Struct Audited 

pub struct Audited<'a> {
    pub caller: &'a Caller,
    pub action: &'a str,
    pub tool: Option<&'a Tool>,
    pub args: &'a Value,
    pub outcome: Result<(), &'a Error>,
    pub origin: &'a Origin,
}

What the audit hook hears: a tool call, admitted or refused, or a terminal opening (terminal.open) and closing (terminal.close).

Fields

caller: &'a Caller

action: &'a str

The tool’s name, or terminal.open / terminal.close.

tool: Option<&'a Tool>

The tool, when the action is one (its annotations say whether it only reads).

args: &'a Value

The arguments as authorized (for a refusal, as sent). The hook keeps only what it knows is safe to keep.

outcome: Result<(), &'a Error>

origin: &'a Origin