treeship

Portable, cryptographically signed receipts for AI agent sessions.

Treeship turns every AI agent session into a portable, signed receipt. Local-first. Cryptographically verifiable. Works offline. The receipt is yours, not ours.

Install

npm install -g treeship

This package downloads the prebuilt Treeship CLI binary for your platform. No Rust required.

Platform support:

| Platform | Status | | --- | --- | | macOS arm64 / x64 | Supported | | Linux x86_64 (any distro, glibc or musl) | Supported as of v0.10.1. Single static binary covers Ubuntu, Debian, Fedora, RHEL/Rocky, Amazon Linux, Alpine. | | Linux ARM64 | Not yet shipped. | | Windows | Not supported natively. Use WSL. |

The preinstall script exits with a clear message on Windows rather than yielding a broken install. The Linux build is statically linked against musl (verified at release time), so there is no GLIBC requirement; if you see GLIBC_2.39 not found, you have a pre-0.10.1 install — npm install -g treeship@latest to upgrade.

Quick start

treeship init                       # one-time, per machine
treeship session start              # opens a recording session
treeship wrap -- npm test           # captures the command + exit code + file writes
treeship session close              # seals the receipt
treeship session report             # uploads + prints a shareable URL (requires `treeship hub attach`)
treeship verify <url>               # structural check of a fetched receipt (verdict: structural-pass)
treeship verify <artifact-id>       # full local verification: signatures + chain, offline

Claude Code users

If you're using Claude Code, install the plugin instead — it auto-records every session via SessionStart / PostToolUse / SessionEnd hooks, no manual session start to remember:

claude plugin marketplace add zerkerlabs/treeship
claude plugin install treeship@treeship

What gets captured

@treeship/mcp and the Claude Code plugin capture:

• Tool name (e.g. read_file, bash)
• SHA-256 digest of arguments — not the raw arguments
• SHA-256 digest of output content — not the raw content
• Exit code, duration, error message text on failures
• Actor URI (e.g. agent://claude-code)

What's not captured by the MCP/plugin path: raw argument values, raw output content, file contents, environment variable values, secrets. Note that treeship wrap records more: the (sanitized) command line, the last output line as a summary, and modified file paths. Full inventory at https://github.com/zerkerlabs/treeship/blob/main/TREESHIP.md.

Where data lives

• Receipts stay in .treeship/sessions/<id>.treeship on your machine
• They leave on treeship session report, treeship hub push, with auto_push: true configured — or automatically at session end if you use the Claude Code plugin with a hub attached (the SessionEnd hook runs session report)
• Verification (treeship verify, treeship package verify) runs entirely offline and doesn't phone home. Package verification authenticates the artifacts and Merkle root; the receipt's narrative fields are not signed, and the verifier says so explicitly

Documentation

• Full docs: https://docs.treeship.dev
• Trust model + complete capture inventory: https://github.com/zerkerlabs/treeship/blob/main/TREESHIP.md
• Source: https://github.com/zerkerlabs/treeship

License

Apache-2.0