@merittdev/horus 0.15.1 → 0.15.2

package/dist/index.cjs

@@ -65880,7 +65880,7 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.15.1" : "dev";
+var HORUS_VERSION = true ? "0.15.2" : "dev";
 var PINNED_SOURCE_VERSION = "2.0.2";
 
 // ../../packages/core/src/evidence.ts
@@ -93610,6 +93610,19 @@ function detectFixedCadence(body2, name2) {
   }
   return null;
 }
+function detectExactMatchQuery(body2, name2) {
+  const sql2 = /\bWHERE\b[^;]*?["'`]?\b\w+\b["'`]?\s*=\s*[$?:]\w*/i.exec(body2);
+  if (sql2 && !/\b(?:LIKE|ILIKE|LOWER|UPPER|TRIM|SIMILAR|REGEXP)\b/i.test(grp(sql2, 0))) {
+    const frag = grp(sql2, 0).trim().slice(0, 48);
+    return { pattern: "exact-match-query", matched: frag, baseScore: 0.2, title: hedged(name2, `matches on an exact-equality query (\`${frag}\`) with no normalization, so a value differing only in formatting (case, whitespace, leading zeros) returns no rows`) };
+  }
+  const orm = /\.(?:find|findOne|findFirst|findUnique)\s*\(\s*\{\s*\w+\s*:/.exec(body2);
+  if (orm) {
+    const frag = grp(orm, 0).trim().slice(0, 40);
+    return { pattern: "exact-match-query", matched: frag, baseScore: 0.2, title: hedged(name2, `looks up by an exact field match (\`${frag}\`) with no normalization, so a value differing only in formatting returns no match`) };
+  }
+  return null;
+}
 function detectInPlaceMutation(body2, ctx) {
   const hay = `${ctx.symbol.name} ${ctx.symbol.filePath ?? ""} ${ctx.symbol.signature ?? ""}`;
   const contextual = /reduc|\bslice\b|store|mutat|\bstate\b/i.test(hay) || ctx.imports.some((i3) => /redux|zustand|immer|valtio|mobx/i.test(i3));
@@ -93665,7 +93678,14 @@ function detectDataFlowCause(ctx) {
   if (raw.length < 40) return null;
   const body2 = stripComments(raw);
   const nm = ctx.symbol.name;
-  return detectFixedCadence(body2, nm) ?? detectInPlaceMutation(body2, ctx) ?? detectUnawaitedWrite(body2, ctx) ?? detectHardcodedBound(body2, nm);
+  return detectFixedCadence(body2, nm) ?? detectExactMatchQuery(body2, nm) ?? detectInPlaceMutation(body2, ctx) ?? detectUnawaitedWrite(body2, ctx) ?? detectHardcodedBound(body2, nm);
+}
+function detectDataFlowCauseAcross(contexts) {
+  for (const c4 of contexts) {
+    const f5 = detectDataFlowCause(c4);
+    if (f5) return f5;
+  }
+  return null;
 }
 
 // ../../packages/engine/src/hypotheses.ts
@@ -97794,8 +97814,12 @@ async function investigate(input, deps) {
       });
     }
   }
-  if (top && seedEv && ctx && !sourceImpactHint) {
-    const dataFlow = detectDataFlowCause(ctx);
+  if (top && seedEv && ctx && code && !sourceImpactHint) {
+    const scanIds = [
+      .../* @__PURE__ */ new Set([...seeds.slice(1, 4).map((s5) => s5.id), ...(ctx.callees ?? []).slice(0, 4).map((c4) => c4.id)])
+    ].filter((id) => id !== top.id);
+    const extraCtxs = (await Promise.all(scanIds.map((id) => code.context(id).catch(() => null)))).filter((c4) => c4 !== null);
+    const dataFlow = detectDataFlowCauseAcross([ctx, ...extraCtxs]);
     if (dataFlow) {
       causeInputs.push({
         id: "cause:seed-data-flow",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.15.1",
+  "version": "0.15.2",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {