@davesheffer/hunch 1.45.2 → 1.47.0

package/dist/extractors/diff.js

@@ -20,25 +20,21 @@ const DECL_PATTERNS = [
     { kind: "type", re: /^\s*(?:export\s+)?type\s+([A-Za-z_$][\w$]*)\s*[=<]/ },
     { kind: "const", re: /^\s*(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>/ },
     { kind: "const", re: /^\s*(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?function/ },
+    // No Python class pattern: the generic class pattern above already matches a
+    // Python class header, and the first match wins.
     { kind: "function", re: /^\s*(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/ },
-    // No Python-specific class pattern needed: the generic TS `class` pattern above has no
-    // trailing-syntax requirement (no `{`/`:`), so it already matches Python's
-    // `class Foo(Bar):` header too, and — since declOf() returns on the first match —
-    // always wins for Python class lines before any Python-specific pattern would run.
 ];
 import { languageFor, isSubstantive } from "./languages.js";
 const IMPORT_RE = /^\s*import\s+(?:[^'"]*from\s+)?['"]([^'"]+)['"]/;
 const CONT_IMPORT_RE = /^\s*\}?\s*from\s+['"]([^'"]+)['"]/; // multi-line: "} from 'x'"
 const REQUIRE_RE = /\brequire\(\s*['"]([^'"]+)['"]\s*\)/;
 const PHP_REQUIRE_RE = /\b(?:require|require_once|include|include_once)\s*(?:\(\s*)?['"]([^'"]+)['"]/;
-// "import os" / "import a.b.c" / "import os as o" / "import os, sys" / trailing "# comment".
-// Anchored to the END of the line (optional "as alias", comma-separated modules, comment)
-// so it matches a COMPLETE Python import statement only — this deliberately rejects
-// TypeScript's `import Foo = Bar.Baz;` (import-equals), which would otherwise falsely
-// look like a Python "import Foo" prefix match.
-const PY_IMPORT_RE = /^\s*import\s+([A-Za-z_][\w.]*)(?:\s+as\s+\w+)?(?:\s*,\s*[A-Za-z_][\w.]*(?:\s+as\s+\w+)?)*\s*(?:#.*)?$/;
-const PY_FROM_IMPORT_RE = /^\s*from\s+([.\w]+)\s+import\s+/; // "from os import path" / "from . import x"
-const isCode = (p) => !!p && languageFor(p) !== null;
+// A COMPLETE Python import statement: comma-separated dotted modules, each with an
+// optional alias, an optional trailing comment, and nothing else. The anchoring is
+// what rejects TypeScript's `import Foo = Bar.Baz;`.
+const PY_IMPORT_RE = /^\s*import\s+([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)(?:\s+as\s+\w+)?(?:\s*,\s*[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*(?:\s+as\s+\w+)?)*\s*(?:#.*)?$/;
+const PY_FROM_RE = /^\s*from\s+(\.*[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*|\.+)\s+import\b/;
+const isCode = (p) => p.length > 0 && languageFor(p) !== null;
 function declOf(line) {
     for (const { kind, re } of DECL_PATTERNS) {
         const m = re.exec(line);
@@ -52,7 +48,7 @@ function importOf(line) {
         CONT_IMPORT_RE.exec(line) ??
         REQUIRE_RE.exec(line) ??
         PHP_REQUIRE_RE.exec(line) ??
-        PY_FROM_IMPORT_RE.exec(line) ??
+        PY_FROM_RE.exec(line) ??
         PY_IMPORT_RE.exec(line);
     return m ? m[1] : null;
 }
@@ -280,15 +276,15 @@ export function analyzeDiff(diff) {
         // ---- inside a hunk: content lines ----
         if (raw.startsWith("+")) {
             const body = raw.slice(1);
-            // Raw added lines are captured for EVERY file, before the substantive gate:
+            // Raw added lines are captured for every file, before the substantive gate:
             // content-matched constraints and Veto tripwires are not code-only rules
             // (a blocking invariant legitimately scopes .github/workflows/**, *.sql,
             // Dockerfile). Skipping them here left `scopedAdded` empty, which
             // buildCheckReport reads as "cannot prove a violation ⇒ complies" — so the
             // pre-edit hook denied the edit while `hunch check --strict` passed the
-            // very commit that landed it. The churn counters below now also include
-            // prose (isSubstantive, issue #12); symbol/import extraction stays
-            // code-only (isCode/languageFor) since declarations are a code concept.
