| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Improve LLM payload capture and onboarding - Preserve request tool-call content and complete Anthropic SSE responses when stop_reason arrives. - Centralize the TLS unknown-stream default, lower it to 1MiB, and let tests inherit the product default. - Rewrite README and quickstart around init/start/launch/web, add a release install helper, and collapse duplicated default config in docs and examples. Co-Authored-By: GPT-5.5 | 15 天前 | |
Improve LLM payload capture and onboarding - Preserve request tool-call content and complete Anthropic SSE responses when stop_reason arrives. - Centralize the TLS unknown-stream default, lower it to 1MiB, and let tests inherit the product default. - Rewrite README and quickstart around init/start/launch/web, add a release install helper, and collapse duplicated default config in docs and examples. Co-Authored-By: GPT-5.5 | 15 天前 | |
Unify process identity and harden launch readiness - Unify logical process identity across collector ingestion, trace membership, storage, export, semantic lineage, and process-tree reconciliation. - Keep lifecycle collection free of exec-time procfs enrichment and preserve namespace-native TLS identity observations. - Refactor process and real-agent E2E helpers around logical identities, action snapshots, and concurrent launch sessions. - Add a daemon control-plane TLS launch-plan query and cache, with ctl diagnostics and timing, so repeated launches avoid local rescans. - Add per-profile daemon startup host-eBPF load preflight and use verified readiness for launch permission selection. - Bound direct socket payload capture for verifier-safe eBPF loading and retain staged preflight verification. Co-Authored-By: GPT-5.5 | 9 天前 | |
Refactor operator config to hierarchical TOML Remove the legacy flat operator parser path and make operator parsing accept only the typed hierarchical TOML document. Migrate docs, examples, and test operator configs to the new structure and update helper scripts that read or generate operator configs. Co-Authored-By: GPT-5.5 | 26 天前 | |
Improve LLM payload capture and onboarding - Preserve request tool-call content and complete Anthropic SSE responses when stop_reason arrives. - Centralize the TLS unknown-stream default, lower it to 1MiB, and let tests inherit the product default. - Rewrite README and quickstart around init/start/launch/web, add a release install helper, and collapse duplicated default config in docs and examples. Co-Authored-By: GPT-5.5 | 15 天前 | |
Integrate plugin control and docs config updates Adds plugin control/runtime integration, dynamic file policy examples and E2E coverage, compresses docs operator configs into sparse default-template patches, updates launch-mode docs regression coverage, and stabilizes aarch64 LD_AUDIT launch behavior for Python-style structure-return calls. Co-Authored-By: GPT-5.5 | 21 天前 | |
Improve LLM payload capture and onboarding - Preserve request tool-call content and complete Anthropic SSE responses when stop_reason arrives. - Centralize the TLS unknown-stream default, lower it to 1MiB, and let tests inherit the product default. - Rewrite README and quickstart around init/start/launch/web, add a release install helper, and collapse duplicated default config in docs and examples. Co-Authored-By: GPT-5.5 | 15 天前 | |
Improve LLM payload capture and onboarding - Preserve request tool-call content and complete Anthropic SSE responses when stop_reason arrives. - Centralize the TLS unknown-stream default, lower it to 1MiB, and let tests inherit the product default. - Rewrite README and quickstart around init/start/launch/web, add a release install helper, and collapse duplicated default config in docs and examples. Co-Authored-By: GPT-5.5 | 15 天前 | |
Integrate local dev observability features - Expand eBPF file observation with path capture, bulk read events, and transport-loss containment. - Harden controlled launch, daemon live reconciliation, identity, TLS sync, and control runtime lifecycle handling. - Add web trace and token statistics workspaces with stats API, storage schema, and visualization components. - Extend HTTP/HTTPS, file scan, file writev, transport-loss, performance, and docs example E2E coverage. Co-Authored-By: GPT-5.5 | 19 天前 | |
Integrate plugin control and docs config updates Adds plugin control/runtime integration, dynamic file policy examples and E2E coverage, compresses docs operator configs into sparse default-template patches, updates launch-mode docs regression coverage, and stabilizes aarch64 LD_AUDIT launch behavior for Python-style structure-return calls. Co-Authored-By: GPT-5.5 | 21 天前 | |
feat(payload): support LangGraph and LangChain4j agent capture Co-Authored-By: GPT-5.5 | 1 个月前 | |
feat(payload): support LangGraph and LangChain4j agent capture Co-Authored-By: GPT-5.5 | 1 个月前 | |
Improve LLM payload capture and onboarding - Preserve request tool-call content and complete Anthropic SSE responses when stop_reason arrives. - Centralize the TLS unknown-stream default, lower it to 1MiB, and let tests inherit the product default. - Rewrite README and quickstart around init/start/launch/web, add a release install helper, and collapse duplicated default config in docs and examples. Co-Authored-By: GPT-5.5 | 15 天前 | |
feat: container permission auto-selection (host-eBPF × seccomp-notify) Introduce independent --host-ebpf and --seccomp-notify policies, each supporting auto|required|disabled. - Let actrailctl probe the container seccomp-notify path and let the daemon combine that result with host collector state and operator configuration to return the selected immutable profile and effective launch switches. - Keep automatic degradation explicit, with required permissions failing loud and disabled permissions never binding. - Bind the kernel-authenticated peer principal to trace ownership for control operations and TLS-sync ingestion. - Add the self-contained deploy/container-auto Docker bundle, custom seccomp profile, permission-matrix E2E, and cross-container isolation coverage without replacing the master deployment layout. - Replace the unreleased legacy launch flags, preserve existing track-add protocol compatibility, clarify deployment documentation, and bump the workspace version to 0.6.3. Validated with targeted unit tests, a release build, and the full 2x2 permission matrix plus cross-container isolation E2E on x86_64 and ARM64. Co-Authored-By: Claude Fable 5 | 19 天前 | |
feat: add AgentScope observation and TLS socket fixes Squash of the real non-merge commits from 38c1654^..HEAD: - 38c16543 feat: add AgentScope HTTP HTTPS observation example - 4d2b4c3d Implement aarch64 TLS trampoline relocation - 4f24690f fix: capture split plain http socket bodies - 27933477 Fix TLS audit scoping for AArch64 opencode Add a ready-to-run AgentScope docs example for default AcTrail collection across HTTP proxy and direct HTTPS provider routes. Extend OpenSSL TLS probe coverage for SSL_write_ex2, x86_64 short conditional branch relocation, and AArch64 TLS trampoline relocation. Track HTTP/1.x Content-Length continuation state in the socket seccomp fallback so a large body syscall following a small header syscall is captured on the same traced fd generation. Return the loader-provided AArch64 audit ABI version, only inject LD_AUDIT for shared-library plans, and scope audit binding callbacks to TLS provider objects. Verification: - cargo fmt --all - cargo build --release - Original HTTP socket fix verification included split HTTP LLM projection E2E, single-syscall baseline, HTTP/non-HTTP payload filter E2E, and real xiaoO HTTP proxy agent E2E. - Original AArch64 audit verification included cargo fmt, cargo build --release -p ctl -p tls_payload_probe_sync, tls-payload-probe-sync boringssl opencode probe, and actrailctl opencode launch. Co-Authored-By: GPT-5.5 | 21 天前 | |
Stabilize capture configuration and agent trace flows Add hierarchical operator config coverage across examples and tests, preserve large TLS transfer summaries without retaining bulk bodies, and keep LLM semantic projection behavior intact. Link HTTP responses to their requests, render exchange arcs in the web action tree, and improve LLM/HTTP detail panels for repeated tool calls and captured JSON bodies. Update xiaoO CLI invocation paths, strengthen real-agent E2E assertions, document test scenario intent, and retain Process exit rows when exit events flush file summaries. Co-Authored-By: GPT-5.5 | 26 天前 | |
Integrate plugin control and docs config updates Adds plugin control/runtime integration, dynamic file policy examples and E2E coverage, compresses docs operator configs into sparse default-template patches, updates launch-mode docs regression coverage, and stabilizes aarch64 LD_AUDIT launch behavior for Python-style structure-return calls. Co-Authored-By: GPT-5.5 | 21 天前 |
AcTrail Examples
Use 08.full-monitor-validation for real agent end-to-end validation with actrailctl launch, semantic actions, payloads, OTEL export, and actrailweb.
Index
| Directory | Entry |
|---|---|
01.quick-start |
README |
02.llm-http-payload-capture |
README |
03.extended-observation-e2e |
README |
04.fanotify-enforcement-e2e |
README |
05.http-payload-unified |
README |
06.xiaoo-tls-capture |
README |
07.xiaoo-claude-agent-invocation |
README |
08.full-monitor-validation |
README |
09.agentscope-http-https |
README |
10.java-langchain4j-agent |
README |
container-agent-minimal |
README — host daemon baseline config for container-side actrailctl launch. |
container-agent-restricted |
README — degradation test: container with default seccomp and no eBPF/CAP_BPF, proving probe/launch auto-degrade and tls-sync-only capture. |
Regression coverage for documented examples is described in TESTING.md.