agenticreplay 0.1.0 → 0.1.2

package/capture/CURSOR-HTTP2.md

@@ -1,226 +0,0 @@
-# Capturing Cursor, and the four things in the way
-
-Cursor's CLI agent was the one harness none of the existing techniques reached. Getting to its
-system prompt took four separate fixes, three of them in AgenticReplay itself. This is what each one
-was, how it was diagnosed, and how to reproduce the result.
-
-```console
-AGENTICREPLAY_BIN=packages/cli/dist/cli.js node capture/capture.mjs cursor
-```
-
-That is the whole procedure now. What follows is why it did not work before.
-
-## The shape of the problem
-
-Cursor is unlike the other four harnesses in every layer that matters.
-
-| | Claude Code / Codex / Qwen | OpenCode | Cursor |
-|---|---|---|---|
-| origin | environment variable | `opencode.json` | fixed, undiscoverable |
-| redirect | yes | no | no |
-| transport | HTTP/1.1 | HTTP/1.1 | **HTTP/2 only** |
-| wire format | JSON | JSON | **Connect over protobuf** |
-| prompt lives in | the request | the request | **the response** |
-
-Every cell in that last column is a separate obstacle, and they had to be removed in order.
-
-## 1. The interceptor spoke only HTTP/1.1
-
-The conversation goes to `agentn.global.api5.cursor.sh`, which negotiates h2 exclusively. The
-interceptor offered one protocol:
-
-```ts
-ALPNProtocols: ['http/1.1'],   // packages/proxy/src/intercept.ts
-```
-
-No common protocol, so the handshake died before any bytes moved:
-
-```
-warn tls.handshake_failed host=agentn.global.api5.cursor.sh
-  reason="tls_handle_alpn: no application protocol"
-```
-
-Offering `['h2', 'http/1.1']` fixes the handshake and nothing else. Two mistakes followed.
-
-**`secureConnect` is the client-side event.** A socket built with `isServer: true` emits `secure`.
-Listening for the wrong one dispatched nothing at all: the baseline passed 12 of 12 interception
-tests, and the change passed 4. That comparison is the only reason it was caught, and it is worth
-running the baseline before believing any test result on a change like this.
-
-**`session.socket` is a Proxy.** Node's http2 hands out a stand-in rather than the real socket, so
-the `WeakMap` keyed by socket never matched and every h2 stream was rejected as arriving on an
-unknown connection. The target is now a symbol property on the socket, looked up along `_parent`.
-
-## 2. An already-terminated TLS socket cannot be handed to an h2 server
-
-With ALPN fixed, the session established and then nothing flowed. The client gave up after five
-seconds:
-
-```
-RetriableError: [internal] HTTP/2 keepalive ping timed out after 5000ms
-```
-
-Rather than keep guessing against a live agent, this was reduced to a loopback with no agent in it
-at all: a raw socket, `new TLSSocket({ isServer: true })`, and the decrypted socket handed to
-`http2.createServer()` — exactly what the interceptor did.
-
-```
-client: connected
-server: alpn = h2
-server: session established
-TIMEOUT after 8s
-```
-
-So the architecture was wrong, not Cursor. An `Http2Session` takes over the socket's handle rather
-than reading the stream, and the client's connection preface and first PING — already buffered by
-the time the handshake callback runs — are never seen.
-
-The same harness with `http2.createSecureServer` doing the TLS itself answers immediately. The
-interceptor now keeps one such server per intercepted host, with `allowHTTP1: true` so a single
-server still serves HTTP/1.1. Per host rather than one server with `SNICallback`, so the
-certificate is still chosen by the CONNECT target: SNI would work for every client that sends it
-and quietly pick the wrong certificate for one that does not.
-
-One detail only a real run surfaces: with `allowHTTP1`, an h2 request emits **both** `stream` and
-`request`. Answering both throws `ERR_HTTP2_HEADERS_SENT`, so the `request` handler serves HTTP/1.1
-only.
-
-## 3. A binary body could not survive the trace
-
-Two independent problems, one after the other.
-
-**Bodies were decoded as text.** `bytes.toString('utf8')` on a protobuf body replaces every invalid
-sequence with U+FFFD and is not reversible: 974 replacement characters in 8,459 bytes. A body that
-is not valid UTF-8 is now recorded as base64 behind a marker, decided by a round-trip test, so text
-bodies are untouched.
-
-**Then the redactor shredded the base64.** A base64 body is one long high-entropy run by
-construction, and the entropy scanner replaced 226 spans of a 14 KB response with
-`<secret:high_entropy:…>` placeholders. The raw bytes were 14,366 and started with valid Connect
-framing; the trace copy was 6,161 bytes of noise. Comparing the two in one run is what identified
-it — before that, the corruption looked like the interceptor losing the head of the stream.
-
-The redactor now leaves a body carrying the marker alone. The named pattern rules still run on it;
-only the randomness heuristic is skipped, and it was protecting nothing there, because a credential
-inside a binary body is not matchable once encoded.
-
-## 4. The prompt is in the response, not the request
-
-The request to `/agent.v1.AgentService/Run` is around 3 KB and carries the user's turn, a few
-session ids, and — with `auto` — the router's whole candidate set with per-model settings, such as
-`claude-fable-5-1` at `thinking: true, context: 300k, effort: high`. No system prompt.
-
-The server composes the prompt and sends the whole conversation **back** in the response stream,
-gzipped inside Connect frames. Reading it needs no `.proto` files: the frames carry the messages as
-JSON strings, so five bytes of framing, a gunzip where the flag bit says so, and a brace-matched
-scan for `{"role": …}` is enough.
-
-An earlier conclusion here was wrong and worth recording as such: the request being small was read
-as "the prompt is server-side, so it cannot be captured". The first half is right and the second
-does not follow.
-
-**Which model answered comes from the response, not the request.** The first version of this
-profile took the first model-shaped string in the request, which under `auto` is a candidate rather
-than the choice, and filed three captures under `grok-4.6` when the model that actually answered
-was `grok-4.5-high`. The response states it once:
-
-```json
-"providerOptions":{"cursor":{"modelName":"cursor-grok-4.5-high"}}
-```
-
-The same regex also matched the working directory, which reaches the request as a path and produces
-a slug beginning `claude-`. Real model ids are short, so the candidate list is filtered by length.
-
-## What comes out
-
-```
-system[0]      1,954 chars    the prompt itself
-user[0]       19,031 chars    environment, rules, skills, tool namespaces
-user[1]          165 chars    timestamp and the typed turn
-assistant[2]     844 chars    the reply
-```
-
-The prompt opens:
-
-> You are an AI coding assistant, powered by Composer. You are an interactive CLI tool that helps
-> users with software engineering tasks.
->
-> `<communication>` Communicate directly and concisely. You are Auto, an agent router designed by
-> Cursor. If asked who you are or what your model name is, this is the correct response.
-> `</communication>`
-
-Sections are `<communication>`, `<citing_code>` and `<terminal_files_information>`. The 19 KB user
-turn carries `user_info`, `agent_transcripts`, `rules`, `user_rule`, `agent_skills`,
-`dynamic_tools` and `dynamic_tool_namespaces`.
-
-Cursor declares no tool schemas. Two meta-tools are described in prose, `GetDynamicTools` and
-`CallDynamicTool`, and the rest are named in an attribute:
-
-```xml
-<namespace name="cursor" tools="CreateGoal, GenerateImage, UpdateGoal" …>
-```
-
-The schemas stay server-side, so a tool count of five is the honest number rather than a missing
-one.
-
-## What is still not captured, and why
-
-`cursor-agent models` lists 217 entries, mostly effort and speed variants of a dozen base models.
-Only `auto` can be captured on this account. Every named model answers:
-
-```
-capture failed: Cursor answered resource_exhausted rather than running the turn, so there is no
-prompt to read.
-  resource_exhausted means the account has no quota left for this model; try another, or `auto`.
-```
-
-Tried and refused: `composer-2.5`, `composer-2.5-fast`, `claude-opus-5-thinking-high`,
-`gpt-5.3-codex`, `gpt-5.2`, `cursor-grok-4.6-low`, `gemini-3.7-flash-high`. This is an account
-limit, not a pipeline limit — the same command succeeds on `auto` every time.