+            // same diff. Churn counters below now include prose (isSubstantive, issue
+            // #12), while symbol/import extraction stays code-only (isCode): a
+            // declaration is a code concept.
             let lines = addedLinesBy.get(curFile);
             if (!lines) {
                 lines = [];
@@ -301,12 +297,12 @@ export function analyzeDiff(diff) {
             if (!curAdded && !curDeleted)
                 filesModified.add(curFile);
             if (isCode(curFile)) {
-                const d = declOf(body);
-                if (d)
-                    declsFor(curFile)?.added.set(d.name, d);
-                const imp = importOf(body);
-                if (imp && !imp.startsWith("."))
-                    addedImports.add(imp);
+                const decl = declOf(body);
+                if (decl)
+                    declsFor(curFile).added.set(decl.name, decl);
+                const spec = importOf(body);
+                if (spec && !spec.startsWith("."))
+                    addedImports.add(spec);
             }
         }
         else if (raw.startsWith("-")) {
@@ -317,12 +313,12 @@ export function analyzeDiff(diff) {
                 filesModified.add(curFile);
             if (isCode(curFile)) {
                 const body = raw.slice(1);
-                const d = declOf(body);
-                if (d)
-                    declsFor(curFile)?.removed.set(d.name, d);
-                const imp = importOf(body);
-                if (imp && !imp.startsWith("."))
-                    removedImports.add(imp);
+                const decl = declOf(body);
+                if (decl)
+                    declsFor(curFile).removed.set(decl.name, decl);
+                const spec = importOf(body);
+                if (spec && !spec.startsWith("."))
+                    removedImports.add(spec);
             }
         }
     }

package/dist/extractors/git.d.ts

@@ -307,32 +307,17 @@ export interface CommitCandidate {
     sha: string;
     files: string[];
 }
-/** Every commit newly reachable in `oldRef..newRef` (capped to the most
- *  recent `maxCount`), with the files each one changed (rename-aware, via
- *  commitChanges). Used to find the commit a squash-merge produced from a
- *  set of now-orphaned source-branch commits. */
+/** Commits in `oldRef..newRef` (most recent `maxCount`, oldest first), each with the
+ *  non-deleted paths it touched. Squash-merge provenance repair reads this. A git
+ *  failure yields []. */
 export declare function mergeRangeChanges(oldRef: string, newRef: string, cwd: string, maxCount?: number): CommitCandidate[];
-/** Batched existence check for many commit shas at once — one `git cat-file
- *  --batch-check` process instead of one `rev-parse --verify` per sha. Used
- *  by drift.ts's default commitResolvable so hunch drift/heal/doctor spawn a
- *  single git process regardless of how many decisions carry a commit, not
- *  one per decision. Returns the subset of `shas` that resolve to a real
- *  commit object, or `null` if the check itself failed to run (not a git
- *  repo, git missing, timeout) — distinct from an empty set, which means
- *  "checked, and none of them resolve." A caller that collapsed those two
- *  would flag every commit as unresolvable on a transient environment error
- *  instead of failing open. */
+/** Which of `shas` resolve to a commit, via one `git cat-file --batch-check`.
+ *  Malformed values are dropped before the stdin lines are built (positional mapping).
+ *  Returns null when git itself could not run: callers fail open. */
 export declare function commitsExist(shas: readonly string[], cwd: string): Set<string> | null;
 export type CommitRepairStatus = "orphaned" | "current" | "unresolvable" | "unknown";
-/** Classifies `commit` relative to `ref` for squash-merge repair eligibility.
- *  "orphaned" (exists in this repo, but is not an ancestor of `ref`) is the
- *  ONLY status planCommitRepair should ever act on. "unresolvable" (the
- *  commit doesn't exist here at all) is explicitly out of repair scope —
- *  drift.ts's commit-unresolvable kind is what flags that case, because
- *  there's no reliable signal left to match a replacement against. "unknown"
- *  (the git command itself failed to run — timeout, git missing) must never
- *  be treated as repair-eligible; collapsing "false" and "error" into one
- *  boolean is exactly the bug this type exists to prevent. */
+/** Whether `commit` is reachable from `ref`. Never collapses "no" and "error": only
+ *  "orphaned" is repair-eligible. A missing or non-directory cwd is "unresolvable". */
 export declare function commitRepairStatus(commit: string, ref: string, cwd: string): CommitRepairStatus;
 /** commitRepairStatus against several tips: "orphaned" only when NO ref
  *  reaches the commit. A historical `--range old..new` must not make a commit

package/dist/extractors/git.js

@@ -7,6 +7,7 @@ import { isAbsolute, resolve, join, basename, dirname, relative, sep, posix } fr
 import { mkdtempSync, openSync, closeSync, readSync, mkdirSync, rmSync, statSync, lstatSync, realpathSync, readFileSync, renameSync, readdirSync, existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { MEMLOG_FORMAT } from "../core/memorylog.js";
+import { boundedExecFileSync } from "../core/boundedSpawn.js";
 import { writeFileAtomic } from "../core/io.js";
 import { hunchAttributesAreSafe, hunchTreeAttributesAreSafe, safeOverlayTree } from "../core/overlaySafety.js";
 import { createRepoFileReader } from "../core/safeRepoFile.js";
@@ -580,6 +581,8 @@ function observeGit(observer, event) {
     catch { /* observation cannot change a Git outcome */ }
 }
 const CAPTURE_REMOTE_TIMEOUT_MS = 15_000;
+/** A user's whole branch can be large, so `hunch push` gets far longer than a memory capture push. */
+const BRANCH_PUSH_TIMEOUT_MS = 300_000;
 export const DEFAULT_READ_REMOTE_TIMEOUT_MS = 5_000;
 // A capture can spend roughly 90s in commit + bounded merge/push/retry seams.
 // A contending writer waits beyond that proven ceiling, then takes the lock and
@@ -858,9 +861,6 @@ export function headFileContent(root, rel) {
             encoding: "utf8",
             env: foreignRepoEnv(process.env),
             maxBuffer: 16 * 1024 * 1024,
-            // An untracked/absent-at-HEAD path is an expected, silently-handled case
-            // (falls through to the catch below) — don't let git's "fatal: path ...
-            // does not exist in 'HEAD'" leak onto the caller's stderr for it.
             stdio: ["ignore", "pipe", "ignore"],
         });
     }
@@ -937,10 +937,7 @@ function isDerivedStoreArtifact(relativeName) {
         // staged alongside the record; treating it as a violation made every served write skip
         // the commit quietly and report durability "local" forever (1.26.0/1.26.1).
         || relativeName === "write.lock"
-        // The post-merge hook's detected-but-unconfirmed repair queue and its
-        // rejected-match tombstones (repairqueue.ts): clone-local scratch, never a
-        // memory record — must never ride a public flush's `git add .` or an
-        // overlay's force-add allowlist into shared/pushed memory.
+        // Clone-local scratch that must never ride a public flush or an overlay force-add into shared memory.
         || relativeName === "pending-commit-repairs.json"
         || relativeName === "dropped-commit-repairs.json";
 }
@@ -1193,16 +1190,13 @@ function contractRemoteHeads(hunchDir, contract, direction, env, timeoutMs) {
     if (!hooksDir)
         return null;
     try {
-        const out = execFileSync("git", [
+        // Network git runs under boundedExecFileSync: execFileSync's timeout kills only
+        // the root, orphaning git-remote-https.exe on Windows (issue #498).
