@sdsrs/code-graph 0.109.0 → 0.111.0

package/README.md

@@ -151,6 +151,19 @@ Then reconnect the MCP server in Claude Code with `/mcp`.
 
 > **Note:** Auto-update is disabled in the source repo directory (dev mode). Use manual update when developing the plugin itself.
 
+#### Turning auto-update off
+
+| Environment variable | Effect |
+|----------------------|--------|
+| `CODE_GRAPH_NO_AUTO_UPDATE=1` | Skips the update check entirely — no version check, no download, and no updater process is started. A **missing** binary is still installed on first run, so the MCP server can't be left with no engine. Update manually with the command above. |
+
+Set it in the `env` block of `~/.claude/settings.json` (the environment of the
+process hosting the MCP server), then reconnect with `/mcp`.
+
+An update that keeps failing also stops retrying on its own: after 5 failed
+attempts at the *same* release, the updater goes check-only until a newer
+release is published. Run `code-graph-mcp doctor` to see the state.
+
 #### Invited-memory mode (quieter prompts)
 
 By default, every user prompt the plugin deems code-related gets a small context injection from `code-graph` CLI output. If you'd rather rely on MEMORY.md + explicit tool calls, opt into invited-memory mode:

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.109.0",
+  "version": "0.111.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -12,7 +12,8 @@ const { claudeHome } = require('./claude-config');
 const { clearCache: clearBinaryCache, globalNodeModulesCandidates, nvmNodeModulesDirs, PLATFORM_PKG, detectLibc } = require('./find-binary');
 const { readBinaryVersion, compareVersions, isDevMode } = require('./version-utils');
 const { cgTmpDir } = require('./tmp-dir');
-const { npmSpawnOpts } = require('./npm-exec');
+const { npmInvocation } = require('./npm-exec');
+const { hidden } = require('./proc-opts');
 const { acquireLock } = require('./install-lock');
 
 // ── Environment Checks ────────────────────────────────────
@@ -25,7 +26,7 @@ const { acquireLock } = require('./install-lock');
 function commandExists(cmd) {
   try {
     const whichCmd = process.platform === 'win32' ? 'where' : 'which';
-    execFileSync(whichCmd, [cmd], { stdio: 'ignore' });
+    execFileSync(whichCmd, [cmd], hidden({ stdio: 'ignore' }));
     return true;
   } catch {
     return false;
@@ -47,11 +48,30 @@ const SESSION_START_MIN_GAP_MS = 2 * 60 * 1000;      // 2min — anti-hammer flo
 // `--force` included, because the backoff arm sits above the force arm below.
 const RATE_LIMIT_INTERVAL_MS = 60 * 60 * 1000;       // 1h — GitHub's reset window
 const FETCH_TIMEOUT_MS = 3000;
+// After this many consecutive FAILED install cycles for the SAME target version,
+// stop re-running the download chain and go check-only until a new release moves
+// the target. Some failures are permanent for a given machine (a GNU tar that
+// cannot open `C:\...`, a locked plugin cache, a full disk) and every retry was
+// a fresh ~MB download plus — before the windowsHide sweep — a burst of console
+// windows, once per session, forever (issue #40). Kept equal to statusline.js's
+// STUCK_UPDATE_ATTEMPTS (drift-guarded in statusline.test.js) so the moment the
+// updater gives up is the moment the statusline stops promising "↻ updating".
+const MAX_UPDATE_ATTEMPTS = 5;
 
 function isSilentMode(argv = process.argv.slice(2), env = process.env) {
   return argv.includes('--silent') || env.CODE_GRAPH_AUTO_UPDATE_SILENT === '1';
 }
 
+// Documented opt-out. Until now the only way to stop auto-update was the
+// accidental one — CODE_GRAPH_DEV=1, which also changes binary resolution and
+// several unrelated code paths (issue #40). This one does exactly what it says.
+// It does NOT block --install-missing: that path exists to put a binary on disk
+// for a server that has none, and disabling *updates* must not wedge a fresh
+// install with no engine.
+function isAutoUpdateDisabled(env = process.env) {
+  return env.CODE_GRAPH_NO_AUTO_UPDATE === '1';
+}
+
 function isInstallMissingMode(argv = process.argv.slice(2)) {
   return argv.includes('--install-missing');
 }
@@ -342,7 +362,7 @@ async function downloadBinary(latest) {
     execFileSync('curl', [
       '-sL', '-o', binaryTmp,
       latest.binaryUrl,
-    ], { timeout: 60000, stdio: 'pipe' });
+    ], hidden({ timeout: 60000, stdio: 'pipe' }));
 
     // Integrity sidecar (<asset>.sha256), fail-CLOSED. `curl -f` turns a 404 into
     // a throw. One retry, because the alternative to a transient network blip is
@@ -363,7 +383,7 @@ async function downloadBinary(latest) {
     for (let attempt = 0; attempt < 2 && !expectedSha; attempt++) {
       try {
         execFileSync('curl', ['-sfL', '-o', shaTmp, latest.binaryUrl + '.sha256'],
-          { timeout: 30000, stdio: 'pipe' });
+          hidden({ timeout: 30000, stdio: 'pipe' }));
         expectedSha = (fs.readFileSync(shaTmp, 'utf8').trim().split(/\s+/)[0]) || null;
       } catch { /* retry once, then refuse below */ } finally {
         try { if (fs.existsSync(shaTmp)) fs.unlinkSync(shaTmp); } catch { /* ok */ }
@@ -464,7 +484,7 @@ function refreshMarketplaceClone({ dir = marketplaceCloneDir(), exec = execFileS
   try {
     if (!fs.existsSync(path.join(dir, '.git'))) return false;
     if (!commandExists('git')) return false;
-    exec('git', ['-C', dir, 'pull', '--ff-only', '--quiet'], { timeout: timeoutMs, stdio: 'pipe' });
+    exec('git', ['-C', dir, 'pull', '--ff-only', '--quiet'], hidden({ timeout: timeoutMs, stdio: 'pipe' }));
     return true;
   } catch {
     return false;
@@ -517,7 +537,7 @@ async function downloadAndInstall(latest, {
       '-sL', '-o', tarballPath,
       '-H', 'Accept: application/octet-stream',
       latest.pluginTarballUrl,
-    ], { timeout: 30000, stdio: 'pipe' });
+    ], hidden({ timeout: 30000, stdio: 'pipe' }));
 
     // One retry, matching the binary sidecar at :355 — same failure mode, same
     // argument: a transient blip should cost an update cycle, not force a
@@ -528,7 +548,7 @@ async function downloadAndInstall(latest, {
     for (let attempt = 0; attempt < 2 && !expectedSha; attempt++) {
       try {
         exec('curl', ['-sfL', '-o', shaPath, latest.pluginTarballUrl + '.sha256'],
-          { timeout: 30000, stdio: 'pipe' });
+          hidden({ timeout: 30000, stdio: 'pipe' }));
         expectedSha = (fs.readFileSync(shaPath, 'utf8').trim().split(/\s+/)[0]) || null;
       } catch { /* retried once, then refused just below */ }
     }
@@ -540,9 +560,18 @@ async function downloadAndInstall(latest, {
 
     // No --strip-components: the asset archives `claude-plugin/` itself, while
     // GitHub's source tarball wraps everything in `<owner>-<repo>-<sha>/`.
+    //
+    // Relative archive name + `cwd`, never an absolute path with `-C`: GNU tar
+    // (git-for-Windows / MSYS, first on PATH for many Windows users) reads the
+    // drive letter in `C:\Users\...\claude-plugin.tar.gz` as a REMOTE HOST and
+    // fails with "Cannot connect to C: resolve failed" — the same colon-parsing
+    // family as issues #34/#35. Windows' built-in bsdtar accepts both spellings,
+    // so this form is the portable one. On a failing GNU tar this was the step
+    // that made plugin updates unachievable, which is what put the whole
+    // download chain on a per-session repeat loop (issue #40).
     exec('tar', [
-      'xzf', tarballPath, '-C', tmpDir,
-    ], { timeout: 15000, stdio: 'pipe' });
+      'xzf', PLUGIN_ASSET_NAME,
+    ], hidden({ cwd: tmpDir, timeout: 15000, stdio: 'pipe' }));
 
     const pluginSrc = path.join(tmpDir, 'claude-plugin');
     const pluginDst = path.join(
@@ -587,9 +616,9 @@ async function downloadAndInstall(latest, {
       try {
         const newLifecycle = path.join(pluginDst, 'scripts', 'lifecycle.js');
         if (fs.existsSync(newLifecycle)) {
-          exec(process.execPath, [newLifecycle, 'update'], {
+          exec(process.execPath, [newLifecycle, 'update'], hidden({
             timeout: 5000, stdio: 'pipe',
-          });
+          }));
         }
       } catch { /* not fatal — syncLifecycleConfig will self-heal on next session */ }
     }
@@ -698,10 +727,11 @@ function inactiveNodeGlobalRelics({ dirs = null, activeDir = null } = {}) {
 function npmInstallGlobal(specs) {
   return new Promise((resolve) => {
     if (!commandExists('npm')) { resolve(false); return; }
-    const child = spawn('npm', ['install', '-g', ...specs], npmSpawnOpts({
+    const npm = npmInvocation(['install', '-g', ...specs], {
       timeout: GLOBAL_PKG_HEAL_TIMEOUT_MS,
       stdio: ['ignore', 'ignore', 'pipe'],
-    }));
+    });
+    const child = spawn(npm.file, npm.args, npm.opts);
     let stderr = '';
     child.stderr.on('data', (d) => { stderr += d.toString(); });
     child.on('error', () => resolve(false));
@@ -775,10 +805,11 @@ function shouldHealGlobalsOnThrottle(state, { readStale = staleGlobalPkgs } = {}
 async function checkForUpdate({ installMissing = false, force = false, requestJsonFn } = {}) {
   let installLock = null;
   try {
-    // Skip in dev mode — unless the launcher explicitly requested a missing-
-    // binary install, in which case we MUST proceed regardless of mode (the
-    // alternative is wedging the MCP server with no binary on disk).
-    if (!installMissing && isDevMode()) return null;
+    // Skip in dev mode / when the user opted out — unless the launcher
+    // explicitly requested a missing-binary install, in which case we MUST
+    // proceed regardless of mode (the alternative is wedging the MCP server
+    // with no binary on disk).
+    if (!installMissing && (isDevMode() || isAutoUpdateDisabled())) return null;
 
     const state = readState();
     // manifest.version is authoritative — /plugin update writes it directly and
@@ -845,6 +876,35 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
     }
 
     if (hasUpdate) {
+      // Attempts are counted PER target version, so a newly published release
+      // always starts with a full budget. The counter used to be unscoped, which
+      // only mattered because nothing ever read it: the download chain re-ran on
+      // every single session no matter how many times it had already failed.
+      const attempts = state.latestVersion === latest.version ? (state.updateAttempts || 0) : 0;
+      if (attempts >= MAX_UPDATE_ATTEMPTS) {
+        // Suspended — check-only from here until a newer release moves the
+        // target. The one thing still worth attempting is a MISSING cached
+        // binary: without it the MCP server has no engine at all, so that
+        // self-heal stays reachable while the (separately failing) plugin
+        // tarball chain and the global-npm heal stay parked.
+        const healedMissing = !fs.existsSync(cachedBinaryPath()) && await downloadBinary(latest);
+        saveState({
+          ...state,
+          installedVersion,
+          lastCheck: new Date().toISOString(),
+          latestVersion: latest.version,
+          updateAvailable: true,
+          updateAttempts: attempts,
+          rateLimited: false,
+          binaryUpdated: healedMissing || state.binaryUpdated,
+        });
+        console.error(
+          `[code-graph] Auto-update to v${latest.version} suspended after ${attempts} failed attempts on this machine. ` +
+          'Update manually (`/plugin update code-graph-mcp`, or `npm install -g @sdsrs/code-graph`) or run `code-graph-mcp doctor`. ' +
+          'Retries resume automatically when a newer release is published.'
+        );
+        return { updateAvailable: true, suspended: true, from: installedVersion, to: latest.version };
+      }
       const result = await downloadAndInstall(latest);
       const success = result.pluginUpdated;
       const newState = {
@@ -857,7 +917,7 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
         // update (missing tar/curl, full disk, blocked network) pins "updating"
         // forever, asserting a self-heal that never happens. The statusline stops
         // trusting it past STUCK_UPDATE_ATTEMPTS; success resets to 0.
-        updateAttempts: success ? 0 : (state.updateAttempts || 0) + 1,
+        updateAttempts: success ? 0 : attempts + 1,
         lastUpdate: success ? new Date().toISOString() : state.lastUpdate,
         rateLimited: false,
         binaryUpdated: result.binaryUpdated,
@@ -913,7 +973,8 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
 module.exports = {
   checkForUpdate, commandExists, isDevMode, readState, compareVersions, shouldCheck,
   getExtractedPluginVersion, readBinaryVersion, promoteVerifiedBinary,
-  isSilentMode, isInstallMissingMode, isForceMode,
+  isSilentMode, isInstallMissingMode, isForceMode, isAutoUpdateDisabled,
+  MAX_UPDATE_ATTEMPTS,
   requestJson, resolveProxy, parseLatestRelease, fetchLatestRelease,
   PLUGIN_ASSET_NAME,
   downloadBinary, cachedBinaryPath, cachedBinaryNeedsUpdate, cachedBinaryStaleVsState,
@@ -941,10 +1002,14 @@ if (require.main === module) {
       if (silent) return;
       if (result && result.updated) {
         console.log(`Updated: v${result.from} → v${result.to} (binary: ${result.binaryUpdated ? 'yes' : 'no'})`);
+      } else if (result && result.suspended) {
+        console.log(`Update available: v${result.to} — auto-install SUSPENDED after ${MAX_UPDATE_ATTEMPTS} failed attempts. Update manually; retries resume on the next release.`);
       } else if (result && result.updateAvailable) {
         console.log(`Update available: v${result.to} (auto-install failed)`);
       } else if (result && result.binaryUpdated) {
         console.log(`Repaired binary cache (v${result.to})`);
+      } else if (!installMissing && isAutoUpdateDisabled()) {
+        console.log('CODE_GRAPH_NO_AUTO_UPDATE=1 — auto-update skipped');
       } else if (!installMissing && isDevMode()) {
         console.log('Dev mode — auto-update skipped');
       } else {

package/claude-plugin/scripts/cg-answer.js

@@ -19,6 +19,7 @@
 // runs cannot inflate the deny→use conversion funnel.
 
 const { spawnSync } = require('child_process');
+const { hidden } = require('./proc-opts');
 
 // 2000 ms is a product decision, not a tuning knob: a PreToolUse hook that
 // stalls longer than this costs the user more than the answer is worth, so the
@@ -124,7 +125,7 @@ function runGrepAnswer(opts = {}) {
     const scope = sanitizeSearchPath(searchPath);
     const args = ['grep', pattern];
     if (scope) args.push(scope);
-    const res = spawnSync(binary, args, {
+    const res = spawnSync(binary, args, hidden({
       cwd,
       timeout: timeoutMs,
       encoding: 'utf8',
@@ -133,7 +134,7 @@ function runGrepAnswer(opts = {}) {
       // Hook-internal run: a delivered answer, not a model-initiated conversion.
       // The CLI skips its recommendations.jsonl `use` record when this is set.
       env: { ...process.env, CODE_GRAPH_INTERNAL: '1' },
-    });
+    }));
     if (res.error || res.signal) {
       return { status: 'unavailable' };
     }
@@ -190,14 +191,14 @@ function runShowAnswer(opts = {}) {
     const parts = [];
     for (const sym of symbols.slice(0, 3)) {
       if (typeof sym !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(sym)) continue;
-      const res = spawnSync(binary, ['show', sym], {
+      const res = spawnSync(binary, ['show', sym], hidden({
         cwd,
         timeout: timeoutMs,
         encoding: 'utf8',
         maxBuffer: 4 * 1024 * 1024,
         stdio: ['ignore', 'pipe', 'ignore'],
         env: { ...process.env, CODE_GRAPH_INTERNAL: '1' },
-      });
+      }));
       if (res.error || res.signal || res.status !== 0) continue;
       const out = (res.stdout || '').trim();
       if (!out || out.startsWith(NO_MATCH_PREFIX)) continue;
@@ -238,14 +239,14 @@ function runOverviewAnswer(opts = {}) {
       binary = process.env._CG_ANSWER_BINARY || require('./find-binary').findBinary();
     }
     if (!binary) return { status: 'no-binary' };
-    const res = spawnSync(binary, ['overview', dir], {
+    const res = spawnSync(binary, ['overview', dir], hidden({
       cwd,
       timeout: timeoutMs,
       encoding: 'utf8',
       maxBuffer: 4 * 1024 * 1024,
       stdio: ['ignore', 'pipe', 'ignore'],
       env: { ...process.env, CODE_GRAPH_INTERNAL: '1' },
-    });
+    }));
     if (res.error || res.signal || res.status !== 0) {
       return { status: 'unavailable' };
     }
@@ -293,14 +294,14 @@ function runCallgraphAnswer(opts = {}) {
     }
     if (!binary) return { status: 'no-binary' };
 
-    const res = spawnSync(binary, ['callgraph', symbol], {
+    const res = spawnSync(binary, ['callgraph', symbol], hidden({
       cwd,
       timeout: timeoutMs,
       encoding: 'utf8',
       maxBuffer: 4 * 1024 * 1024,
       stdio: ['ignore', 'pipe', 'ignore'],
       env: { ...process.env, CODE_GRAPH_INTERNAL: '1' },
-    });
+    }));
     if (res.error || res.signal) return { status: 'unavailable' };
     // grep-parity exit codes: 1 = symbol not found (no graph node).
     if (res.status === 1) return { status: 'no-hits' };

package/claude-plugin/scripts/doctor.js

@@ -11,6 +11,8 @@ const {
   installedGlobalPkgs, GLOBAL_INSTALL_MARKER, SHELL_PKG,
 } = require('./lifecycle');
 const { findBinary, clearCache: clearBinaryCache } = require('./find-binary');
+const { hidden } = require('./proc-opts');
+const { MAX_UPDATE_ATTEMPTS } = require('./auto-update');
 
 // ── Diagnostics ───────────────────────────────────────────
 
@@ -136,12 +138,12 @@ function runDiagnostics({ checkOnly = false } = {}) {
     if (execOk) {
       try {
         const cwd = process.cwd();
-        const hcOutput = execFileSync(binary, ['health-check', '--json'], {
+        const hcOutput = execFileSync(binary, ['health-check', '--json'], hidden({
           cwd,
           timeout: 5000,
           encoding: 'utf8',
           stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
+        })).trim();
         const hc = JSON.parse(hcOutput);
 
         // No-index short-circuit — binary deliberately returns a structured
@@ -202,7 +204,20 @@ function runDiagnostics({ checkOnly = false } = {}) {
   // 5. Auto-update state
   try {
     const state = readJson(path.join(CACHE_DIR, 'update-state.json'));
-    if (state && state.updateAvailable && state.binaryUpdated === false) {
+    const attempts = (state && state.updateAttempts) || 0;
+    if (state && state.updateAvailable && attempts >= MAX_UPDATE_ATTEMPTS) {
+      // The updater has given up on this release (issue #40). Deliberately NO
+      // fixId: re-running `auto-update.js check` is precisely the thing that was
+      // suspended, so offering it as a repair would print "✅ Update check
+      // complete" and count a fix that cannot happen. Say what is true and hand
+      // the user the manual route.
+      results.push({
+        name: 'Auto-update',
+        status: 'warn',
+        detail: `v${state.latestVersion} failed to install ${attempts}× — auto-retry suspended until a newer release. `
+          + 'Update manually: `npm install -g @sdsrs/code-graph` (or `/plugin update code-graph-mcp`)',
+      });
+    } else if (state && state.updateAvailable && state.binaryUpdated === false) {
       results.push({
         name: 'Auto-update',
         status: 'warn',
@@ -492,10 +507,10 @@ function runRepairs(results) {
         if (!isDevMode()) {
           console.log('\n  Triggering binary update...');
           try {
-            execFileSync(process.execPath, [path.join(__dirname, 'auto-update.js'), 'check'], {
+            execFileSync(process.execPath, [path.join(__dirname, 'auto-update.js'), 'check'], hidden({
               timeout: 60000,
               stdio: 'inherit',
-            });
+            }));
             console.log('  \u2705 Update check complete');
             fixed++;
           } catch {
@@ -516,11 +531,11 @@ function runRepairs(results) {
         console.log(`    \u2192 ${buildCmd}`);
         try {
           const projectRoot = path.resolve(__dirname, '..', '..');
-          execSync(buildCmd, {
+          execSync(buildCmd, hidden({
             cwd: projectRoot,
             stdio: 'inherit',
             timeout: 600000,  // embed-model (Candle) builds exceed the old 5min
-          });
+          }));
           clearBinaryCache();
           console.log('  \u2705 Build complete');
           fixed++;
@@ -539,11 +554,11 @@ function runRepairs(results) {
           console.log('      (for semantic search: cargo build --release --features embed-model)');
           try {
             const projectRoot = path.resolve(__dirname, '..', '..');
-            execSync('cargo build --release --no-default-features', {
+            execSync('cargo build --release --no-default-features', hidden({
               cwd: projectRoot,
               stdio: 'inherit',
               timeout: 600000,
-            });
+            }));
             clearBinaryCache();
             console.log('  \u2705 Build complete');
             fixed++;
@@ -580,11 +595,11 @@ function runRepairs(results) {
           console.log('\n  Rebuilding index...');
           console.log('    \u2192 code-graph-mcp incremental-index');
           try {
-            execFileSync(binary, ['incremental-index'], {
+            execFileSync(binary, ['incremental-index'], hidden({
               cwd: process.cwd(),
               stdio: 'inherit',
               timeout: 120000,
-            });
+            }));
             console.log('  \u2705 Index rebuilt');
             fixed++;
           } catch {
@@ -597,10 +612,10 @@ function runRepairs(results) {
       case 'update-incomplete': {
         console.log('\n  Completing auto-update...');
         try {
-          execFileSync(process.execPath, [path.join(__dirname, 'auto-update.js'), 'check'], {
+          execFileSync(process.execPath, [path.join(__dirname, 'auto-update.js'), 'check'], hidden({
             timeout: 60000,
             stdio: 'inherit',
-          });
+          }));
           console.log('  \u2705 Update check complete');
           fixed++;
         } catch {

package/claude-plugin/scripts/find-binary.js

@@ -5,7 +5,8 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const { readBinaryVersion, compareVersions } = require('./version-utils');
-const { npmSpawnOpts } = require('./npm-exec');
+const { npmInvocation } = require('./npm-exec');
+const { hidden } = require('./proc-opts');
 
 const PLATFORM = os.platform();
 const ARCH = os.arch();
@@ -108,11 +109,12 @@ function globalNodeModulesCandidates() {
   // 4. Last resort: ask npm directly. Slow (~50-200ms) but most accurate when
   //    user has a non-standard prefix. Cached at the disk-cache layer above.
   try {
-    const root = execFileSync('npm', ['root', '-g'], npmSpawnOpts({
+    const npm = npmInvocation(['root', '-g'], {
       timeout: 2000,
       stdio: ['pipe', 'pipe', 'pipe'],
       encoding: 'utf8',
-    })).trim();
+    });
+    const root = execFileSync(npm.file, npm.args, npm.opts).trim();
     if (root) out.push(root);
   } catch { /* npm not on PATH or timed out */ }
 
@@ -351,7 +353,7 @@ function findBinaryUncached() {
   // --- PATH lookup (last resort for intentionally installed binaries) ---
   try {
     const which = PLATFORM === 'win32' ? 'where' : 'which';
-    const found = execFileSync(which, [BINARY_NAME], { stdio: ['pipe', 'pipe', 'pipe'] })
+    const found = execFileSync(which, [BINARY_NAME], hidden({ stdio: ['pipe', 'pipe', 'pipe'] }))
       .toString().trim().split('\n')[0];
     const hit = gate.consider(found);
     if (hit) return hit;

package/claude-plugin/scripts/incremental-index.js

@@ -2,6 +2,7 @@
 'use strict';
 const { execFileSync } = require('child_process');
 const { findBinary } = require('./find-binary');
+const { hidden } = require('./proc-opts');
 
 // v0.21 — gated default-off. v0.18.0 added query-time freshness
 // (ensure_file_indexed) inside MCP tools that take a file_path arg, so a
@@ -29,10 +30,10 @@ function runMain() {
   if (!bin) return; // silent — binary not installed yet
 
   try {
-    execFileSync(bin, ['incremental-index', '--quiet'], {
+    execFileSync(bin, ['incremental-index', '--quiet'], hidden({
       timeout: 8000,
       stdio: ['pipe', 'pipe', 'pipe']
-    });
+    }));
   } catch { /* timeout or error — silent for hook */ }
 }
 

package/claude-plugin/scripts/launcher-install.js

@@ -22,7 +22,8 @@
  */
 const { spawn } = require('child_process');
 const path = require('path');
-const { NPM_NEEDS_SHELL } = require('./npm-exec');
+const { npmInvocation } = require('./npm-exec');
+const { hidden } = require('./proc-opts');
 const { acquireLock } = require('./install-lock');
 
 const NPM_TIMEOUT_MS = 60000;
@@ -48,11 +49,11 @@ function runStep(cmd, args, timeoutMs, prefix, spawnFn, cb, spawnOpts = {}) {
 
   let child;
   try {
-    child = spawnFn(cmd, args, {
+    child = spawnFn(cmd, args, hidden({
       timeout: timeoutMs,
       stdio: ['ignore', 'ignore', 'pipe'],
       ...spawnOpts,
-    });
+    }));
   } catch (e) {
     process.stderr.write(`[code-graph] install step ${cmd} failed to start: ${e.message}\n`);
     done();
@@ -124,7 +125,12 @@ function installBinaryInBackground({
     return findBinary();
   };
 
-  runStep('npm', ['install', '-g', `@sdsrs/code-graph@${version}`], npmTimeoutMs, '[code-graph][npm]', spawnFn, (npmExit) => {
+  // npmInvocation, not a bare ('npm', args, { shell }) pair: on Windows npm is
+  // `npm.cmd` (needs a shell) and passing `args` alongside `shell: true` is
+  // DEP0190 — runtime-deprecated in Node 24, and unescaped. It pre-quotes the
+  // whole command into `file` with empty `args`, and carries windowsHide.
+  const npm = npmInvocation(['install', '-g', `@sdsrs/code-graph@${version}`]);
+  runStep(npm.file, npm.args, npmTimeoutMs, '[code-graph][npm]', spawnFn, (npmExit) => {
     if (resolved()) {
       if (npmExit === 0 && recordGlobalInstall) {
         try { recordGlobalInstall(); } catch { /* marker is best-effort */ }
@@ -140,7 +146,7 @@ function installBinaryInBackground({
       // The child would otherwise try to take the same install lock we hold.
       env: { ...process.env, CODE_GRAPH_INSTALL_LOCK_HELD: '1' },
     });
-  }, NPM_NEEDS_SHELL ? { shell: true } : {});
+  }, npm.opts);
 }
 
 module.exports = { installBinaryInBackground, runStep, NPM_TIMEOUT_MS, GITHUB_TIMEOUT_MS };

package/claude-plugin/scripts/lifecycle.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { claudeHome } = require('./claude-config');
+const { hidden } = require('./proc-opts');
 
 const PLUGIN_ID = 'code-graph-mcp@code-graph-mcp';
 const OLD_PLUGIN_IDS = [
@@ -879,13 +880,13 @@ function verifyHooksFire({ hooks, env, timeoutMs = 4000, tmpBase } = {}) {
   for (const h of probes) {
     let error = null, ok = false, emitted = false, code = null, signal = null;
     try {
-      const r = spawnSync(process.execPath, [h.script], {
+      const r = spawnSync(process.execPath, [h.script], hidden({
         input: JSON.stringify(h.payload || {}),
         cwd: fixture,
         env: baseEnv,
         timeout: timeoutMs,
         encoding: 'utf8',
-      });
+      }));
       code = r.status;
       signal = r.signal;
       ok = !r.error && r.status === 0;
@@ -1061,11 +1062,10 @@ function installedGlobalPkgs() {
 
 function defaultRunNpm(args) {
   const { spawnSync } = require('child_process');
-  const { npmSpawnOpts } = require('./npm-exec');
+  const { npmInvocation } = require('./npm-exec');
   try {
-    const r = spawnSync('npm', args, npmSpawnOpts({
-      timeout: 120000, stdio: 'pipe', encoding: 'utf8',
-    }));
+    const npm = npmInvocation(args, { timeout: 120000, stdio: 'pipe', encoding: 'utf8' });
+    const r = spawnSync(npm.file, npm.args, npm.opts);
     return !r.error && r.status === 0;
   } catch { return false; }
 }
@@ -1311,9 +1311,9 @@ function readActiveProcessCmdlines() {
   } catch { /* fall through to ps */ }
   try {
     const { execFileSync } = require('child_process');
-    return execFileSync('ps', ['-axww', '-o', 'command='], {
+    return execFileSync('ps', ['-axww', '-o', 'command='], hidden({
       encoding: 'utf8', maxBuffer: 8 * 1024 * 1024,
-    }).split('\n').filter(Boolean);
+    })).split('\n').filter(Boolean);
   } catch { /* unsupported platform — caller falls back to recency-only */ }
   return [];
 }

package/claude-plugin/scripts/mcp-launcher.js

@@ -12,6 +12,7 @@ const path = require('path');
 const fs = require('fs');
 const { isNonProjectCwd } = require('./project-detect');
 const { serveEmptyMcpStub } = require('./mcp-stub');
+const { hidden } = require('./proc-opts');
 
 // Set plugin root so find-binary.js can locate bundled/dev binaries
 // Always derive from __dirname — CLAUDE_PLUGIN_ROOT can leak from other plugins
@@ -78,7 +79,7 @@ if (process.env.CODE_GRAPH_FORCE_PLUGIN_MCP !== '1' && isNonProjectCwd(process.c
         const bin = findBinary();
         if (!bin) return null;
         process.stderr.write(`[code-graph] cwd became a project — upgrading plugin MCP to real tools via ${bin} (restart Claude Code for full tool steering)\n`);
-        return spawn(bin, ['serve'], { stdio: ['pipe', 'pipe', 'inherit'], env: process.env });
+        return spawn(bin, ['serve'], hidden({ stdio: ['pipe', 'pipe', 'inherit'], env: process.env }));
       },
     },
   });
@@ -159,7 +160,7 @@ if (!binary) {
         const bin = findBinary();
         if (!bin) return null;
         process.stderr.write(`[code-graph] binary ready at ${bin} — upgrading plugin MCP to real tools (restart Claude Code for full tool steering)\n`);
-        return spawn(bin, ['serve'], { stdio: ['pipe', 'pipe', 'inherit'], env: process.env });
+        return spawn(bin, ['serve'], hidden({ stdio: ['pipe', 'pipe', 'inherit'], env: process.env }));
       },
     },
   });
@@ -205,10 +206,10 @@ try {
 }
 
 // Spawn binary with stdio inheritance for MCP JSON-RPC
-const child = spawn(binary, ['serve'], {
+const child = spawn(binary, ['serve'], hidden({
   stdio: 'inherit',
   env: process.env,
-});
+}));
 
 child.on('error', (err) => {
   process.stderr.write(`[code-graph] Failed to start: ${err.message}\n`);

package/claude-plugin/scripts/npm-exec.js

@@ -3,13 +3,59 @@
 // .cmd without a shell (and Node >= 18.20 throws EINVAL spawning .cmd directly
 // as a CVE-2024-27980 mitigation). Every bare `spawn('npm', ...)` in the
 // install/update flow therefore silently ENOENT'd on Windows while
-// commandExists('npm') (via `where`) said npm was present. All args routed
-// through here are fixed flags / package specs — shell-quoting-safe.
+// commandExists('npm') (via `where`) said npm was present.
+const { hidden } = require('./proc-opts');
+
 const NPM_NEEDS_SHELL = process.platform === 'win32';
 
-/** Merge shell:true into spawn/exec options when the platform needs it. */
-function npmSpawnOpts(opts = {}) {
-  return NPM_NEEDS_SHELL ? { ...opts, shell: true } : opts;
+// Args we are willing to hand to cmd.exe unquoted: flags, package specs,
+// versions, paths. Everything else gets double-quoted; anything that cannot be
+// made safe inside double quotes throws rather than being passed through.
+const SAFE_CMD_ARG = /^[A-Za-z0-9_@./:\\+=-]+$/;
+
+/**
+ * Quote one argument for the `cmd.exe /d /s /c "..."` line Node builds when
+ * `shell: true`. Node itself only space-joins `args` in that mode — the reason
+ * DEP0190 runtime-deprecated the combination in Node 24 — so the joining (and
+ * the quoting) has to happen here.
+ * @param {string} arg
+ * @returns {string}
+ */
+function quoteCmdArg(arg) {
+  const s = String(arg);
+  if (SAFE_CMD_ARG.test(s)) return s;
+  // `"` ends our quoting; `%` and `!` are expanded inside double quotes; CR/LF
+  // splits the command line. None of our call sites produce these — a throw is
+  // a loud bug report, not a user-facing failure path.
+  if (/["%!\r\n]/.test(s)) {
+    throw new Error(`npm argument cannot be safely quoted for cmd.exe: ${JSON.stringify(s)}`);
+  }
+  return `"${s}"`;
+}
+
+/**
+ * Build a child_process invocation for `npm <args>` that is correct on both
+ * platforms. Spread into spawn/spawnSync/execFileSync:
+ *
+ *   const { file, args, opts } = npmInvocation(['root', '-g'], { timeout: 2000 });
+ *   execFileSync(file, args, opts);
+ *
+ * On Windows the whole command is pre-quoted into `file` with an EMPTY `args`
+ * array: passing `args` alongside `shell: true` is DEP0190 (runtime-deprecated
+ * in Node 24 — it space-joins without escaping, which is a shell-injection
+ * hole) and printed a deprecation warning on every npm call.
+ *
+ * @param {string[]} args
+ * @param {object} [opts] - extra child_process options
+ * @returns {{file: string, args: string[], opts: object}}
+ */
+function npmInvocation(args, opts = {}) {
+  if (!NPM_NEEDS_SHELL) return { file: 'npm', args: [...args], opts: hidden(opts) };
+  return {
+    file: ['npm', ...args.map(quoteCmdArg)].join(' '),
+    args: [],
+    opts: hidden({ ...opts, shell: true }),
+  };
 }
 
-module.exports = { npmSpawnOpts, NPM_NEEDS_SHELL };
+module.exports = { npmInvocation, quoteCmdArg, NPM_NEEDS_SHELL };

package/claude-plugin/scripts/pr-impact-comment.js

@@ -16,6 +16,7 @@
 // cg-answer.js).
 
 const { spawnSync } = require('child_process');
+const { hidden } = require('./proc-opts');
 
 const MARKER = '<!-- code-graph-impact-review -->';
 const SPAWN_TIMEOUT_MS = 60_000;
@@ -88,7 +89,7 @@ function resolveBinary() {
 }
 
 function runAffected(binary, args, cwd, stdin) {
-  const res = spawnSync(binary, args, {
+  const res = spawnSync(binary, args, hidden({
     cwd,
     input: stdin,
     timeout: SPAWN_TIMEOUT_MS,
@@ -96,7 +97,7 @@ function runAffected(binary, args, cwd, stdin) {
     maxBuffer: 16 * 1024 * 1024,
     stdio: ['pipe', 'pipe', 'ignore'],
     env: { ...process.env, CODE_GRAPH_INTERNAL: '1' },
-  });
+  }));
   if (res.error || res.signal || res.status !== 0) return null;
   try {
     return JSON.parse((res.stdout || '').trim());
@@ -201,10 +202,10 @@ function renderMarkdown(review) {
 /// Upsert a sticky comment: find an existing comment containing MARKER and PATCH
 /// it, else POST a new one. Uses `gh api` (preinstalled on GitHub runners).
 function upsertComment(repo, prNumber, body) {
-  const gh = (args, input) => spawnSync('gh', args, {
+  const gh = (args, input) => spawnSync('gh', args, hidden({
     encoding: 'utf8', input, timeout: SPAWN_TIMEOUT_MS,
     env: { ...process.env },
-  });
+  }));
 
   const list = gh(['api', '--paginate', `repos/${repo}/issues/${prNumber}/comments`]);
   let existingId = null;

package/claude-plugin/scripts/pre-edit-guide.js

@@ -15,6 +15,7 @@ const { resolveProjectRoot } = require('./project-root');
 const { recordRecommendation } = require('./recommendation-log');
 const { formatCoveringTests } = require('./covering-tests');
 const { emitPreToolAllowContext } = require('./hook-emit');
+const { hidden } = require('./proc-opts');
 
 // v0.49 — walk up from the shell cwd (subdir-cwd fix). The per-cwd index.db
 // gate kept this hook dark for entire sessions after `cd backend/` — daagu
@@ -81,10 +82,10 @@ if (!symbol || symbol.length < 3) {
         .sort((a, b) => b.length - a.length);
       for (const candidate of candidates.slice(0, 5)) {
         try {
-          const raw = execFileSync(binary, ['grep', candidate, filePath, '--json'], {
+          const raw = execFileSync(binary, ['grep', candidate, filePath, '--json'], hidden({
             cwd, timeout: 2000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
             env: internalEnv,
-          });
+          }));
           const grepResult = JSON.parse(raw);
           // Pick this candidate if it has few matches (precise location)
           const withContainer = (grepResult || []).filter(m => m.container && m.container.name);
@@ -136,13 +137,13 @@ try {
   if (relFile && !relFile.startsWith('..')) args.push('--file', relFile);
   // v0.49 — use the resolved binary (bare 'code-graph-mcp' was PATH-dependent,
   // diverging from the findBinary() result the rest of the hook trusts).
-  const raw = execFileSync(binary, args, {
+  const raw = execFileSync(binary, args, hidden({
     cwd,
     timeout: 2500,
     encoding: 'utf8',
     stdio: ['pipe', 'pipe', 'pipe'],
     env: internalEnv,
-  });
+  }));
   jsonResult = JSON.parse(raw);
 } catch {
   // Symbol not found, timeout, or parse error — exit silently

