@davesheffer/hunch 1.46.0 → 1.47.1

package/dist/core/types.d.ts

@@ -111,12 +111,12 @@ export type Resource = z.infer<typeof ResourceSchema>;
 export declare const EdgeType: z.ZodEnum<{
     depends_on: "depends_on";
     calls: "calls";
+    references: "references";
     imports: "imports";
     contains: "contains";
     implements: "implements";
     supersedes: "supersedes";
     related_to: "related_to";
-    references: "references";
     provides: "provides";
     belongs_to: "belongs_to";
     implemented_by: "implemented_by";
@@ -173,12 +173,12 @@ export declare const EdgeSchema: z.ZodObject<{
     type: z.ZodEnum<{
         depends_on: "depends_on";
         calls: "calls";
+        references: "references";
         imports: "imports";
         contains: "contains";
         implements: "implements";
         supersedes: "supersedes";
         related_to: "related_to";
-        references: "references";
         provides: "provides";
         belongs_to: "belongs_to";
         implemented_by: "implemented_by";
@@ -783,12 +783,12 @@ export declare const SCHEMAS: {
         type: z.ZodEnum<{
             depends_on: "depends_on";
             calls: "calls";
+            references: "references";
             imports: "imports";
             contains: "contains";
             implements: "implements";
             supersedes: "supersedes";
             related_to: "related_to";
-            references: "references";
             provides: "provides";
             belongs_to: "belongs_to";
             implemented_by: "implemented_by";

package/dist/core/types.js

@@ -147,12 +147,12 @@ export const ResourceSchema = z.object({
 export const EdgeType = z.enum([
     "depends_on",
     "calls",
+    "references",
     "imports",
     "contains",
     "implements",
     "supersedes",
     "related_to",
-    "references",
     "provides",
     "belongs_to",
     "implemented_by",

package/dist/extractors/diff.d.ts

@@ -29,10 +29,10 @@ export interface DiffAnalysis {
     removedDeps: string[];
     addedLines: number;
     removedLines: number;
-    /** Added line bodies (the "+" content, marker stripped) per file — every file,
-     *  not just substantive ones. The text veto's symbol/pattern tiers match against
-     *  — call sites, not just declarations, which addedSymbols can't see. Keyed by
-     *  the same (new-path) key as perFile. */
+    /** Added line bodies (content after the `+`) per file, for EVERY file, not only
+     *  substantive ones. The text veto's symbol/pattern tiers match call sites, which
+     *  `addedSymbols` cannot see. Keyed by the same new-side path as the per-file
+     *  declarations map. */
     addedLinesByFile: Map<string, string[]>;
 }
 /** Undo git's C-style path quoting. Even with core.quotePath=false, git quotes a

package/dist/extractors/diff.js

@@ -20,25 +20,21 @@ const DECL_PATTERNS = [
     { kind: "type", re: /^\s*(?:export\s+)?type\s+([A-Za-z_$][\w$]*)\s*[=<]/ },
     { kind: "const", re: /^\s*(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>/ },
     { kind: "const", re: /^\s*(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?function/ },
+    // No Python class pattern: the generic class pattern above already matches a
+    // Python class header, and the first match wins.
     { kind: "function", re: /^\s*(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/ },
-    // No Python-specific class pattern needed: the generic TS `class` pattern above has no
-    // trailing-syntax requirement (no `{`/`:`), so it already matches Python's
-    // `class Foo(Bar):` header too, and — since declOf() returns on the first match —
-    // always wins for Python class lines before any Python-specific pattern would run.
 ];
 import { languageFor, isSubstantive } from "./languages.js";
 const IMPORT_RE = /^\s*import\s+(?:[^'"]*from\s+)?['"]([^'"]+)['"]/;
 const CONT_IMPORT_RE = /^\s*\}?\s*from\s+['"]([^'"]+)['"]/; // multi-line: "} from 'x'"
 const REQUIRE_RE = /\brequire\(\s*['"]([^'"]+)['"]\s*\)/;
 const PHP_REQUIRE_RE = /\b(?:require|require_once|include|include_once)\s*(?:\(\s*)?['"]([^'"]+)['"]/;
-// "import os" / "import a.b.c" / "import os as o" / "import os, sys" / trailing "# comment".
-// Anchored to the END of the line (optional "as alias", comma-separated modules, comment)
-// so it matches a COMPLETE Python import statement only — this deliberately rejects
-// TypeScript's `import Foo = Bar.Baz;` (import-equals), which would otherwise falsely
-// look like a Python "import Foo" prefix match.
-const PY_IMPORT_RE = /^\s*import\s+([A-Za-z_][\w.]*)(?:\s+as\s+\w+)?(?:\s*,\s*[A-Za-z_][\w.]*(?:\s+as\s+\w+)?)*\s*(?:#.*)?$/;
-const PY_FROM_IMPORT_RE = /^\s*from\s+([.\w]+)\s+import\s+/; // "from os import path" / "from . import x"
-const isCode = (p) => !!p && languageFor(p) !== null;
+// A COMPLETE Python import statement: comma-separated dotted modules, each with an
+// optional alias, an optional trailing comment, and nothing else. The anchoring is
+// what rejects TypeScript's `import Foo = Bar.Baz;`.
+const PY_IMPORT_RE = /^\s*import\s+([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)(?:\s+as\s+\w+)?(?:\s*,\s*[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*(?:\s+as\s+\w+)?)*\s*(?:#.*)?$/;
+const PY_FROM_RE = /^\s*from\s+(\.*[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*|\.+)\s+import\b/;
+const isCode = (p) => p.length > 0 && languageFor(p) !== null;
 function declOf(line) {
     for (const { kind, re } of DECL_PATTERNS) {
         const m = re.exec(line);
@@ -52,7 +48,7 @@ function importOf(line) {
         CONT_IMPORT_RE.exec(line) ??
         REQUIRE_RE.exec(line) ??
         PHP_REQUIRE_RE.exec(line) ??
-        PY_FROM_IMPORT_RE.exec(line) ??
+        PY_FROM_RE.exec(line) ??
         PY_IMPORT_RE.exec(line);
     return m ? m[1] : null;
 }
@@ -280,15 +276,15 @@ export function analyzeDiff(diff) {
         // ---- inside a hunk: content lines ----
         if (raw.startsWith("+")) {
             const body = raw.slice(1);
-            // Raw added lines are captured for EVERY file, before the substantive gate:
+            // Raw added lines are captured for every file, before the substantive gate:
             // content-matched constraints and Veto tripwires are not code-only rules
             // (a blocking invariant legitimately scopes .github/workflows/**, *.sql,
             // Dockerfile). Skipping them here left `scopedAdded` empty, which
             // buildCheckReport reads as "cannot prove a violation ⇒ complies" — so the
             // pre-edit hook denied the edit while `hunch check --strict` passed the
-            // very commit that landed it. The churn counters below now also include
-            // prose (isSubstantive, issue #12); symbol/import extraction stays
-            // code-only (isCode/languageFor) since declarations are a code concept.
+            // same diff. Churn counters below now include prose (isSubstantive, issue
+            // #12), while symbol/import extraction stays code-only (isCode): a
+            // declaration is a code concept.
             let lines = addedLinesBy.get(curFile);
             if (!lines) {
                 lines = [];
@@ -301,12 +297,12 @@ export function analyzeDiff(diff) {
             if (!curAdded && !curDeleted)
                 filesModified.add(curFile);
             if (isCode(curFile)) {
-                const d = declOf(body);
-                if (d)
-                    declsFor(curFile)?.added.set(d.name, d);
-                const imp = importOf(body);
-                if (imp && !imp.startsWith("."))
-                    addedImports.add(imp);
+                const decl = declOf(body);
+                if (decl)
+                    declsFor(curFile).added.set(decl.name, decl);
+                const spec = importOf(body);
+                if (spec && !spec.startsWith("."))
+                    addedImports.add(spec);
             }
         }
         else if (raw.startsWith("-")) {
@@ -317,12 +313,12 @@ export function analyzeDiff(diff) {
                 filesModified.add(curFile);
             if (isCode(curFile)) {
                 const body = raw.slice(1);
-                const d = declOf(body);
-                if (d)
-                    declsFor(curFile)?.removed.set(d.name, d);
-                const imp = importOf(body);
-                if (imp && !imp.startsWith("."))
-                    removedImports.add(imp);
+                const decl = declOf(body);
+                if (decl)
+                    declsFor(curFile).removed.set(decl.name, decl);
+                const spec = importOf(body);
+                if (spec && !spec.startsWith("."))
+                    removedImports.add(spec);
             }
         }
     }

package/dist/extractors/git.d.ts

@@ -266,6 +266,16 @@ export declare function pathKnownToHistory(root: string, file: string): boolean;
 /** Current branch name (e.g. "main", "feat/x"), or "" in detached HEAD / non-repo.
  *  Stamped onto auto-captured decisions so branch-scoped work stays filterable. */
 export declare function currentBranch(cwd: string): string;
+/** Whether `cwd` has its repository's default branch checked out: origin/HEAD's branch
+ *  when the remote names one, else `main` or `master`. False on a detached HEAD or
+ *  outside a repository, so a caller keeps its pre-existing behavior there. */
+export declare function onDefaultBranch(cwd: string): boolean;
+/** Whether a memory commit of `hunchDir` would have anything to stage: a tracked file git
+ *  sees as changed (after its own line-ending normalization) or an untracked, non-ignored
+ *  file, skipping the derived artifacts and the per-machine local.json the commit never
+ *  stages. A hook's inherited GIT_DIR/GIT_WORK_TREE is stripped, so the repository is
+ *  resolved from `hunchDir` itself. False when git cannot answer. */
+export declare function hunchDirHasChanges(hunchDir: string): boolean;
 /** Whether HEAD is somewhere a write must not land: mid rebase/merge/cherry-pick/revert/bisect
  *  ("git-operation-in-progress", which wins when both hold), or detached ("detached-head").
  *  null when HEAD is a settled branch — and also when git cannot answer at all (not a repo,
@@ -307,32 +317,17 @@ export interface CommitCandidate {
     sha: string;
     files: string[];
 }
-/** Every commit newly reachable in `oldRef..newRef` (capped to the most
- *  recent `maxCount`), with the files each one changed (rename-aware, via
- *  commitChanges). Used to find the commit a squash-merge produced from a
- *  set of now-orphaned source-branch commits. */
+/** Commits in `oldRef..newRef` (most recent `maxCount`, oldest first), each with the
+ *  non-deleted paths it touched. Squash-merge provenance repair reads this. A git
+ *  failure yields []. */
 export declare function mergeRangeChanges(oldRef: string, newRef: string, cwd: string, maxCount?: number): CommitCandidate[];
-/** Batched existence check for many commit shas at once — one `git cat-file
- *  --batch-check` process instead of one `rev-parse --verify` per sha. Used
- *  by drift.ts's default commitResolvable so hunch drift/heal/doctor spawn a
- *  single git process regardless of how many decisions carry a commit, not
- *  one per decision. Returns the subset of `shas` that resolve to a real
- *  commit object, or `null` if the check itself failed to run (not a git
- *  repo, git missing, timeout) — distinct from an empty set, which means
- *  "checked, and none of them resolve." A caller that collapsed those two
- *  would flag every commit as unresolvable on a transient environment error
- *  instead of failing open. */
+/** Which of `shas` resolve to a commit, via one `git cat-file --batch-check`.
+ *  Malformed values are dropped before the stdin lines are built (positional mapping).
+ *  Returns null when git itself could not run: callers fail open. */
 export declare function commitsExist(shas: readonly string[], cwd: string): Set<string> | null;
 export type CommitRepairStatus = "orphaned" | "current" | "unresolvable" | "unknown";
-/** Classifies `commit` relative to `ref` for squash-merge repair eligibility.
- *  "orphaned" (exists in this repo, but is not an ancestor of `ref`) is the
- *  ONLY status planCommitRepair should ever act on. "unresolvable" (the
- *  commit doesn't exist here at all) is explicitly out of repair scope —
- *  drift.ts's commit-unresolvable kind is what flags that case, because
- *  there's no reliable signal left to match a replacement against. "unknown"
- *  (the git command itself failed to run — timeout, git missing) must never
- *  be treated as repair-eligible; collapsing "false" and "error" into one
- *  boolean is exactly the bug this type exists to prevent. */
+/** Whether `commit` is reachable from `ref`. Never collapses "no" and "error": only
+ *  "orphaned" is repair-eligible. A missing or non-directory cwd is "unresolvable". */
 export declare function commitRepairStatus(commit: string, ref: string, cwd: string): CommitRepairStatus;
 /** commitRepairStatus against several tips: "orphaned" only when NO ref
  *  reaches the commit. A historical `--range old..new` must not make a commit

package/dist/extractors/git.js

@@ -861,9 +861,6 @@ export function headFileContent(root, rel) {
             encoding: "utf8",
             env: foreignRepoEnv(process.env),
             maxBuffer: 16 * 1024 * 1024,
-            // An untracked/absent-at-HEAD path is an expected, silently-handled case
-            // (falls through to the catch below) — don't let git's "fatal: path ...
-            // does not exist in 'HEAD'" leak onto the caller's stderr for it.
             stdio: ["ignore", "pipe", "ignore"],
         });
     }
@@ -940,10 +937,7 @@ function isDerivedStoreArtifact(relativeName) {
         // staged alongside the record; treating it as a violation made every served write skip
         // the commit quietly and report durability "local" forever (1.26.0/1.26.1).
         || relativeName === "write.lock"
-        // The post-merge hook's detected-but-unconfirmed repair queue and its
-        // rejected-match tombstones (repairqueue.ts): clone-local scratch, never a
-        // memory record — must never ride a public flush's `git add .` or an
-        // overlay's force-add allowlist into shared/pushed memory.
+        // Clone-local scratch that must never ride a public flush or an overlay force-add into shared memory.
         || relativeName === "pending-commit-repairs.json"
         || relativeName === "dropped-commit-repairs.json";
 }
@@ -2289,6 +2283,33 @@ export function currentBranch(cwd) {
     const b = gitSafe(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
     return b === "HEAD" ? "" : b; // detached HEAD reports "HEAD" — treat as no branch
 }
+/** Whether `cwd` has its repository's default branch checked out: origin/HEAD's branch
+ *  when the remote names one, else `main` or `master`. False on a detached HEAD or
+ *  outside a repository, so a caller keeps its pre-existing behavior there. */
+export function onDefaultBranch(cwd) {
+    const branch = currentBranch(cwd);
+    if (!branch)
+        return false;
+    const remoteHead = gitSafe(["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"], cwd);
+    if (remoteHead)
+        return branch === remoteHead.replace(/^origin\//, "");
+    return branch === "main" || branch === "master";
+}
+/** Whether a memory commit of `hunchDir` would have anything to stage: a tracked file git
+ *  sees as changed (after its own line-ending normalization) or an untracked, non-ignored
+ *  file, skipping the derived artifacts and the per-machine local.json the commit never
+ *  stages. A hook's inherited GIT_DIR/GIT_WORK_TREE is stripped, so the repository is
+ *  resolved from `hunchDir` itself. False when git cannot answer. */
+export function hunchDirHasChanges(hunchDir) {
+    const changed = [
+        ...gitSafeIsolated(["diff", "--name-only", "--relative", "--no-renames", "HEAD", "--", "."], hunchDir).split("\n"),
+        ...gitSafeIsolated(["ls-files", "--others", "--exclude-standard", "--", "."], hunchDir).split("\n"),
+    ];
+    return changed.some((raw) => {
+        const path = raw.trim().replace(/\\/g, "/");
+        return path !== "" && path !== "local.json" && !isDerivedStoreArtifact(path);
+    });
+}
 /** The state files git writes while it is replaying history. `git rev-parse --git-path`
  *  resolves each against THIS worktree's private git dir (a linked worktree keeps its own
  *  rebase-merge/MERGE_HEAD), so a rebase in one worktree never reads as one in another. */
@@ -2653,83 +2674,70 @@ export function commitChanges(sha, cwd) {
     }
     return out;
 }
-/** Default cap on how many commits mergeRangeChanges will inspect. A `git
- *  pull` bringing in an unusually large number of commits (hundreds) would
- *  otherwise spawn one `diff-tree` per commit with no bound — cheap insurance
- *  against an unbounded background hook run, not a hard product limit. */
-const DEFAULT_MERGE_RANGE_CAP = 500;
-/** Every commit newly reachable in `oldRef..newRef` (capped to the most
- *  recent `maxCount`), with the files each one changed (rename-aware, via
- *  commitChanges). Used to find the commit a squash-merge produced from a
- *  set of now-orphaned source-branch commits. */
-export function mergeRangeChanges(oldRef, newRef, cwd, maxCount = DEFAULT_MERGE_RANGE_CAP) {
-    const shas = gitSafe(["rev-list", "--abbrev-commit", `--max-count=${maxCount}`, `${oldRef}..${newRef}`], cwd).split("\n").filter(Boolean).reverse();
+/** Default cap on commits the range walk inspects: insurance against an unbounded
+ *  background hook run when a pull brings in hundreds of commits. */
+const DEFAULT_RANGE_CAP = 500;
+/** Commits in `oldRef..newRef` (most recent `maxCount`, oldest first), each with the
+ *  non-deleted paths it touched. Squash-merge provenance repair reads this. A git
+ *  failure yields []. */
+export function mergeRangeChanges(oldRef, newRef, cwd, maxCount = DEFAULT_RANGE_CAP) {
+    const raw = gitSafe(["rev-list", "--abbrev-commit", `--max-count=${maxCount}`, `${oldRef}..${newRef}`], cwd);
+    if (!raw)
+        return [];
+    const shas = raw.split("\n").map((s) => s.trim()).filter(Boolean).reverse();
     return shas.map((sha) => ({
         sha,
-        // A deletion is never a sensible repair target — a decision's provenance
-        // should never resolve to the commit that removed the file it's about.
-        files: commitChanges(sha, cwd).filter((c) => c.status !== "deleted").map((c) => c.after ?? c.before).filter((f) => !!f),
+        files: commitChanges(sha, cwd)
+            .filter((c) => c.status !== "deleted")
+            .map((c) => c.after ?? c.before)
+            .filter((f) => !!f),
     }));
 }
-/** Batched existence check for many commit shas at once — one `git cat-file
- *  --batch-check` process instead of one `rev-parse --verify` per sha. Used
- *  by drift.ts's default commitResolvable so hunch drift/heal/doctor spawn a
- *  single git process regardless of how many decisions carry a commit, not
- *  one per decision. Returns the subset of `shas` that resolve to a real
- *  commit object, or `null` if the check itself failed to run (not a git
- *  repo, git missing, timeout) — distinct from an empty set, which means
- *  "checked, and none of them resolve." A caller that collapsed those two
- *  would flag every commit as unresolvable on a transient environment error
- *  instead of failing open. */
+const HEX_COMMIT_RE = /^[0-9a-f]{7,64}$/i;
+/** Which of `shas` resolve to a commit, via one `git cat-file --batch-check`.
+ *  Malformed values are dropped before the stdin lines are built (positional mapping).
+ *  Returns null when git itself could not run: callers fail open. */
 export function commitsExist(shas, cwd) {
-    const resolvable = new Set();
     if (!shas.length)
-        return resolvable;
-    // Same shape guard as commitRepairStatus. Without it, a malformed value
-    // embedding its own newline would count as more input lines than entries
-    // in `shas`, shifting every later sha's output line and misclassifying it.
-    const valid = shas.filter((sha) => /^[0-9a-f]{7,64}$/i.test(sha));
+        return new Set();
+    const valid = shas.filter((s) => HEX_COMMIT_RE.test(s));
     if (!valid.length)
-        return resolvable;
-    let raw;
+        return new Set();
+    let out;
     try {
-        raw = execFileSync("git", ["-C", cwd, "cat-file", "--batch-check"], {
-            encoding: "utf8",
-            input: valid.map((sha) => `${sha}^{commit}\n`).join(""),
-            stdio: ["pipe", "pipe", "ignore"],
-            timeout: 10_000,
+        out = execFileSync("git", ["-C", cwd, "cat-file", "--batch-check"], {
+            input: valid.map((s) => `${s}^{commit}`).join("\n") + "\n",
+            encoding: "utf8", timeout: 10_000, stdio: ["pipe", "pipe", "ignore"], maxBuffer: 16 * 1024 * 1024,
         });
     }
     catch {
         return null;
     }
-    const lines = raw.split("\n").filter(Boolean);
-    for (let i = 0; i < valid.length && i < lines.length; i++) {
-        if (!lines[i].endsWith(" missing"))
-            resolvable.add(valid[i]);
-    }
-    return resolvable;
-}
-/** Classifies `commit` relative to `ref` for squash-merge repair eligibility.
- *  "orphaned" (exists in this repo, but is not an ancestor of `ref`) is the
- *  ONLY status planCommitRepair should ever act on. "unresolvable" (the
- *  commit doesn't exist here at all) is explicitly out of repair scope —
- *  drift.ts's commit-unresolvable kind is what flags that case, because
- *  there's no reliable signal left to match a replacement against. "unknown"
- *  (the git command itself failed to run — timeout, git missing) must never
- *  be treated as repair-eligible; collapsing "false" and "error" into one
- *  boolean is exactly the bug this type exists to prevent. */
+    const lines = out.split("\n");
+    const found = new Set();
+    valid.forEach((sha, i) => {
+        if (lines[i] !== undefined && !/\bmissing$/.test(lines[i].trim()))
+            found.add(sha);
+    });
+    return found;
+}
+/** Whether `commit` is reachable from `ref`. Never collapses "no" and "error": only
+ *  "orphaned" is repair-eligible. A missing or non-directory cwd is "unresolvable". */
 export function commitRepairStatus(commit, ref, cwd) {
-    if (!/^[0-9a-f]{7,64}$/i.test(commit))
+    if (!HEX_COMMIT_RE.test(commit))
         return "unresolvable";
+    const opts = { cwd, stdio: "ignore", timeout: 5_000 };
     try {
-        execFileSync("git", ["-C", cwd, "rev-parse", "--verify", "--quiet", `${commit}^{commit}`], { stdio: "ignore", timeout: 5_000 });
+        execFileSync("git", ["cat-file", "-e", `${commit}^{commit}`], opts);
     }
     catch (e) {
-        return typeof e.status === "number" ? "unresolvable" : "unknown";
+        const err = e;
+        if (typeof err.status === "number" || err.code === "ENOENT" || err.code === "ENOTDIR")
+            return "unresolvable";
+        return "unknown";
     }
     try {
-        execFileSync("git", ["-C", cwd, "merge-base", "--is-ancestor", commit, ref], { stdio: "ignore", timeout: 5_000 });
+        execFileSync("git", ["merge-base", "--is-ancestor", commit, ref], opts);
         return "current";
     }
     catch (e) {

