@aflueza/log-analysis 0.0.0-stage → 0.2.1-rc.2

package/lib/analyzer.js

@@ -0,0 +1,1093 @@
+import { randomUUID } from 'node:crypto';
+const LEVELS = ['ERROR', 'WARN', 'INFO', 'DEBUG', 'TRACE'];
+const MAX_SAMPLE_LENGTH = 128_000;
+const timestamp = /(\d{4}-\d{2}-\d{2}[T ][0-9:.+\-]+|\d{2}:\d{2}:\d{2}(?:\.\d+)?)/;
+const level = /^\s*\*?\s*(?:\d{4}-\d{2}-\d{2}[T ][0-9:.+\-]+\s+)?\*?-?(ERROR|WARN(?:ING)?|INFO|DEBUG|TRACE|FATAL)\b/i;
+const logbackStart = /^\s*\*?\s*\d{4}-\d{2}-\d{2}[T ][0-9:.+\-]+\s+\*?-?(ERROR|WARN(?:ING)?|INFO|DEBUG|TRACE|FATAL)\b/i;
+const bracketLogbackStart = /^\s*\[(ERROR|WARN(?:ING)?|INFO|DEBUG|TRACE|FATAL)\]\s*\[\d{4}-\d{2}-\d{2}[T ][0-9:.+\-]+\b/i;
+const bracketLogHeader = /^\s*\[(ERROR|WARN(?:ING)?|INFO|DEBUG|TRACE|FATAL)\]\s*\[([^\]]+)\]/i;
+const logHeader = /^\s*\*?\s*(\d{4}-\d{2}-\d{2}[T ][0-9:.+\-]+)\s+\*?-?(ERROR|WARN(?:ING)?|INFO|DEBUG|TRACE|FATAL)\b(?:\s+\d+\s+---\s+\[([^\]]+)\]\s+(.+?)\s*:)?/i;
+const duration = /(?:duration|elapsed|cost|耗时)[=: ]+(\d+(?:\.\d+)?)\s*(ms|s)?/i;
+const service = /(?:service|svc|application)[=: ]+([\w.-]+)/i;
+const status = /\bstatus(?:Code)?[=: ]+(\d{3})\b/i;
+const fieldsToCheck = [
+    'timestamp',
+    'level',
+    'threadName',
+    'loggerName',
+    'sourceLine',
+    'traceId',
+    'spanId',
+    'exceptionType',
+    'service',
+    'message',
+    'mdc',
+];
+export class LogAnalyzer {
+    currentSessionId = randomUUID();
+    entries = [];
+    files = [];
+    cancelled = false;
+    activeQuery = {};
+    listeners = new Set();
+    samples = new Map();
+    sampleRecords = new Map();
+    selectedFormat = 'unknown';
+    activeRule = null;
+    activeRuleId = null;
+    suggestedRule;
+    validatedRuleVersion;
+    sampleVersion = 1;
+    sampleFileId = '';
+    sampleSource = 'default';
+    sampleLevel;
+    chunkFiles = new Map();
+    sampleChunks = new Map();
+    get sessionId() {
+        return this.currentSessionId;
+    }
+    setQuery(query) {
+        if (query.keyword !== undefined) {
+            try {
+                new RegExp(query.keyword, 'i');
+            }
+            catch {
+                throw new Error('关键词正则无效');
+            }
+        }
+        this.activeQuery = { ...query };
+    }
+    start(files, samples = [], query = {}) {
+        if (!files.length)
+            throw new Error('至少选择一个日志文件');
+        if (query.keyword !== undefined) {
+            try {
+                new RegExp(query.keyword, 'i');
+            }
+            catch {
+                throw new Error('关键词正则无效');
+            }
+        }
+        this.currentSessionId = randomUUID();
+        this.entries = [];
+        this.cancelled = false;
+        this.setQuery(query);
+        this.activeRule = null;
+        this.activeRuleId = null;
+        this.suggestedRule = undefined;
+        this.validatedRuleVersion = undefined;
+        this.samples = new Map();
+        this.sampleRecords.clear();
+        for (const sample of samples) {
+            this.samples.set(sample.fileId, limitSampleToCompleteRecords(sample.content));
+        }
+        this.files = files.map((input) => ({
+            id: input.id,
+            name: input.name,
+            size: input.size,
+            status: 'pending',
+            count: 0,
+            errors: 0,
+        }));
+        this.sampleVersion = 1;
+        this.sampleFileId = files[0]?.id ?? '';
+        this.sampleSource = 'default';
+        this.sampleLevel = undefined;
+        this.selectedFormat = 'unknown';
+        const sample = this.samples.has(this.sampleFileId)
+            ? this.sampleContext(this.sampleFileId, this.sampleSource, this.sampleLevel)
+            : {
+                fileId: this.sampleFileId,
+                fileName: files[0]?.name ?? '',
+                content: '',
+                sampleVersion: this.sampleVersion,
+                source: this.sampleSource,
+                records: [],
+            };
+        this.sampleRecords.set(this.sampleFileId, sample.records);
+        this.emit();
+        return { summary: this.summary(), sample };
+    }
+    openSampleChunk(fileId, level) {
+        const file = this.files.find((item) => item.id === fileId);
+        if (!file)
+            throw new Error('样例文件不存在');
+        this.sampleChunks.set(fileId, {
+            fileId,
+            offset: 0,
+            line: 0,
+            pending: '',
+            pendingLine: 1,
+            level,
+            records: [],
+        });
+        return { fileId, offset: 0, found: false, needMore: true };
+    }
+    appendSampleChunk(fileId, offset, content, eof = false, byteLength) {
+        const state = this.sampleChunks.get(fileId);
+        if (!state)
+            throw new Error('样例分块会话不存在');
+        if (offset !== state.offset)
+            throw new Error(`样例分块偏移无效，期望 ${state.offset}，收到 ${offset}`);
+        const parts = (state.pending + content.replace(/\r\n?/g, '\n')).split('\n');
+        state.pending = eof ? '' : (parts.pop() ?? '');
+        const commit = (raw, line) => {
+            if (!raw)
+                return;
+            const parsed = parseRecord(raw, this.files.find((item) => item.id === fileId)?.name ?? '', line, fileId, null);
+            const wanted = state.level === undefined || parsed.level === state.level;
+            if (wanted && !state.found)
+                state.found = raw.slice(0, MAX_SAMPLE_LENGTH);
+            if (state.level === undefined && state.records.join('\n').length < MAX_SAMPLE_LENGTH)
+                state.records.push(raw);
+        };
+        for (const rawLine of parts) {
