@merittdev/horus 0.8.4 → 0.8.5

package/dist/index.cjs

@@ -65880,7 +65880,7 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.8.4" : "dev";
+var HORUS_VERSION = true ? "0.8.5" : "dev";
 var PINNED_SOURCE_VERSION = "1.5.0";
 
 // ../../packages/core/src/evidence.ts
@@ -92976,6 +92976,67 @@ async function investigate(input, deps) {
           } catch {
           }
         }
+        if (top !== void 0 && typeof deps.code?.searchSymbols === "function") {
+          const GAP_D_MAX_RESOLVE = 12;
+          const seedScope = /* @__PURE__ */ new Set([top.id, ...(ctx?.callees ?? []).map((c4) => c4.id)]);
+          const alreadyEmitted = new Set(seedEmittedJoins.map((j3) => j3.code));
+          const candidates = analysis.signatures.filter(
+            (s5) => s5.key !== "" && s5.key !== "(none)" && s5.count > 0 && !alreadyEmitted.has(s5.key)
+          ).sort((a2, b5) => b5.count - a2.count).slice(0, GAP_D_MAX_RESOLVE);
+          for (const sig of candidates) {
+            let raiser;
+            try {
+              raiser = (await deps.code.searchSymbols(sig.key, 1))[0];
+            } catch {
+              continue;
+            }
+            if (raiser === void 0 || !seedScope.has(raiser.id)) continue;
+            let evId = directEvIdByKey.get(sig.key);
+            if (evId === void 0) {
+              const where = raiser.id === top.id ? "the seed" : "a callee of the seed";
+              const links = raiser.startLine !== void 0 && raiser.startLine > 0 ? { symbolId: raiser.id, file: raiser.filePath, line: raiser.startLine } : { symbolId: raiser.id, file: raiser.filePath };
+              const ev = mkEv(
+                "log",
+                `event_code ${sig.key}: ${sig.count}x in Elasticsearch \u2014 raised by ${raiser.name} (${where})`.slice(
+                  0,
+                  220
+                ),
+                {
+                  signature: sig.key,
+                  count: sig.count,
+                  firstSeen: sig.firstSeen,
+                  lastSeen: sig.lastSeen,
+                  services: sig.services,
+                  isNew: sig.isNew ?? false,
+                  ratio: sig.ratio ?? null,
+                  sampleMessage: sig.sampleMessage ?? null,
+                  relevanceClass: "direct",
+                  relevanceReason: `event_code ${sig.key} is raised by ${raiser.name} (${where})`,
+                  crossSignalJoin: true,
+                  seedEmitted: true
+                },
+                links,
+                sig.lastSeen || void 0,
+                0.9
+              );
+              if (sig.isNew) ev.isNew = sig.isNew;
+              if (typeof sig.ratio === "number" && Number.isFinite(sig.ratio)) ev.ratio = sig.ratio;
+              logEvIds.push(ev.id);
+              directLogEvIds.push(ev.id);
+              directSignatures.push({ key: sig.key, count: sig.count, message: sig.sampleMessage ?? "" });
+              directEvIdByKey.set(sig.key, ev.id);
+              evId = ev.id;
+            }
+            seedEmittedJoins.push({
+              code: sig.key,
+              count: sig.count,
+              message: sig.sampleMessage ?? "",
+              evId,
+              isNew: sig.isNew ?? false,
+              level: sig.level ?? null
+            });
+          }
+        }
         if (typeof deps.logs.aggregateErrors === "function") {
           const sigForEntities = analysis.signatures.find(
             (s5) => detectEntityFields(s5.sampleContext).length > 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {