chore: remove unanchored docs/ ignore rule - #403
Conversation
An unanchored docs/ matches every docs directory at any depth, so git add docs/... exits 1 with ignore advice even for paths whose siblings are already tracked (docs/ has 19 tracked files on main). This is the same pathology as the previously fixed unanchored Logs/ rule documented further down in this file. Anchoring to /docs/ would not help here: the root docs/ directory is itself tracked (docs/design-system, docs/superpowers, and more), so the rule has to go entirely. docs/.DS_Store remains covered by the existing .DS_Store rule. Note for working copies: previously swallowed untracked files under docs/ (DNS parser plans/specs, design-system SKILL.md, the compass artifact) will now appear in git status; review before bulk adds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR adds Windows DNS parser references and implementation plans, DNS/DHCP workspace designs and plans, CMTrace Open design-system guidance, and removes the ChangesDNS parser and workspace documentation
Estimated code review effort: 2 (Simple) | ~15 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
Six files existed only in local working copies because the removed docs/ ignore rule blocked git add: the DNS parser reference, the design-system skill, and the DNS parser / DNS-DHCP workspace plans and specs (2026-04-11..14), whose sibling files were already tracked. Scanned for credentials and private identifiers before committing; content is design tokens, DNS protocol reference, and implementation plans only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The command transcript embedded an absolute path from the machine the plan was written on. The command works unchanged when run from the repo root. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 17
Note
Due to the large number of review comments, Critical, Major severity comments were prioritized as inline comments.
🟡 Minor comments (6)
docs/superpowers/plans/2026-04-12-dns-parser.md-621-627 (1)
621-627: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winBracket IPv6 addresses when adding ports.
The reference allows IPv6 remote addresses.
format!("{}:{}", self.remote_ip, port)produces values such asfe80::1:54159, which is ambiguous. Use[fe80::1]:54159for IPv6 addresses.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/plans/2026-04-12-dns-parser.md` around lines 621 - 627, Update the source_ip construction in the detail_lines port-extraction loop to bracket IPv6 remote addresses before appending the port, producing [address]:port while preserving the existing address:port format for non-IPv6 addresses.docs/superpowers/plans/2026-04-12-dns-parser.md-258-281 (1)
258-281: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winPreserve the context-dependent meaning of RCODE 16.
The reference and specification define code 16 as
BADVERS/BADSIGdepending on EDNS or TSIG/TKEY context.rcode_namealways returnsBADSIG. Return a context-neutral label or pass the protocol context into the lookup.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/plans/2026-04-12-dns-parser.md` around lines 258 - 281, Update rcode_name so RCODE 16 does not unconditionally return BADSIG; use a context-neutral label or accept the EDNS versus TSIG/TKEY context and return BADVERS or BADSIG accordingly. Preserve the existing mappings and fallback behavior for all other codes.docs/superpowers/plans/2026-04-12-dns-parser.md-632-636 (1)
632-636: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winInclude the captured XID in the message.
parse_packet_capturesstoresxid, butinto_log_entrydoes not use it. The design states that the XID is included in the message. Add the XID to preserve query/response correlation, and assert it in a parser test.Also applies to: 691-724
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/plans/2026-04-12-dns-parser.md` around lines 632 - 636, Update into_log_entry’s message formatting to include the captured xid stored by parse_packet_captures, preserving the documented query/response correlation format. Extend the relevant parser test to assert that the generated log message contains the expected XID.docs/superpowers/plans/2026-04-12-dns-parser.md-204-256 (1)
204-256: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winComplete the QTYPE map.
The reference lists valid types such as
MD(3),MF(4),MB(7),MG(8),MR(9),NULL(10),WKS(11), andMINFO(14), butqtype_nameomits them. Audit records with these values will be displayed asUNKNOWN(n). Synchronize the map with the reference and add tests for the omitted codes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/plans/2026-04-12-dns-parser.md` around lines 204 - 256, The qtype_name map is missing valid QTYPE entries. Add the omitted mappings for MD (3), MF (4), MB (7), MG (8), MR (9), NULL (10), WKS (11), and MINFO (14), then add coverage verifying each code returns its expected name while preserving existing unknown-code behavior.docs/design-system/SKILL.md-70-71 (1)
70-71: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd blank lines after the
###headings.markdownlint MD022 reports these headings because body text follows immediately. Insert one blank line after each heading to keep the document lint-clean.
Proposed formatting
### 1. Severity colors are non-negotiable defaults + Errors are red row-wide.Also applies to: 73-74, 76-77, 79-80, 82-83, 85-86, 92-93, 98-99, 104-105, 107-108
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/design-system/SKILL.md` around lines 70 - 71, Insert a blank line after each affected ### heading in the design-system document, including the headings near the severity-colors section and the additional listed sections, so body text does not follow headings immediately and markdownlint MD022 passes.Source: Linters/SAST tools
docs/design-system/SKILL.md-29-30 (1)
29-30: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the
LogRow.tsxpath.Line 30 points to
src/components/log/LogRow.tsx, but the existing component is atsrc/components/log-view/LogRow.tsx. Update this table entry so developers can locate the component.Proposed fix
-| Log row, gutter, markers | `src/components/log/LogRow.tsx`, `LogGutter.tsx` | `09-components-log-grid.html` | +| Log row, gutter, markers | `src/components/log-view/LogRow.tsx`, `LogGutter.tsx` | `09-components-log-grid.html` |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/design-system/SKILL.md` around lines 29 - 30, Update the Log row, gutter, markers table entry to reference LogRow.tsx under src/components/log-view instead of src/components/log, while preserving the existing LogGutter.tsx reference and example filename.
🧹 Nitpick comments (4)
docs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md (1)
55-55: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd language identifiers to fenced code blocks.
The four fenced blocks at these lines trigger markdownlint MD040. Use an appropriate identifier such as
text,typescript, oryaml.Also applies to: 84-84, 112-112, 161-161
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md` at line 55, Add language identifiers to the four fenced code blocks in the workspace design document, including those at the referenced locations, using the appropriate identifiers such as text, typescript, or yaml based on each block’s contents.Source: Linters/SAST tools
docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md (3)
15-15: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winFix the task heading hierarchy.
