v0.3.2

Summary

Release v0.3.2 brings major stability and security upgrades to CugaAgent and knowledge ingestion, resolving path-containment vulnerabilities across static routes and trajectory logs alongside Dependabot and CodeQL remediations. Knowledge ingestion is now far more dependable, ensuring that canceled, deleted, or restarted jobs no longer lock filenames or misreport task statuses. The repository also gains a published security policy, and we are excited to welcome first-time contributions from @cuga-bob and @Subhasish1802.

On the execution side, CugaAgent now logs reasoning and code trajectories in strict chronological order while gracefully surviving exit() calls and timeouts without terminating the process or losing local state. Builders get several new configurations, including run receipts for token and timing telemetry, per-run tool caps, pluggable shortlisting (cosine/hybrid), reasoning-effort profiles, and early support for sub-agent spawning (disabled by default). Under the hood, the SDK adds dynamic policy evaluation on invoke results, schema validation for unknown tool arguments, harmony-token handling, and an automatic fallback from json_schema to json_mode.

---

What's Changed

CugaAgent

• feat(cuga_lite): configurable caps on tool calls per block, run and thread by @segevshlomovIBM in #560
• feat(cuga_lite): record direct LangChain tool calls in ToolCallTracker by @segevshlomovIBM in #562
• feat(cuga-lite): pluggable shortlister with cosine and hybrid strategies (#624) by @segevshlomovIBM in #664
• fix(cuga_lite): graceful bind_tools fallback; detect body-form tool_use_failed by @segevshlomovIBM in #524
• fix(cuga-lite): keep variables addendum out of persisted history (#600) by @Sergey-Zeltyn in #601
• fix: propagate assistant reasoning and record fenced code in CugaLite trajectories by @offerakrabi in #606
• fix(cuga-lite): emit Assistant_reasoning before code/nl trajectory step by @offerakrabi in #609
• fix(cuga-lite): end the block on exit()/SystemExit instead of the process by @sami-marreed in #630
• fix(cuga-lite): keep block locals when code execution times out by @sami-marreed in #643
• fix(cuga-lite): trim duplicate find_tools schema blocks (#641) by @sami-marreed in #644
• fix(cuga-lite): retry once instead of finalizing an unverified "tools unavailable" refusal by @Sergey-Zeltyn in #657

Agent, policy & graph

• feat(agent-spawn): fluid runtime sub-agent spawning (#199) by @Iftach-Shoham in #425
• feat(policy): expose decisions in invoke results by @Subhasish1802 in #492
• feat: validate shortlister tool names with retry (#546) by @sami-marreed in #549
• fix(policy): keep NL conflict fallback matches above threshold by @sami-marreed in #578
• fix(cuga_graph): handle harmony control tokens when a harmony model is detected by @segevshlomovIBM in #558
• fix: disable agent_spawn by default by @sami-marreed in #593
• fix(agent): reject unknown tool args and surface schema validation errors by @sami-marreed in #588
• fix(registry): stop unwrapping arguments['params'] in ApiRegistry by @sami-marreed in #587
• fix(runtime-tools): normalize execution callables to always be awaitable by @offerakrabi in #594
• fix(agent): fall back to json_mode whenever an endpoint ignores json_schema by @sami-marreed in #640
• fix(policy): OutputFormatter markdown must honor replace/redact instructions by @sami-marreed in #648
• fix(supervisor): pass known variables when delegation omits them by @sami-marreed in #656
• fix(cuga_graph): keep only the final channel when stripping harmony framing by @segevshlomovIBM in #672

Knowledge ingest

• fix(knowledge): only load profiles with a known name by @haroldship in #679
• fix(knowledge): tolerate status-less file-tasks in restart recovery by @dolev31 in #687
• fix(knowledge): make cancel end the ingest instead of wedging the filename by @dolev31 in #688
• fix(knowledge): return 400 for a missing or malformed JSON body by @dolev31 in #690
• fix(knowledge): make delete stop an in-flight ingest of the same file by @dolev31 in #692
• fix(knowledge): serialize terminal task writes so a row cannot lie by @dolev31 in #693
• fix(knowledge): fail the delete instead of reporting one the ingest will undo by @dolev31 in #697

Security

• chore(ci): add Dependabot configuration and limit workflow token permissions by @haroldship in #592
• fix(security): remediate high and critical Dependabot alerts by @sami-marreed in #589
• fix(ci): harden Bob PR-review workflows against CodeQL criticals by @sami-marreed in #608
• fix(codeql): make the path sanitizer model resolve by @haroldship in #634
• fix(server): contain static file routes to their static directory by @haroldship in #632
• fix(tracker): confine external trajectory writes to the tracker directory by @haroldship in #637
• fix(security): remediate all open Dependabot alerts by @haroldship in #646
• docs(security): add a security policy by @haroldship in #651

SDK, config & observability

• feat(sdk): Run Receipt — per-run token/timing visibility (fixes silent token-tracking crash) by @segevshlomovIBM in #467
• feat(config): reasoning-effort model profiles for OpenAI-compatible endpoints by @Sergey-Zeltyn in #653
• fix(watsonx): resolve completion budget from first-seen value, not own write by @segevshlomovIBM in #556
• fix(trajectory): record code not content for Assistant_code step by @offerakrabi in #595
• perf(memory): add memory profiling harness and defer BaseChatModel import in sdk.py (#486) by @offerakrabi in #568
• fix(eval): bound the Langfuse trace fetch to a wall-clock deadline by