See what your agent already ran

npx @oked/scan reads the Claude Code transcripts and Codex CLI sessions already on your machine, then shows which past commands OKed's default rules would have paused. Nothing leaves the machine. No network, no telemetry, no signup, no account.

$ npx @oked/scan

Node.js 18 or newer. The published package is @oked/scan (the binary name is oked-scan). It does not install a hook and it does not pair a device. Source and the full README are in packages/scan.

What it reads

A missing directory is skipped. A line that is not JSON is skipped, and the report says how many. A repeated tool id counts once.

What it shows

The same classify() function the hooks call decides each command. This package does not keep a second copy of the rules. Custom rules are not applied. review and high_stakes would have paused for a person. warning and safe would have run.

The text report uses plain words. Tiers are "High-stakes (always asks)", "Worth a look (asks)", "Runs, logged", and "Runs". Kinds include force-push, rm -rf / file delete, curl POST/PUT/DELETE, destructive SQL, prod deploy, and npm publish. --json keeps the machine names (high_stakes, file_delete, and the rest) and adds plain labels.

Commands in the report are truncated. Values that look like tokens, passwords, or URL userinfo are replaced with [redacted]. A home directory in a command is shown as ~.

Claude Code is classified with the Bash sandbox not containing child processes, which is the default unless you turn the sandbox on and set allowUnsandboxedCommands to false. Test runners and scripts (npm test, cargo test, npx, a script file) then count as review. Codex is classified the way @oked/codex classifies commands, so the same runners stay allowed. One command can therefore differ by host. oked-scan --verbose prints these notes. The default text report leaves the notes out and puts those runners on their own line.

The report ends with how many commands would have paused, leaving test runners and scripts out of that count, the two or three most common high-stakes kinds, then the install command for the history it found, then https://oked.ai. If history exists and nothing would have paused, it says so and does not invent a count. If no transcripts and no sessions are found, it says that no history was found at the paths checked and does not print a zero table.

Decisions happen in Telegram or on the web dashboard. iPhone Soon.

Options

Exit code 0 when the report is printed, including when no transcripts were found. Exit code 1 when the arguments are wrong or --path does not exist.

Sample report

Sample

The counts below are the fixture transcripts in @oked/scan (test/fixtures), not a person's machine. npm test asks for Claude Code and does not ask for Codex, because those are the two hook defaults. The Claude Code one is the routine line. It stays in "Would have paused" and out of the closing count. vercel --prod is high-stakes. The Claude Code curl is past the top 8. In the JSON report it is curl -X POST https://example.com/hook -H "Authorization: Bearer [redacted]" -d hi.

OKed scan 0.6.25
Local only. This scan does not use the network and does not send telemetry.

Claude Code   9 commands in 2 files
Codex CLI     7 commands in 2 files
Window        all history
Skipped 1 unreadable line.

Commands                          16
Would have paused                 10
  High-stakes (always asks)        7
    Destructive or hard to undo.
  Worth a look (asks)              3
    OKed asks before it runs.
Would have run                     6
  Runs, logged                     2
    It runs, and OKed logs it.
  Runs                             4
    It runs. No log line.

What would pause
  7 high-stakes: 3 rm -rf / file delete, 2 force-pushes, 2 prod deploys
  3 worth a look: 2 curl POST/PUT/DELETE, 1 test runner

Top risky commands
  High-stakes (always asks)
      1  claude-code  force-push             git push --force origin main
      1  claude-code  force-push             git push --force origin other
      1  claude-code  rm -rf / file delete   rm -rf /etc/old
      1  claude-code  rm -rf / file delete   rm -rf /var/data
      1  codex        rm -rf / file delete   rm -rf /var/data
      1  claude-code  prod deploy            vercel --prod
      1  codex        prod deploy            vercel --prod
  Worth a look (asks)
      1  codex        curl POST/PUT/DELETE   bash -lc 'curl -X POST https://example.com/hook -d hi'
  Showing 8 of 10. Re-run with --json for every paused command.

1 routine command (test runners, scripts) would also ask under Claude Code's default sandbox setting.
To allow those without a prompt, turn on the Bash sandbox and set allowUnsandboxedCommands to false in ~/.claude/settings.json or .claude/settings.local.json.

Decisions happen in Telegram or on the web dashboard (https://oked.ai/dashboard). The iPhone app is coming soon.

OKed would have paused 9 of these commands, including 3 rm -rf / file delete, 2 force-pushes and 2 prod deploys.
Get a yes/no in Telegram before your agent runs them:
  npm install -g @oked/claude-code @oked/codex && oked init && oked-codex init
https://oked.ai

An empty home, with no transcript directory, says that no history was found. It does not print a zero table, and it does not invent a paused count.

When you want the pause before the next risky command, install OKed or get started.

Questions? contact@oked.ai