@merittdev/horus 0.14.1 → 0.15.0

package/dist/index.cjs

@@ -65880,7 +65880,7 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.14.1" : "dev";
+var HORUS_VERSION = true ? "0.15.0" : "dev";
 var PINNED_SOURCE_VERSION = "2.0.2";
 
 // ../../packages/core/src/evidence.ts
@@ -93580,6 +93580,94 @@ function selectHeadlineCause(rankedCauses, isLinkedToSeed, rerank) {
   return { topCause, topLinkedCause, headlineCause, headlineLinked };
 }
 
+// ../../packages/engine/src/detect-data-flow-cause.ts
+init_cjs_shims();
+function stripComments(s5) {
+  return s5.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\n]*/g, " ");
+}
+function grp(m5, i3) {
+  return m5[i3] ?? "";
+}
+function hedged(symbolName, clause) {
+  return `${symbolName} could explain this \u2014 it ${clause}. Source-only signal: verify against runtime evidence.`;
+}
+var CONFIG_SRC = /process\.env|config\.|opts\.|options\.|this\.|props\.|import\.meta/;
+function detectFixedCadence(body2, name2) {
+  const timer2 = /\bset(?:Interval|Timeout)\s*\(\s*[^,]+,\s*([0-9_]{3,})\s*\)/.exec(body2);
+  if (timer2) {
+    const frag = grp(timer2, 0).trim().slice(0, 48);
+    return { pattern: "fixed-cadence", matched: frag, baseScore: 0.2, title: hedged(name2, `polls/schedules on a fixed interval (\`${frag}\`), so data freshness is bounded by that cadence rather than the event`) };
+  }
+  const cron = /(['"`])(?:\*|[0-9,*/-]+)(?:\s+[0-9,*/-]+){4}\1/.exec(body2);
+  if (cron) {
+    const frag = grp(cron, 0);
+    return { pattern: "fixed-cadence", matched: frag.slice(0, 48), baseScore: 0.2, title: hedged(name2, `runs on a fixed cron cadence (\`${frag}\`), so an effect activates on the next tick, not at its target time`) };
+  }
+  const cad = /\b(?:pollInterval|refetchInterval|cadence|intervalMs|tickMs)\b\s*[:=]\s*[0-9_]{2,}/.exec(body2);
+  if (cad && !CONFIG_SRC.test(grp(cad, 0))) {
+    const frag = grp(cad, 0).trim().slice(0, 40);
+    return { pattern: "fixed-cadence", matched: frag, baseScore: 0.2, title: hedged(name2, `uses a fixed cadence (\`${frag}\`); the symptom may track that interval`) };
+  }
+  return null;
+}
+function detectInPlaceMutation(body2, ctx) {
+  const hay = `${ctx.symbol.name} ${ctx.symbol.filePath ?? ""} ${ctx.symbol.signature ?? ""}`;
+  const contextual = /reduc|\bslice\b|store|mutat|\bstate\b/i.test(hay) || ctx.imports.some((i3) => /redux|zustand|immer|valtio|mobx/i.test(i3));
+  if (!contextual) return null;
+  if (/return\s*\{\s*\.\.\.|=>\s*\(?\s*\{\s*\.\.\.|\.\.\.(?:state|prev|draft)\b/.test(body2)) return null;
+  const assign = /\b(state|store|draft|cache|acc|accumulator)(?:\.[A-Za-z0-9_]+)+\s*=(?!=)/.exec(body2);
+  const method = /\b(state|store|draft|cache)(?:\.[A-Za-z0-9_]+)*\.(?:push|splice|sort|reverse|pop|shift|unshift)\s*\(/.exec(body2);
+  const m5 = assign ?? method;
+  if (!m5) return null;
+  const obj = grp(m5, 1) || "state";
+  const frag = grp(m5, 0).trim().slice(0, 40);
+  return { pattern: "in-place-mutation", matched: frag, baseScore: 0.2, title: hedged(ctx.symbol.name, `appears to mutate the shared \`${obj}\` object in place (\`${frag}\`) rather than producing a new reference, so downstream readers may observe stale or partially-updated state`) };
+}
+function detectUnawaitedWrite(body2, ctx) {
+  const isAsync2 = /\basync\b/.test(ctx.symbol.signature ?? "") || /\bawait\b/.test(body2);
+  if (!isAsync2 || !/\bawait\b/.test(body2)) return null;
+  const calleeNames = new Set(ctx.callees.map((c4) => c4.name));
+  for (const line2 of body2.split("\n")) {
+    const t2 = line2.trim();