-
-`auto` routed to `grok-4.5-high` on all seven runs and produced a byte-identical prompt every
-time, including when the typed turn was changed from a one-word reply to a reasoning question and
-to a coding task. So there is no evidence either way about whether the prompt varies with the model
-Auto picks. Getting that answer needs an account with quota on more than the router.
-
-The candidate set is worth reading on its own, because it is the only place that says what Auto was
-choosing between — nine models, recorded in `meta.json` as `router_candidates`:
-
-```
-claude-fable-5-1  claude-opus-5  claude-sonnet-5  composer-2.5  gemini-3.8-flash
-gpt-5.6-sol  gpt-5.6-terra  grok-4.5  grok-4.6
-```
-
-Nine candidates and one reachable model is the same account limit seen from the other side.
-
-## Reproducing it
-
-The h2 interception is not in any published agenticreplay build, so the capture has to run against a local
-one. `AGENTICREPLAY_BIN` exists for that.
-
-```console
-npm ci && npm run build
-AGENTICREPLAY_BIN=packages/cli/dist/cli.js node capture/capture.mjs cursor
-```
-
-Prerequisites: `cursor-agent` installed and signed in (`cursor-agent status`), and a directory it
-trusts — the profile passes `--trust`, which grants the directory and nothing else, unlike
-`--yolo`.
-
-Two things look like failures and are not. `tls.handshake_failed … ECONNRESET` appears once or
-twice per run for connections that are not the model call. And `capture.empty exchanges=0` is
-expected: that counter tracks *model* exchanges, and a harness captured by decrypting its own
-protocol produces net exchanges instead, which is why the profile is marked `netOnly`.
-
-## Verification
-
-| | |
-|---|---|
-| `npm run typecheck` | passes |
-| `packages/proxy/test/tls-intercept.test.ts` | 12/12 |
-| `packages/core` + `packages/proxy` | 3 failed / 372 passed, the same three files as the baseline |
-| full suite | 32 failed / 1493 passed, file-for-file identical to the baseline |
-| Cursor capture | succeeds; prompt identical across three runs |
-
-Every failure in the suite predates this work. The baseline was recorded by restoring the original
-`intercept.ts` and running the same commands, which is the only way that claim means anything.

package/capture/README.md

@@ -1,349 +0,0 @@
-# Agent system prompt captures
-
-![one capture.mjs run](capture-run.gif)
-
-<sub>A real run, 35 seconds compressed to 13. The pause after `launched pid=` is the agent starting
-in its own console and sending its first turn. The two absolute paths are replaced with a
-placeholder repository; nothing else is reworded.</sub>
-
-
-Captured with AgenticReplay at the local proxy layer: what the harness on this machine actually sends,
-not what a service returns. Everything is scrubbed except the raw traces.
-
-Two directories, and the split is the point:
-
-- `prompt/` is the collection. One file per capture, the prompt and nothing else, flat enough to
-  browse. This is what you read and what you share.
-- `capture/` is the machinery and the evidence: the script, these documents, and one folder per
-  capture holding the prompt, the request body, the tool definitions, the metadata and the raw run.
-
-The prompt exists in both, so each capture folder stands on its own. The copy under `capture/` is
-the source; `--index` compares the two byte for byte and rewrites the mirror in `prompt/` when they
-differ, naming what it repaired. A hand edit to a generated file therefore does not survive
-quietly, which is the part that makes keeping two copies safe.
-
-## One command
-
-```console
-node capture/capture.mjs claude                        # interactive, model from settings
-node capture/capture.mjs claude --model claude-fable-5-1
-node capture/capture.mjs claude --print                # the cheaper -p variant
-node capture/capture.mjs codex  --model gpt-5.6-sol
-node capture/capture.mjs --index                       # rebuild index.json only
-```
-
-```console
-node capture/capture.mjs opencode                      # a free model, so this one costs nothing
-node capture/capture.mjs qwen  --model gpt-5.6-sol --dir qwen-gpt-5.6-sol
-AGENTICREPLAY_BIN=packages/cli/dist/cli.js node capture/capture.mjs cursor
-```
-
-Cursor needs `AGENTICREPLAY_BIN` pointing at a local build: it is reached by decrypting HTTP/2, which no
-published agenticreplay has. `CURSOR-HTTP2.md` covers that in full - four obstacles, three of them fixed in
-agenticreplay itself, and what is still out of reach.
-
-All three work in one command. OpenCode is reached a different way: its provider origin lives in
-`opencode.json` rather than an environment variable, so it cannot be redirected, and the capture
-uses `--tls-intercept` to terminate the TLS it established itself. Its config is left untouched.
-The default model is one of OpenCode's own free ones, which is what makes iterating on a capture
-free. A provider of your own pointing at a plain-HTTP gateway is neither redirected nor decrypted,
-and needs its own answer.
-
-It stands up the proxy, launches the agent, waits for the request that carries the prompt, pulls
-the prompt out, scrubs it, writes it to `prompt/`, and files the evidence under `capture/`.
-Nothing else to run.
-
-| flag | |
-|---|---|
-| `--model <id>` | model to capture. default: the harness's own |
-| `--print` / `--interactive` | pick the non-default mode for that harness |
-| `--upstream <url>` | where the proxy forwards. auto-detected otherwise |
-| `--cwd <path>` | directory to run the agent in. default: the current one |
-| `--port <n>` | proxy port for interactive capture. default 46011 |
-| `--prompt <text>` | the throwaway user turn |
-| `--timeout <sec>` | how long to wait for the request. default 180 |
-| `--no-trace` | skip keeping the raw agenticreplay run |
-
-## What is here
-
-Measured on one machine, and the reason the table is here rather than in a folder listing:
-
-| model | harness | mode | prompt as sent | tools | prefix |
-|---|---|---|---|---|---|
-| `claude-fable-5-1` | claude | interactive | 26,463 chars | 35 | 59,818 tok |
-| `claude-fable-5-1.print` | claude | `-p` | 20,938 chars | 29 | 37,694 tok |
-| `claude-opus-5` | claude | interactive | 22,760 chars | 35 | 58,938 tok |
-| `claude-opus-4-8` | claude | interactive | 19,083 chars | 33 | 54,545 tok |
-| `gpt-5.6-sol` | codex | `exec` | 23,377 chars | 9 | 1,689 tok |
-| `gpt-5.6-luna` | codex | `exec` | 20,842 chars | 3 | - |
-| `big-pickle` | opencode | `run` | 9,621 chars | 11 | 8,017 tok |
-| `ling-3.0-flash-fin-free` | opencode | `run` | 9,647 chars | 11 | - |
-| `mimo-v2.5-free` | opencode | `run` | 9,629 chars | 11 | 8,025 tok |
-| `muse-spark-1.2-contributor-free` | opencode | `run` | 10,249 chars | 11 | - |
-| `nemotron-3-ultra-free` | opencode | `run` | 9,643 chars | 11 | - |
-| `nemotron-3.5-lightning-free` | opencode | `run` | 9,655 chars | 11 | - |
-| `gpt-5.6-sol` | opencode | `run` | 10,413 chars | 9 | 6,327 tok |
-| `gpt-5.6-sol` | qwen | `-p` | 28,285 chars | 23 | 18,258 tok |
-| `grok-4.5-high` | cursor | `-p` | 1,954 chars | 5 | - |
-| `mimo-v2.5` | mimo | `run` | 50,618 chars | 16 | - |
-| `mimo-v2.5-pro` | mimo | `run` | 50,618 chars | 16 | - |
-| `kilo-auto/free` | kilo | `run` | 11,326 chars | 13 | - |
-| `nemotron-3.5-lightning-free` | hermes | `-z` | 14,058 chars | 19 | - |
-| `deepseek/deepseek-v4-flash-free` | mcode | `exec --prompt-mode tui` | 14,777 chars | 18 | - |
-| `deepseek/deepseek-v4-flash-free` | mcode | `exec --prompt-mode coding` | 16,157 chars | 18 | - |
-| `deepseek/deepseek-v4-flash-free` | mcode | `exec --prompt-mode work` | 17,721 chars | 18 | - |
-| `glm-4.6` | zcode | `--prompt --mode yolo` | 9,084 chars | 27 | - |
-| `muse-spark-1.3` | muse | `exec` | 24,864 chars | 25 | - |
-| `gpt-5.6-sol` | openclaw | `agent exec` | 21,762 chars | 38 | - |
-| `gemini-3.5-flash` | gemini | non-interactive | 25,084 chars | 8 | - |
-| `deepseek-v4.1-flash` | crush | non-interactive | 29,335 chars | 26 | - |
-| `deepseek-v4.1-flash` | goose | non-interactive | 9,768 chars | 18 | - |
-| `deepseek-flash` | dsh | non-interactive | 4,663 chars | 25 | - |
-| `openai/gpt-4o-mini` | cline | non-interactive | 4,258 chars | 25 | - |
-| `openai/gpt-4o-mini` | pi | non-interactive | 2,632 chars | 4 | - |
-| `openai/gpt-4o-mini` | hackerai | non-interactive | 1,696 chars | 0 | - |
-| `deepseek-v4.1-flash` | aider | non-interactive | 1,229 chars | 0 | - |
-
-The five rows below the OpenCode block were missing until now. Three of them carry no prefix
-count: `mimo-v2.5` and `mimo-v2.5-pro` were captured with no valid key, so the server answered
-`invalid_key` and reported no usage -- the prompt is unaffected, since it travels in the request,
-which is why `capture.mjs` files these only under `--allow-failed` and says so. `grok-4.5-high`
-and `kilo-auto/free` completed, but neither response carried a usage block to read. Hermes
-completed too, on the same anonymous tier, and its response carried no usage block either.
-
-**The fourteen rows below Hermes have no prefix count either, and nine of them have no profile.**
-MiniMax Code has one, `capture.mjs mcode`, and its three modes are three prompts from one binary.
-ZCode has one too, `capture.mjs zcode`; it is the second harness here redirected through its own
-config file rather than an environment variable, and the first whose file is JSON, so the rewrite
-walks a parsed tree instead of matching text. Its prefix column is blank because the turn was
-refused before any tokens were counted: this machine has no personal provider config, so the
-adapter wrote its own single provider pointed at the proxy, agenticreplay forwarded that to its default
-upstream, and the upstream does not serve `glm-4.6` -- `upstream 400`, carried back inside a `200`
-stream. The prompt is unaffected: it travels in the request, and all 9,084 characters of it were
-on disk before the response arrived.
-
-ZCode's prompt embeds three things about the directory it runs in rather than about the harness:
-the git branch, the `git status` output, and the name of its per-project memory directory, which
-is `<basename>-<16 hex of the absolute path>`. All three are scrubbed to placeholders now, for the
-reason the `{{RUN_ID}}` rule gives -- an artifact that changes with the machine makes `regenerate`
-produce a diff every time and mean nothing when it does. Measured after the change: the same
-capture taken inside this repository, on a feature branch with a dirty tree, and taken in an empty
-one on `master`, produce byte-identical files.
-
-The `prompt as sent` column is still the length before scrubbing, and that does vary with the
-directory, because the branch name and the dirty list are part of what was sent: 9,084 characters
-in an empty repository, and more inside a checkout by however much its own git state comes to.
-The row records the empty-repository figure, which is the one that reproduces.
-
-Muse Code has a profile too, `capture.mjs muse`, and it is the only one that puts a process
-between the harness and the proxy. Muse fetches a model catalogue with `GET /muse-code/models` and
-will not build a turn until that answers; agenticreplay's proxy answers 404 to every non-POST, because only
-a POST is ever a model call. Neither is wrong, so `muse-shim.mjs` serves that one GET and forwards
-everything else untouched -- a catalogue is not a model call, and the turn carrying the prompt is
-still recorded by agenticreplay as a `/responses` exchange. The shim also exists because Muse takes its
-origin from a `--base-url` flag and *discards any path on it*, measured, which rules out
-`/forward/` for this harness: a forward is nothing but path.
-
-Two things about that row are unlike the others. Its twenty-five tools arrive as a single entry of
-`type: "namespace"` with the real tools nested inside, so counting the outer array gives `1` --
-which is what the table said until `pickPromptRequest` learned to prefer the turn with the most
-tools. That rule earned itself twice over: Muse sends two turns per prompt, the agent's and a
-skill-relevance judge's, they do not arrive in a fixed order, and "first turn with any tools" filed
-whichever won the race. Both carry the same 24,864-character prompt; only the tools and the
-context differ. No account is needed for any of it -- the key is a placeholder, the turn comes back
-refused, and `--allow-failed` is what files it, the same as the MiniMax rows.
-the agent pointed at the proxy -- so `capture.mjs <harness>` will answer `unknown harness` for
-every one of them, and the way to reproduce one today is the way it was taken: run the agent
-under `agenticreplay record` with its provider base URL moved, and read the system prompt out of the
-request. Writing profiles for them is the follow-up that turns these rows into one-liners.
-
-Four are worth a sentence each, because the shape of the capture is not obvious from the row:
-
-  aider       1,229 characters and no tools. Aider sends its whole instruction set as the system
-              prompt and drives edits through the reply format rather than through tool calls, so
-              a zero in the tools column is the product, not a truncated capture.
-  hackerai    also zero tools, and driven through the package's own `Agent` class rather than its
-              CLI, which has no non-interactive entry point. The prompt is the product's: the shim
-              only calls `agent.run`, and everything in the request comes from their code.
-  crush       the only one of the nine that needed re-scrubbing before it could be committed. It
-              was taken on 2026-09-18, before `pathRe` learned to match a path written with
-              forward slashes, so eight `<location>` lines carried `C:/Users/<name>/.claude/...`
-              and two account uuids straight through the audit that is supposed to stop exactly
-              that. Re-scrubbed with the current rules; 29,335 characters as sent, 28,741 on disk
-              after the second re-scrub below.
-  openclaw    38 tools, the largest set here, and its first line is an HTML comment
-              (`<!-- openclaw:attempt:STABLE -->`) rather than an identity sentence.
-
-About 6,300 characters of the Hermes row is an `<available_skills>` block listing 51 skills, and
-they are Hermes' own -- `hermes skills list` reports them as builtin, with none installed by
-anyone. So the catalogue belongs in the capture, and this row is the whole prompt.
-
-Worth saying because it caught me: the same prompt comes out **7,742 characters** when Hermes
-cannot find its own skills directory. `HERMES_HOME` was a persisted user variable pointing at the
-install, and the shell I first captured from had inherited an environment from before the install
-existed, so Hermes fell back to a home with no skills in it. The short capture is not a variant of
-the prompt; it is a broken install. If a Hermes capture comes out near 7,700, run
-`hermes skills list` -- `0 builtin` means the harness cannot find itself, and the same install
-also drops a multi-turn replay from `3/3 exact=3` to `1/3`.
-
-`nemotron-3.5-lightning-free` appears twice, which is the most direct comparison in this
-table: one free model, two harnesses, 9,655 characters and 11 tools from OpenCode against
-7,742 and 19 from Hermes. Same model, same anonymous endpoint, different instructions and a
-different tool surface -- the harness is the variable, and this is the pair that isolates it.
-
-The two MiMo rows are identical on purpose: captured from the same directory, `mimo-v2.5`,
-`mimo-v2.5-pro` and `mimo-v2.5-pro-ultraspeed` send byte-identical prompts and tool sets, same
-sha256. The tier changes the model behind the request and nothing about the request. Pointed at a
-GPT-family model instead, MiMo sends the Codex template with its own name substituted in and one
-`exec` tool rather than sixteen -- that one is not filed here, being mostly Codex's prompt.
-
-The OpenCode rows are one harness on seven models, and they are not one prompt. Three templates
-show up. Five of the free models open with *You are opencode, an interactive CLI tool that helps
-users with software engineering tasks*; `muse-spark-1.2-contributor-free` opens with *You are
-OpenCode, a coding agent that helps users with software engineering tasks* and is the only one on
-the responses dialect rather than chat completions; `gpt-5.6-sol` through a gateway of my own gets
-a third, *You are OpenCode, You and the user share the same workspace*, and is the only one with
-`apply_patch` in place of `edit` and `write`. The prompt and the wire format are both chosen per
-model.
-
-Sizes are the prompt as sent. The file on disk is a few hundred characters shorter, since the
-placeholders are shorter than the paths they replace; `meta.json` carries both figures.
-
-Four rows were re-scrubbed when the branch and status rules were added, because their captures
-predate them and carried the capture machine's working state into a published file: `claude-opus-5`
-listed fifteen dirty paths, `claude-fable-5-1` three, `crush` six including a `.venv/`, and
-`claude-opus-4-8` two, each under the branch that happened to be checked out. None of it is a
-credential and none of it is a fact about the harness, which is the test that applies here. The
-as-sent figures in the table are unchanged, since scrubbing happens after the prompt is sent.
-
-Only the scrubbed prompts under `prompt/` are committed. A capture's own folder stays local:
-`capture/.gitignore` excludes every subdirectory and `index.json`, because the request bodies carry
-session and message ids and the raw runs carry account and device ids. Run the command and the
-folder appears; clone the repository and you get the tool and the prompts.
-
-Every file is prefixed with its capture's name, so a file pulled out on its own still says which
-model and which mode it came from:
-
-| file | where | scrubbed | what |
-|---|---|---|---|
-| `<model>-system-prompt.md` | `capture/<name>/` and `prompt/<HARNESS>/` | yes | the prompt on its own, nothing else |
-| `<name>-prompt-annotated.txt` | `capture/<name>/` | yes | same text with block boundaries and char counts |
-| `<name>-request.json` | `capture/<name>/` | yes | the whole request body as sent |
-| `<name>-tools.json` | `capture/<name>/` | yes | tool definitions |
-| `<name>-meta.json` | `capture/<name>/` | n/a | run id, sizes, token counts, tool names |
-| `trace/` | `capture/<name>/` | **no** | the raw agenticreplay run. holds account and session ids |
-
-`prompt/` groups by harness, one folder per agent, so the file inside is named for the model
-alone: `prompt/CLAUDECODE/claude-fable-5-1-system-prompt.md`, and the `-p` variant beside it as
-`claude-fable-5-1-print-system-prompt.md`. Two harnesses can serve the same model, which is what
-the harness folder disambiguates — `prompt/CODEX/gpt-5-6-sol-system-prompt.md` and
-`prompt/OPENCODE/gpt-5-6-sol-system-prompt.md` are different prompts for one model. Under
-`capture/` the same collision needs `--dir`, since there is no harness level there.
-
-Only `trace/` is unsafe to share, and `capture/.gitignore` keeps it out of commits. Everything else
-runs through the scrubber, and a capture aborts rather than writing a file if anything identifying
-survives the pass.
-
-Each capture folder's own `README.md` is generated from its `meta.json`, so `node
-capture/capture.mjs --index` refreshes the file tables after a rename instead of letting them
-drift.
-
-## What `-p` means
-
-`-p` / `--print` is Claude Code's non-interactive mode: the prompt goes in as an argument, one turn
-runs, the answer goes to stdout, and the process exits. No terminal UI. It is what a script or a CI
-job uses, and what the Agent SDK drives.
-
-It is a different prompt, not the same prompt in a different shape. The billing header says
-`cc_entrypoint=sdk-cli` rather than `cli`, and the identity line changes from *You are Claude Code,
-Anthropic's official CLI for Claude.* to *You are a Claude agent, built on Anthropic's Claude Agent
-SDK.* Interactive mode then adds the `! <command>` hint, the whole Scratchpad Directory section, a
-`gitStatus` block when the working directory is a repository, and four tools: `Artifact`,
-`AskUserQuestion`, `EnterPlanMode`, `ExitPlanMode`. Its injected `role:"system"` turn grows from
-7,585 to 11,529 characters, carrying more agent types, the artifact and design skills,
-`claude-in-chrome`, and a paragraph about the active permission mode.
-
-Both are worth keeping. Interactive is the prompt behind daily use; `-p` is the one you actually
-get when you call the harness from a script.
