From 7c63c5f76d84613ca5e40d71b9a541058501bcbf Mon Sep 17 00:00:00 2001 From: lorentz Date: Wed, 15 Jul 2026 08:08:20 -0400 Subject: [PATCH] fix(15): WR-02 refresh evidence snapshot even when content_hash unchanged --- lib/services/phishing-detector.ts | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/services/phishing-detector.ts b/lib/services/phishing-detector.ts index a732c2c..54349b5 100644 --- a/lib/services/phishing-detector.ts +++ b/lib/services/phishing-detector.ts @@ -188,7 +188,19 @@ export async function detectPhishingTicket( ); if (existing.rowCount && existing.rowCount > 0 && existing.rows[0].content_hash === contentHash) { - return { flagged: true, skippedUnchanged: true }; + // Content unchanged (D-04): skip full reprocessing (title/description/ + // matched_patterns/content_hash rewriting would be a no-op anyway). + // But the evidence snapshot (notes, time entries, attachments) can + // still drift after the first detection — an analyst can add a note, + // log time, or attach a file without touching title/description. Refresh + // the evidence snapshot on every call regardless of the content-hash + // gate so later phases never read a stale snapshot. + const refreshedEvidence = await gatherTicketEvidence(ticket); + await postgresClient.query( + `UPDATE reports SET evidence = $1::jsonb, updated_at = NOW() WHERE ticket_id = $2`, + [JSON.stringify(refreshedEvidence), ticket.id] + ); + return { flagged: true, reportId: existing.rows[0].id, skippedUnchanged: true }; } const evidence = await gatherTicketEvidence(ticket);