feat(parser): add the EvtxECmd map engine - #541

Merged

adamgell merged 87 commits into

mainfrom

feat/eventmap-engine

Aug 13, 2026

Commits on Aug 9, 2026

feat(parser): add the EvtxECmd map engine

adamgell
and
claude
committed
8dd5c9f
fix(parser): join repeated elements, matching verified EvtxECmd behaviour

adamgell
and
claude
committed
23dca7b
feat(event-log): load EvtxECmd .map files from disk

adamgell
and
claude
committed
4fe3ab7
fix(parser): render map templates in a single pass

adamgell
and
claude
committed
6f819fd
feat(parser): build XPath queries so the service does the filtering

adamgell
and
claude
committed
9ed4e3e
perf(event-log): filter in the service and query channels concurrently

adamgell
and
claude
committed
2976833
feat(event-log): give the live view a server-side time window

adamgell
and
claude
committed
c91d4fc
feat(event-log): convert rendered event XML into the map engine's node tree

adamgell
and
claude
committed
f0f2e94
fix(event-log): take a slice in the XML close helper

adamgell
and
claude
committed
5867298
feat(event-log): surface the System block fields every event carries

adamgell
and
claude
committed
80a57c2
feat(event-log): export the events on screen to CSV, TSV, JSON, or event XML

adamgell
and
claude
committed
462c976
feat(event-log): apply loaded maps to events and surface the columns

adamgell
and
claude
committed
4ec7066
fix(parser): emit queries the Event Log service actually accepts

adamgell
and
claude
committed
99e810b
fix(event-log): gate the new commands behind the event-log feature

adamgell
and
claude
committed
9e448d0
fix(parser): quote by delimiter choice and budget by expressions, not selectors

adamgell
and
claude
committed
50fb050
test(event-log): exercise the live query path against a real service

adamgell
and
claude
committed
ff7020c
feat(parser): render event descriptions from captured provider metadata

adamgell
and
claude
committed
cc36318
feat(event-log): read captured provider metadata from a provider database

adamgell
and
claude
committed
43b9bab
test(event-log): read a real provider database, not just synthetic fixtures

adamgell
and
claude
committed
a233344
fix(parser): accept the signed integers the provider metadata actually contains

adamgell
and
claude
committed
11f34b1
feat(event-log): render provider descriptions for events read from files

adamgell
and
claude
committed
bd031f8
test(event-log): prove the description chain against a real database

adamgell
and
claude
committed
41f6407
feat(event-log): group the event list by level, provider, channel, id, or day

adamgell
and
claude
committed
30f30e0
feat(event-log): wire grouping into the list and add a group-by control

adamgell
and
claude
committed
16d9ea3
feat(event-log): add a saved filter library

adamgell
and
claude
committed
f1e82bd
feat(event-log): persist the filter library and apply saved filters from the bar

adamgell
and
claude
committed
212463e
feat(event-log): add a column model with visibility, order, and widths

adamgell
and
claude
committed
5830712
feat(event-log): render the list from the column config and add a chooser

adamgell
and
claude
committed
84a78bd
feat(parser): merge Windows events and text logs into one timeline

adamgell
and
claude
committed
d3dec44
feat(event-log): place events on the unified timeline and expose it over IPC

adamgell
and
claude
committed
c4805ea
feat(event-log): frontend model for the unified timeline

adamgell
and
claude
committed
3309070
feat(event-log): render the unified timeline

adamgell
and
claude
committed
8de9b26
feat(event-log): decode .etl payloads and fix the dead file-open path

adamgell
and
claude
committed
adfeb11
test(event-log): cover the .evtx file path against a real capture

adamgell
and
claude
committed
70db7bd
fix(parser): give every split query node an Id and pin the structured form

adamgell
and
claude
committed
4784b3f
fix(event-log): stop the map loader hiding gaps and depending on read_dir order

adamgell
and
claude
committed
f655a9e
docs(eventmap): a format conversion cannot be byte-faithful

adamgell
and
claude
committed
7ebe1f3
fix(event-log): import the shared timestamp parser in the live path

adamgell
and
claude
committed
1338145
fix(event-log): explain what is missing from a parse instead of counting it

adamgell
and
claude
committed
174767e
feat(event-log): show what is missing from the loaded events

adamgell
and
claude
committed
f7bb7b0
fix(event-log): show event times in one stated zone instead of three unstated ones

adamgell
and
claude
committed
ee3ff9c
feat(event-log): let map-derived values be columns, not just detail-pane text

adamgell
and
claude
committed
a35403b

Commits on Aug 10, 2026

fix(event-log): stop dropping fields from events that carry no Data element

adamgell
and
claude
committed
eac274e
fix(parser): cost the time window correctly and record the real expression limit

adamgell
and
claude
committed
c9961b1
fix(event-log): stop misattributing values in rendered descriptions

adamgell
and
claude
committed
9ce3e90
refactor(event-log): own the map and provider registries in AppState

adamgell
and
claude
committed
55b0294
fix(event-log): pass the registry in the live service tests

adamgell
and
claude
committed
033e8f5
fix(event-log): remove a duplicated argument in two service tests

adamgell
and
claude
committed
d6ffbbd
fix(event-log): stop an oversized exclusion filter silently returning nothing

adamgell
and
claude
committed
8b3d950
fix(parser): bound the terms that repeat in every node, not just the Event IDs

adamgell
and
claude
committed
722e79c
test(event-log): drive coverage gaps through the store, not just the merge rule

adamgell
and
claude
committed
d44afcb
fix(event-log): label positional fields by slot, and use the one filter ordering

adamgell
and
claude
committed
21a0c05
fix(event-log): send event origins over the wire with the keys the UI reads

adamgell
and
claude
committed
9dae0fc
test(event-log): give the timeline fixture distinguishable ids, and document severities

adamgell
and
claude
committed
79de6e2
fix(event-log): apply the time window on refresh, and stop emitting over-budget nodes

adamgell
and
claude
committed
cb2b13c
fix(event-log): close four saved-filter findings I had misread as already fixed

adamgell
and
claude
committed
48dce30
fix(event-log): stop a wide id range hanging the tab, and name classic providers

adamgell
and
claude
committed
a57ec6a
fix(event-log): export the columns the grid showed, and stop reopening databases

adamgell
and
claude
committed
9133042
fix(event-log): make saving and reordering work for macOS and keyboard operators

adamgell
and
claude
committed
6f988c6
fix(event-log): gate the event-log-only dependencies, and tighten weak tests

adamgell
and
claude
committed
3cbfe51
fix(parser): make provider metadata able to read its own output back

adamgell
and
claude
committed
2965fbf
perf(event-log): stop shipping every record's XML for a delimited export

adamgell
and
claude
committed
270b557
fix(event-log): verify the reader's reply at the boundary, once

adamgell
and
claude
committed
91273d8
fix(event-log): keep the empty live region in the accessibility tree

adamgell
and
claude
committed
ba55802
fix(event-log): refuse malformed value paths, and declare the grouped list a tree

adamgell
and
claude
committed
20c01be
fix(event-log): clear a selection collapse hides, and stop two tests passing vacuously

adamgell
and
claude
committed
6c546d5

Commits on Aug 11, 2026

Commits on Aug 12, 2026

fix(eventmap): make the memoized cache impossible to outlive its source

adamgell
and
claude
committed
4ad735d
docs(eventmap): say what compiled() actually does

adamgell
and
claude
committed
d72096c
fix(event-log): read the live path's fields from the parsed tree

adamgell
and
claude
committed
282b90c
test(event-log): add a timing harness for the live scan

adamgell
and
claude
committed
05ae283
fix(event-log): query channels one at a time, not all in one request

adamgell
and
claude
committed
38f66be
docs(event-log): stop claiming a default event cap that does not exist

adamgell
and
claude
committed
8964b2d
test(event-log): account for where a scan's memory goes

adamgell
and
claude
committed
5086b7e
fix(event-log): stop reporting a truncated channel as a complete one

adamgell
and
claude
committed
fd6fdbf
refactor(event-log): move the fetch-failure decision where CI can test it

adamgell
and
claude
committed
3c9cca1
feat(event-log): deliver a channel's records as they are read

adamgell
and
claude
committed
41b8ec6
fix(event-log): count render failures and slice previews by character
adamgell
committed
f008ac9
fix(event-log): build the file path's summary the way the live path does
adamgell
committed
6a47c0f
fix(event-log): guard channel processing and bound the sequence scan
adamgell
committed
9b7c5a4
fix(event-log): reject a --days value that overflows the time window
adamgell
committed
2de996e
fix(event-log): report a channel whose refresh failed as a gap
adamgell
committed
ee5af28
fix(event-log): count channels with gaps separately from gap entries
adamgell
committed
1a631b6
fix(event-log): clear loadError on refresh and pin the failure state
adamgell
committed
4b2bbdb