Module audit 

Append-only provider invocation audit log.

Records minimal metadata for each provider routing event without storing prompts or tool payloads. File: $SYNAPS_BASE_DIR/extensions/audit.jsonl.

Design constraints:

• One JSON object per line; missing file is equivalent to no entries.
• Append-only: each new entry uses O_APPEND so concurrent appenders on Unix produce well-formed line records without locking.
• Malformed lines (e.g. partial write from a crash) are skipped on read with a tracing::warn! so a corrupt line cannot lock the user out.
• Never contains prompt text, tool inputs, tool outputs, or tokens.

Structs

InterceptAuditEntry

Audit record for an extension rewriting a tool’s output via HookResult::Replace. Captures WHO rewrote WHICH tool’s output and WHEN, plus sizes — never the content (privacy), matching the provider-audit policy.

ProviderAuditEntry

Functions

append_audit_entry

Append a single entry as one JSON line. Creates parent dirs and the file if missing. Atomic per-line via O_APPEND on Unix.

audit_file_path

Path to the audit file under the active base dir. Caller is responsible for creating parent directories when writing.

intercept_file_path

Path to the intercept audit file ($SYNAPS_BASE_DIR/extensions/intercept.jsonl).

new_audit_entry

Build a fresh entry with the current UTC timestamp.

read_audit_entries

Read all entries (one per line). Missing file → empty Vec. Malformed lines are skipped with a tracing::warn!.

read_audit_entries_tail

Read only the last n entries from the audit log. Reads the whole file but collects lines into a fixed-capacity ring so only the tail N lines are ever parsed by serde — O(file_size) bytes read but O(N) deserialisation. Missing file → empty Vec. Malformed tail lines are skipped with a warn.

record_tool_output_replace

Record that an extension replaced a tool’s output. Best-effort and metadata-only — auditing must never break or alter the tool flow, so callers typically ignore the result.