fix(mcp): make event_patterns drill-down snippets executable (#3426)

## Summary

`clickstack_event_patterns` returned a `whereSnippet` per pattern that agents were told to pass to `clickstack_search`, but it often matched nothing. A template like `Sending <*> rows` became `Body:"Sending rows"` (a phrase that never occurs), and map-field body expressions produced Lucene that failed to parse. Agents hit dead ends on the main drill-down path.

Changes:

- **Executable drill-down.** `whereSnippet` is now a SQL `match()` predicate (`whereLanguage: "sql"`) built from the template: literal tokens in order, one non-whitespace token per `<*>`, whitespace matching Drain's JS `\s` tokenization. It already ANDs in the caller's `where` (rendered to SQL, dashboard variables expanded) and the source's table filter. If the caller filter can't be rendered as SQL, `summary.drilldown.includesFilters` is `false` with a warning. Templates over 4000 chars get `drilldownUnavailable` instead of an empty snippet that would match everything.
- **Source table filter.** Pattern mining (`event_patterns`, `emerging_signals`, dashboard pattern tiles) now applies the log source's `tableFilterExpression`. Counts can drop for sources that set one.
- **`bodyExpression`** also accepts `JSONExtractString(<column or map ref>, '<key>', ...)`. It is rebuilt from validated args, so the injection allowlist still holds.
- **Sampling transparency.** Response reports `sampleCoverage`, and `summary.trend` gives the real bucket interval and boundaries (granularity rounding means fewer or wider buckets than requested). Tool description and usage text explain that counts are extrapolated and a 0 bucket doesn't mean no events.
- **`minePatterns` template bug.** Each cluster now reports its own template. Before, it re-matched the first member's body and could pick up a different same-length cluster's template that other members didn't fit, so the drill-down missed some of the pattern's own events.

### How to reproduce

**Starting point:** `yarn dev`, MCP client connected to the local API, a log source with data.

**On `main`:**

1. Call `clickstack_event_patterns` on a log source.
2. Pass a pattern containing `<*>` as `where` to `clickstack_search`. It returns no rows, or a parse error when `bodyExpression` is a map field.

**On this branch:**

1. Same call. Each pattern has a SQL `whereSnippet` and `whereLanguage: "sql"`.
2. Pass it to `clickstack_search` with `whereLanguage: "sql"`. It returns that pattern's events.

Covered by new unit tests (`patternDrilldown.test.ts`, `mine-patterns.test.ts`, `query.test.ts`) and integration tests in `queryTool.int.test.ts` / `queryTile.int.test.ts` that run each snippet through search.

### References

HDX-5748

Author: brandon-pereira

.changeset/mcp-event-patterns-drilldown.md

@@ -0,0 +1,10 @@
+---
+'@hyperdx/api': patch
+'@hyperdx/common-utils': patch
+---
+
+fix: make clickstack_event_patterns drill-down snippets executable
+
+Each pattern's `whereSnippet` is now a SQL predicate (`whereLanguage: "sql"`) that keeps the template's token order and variable positions and includes the caller's filter and the source table filter, so passing it to `clickstack_search` returns the pattern's events. Before, a template like `Sending <*> rows` produced `Body:"Sending rows"`, which matched nothing, and map fields produced Lucene that failed to parse. `bodyExpression` now also accepts `JSONExtractString(<column>, '<key>', ...)` to mine a field inside JSON bodies, and the tool reports sample coverage and the actual trend bucket interval and boundaries.
+
+`clickstack_event_patterns`, `clickstack_emerging_signals` and dashboard event-pattern tiles now apply the log source's `tableFilterExpression`, so their counts can drop for sources that set one. `minePatterns` now reports each cluster's own template; before, it could report the template of a different same-length cluster that some members did not fit.

packages/api/src/fixtures.ts

@@ -434,6 +434,7 @@ export const bulkInsertLogs = async (
     ServiceName: string;
     SeverityText: string;
     Timestamp: Date;
+    LogAttributes?: Record<string, string>;
   }[],
 ) => {
   if (!config.IS_CI) {

packages/api/src/mcp/__tests__/dashboards/queryTile.int.test.ts

@@ -891,6 +891,30 @@ describe('MCP Dashboard Tools - clickstack_query_tile', () => {
       };
     };
 
+    // clickstack_search has no variable context, so each snippet must carry
+    // the expanded selection and return only the selected service's rows.
+    const expectDrilldownServices = async (text: string, service: string) => {
+      const { patterns } = JSON.parse(text);
+      expect(patterns.length).toBeGreaterThan(0);
+      for (const p of patterns) {
+        expect(p.whereSnippet).not.toContain('$__filter');
+        expect(p.whereSnippet).not.toContain('$service');
+        const search = await callTool(ctx.client!, 'clickstack_search', {
+          sourceId: logSourceId,
+          startTime,
+          endTime,
+          where: p.whereSnippet,
+          whereLanguage: 'sql',
+          columns: 'ServiceName',
+        });
+        expect(search.isError).toBeFalsy();
+        const rows: { ServiceName: string }[] = JSON.parse(getFirstText(search))
+          .result.data;
+        expect(rows.length).toBeGreaterThan(0);
+        for (const r of rows) expect(r.ServiceName).toBe(service);
+      }
+    };
+
     it('expands $__filter to a no-op on an event_patterns tile with nothing selected', async () => {
       const dashboard = await saveDashboard([eventPatternsTile()]);
 
@@ -931,6 +955,7 @@ describe('MCP Dashboard Tools - clickstack_query_tile', () => {
       expect(sampledCount).toBe(2);
       expect(bodies.some(b => b.includes('checkout'))).toBe(true);
       expect(bodies.some(b => b.includes('payments'))).toBe(false);
+      await expectDrilldownServices(getFirstText(result), 'checkout');
     });
 
     it('expands a Lucene variable reference on an event_patterns tile', async () => {
@@ -953,6 +978,7 @@ describe('MCP Dashboard Tools - clickstack_query_tile', () => {
       expect(totalCount).toBe(1);
       expect(bodies.some(b => b.includes('checkout'))).toBe(false);
       expect(bodies.some(b => b.includes('payments'))).toBe(true);
+      await expectDrilldownServices(getFirstText(result), 'payments');
     });
 
     it('reports an event_patterns macro naming a variable the dashboard does not declare', async () => {

packages/api/src/mcp/__tests__/query.test.ts

@@ -21,6 +21,7 @@ import {
   INCREASE_TOP_N_CAP,
   isServerError,
   mergeWhereIntoSelectItems,
+  normalizeBodyExpression,
   parseTimeRange,
 } from '@/mcp/tools/query/helpers';
 import {
@@ -109,6 +110,60 @@ describe('parseTimeRange', () => {
 
 // ─── mergeWhereIntoSelectItems ───────────────────────────────────────────────
 
+describe('normalizeBodyExpression', () => {
+  it.each([
+    ['Body', 'Body'],
+    ['SpanName', 'SpanName'],
+    ["SpanAttributes['http.url']", "SpanAttributes['http.url']"],
+    [
+      "JSONExtractString(Body, 'message')",
+      "JSONExtractString(Body, 'message')",
+    ],
+    [
+      "JSONExtractString(Body,'error',  'message')",
+      "JSONExtractString(Body, 'error', 'message')",
+    ],
+    [
+      "JSONExtractString(Body, 'app.user.currency')",
+      "JSONExtractString(Body, 'app.user.currency')",
+    ],
+    [
+      "JSONExtractString(LogAttributes['object'], 'regarding', 'kind')",
+      "JSONExtractString(LogAttributes['object'], 'regarding', 'kind')",
+    ],
+    [
+      String.raw`JSONExtractString(Body, 'it\'s, ok')`,
+      String.raw`JSONExtractString(Body, 'it\'s, ok')`,
+    ],
+    [
+      "JSONExtractString(Body, 'it''s, ok')",
+      "JSONExtractString(Body, 'it''s, ok')",
+    ],
+  ])('accepts %s', (expr, expected) => {
+    expect(normalizeBodyExpression(expr)).toBe(expected);
+  });
+
+  it.each([
+    'Body) OR (1=1',
+    'lower(Body)',
+    "JSONExtract(Body, 'message', 'String')",
+    'JSONExtractString(Body)',
+    'JSONExtractString(Body, message)',
+    "JSONExtractString(lower(Body), 'message')",
+    "JSONExtractString(Body, 'm') OR 1=1",
+    "JSONExtractString(Body, 'm'), Body",
+    "JSONExtractString(Body, 'm' || 'x')",
+    "JSONExtractString(Body, 'm')) OR (lower(Body)",
+    "JSONExtractString(LogAttributes['a'], 'm') OR (1=1",
+    "JSONExtractString(Body, 'm', (SELECT 1))",
+    // A stray quote in the column would pair with a key's quotes.
+    "JSONExtractString(Body', ' OR 1=1 --')",
+    "JSONExtractString(Body, 'm'' OR 1=1)",
+  ])('rejects %s', expr => {
+    expect(normalizeBodyExpression(expr)).toBeNull();
+  });
+});
+
 describe('mergeWhereIntoSelectItems', () => {
   it('should return items unchanged when topWhere is empty', () => {
     const items = [{ where: 'level:error', whereLanguage: 'lucene' as const }];