v0.2.0

What's New

SSE Event Streaming with Replay (#20)

• Live event streaming — GET /runs/{run_id}/stream delivers real-time SSE events as the agent executes each step
• Full replay on connect — connecting mid-run or after completion replays all past events first, then continues live
• Last-Event-ID reconnection — standard SSE reconnection support; clients skip already-seen events automatically
• Event persistence — run status and action log are persisted to Modal Volume on completion, so GET /runs/{run_id} and GET /runs/{run_id}/stream work even after the sandbox terminates
• In-process status API — fixed a pre-existing bug where the status API (uvicorn) and agent ran as separate processes with no shared state, meaning SSE streaming never actually delivered events

Multi-Container API Support (#20)

• Sandbox.from_id() fallback — status, stream, and stop endpoints reconstruct sandbox handles from Modal's API when the run isn't in the local registry, enabling multi-container deployments without sticky sessions
• Volume-backed fallback — after sandbox termination, responses are served from persisted status.json on the recordings volume

Credential Security (#18, #19)

• SecretValue wrapper — credentials are wrapped in an opaque type that masks str()/repr() output and blocks json.dumps(), preventing accidental exposure in logs
• HTTPS + Modal encryption — credentials flow over TLS to the API, then via Modal's encrypted env vars to sandboxes
• Flat credential format — simplified from nested dict[str, dict[str, str]] to flat dict[str, str]

Local Evaluation Framework (#17)

• Offline test stabilization — all 350 tests run without API keys or network access
• evaluation/ module — new eval runner, models, and example suite for measuring task success, action count, and output quality
• scripts/eval_local.py — CLI to run eval suites locally with JSON report output
• CI workflow — added .github/workflows/ci.yml for automated testing

API Improvements (#16, #20)

• RunStatusValue and RunPhase as StrEnum — type-safe status values replacing raw Literal strings
• RunResponse.status field — POST /runs response now includes the run status
• API key authentication — api/auth.py with Bearer token verification, ENVIRONMENT=local to disable for development
• Safe Last-Event-ID parsing — malformed headers default to 0 instead of raising errors

Documentation

• Streamlined README — focused on setup, quick start, and why CUA is different (~120 lines, down from ~600)
• docs/ directory — 8 focused guides: API, Tools, Playbooks, Authentication, Guardrails, Recording, Observability, Configuration

Breaking Changes

• config.credentials now returns dict[str, SecretValue] instead of dict[str, str] — use .get_secret_value() to access raw values
• RunStatusValue is now a StrEnum (compares equal to strings, so most code is unaffected)

Stats

• 50 files changed, 2,260 insertions, 663 deletions
• 350 tests (all offline, no API keys required)
• Deployed and validated end-to-end on Modal

Full Changelog: v0.1.0...v0.2.0