build(deps): bump @mastra/observability from 1.3.1 to 1.5.1

[dependabot]

Bumps @mastra/observability from 1.3.1 to 1.5.1.

Release notes

Sourced from @​mastra/observability's releases.

February 19, 2026

Highlights

Core Harness: A Reusable Orchestration Layer for Agent Apps

A new generic Harness in @mastra/core provides a foundation for building agent-powered applications with modes, state management, built-in tools (ask_user, submit_plan), subagent support, Observational Memory integration, model discovery, permission-aware tool approval, and event-driven/thread/heartbeat management.

Workspace Capability Upgrades (Security, Discovery, and Search)

Workspaces gain least-privilege filesystem access via LocalFilesystem.allowedPaths (plus runtime updates with setAllowedPaths()), expanded glob-based configuration for file listing/indexing/skill discovery, and a new regex search tool mastra_workspace_grep to complement semantic search.

Better Tool I/O and Streaming Behavior in the Agent Loop

Tools can now define toModelOutput to transform tool results into model-friendly content while preserving raw outputs in storage, and workspace tools now return raw text (moving structured metadata to data-workspace-metadata stream chunks) to reduce token usage. Streaming reliability also improves (correct chunk types for tool errors, onChunk receives raw Mastra chunks, agent loop continues after tool errors).

Changelog

@​mastra/core@​1.5.0

Minor Changes

• Added allowedPaths option to LocalFilesystem for granting agents access to specific directories outside basePath without disabling containment. (#13054)

  const workspace = new Workspace({
    filesystem: new LocalFilesystem({
      basePath: './workspace',
      allowedPaths: ['/home/user/.config', '/home/user/documents'],
    }),
  });

  Allowed paths can be updated at runtime using setAllowedPaths():

  workspace.filesystem.setAllowedPaths(prev => [...prev, '/home/user/new-dir']);

  This is the recommended approach for least-privilege access — agents can only reach the specific directories you allow, while containment stays enabled for everything else.

• Added generic Harness class for orchestrating agents with modes, state management, built-in tools (ask_user, submit_plan), subagent support, Observational Memory integration, model discovery, and permission-aware tool approval. The Harness provides a reusable foundation for building agent-powered applications with features like thread management, heartbeat monitoring, and event-driven architecture. (#13245)

• Added glob pattern support for workspace configuration. The list_files tool now accepts a pattern parameter for filtering files (e.g., **/*.ts, src/**/*.test.ts). autoIndexPaths accepts glob patterns like ./docs/**/*.md to selectively index files for BM25 search. Skills paths support globs like ./**/skills to discover skill directories at any depth, including dot-directories like .agents/skills. (#13023)

  list_files tool with pattern:

  // Agent can now use glob patterns to filter files
  const result = await workspace.tools.workspace_list_files({
    path: '/',

... (truncated)

Changelog

Sourced from @​mastra/observability's changelog.

1.5.1

Patch Changes

• Fix cache token extraction in multi-step agent runs. Prefer AI SDK aggregated inputTokenDetails over providerMetadata (which only reflects the last step). Also fix truthiness checks to correctly handle zero values for cache and reasoning tokens. (#14492)

  Fix Datadog metric keys to match dd-trace expected format: cacheReadTokens, cacheWriteTokens, reasoningOutputTokens.

• Fixed span serialization to avoid incorrect [Circular] placeholders in traces. (#14263)

• Updated dependencies [cb611a1, da93115, 62d1d3c, 9e1a3ed, 8681ecb, 28d0249, 681ee1c, bb0f09d, a579f7a, 5f7e9d0, d7f14c3, 0efe12a]:

  • @​mastra/core@​1.15.0

1.5.1-alpha.1

Patch Changes

• Fix cache token extraction in multi-step agent runs. Prefer AI SDK aggregated inputTokenDetails over providerMetadata (which only reflects the last step). Also fix truthiness checks to correctly handle zero values for cache and reasoning tokens. (#14492)

  Fix Datadog metric keys to match dd-trace expected format: cacheReadTokens, cacheWriteTokens, reasoningOutputTokens.

• Updated dependencies [9e1a3ed, a579f7a]:

  • @​mastra/core@​1.15.0-alpha.2

1.5.1-alpha.0

Patch Changes

• Fixed span serialization to avoid incorrect [Circular] placeholders in traces. (#14263)

• Updated dependencies [cb611a1, 62d1d3c, 8681ecb, 28d0249, bb0f09d, 5f7e9d0]:

  • @​mastra/core@​1.15.0-alpha.0

1.5.0

Minor Changes

• Updated exporters and event bus to use renamed observability types from @mastra/core. Added EventBuffer for batching non-tracing signals with configurable flush intervals. (#14214)

  Breaking changes:

  • ObservabilityBus now takes a config object in its constructor (cardinalityFilter, autoExtractMetrics); setCardinalityFilter() and enableAutoExtractedMetrics() removed

Patch Changes

• Updated dependencies [ea86967, db21c21, 11f5dbe, 6751354, c958cd3, 86f2426, 950eb07]:
  • @​mastra/core@​1.13.0

1.5.0-alpha.0

Minor Changes

... (truncated)

Commits

• 21f5a3e chore: version - exit prerelease mode
• dee6faf fix(observability): update snapshot for fixed serialization (#14512)
• efcdd54 chore: version packages
• 5ac24c4 fix(observability): prefer aggregated inputTokenDetails for cache tokens and ...
• 6dd73cd chore: version packages
• 4e699e0 fix: prevent false [Circular] and [MaxDepth] in span serialization (#14263)
• 62d1d3c fix(core): return top-level agent run span ID instead of nested model spans (...
• 5316071 chore(deps): update build tools (#13933)
• bbcbbce chore: update dependencies and fix mcp build for @​modelcontextprotocol/sdk@​1....
• 37ea0d2 chore: version - exit prerelease mode
• Additional commits viewable in compare view

[dependabot]

Superseded by #433.