llm fix

tests/test_llm.py

@@ -1,6 +1,6 @@
 import unittest
 
-from fgai.llm import _json_object_from_text
+from fgai.llm import _json_object_from_text, compact_dashboard_analysis
 
 
 class LlmTests(unittest.TestCase):
@@ -18,6 +18,45 @@ class LlmTests(unittest.TestCase):
 
         self.assertEqual(payload["profiles"][0]["stream_id"], "firewall")
 
+    def test_dashboard_compaction_removes_heavy_evidence_payloads(self):
+        status = {
+            "summary": {"total": 1000},
+            "capabilities": {
+                "graylog_mcp": {
+                    "status": "connected",
+                    "streams": [{"stream_id": f"stream-{index}", "events": index} for index in range(100)],
+                    "aggregate_events": 1000,
+                    "raw_events_fetched": 50,
+                }
+            },
+            "event_context": {
+                "source_profiles": [{"entity": f"10.0.0.{index}"} for index in range(20)],
+                "related_activity": [{"entity": f"10.0.0.{index}"} for index in range(40)],
+            },
+            "field_deviations": {
+                "alice": [
+                    {
+                        "stream_name": "Windows",
+                        "detector": "new_relationship",
+                        "field": "relationship:username->srcip",
+                        "score": 90,
+                        "reason": "new srcip value",
+                        "sample_events": [{"message": "very large raw event", "graylog_query": "username:alice"}],
+                    }
+                ]
+            },
+        }
+
+        compact = compact_dashboard_analysis(status)
+
+        self.assertEqual(compact["capabilities"]["graylog_mcp"]["status"], "connected")
+        self.assertNotIn("streams", compact["capabilities"]["graylog_mcp"])
+        self.assertEqual(len(compact["event_context"]["source_profiles"]), 10)
+        self.assertEqual(len(compact["event_context"]["related_activity"]), 20)
+        self.assertEqual(compact["field_deviations"][0]["entity"], "alice")
+        self.assertNotIn("sample_events", compact["field_deviations"][0])
+        self.assertNotIn("graylog_query", str(compact))
+
 
 if __name__ == "__main__":
     unittest.main()