@merittdev/horus 0.15.0 → 0.15.2

package/dist/index.cjs

@@ -65880,7 +65880,7 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.15.0" : "dev";
+var HORUS_VERSION = true ? "0.15.2" : "dev";
 var PINNED_SOURCE_VERSION = "2.0.2";
 
 // ../../packages/core/src/evidence.ts
@@ -93610,6 +93610,19 @@ function detectFixedCadence(body2, name2) {
   }
   return null;
 }
+function detectExactMatchQuery(body2, name2) {
+  const sql2 = /\bWHERE\b[^;]*?["'`]?\b\w+\b["'`]?\s*=\s*[$?:]\w*/i.exec(body2);
+  if (sql2 && !/\b(?:LIKE|ILIKE|LOWER|UPPER|TRIM|SIMILAR|REGEXP)\b/i.test(grp(sql2, 0))) {
+    const frag = grp(sql2, 0).trim().slice(0, 48);
+    return { pattern: "exact-match-query", matched: frag, baseScore: 0.2, title: hedged(name2, `matches on an exact-equality query (\`${frag}\`) with no normalization, so a value differing only in formatting (case, whitespace, leading zeros) returns no rows`) };
+  }
+  const orm = /\.(?:find|findOne|findFirst|findUnique)\s*\(\s*\{\s*\w+\s*:/.exec(body2);
+  if (orm) {
+    const frag = grp(orm, 0).trim().slice(0, 40);
+    return { pattern: "exact-match-query", matched: frag, baseScore: 0.2, title: hedged(name2, `looks up by an exact field match (\`${frag}\`) with no normalization, so a value differing only in formatting returns no match`) };
+  }
+  return null;
+}
 function detectInPlaceMutation(body2, ctx) {
   const hay = `${ctx.symbol.name} ${ctx.symbol.filePath ?? ""} ${ctx.symbol.signature ?? ""}`;
   const contextual = /reduc|\bslice\b|store|mutat|\bstate\b/i.test(hay) || ctx.imports.some((i3) => /redux|zustand|immer|valtio|mobx/i.test(i3));
@@ -93665,7 +93678,14 @@ function detectDataFlowCause(ctx) {
   if (raw.length < 40) return null;
   const body2 = stripComments(raw);
   const nm = ctx.symbol.name;
-  return detectFixedCadence(body2, nm) ?? detectInPlaceMutation(body2, ctx) ?? detectUnawaitedWrite(body2, ctx) ?? detectHardcodedBound(body2, nm);
+  return detectFixedCadence(body2, nm) ?? detectExactMatchQuery(body2, nm) ?? detectInPlaceMutation(body2, ctx) ?? detectUnawaitedWrite(body2, ctx) ?? detectHardcodedBound(body2, nm);
+}
+function detectDataFlowCauseAcross(contexts) {
+  for (const c4 of contexts) {
+    const f5 = detectDataFlowCause(c4);
+    if (f5) return f5;
+  }
+  return null;
 }
 
 // ../../packages/engine/src/hypotheses.ts
@@ -95200,6 +95220,17 @@ var TYPE_LIKE_NAME = new RegExp(`(?:${TYPE_SUFFIX.source})|(?:${INTERFACE_PREFIX
 function isTypeLikeName(name2) {
   return TYPE_LIKE_NAME.test(name2);
 }
+var CODEGEN_PATH_RE = /(^|\/)(?:__generated__|generated)\//i;
+var CODEGEN_FILE_RE = /(?:(?:^|\/)generated|[._-](?:generated|gen))\.[jt]sx?$/i;
+var GQL_GEN_FILE_RE = /\.(?:graphql|gql)\.[jt]sx?$/i;
+function isCodegenPath(filePath) {
+  return CODEGEN_PATH_RE.test(filePath) || CODEGEN_FILE_RE.test(filePath) || GQL_GEN_FILE_RE.test(filePath);
+}
+var TYPE_DECL_KIND_RE = /^(?:type_alias|typealias|type|interface|enum)$/i;
+function isTypeDeclarationSymbol(s5) {
+  const kind = s5.id.split(":", 1)[0] ?? "";
+  return TYPE_DECL_KIND_RE.test(kind);
+}
 function executableBaseName(name2) {
   const stripped = name2.replace(TYPE_SUFFIX, "").replace(INTERFACE_PREFIX, "");
   return stripped !== name2 && stripped.length >= 4 ? stripped : null;
@@ -95331,6 +95362,8 @@ function scoreSeed(s5, index2, hintTokens, changedFiles, hintHasCode, qualifier,
   score += Math.max(0, 5 - index2) * (hintHasCode ? 0.8 : 0.1);
   if (s5.score !== void 0) score += s5.score * (hintHasCode ? 8 : 2);
   if (/\.[jt]sx?$/i.test(s5.name)) score -= 5;
+  if (isCodegenPath(s5.filePath)) score -= 5;
+  if (isTypeDeclarationSymbol(s5)) score -= 6;
   if (hintTokens !== void 0 && hintTokens.length > 0) {
     let hintBoost = 0;
     for (const tok of hintTokens) {
@@ -95350,6 +95383,9 @@ function isDeprioritizedSeedPath(filePath) {
     filePath
   );
 }
+function isDeprioritizedSeed(s5) {
+  return isDeprioritizedSeedPath(s5.filePath) || isCodegenPath(s5.filePath) || isTypeDeclarationSymbol(s5);
+}
 function isAnchoredExactSeed(s5, qualifier, hintHasCode, preferNamed) {
   if (qualifier && qualifierBoost(s5, qualifier) >= 40) return true;
   if (preferNamed !== void 0 && s5.name.toLowerCase() === preferNamed.toLowerCase()) return true;
@@ -95362,7 +95398,7 @@ function rankSeeds(seeds, hintTokens, changedFiles, hintHasCode, qualifier, pref
     score: scoreSeed(symbol, i3, hintTokens, changedFiles, hintHasCode, qualifier, preferNamed),
     role: seedRole(symbol),
     i: i3,
-    deprio: isDeprioritizedSeedPath(symbol.filePath),
+    deprio: isDeprioritizedSeed(symbol),
     // HOR-430: a deprioritized candidate the request anchors on exactly is exempt from the
     // hard demotion below — it keeps only the soft path penalty so a strong/exact match in an
     // example/test file can still surface.
@@ -97778,8 +97814,12 @@ async function investigate(input, deps) {
       });
     }
   }
-  if (top && seedEv && ctx && !sourceImpactHint) {
-    const dataFlow = detectDataFlowCause(ctx);
+  if (top && seedEv && ctx && code && !sourceImpactHint) {
+    const scanIds = [
+      .../* @__PURE__ */ new Set([...seeds.slice(1, 4).map((s5) => s5.id), ...(ctx.callees ?? []).slice(0, 4).map((c4) => c4.id)])
+    ].filter((id) => id !== top.id);
+    const extraCtxs = (await Promise.all(scanIds.map((id) => code.context(id).catch(() => null)))).filter((c4) => c4 !== null);
+    const dataFlow = detectDataFlowCauseAcross([ctx, ...extraCtxs]);
     if (dataFlow) {
       causeInputs.push({
         id: "cause:seed-data-flow",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {