@davesheffer/hunch 1.38.0 → 1.39.0

package/dist/extractors/indexer.js

@@ -10,8 +10,9 @@
  */
 import { readFileSync } from "node:fs";
 import { dirname, join, posix } from "node:path";
-import { parseSource, attributeCalls, attributeRelations } from "./parse.js";
+import { parseSource, attributeCalls, attributeRelations, MAX_BODY_TEXT_CHARS } from "./parse.js";
 import { extractHelmDirectives } from "./helm.js";
+import { extractK8sManifest } from "./k8sManifest.js";
 import { symbolId, componentId, edgeId, sha1 } from "../core/ids.js";
 import { externalImportNodeId, externalPackage } from "../core/externalImports.js";
 import { resolveRelativeImport } from "../core/relativeImports.js";
@@ -100,6 +101,10 @@ export function scanRepo(store, root, opts = {}) {
     const perFileCalls = [];
     const perFileImports = [];
     const perFileRelations = [];
+    const k8sResourceIndex = [];
+    const k8sReferenceCandidates = [];
+    const k8sSelectors = [];
+    const k8sWorkloadLabels = [];
     const phpNamespaces = new Map();
     const phpUseDeclarations = new Map();
     // Batched per-file git metrics (churn + last commit) in TWO `git log` spawns
@@ -113,7 +118,7 @@ export function scanRepo(store, root, opts = {}) {
         const chartRoot = chartRootFor(path);
         if (chartRoot === null)
             continue;
-        (chartFiles.get(chartRoot) ?? chartFiles.set(chartRoot, []).get(chartRoot)).push(path);
+        pushInto(chartFiles, chartRoot, path);
     }
     const gitMeta = useGit ? fileGitMetrics(root, rels, opts.churn === false ? 0 : 90) : null;
     let skipped = 0;
@@ -165,8 +170,50 @@ export function scanRepo(store, root, opts = {}) {
         // JS-falsy — `if (chartRoot)` would silently skip every repo-root chart.
         if (chartRoot !== null) {
             const helm = extractHelmDirectives(src);
-            parsed.symbols = [...parsed.symbols, ...helm.symbols].sort((a, b) => a.startByte - b.startByte);
-            parsed.calls = [...parsed.calls, ...helm.calls];
+            // helm.ts's own offsets are named *Char (they're JS char indices, not
+            // UTF-8 bytes -- see its module doc comment); mapped here into
+            // parsed.symbols/calls's startByte/endByte/atByte fields, which carry
+            // the same char-index values under the shared ParsedSymbol/ParsedCall
+            // naming this merge target already uses.
+            const helmSymbols = helm.symbols.map((s) => ({
+                name: s.name, kind: s.kind, startByte: s.startChar, endByte: s.endChar, loc: s.loc, bodyText: s.bodyText,
+            }));
+            const helmCalls = helm.calls.map((c) => ({
+                callee: c.callee, atByte: c.atChar, endByte: c.endChar, member: c.member,
+            }));
+            parsed.symbols = [...parsed.symbols, ...helmSymbols].sort((a, b) => a.startByte - b.startByte);
+            parsed.calls = [...parsed.calls, ...helmCalls];
+        }
+        // Runs for EVERY yaml file, chart or not (unlike the Helm merge above) --
+        // raw manifests with no Chart.yaml are still in scope; what varies below is
+        // resolution SCOPE (chartRoot ?? this file), not whether extraction runs.
+        let k8sDocs = [];
+        // THIS file's K8s resource symbol OBJECTS (identity, not their byte
+        // offsets) -- scopes the id lookup below to exactly the symbols this pass
+        // creates. Identity, not a Set<number> of startBytes, because a byte
+        // value is not a reliable per-symbol key: a Helm `define` symbol that
+        // happens to share a startByte with a K8s doc symbol in the same .yaml
+        // file (both legitimately synthetic, both can start at byte 0) would
+        // otherwise be indistinguishable by offset alone, and the wrong (Helm)
+        // symbol id could get recorded instead of the K8s one.
+        const k8sSymbolObjects = new Set();
+        if (languageFor(rel)?.id === "yaml") {
+            k8sDocs = extractK8sManifest(src);
+            const k8sSymbols = k8sDocs
+                .filter((d) => d.resource !== null)
+                // k8sManifest.ts's own offsets are named *Char; mapped here into the
+                // shared startByte/endByte fields, same as the Helm merge above.
+                .map((d) => ({
+                name: `${d.resource.kind}/${displayNameText(d.resource.name)}`,
+                kind: "variable",
+                startByte: d.resource.startChar,
+                endByte: d.resource.endChar,
+                loc: src.slice(d.resource.startChar, d.resource.endChar).split("\n").length,
+                bodyText: src.slice(d.resource.startChar, d.resource.endChar).slice(0, MAX_BODY_TEXT_CHARS),
+            }));
+            for (const s of k8sSymbols)
+                k8sSymbolObjects.add(s);
+            parsed.symbols = [...parsed.symbols, ...k8sSymbols].sort((a, b) => a.startByte - b.startByte);
         }
         const m = gitMeta?.get(rel);
         const churn = opts.churn === false ? (preservedChurn.get(rel) ?? 0) : (m?.churn ?? 0);
@@ -174,6 +221,7 @@ export function scanRepo(store, root, opts = {}) {
         const idsInFile = [];
         const symbolIndexId = new Map();
         const idCounts = new Map(); // disambiguate same (file,name,kind)
+        const k8sSymbolIdByStartByte = new Map();
         for (const [index, ps] of parsed.symbols.entries()) {
             const base = symbolId(rel, ps.name, ps.kind);
             const n = idCounts.get(base) ?? 0;
@@ -182,7 +230,7 @@ export function scanRepo(store, root, opts = {}) {
             const id = n === 0 ? base : `${base}_${n}`;
             idsInFile.push(id);
             symbolIndexId.set(index, id);
-            (nameIndex.get(ps.name) ?? nameIndex.set(ps.name, []).get(ps.name)).push(id);
+            pushInto(nameIndex, ps.name, id);
             symbols.push({
                 id, file: rel, name: ps.name, kind: ps.kind,
                 signature_hash: sha1(ps.bodyText).slice(0, 16),
@@ -190,6 +238,27 @@ export function scanRepo(store, root, opts = {}) {
                 metrics: { loc: ps.loc, churn_90d: churn, bug_count: 0, fan_in: 0, fan_out: 0 },
                 last_changed: last,
             });
+            if (k8sSymbolObjects.has(ps))
+                k8sSymbolIdByStartByte.set(ps.startByte, id);
+        }
+        for (const doc of k8sDocs) {
+            if (!doc.resource)
+                continue;
+            const fromId = k8sSymbolIdByStartByte.get(doc.resource.startChar);
+            if (!fromId)
+                continue;
+            const scope = chartRoot ?? rel;
+            k8sResourceIndex.push({ symbolId: fromId, scope, kind: doc.resource.kind, nameKey: nameKeyText(doc.resource.name) });
+            for (const ref of doc.references) {
+                k8sReferenceCandidates.push({
+                    fromSymbolId: fromId, scope, refKind: ref.refKind, nameKey: nameKeyText(ref.name),
+                    reason: `${doc.resource.kind}/${displayNameText(doc.resource.name)} references ${ref.refKind}/${displayNameText(ref.name)}`,
+                });
+            }
+            if (doc.selector)
+                k8sSelectors.push({ symbolId: fromId, scope, selector: doc.selector });
+            if (doc.labels)
+                k8sWorkloadLabels.push({ symbolId: fromId, scope, labels: doc.labels });
         }
         fileSymbols.set(rel, idsInFile);
         fileSymbolIndexId.set(rel, symbolIndexId);
@@ -285,6 +354,77 @@ export function scanRepo(store, root, opts = {}) {
             }
         }
     }
+    // ---- K8s manifest cross-resource references (Phase 1: name-keyed) --------
+    // Own resolver, not resolveName(): resolveName() indexes by bare symbol name
+    // only, with no concept of Kubernetes kind -- a ConfigMap and a Secret that
+    // happen to share a name would incorrectly conflate. Same ambiguity contract
+    // as resolveName() though: 0 matches or 2+ matches -> no edge, never guess.
+    const kindNameIndex = new Map();
+    for (const r of k8sResourceIndex) {
+        const key = `${r.scope}:${r.kind}:${r.nameKey}`;
+        pushInto(kindNameIndex, key, r.symbolId);
+    }
+    for (const ref of k8sReferenceCandidates) {
+        const candidates = kindNameIndex.get(`${ref.scope}:${ref.refKind}:${ref.nameKey}`) ?? [];
+        if (candidates.length !== 1)
+            continue; // 0 or 2+ -> ambiguous or absent, don't guess
+        const toId = candidates[0];
+        if (toId === ref.fromSymbolId)
+            continue;
+        addEdge({
+            schema: "hunch.edge/1",
+            id: edgeId(ref.fromSymbolId, toId, "references"),
+            from: ref.fromSymbolId, to: toId, type: "references",
+            reason: ref.reason, strength: 0.7,
+            provenance: extracted(0.7, [ref.scope]),
+            environment: null,
+            metadata: {},
+        });
+    }
+    // ---- K8s manifest cross-resource references (Phase 2: label-selector) ----
+    // Structurally different from Phase 1: no name to look up, a SUBSET match
+    // between a Service's selector and a workload's pod-template labels, within
+    // the same scope. Only ever fires on LITERAL selector/labels (k8sSelectors/
+    // k8sWorkloadLabels are already filtered to literal-only by k8sManifest.ts --
+    // a block-form templated value is never guessed at).
+    //
+    // Deliberately NO ambiguity guard here, unlike Phase 1's "0 or 2+ candidates
+    // -> no edge": a Service legitimately fronting multiple workloads (blue/green,
+    // canary, a shared-label pair of Deployments) is normal, intentional
+    // Kubernetes usage, not an ambiguous match to decline -- Phase 1's guard
+    // exists because a ConfigMap named X is exactly one resource by definition,
+    // which has no analogue here. Fan-out is the correct behavior, not a gap.
+    const selectorsByScope = new Map();
+    for (const s of k8sSelectors)
+        pushInto(selectorsByScope, s.scope, s);
+    const labelsByScope = new Map();
+    for (const l of k8sWorkloadLabels)
+        pushInto(labelsByScope, l.scope, l);
+    for (const [scope, selectors] of selectorsByScope) {
+        const workloads = labelsByScope.get(scope) ?? [];
+        for (const svc of selectors) {
+            for (const wl of workloads) {
+                // Defensive, not currently reachable: k8sSelectors only ever holds
+                // Service symbols and k8sWorkloadLabels only ever holds symbols for
+                // kinds in LABELS_PATH_BY_KIND, which excludes Service -- so the two
+                // ids can never collide today.
+                if (svc.symbolId === wl.symbolId)
+                    continue;
+                const isSubset = Object.entries(svc.selector).every(([k, v]) => wl.labels[k] === v);
+                if (!isSubset)
+                    continue;
+                addEdge({
+                    schema: "hunch.edge/1",
+                    id: edgeId(svc.symbolId, wl.symbolId, "references"),
+                    from: svc.symbolId, to: wl.symbolId, type: "references",
+                    reason: "Service selector matches workload pod-template labels", strength: 0.6,
+                    provenance: extracted(0.6, [scope]),
+                    environment: null,
+                    metadata: {},
+                });
+            }
+        }
+    }
     // PHP's static type relationships use the same symbol graph and conservative
     // resolver as calls. Ambiguous or dynamic targets produce no edge.
     for (const { file, bySym } of perFileRelations) {
@@ -441,6 +581,16 @@ export function indexRepo(store, root, opts = {}) {
     return scan.result;
 }
 // ---- helpers --------------------------------------------------------------
+/** Append `value` to the array at `key`, creating the array on first use.
+ *  Function declaration (not `const`) so it's usable from pass-1 code above
+ *  this section via hoisting, without reordering. */
+function pushInto(map, key, value) {
+    const bucket = map.get(key);
+    if (bucket)
+        bucket.push(value);
+    else
+        map.set(key, [value]);
+}
 /** Nearest-ancestor Chart.yaml lookup, memoized per directory: walks a file's
  *  own directory upward through the tracked-file set until it finds
  *  `<dir>/Chart.yaml`, or returns null if the file isn't under any chart.
@@ -449,8 +599,9 @@ export function indexRepo(store, root, opts = {}) {
  *  approximation, not full Helm semantics: Helm's template namespace is
  *  actually release-global, so a parent chart can legitimately include a
  *  subchart's define — nearest-ancestor scoping will miss that edge rather
- *  than fabricate a wrong one. No test currently covers the nested
- *  charts/<sub>/Chart.yaml case — tracked as issue #42. */
+ *  than fabricate a wrong one (test coverage: indexer.test.ts's nested-subchart
+ *  and subchart-miss cases). Modeling the release-global namespace itself
+ *  remains open — issue #42. */
 function nearestChartRoot(rels) {
     const tracked = new Set(rels);
     const cache = new Map();
@@ -466,6 +617,19 @@ function nearestChartRoot(rels) {
     };
     return (file) => resolveDir(file.includes("/") ? file.slice(0, file.lastIndexOf("/")) : "");
 }
+/** Human-readable text for a name/kind field -- a literal value as-is, or a
+ *  template's exact raw `{{ }}` source text (never evaluated). Used for
+ *  display (symbol names, edge reasons); NOT for resolution-key equality --
+ *  see nameKeyText below for that. */
+function displayNameText(ref) {
+    return ref.form === "literal" ? ref.value : ref.sourceText;
+}
+/** Normalized resolution-key text for a name/kind field: a literal value or a
+ *  template's exact raw source text, EACH PREFIXED so a literal "foo" can
+ *  never collide with a template whose source text happens to read "foo". */
+function nameKeyText(ref) {
+    return ref.form === "literal" ? `L:${ref.value}` : `T:${ref.sourceText}`;
+}
 /** Resolve a callee name to a symbol id: prefer same-file, otherwise require a
  * unique symbol in a statically imported local file. A unique repository-wide
  * name is not evidence of a binding: callback parameters and built-ins often

package/dist/extractors/k8sManifest.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Deterministic text scan for Kubernetes manifest cross-resource references —
+ * NOT a tree-sitter walk. Confirmed directly (not assumed): parsing a realistic
+ * templated Deployment with this repo's own tree-sitter-yaml bundle showed a
+ * same-line templated scalar (`name: {{ include "x" . }}`) parses cleanly, but
+ * a block-form injection on its own line (`labels:\n  {{- include ... }}` — the
+ * pattern real charts use for metadata.labels and spec.selector) collapses the
+ * WHOLE REST OF THE DOCUMENT'S error recovery into a flat, unstructured ERROR
+ * node. Real charts place such an injection early (right after metadata.name),
+ * so it would poison parsing for every field-path this module needs further
+ * down the same document. parseSource() (parse.ts) also never exposes its
+ * tree-sitter tree to callers at all -- helm.ts's own text-scan precedent
+ * exists for the same reason.
+ *
+ * This is a line-oriented, indentation-tracking scanner (not flat regex, unlike
+ * helm.ts's `{{ }}`-action scan) because K8s field-paths are nested block
+ * structure (`spec.template.spec.containers[].env[].valueFrom.secretKeyRef.name`)
+ * that a flat scan can't reconstruct. It never interprets `{{ }}` as YAML syntax
+ * at all -- a `{{ ... }}` on a line's value side is just that line's raw value
+ * text, same-line or block-form alike -- so it is immune to the exact failure
+ * mode that broke tree-sitter.
+ */
+export type ManifestNameRef = {
+    form: "literal";
+    value: string;
+    atChar: number;
+    endChar: number;
+} | {
+    form: "template";
+    sourceText: string;
+    atChar: number;
+    endChar: number;
+};
+interface K8sReferenceCandidate {
+    /** Fixed literal for most kinds ("ConfigMap", "Secret", "PersistentVolumeClaim",
+     *  "Service"); for an ownerReferences entry, the reference's OWN `kind` field
+     *  value (data-dependent, not statically known). */
+    refKind: string;
+    name: ManifestNameRef;
+}
+type ManifestLabelMap = Record<string, string>;
+interface K8sResourceDoc {
+    kind: string;
+    name: ManifestNameRef;
+    startChar: number;
+    endChar: number;
+}
+export interface K8sManifestDocument {
+    resource: K8sResourceDoc | null;
+    references: K8sReferenceCandidate[];
+    selector: ManifestLabelMap | null;
+    labels: ManifestLabelMap | null;
+}
+/** Where a kind's pod spec lives -- factored once so container/volume field
+ *  paths below aren't hand-duplicated per kind. */
+export declare const POD_SPEC_PATH_BY_KIND: Record<string, string>;
+export declare const LABELS_PATH_BY_KIND: Record<string, string>;
+export declare function extractK8sManifest(source: string): K8sManifestDocument[];
+export {};