querysub 0.644.0 → 0.646.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "querysub",
-  "version": "0.644.0",
+  "version": "0.646.0",
   "main": "index.js",
   "license": "MIT",
   "note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",
@@ -79,7 +79,7 @@
     "node-forge": "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6",
     "pako": "^2.1.0",
     "peggy": "^5.0.6",
-    "sliftutils": "^1.7.116",
+    "sliftutils": "^1.7.119",
     "socket-function": "^1.2.33",
     "terser": "^5.31.0",
     "typenode": "^6.6.1",

package/src/deployManager/components/storage/StorageLogsPage.tsx

@@ -6,7 +6,7 @@ import { Querysub } from "../../../4-querysub/Querysub";
 import { t } from "../../../2-proxy/schema2";
 import { isDefined } from "../../../misc";
 import { formatNumber, formatTime, formatDateTime } from "socket-function/src/formatting/format";
-import { timeInMinute, timeInSecond } from "socket-function/src/misc";
+import { sort, timeInMinute, timeInSecond } from "socket-function/src/misc";
 import type { LogFileInfo } from "sliftutils/storage/StreamingLogs";
 import { MachineServiceController } from "../../machineSchema";
 import { getStorageServers } from "./storageServers";
@@ -55,6 +55,30 @@ type ServerLogListing = {
 
 const MODAL_FIELD_NAME_MIN_WIDTH = 140;
 const VIEW_BUTTON_ACTIVE_HUE = 210;
+const FAILED_STACK_FONT_SIZE = 12;
+
+class FailedFileRow extends qreact.Component<{ failure: FailedLogFile }> {
+    state = t.state({
+        expanded: t.boolean,
+    });
+    render() {
+        let failure = this.props.failure;
+        return <div className={css.vbox(2)}>
+            <div
+                className={css.hbox(8).pointer}
+                title={this.state.expanded ? "Click to collapse" : "Click to show the full stack"}
+                onClick={() => this.state.expanded = !this.state.expanded}
+            >
+                <span>{this.state.expanded ? "▾" : "▸"}</span>
+                <span className={css.boldStyle.whiteSpace("nowrap")}>{failure.url} {failure.name}</span>
+                {!this.state.expanded && <span className={css.ellipsis}>{failure.error.split("\n")[0]}</span>}
+            </div>
+            {this.state.expanded && <div className={css.whiteSpace("pre-wrap").fontFamily("monospace").fontSize(FAILED_STACK_FONT_SIZE)}>
+                {failure.error}
+            </div>}
+        </div>;
+    }
+}
 
 // Shared between the modal and the table's View buttons, so the button of the row on display highlights and arrow keys move the selection
 const viewedRowState = Querysub.createLocalSchema("storageLogsViewedRow", {
@@ -114,6 +138,39 @@ function showRowModal(rows: Record<string, unknown>[], index: number): void {
     });
 }
 
+/** Every distinct value of one column across the results, most common first. */
+function showColumnInspectModal(rows: Record<string, unknown>[], field: string): void {
+    let counts = new Map<string, number>();
+    let missing = 0;
+    for (let row of rows) {
+        if (!(field in row)) {
+            missing++;
+            continue;
+        }
+        let value = row[field];
+        let text = typeof value === "string" ? value : JSON.stringify(value);
+        counts.set(text, (counts.get(text) || 0) + 1);
+    }
+    let inspectRows = [...counts.entries()].map(([value, count]) => ({ count, value }));
+    sort(inspectRows, x => -x.count);
+    let close = showModal({
+        content: <FullscreenModal onCancel={() => close.close()}>
+            <div className={css.vbox(8).pad2(16)}>
+                <div className={css.boldStyle}>
+                    {field}: {formatNumber(inspectRows.length)} distinct values across {formatNumber(rows.length)} rows{missing > 0 && `, missing on ${formatNumber(missing)}`}
+                </div>
+                <Table
+                    rows={inspectRows}
+                    columns={{
+                        count: { title: "Count" },
+                        value: { title: "Value" },
+                    }}
+                />
+            </div>
+        </FullscreenModal>
+    });
+}
+
 /** Whether a log file could hold entries in the range - a live file (no endTime) runs to now. */
 function fileOverlapsRange(file: LogFileInfo, startTime: number, endTime: number): boolean {
     let fileEnd = file.endTime ?? Date.now();
@@ -128,6 +185,9 @@ export class StorageLogsPage extends qreact.Component {
         currentFile: t.string,
         /** How long the last search took */
         durationTime: t.number,
+        /** Summed per file across the last search's fresh (uncached) fetches */
+        downloadTime: t.number,
+        searchTime: t.number,
         /** The oldest fetch time among the results being displayed */
         resultsFetchTime: t.number,
         rows: t.atomic<Record<string, unknown>[]>([]),
@@ -188,6 +248,8 @@ export class StorageLogsPage extends qreact.Component {
         this.state.fields = [];
         this.state.failedFiles = [];
         this.state.durationTime = 0;
+        this.state.downloadTime = 0;
+        this.state.searchTime = 0;
         this.state.resultsFetchTime = 0;
         Querysub.onCommitFinished(async () => {
             let files = cachedFiles;
@@ -247,6 +309,8 @@ export class StorageLogsPage extends qreact.Component {
                     this.state.fields = fields;
                     this.state.failedFiles = result.failures;
                     this.state.durationTime = result.durationTime;
+                    this.state.downloadTime = result.downloadTime;
+                    this.state.searchTime = result.searchTime;
                     this.state.resultsFetchTime = result.oldestFetchTime;
                 });
             } catch (e: any) {
@@ -352,6 +416,8 @@ export class StorageLogsPage extends qreact.Component {
                         this.state.failedFiles = [];
                         this.state.resultsFetchTime = 0;
                         this.state.durationTime = 0;
+                        this.state.downloadTime = 0;
+                        this.state.searchTime = 0;
                     }}
                 >
                     Invalidate
@@ -393,11 +459,15 @@ export class StorageLogsPage extends qreact.Component {
                 {listings.map(listing => {
                     let files = listing.files || [];
                     let totalBytes = files.reduce((sum, file) => sum + file.size, 0);
+                    let oldest = files.length && Math.min(...files.map(file => file.startTime)) || 0;
                     return <div key={listing.url} className={css.hbox(8).wrap.alignItems("center")}>
                         <b>{listing.url}</b>
                         {listing.loading && <span>Loading log files...</span>}
                         {listing.error && <span className={css.colorhsl(ERROR_COLOR.h, ERROR_COLOR.s, ERROR_COLOR.l).ellipsis} title={listing.error}>{listing.error}</span>}
                         {listing.files && <span>{formatNumber(files.length)} log files, {formatNumber(totalBytes)}B</span>}
+                        {!!oldest && <span className={css.colorhsl(AGE_COLOR.h, AGE_COLOR.s, AGE_COLOR.l)}>
+                            oldest {formatTime(now - oldest)} ago
+                        </span>}
                     </div>;
                 })}
                 <div>
@@ -406,36 +476,49 @@ export class StorageLogsPage extends qreact.Component {
                 <div className={css.hbox(12).wrap.fontSize(AGE_FONT_SIZE).colorhsl(AGE_COLOR.h, AGE_COLOR.s, AGE_COLOR.l)}>
                     {!!oldestListingTime && <span>File listing from {formatTime(now - oldestListingTime)} ago</span>}
                     {!!this.state.resultsFetchTime && <span>Results from {formatTime(now - this.state.resultsFetchTime)} ago</span>}
-                    {!!this.state.durationTime && <span>Search took {formatTime(this.state.durationTime)}</span>}
+                    {!!this.state.durationTime && <span>
+                        Search took {formatTime(this.state.durationTime)} (downloading {formatTime(this.state.downloadTime)}, searching {formatTime(this.state.searchTime)}, summed per file)
+                    </span>}
                     {this.state.searching && !!this.state.currentFile && <span>Searching {this.state.currentFile}</span>}
                 </div>
             </div>
             {this.state.error && <div className={css.colorhsl(ERROR_COLOR.h, ERROR_COLOR.s, ERROR_COLOR.l).whiteSpace("pre-wrap")}>{this.state.error}</div>}
             {!!this.state.failedFiles.length && <div className={css.vbox(2).colorhsl(ERROR_COLOR.h, ERROR_COLOR.s, ERROR_COLOR.l)}>
                 <div className={css.boldStyle}>{formatNumber(this.state.failedFiles.length)} files failed to search (their entries are missing from the results):</div>
-                {this.state.failedFiles.map(failure => <div key={`${failure.url}|${failure.name}`} className={css.ellipsis} title={failure.error}>
-                    {failure.url} {failure.name}
-                </div>)}
+                {this.state.failedFiles.map(failure => <FailedFileRow key={`${failure.url}|${failure.name}`} failure={failure} />)}
             </div>}
             {!!this.state.rows.length && <div className={css.vbox(8)}>
                 <div className={css.hbox(6, 4).wrap.alignItems("center")}>
                     {this.state.fields.map(({ field, count }) => {
                         let selected = selectedSet.has(field);
                         let color = selected ? FIELD_CHIP_ACTIVE_COLOR : FIELD_CHIP_COLOR;
-                        return <div
-                            key={field}
-                            className={
-                                css.hbox(5).alignItems("center").pad2(8, 4).button.whiteSpace("nowrap")
-                                    .hsl(color.h, color.s, color.l).bord2(color.h, color.s, color.l - 20)
-                            }
-                            onClick={() => {
-                                let newValues = { ...storageLogFieldsParam.value };
-                                newValues[field] = !selected;
-                                storageLogFieldsParam.value = newValues;
-                            }}
-                        >
-                            <span className={css.boldStyle}>{field}</span>
-                            <span className={css.fontSize(FIELD_COUNT_FONT_SIZE).colorhsl(FIELD_COUNT_COLOR.h, FIELD_COUNT_COLOR.s, FIELD_COUNT_COLOR.l)}>{formatNumber(count)}</span>
+                        // The chip and its inspect button sit flush as one segmented control - the chip toggles the column, the magnifier inspects it
+                        return <div key={field} className={css.hbox(0).alignItems("stretch")}>
+                            <div
+                                className={
+                                    css.hbox(5).alignItems("center").pad2(8, 4).button.whiteSpace("nowrap")
+                                        .hsl(color.h, color.s, color.l).bord2(color.h, color.s, color.l - 20)
+                                }
+                                onClick={() => {
+                                    let newValues = { ...storageLogFieldsParam.value };
+                                    newValues[field] = !selected;
+                                    storageLogFieldsParam.value = newValues;
+                                }}
+                            >
+                                <span className={css.boldStyle}>{field}</span>
+                                <span className={css.fontSize(FIELD_COUNT_FONT_SIZE).colorhsl(FIELD_COUNT_COLOR.h, FIELD_COUNT_COLOR.s, FIELD_COUNT_COLOR.l)}>{formatNumber(count)}</span>
+                            </div>
+                            <div
+                                className={
+                                    css.hbox(0).alignItems("center").pad2(6, 4).button
+                                        .hsl(0, 0, 100).bord2(color.h, color.s, color.l - 20)
+                                        .background(`hsl(${color.h}, ${color.s}%, 96%)`, "hover")
+                                }
+                                title="All values of this column, most common first"
+                                onClick={() => showColumnInspectModal(this.state.rows, field)}
+                            >
+                                🔍
+                            </div>
                         </div>;
                     })}
                 </div>

package/src/deployManager/components/storage/storageLogMCPSearch.ts

@@ -0,0 +1,203 @@
+import { runInParallel } from "socket-function/src/batching";
+import { listServerLogFiles } from "sliftutils/storage/remoteStorage/createArchives";
+import { decodeLogFile } from "sliftutils/storage/StreamingLogs";
+import type { LogFileInfo } from "sliftutils/storage/StreamingLogs";
+import { getAllServiceConfigs } from "../../machineSchema";
+import { getStorageServers } from "./storageServers";
+import { STORAGE_ACCOUNT } from "../../../-a-archives/archives2";
+import { callStorageServer } from "./storageController";
+import { parseSearchClauses, clauseMatches } from "./storageLogSearch";
+import type { SearchClause } from "./storageLogSearch";
+
+// Server-side (MCP) storage-log search. The file listing is re-requested on every call (so a caller always sees the current set of files), but the expensive parts - the raw download and the decompress/decode - are cached across calls for files that can no longer change. An in-progress file (still being streamed to) is never cached, since its bytes keep growing.
+module.hotreload = false;
+
+const PARALLEL_FILE_SEARCHES = 4;
+const DEFAULT_LIMIT = 100;
+// Compressed input bytes of downloaded files to keep resident.
+const DOWNLOAD_CACHE_MAX_BYTES = 1024 ** 3;
+// Decoded output bytes (estimated via serialized length) of decoded files to keep resident. Sized independently of the download cache because the decoded form is much larger than the compressed download.
+const DECODE_CACHE_MAX_BYTES = 1024 ** 3;
+
+// An LRU keyed by string, evicting oldest-used entries once the summed byte weight exceeds maxBytes. A Map keeps insertion order, so re-inserting on read moves an entry to the newest position and the oldest key is always the head.
+class ByteLruCache<T> {
+    private entries = new Map<string, { value: T; bytes: number }>();
+    private totalBytes = 0;
+    constructor(private maxBytes: number) { }
+
+    public get(key: string): T | undefined {
+        let entry = this.entries.get(key);
+        if (!entry) return undefined;
+        this.entries.delete(key);
+        this.entries.set(key, entry);
+        return entry.value;
+    }
+
+    public set(key: string, value: T, bytes: number): void {
+        let existing = this.entries.get(key);
+        if (existing) {
+            this.totalBytes -= existing.bytes;
+            this.entries.delete(key);
+        }
+        // A single item bigger than the whole budget would evict everything and still not fit, so it is simply not cached.
+        if (bytes > this.maxBytes) return;
+        this.entries.set(key, { value, bytes });
+        this.totalBytes += bytes;
+        while (this.totalBytes > this.maxBytes) {
+            let oldestKey = this.entries.keys().next().value;
+            if (oldestKey === undefined) break;
+            let oldest = this.entries.get(oldestKey);
+            if (oldest) this.totalBytes -= oldest.bytes;
+            this.entries.delete(oldestKey);
+        }
+    }
+}
+
+// Keyed by `${url}|${name}`. Completed (compressed) files carry the whole identity in their name (pid/thread/time/count/id), so the name alone is a stable key for immutable content.
+const downloadCache = new ByteLruCache<Buffer>(DOWNLOAD_CACHE_MAX_BYTES);
+const decodeCache = new ByteLruCache<unknown[]>(DECODE_CACHE_MAX_BYTES);
+
+export type StorageLogSearchResult = {
+    // Union of every field seen on any returned row (including the injected `server`/`file`). Lets a caller pick `columns` for a follow-up call.
+    allColumns: string[];
+    results: Record<string, unknown>[];
+    // Files across all servers that overlapped the range, and how many were actually searched (equal unless a download failed).
+    files: { total: number; searched: number };
+    // One entry per storage server discovered, with an error if that whole server's listing could not be read - one bad server never fails the search.
+    servers: { url: string; error?: string }[];
+    // Only present when the result was cut to `limit`; its presence signals truncation.
+    limitHit?: true;
+    note?: string;
+};
+
+/** Whether a log file could hold entries in the range - a live file (no endTime) runs to now. Mirrors the browser page's fileOverlapsRange. */
+function fileOverlapsRange(file: LogFileInfo, startTime: number, endTime: number): boolean {
+    let fileEnd = file.endTime ?? Date.now();
+    return file.startTime <= endTime && fileEnd >= startTime;
+}
+
+/** Only a compressed, no-longer-written file has immutable content worth caching; anything still being streamed keeps growing. */
+function isCacheable(file: LogFileInfo): boolean {
+    return file.compressed && !file.active;
+}
+
+/** An entry matches the query if ANY or-clause matches its serialized line (an empty query matches everything). One pass over real entries, so there is no per-clause de-duplication to do. */
+function matchesQuery(entry: unknown, clauses: SearchClause[]): boolean {
+    if (!clauses.length) return true;
+    let line = JSON.stringify(entry);
+    return clauses.some(clause => clauseMatches(line, clause));
+}
+
+/** The decoded entries of one file, served from (and populated into) the download + decode caches. Cacheable files are downloaded and decoded at most once across calls; an in-progress file is fetched and decoded fresh every time. */
+async function getFileEntries(file: { url: string; name: string; cacheable: boolean }): Promise<unknown[]> {
+    let key = `${file.url}|${file.name}`;
+
+    if (file.cacheable) {
+        let cachedEntries = decodeCache.get(key);
+        if (cachedEntries) return cachedEntries;
+    }
+
+    let data = file.cacheable ? downloadCache.get(key) : undefined;
+    if (!data) {
+        data = Buffer.from(await callStorageServer(file.url, controller => controller.getLogFile({ account: STORAGE_ACCOUNT, name: file.name })));
+        if (file.cacheable) downloadCache.set(key, data, data.length);
+    }
+
+    let entries = decodeLogFile(data);
+    if (file.cacheable) {
+        decodeCache.set(key, entries, Buffer.byteLength(JSON.stringify(entries)));
+    }
+    return entries;
+}
+
+/** One MCP call: re-lists every storage server's log files, searches each overlapping file (reusing cached downloads/decodes where possible), and returns the matching rows projected to `columns` (or every field when `columns` is omitted). */
+export async function searchStorageLogsForMCP(config: {
+    query: string;
+    startTime: number;
+    endTime: number;
+    // Which entry fields to project onto each row. Omit to return every field. `time` is always included (the sort needs it). `server`/`file` are always added.
+    columns?: string[];
+    limit?: number;
+    direction?: "fromStart" | "fromEnd";
+}): Promise<StorageLogSearchResult> {
+    let { query, startTime, endTime } = config;
+    if (startTime >= endTime) {
+        throw new Error(`startTime (${startTime}) must be < endTime (${endTime})`);
+    }
+    let limit = config.limit ?? DEFAULT_LIMIT;
+    let direction = config.direction ?? "fromEnd";
+    let columns = config.columns && (config.columns.includes("time") ? config.columns : ["time", ...config.columns]);
+    let clauses = parseSearchClauses(query);
+
+    let servers = getStorageServers(await getAllServiceConfigs());
+    let serverResults: { url: string; error?: string }[] = servers.map(server => ({ url: server.url }));
+
+    // Flatten every overlapping file across every server into one work list, so the parallelism is over files (not servers) and one slow server does not serialize the rest.
+    let work: { url: string; name: string; cacheable: boolean }[] = [];
+    await Promise.all(servers.map(async (server, serverIndex) => {
+        try {
+            let files = await listServerLogFiles({ url: server.url, account: STORAGE_ACCOUNT });
+            for (let file of files) {
+                if (!fileOverlapsRange(file, startTime, endTime)) continue;
+                work.push({ url: server.url, name: file.name, cacheable: isCacheable(file) });
+            }
+        } catch (e) {
+            serverResults[serverIndex].error = (e as Error).stack ?? String(e);
+            console.error(`MCP storage-log search: listing ${server.url} failed, continuing with the other servers:`, (e as Error).stack ?? e);
+        }
+    }));
+
+    let rows: Record<string, unknown>[] = [];
+    let searched = 0;
+    let runFile = runInParallel({ parallelCount: PARALLEL_FILE_SEARCHES }, async (file: { url: string; name: string; cacheable: boolean }) => {
+        let entries: unknown[];
+        try {
+            entries = await getFileEntries(file);
+        } catch (e) {
+            console.error(`MCP storage-log search: reading ${file.name} on ${file.url} failed, continuing with the other files:`, (e as Error).stack ?? e);
+            return;
+        }
+        searched++;
+        for (let entry of entries) {
+            let fields = entry && typeof entry === "object" ? entry as Record<string, unknown> : { value: entry };
+            // File selection is only file-granular, so the range still has to be applied to each entry.
+            let time = fields.time;
+            if (typeof time === "number" && (time < startTime || time > endTime)) continue;
+            if (!matchesQuery(entry, clauses)) continue;
+            let projected: Record<string, unknown> = { server: file.url, file: file.name };
+            if (columns) {
+                for (let col of columns) {
+                    if (col in fields) projected[col] = fields[col];
+                }
+            } else {
+                Object.assign(projected, fields);
+            }
+            rows.push(projected);
+        }
+    });
+    await Promise.all(work.map(runFile));
+
+    let dir = direction === "fromStart" ? 1 : -1;
+    rows.sort((a, b) => dir * ((typeof a.time === "number" && a.time || 0) - (typeof b.time === "number" && b.time || 0)));
+    let totalMatched = rows.length;
+    let limitHit = totalMatched > limit;
+    if (limitHit) rows = rows.slice(0, limit);
+
+    let allColumns = new Set<string>();
+    for (let row of rows) {
+        for (let key of Object.keys(row)) allColumns.add(key);
+    }
+
+    console.log(`[storage-search] query=${JSON.stringify(query)} servers=${servers.length} files=${work.length} searched=${searched} matched=${totalMatched} returned=${rows.length} limit=${limit}${limitHit ? " HIT" : ""}`);
+
+    return {
+        allColumns: Array.from(allColumns),
+        results: rows,
+        files: { total: work.length, searched },
+        servers: serverResults,
+        limitHit: limitHit ? true : undefined,
+        note: limitHit
+            ? `Stopped at limit=${limit}. Results are truncated - there are likely more matches outside what's returned. This is NOT missing data; raise the limit or narrow the time range to see more.`
+            : undefined,
+    };
+}

package/src/deployManager/components/storage/storageLogSearch.ts

@@ -4,15 +4,31 @@ import { StorageLogsController } from "./storageLogsController";
 
 module.hotreload = true;
 
-// searchServerLogs only ANDs its search strings, so the `|` level of a query has to be decomposed on our side: one server-side search per or-clause, unioned. The union check uses the entry's own JSON (the same text the server searched), so it never collapses genuinely duplicate log lines the way a dedupe-by-content would.
+// searchServerLogs only ANDs its positive search strings, so everything else is decomposed on our side: one server-side search per or-clause (unioned), and `!` excludes filtered off each clause's results here. The union and exclude checks use the entry's own JSON (the same text the server searched), so they never collapse genuinely duplicate log lines the way a dedupe-by-content would.
 
 const PARALLEL_FILE_SEARCHES = 4;
 
-/** A query's or-clauses, each the list of terms that must all appear - the same `|` / `&` semantics matchFilter (misc.ts) applies locally, minus its lowercasing, as the server search is case-sensitive. */
-export function parseSearchClauses(query: string): string[][] {
+export type SearchClause = {
+    includes: string[];
+    excludes: string[];
+};
+
+/** A query's or-clauses: `|` between clauses, `&` between a clause's terms, `!` in front of a term to require its ABSENCE. Like matchFilter (misc.ts) minus its lowercasing, as the server search is case-sensitive. */
+export function parseSearchClauses(query: string): SearchClause[] {
     return query.split("|")
-        .map(clause => clause.split("&").map(x => x.trim()).filter(x => x))
-        .filter(clause => clause.length > 0);
+        .map(clauseText => {
+            let terms = clauseText.split("&").map(x => x.trim()).filter(x => x);
+            return {
+                includes: terms.filter(x => !x.startsWith("!")),
+                excludes: terms.filter(x => x.startsWith("!")).map(x => x.slice(1).trim()).filter(x => x),
+            };
+        })
+        .filter(clause => clause.includes.length > 0 || clause.excludes.length > 0);
+}
+
+export function clauseMatches(line: string, clause: SearchClause): boolean {
+    return clause.includes.every(term => line.includes(term))
+        && clause.excludes.every(term => !line.includes(term));
 }
 
 export type SearchedLogFile = {
@@ -23,35 +39,55 @@ export type SearchedLogFile = {
     fetchTime: number;
 };
 
-const searchCache = new Map<string, { entries: unknown[]; fetchTime: number }>();
+type FileSearchResult = {
+    entries: unknown[];
+    fetchTime: number;
+    downloadTime: number;
+    searchTime: number;
+};
+const searchCache = new Map<string, FileSearchResult>();
 export function invalidateStorageLogSearchCache(): void {
     searchCache.clear();
 }
 
-async function searchFile(url: string, name: string, query: string): Promise<{ entries: unknown[]; fetchTime: number }> {
+// An old server still returns the bare entries array (the controller is a full-refresh module, and deploys overlap versions), which must not break the whole search
+function normalizeSearchCall(call: { entries: unknown[]; downloadTime: number; searchTime: number } | unknown[]): { entries: unknown[]; downloadTime: number; searchTime: number } {
+    if (Array.isArray(call)) return { entries: call, downloadTime: 0, searchTime: 0 };
+    return call;
+}
+
+async function searchFile(url: string, name: string, query: string): Promise<FileSearchResult & { cached: boolean }> {
     let cacheKey = `${url}|${name}|${query}`;
     let cached = searchCache.get(cacheKey);
-    if (cached) return cached;
+    if (cached) return { ...cached, cached: true };
     let controller = StorageLogsController.nodes[SocketFunction.browserNodeId()];
     let clauses = parseSearchClauses(query);
-    let entries: unknown[];
-    if (clauses.length <= 1) {
-        entries = await controller.searchLogFile(url, name, clauses[0] || []);
+    let entries: unknown[] = [];
+    let downloadTime = 0;
+    let searchTime = 0;
+    if (!clauses.length) {
+        let call = normalizeSearchCall(await controller.searchLogFile(url, name, []));
+        entries = call.entries;
+        downloadTime = call.downloadTime;
+        searchTime = call.searchTime;
     } else {
         // Later clauses drop entries an earlier clause already returned, which unions the or-clauses without collapsing real duplicates
-        entries = [];
         for (let [index, clause] of clauses.entries()) {
-            let clauseEntries = await controller.searchLogFile(url, name, clause);
-            for (let entry of clauseEntries) {
+            // The server only sees the positive terms (an exclude-only clause downloads the whole file); the excludes are applied to the returned lines below
+            let call = normalizeSearchCall(await controller.searchLogFile(url, name, clause.includes));
+            downloadTime += call.downloadTime;
+            searchTime += call.searchTime;
+            for (let entry of call.entries) {
                 let line = JSON.stringify(entry);
-                if (clauses.slice(0, index).some(prev => prev.every(term => line.includes(term)))) continue;
+                if (!clauseMatches(line, clause)) continue;
+                if (clauses.slice(0, index).some(prev => clauseMatches(line, prev))) continue;
                 entries.push(entry);
             }
         }
     }
-    let result = { entries, fetchTime: Date.now() };
+    let result: FileSearchResult = { entries, fetchTime: Date.now(), downloadTime, searchTime };
     searchCache.set(cacheKey, result);
-    return result;
+    return { ...result, cached: false };
 }
 
 export type StorageLogSearchProgress = {
@@ -75,17 +111,26 @@ export async function searchStorageLogs(config: {
     files: SearchedLogFile[];
     failures: FailedLogFile[];
     durationTime: number;
+    /** Summed per file (files run concurrently, so these can exceed durationTime). Cached files contribute nothing - only work this search actually did counts. */
+    downloadTime: number;
+    searchTime: number;
     /** The oldest fetch time among the results used, so the UI can say how stale the display is. */
     oldestFetchTime: number;
 }> {
     let startTime = Date.now();
     let doneFiles = 0;
+    let downloadTime = 0;
+    let searchTime = 0;
     let results: SearchedLogFile[] = [];
     let failures: FailedLogFile[] = [];
     let runFile = runInParallel({ parallelCount: PARALLEL_FILE_SEARCHES }, async (file: { url: string; name: string }) => {
         config.onProgress({ doneFiles, totalFiles: config.files.length, currentFile: file.name });
         try {
             let result = await searchFile(file.url, file.name, config.query);
+            if (!result.cached) {
+                downloadTime += result.downloadTime;
+                searchTime += result.searchTime;
+            }
             results.push({ url: file.url, name: file.name, entries: result.entries, fetchTime: result.fetchTime });
         } catch (e) {
             let error = (e as Error).stack ?? String(e);
@@ -100,6 +145,8 @@ export async function searchStorageLogs(config: {
         files: results,
         failures,
         durationTime: Date.now() - startTime,
+        downloadTime,
+        searchTime,
         oldestFetchTime: results.length && Math.min(...results.map(x => x.fetchTime)) || Date.now(),
     };
 }

package/src/deployManager/components/storage/storageLogsController.ts

@@ -1,5 +1,6 @@
 import { SocketFunction } from "socket-function/SocketFunction";
-import { listServerLogFiles, getServerLogs, searchServerLogs } from "sliftutils/storage/remoteStorage/createArchives";
+import { listServerLogFiles } from "sliftutils/storage/remoteStorage/createArchives";
+import { decodeLogFile, createLogSearcher } from "sliftutils/storage/StreamingLogs";
 import type { LogFileInfo } from "sliftutils/storage/StreamingLogs";
 import { parseStorageUrl } from "sliftutils/storage/remoteStorage/ArchivesRemote";
 import { ROUTING_FILE, parseRoutingData, normalizeSource, parseHostedUrl } from "sliftutils/storage/remoteStorage/remoteConfig";
@@ -43,14 +44,14 @@ class StorageLogsControllerBase {
             fetchTime: Date.now(),
         };
     }
-    /** One file per call, so the client can report per-file progress. Empty searches downloads and decodes the whole file (searchServerLogs requires at least one search string). */
-    public async searchLogFile(url: string, name: string, searches: string[]): Promise<unknown[]> {
-        if (!searches.length) {
-            let results = await getServerLogs({ url, account: STORAGE_ACCOUNT, names: [name] });
-            return results[0]?.entries || [];
-        }
-        let results = await searchServerLogs({ url, account: STORAGE_ACCOUNT, names: [name], searches });
-        return results[0]?.entries || [];
+    /** One file per call, so the client can report per-file progress. Empty searches decodes the whole file. Done as separate download and search steps (rather than sliftutils' searchServerLogs, which bundles them) so each is timed on its own. */
+    public async searchLogFile(url: string, name: string, searches: string[]): Promise<{ entries: unknown[]; downloadTime: number; searchTime: number }> {
+        let downloadStart = Date.now();
+        let data = await callStorageServer(url, controller => controller.getLogFile({ account: STORAGE_ACCOUNT, name }));
+        let downloadTime = Date.now() - downloadStart;
+        let searchStart = Date.now();
+        let entries = searches.length ? createLogSearcher(Buffer.from(data))(searches) : decodeLogFile(Buffer.from(data));
+        return { entries, downloadTime, searchTime: Date.now() - searchStart };
     }
     /** One path's live value on ONE server: its own newest copy (internal), plus what each of its configured stores serves normally. One call per server, so a locked-up server only stalls its own row. */
     public async getServerPathValue(url: string, bucketName: string, path: string): Promise<ServerPathValue> {

package/src/deployManager/machineSchema.ts

@@ -192,6 +192,13 @@ function normalizeServiceConfig(config: ServiceConfig): ServiceConfig {
     return config;
 }
 
+/** Every service config, read straight from the archive. Server-side callers (that hold the machine identity, so they aren't a synced browser) use this instead of the synced MachineServiceController.getServiceList/getServiceConfig pair. */
+export async function getAllServiceConfigs(): Promise<ServiceConfig[]> {
+    let ids = await serviceConfigs.keys();
+    let configs = await Promise.all(ids.map(id => serviceConfigs.get(id)));
+    return configs.filter((config): config is ServiceConfig => !!config).map(normalizeServiceConfig);
+}
+
 
 export type LaunchRecord = {
     serviceId: string;

package/src/diagnostics/logs/IndexedLogs/MCPIndexedLogs.ts

@@ -118,7 +118,7 @@ type SearchSink = {
 // Accept epoch ms (number) or any string `new Date(...)` understands. String
 // inputs without a timezone designator are interpreted as local time, which is
 // what callers typically have on hand (e.g. "2026-05-09 03:00").
-function normalizeTime(value: string | number, label: string): number {
+export function normalizeTime(value: string | number, label: string): number {
     if (typeof value === "number") return value;
     let asNumber = Number(value);
     if (!Number.isNaN(asNumber) && value.trim() !== "") return asNumber;

package/src/diagnostics/logs/IndexedLogs/MCPIndexedLogsEntry.ts

@@ -16,10 +16,12 @@ import "../../../inject";
 import * as http from "http";
 import { logErrors, timeoutToUndefinedSilent } from "../../../errors";
 import { Querysub } from "../../../4-querysub/Querysub";
-import { MCPIndexedLogs } from "./MCPIndexedLogs";
+import { MCPIndexedLogs, normalizeTime } from "./MCPIndexedLogs";
+import { searchStorageLogsForMCP } from "../../../deployManager/components/storage/storageLogMCPSearch";
 import { getAllNodeIds } from "../../../-f-node-discovery/NodeDiscovery";
 import { NodeCapabilitiesController } from "../../../-g-core-values/NodeCapabilities";
 import { formatTime } from "socket-function/src/formatting/format";
+import { SocketFunction } from "socket-function/SocketFunction";
 
 const DEFAULT_MCP_HTTP_PORT = 4487;
 const NODE_INFO_TIMEOUT_MS = 5000;
@@ -61,6 +63,32 @@ Note: each segment between operators ideally has at least 4 contiguous character
             required: ["query", "machine", "startTime", "endTime", "direction", "columns"],
         },
     },
+    {
+        name: "searchStorage",
+        description: `Search the storage-server logs (a separate stream from the indexed logs above) across every storage server in the cluster, for entries in a time range matching a query, projected to the requested columns.
+
+Returns { allColumns, results, files: {total, searched}, servers: [{url, error?}] }. \`allColumns\` is the union of every field seen on any returned row (each row also carries \`server\` and \`file\`), so callers can pick additional \`columns\` for a follow-up call. If a \`limitHit\` field is present, results were truncated by the limit and a \`note\` will explain — this is NOT missing data; raise the limit or narrow the time range. A server that could not be listed shows up in \`servers\` with an \`error\` and costs only its own rows.
+
+The file listing is re-requested on every call, so newly written files are always seen. Completed files' downloads and decodes are cached in memory across calls; in-progress (still-being-written) files are re-read fresh each time.
+
+Query syntax (case-sensitive substring match against each entry's JSON):
+  | — OR between clauses. \`cat|dog\` matches if either clause matches.
+  & — AND within a clause. \`error&timeout\` matches if both substrings are present.
+  ! — require ABSENCE. \`error&!timeout\` matches lines with "error" but not "timeout".
+  Omit the query (empty string) to return every entry in the range.`,
+        inputSchema: {
+            type: "object",
+            properties: {
+                query: { type: "string", description: "Empty string returns every entry in the range." },
+                startTime: { type: ["number", "string"], description: "epoch ms or any string Date can parse (no-tz strings are local time)" },
+                endTime: { type: ["number", "string"], description: "epoch ms or any string Date can parse" },
+                columns: { type: "array", items: { type: "string" }, description: "Which entry fields to project onto each row. Omit to return every field. \`time\` is always included; \`server\`/\`file\` are always added." },
+                limit: { type: "number", default: 100 },
+                direction: { type: "string", enum: ["fromStart", "fromEnd"], description: "Which end of the range to keep when truncating to limit. Default fromEnd (newest first)." },
+            },
+            required: ["query", "startTime", "endTime"],
+        },
+    },
     {
         name: "listNodes",
         description: `List every node in the Querysub cluster, with each node's process entry point. Returns an array of { nodeId, entryPoint }. A node that does not answer in time has entryPoint left undefined.`,
@@ -137,6 +165,23 @@ async function dispatch(method: string, params: unknown, mcp: MCPIndexedLogs): P
         let result: unknown;
         if (toolName === "search") {
             result = await mcp.search(args as Parameters<MCPIndexedLogs["search"]>[0]);
+        } else if (toolName === "searchStorage") {
+            let a = args as {
+                query: string;
+                startTime: string | number;
+                endTime: string | number;
+                columns?: string[];
+                limit?: number;
+                direction?: "fromStart" | "fromEnd";
+            };
+            result = await searchStorageLogsForMCP({
+                query: a.query,
+                startTime: normalizeTime(a.startTime, "startTime"),
+                endTime: normalizeTime(a.endTime, "endTime"),
+                columns: a.columns,
+                limit: a.limit,
+                direction: a.direction,
+            });
         } else if (toolName === "listNodes") {
             result = await getNodeInfos();
         } else {
@@ -216,7 +261,9 @@ async function main() {
     });
     console.log(`MCPIndexedLogs HTTP server listening on http://127.0.0.1:${port}`);
 
-    await Querysub.hostService("MCPIndexedLogs");
+    if (!SocketFunction.isMounted()) {
+        await Querysub.hostService("MCPIndexedLogs");
+    }
 }
 
 main().catch(console.error);