agentwhy-session-audit

1# agentwhy session audit
2 
3[agentwhy](https://github.com/karolkozer/agentwhy) (Apache 2.0, npm `@agentwhy/cli`) reads the session records Claude
4Code keeps on disk, including each subagent's own transcript, and says which private files were reached and how. It
5works by fixed rules: no AI model, no account, no network request once the package is installed. Values are replaced
6before the report is built, so its output names files, never their contents. It needs Node 22 or later.
7 
8By default it treats these as private: `.env*`, `*.env`, `.npmrc`, `secrets/`, `.ssh/`, `id_rsa*`.
9 
10Run every command below from the folder Claude Code was started in, the project root. If `command -v agentwhy` finds
11it installed, use `agentwhy` in place of `npx -y @agentwhy/cli@0.4.1`. The first `npx` run downloads that pinned
12version from npm; agentwhy never updates itself.
13 
14Which command to run depends on what the user asked:
15 
16- A question ("did an agent read my .env?", "which key do I change?", "did anything leak?"): run `check` (section 1)
17  and answer it here.
18- A request for the report ("show me the report", "open agentwhy", "what happened session by session"), or a
19  question about Codex sessions: open the page (section 2).
20 
21If either command answers that no sessions are stored for this directory, the user is in a different folder from the
22one they worked in. Ask which folder it was and run it there.
23 
24## 1. Answer a question: the short check
25 
26```bash
27npx -y @agentwhy/cli@0.4.1 check
28```
29…