opencode-skill-audit 0.1.0 → 0.1.1-dev.pr2.34397019140

package/README.md

@@ -2,6 +2,10 @@
 
 [![CI](https://github.com/DepickereSven/skill-audit/actions/workflows/ci.yml/badge.svg)](https://github.com/DepickereSven/skill-audit/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/opencode-skill-audit?logo=npm&logoColor=white&color=CB3837)](https://www.npmjs.com/package/opencode-skill-audit)
+[![Claude Code](https://img.shields.io/badge/Claude_Code-supported-D97757?logo=claude&logoColor=white)](#claude-code)
+[![Codex](https://img.shields.io/badge/Codex-supported-000000?logoColor=white)](#codex)
+[![OpenCode](https://img.shields.io/badge/OpenCode-supported-FBBF24?logo=opencode&logoColor=white)](#opencode)
 
 Deterministic audit trail for [Claude Code](https://code.claude.com),
 [Codex](https://developers.openai.com/codex/) and [opencode](https://opencode.ai) sessions: which
@@ -12,24 +16,31 @@ On opencode it also renders live in the TUI sidebar, so the audit sits next to t
 with no command to run.
 
 ```text
-● Skill audit — f3a91c2e · ~/Dev/Web · 14:02→14:20 UTC
-
-  14:02 ⚡ superpowers:brainstorming
-  14:05 ⚡ superpowers:test-driven-development
-  14:06 │  ✎ src/auth/token.ts  Edit
-  14:09 │  ✎ src/auth/token.test.ts  Write
-  14:20 ⚠ (no skill active)
-  14:20 │  ✎ src/index.ts  Edit
-
-● 2 skill runs (2 distinct) · 3 files touched · ⚠ 1 edits outside skill context
+● Skill audit — f3a91c2e · ~/Dev/Web · 14:02→16:40
+
+  ⚡ superpowers:brainstorming
+  ⚡ superpowers:test-driven-development
+     14:00  (2)
+       14:06 ✎ src/auth/token.ts  Edit
+       14:09 ✎ src/auth/token.test.ts  Write
+     15:00  (1)
+       15:12 ✎ src/auth/session.ts  Edit
+  ⚠ (no skill active)
+     16:00  (1)
+       16:40 ✎ src/index.ts  Edit
+
+● 2 skill runs (2 distinct) · 4 files touched · ⚠ 1 edits outside skill context
 ```
 
+The skill leads each block; the hours beneath it show when its work actually happened. Times are
+your local clock — the log itself stays UTC, so a session stays readable across machines.
+
 ## Why
 
 You ask an agent to follow a skill. Did it? Reading the transcript to find out is slow, and asking
 another model to judge costs tokens and is itself non-deterministic.
 
-LLMs are not deterministic; hook events are. This plugin logs the facts exposed by each host's
+LLMs are not deterministic. Hook events are. This plugin logs the facts exposed by each host's
 documented hook API:
 
 - **No LLM judging, no tokens.** Everything except the two in-session slash/skill commands runs
@@ -43,6 +54,7 @@ documented hook API:
 
 ## Contents
 
+- [Why](#why)
 - [How it works](#how-it-works)
 - [Install](#install)
 - [Verify the install](#verify-the-install)
@@ -60,8 +72,18 @@ documented hook API:
 `PostToolUse` hooks capture skill-tool calls and file edits. On Codex, a `UserPromptSubmit` hook
 also captures explicit `$skill-name` references, and `apply_patch` payloads are expanded into one
 file event per path. On opencode a plugin does the same job through the `tool.execute.after` hook.
-Events are appended as NDJSON to `~/.claude/skill-audit/<session_id>.ndjson`; override the location
-with `SKILL_AUDIT_DIR`.
+Events are appended as NDJSON to `~/.claude/skill-audit/<session_id>.ndjson`. All three hosts
+write to that one directory on purpose, so any viewer can read any host's session. Override the
+location with `SKILL_AUDIT_DIR`.
+
+A skill run only claims the edits that keep arriving under it. Once 30 minutes pass with no
+activity the run closes, and later files are counted as `(no skill active)` rather than being
+attributed to whatever skill happened to run that morning. Tune the window with
+`SKILL_AUDIT_IDLE_MINUTES`.
+
+The opencode sidebar draws in fixed columns, so it defaults to icons that are always one terminal
+cell wide (`·` `✎` `!`); emoji such as `⚡` and `⚠` render two cells wide in most terminals and
+shift every row that carries them. Set `SKILL_AUDIT_ICONS=emoji` to use the emoji set anyway.
 
 ```text
 Claude Code / Codex ──hooks───▶ logger.sh ──┐
@@ -111,12 +133,14 @@ Invoke the bundled Codex skill with `$skill-audit`.
 opencode plugin opencode-skill-audit --global
 ```
 