+            state.line += 1;
+            if (isLogRecordStart(rawLine)) {
+                if (state.pending)
+                    commit(state.pending, state.pendingLine);
+                state.pending = rawLine;
+                state.pendingLine = state.line;
+            }
+            else if (state.pending)
+                state.pending += `\n${rawLine}`;
+        }
+        if (eof && state.pending) {
+            commit(state.pending, state.pendingLine);
+            state.pending = '';
+        }
+        state.offset += byteLength ?? Buffer.byteLength(content, 'utf8');
+        if (eof && !state.found && state.level === undefined && state.records.length)
+            state.found = state.records.join('\n');
+        const record = state.found;
+        const done = Boolean(record) || eof;
+        if (done)
+            this.sampleChunks.delete(fileId);
+        return {
+            fileId,
+            offset: state.offset,
+            found: Boolean(record),
+            needMore: !done,
+            ...(record ? { record, level: state.level } : {}),
+        };
+    }
+    finishSampleChunk(fileId) {
+        const state = this.sampleChunks.get(fileId);
+        if (!state)
+            throw new Error('样例分块会话不存在');
+        return this.appendSampleChunk(fileId, state.offset, '', true);
+    }
+    cancelSampleChunk(fileId) {
+        this.sampleChunks.delete(fileId);
+    }
+    setSample(fileId, content, source, levelValue) {
+        const file = this.files.find((item) => item.id === fileId);
+        if (!file)
+            throw new Error('样例文件不存在');
+        if (!content.trim())
+            throw new Error('样例内容不能为空');
+        const bounded = limitSampleToCompleteRecords(content);
+        const candidateRecords = splitRecords(bounded, null);
+        const candidateEntries = candidateRecords.map((record) => parseRecord(record.raw, file.name, record.line, file.id, null));
+        const matchingIndex = source === 'level' && levelValue
+            ? candidateEntries.findIndex((entry) => entry.level === levelValue)
+            : 0;
+        const selectedRecord = matchingIndex >= 0 ? candidateRecords[matchingIndex] : undefined;
+        const selectedContent = source === 'level' ? (selectedRecord?.raw ?? '') : bounded;
+        this.sampleFileId = fileId;
+        this.samples.set(fileId, selectedContent);
+        this.sampleVersion += 1;
+        this.sampleSource = source;
+        this.sampleLevel = levelValue;
+        this.suggestedRule = undefined;
+        this.validatedRuleVersion = undefined;
+        this.activeRule = null;
+        this.activeRuleId = null;
+        const sample = selectedContent
+            ? this.sampleContext(fileId, source, levelValue)
+            : {
+                fileId,
+                fileName: file.name,
+                content: '',
+                sampleVersion: this.sampleVersion,
+                source,
+                level: levelValue,
+                records: [],
+            };
+        this.sampleRecords.set(fileId, sample.records);
+        this.emit();
+        return sample;
+    }
+    previewWithRule(rule, sampleContent, fileId = this.sampleFileId, fileName) {
+        const file = this.files.find((item) => item.id === fileId) ??
+            (fileName
+                ? {
+                    id: fileId,
+                    name: fileName,
+                    size: Buffer.byteLength(sampleContent),
+                    status: 'done',
+                    count: 0,
+                    errors: 0,
+                }
+                : undefined);
+        if (!file)
+            throw new Error('没有可用于格式识别的日志样例');
+        const records = splitRecords(sampleContent, rule);
+        const parsed = records.map((record) => parseRecord(record.raw, file.name, record.line, file.id, rule));
+        const first = parsed[0] ?? null;
+        const unknownFields = first
+            ? fieldsToCheck.filter((field) => !hasField(first, field))
+            : [...fieldsToCheck];
+        const multilineRecords = parsed.filter((entry) => entry.raw.includes('\n')).length;
+        const totalLines = sampleContent.split(/\r?\n/).filter(Boolean).length;
+        const matchedLines = parsed.reduce((sum, entry) => {
+            const firstLine = entry.raw.split(/\r?\n/, 1)[0] ?? '';
+            return (sum + (matchesPattern(rule.recordStart, firstLine) ? entry.raw.split(/\r?\n/).length : 0));
+        }, 0);
+        const fieldCoverage = parsed.length
+            ? parsed.reduce((sum, entry) => sum + fieldsToCheck.filter((field) => hasField(entry, field)).length, 0) /
+                (parsed.length * fieldsToCheck.length)
+            : 0;
+        return {
+            sessionId: this.currentSessionId,
+            sampleVersion: this.sampleVersion,
+            fileId: file.id,
+            fileName: file.name,
+            sampleSource: this.sampleSource,
+            sampleLevel: this.sampleLevel,
+            sampleRaw: sampleContent,
+            format: rule.format,
+            confidence: parsed.length && unknownFields.length < 4 ? 'high' : 'medium',
+            firstLine: first?.raw.split(/\r?\n/, 1)[0] ?? '',
+            firstRecord: first,
+            records: parsed,
+            sampleRecords: sampleRecordsFrom(records, parsed),
+            unknownFields,
+            matchedRecords: parsed.length,
+            multilineRecords,
+            unmatchedLines: Math.max(0, totalLines - matchedLines),
+            fieldCoverage,
+            rule,
+            validationErrors: [],
