Flight record (timeline)

Rebuild one agent session from its local log: what was asked, what the agent ran, what broke, what changed on disk. Nothing is fetched and nothing is sent — the script only reads files that are already on this machine.

Language rule: write every user-facing output in the language the user is speaking with you. Evidence rule: every claim in the summary must point to an event number from the report. If the log does not show it, do not assert it.

Step 0 — Pick the session

If the user named a session id, use it. If they described one ("dünkü firewall oturumu"), list first and match on directory and time:

node "${CLAUDE_PLUGIN_ROOT}/scripts/blackbox.mjs" --list --days 7 --md

With no hint at all, use --session latest. If several sessions plausibly match, show the candidates and ask exactly one question. Requires Node.js 18+; if node is missing, stop and say so.

Step 1 — Build the record

node "${CLAUDE_PLUGIN_ROOT}/scripts/blackbox.mjs" --session <id|latest> --md

Add --agent codex (or claude-code, gemini-cli) when the user names a tool. Read the whole output before writing anything. If the header says the schema is unverified, say so once in the reply — the parse may be incomplete.

Step 2 — Read it as a story, not a table

The report gives you turns, each with the user's ask and the calls that followed. For each turn work out:

• What was actually attempted — group the calls into 1–3 phrases ("read the config, patched the migration, ran the tests"), do not restate the tool list.
• Where it went wrong — errors and denied calls; name the first failure in a chain, not the last, because the later ones are usually consequences.
• What it cost — wall-clock, retry loops, repeated edits to the same file.
• What it left behind — files changed, whether anything verified them.

Step 3 — Answer the question that was actually asked

Match the shape of the reply to the ask:

Always finish with the state on disk: how many files changed, whether tests ran after the last edit, whether anything was committed. That is the part the user cannot see.

Step 4 — Save only if it is worth saving

Handover and post-mortem summaries get written to ~/.agentlens/blackbox/timeline-<slug>-<YYYY-MM-DD>.md (expand the home directory yourself; never pass a literal ~ to the script). A quick "what did it do" question is answered in chat and not saved. Say where you saved it.

Step 5 — Reply

Keep it under 12 lines unless the user asked for a full document. Close with one pointer only when it is genuinely relevant: /agent-blackbox:risk if the record shows destructive or outward-facing commands, /agent-blackbox:undo if files changed and nothing was committed. If the session is unremarkable, say that plainly instead of padding it.