● Zion Boggan
repos/TreeTrace/commits/a41d343
zionboggan.com ↗
Code Commits Tags

Release 0.9.1: finalize audit-fix release

Bump version to 0.9.1, since npm 0.9.0 is already published with the
pre-fix code and is immutable. Relabel the CHANGELOG audit-fix entry to
0.9.1, update the README signal-coverage matrix and examples labels to
v0.9.1, and regenerate the checked-in examples at 0.9.1.
a41d343   Zion Boggan committed on Jun 19, 2026 (3 days ago)
CHANGELOG.md +10 -5
@@ -2,21 +2,26 @@
Notable changes to TreeTrace. The format follows Keep a Changelog, and the project uses semantic versioning.
-## 0.9.0 - 2026-06-19
+## 0.9.1 - 2026-06-19
### Added
- `tree.json` now exports token totals (aggregate stats and per-session), a per-turn `model` field on each node, and a per-node `actions` array (tool invocations, file paths, and Bash commands). Claims in the README about token usage, model-per-turn, and tool/file capture now reflect what the schema exports.
+- Bash-command file paths are now counted in `filesTouched`.
### Changed
-- Redaction and detection hardened in this release cycle (see 0.8.x entries for detail).
-- Examples regenerated for v0.9.0; footers and `.treetrace/redactions.json` reflect the current schema version.
+- Hallucination detection no longer flags prose `word/word` fragments as missing file paths, and now checks the structured `action.file` path for Write, Edit, and NotebookEdit actions.
+- Analysis adds an inferred-tier recall backstop so strongly worded uncorroborated frustration, scope-drift, and overbuilt-solution turns still surface a signal.
+- The `bearer` redaction rule is now case-insensitive, and `--redact-auto` resolves residual high-entropy shadow-scan hits instead of failing closed; the interactive fail-closed path is unchanged.
+- The combined report counts the full set of models seen and lists correction chains.
+- Examples regenerated for v0.9.1.
### Documentation
-- Signal-coverage matrix version label updated from v0.8.1 to v0.9.0.
-- Terminal output modes (`--graph`, `--full`, `--summary`) documented as early-return modes that do not compose with `--report` or `--analysis`.
+- `SCHEMA.md` documents the new token, model, and action fields and the `hallucinations.json` shape.
+- Signal-coverage matrix version label updated from v0.8.1 to v0.9.1.
+- Terminal output modes (`--graph`, `--full`, `--summary`) documented as early-return modes that do not compose with `--report` or `--analysis`, and the CLI now prints a notice when other output flags are skipped because a graph mode is set.
## 0.8.1 - 2026-06-19
README.md +2 -2
@@ -110,7 +110,7 @@ TreeTrace reads coding and CLI agent sessions (Claude Code, Codex, Cursor, Copil
### Signal coverage by adapter
-Signal coverage depends on what each tool exports. The matrix below reflects the actual source code (v0.9.0); cells marked `--` are confirmed absent.
+Signal coverage depends on what each tool exports. The matrix below reflects the actual source code (v0.9.1); cells marked `--` are confirmed absent.
| Signal | Claude Code | ChatGPT | Codex | Cursor | Copilot | Gemini | Grok |
|---|:---:|:---:|:---:|:---:|:---:|:---:|:---:|
@@ -321,7 +321,7 @@ Verified means the adapter was validated against real session or real published
## Examples
-See [examples/](examples/) for generated artifacts produced by running the CLI with no hand-editing. The checked-in examples are versioned snapshots regenerated for v0.9.0; footers, `.treetrace/redactions.json`, and any schema fields introduced since the previous version reflect the current release.
+See [examples/](examples/) for generated artifacts produced by running the CLI with no hand-editing. The checked-in examples are versioned snapshots regenerated for v0.9.1; footers and any schema fields introduced since the previous version reflect the current release.
- [examples/weather-dashboard](examples/weather-dashboard) shows lineage and the redaction gate on a clean session.
- [examples/api-key-auth](examples/api-key-auth) shows the [`--security` report](examples/api-key-auth/SECURITY_REPORT.md), [rejection capture](examples/api-key-auth/.treetrace/rejections.json), and [hallucination detection](examples/api-key-auth/.treetrace/hallucinations.json) lighting up on a session that touches auth, hardcodes a secret, skips tests, force-pushes, references a missing file, and imports an undeclared package.
