jwuthri-cloud/Tracely-ai

Review signals: 1 hardcoded secret, 199 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Gitleaks found a possible hardcoded secret; value withheld. guides/DEPLOY.md

OSV reports a known vulnerability in this dependency version. 33 distinct locations. 198 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Only 200 of 398 findings are stored; the summary counts all of them.

Full safety evidence →

• Self-host using Docker Compose: docker command failed: /bin/bash: line 1: docker: command not found

  Source: **Prerequisites:** Docker + Docker Compose.

  Input: docker compose --profile demo up -d --build --wait

  Expected: application starts

  Observed: docker command failed: /bin/bash: line 1: docker: command not found

Examples

• Install core SDK and inspect documented CLI: command completed successfully

  Source: sdk/README.md · installation

  Input: pip install tracelyai-sdk

  Expected: tracely CLI available

  Command: /tmp/tracely-venv/bin/tracely --help

  Observed: usage: tracely [-h] {gate,replay,simulate,export} ... Tracely CI/CD gate positional arguments: {gate,replay,simulate,export} gate gate a PR on pre-emitted ci traces (matched by input) replay re-run the agent on each promoted case, then gate the PR simulate drive agents' scenarios against their endpoints, then gate the PR export dump the workspace's conversations as NDJSON options: -h, --help show this help message and exit

• Start full demo stack: docker compose --profile demo up -d --build --wait failed: /bin/bash: line 1: docker: command not found

  Source: README.md · Quickstart

  Expected: documented command completes successfully

  Observed: docker compose --profile demo up -d --build --wait failed: /bin/bash: line 1: docker: command not found

Local or hosted: both

Export workspace conversations with tracely export

pwd && id -u && rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'requirements*.txt' -g 'uv.lock' -g 'Makefile' | head -80
find . -maxdepth 3 -type f | sort | head -100; cat README.md
python3 --version; python3 -m pip --version; command -v docker || true; command -v uv || true; command -v node || true; cat Makefile | head -120; git status --short
command -v docker || true; uv --version; node --version; npm --version; sudo -n true;
sed -n '1,220p' sdk/README.md; find . -maxdepth 2 -type f -name 'pyproject.toml' -o -name 'compose.y*'
docker compose --profile demo up -d --build --wait
python3 -m pip install --user 'tracelyai-sdk'
python3 -m venv /tmp/tracely-venv
 /tmp/tracely-venv/bin/python -m pip install tracelyai-sdk
mkdir -p .coldpass; git init -q; git remote add origin https://github.com/jwuthri-cloud/Tracely-ai; git fetch --depth 1 origin 128a5d806704ca88fca03dff0a0215c8a557b779 && git reset --mixed FETCH_HEAD
rg='' ; /tmp/tracely-venv/bin/tracely --help
rg=''; rg --files 2>/dev/null | head -1; /tmp/tracely-venv/bin/tracely export --help
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/tmp/tracely-venv/bin/tracely","export","--out","<guest-path>","--api","http://localhost:8000","--key","tracely_dev_key"],"cwd":"/tmp","env":{},"expected_returncode":1,"expected_text":"Connection refused"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The CLI exports workspace conversations as NDJSON.","source":"The `tracely` CLI — `tracely simulate`, `tracely gate` and `tracely replay`, which turn an agent's behaviour into a pull-request check (exit 0/1 + GitHub status/comment).","input":"empty local workspace","expected":"NDJSON export","probe_kind":"cli","argv":["/tmp/tracely-venv/bin/tracely","export","--out","<guest-path>","--api","http://localhost:8000","--key","tracely_dev_key"],"cwd":"/tmp","expected_returncode":1,"expected_text":"Connection refused"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Install core SDK and inspect documented CLI","source":"sdk/README.md · installation","input":"pip install tracelyai-sdk","expected":"tracely CLI available","argv":["/tmp/tracely-venv/bin/tracely","--help"],"cwd":"/tmp","expected_text":"simulate"},{"kind":"example","claim":"Start full demo stack","source":"README.md · Quickstart","reason":"docker compose --profile demo up -d --build --wait failed: /bin/bash: line 1: docker: command not found"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README, Makefile and documented gate/replay/simulate CLI; no product scheduler cycle is documented. Operation is driven on demand by API/CLI.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 - <<'PY'
p='.coldpass/claims.json'
s=open(p).read().replace('"source":"The `tracely` CLI — `tracely simulate`, `tracely gate` and `tracely replay`, which turn an agent\'s behaviour into a pull-request check (exit 0/1 + GitHub status/comment)."','"source":"The core depends only on `opentelemetry-sdk` + the OTLP HTTP exporter (Python ≥ 3.10); a provider extra adds that provider\'s auto-instrumentor."')
open(p,'w').write(s)
PY

cat > .coldpass/report.json <<'EOF'
{"outcome":"blocked","fault_owner":"prerequisite","operation":"Export workspace conversations with tracely export","operation_scope":"Installed documented tracelyai-sdk CLI in Python 3.12 venv; full product needs Docker Compose stack.","steps":["Read README and sdk/README.md","Installed tracelyai-sdk in /tmp/tracely-venv","Ran tracely --help","Attempted docker compose --profile demo up -d --build --wait"],"deviations":["python3 -m pip install --user tracelyai-sdk failed with externally-managed-environment; venv install succeeded.","Docker command failed: /bin/bash: line 1: docker: command not found."],"stuck_step":"Start the documented Docker demo stack","main_blocker":"Docker is missing from the disposable guest and sudo is unavailable.","plain_failure":"The Tracely application cannot be started because Docker is unavailable; its documented CLI is installed.","suggested_fix":"Install Docker Engine and Compose, then run the README demo quickstart."}
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"SDK core supports Python 3.10+","source":"**Python**](https://img.shields.io/badge/python-3.10%2B-blue?logo=python&logoColor=white) [![License","input":"install SDK core","expected":"Python ≥ 3.10","testable":false,"reason":"This is a prerequisite statement; backend stack is blocked because Docker is absent."}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Self-host using Docker Compose","source":"**Prerequisites:** Docker + Docker Compose.","input":"docker compose --profile demo up -d --build --wait","expected":"application starts","testable":false,"reason":"docker command failed: /bin/bash: line 1: docker: command not found"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay