agit — git for running agents

An AI coding session is trapped: one terminal, one machine, a proprietary log
format, one pair of eyes. When it ends you're left with changed files and a
scrollback buffer.

agit turns the session itself into an open artifact. It imports a runtime's
native log into an append-only, hash-chained JSONL event log — and every
feature is a view over that log. agit does not build an agent; it sits above
every agent, the way git sits above every editor.

(a synthetic fixture session — real ones look the same, only longer)

agit is not an observability platform. Those ask you to instrument your
agents with an SDK, and they show you what that instrumentation captured.
agit reads the logs your runtime already wrote, on your own machine, with
nothing to adopt in advance. And because every event carries content
hashes, agit can prove when a log is incomplete rather than quietly
presenting a partial picture as the whole story.

npm install -g agitsh

Or, for contributors, from source:

git clone https://github.com/agitHQ/agit && cd agit
npm ci && npm run build && npm link   # `agit` is now on your PATH

What works today

• agit import <session | bundle> — ingest a native session into
  .agit/sessions/<id>/events.jsonl, or adopt an agit log someone sent
  you (a pr bundle, a downloaded share log) — auto-detected, verified
  before it is stored, and kept byte for byte so the sender's hashes still
  check out. Adapters for native logs, also auto-detected:
  Claude Code (~/.claude/projects/<project>/<uuid>.jsonl),
  Codex CLI (~/.codex/sessions/<y>/<m>/<d>/rollout-*.jsonl),
  OpenClaw (its JSONL transcripts, or the agent database that holds
  them: agit import openclaw-agent.sqlite), Cline — both the SDK
  messages file new sessions land in and the 3.x task directories an
  installed history still sits in (agit import <globalStorage>/tasks/<id>)
  — Roo Code's task directories, which are the same layout in its own
  dialect, pi sessions (~/.pi/agent/sessions/--<cwd>--/*.jsonl),
  Hermes Agent's session database (agit import ~/.hermes/state.db),
  ATIF trajectories, LangGraph checkpoint databases
  (agit import checkpoints.sqlite), Gemini CLI recordings
  (~/.gemini/tmp/<project>/chats/session-*.jsonl), Kimi Code wire
  logs (~/.kimi/sessions/<work dir>/<session>/wire.jsonl), and
  OpenCode's session database
  (agit import ~/.local/share/opencode/opencode.db) — the same event log,
  the same verbs, whichever agent produced the session. A database holds sessions rather
  than a session: every one in it is imported, one line each, and
  --thread <id> names just one. agit import --all finds every session
  those runtimes have written on this machine (~/.claude/projects,
  ~/.codex/sessions, ~/.openclaw/agents/*/sessions and the agent
  database beside them, ~/.gemini/tmp/*/chats,
  ~/.kimi/sessions/*/*/wire.jsonl, ~/.pi/agent/sessions/*/*.jsonl,
  ~/.hermes/state.db,
  ~/.local/share/opencode/opencode*.db, ~/.cline/data/sessions and
  ~/.cline/data/tasks, and VS Code's
  User/globalStorage/{saoudrizwan.claude-dev,rooveterinaryinc.roo-cline}/tasks)
  and imports what is new;
  --latest
  takes just the most recent one; --since 7d bounds the scan. A directory
  listing plus the ordinary import — no daemon, no hooks — and last month's
  sessions are found the same way as today's.
  Deterministic: the same input always produces byte-identical output.
  Credential-looking strings are redacted on the way in (see
  SPEC.md section 8 for exactly what is and isn't caught).
  --no-redact stores a session verbatim when redaction would mangle it;
  share, pr and export-html then refuse that session until you pass
  --allow-unredacted, and re-importing without the flag puts redaction back.

• agit ls — list imported sessions: start, duration, events, files
  touched, and tags. Ids show as the shortest prefix still unique in the
  store. Narrow with --tag, --runtime or --project, order with
  --sort started|events|files|id.

• agit tag <id> <tag> / agit note <id> "<text>" — what you thought
  about a session afterwards. Both live in a sidecar (notes.json) beside
  the log and never enter the chain: the chain is what the runtime did, and a
  tag changes. agit verify neither sees nor is affected by them.

• agit rm <id> and agit gc --older-than 90d [--keep-tagged] —
  retention. Both confirm before deleting, and refuse outright when there is
  no terminal to ask unless --yes is passed. rm warns first that any fork
  of the session loses its merge base, since agit merge reconstructs that
  from the log — it cannot know whether such a fork exists, since forks live
  wherever --out put them with no registry to consult, and says so rather
  than guessing.

• agit show <id> — one-session summary: model, tools, token totals,
  per-file diffstat. --by-model splits it: what each model cost and how
  many files its edits touched. Tokens are exact; file attribution credits
  an edit to the model named by the nearest preceding event, and says so.

• agit stats — store-wide usage across every session and runtime:
  tokens, cache reads and writes, API calls, sessions and files touched,
  grouped --by day|model|runtime|project and narrowed with --since.
  No prices are built in — they change, they differ per account, and a stale
  number that looks authoritative is worse than none. Pass your own rate
  table to get money:

  { "currency": "USD", "per": 1000000,
    "models": { "claude-opus-5": { "input": 15, "output": 75,
                                   "cacheRead": 1.5, "cacheWrite": 18.75 } } }
  

  agit stats --by model --price rates.json. A model missing from the table
  is reported as unpriced, never costed at zero, and a group whose runtime
  records no cost events at all says so rather than showing a row of zeros.
  A fold over the cost events each session already carries, so it needs no
  new data, and it says how many sessions it could not read rather than
  quietly leaving them out. --json for scripts.

• agit grep <pattern> — search every imported session at once:
  "which session touched auth.py" (--path), "where did I run pytest"
  (--type tool.call). Matches the same one-line rendering replay --timeline prints, so what you search is what you saw, and outputs one
  flat row per hit for piping onward.

• agit verify <id> — validate the hash chain; reports the first broken
  link, and detects truncation via meta.json.

• agit blame <file> and agit why <file>:<line> — from a line of
  code back to the session and event that wrote it, and from there back to
  the prompt that asked for it. Verifiable rather than merely recorded: the
  line traces to a hash-chained event, and every replayed step had to
  reproduce its own content hash. It inherits the §5.7 limit and says so —
  lines a shell command wrote read (no structured edit), and where a file
  changed outside structured edits, blame stops at that point and names it
  instead of guessing past it. agit link prints the
  Agit-Session: <id>@<seq> <hash> trailer to anchor a commit to a session.

• Redaction controls — the built-in patterns (SPEC §8) can be extended
  and narrowed per project via .agit/redact.json (or --redact-patterns):

  { "patterns": [{ "label": "acme-token", "regex": "acme_[A-Za-z0-9]{20,}" }],
    "allow": ["sk-ant-EXAMPLE00000000000000", { "regex": "^sk-ant-example-" }] }
  

  Custom patterns catch internal token formats the built-ins cannot know
  about; the allowlist keeps documented example keys and test fixtures from
  being rewritten on import. agit redact --check <log> is a dry run: it
  prints what would be redacted, by event type and payload path, with every
  sample masked, then re-scans the redacted result so the count can never
  under-report. --no-redact stores a log exactly as the runtime wrote it —
  for local-only stores; share and pr refuse such a session unless
  --allow-unredacted is passed. Redaction still happens once, before
  hashing, at import: the chain never holds both versions of a string. A
  live share re-converts from the native log rather than reading the
  store, and applies the same config, so what a viewer sees is redacted by
  the same rules the store was.

• agit replay <id> — step through events (n/p/g N), inspect any
  event, and show cumulative file state at any point (s, or --at N --state non-interactively). --at N jumps straight to event N;
  --timeline prints the whole session one line per event.

• agit fork <id> --at N — branch a session at event N. The file tree
  is reconstructed from the log and verified: every replayed diff must
  reproduce its event's content hash, broken chains recover from
  runtime-recorded pre-edit content where it exists, and whatever cannot be
  verified is listed instead of written. Context is honestly lossy: the
  fork gets SEED.md, a deterministic mechanical summary (provenance,
  the task, last exchanges, file state) — not a transplant of the agent's
  mind. fork.json records the source session and fork-point hash, so
  provenance is checkable with agit verify.

• agit diff <a> <b> — what two sessions did differently: files each
  side touched, which ones converged on identical content, which diverged
  (with both hashes), and the work each spent getting there. agit diff <fork-dir> compares a fork against the parent it came from, starting at
  the fork point recorded in fork.json. Comparison is by reconstructed
  content, so it inherits replay's blind spot and says so.