-
-## Scrubbing
-
-Replacements are derived from the machine, not hard-coded, so the script is portable: home
-directory, username, git name and email, the gateway host from `~/.config/agenticreplay/config.json`, the
-Claude Code project slug, the OS build, then generic rules for emails, uuids and hex runs of 32 or
-more. Order matters, since the memory directory sits inside the home directory.
-
-Placeholders currently in use: `{{CWD}}`, `{{HOME}}`, `{{TMP}}`, `{{CLAUDE_HOME}}`,
-`{{CLAUDE_PROJECTS}}`, `{{CODEX_HOME}}`, `{{PROJECT_SLUG}}`, `{{GIT_USER}}`, `{{OS_BUILD}}`,
-`{{RECENT_COMMITS}}`, `{{EMAIL}}`, `{{UUID}}`, `{{HEX}}`, `{{USER}}`, `{{GATEWAY}}`.
-
-## Two things the script exists to get right
-
-**The interactive prompt is a different prompt.** A harness only assembles it when stdin is a real
-console, and a pipe is not one, so a plain `agenticreplay record claude` always captures the `-p` variant.
-Interactive mode holds the proxy open with `agenticreplay attach` and has PowerShell launch the agent in a
-console of its own. For Claude Fable 5.1 that is the difference between 20,806 and 26,054 chars,
-and between 29 tools and 35.
-
-**The first request with a prompt in it is the wrong request.** Claude Code opens with a title
-generator that ships four system blocks and a naming spec of its own. The agent turn is the one
-that carries tool definitions, so that is what identifies it.
-
-## The working directory is part of the prompt
-
-Interactive capture refuses to start in a directory Claude Code has not been trusted in, and says
-so in a tenth of a second rather than waiting out the timeout:
-
-```
-capture failed: claude has not been trusted in C:\...\scratch, so it would stop on the trust dialog.
-  start it there once by hand and accept, then run this again.
-  capture in a directory you actually work in: the working directory is part of the
-  prompt, and a non-repository loses the gitStatus block entirely.
-```
-
-Trust is one boolean in `~/.claude.json`, so the script could set it. It deliberately does not.
-Writing it makes capturing in a throwaway directory the easy path, and that produces a worse
-capture: a temporary non-repository loses the whole `gitStatus` block, which cost 4,271 characters
-on a measured Opus 5 run. `-p` never asks, which is why non-interactive captures work anywhere.
-
-`--dangerously-skip-permissions` is not a way around it either. It adds a paragraph about the
-active permission mode to the injected system turn, so it changes the prompt you are trying to
-read.
-
-## When the turn fails but the capture does not
-
-A turn can come back `overloaded_error` inside a 200 stream. The prompt is still captured in full,
-because it travels in the request, but there is no token count for it. The script says so rather
-than just omitting the line:
-
-```
-  note: the agent's turn came back overloaded_error, so there is no token
-        count for it. the prompt is unaffected - it travels in the request.
-```
-
-## Documents
-
-- `CURSOR-HTTP2.md` - Cursor: HTTP/2 interception, a protobuf wire format, and a prompt that
-  arrives in the response.
-- `CAPTURE-RUNBOOK.md` - the manual procedure in eight steps, with the pitfalls and how to prove a
-  capture is genuine. Read it to port this to another harness or another platform.
-- `capture-run.gif` - one `capture.mjs` run, rendered by `render-run.mjs`.
-- `fable-capture.gif`, `fable-capture.mp4` - the manual procedure as a screencast, rendered by
-  `render.mjs`.
-
-![capturing the Fable 5.1 system prompt](fable-capture.gif)
-
-## Not covered
-
-Interactive capture is Windows-only for now; it depends on `Start-Process` handing a console
-application a real console. On Linux and macOS a pipe sits behind a pty, so one `agenticreplay record`
-should reach the interactive prompt directly, and the profile in `capture.mjs` would need a branch
-for it.
-
-Codex TUI capture works through the same path but is not run here by default: this installation
-sets `approval_policy = "never"` with `sandbox_mode = "danger-full-access"`, and an interactive
-session under those settings is a different risk from a `codex exec` that answers one word. Pass
-`--interactive` to do it anyway.
-
-A prompt captured this way is the one the local harness sent. A service that injects its own
-prompt server-side, claude.ai for instance, is invisible to this method by construction.