v0.8.0

What's new

Subagent tracing

When an agent spawns subagents, sessions are linked into a parent-child tree. Three new flags expose this:

• replay --expand-subagents - inline subagent events under the parent tool_call, with timestamps anchored to the root session
• replay --tree - compact hierarchy: session IDs, durations, tool counts
• stats --include-subagents - tool calls, LLM requests, tokens, and errors across the full tree (duration is wall-clock max, not sum)

Session metadata gains three optional fields (parent_session_id, parent_event_id, depth), omitted from JSON when zero. Existing sessions deserialize without changes.

diff - compare two sessions

agent-strace diff <session-a> <session-b>

Aligns phases using longest common subsequence, then reports per-phase differences: commands only in A or B, files only in A or B, failed vs passed outcomes, duration/event/retry counts. Compare a broken run against a working one.

why - causal chain

agent-strace why [session-id] <event-number>

Walks backwards from any event to find what caused it. Follows parent_id links, detects retries (same tool and command after an error), matches path references, and traces read-write pairs on the same file. Terminates at user_prompt or session_start. Event numbers match replay output.

audit - permission audit

agent-strace audit [session-id] [--policy .agent-scope.json]

Checks every tool call against a policy file. Auto-flags sensitive paths with no policy required: .env, *.pem, .ssh/*, .aws/credentials, .github/workflows/*, secrets.json/yaml.

Policy file controls file read/write (glob patterns with **), command execution (prefix + glob allow/deny), and network access (deny_all + allow exceptions). Grep and Glob calls are subject to file read policy. Exits 1 on violations - drop it in CI.

Bug fixes

• aggregate_stats: multi-child tree duration now takes the running max across children, not the root's fixed value
• why: retry attribution now requires the same tool name and command string - previously any Bash call after an error was marked as a retry
• audit: ** glob patterns now match nested paths correctly (src/** matches src/utils/path.py); fnmatch alone does not handle path separators