src2sink 2.0.0__tar.gz → 3.0.0__tar.gz

{src2sink-2.0.0/src2sink.egg-info → src2sink-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: src2sink
-Version: 2.0.0
+Version: 3.0.0
 Summary: Cross-repository source-to-sink metabase for LLM-assisted SAST
 Author: Brett Crawley
 License-Expression: MIT

{src2sink-2.0.0 → src2sink-3.0.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "src2sink"
-version = "2.0.0"
+version = "3.0.0"
 description = "Cross-repository source-to-sink metabase for LLM-assisted SAST"
 authors = [{ name = "Brett Crawley" }]
 readme = "README.md"

{src2sink-2.0.0 → src2sink-3.0.0}/src2sink/aggregators/api_client_discovery.py

@@ -26,6 +26,7 @@ unverified binding poisons the taint graph with phantom cross-service edges.
 from __future__ import annotations
 
 import json
+import re
 from collections import defaultdict
 from pathlib import Path
 from typing import Any
@@ -85,21 +86,107 @@ def _http_in_paths_by_repo(records: list[dict[str, Any]]) -> dict[str, set[str]]
     return out
 
 
+# Suffixes a client library's repo conventionally carries. Used only to derive
+# the *stem to search for* — never as the test itself. The test is whether the
+# repo declares inbound endpoints, which is name-independent and catches estates
+# that name their libraries differently (`OI-40`).
+_CLIENT_SUFFIX_RX = re.compile(r"[-_](?:clients?|sdk)$", re.IGNORECASE)
+
+
+def _service_for_client_repo(
+    declaring_repo: str, endpoints: dict[str, set[str]]
+) -> str | None:
+    """Map a client-library repo to the service repo it fronts, or None.
+
+    `resolve(coord)` names the repo that *declares* the artifact, and
+    `_canonical_repo_id` maps that to the repo owning it. Both are correct. But
+    when a client library is published from **its own repository** rather than as
+    a submodule of the service, the repo owning the declaration *is* the library
+    — so the binding points at the client instead of the service it calls
+    (`OI-40`).
+
+    `OI-33` fixed the *shape* of the identity; this is the *referent* being
+    wrong, and no amount of path normalisation reaches it. The service is not
+    named anywhere in the consumer's dependency declaration.
+
+    A service has inbound endpoints; a client library does not. So the test is
+    the endpoint count, and the name only supplies the stem to search for.
+    Returns None rather than guessing — 31 of 42 in the observed fleet had no
+    sibling because the service is not in the scanned set at all, and inventing
+    one would manufacture the broken edges `OI-33` was about.
+    """
+    if "/" not in declaring_repo:
+        return None
+    if endpoints.get(declaring_repo):
+        return None  # it receives calls, so it is a service; leave it alone
+    stem = _CLIENT_SUFFIX_RX.sub("", declaring_repo.split("/")[-1])
+    if not stem:
+        return None
+    hits = sorted(
+        repo for repo, paths in endpoints.items()
+        if paths and repo.split("/")[-1] in (stem, f"{stem}-service")
+    )
+    return hits[0] if len(hits) == 1 else None
+
+
 def _key(target_repo: str, artifact: str) -> str:
     """Stable candidate key used for de-dup and for preserving reviewer edits."""
     return f"{target_repo}\t{artifact}"
 
 
-def _load_discovered(path: Path) -> dict[str, dict[str, Any]]:
-    """Return prior candidates keyed by (target_repo, artifact), or {} if absent."""
+def _canonical_repo_id(resolved: str, known: frozenset[str]) -> str | None:
+    """Map a resolved coordinate path to the repo id that owns it.
+
+    The identity index resolves a coordinate to the directory that *declares* it,
+    which may be a build module inside a repo — `group/repo/some-client`. The
+    demand-side pass names its target `group/repo`, from `repo_id()`. The two
+    never met, so `discovery_method: "both"` — the strongest signal the design
+    produces — could not occur even once (`OI-33`).
+
+    Truncating to two segments would be wrong: `group/subgroup/repo` is a valid
+    GitLab path and this estate contains them (`OI-34`). So match the longest
+    known repo id instead. That handles in-repo modules and nested repos alike,
+    and depends on neither path depth nor on `.git` being present — 65 of 746
+    repos in the observed fleet have no `.git` at all.
+
+    Returns None when nothing matches, which is a resolver failure worth
+    surfacing rather than a repo id worth guessing.
+    """
+    if not resolved:
+        return None
+    parts = resolved.split("/")
+    for n in range(len(parts), 0, -1):
+        candidate = "/".join(parts[:n])
+        if candidate in known:
+            return candidate
+    return None
+
+
+def _load_discovered(
+    path: Path, known: frozenset[str] | None = None
+) -> dict[str, dict[str, Any]]:
+    """Return prior candidates keyed by (target_repo, artifact), or {} if absent.
+
+    ``known`` lets a candidate stored under a pre-`OI-33` module path also be
+    found under its canonical repo id, so reviewer decisions survive the fix.
+    """
     try:
         data = json.loads(path.read_text(encoding="utf-8"))
     except (OSError, json.JSONDecodeError):
         return {}
     out: dict[str, dict[str, Any]] = {}
     for c in data.get("candidates", []):
-        if isinstance(c, dict) and "maven_artifact" in c:
-            out[_key(c.get("target_repo", ""), c["maven_artifact"])] = c
+        if not isinstance(c, dict) or "maven_artifact" not in c:
+            continue
+        stored = str(c.get("target_repo", ""))
+        artifact = c["maven_artifact"]
+        out[_key(stored, artifact)] = c
+        # A candidate reviewed before `OI-33` was keyed on the *module* path.
+        # Index it under its canonical repo id too, or the fix would silently
+        # discard every accept/reject a reviewer has already made.
+        canonical = _canonical_repo_id(stored, known) if known else None
+        if canonical and canonical != stored:
+            out.setdefault(_key(canonical, artifact), c)
     return out
 
 
@@ -112,12 +199,40 @@ def _confidence(target_repo: str, scanned: set[str], has_paths: bool) -> str:
     return "low"  # artifact looks like a client but coordinate did not resolve
 
 
+def _resolve_target(
+    resolve: Any, coord: str, known: frozenset[str], endpoints: dict[str, set[str]],
+) -> tuple[str, str, str]:
+    """Resolve a coordinate to (declaring path, service repo, client repo if corrected).
+
+    Two corrections in sequence, both needed and neither sufficient alone:
+    `_canonical_repo_id` fixes the identity's *shape* (`OI-33`), and
+    `_service_for_client_repo` fixes its *referent* when the declaring repo turns
+    out to be the client library rather than the service (`OI-40`).
+
+    The client repo is returned rather than discarded, because a substitution a
+    reviewer cannot see is one they cannot check.
+    """
+    resolved = resolve(coord) or ""
+    target = _canonical_repo_id(resolved, known) or ""
+    corrected = _service_for_client_repo(target, endpoints)
+    if corrected:
+        return resolved, corrected, target
+    return resolved, target, ""
+
+
 def _collect_candidates(
     records: list[dict[str, Any]],
     resolve: Any,
 ) -> dict[str, dict[str, Any]]:
-    """Mine consumer ``dependencies_internal`` into per-(target, artifact) candidates."""
+    """Mine consumer ``dependencies_internal`` into per-(target, artifact) candidates.
+
+    ``target_repo`` is normalised to a repo id the metabase knows (`OI-33`). The
+    resolver returns the directory that *declares* a coordinate, which for a
+    multi-module build is deeper than the repo — and the demand-side pass names
+    the same service by its repo id, so without this the two can never agree.
+    """
     paths_by_repo = _http_in_paths_by_repo(records)
+    known = frozenset(repo_id(d) for d in records)
     cands: dict[str, dict[str, Any]] = {}
     for data in records:
         consumer = repo_id(data)
@@ -127,12 +242,18 @@ def _collect_candidates(
             if not _looks_like_client_artifact(aid):
                 continue
             coord = f"{gid}:{aid}" if gid else aid
-            target = resolve(coord) or ""
+            # The declaring directory, then the repo that owns it. Both are kept:
+            # the module path is strictly more information and `OI-34` may want it.
+            resolved, target, client_repo = _resolve_target(
+                resolve, coord, known, paths_by_repo,
+            )
             key = _key(target, aid)
             cand = cands.setdefault(
                 key,
                 {
                     "target_repo": target,
+                    "target_module": resolved,
+                    "client_repo": client_repo,
                     "maven_artifact": aid,
                     "import_prefix": gid,  # best-effort; reviewer tightens
                     "paths": sorted(paths_by_repo.get(target, ())),
@@ -176,16 +297,29 @@ def _enclosing_class(file_path: str) -> str:
     return Path(file_path).stem if file_path else ""
 
 
-def _repos_containing_class(records: list[dict[str, Any]], class_name: str) -> set[str]:
-    """Repos with a file of this name, as a proxy for corpus-wide occurrence."""
-    hits: set[str] = set()
+def _repos_by_class(records: list[dict[str, Any]]) -> dict[str, set[str]]:
+    """Map each class name to the repos containing a file of that name.
+
+    Built in **one** pass and queried by key. It replaces a per-class rescan of
+    the whole fleet: the caller iterates targets, and each target's classes, and
+    asked the corpus about every one — so the cost was
+    ``targets x classes x records x nodes``, and on a synthetic fleet where all
+    four scale together the node visits grew ~15x for every doubling of the
+    repository count.
+
+    Nothing about the answer needed that. The question is corpus-wide and
+    target-independent: which repos hold a file called `StockClient`. Asked once
+    per class instead of once per (target, class), and answered from an index
+    instead of a scan.
+    """
+    by_class: dict[str, set[str]] = defaultdict(set)
     for data in records:
         rid = repo_id(data)
         for node in data.get("nodes", []):
-            if _enclosing_class(str(node.get("file", ""))) == class_name:
-                hits.add(rid)
-                break
-    return hits
+            cls = _enclosing_class(str(node.get("file", "")))
+            if cls:
+                by_class[cls].add(rid)
+    return by_class
 
 
 def _demand_side_observations(
@@ -229,6 +363,80 @@ def _demand_side_observations(
     return observed
 
