@davesheffer/hunch 1.39.2 → 1.40.0

package/dist/extractors/indexer.js

@@ -11,8 +11,9 @@
 import { readFileSync } from "node:fs";
 import { dirname, join, posix } from "node:path";
 import { parseSource, attributeCalls, attributeRelations, MAX_BODY_TEXT_CHARS } from "./parse.js";
+import { isParserLoadError } from "./nativeTreeSitter.js";
 import { extractHelmDirectives } from "./helm.js";
-import { extractK8sManifest } from "./k8sManifest.js";
+import { extractK8sManifest, namespacesCompatible } from "./k8sManifest.js";
 import { symbolId, componentId, edgeId, sha1 } from "../core/ids.js";
 import { externalImportNodeId, externalPackage } from "../core/externalImports.js";
 import { resolveRelativeImport } from "../core/relativeImports.js";
@@ -101,6 +102,12 @@ export function scanRepo(store, root, opts = {}) {
     const perFileCalls = [];
     const perFileImports = [];
     const perFileRelations = [];
+    // `namespace` on all four: a Kubernetes reference only resolves WITHIN a
+    // namespace, so a same-named resource in a different one is a different
+    // resource (issue #297). null means UNKNOWN (absent/templated/empty), which
+    // matches anything -- see namespacesCompatible. All four are in-memory
+    // resolution scratch, never persisted: the edges they produce keep their
+    // existing shape.
     const k8sResourceIndex = [];
     const k8sReferenceCandidates = [];
     const k8sSelectors = [];
@@ -145,7 +152,16 @@ export function scanRepo(store, root, opts = {}) {
         try {
             parsed = parseSource(rel, src);
         }
-        catch {
+        catch (error) {
+            // …but a dead PARSER is not a bad file. The native addons load on first
+            // parse, so a broken load (unwritable TMPDIR, missing prebuild, an addon
+            // preloaded past the isolation guard) surfaces here and would mark every
+            // file parse_failed, after which indexRepo replaces symbols/edges/
+            // components with empty arrays and exits 0 — the whole graph silently
+            // wiped. Rethrow so the scan dies before its first store write, the way
+            // the import-time load did.
+            if (isParserLoadError(error))
+                throw error;
             skipped++;
             issues.push({ path: rel, code: "parse_failed", detail: `${rel} could not be parsed` });
             noteSkip(rel, "parse_failed");
@@ -248,17 +264,18 @@ export function scanRepo(store, root, opts = {}) {
             if (!fromId)
                 continue;
             const scope = chartRoot ?? rel;
-            k8sResourceIndex.push({ symbolId: fromId, scope, kind: doc.resource.kind, nameKey: nameKeyText(doc.resource.name) });
+            const namespace = doc.resource.namespace;
+            k8sResourceIndex.push({ symbolId: fromId, scope, kind: doc.resource.kind, nameKey: nameKeyText(doc.resource.name), namespace });
             for (const ref of doc.references) {
                 k8sReferenceCandidates.push({
-                    fromSymbolId: fromId, scope, refKind: ref.refKind, nameKey: nameKeyText(ref.name),
+                    fromSymbolId: fromId, scope, refKind: ref.refKind, nameKey: nameKeyText(ref.name), namespace: ref.namespace,
                     reason: `${doc.resource.kind}/${displayNameText(doc.resource.name)} references ${ref.refKind}/${displayNameText(ref.name)}`,
                 });
             }
             if (doc.selector)
-                k8sSelectors.push({ symbolId: fromId, scope, selector: doc.selector });
+                k8sSelectors.push({ symbolId: fromId, scope, namespace, selector: doc.selector });
             if (doc.labels)
-                k8sWorkloadLabels.push({ symbolId: fromId, scope, labels: doc.labels });
+                k8sWorkloadLabels.push({ symbolId: fromId, scope, namespace, labels: doc.labels });
         }
         fileSymbols.set(rel, idsInFile);
         fileSymbolIndexId.set(rel, symbolIndexId);
@@ -359,16 +376,24 @@ export function scanRepo(store, root, opts = {}) {
     // only, with no concept of Kubernetes kind -- a ConfigMap and a Secret that
     // happen to share a name would incorrectly conflate. Same ambiguity contract
     // as resolveName() though: 0 matches or 2+ matches -> no edge, never guess.
+    //
+    // Namespace is a FILTER applied to the candidate list, not part of the key
+    // (issue #297): an unknown namespace on either side must still match, which
+    // a key can't express. Filtering before the uniqueness check -- rather than
+    // after picking a single candidate -- is what makes "ref in a, candidates in
+    // a and b" resolve to a instead of declining as ambiguous, while "ref in a,
+    // candidates in a and unknown" correctly stays ambiguous.
     const kindNameIndex = new Map();
     for (const r of k8sResourceIndex) {
         const key = `${r.scope}:${r.kind}:${r.nameKey}`;
-        pushInto(kindNameIndex, key, r.symbolId);
+        pushInto(kindNameIndex, key, r);
     }
     for (const ref of k8sReferenceCandidates) {
-        const candidates = kindNameIndex.get(`${ref.scope}:${ref.refKind}:${ref.nameKey}`) ?? [];
+        const byName = kindNameIndex.get(`${ref.scope}:${ref.refKind}:${ref.nameKey}`) ?? [];
+        const candidates = byName.filter((c) => namespacesCompatible(ref.namespace, c.namespace));
         if (candidates.length !== 1)
             continue; // 0 or 2+ -> ambiguous or absent, don't guess
-        const toId = candidates[0];
+        const toId = candidates[0].symbolId;
         if (toId === ref.fromSymbolId)
             continue;
         addEdge({
@@ -410,6 +435,11 @@ export function scanRepo(store, root, opts = {}) {
                 // ids can never collide today.
                 if (svc.symbolId === wl.symbolId)
                     continue;
+                // A Service only ever selects pods in its OWN namespace -- a
+                // label-identical workload next door is a different workload (issue
+                // #297). Unknown on either side still matches, same rule as Phase 1.
+                if (!namespacesCompatible(svc.namespace, wl.namespace))
+                    continue;
                 const isSubset = Object.entries(svc.selector).every(([k, v]) => wl.labels[k] === v);
                 if (!isSubset)
                     continue;
@@ -560,6 +590,22 @@ export function scanRepo(store, root, opts = {}) {
         issues,
     };
 }
+/** True for an edge this indexer produced: the scan re-derives exactly these on
+ *  every pass, so they — and only they — are safe to replace wholesale. */
+export function isExtractorEdge(edge) {
+    return edge.schema === "hunch.edge/1" && edge.provenance.source === "extracted";
+}
+/** Merge a fresh scan into the stored edge set. A scan can only re-derive what
+ *  it extracted; `supersedes` edges (written by the store) and human-reviewed
+ *  Landscape relationships have no other source, so replacing the whole index
+ *  with the scan deleted them on every `hunch index` (issue #288). Non-extractor
+ *  edges are carried forward in their stored order and win an id collision:
+ *  a reviewed or store-written fact outranks a re-derivable one. */
+export function mergeScannedEdges(stored, scanned) {
+    const carried = stored.filter((edge) => !isExtractorEdge(edge));
+    const carriedIds = new Set(carried.map((edge) => edge.id));
+    return [...carried, ...scanned.filter((edge) => !carriedIds.has(edge.id))];
+}
 /** Persist one pure scan into the Git-native source of truth. */
 export function indexRepo(store, root, opts = {}) {
     if (opts.requireClean) {
@@ -576,7 +622,7 @@ export function indexRepo(store, root, opts = {}) {
     if (opts.requireComplete)
         assertCompleteRepoScan(scan);
     store.json.replaceAll("symbols", scan.symbols);
-    store.json.replaceAll("edges", scan.edges);
+    store.json.replaceAll("edges", mergeScannedEdges(store.json.loadAll("edges"), scan.edges));
     store.json.replaceAll("components", scan.components);
     return scan.result;
 }

package/dist/extractors/k8sManifest.d.ts

@@ -37,11 +37,21 @@ interface K8sReferenceCandidate {
      *  value (data-dependent, not statically known). */
     refKind: string;
     name: ManifestNameRef;
+    /** The namespace this reference resolves IN, or null for "unknown" (see
+     *  literalNamespace). Kubernetes name references are same-namespace by
+     *  definition, so this defaults to the referring DOCUMENT's own namespace;
+     *  the one shape that can legitimately point elsewhere (a Gateway API
+     *  `backendRefs[].namespace` sibling) overrides it. */
+    namespace: string | null;
 }
 type ManifestLabelMap = Record<string, string>;
 interface K8sResourceDoc {
     kind: string;
     name: ManifestNameRef;
+    /** `metadata.namespace` when it is a plain literal, else null = UNKNOWN (see
+     *  literalNamespace). Cluster-scoped kinds need no special case: they simply
+     *  never carry the field, so they are unknown and compatible with anything. */
+    namespace: string | null;
     startChar: number;
     endChar: number;
 }
@@ -51,6 +61,9 @@ export interface K8sManifestDocument {
     selector: ManifestLabelMap | null;
     labels: ManifestLabelMap | null;
 }
+/** Namespace compatibility per the product rule: a MISSING (unknown) namespace
+ *  matches anything; two DIFFERENT literal namespaces block the edge. */
+export declare function namespacesCompatible(a: string | null, b: string | null): boolean;
 /** Where a kind's pod spec lives -- factored once so container/volume field
  *  paths below aren't hand-duplicated per kind. */
 export declare const POD_SPEC_PATH_BY_KIND: Record<string, string>;

package/dist/extractors/k8sManifest.js

@@ -71,6 +71,20 @@ const BARE_TEMPLATE_LINE = /^\s*(?:-\s+)?\{\{[\s\S]*$/;
 // -- reparenting the item's real children one level up (`containers.name`
 // instead of `containers[0].name`), silently dropping every reference under it.
