fix+feat: bugs, optimizations, new integrations, dashboard keys page

Bug fixes:
- loop.py: async function passed to sync run() now raises TypeError with
  a clear message pointing to arun(); fixes silent hang/crash
- loop.py apply_proposal: replace fragile `"proposed" in locals()` guard
  with an explicit `proposed: str | None = None` initializer before the
  try block
- control_plane.py: 401/403 responses now log at ERROR level and set an
  _auth_failed flag that blocks all further enqueues, preventing the
  client from silently dropping all events with a bad key forever
- cli.py: replace local naive _apply_patch (no backup, no libcst) with
  apply_function_patch from _patch.py; add is_git_dirty guard on --apply
  path so dirty working trees are rejected cleanly
- events.py, pytest_plugin.py, integrations/__init__.py: remove stale
  version-number comments that described unshipped future work
- site/app/page.tsx: version badge v0.4.0 -> v0.5.0

Optimizations:
- propose.py: cache REPAIR_SYSTEM + SANDBOX_IMPORT_HINT as a module-level
  constant _REPAIR_SYSTEM_SANDBOX instead of re-concatenating on every
  build_messages() call

New features:
- src/self_heal/integrations/openai_agents.py: first-class OpenAI Agents
  SDK integration (healing_tool decorator, mirrors claude_agent_sdk.py)
- site/app/dashboard/keys/page.tsx: API key management page (was linked
  from runs page empty state but missing)
- pyproject.toml: add pytest-cov>=4.0.0 to dev extras; enable --cov flags
  in pytest addopts with 80% minimum threshold
- ci.yml: upload .coverage artifact on Python 3.13 matrix leg

Author: Johin2

.github/workflows/ci.yml

@@ -35,3 +35,10 @@ jobs:
 
       - name: Run tests
         run: pytest -v
+
+      - name: Upload coverage report
+        if: matrix.python-version == '3.13'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: .coverage

pyproject.toml

@@ -56,6 +56,7 @@ all = [
 ]
 dev = [
     "pytest>=8.0.0",
+    "pytest-cov>=4.0.0",
     "ruff>=0.6.0",
     "anthropic>=0.40.0",
     "cohere>=5.0.0",
@@ -112,4 +113,4 @@ extend-immutable-calls = [
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 python_files = ["test_*.py"]
-addopts = "-ra -q"
+addopts = "-ra -q --cov=src/self_heal --cov-report=term-missing --cov-fail-under=80"

