How codingway-hub/a3 works
a3 audits Claude Code and Codex activity through a terminal collector, applies local pre-tool blocking where supported, and sends events to a server for durable audit, risk scanning, alerts, and administrator review. The main path is log collection → event parsing/masking → batching and offline spool → authenticated ingestion → storage and asynchronous rule scanning → console review or alert notification. The README documents additional management and install/signing capabilities; those are represented at their enclosing source paths where implementation excerpts were not sampled.
Main entry points: pipeline.go Collection pipeline · router.go HTTP API · service.go Alert scanning · store.go Audit database
Components 24
Terminal collector
- Agent commands
cmd/agent/main.go - Collection pipeline
cmd/agent/pipeline.go - Agent plugins
internal/agent/plugins - Log tailer
internal/agent/core/watcher/tailer.go - Event masking
internal/agent/core/masking/mask.go - Offline spool
internal/agent/core/spool/spool.go - Batch uploader
internal/agent/core/transport/uploader.go - Pre-tool hook
internal/agent/plugins/claude/rules.go
Audit server
- HTTP API
internal/server/api/router.go - Device ingestion
internal/server/ingest/service.go - Device and user auth
internal/server/auth - Risk rule engine
internal/server/rules/engine.go - Alert scanning
internal/server/alert/service.go - Audit database
internal/server/store/store.go
Admin console
- Console application
web/src/App.vue - Console API client
web/src/api/console.js - Audit and management views
web/src/views
Device onboarding
- Install and signing routes
internal/server/api/install_routes.go - Install script renderer
internal/server/api/installer/installer.go
Alert delivery
- Notification worker
internal/server/notify/worker.go - Webhook channel
internal/server/notify/webhook.go
Other components
- Developer
- Administrator
- Webhook service
Connections 32
- Developer → Agent commands: runs
- Agent commands → Collection pipeline: starts
- Collection pipeline → Log tailer: watches logs
- Collection pipeline → Agent plugins: selects plugins
- Log tailer → Collection pipeline: delivers lines
- Collection pipeline → Agent plugins: parses lines
- Collection pipeline → Event masking: masks events
- Collection pipeline → Offline spool: queues batches
- Collection pipeline → Batch uploader: uploads batches
- Batch uploader → HTTP API: posts events
- Offline spool → Batch uploader: replays batches
- Agent commands → Pre-tool hook: dispatches hook
- Pre-tool hook → Offline spool: queues hook events
- Pre-tool hook → HTTP API: fetches rules
- HTTP API → Device and user auth: checks credentials
- HTTP API → Device ingestion: dispatches requests
- Device ingestion → Audit database: stores events
- Device ingestion → Alert scanning: submits accepted events
- Alert scanning → Risk rule engine: evaluates events
- Alert scanning → Audit database: applies scan results
- Alert scanning → Notification worker: queues notifications
- Notification worker → Audit database: reads outbox
- Notification worker → Webhook channel: sends digest
- Webhook channel → Webhook service: posts alert
- Administrator → Console application: uses console
- Console application → Console API client: requests data
- Console API client → HTTP API: calls API
- HTTP API → Audit database: reads and writes
- Console application → Audit and management views: renders pages
- HTTP API → Install and signing routes: routes install requests
- Install and signing routes → Install script renderer: renders script
- Developer → Install and signing routes: requests install