Module logs 

Log pattern analysis — the executor behind brain logs analyze and the logs.analyze native capability.

Two-stage, truthful-by-construction:

1. Deterministic pattern pass (always runs, works offline). Recent log lines are read from one of two sources, each line is classified by level and normalised into a signature — volatile tokens (timestamps, UUIDs, hex, paths, numbers) are collapsed to placeholders — and identical signatures are counted. The result is a digest: per-level totals plus the top recurring patterns with their counts. This is the core; it never invents anything, it only counts what is there. analyze returns this digest, and it is the entire logs.analyze capability — narration is the reasoner’s job, not the capability’s.

2. Optional LLM narration (narrate, used by the CLI). The deterministic digest — not the raw log — is handed to the LLM, which renders a short plain-language summary. Because it only ever sees the digest, it cannot fabricate log lines or causes.

Sources: LogSource::Brain (default) reads the daemon’s own rotated logs in ~/.brain/logs/; LogSource::System reads OS logs (log show on macOS, sandboxed journalctl on Linux).

Both the daemon’s pretty format (2026-… INFO target: msg) and its JSON format (logging.format: json) are parsed: a JSON line’s timestamp, level, and fields.message are read directly; otherwise the leading RFC3339 token + level keyword are used.

Structs

LogAnalysis

The cortex::actions::LogAnalysisBackend implementation. Holds a snapshot of the config taken at boot and runs the deterministic analyze on each dispatch, returning the digest. The chat tool-loop dispatches logs.analyze through this; the CLI calls analyze/narrate directly.

Enums

LogSource

Where to read logs from. A plain enum (no clap derive) so the backends crate stays free of the CLI’s arg-parsing dependency; the CLI maps its own --source value onto this.

Functions

analyze

Analyse recent logs into the deterministic digest. Reads from source, applies the since window, caps at lines, groups by normalised signature, and renders the per-level totals + top recurring patterns. No LLM, no network — this is the whole logs.analyze capability.

capabilities

The capability this backend declares: read-only log pattern analysis. Always wired — it reads the daemon’s own (or the OS) log offline.

narrate

Narrate a rendered digest in plain language. The prompt is strictly grounded: the model is told to summarise only what the digest contains and never to invent log lines or causes. Returns an error (not a panic) when no provider is reachable, so the caller can degrade to the digest alone.