site/app/dashboard/keys/page.tsx

@@ -0,0 +1,220 @@
+"use client";
+
+import { useState, useEffect, useCallback } from "react";
+import { Copy, Trash2, Plus, Eye, EyeOff } from "lucide-react";
+
+type ApiKey = {
+  id: string;
+  name: string;
+  prefix: string;
+  created_at: string;
+  last_used_at: string | null;
+};
+
+type RevealedKey = {
+  id: string;
+  key: string;
+};
+
+function fmt(iso: string): string {
+  return new Date(iso).toLocaleString();
+}
+
+function CopyButton({ text }: { text: string }) {
+  const [copied, setCopied] = useState(false);
+  const copy = () => {
+    navigator.clipboard.writeText(text);
+    setCopied(true);
+    setTimeout(() => setCopied(false), 1500);
+  };
+  return (
+    <button
+      onClick={copy}
+      className="ml-1 inline-flex items-center rounded p-0.5 text-neutral-500 hover:text-neutral-200 transition"
+      title="Copy"
+    >
+      <Copy size={13} />
+      {copied && <span className="ml-1 text-[10px] text-emerald-400">copied</span>}
+    </button>
+  );
+}
+
+export default function KeysPage() {
+  const [keys, setKeys] = useState<ApiKey[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [creating, setCreating] = useState(false);
+  const [newName, setNewName] = useState("");
+  const [revealed, setRevealed] = useState<RevealedKey | null>(null);
+  const [error, setError] = useState<string | null>(null);
+
+  const fetchKeys = useCallback(async () => {
+    try {
+      const res = await fetch("/api/cp/v1/keys", { credentials: "include" });
+      if (!res.ok) throw new Error(`${res.status}`);
+      const data = await res.json();
+      setKeys(data.keys ?? []);
+    } catch {
+      setError("Failed to load API keys.");
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    fetchKeys();
+  }, [fetchKeys]);
+
+  const createKey = async () => {
+    if (!newName.trim()) return;
+    setCreating(true);
+    setError(null);
+    try {
+      const res = await fetch("/api/cp/v1/keys", {
+        method: "POST",
+        credentials: "include",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ name: newName.trim() }),
+      });
+      if (!res.ok) throw new Error(`${res.status}`);
+      const data = await res.json();
+      setRevealed({ id: data.id, key: data.key });
+      setNewName("");
+      await fetchKeys();
+    } catch {
+      setError("Failed to create API key.");
+    } finally {
+      setCreating(false);
+    }
+  };
+
+  const deleteKey = async (id: string) => {
+    if (!confirm("Revoke this key? This cannot be undone.")) return;
+    try {
+      const res = await fetch(`/api/cp/v1/keys/${id}`, {
+        method: "DELETE",
+        credentials: "include",
+      });
+      if (!res.ok) throw new Error(`${res.status}`);
+      setKeys((prev) => prev.filter((k) => k.id !== id));
+      if (revealed?.id === id) setRevealed(null);
+    } catch {
+      setError("Failed to revoke key.");
+    }
+  };
+
+  return (
+    <div className="max-w-3xl">
+      <div className="flex items-end justify-between">
+        <div>
+          <h1 className="text-2xl font-semibold tracking-tight">API Keys</h1>
+          <p className="mt-1 text-sm text-neutral-400">
+            Keys authenticate the{" "}
+            <span className="font-mono text-neutral-300">ControlPlaneClient</span> in the OSS library.
+          </p>
+        </div>
+      </div>
+
+      {/* Create key */}
+      <div className="mt-8 rounded-xl border border-neutral-900 bg-neutral-950/40 p-5">
+        <h2 className="text-sm font-medium text-neutral-200">Create a new key</h2>
+        <div className="mt-3 flex gap-2">
+          <input
+            value={newName}
+            onChange={(e) => setNewName(e.target.value)}
+            onKeyDown={(e) => e.key === "Enter" && createKey()}
+            placeholder="Key name (e.g. production)"
+            className="flex-1 rounded-lg border border-neutral-800 bg-neutral-950 px-3 py-2 text-sm text-neutral-100 placeholder-neutral-600 focus:border-neutral-600 focus:outline-none"
+          />
+          <button
+            onClick={createKey}
+            disabled={creating || !newName.trim()}
+            className="inline-flex items-center gap-1.5 rounded-lg bg-white px-3.5 py-2 text-xs font-medium text-black hover:bg-neutral-200 transition disabled:opacity-40"
+          >
+            <Plus size={13} />
+            {creating ? "Creating…" : "Create"}
+          </button>
+        </div>
+
+        {/* One-time reveal */}
+        {revealed && (
+          <div className="mt-4 rounded-lg border border-emerald-900/60 bg-emerald-950/30 p-4">
+            <div className="flex items-center justify-between">
+              <p className="text-xs font-medium text-emerald-400">
+                Copy this key now — it won&apos;t be shown again.
+              </p>
+              <button
+                onClick={() => setRevealed(null)}
+                className="text-xs text-neutral-500 hover:text-neutral-300"
+              >
+                dismiss
+              </button>
+            </div>
+            <div className="mt-2 flex items-center gap-1 font-mono text-sm text-emerald-300">
+              <span className="break-all">{revealed.key}</span>
+              <CopyButton text={revealed.key} />
+            </div>
+          </div>
+        )}
+      </div>
+
+      {error && (
+        <p className="mt-3 text-xs text-red-400">{error}</p>
+      )}
+
+      {/* Key list */}
+      <div className="mt-6">
+        {loading ? (
+          <div className="py-10 text-center text-sm text-neutral-600">Loading…</div>
+        ) : keys.length === 0 ? (
+          <div className="rounded-xl border border-neutral-900 bg-neutral-950/40 p-10 text-center">
+            <div className="text-sm font-medium text-neutral-200">No keys yet</div>
+            <p className="mt-2 text-xs text-neutral-500">
+              Create your first key above to start sending events.
+            </p>
+          </div>
+        ) : (
+          <div className="overflow-hidden rounded-xl border border-neutral-900 bg-neutral-950/40">
+            <table className="w-full text-left text-sm">
+              <thead className="border-b border-neutral-900 bg-neutral-950/80 text-xs uppercase tracking-wider text-neutral-500">
+                <tr>
+                  <th className="px-4 py-3 font-medium">Name</th>
+                  <th className="px-4 py-3 font-medium">Prefix</th>
+                  <th className="px-4 py-3 font-medium">Created</th>
+                  <th className="px-4 py-3 font-medium">Last used</th>
+                  <th className="px-4 py-3 font-medium" />
+                </tr>
+              </thead>
+              <tbody>
+                {keys.map((k) => (
+                  <tr
+                    key={k.id}
+                    className="border-b border-neutral-900 last:border-0 hover:bg-neutral-950 transition"
+                  >
+                    <td className="px-4 py-3 text-neutral-100">{k.name}</td>
+                    <td className="px-4 py-3 font-mono text-xs text-neutral-400">
+                      {k.prefix}…
+                      <CopyButton text={k.prefix} />
+                    </td>
+                    <td className="px-4 py-3 text-neutral-400 text-xs">{fmt(k.created_at)}</td>
+                    <td className="px-4 py-3 text-neutral-500 text-xs">
+                      {k.last_used_at ? fmt(k.last_used_at) : "Never"}
+                    </td>
+                    <td className="px-4 py-3 text-right">
+                      <button
+                        onClick={() => deleteKey(k.id)}
+                        className="inline-flex items-center gap-1 rounded p-1 text-neutral-600 hover:text-red-400 transition"
+                        title="Revoke"
+                      >
+                        <Trash2 size={14} />
+                      </button>
+                    </td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}

