improve find fileds for default profiles

tests/test_dashboard.py

@@ -28,6 +28,10 @@ class DashboardTests(unittest.TestCase):
         self.assertIn('data-view="howto"', HTML)
         self.assertIn("How To Use SignalScope", HTML)
 
+    def test_dashboard_can_update_existing_recommended_profiles(self):
+        self.assertIn("Update profile", HTML)
+        self.assertIn("function mergeProfile", HTML)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_profile_suggestions.py

@@ -178,6 +178,30 @@ class ProfileSuggestionTests(unittest.TestCase):
             self.assertIn("result_code", profile["categorical_fields"])
             self.assertIn("latency_ms", profile["numeric_fields"])
 
+    def test_semantic_alias_fields_are_shared_across_streams(self):
+        events = []
+        events.extend(
+            parse_log_line(
+                f"fgai_stream_id=proxy fgai_stream=Proxy source.ip=10.0.0.{index % 7} url=/item/{index % 3} action=allow"
+            )
+            for index in range(1, 30)
+        )
+        events.extend(
+            parse_log_line(
+                f"fgai_stream_id=firewall fgai_stream=Firewall client_ip=10.0.0.{index % 7} dstport=443 action=accept"
+            )
+            for index in range(1, 30)
+        )
+
+        suggestions = {item["stream_id"]: item for item in suggest_stream_profiles(events)}
+
+        for suggestion in suggestions.values():
+            shared = {item["field"]: item for item in suggestion["shared_fields"]}
+            self.assertIn("srcip", shared)
+            self.assertEqual(shared["srcip"]["kind"], "entity")
+            self.assertIn("source.ip", shared["srcip"]["aliases"])
+            self.assertIn("client_ip", shared["srcip"]["aliases"])
+
     def test_applies_valid_llm_advice_and_rejects_unknown_fields(self):
         suggestion = suggest_stream_profiles([
             parse_log_line("fgai_stream_id=windows fgai_stream=Windows username=alice hostname=host01 eventid=4625 action=failure")
@@ -199,6 +223,16 @@ class ProfileSuggestionTests(unittest.TestCase):
         self.assertNotIn("full_message", advised["profile"]["categorical_fields"])
         self.assertEqual(set(advised["profile"]["detectors"]), {"auth_failure"})
 
+    def test_missing_llm_advice_keeps_heuristic_profile(self):
+        suggestion = suggest_stream_profiles([
+            parse_log_line("fgai_stream_id=app fgai_stream=App actor_id=user1 action=login")
+        ])[0]
+
+        advised = apply_profile_advice([suggestion], [])[0]
+
+        self.assertEqual(advised["profile_advisor"]["status"], "heuristic")
+        self.assertEqual(advised["profile"], suggestion["profile"])
+
 
 if __name__ == "__main__":
     unittest.main()