analyze-logs

<!-- 🔒 LOCKED — managed by clade · auto-generated by sync-to-codex; edit source in .claude/ then re-run sync --> # Analyze application logs Read and analyze structured wide-event logs from the local `.evlog/logs/` directory to debug errors, investigate performance issues, and understand application behavior. ## When to Use - User asks to debug an error, investigate a bug, or understand why something failed - User asks about request patterns, slow endpoints, or error rates - User asks "what happened" or "what's going on" with their application - User asks to analyze logs, check recent errors, or review application behavior - User mentions a specific error message or status code they're seeing ## Finding the logs Logs are written by evlog's file system drain as `.jsonl` files, organized by date. **Format detection**: The drain supports two modes: - **NDJSON** (default, `pretty: false`): One compact JSON object per line. Parse line-by-line. - **Pretty** (`pretty: true`): Multi-line indented JSON per event. Parse by reading the entire file and splitting on top-level objects (e.g. `JSON.parse('[' + content.replace(/\}\n\{/g, '},{') + ']')`) or use a streaming JSON parser. Always check the first few bytes of the file to detect the format: if the second character is a newline or `"`, it's NDJSON; if it's a space or newline followed by spaces, it's pretty-printed. **Search order** — check these locations relative to the project root: 1. `.evlog/logs/` (default) 2. Any `.ev...