A hardening release that follows 2.12.0. The Dumper learns to speak modern PHP – virtual hooked properties, WeakReference, PHP 8.5 URI objects – any HTTP client can now ask for markdown output with a single header, and a long list of fixes makes the Bar, the session and the logger behave under concurrency, broken storage and hostile input.

✨ New Features

• The Dumper now understands modern PHP constructs – PHP 8.4 virtual hooked properties render as {virtual} instead of the misleading unset, WeakReference shows its target (or (dead)), PHP 8.5 Uri\Rfc3986\Uri and Uri\WhatWg\Url expand into address and components, closures reveal the class of their bound $this, and lazy objects expose their eagerly-initialized private and protected properties without throwing
• cURL handles are dumped again – now via CurlHandle, not the long-gone resource type
• X-Tracy-Agent request header – non-browser agents (curl, HTTP clients, CI jobs) can ask for markdown output without the webdriver cookie, and a non-HTML response carries the markdown BlueScreen straight in the body
• editor: false in the Nette configuration finally disables editor links; previously the value was silently ignored

🐛 Bug Fixes

• Tracy's fetch() wrapper no longer drops the options argument and no longer mutates the caller's Request object – AJAX calls reach the server exactly as your code wrote them
• The XMLHttpRequest patch stopped stacking a load listener on every open() call, and a dump with a broken payload no longer aborts the initialization of every other dump on the page
• A corrupt localStorage / sessionStorage entry no longer breaks the Bar and Toggle initialization
• Toggle links can be activated from the keyboard again
• Dumper::$keysToHide and the scrubber now also apply to properties returned by __debugInfo() and custom object exporters – sensitive values no longer slip through
• Debugger::dump() with return: true respects $keysToHide and passes the options in CLI mode
• The email throttle is now atomic and honest: an invalid $emailSnooze interval throws instead of silently flooding your inbox, concurrent requests can no longer both send the same notification, and the snooze window restarts only after the mail was really sent
• TracyToPsrLoggerAdapter no longer logs an exception twice when the accompanying message adds no information, and casts Stringable messages to string
• FileSession hardening – session files are created with mode 0600, unserialization refuses objects, the cookie gets SameSite=Lax plus the secure flag on HTTPS, and concurrent garbage collection no longer emits warnings
• BlueScreen no longer triggers autoloading of class names it finds in an exception message
• The exception fallback output is HTML-escaped in HTML mode
• A repeated DeferredContent::enable() after output has started is a harmless no-op instead of an exception
• The Dumper's exposer ordering comparator is a valid total order and understands interface-keyed exposers, so custom exposers are picked deterministically
• Removed legacy browser workarounds (IE getAttribute flag, keyCode, navigator.platform, document.write() in the panel popup) and evalScripts() no longer leaves executed <script> clones behind in the DOM

Tracy learns to speak AI. This release turns every error screen, debug bar, and dump() call into a first-class citizen of agentic workflows – when an AI coding assistant hits your app, it gets a structured, token-efficient view of exactly what went wrong instead of a blob of HTML. Plus the usual spit-and-polish: a unified "transparent frames" model across BlueScreen and Dumper, a new breadcrumb in logged exceptions showing where Debugger::log() was called from, and a few quality-of-life API additions.

✨ New Features

• AI agent support – Tracy now detects AI agents (via Helpers::isAgent()) and serves them tailored output instead of HTML:
  • BlueScreen renders a dedicated agent template for exceptions, making stack traces and context machine-readable
  • Debug Bar ships an agent-friendly render path with bespoke templates for the Warnings and Dumps panels
  • Debugger::dump() writes to the console when an agent is on the other end, so your dumps land where the agent actually looks
  • Production error page now includes a hint for agents so they don't have to guess what happened behind the generic 500
• Markdown companion files – every HTML error log now gets a .md sibling, giving agents a clean, readable version of the same crash
• Debugger::$transparentPaths – a public, autodetected list of "framework" paths (Tracy, Nette, Latte) whose frames are skipped when locating the real call site. Path-based, so it catches anonymous functions and closures that class-based detection missed
• Helpers::findCallerLocation() – walks the backtrace and returns the first frame outside $transparentPaths, respecting @tracySkipLocation and internal functions. Reusable across Tracy instead of buried in Dumper
• Helpers::countTransparentFrames() – companion helper returning the number of leading transparent frames in a trace
• Logger records caller location – exception reports now show a "Logged from ..." footer pointing to the exact line where Debugger::log() was called, alongside the existing "Report generated at" entry
• Dumper::toText() – gained an optional $key parameter so you can label the dumped value in text output

♻️ Code Refactoring

• BlueScreen stack-trace collapse unified with Debugger::$transparentPaths – one source of truth for which frames to hide, replacing the inline logic in section-stack-exception.php. BlueScreen::$collapsePaths and isCollapsed() remain as @deprecated shims so existing configuration keeps working
• BlueScreen internals cleaned up, including a new prepareStack(\Throwable) method that strips Tracy's own handler frames and returns the frame index to expand by default

A maintenance release focused on CSP-friendly assets, mobile-friendly error pages, and a couple of handy API additions. Expect cleaner nonce handling, better behavior on phones, and a bar.js that no longer trips strict Content Security Policies.

• script-src-elem support in Helpers::getNonce() – nonces are now also picked up from the script-src-elem CSP directive, not just script-src (#612).
• CSP-friendly Tracy Bar – replaced the inline onload attribute in bar.js with a native addEventListener, eliminating a common CSP violation (#614).
• FileSession::clean() – emits a warning when the session directory is not readable, making misconfigured storage easier to diagnose (#538).
• Mobile-friendly error pages – BlueScreen and the 500 error template now include a proper viewport meta tag, so exceptions no longer render microscopically on phones (#604).
• Improved PHPDoc descriptions and fixed PHPStan errors across the codebase.
• open-in-editor on Windows – installer now registers the protocol via AutoLaunchProtocolsFromOrigins, suppressing the browser's "Open external app?" confirmation prompt (#573).

• Templates converted to Latte-like syntax, paving the way for a cleaner templating pipeline
• Environment guards relocated from Debugger to the individual strategy classes, improving separation of concerns
• Upgraded to PHPStan level 8 — the strictest static analysis level is now passing

✨ New Features

• Dumper – added support for uninitialized lazy objects (PHP 8.4), displaying them with a (lazy) label and showing only pre-initialized properties
• Source mapper – added column support, so BlueScreen can now pinpoint the exact character position in mapped source files

🐛 Bug Fixes

• keysToHide now applies to bdump()/barDump() as well – previously sensitive keys were only hidden in dump() and BlueScreen (#608)
• TracyExtension sets keysToHide config for Debugger too, not just for BlueScreen (#608)
• Dumper correctly loads its assets even when $showBar = false (#606)

• requires PHP 8.2 & supports PHP 8.5
• added support for backtraces for fatal errors in PHP 8.5
• bar: errors panel => warnings
• Bridge: removed support for Latte (is part of Latte)

• bluescreen.js: fixed scrolling to top
• bluescreen.css: fixed displaying with body { display: relative }
• bar.js: removes the data-tracy-content HTML attributes from DOM
• bar.css: .tracy-label removes leading and trailing spaces
• css: used fit-content
• Bridge: Nette\MemberAccessException may not throw only ObjectHelpers
• Dumper: added support for Dom classes in PHP 8.4

• Released version 2.10.9
• dumper: added cmd-click to open in editor
• dumper: exposeDOMNode() does not throw deprecation notices in PHP 8.4
• added workaround for Opera "feature" – 'Close tabs created for opening external apps'
• error 500: improved CSS style reset #581
• drop obsolete E_STRICT error level (#587)
• FileSession: greater $gcProbability value #585
• Logger: uses CRLF for mail headers #584

• bar.js: initializes Tabs (#580)
• refactoring
• support for PHP 8.4

• bluescreen: added php://input preview
• bluescreen: allows to create classes with two-letter namespace
• bluescreen: stack trace is reduced before analysis
• bar: label 'Errors' => 'Warnings'