Local-first analytics for your OpenCode sessions

• Local-first

  Default bind is loopback. The app opens no outbound socket and ships no telemetry. Your session history never leaves the machine that produced it.

  OPENCODEVIEW_HOST=127.0.0.1

• Read-only source

  The OpenCode database is opened read-only at the engine level and pinned with a query_only pragma. OpencodeView structurally cannot write to it.

  readonly: true · PRAGMA query_only = 1

• Separate cache

  Every derived metric lands in its own SQLite file. The cache path is checked so it can never be the same file, symlink or hardlink as the source.

  .cache/analytics.sqlite

• Redact before leave

  Transcript and live payloads pass through server-side redaction before JSON leaves the process: secret-like keys, bearer tokens, provider prefixes, URL userinfo and absolute home paths.

  sk-… ghp-… → [REDACTED]

• Fail closed

  Binding beyond loopback without an auth token is not a warning — the server refuses to start. Exposure is always a deliberate operator decision.

  no token + public bind → exit

01Overview02Live03Consumption04Efficiency05Orchestration06Quality07Tools

Where the budget actually went

Global and per-project rollups: total tokens, session counts, active time, tool calls and flagged sessions. Token volume by project is clickable — every bar is a drill-down into that project's session table.

• Project rollups with tokens, sessions, active time and patch precision
• Flag distribution across the whole corpus, ranked by count
• Per-project drill-down into a sortable session table
• Subagent counts surfaced next to primary sessions

API

• /api/global
• /api/projects
• /api/projects/:id

Synthetic documentation previews — not live user data.

• Tool failure loop

  tool_failure_loop
  Rule tool_calls ≥ 20 and error rate > 30%

  The agent kept calling tools that kept failing. Usually a broken assumption about the environment.

• Patch waste

  patch_waste
  Rule patch_count > 50, apply_patch_ok = 0, summary_additions = 0

  Fifty-plus patch attempts, nothing applied, nothing added. Pure burn.

• Context pressure

  context_pressure
  Rule compaction_count > 15

  The session spent more effort compacting context than moving forward.

• Truncation

  truncation
  Rule at least one message with finish = length

  Output hit the token ceiling. Whatever came next was never written.

• Metadata bug

  omo_metadata_bug
  Rule session title starts with the literal 'undefined'

  A harness-side metadata defect leaked into the stored title.

• Security anomaly

  security_anomaly
  Rule title matches local injection-like string heuristics

  Worth a human look. String matching only — no model, no network.

• Low yield, high cost

  low_yield_high_cost
  Rule > 1M tokens, no additions, no successful apply_patch

  A million tokens spent with nothing landing in the diff.

• Data quality gap

  data_quality_gap
  Rule session month falls in a known low-coverage window

  Not a session problem — a dataset problem. Flagged so it is never read as a real zero.

• OpenCode

  Required

  The agent runtime and the session store

  OpenCode owns the agent runtime and the on-disk database that OpencodeView reads. Schema evolution belongs to them, so the SQLite adapter here is best-effort and may lag upstream migrations. When source data looks wrong, that is where it should be investigated — flags on this side are local operator heuristics, not statements about OpenCode.

  opencode.ai ↗ anomalyco/opencode ↗

• oh-my-openagent

  Optional

  Optional harness that enriches the Live lens

  An agent harness for OpenCode, also known as omo. When its activity log is readable, the server overlays per-session poll telemetry onto the Live lens: the suspect health state, and terminal events such as poll_timeout, max_turns, aborted_by_user and terminal_error. The omo_metadata_bug flag also originates here. Everything else works without it.

  code-yeongyu/oh-my-openagent ↗ omo.dev ↗

Both are third-party projects. OpencodeView is not affiliated with, endorsed by, or maintained by either.

• Bind

  Defaults to 127.0.0.1, with localhost and ::1 accepted. Host and Origin guards apply on loopback.

• Auth

  Any non-loopback host requires OPENCODEVIEW_AUTH_TOKEN. Without it the process exits instead of starting unprotected.

• Redaction

  Secret-like keys, bearer tokens, common provider prefixes, URL userinfo and absolute home paths are replaced before serialization.

• Caching

  API responses are sent with Cache-Control: no-store. Nothing analytical lands in an intermediary.

• Telemetry

  There is none. The runtime opens no outbound product analytics connection of any kind.

• Supply chain

  Gitleaks runs as a mandatory gate in bun run check, alongside tests, typecheck, lint, build and dependency audit.

Exposing past loopback is an operator choice. Review the redaction rules against your own data before you make it.

1. 01

   Clone and install

   The web workspace installs separately — it is a distinct Vite app.

   Copy

   git clone https://github.com/4i3n6/opencodeview.git
   cd opencodeview
   bun install
   cd web && bun install && cd ..

2. 02

   Materialize the cache

   Reads the source read-only and writes rollups into its own SQLite file. Point OPENCODE_DB elsewhere if your install is non-standard.

   Copy

   bun src/scan.ts --all
   
   # or a single project
   bun src/scan.ts --list
   bun src/scan.ts <project>

3. 03

   Serve the dashboard

   API and UI run as two processes, both bound to loopback.

   Copy

   bun run serve   # http://127.0.0.1:4317
   bun run web     # http://127.0.0.1:5273