reading-the-audit-traillisted

# Reading the audit trail Two append-only JSONL files under the plugin's data directory (`${CLAUDE_PLUGIN_DATA}`, or `~/.claude/session-sitter/` when the plugin is loaded session-only). Both are rotated at 4 MiB, with one previous generation kept as `<name>.jsonl.1`. Read them through the CLI rather than by hand — it already merges the rotated generation, skips malformed lines, and filters: ```bash node "${CLAUDE_PLUGIN_ROOT}/lib/audit/cli.js" log --since 24h --denied node "${CLAUDE_PLUGIN_ROOT}/lib/audit/cli.js" digest --since 24h node "${CLAUDE_PLUGIN_ROOT}/lib/audit/cli.js" status ``` `--json` and `--csv` are there for handing the log to someone else. `/session-sitter:log`, `:digest` and `:status` are the same three commands. ## `decisions.jsonl` — one record per permission decision | Field | Read it as | |---|---| | `ts` | ISO timestamp, UTC | | `sessionId` | joins to `status`, and to the session files under `sessions/` | | `cwd` | which repository the agent was in | | `tool` | the Claude Code tool name — `Bash`, `Write`, `Edit`, … | | `inputSummary` | the command or path, **redacted and truncated to 300 characters**. Never the raw input. | | `light` | `green` allowed · `yellow` corrected · `red` denied · `null` no light was assigned | | `decision` | `allow` or `deny` — what Claude Code was actually told | | `clause` | the citation, e.g. `practices §team-git-002`, or `null` when no written clause applied | | `actor` | who decided (below) | | `latencyMs` | how long t