-Restart opencode so the plugin loads. It registers two things: a server hook that logs
-`skill`, `edit`, `write` and `apply_patch` tool calls, and a sidebar section that renders the
-current session's timeline live.
+The plugin is published on npm as
+[`opencode-skill-audit`](https://www.npmjs.com/package/opencode-skill-audit).
 
+Restart opencode so the plugin loads. It registers two things: a server hook that logs
+`skill`, `edit`, `write`, `multiedit`, `apply_patch` and `patch` tool calls, and a sidebar section
+that renders the current session's timeline live.
 
-![OpenCode Image](docs/opencode.png)
+![The opencode sidebar rendering a live skill-audit timeline beside a conversation](docs/opencode.png)
 
 Click the header to collapse the section, or a skill row to fold its files away.
 
@@ -146,7 +170,7 @@ ln -sf ~/.codex/plugins/cache/*/skill-audit/*/scripts/skill-audit ~/.local/bin/s
 
 You can also clone this repository and link `scripts/skill-audit` directly.
 
-`~/.local/bin` is not on every system's `PATH`. Check with `command -v skill-audit`; if it prints
+`~/.local/bin` is not on every system's `PATH`. Check with `command -v skill-audit`. If it prints
 nothing, add the directory in your shell profile:
 
 ```bash
@@ -182,7 +206,8 @@ installing.
    - Claude Code: `/skill-audit`
    - Codex: `$skill-audit`
    - opencode: watch the sidebar section appear
-2. Check that a log exists and is growing:
+2. Check that a log exists and is growing. Look in `~/.claude/skill-audit`, or in the directory
+   you set as `SKILL_AUDIT_DIR`:
 
    ```bash
    ls -la ~/.claude/skill-audit/
@@ -195,7 +220,7 @@ installing.
    skill-audit status    # counts + recent timeline for the newest session
    ```
 
-If `list` prints `no session logs in ...`, nothing was written — go to
+If `list` prints `no session logs in ...`, nothing was written. Go to
 [Troubleshooting](#troubleshooting).
 
 ## Usage
@@ -204,16 +229,16 @@ If `list` prints `no session logs in ...`, nothing was written — go to
 |----------------------------|------------------------------------------------------------------|-----------:|
 | `skill-audit status [sid]` | Compact counts and recent timeline                               |          0 |
 | `skill-audit report [sid]` | Full timeline                                                    |          0 |
-| `skill-audit watch [sid]`  | Live view, refreshed every two seconds; `q` quits                |          0 |
+| `skill-audit watch [sid]`  | Live view, refreshed every two seconds. `q` quits                |          0 |
 | `skill-audit list`         | Recent sessions                                                  |          0 |
 | `skill-audit --help`       | Usage summary                                                    |          0 |
-| `! skill-audit status`     | Run inside a Claude Code session; queues while the model is busy |          0 |
-| opencode sidebar           | Live timeline beside the conversation; no command to run         |          0 |
+| `! skill-audit status`     | Run inside a Claude Code session. Queues while the model is busy |          0 |
+| opencode sidebar           | Live timeline beside the conversation. No command to run         |          0 |
 | `/skill-audit`             | Show the report inside Claude Code                               | Model turn |
 | `$skill-audit`             | Show the report inside Codex                                     | Model turn |
 
 `status`, `report` and `watch` all take an optional session ID. Without one they use the most
-recently modified log, which is the wrong session if you run several at once — get the ID from
+recently modified log, which is the wrong session if you run several at once. Get the ID from
 `skill-audit list` and pass it explicitly.
 
 The `⚠ edits outside skill context` counter is the compliance red flag: files changed while no
@@ -231,13 +256,13 @@ One NDJSON file per session, one event per line, appended in chronological order
 | Field     | On      | Meaning                                                                       |
 |-----------|---------|-------------------------------------------------------------------------------|
 | `ts`      | both    | UTC timestamp, `YYYY-MM-DDThh:mm:ssZ`                                         |
-| `kind`    | both    | `skill` or `file` — the only two event kinds                                  |
+| `kind`    | both    | `skill` or `file`, the only two event kinds                                   |
 | `cwd`     | both    | Session working directory as reported by the host                             |
