Docs / Action log
Action log
A signed record of each tool call, and what each agent was seen using.
What a record holds
The action log is off until you turn it on. Once on, hooks in Claude Code and Codex write a record when a tool call is asked for, and another when it has run or was denied. Both agents share one format. A record is metadata. It never holds content: not a prompt, not a reply, not a file's text.
flanner curb log --enableInstalls the hooks that log each tool call. It changes agent settings, so your operating system asks you first.
flanner curb logWhether logging is on for each agent, and how many records are held.
flanner curb log --verifyChecks that no record was changed, removed or reordered.
flanner curb log --disableRemoves the hooks. It asks first too.
--agent limits any of these to one agent.
agent, session
Which agent, and its own id for the session.
tool
The tool that was called.
channel
The channel the call used: file tools, shell files, shell network, web or MCP.
target
Its kind, such as a file, a URL or a command, and a keyed fingerprint of it. Never the path, the address or the command line itself.
program
For a shell command, the name of the program it ran.
decision
Requested, ran, failed or denied.
time
When it happened.
Curb's own approvals are logged too: what was asked, and whether it was granted or refused.
The hooks fail open. If a record cannot be written, the hook exits quietly and the tool call goes ahead unlogged. Your agent is never stopped over a log line.
Hash chain and signature
Each record carries the hash of the record before it, and its own hash, signed with this device's key. So a record that is edited, removed or moved breaks the chain.
flanner curb log --verify walks the whole log. It names the first record that fails and exits 1.
Records are kept for 30 days, on this machine only. Older ones are dropped, and the chain starts again from a signed record that names the last one dropped. flanner curb forget deletes the log.
Observed use
The log shows what each agent has been seen using. That is evidence of use. It is never proof of need.
flanner curb observedFor each agent and channel: seen, and how many times, or not seen. --agent picks one agent; --json gives the same, redacted the same.
no evidenceThe log is off, nothing is logged yet, or the log is shorter than the window: 14 days and 20 sessions.
partial evidenceThe window is met, but some sessions ran without the hooks. What they did is unknown, and the report says how many.
observed useThe window is met, and every session in it was logged.
Not seen is not the same as not needed. A channel that was not seen is reported as not seen, and nothing is closed because of it.
Once the window is met, Curb may list a channel under “To review”: one that is open, that the hooks can see, and that was never seen in use. It is a suggestion for you to weigh, with what could not be observed listed beside it. Curb never applies one.
What the hooks cannot see
A hook sees a tool call. It does not see what a shell command starts: child processes are never logged, for either agent.
Codex's hooks cover shell commands and patches only. Its web search, MCP servers and apps are not seen, and each is marked that way in the report. A channel the hooks cannot see never gets a suggestion.
A session that ran without the hooks is known only by its transcript. Curb counts those sessions, and reports partial evidence rather than guessing what they did.