v0.5.0

Added

• --security focused report mode. Prints a security-focused report that leads with concrete failure classes and answers five questions from the existing analysis: whether the agent touched auth, secrets, access control, crypto, dependency config, CI, deployment, or tests; whether it disabled or skipped tests; whether it ran risky shell commands; whether it referenced files, paths, imports, or packages that do not exist; and which human correction should become a future eval or memory item. It reuses the same signals as the full analysis and does not run a separate scanner. The report prints to stdout and writes .treetrace/hallucinations.json, both gated through the redaction shadow scan.
• Deterministic hallucination detector. TreeTrace runs inside the repository, so it extracts the files, paths, imports, and packages the agent referenced in prompts and captured actions, then verifies them against the real working tree and package.json, package-lock.json, and Python manifests. References that do not resolve are flagged as likely hallucinations in two categories, hallucinated_file_or_path and hallucinated_import_or_package, and surfaced both in the security report and in .treetrace/hallucinations.json (mirroring the failures.json shape). Each one carries an eval candidate. File and path existence and import and package declaration are checked; per-symbol and per-API resolution inside a module is not attempted, and the tool says so. Files the agent created during the session, Node builtins, and Python standard library modules are excluded to avoid false positives. Relative paths inside the project (./ and bare) are resolved and verified; absolute paths and ../ references that fall outside the project directory are treated as out of scope and are never stat checked, so detection never reveals host filesystem state outside the project.
• Read-only MCP server. treetrace mcp (or treetrace --mcp) starts a Model Context Protocol server over stdio using JSON-RPC 2.0, hand-rolled with no dependencies. It implements initialize, tools/list, and tools/call, and exposes four read-only tools that reuse existing functionality: handoff, lessons, security_summary, and eval_candidates. No tool mutates files, runs shell, hits the network, or requires authentication. Every returned text passes the same redaction shadow scan as the file exports. Tools take no arguments and reject extra arguments; point the server at a project with --dir or import with --file (the JSON-RPC transport owns stdin, so --stdin is not available in MCP mode).

Security

• Redaction now catches generic secret assignments written in JSON style ("api_key":"..."), single-quoted keys, backtick values, and multiline quoted values, and treats a generic secret-key assignment as a finding even when the value has low entropy. Over-redaction is the safe side for a privacy tool. These shapes previously reached written artifacts even under --redact-auto.
• A prior keep decision in .treetrace/redactions.json is no longer honored for high or medium findings under --redact-auto, non-interactive (non-TTY) runs, or the MCP server. A keep is only honored inside an interactive terminal session, so a preseeded redactions file in an untrusted repository can no longer cause a raw secret to be emitted.
• The hallucination detector and MCP security_summary no longer stat absolute paths or ../ references outside the project directory, removing a filesystem existence oracle.
• Claude session auto-discovery validates each session's recorded cwd against the target directory, so a different project whose path munges to the same storage directory name is no longer read.
• Redaction now catches generic secret assignments whose quoted value contains escaped characters, such as the serialized JSON form {"api_key":"line1\nline2"} with a literal backslash, an escaped quote, an escaped tab, or an escaped backslash. Serialized JSON is a common way for multiline and escaped secret values to appear in transcripts, and these shapes previously reached written artifacts even under --redact-auto.
• The high-entropy fallback now catches a long secret made only of lowercase letters and digits (no uppercase), such as a bare token pasted in prose. The previous rule required all three character classes, so a high-entropy lowercase-and-digit token could reach a written artifact; the entropy threshold still keeps ordinary identifiers, UUIDs, and paths from being flagged.

Fixed

• The hallucination detector flags an Edit or NotebookEdit to a file that does not exist in the working tree (only Write, or an edit to a file that exists, counts as created), and resolves relative (./, bare) missing paths that were previously skipped.
• Risky-command detection covers rm -fr, rm -r -f, chmod -R 777, chmod 0777, curl | sudo bash, curl | zsh, bash <(curl ...), DROP SCHEMA, and bare TRUNCATE. Test-disable detection covers test.skip, describe.skip, it.skip, xit, and similar framework skip and removal idioms.
• Value-taking options (--from, --dir, --out, --report-file, --since) reject a missing value or a value that begins with --, so a typo no longer writes a file named after a flag. --since requires a real date and applies only to timestamped sessions. --stdin --from claude is rejected with a clear message.
• --handoff persists redaction decisions to .treetrace/redactions.json when any were made.
• The hallucination detector no longer reports ordinary dotted code symbols such as JSON.parse, params.name, test.skip, and describe.skip as missing file paths. A dotted token with no slash is only treated as a file reference when its extension is a known file extension, so member expressions are left alone while genuine paths such as src/missing.ts are still flagged.
• The hallucination detector now recognizes common extensionless file references, including Dockerfile, Makefile, README, .env, and slash-containing local paths such as src/route. Known filename words are only flagged when a file-operation verb is nearby, which keeps prose mentions from becoming false positives.
• The hallucination detector no longer reports process.env as a missing file. A bare name.env token with no slash is treated as a member expression, while genuine .env files and path/to/file.env references are still resolved.
• A relative require('./x') or dynamic import('./x') is no longer reported as a missing import named .. Relative and local module specifiers are skipped before the package root is taken, and a genuinely missing relative file is still flagged as a file reference.