 | `name`    | `skill` | Skill identifier, e.g. `superpowers:test-driven-development`                  |
-| `args`    | `skill` | Arguments passed to the skill tool; empty string when there were none         |
+| `args`    | `skill` | Arguments passed to the skill tool, empty string when there were none         |
 | `source`  | `skill` | `tool` for an observed skill tool call, `prompt` for a Codex `$skill-name`    |
-| `turn_id` | `skill` | Codex turn identifier; present only when the host supplies one                |
-| `tool`    | `file`  | Tool that made the edit: `Edit`, `Write`, `NotebookEdit`, `apply_patch`…      |
+| `turn_id` | `skill` | Codex turn identifier, present only when the host supplies one                |
+| `tool`    | `file`  | Tool that made the edit: `Edit`, `Write`, `MultiEdit`, `apply_patch`, etc.    |
 | `path`    | `file`  | Absolute path of the changed file (relative paths are resolved against `cwd`) |
 
 Within a Codex turn, a repeated `(turn_id, name)` skill pair is written once, so a skill named
@@ -257,7 +282,7 @@ find ~/.claude/skill-audit -name '*.ndjson' -mtime +30 -delete
   session keeps running without them.
 - Confirm the plugin is installed: `claude plugin list`, `codex plugin list`, or check the
   `plugin` array in `~/.config/opencode/opencode.json`.
-- On Codex, hooks only run after you review and trust them — accept the prompt.
+- On Codex, hooks only run after you review and trust them, so accept the prompt.
 - Is `jq` installed? `logger.sh` exits silently without it, by design: the hook must never block a
   session. Check with `command -v jq`.
 
@@ -269,13 +294,13 @@ recently modified log, which is the wrong one when sessions run in parallel. Run
 and pass the ID: `skill-audit report <sid>`.
 
 **The CLI finds nothing but the logs exist.** Writer and viewer disagree about the directory. If
-you set `SKILL_AUDIT_DIR` for the host, export it for your shell too — otherwise the CLI looks in
+you set `SKILL_AUDIT_DIR` for the host, export it for your shell too. Otherwise the CLI looks in
 `~/.claude/skill-audit`.
 
-**`skill-audit: command not found`.** The symlink is missing or its directory is not on `PATH`;
-see [CLI on your PATH](#cli-on-your-path-recommended).
+**`skill-audit: command not found`.** The symlink is missing or its directory is not on `PATH`.
+See [CLI on your PATH](#cli-on-your-path-recommended).
 
-**A skill ran but is missing from the timeline.** Expected in some cases — see
+**A skill ran but is missing from the timeline.** Expected in some cases. See
 [Honest limitations](#honest-limitations).
 
 ## Honest limitations
@@ -283,19 +308,19 @@ see [CLI on your PATH](#cli-on-your-path-recommended).
 - **Invocation is not compliance.** The log proves that a skill was explicitly selected or exposed
   as a tool event, not that the result followed every instruction.
 - **Codex automatic skill loading is not a hook event today.** Explicit `$skill-name` references
-  are captured; skills that Codex chooses automatically are not. No transcript parsing is used to
+  are captured. Skills that Codex chooses automatically are not. No transcript parsing is used to
   fill that gap.
 - **Prompt-sourced entries are syntax-level evidence.** Codex supplies plain prompt text to the
   hook, so a lower-case dollar-prefixed token can be logged even if it does not resolve to an
   installed skill. The NDJSON `source: "prompt"` field distinguishes these entries.
-- **Only observable file tools are captured.** Claude `Edit`/`Write`/`NotebookEdit`, Codex
-  `apply_patch`, and opencode `edit`/`write`/`apply_patch` edits are logged. Files created
-  indirectly by shell commands are not visible as separate file events.
+- **Only observable file tools are captured.** Claude `Edit`/`Write`/`MultiEdit`/`NotebookEdit`,
+  Codex `apply_patch`, and opencode `edit`/`write`/`multiedit`/`apply_patch`/`patch` edits are
+  logged. Files created indirectly by shell commands are not visible as separate file events.
 - **opencode agents and subagents are not logged.** They have no equivalent on the other two
   hosts, so logging them would add an event kind only one host can emit. The audit keeps one data
   model across all three.
 - **Session-start injected skills** are context, not skill tool calls, and do not appear.
-- **Concurrent sessions:** the newest-log default can pick the wrong session; pass the session ID
+- **Concurrent sessions:** the newest-log default can pick the wrong session. Pass the session ID
   explicitly after using `skill-audit list`.
 
 ## Uninstall
@@ -312,7 +337,7 @@ Codex:
 codex plugin remove skill-audit@depickeresven-skill-audit
 ```
 
