fix: correctly extract username from "invalid user" SSH log lines (#31)

The USER_REGEX matched "for" then captured "invalid" as the username.
Add a more specific INVALID_USER_REGEX that matches the full "for invalid
user <name>" pattern and try it first.

Fixes #26

Co-authored-by: xiaow-ai <xiaow-ai@ugig.net>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

apps/cli/src/core/log-parser.ts

@@ -14,6 +14,7 @@ const SYSLOG_REGEX = /^(\w+\s+\d+\s+[\d:]+)\s+\S+\s+(\S+?)(?:\[\d+\])?:\s+(.*)/;
 
 // Extract IP from auth messages
 const IP_REGEX = /(?:from|FROM)\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/;
+const INVALID_USER_REGEX = /(?:for\s+invalid\s+user)\s+(\S+?)(?:\s+from|\s*$)/;
 const USER_REGEX = /(?:for|user)\s+(\S+?)(?:\s+from|\s*$)/;
 
 // Attack pattern signatures
@@ -73,7 +74,7 @@ export function parseAuthLog(line: string): AuthLogEntry | null {
   if (!match) return null;
 
   const ipMatch = match[3].match(IP_REGEX);
-  const userMatch = match[3].match(USER_REGEX);
+  const userMatch = match[3].match(INVALID_USER_REGEX) || match[3].match(USER_REGEX);
 
   return {
     timestamp: parseSyslogTimestamp(match[1]),