Download Latest Version v1.3.3 - Scoped API keys, terminal-first onboarding source code.zip (15.7 MB) Google Add to Preferred Sources
Home / v1.3.3
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-10-26 11.9 kB
0
v1.3.3 - Scoped API keys, terminal-first onboarding source code.tar.gz 2026-10-26 14.4 MB
0
v1.3.3 - Scoped API keys, terminal-first onboarding source code.zip 2026-10-26 15.7 MB
0
Totals: 3 Items   30.1 MB 0

This release scopes project API keys so the credential an application carries to send telemetry can no longer manage keys, and serves key management on the public API base URL. Sign-up has been rebuilt around the terminal: the onboarding flow creates the workspace before approving the device, hands back to traceroot setup, and waits for the first trace. Spans can carry a cost the app reports and a marker that the app redacted them, the SQL gateway accepts BETWEEN and = on time columns, and make prod-lite generates every secret the prod compose file requires.

New Features

  • Scoped API keys. Every access key now has a scope: ingest sends telemetry, reads project data and reports evaluation runs; admin is everything the project allows, including key management. Existing keys were backfilled as admin so no live credential was narrowed; every new key is ingest unless minted as admin (#2424). The public API enforces the scope on its key-management routes rather than forwarding and relying on the control plane's refusal (#2616), and whoami reports key_scope so a tool can tell what a key may do before writing it into an env file (#2617).
  • Key management on the public API. GET/POST /api/v1/public/api-keys and DELETE .../api-keys/{key_id} are served on the same base URL as the rest of the public API, with every error arriving as {"detail": ...}. A key minted here is always ingest (#2425). A project's first key is minted on the signed-in user's credential, so traceroot setup can bootstrap a project that has no key yet, and can revoke it if setup fails afterwards (#2426).
  • Terminal-first onboarding. Sign-up hands off to onboarding, which creates the workspace and project before the device page approves the terminal, so the CLI never holds a session for an account that owns nothing (#2567). The browser flow ends on a hand-back page carrying the traceroot setup command, waits for the project's first trace and opens it when it lands (#2596, [#2630]). Onboarding renders without the app shell (#2595), an interrupted sign-up is finishable without leaving a duplicate workspace (#2597), and a signed-out visitor keeps the terminal callback through sign-in (#2615, [#2638]).
  • One-command getting started. The empty traces page leads with traceroot setup filled in for the project (#2427). The manual path asks for the stack and a model provider key once, above the walkthrough, and the chosen stack drives the install command, snippet, docs link and key field (#2598, [#2634], [#2635], [#2637]).
  • Caller-reported LLM cost. A valid OpenInference llm.cost.total attribute replaces TraceRoot's list-price cost for that span; tokens are still recorded, and the cost breakdown is hidden when it no longer adds up to the stored total (#2724, [#2725]).
  • Redacted-span marker. Ingest preserves traceroot.redacted, and the trace view shows a "Redacted by your app" chip on spans the SDK's redact function ran on. The data-capture docs describe what redact receives and what is held back (#2706, [#2707], [#2735]).

Bug Fixes

  • make prod-lite could not start. A fresh .env left SQL_GATEWAY_BOOTSTRAP_PASSWORD, BETTER_AUTH_SECRET and INTERNAL_API_SECRET empty, and compose aborts on an empty required variable before the first container starts. A new env-secrets target generates each one that is missing (#2559).
  • SQL gateway refused equivalent time filters. BETWEEN and = on a time column were refused even though the >=/<= spelling ran. They now expand to the same pair of comparisons and produce the same view call, and the refusal states the rule it enforces (#2286).
  • Lists repeated or skipped rows on tied timestamps. Sessions, users and detector runs ordered by time alone; each now breaks ties by its ID (#2683).
  • Tiny alert thresholds showed as $0. Assistant alert cards formatted with three fractional digits. Sub-dollar currency values now keep three significant digits, so $0.0004 reads as such (#2648).
  • Campaign attribution was lost at Cloud sign-up. A host-only campaign cookie now survives the sign-in redirect and is cleared after identification, so the sign-up event records where the user came from (#2555).
  • CLI installs warned on Node 20 and 22. @traceroot-ai/tools declared node >=24 though it runs on 20.3; the engines floor is back to >=20.3 and ships with the next tools release (#2745).
  • BYOK model catalogs were stale. The Model Providers dropdowns add 20 IDs and drop 6 across eight providers, and the BYOK docs match (#2653).

Improvements

  • Dependencies. Next 16.4.1, plus certifi, virtualenv, follow-redirects, hono, vite, vitest, ip-address, dompurify, undici, zod, nodemailer and opentelemetry-api bumped for security advisories (#2696, [#2703], [#2726], [#2730], [#2747]).
  • Docs and examples. The agent-eval examples move to current models (#2668); the READMEs put setup before getting started and link the website (#2739, [#2553]); the contributing guide asks contributors to check in before starting on an assigned issue (#2712).

Upgrade notes

  • Two migrations run on upgrade. The first adds scope VARCHAR NOT NULL DEFAULT 'admin' to access_keys, backfilling every existing key as admin. The second flips the default to ingest, so any later insert that names no scope gets the safe scope (#2424).
  • Audit your existing keys. Every key minted before this release is admin. Keys that only send telemetry should be re-minted as ingest and rotated into the application's env files.
  • SQL_GATEWAY_BOOTSTRAP_PASSWORD is now uncommented in .env.example and required by the prod compose file. make prod-lite generates it when empty; other deployments must set it (#2559).
  • The onboarding and getting-started screens print npx -y traceroot-cli@0.6.0 setup. traceroot-cli 0.6.0 is published on npm, and the setup command first appears in that release; a self-hosted deployment pinned to an older CLI should upgrade it (#2630, [#2427]).

What's Changed

New Contributors

Full Changelog: https://github.com/traceroot-ai/traceroot/compare/v1.3.2...v1.3.3

Source: README.md, updated 2026-10-26