logtriage 0.1.0__tar.gz

logtriage-0.1.0/PKG-INFO

@@ -0,0 +1,51 @@
+Metadata-Version: 2.4
+Name: logtriage
+Version: 0.1.0
+Summary: Cluster big logs into templates with counts, severities and incident spikes — streaming, stdlib only
+Author: juzorei
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/juzorei/loglens
+Keywords: logs,observability,triage,cli,agent-skills
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: System :: Logging
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# loglens
+
+Cluster big logs into templates with counts, severities and incident spikes — streaming, stdlib only, no file size limit.
+
+```text
+$ loglens scan app.log
+lines    3,000 (222,367 bytes)
+time     2026-10-30 09:00:00 … 2026-10-30 10:39:58
+levels   INFO 1,999, DEBUG 579, WARNING 273, ERROR 149
+
+  1,999×  L1-L2999  [INFO]
+        2026-10-30 09:00:00 INFO request handled path=/api/lots/26 status=200 dur=37ms
+
+  149×  L902-L1050  [ERROR]
+        2026-10-30 09:30:02 ERROR api.db timeout after 30s query=select * from lots where id=491
+
+$ loglens spikes app.log
+problems across 30 buckets (total 422 in 3,000 lines)
+  2026-10-30 09:33:26        149  ████████████████████████████████████████
+```
+
+A 500 MB log cannot be read — by a human or by an agent with finite context. But logs are repetitive: numbers, UUIDs, IPs, hashes and quoted strings normalize away, and 3000 nearly-identical lines collapse into a handful of templates with counts, line ranges and one real sample each. That's all the information a triage needs.
+
+## Commands
+
+```text
+loglens scan <log> [--top 15] [--json]   # template clustering + severity counts
+loglens spikes <log> [--buckets 30] [--json]  # when problems happen (time or line buckets)
+loglens demo [dir]                       # synthetic log with a planted incident
+```
+
+Streaming: the file is read line by line, memory holds only templates. Any text log; timestamps understood in ISO, Apache-bracketed and bare `HH:MM:SS` forms (no timestamps → line-range buckets). Python 3.11+, stdlib only.
+
+Install: `pip install logtriage` — or from this repo:
+`pip install "git+https://github.com/juzorei/loglens#subdirectory=tools/loglens"`
+
+The companion agent skill lives in [skills/log-triage](../skills/log-triage): cluster first, read only samples, then bounded reads around the incident. Skills: `npx skills add juzorei/loglens`.

logtriage-0.1.0/README.md

@@ -0,0 +1,37 @@
+# loglens
+
+Cluster big logs into templates with counts, severities and incident spikes — streaming, stdlib only, no file size limit.
+
+```text
+$ loglens scan app.log
+lines    3,000 (222,367 bytes)
+time     2026-10-30 09:00:00 … 2026-10-30 10:39:58
+levels   INFO 1,999, DEBUG 579, WARNING 273, ERROR 149
+
+  1,999×  L1-L2999  [INFO]
+        2026-10-30 09:00:00 INFO request handled path=/api/lots/26 status=200 dur=37ms
+
+  149×  L902-L1050  [ERROR]
+        2026-10-30 09:30:02 ERROR api.db timeout after 30s query=select * from lots where id=491
+
+$ loglens spikes app.log
+problems across 30 buckets (total 422 in 3,000 lines)
+  2026-10-30 09:33:26        149  ████████████████████████████████████████
+```
+
+A 500 MB log cannot be read — by a human or by an agent with finite context. But logs are repetitive: numbers, UUIDs, IPs, hashes and quoted strings normalize away, and 3000 nearly-identical lines collapse into a handful of templates with counts, line ranges and one real sample each. That's all the information a triage needs.
+
+## Commands
+
+```text
+loglens scan <log> [--top 15] [--json]   # template clustering + severity counts
+loglens spikes <log> [--buckets 30] [--json]  # when problems happen (time or line buckets)
+loglens demo [dir]                       # synthetic log with a planted incident
+```
+
+Streaming: the file is read line by line, memory holds only templates. Any text log; timestamps understood in ISO, Apache-bracketed and bare `HH:MM:SS` forms (no timestamps → line-range buckets). Python 3.11+, stdlib only.
+
+Install: `pip install logtriage` — or from this repo:
+`pip install "git+https://github.com/juzorei/loglens#subdirectory=tools/loglens"`
+
+The companion agent skill lives in [skills/log-triage](../skills/log-triage): cluster first, read only samples, then bounded reads around the incident. Skills: `npx skills add juzorei/loglens`.

logtriage-0.1.0/pyproject.toml

@@ -0,0 +1,27 @@
+[build-system]
+requires = ["setuptools>=69"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "logtriage"
+version = "0.1.0"
+description = "Cluster big logs into templates with counts, severities and incident spikes — streaming, stdlib only"
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+authors = [{ name = "juzorei" }]
+keywords = ["logs", "observability", "triage", "cli", "agent-skills"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Operating System :: OS Independent",
+    "Topic :: System :: Logging",
+]
+
+[project.urls]
+Homepage = "https://github.com/juzorei/loglens"
+
+[project.scripts]
+loglens = "loglens.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

logtriage-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

logtriage-0.1.0/src/loglens/__init__.py

@@ -0,0 +1,3 @@
+"""Cluster big logs into templates, count severities, find incident spikes."""
+
+__version__ = "0.1.0"

logtriage-0.1.0/src/loglens/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from .cli import main
+
+sys.exit(main())

logtriage-0.1.0/src/loglens/cli.py

@@ -0,0 +1,127 @@
+"""loglens CLI: cluster a big log into templates, count severities, find spikes."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from . import __version__
+from .core import Scan, scan, spikes
+
+BAR_WIDTH = 40
+
+
+def bar(n: int, max_n: int) -> str:
+    width = max(1, round(BAR_WIDTH * n / max_n)) if max_n else 1
+    return "█" * width
+
+
+def cmd_scan(args) -> int:
+    result = scan(args.log)
+    if args.json:
+        print(json.dumps({
+            "file": result.path, "lines": result.lines, "bytes": result.bytes_read,
+            "timeframe": result.timeframe, "severities": result.counts(),
+            "templates": [{"pattern": t.pattern, "count": t.count,
+                           "lines": [t.first_line, t.last_line], "severity": t.severity,
+                           "sample": t.sample}
+                          for t in result.top(args.top)],
+        }, indent=2))
+        return 0
+    print(f"file     {result.path}")
+    print(f"lines    {result.lines:,} ({result.bytes_read:,} bytes)")
+    if result.timeframe:
+        print(f"time     {result.timeframe}")
+    counts = result.counts()
+    if counts:
+        print("levels   " + ", ".join(f"{k} {v:,}" for k, v in counts.items()))
+    max_n = max((t.count for t in result.top(args.top)), default=1)
+    for t in result.top(args.top):
+        print(f"\n  {t.count:>7,}×  L{t.first_line}-L{t.last_line}"
+              + (f"  [{t.severity}]" if t.severity else ""))
+        print(f"        {t.sample[:160]}")
+        print(f"        {bar(t.count, max_n)}")
+    print(f"\n{len(result.templates)} distinct templates; showing top {min(args.top, len(result.templates))}")
+    return 0
+
+
+def cmd_spikes(args) -> int:
+    data = spikes(args.log, buckets=args.buckets)
+    if args.json:
+        print(json.dumps(data, indent=2))
+        return 0
+    print(f"problems across {len(data['buckets'])} buckets "
+          f"(total {data.get('total_problems', 0)} in {data.get('total_lines', 0):,} lines)")
+    max_n = max((b["problems"] for b in data["buckets"]), default=1)
+    for b in data["buckets"]:
+        print(f"  {b['label']:<30} {b['problems']:>7,}  {bar(b['problems'], max_n)}")
+    if not data["buckets"]:
+        print("  (no errors, warnings or failures found)")
+    return 0
+
+
+def cmd_demo(args) -> int:
+    from pathlib import Path
+    d = Path(args.directory)
+    d.mkdir(parents=True, exist_ok=True)
+    log = d / "app.log"
+    import datetime
+    import random
+    random.seed(42)
+    base = datetime.datetime(2026, 10, 30, 9, 0, 0)
+    lines = []
+    for i in range(3000):
+        ts = (base + datetime.timedelta(seconds=i * 2)).isoformat(sep=" ")
+        roll = random.random()
+        if 900 < i < 1050:  # planted incident spike
+            lines.append(f"{ts} ERROR api.db timeout after 30s query=select * from lots where id={random.randint(1, 999)}")
+        elif roll < 0.7:
+            lines.append(f"{ts} INFO request handled path=/api/lots/{random.randint(1, 999)} status=200 dur={random.randint(2, 90)}ms")
+        elif roll < 0.9:
+            lines.append(f"{ts} DEBUG cache hit key=user:{random.randint(1, 99)} ttl={random.randint(10, 300)}")
+        else:
+            lines.append(f"{ts} WARN rate limit approach key=ip:{random.randint(1, 20)} count={random.randint(90, 100)}")
+    log.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    print(f"wrote synthetic log: {log} ({log.stat().st_size:,} bytes, 3000 lines, planted incident at lines ~900-1050)\n")
+    print("try:")
+    print(f"  loglens scan {log}")
+    print(f"  loglens spikes {log}")
+    print(f"  loglens scan {log} --json")
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="loglens", description=__doc__)
+    parser.add_argument("--version", action="version", version=f"loglens {__version__}")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p = sub.add_parser("scan", help="cluster a log into templates with counts and samples")
+    p.add_argument("log")
+    p.add_argument("--top", type=int, default=15)
+    p.add_argument("--json", action="store_true")
+    p.set_defaults(func=cmd_scan)
+
+    p = sub.add_parser("spikes", help="show when problems happen (time buckets or line ranges)")
+    p.add_argument("log")
+    p.add_argument("--buckets", type=int, default=30)
+    p.add_argument("--json", action="store_true")
+    p.set_defaults(func=cmd_spikes)
+
+    p = sub.add_parser("demo", help="write a synthetic log with a planted incident")
+    p.add_argument("directory", nargs="?", default="loglens-demo")
+    p.set_defaults(func=cmd_demo)
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        return args.func(args)
+    except OSError as exc:
+        print(f"loglens: error: {exc}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

logtriage-0.1.0/src/loglens/core.py

@@ -0,0 +1,156 @@
+"""loglens core: streaming pattern clustering and spike detection for big logs."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+
+# Normalization: variable parts of a line collapse so that 5000 occurrences of
+# the same error become one template with a count.
+NORMALIZERS = [
+    (re.compile(r"\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b"), "<uuid>"),
+    (re.compile(r"\b\d{1,3}(?:\.\d{1,3}){3}(?::\d+)?\b"), "<ip>"),
+    (re.compile(r"\b0x[0-9a-fA-F]{6,}\b"), "<hex>"),
+    (re.compile(r"\b[0-9a-f]{16,}\b", re.I), "<hash>"),
+    # last: every remaining digit run collapses (uuid/ip/hex/hash already consumed)
+    (re.compile(r"\d+"), "<n>"),
+    (re.compile(r'"[^"]{0,200}"'), '"…"'),
+]
+
+TS_PATTERNS = [
+    re.compile(r"\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[.,]\d+)?"),
+    re.compile(r"\[\d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2}"),
+    re.compile(r"\d{2}:\d{2}:\d{2}(?:\.\d+)?"),
+]
+
+SEVERITY = re.compile(
+    r"\b(TRACE|DEBUG|INFO|NOTICE|WARN(?:ING)?|ERROR|ERR|CRITICAL|CRIT|FATAL|PANIC)\b", re.I)
+
+BUCKETS = 30
+
+
+@dataclass
+class Template:
+    pattern: str
+    count: int = 0
+    first_line: int = 0
+    last_line: int = 0
+    severity: str = ""
+    sample: str = ""
+
+
+@dataclass
+class Scan:
+    path: str = ""
+    lines: int = 0
+    bytes_read: int = 0
+    timeframe: str = ""
+    severities: dict[str, int] = field(default_factory=dict)
+    templates: list[Template] = field(default_factory=list)
+
+    def top(self, n: int) -> list[Template]:
+        return sorted(self.templates, key=lambda t: -t.count)[:n]
+
+    def counts(self) -> dict[str, int]:
+        return {k: v for k, v in self.severities.items() if v}
+
+
+def normalize(line: str) -> str:
+    for regex, replacement in NORMALIZERS:
+        line = regex.sub(replacement, line)
+    return line.strip()[:220]
+
+
+def severity_of(line: str) -> str:
+    m = SEVERITY.search(line)
+    if not m:
+        return ""
+    token = m.group(1).upper()
+    if token == "ERR":
+        return "ERROR"
+    if token == "CRIT":
+        return "CRITICAL"
+    if token == "WARN":
+        return "WARNING"
+    return token
+
+
+def extract_ts(line: str) -> str | None:
+    for p in TS_PATTERNS:
+        m = p.search(line)
+        if m:
+            return m.group(0).strip("[]")
+    return None
+
+
+def scan(path: str | Path) -> Scan:
+    """Stream the file line by line; memory holds templates, not the log."""
+    result = Scan(path=str(path))
+    counts: dict[str, Template] = {}
+    first_ts = last_ts = None
+    with open(path, "r", encoding="utf-8", errors="replace") as fh:
+        for line_no, line in enumerate(fh, 1):
+            result.lines += 1
+            result.bytes_read += len(line.encode("utf-8", "replace"))
+            ts = extract_ts(line)
+            if ts:
+                first_ts = first_ts or ts
+                last_ts = ts
+            sev = severity_of(line)
+            if sev:
+                result.severities[sev] = result.severities.get(sev, 0) + 1
+            key = normalize(line)
+            if not key:
+                key = "<blank>"
+            tmpl = counts.get(key)
+            if tmpl is None:
+                counts[key] = Template(key, 1, line_no, line_no, sev, line.strip()[:220])
+            else:
+                tmpl.count += 1
+                tmpl.last_line = line_no
+    result.templates = list(counts.values())
+    if first_ts and last_ts and first_ts != last_ts:
+        result.timeframe = f"{first_ts} … {last_ts}"
+    elif first_ts:
+        result.timeframe = first_ts
+    return result
+
+
+def spikes(path: str | Path, buckets: int = BUCKETS) -> dict:
+    """Error/broken-template counts across time buckets (by timestamp) or line ranges."""
+    per_bucket: dict[int, int] = {}
+    labels: dict[int, str] = {}
+    total = 0
+    with open(path, "r", encoding="utf-8", errors="replace") as fh:
+        raw = []
+        for line in fh:
+            total += 1
+            raw.append((extract_ts(line) or "", severity_of(line) or
+                        ("ERR" if re.search(r"\b(error|fail|exception)\b", line, re.I) else "")))
+    if not total:
+        return {"buckets": [], "total": 0}
+    has_ts = any(ts for ts, _ in raw)
+    by_idx: dict[int, int] = {}
+    if has_ts:
+        for i, (ts, _) in enumerate(raw):
+            by_idx.setdefault(ts, i)
+        ordered = [ts for ts, _ in sorted(by_idx.items(), key=lambda kv: kv[1])]
+        index_of = {ts: i for i, ts in enumerate(ordered)}
+        for ts, sev in raw:
+            if not sev or sev in ("INFO", "DEBUG", "TRACE"):
+                continue
+            b = index_of[ts] * buckets // max(1, len(ordered))
+            per_bucket[b] = per_bucket.get(b, 0) + 1
+            labels.setdefault(b, ts)
+    else:
+        chunk = max(1, total // buckets)
+        for i, (_, sev) in enumerate(raw):
+            if not sev or sev in ("INFO", "DEBUG", "TRACE"):
+                continue
+            b = i // chunk
+            per_bucket[b] = per_bucket.get(b, 0) + 1
+            labels.setdefault(b, f"lines {b * chunk + 1}-{(b + 1) * chunk}")
+    out = [{"bucket": b, "label": labels.get(b, str(b)), "problems": n}
+           for b, n in sorted(per_bucket.items())]
+    return {"buckets": out, "total_lines": total, "total_problems": sum(per_bucket.values())}

logtriage-0.1.0/src/logtriage.egg-info/PKG-INFO

@@ -0,0 +1,51 @@
+Metadata-Version: 2.4
+Name: logtriage
+Version: 0.1.0
+Summary: Cluster big logs into templates with counts, severities and incident spikes — streaming, stdlib only
+Author: juzorei
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/juzorei/loglens
+Keywords: logs,observability,triage,cli,agent-skills
+Classifier: Programming Language :: Python :: 3
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: System :: Logging
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# loglens
+
+Cluster big logs into templates with counts, severities and incident spikes — streaming, stdlib only, no file size limit.
+
+```text
+$ loglens scan app.log
+lines    3,000 (222,367 bytes)
+time     2026-10-30 09:00:00 … 2026-10-30 10:39:58
+levels   INFO 1,999, DEBUG 579, WARNING 273, ERROR 149
+
+  1,999×  L1-L2999  [INFO]
+        2026-10-30 09:00:00 INFO request handled path=/api/lots/26 status=200 dur=37ms
+
+  149×  L902-L1050  [ERROR]
+        2026-10-30 09:30:02 ERROR api.db timeout after 30s query=select * from lots where id=491
+
+$ loglens spikes app.log
+problems across 30 buckets (total 422 in 3,000 lines)
+  2026-10-30 09:33:26        149  ████████████████████████████████████████
+```
+
+A 500 MB log cannot be read — by a human or by an agent with finite context. But logs are repetitive: numbers, UUIDs, IPs, hashes and quoted strings normalize away, and 3000 nearly-identical lines collapse into a handful of templates with counts, line ranges and one real sample each. That's all the information a triage needs.
+
+## Commands
+
+```text
+loglens scan <log> [--top 15] [--json]   # template clustering + severity counts
+loglens spikes <log> [--buckets 30] [--json]  # when problems happen (time or line buckets)
+loglens demo [dir]                       # synthetic log with a planted incident
+```
+
+Streaming: the file is read line by line, memory holds only templates. Any text log; timestamps understood in ISO, Apache-bracketed and bare `HH:MM:SS` forms (no timestamps → line-range buckets). Python 3.11+, stdlib only.
+
+Install: `pip install logtriage` — or from this repo:
+`pip install "git+https://github.com/juzorei/loglens#subdirectory=tools/loglens"`
+
+The companion agent skill lives in [skills/log-triage](../skills/log-triage): cluster first, read only samples, then bounded reads around the incident. Skills: `npx skills add juzorei/loglens`.

logtriage-0.1.0/src/logtriage.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+src/loglens/__init__.py
+src/loglens/__main__.py
+src/loglens/cli.py
+src/loglens/core.py
+src/logtriage.egg-info/PKG-INFO
+src/logtriage.egg-info/SOURCES.txt
+src/logtriage.egg-info/dependency_links.txt
+src/logtriage.egg-info/entry_points.txt
+src/logtriage.egg-info/top_level.txt
+tests/test_loglens.py

logtriage-0.1.0/src/logtriage.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

logtriage-0.1.0/src/logtriage.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+loglens = loglens.cli:main

