feat: harness session-export — join transcript JSONL with evidence ledger#67
Merged
LanNguyenSi merged 1 commit intomasterfrom May 6, 2026
Merged
feat: harness session-export — join transcript JSONL with evidence ledger#67LanNguyenSi merged 1 commit intomasterfrom
LanNguyenSi merged 1 commit intomasterfrom
Conversation
…dger Adds a new CLI verb that reads the on-disk Claude Code transcript at ~/.claude/projects/<projectDir>/<sessionId>.jsonl, joins it with evidence-ledger rows for the same sessionId, and emits a single chronologically-ordered audit artifact (--format json default, --format jsonl streaming, -o <file> to disk). Each event carries a source: transcript | ledger marker so the export is traceable. Default-on regex redaction catches the four obvious key/secret patterns out of the box. The new optional audit.redact[] manifest block extends the denylist with custom regexes or env_var entries that resolve at export time. Manifests without audit: parse unchanged. Empty-result case (no transcript and no ledger entries) exits 1 with a one-line stderr message. Partial sources (transcript present but ledger empty, or vice versa) still run and note the gap in the header. Refs agent-tasks 7e6753a2. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
LanNguyenSi
added a commit
that referenced
this pull request
May 6, 2026
Bump package.json 0.6.0 -> 0.7.0. Roll up CHANGELOG [Unreleased] into [0.7.0] - 2026-05-06 with a one-paragraph headline plus operator note. PR refs (#65, #66, #67, #68, #69) added to each entry. README now references v0.7.0 in the prose and gains a status checklist row for the workflows-as-data + session-export + docs-split set. Two version-pinned tests bumped to match the new binary header. Theme: workflows-as-data and full-session audit forensics. No schema bump (still version: 1); all new manifest fields are additive and parse identically against 0.6.0 manifests. Refs agent-tasks 1fe55885. Co-authored-by: Lan Nguyen Si <nguyen-si@publicplan.de> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
harness session-export <sessionId>reads the on-disk Claude Code transcript at~/.claude/projects/<projectDir>/<sessionId>.jsonl, joins it with evidence-ledger rows for the same session, and emits a single chronologically-ordered audit artifact. Each event carries an explicitsource: "transcript" | "ledger"marker.--format json(default) and--format jsonlship in v1;-o/--out <file>writes to disk.token/secret/password/api_key) before any output is written.audit.redact[]manifest block extends the denylist with customregex:rules orenv_var:entries that resolve to the actual env value at export time. Manifests withoutaudit:parse unchanged.Why
Closes the audit gap: today, "what happened in session X" requires grepping three disjoint sources. This collapses transcript JSONL + evidence-ledger into one chronological artifact suitable for incident forensics, contributor onboarding, and dogfooding.
Refs agent-tasks
7e6753a2.Scope cut
policy_decisionrows + transcripttool_useblocks cover v1.Test plan
npm run typecheckcleannpx vitest run711 / 711 green (added 25 cases across redact / transcript / session-export)session-exportagainst a real 1040-event transcript; default regex fired 26 times, no leak ofAGENT_TASKS_TOKEN(verified viagrep -F "$AGENT_TASKS_TOKEN" /tmp/export.json)harness session-export nonexistent-session-id→ stderr message + exit 1