grith profile audit

grith profile audit --profile <NAME> --trace <FILE>

A maintainer tool. It takes a forensics trace from a real session and reports what a profile would need in order to stop prompting for the things that session did. Both flags are required, and audit is the only subcommand grith profile has.

Record a trace first

$ grith exec --trace-syscalls-jsonl ~/trace.jsonl -- claude

That writes raw, pre-filter records as JSONL for the whole session. Run the tool through its normal work, quit, then audit the file.

What it prints

$ grith profile audit --profile claude-code --trace ~/trace.jsonl
Profile Audit: claude-code
Trace: /home/u/trace.jsonl

Events analyzed: 4
Approved: 0  Denied: 1  Other: 3

Remote Overlay Candidates (2):
readonly_paths:
  + /home/u/.ssh/id_rsa
routine_destinations:
  + example-telemetry.io

Bundled-Profile Changes Required (2):
new exec root required for: /usr/bin/rsync
listener policy: 0.0.0.0:8080

A fourth section, Unused Existing Entries (observed 0 times), lists every profile entry the trace never exercised. On a short trace that is most of the profile, so read it as "nothing here fired", not "delete these".

Reading the three buckets

• Remote overlay candidates - additions that could ship as a profile overlay: read-only paths and routine destinations.
• Bundled-profile changes required - things that cannot be added by overlay, such as a new exec root or a listener policy. These need a change to the compiled profile.
• Unused existing entries - profile entries this trace did not touch.

Note the first bucket in the example above: a trace containing an SSH private key read surfaces /home/u/.ssh/id_rsa as a candidate. The tool reports what the session did; it does not judge whether you should grant it.

It changes nothing

profile audit is read-only. It does not modify the profile, and grith has no path for a user to author or edit one - profiles are compiled into the binary. The output is evidence for a change request, not a patch.

A missing trace file fails plainly: Error: No such file or directory (os error 2), exit 1.

See also

• How profiles work - the merge order and what is fixed
• grith exec - the --trace-syscalls-jsonl flag