error-scan

# Error Scan

Sweep recent events across sessions for error and failure signals, then rank them
by how often they occur and which tool or model produced them.

## Input

The user provides: **$ARGUMENTS**

This may be:
- empty or "all" — scan every failure signal (default)
- "api" — APIError events only
- "tools" — tool-failure gaps only
- a number N — limit the scan to the most recent N sessions
- a session ID — scan a single session

## Data Sources

| Endpoint | Returns |
|----------|---------|
| `GET /api/analytics` | `event_types` (counts per type incl. PreToolUse, PostToolUse, APIError), `tool_usage` (top 20), `daily_events` (365d) — fleet-wide failure baseline |
| `GET /api/events?session_id=X` | Per-session event stream: `event_type`, `tool_name`, `summary`, `data`, `timestamp` — locate `APIError` and unmatched `PreToolUse` |
| `GET /api/sessions?limit=N` | Sessions with `id`, `status`, `model`, `started_at` — pick the recent window and attribute failures to a model |

## Report Sections

### 1. Scope
Resolve `$ARGUMENTS` to a session set: pull `GET /api/sessions?limit=N` (default 50, ordered by `started_at`). Report how many sessions and what time span are covered.

### 2. Fleet Failure Counts
From `GET /api/analytics` `event_types`, report total `APIError` count and the PreToolUse→PostToolUse gap: `gap = PreToolUse − PostToolUse` (unmatched tool starts = likely failures). State both as raw counts and as a share of `total_events`.

### 3. Group by Tool
For each session in scope, pull `GET /api/events?session_id=X`. Match each `PreToolUse` to its following `PostToolUse` by `tool_name`; unmatched starts are failures. Aggregate failures and `APIError` events per `tool_name`. Rank tools by failure frequency (descending).

### 4. Group by Model
Join failures to the owning session's `model` (from `GET /api/sessions`). Rank models by APIError count and tool-failure count.

### 5. Top Offenders
List the single most failure-prone tool, the most error-prone model, and the session with the most failures, each with its exact count and one-line `summary` excerpt from a representative event.

## Output

- A ranked Markdown table: tool/model | APIError count | tool-failure (gap) count | total failures | share of events.
- Rates as percentages to 2 decimals.
- Cite exact `event_type`, `tool_name`, and `session_id` values — never fabricate counts.
- End with the one failure pattern most worth investigating and a concrete next step.
- Read-only: only report what the API returns. If `curl` cannot reach `http://localhost:4820`, tell the user to start the dashboard with `npm start` from the repo root.