+    const call = /^([A-Za-z_$][\w.$]*)\s*\(/.exec(t2);
+    if (!call) continue;
+    if (/^(?:await|return|void|yield|const|let|var|if|for|while|}|else|switch|throw|case)\b/.test(t2)) continue;
+    if (t2.includes(".then(") || t2.includes(".catch(") || t2.includes("await ")) continue;
+    const callee = grp(call, 1);
+    const fn2 = callee.split(".").pop() ?? "";
+    if (/^(?:emit|log|console|track|debug|warn|error|info|print|notify|next|push|set[A-Z])/.test(fn2)) continue;
+    const writeLike = /^(?:save|write|flush|persist|commit|sync|update|insert|upsert|fetch|load|send|post)/i.test(fn2) || /Async$/.test(fn2);
+    if (!writeLike) continue;
+    if (!calleeNames.has(callee) && !calleeNames.has(fn2)) continue;
+    return { pattern: "unawaited-async-write", matched: t2.slice(0, 60), baseScore: 0.19, title: hedged(ctx.symbol.name, `calls \`${fn2}\` without \`await\` while awaiting elsewhere, so a later read may race ahead of that write`) };
+  }
+  return null;
+}
+function detectHardcodedBound(body2, name2) {
+  const eq2 = /\b(Object\.is|shallowEqual|isEqual)\s*\(/.exec(body2);
+  if (eq2) {
+    return { pattern: "hardcoded-bound", matched: grp(eq2, 0).slice(0, 40), baseScore: 0.18, title: hedged(name2, `gates on a reference/shallow equality check (\`${grp(eq2, 1)}\`), so an in-place or structurally-equal update can be skipped and a change goes unobserved`) };
+  }
+  const re = /\b([A-Za-z_$][\w$]*)\s*(?:<=|>=|<|>|===|!==)\s*([0-9]+(?:\.[0-9]+)?)\b/g;
+  for (let m5 = re.exec(body2); m5 !== null; m5 = re.exec(body2)) {
+    const id = grp(m5, 1);
+    const n4 = Number(grp(m5, 2));
+    if (n4 === 0 || n4 === 1) continue;
+    if (!/thresh|limit|max|min|retr|attempt|backoff|count|rate|ratio|ttl|timeout|delay|capacity|tolerance|distance|score/i.test(id)) continue;
+    if (/\.length\b|\bidx\b|\bindex\b|\bi\b/.test(id)) continue;
+    const frag = grp(m5, 0).trim().slice(0, 40);
+    return { pattern: "hardcoded-bound", matched: frag, baseScore: 0.2, title: hedged(name2, `gates the flow on a fixed bound (\`${frag}\`), so behavior can flip at that constant independent of any deploy`) };
+  }
+  return null;
+}
+function detectDataFlowCause(ctx) {
+  const raw = ctx.sourceBody ?? ctx.snippet ?? "";
+  if (raw.length < 40) return null;
+  const body2 = stripComments(raw);
+  const nm = ctx.symbol.name;
+  return detectFixedCadence(body2, nm) ?? detectInPlaceMutation(body2, ctx) ?? detectUnawaitedWrite(body2, ctx) ?? detectHardcodedBound(body2, nm);
+}
+
 // ../../packages/engine/src/hypotheses.ts
 init_cjs_shims();
 function generateHypotheses(evidence2, _correlation, ctx) {
@@ -97690,6 +97778,19 @@ async function investigate(input, deps) {
       });
     }
   }
+  if (top && seedEv && ctx && !sourceImpactHint) {
+    const dataFlow = detectDataFlowCause(ctx);
+    if (dataFlow) {
+      causeInputs.push({
+        id: "cause:seed-data-flow",
+        title: dataFlow.title.slice(0, 220),
+        category: "data-flow",
+        sourceEvidenceIds: [seedEv.id],
+        baseScore: dataFlow.baseScore,
+        metadata: { dataFlowPattern: dataFlow.pattern, matched: dataFlow.matched, blastRadius }
+      });
+    }
+  }
   if (analysis !== null && analysis.signatures.length > 0 && queueHits.length > 0 && directLogEvIds.length > 0) {
     const firstQueue = queueHits[0];
     const queueLabel = firstQueue !== void 0 ? `"${firstQueue.queueName}" (${firstQueue.producerSymbol ?? "unknown"} -> ${firstQueue.workerSymbol ?? "unknown"})` : "the queue path";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {