@javierkaiser/opencode-indexing 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.3] - 2026-10-16
+
+### Added
+- `install.mjs` accepts `--with-codegraph`. It is **off by default** and only
+  has effect in `--package` mode, as consent comes from passing the flag. When
+  active it detects an existing `codegraph` CLI, installs it globally (`npm install
+  -g codegraph`) if it is missing, and registers its MCP with OpenCode via
+  `codegraph install --target opencode`. A failure in either step is reported and
+  does not cancel this plugin's own install.
+- The README now names `npx` (not `opencode plugin add`) as the recommended
+  install method, and shows the companion install in the recommended command:
+  `npx @javierkaiser/opencode-indexing --with-codegraph`.
+
 ## [0.2.1] - 2026-10-15
 
 ### Added

package/README.md

@@ -26,28 +26,48 @@ index is still installed.
 
 ## Install
 
-### With the OpenCode CLI (recommended)
+### With npx (recommended)
 
 ```bash
-opencode plugin add @javierkaiser/opencode-indexing
+npx @javierkaiser/opencode-indexing
+```
+
+This is the whole install: the installer runs `opencode plugin add`, writes the
+permission rules, restarts the service, and, when you ask for it, also installs
+and registers the companion `codegraph`
+MCP. It picks its strategy from where it runs — from an npx cache or an
+unpacked tarball it installs the published package, from a checkout it
+installs your working tree instead — so edits take effect on restart with no
+publish in between. It prints which one it chose.
+
+Add `--with-codegraph` to install and register codegraph as part of the same run
+(the flag is opt-in and only has effect in the published-package mode):
+
+```bash
+npx @javierkaiser/opencode-indexing --with-codegraph
 ```
 
-That is the whole install. OpenCode downloads the package into its own cache and
-records it in the global `plugins` array, and it loads both halves of the plugin:
-the server side (`index.ts`, which registers the tools) and the terminal UI
-(`tui.ts`, which adds the prompt-footer indicator and the `/indexing` page).
+| Flag | Effect |
+| --- | --- |
+| `--package [spec]` | Install the published package (default spec `@latest`) |
+| `--local` | Copy this directory into the config dir (development) |
+| `--skip-deps` | `--local` only: copy the files, install no dependencies |
+| `--no-restart` | Do not restart the service |
+| `--with-codegraph` | Install and register codegraph as a companion MCP (opt-in, `--package` only) |
 
-Update and remove it with the same command family:
+### With the OpenCode CLI
 
 ```bash
-opencode plugin check     # is there a newer version?
-opencode plugin update    # install it
-opencode plugin remove @javierkaiser/opencode-indexing
+opencode plugin add @javierkaiser/opencode-indexing
 ```
 
-`plugin add` installs the plugin but knows nothing about its tools, so it does
-not write permission rules. Add this one to `opencode.json` to keep the host
-asking before the only tool that writes your settings file:
+OpenCode downloads the package into its own cache and records it in the global
+`plugins` array, and it loads both halves of the plugin: the server side
+(`index.ts`, which registers the tools) and the terminal UI (`tui.ts`, which
+adds the prompt-footer indicator and the `/indexing` page). It brings `plugin
+check`, `plugin update` and `plugin remove` with it, but it cannot write
+permission rules — add this one to `opencode.json` to keep the host asking
+before the only tool that writes your settings file:
 
 ```jsonc
 {
@@ -61,27 +81,6 @@ The other six tools only read. OpenCode's base policy already allows everything
 (`{ "action": "*", "resource": "*", "effect": "allow" }`), so they need no rule;
 write them out only if you want to tighten the set.
 
-### One command, permissions included
-
-To skip the manual rule:
-
-```bash
-npx @javierkaiser/opencode-indexing
-```
-
-The installer runs `opencode plugin add`, writes the permission rules, and
-restarts the service. It picks its strategy from where it runs: from an installed
-copy — an npx cache, an unpacked tarball — it installs the published package;
-from a checkout it installs your working tree instead, so edits take effect on
-restart with no publish in between. It prints which one it chose.
-
-| Flag | Effect |
-| --- | --- |
-| `--package [spec]` | Install the published package (default spec `@latest`) |
-| `--local` | Copy this directory into the config dir (development) |
-| `--skip-deps` | `--local` only: copy the files, install no dependencies |
-| `--no-restart` | Do not restart the service |
-
 `install.sh` and `install.ps1` are thin wrappers over it; PowerShell also accepts
 `-Local`, `-Package`, `-Spec`, `-SkipDeps` and `-NoRestart`.
 
@@ -482,7 +481,7 @@ This plugin deliberately stays on the semantic side and coexists with grep/read
 (see the tool descriptions and the bundled skill). A code-graph mode (tree-sitter
 symbol/edge extraction into SQLite, exposed as `indexing_graph_*` tools that
 chain after `indexing_search`) is a candidate for a future major version; the
-tree-sitter infrastructure is already in place.
+tree-sitter infrastructure is already in place. Independently, the installer can itself install and register codegraph as a companion MCP (`--with-codegraph`, opt-in, published-package mode only).
 
 ## Development
 

package/install.mjs

@@ -4,7 +4,7 @@
  *
  * Works on Windows, Linux and macOS (Node >= 22.6; Node 26 recommended).
  *
- *   node install.mjs [--local|--package] [spec] [--skip-deps] [--no-restart]
+ *   node install.mjs [--local|--package] [spec] [--skip-deps] [--no-restart] [--with-codegraph]
  *   npx @javierkaiser/opencode-indexing
  *
  * There are two ways to install, because there are two audiences.
@@ -38,6 +38,7 @@ const argv = process.argv.slice(2)
 const has = (name) => argv.some((arg) => arg.toLowerCase() === name)
 const skipDeps = has("--skip-deps")
 const noRestart = has("--no-restart")
+const withCodegraph = has("--with-codegraph")
 
 const source = dirname(fileURLToPath(import.meta.url))
 const sourcePkg = JSON.parse(readFileSync(join(source, "package.json"), "utf8"))
@@ -75,6 +76,7 @@ const spec = positional[0] ?? `${sourcePkg.name}@latest`
 log(`Installing ${sourcePkg.name} ${sourcePkg.version}`)
 log(`  from: ${source}`)
 log(`  mode: ${mode} (${reason})`)
+if (withCodegraph) log("  + codegraph (via --with-codegraph, package mode)")
 
 // ---------------------------------------------------------------------------
 // Tool permissions (both modes)
@@ -308,14 +310,78 @@ function installPackage() {
   return true
 }
 
+// ---------------------------------------------------------------------------
+// Codegraph as a companion MCP (opt-in, --with-codegraph)
+// ---------------------------------------------------------------------------
+/**
+ * Whether a `codegraph` CLI is available on PATH.
+ *
+ * A plain spawn is the cheapest, shell-independent probe and matches what
+ * the bench harness `resolveBinary()` does. It is treated as read-only here.
+ */
+function hasCodegraphBin() {
+  try {
+    const probe = spawnSync("codegraph", ["--version"], { stdio: "ignore", shell: isWindows })
+    if (probe.error) return false
+    // status is either 0 or, on some wrappers, undefined-but-no-error; treat both as present
+    return probe.status === 0 || probe.status === null
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Install codegraph and register its MCP with OpenCode.
+ *
+ * The only consent gate is the flag itself, as the user requested: this is
+ * an install step, not a recommendation. A failure in either half is reported
+ * and tolerated — the plugin is already installed and still works with
+ * semantic search only.
+ */
+function installCodegraph() {
+  log("  installing codegraph as a companion MCP server...")
+
+  if (!hasCodegraphBin()) {
+    log("  codegraph CLI missing; running npm install -g codegraph...")
+    const npm = isWindows ? "npm.cmd" : "npm"
+    // --omit=... is not needed here: codegraph stands on its own, and a global
+    // install is what its own documentation assumes.
+    const installed = spawnSync(npm, ["install", "-g", "codegraph"], {
+      stdio: "inherit",
+      shell: isWindows,
+    })
+    if (installed.error || installed.status !== 0) {
+      warn("  could not install codegraph (npm install -g codegraph failed); skipping MCP registration")
+      return
+    }
+  }
+
+  const register = spawnSync("codegraph", ["install", "--target", "opencode"], {
+    stdio: "inherit",
+    shell: isWindows,
+  })
+  if (register.error || register.status !== 0) {
+    warn("  codegraph is present but `codegraph install --target opencode` failed")
+    warn("  run it manually once to finish MCP registration: codegraph install --target opencode")
+    return
+  }
+
+  log("  codegraph installed and registered with OpenCode")
+}
+
 // ---------------------------------------------------------------------------
 // Run
 // ---------------------------------------------------------------------------
 if (mode === "local") {
   installLocal()
-} else if (!installPackage()) {
+  if (withCodegraph) warn("  --with-codegraph is ignored in --local mode; codegraph is not installed there")
+} else {
+  if (!installPackage()) {
   warn("  not writing permissions or restarting: the install did not complete")
   process.exit(1)
+  }
+  if (withCodegraph) installCodegraph()
+
 }
 
 writePermissions()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@javierkaiser/opencode-indexing",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "OpenCode plugin: semantic code search that reuses Kilo Code indexes (Qdrant/LanceDB) and maintains its own independent index",
   "license": "MIT",
   "author": "Carlos Javier Lust <javierkaiser@gmail.com>",