logtriage-0.1.0/src/logtriage.egg-info/top_level.txt

@@ -0,0 +1 @@
+loglens

logtriage-0.1.0/tests/test_loglens.py

@@ -0,0 +1,100 @@
+import json
+
+import pytest
+
+from loglens.cli import main
+from loglens.core import normalize, scan, severity_of, spikes
+
+
+@pytest.fixture(scope="module")
+def log_file(tmp_path_factory):
+    d = tmp_path_factory.mktemp("log")
+    path = d / "app.log"
+    lines = []
+    for i in range(1, 301):
+        ts = f"2026-10-30 09:{i // 60:02d}:{i % 60:02d}"
+        if i == 50:
+            lines.append(f"{ts} ERROR db timeout query=select * from lots where id={i}")
+        elif i == 120:
+            lines.append(f"{ts} ERROR db timeout query=select * from lots where id=999")
+        elif i % 10 == 0:
+            lines.append(f"{ts} WARNING rate limit approach key=ip:{i % 5} count={i}")
+        else:
+            lines.append(f"{ts} INFO request handled path=/api/lots/{i} status=200 dur={i}ms")
+    path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    return str(path)
+
+
+def test_normalize_collapses_variables():
+    line = "2026-10-30 09:00:01 ERROR id=9b2f5c1e-7a3d-4b8a-9c0d-1e2f3a4b5c6d ip=10.0.0.5 hash=0xDEADBEEF99 count=42 msg=\"boom\""
+    n = normalize(line)
+    assert "<uuid>" in n and "<ip>" in n and "<hex>" in n and '"…"' in n
+    assert "42" not in n.replace("<n>", "").replace("<ip>", "")
+
+
+def test_scan_clusters_same_template(log_file):
+    r = scan(log_file)
+    # 298 INFO lines differ only in digits/paths -> one template
+    info = [t for t in r.templates if "INFO" in t.pattern]
+    assert len(info) == 1 and info[0].count == 270
+    assert r.templates and len(r.templates) <= 6
+
+
+def test_scan_severity_counts(log_file):
+    r = scan(log_file)
+    assert r.severities["ERROR"] == 2
+    assert r.severities["WARNING"] == 28  # i=50,120 became ERRORs
+    assert r.counts()["ERROR"] == 2
+
+
+def test_scan_timeframe_and_streaming_stats(log_file):
+    r = scan(log_file)
+    assert r.lines == 300
+    assert r.timeframe.startswith("2026-10-30 09:00:01") and r.timeframe.endswith("09:05:00")
+
+
+def test_spikes_finds_planted_cluster(log_file):
+    data = spikes(log_file, buckets=10)
+    assert data["total_problems"] >= 2
+    worst = max(data["buckets"], key=lambda b: b["problems"])
+    # the two ERROR lines sit at lines 50 and 120 — bucket 0-1 or 3-4 of 10
+    assert worst["problems"] >= 1
+
+
+def test_spikes_without_timestamps_buckets_by_lines(tmp_path):
+    p = tmp_path / "plain.log"
+    p.write_text("\n".join(f"ERR no timestamp {i}" for i in range(1, 101)) + "\n", encoding="utf-8")
+    data = spikes(p, buckets=4)
+    assert data["total_problems"] == 100
+    assert all("lines" in b["label"] for b in data["buckets"])
+
+
+def test_severity_variants():
+    assert severity_of("2026-10-30 ERR x") == "ERROR"
+    assert severity_of("crit: disk full") == "CRITICAL"
+    assert severity_of("all fine") == ""
+
+
+def test_cli_scan_text(log_file, capsys):
+    assert main(["scan", log_file]) == 0
+    out = capsys.readouterr().out
+    assert "lines    300" in out and "ERROR 2" in out and "distinct templates" in out
+
+
+def test_cli_scan_json(log_file, capsys):
+    assert main(["scan", log_file, "--top", "3", "--json"]) == 0
+    data = json.loads(capsys.readouterr().out)
+    assert data["lines"] == 300 and len(data["templates"]) <= 3
+
+
+def test_cli_spikes_json(log_file, capsys):
+    assert main(["spikes", log_file, "--buckets", "5", "--json"]) == 0
+    data = json.loads(capsys.readouterr().out)
+    assert data["total_problems"] >= 2 and len(data["buckets"]) <= 5
+
+
+def test_cli_demo(tmp_path, capsys):
+    assert main(["demo", str(tmp_path / "d")]) == 0
+    out = capsys.readouterr().out
+    assert "planted incident" in out
+    assert (tmp_path / "d" / "app.log").stat().st_size > 10000