From 849951be1d1a7ee9f9302006ccb187bf5b4e36f3 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Wed, 22 Jul 2026 23:51:18 +0300
Subject: =?UTF-8?q?feat:=20DTail=20fork=20=E2=80=94=20server/client=20feat?=
 =?UTF-8?q?ure=20development?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Squashed development of the snonux/dtail fork's product code (internal/, cmd/)
since diverging from mimecast/dtail. Major areas:

- Read/output path: the former "turbo" channel-less path is now the single,
  default server-side read/output path for cat/grep/tail and MapReduce; the old
  channel-based path and its config/env toggles were removed.
- MapReduce: single aggregate implementation (server + serverless) fed directly
  by a processor pipeline, with input-exhausted finalization via the shutdown
  coordinator; high-concurrency and data-race fixes.
- Journal source reads (journal:unit.service) via journalctl, Linux-gated behind
  a journal-v1 capability.
- Auth-key fast reconnect: in-memory per-user public-key cache with TTL/max-keys,
  registered over an authenticated session (AUTHKEY), checked before
  authorized_keys.
- Interactive query reload (--interactive-query) with SESSION START/UPDATE
  generation boundaries and capability negotiation.
- Client-side deadlines: --timeout / --shutdownAfter as context deadlines;
  follow shutdown handling.
- Client logging: diagnostics-only daily log by default, opt-in payload tee via
  --log-payload.
- Numerous correctness fixes (buffer-pool double-recycle races, EOF-sentinel
  leaks, glob-expansion cap, TOCTOU in CSV parsing) with accompanying unit tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 internal/mapr/query_test.go | 83 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)

(limited to 'internal/mapr/query_test.go')

diff --git a/internal/mapr/query_test.go b/internal/mapr/query_test.go
index f37b8d4..e81bc84 100644
--- a/internal/mapr/query_test.go
+++ b/internal/mapr/query_test.go
@@ -292,3 +292,86 @@ func TestQuotedSelectCondition(t *testing.T) {
 			"'select' clause but got '%v': %s\n%v", q.Select[3].Operation, queryStr, q)
 	}
 }
+
+// TestCsvLogformatDefaultTable verifies that a query using "logformat csv"
+// without an explicit FROM clause gets the default table "." applied after
+// parsing. This is a regression test for a bug where the CSV check ran
+// before q.parse(), so LogFormat was always empty and Table was never set.
+func TestCsvLogformatDefaultTable(t *testing.T) {
+	// Without an explicit FROM, the CSV logformat should default to table "."
+	// meaning "process all lines without file filtering".
+	queryStr := "select foo logformat csv"
+
+	q, err := NewQuery(queryStr)
+	if err != nil {
+		t.Fatalf("Query parse error: %s\n%v: %v", queryStr, q, err)
+	}
+
+	if q.LogFormat != "csv" {
+		t.Errorf("Expected LogFormat 'csv' but got '%v': %s\n%v", q.LogFormat, queryStr, q)
+	}
+
+	// The CSV default table must be "." when no FROM clause is provided.
+	if q.Table != "." {
+		t.Errorf("Expected Table '.' for CSV logformat without FROM clause but got '%v': %s\n%v",
+			q.Table, queryStr, q)
+	}
+}
+
+// TestCsvLogformatExplicitTableNotOverridden verifies that an explicit FROM
+// clause is preserved when using "logformat csv"; the default "." must not
+// override a user-supplied table name.
+func TestCsvLogformatExplicitTableNotOverridden(t *testing.T) {
+	queryStr := "select foo from myfile logformat csv"
+
+	q, err := NewQuery(queryStr)
+	if err != nil {
+		t.Fatalf("Query parse error: %s\n%v: %v", queryStr, q, err)
+	}
+
+	if q.LogFormat != "csv" {
+		t.Errorf("Expected LogFormat 'csv' but got '%v': %s\n%v", q.LogFormat, queryStr, q)
+	}
+
+	// Explicit FROM value must be preserved and not replaced with ".".
+	if q.Table != "MYFILE" {
+		t.Errorf("Expected Table 'MYFILE' for CSV logformat with explicit FROM but got '%v': %s\n%v",
+			q.Table, queryStr, q)
+	}
+}
+
+func TestParseQueryPercentageAndPercentile(t *testing.T) {
+	queryStr := "select percentage($value),percentile($value) from stats group by $host order by percentile($value)"
+
+	q, err := NewQuery(queryStr)
+	if err != nil {
+		t.Errorf("Query parse error: %s\n%v: %v", queryStr, q, err)
+	}
+	if len(q.Select) != 2 {
+		t.Fatalf("Expected two elements in 'select' clause but got '%v': %s\n%v",
+			q.Select, queryStr, q)
+	}
+
+	if q.Select[0].Operation != Percentage {
+		t.Errorf("Expected 'percentage' as first select aggregation but got '%v': %s\n%v",
+			q.Select[0].Operation, queryStr, q)
+	}
+	if q.Select[0].FieldStorage != "percentage($value)" {
+		t.Errorf("Expected percentage field storage but got '%v': %s\n%v",
+			q.Select[0].FieldStorage, queryStr, q)
+	}
+
+	if q.Select[1].Operation != Percentile {
+		t.Errorf("Expected 'percentile' as second select aggregation but got '%v': %s\n%v",
+			q.Select[1].Operation, queryStr, q)
+	}
+	if q.Select[1].FieldStorage != "percentile($value)" {
+		t.Errorf("Expected percentile field storage but got '%v': %s\n%v",
+			q.Select[1].FieldStorage, queryStr, q)
+	}
+
+	if q.OrderBy != "percentile($value)" {
+		t.Errorf("Expected order by percentile($value) but got '%v': %s\n%v",
+			q.OrderBy, queryStr, q)
+	}
+}
-- 
cgit v1.2.3