From docs/AUDIT-v0.4.0.md (P1, item 5).
The PostToolUse matcher is Bash|Edit|Write|NotebookEdit. Research-heavy sessions (Read, Grep, Glob, WebFetch, WebSearch, Task/subagents, MCP tools) leave almost no trace in the buffer.
Proposal: widen the matcher and emit compact one-liners for high-signal read-side tools - tool name plus one redacted argument (query, URL, or subagent description). Keep the hot path at a single jq invocation. Deliberately skip the noisiest tools (Read/Glob) or sample them, so buffers stay skimmable.
Open question: whether Task/subagent boundaries deserve their own marker lines (SubagentStop) so a handoff can attribute actions to a delegated task.
From docs/AUDIT-v0.4.0.md (P1, item 5).
The PostToolUse matcher is Bash|Edit|Write|NotebookEdit. Research-heavy sessions (Read, Grep, Glob, WebFetch, WebSearch, Task/subagents, MCP tools) leave almost no trace in the buffer.
Proposal: widen the matcher and emit compact one-liners for high-signal read-side tools - tool name plus one redacted argument (query, URL, or subagent description). Keep the hot path at a single jq invocation. Deliberately skip the noisiest tools (Read/Glob) or sample them, so buffers stay skimmable.
Open question: whether Task/subagent boundaries deserve their own marker lines (SubagentStop) so a handoff can attribute actions to a delegated task.