Skip to content

feat(agent): egress topSources, chat ingest guard, JSON parsing#28

Merged
kgrubb merged 1 commit into
mainfrom
feat/egress-topSources-chat-json-hardening
May 13, 2026
Merged

feat(agent): egress topSources, chat ingest guard, JSON parsing#28
kgrubb merged 1 commit into
mainfrom
feat/egress-topSources-chat-json-hardening

Conversation

@kgrubb
Copy link
Copy Markdown
Contributor

@kgrubb kgrubb commented May 13, 2026

Added

  • Flow tool output for top external destinations now includes who is sending: source IPs per destination, plus pod, namespace, or display-style labels when the index has aggregatable fields for them.
  • Chat startup guard so messages older than process start (with a small clock skew allowance) are not sent to the agent, avoiding a backlog replay from Slack, Matrix, or Mattermost.
  • More forgiving parsing of agent JSON replies (fenced or messy framing) and throttled warnings when JSON cannot be parsed, so logs stay usable.

Changed

  • Mattermost adapter starts after the chat router is constructed so the same startup guard applies as for other chat channels.

Fixed

  • Chat router logs handler failures with a consistent error shape for operators.

@kgrubb kgrubb force-pushed the feat/egress-topSources-chat-json-hardening branch from 205a14d to 3f0f736 Compare May 13, 2026 20:34
## Added
- topExternalDestinationsByBytes returns topSources (per-dst srcIp, bytes,
  optional pod/namespace/display when index fields aggregate).
- pickAggregatableField helper shared with topTalkersByBytes.
- parseLenientOrNull for fenced / messy LLM JSON; per-context parse warn
  throttle in json util.
- ChatRouter ingestOpenedAtMs plus chatMessageServerTimeMs to skip stale
  backlog messages on startup.
- createThrottle helper for log/insight throttling; tests for router and
  topExternalDestinationsByBytes.

## Changed
- Agent loop uses parseLenientOrNull; extractToolCallsFromText bails early
  when no tool_calls pattern.
- Mattermost adapter starts after ChatRouter construction so ingest clock
  applies consistently.
- topTalkersByBytes uses pick helper and spread-built aggs and rows.
- fieldCaps, conversationStore, insights engine, opensearchDetections,
  openaiCompat, matrix adapter: aligned with throttle or small cleanups.

## Fixed
- Router error logging passes logErr consistently.
@kgrubb kgrubb force-pushed the feat/egress-topSources-chat-json-hardening branch from 3f0f736 to 11b61e0 Compare May 13, 2026 20:34
@kgrubb kgrubb self-assigned this May 13, 2026
@kgrubb kgrubb merged commit 2721faf into main May 13, 2026
1 check passed
@kgrubb kgrubb deleted the feat/egress-topSources-chat-json-hardening branch May 13, 2026 20:36
@github-actions github-actions Bot mentioned this pull request May 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant