{"slug": "who-typed-my-agent-logs", "title": "Who typed my agent logs?", "summary": "A developer analyzing one week of coding-agent logs found that of 30,803 records labeled \"user,\" at most 917 (3%) were actually typed at a prompt, with 82.4% being tool results, 11% harness messages, 3.3% injected context, and 0.4% orchestrator prompts to subagents. The developer also found that two \"one prompt\" builds were initiated by an orchestrator rather than a human, meaning the 3% figure is a ceiling. The analysis warns that anyone building on agent transcripts will be misled by the \"user\" label.", "body_md": "**TLDR.** My coding agent’s logs from one week hold 30,803 records labelled “user”. At most 917 of them, 3%, were typed at a prompt. The rest are tool output, harness messages, injected context and my orchestrator talking to its subagents. And 917 is a ceiling. Two of my “one prompt” builds this week started with a prompt my orchestrator typed, not me. If you build anything on agent transcripts, the “user” label will mislead you.\n\n## The number\n\nI wanted a simple count: how many messages did I send my agents this week? The logs have a field for it. Every record has a type, and the type for things that go into the model is “user”.\n\nFrom 5 to 12 November that field said “user” 30,803 times. That’s across 79 sessions and 106 subagent transcripts, all from one coding agent on one machine.\n\nI did not type 30,803 messages. So I sorted every record into one of five buckets:\n\n25,390 tool results (82.4%). A tool runs, its output goes back to the agent, and the log files it as “user”.\n\n3,376 harness messages (11.0%). Slash command expansions, task notifications, interrupts.\n\n1,009 injected context (3.3%). Skill text and pasted-image notices that the harness adds.\n\n111 orchestrator prompts (0.4%). Briefs my orchestrator wrote to its own subagents.\n\n917 typed at the prompt (3.0%).\n\nThe five buckets don’t overlap, and they add up exactly to 30,803. That matters to me. If the parts don’t sum to the total, one bucket is hiding inside another, and nobody can check the claim.\n\n## How the sorting works\n\nEach record goes through four checks, in this order. The first match wins.\n\n1. Does it carry a tool result? Then it’s a tool result. Some records hold a tool result block in the message, some carry a separate result key at the top level, and some carry both. Check both shapes, or you miss most of them.\n2. Is it flagged as meta? Then it’s injected context.\n3. Does the prompt-source field say “typed” or “queued”? Then it was typed at the prompt. “Queued” means typed while the agent was still busy. I keep it, because dropping it would undercount the person.\n4. Is it inside a subagent’s transcript? Then the orchestrator wrote it.\n\nAnything left over is a harness message.\n\nThe classifier is about 100 lines of Python in a tool I build to measure agent runs. It reads the log files already on disk. I used one run, at 00:48 on 12 November, and did not rerun it for this post.\n\n## Why 917 is a ceiling\n\nHere is the part I didn’t expect.\n\nI run an orchestrator. It splits work into lanes, opens a new terminal session for each lane, and types a brief into it. The log gives that brief the same “typed” stamp as my own keystrokes. To the log, a brief from my orchestrator and a sentence from me look the same.\n\nSo the “typed” bucket holds my keystrokes plus some number of machine-typed briefs. All I can honestly say is “at most 3%”. The real share of me is lower.\n\nThere’s one clean result on the other side. In the 106 subagent transcripts, zero records carried a typed stamp, even with the subagent rule switched off. Every keystroke-shaped record lives in the 79 top-level sessions.\n\n## The “one prompt” builds were not my prompt\n\nI also make run cards for single builds. They show typed turns next to wall time and tool calls. Three of them fall inside this week:\n\nBuild A: 1 typed prompt, 190 “user” records, 174 tool calls, 2 hours 12 minutes.\n\nBuild B: 1 typed prompt, 91 “user” records, 89 tool calls, 18 minutes.\n\nBuild C: 35 typed prompts, 297 “user” records, 249 tool calls, 3 hours 11 minutes.\n\nThe first two look like the dream. One prompt, then the agent works alone for hours.\n\nThen I opened the one typed prompt in each. My orchestrator typed both. One is a lane brief. The other passes on a request I had made earlier, in the orchestrator’s words. I typed neither. In the build with 35 typed prompts, none is an orchestrator brief.\n\nSo a “1 typed turn” badge can mean two different things. It can mean a person set the direction once. Or it can mean a machine typed the prompt, sometimes passing on what the person asked for somewhere else. The log can’t tell them apart. I couldn’t either, until I read the records.\n\nWall time needs a warning too. Another card, from a different coding agent, says 29 hours 32 minutes for 2 typed prompts. The session sat open overnight. Wall time measures how long a window stayed open. It does not measure work.\n\n## Why this matters if you build on logs\n\nMemory tools, eval harnesses and usage dashboards all read these transcripts. If one of them treats every “user” record as the person, it will:\n\nsee 30 times more “user” messages than the person sent,\n\nlearn “preferences” from tool output and skill text,\n\ncredit the person with prompts an orchestrator wrote.\n\nThe fix is cheap. Gate on how the prompt arrived. Drop tool results and meta records first. Then treat what’s left as an upper bound until you can tell a person from a machine typing into the same box.\n\n## The limits\n\nThese are counts of records, not of words. One typed record can be a single word or a full page.\n\nThe harness bucket is a catch-all. A slash command I typed lands there as an expansion, so some harness records were caused by me. I only claim “typed”, never “caused”.\n\nA record with no prompt-source field falls into the harness bucket. I haven’t counted those. If some are mine, the typed count is low for that reason, and high for the orchestrator reason above.\n\nI read the typed prompts of three builds, not all 917. How many of the 917 are machine briefs is still unmeasured.\n\nThis is one week, one machine, one coding agent. The other agent I use writes a different log, and it’s not in these numbers.\n\nThe percentages are rounded, so they add to 100.1. The counts add exactly.\n\n## What I’ll do next\n\nCount the orchestrator briefs inside the 917. My orchestrator’s briefs tend to open the same few ways, so many of them should be matchable. When that works, the ceiling becomes a number, and I’ll post it.", "url": "https://wpnews.pro/news/who-typed-my-agent-logs", "canonical_source": "https://morkeeth.substack.com/p/who-typed-my-agent-logs", "published_at": "2026-11-12 21:17:52+00:00", "updated_at": "2026-11-12 21:52:50.254290+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "large-language-models"], "entities": [], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/who-typed-my-agent-logs", "markdown": "https://wpnews.pro/news/who-typed-my-agent-logs.md", "text": "https://wpnews.pro/news/who-typed-my-agent-logs.txt", "jsonld": "https://wpnews.pro/news/who-typed-my-agent-logs.jsonld"}}