Send the API key header, fix the ElevenLabs monitor command, add end and watch, release 0.0.2

[buildbyjithu]

Aligns the client with the agent endpoints that land in deeptrust-ai/deeptrust #3658 and adds the two calls the hosted "Connect ElevenLabs" path needs. Bumps to 0.0.2.

What changed

• The key is sent as X-DeepTrust-Api-Key, which is the header require_agent_api_key reads. The bearer form is still sent for one release and goes away in 0.1.
• Default base URL is https://app.deeptrust.ai/api/v1. A DEEPTRUST_BASE_URL from 0.0.1 ending in /api needs /v1 appended.
• Error envelopes: FastAPI nests a coded refusal under detail, so code, needed and scopes are now read from either the top level or detail. EntitlementError and ScopeError fire on the real 403 shapes.
• ElevenLabs adapter: contextual updates go out in the monitor socket's command envelope (command_type + parameters.contextual_update). 0.0.1 sent the main-socket {"type": ...} shape, which the monitor socket ignores, so nudges never arrived.
• Session.end() posts to /agents/sessions/{id}/end so post-call processing starts now rather than after the inactivity timeout.
• DeepTrust.watch(conversation_id, platform="elevenlabs") posts to /agents/conversations/{id}/watch, handing a live conversation to the hosted monitor for an org that connected its workspace in the dashboard.
• Local dev server gained the two endpoints. The ElevenLabs example gained a handoff command. README presents Connect as the no-code option and Monitor as the self-hosted one.

Tests

just check is clean: ruff, mypy strict, 28 tests. New tests pin the header, the base URL, both nested error shapes, end idempotence, watch results, and a fake monitor socket asserting the command envelope is sent once per nudge.

Merge order

After deeptrust-ai/deeptrust #3658 (the analyze, end and watch routes) is on dev. Until then the default base URL points at routes that do not exist yet.

🤖 Generated with Claude Code

Rebased onto main (2026-09-10)

Main landed 0aef103, which already made two of the changes this PR opened with: the /api/v1 base URL and sending the key as X-DeepTrust-Api-Key. Both conflicts resolved in favour of main, so this PR no longer touches either.

One deliberate change of mind: this branch originally kept Authorization: Bearer alongside the new header for one release. Main removed it, with the reasoning that the API tells a key-authenticated request from a session-authenticated one by which header carried the credential, and sending both makes a key look like a user's token at the edge. That is the better call and the backend reads the dedicated header first anyway, so the bearer form is gone and test_key_travels_in_the_api_key_header now asserts authorization is absent.

What remains in this PR and is not on main: nested detail parsing in _read_error, the command_type envelope for the ElevenLabs monitor socket, Session.end(), DeepTrust.watch(), the dev server endpoints behind them, the handoff example command, the README, and the 0.0.2 bump.

Local: ruff check, ruff format --check, mypy and 28 tests all pass on src and tests, matching CI.

[devin-ai-integration]

🔍 Devin Review: 1 bug

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)