package/dist/extractors/helm.d.ts

@@ -1,15 +1,25 @@
 import type { ParsedSymbolKind } from "./languages.js";
+/**
+ * Deterministic token scan over Helm chart template text. Reports `define`
+ * blocks as symbols and `include` / `template` references as calls. This is
+ * not a Go-template parser: comments and quoting are deliberately ignored.
+ * All offsets are JS string (UTF-16) indices into the source.
+ */
 export interface HelmSymbol {
     name: string;
     kind: ParsedSymbolKind;
+    /** Index of the first `{` of the opening define action (inclusive). */
     startChar: number;
+    /** Index just past the `}}` of the matching end action (exclusive). */
     endChar: number;
     loc: number;
     bodyText: string;
 }
 export interface HelmCall {
     callee: string;
+    /** Index of the first letter of the `include` / `template` keyword. */
     atChar: number;
+    /** Index just past the closing quote of the name (exclusive). */
     endChar: number;
     member: boolean;
 }

package/dist/extractors/helm.js

@@ -1,76 +1,60 @@
-/**
- * Deterministic text scan for Helm's `define`/`include`/`template` Go-template
- * actions — NOT a Go-template parser, and NOT a tree-sitter query. tree-sitter-yaml
- * has no notion of `{{ }}` content: parsing `{{ include "x" . }}` inside a real
- * YAML mapping value produces only stray `{` flow-mapping-open tokens, with the
- * enclosed text lost to ERROR recovery (verified directly against this repo's
- * tree-sitter-yaml bundle). There is nothing for a tree-sitter query to capture,
- * so this runs as a sidecar text scan over the raw source — invoked only for
- * files under a Helm chart (indexer.ts's chart-root detection), never for
- * arbitrary YAML.
- *
- * Known bounded limitation: this is a token scan, not a full parser. A literal
- * `}}` inside a quoted argument, or an include/define-shaped string inside a
- * `{{/* comment *}}`, can misattribute a char range or produce a phantom call.
- * Both are bounded failure modes (a stray reference to a real symbol name, or a
- * slightly-long symbol range) — the same class of accepted limitation
- * `toleratedErrorScopes` documents for the tree-sitter grammars, not a silent gap.
- * The chart-wide `importedFiles` widening this module's output flows through
- * (indexer.ts) also lets a YAML alias resolve to an anchor in a sibling chart
- * file, even though YAML anchors are properly document-scoped; this only fires
- * when the alias has no matching anchor in its own file (i.e. only on input
- * that's already invalid YAML on its own terms), so it's bounded, but it's a
- * real, disclosed side effect of the chart-scoping mechanism, not something to
- * silently rely on.
- */
 import { MAX_BODY_TEXT_CHARS } from "./parse.js";
-// Matches one `{{ ... }}` action, including the `{{-`/`-}}` whitespace-trim
-// markers. Non-greedy so a multi-action line matches each action separately.
-const ACTION = /\{\{-?([\s\S]*?)-?\}\}/g;
-const BLOCK_OPEN = new Set(["if", "range", "with", "define", "block"]);
-const NAME_ARG = /^"([^"]*)"/;
-// Matched against an action's RAW inner text (not just a leading keyword) so
-// `{{ $labels := include "x" . }}` and `{{ if include "x" . }}` are caught,
-// not only the standalone `{{ include "x" . }}` form.
-const CALL_SITE = /\b(?:include|template)\s+"([^"]+)"/g;
+const OPENERS = new Set(["if", "range", "with", "block"]);
+const CALL_RE = /(?<![A-Za-z0-9_])(?:include|template)\s+"([^"]+)"/g;
 export function extractHelmDirectives(source) {
     const symbols = [];
     const calls = [];
     const stack = [];
-    for (const m of source.matchAll(ACTION)) {
-        const raw = m[1];
-        // "{{" is 2 chars; a trim-marker "{{-" is 3 — this is the char offset of
-        // `raw`'s first character within `source`, needed for call-site atChar math.
-        const innerStart = m.index + (source[m.index + 2] === "-" ? 3 : 2);
-        const endChar = m.index + m[0].length;
-        const body = raw.trim();
-        const spaceIdx = body.search(/\s/);
-        const keyword = spaceIdx === -1 ? body : body.slice(0, spaceIdx);
+    let pos = 0;
+    while (pos < source.length) {
+        const open = source.indexOf("{{", pos);
+        if (open === -1)
+            break;
+        const close = source.indexOf("}}", open + 2);
+        if (close === -1)
+            break;
+        const innerStart = source[open + 2] === "-" ? open + 3 : open + 2;
+        const innerEnd = close - 1 >= innerStart && source[close - 1] === "-" ? close - 1 : close;
+        const inner = innerEnd > innerStart ? source.slice(innerStart, innerEnd) : "";
+        const actionEnd = close + 2;
+        pos = actionEnd;
+        // Calls: any action, any keyword.
+        CALL_RE.lastIndex = 0;
+        for (let m = CALL_RE.exec(inner); m; m = CALL_RE.exec(inner)) {
+            const atChar = innerStart + m.index;
+            calls.push({ callee: m[1], atChar, endChar: atChar + m[0].length, member: false });
+        }
+        const trimmed = inner.trim();
+        const ws = trimmed.search(/\s/);
+        const keyword = ws === -1 ? trimmed : trimmed.slice(0, ws);
         if (keyword === "define") {
-            const name = NAME_ARG.exec(body.slice(spaceIdx + 1).trim())?.[1];
-            stack.push({ name, startChar: m.index });
+            const rest = trimmed.slice(keyword.length).trimStart();
+            let name = null;
+            if (rest.startsWith('"')) {
+                const q = rest.indexOf('"', 1);
+                const candidate = q === -1 ? "" : rest.slice(1, q);
+                if (candidate.length > 0)
+                    name = candidate;
+            }
+            stack.push({ start: open, name });
         }
-        else if (BLOCK_OPEN.has(keyword)) {
-            // if/range/with/block: depth marker only, no symbol on its own.
-            stack.push({ startChar: m.index });
+        else if (OPENERS.has(keyword)) {
+            stack.push({ start: open, name: null });
         }
         else if (keyword === "end") {
-            const open = stack.pop();
-            if (open?.name) {
+            const frame = stack.pop();
+            if (frame && frame.name !== null) {
+                const span = source.slice(frame.start, actionEnd);
                 symbols.push({
-                    name: open.name,
+                    name: frame.name,
                     kind: "variable",
-                    startChar: open.startChar,
-                    endChar,
-                    loc: source.slice(open.startChar, endChar).split("\n").length,
-                    bodyText: source.slice(open.startChar, endChar).slice(0, MAX_BODY_TEXT_CHARS),
+                    startChar: frame.start,
+                    endChar: actionEnd,
+                    loc: span.split("\n").length,
+                    bodyText: span.slice(0, MAX_BODY_TEXT_CHARS),
                 });
             }
         }
-        for (const call of raw.matchAll(CALL_SITE)) {
-            const atChar = innerStart + call.index;
-            calls.push({ callee: call[1], atChar, endChar: atChar + call[0].length, member: false });
-        }
     }
     return { symbols, calls };
 }

package/dist/extractors/indexer.d.ts

@@ -68,3 +68,9 @@ export declare function isExtractorEdge(edge: Edge): boolean;
 export declare function mergeScannedEdges(stored: Edge[], scanned: Edge[]): Edge[];
 /** Persist one pure scan into the Git-native source of truth. */
 export declare function indexRepo(store: HunchStore, root: string, opts?: IndexRepoOptions): IndexResult;
+/** Build a lookup from a tracked file to the root directory of its nearest Helm
+ *  chart ("" = repo root), or null. A directory is a chart root when
+ *  `<dir>/Chart.yaml` is tracked; nested subcharts resolve to their OWN root. This
+ *  is a conservative approximation of Helm's release-global template namespace
+ *  (issue #42): a parent including a subchart define is missed, never wrongly linked. */
+export declare function nearestChartRoot(tracked: readonly string[]): (file: string) => string | null;