What Goes on Inside of Claude Code?

When we use tools like GSD, Claude Code does a ton of work for us. It does it so fast, that we cannot keep track. Did it call a specific tool? What was our input? If those are questions you would like an answer for, then this post is for you.

What did we enter?

The user specific .claude folder (C:\Users\USERNAME\.claude) does not only host the global CLAUDE.md configuration file, but it is also the home for many more interesting files.

The file history.jsonl is where we can find the history of all the prompts we wrote in Claude Code. It only contains our inputs and not the outputs, but when we need to see what we wrote in a past session, this is the place where we can find the answer.

"{display":"/gsd:audit-milestone ","pastedContents":{},"timestamp":1773346313222,"project":"C:\\__CODE\\claude_demos\\travel_goals_gsd","sessionId":"ae187073-6a62-46aa-9015-ed6bbb1b73b9"}
{"display":"/gsd:progress ","pastedContents":{},"timestamp":1773346706457,"project":"C:\\__CODE\\claude_demos\\travel_goals_gsd","sessionId":"ae187073-6a62-46aa-9015-ed6bbb1b73b9"}
{"display":" /gsd:complete-milestone","pastedContents":{},"timestamp":1773346787345,"project":"C:\\__CODE\\claude_demos\\travel_goals_gsd","sessionId":"ae187073-6a62-46aa-9015-ed6bbb1b73b9"}
{"display":"cat .planning/RETROSPECTIVE.md","pastedContents":{},"timestamp":1773347209116,"project":"C:\\__CODE\\claude_demos\\travel_goals_gsd","sessionId":"ae187073-6a62-46aa-9015-ed6bbb1b73b9"}
{"display":"/model ","pastedContents":{},"timestamp":1773347821601,"project":"C:\\__CODE\\claude_demos\\travel_goals_gsd","sessionId":"ae187073-6a62-46aa-9015-ed6bbb1b73b9"}

The history is in a JSON Lines file, and we can use our favourite text editor to find the part that interests us.

What did Claude Code do?

There are lots of tools to keep track on what Claude Code does. However, they either require a lot of resources, enterprise plans or are no longer supported. While this field changes fast, your search may yield better results as mine did. Nevertheless, we can write our audit log with a bit of PowerShell and the hook system of Claude Code.

We first must make sure that we have PowerShell 7 installed. Follow this guide if you are unsure.

We need to create the audit logger and put it in our system-wide settings folder (C:\Users\USERNAME\.claude\hooks\audit-log.ps1):

try {
    $raw = [Console]::In.ReadToEnd()
    if ([string]::IsNullOrWhiteSpace($raw)) { exit 0 }

    $input_json = $raw | ConvertFrom-Json -ErrorAction Stop
    $timestamp = (Get-Date -Format "o")

    $log_dir = "$env:USERPROFILE\.claude"
    if (-not (Test-Path $log_dir)) { New-Item -ItemType Directory -Path $log_dir | Out-Null }

    $entry = [PSCustomObject]@{
        ts    = $timestamp
        tool  = $input_json.tool_name
        input = $input_json.tool_input
    } | ConvertTo-Json -Compress -Depth 10

    Add-Content -Path "$log_dir\audit.jsonl" -Value $entry
} catch {
    # Silently ignore so Claude Code is not disrupted
}
exit 0

As a final step, we need to wire-up the PostToolUse hook with our audit logger:

{
  "enabledPlugins": {
    "skill-creator@claude-plugins-official": true
  },
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "pwsh -NoProfile -File \"C:\\Users\\USERNAME\\.claude\\hooks\\audit-log.ps1\""
          }
        ]
      }
    ]
  }
}

We can now open a new terminal, start Claude Code and should find our audit.jsonl file in the .claude folder:

{"ts":"2026-04-27T20:58:07.8382970+02:00","tool":"Glob","input":{"pattern":"**/*","path":"C:\\__CODE\\claude_demo\\sayno"}}
{"ts":"2026-04-27T20:58:11.7661379+02:00","tool":"Read","input":{"file_path":"C:\\__CODE\\claude_demo\\sayno\\Program.cs"}}

What Goes on Inside of Claude Code?

What did we enter?

What did Claude Code do?

Next