0.65.4 — Multi-agent regression fix

Restores agent-to-agent tool handoffs, which 0.65.3's
GHSA-gjgq-w2m6-wr5q security fix unintentionally broke. If you are on
0.65.3 and use more than one agent, upgrading is strongly recommended — the
regression silently disabled the core multi-agent orchestration pattern. This
release also fixes a PGVector failure on hyphenated collection names and
refreshes the dependency lock to drain the Dependabot backlog.

pip install -U langroid

Regression fix — multi-agent tool handoffs (#1034)

0.65.3 shipped _filter_user_origin_tools (the GHSA-gjgq-w2m6-wr5q patch),
which drops handle-only tools from USER-origin messages so that raw human
input can't invoke a handler directly, bypassing the LLM.

But langroid Tasks relabel inter-agent messages' sender to USER — to a
receiving sub-task, the calling task's message looks like its "user" input. So
the new filter also dropped legitimate agent-to-agent handoffs: one agent's
LLM emits a tool, another agent handles it. This silently broke recipient_tool
and the orchestration tools (PassTool, ForwardTool, SendTool, DoneTool)
— the backbone of multi-agent workflows.

Fix: a new ChatDocMetaData.tools_from_agent flag, set at construction
whenever a message's sender is LLM or AGENT, and only ever set (never
cleared) so it survives the USER relabeling, relays, and deepcopies.
_filter_user_origin_tools now passes tools through unchanged when the flag is
set, and still drops handle-only tools from genuine raw USER input. A raw
human message is never marked (it enters as USER and no agent produced it), so
the GHSA-gjgq protection is fully preserved.

Verified by tests/main/test_tool_orchestration.py — 13 deterministic
(MockLM) cases across PassTool/ForwardTool/SendTool/DoneTool went from
failing to passing — plus test_recipient_tool. The security guarantee still
holds via tests/main/test_handle_message_security.py (7/7).

Bug fix — PGVector collection names with hyphens (#1037)

PGVectorStore's raw CREATE INDEX / DROP INDEX statements interpolated the
table and index names unquoted, so any collection name containing a hyphen
(or other identifier-special character) — e.g. a pytest-xdist worker suffix
like mycollection-gw1 — produced a Postgres syntax error. A new _quote_ident
helper now properly quotes identifiers in the raw DDL.

Dependencies — Dependabot security drain (#1033)

Regenerated the root uv.lock via uv lock --upgrade, moving ~46 packages to
patched versions and draining ~168 Dependabot alerts (e.g. aiohttp, pypdf,
authlib, nltk, litellm, urllib3, cryptography, starlette, tornado, requests,
gitpython, docling, scrapy, onnx, plus a fastmcp 2 → 3 major bump). The
published dependency ranges in [project] are unchanged — every patched
version already sat within the existing constraints, so a fresh
pip install -U langroid resolves to them.

A lock-only [tool.uv] constraint-dependencies block holds back four deps
that the bulk upgrade over-bumped to breaking versions (none of them
security-flagged):

• qdrant-client<1.16 — 1.16 removes search_batch / vectors_count that
  QdrantDB relies on
• onnxruntime<1.24 — 1.24 ships no cp310 wheels, breaking uv sync on
  Python 3.10
• mypy<1.16 — dev-only stricter checks
• pinecone-client<6 — 6.x is an import-time stub that raises, breaking
  VectorStore.create()

These constraints are not part of published metadata, so downstream installs
are unaffected.

Minor internal adjustments accompany the openai/pydantic currency
(openai_assistant.py, pydantic_utils.py). The marker PDF backend's test
case is now xfailed: marker-pdf pins openai<2 / litellm<1.83, which
conflict with the security-patched lock; users who install langroid[marker]
still get a working marker via normal pip resolution.

Upgrade

pip install -U langroid

Full changelog:
0.65.3...0.65.4