/timeline

description: Chronological engagement timeline — all events merged by time
allowed-tools: Bash, Read, Glob
argument-hint: [--last N]

Engagement Timeline

Build a chronological view of the entire engagement by merging all event sources.

The user's argument: `$ARGUMENTS`

Gather Events

Read these data sources:

1. Findings

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" list

Each finding has a `first_seen` date. Parse the output or read `findings-db.jsonl` directly for timestamps.

2. Techniques

node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" list

Each technique has a `timestamp` field. Parse the output or read `techniques-db.jsonl` directly.

3. Session State

node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show

Extract decisions (have timestamps), blockers, notes, phase completions, and agent history.

Merge & Sort

Combine all events into a single timeline. Each event gets:

• **Timestamp** (ISO or date)
• **Type icon**: `[F]` finding, `[T]` technique, `[D]` decision, `[B]` blocker, `[N]` note, `[A]` agent, `[P]` phase
• **Description**: One-line summary

Sort by timestamp, most recent first (reverse-chrono).

If `--last N` is specified, show only the last N events.

Format Output

Group by date, reverse-chrono:

=== 2025-01-15 ===
  14:32  [F] CRITICAL — SQL Injection in /api/users (f-012)
  14:30  [T] sqlmap on target.com → success
  13:15  [D] Pivoted to database testing after SQLi discovery
  12:00  [T] nuclei on target.com → partial
  11:45  [P] Phase 2 completed — 4 findings

=== 2025-01-14 ===
  16:20  [F] HIGH — IDOR in /api/payments (f-008)
  15:00  [B] Rate limit detected on /api/auth
  14:00  [T] dalfox on target.com → clean
  10:30  [N] Started API testing campaign

Keep it concise. One line per event. No raw data dumps.