Tool Call Extract

Leading word: the calls dump — one paired record per matching call (call_entry → result_entry, full args, result text, is_error). The compact map of a multi-MB session log's tool usage; build it once, the diagnose skill's axis sub-agents read the dump plus the trace index, never the raw jsonl.

Two modes:

1. Search — across all sessions: <tool-name> + optional --args-contains + optional --errors-only. Per match: counts, sample error texts, whether the last call still failed.
2. Dump — one session file: the paired records above, args clipped to 4000 chars by default (--full-args for the whole thing).

Doc-consumption audits ("这个文档有没有被 agent 真的在用") moved to the doc-consumption skill; its session-format primer below is shared.

Process

1. Resolve inputs

Tool name as it appears in tool definitions (bash, subagent, edit, ...). A user symptom like "glab api 经常失败" resolves to bash --args-contains 'glab api'; "subagent workflowScript 挂了" resolves to subagent --errors-only (optionally narrowed with --args-contains workflowScript). Neither tool name nor session given → ask; do not guess.

2. Search