@merittdev/horus 0.8.3 → 0.8.5

package/dist/index.cjs

@@ -65880,7 +65880,7 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.8.3" : "dev";
+var HORUS_VERSION = true ? "0.8.5" : "dev";
 var PINNED_SOURCE_VERSION = "1.5.0";
 
 // ../../packages/core/src/evidence.ts
@@ -71867,7 +71867,14 @@ function buildErrorAnalysisBody(q2, field = "event_code", mapping = MERITT_FIELD
           sample: {
             top_hits: {
               size: 1,
-              _source: [mapping.messageField, "component", "log_logger", "context", "detail"],
+              _source: [
+                mapping.messageField,
+                mapping.levelField,
+                "component",
+                "log_logger",
+                "context",
+                "detail"
+              ],
               sort: [{ [mapping.timestampField]: { order: "desc" } }]
             }
           }
@@ -71881,7 +71888,21 @@ function bucketsOf(node) {
   const n4 = node;
   return n4?.["buckets"] ?? [];
 }
-function parseErrorAnalysis(resp, window2, messageField = "message") {
+function readLevel(src, levelField) {
+  const raw = getField(src, levelField) ?? src[levelField];
+  if (typeof raw === "number" && Number.isFinite(raw)) return valueToLevel(raw);
+  if (typeof raw === "string") {
+    const v4 = raw.trim().toLowerCase();
+    if (v4 === "fatal" || v4 === "error" || v4 === "warn" || v4 === "info" || v4 === "debug" || v4 === "trace") {
+      return v4;
+    }
+    if (v4 === "warning") return "warn";
+    const n4 = Number(v4);
+    if (Number.isFinite(n4)) return valueToLevel(n4);
+  }
+  return void 0;
+}
+function parseErrorAnalysis(resp, window2, messageField = "message", levelField) {
   const res = resp;
   const aggs = res["aggregations"] ?? {};
   const hits = res["hits"];
@@ -71898,12 +71919,14 @@ function parseErrorAnalysis(resp, window2, messageField = "message") {
     const sampleMessage = typeof rawMsg === "string" ? rawMsg : typeof sampleSrc["message"] === "string" ? sampleSrc["message"] : void 0;
     const ctx = sampleSrc["context"];
     const sampleContext = ctx !== null && typeof ctx === "object" && !Array.isArray(ctx) ? ctx : void 0;
+    const level = levelField !== void 0 ? readLevel(sampleSrc, levelField) : void 0;
     return {
       key: String(b5["key"] ?? "") || "(none)",
       count: typeof b5["doc_count"] === "number" ? b5["doc_count"] : 0,
       firstSeen: typeof first === "string" ? first : "",
       lastSeen: typeof last === "string" ? last : "",
       services,
+      ...level !== void 0 ? { level } : {},
       sampleMessage,
       sampleComponent: typeof sampleSrc["component"] === "string" ? sampleSrc["component"] : typeof sampleSrc["log_logger"] === "string" ? sampleSrc["log_logger"] : void 0,
       ...sampleContext !== void 0 ? { sampleContext } : {}
@@ -72182,7 +72205,12 @@ var ElasticsearchLogsProvider = class {
       this.resolveIndex(q2),
       buildErrorAnalysisBody(current, sigField, this.mapping)
     );
-    const analysis = parseErrorAnalysis(curRes, { from, to }, this.mapping.messageField);
+    const analysis = parseErrorAnalysis(
+      curRes,
+      { from, to },
+      this.mapping.messageField,
+      this.mapping.levelField
+    );
     const fromMs = Date.parse(from);
     const toMs = Date.parse(to);
     if (!Number.isNaN(fromMs) && !Number.isNaN(toMs) && toMs > fromMs) {
@@ -92248,6 +92276,24 @@ function clamp015(n4) {
   if (n4 > 1) return 1;
   return n4;
 }
+var SEV_ERROR = 2;
+var SEV_WARN = 1;
+var SEV_INFO = 0;
+function seedEmittedSeverityTier(level, code, message) {
+  const lv = level?.toLowerCase();
+  if (lv === "error" || lv === "fatal" || lv === "critical") return SEV_ERROR;
+  if (lv === "warn" || lv === "warning") return SEV_WARN;
+  if (lv === "info" || lv === "debug" || lv === "trace") return SEV_INFO;
+  const m5 = /^([A-Z])_/.exec(code);
+  const prefix = m5?.[1];
+  if (prefix === "W") return SEV_WARN;
+  if (prefix === "D" || prefix === "I" || prefix === "T") return SEV_INFO;
+  if (prefix === "E" || prefix === "F" || prefix === "C") return SEV_ERROR;
+  const text2 = `${code} ${message ?? ""}`.toLowerCase();
+  if (/\b(skip|skipping|skipped|deprecat|info|debug|trace|notice)\b/.test(text2)) return SEV_INFO;
+  if (/\bwarn(ing)?\b/.test(text2)) return SEV_WARN;
+  return SEV_ERROR;
+}
 function confidenceCeilingForCause(score) {
   const s5 = clamp015(score);
   if (s5 < 0.2) return 0.6;
@@ -92438,7 +92484,7 @@ function looksPerformance(hint) {
     hint
   );
 }
-function buildBehavioralWalkthrough(hint, top, ctx, flows) {
+function buildBehavioralWalkthrough(hint, top, ctx, flows, classMethods = []) {
   const shortFile = (f5) => f5.replace(/^.*?((?:src|app|lib|packages)\/.*)$/, "$1");
   const isNoise = (s5) => /logger|logging|\.log\b|telemetry/i.test(s5.filePath) || /^(forcontext|getlogger|child|debug|info|warn|error|log|trace|tracer)$/i.test(s5.name);
   const flow = flows.slice().sort((a2, b5) => b5.steps.length - a2.steps.length)[0];
@@ -92456,7 +92502,7 @@ function buildBehavioralWalkthrough(hint, top, ctx, flows) {
   };
   const PERSIST_RE = /(^|[._])(save|insert|upsert|persist|bulkwrite|find|findone|findmany|aggregate|delete|remove)\b|repositor|\brepo\b|\.model|entity|prisma|mongoose|typeorm|knex|\bdao\b|datasource/i;
   const EXTERNAL_RE = /(^|[._])(request|publish|enqueue|dispatch|emit|notify)\b|http|axios|\bapi\b|webhook|\bqueue\b|processor|producer|gateway|\.client\b/i;
-  const pool = dedup([...steps, ...ctx?.callees ?? []]).filter((s5) => !isNoise(s5));
+  const pool = dedup([...steps, ...ctx?.callees ?? [], ...classMethods]).filter((s5) => !isNoise(s5));
   const persistence = dedup(pool.filter((s5) => PERSIST_RE.test(s5.name) || PERSIST_RE.test(s5.filePath))).slice(0, 6).map((s5) => `${s5.name} (${shortFile(s5.filePath)})`);
   const persistNames = new Set(persistence.map((p5) => p5.split(" (")[0]));
   const externalCalls = dedup(
@@ -92467,9 +92513,15 @@ function buildBehavioralWalkthrough(hint, top, ctx, flows) {
     const loc = entry2.startLine ? `${shortFile(entry2.filePath)}:${entry2.startLine}` : shortFile(entry2.filePath);
     lines.push(`Entry point: \`${entry2.name}\` (${loc}).`);
   }
+  const methodList = dedup(classMethods.filter((s5) => !isNoise(s5)));
   if (steps.length > 1) {
     const chain = steps.slice(0, 12).map((s5) => s5.name).join(" \u2192 ");
     lines.push(`Flow: ${chain}${steps.length > 12 ? " \u2192 \u2026" : ""}${flow ? ` (${flow.steps.length} steps)` : ""}.`);
+  } else if (entry2 && methodList.length > 0) {
+    const names = methodList.slice(0, 12).map((s5) => s5.name).join(", ");
+    lines.push(
+      `\`${entry2.name}\` is a class \u2014 its methods are the entry points: ${names}${methodList.length > 12 ? ", \u2026" : ""}. Trace one with \`horus explain <method>\`.`
+    );
   } else if (entry2) {
     lines.push(`No multi-step execution flow was indexed for \`${entry2.name}\` \u2014 showing its direct calls.`);
   }
@@ -92478,6 +92530,28 @@ function buildBehavioralWalkthrough(hint, top, ctx, flows) {
   if (lines.length === 0) lines.push("No execution flow could be reconstructed for this query from the source graph.");
   return { question: hint, entry: entry2, steps, externalCalls, persistence, narrative: lines.join("\n") };
 }
+function isClassSymbol(sym) {
+  return sym !== void 0 && sym.id.split(":", 1)[0]?.toLowerCase() === "class";
+}
+async function fetchClassMethods(code, cls) {
+  const safe = (s5) => s5.replace(/["\\]/g, "");
+  const name2 = safe(cls.name);
+  if (!name2) return [];
+  const file = safe(cls.filePath);
+  try {
+    const res = await code.cypher(
+      `MATCH (m:Method) WHERE m.class_name = "${name2}"` + (file ? ` AND m.file_path = "${file}"` : "") + " RETURN m.id, m.name, m.file_path, m.start_line ORDER BY m.start_line LIMIT 40"
+    );
+    return res.rows.map((r) => ({
+      id: String(r[0] ?? ""),
+      name: String(r[1] ?? ""),
+      filePath: String(r[2] ?? ""),
+      ...typeof r[3] === "number" ? { startLine: r[3] } : {}
+    })).filter((s5) => s5.id !== "" && s5.name !== "");
+  } catch {
+    return [];
+  }
+}
 function formatRegressionCitation(recentChanges, changes, seedFile) {
   const matchesSeed = (f5) => seedFile === void 0 || f5 === seedFile || seedFile.endsWith(f5) || f5.endsWith(seedFile);
   const all = recentChanges?.commits ?? [];
@@ -92847,7 +92921,8 @@ async function investigate(input, deps) {
                     count: sig.count,
                     message: sig.sampleMessage ?? "",
                     evId: existingEvId,
-                    isNew: sig.isNew ?? false
+                    isNew: sig.isNew ?? false,
+                    level: sig.level ?? null
                   });
                 }
               }
@@ -92894,12 +92969,74 @@ async function investigate(input, deps) {
                 count: sig.count,
                 message: sig.sampleMessage ?? "",
                 evId: ev.id,
-                isNew: sig.isNew ?? false
+                isNew: sig.isNew ?? false,
+                level: sig.level ?? null
               });
             }
           } catch {
           }
         }
+        if (top !== void 0 && typeof deps.code?.searchSymbols === "function") {
+          const GAP_D_MAX_RESOLVE = 12;
+          const seedScope = /* @__PURE__ */ new Set([top.id, ...(ctx?.callees ?? []).map((c4) => c4.id)]);
+          const alreadyEmitted = new Set(seedEmittedJoins.map((j3) => j3.code));
+          const candidates = analysis.signatures.filter(
+            (s5) => s5.key !== "" && s5.key !== "(none)" && s5.count > 0 && !alreadyEmitted.has(s5.key)
+          ).sort((a2, b5) => b5.count - a2.count).slice(0, GAP_D_MAX_RESOLVE);
+          for (const sig of candidates) {
+            let raiser;
+            try {
+              raiser = (await deps.code.searchSymbols(sig.key, 1))[0];
+            } catch {
+              continue;
+            }
+            if (raiser === void 0 || !seedScope.has(raiser.id)) continue;
+            let evId = directEvIdByKey.get(sig.key);
+            if (evId === void 0) {
+              const where = raiser.id === top.id ? "the seed" : "a callee of the seed";
+              const links = raiser.startLine !== void 0 && raiser.startLine > 0 ? { symbolId: raiser.id, file: raiser.filePath, line: raiser.startLine } : { symbolId: raiser.id, file: raiser.filePath };
+              const ev = mkEv(
+                "log",
+                `event_code ${sig.key}: ${sig.count}x in Elasticsearch \u2014 raised by ${raiser.name} (${where})`.slice(
+                  0,
+                  220
+                ),
+                {
+                  signature: sig.key,
+                  count: sig.count,
+                  firstSeen: sig.firstSeen,
+                  lastSeen: sig.lastSeen,
+                  services: sig.services,
+                  isNew: sig.isNew ?? false,
+                  ratio: sig.ratio ?? null,
+                  sampleMessage: sig.sampleMessage ?? null,
+                  relevanceClass: "direct",
+                  relevanceReason: `event_code ${sig.key} is raised by ${raiser.name} (${where})`,
+                  crossSignalJoin: true,
+                  seedEmitted: true
+                },
+                links,
+                sig.lastSeen || void 0,
+                0.9
+              );
+              if (sig.isNew) ev.isNew = sig.isNew;
+              if (typeof sig.ratio === "number" && Number.isFinite(sig.ratio)) ev.ratio = sig.ratio;
+              logEvIds.push(ev.id);
+              directLogEvIds.push(ev.id);
+              directSignatures.push({ key: sig.key, count: sig.count, message: sig.sampleMessage ?? "" });
+              directEvIdByKey.set(sig.key, ev.id);
+              evId = ev.id;
+            }
+            seedEmittedJoins.push({
+              code: sig.key,
+              count: sig.count,
+              message: sig.sampleMessage ?? "",
+              evId,
+              isNew: sig.isNew ?? false,
+              level: sig.level ?? null
+            });
+          }
+        }
         if (typeof deps.logs.aggregateErrors === "function") {
           const sigForEntities = analysis.signatures.find(
             (s5) => detectEntityFields(s5.sampleContext).length > 0
@@ -93161,7 +93298,8 @@ async function investigate(input, deps) {
           const matchesHint = serviceFilter.length === 0 && hintIsPerf && hintTokens.some(
             (t2) => t2.length >= 4 && (panelLower.includes(t2) || labelVals.some((v4) => v4.includes(t2)))
           );
-          if (matchesService || matchesHint) latencyMetricEvIds.push(ev.id);
+          const genericPerf = serviceFilter.length === 0 && hintIsPerf && f5.anomaly === "latency-spike";
+          if (matchesService || matchesHint || genericPerf) latencyMetricEvIds.push(ev.id);
         } else if (f5.anomaly === "queue-growth") {
           const panelNorm = f5.panelTitle.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
           const labelNorms = Object.values(f5.labels).map(
@@ -93483,25 +93621,45 @@ async function investigate(input, deps) {
     });
   }
   if (seedEmittedJoins.length > 0 && top && seedEv) {
-    const ordered = [...seedEmittedJoins].sort((a2, b5) => b5.count - a2.count);
+    const ordered = [...seedEmittedJoins].sort((a2, b5) => {
+      const ta = seedEmittedSeverityTier(a2.level, a2.code, a2.message);
+      const tb = seedEmittedSeverityTier(b5.level, b5.code, b5.message);
+      if (ta !== tb) return tb - ta;
+      return b5.count - a2.count;
+    });
     const lead = ordered[0];
     if (lead !== void 0) {
       const sourceEvidenceIds = [
         .../* @__PURE__ */ new Set([...ordered.map((j3) => j3.evId), seedEv.id])
       ];
+      const tier = seedEmittedSeverityTier(lead.level, lead.code, lead.message);
       const volumeBoost = Math.min(0.1, Math.log10(Math.max(1, lead.count)) * 0.025);
-      const baseScore = clamp015(0.6 + volumeBoost);
       const msgClause = lead.message ? ` \u2014 "${lead.message.replace(/\s+/g, " ").trim().slice(0, 90)}"` : "";
+      let title;
+      let baseScore;
+      if (tier === SEV_ERROR) {
+        title = `Runtime error ${lead.code} (${lead.count}x in Elasticsearch) is raised by ${top.name} \u2014 the likely failure${msgClause}`;
+        baseScore = clamp015(0.6 + volumeBoost);
+      } else if (tier === SEV_WARN) {
+        title = `Warning ${lead.code} (${lead.count}x in Elasticsearch) is raised by ${top.name}${msgClause}`;
+        baseScore = clamp015(0.42 + volumeBoost);
+      } else {
+        title = `Diagnostic signal ${lead.code} (${lead.count}x in Elasticsearch) is logged by ${top.name} \u2014 informational, not an error${msgClause}`;
+        baseScore = clamp015(0.3 + volumeBoost);
+      }
       causeInputs.push({
         id: "cause:seed-emitted-error",
-        title: `Runtime error ${lead.code} (${lead.count}x in Elasticsearch) is raised by ${top.name} \u2014 the likely failure${msgClause}`.slice(
-          0,
-          220
-        ),
+        title: title.slice(0, 220),
         category: "error-correlation",
         sourceEvidenceIds,
         baseScore,
-        metadata: { blastRadius, seedEmitted: true, code: lead.code, count: lead.count }
+        metadata: {
+          blastRadius,
+          seedEmitted: true,
+          code: lead.code,
+          count: lead.count,
+          severity: tier === SEV_ERROR ? "error" : tier === SEV_WARN ? "warn" : "info"
+        }
       });
     }
   }
@@ -93609,7 +93767,11 @@ async function investigate(input, deps) {
   const seedLinkedEvIds = /* @__PURE__ */ new Set([
     ...directLogEvIds,
     ...seedEv ? [seedEv.id] : [],
-    ...impactEv ? [impactEv.id] : []
+    ...impactEv ? [impactEv.id] : [],
+    // GAP B: for a performance hint, a latency/error-rate anomaly is the structural answer,
+    // not co-occurring noise — let the metric-latency cause headline rather than yielding to
+    // a higher-volume but lower-severity log code.
+    ...looksPerformance(hint) ? latencyMetricEvIds : []
   ]);
   const isLinkedToSeed = (ids2) => ids2.some((id) => seedLinkedEvIds.has(id));
   const topLinkedCause = rankedCauses.find(
@@ -93638,7 +93800,14 @@ async function investigate(input, deps) {
         }
       }
     }
-    behavioral = buildBehavioralWalkthrough(hint, top, ctx ?? void 0, flowPool);
+    let classMethods = [];
+    if (code && isClassSymbol(top)) {
+      const richest = flowPool.slice().sort((a2, b5) => b5.steps.length - a2.steps.length)[0];
+      if (richest === void 0 || richest.steps.length <= 1) {
+        classMethods = await fetchClassMethods(code, top);
+      }
+    }
+    behavioral = buildBehavioralWalkthrough(hint, top, ctx ?? void 0, flowPool, classMethods);
     const noisy = hasIncidentSignal ? ' (note: live error signals also exist in this codebase \u2014 rephrase as a symptom like "X failing" for a fault hunt)' : "";
     summary = `${seedDisclaimer}${banner2}"${hint}" reads as a "how does it work" question \u2014 here is the code path${noisy}:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {