ReferenceTransient Trace

CLI reference

All Transient Trace commands and flags.

Global flags

These flags apply to most commands and can be placed before or after the subcommand.

Flag	Description
--mode <mode>	Governance mode: audit (default), strict, permissive
--state-dir <path>	Override default state directory
--policy <path>	Path to a custom policy JSON file
--packages <list>	Comma-separated governance packages

wrap

Manage PATH shims.

transient-trace wrap install <binary>     # install a shim for a specific binary
transient-trace wrap uninstall <binary>   # remove a shim
transient-trace wrap status               # list installed shims
transient-trace wrap install-hook         # install subprocess intercept hook

run

Start a governed session.

transient-trace run [flags] -- <command>

Flag	Description
--mode <mode>	audit \| strict \| permissive
--packages <list>	Governance packages
--shim	Force shim-only mode (no subprocess hook)
--learning	Enable learning mode (promotes frequent allows to rules)

Examples:

transient-trace run -- python agent.py
transient-trace run --mode strict --packages filesystem,shell -- python agent.py

receipts

Inspect governance receipts.

transient-trace receipts list              # list all receipts
transient-trace receipts summary           # session summary
transient-trace receipts show <id>         # full receipt detail
transient-trace receipts index             # rebuild search index

Filter flags for list:

Flag	Description
--outcome allow\|deny	Filter by outcome
--action-class <class>	Filter by action class
--session <id>	Filter by session identifier
--limit <n>	Maximum number of results to return

config

Manage defaults.

transient-trace config show                # print current config
transient-trace config set <key> <value>   # set a config value

explain / export

transient-trace explain <receipt-id>       # explain why an action was allowed or denied
transient-trace export --format json       # export receipts as JSON
transient-trace export --format csv        # export receipts as CSV

uninstall

transient-trace uninstall                  # remove shims and hooks
transient-trace uninstall --purge-data     # also delete all receipts and state

Environment variables

Variable	Description
TRANSIENT_MODE	Override governance mode
TRANSIENT_STATE_DIR	Override state directory
TRANSIENT_AGENT_ID	Tag receipts with an agent identifier
TRANSIENT_SESSION_ID	Tag receipts with a session identifier

How it works →Trace →Troubleshooting →