Process-family observation is the stable backbone
The useful unit for an agent task is usually not one PID. The selected CLI launches descendants and those descendants can perform the build, test, file, network, or tool work that matters. AgentSight uses system observation to keep those relationships tied to the recorded session so the user can move from an agent/tool phase to the executable that actually ran.
File and resource events answer different questions from model traces
A model or tool trace can explain the semantic request; system events can show observed path activity and local resource phases. Combining them lets you ask whether a slow tool was CPU-heavy, whether a patch touched files outside the intended scope, or whether a child process contacted services beyond the model provider. These signals should remain attributable rather than flattened into a generic “agent event.”
TLS plaintext capture uses uprobes, so the target binary still matters
eBPF does not remove the need to understand user-space runtime packaging. Linux uprobes attach to a specific object path and function/offset. Modern agent CLIs can use shared OpenSSL, OpenSSL embedded in Node, stripped Bun/BoringSSL, or rustls. AgentSight's compatibility code resolves wrappers and binaries and uses implementation-specific discovery where necessary. The hard part is often choosing the correct plaintext function, not loading the BPF program.
Correlation above the probes is what turns events into an agent profile
Raw process, file, and TLS events are not enough to explain a coding task. AgentSight's collector and session layer align them with model/tool activity and store a reusable local run. The product views then expose Overview, timeline, process tree, metrics, reports, and semantic flamegraphs. The eBPF mechanism is one part of the system, not the whole user-facing abstraction.
Privileges and platform support are part of the deployment model
Kernel and uprobe tracing require Linux features and sufficient privilege. Containers and Kubernetes add host-PID and runtime resolution. Binary packaging can change TLS compatibility. Use the maintained product documentation for the current supported environment rather than treating “uses eBPF” as a promise that every operating system, runtime, or binary build is observable in the same way.
Capture is observational, not an enforcement guarantee
AgentSight is designed to profile and inspect observed activity. A recorded run can be valuable for debugging, performance work, or audit, but it does not automatically block an operation or prove the absence of unobserved behavior. If your requirement is policy enforcement, combine observation with an enforcement mechanism designed for that control point.
$ sudo agentsight record -- claude
$ sudo agentsight debug trace --server
$ sudo agentsight debug ssl --binary-path <resolved-binary> --verbose