release: 0.36.0 — default port 8722 (TRAC), unmasked session ids by default

[lroolle]

Two direct asks from Eric (2026-08-06):

Default port: 9317 -> 8722

• 8722 spells TRAC on a phone keypad — a default with a story, instead of "avoids Clash". IANA-unassigned, outside every OS ephemeral range, clear of proxy-tool territory (8080/8443/8888/9090).
• Walk is 8722..8731; the discovery sweep additionally keeps covering the legacy 9317..9326 range, so live instances of older versions still appear in ps, the switcher, and the dashboard during the transition.
• --port and env PORT (portless routes) behavior unchanged. Docs updated everywhere the old number appeared.

Identity ids: unmasked by default, --redact-ids to opt in

• session/user/device uuids are workflow identity, not credentials. Masking them at capture broke sid-keyed continuity (view-by-sid needed a fallback in 0.35.0, the registry catalog stores starred ids) and bought nothing until a trace leaves the machine.
• New: --redact-ids flag / CCTRACE_REDACT_IDS=1 env restores the masking for shareable captures. Credentials (tokens, keys, cookies, OAuth codes) remain ALWAYS redacted — no opt-out exists.
• Display-layer mask mode is untouched (sid was already excluded there by default per the 0.29 decision).
• Regression tests: default passthrough, opt-in masking, credentials-always-masked.

Tests: 613 pass. Smoke: built binary binds 8722, /api/self answers.

🤖 Generated with Claude Code