 
+def _unresolved_warning(target_repo: str, coordinate: str, module: str) -> str | None:
+    """Explain an unresolvable coordinate, or None when it resolved.
+
+    An empty `target_repo` used to arrive as an ordinary candidate with nothing
+    saying why — 8 of them in the first fleet run. Promoting one creates an edge
+    pointing at nothing, so it must not read like a merely weak candidate
+    (`OI-33`, and the class in `OI-36`).
+    """
+    if target_repo:
+        return None
+    where = f"; declared at {module!r}" if module else "; not found in the checkout"
+    return (
+        f"coordinate {coordinate or '(none)'} did not resolve to a known repo"
+        f"{where} — the target cannot be trusted, and promoting this would "
+        "create an edge to nothing"
+    )
+
+
+def _target_warnings(
+    target_repo: str, coordinate: str, module: str, client_repo: str,
+) -> list[str]:
+    """Everything worth saying about how this candidate's target was arrived at."""
+    out: list[str] = []
+    unresolved = _unresolved_warning(target_repo, coordinate, module)
+    if unresolved:
+        out.append(unresolved)
+    if client_repo:
+        out.append(
+            f"target corrected from {client_repo!r}, which declares the client "
+            "library and no inbound endpoints, to the service it appears to "
+            "front — check the substitution before accepting (OI-40)"
+        )
+    return out
+
+
+def _endpointless_warning(target_repo: str, has_paths: bool, scanned: set[str]) -> str | None:
+    """Flag a target that receives no calls, without dropping it.
+
+    A binding's target is by definition a service that receives calls, so a
+    target with no detected inbound endpoint cannot fulfil that. But **zero
+    endpoints is also what a detection gap looks like** — `OI-17` left an entire
+    language half of a fleet returning none — and the two causes are
+    indistinguishable from the outside.
+
+    So this warns and never filters. Dropping these would turn `OI-17`-class
+    blindness into an invisible data-quality filter, which is `OI-36` with the
+    tool doing it to itself.
+    """
+    if not target_repo or has_paths or target_repo not in scanned:
+        return None
+    return (
+        f"{target_repo} declares no inbound endpoints: it may be a client "
+        "library whose service is outside the scanned fleet, or a service whose "
+        "endpoints were not detected — the two look identical from here"
+    )
+
+
+def _entry_fields(
+    cand: dict[str, Any], prev: dict[str, Any] | None
+) -> dict[str, Any]:
+    """The tunable fields and status, preserving a reviewer's decision.
+
+    A reviewer who set accepted/rejected has tuned the binding, so their edits
+    and status are kept and only evidence and confidence are refreshed.
+    """
+    if prev and prev.get("status") in (STATUS_ACCEPTED, STATUS_REJECTED):
+        entry = {k: prev.get(k, cand.get(k)) for k in _TUNABLE_FIELDS}
+        entry["status"] = prev["status"]
+        return entry
+    entry = {k: cand[k] for k in _TUNABLE_FIELDS}
+    entry["status"] = STATUS_PENDING
+    return entry
+
+
 def _build_entry(
     cand: dict[str, Any],
     scanned: set[str],
@@ -237,22 +445,22 @@ def _build_entry(
     """Assemble a candidate entry, preserving a reviewer's non-pending decision."""
     consumers = sorted(cand.pop("consumers"))
     coordinate = cand.pop("coordinate")
-    warnings = cand.pop("warnings", [])
+    warnings = list(cand.pop("warnings", []))
+    module = cand.pop("target_module", "")
+    client_repo = cand.pop("client_repo", "")
+    warnings += _target_warnings(
+        str(cand.get("target_repo", "")), coordinate, module, client_repo,
+    )
     has_paths = bool(cand["paths"])
     evidence = {
         "coordinate": coordinate,
         "consumers": consumers,
         "resolved": bool(cand["target_repo"]),
+        "declared_at": module,
+        "client_repo": client_repo,
         "paths_from_target_scan": has_paths and cand["target_repo"] in scanned,
     }
-    # A reviewer who set status to accepted/rejected has tuned the binding; keep
-    # their edits and status, only refreshing evidence + confidence.
-    if prev and prev.get("status") in (STATUS_ACCEPTED, STATUS_REJECTED):
-        entry = {k: prev.get(k, cand.get(k)) for k in _TUNABLE_FIELDS}
-        entry["status"] = prev["status"]
-    else:
-        entry = {k: cand[k] for k in _TUNABLE_FIELDS}
-        entry["status"] = STATUS_PENDING
+    entry = _entry_fields(cand, prev)
     # How the candidate was found. `both` is materially stronger than either
     # alone: a declared dependency and an observed call site are independent
     # lines of evidence. `call-site` sorts lowest, since it rests on the path
@@ -260,6 +468,12 @@ def _build_entry(
     entry["discovery_method"] = cand.get("discovery_method", "dependency")
     if warnings:
         entry["warnings"] = warnings
+    endpointless = _endpointless_warning(
+        str(entry["target_repo"] or ""), bool(entry["paths"]), scanned,
+    )
+    if endpointless:
+        existing: list[str] = list(entry.get("warnings") or [])
+        entry["warnings"] = [*existing, endpointless]
     entry["confidence"] = _confidence(
         str(entry["target_repo"] or ""), scanned, bool(entry["paths"])
     )
@@ -282,12 +496,14 @@ def _apply_demand_side(
     """
     observed = _demand_side_observations(records)
     by_target = {c["target_repo"]: (k, c) for k, c in cands.items() if c["target_repo"]}
+    # One pass over the fleet, before the loop rather than inside it.
+    repos_by_class = _repos_by_class(records)
 
     for target, seen in sorted(observed.items()):
         classes = sorted(seen["classes"])
         warnings = []
         for cls in classes:
-            repos = _repos_containing_class(records, cls)
+            repos = repos_by_class.get(cls, set())
             if len(repos) > MAX_PATTERN_REPOS:
                 warnings.append(
                     f"class_pattern {cls!r} appears in {len(repos)} repos; too "
@@ -338,7 +554,7 @@ def discover_api_clients_from_records(
     for cand in cands.values():
         cand.setdefault("discovery_method", "dependency")
     _apply_demand_side(cands, records)
-    prev = _load_discovered(metabase_root / DISCOVERED_FILE)
+    prev = _load_discovered(metabase_root / DISCOVERED_FILE, frozenset(scanned))
 
     entries = [
         _build_entry(cand, scanned, prev.get(key))
@@ -364,7 +580,13 @@ def discover_api_clients(
     by_coord, by_name, by_full = _build_component_identity_index(repos_root)
 
     def resolve(coord: str) -> str | None:
-        """Resolve a maven coordinate to the repo id that publishes it, or None."""
+        """Resolve a coordinate to the clone path that *declares* it, or None.
+
+        Not the repo id — this docstring used to claim it was, and that claim is
+        how `OI-33` went unnoticed: `_resolve_clone_path` returns the declaring
+        directory, which for a multi-module build sits inside the repo. The
+        caller normalises via `_canonical_repo_id`.
+        """
         return _resolve_clone_path(coord, by_coord, by_name, by_full)
 
     return discover_api_clients_from_records(metabase_root, records, resolve)

src2sink-3.0.0/src2sink/aggregators/graphs.py

@@ -0,0 +1,89 @@
+"""Orchestrate v2 cross-repo graph generation."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from ..graph_common import (
+    iter_v2_repo_records,
+    load_v2_repo_records,
+    v2_record_paths,
+)
+from ..index_store import build_index
+from .data_stores import write_data_store_graph
+from .index_v2 import write_index_v2
+from .openapi_edges import write_openapi_artifacts
+from .payload_producers import build_producer_indices, write_payload_producer_index
+from .phase3 import aggregate_phase3_v2
+from .pii_flow_v2 import write_pii_flow_v2
+from .queues import write_queue_graph
+from .service_calls import collect_service_edges, write_service_call_graph
+from .traces_index import write_traces_index
+
+
+def write_fleet_index(
+    metabase_root: Path,
+    repo_jsons: list[Path],
+    *,
+    repos_root: Path | None = None,
+    producer_indices: list[Any] | None = None,
+) -> Path:
+    """Persist the four things a trace consults, keyed by target repo (`OI-15`).
+
+    Built here because aggregation already walks every repo, so the index is one
+    more pass over data that is being read anyway rather than a second crawl.
+
+    The two fleet-wide derivations are computed the same way `trace` computed
+    them, from the same functions — the index is a cache of this code's output,
+    not a reimplementation of it, which is what keeps the two from drifting.
+
+    ``producer_indices`` is taken from the caller when aggregation has already
+    built it. Rebuilding it here meant the fleet's source tree was scanned a
+    second time, which doubled the slowest step of the whole run (`OI-30`).
+    """
+    paths = v2_record_paths(metabase_root, json_paths=repo_jsons)
+    records = load_v2_repo_records(metabase_root, json_paths=paths)
+    call_edges, _unmatched = collect_service_edges(records)
+    if producer_indices is None:
+        producer_indices = build_producer_indices(
+            metabase_root, repos_root=repos_root, json_paths=paths,
+        )
+    del records  # the streamed pass below must not be served from this list
+
+    return build_index(
+        metabase_root,
+        paths,
+        call_edges=call_edges,
+        producer_indices=producer_indices,
+        records=iter_v2_repo_records(metabase_root, json_paths=paths),
+    )
+
+
+def aggregate_graphs_v2(
+    metabase_root: Path,
+    repo_jsons: list[Path],
+    *,
+    repos_root: Path | None = None,
+    phase3: bool = True,
+    fleet_index: bool = True,
+) -> None:
+    """Run all v2 cross-repo graph writers (service, queue, data-store, PII, phase 3)."""
+    write_service_call_graph(metabase_root, repo_jsons, repos_root=repos_root)
+    if repos_root:
+        write_openapi_artifacts(metabase_root, repos_root, repo_jsons)
+    write_queue_graph(metabase_root, repo_jsons)
+    write_data_store_graph(metabase_root, repo_jsons)
+    producer_indices = write_payload_producer_index(
+        metabase_root, repo_jsons, repos_root=repos_root,
+    )
+    write_index_v2(metabase_root, repo_jsons)
+    write_pii_flow_v2(metabase_root, repo_jsons)
+    write_traces_index(metabase_root)
+    if phase3:
+        aggregate_phase3_v2(metabase_root, repo_jsons)
+    if fleet_index:
+        write_fleet_index(
+            metabase_root, repo_jsons, repos_root=repos_root,
+            producer_indices=producer_indices,
+        )

src2sink-3.0.0/src2sink/aggregators/openapi_discovery.py

@@ -0,0 +1,125 @@
+"""Discover OpenAPI specs and Helm ingress hosts under repos/."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from ..checkout_scan import paths_by_name
+from ..graph_common import normalize_path_template as norm_path
+
+from .openapi_models import OpenApiSpec
+
+OPENAPI_GLOBS = ("openapi.yaml", "openapi.yml", "swagger.yaml", "swagger.yml")
+PATH_LINE_RX = re.compile(
+    r"^\s{2,}(/[/\w{}.:$-]+)\s*:\s*$",
+    re.MULTILINE,
+)
+SERVERS_URL_RX = re.compile(
+    r"^\s*-\s*url:\s*['\"]?(https?://[^'\"\s]+)",
+    re.MULTILINE | re.IGNORECASE,
+)
+HELM_VALUES_NAMES = ("values.yaml", "values.yml")
+HELM_HOST_RX = re.compile(
+    r"^\s*(?:host|hostname|externalHost|ingress\.host)\s*:\s*['\"]?([^\s#'\"]+)",
+    re.MULTILINE | re.IGNORECASE,
+)
+
+_SKIP_DIR_PARTS = frozenset({".git", "node_modules", "target", "build", "charts"})
+
+
+def repo_from_under_repos(spec_path: Path, repos_root: Path) -> str | None:
+    """Return the ``org/repo`` id for a path under repos_root, or None."""
+    try:
+        rel = spec_path.relative_to(repos_root)
+    except ValueError:
+        return None
+    parts = rel.parts
+    if len(parts) < 2:
+        return None
+    return f"{parts[0]}/{parts[1]}"
+
+
+def _should_skip_path(path: Path) -> bool:
+    """True if the path lies within a skipped directory (.git, node_modules, ...)."""
+    return any(p in path.parts for p in _SKIP_DIR_PARTS)
+
+
+def _walk_once(repos_root: Path, names: tuple[str, ...]) -> list[Path]:
+    """Every file under the checkout carrying one of ``names``, from a single walk.
+
+    `Path.rglob(name)` traverses the whole tree and filters by name, so the
+    per-pattern loop this replaces cost one full traversal of a 34 GB checkout
+    *per filename* — four for the OpenAPI globs, two for Helm, and again for
+    every call site. The same defect as `OI-30` in the producer scan: the loop
+    over what to look for sat outside the loop over where to look.
+    """
+    found = paths_by_name(repos_root, frozenset(names))
+    return [path for name in names for path in found[name]]
+
+
+def discover_openapi_specs(repos_root: Path) -> list[OpenApiSpec]:
+    """Scan repos_root for OpenAPI/Swagger specs and return parsed OpenApiSpec rows."""
+    if not repos_root.is_dir():
+        return []
+    specs: list[OpenApiSpec] = []
+    seen: set[tuple[str, str]] = set()
+    for path in _walk_once(repos_root, OPENAPI_GLOBS):
+        if _should_skip_path(path):
+            continue
+        try:
+            if path.stat().st_size > 2_000_000:
+                continue
+            text = path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        target = repo_from_under_repos(path, repos_root)
+        if not target:
+            continue
+        key = (target, str(path))
+        if key in seen:
+            continue
+        seen.add(key)
+        paths = sorted({norm_path(m.group(1)) for m in PATH_LINE_RX.finditer(text)})
+        servers = [m.group(1) for m in SERVERS_URL_RX.finditer(text)]
+        specs.append(OpenApiSpec(
+            target_repo=target,
+            spec_path=str(path.relative_to(repos_root)),
+            paths=[p for p in paths if p and p != "/"],
+            servers=servers[:5],
+        ))
+    return specs
+
+
+def discover_helm_hosts(repos_root: Path) -> list[dict[str, str]]:
+    """Scan Helm values for declared ingress/service hostnames."""
+    if not repos_root.is_dir():
+        return []
+    rows: list[dict[str, str]] = []
+    seen: set[tuple[str, str]] = set()
+    for path in _walk_once(repos_root, HELM_VALUES_NAMES):
+        if _should_skip_path(path):
+            continue
+        try:
+            if path.stat().st_size > 500_000:
+                continue
+            text = path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        target = repo_from_under_repos(path, repos_root)
+        if not target:
+            continue
+        for m in HELM_HOST_RX.finditer(text):
+            host = m.group(1).strip().strip("'\"")
+            if not host or host.startswith("{{"):
+                continue
+            key = (target, host)
+            if key in seen:
+                continue
+            seen.add(key)
+            rows.append({
+                "target_repo": target,
+                "host": host,
+                "values_path": str(path.relative_to(repos_root)),
+            })
+    return rows