site/app/page.tsx

@@ -14,7 +14,7 @@ export default function Home() {
           <span className="inline-block h-2 w-2 rounded-full bg-emerald-400" />
           <span>self-heal</span>
           <span className="ml-2 rounded-md border border-neutral-800 px-1.5 py-0.5 text-xs text-neutral-500">
-            v0.4.0
+            v0.5.0
           </span>
         </div>
         <nav className="flex items-center gap-6 text-sm text-neutral-400">

src/self_heal/cli.py

@@ -156,8 +156,21 @@ def _cmd_heal(args) -> int:
     print(_format_diff(original_source, winning))
 
     if args.apply:
-        _apply_patch(src_path, fn_name, original_source, winning)
-        print(f"\nApplied patch to {src_path}.")
+        from self_heal._patch import PatchError, apply_function_patch, is_git_dirty
+
+        if is_git_dirty(src_path):
+            print(
+                f"error: {src_path} has uncommitted changes. "
+                "Commit or stash your changes before using --apply.",
+                file=sys.stderr,
+            )
+            return 1
+        try:
+            backup = apply_function_patch(src_path, fn_name, original_source, winning)
+        except PatchError as exc:
+            print(f"error: patch failed: {exc}", file=sys.stderr)
+            return 1
+        print(f"\nApplied patch to {src_path} (backup: {backup.name}).")
 
     return 0
 
@@ -274,38 +287,6 @@ def _format_diff(before: str, after: str) -> str:
     )
 