examples/api-key-auth/.treetrace/failures.json +1 -1
@@ -2,7 +2,7 @@
"schemaVersion": "0.3",
"project": {
"name": "api-key-auth",
- "generatedAt": "2026-06-19T06:41:31.989Z"
+ "generatedAt": "2026-06-19T06:50:12.466Z"
},
"summary": {
"totalFailureSignals": 5,
examples/api-key-auth/.treetrace/hallucinations.json +1 -1
@@ -2,7 +2,7 @@
"schemaVersion": "0.3",
"project": {
"name": "api-key-auth",
- "generatedAt": "2026-06-19T06:41:32.339Z"
+ "generatedAt": "2026-06-19T06:50:12.730Z"
},
"verifiedAgainstWorkingTree": true,
"manifestSeen": true,
examples/api-key-auth/.treetrace/rejections.json +1 -1
@@ -2,7 +2,7 @@
"schemaVersion": "0.3",
"project": {
"name": "api-key-auth",
- "generatedAt": "2026-06-19T06:41:31.989Z"
+ "generatedAt": "2026-06-19T06:50:12.466Z"
},
"summary": {
"total": 1,
examples/api-key-auth/.treetrace/tree.json +2 -2
@@ -2,12 +2,12 @@
"schemaVersion": "0.3",
"generator": {
"name": "treetrace",
- "version": "0.9.0",
+ "version": "0.9.1",
"url": "https://github.com/TreeTraceTool/TreeTrace"
},
"project": {
"name": "api-key-auth",
- "generatedAt": "2026-06-19T06:41:31.989Z",
+ "generatedAt": "2026-06-19T06:50:12.466Z",
"sourceType": "claude-code-jsonl"
},
"stats": {
examples/api-key-auth/PROMPT_TREE.md +1 -1
@@ -38,4 +38,4 @@
---
-*[treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.0 · [schema](https://github.com/TreeTraceTool/TreeTrace/blob/main/SCHEMA.md)*
+*[treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.1 · [schema](https://github.com/TreeTraceTool/TreeTrace/blob/main/SCHEMA.md)*
examples/api-key-auth/SECURITY_REPORT.md +2 -2
@@ -1,6 +1,6 @@
# TreeTrace Security Report - api-key-auth
-Generated: 2026-06-19T06:41:32.339Z
+Generated: 2026-06-19T06:50:12.730Z
## Surfaces touched
@@ -32,4 +32,4 @@ Generated: 2026-06-19T06:41:32.339Z
---
-Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.0.
+Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.1.
examples/api-key-auth/TREETRACE_REPORT.md +2 -2
@@ -1,6 +1,6 @@
# TreeTrace Report - api-key-auth
-Generated: 2026-06-19T06:41:31.989Z
+Generated: 2026-06-19T06:50:12.466Z
## Session summary
@@ -63,4 +63,4 @@ Typed rejection / refusal / decline events captured on the session. Each one is
See: `PROMPT_TREE.md` · `.treetrace/lessons.md` · `.treetrace/agent-memory.md` · handoff: run `treetrace --handoff`
---
-Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.0.
+Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.1.
examples/rejections/.treetrace/failures.json +1 -1
@@ -2,7 +2,7 @@
"schemaVersion": "0.3",
"project": {
"name": "rejections",
- "generatedAt": "2026-06-19T06:41:32.578Z"
+ "generatedAt": "2026-06-19T06:50:12.990Z"
},
"summary": {
"totalFailureSignals": 9,
examples/rejections/.treetrace/hallucinations.json +1 -1
@@ -2,7 +2,7 @@
"schemaVersion": "0.3",
"project": {
"name": "rejections",
- "generatedAt": "2026-06-19T06:41:32.880Z"
+ "generatedAt": "2026-06-19T06:50:13.492Z"
},
"verifiedAgainstWorkingTree": true,
"manifestSeen": false,
examples/rejections/.treetrace/rejections.json +1 -1
@@ -2,7 +2,7 @@
"schemaVersion": "0.3",
"project": {
"name": "rejections",
- "generatedAt": "2026-06-19T06:41:32.578Z"
+ "generatedAt": "2026-06-19T06:50:12.990Z"
},
"summary": {
"total": 7,
examples/rejections/.treetrace/tree.json +2 -2
@@ -2,12 +2,12 @@
"schemaVersion": "0.3",
"generator": {
"name": "treetrace",
- "version": "0.9.0",
+ "version": "0.9.1",
"url": "https://github.com/TreeTraceTool/TreeTrace"
},
"project": {
"name": "rejections",
- "generatedAt": "2026-06-19T06:41:32.578Z",
+ "generatedAt": "2026-06-19T06:50:12.990Z",
"sourceType": "claude-code-jsonl"
},
"stats": {
examples/rejections/PROMPT_TREE.md +1 -1
@@ -27,4 +27,4 @@
---
-*[treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.0 · [schema](https://github.com/TreeTraceTool/TreeTrace/blob/main/SCHEMA.md)*
+*[treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.1 · [schema](https://github.com/TreeTraceTool/TreeTrace/blob/main/SCHEMA.md)*
examples/rejections/SECURITY_REPORT.md +2 -2
@@ -1,6 +1,6 @@
# TreeTrace Security Report - rejections
-Generated: 2026-06-19T06:41:32.880Z
+Generated: 2026-06-19T06:50:13.492Z
## Surfaces touched
@@ -31,4 +31,4 @@ None detected.
