Skip to content

Docs/UI screenshots v0.3.0 - #34

Merged
kjgpta merged 3 commits into
mainfrom
docs/ui-screenshots-v0.3.0
Jun 25, 2026
Merged

Docs/UI screenshots v0.3.0#34
kjgpta merged 3 commits into
mainfrom
docs/ui-screenshots-v0.3.0

Conversation

@kjgpta

@kjgpta kjgpta commented Jun 25, 2026

Copy link
Copy Markdown
Owner

Summary

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing behaviour to change)
  • Documentation only
  • Internal / refactor (no user-visible change)

Related issues

Test plan

  • python -m py_compile passes on every modified Python file
  • ruff check src/ tests/ tools/ is clean
  • Targeted test passes: pytest tests/test_<your_module>.py
  • Full suite passes: pytest tests/ --ignore=tests/stress
  • No new ResourceWarning during tests (no leaked DB connections / async tasks)
  • Manual smoke test against an example, if user-facing

Public-API changes

  • New: …
  • Changed: …
  • Removed: …

Screenshots / output

Checklist

  • I have read CONTRIBUTING.md
  • I have updated docs/changelog.md under the next unreleased version
  • I have updated docs in docs/ if user-visible behaviour changed
  • My commits follow the project's convention

Security policy

Supported versions

tracesage is currently in v0.1 alpha. Only the latest minor release receives
security fixes. Once v1.0 ships, the previous minor will receive fixes for
6 months after the next release.

Version Supported
0.1.x yes (alpha)
< 0.1 no

Reporting a vulnerability

Please do not open a public issue for security reports.

Use GitHub's Private Vulnerability Reporting
to send a confidential report. If that is unavailable, email
kjgpta+tracesage-security@users.noreply.github.com with:

  • A description of the issue and its impact
  • Steps to reproduce (a minimal proof-of-concept is ideal)
  • Affected versions, if known
  • Your suggested mitigation, if any

Response timeline

  • Acknowledgement within 3 business days
  • Initial assessment (severity + scope) within 7 business days
  • Fix or mitigation for high-severity issues within 30 days; lower-severity
    issues are scheduled into the next release
  • Public disclosure coordinated with the reporter; CVE assigned if
    applicable

Scope

In-scope:

  • The tracesage Python package itself (src/tracesage/)
  • The embedded server (FastAPI app, REST + WebSocket endpoints)
  • The on-disk storage format (SQLite + gzipped blobs)
  • The CLI (tracesage command)
  • Authentication and authorization paths

Out of scope:

  • Third-party dependencies — please report to the upstream project. We will
    upgrade once a fix is available.
  • LangChain / LangGraph behaviour itself — only the tracesage adapter is in scope.
  • Local-only attacks where the attacker already has shell access to the host.

Hardening recommendations

If you operate tracesage in production, please review
docs/production.md
which covers:

  • The hard fail-stop on non-loopback binding without auth_token
  • Constant-time bearer-token comparison
  • Path-traversal guards on blob reads
  • Sampling and per-run event caps as denial-of-service mitigations

kshitijgupta-ops and others added 3 commits June 25, 2026 16:39
For the official demo: run before.py first to show the pain of debugging an MCP
agent with zero observability (silent run, then just a final travel brief — no
tool log, no per-server attribution, no token counts, no timeline), then run
demo.py to show tracesage answering all of it.

before.py is byte-for-byte identical to demo.py in agent, query, MCP client, and
LLM — the only difference is the five lines of tracesage demo.py adds, so
`diff before.py demo.py` shows the exact integration. It loads .env and preflights
the LLM key the same way, and ends by listing what you DON'T get without tracing.

Also refreshed the trip_demo README: documents the before/after pair, fixes the
stale per-server tool counts (2 → 7 each; 21 MCP + 1 local), and adds the LLM
token-usage drawer to the "what tracesage shows" table.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…e count

Replaced the specific "two lines / five lines" integration claims with
"minimal change" phrasing across the README, docs (index, comparison, changelog),
and the MCP demo READMEs/scripts. The integration is a couple of imports, the
setup calls, and a callbacks= kwarg — counting it as "2" undersold the imports
and "5" felt arbitrary; "minimal, mechanical change, no agent rewrite" is both
accurate and doesn't pin a number.

Kept the inline labels in the gmail demo's code block (# two imports / # two setup
lines) since those annotate the actual lines shown, not a marketing count.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The README listed only 8 of the 13 CLI commands as a flat code block, missing the
ones that matter most for a demo: `demo` (zero-code "see it working"), and the
terminal-native `show` / `watch` / `diff` / `view`.

Rewrote it from docs/cli.md into a `demo` quick-start callout plus three grouped
tables — inspect in the browser (serve, view), inspect in the terminal (runs,
show, watch, diff, stats), and move/retain/diagnose (export, import, gc, doctor,
version) — each with its key flags. Verified every command and flag cited
(--auth-token, --max-blob-size-gb, --dry-run, --once, --tag, --all, --open)
against `tracesage --help`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@kjgpta
kjgpta merged commit 16b378c into main Jun 25, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants