Release notes · 0.3 · 13 October 2026
Actualis reads the transcripts your coding agents already write and reports what actually ran. 0.3 adds a network inventory: every install, clone and web fetch, whether a person approved it, the agent's own reason, and a trace back to the transcript line. It comes with charts in the terminal, an offline HTML report, and an optional check against known-bad package lists.
$ brew install digital-foundry/tap/actualis # or: uv tool install actualis $ actualis --network --html
actualis --networkEvery npm i, pip install, git clone, curl and web fetch the transcripts show, from Claude Code, Codex and Copilot CLI. For each one: asked, unasked or unknown, the agent’s stated reason, and a trace to the exact transcript line. Narrow it with --host, --package, --session and --unasked.
The terminal view opens with an approval bar and a per-day chart, then ranks hosts, packages and projects with bars. actualis --network --html writes the same report as one offline page with sortable tables. It never overwrites, only you can read it, and a content security policy blocks every fetch. The --json object is embedded with its sha256, so every number can be checked.
--ioc FILE: did an agent install the bad version?Matches every download against a known-bad list you supply, in the actualis-ioc line format or OSV JSON, offline. A match is a high finding, so --fail-on high gates on it in CI.
New high-severity remote-exec shapes (bash <(curl …), sh -c "$(curl …)", dequoted cu''rl), more credential shapes masked, current-generation model pricing, and newer Codex sessions read correctly. --fail-on can newly fail on transcripts 0.2 passed; the changelog lists each case.
0.2.2 — Five calculation fixes from an audit of every number for explainability and determinism. Results no longer depend on the order the filesystem lists transcripts, and AF012 no longer fires a false critical on Codex- or Copilot-only fleets.
Found Actualis useful? Tell the people you build with. Copy a post, make it sound like you, and the link at the end shows the image above.
Each post gives both ways to install: Homebrew on macOS and Linux, and uv (or pipx) on any OS, Windows included. Both install the same release from PyPI, the one place Actualis is published, so readers can check the version, the licence and that it has no dependencies before they run anything.