---
-Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.0.
+Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.1.
examples/rejections/TREETRACE_REPORT.md +2 -2
@@ -1,6 +1,6 @@
# TreeTrace Report - rejections
-Generated: 2026-06-19T06:41:32.578Z
+Generated: 2026-06-19T06:50:12.990Z
## Session summary
@@ -73,4 +73,4 @@ Typed rejection / refusal / decline events captured on the session. Each one is
See: `PROMPT_TREE.md` · `.treetrace/lessons.md` · `.treetrace/agent-memory.md` · handoff: run `treetrace --handoff`
---
-Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.0.
+Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.1.
examples/weather-dashboard/.treetrace/failures.json +1 -1
@@ -2,7 +2,7 @@
"schemaVersion": "0.3",
"project": {
"name": "weather-dashboard",
- "generatedAt": "2026-06-19T06:41:31.432Z"
+ "generatedAt": "2026-06-19T06:50:11.984Z"
},
"summary": {
"totalFailureSignals": 2,
examples/weather-dashboard/.treetrace/hallucinations.json +1 -1
@@ -2,7 +2,7 @@
"schemaVersion": "0.3",
"project": {
"name": "weather-dashboard",
- "generatedAt": "2026-06-19T06:41:31.730Z"
+ "generatedAt": "2026-06-19T06:50:12.249Z"
},
"verifiedAgainstWorkingTree": true,
"manifestSeen": false,
examples/weather-dashboard/.treetrace/rejections.json +1 -1
@@ -2,7 +2,7 @@
"schemaVersion": "0.3",
"project": {
"name": "weather-dashboard",
- "generatedAt": "2026-06-19T06:41:31.432Z"
+ "generatedAt": "2026-06-19T06:50:11.984Z"
},
"summary": {
"total": 2,
examples/weather-dashboard/.treetrace/tree.json +2 -2
@@ -2,12 +2,12 @@
"schemaVersion": "0.3",
"generator": {
"name": "treetrace",
- "version": "0.9.0",
+ "version": "0.9.1",
"url": "https://github.com/TreeTraceTool/TreeTrace"
},
"project": {
"name": "weather-dashboard",
- "generatedAt": "2026-06-19T06:41:31.432Z",
+ "generatedAt": "2026-06-19T06:50:11.984Z",
"sourceType": "claude-code-jsonl"
},
"stats": {
examples/weather-dashboard/PROMPT_TREE.md +1 -1
@@ -38,4 +38,4 @@
---
-*[treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.0 · [schema](https://github.com/TreeTraceTool/TreeTrace/blob/main/SCHEMA.md)*
+*[treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.1 · [schema](https://github.com/TreeTraceTool/TreeTrace/blob/main/SCHEMA.md)*
examples/weather-dashboard/SECURITY_REPORT.md +2 -2
@@ -1,9 +1,9 @@
# TreeTrace Security Report - weather-dashboard
-Generated: 2026-06-19T06:41:31.730Z
+Generated: 2026-06-19T06:50:12.249Z
None detected.
---
-Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.0.
+Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.1.
examples/weather-dashboard/TREETRACE_REPORT.md +2 -2
@@ -1,6 +1,6 @@
# TreeTrace Report - weather-dashboard
-Generated: 2026-06-19T06:41:31.432Z
+Generated: 2026-06-19T06:50:11.984Z
## Session summary
@@ -53,4 +53,4 @@ Typed rejection / refusal / decline events captured on the session. Each one is
See: `PROMPT_TREE.md` · `.treetrace/lessons.md` · `.treetrace/agent-memory.md` · handoff: run `treetrace --handoff`
---
-Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.0.
+Generated by [treetrace](https://github.com/TreeTraceTool/TreeTrace) v0.9.1.
package.json +1 -1
@@ -1,6 +1,6 @@
{
"name": "treetrace",
- "version": "0.9.0",
+ "version": "0.9.1",
"description": "Prompt-lineage visibility for coding & CLI agent sessions. Turns a raw session into a structured, local record of every correction, refusal, token, and tool - for audit, training data, and token efficiency.",
"keywords": [
"claude-code",