Why AgentSight sometimes skips the TLS command filter

Short answer: the two tracers intentionally use different filters

AgentSight constructs arguments independently for the sslsniff TLS runner and the process runner. A human-readable agent command can identify the process family, but bpf_get_current_comm() names the current task or worker thread. Claude's TLS calls can run on an HTTP Client thread; filtering TLS events using only claude can silently discard the very calls being sought.

This article examines v1.0.35 source at commit c1574366122a90c451bca6a84713e28813ab95e2. It is a static interpretation of executable argument-building and first-party unit tests, not a live capture, measured coverage rate, or guarantee for another runtime. The question here is which filters are actually sent to each tracer?The separate Docker TLS discovery analysisaddresses which binary the container resolver finds.

Three mechanisms that explain an apparently inconsistent trace

Thread-name mismatch. A TLS function can execute in a thread with a different comm value from the user-visible CLI. That makes kernel-task-name filtering dangerous for some threaded or wrapped agent binaries. A CodeBuddy launcher is a second example: the CLI may be named CodeBuddy but the underlying program may have the task name node.

Executable attachment. A pinned --binary-path tells the TLS tracer which executable should provide the SSL symbols or static-library offsets. The Rust builder consequently omits -c and session filtering on that SSL runner. It also omits its PID filter in this mode. This is a choice about what receives TLS probe events, not a promise of per-agent exclusivity. The process runner can still receive its own PID, session and command filters independently.

Conditional discovery. Without a pinned ELF, the trace command may resolve a single requested command to an executable embedding SSL. When that succeeds it sets binary_path before constructing the TLS arguments; when it fails, the dynamic-library path retains applicable -cfiltering. This explains why otherwise similar commands may produce different low-level SSL arguments after runtime discovery.

Ten concrete source-level cases

These are derived from build_ssl_args, build_process_argsand the conditional resolver. They show argument-selection behavior, not a claim that a particular run captured plaintext successfully.

The code and regression tests make the distinction explicit

The TLS builder first computes whether a binary path is pinned, then gates its -p, --session and -c additions differently. A UID filter remains eligible even for a pinned binary. The CodeBuddy command-name exception is separate from binary pinning and is case-insensitive. The process builder, by contrast, forwards the configured PID, session and command selectors without the same binary-path gate.

// Simplified decision structure, not a copy of the full implementation
if (!pin_binary && session_id.is_none()) { /* optional -p */ }
if (!pin_binary) { /* optional --session and non-misleading -c */ }
if (ssl_uid.is_some()) { /* optional -u */ }
if (binary_path.is_some()) { /* --binary-path <ELF> */ }

The repository includes focused tests: ssl_args_skip_codebuddy_comm_filter checks that CodeBuddy loses -c while node keeps it; and ssl_args_skip_session_filter_when_binary_path_is_pinned checks that an explicit Codex ELF path suppresses both --session and-c on SSL argument construction. These are regression assertions for the builder—not integration tests of observed network requests.

Reproduce the argument decision without collecting private traffic

Check out the matching release and inspect the exact implementation and tests. This read-only procedure needs no root privileges, eBPF probe, real prompt, response body, or outgoing network capture:

git clone https://github.com/eunomia-bpf/agentsight.git
cd agentsight
git checkout v1.0.35
grep -nE 'fn build_ssl_args|fn ssl_comm_is_misleading|fn build_process_args' collector/src/cmd_trace.rs
grep -nE 'ssl_args_skip_codebuddy_comm_filter|ssl_args_skip_session_filter' collector/src/cmd_trace.rs
sed -n '262,330p' collector/src/cmd_trace.rs
sed -n '705,740p' collector/src/cmd_trace.rs

To additionally execute the tests on a suitable development machine, use the Rust collector test target for those names. This page has notrun them and does not report any observed success rate or numeric overhead. The source checks establish the intended configuration logic only.

Scope and privacy: avoiding false negatives can widen what is observed

Pinning an ELF is a probe-attachment selection; do not describe it as a strict per-process authorization boundary. If more than one process loads and calls that executable, an SSL probe without a PID, session or command selector may include activity outside the agent run being investigated. A missing TLS event still cannot prove the agent did not contact a model: an unsupported SSL library, wrong executable, short-lived process, filtering mismatch, dropped event or truncated capture may explain it.

TLS plaintext can include prompts, responses, authentication headers, API payloads and network destinations. Limit collection to an authorized test environment, keep sensitive trace files local, and independently verify the actual process and destination identity before drawing an audit conclusion. For evidence-loss diagnosis, read the capture-loss guide. For the limits of network target aggregates, see the network counts reference.

Primary implementation references and version limits

• v1.0.35 Rust SSL and process argument builders plus regression tests
• v1.0.35 SSL tracer CLI and static-library attachment limitations
• v1.0.35 product agent runtime and tracer architecture notes
• v1.0.35 binary-path resolution and embedded SSL discovery
• AgentSight v1.0.35 stable release

The conditional branches and regression tests above describe the v1.0.35 implementation as inspected on 5 November 2026. Actual attachment depends on binary packaging, kernel support, access permissions and probe health. Process tracing and TLS capture have different filtering contracts; never infer a complete causal, security or task-success verdict merely because one event category contains a record.