@skyhook-io/k8s-ui 1.15.0 → 1.16.0

package/src/utils/log-level.test.ts

@@ -0,0 +1,269 @@
+import { describe, expect, it } from 'vitest'
+import {
+  associateContinuations,
+  detectLevel,
+  groupContinuations,
+  isContinuationLine,
+  normalizeLevel,
+  selectLevelField,
+  type LevelSource,
+  type LogLevel,
+} from './log-level'
+import { applySearchMode } from '../components/logs/useLogSearch'
+
+// Lines taken from real clusters (lightly shortened), grouped by the library that wrote them.
+const CASES: [string, string, LogLevel, LevelSource][] = [
+  // klog — most Kubernetes controllers
+  ['klog error', 'E0929 22:27:48.228549       1 controller.go:157] "re-queuing item due to error processing" err="secrets \\"capi-serving-cert-\\" is forbidden"', 'error', 'header'],
+  ['klog info', 'I0929 22:27:51.404929       1 reflector.go:376] Caches populated for *v1.Gateway from k8s.io/client-go@v0.32.0/tools/cache/reflector.go:251', 'info', 'header'],
+  ['klog warning', 'W0930 10:00:00.000001       1 warnings.go:70] v1 Endpoints is deprecated in v1.33+', 'warn', 'header'],
+  ['klog fatal', 'F0930 10:00:00.000001       1 main.go:12] cannot start', 'error', 'header'],
+
+  // logfmt — Argo CD, Grafana, slog text (Prometheus, Beyla), logrus
+  ['logfmt level beats message words', 'time=2026-09-30T10:00:00Z level=info msg="retrying after error: connection reset"', 'info', 'structured'],
+  ['two-pair logfmt', 'level=info msg="retrying after error"', 'info', 'structured'],
+  ['argocd', 'time="2026-09-29T22:28:21Z" level=info msg="started call" grpc.component=server grpc.method=GetGitFiles', 'info', 'structured'],
+  ['slog uppercase', 'time=2026-09-12T22:00:43.702Z level=WARN msg="can\'t fetch Kubernetes Cluster Name"', 'warn', 'structured'],
+  ['prometheus warning text at INFO', 'time=2026-09-25T09:12:00.796Z level=INFO source=warnings.go:107 msg="Warning: v1 Endpoints is deprecated in v1.33+; use discovery.k8s.io/v1 EndpointSlice"', 'info', 'structured'],
+  ['grafana', 'logger=dashboard-service t=2026-09-29T22:28:31.732506197Z level=info msg="No last resource version found, starting from scratch" orgID=1', 'info', 'structured'],
+  ['header level before a level= pair in the message', '2026-09-30T10:00:00Z ERROR request failed level=debug', 'error', 'header'],
+  ['level inside quoted message', 'msg="upstream said level=error" level=info', 'info', 'structured'],
+  ['unrecognized structured level', 'level=custom_level msg="error happened"', 'unknown', 'structured'],
+
+  // JSON — zap, controller-runtime, pino, GCP, ECS
+  ['zap json', '{"level":"error","ts":"2026-09-29T22:20:12.561715963Z","msg":"Reconciler error","controller":"cluster"}', 'error', 'structured'],
+  ['json info with error key', '{"level":"info","ts":"2026-09-29T20:42:20.831Z","message":"RequestCompleted HTTP/1.1 GET / 404","error":null}', 'info', 'structured'],
+  ['pino numeric wins over severity text', '{"severity":"ERROR","level":50,"time":1790720767281,"errmsg":"Authentication failed."}', 'error', 'structured'],
+  ['gcp severity', '{"time":"2026-09-29T12:18:58.483192609Z","severity":"INFO","message":"[audit] retention sweep"}', 'info', 'structured'],
+  ['logfmt dotted level key', 'time=2026-09-30T10:00:00Z log.level=info msg="retry after error"', 'info', 'structured'],
+  ['ecs dotted key', '{"@timestamp":"2026-09-30T10:00:00Z","log.level":"warn","message":"slow"}', 'warn', 'structured'],
+  ['ecs nested', '{"log":{"level":"debug"},"message":"cache miss"}', 'debug', 'structured'],
+  ['empty level falls through to next field', '{"level":"","severity":"error","msg":"failed"}', 'error', 'structured'],
+  ['json without level, null error', '{"msg":"ok","error":null}', 'unknown', 'none'],
+
+  // Console encoders and Java/Python loggers — level word in the line header
+  ['zap console', '2026-09-29T22:19:30.112Z\tERROR\tprovider\tkubernetes/controller.go:639\tfailed to get Service\t{"runner": "provider"}', 'error', 'header'],
+  ['zap console info', '2026-09-29T22:26:08.897Z\tINFO\tinfrastructure\trunner/runner.go:100\treceived an update', 'info', 'header'],
+  ['zap verbosity', '2026-09-29T22:20:31Z\tLEVEL(-2)\tReconciling JobSet\t{"controller": "jobset"}', 'debug', 'header'],
+  ['zerolog console', '2026-09-25T11:58:46Z WRN Controller is running', 'warn', 'header'],
