
Security News
Socket Releases Free Certified Patches for Nuxt Security Vulnerabilities
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.
Oh, so that's what your coding agents have been doing! — Claude Code & Codex harness insights dashboard
Oh, so that's what your coding agents have been doing! — A visual dashboard for your AI coding harnesses (Claude Code & Codex).
Parses your Claude Code and Codex configuration and usage data, stores results in a local SQLite database, and serves an interactive dashboard via a local HTTP server. It discovers each tool by its config directory, so a single dashboard shows them side by side.
Breaks down token usage by context type and individual item. Shows which skills, agents, MCP servers, and built-in tools are consuming the most tokens — and how much of that cost comes from startup context that loads on every session.
Startup context cost estimates the cumulative token cost of items that load automatically before every session (CLAUDE.md, skill descriptions, principles, MCP tool listings). Multiplied by session count for the selected period, it gives you a concrete number to act on — trim a large CLAUDE.md or remove unused skills to reduce your baseline cost per session.
Tracks how much the cache TTL regression (5 min vs 1 hr) may be costing you. Compares 7-day rolling cache hit rates to estimate excess re-creation cost — drops in the trend chart indicate periods when caches expired before being reused.
Pick a real session from your Claude Code or Codex history and replay it turn-by-turn. The explorer breaks down every API turn into its contribution to the context window — system prompt, CLAUDE.md / AGENTS.md, memory, skill descriptions, MCP tools, user prompts, model responses, tool calls — so you can see exactly where your tokens went and when compaction kicked in. For Codex, each turn is classified by the tool it used (exec_command, apply_patch, …).
You can also view a guided example session to walk through the mechanics before loading your own:
claude plugin marketplace add netil/oh-my-hi
claude plugin install oh-my-hi
/plugin marketplace add netil/oh-my-hi
/plugin install oh-my-hi@oh-my-hi
Run in Claude Code:
/omh
This will parse your harness data, build the dashboard, and open it in your browser.
| Command | Description |
|---|---|
/omh | Full build — parse data, build web-ui, open in browser |
/omh --data-only | Lightweight data collection (skip dashboard build) |
/omh --enable-auto | Auto-rebuild on session end (registers Stop hook) |
/omh --disable-auto | Disable auto-rebuild |
/omh --update | Check and install latest version |
/omh --status | Check auto-rebuild status |
/omh <path> | Build with specific project paths only |
oh-my-hi is also a plain CLI — it does not require Claude Code to run:
npx --yes oh-my-hi # one-off
npm install -g oh-my-hi # then: oh-my-hi (or: omh)
All flags above work the same (oh-my-hi --data-only, oh-my-hi --help, …).
oh-my-hi discovers data by config directory, so it shows Claude Code and Codex side by side — pick a tool from the scope selector to see its tokens, cost, sessions, skills, memory, and MCP.
Claude Code data comes from CLAUDE_CONFIG_DIR (default ~/.claude).
Codex data comes from CODEX_HOME (default ~/.codex). Set it if your Codex
config lives elsewhere:
CODEX_HOME=/path/to/codex-config npx oh-my-hi
A provider whose config dir is absent is skipped, so a Claude-only (or Codex-only) machine just works. Codex token accounting (cached-input subset, reasoning tokens, no cache-creation) and GPT-5.x / Codex pricing are handled automatically.
Launching from Codex — Codex has no plugin system, so run the CLI directly,
or install the ready-made prompt at codex/omh-prompt.md:
cp codex/omh-prompt.md "${CODEX_HOME:-$HOME/.codex}/prompts/omh.md" # then use /omh in Codex
Enable automatic data refresh so the dashboard stays up to date:
/omh --enable-auto
This registers a Stop hook that collects data whenever a Claude Code session ends. data.json and SQLite are updated incrementally — just refresh the browser tab to see the latest data.
/omh --update
Checks for new versions and updates the plugin. An update check also runs automatically once per day when using /omh.
See GUIDE.md for a detailed walkthrough of each dashboard section — overview, token analytics, cost estimation, structure view, category pages, and more.
CLAUDE_CONFIG_DIR → ~/.claude, CODEX_HOME → ~/.codex). A tool whose directory is absent is skipped.jsonl transcripts and Codex sessions/**/rollout-*.jsonltask-categories.json for user customizationdata.json (structure/metadata) and syncs token entries — tagged by provider — to month-partitioned SQLite (output/db/) for fast API queriesserve.mjs, port 8282) with /api/meta and /api/usage endpoints. Server is reused across builds via a lock fileAll data stays on your machine. oh-my-hi reads only local Claude Code and Codex config files and transcripts — nothing is sent to external servers. The dashboard is served by a local HTTP server on localhost; all API calls go to 127.0.0.1 only. Your usage data, token statistics, and configuration details never leave your local environment.
The dashboard is served locally via http://localhost:8282 (or next available port). The server starts automatically on first /omh run and stays running between builds.
On macOS, subsequent builds will refresh the existing browser tab instead of opening a new one (Chrome and Safari supported).
FAQs
Oh, so that's what your coding agents have been doing! — Claude Code & Codex harness insights dashboard
The npm package oh-my-hi receives a total of 83 weekly downloads. As such, oh-my-hi popularity was classified as not popular.
We found that oh-my-hi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

Security News
An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.