{"slug": "i-built-a-flight-recorder-for-ai-agents-because-what-did-it-do-shouldnt-be-a", "title": "I Built a Flight Recorder for AI Agents (Because “What Did It Do?” Shouldn’t Be a Mystery)", "summary": "A developer released AGENTBOX, a zero-dependency, fully local flight recorder that wraps any AI agent or command and produces a hash-chained JSONL session file of every tool call, shell command, file operation and URL hit. Each event commits to the previous one via SHA-256, so `agentbox verify` flags any tampering, and all strings are redacted before hashing so secrets are not recoverable from the tape. The tool offers replay scrubbing, one-page session receipts, shareable clips, and passive hook-based recording for Claude Code.", "body_md": "AI agents now run your shell, edit your files, and ship to prod—often with zero humans in the loop. The tooling explosion of 2026 made software *agent-native*… and produced exactly one new question:\n\n**\"What did my agent actually do while I was away?\"**\n\n[AGENTBOX](https://github.com/arunsoman/agentbox) is the answer. Strap a flight recorder to **any** command or agent—no SDK, no code changes, no cloud—and get a tamper-evident tape of everything it did: every tool call, every file touched, every URL hit.\n\nI recently came across this project and it solves a problem I didn't know I had. Let me break down why it matters and how you can try it in 10 seconds.\n\nIf you've used Claude Code, Codex CLI, or any autonomous coding agent, you know the drill: you give it a task, it runs for a while, and then something breaks. Maybe it deleted a file, maybe it hit an unexpected API, or maybe it just did something… *odd*.\n\nTraditional logging doesn't cut it. You need a **forensic record**—a black box that captures everything in a way that can't be quietly edited afterward.\n\nThat's exactly what AGENTBOX does.\n\nAGENTBOX is a **zero-dependency, 100% local flight recorder for AI agents**. It wraps any command or agent and produces a session file (JSONL) containing every event: tool calls, shell commands, file operations, URLs hit, even human keystrokes.\n\nThe tagline says it all:\n\n**\"`npm test` for your agent's behavior · tamper-evident · 100% local · zero dependencies\"**\n\n`agentbox replay` opens an interactive scrubber—like security footage for your terminal.\n\n`▲` tool call · `$` shell · `✎` file op · `i` human input`00:47.2`, the moment it dropped the table` HUMAN` lines)`--headless` renders a static frame for CI, GIFs, and GitHub\nEvery event is hash-chained. Each line commits to the previous one:\n\n```\n{ i, t, type, data, prev, hash }\nhash = sha256(prev ‖ i ‖ t ‖ type ‖ data)\n```\n\nEdit one line—even a single character—and `agentbox verify` pins the exact event:\n\n``` bash\n$ agentbox verify\n✗ hash mismatch at event 7 — event was tampered with or forged\n```\n\nThat makes the session file **evidence, not a log**: post-mortems, compliance, \"the agent did it / no it didn't\" arguments in PRs—settled.\n\nEvery string written to a session file is scrubbed *before* it is hashed and appended. The chain commits to the redacted form, so the original secret is not recoverable from the file, the receipt, or a shared clip. Default patterns catch API tokens, cloud keys, auth headers, private keys, and connection strings.\n\nYou can extend the redaction patterns via `AGENTBOX_REDACT_EXTRA` or project-local config.\n\n```\n# 1. Watch a scripted agent get recorded\nnpx agentbox-cli demo\n\n# 2. Wrap anything — your agent, a script, any CLI\nagentbox wrap -- claude \"refactor auth.js\"\nagentbox wrap --name eval-run -- python evaluate.py --suite prod\n\n# 3. Read the tape\nagentbox list        # all sessions\nagentbox receipt     # newest session, one page\nagentbox replay      # scrub the footage\nagentbox verify      # tamper check\n\n# 4. Share a moment, not a dump\nagentbox clip --from 30 --to 75   # → self-contained .clip.html\n\n# 5. Or skip the wrapper entirely — passive mode\nagentbox init claude    # hooks → every claude session, recorded\nagentbox mcp -- npx -y @modelcontextprotocol/server-everything\n```\n\nNo install, no config, no accounts. Sessions land in `./.agentbox/sessions/` next to your repo—commit them if you want receipts in git history.\n\nWrapping is for flights you know about in advance. **Adapters** are for the ones you don't.\n\nFor Claude Code, you can merge hooks into your settings with a single command:\n\n```\nagentbox init claude         # merges hooks into .claude/settings.json\nagentbox init claude --local # .claude/settings.local.json instead\nagentbox init claude --remove # clean uninstall\n```\n\nFrom the next session on, Claude Code quietly feeds every event to `agentbox hook claude`.\n\n`agentbox demo`\nEvery session ends with a one-page flight receipt. Here's real output from the demo:\n\n```\n⬢ M A Y D A Y  R E C E I P T\n┌──────────────────────────────────────────────────┐\n│ session          demo-deploy                      │\n│ command          node examples/fake-agen…         │\n│ started          2026-09-24 18:40:52              │\n│ duration         5.4s                             │\n│ exit code        0 (clean landing)                │\n├──────────────────────────────────────────────────┤\n│ tool calls       7                                │\n│ · bash(\"git status --s…                           │\n│ · write(src/deploy.sh …                           │\n│ · bash(\"./deploy.sh --…                           │\n│ … +4 more                                         │\n│ shell commands   1                                │\n│ · rm -rf /tmp/old-buil…                           │\n│ files touched    2 · 1 written · 1 edited         │\n│ · src/deploy.sh wrote                             │\n│ · config.yaml edited                              │\n│ urls hit         1                                │\n│ output volume    808 B across 17 lines            │\n│ stderr lines     0                                │\n│ humans consulted 0 (unsupervised flight)          │\n├──────────────────────────────────────────────────┤\n│ events recorded  19                               │\n│ tamper chain     sha256 · intact                  │\n└──────────────────────────────────────────────────┘\nuneventful flight. the best kind.\n```\n\nAgentic tooling is moving fast, and trust is the bottleneck. Before you let an agent run `terraform apply` or `kubectl delete`, you need to know you can **audit exactly what happened**—and prove it wasn't altered.\n\nAGENTBOX fills that gap with a beautiful, minimal approach:\n\nIt's the kind of tool that should be in every agent operator's toolkit.\n\nHead over to the repo and try the demo:\n\n👉 [github.com/arunsoman/agentbox](https://github.com/arunsoman/agentbox)\n\n```\nnpx agentbox-cli demo\n```\n\nIf you're running agents in production (or just want to know what they're really doing), give it a star and let the author know what you think.\n\n*Have you used AGENTBOX or a similar auditing tool for your agents? Share your experience in the comments below.*", "url": "https://wpnews.pro/news/i-built-a-flight-recorder-for-ai-agents-because-what-did-it-do-shouldnt-be-a", "canonical_source": "https://dev.to/aarun_soman_/i-built-a-flight-recorder-for-ai-agents-because-what-did-it-do-shouldnt-be-a-mystery-235h", "published_at": "2026-09-25 12:49:20+00:00", "updated_at": "2026-09-25 13:01:32.245505+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "mlops", "ai-safety"], "entities": ["AGENTBOX", "Claude Code", "Codex CLI", "Model Context Protocol", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/i-built-a-flight-recorder-for-ai-agents-because-what-did-it-do-shouldnt-be-a", "markdown": "https://wpnews.pro/news/i-built-a-flight-recorder-for-ai-agents-because-what-did-it-do-shouldnt-be-a.md", "text": "https://wpnews.pro/news/i-built-a-flight-recorder-for-ai-agents-because-what-did-it-do-shouldnt-be-a.txt", "jsonld": "https://wpnews.pro/news/i-built-a-flight-recorder-for-ai-agents-because-what-did-it-do-shouldnt-be-a.jsonld"}}