Changelog

production-ready runtime for agent networks, with context folds (core) BREAKING (00b1845)

Runs now have a lifecycle, limits, validation, tenant-scoped history and resumable streams, and agents can build their model context incrementally with context folds. Migration notes for every breaking change are in packages/core/CHANGELOG.md.

• Run lifecycle: endsOn(event, when?), ctx.complete() / ctx.fail(), idleTimeout and maxDuration, onAgentError: 'fail' | 'continue', and m4trix:run.completed|failed|cancelled after which the stream closes. Agents, tools and skills get an AbortSignal.
• Concurrency: per-run mailboxes, so a run's events are handled in order while runs proceed in parallel; .concurrency(n) per agent; transient events slide instead of blocking.
• Limits and usage: maxDepth (25) and maxEvents (1000) by default, ctx.reportUsage() with optional maxTokens / maxCostUsd; events carry eventId, ts, depth and causationId.
• Stores and tenancy: async pluggable AgentNetworkStore, ctx.history, an in-memory default with TTL and LRU, history namespaced by the principal auth returns, EventTransport, and runStoreContract / runTransportContract in @m4trix/core/testing.
• Validation: 400 on invalid requests, strict emits against .emits([...]), enforced channel.events([...]), a wiring check at setup (network.validate()), validated params.
• SSE: id: lines with Last-Event-ID resume from the store, a 30 s reconnect window, heartbeats, Express back-pressure, GET ?payload=.
• Tools: JSON Schema, toOpenAI() / toAnthropic() / toAiSdk(), typed errors, executeForModel(), .timeout() / .retry(), a trace span per call; skills stream.
• Context folds: ContextFold, SegmentedFold, budgeted views with ContextStrategy, .folds([...]) and ctx.folds.<name>(), cached on the event plane, compaction via checkpoint events; history.context({ names, after }) and history.latest().
• Observability: logger and onMetric options, a tracer onUsage hook, cancelled status.
• Public API: explicit exports with an API report, no Node built-ins (Edge runtimes), effect as a peer dependency, Node 20+.

BREAKING CHANGE: streams close when their run ends and runs need endsOn or complete(); ctx.history replaces runEvents / contextEvents; AgentNetworkStore is async with a new interface; auth returns a principal; undeclared or invalid emits fail the run; runs default to 25 hops and 1000 events; tools reject with typed errors; NetworkTracer end hooks take a status; DepedencyLayer* is renamed DependencyLayer*; the spawner, Proxy.kafka / Proxy.socketIo and the legacy LLM and socket.io helpers are removed; effect must be installed alongside.

override vulnerable transitive dependencies to clear high-severity audit findings (core, stream, react, ui) (f5b079d)

pnpm audit (scripts/audit-deployed-packages.ts) reported high/critical advisories reachable from published packages, which blocks the release pipeline. Pin patched versions via pnpm overrides, staying within each dependency's current major line:

• brace-expansion@5 >=5.0.11, nanoid@3 >=3.3.18, ws@8 >=8.21.0, js-yaml@4 >=4.3.2 (version-scoped so other majors are untouched)
• browserslist >=4.28.7, engine.io >=6.6.10, postcss >=8.5.18, @grpc/grpc-js >=1.13.6
• raise existing floors: axios >=1.20.0, form-data >=4.0.6, socket.io-parser >=4.2.7
• trace-viewer: vite ^6.4.3; vitest's auto-installed vite peer now resolves to the same patched 6.4.3 instead of 7.3.3

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

replace channel sinks with proxy consumers (matrix) BREAKING (90871b6)

Add channel proxy declarations, explicit SSE proxy consumers, custom proxy registration, and inbound event publishing through InteractiveProxyHandle.

BREAKING CHANGE: AgentNetwork setup now provides proxy instead of sink, channels use .proxy(...)/getProxies() instead of .sink(...)/getSinks(), and network.expose() now accepts proxy consumers such as registerSSEStream(...) instead of { protocol, select } options.

add dependency layers, typed tools, and network tracing (matrix) (4e2c6fa)

• Extract DepedencyLayer for injection across skills, agents, and networks
• AgentFactory dependsOn/tools; agent logic gets layers, tools, emitAndAwait, tracing
• Tool builder with Effect schemas, layer deps, and optional event emission
• AgentNetwork.dependsOn with layer injection at run() and expose()
• EventPlane.publishAndAwait for request-reply over the event bus
• NetworkTracer hooks for runs, event publish, and agent invocations

upgrade dependencies to clear high-severity audit findings (core, stream, react, ui) (3316b84)

• bump effect, langchain, and socket.io in core; effect in evals
• upgrade vitest 4 and tsup 8 across packages; turbo at root
• add pnpm overrides for transitive advisories (axios, protobufjs, etc.)
• align example apps and website on patched next releases
• fix ui vitest 4 test options API in AiCursor spec

add skill export and enhance type safety in event-plane (matrix) (5bfa399)

• Added export for the 'skill' module in the matrix index.
• Improved type safety by specifying types for results and error handling in event-plane functions.