no-default-features) fails clippy -D warnings. (#721)

For contributors

• Embedders of the AURA crates see API changes.
  • Runs: StreamingAgent::stream takes RunOptions and returns an AgentRun handle that cancels the run when dropped.
  • Removed: stream_with_timeout and the process-wide event brokers. glob_match is also gone; use aura_config::GlobPattern.
  • Types: event identifiers and usage use typed wrappers (ToolCallId, ToolName, TokenUsage, Progress). (#618, #625, #705)
• aura_events::OrchestrationStreamEvent is the single definition of orchestration frames. Typed consumers now parse frames such as plan_created and iteration_complete as the server sends them, and OrchestratorEvent is removed. (#623)
• The DVP report sync mints a fresh Docker Hub JWT per report and reads HogQL responses reliably. A single JWT expired before the fifth report download, causing 401s. Retried 504 bodies no longer corrupt the JSON that jq reads, and self-tests cover both fixes. (#718)
• Debug output and agent-id constants are tidied. GlobPattern debug output now shows only the source string. The conversation agent id main is defined once as CONVERSATION_AGENT_ID, with no wire change. (#729)
• Nightly and beta channels can no longer release from a stale baseline. sync-main.yml now opens main-to-channel back-merges, triggered on release and kept fast-forwarded. check-release-baseline.sh refuses to release a channel that cannot reach main's latest tag.

Bug Fix Commits

• ci: keep channel branches from releasing off a stale baseline 2d6080d - Justin Gross

• ci: refresh the docker jwt per dvp report and harden hogql reads dbc3bce - Justin Gross

• cli: flush telemetry on sigterm in standalone mode 6adf23b - Justin Gross #305

• config: end a literal run at a character class 2cf0f10 - Justin Gross

• config: enforce the mcp_filter literal cap and name it in the error 584ee15 - Justin Gross

• config: match tool-name glob patterns with globset 9316530 - Justin Gross #705

• config: measure a class as one character and report the full run 5b3d78f - Justin Gross

• events: carry the worker id into the tool-completion frame 50b8c57 - Justin Gross

• mcp: bound connect/initialize/discovery with a timeout 3a2fd56 - Justin Gross #305

• mcp: warn if multiple servers use same tool name 22c7c05 - Justin Gross #713

• orchestration: attribute tool completions to the worker 1470d11 - Justin Gross

• orchestration: fail safe on dropped cancel watcher 9b95c00 - Justin Gross #305

• orchestration: reject an unflattenable plan instead of panicking 3b0a8f5 - Justin Gross

• skills: scope skill invocation records to the serving agent e2aad6c - Justin Gross

• web-server: abort stragglers before otel shutdown 6c278e8 - Justin Gross #305

• web-server: let a zero streaming timeout disable the bound 08d6c54 - Justin Gross #715

Chore Commits

• globpattern: stop emiiting Regex debug info 1faf45b - Justin Gross

Code Refactoring Commits

• agents: cancel a run through its own token a9c4a42 - Justin Gross #626

• events: approvals reach the run's observer 8777c0e - Justin Gross #626

• events: define orchestration SSE frames once ca67258 - Justin Gross #623

• events: define the conversation agent id once 28f312b - Justin Gross

• events: send a run's events to its observer a171983 - Justin Gross #626

Feature Commits

• agents: carry run identity in task-local scope 55fa378 - Justin Gross #625

• agents: give StreamingAgent one entry point returning a run handle 5530e96 - Justin Gross #625

• agents: give the run its own tool-call queue 3856861 - Justin Gross #626

• agents: make hooks an extension point faab087 - Justin Gross #625

• events: add agent event schema and broker adapter 8ba61fd - Justin Gross #618

• events: approvals emit the agent event schema ab5a15e - Justin Gross #624

• events: carry response content on the run's event stream ea0ae61 - Justin Gross #626

• events: name the agent on orchestrated content 0fdec1a - Justin Gross #626

• events: orchestration emits the agent event schema a4414a5 - Justin Gross #623

• events: single-agent producers emit the agent event schema cac4f3b - Justin Gross #620

• examples: add Checkly incident response example config 59c269c - Justin Gross

• mcp: add namespace tracking for mcp tools 45036ad - Justin Gross #712

• mcp: identify aura to mcp servers with a configurable user agent 62f7810 - Justin Gross #670

• orchestration: add default 5m telemetry lookback policy c2733ae - Justin Gross #697

• skills: persist and rehydrate skill invocations across turns 770f114 - Justin Gross

Miscellaneous Commits

• Merge branch 'nightly' into main 1000f11 - GitHub

• Merge pull request #688 from mezmo/main 1f4ca61 - GitHub #688

Test Commits

• ci: cover the dvp jwt refresh and hogql retry, clean up on failure bd68e28 - Justin Gross

• events: state the worker-id parse case as current behavior c78b6e6 - Justin Gross

• sre: add coverage for default window and override query args 3682802 - Justin Gross #697