the scan catches surface stuff. funnier signal would be tracking when the agent reads the same file 3 times in a row, or deletes what it just wrote. you can hear the frustration in the access pattern.
Just track tool calls. Even diff logs would clue in. Tie in git? Why not? This is a great angle and idea, watching an agent modify the same text document over and over is already frustrating, having an audio to alert me a console is stuck is great. Likely annoying after a time, but hilarious right now.