v0.17.1rc3

Release candidate — for testing. agento upgrade will not pick this up; pin it.

Carries everything in v0.17.1rc2, plus the toolbox and security fixes below.

Bug Fixes

• SQL queries are now cancelled on the server when they time out. A query that hit core/sql_timeout_seconds was abandoned by the client while the database kept running it to the end, so the server stayed busy on work nobody waits for. MySQL and MSSQL now cancel the request server-side and set a matching lock timeout.
• MSSQL tools honour core/sql_timeout_seconds. node-mssql ignores Request.timeout and reads only requestTimeout from the pool config, so every MSSQL query failed at the library default of 15 s. The healthcheck keeps its own 10 s limit through request cancellation.
• Large-result offload files no longer overwrite each other. The name was result_YYYYMMDD_HHMMSS.{csv,txt}, so two calls that ended in the same second wrote the same path and the second result replaced the first. The name now carries a random suffix.

Security

• A nested repository config can no longer run commands through the artifact store. The desk and the Git backend refuse a config that a caller placed inside the tree they operate on.
• Outlook replies align the DMARC header.from with the sending mailbox. A reply sent from a shared mailbox could carry a from the receiving domain's DMARC policy did not accept.

Upgrade

agento upgrade --version 0.17.1rc3