+  ['zerolog console info', '2026-09-25T11:58:46Z INF Starting controllers', 'info', 'header'],
+  ['log4j kafka', '[2026-09-29 22:12:42,867] INFO [SnapshotEmitter id=0] Successfully wrote snapshot (org.apache.kafka.image.publisher.SnapshotEmitter)', 'info', 'header'],
+  ['java agent prefix', '[otel.javaagent 2026-09-29 22:31:56:986 +0000] [EndpointMetricCollector] INFO software.amazon.opentelemetry.EndpointCollector - Error rate 0', 'info', 'header'],
+  ['python logging', 'WARNING:root:disk almost full', 'warn', 'header'],
+  ['nginx error log', '2026/09/30 10:00:00 [error] 29#29: *1 connect() failed (111: Connection refused)', 'error', 'header'],
+  ['nestjs with ANSI colours', '\x1b[31m[Nest] 1  - \x1b[39m09/29/2026, 10:23:14 PM \x1b[31m  ERROR\x1b[39m \x1b[38;5;3m[MongooseModule] \x1b[39m\x1b[31mUnable to connect to the database.\x1b[39m', 'error', 'header'],
+  ['nestjs LOG', '[Nest] 1  - 09/29/2026, 10:23:14 PM     LOG [RoutesResolver] AppController {/}:', 'info', 'header'],
+
+  ['clickhouse', '2026.09.29 22:30:12.093808 [ 31 ] {} <Information> KeeperTCPHandler: Receiving request for session 36 took 4421 ms', 'info', 'header'],
+  ['clickhouse error', '2026.09.29 22:30:12.093808 [ 31 ] {} <Error> TCPHandler: Code: 210. DB::NetException', 'error', 'header'],
+  ['cloudwatch agent', '2026-09-29T20:38:42Z I! {"caller":"k8sapiserver/k8sapiserver.go:128","msg":"collect data from K8s API Server..."}', 'info', 'header'],
+  ['cloudwatch agent error', '2026-09-29T20:38:42Z E! [outputs.cloudwatchlogs] Aws error received when sending logs', 'error', 'header'],
+  ['supervisord', "2026-09-29 22:33:00,972 DEBG 'nginx' stdout output:", 'debug', 'header'],
+  ['envoy bracketed', '[2026-09-29 22:43:46.517][1][info][main] [source/server/server.cc:493]   request header map: 664 bytes', 'info', 'header'],
+
+  // Unstructured text — keyword fallback
+  ['exception head', 'MongoServerError: Authentication failed.', 'error', 'keyword'],
+  ['node error code', 'TypeError [ERR_INVALID_ARG_TYPE]: The "path" argument must be of type string', 'error', 'keyword'],
+  ['logfmt empty level falls through', 'level= severity=error msg="failed"', 'error', 'structured'],
+  ['java exception head', 'java.lang.IllegalStateException: Connection pool shut down', 'error', 'keyword'],
+  ['python traceback', 'Traceback (most recent call last):', 'error', 'keyword'],
+  ['go panic', 'panic: runtime error: invalid memory address or nil pointer dereference', 'error', 'keyword'],
+  ['plain warning', 'deprecated flag used, warning: will be removed', 'warn', 'keyword'],
+  ['key names are not severities', 'GET /healthz 200 errors=0 debug=false', 'unknown', 'none'],
+  ['stack trace word is not debug', 'printing stack trace for request 42', 'unknown', 'none'],
+  ['access log', '10.0.0.1 - - [30/Sep/2026:10:00:00 +0000] "GET / HTTP/1.1" 200 612', 'unknown', 'none'],
+]
+
+describe('detectLevel', () => {
+  it.each(CASES)('%s', (_name, line, level, source) => {
+    expect(detectLevel(line)).toEqual({ level, source })
+  })
+})
+
+describe('normalizeLevel', () => {
+  it('treats absent values as no level and unrecognized names as unknown', () => {
+    expect(normalizeLevel(undefined)).toBeNull()
+    expect(normalizeLevel('')).toBeNull()
+    expect(normalizeLevel({ name: 'error' })).toBeNull()
+    expect(normalizeLevel('custom')).toBe('unknown')
+  })
+
+  it('maps pino numbers, including as strings', () => {
+    expect(normalizeLevel(60)).toBe('error')
+    expect(normalizeLevel('40')).toBe('warn')
+    expect(normalizeLevel(30)).toBe('info')
+    expect(normalizeLevel(10)).toBe('debug')
+  })
+})
+
+describe('selectLevelField', () => {
+  it('returns the raw value of the field the level came from', () => {
+    expect(selectLevelField({ level: '', severity: 'ERROR' })).toEqual({ raw: 'ERROR', level: 'error' })
+    expect(selectLevelField({ msg: 'x' })).toBeNull()
+  })
+})
+
+interface TestEntry {
+  id: number
+  content: string
+  level: LogLevel
+  levelSource: LevelSource
+  pod?: string
+  container: string
+}
+
+function entry(id: number, content: string, pod = 'a'): TestEntry {
+  const { level, source } = detectLevel(content)
+  return { id, content, level, levelSource: source, pod, container: 'app' }
+}
+
+describe('isContinuationLine', () => {
+  it.each([
+    ['\tat com.example.Pool.get(Pool.java:10)', true],
+    ['Caused by: java.io.IOException: closed', true],
+    ['\x1b[90m    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)', true],
+    ['}', true],
+    ['});', true],
+    ['goroutine 1 [running]:', true],
+    ['main.main()', true],
+    ['net/http.(*conn).serve(0xc000112000, {0x1a2b3c, 0x4})', true],
+    ['created by net/http.(*Server).Serve in goroutine 1', true],
+    ['Starting server (version 1.2)', false],
+    ['GET /api/v1/pods(list)', false],
+    ['I0929 22:27:51.404929       1 reflector.go:376] Caches populated', false],
+  ])('%s', (line, expected) => {
+    expect(isContinuationLine(line)).toBe(expected)
+  })
+
+  it('keeps a Python traceback together, closing line included', () => {
+    const lines = [
+      entry(0, 'Traceback (most recent call last):'),
+      entry(1, '  File "/app/main.py", line 7, in <module>'),
+      entry(2, 'ValueError: bad config'),
+      entry(3, 'ValueError: a separate error'),
+    ]
+    expect(associateContinuations(lines).headOf).toEqual([0, 0, 0, 3])
+  })
+
+  it('closes a traceback with a generic exception name', () => {
+    const lines = [
+      entry(0, 'Traceback (most recent call last):'),
+      entry(1, '  File "/app/main.py", line 1, in <module>'),
+      entry(2, '    raise Exception("boom")'),
+      entry(3, 'Exception: boom'),
+      entry(4, 'Traceback (most recent call last):'),
+      entry(5, 'KeyboardInterrupt'),
+    ]
+    expect(associateContinuations(lines).headOf).toEqual([0, 0, 0, 0, 4, 4])
+  })
+
+  it('keeps an indented source line with a level word inside its traceback', () => {
+    const lines = [
+      entry(0, 'Traceback (most recent call last):'),
+      entry(1, '  File "/app/main.py", line 2, in <module>'),
+      entry(2, '    ERROR = "boom"'),
+      entry(3, 'ValueError: bad'),
+    ]
+    expect(lines[2].levelSource).toBe('header')
+    expect(associateContinuations(lines).headOf).toEqual([0, 0, 0, 0])
+  })
+
+  it('keeps a Go panic together as one error record', () => {
+    const lines = [
+      entry(0, 'panic: runtime error: invalid memory address or nil pointer dereference'),
+      entry(1, 'goroutine 1 [running]:'),
+      entry(2, 'main.main()'),
+      entry(3, '\t/app/main.go:12 +0x1d'),
+    ]
+    expect(associateContinuations(lines).effectiveLevel).toEqual(['error', 'error', 'error', 'error'])
+  })
+})
+
+describe('associateContinuations', () => {
+  const nodeTrace = [
+    entry(0, '[Nest] 1  - 09/29/2026, 10:25:37 PM   ERROR [ExceptionHandler] MongoServerError: Authentication failed.'),
+    entry(1, 'MongoServerError: Authentication failed.'),
+    entry(2, '    at Connection.sendCommand (/app/node_modules/mongodb/lib/cmap/connection.js:306:27)'),
+    entry(3, '    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)'),
+    entry(4, '[Nest] 1  - 09/29/2026, 10:25:38 PM     LOG [NestApplication] Nest application successfully started'),
+  ]
+
+  it('gives stack frames the level of the line that started their record', () => {
+    const { headOf, effectiveLevel } = associateContinuations(nodeTrace)
+    expect(headOf).toEqual([0, 1, 1, 1, 4])
+    expect(effectiveLevel).toEqual(['error', 'error', 'error', 'error', 'info'])
+  })
+
+  it('keeps a frame whose text contains a level word inside its record', () => {
+    const lines = [
+      entry(0, '2026-09-30 10:00:00 ERROR [main] request failed'),
+      entry(1, '    at example.debug.Handler.run(Handler.java:42)'),
+    ]
+    expect(lines[1].levelSource).toBe('keyword')
+    expect(associateContinuations(lines).effectiveLevel).toEqual(['error', 'error'])
+  })
+
+  it('does not splice interleaved pods into each other\'s traces', () => {
+    const lines = [
+      entry(0, 'java.lang.IllegalStateException: pool closed', 'a'),
+      entry(1, 'GET /healthz 200', 'b'),
+      entry(2, '\tat com.example.Pool.get(Pool.java:10)', 'a'),
+      entry(3, '\tat com.example.Pool.get(Pool.java:10)', 'c'),
+    ]
+    const { headOf, effectiveLevel } = associateContinuations(lines)
+    expect(headOf).toEqual([0, 1, 0, 3])
+    expect(effectiveLevel[2]).toBe('error')
+    // A continuation with no earlier line from its own source starts its own record.
+    expect(effectiveLevel[3]).toBe('unknown')
+  })
+})
+
+describe('groupContinuations', () => {
+  const lines = [
+    entry(0, 'java.lang.IllegalStateException: pool closed', 'a'),
+    entry(1, 'GET /healthz 200', 'b'),
+    entry(2, '\tat com.example.Pool.get(Pool.java:10)', 'a'),
+    entry(3, '\tat com.example.Main.run(Main.java:5)', 'a'),
+  ]
+  const { headOf } = associateContinuations(lines)
+  const headIdById = new Map<number, number>()
+  headOf.forEach((h, i) => { if (h !== i) headIdById.set(lines[i].id, lines[h].id) })
+
+  it('groups frames under their own pod\'s record, not the previous row', () => {
+    const groups = groupContinuations(lines, headIdById)
+    expect(groups.map(g => [g.head.id, g.continuations.map(c => c.id)])).toEqual([[0, [2, 3]], [1, []]])
+  })
+
+  it('leaves frames on their own rows when their record start is filtered out', () => {
+    const groups = groupContinuations(lines.slice(1), headIdById)
+    expect(groups.map(g => g.head.id)).toEqual([1, 2, 3])
+  })
+
+  const recordIdOf = (e: TestEntry) => headIdById.get(e.id) ?? e.id
+
+  it('hides a whole record when its first line matches', () => {
+    expect(applySearchMode(lines, [0], 'hide', recordIdOf).map(e => e.id)).toEqual([1])
+  })
+
+  it('hides a whole record when only a frame matches', () => {
+    expect(applySearchMode(lines, [3], 'hide', recordIdOf).map(e => e.id)).toEqual([1])
+  })
+
+  it('shows a whole record, error line included, when only a frame matches', () => {
+    expect(applySearchMode(lines, [3], 'only', recordIdOf).map(e => e.id)).toEqual([0, 2, 3])
+  })
+})
+
+describe('applySearchMode', () => {
+  const lines = [{ id: 0 }, { id: 1 }, { id: 2 }, { id: 3 }]
+  const ids = (xs: { id: number }[]) => xs.map(x => x.id)
+  it('shows everything when highlighting', () => {
+    expect(ids(applySearchMode(lines, [1, 3], 'highlight'))).toEqual([0, 1, 2, 3])
+  })
+  it('keeps only matches', () => {
+    expect(ids(applySearchMode(lines, [1, 3], 'only'))).toEqual([1, 3])
+  })
+  it('drops matches when hiding', () => {
+    expect(ids(applySearchMode(lines, [1, 3], 'hide'))).toEqual([0, 2])
+  })
+})

package/src/utils/log-level.ts

@@ -0,0 +1,301 @@
+import { stripAnsi } from './log-format'
+import type { LogEntry } from '../components/logs/useLogBuffer'
+
+export type LogLevel = 'error' | 'warn' | 'info' | 'debug' | 'unknown'
+
+/**
+ * Where a line's level came from. `structured` and `header` are the line
+ * stating its own severity; `keyword` is a guess from words in the message, so
+ * it must not override a line's membership in a stack trace or a structured
+ * field that says otherwise.
+ */
+export type LevelSource = 'structured' | 'header' | 'keyword' | 'none'
+
+export interface DetectedLevel {
+  level: LogLevel
+  source: LevelSource
+}
+
+const ERROR_NAMES = new Set(['error', 'err', 'eror', 'fatal', 'ftl', 'panic', 'pnc', 'dpanic', 'critical', 'crit', 'alert', 'emerg', 'emergency', 'severe'])
+const WARN_NAMES = new Set(['warn', 'warning', 'wrn'])
+const INFO_NAMES = new Set(['info', 'inf', 'information', 'notice', 'log'])
+const DEBUG_NAMES = new Set(['debug', 'dbg', 'debg', 'trace', 'trc', 'verbose', 'fine', 'finer', 'finest'])
+
+function levelFromNumber(n: number): LogLevel {
+  // Pino/bunyan: 10 trace, 20 debug, 30 info, 40 warn, 50 error, 60 fatal
+  if (n >= 50) return 'error'
+  if (n >= 40) return 'warn'
+  if (n >= 30) return 'info'
+  return 'debug'
+}
+
+/**
+ * Map a raw level value to a LogLevel. Returns null when the value carries no
+ * level at all (missing, empty, non-scalar) so callers can fall through to the
+ * next source; a present but unrecognized name is `unknown`.
+ */
+export function normalizeLevel(raw: unknown): LogLevel | null {
+  if (typeof raw === 'number') return Number.isFinite(raw) ? levelFromNumber(raw) : null
+  if (typeof raw !== 'string') return null
+  const v = raw.trim().toLowerCase()
+  if (!v) return null
+  if (/^\d+$/.test(v)) return levelFromNumber(Number(v))
+  if (ERROR_NAMES.has(v)) return 'error'
+  if (WARN_NAMES.has(v)) return 'warn'
+  if (INFO_NAMES.has(v)) return 'info'
+  if (DEBUG_NAMES.has(v)) return 'debug'
+  // zap/logr verbosity levels render as LEVEL(-2)
+  if (/^level\(-\d+\)$/.test(v)) return 'debug'
+  return 'unknown'
+}
+
+const LEVEL_FIELD_KEYS = ['level', 'lvl', 'severity', 'levelname', 'log.level'] as const
+
+/**
+ * Pick the level field of a structured record. Shared by detection and the
+ * structured-line badge so the badge text and the line's resolved level always
+ * come from the same field.
+ */
+export function selectLevelField(obj: Record<string, unknown>): { raw: unknown; level: LogLevel } | null {
+  for (const key of LEVEL_FIELD_KEYS) {
+    const level = normalizeLevel(obj[key])
+    if (level) return { raw: obj[key], level }
+  }
+  const log = obj.log
+  if (log && typeof log === 'object' && !Array.isArray(log)) {
+    const raw = (log as Record<string, unknown>).level
+    const level = normalizeLevel(raw)
+    if (level) return { raw, level }
+  }
+  return null
+}
+
+// Same tokenization as parseLogfmt: a quoted value is consumed whole, so a
+// `level=` inside a quoted message is never read as the line's own level.
+const LOGFMT_PAIR_RE = /(?:^|\s)([a-zA-Z_][\w.]*)=((?:"(?:[^"\\]|\\.)*")|(?:[^\s]*))/g
+const LOGFMT_LEVEL_KEYS = new Set(['level', 'lvl', 'severity', 'log.level'])
+const LOGFMT_LEVEL_HINT = /(?:^|\s)(?:level|lvl|severity|log\.level)=/
+
+interface PlacedLevel {
+  level: LogLevel
+  /** Where in the line the level marker starts */
+  at: number
+}
+
+function logfmtLevel(line: string): PlacedLevel | null {
+  if (!LOGFMT_LEVEL_HINT.test(line)) return null
+  const re = LOGFMT_PAIR_RE
+  re.lastIndex = 0
+  let match: RegExpExecArray | null
+  while ((match = re.exec(line)) !== null) {
+    if (!LOGFMT_LEVEL_KEYS.has(match[1])) continue
+    let value = match[2]
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) value = value.slice(1, -1)
+    const level = normalizeLevel(value)
+    if (level) return { level, at: match.index }
+  }
+  return null
+}
+
+// klog: Lmmdd hh:mm:ss.uuuuuu threadid file:line]
+const KLOG_RE = /^([IWEF])\d{4} \d{2}:\d{2}:\d{2}\.\d+\s/
+const KLOG_LEVELS: Record<string, LogLevel> = { I: 'info', W: 'warn', E: 'error', F: 'error' }
+
+// A standalone uppercase level word near the start of the line: zap and
+// zerolog console output, logback/log4j, Python logging, NestJS. The window
+// covers prefixes such as timestamps, thread names and agent tags.
+const HEADER_WINDOW = 100
+const HEADER_TOKEN_RE = /(?:^|[\s[<|(])(TRACE|TRC|DEBUG|DBG|DEBG|VERBOSE|INFO|INF|LOG|NOTICE|WARN|WARNING|WRN|ERROR|ERR|FATAL|FTL|PANIC|PNC|DPANIC|CRITICAL|CRIT|SEVERE|LEVEL\(-\d+\))(?=$|[\s\]>|:)])/
+// `[error]` (nginx, envoy), `<Information>` (ClickHouse)
+const BRACKETED_TOKEN_RE = /[[<](trace|debug|information|info|notice|warning|warn|error|critical|crit|alert|emerg|fatal)[\]>]/i
+// telegraf and the CloudWatch agent: `2026-09-29T20:38:42Z E! message`
+const BANG_PREFIX_RE = /^\S+\s([DIWE])!\s/
+const BANG_LEVELS: Record<string, LogLevel> = { D: 'debug', I: 'info', W: 'warn', E: 'error' }
+
+function headerLevel(line: string): PlacedLevel | null {
+  const klog = KLOG_RE.exec(line)
+  if (klog) return { level: KLOG_LEVELS[klog[1]], at: 0 }
+  const bang = BANG_PREFIX_RE.exec(line)
+  if (bang) return { level: BANG_LEVELS[bang[1]], at: 0 }
+  const head = line.slice(0, HEADER_WINDOW)
+  const token = HEADER_TOKEN_RE.exec(head)
+  const tokenLevel = token && normalizeLevel(token[1])
+  if (token && tokenLevel) return { level: tokenLevel, at: token.index }
+  const bracketed = BRACKETED_TOKEN_RE.exec(head)
+  const bracketedLevel = bracketed && normalizeLevel(bracketed[1])
+  if (bracketed && bracketedLevel) return { level: bracketedLevel, at: bracketed.index }
+  return null
+}
+
+// A word followed by `=` is a key name (`errors=0`, `debug=false`), and a JSON
+// key with an empty value says nothing happened.
+const NOT_A_KEY = String.raw`(?!\s*=)(?!"\s*:\s*(?:null|false|0|""|\[\]|\{\})\s*[,}])`
+const KEYWORD_ERROR_RE = new RegExp(String.raw`\b(?:error|fatal|panic|critical|crit|exception)\b` + NOT_A_KEY)
+const KEYWORD_WARN_RE = new RegExp(String.raw`\b(?:warn|warning)\b` + NOT_A_KEY)
+const KEYWORD_DEBUG_RE = new RegExp(String.raw`\bdebug\b` + NOT_A_KEY)
+const KEYWORD_INFO_RE = new RegExp(String.raw`\binfo\b` + NOT_A_KEY)
+const PYTHON_TRACEBACK_HEAD = 'Traceback (most recent call last):'
+// The unindented line that ends a traceback: `ValueError: bad`, `Exception: boom`, `KeyboardInterrupt`
+const PYTHON_EXCEPTION_LINE_RE = /^[A-Za-z_][\w.]*(?::|$)/
+// The first line of an exception: `MongoServerError: ...`, `java.lang.IllegalStateException`,
+// `Traceback (most recent call last):`.
+const EXCEPTION_HEAD_RE = /^(?:(?:[\w$]+\.)*[A-Z][\w$]*(?:Error|Exception)(?: \[[\w-]+\])?(?::|\s*$)|Traceback \(most recent call last\):)/
+
+function keywordLevel(line: string): LogLevel | null {
+  if (EXCEPTION_HEAD_RE.test(line)) return 'error'
+  const lower = line.toLowerCase()
+  if (KEYWORD_ERROR_RE.test(lower)) return 'error'
+  if (KEYWORD_WARN_RE.test(lower)) return 'warn'
+  if (KEYWORD_DEBUG_RE.test(lower)) return 'debug'
+  if (KEYWORD_INFO_RE.test(lower)) return 'info'
+  return null
+}
+
+/**
+ * Resolve a log line's severity. Sources are tried from most to least
+ * authoritative, and the first that yields a level wins: a structured field,
+ * then a header the logging library wrote, then words in the message.
+ */
+export function detectLevel(content: string): DetectedLevel {
+  const line = content.includes('\x1b') ? stripAnsi(content) : content
+  const trimmed = line.trim()
+
+  if (trimmed[0] === '{' && trimmed[trimmed.length - 1] === '}') {
+    try {
+      const obj = JSON.parse(trimmed)
+      if (obj && typeof obj === 'object' && !Array.isArray(obj)) {
+        const selected = selectLevelField(obj as Record<string, unknown>)
+        if (selected) return { level: selected.level, source: 'structured' }
+      }
+    } catch {}
+  }
+
+  // A console line can carry key=value pairs in its message, so between a
+  // header level word and a `level=` pair the one written first is the
+  // line's own.
+  const fromHeader = headerLevel(line.trimEnd())
+  const fromLogfmt = trimmed[0] === '{' ? null : logfmtLevel(line.trimEnd())
+  if (fromLogfmt && (!fromHeader || fromLogfmt.at <= fromHeader.at)) return { level: fromLogfmt.level, source: 'structured' }
+  if (fromHeader) return { level: fromHeader.level, source: 'header' }
+
+  const fromKeyword = keywordLevel(trimmed)
+  if (fromKeyword) return { level: fromKeyword, source: 'keyword' }
+
+  return { level: 'unknown', source: 'none' }
+}
+
+export function detectLogLevel(content: string): LogLevel {
+  return detectLevel(content).level
+}
+
+const LEADING_ANSI_RE = /^(?:\x1b\[[0-9;]*m)+/
+
+// `goroutine 1 [running]:`, `main.main()`, `net/http.(*conn).serve(0xc000112000, {0x1a2b3c, 0x4})`,
+// `created by net/http.(*Server).Serve in goroutine 1`
+const GO_PANIC_LINE_RE = /^(?:goroutine \d+ \[[^\]]*\]:$|created by \S+|[\w./-]*[\w)\]]\.[\w*().[\]{}-]*\((?:[^()]|\([^()]*\))*\)$)/
+
+/**
+ * Lines that continue the previous line's record rather than starting a new
+ * one: stack frames and wrapped detail, which almost always start indented.
+ */
+export function isContinuationLine(raw: string): boolean {
+  return isIndented(raw) || looksLikeUnindentedFrame(raw)
+}
+
+// Java `\tat com.foo.Bar`, Go `\tpackage.func`, Node `    at func`, Python `  File "..."`.
+function isIndented(raw: string): boolean {
+  // Colored output (Node's inspector) can put an escape code ahead of the indentation.
+  const content = raw.charCodeAt(0) === 0x1b ? raw.replace(LEADING_ANSI_RE, '') : raw
+  return /^\s/.test(content)
+}
+
+function looksLikeUnindentedFrame(content: string): boolean {
+  // Java's secondary chain markers that don't start with whitespace.
+  if (/^(Caused by:|Suppressed:|\.\.\. \d+ more)/.test(content)) return true
+  // The closing bracket of an object printed across lines (Node's util.inspect).
+  if (/^[}\])]+[;,]?$/.test(content)) return true
+  // A Go panic prints its goroutine header and function frames unindented;
+  // only the file:line under each frame is indented.
+  if (content.startsWith('goroutine ') || content.startsWith('created by ')) return GO_PANIC_LINE_RE.test(content)
+  const paren = content.indexOf('(')
+  if (paren <= 0 || !content.endsWith(')') || content.lastIndexOf(' ', paren) !== -1) return false
+  return GO_PANIC_LINE_RE.test(content)
+}
+
+interface AssociableEntry {
+  content: string
+  level: LogLevel
+  levelSource?: LevelSource
+  pod?: string
+  container: string
+}
+
+export interface ContinuationAssociation {
+  /** Index of the record's first line for each entry; equals the entry's own index for a head. */
+  headOf: number[]
+  /** The level filters should use: a continuation carries its record's level. */
+  effectiveLevel: LogLevel[]
+}
+
+/**
+ * Link each continuation line to the record it belongs to, per pod and
+ * container, so a filter keeps or drops a stack trace together with its
+ * first line and interleaved pods never splice into each other's traces.
+ */
+export function associateContinuations(entries: readonly AssociableEntry[]): ContinuationAssociation {
+  const headOf = new Array<number>(entries.length)
+  const effectiveLevel = new Array<LogLevel>(entries.length)
+  const lastHeadBySource = new Map<string, number>()
+  // Sources whose current record is a Python traceback still waiting for its
+  // closing `ValueError: ...` line, which Python prints unindented.
+  const openTraceback = new Set<string>()
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i]
+    const source = `${entry.pod ?? ''}\x00${entry.container}`
+    const lastHead = lastHeadBySource.get(source)
+    // Indentation always continues a record, even when a frame's source text
+    // holds a level word; the unindented patterns yield to a line's own level.
+    const explicit = entry.levelSource === 'structured' || entry.levelSource === 'header'
+    const closesTraceback = openTraceback.has(source) && PYTHON_EXCEPTION_LINE_RE.test(entry.content)
+    const continues = isIndented(entry.content) || (!explicit && (closesTraceback || looksLikeUnindentedFrame(entry.content)))
+    if (lastHead !== undefined && continues) {
+      headOf[i] = lastHead
+      effectiveLevel[i] = effectiveLevel[lastHead]
+      if (closesTraceback) openTraceback.delete(source)
+    } else {
+      headOf[i] = i
+      effectiveLevel[i] = entry.level
+      lastHeadBySource.set(source, i)
+      if (entry.content.startsWith(PYTHON_TRACEBACK_HEAD)) openTraceback.add(source)
+      else openTraceback.delete(source)
+    }
+  }
+  return { headOf, effectiveLevel }
+}
+
+export interface LogGroup<T extends { id: number } = LogEntry> {
+  head: T
+  continuations: T[]
+}
+
+/**
+ * Fold visible lines into records using `headIdById` (continuation id → id of
+ * its record's first line). A line whose record start is not visible keeps
+ * its own row rather than attaching to an unrelated neighbour.
+ */
+export function groupContinuations<T extends { id: number }>(visible: readonly T[], headIdById: ReadonlyMap<number, number>): LogGroup<T>[] {
+  const groups: LogGroup<T>[] = []
+  const groupByHeadId = new Map<number, LogGroup<T>>()
+  for (const entry of visible) {
+    const headId = headIdById.get(entry.id)
+    const headGroup = headId !== undefined ? groupByHeadId.get(headId) : undefined
+    if (headGroup) {
+      headGroup.continuations.push(entry)
+    } else {
+      const group: LogGroup<T> = { head: entry, continuations: [] }
+      groups.push(group)
+      groupByHeadId.set(entry.id, group)
+    }
+  }
+  return groups
+}

package/src/utils/resource-hierarchy.test.ts

@@ -1039,6 +1039,75 @@ describe('group-qualified lane identity', () => {
     expect(lanes.map((lane) => lane.id)).toEqual(['Cluster.postgresql.cnpg.io/prod/main'])
   })
 
+  it("builds a workload's detail lanes from its scoped history without its Service's other backends", () => {
+    const events = [
+      changeEvent('Deployment', 'prod', 'web', { apiVersion: 'apps/v1' }),
+      changeEvent('ReplicaSet', 'prod', 'web-1', { apiVersion: 'apps/v1', owner: { kind: 'Deployment', name: 'web' } }),
+      changeEvent('Pod', 'prod', 'web-1-a', { apiVersion: 'v1', owner: { kind: 'ReplicaSet', name: 'web-1' } }),
+      changeEvent('Service', 'prod', 'web', { apiVersion: 'v1' }),
+    ]
+    // The Service also fronts a sibling Deployment; with scoped history the
+    // sibling has no events, so nothing of it may appear.
+    const topology = {
+      nodes: [
+        { id: 'service/prod/web', kind: 'Service', name: 'web', status: 'healthy', data: { namespace: 'prod', apiVersion: 'v1' } },
+        { id: 'deployment/prod/web', kind: 'Deployment', name: 'web', status: 'healthy', data: { namespace: 'prod', apiVersion: 'apps/v1' } },
+        { id: 'deployment/prod/api', kind: 'Deployment', name: 'api', status: 'healthy', data: { namespace: 'prod', apiVersion: 'apps/v1' } },
+      ],
+      edges: [
+        { id: 'e1', source: 'service/prod/web', target: 'deployment/prod/web', type: 'exposes' },
+        { id: 'e2', source: 'service/prod/web', target: 'deployment/prod/api', type: 'exposes' },
+      ],
+    } as unknown as Topology
+    const lanes = buildResourceHierarchy({
+      events,
+      topology,
+      rootResource: { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'web' },
+      groupByApp: true,
+    })
+    const ids = getAllEventsFromHierarchy(lanes).map((e) => e.id).sort()
+    expect(ids).toEqual(['Deployment/prod/web', 'Pod/prod/web-1-a', 'ReplicaSet/prod/web-1', 'Service/prod/web'])
+    const laneNames: string[] = []
+    const walk = (list: ResourceLane[]) => list.forEach((l) => { laneNames.push(l.name); walk(l.children ?? []) })
+    walk(lanes)
+    expect(laneNames).not.toContain('api')
+  })
+
+  describe('history already scoped to the root', () => {
+    const laneNames = (lanes: ResourceLane[]) => {
+      const out: string[] = []
+      const walk = (list: ResourceLane[]) => list.forEach((l) => { out.push(`${l.kind}/${l.name}`); walk(l.children ?? []) })
+      walk(lanes)
+      return out.sort()
+    }
+    const build = (root: { kind: string; group: string; name: string }, events: TimelineEvent[], eventsScopedToRoot: boolean) =>
+      buildResourceHierarchy({ events, rootResource: { ...root, namespace: 'prod' }, eventsScopedToRoot, groupByApp: true })
+
+    it("keeps a StatefulSet's ownerless Pod", () => {
+      const events = [
+        changeEvent('StatefulSet', 'prod', 'db', { apiVersion: 'apps/v1' }),
+        changeEvent('Pod', 'prod', 'db-2', { apiVersion: 'v1' }),
+      ]
+      const root = { kind: 'StatefulSet', group: 'apps', name: 'db' }
+      expect(laneNames(build(root, events, false))).toEqual(['StatefulSet/db'])
+      const lanes = build(root, events, true)
+      expect(laneNames(lanes)).toEqual(['Pod/db-2', 'StatefulSet/db'])
+      expect(getAllEventsFromHierarchy(lanes).map((e) => e.id).sort()).toEqual(['Pod/prod/db-2', 'StatefulSet/prod/db'])
+    })
+
+    it("keeps a CronJob's past runs when the CronJob and a run's Job left no events", () => {
+      const events = [
+        changeEvent('Job', 'prod', 'backup-29012345', { apiVersion: 'batch/v1' }),
+        changeEvent('Pod', 'prod', 'backup-29012346-bcdfg', { apiVersion: 'v1' }),
+      ]
+      const lanes = build({ kind: 'CronJob', group: 'batch', name: 'backup' }, events, true)
+      expect(lanes).toHaveLength(1)
+      expect(lanes[0].name).toBe('backup')
+      expect(laneNames(lanes)).toEqual(['CronJob/backup', 'Job/backup-29012345', 'Pod/backup-29012346-bcdfg'])
+      expect(lanes[0].allEventsSorted).toHaveLength(2)
+    })
+  })
+
   it('keeps core/built-in resource ids bare (byte-stable)', () => {
     const lanes = buildResourceHierarchy({
       events: [