@merittdev/horus 0.8.11 → 0.8.13

package/dist/index.cjs

@@ -43846,7 +43846,7 @@ var require_pg_pool = __commonJS({
     function throwOnDoubleRelease() {
       throw new Error("Release called on client which has already been released to the pool.");
     }
-    function promisify5(Promise2, callback) {
+    function promisify6(Promise2, callback) {
       if (callback) {
         return { callback, result: void 0 };
       }
@@ -43984,7 +43984,7 @@ var require_pg_pool = __commonJS({
           const err2 = new Error("Cannot use a pool after calling end on the pool");
           return cb ? cb(err2) : this.Promise.reject(err2);
         }
-        const response = promisify5(this.Promise, cb);
+        const response = promisify6(this.Promise, cb);
         const result = response.result;
         if (this._isFull() || this._idle.length) {
           if (this._idle.length) {
@@ -44169,7 +44169,7 @@ var require_pg_pool = __commonJS({
       }
       query(text2, values2, cb) {
         if (typeof text2 === "function") {
-          const response2 = promisify5(this.Promise, text2);
+          const response2 = promisify6(this.Promise, text2);
           setImmediate(function() {
             return response2.callback(new Error("Passing a function as the first parameter to pool.query is not supported"));
           });
@@ -44179,7 +44179,7 @@ var require_pg_pool = __commonJS({
           cb = values2;
           values2 = void 0;
         }
-        const response = promisify5(this.Promise, cb);
+        const response = promisify6(this.Promise, cb);
         cb = response.callback;
         this.connect((err2, client) => {
           if (err2) {
@@ -44224,7 +44224,7 @@ var require_pg_pool = __commonJS({
           return cb ? cb(err2) : this.Promise.reject(err2);
         }
         this.ending = true;
-        const promised = promisify5(this.Promise, cb);
+        const promised = promisify6(this.Promise, cb);
         this._endCallback = promised.callback;
         this._pulseQueue();
         return promised.result;
@@ -65880,8 +65880,8 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.8.11" : "dev";
-var PINNED_SOURCE_VERSION = "1.5.1";
+var HORUS_VERSION = true ? "0.8.13" : "dev";
+var PINNED_SOURCE_VERSION = "1.5.2";
 
 // ../../packages/core/src/evidence.ts
 init_cjs_shims();
@@ -70987,7 +70987,7 @@ async function getSourceVersion() {
 var SourceVersionMismatchError = class extends Error {
   constructor(installed, pinned) {
     super(
-      `horus-source ${installed} is installed but Horus is pinned to ${pinned}. A drifted backend builds a graph this CLI cannot map and can corrupt the index (e.g. duplicate-primary-key failures during "Running initial index"). Install the pinned version: pip install 'horus-source==${pinned}'`
+      `horus-source ${installed} is installed but Horus is pinned to ${pinned}. A drifted backend builds a graph this CLI cannot map and can corrupt the index (e.g. duplicate-primary-key failures during "Running initial index"). Run \`horus update\` to sync the backend, or re-run the installer: curl -fsSL https://horus.sh/install.sh | bash`
     );
     this.installed = installed;
     this.pinned = pinned;
@@ -71007,7 +71007,7 @@ function isAnalyzed(root) {
 }
 async function analyzeRepo(root) {
   const bin = await resolveSourceBin();
-  if (!bin) throw new Error("horus-source not found on PATH. Install it: pip install horus-source");
+  if (!bin) throw new Error("horus-source not found on PATH. Install it: curl -fsSL https://horus.sh/install.sh | bash");
   await exec(bin, ["analyze", "."], {
     cwd: root,
     timeout: 9e5,
@@ -71083,7 +71083,7 @@ function startHost(root, port) {
   child.on("error", (err2) => {
     if (err2.code === "ENOENT") {
       process.stderr.write(
-        "\nhorus-source not found on PATH. Install it: pip install horus-source\n"
+        "\nhorus-source not found on PATH. Install it: curl -fsSL https://horus.sh/install.sh | bash\n"
       );
     }
   });
@@ -71159,7 +71159,14 @@ var SourceCodeProvider = class {
     };
   }
   async rows(query) {
-    return (await this.client.cypher(query)).rows;
+    try {
+      return (await this.client.cypher(query)).rows;
+    } catch (err2) {
+      if (err2 instanceof SourceHttpError && err2.status >= 400 && err2.status < 500) {
+        return [];
+      }
+      throw err2;
+    }
   }
   cypherRowToSymbol(row, idIdx, nameIdx, fileIdx, lineIdx, classNameIdx) {
     const startLine = lineIdx != null && row[lineIdx] != null ? Number(row[lineIdx]) : void 0;
@@ -71571,6 +71578,18 @@ function buildLevelFilter(m5, minLevel) {
   );
   return { terms: { [m5.levelField]: stringLevels } };
 }
+function buildWhereFilters(where) {
+  if (where === void 0 || where.length === 0) return [];
+  return where.map((w4) => ({
+    bool: {
+      should: [
+        { term: { [w4.field]: w4.value } },
+        { term: { [`${w4.field}.keyword`]: w4.value } }
+      ],
+      minimum_should_match: 1
+    }
+  }));
+}
 function buildTextMust(q2, mapping = MERITT_FIELD_MAPPING) {
   if (q2.text === void 0) return [{ match_all: {} }];
   if (q2.broadText === true) {
@@ -71595,6 +71614,7 @@ function buildSearchBody(q2, mapping = MERITT_FIELD_MAPPING) {
   if (q2.service !== void 0) {
     filters.push({ term: { [serviceTermField(mapping)]: q2.service } });
   }
+  filters.push(...buildWhereFilters(q2.where));
   const mustClause = buildTextMust(q2, mapping);
   return {
     query: {
@@ -71623,6 +71643,7 @@ function buildErrorAggBody(q2, field, mapping = MERITT_FIELD_MAPPING) {
   if (q2.eventCode !== void 0) {
     filters.push({ term: { [signatureTermField(mapping)]: q2.eventCode } });
   }
+  filters.push(...buildWhereFilters(q2.where));
   const aggField = field === mapping.eventCodeField ? signatureTermField(mapping) : `${field}.keyword`;
   return {
     size: 0,
@@ -71857,6 +71878,7 @@ function buildErrorAnalysisBody(q2, field = "event_code", mapping = MERITT_FIELD
   if (q2.eventCode !== void 0) {
     filters.push({ term: { [sigTerm]: q2.eventCode } });
   }
+  filters.push(...buildWhereFilters(q2.where));
   const mustClause = buildTextMust(q2, mapping);
   return {
     size: 0,
@@ -74269,6 +74291,14 @@ function parseGitLog(stdout) {
   }
   return commits;
 }
+async function resolvesToCommit(repoPath, rev) {
+  try {
+    await exec2("git", ["-C", repoPath, "rev-parse", "--verify", "--quiet", `${rev}^{commit}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function gitLog(repoPath, opts = {}) {
   const args2 = [
     "-C",
@@ -74278,11 +74308,16 @@ async function gitLog(repoPath, opts = {}) {
     "--pretty=format:%H%h%an%aI%s",
     "--name-only"
   ];
-  if (opts.since !== void 0) {
-    args2.push("--since=" + opts.since);
-  }
-  if (opts.until !== void 0) {
-    args2.push("--until=" + opts.until);
+  if (opts.since !== void 0 && await resolvesToCommit(repoPath, opts.since)) {
+    const end = opts.until !== void 0 && await resolvesToCommit(repoPath, opts.until) ? opts.until : "HEAD";
+    args2.push(`${opts.since}..${end}`);
+  } else {
+    if (opts.since !== void 0) {
+      args2.push("--since=" + opts.since);
+    }
+    if (opts.until !== void 0) {
+      args2.push("--until=" + opts.until);
+    }
   }
   args2.push("--max-count=" + (opts.maxCount ?? 200));
   const { stdout } = await exec2("git", args2, { maxBuffer: 10 * 1024 * 1024 });
@@ -93854,7 +93889,7 @@ async function investigate(input, deps) {
   const headlineLinked = headlineCause !== void 0 && isLinkedToSeed(headlineCause.sourceEvidenceIds);
   if (headlineCause && !headlineLinked) confidence = Math.min(confidence, 0.6);
   const banner2 = degradedNoSource ? "Runtime-only (source intelligence unavailable). " : "";
-  const scope = top ? `resolved to ${label} (${area})` : `over runtime evidence (${area})`;
+  const scope = top ? seedIsLowConfidence ? "could not be confidently localized from source alone" : `resolved to ${label} (${area})` : `over runtime evidence (${area})`;
   const seedDisclaimer = seedIsLowConfidence && top ? `\u26A0 No symbol closely matched "${hint}" \u2014 "${top.name}" is a low-confidence closest match (semantic). Refine with an exact symbol or error code to target precisely. ` : "";
   let summary = headlineCause ? headlineLinked ? `${seedDisclaimer}${banner2}Investigation of "${hint}" ${scope}. Top suspected cause: ${headlineCause.title}.` : `${seedDisclaimer}${banner2}Investigation of "${hint}" ${scope}. No cause is structurally linked to the seed; the strongest co-occurring signal (a lead to verify, not a diagnosis) is: ${headlineCause.title}.` : `${seedDisclaimer}${banner2}Investigation of "${hint}" ${scope}. No dominant suspected cause emerged from the available ${degradedNoSource ? "runtime" : "structural"} evidence.`;
   const hasIncidentSignal = directLogEvIds.length > 0 || latencyMetricEvIds.length > 0 || queueMetricEvIds.length > 0 || dataAnomalyEvIds.length > 0 || queueFailureSignals.length > 0 || findings2.some((f5) => f5.kind === "anomaly") || headlineCause !== void 0;
@@ -94374,7 +94409,19 @@ var EXTERNAL_MARKERS = [
   "elasticsearch",
   "prometheus",
   "mongo",
-  "graphql"
+  "graphql",
+  // Python ecosystem (HOR-356): the markers above are Node-centric, so Python backends'
+  // DB/queue/web stacks went undetected (e.g. redash's Postgres + Celery). 'mongo'/'redis'
+  // already cover pymongo/redis-py by substring.
+  "sqlalchemy",
+  "sqlmodel",
+  "psycopg",
+  "celery",
+  "fastapi",
+  "flask",
+  "django",
+  "kafka",
+  "boto3"
 ];
 async function discoverArchitecture(deps) {
   const nodeStats = await (async () => {
@@ -97295,7 +97342,7 @@ function parseHostPort(hostUrl) {
 function ensureHostReasonHint(reason) {
   switch (reason) {
     case "source-unavailable":
-      return "horus-source is not installed \u2014 install it: pip install horus-source";
+      return "horus-source is not installed \u2014 install it: curl -fsSL https://horus.sh/install.sh | bash";
     case "version-mismatch":
       return "the installed horus-source backend does not match the version Horus is pinned to \u2014 reinstall the pinned version (run `horus status` to see it)";
     case "not-analyzed":
@@ -97444,7 +97491,7 @@ async function runIndex(opts) {
       spawned = true;
       console.log(import_picocolors3.default.bold(`Indexing ${label}`) + import_picocolors3.default.dim(`  (${root})`));
       if (!await sourceAvailable()) {
-        console.error(import_picocolors3.default.red("horus-source not found on PATH. Install it: pip install horus-source"));
+        console.error(import_picocolors3.default.red("horus-source not found on PATH. Install it: curl -fsSL https://horus.sh/install.sh | bash"));
         return 1;
       }
       try {
@@ -97465,28 +97512,41 @@ async function runIndex(opts) {
         console.log(import_picocolors3.default.dim("  already analyzed"));
       }
       const priorPort = parseHostPort(configuredHost ?? "") ?? parseHostPort(readSourceHostUrl(root) ?? "");
-      let port;
-      if (priorPort !== null) {
-        try {
-          port = await findFreePort(priorPort, priorPort);
-        } catch {
+      const MAX_PORT_ATTEMPTS = 4;
+      let started = false;
+      for (let attempt = 0; attempt < MAX_PORT_ATTEMPTS && !started; attempt += 1) {
+        let port;
+        if (attempt === 0 && priorPort !== null) {
+          try {
+            port = await findFreePort(priorPort, priorPort);
+          } catch {
+            port = await findFreePort();
+          }
+        } else {
           port = await findFreePort();
         }
-      } else {
-        port = await findFreePort();
+        hostUrl = `http://127.0.0.1:${port}`;
+        console.log(
+          import_picocolors3.default.dim(
+            attempt === 0 ? `  starting source-intelligence host on port ${port}\u2026` : `  port contended \u2014 retrying on ${port}\u2026`
+          )
+        );
+        startHost(root, port);
+        if (await waitForHost(hostUrl)) {
+          reconcileSpawnedHostPid(root, port);
+          started = true;
+        } else {
+          removeSpawnedHostRecord(root);
+        }
       }
-      hostUrl = `http://127.0.0.1:${port}`;
-      console.log(import_picocolors3.default.dim(`  starting source-intelligence host on port ${port}\u2026`));
-      startHost(root, port);
-      if (!await waitForHost(hostUrl)) {
-        removeSpawnedHostRecord(root);
+      if (!started) {
         console.error(
           import_picocolors3.default.red(`  Source-intelligence host did not become healthy \u2014 see ${root}/.horus/source-host.log`)
         );
         return 1;
       }
-      reconcileSpawnedHostPid(root, port);
     }
+    if (!hostUrl) return 1;
     await stitchQueueMap(hostUrl, dbUrl, label);
     buildKnowledgeIndex(root, config2, label, configuredProject, opts);
     const hasLocalConfig = discoverLocalConfig(root) !== null;
@@ -112108,6 +112168,19 @@ function resolveRawLevel(opts) {
   if (opts.allLevels) return void 0;
   return opts.level ?? "error";
 }
+function parseWhere(raw) {
+  if (raw === void 0) return [];
+  return raw.map((entry2) => {
+    const eq2 = entry2.indexOf("=");
+    if (eq2 <= 0) {
+      throw new Error(
+        `Invalid --where "${entry2}" \u2014 expected field=value, e.g. --where context.brand_id=42`
+      );
+    }
+    return { field: entry2.slice(0, eq2).trim(), value: entry2.slice(eq2 + 1).trim() };
+  });
+}
+var whereLabel = (where) => where.map((w4) => `${w4.field}=${w4.value}`).join(", ");
 function levelColor(level, text2) {
   if (level === "error" || level === "fatal") return import_picocolors27.default.red(text2);
   if (level === "warn") return import_picocolors27.default.yellow(text2);
@@ -112123,6 +112196,15 @@ function matchServiceLabel(requested, candidates) {
 }
 async function runLogs(service, opts) {
   try {
+    let where;
+    try {
+      where = parseWhere(opts.where);
+    } catch (err2) {
+      console.error(import_picocolors27.default.red(err2.message));
+      return 1;
+    }
+    const hasWhere = where.length > 0;
+    const whereArg = hasWhere ? where : void 0;
     const config2 = await loadConfig(opts.config, { name: opts.name });
     let renv;
     try {
@@ -112174,8 +112256,9 @@ async function runLogs(service, opts) {
     const from = sinceToIso(opts.since) ?? new Date(Date.now() - 7 * 864e5).toISOString();
     const fromDisplay = from.slice(0, 16).replace("T", " ");
     if (opts.raw === true) {
-      const rawLevel = resolveRawLevel(opts);
-      const limit = opts.limit !== void 0 ? Math.min(Number(opts.limit), 1e3) : 20;
+      const rawLevel = hasWhere && opts.level === void 0 ? void 0 : resolveRawLevel(opts);
+      const defaultLimit = hasWhere ? 200 : 20;
+      const limit = opts.limit !== void 0 ? Math.min(Number(opts.limit), 1e3) : defaultLimit;
       const records = await logs.searchLogs({
         service: resolvedService,
         from,
@@ -112184,8 +112267,10 @@ async function runLogs(service, opts) {
         // grep searches message + detail + context.* so error strings buried
         // outside the message field are still found (HOR-216).
         broadText: opts.grep !== void 0,
+        where: whereArg,
         limit
       });
+      const truncated = records.length === limit;
       if (opts.json) {
         console.log(
           JSON.stringify(
@@ -112197,7 +112282,9 @@ async function runLogs(service, opts) {
                 index: indexPattern,
                 from,
                 level: rawLevel ?? "all",
-                grep: opts.grep ?? null
+                grep: opts.grep ?? null,
+                where: whereArg ?? null,
+                truncated
               },
               records: records.map((r) => ({
                 timestamp: r.timestamp,
@@ -112219,6 +112306,11 @@ async function runLogs(service, opts) {
         );
         return 0;
       }
+      console.error(
+        import_picocolors27.default.dim(
+          `logs: ${renv.project}/${renv.env}` + (resolvedService ? ` \xB7 service ${resolvedService}` : "") + ` \xB7 from ${fromDisplay} UTC \xB7 level ${rawLevel ?? "all"}` + (hasWhere ? ` \xB7 where ${whereLabel(where)}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "") + (rawLevel === "error" && !hasWhere ? "  (error+ only \u2014 use --all-levels for info/debug)" : "")
+        )
+      );
       if (records.length === 0) {
         console.log(import_picocolors27.default.dim("No logs matched."));
         return 0;
@@ -112233,6 +112325,13 @@ async function runLogs(service, opts) {
           console.log(import_picocolors27.default.dim(`    ${key}: ${value.slice(0, 200)}`));
         }
       }
+      if (truncated) {
+        console.error(
+          import_picocolors27.default.yellow(
+            `[warn] showing the first ${limit} record(s) \u2014 results may be truncated. Narrow with --where/--since/--level or raise --limit (max 1000).`
+          )
+        );
+      }
       return 0;
     }
     if (opts.groupBy !== void 0) {
@@ -112242,7 +112341,8 @@ async function runLogs(service, opts) {
           service: resolvedService,
           from,
           text: opts.grep,
-          broadText: opts.grep !== void 0
+          broadText: opts.grep !== void 0,
+          where: whereArg
         },
         field
       );
@@ -112258,6 +112358,7 @@ async function runLogs(service, opts) {
                 from,
                 severity: "error+",
                 grep: opts.grep ?? null,
+                where: whereArg ?? null,
                 groupBy: field
               },
               buckets
@@ -112270,7 +112371,7 @@ async function runLogs(service, opts) {
       }
       console.log(
         import_picocolors27.default.bold(`Top ${field}`) + import_picocolors27.default.dim(
-          ` \u2014 ${renv.project}/${renv.env}` + (resolvedService ? ` \xB7 service ${resolvedService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "")
+          ` \u2014 ${renv.project}/${renv.env}` + (resolvedService ? ` \xB7 service ${resolvedService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "") + (hasWhere ? ` \xB7 where ${whereLabel(where)}` : "")
         )
       );
       console.log(import_picocolors27.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
@@ -112291,12 +112392,13 @@ async function runLogs(service, opts) {
       service: resolvedService,
       from,
       text: opts.grep,
-      broadText: opts.grep !== void 0
+      broadText: opts.grep !== void 0,
+      where: whereArg
     });
     let scopeService = resolvedService;
     let broadeningNote;
     if (analysis.signatures.length === 0 && resolvedService !== void 0) {
-      const broader = await logs.analyzeErrors({ from, text: opts.grep, broadText: opts.grep !== void 0 });
+      const broader = await logs.analyzeErrors({ from, text: opts.grep, broadText: opts.grep !== void 0, where: whereArg });
       if (broader.signatures.length > 0) {
         const match = matchServiceLabel(resolvedService, broader.affectedServices);
         if (match.kind === "unique" && match.matched !== void 0 && match.matched !== resolvedService) {
@@ -112304,7 +112406,8 @@ async function runLogs(service, opts) {
             service: match.matched,
             from,
             text: opts.grep,
-            broadText: opts.grep !== void 0
+            broadText: opts.grep !== void 0,
+            where: whereArg
           });
           if (scoped.signatures.length > 0) {
             analysis = scoped;
@@ -112337,7 +112440,8 @@ async function runLogs(service, opts) {
               index: indexPattern,
               from,
               severity: "error+",
-              grep: opts.grep ?? null
+              grep: opts.grep ?? null,
+              where: whereArg ?? null
             },
             totalErrors: analysis.totalErrors,
             signatures: analysis.signatures,
@@ -112352,7 +112456,7 @@ async function runLogs(service, opts) {
     }
     console.log(
       import_picocolors27.default.bold(`Error analysis`) + import_picocolors27.default.dim(
-        ` \u2014 ${renv.project}/${renv.env}` + (scopeService ? ` \xB7 service ${scopeService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "")
+        ` \u2014 ${renv.project}/${renv.env}` + (scopeService ? ` \xB7 service ${scopeService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "") + (hasWhere ? ` \xB7 where ${whereLabel(where)}` : "")
       )
     );
     console.log(import_picocolors27.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
@@ -112838,7 +112942,7 @@ async function runSetup(opts) {
     write(
       import_picocolors32.default.dim(
         `      install it (Python 3.11+ required):
-        pip install horus-source
+        curl -fsSL https://horus.sh/install.sh | bash
       ensure ~/.local/bin is on your PATH`
       )
     );
@@ -112850,7 +112954,7 @@ async function runSetup(opts) {
     write(
       import_picocolors32.default.dim(
         `      update it:
-        pip install --upgrade horus-source`
+        horus update`
       )
     );
   } else {
@@ -114792,7 +114896,7 @@ async function runReadiness(opts) {
       status: "warn",
       blocking: false,
       detail: "not installed \u2014 source intelligence unavailable",
-      next: `pip install horus-source`
+      next: `curl -fsSL https://horus.sh/install.sh | bash`
     });
   } else if (sourceVersion !== PINNED_SOURCE_VERSION) {
     checks.push({
@@ -114800,7 +114904,7 @@ async function runReadiness(opts) {
       status: "warn",
       blocking: false,
       detail: `version mismatch (installed: ${sourceVersion}, required: ${PINNED_SOURCE_VERSION})`,
-      next: `pip install horus-source`
+      next: `horus update`
     });
   } else {
     checks.push({
@@ -115390,7 +115494,40 @@ var import_node_fs19 = require("fs");
 var import_node_path21 = require("path");
 var import_node_os6 = require("os");
 var import_node_crypto7 = require("crypto");
+var import_node_child_process9 = require("child_process");
+var import_node_util5 = require("util");
 var import_picocolors43 = __toESM(require_picocolors(), 1);
+var execFileAsync2 = (0, import_node_util5.promisify)(import_node_child_process9.execFile);
+async function ensureBackendPinned(write) {
+  let installed = null;
+  try {
+    installed = await getSourceVersion();
+  } catch {
+    installed = null;
+  }
+  if (installed === PINNED_SOURCE_VERSION) {
+    write(`  ${import_picocolors43.default.green("\u2713")} Source backend already on pinned ${PINNED_SOURCE_VERSION}.`);
+    return;
+  }
+  if (installed === null) {
+    write(
+      `  ${import_picocolors43.default.dim("Source backend not installed \u2014 install it: curl -fsSL https://horus.sh/install.sh | bash")}`
+    );
+    return;
+  }
+  write(`  Upgrading source backend ${installed} \u2192 ${PINNED_SOURCE_VERSION}\u2026`);
+  try {
+    await execFileAsync2(
+      "uv",
+      ["tool", "install", "--force", `horus-source==${PINNED_SOURCE_VERSION}`],
+      { timeout: 3e5 }
+    );
+    write(`  ${import_picocolors43.default.green("\u2713")} Source backend upgraded to ${PINNED_SOURCE_VERSION}.`);
+  } catch {
+    write(`  ${import_picocolors43.default.yellow("!")} Couldn't auto-upgrade the source backend. Re-run the installer:`);
+    write(`    ${import_picocolors43.default.dim("curl -fsSL https://horus.sh/install.sh | bash")}`);
+  }
+}
 var RELEASES_API = "https://api.github.com/repos/meritt-dev/horus/releases/latest";
 function parseVersion(v4) {
   const m5 = v4.replace(/^v/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -115458,6 +115595,7 @@ ${import_picocolors43.default.bold("Horus update")}
   if (!newer && !opts.force) {
     write(`
   ${import_picocolors43.default.green("\u2713")} Already on the latest version.`);
+    await ensureBackendPinned(write);
     return 0;
   }
   const tag = release.tag_name;
@@ -115553,19 +115691,20 @@ ${import_picocolors43.default.bold("Horus update")}
   }
   write(`  ${import_picocolors43.default.green("\u2713")} Updated: ${import_picocolors43.default.bold(currentVersion)} \u2192 ${import_picocolors43.default.bold(latest)}`);
   write(`  ${import_picocolors43.default.dim(binaryPath)}`);
+  await ensureBackendPinned(write);
   return 0;
 }
 
 // ../../packages/cli/src/commands/login.ts
 init_cjs_shims();
-var import_node_child_process9 = require("child_process");
+var import_node_child_process10 = require("child_process");
 var import_picocolors44 = __toESM(require_picocolors(), 1);
 var sleep2 = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
 function openBrowser(url) {
   const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
   const args2 = process.platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    (0, import_node_child_process9.execFile)(cmd, args2, () => {
+    (0, import_node_child_process10.execFile)(cmd, args2, () => {
     });
   } catch {
   }
@@ -115704,7 +115843,7 @@ var import_promises3 = require("readline/promises");
 
 // ../../packages/cli/src/lib/cloud/git.ts
 init_cjs_shims();
-var import_node_child_process10 = require("child_process");
+var import_node_child_process11 = require("child_process");
 function parseRepoName(remoteUrl) {
   const cleaned = remoteUrl.trim().replace(/\.git$/, "");
   const lastSegment = cleaned.split(/[/:]/).filter(Boolean).pop() ?? "";
@@ -115728,7 +115867,7 @@ function inferProvider(remoteUrl) {
 }
 function detectGitRemote(root) {
   try {
-    const remoteUrl = (0, import_node_child_process10.execFileSync)("git", ["-C", root, "remote", "get-url", "origin"], {
+    const remoteUrl = (0, import_node_child_process11.execFileSync)("git", ["-C", root, "remote", "get-url", "origin"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -116652,7 +116791,12 @@ Examples:
   });
   program2.command("logs [service]").description(
     "Synthesize error evidence from logs (signatures, first/last, affected services); --raw for lines"
-  ).option("-c, --config <path>", "path to horus.config.ts").option("--name <name>", "registered project name (resolves via the registry)").option("--project <name>", "project name").option("--env <name>", "environment name (e.g. production)").option("--since <when>", "time window, e.g. 24h, 7d, or an ISO date").option("--level <level>", "minimum level (with --raw): trace|debug|info|warn|error|fatal").option("--grep <text>", "match text in the message").option("--raw", "dump individual log lines instead of synthesized evidence (error+ by default)").option("--all-levels", "with --raw: show all severity levels, not just error+").option("--group-by <field>", "aggregate error counts by a context field, e.g. context.brand_id").option("--limit <n>", "max records (with --raw)").option("--json", "output JSON").option("--ai", "append AI narration of error signatures (default mode only, not --raw or --json)").option("--ai-model <model>", "override the AI model (default: claude-opus-4-8)").action(
+  ).option("-c, --config <path>", "path to horus.config.ts").option("--name <name>", "registered project name (resolves via the registry)").option("--project <name>", "project name").option("--env <name>", "environment name (e.g. production)").option("--since <when>", "time window, e.g. 24h, 7d, or an ISO date").option("--level <level>", "minimum level (with --raw): trace|debug|info|warn|error|fatal").option("--grep <text>", "match text in the message").option("--raw", "dump individual log lines instead of synthesized evidence (error+ by default)").option("--all-levels", "with --raw: show all severity levels, not just error+").option("--group-by <field>", "aggregate error counts by a context field, e.g. context.brand_id").option(
+    "--where <field=value>",
+    "filter by a structured context field (repeatable, AND-combined), e.g. --where context.brand_id=42",
+    (val, acc) => [...acc, val],
+    []
+  ).option("--limit <n>", "max records (with --raw)").option("--json", "output JSON").option("--ai", "append AI narration of error signatures (default mode only, not --raw or --json)").option("--ai-model <model>", "override the AI model (default: claude-opus-4-8)").action(
     async (service, opts) => {
       process.exitCode = await runLogs(service, opts);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.8.11",
+  "version": "0.8.13",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {