@cycgraph/a2a@1.1.4

Patch Changes

• 85bd517: Bound each shared Agent Card resolution with its own 30s timeout and evict the cache entry when it fires. A remote that accepted the connection and never answered previously left a permanently pending card promise cached for that agent, failing every later call to it until the process restarted.

@cycgraph/a2a@1.1.3

Patch Changes

• 303944f: The Agent Card cache is now keyed by agent card URL plus the headers the card was fetched with, so two registry entries that share one agent_card_url but use different credentials each resolve the card with their own auth instead of silently reusing the first caller's cached card.
• c31a48d: The endpoints a resolved Agent Card offers are now SSRF-guarded before any transport is built: the registry validates the card URL, but the card's returned RPC endpoints come from the remote, and a compromised agent could point the transport at loopback or cloud-metadata hosts. Honors the same CYCGRAPH_ALLOW_PRIVATE_A2A_URLS=true development opt-out as the card-url guard.

@cycgraph/tools@1.4.1

Patch Changes

• e004a48: diagnosticsTool accepts an env option so callers can hand the spawned check a scrubbed environment instead of the full process env.

@cycgraph/tools@1.4.0

Minor Changes

• 2a15a85: prFeedback now reports the PR's label names and stamps every relayed comment with the author's repository association, so consumers that treat comment text as instructions can gate on it — commenting needs no permission, making association the only trust signal a comment carries. PublishConfig accepts labels to apply to a pull request on creation (best-effort — a label the repository lacks is skipped, never a failed publish).

@cycgraph/tools@1.3.1

Patch Changes

• 2f4e0b3: pendingDiff registers untracked files as intent-to-add before diffing, so a file an agent created shows up in the patch instead of being invisible. Reviewers and judges previously saw imports of a file that appeared not to exist and refused sound fixes.

@cycgraph/orchestrator@1.3.7

Patch Changes

• e004a48: Reflection nodes extend best-effort handling to the memory writer: a store or I/O failure while persisting extracted facts rethrows while the node has retries left and degrades to zero facts on the final attempt — the result envelope carries writer_failed: true — instead of failing a run whose productive work already succeeded. A missing memoryWriter (configuration) still fails loudly.

@cycgraph/orchestrator@1.3.6

Patch Changes

• ae66ab3: The max_concurrent_tasks field on an A2A server registry entry is now enforced: the a2a node holds a per-server slot for the whole remote exchange, so a map, voting, or parallel-branch graph queues instead of firing every branch at one remote agent at once. Servers without the field are unchanged and still fan out freely.

@cycgraph/a2a@1.1.2

Patch Changes

• e2b590b: Translate a bare Message reply from message/send into a completed task result whose response artifact carries the reply's parts. Agents that answer statelessly without creating a task no longer fail every a2a node with a fabricated failure that discarded the reply.
• a385ce1: A multi-part status.message is no longer dropped: every part now contributes to A2ATaskResult.message, joined by newline in wire order, so an input-required pause still shows the remote agent's question when it arrives as more than one part.

@cycgraph/orchestrator@1.3.5

Patch Changes

• 7c79357: Reflection nodes treat LLM extractor failures as best-effort: an extraction error (structured output not matching the schema, a transient provider error) rethrows while the node has retries left and degrades to zero facts on the final attempt — the result envelope carries extractor_failed: true — instead of failing a run whose productive work already succeeded. Configuration errors such as a missing memoryWriter stay loud.

@cycgraph/orchestrator@1.3.4

Patch Changes

• 9671a03: Fan-out and accounting hardening for map nodes and agent executions:

  • Map workers now honor their node's failurePolicy.timeoutMs instead of always running under the executor's 2-minute default.
  • The map executor stops dispatching new workers once projected spend would cross the run's token budget; skipped items are reported in the node's error output and completed work survives instead of the whole run failing after the fact.
  • Workers' lesson provenance is hoisted from their nested update payloads to the merged action, so fan-out retrieval is attributable to run outcomes like any other node.
  • Multi-step agents whose final step produces no text now fall back to the last step that did, instead of silently discarding the answer written mid-loop.
  • Usage accounting carries prompt-cache detail end to end: the per-step usage fallback keeps inputTokenDetails, actions carry cacheReadTokens/cacheWriteTokens (map merges included), calculateCost prices cache reads at 10% and writes at 125% of the input rate, and the token_usage log line names its source (aggregate or step_sum).
  • reflection() accepts an agent() value for the LLM extractor's agentId, like every other agent reference.