• **agit merge <fork-dir> — bring a fork's files back: ordinary git
  three-way merge per file with the fork point as base (git merge-file
  does the merging). Trivial cases fast-forward, real conflicts get
  standard markers and a nonzero exit, and the merge — outcomes plus your
  --summary of what the fork learned — is recorded in the fork's
  merge.json. Not a merge of two minds; file-level, as promised.

• agit pr <id> — hand a session to a colleague as a directory: the
  full event log, meta.json, the reconstructed hash-verified tree,
  SEED.md context, and provenance. They run agit import on the
  directory and get a session they can replay, fork and verify like any
  other — working context, not a read-only transcript.

• agit share <id | native.jsonl> — share a session through a relay,
  live while the agent is still running: the CLI tails the native log
  and streams events; teammates watch in a browser (timeline, diffs, token
  meter) and can send messages that land in your terminal. Watching is
  read-only by default: viewer messages reach the human at the keyboard,
  never the agent; --steer is the opt-in that changes that, below. A
  completed live stream is byte-identical to a full
  import — viewers can download events.jsonl and agit verify what they
  watched. If the sharing CLI dies, agit share --resume <share-id>
  reattaches to the same link and pushes only the missing tail. Links
  expire (24h default) and sharing is opt-in per session, always. A stored
  session whose chain does not verify is refused — share, export, fork
  and pr all name the failing event rather than publishing it. A session
  that lives in a database is shared the same way — agit share ~/.hermes/state.db --thread <id> (the id is optional when the file holds
  one session) — read as SQLite reads it, WAL sidecar folded in, so a
  running Hermes, OpenCode or LangGraph session streams as its rows land;
  totals a runtime records only for the whole session are held back until
  it ends, and a message OpenCode is still streaming (no time.completed
  yet — its parts grow in place) is held back until it completes. A runtime
  that rewrites earlier rows in place (a compression, a rewind) stops the
  share as the rewrite of streamed history it is.

• agit share <native.jsonl> --steer — let teammates redirect the agent,
  not just watch it. The share prints a steer key alongside the link; a
  viewer who enters it (on the page, or from a terminal with
  agit steer <link> "<text>" --steer-key K) sends a message to the agent
  instead of only to your terminal. Nothing is injected mid-run and nothing
  is typed on your behalf: the message is queued under .agit/steer/, and
  Claude Code's own hooks hand it over at the next turn boundary —
  Stop, so the agent picks it up instead of stopping, and
  UserPromptSubmit, so it rides along with your next prompt if the agent
  was idle. Both are the documented hookSpecificOutput.additionalContext
  channel, subject to Claude Code's own loop guard (eight continuations in
  a row, then it stops regardless). One-time setup per project:
  agit hook --config prints the two-line settings.json fragment that
  runs agit hook at those events; it prints nothing unless a live share
  has queued something. Every steered message is shown in the sharing
  terminal first, attributed, and a message with a wrong key is shown too —
  labelled, and delivered to no one. The key never reaches other viewers;
  the relay forwards it to the sharer alone, who is the only party that can
  check it. Three runtimes are wired, because three document a
  turn-boundary channel: Claude Code (above, verified against the
  runtime); Gemini CLI, whose AfterAgent hook takes a blocking
  decision whose reason is sent to the agent as the next prompt with the
  history kept, and whose BeforeAgent hook takes additionalContext for
  the idle case — agit hook --config gemini-cli prints that fragment; and
  pi, whose extension API lets a handler inject a message from
  before_agent_start and queue one from agent_end with
  pi.sendMessage(…, { deliverAs: "followUp", triggerTurn: true }) —
  agit hook --config pi prints a small extension that does exactly that
  by running agit hook, to save as ~/.pi/agent/extensions/agit-steer.ts.
  Both Gemini CLI's and pi's paths are derived from the source and not yet
  exercised against a running copy. --steer on a Codex or OpenClaw
  session is refused with that reason rather than promising a channel that
  does not exist.

• agit relay — the self-hosted relay behind share: in-memory only,
  loopback by default, nothing persisted. PROTOCOL.md
  documents the (v0, unstable) wire protocol.

• agit push <id> / agit pull <link> — a remote is just a relay
  someone else runs. push publishes a verified session and exits, printing
  a link; pull adopts it somewhere else over HTTP. Pulling is the same code
  path as adopting a pr bundle, so the relay is never trusted: the chain
  is verified before anything is stored, the events land byte for byte with
  the hashes the origin published, and a relay that alters a single byte
  serves a log that fails verification. Pushing twice reuses the same link
  unless you pass --force, and pushing a session that does not verify is
  refused, like every other publishing verb.

  agit relay --store <dir> gives the relay a disk, so a restart keeps every
  link working instead of dropping it — two flat files per share, no database
  and no dependency. Without it the relay is memory-only, which is still the
  default. That directory holds writer tokens, so treat it as a credential
  store; it is created 0700 with 0600 files, and on Windows those modes
  are advisory. agit share --static --detach prints the link and exits, for
  CI and scripts that want a URL rather than a process.

• agit export <id> --otel | --atif — feed the tools you already run,
  with a log that verifies. --otel emits OTLP/JSON spans following the
  OpenTelemetry GenAI semantic conventions: an invoke_agent root, chat
  children per model call with token counts, execute_tool children per tool.
  --atif emits a Harbor Agent Trajectory Interchange Format document
  (ATIF-v1.8), which Harbor uses for evals and fine-tuning and which its
  OpenHands adapter converts OpenHands event logs into. Both are folds over
  events already stored; neither changes SPEC.

  Span ids are the leading bytes of the event hash they came from, so a
  trace in Grafana points back at a specific line of a log you can agit verify; the full hash rides along as an attribute, because 8 bytes is a
  convenience and not a proof. Output is deterministic — no random ids, no
  wall clock — and an unverified session is refused, since feeding an eval
  from a log agit cannot vouch for is how a verified pipeline quietly stops
  being one. The GenAI conventions are at Development stability and have
  never cut a release, so the emitted schema URL ends in -dev and this will
  need updating; file.diff has no home in either schema, so edits ride in
  each format's own extension field with the SPEC §5.7 lower bound stated
  beside them.

• agit export <id> --markdown — the session as a Markdown audit report
  for a PR body or a review ticket: provenance (head hash, chain verified,
  every signature and its verdict), usage totals as stats counts them,
  the files touched with the SPEC §5.7 floor stated, and a timeline.
  Everything a log contributes is text, never structure: message bodies
  are fenced with a fence longer than any backtick run inside, names and
  paths sit in inline code built the same way, and table cells escape their
  pipes — a user message reading # AUDIT PASSED stays inside its fence.
  Same gates as export-html: an unverified session is refused, and an
  unredacted one needs --allow-unredacted.

• agit sign <id> --key <file> — bind a head to a key. The chain proves
  a log was not modified after it was chained; it says nothing about who
  chained it, because anyone can rebuild a perfectly valid chain over edited
  content and a matching head. A signature is the missing half, and verify
  catches exactly that forgery:

  NOT OK: 31 events, chain intact, matches meta.json head, but a signature does not match:
  SIGNATURE DOES NOT MATCH (SHA256:+++sbwFo…): does not match this head — the log changed after signing, or the signature was never valid
  

  Ed25519, reading the ~/.ssh/id_ed25519 you already have or any PKCS#8
  PEM. Signatures live in meta.json, never in the chain, so a session can
  be signed after import and by more than one person without rewriting an
  event — and they travel in pr bundles, so the recipient can check them.
  Encrypted keys are refused rather than prompted for; agit never handles a
  passphrase. What it does not prove: when. The timestamp is signed, so
  it cannot be edited afterwards, but it is still a time the signer chose.
  Only a third-party RFC 3161 time-stamp makes that evidence, and agit does
  not issue one. SPEC §12 documents the signed payload so other
  implementations can verify without agit.

• agit mcp — serve the store to an agent over MCP, so the agent can
  ask its own verified history "have I solved this before?" instead of that
  being something only a human can do with grep. Six read-only tools:
  agit_list, agit_grep, agit_show, agit_replay, agit_diff and
  agit_verify. Claude Code, Codex, Cursor, Gemini and Cline all speak MCP,
  so one server covers every runtime agit imports from. Point a client at it:

  { "mcpServers": { "agit": { "command": "agit", "args": ["mcp", "--dir", "/path/to/project"] } } }
  

  Read-only by design. There is no tool that writes, and nothing arriving
  over this transport reaches import, tag, rm or the redaction config.
  Every answer carries whether that session's chain verifies, and
  agit_verify asks directly, so an agent knows what it is trusting. Session
  logs are untrusted input, so each payload is labelled as recorded data
  rather than direction — a label, not a sandbox, and worth the same
  scepticism as redaction.

--json on ls, show, show --by-model, verify, grep, diff
and export emits the structures agit already builds, so a script reads
the same numbers the table renders — full ids, ISO timestamps, real
integers. grep --json is one object per line (NDJSON); everything else
is one document. Errors stay on stderr, so a pipe into jq is always clean.

Session ids accept unique prefixes, git-style. The inspection verbs are
fully local: no server, no network calls, no telemetry. Only share talks
to a relay — one you run.

Adapter matrix

What each runtime's log lets agit do, at a glance; the reasons and edges are
in "What does not work yet" below. Verified means a file.diff whose
hashes are over bytes agit holds and the runtime wrote; window means an
update verifies only while agit already holds the file (a create, an
earlier verified edit, a complete read, or --base).

Every database (LangGraph, OpenClaw, OpenCode, Hermes) is read with its WAL
sidecar folded in, so a running writer's newest rows are seen. "Derived
from source" means the adapter was built from the runtime's own recorder
and checked against a fixture written the same way, not against a real log
from that runtime; a real one that disagrees names its unmapped records in
the import report.

The format

SPEC.md is the most important artifact in this repo. Nine event
types (session.start, session.end, message.user, message.assistant,
tool.call, tool.result, file.diff, file.delete, cost), each
carrying a canonical
SHA-256 hash and the hash of the previous event. Tamper-evidence, stable fork
points, and independent verification of what an agent claims it did — all
fall out of that chain.

What does not work yet

Said plainly:

• Twelve adapters, with different limits. Claude Code is the reference;
  Codex is mapped from its own structured edit records. OpenClaw is mapped
  from the apply_patch text it records, replayed with OpenClaw's own
  matching rules. pi's write writes its argument verbatim and its edit
  records the patch it applied, so both verify — a write against the bytes
  it wrote, an edit against content agit already holds. Hermes's write_file
  verifies when its own post-write byte count says nothing was transformed,
  and its patch against content agit holds. ATIF is a standard rather than a runtime, Cline's SDK
  format is a published contract and its 3.x task directory is read from
  the source of the last release that wrote it, LangGraph's and OpenCode's
  databases are read from each runtime's own schema, Gemini CLI's recording
  is folded the way its own loader folds it, and Kimi Code's wire log is
  folded the way its own replay folds it; none of the seven carries file
  content agit can hash — see below.
• Codex updates have a verification window. Codex records a file's full
  content when it creates one, but only a diff when it updates one — so
  agit can verify an update only while it already holds that file's content
  from earlier in the same session. An edit to a file that predates the
  session is skipped and counted, never hashed on a guess — unless you supply
  the base yourself: agit import <log> --base <git-ref | directory> seeds
  the pre-session content from the commit the session started from, or a copy
  of the tree. It is checked, not trusted: the runtime's own diff still has to
  apply to it and the result still has to hash, so a wrong base skips exactly
  as no base does. Only files the runtime actually edited are consulted;
  nothing else enters the log, and meta.json records which base was used.
• OpenClaw has the same window: apply_patch records the patch, not
  the file, so an update is verifiable only for a file the session created.
• Codex renames are recorded as a delete plus a create — schema v2 gives
  a rename an honest encoding, so the log says what the filesystem saw: the
  old path gone, the new one created with the updated content. A rename
  whose base predates the session is still skipped and counted, because
  neither path has content agit could hash. Deletions are recorded
  (file.delete) whenever Codex logged the file's content.
• Codex reasoning arrives encrypted and is dropped, counted.
• file.diff coverage is partial. Diffs come from structured edit tools
  (Edit/Write). Files changed through shell commands leave no diff event;
  file state from replay is a lower bound on what changed. Fork trees
  inherit this blind spot: a file the log never structurally edited is
  absent from the tree entirely, and a file deleted by a shell command
  still appears at its last logged content — only a structured deletion
  (file.delete) removes it.
• No message injection mid-run, and steering is wired per runtime.
  Sharing is watch-only unless the sharer passes --steer, and even then a
  message is never fed into a running turn: it waits for the runtime's own
  turn boundary — Claude Code's Stop / UserPromptSubmit hooks, Gemini
  CLI's AfterAgent / BeforeAgent, pi's agent_end /
  before_agent_start extension events — and is delivered through the
  channel each documents, which the agent weighs like any other context — a
  teammate's request, not a command from the keyboard. Codex, OpenClaw,
  Cline, Roo Code, Kimi Code, OpenCode, LangGraph, Hermes and ATIF sessions
  have no documented equivalent, so --steer refuses them; a runtime that
  gains one gets wired the same way, per adapter, opt-in.
• The relay speaks TLS only when you give it a certificate.
  agit relay --cert <pem> --key <pem> serves HTTPS; otherwise it is plain
  HTTP on loopback, and binding beyond loopback without TLS is refused unless
  --insecure is passed. A tunnel or TLS-terminating proxy remains a
  perfectly good alternative (PROTOCOL.md).
• Merge is file-level. Three-way content content merge only, and a
  rename is two files. It uses git merge-file when git is on PATH and a
  built-in three-way merge otherwise (--no-git forces the built-in one);
  git is preferred because its results are what everyone's expectations are
  calibrated against, and the two are pinned to each other by differential
  tests. A file simply absent from a fork tree counts as untouched rather
  than deleted, because the tree records only what the log could reconstruct
  — but agit merge --session <id> reads the fork's own imported session and
  honours the file.delete events it recorded after the fork point, deleting
  only where the removed content matches both the fork point and what the
  target holds today. Fork and pr context seeding is a summary by design;
  you cannot inject history into a running agent.
• An ATIF import has no file history. agit import <trajectory.json>
  reads Harbor's Agent Trajectory Interchange Format, so anything emitting
  ATIF can be verified, replayed, searched and shared. But ATIF has no
  file-edit construct — a write is an ordinary tool call whose result is
  prose — so no file.diff can be emitted over content the document does not
  hold. blame, why, fork, merge and diff therefore have nothing to
  work with on such a session; everything else does. What the import cannot
  carry is counted and named rather than passed over, including edits that
  agit itself exported as hashes.
• A Cline SDK import has no file history either, for a sharper reason.
  agit import <id>.messages.json reads the format new Cline sessions land
  in from 4.0 (~/.cline/data/sessions/), which Cline documents as "the
  canonical replay/export artifact" for exactly this purpose. The editor
  tool's create path converts LF to CRLF when, and only when, the operating
  system Cline ran on is Windows — and the log does not record which OS that
  was. A hash over the recorded content would be right on Linux and wrong on
  Windows, which is a hash agit did not compute over bytes it holds, so none
  is emitted. Edit results carry only a diff the runtime truncates at 200
  lines. Every editor and apply_patch call is counted in the import report
  as an edit agit cannot verify.
• A Cline 3.x task directory imports, and its <final_file_content> is
  not the file. agit import <globalStorage>/tasks/<taskId> (or the
  api_conversation_history.json inside it) reads the layout every Cline
  release up to 3.89 wrote — frozen now that 4.0 moved on — the way that
  release's own source reads it: XML tool calls split by Cline's own parser
  and paired with the framed results that follow them, native tool_use
  calls by id, and, for tasks older than the transcript's own ts and
  metrics stamps, dates and token counts taken from the ui_messages.json
  beside it by the index Cline writes on every timeline entry (or by request
  order where even that predates the file). Cline's own injected
  <environment_details> is counted, not filed as the person's words. The
  research on #63 expected this to be the layout where edits verify, since a
  write's result carries the whole file in <final_file_content>; reading
  DiffViewProvider.saveChanges shows it carries a normalized copy — line
  endings rewritten to the model's, trailing whitespace trimmed, one newline
  appended — so a hash over it is not a hash over the bytes on disk, and none
  is emitted. Roo Code's task directories are read by the same adapter,
  in Roo's dialect, from Roo's own source (archived May 2026): the same
  two files, but a UUID task id, Roo's tool and parameter names, an XML-era
  result written as two blocks (the [name for '…'] Result: frame, then the
  content), native results with no framing, toolError as JSON by the end,
  condensed-context summaries and truncation markers in the transcript, and
  no conversationHistoryIndex ever — so older Roo tasks pair with the
  timeline by request order, and usage is paired only when the request and
  turn counts agree. Which dialect a task is in is decided from the
  directory name (milliseconds are Cline's, a UUID is Roo's) or the
  transcript's own tells, recorded in session.start, and reported as
  runtime cline or roo-code. Derived from the sources and checked
  against fixtures built to them, one per tool-call shape per dialect; a
  real task that disagrees names its unmapped blocks in the import report.
• A Gemini CLI import is the recording as Gemini CLI itself would load
  it. agit import session-*.jsonl reads what ChatRecordingService
  writes: a metadata line, then messages appended again each time their
  tokens or tool calls land, $set updates and $rewindTo marks. The
  adapter folds those by id exactly as the CLI's loader does, so a rewound
  turn is gone and a message's final form is what is recorded; the fold's
  losses (rewound messages, cancelled or unfinished tool calls, info /
  warning / error lines) are counted by name. A live share holds the
  last message back until a newer one settles it, since the last message is
  the one the writer re-pushes; a rewind during a live share stops it as
  the rewrite of streamed history it is. No file.diff: an edit is a tool
  call whose result is prose, and no content is recorded beside it. The
  legacy single-document .json form is read too. Derived from the source
  and checked against a fixture built to it; a real recording that
  disagrees names its unmapped records in the import report.
• A Kimi Code import reads the wire, not the context. Kimi keeps a
  session's model context in context.jsonl (no timestamps) and its event
  stream in wire.jsonl (each record stamped); agit import wire.jsonl
  reads the latter, folding it the way Kimi's own replay does — streamed
  text and thinking pieces merge into one assistant message per step, a
  tool call's argument parts fold into it, the step's token_usage becomes
  its cost, and a /clear turn drops what came before. The session id
  is the directory the file sits in, as Kimi's docs say; the wire names no
  model and no working directory, so both are null rather than guessed.
  Interrupted and retried steps, notifications, approvals and every other
  wire message agit has no event for are counted by name, as is a diff
  display block — a viewer's excerpt of an edit, not the file — so there
  is no file.diff. Derived from the source and checked against a fixture
  built to it; a real wire log that disagrees names its unmapped messages
  in the import report.
• A pi import verifies writes outright and edits within a window.
  agit import ~/.pi/agent/sessions/<project>/<session>.jsonl reads the
  format session-format.md documents: a header, then a tree of entries
  (/tree branches in place) linearized in file order with the tree kept
  under native. pi's write tool writes its content argument verbatim
  (fsWriteFile(path, content, "utf-8")), so a successful write is a
  file.diff hashed over exactly the bytes that reached the disk — recorded
  as a create when agit holds no prior content, since pi does not say
  whether the file existed, and counted as such. pi's edit records the
  unified patch it applied over the LF-normalized file; agit replays it the
  way edit.ts does — BOM off, line ending noted, normalize, apply, restore —
  when it already holds the file (a write, a verified edit, an untruncated
  read, which returns the text unchanged, or --base), and counts the
  edit otherwise. A complete read is also tagged on its result, so agit fork can rebuild a file whose first recorded edit came after one — the
  read has to hash to the edit's beforeHash to count. Shell edits stay
  invisible. usage.cost is dollars and is counted, not stored. OpenClaw writes this same format, being built on pi;
  the two are told apart by session version (OpenClaw's is 4, pi's 3) and,
  for a version-3 file, by whose tools it calls, before either adapter
  claims it. Derived from the source and checked against a fixture built to
  it; a real session that disagrees names its unmapped entries in the
  import report.
• A Hermes import reads state.db, and verifies what Hermes itself
  verified. agit import ~/.hermes/state.db reads the sessions,
  messages and session_model_usage tables from Hermes's own DDL, one
  session per import (--thread <id> picks one; every session with
  messages otherwise). Messages are in the OpenAI shape — tool calls as a
  JSON list on the assistant row, results as tool rows whose content is
  the tool's JSON, carried as structured. Hermes's write_file preserves
  a target's CRLF and BOM, then checks the disk's sha256 and reports
  verified and bytes_written; when the count equals the argument's UTF-8
  length nothing was transformed and the event's hash is over bytes Hermes
  confirmed — a create with a null beforeHash when agit held nothing
  before, since Hermes does not say whether the file existed. Its patch
  (replace mode) answers with a difflib diff of the BOM-stripped file, which
  agit applies to content it holds. A V4A patch and a read_file (returned
  with line gutters, long lines clamped) are not replayed. Hermes keeps no
  per-message usage: each model's session totals become one aggregate
  cost at the session's end, flagged as such. Rows retired by compression
  or a rewind are kept and flagged. state.db runs in WAL mode and Hermes
  keeps the WAL open, so the newest rows sit in state.db-wal; the import
  folds that sidecar in (below), so a running Hermes reads as it stands.
  Derived from the
  source and checked against a fixture written with the same DDL; a real
  database that disagrees names its unmapped rows in the import report.
• A database still being written imports as it stands. SQLite in WAL
  mode keeps committed pages in <file>-wal until a checkpoint, and every
  database agit reads (LangGraph, OpenClaw, OpenCode, Hermes) runs that way,
  so a reader that ignored the sidecar saw whatever was last checkpointed —
  agit used to refuse such a file. It now folds the sidecar's committed
  frames over the main file the way SQLite's own reader does: header
  checked, salts and the checksum chain verified frame by frame, the log
  ended at the first frame that breaks it, uncommitted frames left out, the
  latest committed page winning. The import report says how many frames in
  how many commits were folded in. A sidecar that is not a WAL at all is
  still refused, naming the checkpoint command.
• An OpenCode import has no file history either. agit import opencode.db reads the session, message and part tables OpenCode
  writes (its drizzle schema and generated DDL, its v1 session schema for
  the JSON in data), in the order its own MessageV2.page reads them.
  Messages, reasoning, tool calls with their results, and one cost per
  model step (from step-finish parts, or from the message when there are
  none) all come through. OpenCode's file changes live in git snapshots of
  the worktree, not in the database, so a patch part names files and
  carries no content: nothing is hashed, nothing is invented, and
  blame/fork/merge/diff have nothing to work with. Every part type
  agit has no event for is counted by name. Derived from the schema and
  checked against a fixture built to it; a real opencode.db that disagrees
  names its unmapped parts in the import report.
• A LangGraph import is the thread's current history, and no more.
  agit import <checkpoints.sqlite> reads what langgraph-checkpoint-sqlite
  wrote — the SQLite file itself, with a zero-dependency reader for the file
  format and for the msgpack the checkpointer serializes with — and maps the
  messages channel (LangChain messages: human, AI with tool calls and
  usage, tool results) onto the event log. What it follows is the parent
  chain from the checkpoint the runtime itself treats as current; a branch
  abandoned by update_state, a subgraph's own checkpoints, and any other
  thread in the file are counted, not imported. LangGraph has no file-edit
  construct, so there is no file.diff and nothing for blame, fork,
  merge or diff to work with; a message has no timestamp of its own and
  is dated by the checkpoint that first held it, which the report says. A
  database still open in WAL mode keeps its newest pages in the -wal
  sidecar; agit refuses such a file rather than read a stale one as
  current. Graphs whose state has no messages channel, the beta
  DeltaChannel snapshot form, and pickle checkpoints are refused or
  counted by name.
• A signature does not prove when, and does not prove truth.
  agit sign binds a head to a key, which is what the chain alone could
  never do. The timestamp inside it is signed, so it cannot be edited
  afterwards, but it is still the signer's own claim — turning that into
  evidence needs a third-party RFC 3161 time-stamp, which agit does not
  issue. And a signature over a log full of false statements is a signed log
  full of false statements: it binds an identity to bytes, nothing more.
• The MCP server labels untrusted content; it does not sandbox it.
  agit mcp hands recorded session text to a model, and that text can
  contain anything the agent saw, including material written to read as
  instructions. Every payload is framed as recorded data in a field no
  session can shadow, which is a label of the same kind as redaction and
  deserves the same scepticism.
• The OpenTelemetry export tracks a moving target. The GenAI semantic
  conventions are at Development stability, moved repositories during 2026,
  and have never cut a release — so --otel emits the only schema URL that
  exists, which ends in -dev, and will need updating as the conventions
  settle.
• Redaction is a seatbelt, not a guarantee. Session logs contain whatever
  the agent saw. Before sharing one anywhere, read it.

Security posture

Session logs are untrusted input: they may contain adversarial content and
are never executed, only displayed — the share page builds its DOM from
textContent exclusively and ships a CSP that forbids external resources.
Known credential patterns are redacted before events leave your machine
(at import and during live shares alike) and counted in meta.json. Share
links are unguessable 128-bit capabilities with TTLs; the relay holds
everything in memory, binds loopback by default, and persists nothing. A
steer key is a second, separate capability: the link lets someone read, the
key lets them queue a message for the agent, and the relay never learns
whether a key was right — only the sharer holds it. Never commit real
session logs to this repo — tests run against synthetic fixtures.

Development

Node 20+, TypeScript, ESM, zero runtime dependencies.

npm install
npm run build   # tsc -> dist/
npm test        # vitest

Conventional Commits, small and focused. If a real session breaks an adapter,
fix the adapter, not the fixture. CONTRIBUTING.md has the
full onboarding path — repo map, adapter-writing guide, and the rules that
are not suggestions. CI runs build + tests on Linux and Windows, Node 20/22.

License

Apache-2.0