fix: correct cf-orch port to 7700; fix relative time parsing in diagnose; fix syslog PRI prefix

app/services/diagnose.py

@@ -20,12 +20,35 @@ except ImportError:
     _HAS_DATEPARSER = False
 
 
+_RELATIVE_RE = re.compile(
+    r"\b(?:last|past)\s+(\d+)?\s*(minute|hour|day|week)s?\b",
+    re.IGNORECASE,
+)
+_RELATIVE_UNITS = {"minute": 1, "hour": 60, "day": 1440, "week": 10080}
+
+
+def _relative_window(match: re.Match) -> tuple[str, str]:
+    """Convert a relative time match to (since_iso, until_iso)."""
+    n = int(match.group(1) or 1)
+    unit = match.group(2).lower()
+    minutes = n * _RELATIVE_UNITS[unit]
+    return _last_n_minutes(minutes), _now_iso()
+
+
 def parse_time_window(query: str) -> tuple[str | None, str | None, str]:
     """Extract a time window from a natural-language query string.
 
     Returns (since_iso, until_iso, keywords) where keywords is the query with
     the matched time phrase stripped. Falls back to last-60-min window.
     """
+    # Handle relative expressions first ("last hour", "past 30 minutes", etc.)
+    # dateparser misinterprets these as absolute times.
+    m = _RELATIVE_RE.search(query)
+    if m:
+        since, until = _relative_window(m)
+        keywords = re.sub(r"\s{2,}", " ", query[:m.start()] + query[m.end():]).strip()
+        return since, until, keywords or query
+
     if _HAS_DATEPARSER and _search_dates is not None:
         try:
             results = _search_dates(query, languages=["en"], settings={"PREFER_DATES_FROM": "past"})

scripts/docker-cluster.sh

@@ -34,7 +34,7 @@ PORT=8534
 TZ=America/Los_Angeles
 
 # LLM: route to local cf-orch coordinator (same host, host network).
-LLM_URL="${TURNSTONE_LLM_URL:-http://127.0.0.1:7701}"
+LLM_URL="${TURNSTONE_LLM_URL:-http://127.0.0.1:7700}"
 LLM_MODEL="${TURNSTONE_LLM_MODEL:-llama3.1:8b}"
 LLM_API_KEY="${TURNSTONE_LLM_API_KEY:-}"
 
@@ -80,6 +80,7 @@ docker run -d \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v /run/systemd/journal:/run/systemd/journal:ro \
   -e TURNSTONE_DB=/data/turnstone.db \
+  -e TURNSTONE_PATTERNS=/patterns \
   -e TURNSTONE_SOURCE_HOST="heimdall-cluster" \
   -e TURNSTONE_BUNDLE_ENDPOINT="${TURNSTONE_BUNDLE_ENDPOINT:-}" \
   -e PYTHONUNBUFFERED=1 \