Download Latest Version v1.3.3 - Scoped API keys, terminal-first onboarding source code.zip (15.7 MB) Google Add to Preferred Sources
Home / v1.3.0
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-10-15 10.1 kB
0
v1.3.0 - Native Jev decision spans source code.tar.gz 2026-10-15 14.0 MB
0
v1.3.0 - Native Jev decision spans source code.zip 2026-10-15 15.2 MB
0
Totals: 3 Items   29.2 MB 0

This release adds native support for TypeSafe's Jev: calls to the decision model arrive as DECISION spans, and model, tokens and cost flow through for them the same way they do for LLM spans. Detectors now screen traces on gpt-6-luna by default, every page sends a Content-Security-Policy, and API responses carry HSTS, nosniff and no-store headers. Dashboards and the trace list stop counting offline-evaluation traces as production traffic, and the main list pages keep their page, search and scroll state when you open a row and come back. The docs gain a Signals section, a TypeSafe AI integration page and refreshed screenshots.

New Features

  • DECISION spans with model and cost. Ingest recognizes openinference.span.kind=DECISION and reads the model and token counts from the decision.* attributes, so decision-model calls get model, tokens and cost like LLM calls instead of landing as plain spans (#2538). Detector judge calls record as DECISION too, so the same model shows under one kind (#2542), and the Default dashboard's by-model widgets count both kinds through a new in filter operator (#2552).
  • Detectors screen on gpt-6-luna by default. Detectors that don't pin a model now use gpt-6-luna instead of claude-haiku-4-5. When no OpenAI key resolves, unpinned detectors fall back to claude-haiku-5-5; digest summaries stay on claude-haiku-4-5 (#2556).
  • Content-Security-Policy on every page. Each request gets a fresh nonce, so the browser runs only scripts the app served. Violations are logged to the server, and a Permissions-Policy turns off camera, microphone and location. CSP_MODE=report-only reports without blocking, for trying a change out (#2528).
  • error_type in the SQL gateway. The spans_public_v1 view and the curated schema expose error_type, so the SQL vocabulary matches the trace-list filter and the widget builder (#2539).

Bug Fixes

  • Dashboards counted evaluation traces. KPI tiles, charts, metric alerts and the public widgets query API included offline-evaluation traces, so a window holding only eval runs showed non-zero cost next to "No traces in this time range". Every widget scan now applies the evaluation exclusion (#2498). The trace list, sessions, users and detector counts read flagged spans as well as flagged traces, so an evaluation trace whose trace row was merged away or never written stays hidden (#2499).
  • Edited or resumed alert rules left a page open in Slack. Resetting a rule discarded its open page without posting a close, so a continuing breach was announced again as a new incident. The reset now leaves a marker, and the next worker tick posts the "[OK]" close ahead of any new "[ALERT]" (#2532).
  • API responses missing security headers. /api/v1 responses from the REST service did not carry Strict-Transport-Security or X-Content-Type-Options, and /api routes had no Cache-Control. A REST middleware sets HSTS and nosniff on every response (#2535), and every /api route sends private, no-cache, no-store, max-age=0, must-revalidate (#2536).
  • Lists lost their place. Opening a run, dataset, detector or alert and going back dropped you on page 1 of the default window. Page and date range now live in the URL, and the breadcrumb links back to the exact list view (#2510, [#2511], [#2512], [#2513]). Search text is kept in the URL too, so the restored page applies to your results rather than the whole list (#2517). Changing page scrolls the list back to the top (#2563), and every main list uses the same pager, page-size control and "Showing X–Y of N" readout (#2565).
  • Migration 015 failed on EFS. CREATE OR REPLACE VIEW needs renameat2(), which EFS does not support, so the ClickHouse migrate hook failed on staging. The view is now redefined with DROP VIEW followed by CREATE VIEW, and a test forbids in-place replace for any later view migration (#2558).

Improvements

  • Docs. New Signals section (#2584); the Detectors section folded into one corrected page (#2585); the built-in agent is called the TraceRoot Agent throughout and the sidebar is reordered (#2586); refreshed screenshots across Tracing, TraceRoot Agent and Evaluations (#2583); a TypeSafe AI integration page (#2587); a complete Python SDK reference (#2442); AI agent write tools and approvals (#2464); the tracing quickstart exports env vars since the SDKs don't load .env (#2328).
  • Examples. Python examples require traceroot>=0.2.0 (#2397), the Pydantic AI example is validated against 2.54.0 (#2483), and the autogen example pins ag2<1.0 (#2566).
  • CI. Every external GitHub Action is pinned to a commit SHA (#2533).

Upgrade notes

  • Two migrations run on upgrade. ClickHouse 015 redefines spans_public_v1 to add error_type (#2539, [#2558]). The Postgres migration adds a nullable pending_close column on alerts; it rewrites no rows (#2532).
  • Detector model default. Unpinned detectors need an OpenAI key (OPENAI_API_KEY or a workspace key) to run on gpt-6-luna; without one they screen on claude-haiku-5-5. Detectors pinned to an OpenAI model still need the key. Signal grouping continues to run on OPENAI_API_KEY (#2556).
  • CSP. The policy is enforced by default. If a self-hosted deployment loads scripts or connects to hosts the app doesn't know about, set CSP_MODE=report-only and read the reports at /api/csp-report before switching back (#2528).

What's Changed

New Contributors

Full Changelog: https://github.com/traceroot-ai/traceroot/compare/v1.2.2...v1.3.0

Source: README.md, updated 2026-10-15