The black box of AI coding agents just got a little less opaque. Gabriel Anhaia, creator of Hermes IDE, published a guide on November 3, 2026, detailing eight specific jq commands that extract hard truths from the JSONL transcript files generated by Claude Code and Codex. While agents often claim a refactor is complete, the underlying logs reveal whether they actually pushed code, touched migration folders, or failed silently on half their tool calls.

The Raw Data Behind the Hallucination

Claude Code writes every session to a JSONL file under ~/.claude/projects/, storing messages, tool calls, and results in plaintext for 30 days by default. Codex follows a similar pattern with rollout files under ~/.codex/sessions. Anhaia notes that neither vendor documents these files as a stable, versioned format, so developers must treat these queries as forensic tools rather than supported APIs. The commands parse one JSON object per line, leveraging jq’s strength in handling structured data streams to answer critical questions about agent behavior.

Auditing Actions and Failures

The guide provides commands to list every shell command executed via the Bash tool and every file modified via Edit or Write tools. Crucially, it distinguishes between successful edits and permission denials, which often appear as errors in the transcript. One command specifically isolates the five slowest tool calls by calculating the time delta between a tool_use timestamp and its corresponding tool_result, helping developers identify where the agent got stuck waiting for permissions or processing large files.

Codex-Specific Forensics

For OpenAI’s Codex users, Anhaia includes commands tailored to the rollout file structure. These queries extract the model used per turn, list all function calls with their arguments, and pull cumulative token totals from the session’s end. Because Codex tool names and argument keys can change between releases, the guide advises listing tool names first before parsing arguments, ensuring compatibility as the platform evolves.

Key Takeaways

  • Transcripts are ephemeral: Claude Code files are cleaned up after 30 days by default, so audit immediately after critical sessions.
  • Subagents matter: Queries must include subagent transcripts located in /subagents/ to get a full picture of delegated tasks.
  • No duration field: Agents don't log execution time directly; developers must calculate it by subtracting call timestamps from result timestamps.
  • Unstable formats: Neither Anthropic nor OpenAI guarantees the stability of these JSONL structures, so scripts may break with future updates.

The Bottom Line

Trusting an agent's final message is like trusting a contractor who says 'it's done' without checking the work. These jq commands turn vibes into evidence.