-opencode has no removal subcommand — delete the `"opencode-skill-audit"` entry from the `plugin`
+opencode has no removal subcommand. Delete the `"opencode-skill-audit"` entry from the `plugin`
 array in `~/.config/opencode/opencode.json` (or the project-local `opencode.json`), and remove the
 skill symlink if you made one:
 
@@ -327,17 +352,23 @@ rm -f ~/.local/bin/skill-audit
 rm -rf ~/.claude/skill-audit
 ```
 
-## Requirements
-
-- macOS or Linux
-- `bash` and `jq` for the CLI viewer and the Claude Code / Codex hooks
-- opencode `>= 1.14` for the plugin and its sidebar
-
 ## Development
 
 The hooks and the CLI viewer are plain bash (`scripts/`) with no build step. The opencode plugin
 and sidebar are TypeScript (`src/`) built with [Bun](https://bun.sh).
 
+| Path              | What                                                                       |
+|-------------------|----------------------------------------------------------------------------|
+| `scripts/`        | `logger.sh` hook target, the `skill-audit` CLI, `sync-versions.mjs`        |
+| `src/`            | opencode plugin (`index.ts`), sidebar (`tui.ts`), shared log and view code |
+| `test/`           | Bun tests, fixtures, and `test/format-contract.sh`                         |
+| `.claude-plugin/` | Claude Code plugin manifest and marketplace entry                          |
+| `.codex-plugin/`  | Codex plugin manifest                                                      |
+| `.agents/`        | Codex marketplace manifest                                                 |
+| `skills/`         | The `skill-audit` skill used by Codex and opencode                         |
+| `commands/`       | The `/skill-audit` slash command for Claude Code                           |
+| `.opencode/`      | Local opencode workspace for testing the plugin during development         |
+
 ```bash
 bun install
 bun run check     # format:check + lint + typecheck (src and test) + tests
@@ -355,12 +386,51 @@ bun run build     # dist/index.js (plugin) and dist/tui.js (sidebar)
 | `bun run sync:versions`  | Rewrite the plugin manifests from `package.json`         |
 
 Tests live in `test/`. `test/format-contract.sh` pins the rendered CLI output against fixtures, so
-a change to the timeline format has to be updated there deliberately — that output is the contract
+a change to the timeline format has to be updated there deliberately. That output is the contract
 the sidebar and any third-party viewer rely on.
 
-Version bumps go through `npm version`, which runs `scripts/sync-versions.mjs` and stages
-`.claude-plugin/plugin.json` and `.codex-plugin/plugin.json` alongside it. CI (`.github/workflows/ci.yml`)
-runs `bun run check` plus a manifest-version job on every push and pull request.
+### Releasing
+
+Two workflows, chained.
+
+`.github/workflows/ci.yml` runs four jobs: it checks that both plugin manifests carry the same
+version as `package.json`, runs `bun run check` on Bun 1.2.0 and on the latest Bun, builds the
+bundles, and packs the npm tarball to confirm it ships every entry point `package.json` exports.
+It runs on pull requests and on pushes to `main`, not on every branch, so a pull request is never
+tested twice.
+
+`.github/workflows/publish.yml` starts only when a CI run on `main` finishes successfully. It
+checks out that exact commit and asks npm whether the version in `package.json` already exists:
+
+- **Already on npm.** Nothing is released. This is what an ordinary push to `main` does.
+- **Not on npm.** It publishes with provenance over OIDC, tags the commit, and opens a GitHub
+  release with notes generated from the merged commits.
+
+So a version bump landing on `main` *is* the release, and it can only happen after CI has gone
+green on that commit.
+
+To cut one:
+
+```bash
+npm version patch --no-git-tag-version   # or minor / major
+git commit -am "chore: release $(node -p 'require("./package.json").version')"
+git push
+```
+
+`--no-git-tag-version` matters. The workflow creates the `v<version>` tag itself, and it aborts
+the release if that tag already exists while npm has never seen the version. The bump still runs
+`scripts/sync-versions.mjs` and stages `.claude-plugin/plugin.json` and `.codex-plugin/plugin.json`
+alongside it, keeping both manifests on the same version as `package.json`, which CI fails the
+build over if they ever drift.
+
+Use the publish workflow's manual trigger (`workflow_dispatch`) with *dry run* enabled to rehearse
+a publication without releasing anything.
+
+## Requirements
+
+- macOS or Linux
+- `bash` and `jq` for the CLI viewer and the Claude Code / Codex hooks
+- opencode `>= 1.14` for the plugin and its sidebar
 
 ## License
 

package/dist/index.js

@@ -9,6 +9,7 @@ function logDir() {
 function logPath(sessionID) {
   return join(logDir(), `${sessionID}.ndjson`);
 }
+var DEFAULT_IDLE_GAP_MS = 30 * 60000;
 function append(sessionID, event) {
   try {
     mkdirSync(logDir(), { recursive: true });

package/dist/log.d.ts

@@ -34,11 +34,23 @@ export type SkillRun = {
     ts: string;
     files: TimelineFile[];
 };
+/** How long a skill run may sit idle before it stops claiming later edits. */
+export declare const DEFAULT_IDLE_GAP_MS: number;
+/**
+ * The idle gap, in milliseconds. Without one a single skill invoked in the
+ * morning claims every edit made for the rest of the day.
+ */
+export declare function idleGapMs(): number;
 /**
  * Group a flat event list into skill runs, each carrying the files edited after
  * it. Port of the jq reduce in scripts/skill-audit; the two must agree.
+ *
+ * A run only claims edits that keep arriving: once `gapMs` passes with no
+ * activity, later files fall into a synthetic run instead. An unparseable
+ * timestamp compares as NaN, which never exceeds the gap, so logs written
+ * before this rule existed group exactly as they did before.
  */
-export declare function group(events: AuditEvent[]): SkillRun[];
+export declare function group(events: AuditEvent[], gapMs?: number): SkillRun[];
 export type Summary = {
     runs: number;
     distinct: number;

