Hook Failure Audit

---
name: hook-failure-audit
description: >
  Audit hook delivery health from Agent Monitor data — balance PreToolUse vs
  PostToolUse (a gap means tools that started but never reported back), detect
  missing Stop/SubagentStop terminators (sessions/subagents that never closed),
  and check for stale ingestion (no recent events). Use when hooks look
  unreliable or events seem to be dropping.
---

# Hook Failure Audit

Assess whether the hook pipeline is delivering events reliably, using the event
counts and stream the dashboard already has. This is about *delivery* health
(missing/dropped events), not about why a model errored.

## Input

The user provides: **$ARGUMENTS**

This may be:
- empty or "all" — run every check (default)
- "balance" — PreToolUse/PostToolUse balance only
- "terminators" — missing Stop/SubagentStop only
- "freshness" — stale-ingestion check only

## Data Sources

| Endpoint | Returns |
|----------|---------|
| `GET /api/analytics` | `event_types` (counts per type: PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd), `daily_events` (365d), `total_subagents`, `sessions_by_status` — fleet-wide delivery balance |
| `GET /api/stats` | `total_sessions`, `total_agents`, `total_events`, `events_today` — expected terminator counts and recency |
| `GET /api/events?session_id=X` | Per-session stream — confirm which sessions are missing a `PostToolUse`, `Stop`, or `SubagentStop` |

## Report Sections

### 1. PreToolUse / PostToolUse Balance
From `GET /api/analytics` `event_types`: `gap = PreToolUse − PostToolUse`. A positive gap means tools whose completion hook never arrived. Report the gap as a count and as a percentage of `PreToolUse`. A healthy pipeline keeps this near 0%.

### 2. Missing Terminators
Compare `Stop` count against completed sessions (`sessions_by_status`) and `SubagentStop` against `total_subagents`/`total_agents` (from `/api/stats`). A shortfall means sessions or subagents that ran but never emitted a closing hook — likely dropped delivery or a crashed handler. Report expected vs observed for each.

### 3. Stale Ingestion
Check `events_today` from `/api/stats` and the tail of `daily_events` from analytics. If recent days are empty while sessions exist, ingestion has stalled. Report the most recent day with events and how long ago that was.

### 4. Localize
For the sessions with the largest gaps or missing terminators, pull `GET /api/events?session_id=X` and confirm which specific hook types are absent. List the offending session IDs.

## Output

- A check-by-check report with a PASS / WARN / FAIL marker each (✅ / ⚠️ / ❌) and the expected-vs-observed numbers.
- Rates as percentages to 2 decimals.
- Cite exact `event_type` counts and `session_id` values — never fabricate.
- End with an overall verdict (e.g., "4/4 checks passed" or "hook delivery DEGRADED") and the single highest-impact remediation (e.g., reinstall hooks via the dashboard Settings, or restart the server with `npm start`).
- Read-only: only report what the API returns. If `curl` cannot reach `http://localhost:4820`, tell the user to start the dashboard with `npm start` from the repo root.