From c7f1a27ee00c857e97b213ffea1805e798c7f005 Mon Sep 17 00:00:00 2001
From: pyr0ball <pyroballpcs@gmail.com>
Date: Wed, 13 May 2026 05:33:41 -0700
Subject: [PATCH] fix: correct cf-orch port to 7700; fix relative time parsing
 in diagnose; fix syslog PRI prefix

---
 app/services/diagnose.py  | 23 +++++++++++++++++++++++
 scripts/docker-cluster.sh |  3 ++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/app/services/diagnose.py b/app/services/diagnose.py
index e82b0fe..eb7e325 100644
--- a/app/services/diagnose.py
+++ b/app/services/diagnose.py
@@ -20,12 +20,35 @@ except ImportError:
     _HAS_DATEPARSER = False
 
 
+_RELATIVE_RE = re.compile(
+    r"\b(?:last|past)\s+(\d+)?\s*(minute|hour|day|week)s?\b",
+    re.IGNORECASE,
+)
+_RELATIVE_UNITS = {"minute": 1, "hour": 60, "day": 1440, "week": 10080}
+
+
+def _relative_window(match: re.Match) -> tuple[str, str]:
+    """Convert a relative time match to (since_iso, until_iso)."""
+    n = int(match.group(1) or 1)
+    unit = match.group(2).lower()
+    minutes = n * _RELATIVE_UNITS[unit]
+    return _last_n_minutes(minutes), _now_iso()
+
+
 def parse_time_window(query: str) -> tuple[str | None, str | None, str]:
     """Extract a time window from a natural-language query string.
 
     Returns (since_iso, until_iso, keywords) where keywords is the query with
     the matched time phrase stripped. Falls back to last-60-min window.
     """
+    # Handle relative expressions first ("last hour", "past 30 minutes", etc.)
+    # dateparser misinterprets these as absolute times.
+    m = _RELATIVE_RE.search(query)
+    if m:
+        since, until = _relative_window(m)
+        keywords = re.sub(r"\s{2,}", " ", query[:m.start()] + query[m.end():]).strip()
+        return since, until, keywords or query
+
     if _HAS_DATEPARSER and _search_dates is not None:
         try:
             results = _search_dates(query, languages=["en"], settings={"PREFER_DATES_FROM": "past"})
diff --git a/scripts/docker-cluster.sh b/scripts/docker-cluster.sh
index 993f572..023d1c8 100644
--- a/scripts/docker-cluster.sh
+++ b/scripts/docker-cluster.sh
@@ -34,7 +34,7 @@ PORT=8534
 TZ=America/Los_Angeles
 
 # LLM: route to local cf-orch coordinator (same host, host network).
-LLM_URL="${TURNSTONE_LLM_URL:-http://127.0.0.1:7701}"
+LLM_URL="${TURNSTONE_LLM_URL:-http://127.0.0.1:7700}"
 LLM_MODEL="${TURNSTONE_LLM_MODEL:-llama3.1:8b}"
 LLM_API_KEY="${TURNSTONE_LLM_API_KEY:-}"
 
@@ -80,6 +80,7 @@ docker run -d \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v /run/systemd/journal:/run/systemd/journal:ro \
   -e TURNSTONE_DB=/data/turnstone.db \
+  -e TURNSTONE_PATTERNS=/patterns \
   -e TURNSTONE_SOURCE_HOST="heimdall-cluster" \
   -e TURNSTONE_BUNDLE_ENDPOINT="${TURNSTONE_BUNDLE_ENDPOINT:-}" \
   -e PYTHONUNBUFFERED=1 \