package/dist/tui.js

@@ -30,8 +30,17 @@ function parse(text) {
   return events;
 }
 var NO_SKILL = "(no skill active)";
-function group(events) {
+var DEFAULT_IDLE_GAP_MS = 30 * 60000;
+function idleGapMs() {
+  const minutes = Number(process.env.SKILL_AUDIT_IDLE_MINUTES);
+  return Number.isFinite(minutes) && minutes > 0 ? minutes * 60000 : DEFAULT_IDLE_GAP_MS;
+}
+function epoch(ts) {
+  return new Date(ts).getTime();
+}
+function group(events, gapMs = idleGapMs()) {
   const runs = [];
+  let lastActivity = NaN;
   for (const event of events) {
     if (event.kind === "skill") {
       runs.push({
@@ -39,9 +48,12 @@ function group(events) {
         ts: event.ts,
         files: []
       });
+      lastActivity = epoch(event.ts);
       continue;
     }
-    if (runs.length === 0) {
+    const current = runs[runs.length - 1];
+    const stale = epoch(event.ts) - lastActivity > gapMs;
+    if (!current || stale && current.skill !== NO_SKILL) {
       runs.push({
         skill: NO_SKILL,
         ts: event.ts,
@@ -53,6 +65,7 @@ function group(events) {
       tool: event.tool,
       path: event.path
     });
+    lastActivity = epoch(event.ts);
   }
   return runs;
 }
@@ -102,27 +115,76 @@ function readSession(sessionID) {
 