+            executionErrors: [],
+        };
+    }
+    previewParserRule(rule, fileId = this.sampleFileId) {
+        const sample = this.samples.get(fileId);
+        if (!sample)
+            throw new Error('分析会话中没有可供解析的日志样例');
+        return this.previewWithRule(rule, sample, fileId);
+    }
+    previewRuleOnSample(ruleValue, sampleContent, fileName) {
+        if (!sampleContent.trim())
+            throw new Error('样例内容不能为空');
+        const rule = validateParserRule(ruleValue);
+        const fileId = `rule-validation:${Date.now()}`;
+        return this.previewWithRule(rule, sampleContent, fileId, fileName || 'sample.log');
+    }
+    sampleContext(fileId, source, levelValue) {
+        const file = this.files.find((item) => item.id === fileId);
+        if (!file)
+            throw new Error('样例文件不存在');
+        const content = this.samples.get(fileId);
+        if (!content)
+            throw new Error('样例内容不存在');
+        const records = splitRecords(content, null);
+        const parsed = records.map((record) => parseRecord(record.raw, file.name, record.line, file.id, null));
+        return {
+            fileId,
+            fileName: file.name,
+            content,
+            sampleVersion: this.sampleVersion,
+            source,
+            level: levelValue,
+            records: sampleRecordsFrom(records, parsed),
+        };
+    }
+    async suggestParser(provider, model, stream, fileId = this.sampleFileId, sampleVersion = this.sampleVersion, signal, logModelOutput, externalSample) {
+        if (!externalSample && sampleVersion !== this.sampleVersion)
+            throw new Error('样例已变化，请重新识别');
+        const sample = externalSample?.content ?? this.samples.get(fileId);
+        if (!sample)
+            throw new Error('分析会话中没有可供智能解析的日志样例');
+        const prompt = [
+            '你是日志格式解析器设计助手。请仅返回一个 JSON 对象，不要 Markdown、代码围栏、解释、数组或已解析日志数据。',
+            '根据日志样例输出版本化声明式规则，不得输出可执行代码。字段正则的首个捕获组必须是字段值；可选字段可省略。',
+            '所有 pattern 必须是可直接传给 JavaScript new RegExp(pattern, "m") 的正则正文，不要附加斜杠包围符或内联模式标记（如 (?m)）；多行模式由程序设置。JSON 字符串中反斜杠只按 JSON 规则转义一次，例如正则 \\s 在 JSON 中写作 \\\\s。',
+            '结构：{"version":1,"format":"名称","recordStart":"^正则","fields":{"timestamp":{"pattern":"正则"},"level":{"pattern":"正则"},"threadName":{"pattern":"正则"},"loggerName":{"pattern":"正则"},"sourceLine":{"pattern":"正则"},"traceId":{"pattern":"正则"},"spanId":{"pattern":"正则"},"exceptionType":{"pattern":"正则"},"service":{"pattern":"正则"},"message":{"pattern":"正则"},"mdc":{"pattern":"正则"}},"continuation":"until-next-record"}',
+            '只允许字段 timestamp、level、threadName、loggerName、sourceLine、traceId、spanId、exceptionType、service、message、mdc。recordStart 必须从行首开始，并使用足以区分一条完整日志记录的非空特征；禁止使用 ^、^\\s* 或仅匹配任意日期前缀的宽泛规则。为兼容安全校验，recordStart 不得使用前瞻/后顾、反向引用或带嵌套重复量词的分组；优先使用明确的时间戳与级别/分隔符、普通非捕获组和字符类。JSON 日志匹配对象记录的起始结构。每个 pattern 的首个捕获组必须是字段值；message 必须存在。',
+            '日志记录可能跨越多行。recordStart 只匹配每条记录的首行，下一条 recordStart 之前的所有行属于当前记录。',
+            '常见 Logback 首行包括“2026-10-15 17:00:40.117 ERROR [SYSTEM] logger - message”和“2026-10-13 00:56:26.507 ERROR 8428 --- [thread] logger : message”。这两种格式都必须把时间戳与级别作为 recordStart 的边界；[SYSTEM]、线程、logger 和分隔符属于首行上下文，不要要求 message 必须在同一行结束。',
+            '如果 message 中包含 SQL、括号、方括号或换行，message pattern 只需从首行消息开始捕获到行尾；不要把 SQL 正文、异常堆栈或括号内容写入 recordStart。',
+            '日志样例（可能包含敏感信息，请只推断格式，不要复述样例内容）：',
+            truncateSampleLines(sample, 1_000).slice(0, 12_000),
+        ].join('\n\n');
+        let output = '';
+        for await (const chunk of stream(provider, model, prompt)) {
+            if (signal?.aborted)
+                throw new Error('日志格式识别已取消');
+            if (typeof chunk === 'object' &&
+                chunk !== null &&
+                chunk.type === 'text-delta') {
+                const text = chunk.text;
+                if (typeof text === 'string')
+                    output += text;
+            }
+        }
+        if (signal?.aborted)
+            throw new Error('日志格式识别已取消');
+        logModelOutput?.('raw', output);
+        const candidate = parseModelRuleJson(output);
+        logModelOutput?.('formatted-json', JSON.stringify(candidate, null, 2));
+        const rule = validateParserRule(candidate);
+        const preview = this.previewWithRule(rule, sample, fileId, externalSample?.fileName);
+        const parsed = preview.records;
+        const firstRecord = preview.firstRecord;
+        const known = parsed.filter((entry) => entry.level !== 'UNKNOWN' || entry.timestamp !== undefined).length;
+        const lineCount = sample.split(/\r?\n/).filter(Boolean).length;
+        const coveredLines = parsed.reduce((sum, entry) => {
+            const firstLine = entry.raw.split(/\r?\n/, 1)[0] ?? '';
+            return (sum + (matchesPattern(rule.recordStart, firstLine) ? entry.raw.split(/\r?\n/).length : 0));
+        }, 0);
+        const fieldCoverage = parsed.length
+            ? parsed.reduce((sum, entry) => sum + fieldsToCheck.filter((field) => hasField(entry, field)).length, 0) /
+                (parsed.length * fieldsToCheck.length)
+            : 0;
+        const validationErrors = parsed.length === 0
+            ? ['样例中没有找到记录']
+            : known === 0
+                ? ['规则无法识别样例中的时间或日志级别']
+                : [];
+        const executionErrors = firstRecord === null ? ['规则执行后没有可展示的首条记录'] : [];
+        const result = {
+            ...preview,
+            format: rule.format,
+            confidence: validationErrors.length ? 'low' : known / parsed.length > 0.8 ? 'high' : 'medium',
+            firstRecord,
+            records: parsed,
+            unknownFields: firstRecord
+                ? fieldsToCheck.filter((field) => !hasField(firstRecord, field))
+                : [...fieldsToCheck],
+            multilineRecords: parsed.filter((entry) => entry.raw.includes('\n')).length,
+            unmatchedLines: Math.max(0, lineCount - coveredLines),
+            fieldCoverage,
+            rule,
+            validationErrors,
+            executionErrors,
+        };
+        if (!externalSample && validationErrors.length === 0 && executionErrors.length === 0) {
+            this.suggestedRule = rule;
+            this.validatedRuleVersion = sampleVersion;
+            this.sampleRecords.set(fileId, result.sampleRecords);
+        }
+        else if (!externalSample) {
+            this.suggestedRule = undefined;
+            this.validatedRuleVersion = undefined;
+        }
+        return result;
+    }
+    async analyzeFile(fileId, content, ruleId, rule) {
+        const file = this.files.find((item) => item.id === fileId);
+        if (!file || file.status !== 'pending')
+            throw new Error(`未知或已开始解析的文件: ${fileId}`);
+        if (this.cancelled)
+            throw new Error('分析已取消');
+        if (!ruleId)
+            throw new Error('请先选择日志解析规则');
+        this.activeRuleId = ruleId;
+        this.activeRule = rule;
+        this.selectedFormat = rule.format;
+        file.status = 'processing';
+        this.emit();
+        try {
+            for (const record of splitRecords(content, this.activeRule))
+                this.addRecord(file, record.raw, record.line);
+            if (this.cancelled) {
+                file.status = 'failed';
+                file.error = '已取消';
+            }
+            else {
+                file.status = 'done';
+            }
+        }
+        catch (error) {
+            file.status = 'failed';
+            file.error = error instanceof Error ? error.message : String(error);
+        }
+        this.emit();
+        return this.summary();
+    }
+    openFileChunk(fileId, ruleId, rule) {
+        const file = this.files.find((item) => item.id === fileId);
+        if (!file)
+            throw new Error('未知日志文件');
+        if (!ruleId)
+            throw new Error('请先选择日志解析规则');
+        this.activeRuleId = ruleId;
+        this.activeRule = rule;
+        this.selectedFormat = rule.format;
+        file.status = 'processing';
+        this.chunkFiles.set(fileId, {
+            file,
+            offset: 0,
+            line: 0,
+            pending: '',
+            pendingLine: 1,
+            records: 0,
+        });
+        this.emit();
+        return { fileId, offset: 0, processedLines: 0, processedRecords: 0, status: 'processing' };
+    }
+    appendFileChunk(fileId, offset, content, eof = false, byteLength) {
+        const state = this.chunkFiles.get(fileId);
+        if (!state)
+            throw new Error('文件分块会话不存在');
+        if (offset !== state.offset)
+            throw new Error(`文件分块偏移无效，期望 ${state.offset}，收到 ${offset}`);
+        const normalized = state.pending + content.replace(/\r\n?/g, '\n');
+        const parts = normalized.split('\n');
+        state.pending = eof ? '' : (parts.pop() ?? '');
+        for (const rawLine of parts) {
+            state.line += 1;
+            const start = this.activeRule
+                ? matchesPattern(this.activeRule.recordStart, rawLine)
+                : isLogRecordStart(rawLine);
+            if (start) {
+                if (state.pending) {
+                    this.addRecord(state.file, state.pending, state.pendingLine);
+                    state.records += 1;
+                }
+                state.pending = rawLine;
+                state.pendingLine = state.line;
+            }
+            else if (state.pending) {
+                state.pending += `\n${rawLine}`;
+            }
+        }
+        if (eof && state.pending) {
+            this.addRecord(state.file, state.pending, state.pendingLine);
+            state.records += 1;
+            state.pending = '';
+        }
+        state.offset += byteLength ?? Buffer.byteLength(content, 'utf8');
+        if (eof)
+            state.file.status = 'done';
+        this.emit();
+        return {
+            fileId,
+            offset: state.offset,
+            processedLines: state.line,
+            processedRecords: state.records,
+            status: eof ? 'done' : 'processing',
+        };
+    }
+    finishFileChunk(fileId) {
+        const state = this.chunkFiles.get(fileId);
+        if (!state)
+            throw new Error('文件分块会话不存在');
+        return this.appendFileChunk(fileId, state.offset, '', true, 0);
+    }
+    cancelFileChunk(fileId) {
+        const state = this.chunkFiles.get(fileId);
+        if (state) {
+            state.file.status = 'failed';
+            state.file.error = '已取消';
+            this.chunkFiles.delete(fileId);
+        }
+        this.emit();
+        return this.summary();
+    }
+    failFile(fileId, message) {
+        const file = this.files.find((item) => item.id === fileId);
+        if (file && file.status === 'pending') {
+            file.status = 'failed';
+            file.error = message;
+            this.emit();
+        }
+        return this.summary();
+    }
+    removeFile(fileId) {
+        this.chunkFiles.delete(fileId);
+        this.sampleChunks.delete(fileId);
+        this.files = this.files.filter((file) => file.id !== fileId);
+        this.entries = this.entries.filter((entry) => !entry.id.startsWith(`${fileId}:`));
+        this.samples.delete(fileId);
+        this.emit();
+        return this.summary();
+    }
+    cancel() {
+        this.cancelled = true;
+        for (const file of this.files)
+            if (file.status === 'pending' || file.status === 'processing') {
+                file.status = 'failed';
+                file.error = '已取消';
+            }
+        this.emit();
+    }
+    clear() {
+        this.entries = [];
+        this.files = [];
+        this.samples.clear();
+        this.sampleRecords.clear();
+        this.chunkFiles.clear();
+        this.sampleChunks.clear();
+        this.cancelled = false;
+        this.activeQuery = {};
+        this.activeRule = null;
+        this.activeRuleId = null;
+        this.suggestedRule = undefined;
+        this.validatedRuleVersion = undefined;
+        this.selectedFormat = 'unknown';
+        this.emit();
+    }
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    }
+    summary(recentRule) {
+        const levels = {};
+        for (const entry of this.entries)
+            levels[entry.level] = (levels[entry.level] ?? 0) + 1;
+        const times = this.entries
+            .map((entry) => entry.timestamp)
+            .filter(Boolean)
+            .sort();
+        const groups = new Map();
+        for (const entry of this.entries) {
+            const bucket = entry.timestamp?.slice(0, 16) ?? '未知时间';
+            const group = groups.get(bucket) ?? { total: 0, errors: 0, levels: {}, sources: {} };
+            group.total++;
+            if (entry.level === 'ERROR')
+                group.errors++;
+            group.levels[entry.level] = (group.levels[entry.level] ?? 0) + 1;
+            group.sources[entry.file || '未知来源'] = (group.sources[entry.file || '未知来源'] ?? 0) + 1;
+            groups.set(bucket, group);
+        }
+        const errorGroups = new Map();
+        for (const entry of this.entries.filter((item) => item.level === 'ERROR' || item.level === 'WARN')) {
+            const first = entry.message.split(/\r?\n/, 1)[0]?.trim() ||
+                entry.raw.split(/\r?\n/, 1)[0]?.trim() ||
+                '未知消息';
+            const message = normalizeMessageForGrouping(first);
+            const exceptionType = exceptionName(entry);
+            const key = `${entry.level}\0${exceptionType}\0${message}`;
+            const fullStack = entry.raw.split(/\r?\n/).slice(1).filter(Boolean).join('\n');
+            const group = errorGroups.get(key) ?? {
+                level: entry.level,
+                message,
+                count: 0,
+                exceptionType,
+                stack: fullStack.slice(0, 1200),
+                entryIds: [],
+                sample: entry.raw,
+                timeBuckets: {},
+                contextText: '',
+            };
+            group.count++;
+            group.first ??= entry.timestamp;
+            group.last = entry.timestamp;
+            if (group.entryIds.length < 100)
+                group.entryIds.push(entry.id);
+            if (entry.raw.length > group.sample.length)
+                group.sample = entry.raw;
+            const bucket = entry.timestamp?.slice(0, 16);
+            if (bucket)
+                group.timeBuckets[bucket] = (group.timeBuckets[bucket] ?? 0) + 1;
+            errorGroups.set(key, group);
+        }
+        for (const group of errorGroups.values()) {
+            const distribution = Object.entries(group.timeBuckets)
+                .slice(0, 60)
+                .map(([bucket, count]) => `${bucket} 出现 ${count} 次`)
+                .join('\n');
+            group.contextText = [
+                '【日志问题分析请求】',
+                '',
+                '## 问题',
+                group.message || '未知消息',
+                '',
+                '## 统计',
+                `- 出现次数：${group.count}`,
+                `- 首次：${group.first ?? '--'}`,
+                `- 末次：${group.last ?? '--'}`,
+                `- 级别：${group.level}`,
+                '',
+                '## 样例原文',
+                group.sample.split(/\r?\n/).slice(0, 11).join('\n'),
+                '',
+                '## 时间分布',
+                distribution || '暂无时间分布',
+                '',
+                '---',
+                '请分析根因并给出修复建议。',
+            ]
+                .join('\n')
+                .slice(0, 2000);
+        }
+        const hasFailedFiles = this.files.some((file) => file.status === 'failed');
+        const isProcessing = this.files.some((file) => file.status === 'processing');
+        const hasPendingFiles = this.files.some((file) => file.status === 'pending');
+        const status = this.cancelled
+            ? 'cancelled'
+            : isProcessing
+                ? 'processing'
+                : hasFailedFiles
+                    ? 'partial'
+                    : hasPendingFiles
+                        ? 'pending'
+                        : this.files.length
+                            ? 'done'
+                            : 'idle';
+        const reparseRecent = recentRule !== undefined &&
+            (recentRule.id !== this.activeRuleId ||
+                JSON.stringify(recentRule.rule) !== JSON.stringify(this.activeRule));
+        const recentEntries = reparseRecent && recentRule
+            ? this.entries
+                .map((entry) => ({
+                ...parseWithRule(entry.raw, entry.file, entry.line, '', recentRule.rule),
+                id: entry.id,
+            }))
+                .filter((entry) => entry.level === 'ERROR' || entry.level === 'WARN')
+            : this.entries.filter((entry) => entry.level === 'ERROR' || entry.level === 'WARN');
+        return {
+            sessionId: this.sessionId,
+            status,
+            files: this.files,
+            total: this.entries.length,
+            levels,
+            firstTimestamp: times[0],
+            lastTimestamp: times.at(-1),
+            durationCoverage: this.entries.length
+                ? this.entries.filter((entry) => entry.durationMs !== undefined).length /
+                    this.entries.length
+                : 0,
+            topErrors: [...errorGroups.entries()]
+                .sort((a, b) => {
+                const score = (item) => item.count * (item.level === 'ERROR' ? 3 : 2);
+                return score(b[1]) - score(a[1]) || b[1].count - a[1].count || a[0].localeCompare(b[0]);
+            })
+                .slice(0, 10)
+                .map(([key, group]) => ({
+                ...group,
+            })),
+            recent: recentEntries.reverse(),
+            trend: [...groups.entries()].map(([bucket, group]) => ({ bucket, ...group })).slice(-120),
+        };
+    }
+    entry(id) {
+        return this.entries.find((item) => item.id === id);
+    }
+    addRecord(file, raw, lineNumber) {
+        const entry = parseRecord(raw, file.name, lineNumber, file.id, this.activeRule);
+        if (!matchesQuery(entry, this.activeQuery))
+            return;
+        this.entries.push(entry);
+        file.count++;
+        if (entry.level === 'ERROR')
+            file.errors++;
+    }
+    emit() {
+        const value = this.summary();
+        for (const listener of this.listeners)
+            listener(value);
+    }
+}
+function detectFormat(content) {
+    const lines = content.split(/\r?\n/).filter(Boolean).slice(0, 30);
+    if (!lines.length)
+        return 'unknown';
+    const json = lines.filter((line) => {
+        try {
+            const value = JSON.parse(line);
+            return typeof value === 'object' && value !== null && !Array.isArray(value);
+        }
+        catch {
+            return false;
+        }
+    }).length;
+    if (json / lines.length > 0.7)
+        return 'json';
+    if (lines.some((line) => logHeader.test(line)))
+        return 'logback-spring';
+    if (lines.some((line) => timestamp.test(line) && level.test(line)))
+        return 'timestamp-level';
+    return 'unknown';
+}
+function limitSampleToCompleteRecords(content) {
+    const normalized = content.replace(/\r\n?/g, '\n');
+    if (!normalized.trim())
+        throw new Error('样例内容不能为空');
+    if (normalized.length <= MAX_SAMPLE_LENGTH) {
+        if (!splitRecords(normalized, null).length)
+            throw new Error('样例中没有完整日志记录');
+        return normalized;
+    }
+    const prefix = normalized.slice(0, MAX_SAMPLE_LENGTH);
+    const lastBreak = prefix.lastIndexOf('\n');
+    if (lastBreak <= 0)
+        throw new Error('样例在大小限制内没有完整日志记录');
+    const records = splitRecords(prefix.slice(0, lastBreak), null);
+    const complete = records.length > 1
+        ? records.slice(0, -1)
+        : records.length === 1 && records[0].raw.length <= lastBreak
+            ? records
+            : [];
+    if (!complete.length)
+        throw new Error('样例在大小限制内没有完整日志记录');
+    return complete.map((record) => record.raw).join('\n');
+}
+function splitRecords(content, rule) {
+    const output = [];
+    let record = '';
+    let recordLine = 1;
+    let line = 0;
+    for (const rawLine of content.split(/\r?\n/)) {
+        line++;
+        const start = rule ? matchesPattern(rule.recordStart, rawLine) : isLogRecordStart(rawLine);
+        if (start) {
+            if (record)
+                output.push({ raw: record, line: recordLine });
+            record = rawLine;
+            recordLine = line;
+        }
+        else if (record) {
+            record += `\n${rawLine}`;
+        }
+    }
+    if (record)
+        output.push({ raw: record, line: recordLine });
+    return output;
+}
+function sampleRecordsFrom(records, parsed) {
+    return records.map((record, index) => ({
+        raw: record.raw,
+        firstLine: record.raw.split(/\r?\n/, 1)[0]?.trim() || '--',
+        line: record.line,
+        lineCount: record.raw.split(/\r?\n/).length,
+        level: parsed[index]?.level ?? 'UNKNOWN',
+        timestamp: parsed[index]?.timestamp,
+    }));
+}
+function isLogRecordStart(raw) {
+    if (/^\s*\{/.test(raw)) {
+        try {
+            const value = JSON.parse(raw);
+            if (typeof value === 'object' && value !== null && !Array.isArray(value))
+                return true;
+        }
+        catch {
+            /* JSON log records are normally one physical line. */
+        }
+    }
+    return logbackStart.test(raw) || bracketLogbackStart.test(raw);
+}
+function parseRecord(raw, file, lineNumber, fileId, rule) {
+    if (rule)
+        return parseWithRule(raw, file, lineNumber, fileId, rule);
+    let json = {};
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+            json = parsed;
+    }
+    catch {
+        /* Non-JSON log record. */
+    }
+    const head = raw.split(/\r?\n/, 1)[0] ?? raw;
+    const jsonMessage = json.message ?? json.msg;
+    const text = typeof jsonMessage === 'string' ? jsonMessage : raw;
+    const header = head.match(logHeader);
+    const bracketHeader = head.match(bracketLogHeader);
+    const jsonLevel = typeof json.level === 'string' ? json.level.trim() : '';
+    const levelMatch = jsonLevel ||
+        header?.[2]?.toUpperCase() ||
+        bracketHeader?.[1]?.toUpperCase() ||
+        head.match(level)?.[1]?.toUpperCase();
+    const normalized = normalizeLevel(levelMatch);
+    const time = String(json.timestamp ??
+        json.time ??
+        header?.[1] ??
+        bracketHeader?.[2] ??
+        head.match(timestamp)?.[1] ??
+        '');
+    const durationMatch = text.match(duration);
+    const durationValue = json.durationMs ?? json.duration ?? durationMatch?.[1];
+    const durationMs = durationValue === undefined
+        ? undefined
+        : Number(durationValue) * (durationMatch?.[2]?.toLowerCase() === 's' ? 1000 : 1);
+    const serviceName = String(json.service ?? json.svc ?? text.match(service)?.[1] ?? '') || undefined;
+    const fields = { ...json };
+    if (header?.[3] && !fields.threadName)
+        fields.threadName = header[3];
+    if (header?.[4] && !fields.loggerName)
+        fields.loggerName = header[4].trim();
+    const statusCode = Number(json.statusCode ?? json.status ?? text.match(status)?.[1]);
+    return {
+        id: `${fileId}:${lineNumber}`,
+        timestamp: time || undefined,
+        level: normalized,
+        service: serviceName,
+        statusCode: Number.isFinite(statusCode) && statusCode ? statusCode : undefined,
+        durationMs: Number.isFinite(durationMs) ? durationMs : undefined,
+        message: text,
+        raw,
+        file,
+        line: lineNumber,
+        fields: {
+            ...fields,
+            ...(header?.[3] ? { threadName: header[3] } : {}),
+            ...(header?.[4] ? { loggerName: header[4].trim() } : {}),
+        },
+    };
+}
+function parseWithRule(raw, file, lineNumber, fileId, rule) {
+    const extracted = {};
+    for (const [field, spec] of Object.entries(rule.fields)) {
+        if (!spec)
+            continue;
+        const match = raw.match(new RegExp(spec.pattern, 'm'));
+        if (match)
+            extracted[field] = match[1] ?? match[0];
+    }
+    const firstLine = raw.split(/\r?\n/, 1)[0] ?? raw;
+    const levelValue = normalizeLevel(extracted.level);
+    const msg = rule.fields.message ? (extracted.message ?? '') : '';
+    const fields = { ...extracted };
+    if (extracted.loggerName)
+        fields.loggerName = extracted.loggerName;
+    return {
+        id: `${fileId}:${lineNumber}`,
+        timestamp: extracted.timestamp ?? firstLine.match(timestamp)?.[1],
+        level: levelValue,
+        service: extracted.service,
+        message: msg,
+        raw,
+        file,
+        line: lineNumber,
+        fields,
+    };
+}
+function truncateSampleLines(sample, maxLength) {
+    return sample
+        .split(/\r?\n/)
+        .map((line) => line.slice(0, maxLength))
+        .join('\n');
+}
+function parseModelRuleJson(output) {
+    const text = output.replace(/^\uFEFF/, '').trim();
+    if (!text)
+        throw new TypeError('模型没有返回解析规则');
+    const firstJsonToken = text.search(/[\[{]/);
+    if (firstJsonToken === -1)
+        throw new TypeError('模型返回的内容中没有 JSON 对象');
+    if (text[firstJsonToken] === '[')
+        throw new TypeError('模型返回的是数组，不是解析规则对象');
+    const start = text.indexOf('{', firstJsonToken);
+    if (start === -1)
+        throw new TypeError('模型返回的内容中没有 JSON 对象');
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let index = start; index < text.length; index += 1) {
+        const char = text[index];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === '"')
+                inString = false;
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            continue;
+        }
+        if (char === '{')
+            depth += 1;
+        if (char === '}') {
+            depth -= 1;
+            if (depth === 0) {
+                try {
+                    return JSON.parse(text.slice(start, index + 1));
+                }
+                catch {
+                    throw new TypeError('模型返回的 JSON 对象无法解析');
+                }
+            }
+        }
+    }
+    throw new TypeError('模型返回的 JSON 对象不完整');
+}
+function validateParserRule(value) {
+    if (!isRecord(value) ||
+        value.version !== 1 ||
+        typeof value.format !== 'string' ||
+        !value.format.trim() ||
+        typeof value.recordStart !== 'string' ||
+        !isRecord(value.fields) ||
+        value.continuation !== 'until-next-record') {
+        throw new TypeError('模型返回的解析规则结构无效');
+    }
+    const ruleKeys = new Set(['version', 'format', 'recordStart', 'fields', 'continuation']);
+    if (Object.keys(value).some((key) => !ruleKeys.has(key)))
+        throw new TypeError('解析规则包含未知字段');
+    const recordStart = validatePattern(value.recordStart, 'recordStart', true);
+    const fields = {};
+    for (const [key, spec] of Object.entries(value.fields)) {
+        if (!fieldsToCheck.includes(key) ||
+            !isRecord(spec) ||
+            typeof spec.pattern !== 'string')
+            throw new TypeError(`解析规则字段无效：${key}`);
+        if (Object.keys(spec).some((fieldKey) => fieldKey !== 'pattern'))
+            throw new TypeError(`解析规则字段包含未知属性：${key}`);
+        if (!spec.pattern.trim())
+            continue;
+        const pattern = validatePattern(spec.pattern, key, false, true);
+        fields[key] = { pattern };
+    }
+    return {
+        version: 1,
+        format: value.format.slice(0, 80),
+        recordStart,
+        fields,
+        continuation: 'until-next-record',
+    };
+}
+function validatePattern(pattern, label, anchored, requireCapture = false) {
+    // The parser always supplies the multiline flag, so remove the Java/PCRE inline form.
+    pattern = pattern.replace(/^\(\?m\)/, '');
+    let constraint;
+    if (pattern.length === 0)
+        constraint = '正则不能为空';
+    else if (pattern.length > 512)
+        constraint = '正则超过 512 个字符';
+    else if (anchored && !pattern.startsWith('^'))
+        constraint = 'recordStart 必须以 ^ 开头';
+    else if (/\(\?<?[=!]/.test(pattern))
+        constraint = '不支持前瞻或后顾断言';
+    else if (/\\[1-9]|\\k</.test(pattern))
+        constraint = '不支持反向引用';
+    else if (/\([^)]*[+*][^)]*\)[+*{]/.test(pattern))
+        constraint = '不支持含嵌套重复量词的分组';
+    else if (/\\[pP]\{/.test(pattern))
+        constraint = '不支持 Unicode 属性转义';
+    if (constraint)
+        throw new TypeError(`解析规则正则不安全或不符合约束：${displayParserField(label)}（${constraint}；pattern=${JSON.stringify(pattern.slice(0, 180))}）`);
+    try {
+        const expression = new RegExp(pattern, 'm');
+        if (anchored && expression.test(''))
+            throw new TypeError(`解析规则记录起始必须匹配非空内容：${displayParserField(label)}`);
+        if (requireCapture && !hasCaptureGroup(pattern))
+            throw new TypeError(`解析规则字段必须包含首个捕获组：${displayParserField(label)}`);
+        return pattern;
+    }
+    catch (error) {
+        if (error instanceof TypeError &&
+            (error.message.includes('首个捕获组') || error.message.includes('记录起始必须匹配非空内容')))
+            throw error;
+        throw new TypeError(`解析规则正则无效：${displayParserField(label)}（pattern=${JSON.stringify(pattern.slice(0, 180))}）`);
+    }
+}
+function displayParserField(field) {
+    const labels = {
+        recordStart: '记录起始正则',
+        level: '级别',
+        timestamp: '时间',
+        exceptionType: '异常',
+        loggerName: '类名',
+        threadName: '线程',
+        sourceLine: '行号',
+        traceId: 'TraceId',
+        spanId: 'SpanId',
+        service: '服务',
+        mdc: 'MDC',
+        message: '消息',
+    };
+    return labels[field] ?? field;
+}
+function hasCaptureGroup(pattern) {
+    let escaped = false;
+    for (let index = 0; index < pattern.length - 1; index++) {
+        const char = pattern[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === '(' && pattern[index + 1] !== '?')
+            return true;
+    }
+    return false;
+}
+function matchesPattern(pattern, value) {
+    try {
+        return new RegExp(pattern).test(value);
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeLevel(value) {
+    const match = value?.toUpperCase();
+    if (match === 'WARNING')
+        return 'WARN';
+    if (match === 'FATAL')
+        return 'ERROR';
+    return LEVELS.includes(match) ? match : 'UNKNOWN';
+}
+function exceptionName(entry) {
+    const explicit = entry.fields.exceptionType;
+    if (typeof explicit === 'string' && explicit.trim())
+        return explicit.trim();
+    return '';
+}
+function normalizeMessageForGrouping(value) {
+    return value
+        .replace(/[0-9a-f]{8}-[0-9a-f-]{27}/gi, '<UUID>')
+        .replace(/\b(?:\d{1,3}\.){3}\d{1,3}\b/g, '<IP>')
+        .replace(/\b\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[.,]\d+)?(?:Z|[+-]\d{2}:?\d{2})?\b/g, '<TIME>')
+        .replace(/\b\d{2}:\d{2}:\d{2}(?:[.,]\d+)?\b/g, '<TIME>')
+        .replace(/(?:[A-Z]:)?(?:[\\/][\w.-]+){2,}/gi, '<PATH>')
+        .replace(/\b0x[0-9a-f]+\b/gi, '<HEX>')
+        .replace(/\b\d+\b/g, '<NUM>')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+function hasField(entry, field) {
+    if (field === 'timestamp')
+        return Boolean(entry.timestamp);
+    if (field === 'level')
+        return entry.level !== 'UNKNOWN';
+    if (field === 'message')
+        return Boolean(entry.message.trim());
+    if (field === 'service')
+        return Boolean(entry.fields.service ?? entry.service);
+    return Boolean(entry.fields[field]);
+}
+function matchesQuery(entry, query) {
+    return ((!query.level || entry.level === query.level) &&
+        (!query.service || entry.service === query.service) &&
+        (!query.file || entry.file === query.file) &&
+        (!query.ids || query.ids.includes(entry.id)) &&
+        (!query.statusCode || String(entry.statusCode) === query.statusCode) &&
+        (!query.keyword ||
+            safeQueryPattern(query.keyword).test(entry.message) ||
+            safeQueryPattern(query.keyword).test(entry.raw)) &&
+        (!query.from || (entry.timestamp ?? '') >= query.from) &&
+        (!query.to || (entry.timestamp ?? '') <= query.to));
+}
+function safeQueryPattern(pattern) {
+    try {
+        return new RegExp(pattern, 'i');
+    }
+    catch {
+        return /$a/;
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}