### Task 1follows an#heading without an intermediate##heading. Use## Task 1through## Task 7, or add an intermediate section heading.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md` at line 15, Update the task headings in the workspace plan so Task 1 through Task 7 use the correct hierarchy under the document’s top-level heading: change each `### Task N` heading to `## Task N`, unless an intermediate `##` section is intentionally added.Source: Linters/SAST tools
1418-1422: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd automated tests for correlation and source state.
The plan only runs TypeScript compilation and manual visual checks. Add tests for IPv6 normalization, format classification, audit/DHCP correlation, source-path provenance, disabled-source rebuilds, and multi-source enrichment.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md` around lines 1418 - 1422, Add automated test coverage to the plan’s final checks for IPv6 normalization, format classification, audit/DHCP correlation, source-path provenance, disabled-source rebuilds, and multi-source enrichment. Update the “Step 6: Run final checks” section to run the relevant test commands alongside TypeScript compilation, replacing reliance on manual visual checks for these behaviors.
730-761: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winImplement lease-duration display or remove the requirement.
The design requires lease duration when DHCP data exists.
DeviceSummaryHeaderonly displays the DHCP event count, andDevicehas no lease fields. Add the required lease data to the model and header, or update the design.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md` around lines 730 - 761, The DHCP summary must display lease duration whenever DHCP data exists, but DeviceSummaryHeader currently only shows the event count and Device lacks lease fields. Add the lease-duration data to the Device model, populate it from the DHCP records, and render it in DeviceSummaryHeader alongside “DHCP events”; otherwise remove the lease-duration requirement from the design.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@docs/compass_artifact_wf-d4b3505b-8666-487c-9577-1184da86cbd6_text_markdown.md`:
- Around line 287-309: Complete the analytical keyword table by adding the
entries for event IDs 275–278 with their corresponding bit values, keeping it
synchronized with the event registry through IDs 279–280. Update the
tracelog.exe and logman capture masks to cover the full intended 64-bit channel
range, including bits above 31 and the documented audit/channel-selector bits.
- Around line 535-543: Update the “ETW/analytical parser” and “Critical
implementation note” sections to distinguish native .etl handling from EVTX
parsing: use an ETL decoder or tracerpt conversion for offline .etl files,
reserve evtx for resulting .evtx files, and retain ferrisetw for real-time ETW
consumption. Remove the wevtutil conversion reference.
- Around line 482-503: Correct the DNS debug-log examples in the “DNS header
flags bitmap” section to distinguish displayed byte order from the wire bitmap:
interpret displayed values by swapping the two bytes before decoding flags and
RCODE, so 0001→0x0100, 8081→0x8180, and 8385→0x8583/NXDOMAIN. Update the
standard recursive-response example to use displayed value 8081, explicitly
document the conversion rule, and add tests covering these conversions and
decoded results.
In `@docs/superpowers/plans/2026-04-12-dns-parser.md`:
- Around line 561-590: Update the parsing loop so encountering a blank line
flushes the current pending record into entries and clears pending before
continuing. Preserve the existing PACKET-line flush and detail-line accumulation
behavior, ensuring subsequent non-PACKET lines cannot be appended to a record
separated by a blank-line boundary.
- Around line 740-761: The timestamp parser’s ISO and slash-date paths split
only on literal spaces, so repeated whitespace or tabs produce empty tokens and
incorrect parsing. Update the logic surrounding the ISO split and the `parts`
construction to normalize whitespace with `split_whitespace()` (or equivalent
regex captures), preserving correct date, time, and optional AM/PM extraction.
- Around line 1261-1277: The provider validation is duplicated and only matches
the provider name, so GUID-only DNS EVTX records are missed. Add a shared
provider-matching helper for `Provider.#attributes.Name` or
`Provider.#attributes.Guid`, then use it in both `is_dns_evtx` and `parse_evtx`
instead of their direct name-only checks; preserve the existing DNS provider
constants and record-processing behavior.
- Around line 1851-1857: The parser plan and specification disagree with the
current non-DNS EVTX behavior: update src-tauri/src/parser/mod.rs so the non-DNS
branch dispatches to the Sysmon path, preserving routing for open_log_file,
batch parsing, and folder parsing; align
docs/superpowers/plans/2026-04-12-dns-parser.md:1851-1857 and
docs/superpowers/specs/2026-04-11-dns-parser-design.md:46-53 with that behavior,
or explicitly revise both documents to require the separate Sysmon workspace
instead.
In `@docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md`:
- Around line 1263-1266: Add an accessible name to the Switch in the source row
by associating it with source.fileName, using an explicit aria-label or
equivalent labeling mechanism while preserving the existing checked state and
toggleSource behavior.
- Around line 92-103: Update the format discriminator in the DHCP grouping
branch around dhcpByIp to handle format === "Dhcp" consistently with the
documented design and acceptance flow. Preserve the existing ipAddress grouping
behavior, and only retain the generic formats if their mapping to DHCP is
explicitly documented and tested.
- Around line 208-229: Update the addSource and removeSource rebuild paths to
filter entries to enabled sources before calling buildDevices, so disabled
sources remain excluded after any source change. Use the current sources state,
including the added or removed source, when applying the enabled-source filter;
preserve the existing source and allEntries updates.
- Around line 117-123: Update the DHCP enrichment logic in the isEnriched block
to select hostname and MAC values from the entry with the newest timestamp
rather than relying on dhcpEntries iteration order. Track the latest timestamp
independently for each metadata field, ignore entries without the relevant value
or timestamp, and preserve the existing fallback behavior when no valid value is
available.
- Around line 508-531: Update DeviceRow so its clickable device-selection
control is keyboard accessible: prefer replacing the clickable div with a native
button while preserving the existing selection styling and mouse behavior;
otherwise add button semantics, tabIndex, and Enter/Space handlers that invoke
onClick. Ensure keyboard activation selects the device without changing existing
pointer behavior.
- Around line 1292-1369: Update Task 6 to use the existing
src/components/log-view/DnsWorkspaceBanner.tsx and its no-props contract. Remove
the instruction to create a new component or require parser/onOpenInWorkspace
props; instead, describe modifying the existing DnsWorkspaceBanner and its
AppShell integration to conditionally show the banner for supported DNS/DHCP
parsers in the log workspace, load entries into the dns-dhcp store, and switch
workspaces.
- Around line 409-432: Centralize file opening in one validated loader and route
onOpenSource, onOpenPath, and DnsDhcpWorkspace.handleOpenFile through it.
Validate formatDetected against the supported formats before calling addSource,
preserving the original path and filename provenance. Replace console-only
failure handling with user-visible store errors, including when all selected
files fail, while retaining loading-state cleanup.
- Around line 62-72: Update stripPort to avoid treating an unbracketed IPv6
address as host:port: only strip a numeric suffix when the input is an
explicitly bracketed IPv6 host with a port, while preserving IPv4 addresses and
all unbracketed IPv6 values such as ::1 and 2001:db8::10 unchanged.
In `@docs/superpowers/specs/2026-04-11-dns-parser-design.md`:
- Around line 55-60: The date-order detection and parsing contract must handle
dates whose first and second fields are both 12 or less instead of silently
defaulting to MonthFirst. Update the detection logic around DateOrder and
dns_debug::parse_lines to return or propagate an explicit ambiguous state, then
support the documented frontend selection and re-parse flow; otherwise remove
the prompt and related caching claims from the specification.
In `@docs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md`:
- Around line 41-49: Align the DNS audit identity contract across all three
documented sites: in
docs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md lines 41-49,
explicitly define whether audit-only devices use event identity or IP identity;
in docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md lines 75-85, preserve
audit records that lack sourceIp; and in lines 830-836, ensure audit records are
not emitted as DNS query rows.
---
Minor comments:
In `@docs/design-system/SKILL.md`:
- Around line 70-71: Insert a blank line after each affected ### heading in the
design-system document, including the headings near the severity-colors section
and the additional listed sections, so body text does not follow headings
immediately and markdownlint MD022 passes.
- Around line 29-30: Update the Log row, gutter, markers table entry to
reference LogRow.tsx under src/components/log-view instead of
src/components/log, while preserving the existing LogGutter.tsx reference and
example filename.
In `@docs/superpowers/plans/2026-04-12-dns-parser.md`:
- Around line 621-627: Update the source_ip construction in the detail_lines
port-extraction loop to bracket IPv6 remote addresses before appending the port,
producing [address]:port while preserving the existing address:port format for
non-IPv6 addresses.
- Around line 258-281: Update rcode_name so RCODE 16 does not unconditionally
return BADSIG; use a context-neutral label or accept the EDNS versus TSIG/TKEY
context and return BADVERS or BADSIG accordingly. Preserve the existing mappings
and fallback behavior for all other codes.
- Around line 632-636: Update into_log_entry’s message formatting to include the
captured xid stored by parse_packet_captures, preserving the documented
query/response correlation format. Extend the relevant parser test to assert
that the generated log message contains the expected XID.
- Around line 204-256: The qtype_name map is missing valid QTYPE entries. Add
the omitted mappings for MD (3), MF (4), MB (7), MG (8), MR (9), NULL (10), WKS
(11), and MINFO (14), then add coverage verifying each code returns its expected
name while preserving existing unknown-code behavior.
---
Nitpick comments:
In `@docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md`:
- Line 15: Update the task headings in the workspace plan so Task 1 through Task
7 use the correct hierarchy under the document’s top-level heading: change each
`### Task N` heading to `## Task N`, unless an intermediate `##` section is
intentionally added.
- Around line 1418-1422: Add automated test coverage to the plan’s final checks
for IPv6 normalization, format classification, audit/DHCP correlation,
source-path provenance, disabled-source rebuilds, and multi-source enrichment.
Update the “Step 6: Run final checks” section to run the relevant test commands
alongside TypeScript compilation, replacing reliance on manual visual checks for
these behaviors.
- Around line 730-761: The DHCP summary must display lease duration whenever
DHCP data exists, but DeviceSummaryHeader currently only shows the event count
and Device lacks lease fields. Add the lease-duration data to the Device model,
populate it from the DHCP records, and render it in DeviceSummaryHeader
alongside “DHCP events”; otherwise remove the lease-duration requirement from
the design.