 // src/view.ts
 import { basename, relative } from "path";
+var TEXT_ICONS = {
+  run: "\xB7",
+  file: "\u270E",
+  warn: "!",
+  open: "\u25BC",
+  closed: "\u25B6"
+};
+var EMOJI_ICONS = {
+  run: "\u26A1",
+  file: "\u270E",
+  warn: "\u26A0",
+  open: "\u25BC",
+  closed: "\u25B6"
+};
+function icons() {
+  return process.env.SKILL_AUDIT_ICONS === "emoji" ? EMOJI_ICONS : TEXT_ICONS;
+}
+function pad(value) {
+  return String(value).padStart(2, "0");
+}
+function local(ts) {
+  const date = new Date(ts);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
 function hhmm(ts) {
-  return ts.slice(11, 16);
+  const date = local(ts);
+  return date ? `${pad(date.getHours())}:${pad(date.getMinutes())}` : "";
+}
+function hourKey(ts) {
+  const date = local(ts);
+  return date ? `${pad(date.getHours())}:00` : "";
 }
 function shortName(name) {
   const parts = name.split(":");
   return parts[parts.length - 1] || name;
 }
+function bucketByHour(files) {
+  const buckets = [];
+  for (const file of files) {
+    const day = file.ts.slice(0, 10);
+    const hour = hourKey(file.ts);
+    const last = buckets[buckets.length - 1];
+    if (!last || last.day !== day || last.hour !== hour) {
+      buckets.push({
+        day,
+        hour,
+        files: []
+      });
+    }
+    buckets[buckets.length - 1].files.push(file);
+  }
+  return buckets;
+}
 function headerLine(summary) {
-  const counts = `\u26A1${summary.runs} \u270E${summary.files}${summary.orphan > 0 ? ` \u26A0${summary.orphan}` : ""}`;
+  const icon = icons();
+  const counts = `${icon.run}${summary.runs} ${icon.file}${summary.files}${summary.orphan > 0 ? ` ${icon.warn}${summary.orphan}` : ""}`;
   return `Skill audit  ${counts}`;
 }
 function runTitle(run, collapsed) {
-  const time = hhmm(run.ts);
-  if (run.skill === NO_SKILL) {
-    return `\u26A0 ${time} no skill`;
-  }
-  const name = shortName(run.skill);
+  const icon = icons();
+  const name = run.skill === NO_SKILL ? `${icon.warn} no skill` : shortName(run.skill);
   if (run.files.length === 0) {
-    return `  ${time} ${name}`;
+    return `  ${name}`;
   }
-  return collapsed ? `\u25B6 ${time} ${name} (${run.files.length})` : `\u25BC ${time} ${name}`;
+  return collapsed ? `${icon.closed} ${name} (${run.files.length})` : `${icon.open} ${name}`;
+}
+function hourTitle(bucket, collapsed) {
+  const icon = icons();
+  const marker = collapsed ? icon.closed : icon.open;
+  return `${marker} ${bucket.hour} (${bucket.files.length})`;
 }
 function displayPath(path, cwd, width) {
   const rel = cwd && path.startsWith(`${cwd}/`) ? relative(cwd, path) : path;
@@ -135,9 +197,17 @@ function displayPath(path, cwd, width) {
   }
   return `${base.slice(0, Math.max(0, width - 1))}\u2026`;
 }
-var FILE_INDENT = "     \u270E ";
+var HOUR_INDENT = "  ";
+var FILE_INDENT = "    ";
+function runKey(index) {
+  return `run:${index}`;
+}
+function hourKeyOf(index, bucket) {
+  return `${runKey(index)}/hour:${bucket.day} ${bucket.hour}`;
+}
 function sidebarLines(view, options) {
-  const marker = options.sectionOpen ? "\u25BC" : "\u25B6";
+  const icon = icons();
+  const marker = options.sectionOpen ? icon.open : icon.closed;
   const lines = [
     {
       text: `${marker} ${headerLine(view.summary)}`,
@@ -155,20 +225,35 @@ function sidebarLines(view, options) {
     return lines;
   }
   view.runs.forEach((run, index) => {
-    const collapsed = options.collapsed.has(index);
+    const key = runKey(index);
+    const runCollapsed = options.collapsed.has(key);
     lines.push({
-      text: runTitle(run, collapsed),
+      text: runTitle(run, runCollapsed),
       tone: run.skill === NO_SKILL ? "warning" : "accent",
-      runIndex: index
+      key
     });
-    if (collapsed) {
+    if (runCollapsed) {
       return;
     }
-    for (const file of run.files) {
+    for (const bucket of bucketByHour(run.files)) {
+      const bucketKey = hourKeyOf(index, bucket);
+      const hourCollapsed = options.collapsed.has(bucketKey);
       lines.push({
-        text: `${FILE_INDENT}${displayPath(file.path, view.cwd, options.width - FILE_INDENT.length)}`,
-        tone: "muted"
+        text: `${HOUR_INDENT}${hourTitle(bucket, hourCollapsed)}`,
+        tone: "text",
+        key: bucketKey
       });
+      if (hourCollapsed) {
+        continue;
+      }
+      for (const file of bucket.files) {
+        const stamp = `${hhmm(file.ts)} ${icon.file} `;
+        const room = options.width - FILE_INDENT.length - stamp.length;
+        lines.push({
+          text: `${FILE_INDENT}${stamp}${displayPath(file.path, view.cwd, room)}`,
+          tone: "muted"
+        });
+      }
     }
   });
   return lines;
@@ -252,10 +337,10 @@ function toneColor(theme, tone) {
   }
   return theme.text;
 }
-function toggle(set, index) {
+function toggle(set, key) {
   const next = new Set(set);
-  if (!next.delete(index)) {
-    next.add(index);
+  if (!next.delete(key)) {
+    next.add(key);
   }
   return next;
 }
@@ -276,8 +361,8 @@ function Section(api, sessionID, width) {
     const onMouseDown = index === 0 ? () => {
       setSectionOpen((open) => !open);
       redraw();
-    } : line.runIndex !== undefined ? () => {
-      setCollapsed((current) => toggle(current, line.runIndex));
+    } : line.key !== undefined ? () => {
+      setCollapsed((current) => toggle(current, line.key));
       redraw();
     } : undefined;
     return element("text", {

