The normal path is still the command you already use
Run Claude Code normally under agentsight record. The record path resolves the user-local executable even under sudo, follows symlinks, and creates a bounded session around the selected command. Use an explicit binary path for debugging or when the maintained compatibility guide says automatic resolution is insufficient.
Claude Code already exposes rich native OpenTelemetry
Current Claude Code telemetry can report model/API activity, token and cost metrics, tool result and decision events, MCP connections and calls, hooks, skills, and optional traces. Detailed logging flags can include Bash commands and tool arguments. Use that data for internal tool identity, policy decisions, and application semantics instead of trying to infer them from syscalls.
AgentSight adds the child-process and host boundary
Use AgentSight when the question is which process actually ran, which descendant launched next, which paths were observed, which remote destinations were contacted, or where local resource time accumulated. Claude's documentation explicitly says its OTEL_* configuration is not propagated into Bash subprocesses, hooks, MCP servers, or language servers, so the parent exporter does not automatically instrument every descendant.
Claude TLS capture is a Bun/BoringSSL compatibility case
AgentSight v1.0.3 documents the supported Claude binary as Bun-based with statically linked, stripped BoringSSL. sslsniff therefore includes validated byte-pattern discovery instead of assuming exported OpenSSL symbols. The TLS deep dive documents the version-sensitive fingerprint logic; if a future Claude/Bun build changes compiler output, verify the binary rather than assuming the old offsets still apply.
TLS can run on a worker thread with a different comm name
AgentSight documents Claude model traffic flowing through an internal HTTP Client thread. When a binary path is specified, the SSL capture path avoids the comm filter so that worker-thread traffic is not dropped, while process monitoring can remain scoped to the Claude process family. This explains an otherwise confusing failure mode where the correct binary is attached but a name filter still yields no TLS events.
Choose content capture deliberately
Claude native telemetry can be configured to log prompts, tool inputs, tool content, and even raw API bodies; AgentSight plaintext/session capture can contain similarly sensitive values. These are independent data paths. Enable only the content needed for the investigation, keep raw local sessions private, and configure redaction/filtering in any remote telemetry backend separately.
$ sudo agentsight record -- claude
$ agentsight report serve
$ sudo agentsight debug ssl --binary-path <claude-binary> --verbose