jq script lists every file Claude Code read

Claude Code, Anthropic's coding assistant, leaves a jsonl log for every conversation, with each line a JSON record whose type separates a person's message, Claude's reply, an attachment the tool added, or a system notice. That structure is what makes the script possible: tool calls sit inside an assistant reply, tool results sit in rows typed as user, and attachments carry things like pasted-in files or change notices. The script walks these rows, marks files read when Claude calls Read, marks them edited on Edit, MultiEdit, Write, or NotebookEdit, and flips everything to stale when a compact_boundary row shows the conversation was compressed.

The sample run shows two behaviors that matter for anyone trusting the output. A file read before compression and never touched again stays stale, because only a summary remains in context, while a file edited before compression and re-read afterward returns to read. The author also excludes rows flagged isSidechain, since a subagent's reading never reaches the main Claude's context. Rewinding with /rewind or pressing Esc splits the parentUuid chain, and because the script reads every row, files from abandoned branches still appear.

The same rules power the file-tree markings in tanacode, the author's macOS app for watching Claude Code work, which reads logs incrementally with fs.watch and keeps a file edited marker even after a later read. The open question is how much of this a reader should treat as ground truth: the markings reflect what the log recorded, and the author notes that a running session may have a last row that is still being written, so a snapshot taken mid-turn could miss the newest activity.