ranwhat watch: what your agents actually ran

01 / Detection

Nine things worth interrupting you for.

This isn't antivirus. There's no adversary and no signature, because you asked the agent to do things. So it doesn't guess whether an action was allowed. It raises the ones you'd want to know about either way.

Rule	Severity	Why it's on the list
Credential access `.env · ~/.aws/credentials · id_rsa`	Critical	Read a file whose only purpose is holding secrets. The contents are now in a context you don't control.
Secret literal in a command `sk_live_… · ghp_… · AKIA…`	Critical	A live key appeared verbatim. Even if the command was benign, it's in shell history now.
Package published `npm publish · twine upload`	Critical	Something reached a registry other people install from. Supply-chain reach, usually irreversible.
Cloud resource destroyed `terraform destroy · kubectl delete`	Critical	A write or delete against live infrastructure.
Financial API called `stripe charges · refunds`	Critical	Every one of these moves real money.
Log or history tampering `history -c · cloudtrail stop`	Critical	An action whose effect is removing the record of other actions.
Destructive git `push --force · reset --hard`	High	History rewriting. The class of action that destroys the record of what else happened.
Recursive deletion `rm -rf · find -delete`	High	Recoverable only if something else was backing it up.
Exfiltration-shaped pipe `tar … \| curl`	High	File contents sent outbound in one command. That shape, whatever the intent.

02 / Precision

A watcher that cries wolf gets muted in a day.

So three things that look dangerous are not treated as actions. Each of these was a real false positive on real history, found by pointing the first version at a live machine.

grep "rm -rf" src/

Searching for a string isn't running it. Search tools without an action flag are suppressed.

python3 -c "…rm -rf…"

The payload is Python source. bash -c is the exception: that really is shell, so it recurses in.

cat > f.sh <<'EOF'

A heredoc body is data being written. Writing a script that contains a command isn't running it.

On real history 15 findings before these rules, 4 after. Three were false positives; eleven were true deletions of build and temp directories that nobody would want to read.

Evidence Every finding carries surrounding context. rm -rf on its own tells you nothing. The target is the point.

Test suite 102 tests, written as invariants rather than expected output.

03 / Sources

Reads the agents already on your machine.

No wrapper, no proxy, nothing in your critical path. It reads what the agent already wrote to disk.

Agent	Location	Format	Status
Claude Code	`~/.claude/projects//.jsonl`	JSONL transcripts	Shipped
OpenClaw	`$OPENCLAW_STATE_DIR/agents/*/…`	SQLite, schema discovered at runtime	Shipped
Codex	n/a	Native OpenTelemetry	Next
OTLP receiver	localhost	Any agent emitting GenAI spans	Next

OpenClaw's transcript schema isn't published beyond “append-only, tree-structured”. Rather than pin table names that break on the next release, the adapter discovers the schema at runtime and recognises tool calls by shape. The database is opened read-only, since it belongs to a running agent, and falls back to a copy if that agent holds a WAL lock.