package/dist/view.d.ts

@@ -1,28 +1,55 @@
-import { type SessionView, type SkillRun, type Summary } from "./log";
+import { type SessionView, type SkillRun, type Summary, type TimelineFile } from "./log";
+export type IconSet = {
+    run: string;
+    file: string;
+    warn: string;
+    open: string;
+    closed: string;
+};
+export declare function icons(): IconSet;
 export declare function hhmm(ts: string): string;
+/** The local hour a timestamp belongs to, as a bucket label. */
+export declare function hourKey(ts: string): string;
 /** `superpowers:brainstorming` -> `brainstorming`, the way the statusline snippet does. */
 export declare function shortName(name: string): string;
+/** `day` is carried so a run spanning midnight gets one bucket per calendar hour. */
+export type HourBucket = {
+    day: string;
+    hour: string;
+    files: TimelineFile[];
+};
+/**
+ * Split a run's files into consecutive local-hour buckets. Consecutive rather
+ * than keyed, so the same hour on the next day opens a second bucket instead of
+ * folding a day's gap into one row.
+ */
+export declare function bucketByHour(files: TimelineFile[]): HourBucket[];
 export declare function headerLine(summary: Summary): string;
+/** The skill name leads the row; its times live on the hour buckets below it. */
 export declare function runTitle(run: SkillRun, collapsed: boolean): string;
+export declare function hourTitle(bucket: HourBucket, collapsed: boolean): string;
 /**
  * Fit a path into the sidebar: relative to the session directory, then the
  * basename, then a truncated basename.
  */
 export declare function displayPath(path: string, cwd: string, width: number): string;
 export type Tone = "text" | "muted" | "accent" | "warning";
+/** `key` marks a collapsible node; the sidebar toggles whatever key it carries. */
 export type Line = {
     text: string;
     tone: Tone;
-    runIndex?: number;
+    key?: string;
 };
 export type SidebarOptions = {
     /** Whether the whole section is expanded. */
     sectionOpen: boolean;
-    /** Indices of runs whose files are hidden. */
-    collapsed: Set<number>;
+    /** Keys of runs and hour buckets whose children are hidden. */
+    collapsed: Set<string>;
     /** Usable sidebar width, in columns. */
     width: number;
 };
+export declare function runKey(index: number): string;
+export declare function hourKeyOf(index: number, bucket: HourBucket): string;
 /**
  * The entire sidebar section as plain lines. Keeping layout here rather than in
  * the OpenTUI glue means it can be tested without a terminal.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skill-audit",
-  "version": "0.1.0",
+  "version": "0.1.1-dev.pr2.34397019140",
   "description": "Audit trail of skill invocations and file changes, with a live timeline in the opencode sidebar",
   "type": "module",
   "license": "MIT",
@@ -47,10 +47,10 @@
     "build:index": "bun build src/index.ts --outfile dist/index.js --target bun --format esm --external @opencode-ai/plugin --external @opencode-ai/sdk",
     "build:tui": "bun build src/tui.ts --outfile dist/tui.js --target bun --format esm --external @opencode-ai/plugin --external @opencode-ai/sdk --external @opentui/core --external @opentui/solid --external solid-js",
     "build": "bun run clean && bun run build:types && bun run build:index && bun run build:tui",
-    "test": "bun test && ./test/format-contract.sh",
+    "test": "TZ=UTC bun test && TZ=UTC ./test/format-contract.sh",
     "typecheck": "tsc --noEmit",
     "typecheck:test": "tsc -p tsconfig.test.json",
-    "check": "bun run format:check && bun run lint && bun run typecheck && bun run typecheck:test && bun test && ./test/format-contract.sh",
+    "check": "bun run format:check && bun run lint && bun run typecheck && bun run typecheck:test && TZ=UTC bun test && TZ=UTC ./test/format-contract.sh",
     "check:versions": "node scripts/sync-versions.mjs --check",
     "sync:versions": "node scripts/sync-versions.mjs",
     "version": "node scripts/sync-versions.mjs && git add .claude-plugin/plugin.json .codex-plugin/plugin.json",