 const BARE_LIST_MARKER = /^(\s*)-[ \t]*\r?$/;
+// A list item whose ENTIRE content is a block-scalar header (`- |`, `- |-`,
+// `- >`, `- |2`, `- | # comment`) -- the idiomatic way a chart inlines a shell
+// script into `args:`/`command:`. The item's value is opaque TEXT, not YAML,
+// yet the body lines look exactly like manifest fields (a heredoc'd
+// `secretKeyRef:` block is the canonical case), and this line matches neither
+// KEY_LINE (no colon) nor BARE_LIST_MARKER (something follows the dash), so it
+// fell to the unrecognized-line branch and the script body was then scanned as
+// the surrounding container's children -- inventing a reference to a resource
+// that only ever existed as text. The `key: |` form needs no such handling:
+// its body nests under the key's OWN frame, where no reference field-path can
+// match. The rest is captured (not `[|>]` inline) so the header can be run
+// through stripTrailingComment before BLOCK_SCALAR_HEADER, exactly as a
+// key line's value is.
+const BLOCK_SCALAR_LIST_ITEM = /^(\s*)-[ \t]+(.*?)\r?$/;
 // A YAML block-scalar header (`|`, `>`, plus an optional chomping indicator
 // `+`/`-` and/or an explicit indent digit, in either order: `|`, `|-`, `>+`,
 // `|2`, `|2-`, `|-2`). When a key's value is JUST this header, the real
@@ -138,8 +152,21 @@ function scanFieldPaths(text, baseChar) {
     // avoid. Silently ignoring what the scanner can't parse is not safe here;
     // "I can't tell" must read as "unresolved," the same as a real template.
     const unresolvedContainers = new Set();
+    // The framePath of every container that DIRECTLY holds a key written with no
+    // value at all (`tier:`). Deliberately its own set rather than more entries
+    // in unresolvedContainers: an ordinary container like `spec:` legitimately
+    // holds value-less keys (every nested mapping starts with one), so folding
+    // these in would destroy that set's meaning -- "the scanner could not
+    // account for this line". Only a map that is supposed to be FLAT
+    // (selector/labels) cares, and it checks this set itself.
+    const valuelessKeyParents = new Set();
     const stack = [];
     let charOffset = baseChar;
+    // Indent of the `-` of a `- |` list item whose block-scalar body is being
+    // skipped, or null when no such skip is active. The body ends at the first
+    // line indented at or shallower than that dash (YAML's own rule for where a
+    // sequence item's content stops).
+    let blockScalarSkipIndent = null;
     const popToForListItem = (dashIndent) => {
         while (stack.length) {
             const top = stack[stack.length - 1];
@@ -205,6 +232,31 @@ function scanFieldPaths(text, baseChar) {
     for (const line of text.split("\n")) {
         const lineStartChar = charOffset;
         charOffset += line.length + 1; // +1 for the \n split() consumed
+        // Inside a `- |` item's body: these lines are script/config TEXT, so they
+        // must never be read as field structure. Runs after the charOffset
+        // bookkeeping above so skipped lines still advance the offset exactly --
+        // every atChar/endChar after the block scalar depends on it.
+        if (blockScalarSkipIndent !== null) {
+            // A blank line is part of the block scalar (YAML lets a scalar body
+            // contain empty lines at any indent), never its terminator.
+            if (line.trim().length === 0)
+                continue;
+            if (BARE_TEMPLATE_LINE.test(line)) {
+                // A `{{ }}` action line's own indentation carries no structural
+                // meaning (`{{-` chomps it; the `| indent N` idiom puts the action at
+                // column 0 -- see markAllOpenContainersUnresolved), so a column-0
+                // action inside a script body must NOT be read as a dedent that ends
+                // the skip and re-exposes the remaining body lines as fields. Taint
+                // conservatively and stay in the skip: we cannot tell whether the
+                // action sits inside the scalar or after it.
+                markAllOpenContainersUnresolved();
+                continue;
+            }
+            const indent = line.length - line.trimStart().length;
+            if (indent > blockScalarSkipIndent)
+                continue; // still the scalar's body
+            blockScalarSkipIndent = null; // dedented out of the item -- real YAML again
+        }
         if (BARE_TEMPLATE_LINE.test(line)) {
             markAllOpenContainersUnresolved();
             continue;
@@ -215,6 +267,18 @@ function scanFieldPaths(text, baseChar) {
             enterListItem(dashIndent, dashIndent + 1);
             continue;
         }
+        // Checked BEFORE the KEY_LINE match: KEY_LINE can't match this shape
+        // anyway (no colon), but without this branch it would land in the
+        // unrecognized-line branch below and the body would be scanned as fields.
+        const blockScalarItem = BLOCK_SCALAR_LIST_ITEM.exec(line);
+        if (blockScalarItem && BLOCK_SCALAR_HEADER.test(stripTrailingComment(blockScalarItem[2]).trim())) {
+            const dashIndent = blockScalarItem[1].length;
+            // It IS a real sequence item, so enter it exactly as the bare-marker
+            // form does -- sibling items after this one must keep their indices.
+            enterListItem(dashIndent, dashIndent + 1);
+            blockScalarSkipIndent = dashIndent;
+            continue;
+        }
         const m = KEY_LINE.exec(line);
         if (!m) {
             // Any other non-blank, non-comment line is a shape this scanner can't
@@ -268,6 +332,18 @@ function scanFieldPaths(text, baseChar) {
             unresolvedContainers.add(parentPath);
             continue;
         }
+        // A key written with NO value (`tier:`) creates a frame but never an
+        // entry, so it is invisible to extractLiteralLabelMap -- which then
+        // returns the map MINUS that key. For a flat string->string map
+        // (selector/labels) a value-less direct child is either a null value or a
+        // nested container; either way the key is silently absent, and a selector
+        // short one key matches strictly MORE workloads than the real one -- the
+        // same over-permissive failure as every other unresolved case here.
+        // Recorded after the block-scalar branch above, which already taints the
+        // parent for its own reason. Note `tier: ""` is NOT value-less: quotes
+        // survive stripTrailingComment/trim, so it stays a literal empty string.
+        if (value.length === 0)
+            valuelessKeyParents.add(parentPath);
         if (value.length > 0) {
             const colonIdx = line.indexOf(":", dashIndent);
             const valueStartInLine = line.indexOf(value, colonIdx);
@@ -309,11 +385,80 @@ function scanFieldPaths(text, baseChar) {
         // line, since that line's own popToForListItem/popOrdinary call pops
         // back to (but never past) this key's frame.
     }
-    return { entries, unresolvedContainers };
+    return { entries, unresolvedContainers, valuelessKeyParents };
 }
 function findEntry(entries, path) {
     return entries.find((e) => e.path === path);
 }
+/** The RFC 1123 DNS label a real Kubernetes namespace name must be -- the
+ *  positive test literalNamespace applies (see there for why). */
+const DNS_LABEL = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/;
+/** A namespace a reference can be MATCHED on, or null meaning UNKNOWN.
+ *  Deliberately narrower than the ManifestNameRef literal/template split that
+ *  names get: a name is a resolution KEY (a template's raw text matches
+ *  another identical template's raw text, which is real evidence), whereas a
+ *  namespace here is only ever a FILTER, and the product rule is that unknown
+ *  matches anything. So a templated `namespace: {{ .Release.Namespace }}` is
+ *  unknown rather than a `T:`-keyed literal -- two documents whose namespace
+ *  renders identically must not be blocked from linking just because one
+ *  spells it via a template and the other spells it out, and two DIFFERENT
+ *  template expressions are not evidence of different namespaces either.
+ *  Absent (no entry at all) and an explicit empty string are unknown for the
+ *  same reason: neither names a namespace this scanner can compare.
+ *
+ *  The literal-ness test is therefore POSITIVE, not a list of excluded
+ *  spellings: a value counts only when it already looks like the RFC 1123 DNS
+ *  label a real namespace must be. One test then covers every shape the
+ *  scanner cannot resolve, without a special case per spelling -- the scanner
+ *  only tags a value "template" when the template action starts the value, so
+ *  `namespace: app-{{ .Values.env }}` arrives here as a "literal" and would
+ *  otherwise block edges against the very namespace it renders to; likewise
+ *  YAML null spellings (`~`, `Null`), anchors and tags (`&ns prod`,
+ *  `!!str prod`), uppercase, whitespace and empty. Blocking is the damaging
+ *  direction (unknown never blocks an edge), so anything uncomparable is
+ *  unknown.
+ *
+ *  `null` is the one spelling the regex admits but must still be rejected,
+ *  since it is also the bare YAML null word. It is excluded explicitly rather
+ *  than by inspecting quotes: stripQuotes runs in the scanner, so a genuinely
+ *  quoted `namespace: "null"` is indistinguishable here -- and reading it as
+ *  unknown errs in the conservative direction. */
+function literalNamespace(entry) {
+    if (!entry || entry.value.form !== "literal")
+        return null;
+    const value = entry.value.value;
+    if (value === "null" || !DNS_LABEL.test(value))
+        return null;
+    return value;
+}
+/** The namespace named at `path`, reading EVERY entry there rather than the
+ *  first. A Helm `{{- if }} namespace: prod {{- else }} namespace: staging
+ *  {{- end }}` emits both branches as entries on the same path, and taking
+ *  findEntry's first one would read the document as confidently `prod` and
+ *  block every edge to `staging`. Only an unambiguous agreement -- at least
+ *  one entry, all of them the same literal -- is a namespace this scanner can
+ *  compare; disagreement is unknown, like any other unresolved shape. */
+function namespaceAt(entries, path) {
+    let agreed = null;
+    let seen = false;
+    for (const e of entries) {
+        if (e.path !== path)
+            continue;
+        const ns = literalNamespace(e);
+        if (ns === null)
+            return null;
+        if (seen && ns !== agreed)
+            return null;
+        agreed = ns;
+        seen = true;
+    }
+    return agreed;
+}
+/** Namespace compatibility per the product rule: a MISSING (unknown) namespace
+ *  matches anything; two DIFFERENT literal namespaces block the edge. */
+export function namespacesCompatible(a, b) {
+    return a === null || b === null || a === b;
+}
 /** Where a kind's pod spec lives -- factored once so container/volume field
  *  paths below aren't hand-duplicated per kind. */
 export const POD_SPEC_PATH_BY_KIND = {
@@ -372,14 +517,32 @@ function fieldSpecsForKind(kind) {
         specs.push({ path: "spec.rules[].backendRefs[].name", refKind: "Service" });
     return specs;
 }
-function extractFieldReferences(kind, entries) {
+/** The ONE reference shape in fieldSpecsForKind that Kubernetes lets point at
+ *  another namespace: a Gateway API `backendRefs[]` entry carries an optional
+ *  `namespace` SIBLING of its own `name`. Every other shape here
+ *  (configMapRef/secretRef/volumes/imagePullSecrets/Ingress backend/
+ *  ownerReferences) is same-namespace by API definition and has no namespace
+ *  field at all, so none of them needs an override. Read off the concrete
+ *  (non-wildcarded) entry list by exact parentPath -- the same
+ *  pair-siblings-by-index technique extractOwnerReferenceCandidates uses --
+ *  rather than new parsing machinery. */
+const NAMESPACE_SIBLING_PATHS = new Set(["spec.rules[].backendRefs[]"]);
+function extractFieldReferences(kind, entries, docNamespace) {
     const specs = fieldSpecsForKind(kind);
     const out = [];
     for (const e of entries) {
         const wp = wildcardPath(e.path);
         const spec = specs.find((s) => s.path === wp);
-        if (spec)
-            out.push({ refKind: spec.refKind, name: e.value });
+        if (!spec)
+            continue;
+        // A sibling that EXISTS but isn't a comparable literal (templated, empty)
+        // must read as unknown, NOT fall back to the document's namespace: it is
+        // an explicit statement that the target lives somewhere this scanner
+        // cannot name, which is the opposite of "same namespace as me". So the
+        // sibling's existence is checked before its literal-ness.
+        const siblingPath = `${e.parentPath}.namespace`;
+        const hasSibling = NAMESPACE_SIBLING_PATHS.has(wildcardPath(e.parentPath)) && entries.some((c) => c.path === siblingPath);
+        out.push({ refKind: spec.refKind, name: e.value, namespace: hasSibling ? namespaceAt(entries, siblingPath) : docNamespace });
     }
     return out;
 }
@@ -389,7 +552,7 @@ function extractFieldReferences(kind, entries) {
  *  entries never get cross-paired. Not expressible via FieldPathSpec's
  *  single-fixed-refKind model, so it's a dedicated pass over the concrete
  *  (non-wildcarded) entries. */
-function extractOwnerReferenceCandidates(entries) {
+function extractOwnerReferenceCandidates(entries, docNamespace) {
     const byIndex = new Map();
     for (const e of entries) {
         const m = /^metadata\.ownerReferences(\[\d+\])\.(name|kind)$/.exec(e.path);
@@ -403,7 +566,10 @@ function extractOwnerReferenceCandidates(entries) {
     for (const { name, kind } of byIndex.values()) {
         if (!name || !kind || kind.value.form !== "literal")
             continue; // an owner's kind must be a literal to type the reference at all
-        out.push({ refKind: kind.value.value, name: name.value });
+        // An ownerReferences entry has NO namespace field in the API at all -- an
+        // owner is always in the owned object's own namespace (or cluster-scoped),
+        // so the document's namespace is the only correct answer here.
+        out.push({ refKind: kind.value.value, name: name.value, namespace: docNamespace });
     }
     return out;
 }
@@ -422,9 +588,14 @@ export const LABELS_PATH_BY_KIND = {
  *  exists, or any direct-child leaf is itself templated -- a partially-literal
  *  map is still unusable for subset-match without evaluating the templated
  *  half, so the whole map is treated as unresolved. */
-function extractLiteralLabelMap(prefix, entries, unresolvedContainers) {
+function extractLiteralLabelMap(prefix, entries, unresolvedContainers, valuelessKeyParents) {
     if (unresolvedContainers.has(prefix))
         return null;
+    // A value-less direct child (`tier:`) never produced an entry at all, so the
+    // map below would come back without it -- see valuelessKeyParents' comment
+    // in scanFieldPaths for why a short map is the dangerous direction.
+    if (valuelessKeyParents.has(prefix))
+        return null;
     // A real Kubernetes label/selector map is always flat (string -> string) --
     // any entry whose parentPath is a DEEPER descendant of prefix (not prefix
     // itself) means some direct child of prefix was itself a nested container
@@ -464,30 +635,43 @@ function extractLiteralLabelMap(prefix, entries, unresolvedContainers) {
     }
     return pairs.length > 0 ? Object.fromEntries(pairs) : null;
 }
-function buildDocument(text, docStartChar, entries, unresolvedContainers) {
+function buildDocument(text, docStartChar, entries, unresolvedContainers, valuelessKeyParents) {
     const kindEntry = findEntry(entries, "kind");
     const kind = kindEntry?.value.form === "literal" ? kindEntry.value.value : null;
     if (!kind || !ALLOWED_KINDS.has(kind))
         return { resource: null, references: [], selector: null, labels: null };
+    // Found with the same entry machinery as metadata.name, so it inherits the
+    // scanner's quote-stripping, comment-stripping and CRLF tolerance for free.
+    // Read OUTSIDE the `resource` branch below: a document with no
+    // metadata.name still emits references, and those references carry this
+    // document's namespace.
+    const namespace = namespaceAt(entries, "metadata.namespace");
     const nameEntry = findEntry(entries, "metadata.name");
     const resource = nameEntry
-        ? { kind, name: nameEntry.value, startChar: docStartChar, endChar: docStartChar + text.length }
+        ? { kind, name: nameEntry.value, namespace, startChar: docStartChar, endChar: docStartChar + text.length }
         : null;
-    const references = [...extractFieldReferences(kind, entries), ...extractOwnerReferenceCandidates(entries)];
-    const selector = kind === "Service" ? extractLiteralLabelMap("spec.selector", entries, unresolvedContainers) : null;
+    const references = [...extractFieldReferences(kind, entries, namespace), ...extractOwnerReferenceCandidates(entries, namespace)];
+    const selector = kind === "Service" ? extractLiteralLabelMap("spec.selector", entries, unresolvedContainers, valuelessKeyParents) : null;
     const labelsPath = LABELS_PATH_BY_KIND[kind];
-    const labels = labelsPath ? extractLiteralLabelMap(labelsPath, entries, unresolvedContainers) : null;
+    const labels = labelsPath ? extractLiteralLabelMap(labelsPath, entries, unresolvedContainers, valuelessKeyParents) : null;
     return { resource, references, selector, labels };
 }
-// Matches a YAML document-start marker (`---`, optionally with a trailing
-// comment -- `--- # second doc` is legal YAML) or a document-end marker
-// (`...`). Without the trailing-comment allowance, a commented separator
-// silently failed to split at all, merging two documents into one -- the
-// later document's fields overwrite the earlier one's (object spread order),
-// and the earlier resource's symbol/edges vanish entirely. `----` (four or
-// more dashes) is deliberately NOT a separator -- real YAML doesn't treat it
-// as one either.
-const DOC_SEPARATOR = /^(?:---(?:[ \t]+#.*)?|\.\.\.)[ \t]*\r?$/m;
+// Matches a YAML document-start marker (`---`) or a document-end marker
+// (`...`). Per the YAML spec `---` FOLLOWED BY WHITESPACE starts a document
+// whatever trails it on that line -- a comment (`--- # second doc`), a tag
+// (`--- !!map`), an anchor (`--- &base`) -- so the trailing text is matched
+// generically rather than as a comment only. Without that, a tagged or
+// anchored separator silently failed to split at all, merging two documents
+// into one: the later document's fields overwrite the earlier one's (object
+// spread order), and the earlier resource's symbol/edges vanish entirely.
+// Whatever trails the marker is consumed WITH the boundary -- for a tag or
+// anchor nothing is lost, and inline content written after the marker
+// (`--- kind: Pod`, legal but vanishingly rare) is dropped, which errs toward
+// fewer edges, this module's standing bias. `----` (four or more dashes) is
+// deliberately NOT a separator -- real YAML doesn't treat it as one either,
+// and it still isn't here: the dashes must be followed by whitespace or end
+// of line.
+const DOC_SEPARATOR = /^(?:---(?:[ \t]+.*)?|\.\.\.)[ \t]*\r?$/m;
 export function extractK8sManifest(source) {
     const docs = [];
     const boundaries = [];
@@ -499,8 +683,8 @@ export function extractK8sManifest(source) {
         const start = starts[i];
         const end = ends[i];
         const text = source.slice(start, end);
-        const { entries, unresolvedContainers } = scanFieldPaths(text, start);
-        docs.push(buildDocument(text, start, entries, unresolvedContainers));
+        const { entries, unresolvedContainers, valuelessKeyParents } = scanFieldPaths(text, start);
+        docs.push(buildDocument(text, start, entries, unresolvedContainers, valuelessKeyParents));
     }
     return docs;
 }

package/dist/extractors/landscapeDiscovery.js

@@ -6,6 +6,7 @@ import { compareCodeUnits } from "../core/canonicalOrder.js";
 import { resourceId, resourceRelationshipId } from "../core/ids.js";
 import { parseJsonc } from "../core/jsonc.js";
 import { parseSource } from "./parse.js";
+import { isParserLoadError } from "./nativeTreeSitter.js";
 import { EdgeSchema, ResourceSchema, isCredentialFreeText, } from "../core/types.js";
 import { canonicalRemoteRepositoryIdentity, foreignRepoEnv, gitNullDevice, } from "./git.js";
 export const LANDSCAPE_DISCOVERY_SCHEMA_VERSION = "hunch.landscape-discovery/1";
@@ -2026,7 +2027,14 @@ function sloDeclarations(root, tree, issues) {
         try {
             valid = blob.format === "json" ? validJsonOpenSlo(source) : validYamlOpenSlo(blob.path, source);
         }
-        catch {
+        catch (error) {
+            // A malformed declaration is a bad file and stays one issue. A dead
+            // native parser is not: swallowing it made `landscape review` report
+            // every valid SLO as slo_declaration_invalid, drop the resource, and
+            // still exit 0 with a ready-made `landscape adopt --acknowledge-issues`
+            // line — a store write of a false verdict.
+            if (isParserLoadError(error))
+                throw error;
             valid = false;
         }
         if (!valid) {

package/dist/extractors/nativeTreeSitter.d.ts

@@ -8,6 +8,30 @@ export interface NativeTreeSitterRuntime {
     php: unknown;
     yaml: unknown;
 }
+/** The parser runtime itself is unavailable — the addons could not be copied or
+ *  dlopen'd (unwritable/full TMPDIR, a missing or wrong-arch prebuild, npm
+ *  replacing the package mid-session, or the fail-closed "preloaded addon"
+ *  guard). Distinct from a per-file parse error on purpose: now that the load
+ *  happens on first parse rather than at import, every swallow-and-continue
+ *  catch on a parse path would otherwise read this as "this one file is bad"
+ *  and, in a whole-repo scan, mark EVERY file parse_failed and overwrite the
+ *  graph with nothing. Callers rethrow it so the run dies before any write,
+ *  the way the import-time load used to. The original error is kept as `cause`
+ *  and its text is carried in the message so the EACCES/dlopen detail a user
+ *  needs is never lost. */
+export declare class NativeTreeSitterLoadError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** The ONE predicate every rethrow site uses — a dead parser is recognised the
+ *  same way everywhere, so no catch can quietly disagree about what counts.
+ *  `instanceof` alone is not enough: a duplicated module instance (two copies of
+ *  this file in one process, e.g. dist/ + src/ under tsx, or a worker that
+ *  re-resolves it) gives a different class identity, and an error rebuilt across
+ *  a worker/IPC boundary keeps only its plain properties. The name check
+ *  survives both. */
+export declare function isParserLoadError(e: unknown): boolean;
 /** Load all native tree-sitter addons (the parser runtime + every grammar) from
  * process-owned temp copies. Windows keeps loaded `.node` files locked for the
  * process lifetime; redirecting the upstream loaders means npm can replace the

package/dist/extractors/nativeTreeSitter.js

@@ -13,6 +13,40 @@ const NATIVE_PACKAGES = [
     "@tree-sitter-grammars/tree-sitter-yaml",
 ];
 let runtime = null;
+/** The parser runtime itself is unavailable — the addons could not be copied or
+ *  dlopen'd (unwritable/full TMPDIR, a missing or wrong-arch prebuild, npm
+ *  replacing the package mid-session, or the fail-closed "preloaded addon"
+ *  guard). Distinct from a per-file parse error on purpose: now that the load
+ *  happens on first parse rather than at import, every swallow-and-continue
+ *  catch on a parse path would otherwise read this as "this one file is bad"
+ *  and, in a whole-repo scan, mark EVERY file parse_failed and overwrite the
+ *  graph with nothing. Callers rethrow it so the run dies before any write,
+ *  the way the import-time load used to. The original error is kept as `cause`
+ *  and its text is carried in the message so the EACCES/dlopen detail a user
+ *  needs is never lost. */
+export class NativeTreeSitterLoadError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "NativeTreeSitterLoadError";
+    }
+}
+/** The ONE predicate every rethrow site uses — a dead parser is recognised the
+ *  same way everywhere, so no catch can quietly disagree about what counts.
+ *  `instanceof` alone is not enough: a duplicated module instance (two copies of
+ *  this file in one process, e.g. dist/ + src/ under tsx, or a worker that
+ *  re-resolves it) gives a different class identity, and an error rebuilt across
+ *  a worker/IPC boundary keeps only its plain properties. The name check
+ *  survives both. */
+export function isParserLoadError(e) {
+    return e instanceof NativeTreeSitterLoadError || e?.name === "NativeTreeSitterLoadError";
+}
+/** Wrap any loader failure once, preserving an already-typed one. */
+function loadFailure(error) {
+    if (error instanceof NativeTreeSitterLoadError)
+        return error;
+    const detail = error instanceof Error ? error.message : String(error);
+    return new NativeTreeSitterLoadError(`native tree-sitter parser unavailable: ${detail}`, { cause: error });
+}
 function processIsAlive(pid) {
     if (pid === process.pid)
         return true;
@@ -71,6 +105,19 @@ function copyNativeBinding(packageName, copyRoot, nodeGypBuild) {
 export function loadNativeTreeSitter() {
     if (runtime)
         return runtime;
+    // Only SUCCESS is memoized (in `runtime`), never the failure: the conditions
+    // that break the load are transient — a full or read-only TMPDIR, an npm
+    // install swapping the package out from under a live process. A long-lived
+    // MCP server must be able to parse again once the condition clears, so every
+    // call retries the load from scratch.
+    try {
+        return loadRuntime();
+    }
+    catch (error) {
+        throw loadFailure(error);
+    }
+}
+function loadRuntime() {
     // Three binding spellings: prebuilds ship as tree-sitter[-typescript|-python].node
     // or, for a scoped package like @tree-sitter-grammars/tree-sitter-yaml, as
     // @scope+name.node; from-source builds are named after the binding.gyp target
@@ -85,9 +132,15 @@ export function loadNativeTreeSitter() {
     }
     removeStaleCopies();
     const copyRoot = mkdtempSync(join(tmpdir(), `${COPY_PREFIX}${process.pid}-`));
-    const nodeGypBuild = runtimeRequire("node-gyp-build");
     const previous = new Map();
     try {
+        // Resolved INSIDE the try: if node-gyp-build cannot be resolved (a partial
+        // install, npm mid-swap) the catch below still removes the copy dir we just
+        // created. Outside it, every retry — and failure is deliberately not
+        // memoized, so a long-lived MCP server retries forever — leaked one empty
+        // hunch-tree-sitter-<pid>-* dir that removeStaleCopies can never prune,
+        // because it only prunes dirs whose pid is dead.
+        const nodeGypBuild = runtimeRequire("node-gyp-build");
         for (const packageName of NATIVE_PACKAGES) {
             const key = environmentKey(packageName);
             previous.set(key, process.env[key]);