USE THE AUDIT TIMELINE

Prerequisites: Swamp installed, a repository with the audit hook enabled. If swamp audit reports no data, run swamp repo init --force to enable the audit hook.

View the default timeline

The audit timeline shows Swamp commands from the last 24 hours:

swamp audit

The output groups commands by session and shows timestamps, commands, and whether they were run through Swamp or directly.

Change the time window

To narrow the window to the last 4 hours:

swamp audit --hours 4

Include all commands

By default, noise commands like ls and cat are filtered out. To see everything:

swamp audit --all

Filter by session

If you know the session ID you want to inspect:

swamp audit --session <session-id>

Check audit hook health

To verify the audit hook is installed and working:

swamp doctor audit

✓ binary-on-path  swamp is on PATH at /Users/you/.local/bin/swamp
✓ agent-config-loadable  .claude/settings.local.json is present with both PostToolUse hooks wired
✓ recording-smoke-test  synthetic payload landed in today's audit JSONL

4 passed, 0 failed, 1 skipped — OVERALL: PASS

If any check fails, swamp doctor audit describes what to fix.