In `@docs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md`:
- Line 55: Add language identifiers to the four fenced code blocks in the
workspace design document, including those at the referenced locations, using
the appropriate identifiers such as text, typescript, or yaml based on each
block’s contents.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 7a77bab5-72fd-44db-aac1-af62de2180ac
📒 Files selected for processing (7)
.gitignoredocs/compass_artifact_wf-d4b3505b-8666-487c-9577-1184da86cbd6_text_markdown.mddocs/design-system/SKILL.mddocs/superpowers/plans/2026-04-12-dns-parser.mddocs/superpowers/plans/2026-04-14-dns-dhcp-workspace.mddocs/superpowers/specs/2026-04-11-dns-parser-design.mddocs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md
💤 Files with no reviewable changes (1)
- .gitignore
| | Bit | Keyword | Events | | ||
| |-----|---------|--------| | ||
| | 0x0000000000000001 | QUERY_RECEIVED | 256 | | ||
| | 0x0000000000000002 | RESPONSE_SUCCESS | 257 | | ||
| | 0x0000000000000004 | RESPONSE_FAILURE | 258 | | ||
| | 0x0000000000000008 | IGNORED_QUERY | 259 | | ||
| | 0x0000000000000010 | RECURSE_QUERY_OUT | 260 | | ||
| | 0x0000000000000020 | RECURSE_RESPONSE_IN | 261 | | ||
| | 0x0000000000000040 | RECURSE_QUERY_DROP | 262 | | ||
| | 0x0000000000000080 | DYN_UPDATE_RECV | 263 | | ||
| | 0x0000000000000100 | DYN_UPDATE_RESPONSE | 264 | | ||
| | 0x0000000000000200 | IXFR_REQ_OUT | 265 | | ||
| | 0x0000000000000400 | IXFR_REQ_RECV | 266 | | ||
| | 0x0000000000000800 | IXFR_RESP_OUT | 267 | | ||
| | 0x0000000000001000 | IXFR_RESP_RECV | 268 | | ||
| | 0x0000000000002000 | AXFR_REQ_OUT | 269 | | ||
| | 0x0000000000004000 | AXFR_REQ_RECV | 270 | | ||
| | 0x0000000000008000 | AXFR_RESP_OUT | 271 | | ||
| | 0x0000000000010000 | AXFR_RESP_RECV | 272 | | ||
| | 0x0000000000020000 | XFR_NOTIFY_IN | 273 | | ||
| | 0x0000000000040000 | XFR_NOTIFY_OUT | 274 | | ||
| | 0x0000000000800000 | INTERNAL_LOOKUP_CNAME | 279 | | ||
| | 0x0000000001000000 | INTERNAL_LOOKUP_ADDITIONAL | 280 | |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Make the analytical keyword table and capture masks complete.
The event registry includes IDs 275–280, but the keyword table omits the bits for IDs 275–278. The 0x7FFFF mask covers only bits 0–18, so the tracelog.exe command misses IDs 279–280. The logman command uses 0xFFFFFFFF, which also misses the documented bits above bit 31, including audit and channel-selector bits. Sync the keyword table with the event registry and use masks that cover the intended 64-bit channels.
Also applies to: 334-344
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@docs/compass_artifact_wf-d4b3505b-8666-487c-9577-1184da86cbd6_text_markdown.md`
around lines 287 - 309, Complete the analytical keyword table by adding the
entries for event IDs 275–278 with their corresponding bit values, keeping it
synchronized with the event registry through IDs 279–280. Update the
tracelog.exe and logman capture masks to cover the full intended 64-bit channel
range, including bits above 31 and the documented audit/channel-selector bits.
| ## 8. DNS header flags bitmap | ||
|
|
||
| ``` | ||
| Bit 15 (MSB): QR — 0=Query, 1=Response | ||
| Bits 14-11: Opcode — 0=QUERY, 4=NOTIFY, 5=UPDATE | ||
| Bit 10: AA — Authoritative Answer | ||
| Bit 9: TC — Truncation | ||
| Bit 8: RD — Recursion Desired | ||
| Bit 7: RA — Recursion Available | ||
| Bit 6: Z — Reserved (must be 0) | ||
| Bit 5: AD — Authentic Data (DNSSEC) | ||
| Bit 4: CD — Checking Disabled (DNSSEC) | ||
| Bits 3-0: RCODE — Response code (4-bit) | ||
| ``` | ||
|
|
||
| **Debug log hex flags decode examples:** | ||
| - `0x0001` → QR=0, RD=1 (query with recursion desired) → char flags: `D` | ||
| - `0x8081` → QR=1, RD=1, RA=1 (response, recursion available) → char flags: `DR` | ||
| - `0x8385` → QR=1, AA=1, RD=1, RA=1, RCODE=5 → char flags: `A DR`, RCODE=REFUSED | ||
| - `0x8180` → QR=1, RD=1, RA=1 (standard recursive response) → char flags: `DR` | ||
|
|
||
| The debug log char codes map: **A**=AA, **T**=TC, **D**=RD, **R**=RA. These appear between the hex flags and the RCODE name inside the square brackets. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file='docs/compass_artifact_wf-d4b3505b-8666-487c-9577-1184da86cbd6_text_markdown.md'
printf '%s\n' '--- target section ---'
sed -n '450,520p' "$file"
printf '%s\n' '--- related files and symbols ---'
rg -n -i --glob '!node_modules' --glob '!dist' --glob '!build' \
'dns\.log|char flags|flags.*hex|RCODE|RD|RA|byte.?swap|DNS header' .
printf '%s\n' '--- tracked files with likely implementations/tests ---'
git ls-files | rg -i 'dns|log|test|spec' | head -200Repository: adamgell/cmtraceopen
Length of output: 50377
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- candidate paths ---'
fd -HI -t f 'dns|resolver|log' . | head -200
printf '%s\n' '--- all exact references ---'
rg -n -i --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
'dns\.log|0x8081|0x8385|0x8180|char.?flags|flags.*bitmap|RCODE' .Repository: adamgell/cmtraceopen
Length of output: 50377
🏁 Script executed:
#!/bin/bash
set -eu
file='docs/compass_artifact_wf-d4b3505b-8666-487c-9577-1184da86cbd6_text_markdown.md'
printf '%s\n' '--- document references ---'
rg -n -C 4 -i 'dns|flags|header|rcode|debug log' "$file" | head -300
printf '%s\n' '--- repository references ---'
rg -n -C 3 -i --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
'dns\.log|0x0001|0x8081|0x8385|0x8180|dns.*flags|flags.*dns|rcode' . | head -500Repository: adamgell/cmtraceopen
Length of output: 50378
🏁 Script executed:
#!/bin/bash
set -eu
rg -n -C 4 -i --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
'dns\.log|0x0001|0x8081|0x8385|0x8180|char.?flags|rcode|dns.*flags|flags.*dns' .Repository: adamgell/cmtraceopen
Length of output: 50377
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- DNS parser implementation ---'
sed -n '1,285p' crates/cmtraceopen-parser/src/parser/dns_debug.rs
printf '%s\n' '--- DNS parser tests ---'
sed -n '400,570p' crates/cmtraceopen-parser/src/parser/dns_debug.rs
printf '%s\n' '--- DNS fixtures and sample flag records ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
'PACKET.*\[|^\s*[0-9].*PACKET|0x8081|0x8385|0x8180|0001\s+[ATDR ]' \
crates docs e2e scripts | head -300Repository: adamgell/cmtraceopen
Length of output: 27173
🏁 Script executed:
#!/bin/bash
set -eu
sed -n '1,285p' crates/cmtraceopen-parser/src/parser/dns_debug.rs
sed -n '400,570p' crates/cmtraceopen-parser/src/parser/dns_debug.rs
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' \
'PACKET.*\[|0x8081|0x8385|0x8180|0001\s+[ATDR ]' \
crates docs e2e scripts | head -300
python3 - <<'PY'
values = [0x0001, 0x8081, 0x8385, 0x8180]
masks = {"QR": 0x8000, "AA": 0x0400, "TC": 0x0200,
"RD": 0x0100, "RA": 0x0080}
for value in values:
swapped = ((value & 0xff) << 8) | (value >> 8)
def decode(v):
return [name for name, mask in masks.items() if v & mask], v & 0xf
print(f"{value:`#06x`}: standard={decode(value)}, byte_swapped={decode(swapped)}")
PYRepository: adamgell/cmtraceopen
Length of output: 27113
Correct the debug-log flag byte order and examples. dns.log displays the two flag bytes in reverse order from the DNS wire bitmap: 0001 represents 0x0100 (RD), and 8081 represents 0x8180 (QR/RD/RA). Therefore, 8385 represents 0x8583 (AA/RD/RA, RCODE 3/NXDOMAIN), not RCODE 5/REFUSED. 8081, not 8180, is the displayed value for a standard recursive response. State this rule and add conversion tests.
