nntrivi2001
17d56d0e01
Clean break, no compatibility alias. Renames the product name, the CLI binary (`ccam` -> `agenthub`), the env var prefix (`CCAM_` -> `AGENTHUB_`), the Prometheus metric namespace (`ccam_*` -> `agenthub_*`), the tmux session prefix (`ccam-lane-<id>` -> `agenthub-lane-<id>`), the per-repo runtime profile directory (`.ccam/profile` -> `.agenthub/profile`), the lanes state root (`~/.claude/ccam-lanes` -> `~/.claude/agenthub-lanes`), the bundled plugins (`plugins/ccam*` -> `plugins/agenthub*`) and their slash commands (`/ccam-doctor` -> `/agenthub-doctor`, `/ccam:*` -> `/agenthub:*`). Because there is no alias, an existing install has to be updated by hand: rename its `.ccam/profile` directory and any `CCAM_*` variables, and reinstall the plugin under its new name. Two other name families are deliberately left alone here, since they are not just strings: the `Claude-Code-Monitor` repository/marketplace name, and the `agent-dashboard` npm package plus its `~/.claude/agent-dashboard` runtime directory, which holds the live database and needs a migration rather than a rename. Verified: server 1406/1406, client 459/459, `grep -i ccam` clean across tracked files, `openapi.yaml` regenerated (95 paths, unchanged count).
89 lines
3.1 KiB
Markdown
89 lines
3.1 KiB
Markdown
---
|
||
description: >
|
||
Identify anomalous sessions using Agent Monitor data — cost outliers from
|
||
the pricing engine, token anomalies (cache miss spikes, compaction baseline
|
||
surges), unusual event type ratios (PreToolUse/PostToolUse gaps, APIError
|
||
clusters), behavioral deviations from workflow intelligence (complexity
|
||
score outliers, error propagation anomalies), and sessions with abnormal
|
||
metadata (extreme turn_count, high thinking_blocks, zero turn_duration).
|
||
---
|
||
|
||
# Anomaly Alert
|
||
|
||
Detect anomalous sessions in AgentHub data.
|
||
|
||
## Input
|
||
|
||
The user provides: **$ARGUMENTS**
|
||
|
||
This may be:
|
||
- "all" or empty (default: check all anomaly types)
|
||
- "cost" for cost anomalies only
|
||
- "duration" for duration anomalies only
|
||
- "errors" for error rate anomalies only
|
||
- A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ)
|
||
|
||
## Procedure
|
||
|
||
1. **Fetch baseline data** from `http://localhost:4820`:
|
||
- `GET /api/sessions?limit=500` — historical sessions for baseline
|
||
- `GET /api/analytics` — aggregated metrics
|
||
- `GET /api/pricing/cost` — cost data per session
|
||
|
||
2. **Compute baselines** for each metric:
|
||
- Mean, median, standard deviation
|
||
- P25, P75, P90, P95, P99 percentiles
|
||
- Interquartile range (IQR) for robust outlier detection
|
||
|
||
3. **Detect anomalies** using statistical thresholds:
|
||
|
||
### Cost Anomalies
|
||
- Sessions costing >2σ above mean
|
||
- Single sessions exceeding daily average
|
||
- Sudden cost spikes (session-over-session increase >200%)
|
||
|
||
### Duration Anomalies
|
||
- Sessions lasting >2σ above mean duration
|
||
- Extremely short sessions (<1 minute) that still incur cost
|
||
- Sessions with unusual active-vs-idle ratios
|
||
|
||
### Error Rate Anomalies
|
||
- Sessions with error rates >2σ above baseline
|
||
- New error types not seen in previous sessions
|
||
- Sessions with >3 consecutive tool failures
|
||
|
||
### Behavioral Anomalies
|
||
- Unusual tool combinations not seen before
|
||
- Sessions with abnormally high compaction counts
|
||
- Model switches mid-session (if unexpected)
|
||
- Sessions with no tool usage (pure conversation)
|
||
|
||
### Token Anomalies
|
||
- Input/output token ratio far from historical norm
|
||
- Cache miss rate significantly higher than average
|
||
- Token usage growing faster than session count
|
||
|
||
4. **Classify each anomaly**:
|
||
- **🔴 Critical**: Likely indicates a real problem requiring attention
|
||
- **🟡 Warning**: Unusual but may be expected for certain tasks
|
||
- **🔵 Info**: Interesting deviation worth noting
|
||
|
||
## Output Format
|
||
|
||
Present as an **Anomaly Report**:
|
||
|
||
```
|
||
═══════════════════════════════════════════════
|
||
ANOMALY DETECTION REPORT
|
||
Analyzed: N sessions | Baseline: last 30 days
|
||
Anomalies found: N (🔴 N critical, 🟡 N warn, 🔵 N info)
|
||
═══════════════════════════════════════════════
|
||
```
|
||
|
||
For each anomaly:
|
||
- Session ID and timestamp
|
||
- Anomaly type and severity
|
||
- Observed value vs expected range
|
||
- Possible explanation
|
||
- Recommended action (if any)
|