Fix log level parsing matching 'error' in non-error contexts (#34)

* fix: restrict log level detection to structured positions

Log level parsing previously matched keywords like ERROR/WARN anywhere
in the log message body, causing false positives (e.g. "connection error
count" being flagged as error-level). Now only matches levels in:
- JSON fields (level/severity/lvl)
- Key=value pairs (level=ERROR)
- Bracketed markers ([ERROR])
- Near line start (after optional timestamp)

* fix: handle spaced and quoted key/value in log level detection

KV_LEVEL_RE now matches formats like level = "error" and
severity : 'warn' in addition to level=ERROR.

* fix: correct word boundary placement in KV_LEVEL_RE regex

Move \b before the optional closing quote so it anchors on the
captured word characters, not on the quote.

Author: joshuapare

ui/providers/BottomDrawer/containers/LogViewer/utils/parseLogLine.ts

@@ -1,20 +1,64 @@
 import type { LogEntry, LogLevel, RawLogLine } from '../types';
 import { parseAnsi } from './parseAnsi';
 
-const LEVEL_PATTERNS: Array<{ level: LogLevel; pattern: RegExp }> = [
-  { level: 'error', pattern: /\b(ERROR|ERR|FATAL|PANIC|CRITICAL)\b/i },
-  { level: 'warn', pattern: /\b(WARN|WARNING)\b/i },
-  { level: 'info', pattern: /\b(INFO)\b/i },
-  { level: 'debug', pattern: /\b(DEBUG|DBG)\b/i },
-  { level: 'trace', pattern: /\b(TRACE|TRC)\b/i },
+const LEVEL_KEYWORDS: Array<{ level: LogLevel; words: string[] }> = [
+  { level: 'error', words: ['error', 'err', 'fatal', 'panic', 'critical'] },
+  { level: 'warn', words: ['warn', 'warning'] },
+  { level: 'info', words: ['info'] },
+  { level: 'debug', words: ['debug', 'dbg'] },
+  { level: 'trace', words: ['trace', 'trc'] },
 ];
 
+const LEVEL_WORD_SET = new Map<string, LogLevel>(
+  LEVEL_KEYWORDS.flatMap(({ level, words }) =>
+    words.map((w) => [w, level] as const),
+  ),
+);
+
+// Match level in JSON fields: "level":"error", "severity":"WARN", "lvl":"info"
+const JSON_LEVEL_RE =
+  /["'](?:level|severity|lvl)["']\s*[:=]\s*["']([a-zA-Z]+)["']/i;
+
+// Match bracketed level: [ERROR], [WARN], [info]
+const BRACKET_LEVEL_RE = /\[([A-Za-z]+)\]/g;
+
+// Match key=value level: level=ERROR, severity=warn, level = "error", severity : 'warn'
+const KV_LEVEL_RE = /\b(?:level|severity|lvl)\s*[=:]\s*["']?([a-zA-Z]+)\b["']?/i;
+
+// Match level keyword at/near line start (with optional leading timestamp):
+// "ERROR ...", "2024-01-01 ERROR ...", "2024-01-01T00:00:00Z ERROR ..."
+const START_LEVEL_RE = /^[\d\-T:.Z+/ ]{0,35}\b([A-Za-z]+)\b/;
+
 function detectLevel(content: string): LogLevel | undefined {
-  for (const { level, pattern } of LEVEL_PATTERNS) {
-    if (pattern.test(content)) {
-      return level;
-    }
+  // 1. JSON field match
+  const jsonMatch = JSON_LEVEL_RE.exec(content);
+  if (jsonMatch) {
+    const found = LEVEL_WORD_SET.get(jsonMatch[1].toLowerCase());
+    if (found) return found;
+  }
+
+  // 2. Key=value match
+  const kvMatch = KV_LEVEL_RE.exec(content);
+  if (kvMatch) {
+    const found = LEVEL_WORD_SET.get(kvMatch[1].toLowerCase());
+    if (found) return found;
+  }
+
+  // 3. Bracketed match — scan all brackets, return first recognized level
+  BRACKET_LEVEL_RE.lastIndex = 0;
+  let bracketMatch: RegExpExecArray | null;
+  while ((bracketMatch = BRACKET_LEVEL_RE.exec(content)) !== null) {
+    const found = LEVEL_WORD_SET.get(bracketMatch[1].toLowerCase());
+    if (found) return found;
   }
+
+  // 4. Level keyword near line start (after optional timestamp)
+  const startMatch = START_LEVEL_RE.exec(content);
+  if (startMatch) {
+    const found = LEVEL_WORD_SET.get(startMatch[1].toLowerCase());
+    if (found) return found;
+  }
+
   return undefined;
 }