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)
[warning] 484-484: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@docs/compass_artifact_wf-d4b3505b-8666-487c-9577-1184da86cbd6_text_markdown.md`
around lines 482 - 503, Correct the DNS debug-log examples in the “DNS header
flags bitmap” section to distinguish displayed byte order from the wire bitmap:
interpret displayed values by swapping the two bytes before decoding flags and
RCODE, so 0001→0x0100, 8081→0x8180, and 8385→0x8583/NXDOMAIN. Update the
standard recursive-response example to use displayed value 8081, explicitly
document the conversion rule, and add tests covering these conversions and
decoded results.
| 1. **Debug log parser** — custom line-by-line parser using `regex` crate or hand-rolled state machine (NXLog's experience suggests hand-written outperforms regex). Handle timestamp detection with fallback patterns. Emit structured records with typed fields. | ||
|
|
||
| 2. **EVTX/audit parser** — use the `evtx` crate to read `.evtx` files, then dispatch on `EventID` to extract typed `EventData` fields. Map `Type`/`RDATA` fields from hex to structured records. | ||
|
|
||
| 3. **ETW/analytical parser** — for offline `.etl` files, use `evtx` crate (which can read archived analytical logs). For real-time capture, use `ferrisetw` to subscribe to the DNS Server provider GUID. Extract `PacketData` fields and decode with `hickory-proto` for full DNS message parsing. | ||
|
|
||
| ### Critical implementation note | ||
|
|
||
| The analytical channel produces `.etl` files, not `.evtx`. These cannot be consumed through standard Windows Event Log APIs. For real-time DNS query monitoring on Server 2012 R2+, ETW is the only path. The `evtx` crate can read archived `.etl` files converted to `.evtx` via `wevtutil`, but native `.etl` consumption requires an ETW consumer like `ferrisetw`. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=$(git ls-files | rg 'docs/compass_artifact_wf-d4b3505b-8666-487c-9577-1184da86cbd6_text_markdown\.md$')
printf '%s\n' "$file"
sed -n '510,555p' "$file"
printf '\nReferences to evtx, ETL, and ferrisetw:\n'
rg -n -i 'evtx|\.etl|ferrisetw|analytical channel|wevtutil' -- "$file" README.md .github 2>/dev/null || true
printf '\nManifest and lockfile references:\n'
rg -n '(^|[^[:alnum:]_])(evtx|ferrisetw|hickory-proto)([^[:alnum:]_]|$)' --glob 'Cargo.toml' --glob 'Cargo.lock' --glob '*.md' . 2>/dev/null || trueRepository: adamgell/cmtraceopen
Length of output: 26312
🌐 Web query:
omerbenamram evtx Rust crate ETL support native .etl files archived analytical logs
💡 Result:
The omerbenamram/evtx Rust crate does not natively support or parse.etl (Event Trace Log) files [1][2]. The crate is explicitly designed as a specialized, high-performance parser for the Windows XML Event Log (.evtx) format [1][3]. While the crate includes advanced features such as WEVT_TEMPLATE extraction for handling missing or corrupt templates within.evtx files [4][5], this functionality is specific to the.evtx format and does not extend to the binary ETL format [4][6]. Analytical or debug logs in Windows are frequently stored as.etl files, which utilize a different architecture (ETW - Event Tracing for Windows) than the standard.evtx log files [7]. To work with.etl files, they generally must be converted to.evtx format using native Windows utilities, such as tracerpt.exe, before they can be processed by standard event log tools [8][7]. Top results: [1][2][8][7]
Citations:
- 1: https://github.com/omerbenamram/evtx
- 2: https://docs.rs/crate/evtx/latest
- 3: https://crates.io/crates/evtx
- 4: https://github.com/omerbenamram/evtx/blob/master/docs/wevt_templates.md
- 5: https://github.com/omerbenamram/evtx/blob/master/CHANGELOG.md
- 6: https://docs.rs/evtx/latest/evtx/
- 7: https://chadduffey.com/windows/2023/09/01/ETLtoEVTX.html
- 8: https://learn.microsoft.com/en-us/answers/questions/3161850/(solved)-how-can-i-bulk-covert-etl-files-to-evtx-f
🌐 Web query:
Microsoft Windows Event Trace Log .etl convert to .evtx wevtutil analytical channel
💡 Result:
To convert a Windows Event Trace Log (.etl) file to the Windows Event Log (.evtx) format, the built-in Windows command-line utility tracerpt.exe is the standard tool, not wevtutil.exe [1][2]. The wevtutil.exe utility is designed for managing and exporting existing.evtx-based event logs; it cannot convert raw binary.etl files into the.evtx format [3][4]. Conversion Process You can use tracerpt.exe to perform the conversion by running the following command in an elevated command prompt [2][5]: tracerpt .etl -o .evtx -of EVTX If your.etl file requires specific decoding metadata (such as TMF files or PDB symbols for custom EventSource traces), you must include the -import parameter to ensure the data is correctly interpreted [5]: tracerpt .etl -import .man -o .evtx -of EVTX Important Considerations Analytical Channels and Forwarding: Analytical and Debug channels are often in.etl format because they are designed for high-volume performance tracing, not for long-term storage or Windows Event Forwarding (WEF) [4][6]. WEF is natively designed to consume.evtx files [4]. While you can manually convert a point-in-time.etl snapshot to.evtx using the command above, this is generally not suitable for real-time log forwarding or "live" analytical channel streaming [4][6]. Alternative Methods - Event Viewer: You can open individual.etl files directly in the Windows Event Viewer by selecting "Open Saved Log..." from the Action menu [7]. This allows you to view the events and then manually save/export them as an.evtx file [1]. - Performance Analysis: If the.etl file contains system performance data, it is more effectively analyzed using the Windows Performance Analyzer (WPA) or Performance Monitor, rather than converting it to.evtx [8][7].
Citations:
- 1: https://learn.microsoft.com/en-us/answers/questions/3161850/(solved)-how-can-i-bulk-covert-etl-files-to-evtx-f
- 2: https://michlstechblog.info/blog/windows-convert-an-etl-event-tracing-file-into-a-human-readable-format/
- 3: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
- 4: https://chadduffey.com/windows/2023/09/01/ETLtoEVTX.html
- 5: https://writeasync.net/?p=1371
- 6: https://www.chadduffey.com/windows/2023/09/01/ETLtoEVTX.html
- 7: https://phillburrows.co.uk/learn/how-to-open-an-etl-file
- 8: https://learn.microsoft.com/en-us/windows-hardware/test/wpt/opening-and-analyzing-etl-files-in-wpa
Separate native .etl handling from EVTX parsing. evtx parses .evtx files and does not parse native .etl files. For offline .etl input, use an ETL decoder or convert it with tracerpt before EVTX parsing. Use ferrisetw for real-time ETW consumption. Replace the wevtutil conversion reference accordingly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@docs/compass_artifact_wf-d4b3505b-8666-487c-9577-1184da86cbd6_text_markdown.md`
around lines 535 - 543, Update the “ETW/analytical parser” and “Critical
implementation note” sections to distinguish native .etl handling from EVTX
parsing: use an ETL decoder or tracerpt conversion for offline .etl files,
reserve evtx for resulting .evtx files, and retain ferrisetw for real-time ETW
consumption. Remove the wevtutil conversion reference.
| // Skip blank lines | ||
| if trimmed.is_empty() { | ||
| continue; | ||
| } | ||
|
|
||
| // Try to match as a PACKET summary line | ||
| if let Some(caps) = re.captures(trimmed) { | ||
| // Flush any pending entry | ||
| if let Some(p) = pending.take() { | ||
| entries.push(p.into_log_entry(id, file_path, &port_re)); | ||
| id += 1; | ||
| } | ||
|
|
||
| // Parse the new PACKET line | ||
| match parse_packet_captures(&caps, (i + 1) as u32, date_order) { | ||
| Ok(p) => { | ||
| pending = Some(p); | ||
| } | ||
| Err(_) => { | ||
| parse_errors += 1; | ||
| } | ||
| } | ||
| } else if pending.is_some() { | ||
| // Detail line — append to pending entry | ||
| if let Some(ref mut p) = pending { | ||
| p.detail_lines.push(trimmed.to_string()); | ||
| } | ||
| } | ||
| // Lines before any PACKET match (header) are silently skipped | ||
| } |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Flush pending records at blank-line boundaries.
The specification says a blank-line sequence ends a logical record, but this loop only skips blank lines. Every later non-PACKET line is then appended to the previous record. A stray detail or Remote addr line can be assigned to the wrong entry. Flush pending when the blank-line boundary is reached, or validate detail lines before appending them.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/superpowers/plans/2026-04-12-dns-parser.md` around lines 561 - 590,
Update the parsing loop so encountering a blank line flushes the current pending
record into entries and clears pending before continuing. Preserve the existing
PACKET-line flush and detail-line accumulation behavior, ensuring subsequent
non-PACKET lines cannot be appended to a record separated by a blank-line
boundary.
| // Try ISO-style first: yyyyMMdd HH:mm:ss | ||
| if let Some((date_part, time_part)) = trimmed.split_once(' ') { | ||
| if date_part.len() == 8 && date_part.chars().all(|c| c.is_ascii_digit()) { | ||
| let yr: i32 = date_part[0..4].parse().unwrap_or(0); | ||
| let mon: u32 = date_part[4..6].parse().unwrap_or(1); | ||
| let day: u32 = date_part[6..8].parse().unwrap_or(1); | ||
| let (h, m, s) = parse_time_hms(time_part, false); | ||
|
|
||
| return build_timestamp(yr, mon, day, h, m, s); | ||
| } | ||
| } | ||
|
|
||
| // Slash-date format: split on space to get date, time, and optional AM/PM | ||
| let parts: Vec<&str> = trimmed.splitn(3, ' ').collect(); | ||
| if parts.len() < 2 { | ||
| return (None, Some(trimmed.to_string())); | ||
| } | ||
|
|
||
| let date_str = parts[0]; | ||
| let has_ampm = parts.len() == 3 | ||
| && (parts[2].eq_ignore_ascii_case("AM") || parts[2].eq_ignore_ascii_case("PM")); | ||
| let time_str = parts[1]; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Parse timestamps with whitespace normalization.
The regex accepts variable whitespace, and the reference documents variable whitespace. split_once(' ') and splitn(3, ' ') preserve empty tokens for repeated spaces or tabs. Valid records can therefore receive 00:00:00 or lose the AM/PM marker. Use split_whitespace() or regex captures for both timestamp paths.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/superpowers/plans/2026-04-12-dns-parser.md` around lines 740 - 761, The
timestamp parser’s ISO and slash-date paths split only on literal spaces, so
repeated whitespace or tabs produce empty tokens and incorrect parsing. Update
the logic surrounding the ISO split and the `parts` construction to normalize
whitespace with `split_whitespace()` (or equivalent regex captures), preserving
correct date, time, and optional AM/PM extraction.
| return ( | ||
| <div | ||
| onClick={onClick} | ||
| style={{ | ||
| padding: "6px 10px", | ||
| cursor: "pointer", | ||
| borderLeft: isSelected | ||
| ? `3px solid ${tokens.colorBrandForeground1}` | ||
| : "3px solid transparent", | ||
| background: isSelected | ||
| ? tokens.colorNeutralBackground1Selected | ||
| : "transparent", | ||
| opacity: device.isEnriched ? 1 : 0.7, | ||
| fontSize: metrics.fontSize, | ||
| }} | ||
| onMouseEnter={(e) => { | ||
| if (!isSelected) | ||
| e.currentTarget.style.background = | ||
| tokens.colorNeutralBackground1Hover; | ||
| }} | ||
| onMouseLeave={(e) => { | ||
| if (!isSelected) | ||
| e.currentTarget.style.background = "transparent"; | ||
| }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Make device selection keyboard accessible.
DeviceRow is a clickable div without a role, tabIndex, or keyboard handler. Keyboard users cannot select a device. Use a native button, or implement Enter and Space handling with the required accessibility semantics.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md` around lines 508 -
531, Update DeviceRow so its clickable device-selection control is keyboard
accessible: prefer replacing the clickable div with a native button while
preserving the existing selection styling and mouse behavior; otherwise add
button semantics, tabIndex, and Enter/Space handlers that invoke onClick. Ensure
keyboard activation selects the device without changing existing pointer
behavior.
| <Switch | ||
| checked={source.enabled} | ||
| onChange={() => toggleSource(source.path)} | ||
| style={{ marginLeft: 8 }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Give each source switch an accessible name.
The Switch has no label or aria-label. A screen reader cannot identify which source it toggles. Associate it with source.fileName or set an explicit accessible name.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md` around lines 1263 -
1266, Add an accessible name to the Switch in the source row by associating it
with source.fileName, using an explicit aria-label or equivalent labeling
mechanism while preserving the existing checked state and toggleSource behavior.
| ### Task 6: Auto-Detect Banner in Log Viewer | ||
|
|
||
| **Files:** | ||
| - Create: `src/src-react/components/log-view/DnsWorkspaceBanner.tsx` | ||
|
|
||
| This task adds the auto-detect prompt that appears when a DNS/DHCP file is opened in the standard log viewer. | ||
|
|
||
| - [ ] **Step 1: Create `DnsWorkspaceBanner.tsx`** | ||
|
|
||
| Create `src/src-react/components/log-view/DnsWorkspaceBanner.tsx`: | ||
|
|
||
| ```tsx | ||
| import { useState } from "react"; | ||
| import { tokens, Button } from "@fluentui/react-components"; | ||
| import { Dismiss16Regular } from "@fluentui/react-icons"; | ||
| import type { ParserKind } from "../../types/log"; | ||
|
|
||
| const PARSER_LABELS: Partial<Record<ParserKind, string>> = { | ||
| dnsDebug: "DNS debug log", | ||
| dnsAudit: "DNS audit log", | ||
| dhcp: "DHCP server log", | ||
| }; | ||
|
|
||
| export function DnsWorkspaceBanner({ | ||
| parser, | ||
| onOpenInWorkspace, | ||
| }: { | ||
| parser: ParserKind; | ||
| onOpenInWorkspace: () => void; | ||
| }) { | ||
| const [dismissed, setDismissed] = useState(false); | ||
|
|
||
| const label = PARSER_LABELS[parser]; | ||
| if (!label || dismissed) return null; | ||
|
|
||
| return ( | ||
| <div | ||
| style={{ | ||
| display: "flex", | ||
| alignItems: "center", | ||
| gap: 12, | ||
| padding: "6px 12px", | ||
| background: tokens.colorNeutralBackground4, | ||
| borderBottom: `1px solid ${tokens.colorNeutralStroke1}`, | ||
| fontSize: 13, | ||
| color: tokens.colorNeutralForeground2, | ||
| }} | ||
| > | ||
| <span> | ||
| This looks like a {label}. Open in the DNS/DHCP workspace for device | ||
| correlation and query analysis? | ||
| </span> | ||
| <Button | ||
| size="small" | ||
| appearance="primary" | ||
| onClick={onOpenInWorkspace} | ||
| > | ||
| Open in Workspace | ||
| </Button> | ||
| <Button | ||
| size="small" | ||
| appearance="subtle" | ||
| icon={<Dismiss16Regular />} | ||
| onClick={() => setDismissed(true)} | ||
| /> | ||
| </div> | ||
| ); | ||
| } | ||
| ``` | ||
|
|
||
| - [ ] **Step 2: Integrate the banner** | ||
|
|
||
| Find the main log list view component. The banner should be rendered conditionally above the log list when `parserSelection.parser` is `dnsDebug`, `dnsAudit`, or `dhcp` and the active workspace is `log`. The `onOpenInWorkspace` handler should: | ||
|
|
||
| 1. Load the current file's entries into the dns-dhcp store | ||
| 2. Switch the active workspace to `dns-dhcp` | ||
|
|
||
| The exact integration point depends on the log view component structure — the implementer should find where the log list renders and add the banner above it. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Update this task to the existing banner contract.
The supplied code already contains src/components/log-view/DnsWorkspaceBanner.tsx, and AppShell renders <DnsWorkspaceBanner /> without props. This plan creates a different path and requires parser and onOpenInWorkspace props. Following it literally can create a duplicate component or a TypeScript error. Update the plan to modify the existing component and integration.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md` around lines 1292 -
1369, Update Task 6 to use the existing
src/components/log-view/DnsWorkspaceBanner.tsx and its no-props contract. Remove
the instruction to create a new component or require parser/onOpenInWorkspace
props; instead, describe modifying the existing DnsWorkspaceBanner and its
AppShell integration to conditionally show the banner for supported DNS/DHCP
parsers in the log workspace, load entries into the dns-dhcp store, and switch
workspaces.
| ### Date order detection (debug log) | ||
|
|
||
| Scan PACKET lines in the sample: | ||
| - If any date field position 1 > 12 → `DayFirst` | ||
| - If any date field position 2 > 12 → `MonthFirst` | ||
| - If all values <=12 → return ambiguous result; frontend prompts user: "This DNS log has ambiguous date formatting. Is the date format MM/DD or DD/MM?" and re-parses with the selection |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Make ambiguous date handling match the parser contract.
The supplied detect.rs implementation only sets DateOrder::DayFirst when the first date field is greater than 12. It does not inspect the second field or return an ambiguous state. dns_debug::parse_lines receives a fixed DateOrder. Therefore, dates where both fields are 12 or less are silently parsed as MonthFirst, and the documented frontend prompt cannot occur. Implement an explicit ambiguous-selection path, or remove the prompt and caching claims.
Also applies to: 120-127
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/superpowers/specs/2026-04-11-dns-parser-design.md` around lines 55 - 60,
The date-order detection and parsing contract must handle dates whose first and
second fields are both 12 or less instead of silently defaulting to MonthFirst.
Update the detection logic around DateOrder and dns_debug::parse_lines to return
or propagate an explicit ambiguous state, then support the documented frontend
selection and re-parse flow; otherwise remove the prompt and related caching
claims from the specification.
| | Sources loaded | Device list shows | Detail panel shows | | ||
| |---------------|-------------------|-------------------| | ||
| | DNS debug only | Source IPs with query stats (provisional) | DNS queries from that IP | | ||
| | DNS audit only | Event IDs with zone/record info | Audit events (record creates/deletes) | | ||
| | DHCP only | Devices with hostname/MAC, zero DNS | DHCP lease events | | ||
| | DNS + DHCP | IPs enriched with hostname/MAC | DNS queries + DHCP context | | ||
| | DNS + DHCP + audit | Full picture | DNS queries + audit events + DHCP context | | ||
|
|
||
| Provisional (IP-only) devices are shown with a dimmed visual indicator. When DHCP data is added, matching IPs upgrade to enriched entries. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Align the DNS audit contract across the design and plan.
The design promises audit-event devices, but the plan only supports IP-keyed DNS query devices.
docs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md#L41-L49: define whether audit-only devices use event identity or IP identity.docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md#L75-L85: preserve audit records instead of dropping entries withoutsourceIp.docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md#L830-L836: prevent audit records from appearing as DNS query rows.
📍 Affects 2 files
docs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md#L41-L49(this comment)docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md#L75-L85docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md#L830-L836
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md` around lines
41 - 49, Align the DNS audit identity contract across all three documented
sites: in docs/superpowers/specs/2026-04-14-dns-dhcp-workspace-design.md lines
41-49, explicitly define whether audit-only devices use event identity or IP
identity; in docs/superpowers/plans/2026-04-14-dns-dhcp-workspace.md lines
75-85, preserve audit records that lack sourceIp; and in lines 830-836, ensure
audit records are not emitted as DNS query rows.
|
@copilot Is this ready? |
Yes — all 15 CI checks are green (Rust MSRV on Ubuntu + Windows, TypeScript, E2E/Playwright, ESP Diagnostics, Rust Check & Test, all three platform builds, CodeQL, and the full suite of CodeQL Analyze jobs). The PR is ready to merge. |
Summary
The
docs/rule at line 24 of.gitignorewas unanchored, so it ignored everydocsdirectory anywhere in the tree. Since the rootdocs/directory is tracked onmain(19 files:docs/design-system,docs/superpowers,docs/esp-diagnostics-windows-vm-acceptance.md),git add docs/...exited 1 with ignore advice even for tracked files, and any new file under anydocs/directory was silently swallowed.This is the same pathology as the previously fixed unanchored
Logs/rule (see the explanatory comment retained in.gitignoreand epic #356 history).Why remove instead of anchor
Anchoring to
/docs/would still ignore the rootdocs/directory, which is exactly where the tracked files live, sogit add docs/sccm/README.mdwould keep failing. Since docs are meant to be tracked, the rule is removed entirely.docs/.DS_Storeremains covered by the existing.DS_Storerule.Recovered files
The rule was silently hiding six real docs files that existed only in local working copies. The second commit adds them: the DNS parser reference,
docs/design-system/SKILL.md, and the DNS parser / DNS-DHCP workspace plans and specs (whose sibling files were already tracked). Scanned for credentials and private identifiers before committing; content is design tokens, DNS protocol reference, and implementation plans only.Verification
Before the fix:
git check-ignore -v docs/sccm/README.mdmatched.gitignore:24:docs/git check-ignore -v src-tauri/docs/notes.mdmatched.gitignore:24:docs/git add --dry-run docs/esp-diagnostics-windows-vm-acceptance.md(a tracked file) exited 1 with ignore adviceAfter the fix:
docs/probes above report not-ignoredgit add docs/, no-fneededdocs/.DS_Storestill matches the.DS_Storerule;node_modules/still matchesThe
codex/parser-family-skeletonbranch (PR #388) carries the same unanchored rule and will pick this fix up when it rebases onto or mergesmain.🤖 Generated with Claude Code
Summary by CodeRabbit