+        const out = boundedExecFileSync("git", [
             "-C", hunchDir,
             "-c", `core.hooksPath=${hooksDir}`,
             "ls-remote", "--refs", "--heads", "--upload-pack=git-upload-pack", url,
-        ], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "pipe"],
-            env: boundedTeamEnv(env),
-            timeout: timeoutMs,
-        });
+        ], { env: boundedTeamEnv(env), timeout: timeoutMs });
         if (!contractReady(contract))
             return null;
         const heads = [];
@@ -1226,12 +1220,12 @@ function fetchContractRef(hunchDir, contract, env, timeoutMs) {
     if (!hooksDir)
         return "";
     try {
-        execFileSync("git", [
+        boundedExecFileSync("git", [
             "-C", hunchDir,
             "-c", `core.hooksPath=${hooksDir}`,
             "fetch", "--no-tags", "--no-write-fetch-head", "--upload-pack=git-upload-pack",
             contract.fetchUrl, `+${contract.ref}:${TEAM_FETCH_REF}`,
-        ], { stdio: ["ignore", "ignore", "pipe"], env: boundedTeamEnv(env), timeout: timeoutMs });
+        ], { stdout: "ignore", env: boundedTeamEnv(env), timeout: timeoutMs });
         if (!contractReady(contract))
             return "";
         const oid = execFileSync("git", ["-C", hunchDir, "rev-parse", "--verify", TEAM_FETCH_REF], {
@@ -1391,17 +1385,21 @@ function mergeRemote(hunchDir, env, timeoutMs, contract, allowUnrelatedHistories
     const tryGit = (args, timeout = timeoutMs) => {
         const startedAt = Date.now();
         lastPullGitError = undefined;
+        const argv = [
+            "-C", hunchDir,
+            "-c", `core.hooksPath=${hooksDir}`,
+            "-c", `core.attributesFile=${gitNullDevice()}`,
+            "-c", "core.autocrlf=false",
+            "-c", "commit.gpgsign=false",
+            ...args,
+        ];
         try {
-            execFileSync("git", [
-                "-C", hunchDir,
-                "-c", `core.hooksPath=${hooksDir}`,
-                "-c", `core.attributesFile=${gitNullDevice()}`,
-                "-c", "core.autocrlf=false",
-                "-c", "commit.gpgsign=false",
-                ...args,
-            ], {
-                stdio: ["ignore", "ignore", "pipe"], env, timeout,
-            });
+            // Only the network call pays for the tree-killing supervisor (#498); the
+            // merge of an already-fetched sha and rev-parse/abort stay local.
+            if (args[0] === "fetch")
+                boundedExecFileSync("git", argv, { stdout: "ignore", env, timeout });
+            else
+                execFileSync("git", argv, { stdio: ["ignore", "ignore", "pipe"], env, timeout });
             return true;
         }
         catch (error) {
@@ -1496,7 +1494,7 @@ function upstreamSha(hunchDir, env) {
  * and discard oversized/unavailable output without changing its exit result. */
 function runObservedPush(args, env, timeoutMs, observe) {
     if (!observe) {
-        execFileSync("git", args, { stdio: "ignore", env, timeout: timeoutMs });
+        boundedExecFileSync("git", args, { stdout: "ignore", env, timeout: timeoutMs });
         return null;
     }
     let directory, descriptor;
@@ -1511,11 +1509,11 @@ function runObservedPush(args, env, timeoutMs, observe) {
             }
             catch { }
         }
-        execFileSync("git", args, { stdio: "ignore", env, timeout: timeoutMs });
+        boundedExecFileSync("git", args, { stdout: "ignore", env, timeout: timeoutMs });
         return null;
     }
     try {
-        execFileSync("git", args, { stdio: ["ignore", descriptor, "ignore"], env, timeout: timeoutMs });
+        boundedExecFileSync("git", args, { stdout: descriptor, env, timeout: timeoutMs });
         try {
             const buffer = Buffer.alloc(1_000_001);
             const bytes = readSync(descriptor, buffer, 0, buffer.length, 0);
@@ -1563,8 +1561,8 @@ function observePushResult(hunchDir, env, output, observer) {
         if (!destination || /[\x00-\x1f\x7f]/.test(destination) || Date.now() >= deadline)
             continue;
         try {
-            const result = execFileSync("git", ["-C", hunchDir, "ls-remote", "--refs", "--exit-code", "--", destination, ref], {
-                env, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: Math.max(1, deadline - Date.now()), maxBuffer: 16_384,
+            const result = boundedExecFileSync("git", ["-C", hunchDir, "ls-remote", "--refs", "--exit-code", "--", destination, ref], {
+                env, timeout: Math.max(1, deadline - Date.now()), maxBuffer: 16_384,
             }).trim();
             const rows = result.split("\n").filter(row => row.split("\t")[1] === ref);
             const commitSha = rows.length === 1 ? rows[0].split("\t")[0] : "";
@@ -1656,12 +1654,7 @@ function establishEmptyRemoteUpstream(hunchDir, env, protectedRepoRoot, timeoutM
     if (!before)
         return false;
     try {
-        const refs = execFileSync("git", ["-C", hunchDir, "ls-remote", "--refs", remote], {
-            encoding: "utf8",
-            stdio: ["ignore", "pipe", "ignore"],
-            env,
-            timeout: timeoutMs,
-        }).trim();
+        const refs = boundedExecFileSync("git", ["-C", hunchDir, "ls-remote", "--refs", remote], { env, timeout: timeoutMs }).trim();
         if (refs)
             return false;
     }
@@ -2332,7 +2325,9 @@ export function memoryMoveDiff(sha, root) {
  *  false when there is no upstream / offline / not a repo. */
 export function pushCurrentBranch(root) {
     try {
-        execFileSync("git", ["-C", root, "push"], { stdio: "ignore" });
+        // Bounded so an unreachable remote can't hang the caller, and a timeout
+        // kills git's whole tree, not just the root (#498).
+        boundedExecFileSync("git", ["-C", root, "push"], { stdout: "ignore", timeout: BRANCH_PUSH_TIMEOUT_MS });
         return true;
     }
     catch {
@@ -2652,83 +2647,70 @@ export function commitChanges(sha, cwd) {
     }
     return out;
 }
-/** Default cap on how many commits mergeRangeChanges will inspect. A `git
- *  pull` bringing in an unusually large number of commits (hundreds) would
- *  otherwise spawn one `diff-tree` per commit with no bound — cheap insurance
- *  against an unbounded background hook run, not a hard product limit. */
-const DEFAULT_MERGE_RANGE_CAP = 500;
-/** Every commit newly reachable in `oldRef..newRef` (capped to the most
- *  recent `maxCount`), with the files each one changed (rename-aware, via
- *  commitChanges). Used to find the commit a squash-merge produced from a
- *  set of now-orphaned source-branch commits. */
-export function mergeRangeChanges(oldRef, newRef, cwd, maxCount = DEFAULT_MERGE_RANGE_CAP) {
-    const shas = gitSafe(["rev-list", "--abbrev-commit", `--max-count=${maxCount}`, `${oldRef}..${newRef}`], cwd).split("\n").filter(Boolean).reverse();
+/** Default cap on commits the range walk inspects: insurance against an unbounded
+ *  background hook run when a pull brings in hundreds of commits. */
+const DEFAULT_RANGE_CAP = 500;
+/** Commits in `oldRef..newRef` (most recent `maxCount`, oldest first), each with the
+ *  non-deleted paths it touched. Squash-merge provenance repair reads this. A git
+ *  failure yields []. */
+export function mergeRangeChanges(oldRef, newRef, cwd, maxCount = DEFAULT_RANGE_CAP) {
+    const raw = gitSafe(["rev-list", "--abbrev-commit", `--max-count=${maxCount}`, `${oldRef}..${newRef}`], cwd);
+    if (!raw)
+        return [];
+    const shas = raw.split("\n").map((s) => s.trim()).filter(Boolean).reverse();
     return shas.map((sha) => ({
         sha,
-        // A deletion is never a sensible repair target — a decision's provenance
-        // should never resolve to the commit that removed the file it's about.
-        files: commitChanges(sha, cwd).filter((c) => c.status !== "deleted").map((c) => c.after ?? c.before).filter((f) => !!f),
+        files: commitChanges(sha, cwd)
+            .filter((c) => c.status !== "deleted")
+            .map((c) => c.after ?? c.before)
+            .filter((f) => !!f),
     }));
 }
-/** Batched existence check for many commit shas at once — one `git cat-file
- *  --batch-check` process instead of one `rev-parse --verify` per sha. Used
- *  by drift.ts's default commitResolvable so hunch drift/heal/doctor spawn a
- *  single git process regardless of how many decisions carry a commit, not
- *  one per decision. Returns the subset of `shas` that resolve to a real
- *  commit object, or `null` if the check itself failed to run (not a git
- *  repo, git missing, timeout) — distinct from an empty set, which means
- *  "checked, and none of them resolve." A caller that collapsed those two
- *  would flag every commit as unresolvable on a transient environment error
- *  instead of failing open. */
+const HEX_COMMIT_RE = /^[0-9a-f]{7,64}$/i;
+/** Which of `shas` resolve to a commit, via one `git cat-file --batch-check`.
+ *  Malformed values are dropped before the stdin lines are built (positional mapping).
+ *  Returns null when git itself could not run: callers fail open. */
 export function commitsExist(shas, cwd) {
-    const resolvable = new Set();
     if (!shas.length)
-        return resolvable;
-    // Same shape guard as commitRepairStatus. Without it, a malformed value
-    // embedding its own newline would count as more input lines than entries
-    // in `shas`, shifting every later sha's output line and misclassifying it.
-    const valid = shas.filter((sha) => /^[0-9a-f]{7,64}$/i.test(sha));
+        return new Set();
+    const valid = shas.filter((s) => HEX_COMMIT_RE.test(s));
     if (!valid.length)
-        return resolvable;
-    let raw;
+        return new Set();
+    let out;
     try {
-        raw = execFileSync("git", ["-C", cwd, "cat-file", "--batch-check"], {
-            encoding: "utf8",
-            input: valid.map((sha) => `${sha}^{commit}\n`).join(""),
-            stdio: ["pipe", "pipe", "ignore"],
-            timeout: 10_000,
+        out = execFileSync("git", ["-C", cwd, "cat-file", "--batch-check"], {
+            input: valid.map((s) => `${s}^{commit}`).join("\n") + "\n",
+            encoding: "utf8", timeout: 10_000, stdio: ["pipe", "pipe", "ignore"], maxBuffer: 16 * 1024 * 1024,
         });
     }
     catch {
         return null;
     }
-    const lines = raw.split("\n").filter(Boolean);
-    for (let i = 0; i < valid.length && i < lines.length; i++) {
-        if (!lines[i].endsWith(" missing"))
-            resolvable.add(valid[i]);
-    }
-    return resolvable;
-}
-/** Classifies `commit` relative to `ref` for squash-merge repair eligibility.
- *  "orphaned" (exists in this repo, but is not an ancestor of `ref`) is the
- *  ONLY status planCommitRepair should ever act on. "unresolvable" (the
- *  commit doesn't exist here at all) is explicitly out of repair scope —
- *  drift.ts's commit-unresolvable kind is what flags that case, because
- *  there's no reliable signal left to match a replacement against. "unknown"
- *  (the git command itself failed to run — timeout, git missing) must never
- *  be treated as repair-eligible; collapsing "false" and "error" into one
- *  boolean is exactly the bug this type exists to prevent. */
+    const lines = out.split("\n");
+    const found = new Set();
+    valid.forEach((sha, i) => {
+        if (lines[i] !== undefined && !/\bmissing$/.test(lines[i].trim()))
+            found.add(sha);
+    });
+    return found;
+}
+/** Whether `commit` is reachable from `ref`. Never collapses "no" and "error": only
+ *  "orphaned" is repair-eligible. A missing or non-directory cwd is "unresolvable". */
 export function commitRepairStatus(commit, ref, cwd) {
-    if (!/^[0-9a-f]{7,64}$/i.test(commit))
+    if (!HEX_COMMIT_RE.test(commit))
         return "unresolvable";
+    const opts = { cwd, stdio: "ignore", timeout: 5_000 };
     try {
-        execFileSync("git", ["-C", cwd, "rev-parse", "--verify", "--quiet", `${commit}^{commit}`], { stdio: "ignore", timeout: 5_000 });
+        execFileSync("git", ["cat-file", "-e", `${commit}^{commit}`], opts);
     }
     catch (e) {
-        return typeof e.status === "number" ? "unresolvable" : "unknown";
+        const err = e;
+        if (typeof err.status === "number" || err.code === "ENOENT" || err.code === "ENOTDIR")
+            return "unresolvable";
+        return "unknown";
     }
     try {
-        execFileSync("git", ["-C", cwd, "merge-base", "--is-ancestor", commit, ref], { stdio: "ignore", timeout: 5_000 });
+        execFileSync("git", ["merge-base", "--is-ancestor", commit, ref], opts);
         return "current";
     }
     catch (e) {

package/dist/extractors/helm.d.ts

@@ -1,15 +1,25 @@
 import type { ParsedSymbolKind } from "./languages.js";
+/**
+ * Deterministic token scan over Helm chart template text. Reports `define`
+ * blocks as symbols and `include` / `template` references as calls. This is
+ * not a Go-template parser: comments and quoting are deliberately ignored.
+ * All offsets are JS string (UTF-16) indices into the source.
+ */
 export interface HelmSymbol {
     name: string;
     kind: ParsedSymbolKind;
+    /** Index of the first `{` of the opening define action (inclusive). */
     startChar: number;
+    /** Index just past the `}}` of the matching end action (exclusive). */
     endChar: number;
     loc: number;
     bodyText: string;
 }
 export interface HelmCall {
     callee: string;
+    /** Index of the first letter of the `include` / `template` keyword. */
     atChar: number;
+    /** Index just past the closing quote of the name (exclusive). */
     endChar: number;
     member: boolean;
 }

package/dist/extractors/helm.js

@@ -1,76 +1,60 @@
-/**
- * Deterministic text scan for Helm's `define`/`include`/`template` Go-template
- * actions — NOT a Go-template parser, and NOT a tree-sitter query. tree-sitter-yaml
- * has no notion of `{{ }}` content: parsing `{{ include "x" . }}` inside a real
- * YAML mapping value produces only stray `{` flow-mapping-open tokens, with the
- * enclosed text lost to ERROR recovery (verified directly against this repo's
- * tree-sitter-yaml bundle). There is nothing for a tree-sitter query to capture,
- * so this runs as a sidecar text scan over the raw source — invoked only for
- * files under a Helm chart (indexer.ts's chart-root detection), never for
- * arbitrary YAML.
- *
- * Known bounded limitation: this is a token scan, not a full parser. A literal
- * `}}` inside a quoted argument, or an include/define-shaped string inside a
- * `{{/* comment *}}`, can misattribute a char range or produce a phantom call.
- * Both are bounded failure modes (a stray reference to a real symbol name, or a
- * slightly-long symbol range) — the same class of accepted limitation
- * `toleratedErrorScopes` documents for the tree-sitter grammars, not a silent gap.
- * The chart-wide `importedFiles` widening this module's output flows through
- * (indexer.ts) also lets a YAML alias resolve to an anchor in a sibling chart
- * file, even though YAML anchors are properly document-scoped; this only fires
- * when the alias has no matching anchor in its own file (i.e. only on input
- * that's already invalid YAML on its own terms), so it's bounded, but it's a
- * real, disclosed side effect of the chart-scoping mechanism, not something to
- * silently rely on.
- */
 import { MAX_BODY_TEXT_CHARS } from "./parse.js";
-// Matches one `{{ ... }}` action, including the `{{-`/`-}}` whitespace-trim
-// markers. Non-greedy so a multi-action line matches each action separately.
-const ACTION = /\{\{-?([\s\S]*?)-?\}\}/g;
-const BLOCK_OPEN = new Set(["if", "range", "with", "define", "block"]);
-const NAME_ARG = /^"([^"]*)"/;
-// Matched against an action's RAW inner text (not just a leading keyword) so
-// `{{ $labels := include "x" . }}` and `{{ if include "x" . }}` are caught,
-// not only the standalone `{{ include "x" . }}` form.
-const CALL_SITE = /\b(?:include|template)\s+"([^"]+)"/g;
+const OPENERS = new Set(["if", "range", "with", "block"]);
+const CALL_RE = /(?<![A-Za-z0-9_])(?:include|template)\s+"([^"]+)"/g;
 export function extractHelmDirectives(source) {
     const symbols = [];
     const calls = [];
     const stack = [];
-    for (const m of source.matchAll(ACTION)) {
-        const raw = m[1];
-        // "{{" is 2 chars; a trim-marker "{{-" is 3 — this is the char offset of
-        // `raw`'s first character within `source`, needed for call-site atChar math.
-        const innerStart = m.index + (source[m.index + 2] === "-" ? 3 : 2);
-        const endChar = m.index + m[0].length;
-        const body = raw.trim();
-        const spaceIdx = body.search(/\s/);
-        const keyword = spaceIdx === -1 ? body : body.slice(0, spaceIdx);
+    let pos = 0;
+    while (pos < source.length) {
+        const open = source.indexOf("{{", pos);
+        if (open === -1)
+            break;
+        const close = source.indexOf("}}", open + 2);
+        if (close === -1)
+            break;
+        const innerStart = source[open + 2] === "-" ? open + 3 : open + 2;
+        const innerEnd = close - 1 >= innerStart && source[close - 1] === "-" ? close - 1 : close;
+        const inner = innerEnd > innerStart ? source.slice(innerStart, innerEnd) : "";
+        const actionEnd = close + 2;
+        pos = actionEnd;
+        // Calls: any action, any keyword.
+        CALL_RE.lastIndex = 0;
+        for (let m = CALL_RE.exec(inner); m; m = CALL_RE.exec(inner)) {
+            const atChar = innerStart + m.index;
+            calls.push({ callee: m[1], atChar, endChar: atChar + m[0].length, member: false });
+        }
+        const trimmed = inner.trim();
+        const ws = trimmed.search(/\s/);
+        const keyword = ws === -1 ? trimmed : trimmed.slice(0, ws);
         if (keyword === "define") {
-            const name = NAME_ARG.exec(body.slice(spaceIdx + 1).trim())?.[1];
-            stack.push({ name, startChar: m.index });
+            const rest = trimmed.slice(keyword.length).trimStart();
+            let name = null;
+            if (rest.startsWith('"')) {
+                const q = rest.indexOf('"', 1);
+                const candidate = q === -1 ? "" : rest.slice(1, q);
+                if (candidate.length > 0)
+                    name = candidate;
+            }
+            stack.push({ start: open, name });
         }
-        else if (BLOCK_OPEN.has(keyword)) {
-            // if/range/with/block: depth marker only, no symbol on its own.
-            stack.push({ startChar: m.index });
+        else if (OPENERS.has(keyword)) {
+            stack.push({ start: open, name: null });
         }
         else if (keyword === "end") {
-            const open = stack.pop();
-            if (open?.name) {
+            const frame = stack.pop();
+            if (frame && frame.name !== null) {
+                const span = source.slice(frame.start, actionEnd);
                 symbols.push({
-                    name: open.name,
+                    name: frame.name,
                     kind: "variable",
-                    startChar: open.startChar,
-                    endChar,
-                    loc: source.slice(open.startChar, endChar).split("\n").length,
-                    bodyText: source.slice(open.startChar, endChar).slice(0, MAX_BODY_TEXT_CHARS),
+                    startChar: frame.start,
+                    endChar: actionEnd,
+                    loc: span.split("\n").length,
+                    bodyText: span.slice(0, MAX_BODY_TEXT_CHARS),
                 });
             }
         }
-        for (const call of raw.matchAll(CALL_SITE)) {
-            const atChar = innerStart + call.index;
-            calls.push({ callee: call[1], atChar, endChar: atChar + call[0].length, member: false });
-        }
     }
     return { symbols, calls };
 }

package/dist/extractors/indexer.d.ts

@@ -68,3 +68,9 @@ export declare function isExtractorEdge(edge: Edge): boolean;
 export declare function mergeScannedEdges(stored: Edge[], scanned: Edge[]): Edge[];
 /** Persist one pure scan into the Git-native source of truth. */
 export declare function indexRepo(store: HunchStore, root: string, opts?: IndexRepoOptions): IndexResult;
+/** Build a lookup from a tracked file to the root directory of its nearest Helm
+ *  chart ("" = repo root), or null. A directory is a chart root when
+ *  `<dir>/Chart.yaml` is tracked; nested subcharts resolve to their OWN root. This
+ *  is a conservative approximation of Helm's release-global template namespace
+ *  (issue #42): a parent including a subchart define is missed, never wrongly linked. */
+export declare function nearestChartRoot(tracked: readonly string[]): (file: string) => string | null;