anomaly-alertlisted

# Anomaly Alert Detect anomalous sessions in Claude Code Agent Monitor data. ## Input The user provides: **$ARGUMENTS** This may be: - "all" or empty (default: check all anomaly types) - "cost" for cost anomalies only - "duration" for duration anomalies only - "errors" for error rate anomalies only - A sensitivity level: "strict" (1σ), "normal" (2σ), "relaxed" (3σ) ## Procedure 1. **Fetch baseline data** from `http://localhost:4820`: - `GET /api/sessions?limit=500` — historical sessions for baseline - `GET /api/analytics` — aggregated metrics - `GET /api/pricing/cost` — cost data per session 2. **Compute baselines** for each metric: - Mean, median, standard deviation - P25, P75, P90, P95, P99 percentiles - Interquartile range (IQR) for robust outlier detection 3. **Detect anomalies** using statistical thresholds: ### Cost Anomalies - Sessions costing >2σ above mean - Single sessions exceeding daily average - Sudden cost spikes (session-over-session increase >200%) ### Duration Anomalies - Sessions lasting >2σ above mean duration - Extremely short sessions (<1 minute) that still incur cost - Sessions with unusual active-vs-idle ratios ### Error Rate Anomalies - Sessions with error rates >2σ above baseline - New error types not seen in previous sessions - Sessions with >3 consecutive tool failures ### Behavioral Anomalies - Unusual tool combinations not seen before - Sessions with abnormally high compact