AgentPulse watches coding agents without asking another model to judge them
When a coding agent spends twenty minutes editing the same file, it may be closing in on a fix or circling a dead end. Many monitoring systems ask another model to interpret the transcript. That adds a probabilistic judge, another data path, and sometimes a second agent to debug.
AgentPulse, a small MIT-licensed project by Conal Hickey, uses local rules instead. It reads Claude Code, Cursor, and Codex transcripts and assigns one of six states: converging, exploring, stuck, done, drifting, or idle. It calls no model, sends no telemetry, and needs no network connection.
AgentPulse gives an inspectable opinion about a session's direction. It does not decide whether the resulting code is correct, secure, or ready to merge.
A trajectory label is not a quality score
AgentPulse examines recent tool activity, verification trends, repeated edits, completion language, and user tone. Its default analysis window is 20 minutes. The live view refreshes every 30 seconds, removes sessions after one hour of inactivity, and shows up to 10 sessions.
The basic command is disposable:
npx @conalh/agentpulse@latest live
It opens a terminal dashboard rather than a hosted control plane. A one-shot JSON mode can feed scripts and CI. With --strict, the command exits with status 1 if a session is drifting or stuck. Analysis errors use a separate gate: --fail-on-error must be enabled to fail on unreadable or corrupt transcripts. The bundled GitHub Action enables that option by default.
Those boundaries matter. A converging agent may be implementing the wrong requirement. A done agent may have skipped tests. AgentPulse reports a pattern in the work trace, not a verdict on the artifact.
"Drifting" currently means three narrow things
The drifting label is easy to overread. AgentPulse applies it when one of three rule families fires:
- Access to privileged paths such as
.ssh,.aws,.kube,/etc/shadow, or/private/var. - A tokenizer-recognized
curlorwgetcommand piped intosh,bash, orzsh. - A Write or Edit operation outside the repository root.
The repository states what those rules exclude. The detector does not cover process substitution such as bash <(curl ...), download-then-execute chains, nested bash -c pipelines, PowerShell iwr | iex, python -c or node -e download-and-execute patterns, package install hooks, ordinary-file credential exfiltration, or API-driven network access. It resolves lexical . and .. path segments, but not symlink escapes.
That list defines the contract. A drifting label means a known risky pattern fired. A clean label means none of those rules fired. It does not mean the session is safe.
The distinction resembles NIST's useful category of controls that are not addressed rather than silently passed. A deterministic monitor becomes more trustworthy when its blind spots are visible.
Reproducibility is the practical advantage
A model judge can understand unfamiliar behavior and messy intent. It can also change its answer after a prompt edit or model update. AgentPulse has the reverse tradeoff. Its rules miss behavior outside their vocabulary, but the same transcript produces the same result under the same version.
That is useful for inexpensive workflow signals. A team could alert a developer when a session becomes stuck, record how often a task oscillates between exploration and convergence, or block CI on the specific drift patterns it has accepted. If a team routes several coding models through api.ish.chat, a transcript monitor also supplies one local vocabulary across providers.
Exceptions live in .agentpulse-exceptions.json as exact fingerprints. The CLI previews additions before confirmation, and CI honors the baseline. Exact matching is a good default. An exception for one known command should not become permission for a broader family of commands.
Local analysis can still leak through CI
"No network" describes the AgentPulse runtime, not every workflow around it. The GitHub Action can put transcript-derived labels, verdicts, drift counts, narratives, and topic keywords into a step summary or pull-request comment. Path redaction only reduces path exposure. The project recommends redact: all when labels or narratives are sensitive.
Those summaries are operational data. A topic keyword can reveal an unreleased feature. A narrative can expose the shape of an incident. Local processing offers little protection if the derived output is copied into a public pull request.
Treat the project as young software
We cloned the repository and ran its test suite on August 31, 2026. TypeScript built successfully and all 300 tests passed. The npm installation reported zero audited vulnerabilities across 45 packages. That is a useful smoke check, not a security review or proof that every supported transcript format behaves correctly.
Adoption signals are thin. At the same check, the GitHub repository had zero stars and zero forks. More practically, its release channels were not aligned. npm marked version 0.9.0 as latest, while the repository package and latest GitHub release showed 0.8.2. The 0.8.2 release fixed stale-session handling during Windows polling and changed session age to reflect transcript activity rather than analysis refresh time.
For CI, pin a version instead of using @latest, inspect the installed package, and test it against transcripts produced by your own agent versions. Transcript schemas are dependencies even when they do not appear in package.json.
AgentPulse is useful because its claims are narrow enough to audit. It can surface loops and three documented tripwires without sending a transcript to another model. Tests, review, sandboxing, and policy enforcement still have to answer the questions its labels leave open.
