Skip to content

docs(agenteye): explain device login approval #626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SiddarthAA wants to merge 3 commits into
base: main
Choose a base branch
from
Open

docs(agenteye): explain device login approval #626

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7f2e0e5
docs(agenteye): explain device login approval
SiddarthAA Jul 30, 2026
b0965dc
docs: add device approval changelog entry
SiddarthAA Jul 30, 2026
cb5929f
docs(agenteye): add Claude Code session capture
SiddarthAA Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@
- Render the Policies dashboard loading ellipsis instead of displaying the literal Unicode escape text `\u2026`. (#623)
- Make dashboard toggle state follow the same project/local/user config merge as runtime enforcement, remove an enabled policy's opt-out from every contributing scope, and isolate unreadable explicit policy files so one bad file cannot leave the Configure tab loading forever. (#623)

### Docs
- Explain the AgentEye CLI device-login approval flow, including matching-email sign-in, short-code verification, scoped approval, and why the link alone cannot authorize a device. (#626)
- Document Claude Code session capture, including local CLI, headless and IDE coverage, child subagents, setup, backfill, and the no-redaction privacy boundary. (#626)

## 0.0.15-beta.0 — 2026-07-23

### Dependencies
Expand Down
55 changes: 55 additions & 0 deletions docs/agenteye/claude-capture.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
---
title: "Claude Code session capture"
description: "Bring your team's local Claude Code sessions and subagents into AgentEye as ordinary sessions and events — with no change to how they run Claude Code."
---

Your engineers already run Claude Code every day. Claude Code session capture brings those coding sessions into AgentEye as ordinary sessions and events, so you can search, replay, and evaluate them next to everything else you observe. It complements the [Python SDK](/agenteye/python-sdk): the SDK instruments agents you write, while this captures the Claude Code work your team already does — with no change to how they run it.

A small background collector reads Claude Code's local session transcripts as they are written and ships them to AgentEye. One collector per machine captures the terminal CLI, headless `claude -p` runs, and IDE integrations backed by local Claude Code — there is no per-surface setup.

The same collector captures other agents too — see [Codex](/agenteye/codex-capture), [OpenClaw](/agenteye/openclaw-capture), and [Hermes](/agenteye/hermes-capture). Enable each one you run; a single collector can capture several at once.

---

## What it captures

Each Claude Code session becomes an AgentEye [session](/agenteye/sessions). Its user and assistant turns, tool calls and results, token usage and context fill, hook runs, compaction boundaries, and failures become the matching [events](/agenteye/event-stream).

This includes failed turns, API errors, and tool failures, so sessions remain useful when you are investigating what went wrong. Claude Code's reasoning text is not captured because its local transcripts do not contain that content.

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "## changed file excerpt"
if [ -f docs/agenteye/claude-capture.mdx ]; then
  nl -ba docs/agenteye/claude-capture.mdx | sed -n '1,80p'
else
  echo "docs/agenteye/claude-capture.mdx not found"
fi

echo
echo "## repository references to Claude Code reasoning/capture/transcript"
rg -n -i "claude-code|claude code|reasoning|transcript|capture" docs/agenteye/claude-capture.mdx . 2>/dev/null | head -n 160 || true

Repository: FailproofAI/failproofai

Length of output: 225

🌐 Web query:

Claude Code release notes reasoning-effort metadata session transcripts feed.xml anthropics/claude-code

💡 Result:

As of July 30, 2026, there is no official implementation or release note confirming that "reasoning-effort" metadata has been added to the status line JSON or session transcripts in Claude Code. Multiple community members have filed feature requests (e.g., issues #13158, #37701, #38637, #50060) on the official anthropics/claude-code GitHub repository explicitly asking for the current reasoning effort level (e.g., low, medium, high) to be exposed in the status line stdin JSON. Users report that this metadata is currently missing from the status line hook, making it difficult to display real-time, mid-session changes made via the /effort command or other settings [1][2][3][4][5]. Currently, while Claude Code internally tracks reasoning effort, it is not consistently exposed in an accessible, programmatic way for external status line scripts or within standard transcript files [1][2][4]. Users relying on workarounds, such as parsing local configuration files (like settings.json) or attempting to regex-match transcript output, find these methods fragile because they do not reliably reflect dynamic, in-session state changes [2][3][4]. You can monitor the official GitHub repository for updates and progress on these feature requests [1][4]. The official documentation, including the changelog, remains the primary source for confirming when such metadata is officially supported [6][7].

Citations:

🌐 Web query:

site:github.com/anthropics/claude-code reasoning effort session transcripts feed.xml "reasoning effort"

💡 Result:

Reasoning effort in Claude Code refers to the configurable "thinking" budget assigned to the model during complex tasks, which directly impacts response latency, cost, and depth of reasoning [1]. Recent updates to Claude Code have integrated reasoning effort more deeply into the system: 1. Session Transcripts: Reasoning effort levels are now recorded on each assistant message within session transcripts [2][3]. This change ensures that the effort applied to specific turns is documented, which is particularly useful for tracking model behavior and debugging [4]. 2. Status Line Integration: The statusLine stdin JSON payload now includes an effort.level field [5]. This allows custom status line scripts to display the active reasoning effort level in real-time, including changes made mid-session via the /effort command [1][5]. 3. Configuration and Precedence: Reasoning effort can be set or overridden through multiple layers. While documentation indicates a precedence of environment variables > skill/subagent frontmatter > session settings > model defaults, users have noted discrepancies where certain overrides (such as skill-specific frontmatter) may not always take effect at runtime [6][7]. 4. Feed Updates: Technical changes related to these features are tracked in the project's feed (feed.xml) and changelog, which document updates such as the inclusion of reasoning effort in status line payloads and transcript records [2][3]. Important limitations identified by users include the failure of the --resume command to persist the session's effort level, which can lead to unexpected behavior and prompt cache invalidation [4], as well as issues where environment-forced effort levels may bypass model capability checks and cause errors with subagents that do not support reasoning parameters [8].

Citations:

Make the reasoning-data claim version-specific.

Claude Code release notes document that reasoning effort is recorded in session transcripts, so “Claude Code’s reasoning text is not captured” is absolute enough that users may infer transcripts remain private from Claude’s own reasoning data. Clarify that the collector excludes Claude reasoning-content while noting any reasoning metadata that may still remain, or tie the statement to the supported Claude Code version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/agenteye/claude-capture.mdx` at line 18, Update the documentation
statement near the failed-turn and tool-failure description to qualify Claude
Code reasoning capture by the supported version or explicitly distinguish
excluded reasoning-content from any reasoning metadata retained in local
transcripts. Avoid the current absolute claim that Claude Code reasoning text is
never captured.

Source: MCP tools


### Subagents become child sessions

When Claude Code starts a task subagent, the subagent appears as its own session with its own transcript, tool activity, and usage. AgentEye links it to the parent session, so you can follow the full delegation flow without mixing the subagent's work into the main transcript.

---

## Turn it on

Capture is off until you enable it. Install the collector with an API key that has the `events:add` permission (see [API keys](/agenteye/api-keys)), and turn on Claude Code capture:

```bash
curl -fsSL https://raw.githubusercontent.com/FailproofAI/agenteye-collector/main/install.sh \

@hermes-exosphere hermes-exosphere Jul 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking — unsafe installer and exposed API key. This executes mutable main content immediately and passes the events:add key as a command-line argument, where it can be exposed to other local processes or shell history. Publish a version-pinned installer/binary with an integrity check, and use a non-argv secret input (for example, a protected environment variable or stdin) before making this the recommended setup path.

| sh -s -- --key <YOUR_API_KEY> --claude-enabled
```
Comment on lines +31 to +33

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Avoid an unpinned installer and API key in argv.

This primary setup path executes mutable main content via curl | sh, while --key <YOUR_API_KEY> exposes the credential through shell history and process arguments. Use a pinned release/checksum and a non-argv secret input path before publishing this command.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/agenteye/claude-capture.mdx` around lines 31 - 33, Update the primary
setup command in the Claude capture documentation to download and verify a
pinned installer release using its checksum rather than executing mutable main
content. Replace the `--key` argv credential flow with a non-argv secret input
mechanism, while preserving the existing `--claude-enabled` setup behavior.


That installs the collector, registers it as a background service, and starts capturing. Confirm it is running:

```bash
agenteye-collector health
```

Capturing more than one agent on the same machine? Add each one's flag to the same command — for example `--claude-enabled --codex-enabled`.

On first run, Claude Code sessions still available on the machine are backfilled and new activity then streams as it is written. Claude Code's own files are only ever read — never modified, moved, or deleted.

---

## Where it shows up

Captured sessions appear in **Sessions**, and their events in the **Events** stream, the same as any other agent you observe — so [session replay](/agenteye/sessions), [search](/agenteye/queries), [evaluations](/agenteye/evaluations), and [alerts](/agenteye/alerts) all work on them. Filter by the Claude agent to see them on their own.