 
-def _apply_patch(
-    src_path: Path, fn_name: str, original_source: str, repaired_source: str
-) -> None:
-    """Replace the function definition in the file with the repaired source.
-
-    Naive text-based replacement. If the original source appears verbatim in
-    the file, we swap it for the repaired version. Otherwise we fall back to
-    appending the repaired function at the end.
-    """
-    text = src_path.read_text(encoding="utf-8")
-    if original_source in text:
-        new_text = text.replace(original_source, repaired_source, 1)
-    else:
-        # Dedent the original, try again.
-        dedented = _dedent(original_source)
-        if dedented and dedented in text:
-            new_text = text.replace(dedented, _dedent(repaired_source), 1)
-        else:
-            new_text = text.rstrip() + "\n\n\n# --- self-heal repaired ---\n" + repaired_source + "\n"
-            print(
-                f"warning: could not locate original {fn_name} in {src_path}; "
-                "appended repaired version at the end.",
-                file=sys.stderr,
-            )
-    src_path.write_text(new_text, encoding="utf-8")
-
-
-def _dedent(s: str) -> str:
-    import textwrap
-
-    return textwrap.dedent(s)
-
 
 if __name__ == "__main__":
     raise SystemExit(main())

src/self_heal/control_plane.py

@@ -128,6 +128,7 @@ def __init__(
         self._lock = threading.Lock()
         self._wake = threading.Event()
         self._stop = threading.Event()
+        self._auth_failed = threading.Event()
 
         self._client = httpx.Client(timeout=timeout)
         self._flusher = threading.Thread(
@@ -186,6 +187,8 @@ def close(self) -> None:
     # -- internals -------------------------------------------------------
 
     def _enqueue(self, wire: dict[str, Any]) -> None:
+        if self._auth_failed.is_set():
+            return
         with self._lock:
             if len(self._buffer) >= self._max_buffer:
                 # drop oldest to bound memory under sustained outage
@@ -229,14 +232,23 @@ def _post_with_retry(self, batch: list[dict[str, Any]]) -> bool:
                 resp = self._client.post(self._endpoint, headers=headers, json=payload)
                 if 200 <= resp.status_code < 300:
                     return True
-                if resp.status_code in (400, 401, 403, 422):
-                    # Non-retryable client error.
+                if resp.status_code in (401, 403):
+                    _log.error(
+                        "control plane authentication failed (%s): %s — "
+                        "all further events will be dropped until the client is "
+                        "recreated with a valid API key",
+                        resp.status_code,
+                        resp.text[:200],
+                    )
+                    self._auth_failed.set()
+                    return True  # drop this batch; future enqueues are blocked
+                if resp.status_code in (400, 422):
                     _log.warning(
                         "control plane rejected batch (%s): %s",
                         resp.status_code,
                         resp.text[:200],
                     )
-                    return True  # drop and move on
+                    return True  # drop malformed batch, move on
                 _log.warning(
                     "control plane %s on attempt %d", resp.status_code, attempt + 1
                 )

src/self_heal/events.py

@@ -4,9 +4,9 @@
 receives a `RepairEvent` on every significant step. Agent UIs can stream
 progress; observability backends can record metrics.
 
-Streaming (token-level) is deferred to v0.3. For now, events are
-discrete: attempt start, failure, propose start/complete, install,
-verify, success/failure.
+Token-level streaming is live: proposers that implement `propose_stream`
+or `apropose_stream` emit `propose_chunk` events for each delta. Falls
+back to discrete events if streaming is unavailable or raises.
 """
 
 from __future__ import annotations

src/self_heal/integrations/__init__.py

@@ -4,9 +4,9 @@
 `import self_heal`.
 
 Available integrations:
-- `self_heal.integrations.claude_agent_sdk` — healing_tool decorator
-  combining `@tool` (Claude Agent SDK) with `@repair` (self-heal).
+- `self_heal.integrations.claude_agent_sdk` — healing_tool for Claude Agent SDK
+- `self_heal.integrations.langgraph` — healing_tool for LangChain / LangGraph
+- `self_heal.integrations.openai_agents` — healing_tool for OpenAI Agents SDK
 
-More integrations (CrewAI, LangGraph) are roadmap items; see the
-`examples/` directory for the decorator-stacking pattern today.
+See `examples/` for CrewAI and other decorator-stacking patterns.
 """