agent-session-forensicslisted

# Agent Session Forensics ## When To Use - Agent session ended mid-tool-call or cannot resume. - Tool call appears in assistant turn but no corresponding result turn follows. - Need to correlate tool calls, tool results, and timing metadata. - Diagnosing slow LLM calls, duplicate user turns, or malformed results. - Debugging experimental MCP data-layer sessions. ## Requirements / Checks - Locate session directory and history files before editing anything. - Prefer read-only inspection first. - Have `jq` or equivalent JSON tooling available. - Ask before modifying, truncating, or deleting any session or history file. ## Workflow 1. **Inventory session files** — find metadata, current history, rotated previous history, and related subagent histories. 2. **Count and list last turns**: ```sh jq 'length' history.json # total messages jq '.[-10:] | .[] | {role, stop_reason}' history.json # last 10 turns jq '.[] | select(.role=="assistant") | .tool_calls[].id' history.json # tool call IDs jq '.[] | select(.role=="user") | .tool_results[]?.tool_call_id' history.json # results ``` 3. **Correlate tool call IDs** — every `tool_call` in an assistant turn must have a matching `tool_result` in the immediately following user turn. Find the first gap. 4. **Check timing for slow calls**: ```sh jq '.[] | select(.timing) | {role, duration_ms: .timing.duration_ms}' history.json ``` 5. **Identify failure pattern** —