DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to record a Codex CLI run that cannot be redirected with Orca Replay

Use opt-in TLS interception to capture a Codex CLI session that talks to its own backend.

Authorization notice. Orca Replay is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Reverse engineering. TLS interception decrypts traffic between a vendor client and its backend, so check that your use complies with the vendor's terms and your organisation's policy before recording.

Who it is forA developer using Codex CLI signed in with a ChatGPT subscription who needs a replayable record of a run.

The problemA Codex CLI session uses a credential that only its own backend accepts, so a base-URL redirect cannot capture it.

The outcomeA trace of the run captured at the process and socket boundary, which you can then replay and inspect with the same commands as other runs.

What you need first

  • Node.js and npm, to install the orcareplay package
  • A coding agent installed locally, such as Claude Code or Codex CLI, to record a run
  • A model API key and network access for recording and for live forked turns
  • A terminal with permission to install a global npm package

Steps

  1. Run npm i -g orcareplay to install the package.
  2. Read the README section on when the harness will not be redirected and confirm your Codex CLI setup matches it.
  3. Run orca record with the --tls-intercept option, following the README for the exact syntax of that flag. (inferred, check the README)
  4. Run orca show last to confirm the trace includes model turns, and orca replay last to confirm the offline replay.

Prompt for your agent

Use the OrcaReplay repo (Continuum-AI-Corp/OrcaReplay) to record a Codex CLI session with TLS interception enabled, following the README section on when the harness will not be redirected. Report whether `orca show last` lists model turns from the session. Verify that hosts not on the intercept list are listed in the trace as tunnelled.

Caveat. The README describes --tls-intercept only at a high level, so the exact flag syntax and setup must be read from the README before running this.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page