recap

AgentKeeper Session Recap

You are producing a security-aware summary of the current Claude Code session by reading local session data.

Step 1: Locate Session Data

Check for the session log file:

AGENTKEEPER_DIR="$HOME/.agentkeeper-plugin"
[ -n "$CLAUDE_PLUGIN_DATA" ] && AGENTKEEPER_DIR="$CLAUDE_PLUGIN_DATA"
cat "$AGENTKEEPER_DIR/sessions/current.jsonl" 2>/dev/null

If the file does not exist or is empty:

Display:

AgentKeeper Session Recap

No session data found.

Session tracking begins after the first tool call in an AgentKeeper-enabled
session. The AgentKeeper hooks record tool calls, file changes, and threat
detections to a local session log.

If you just installed the plugin, start a new session and the recap will
be available after some tool activity.

In the meantime, try:
  /agentkeeper:audit — check your Claude Code security setup
  /agentkeeper:secrets — scan for exposed secrets in this directory

Stop here if no data exists.

If the file exists:

Read the full contents. Each line is a JSON object representing a hook event. Parse the entries to extract the information below.

Step 2: Analyze Session Data

From the JSONL entries, compute the following:

Tool Call Counts

Count events grouped by tool name (Bash, Edit, Write, Read, Glob, Grep, WebFetch, WebSearch, etc.). Display as a simple table.

Files Modified

Extract unique file paths from Edit and Write tool events. List them.

Files Created

Extract file paths from Write events where the file was newly created (if distinguishable from the event data).

Bash Commands Executed

Extract command strings from Bash tool events. Summarize them — show the first 80 characters of each, truncating long commands. Group similar commands if there are many.

Network Requests

Extract URLs from WebFetch events. List unique domains accessed.

Threats Detected

Look for entries where the hook response contained a threat detection (events with verdict of warn or block, or entries with pattern or threat fields). List each with severity and pattern name.