---

## Privacy

Claude Code transcripts can contain raw command output, file contents, command arguments, and secrets. Captured content is shipped as-is without redaction, so enable capture only on machines and for teams where centralizing that content in AgentEye is appropriate, and give the collector a key scoped to `events:add` only. See [Security](/agenteye/security) for how your data is kept isolated.
11 changes: 11 additions & 0 deletions docs/agenteye/cli-and-agents.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,17 @@ agenteye keys create ci --add events:add # a key that can only push events,

One habit to know: global options like `--json` go before the command. `agenteye --json sessions` is right; `agenteye sessions --json` is not.

## Approve a login from another device

When a terminal cannot receive an emailed code directly, start device login there and open the displayed link in a browser. Sign in to AgentEye with the email shown by the CLI, verify that the browser displays the same short code, review the requested access, and approve it. The terminal then receives its own scoped session.

```bash
agenteye login --device --no-wait # print the approval link and return
agenteye login --device --wait # claim the approved session
```

The link is only a way to reach the approval screen. Copying or forwarding it cannot approve a login by itself: approval always requires an active AgentEye sign-in for the matching email. If the email or code is unexpected, deny the request.

## Script it, wire it into CI

Every command takes `--json`, and that changes everything. Clean JSON goes to stdout while human status and warnings go to stderr, so a `--json` capture pipes straight into `jq` with no stray line to strip. That is what makes the CLI equally good for you at a prompt and for a coding agent parsing output:
Expand Down
2 changes: 1 addition & 1 deletion docs/agenteye/codex-capture.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ Your engineers already run OpenAI Codex every day. Codex session capture brings

A small background collector reads Codex's local session transcripts as they are written and ships them to AgentEye. One collector per machine captures every local Codex surface at once — there is no per-surface setup.

The same collector captures other agents too — see [OpenClaw](/agenteye/openclaw-capture) and [Hermes](/agenteye/hermes-capture). Enable each one you run; a single collector can capture several at once.
The same collector captures other agents too — see [Claude Code](/agenteye/claude-capture), [OpenClaw](/agenteye/openclaw-capture), and [Hermes](/agenteye/hermes-capture). Enable each one you run; a single collector can capture several at once.

---

Expand Down
2 changes: 1 addition & 1 deletion docs/agenteye/hermes-capture.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ description: "Bring your team's Hermes gateway sessions — Slack, Telegram, CLI

[Hermes](https://hermes-agent.nousresearch.com) answers your team from wherever they already work — Slack, Telegram, the CLI, scheduled runs. Hermes session capture brings all of it into AgentEye as ordinary sessions and events, so the assistant your team talks to every day is as observable as the agents you write yourself.

A small background collector reads Hermes's local session store as it is written and ships sessions to AgentEye. It works the same way as [Codex](/agenteye/codex-capture) and [OpenClaw](/agenteye/openclaw-capture) capture, and one collector can capture several at once.
A small background collector reads Hermes's local session store as it is written and ships sessions to AgentEye. It works the same way as [Codex](/agenteye/codex-capture), [Claude Code](/agenteye/claude-capture), and [OpenClaw](/agenteye/openclaw-capture) capture, and one collector can capture several at once.

---

Expand Down
2 changes: 1 addition & 1 deletion docs/agenteye/openclaw-capture.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ description: "Tail your team's local OpenClaw sessions into AgentEye as ordinary

If your team runs [OpenClaw](https://docs.openclaw.ai), OpenClaw session capture brings those sessions into AgentEye as ordinary sessions and events, so you can search, replay, and evaluate them next to everything else you observe. It complements the [Python SDK](/agenteye/python-sdk): the SDK instruments agents you write, while this captures the OpenClaw work your team already does — with no change to how they run it.

A small background collector reads OpenClaw's local session transcripts as they are written and ships them to AgentEye. It works the same way as [Codex capture](/agenteye/codex-capture), and one collector can capture both at once.
A small background collector reads OpenClaw's local session transcripts as they are written and ships them to AgentEye. It works the same way as [Codex](/agenteye/codex-capture), [Claude Code](/agenteye/claude-capture), and [Hermes](/agenteye/hermes-capture) capture, and one collector can capture several at once.

---

Expand Down
1 change: 1 addition & 0 deletions docs/docs.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@
"agenteye/python-sdk",
"agenteye/python-sdk-skill",
"agenteye/codex-capture",
"agenteye/claude-capture",
"agenteye/openclaw-capture",
"agenteye/hermes-capture",
"agenteye/cli",
Expand Down