Start by classifying operation direction
Reads answer a different review question from writes, creates, renames, and deletes. A coding agent may read thousands of source and dependency files while changing only a handful. Preserve the operation type so a large read working set does not look like a large modification scope and so deletes or renames remain visible instead of being collapsed into a generic file count.
Keep the process and agent phase attached to the path
A file operation is easier to interpret when you know whether it came from the agent runtime, git, a compiler, a test runner, a package manager, an MCP server, or another descendant. Correlate important paths with the process tree and timeline. That attribution often explains apparently surprising activity without requiring access to the child application's source code.
Separate project paths from expected external runtime paths
Home-directory configuration, language/package caches, temporary directories, Git metadata, compiler output, and agent session stores are common in developer workflows. Group these separately from repository source paths and from truly unexplained external locations. “Outside the repository” is a useful review filter, not an automatic security verdict.
Use the final diff to validate modification scope
For an AI-generated patch, compare observed writes/renames/deletes with the actual Git diff and generated artifacts. A write that does not appear in the final diff may have been reverted, temporary, or outside version control. A file in the diff without a clear generating step can indicate missing capture or a workflow you need to investigate further.
Use the files flamegraph for cross-session patterns
agentpprof's files view weights semantic paths by observed file-effect count. This is useful for questions such as which tasks repeatedly touch external/home paths or which parts of a repository dominate agent activity. The chart is an aggregate projection; return to the underlying sessions before treating a wide category as a problem.
State the capture boundary next to any absence claim
File monitoring depends on the selected process family, privilege, platform, and current probes. A missing path event is not proof that the path was never accessed. If the conclusion depends on absence, reproduce with a smaller task, verify the process was inside the recording scope, and use another source such as the application trace or filesystem audit mechanism when necessary.
$ sudo agentsight record -- codex
$ agentsight report audit --json
$ agentpprof --view files -o files.svg