Zero-friction time tracking and guard rails for AI coding sessions

Problem

Developers working with an AI coding assistant move between many tasks in short bursts and across parallel sessions, so manual timesheets were inaccurate and often forgotten. Naive automatic tracking would either count idle time or store sensitive prompt text. Separately, an autonomous assistant could run risky commands: reading secrets from the wrong place, attributing commits to a machine, or changing other people's tasks.

Goal

Record engaged time per task automatically from assistant activity and post it to the task tracker, with no manual step, no idle time counted, no prompt content stored and no duplicate entries across parallel sessions. Put declarative guard rails around what the assistant may do, and make the whole setup easy to restore on a new machine.

My role

Sole author. I designed the work-block algorithm and wrote the hooks, the tracker integration and background logger, the guard-rail rules, the cross-model review commands and the bootstrap scripts.

Solution

Hooks in the AI coding assistant record lightweight activity heartbeats. A detached background worker turns them into work blocks and one time entry per task. Declarative rules block or warn on risky actions, and snapshot and restore scripts rebuild the environment on a new machine.

How it works

On every prompt and tool call, a hook records a timestamp and any task references it finds in the prompt or shell command by pattern matching. The prompt text itself is never stored.

State lives in a per-session JSON file written under an exclusive file lock with a union merge, so parallel sessions and hooks never overwrite each other, and session ids are validated against path traversal.

At the end of a turn, or when a task is completed or commented on, the hook starts a detached logger so the assistant is never slowed down.

The logger sorts the heartbeats and splits them into work blocks wherever the gap exceeds an idle threshold. A block lasts its span plus a short tail allowance, and a lone event counts as a minimal block.

Each block's time is shared among the tasks referenced in it, in proportion to their activity. Activity with no task counts toward the total but is not logged, so time is never inflated.

The logger creates one time entry per task, or updates the entry it already created for that session, under a per-session lock, so repeated stops never double-count. Every post goes to an audit log, errors to a separate log, and old session files are cleaned up.

Guard-rail rules match on commands and prompts and either block or warn: reading secrets from the wrong project, taking secrets from environment variables, machine attribution in commit messages, reassigning or closing other people's tasks, and more.

Snapshot and restore scripts copy assistant, editor, git and shell configuration, backing up anything they overwrite.

Technical challenges

Measuring engaged time from event-level activity that arrives in short bursts, without counting idle gaps.

Fair attribution when one stretch of work touches several tasks.

Posting each entry exactly once across many stops: update, never duplicate.

Several hooks writing one state file safely.

Keeping hooks non-blocking by moving network work to a detached process.

Extracting task references without keeping any prompt content.

Supporting several secret sources.

Capabilities

• Automatic task detection from activity
• Idle-aware work blocks
• Proportional time splitting across tasks
• One time entry per task, updated in place
• Automatic flush on task completion or comment
• Audit and error logs
• Declarative block and warn rules for agent commands
• Cross-model code review commands
• A CI template for AI pull-request review
• One-command environment snapshot and restore

Technology

• Python standard library plus requests
• POSIX file locks
• AI coding assistant lifecycle hooks and slash commands
• Project-management REST API
• Credentials from the environment or a file
• Cloud secret manager
• JSON state files
• Bash
• CI workflow template

Impact

Timesheets filled themselves from real activity, with consistent, auditable per-task entries and no prompt text stored, and a set of recurring agent mistakes was stopped by rule instead of being caught in review. No metrics are claimed.

Skills demonstrated

• Algorithm design
• Grouping time-series activity into blocks
• Concurrency-safe state management
• API integration with idempotent writes
• Developer tooling and hooks for AI assistants
• Privacy-conscious telemetry
• Guard-rail policy design
• Environment automation