AI Extensions, November 5: inspect replay metadata and executable apps

A coding-session replay can show the files an agent touched without proving its patch works. An extension registry can make useful capabilities easy to discover while introducing code that runs with real privileges. Today's pair is about inspecting those boundaries before treating either interface as a trustworthy result.

This November 5, 2026 edition reviews public documentation and source only. I did not install either project, open private coding transcripts, export sessions or enable a plugin. Both repositories' current licenses were read directly. Popularity is not a quality or security measure, so this edition does not rank projects by stars.

agentplay: a replay still contains project metadata

agentplay turns supported coding-assistant transcripts into maps and timelines. The README describes file exploration and edits, shell-command verbs, errors, model and token lanes, and links to recorded outputs. Current parsers include Claude Code, Codex, Cursor and others; a recent commit adds Goose support. The reviewed source was current at commit b5fcffe, dated November 4.

That can help answer a concrete debugging question: did the agent inspect the file it later edited, and did it retry a failing command? It does not establish that the edit is correct or that a recorded commit passed a meaningful test. The reviewer still needs the diff, requirements and test evidence.

The Apache 2.0 license covers the project. Its documented setup uses Python 3.11 or newer with no Python runtime dependencies beyond the standard library. The quick-start command discovers existing sessions automatically, so it is not an innocuous choice for a machine containing confidential work. For this review I stopped at source inspection.

Local viewing and sharing are different decisions

The README says the viewer binds to 127.0.0.1, uses no remote fonts or scripts, uploads no sessions or maps and has no usage telemetry or update check. It describes one optional email-signup request, carrying the email, install identifier, version and time. The AGENTPLAY_NO_NETWORK=1 or DO_NOT_TRACK=1 setting disables that signup path. These are documented design claims, not a network audit I performed.

The format documentation describes a redaction contract. Map documents exclude prompt text, assistant text, reasoning, tool inputs and outputs, file contents and shell-command arguments. They still contain repository names and remotes, relative file paths, tool and MCP names, models, timings and error classes.

That remaining structure can be sensitive. A repository name can disclose a customer or unreleased product; a path can reveal an internal feature. dirs_only reduces filename detail, while hashed paths have their own key requirements. The README says repository names and remotes remain in every path mode. A redacted export is therefore a document to inspect, not an automatic permission to publish it.

Local extras need separate attention. Titles and task labels can use the start of a prompt in the local index, while prompt images and failed-hook text can be read from original transcripts on demand. They are not included in the map export, according to the README. The --no-titles flag is per run; a later run without it can put titles back. Someone evaluating privacy should distinguish the exported map, local index and live viewer.

What a first trial should check

Use synthetic demo data in an isolated environment, rather than your latest work session. The repository includes a synthetic demo screenshot and describes bundled demo sessions. Compare a tiny invented timeline with the displayed events. Check that a failed command stays a failure, and that an absent event is not silently presented as success.

Then inspect a synthetic export as text. Confirm which names and paths survive. Check whether local titles appear only where the documentation says they should. Do not test these rules by exposing a real customer's repository to a public viewer.

The known limitations also affect interpretation: Cursor sessions have no token or cost figures because billed usage is not recorded locally and the API lookup is disabled. Costs elsewhere are estimates from public list prices. Large maps are capped at 20,000 events and flagged truncated; transcripts above 512 MB are skipped. A missing lane or a small total may reflect parser limits, not an efficient agent.

OpenHands Extensions: inspect the executable category

The OpenHands Extensions registry contains skills, plugins and Agent Canvas Apps. Its current 0.40.0 release, published November 5, adds a Bitbucket Data Center repository picker to Data Center automation templates. That is a specific template change, not a new guarantee for every integration.

The repository's MIT license is distinct from the accounts, model services and other systems an integration might use. Its documentation also separates ownership: the registry holds reusable artifacts, while other OpenHands repositories own execution, the Canvas interface and automation orchestration. A catalog entry is not the whole runtime.

Its categories deserve different reviews. Skills are Markdown guidance. Plugins can contain executable hooks and scripts. Apps provide interfaces in Agent Canvas. The Apps documentation and registry README warn that enabling an App executes trusted JavaScript in the Canvas browser context and permits authenticated requests to the active Agent Server.

A useful review therefore pins the resolved revision, reads the executable components and checks what authenticated service they can reach. A friendly dashboard appearance cannot establish a harmless capability. For the new repository picker, test that a synthetic or disposable account selects the intended repository and cannot silently substitute another target before any automation is enabled.

Registry artifact + resolved revision
    |
    +-- Guidance: inspect instructions and intended scope
    +-- Hook/script: inspect executable behavior
    +-- Canvas App: inspect JavaScript and authenticated server reach

Test with disposable data before connecting work accounts.

The registry documents Node.js 18.20.0 or newer for its catalog package, and publishes a Python catalog too. Neither installation was performed here. Review the exact extension's own requirements and service costs, rather than treating the registry license as a promise that a running workflow costs nothing.

My shortlist is purpose-specific: agentplay for inspecting synthetic session histories, OpenHands Extensions for reviewing a particular reusable integration or interface. In both cases, start with the evidence you need to inspect and the data you are willing to expose. Neither a replay animation nor a catalog listing can replace acceptance tests for the task.