mrkeyoor.com_
Wed 21 Oct 14:52 UTC
AI Toolsevaluationupdated 21 Oct 2026

Trail-Code review

Graft, now called Trail-code, builds a local code map for coding agents. The current README also describes learnings saved from coding conversations. Structural parsing needs no model key; optional written summaries use a configured model provider.

+449stars / 7d
Verdict

The structural map is worth evaluating if you want to keep your coding agent and improve code lookup. Our d34c115 run passed 1,355 tests in 134 seconds, while npm audit reported 2 high-severity vulnerabilities. It does not validate current Trail-code learnings. Supplied user reports also raise questions about cross-repository writes and intrusive hooks; their applicability to the current version is unverified. Resolve those questions in your intended setup before adopting the integration.

We ran it

Lab card: what happened when we ran Trail-CodeScreenshot of Trail-Code (trailhq.com/graft)
Install✓ · 49s88 packages · 443 MB
Build✓ · 17s
Tests✓ · 134s1355 passed · 0 failed of 1355 (node:test)
Known vulns20 critical · 2 high · 0 moderate · 0 low (npm audit)
Repo357 files~65,010 lines of source · 44.9 MB · 6 CI workflows · Dockerfile · tests dir

Answers from our run

Does Trail-Code build from source?

Dependencies installed in 49 seconds (88 packages), and the build succeeded in 17 seconds. We cloned commit d34c115 into a clean Debian container with 3 CPUs and no project-specific setup.

Do Trail-Code's tests pass?

Yes. The project's own test command finished in 134 seconds and reported 1355 passed, 0 failed (node:test).

Does Trail-Code have known vulnerabilities in its dependencies?

npm audit flagged 2 known advisories in the dependency tree at the time of our run.

Who should not use Trail-Code?

Teams that cannot accept changes outside the initialized repository without further verification: a supplied open issue reports Claude Code hooks affecting unrelated projects.

What are the alternatives to Trail-Code?

Repomix, Aider. The structural map is worth evaluating if you want to keep your coding agent and improve code lookup.

SetupN/AThe dated installation passed, but current installation and compatibility with an existing agent setup were not reproduced.
DocsN/ASupplied README extracts describe setup and data handling, but current instructions were not verified against a working agent.
CommunityN/ASupplied repository activity does not establish support quality, response times or resolution of the reported hook behavior.
MaturityN/AThe dated suite passed with two high audit findings; current learning accuracy and sustained application use were not assessed.

Who it’s for

Developers keeping their existing coding agent who want symbol lookup and caller information.
Teams willing to review agent hooks and shared learning files alongside source changes.
Developers prepared to evaluate structural retrieval separately from conversation processing.

Who it’s NOT for

Teams that cannot accept changes outside the initialized repository without further verification: a supplied open issue reports Claude Code hooks affecting unrelated projects.
Users requiring past-session processing to remain offline: the README says Claude reads those messages under the user's Anthropic login.
Teams requiring unobtrusive hooks without further evaluation: a report for Trail-code 0.23.0 describes mandatory reply lines and a blocking learning prompt. Applicability to the current version is unverified.

Setup reality

Our September 30, 2026 run of commit d34c115 installed 88 dependencies in 49 seconds, occupied 443 MB, and built successfully in 17 seconds. Node's test runner reported 1,355 passed and 0 failed out of 1,355 in 134 seconds. Npm audit reported 2 known vulnerabilities, both high severity.

The measured README documents structural parsing without a model key and optional model-written summaries through a configured provider. It also documents initialization that writes agent integration files, including user-level Codex configuration. Previewing those writes is useful, but does not establish that hooks remain confined to the intended repositories or fit an existing workflow.

Our run did not validate the newer Trail-code learning flows or reproduce the supplied hook reports. The lab-node:22 image label does not establish actual runtime or operating-system versions.

Evaluate the map separately from the learning workflow

Graft, now called Trail-code, combines a code map with a newer workflow for saving learnings from coding conversations. The adoption question is whether the map helps your existing agent enough to justify its integration, and whether the broader learning workflow fits your team's data handling and review practices.

The README at measured commit d34c115 describes local structural parsing with tree-sitter, symbol relationships, caller queries and file signatures. The current README retains the graft commands and adds conversation-derived learnings. Our dated repository checks do not validate those newer flows.

What happened when we ran it

Our sandbox run used Graft commit d34c115 on September 30, 2026. Installation succeeded in 49 seconds with 88 dependencies recorded and 443 MB on disk. The build succeeded in 17 seconds. Node's test runner completed in 134 seconds with 1,355 passed and 0 failed out of 1,355.

Npm audit reported 2 known vulnerabilities, both high severity, with 0 critical, moderate or low findings. The supplied measurements do not identify affected packages or exposure paths. Investigate the advisories for the revision you intend to use; passing tests do not resolve audit findings.

The recorded sandbox configuration was 3 CPUs, 8g RAM and image lab-node:22. That image label does not establish the actual runtime or operating-system version. The checkout contained 357 files, about 65,010 source lines and 44.9 MB of checked-out content. The scan found 6 CI workflow files, a Dockerfile and a tests directory.

These results establish that the supplied revision installed, built and passed its repository tests in that sandbox. They do not measure retrieval accuracy, coding-agent speed or compatibility with an existing agent setup.

Structural parsing and model summaries have different boundaries

The measured README describes the structural graph as deterministic tree-sitter parsing without a model or network. It writes a regenerable cache under graft/. Caller queries and file signatures give an agent ways to request specific context.

The optional deep pass uses a chosen model provider for written summaries. Review that provider's data handling before enabling it. Local structural parsing also does not establish that the coding agent consuming the results operates offline. The measured README separately documents usage telemetry and version checks, so its no-network description of structural parsing should not be read as a blanket promise about the entire application.

Preview initialization, then evaluate hook behavior

The measured README documents a dry-run mode that lists proposed integration writes. It also documents user-level Codex configuration and a scope control for skipping writes outside the repository. The current README documents a preview of agent wiring. These previews help inspect setup changes, but do not establish what installed hooks will do in later sessions.

Two supplied open reports make that distinction concrete. In issue #491, a user reports that user-level Claude Code hooks create graph and helper files and modify ignore rules in projects where initialization was never run. The reporter describes disruption across unrelated projects. The supplied report does not identify an installed package version. We did not reproduce it, and its applicability to the current version is unverified.

In issue #628, a user reports that Trail-code 0.23.0 on macOS instructs Claude Code to append fixed credit and speed lines and can block completion until a learning is saved. The reported speed lines were not measured in that session. We did not reproduce this behavior, and its applicability to the current version is unverified.

Before adopting the integration, check whether hooks affect unrelated repositories, alter replies or interrupt completion in your intended setup. Previewing initialization alone does not resolve these reported behaviors. Teams that require strict repository boundaries or control over agent replies should leave adoption pending until those questions are answered for their chosen version.

Past-session processing uses Claude under your login

The current README says initialization reads the user's own messages from past Claude Code sessions for the repository. It says the user's Claude Code performs that reading with Claude Sonnet under their login: messages go to Anthropic and count toward Claude usage. This is documented behavior, not a flow validated by our September run.

Repository learnings live in .trail/ and travel through Git; personal learnings stay under ~/.trail/. Review shared learnings for accuracy and scope because they become context for later agent work.

The README describes the cross-repository Trail workspace as coming soon. It also documents a conditional sharing boundary: when connected, selected repositories' learnings and records of searches and checks go to Trail. Do not treat that conditional description as evidence that we verified workspace availability or sharing behavior.

Choose an alternative by the output you need

Repomix packs a repository into a single AI-friendly file. Consider it when a portable bundle is enough for a chat or review. Inspect the selected content before sharing it with a model.

Aider is a terminal coding assistant with its own codebase map. Its README describes pair programming with models and mapping the codebase. Consider it when you want the assistant itself. Trail-code instead supplies context to an agent you already use. Our run provides no comparative speed or correctness result for either alternative.

What remains unknown

The supplied latest-release lookup is null; the evidence does not establish whether the lookup succeeded or whether a GitHub release exists.

The dated passing suite leaves current learning accuracy, hook compatibility and sustained use on an application unassessed. Start with a repository you know: compare returned callers with the source, inspect proposed writes, and check hook behavior across the repositories you use before enabling conversation-derived context.

Alternatives

ProjectWhat it isPick it when
Repomix gh↗Packs a repository into a single AI-friendly file.Choose it when a portable code bundle is enough for a chat or review.
Aider gh↗A terminal coding assistant with its own codebase map.Choose it when you want the coding assistant itself rather than a context layer for an existing agent.

Sources

  1. Current Trail-code README and migration guidance
  2. Graft README at measured commit d34c115
  3. Repomix README
  4. Aider README
  5. Supplied issue and pull-request evidence, including reports #491 and #628

More ai tools reviews

Beav · PilotDeck · rakazo · BeefTV · OpenDots · reelmimic · the whole board →