v0.8.9-beta

What's New in v0.8.9-beta

This release focuses on reliability and correctness — a full codebase audit identified and fixed 16 bugs across the backend pipeline, frontend, and configuration.

Performance

• Scoring Pipeline N+1 Elimination — Replaced per-event DB writes with bulk operations, hoisted repeated config queries out of inner loops. ~95% fewer DB round-trips in typical scoring runs.
• Smart LLM Retry Logic — 120-second timeouts on all LLM calls. Only transient errors (429/502/503/504) and timeouts trigger a retry; non-retryable errors (400/401/403) fail immediately, saving 2+ seconds per bad request.
• Stale Score Elimination — Re-evaluation zeros out prior windows' meta_scores and uses DISTINCT ON for consistent score components. Removed redundant expensive regex CTE from score recalculation.

Bug Fixes

• LLM Adapter Retried Non-Retryable Errors — 400/401/403/500 responses were silently retried, wasting API calls and adding latency. Now throws immediately.
• Events Permanently Lost After Bulk Write Failure — If score writes failed, events were still marked as "scored" and never re-processed. Now guarded by success flag.
• Normal Behavior Filter Ignored Host/Program — Templates scoped to specific hosts or programs showed as "Normal" in the UI but weren't filtered from the criterion drill-down list.
• Normal Behavior Regex Patterns Too Complex — Generated patterns used {n} quantifiers and (?:...) groups that could fail in PostgreSQL. Now uses simple [^ ]+ for tokens, [0-9]+ for numbers, with no complex quantifiers.
• System Deletion Left Orphaned Records — Deleting a system did not cascade to findings, normal_behavior_templates, or discovery_suggestions.
• Pipeline Errors Silently Swallowed — The orchestrator's catch block was empty; errors from config sync are now logged.
• Pipeline Scheduler Stale Timer — A race condition could set a new timer after stop() during async config loading.
• Login Network Error — Frontend login() showed a cryptic browser TypeError on network failure instead of a user-friendly message.
• RFC 3164 Parser Truncation — MikroTik RouterOS messages with colons in the body were truncated; HP ProCurve switches with year-in-timestamp had host/program misidentified.
• POSIX Regex Compatibility — Normal behavior patterns used PCRE shorthands (\d) that could mismatch PostgreSQL's ~* operator. Now uses universal [0-9] syntax.
• Model Name Validation — Rejected OpenRouter-style names with slashes (e.g., openai/gpt-4o). Now accepts / and :.
• Maintenance Logger — Used console.* instead of the shared logger, bypassing LOG_LEVEL filtering and causing self-ingestion.
• SQL Type Cast Error — batchUpdateTemplateCache VALUES clause lacked ::uuid and ::timestamptz casts.
• LLM URL Double Slash — Trailing slashes on base URL produced malformed API paths.
• CSS Variable Missing — --text-secondary was referenced in 6 rules but never defined.

UX Improvements

• Simplified Regex Patterns — Auto-generated "Mark as Normal" patterns are now much simpler: [^ ]+ for variable tokens (UUIDs, MACs, interfaces), [0-9]+ for numbers, /[^ ]+ for paths. IPv4/CIDR split into clean separate rules. No more {n,m} quantifiers that confused PostgreSQL.
• Regex Quick Reference — The "Mark as Normal" modal now includes a collapsible regex cheat sheet with the 10 most common tokens (.*, .+, [^ ]+, [0-9]+, \., etc.).
• Auto-Escape IPs in Log Source Selectors — Plain IP addresses (e.g., 192.168.30.14) entered in the source_ip field are automatically escaped to ^192\.168\.30\.14$ on blur. Dotted hostnames are also escaped. Patterns with existing regex metacharacters are left untouched.
• Context-Sensitive Placeholders — The source_ip selector field now shows IP or regex (e.g. 192.168.30.14 or ^10\.0\.) instead of a generic regex hint.

Changed

• Scoring chunk size default increased from 500 to 5000 (loop processes ALL events, no hard cap)
• Fluent Bit default log level changed from info to warn
• Settings help text uses [0-9]+ instead of \d+ for consistency

Full Changelog

See CHANGELOG.md for complete details.