package/claude-plugin/scripts/proc-opts.js

@@ -0,0 +1,27 @@
+'use strict';
+/**
+ * Child-process option defaults shared by every spawn/exec in this plugin.
+ *
+ * Windows creates a NEW visible console window for every console-subsystem
+ * child whose parent has no console of its own — and none of our parents do:
+ * the MCP server (`node mcp-launcher.js`), the hooks and the statusline are all
+ * launched hidden by Claude Code. Node's `windowsHide` defaults to `false` on
+ * EVERY child_process API (spawn/spawnSync/exec/execSync/execFile/execFileSync),
+ * so each `where` / `curl` / `tar` / `npm` child flashed a console window for
+ * ~1s and stole keyboard focus. Reported as 5–7 flashes per session start
+ * (issue #40); the auto-update treadmill fixed alongside it made that per
+ * session, forever.
+ *
+ * `windowsHide: true` maps to CREATE_NO_WINDOW, which only stops the child from
+ * ALLOCATING a console — inherited stdio handles still work, so an interactive
+ * `doctor` run in a real terminal is unaffected. No-op on non-Windows.
+ *
+ * Every child_process call site under claude-plugin/scripts/ must route through
+ * here (or set windowsHide itself); `windows-hide.test.js` fails the build on a
+ * new call site that doesn't.
+ */
+function hidden(opts = {}) {
+  return { windowsHide: true, ...opts };
+}
+
+module.exports = { hidden };

package/claude-plugin/scripts/session-init.js

@@ -11,6 +11,7 @@ const {
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const { maybeAutoAdopt, isAdopted, unadopt } = require('./adopt');
 const { isNonProjectCwd } = require('./project-detect');
+const { hidden } = require('./proc-opts');
 
 // v0.17.0 — quietHooks: unconditional quiet 默认。
 // 项目地图与 MEMORY.md plugin contract + on-demand `project_map` 工具高度重叠，
@@ -168,16 +169,20 @@ function formatRecentImpact(changed, affected, dependentCap = 6) {
 
 function launchBackgroundAutoUpdate(spawnFn = spawn, env = process.env, { force = false } = {}) {
   try {
+    // Documented opt-out (issue #40). Checked HERE as well as inside
+    // auto-update.js so an opted-out user doesn't pay for a node process per
+    // session just to have it exit immediately.
+    if (env.CODE_GRAPH_NO_AUTO_UPDATE === '1') return false;
     const args = [path.join(__dirname, 'auto-update.js'), 'check', '--silent'];
     // A session start / reload forces an immediate check (bypasses the soft
     // throttle down to auto-update.js's short anti-hammer floor + rate-limit
     // backoff), so an available update is picked up now rather than on the next tick.
     if (force) args.push('--force');
-    const child = spawnFn(process.execPath, args, {
+    const child = spawnFn(process.execPath, args, hidden({
       detached: true,
       stdio: 'ignore',
       env: { ...env, CODE_GRAPH_AUTO_UPDATE_SILENT: '1' },
-    });
+    }));
     if (child && typeof child.unref === 'function') child.unref();
     return true;
   } catch {
@@ -322,7 +327,7 @@ function indexNeedsRevalidation(bin, cwd) {
     let out;
     try {
       out = execFileSync(bin, ['health-check', '--format', 'json'],
-        { cwd, timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'] }).toString();
+        hidden({ cwd, timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'] })).toString();
     } catch (e) {
       // health-check exits non-zero on an unhealthy index but still writes JSON.
       out = ((e && e.stdout) || '').toString();
@@ -363,7 +368,7 @@ function ensureIndexFresh() {
   try {
     const dbMtime = fs.statSync(dbPath).mtimeMs;
     const gitTs = parseInt(
-      execSync('git log -1 --format=%ct', { cwd, timeout: 2000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }).trim()
+      execSync('git log -1 --format=%ct', hidden({ cwd, timeout: 2000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] })).trim()
     ) * 1000;
     if (gitTs > dbMtime) needsRefresh = true;
   } catch { /* no git / not a repo — fall through to the version probe */ }
@@ -373,11 +378,11 @@ function ensureIndexFresh() {
 
   if (!needsRefresh) return 'fresh';
 
-  const child = spawn(bin, ['incremental-index', '--quiet'], {
+  const child = spawn(bin, ['incremental-index', '--quiet'], hidden({
     cwd,
     detached: true,
     stdio: 'ignore',
-  });
+  }));
   if (child && typeof child.unref === 'function') child.unref();
   return 'refreshing';
 }
@@ -415,7 +420,7 @@ function verifyBinary() {
   // On macOS, verify the binary can actually run (Gatekeeper may block it)
   if (process.platform === 'darwin') {
     try {
-      execFileSync(binary, ['--version'], { timeout: 3000, stdio: 'pipe' });
+      execFileSync(binary, ['--version'], hidden({ timeout: 3000, stdio: 'pipe' }));
     } catch (err) {
       const msg = (err.message || '') + (err.stderr ? err.stderr.toString() : '');
       if (msg.includes('quarantine') || msg.includes('not permitted') ||
@@ -674,7 +679,7 @@ function injectProjectMap() {
     const bin = findBinary();
     if (!bin) return false;
 
-    const output = execFileSync(bin, ['map', '--compact'], {
+    const output = execFileSync(bin, ['map', '--compact'], hidden({
       cwd,
       timeout: 5000,
       encoding: 'utf8',
@@ -682,7 +687,7 @@ function injectProjectMap() {
       // Hook-internal delivery, not a model conversion — keep record_cli_use from
       // logging this `map` run as a phantom `use` (mirror injectRecentImpact's affected call).
       env: { ...process.env, CODE_GRAPH_INTERNAL: '1' },
-    });
+    }));
 
     if (output && output.trim()) {
       process.stdout.write(
@@ -723,7 +728,7 @@ function injectRecentImpact({ source } = {}) {
     // last commit. Timeouts tightened (finding #1): worst-case cap sum is now
     // status(1s) + HEAD~1(1s) + affected(1.5s) = 3.5s, comfortably under the 5s
     // SessionStart hook budget; the old 2+2+3=7s could get the whole hook killed.
-    const gitOpts = { cwd: sessionDir, timeout: 1000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] };
+    const gitOpts = hidden({ cwd: sessionDir, timeout: 1000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
     let changed = [];
     let isWip = false;
     try {
@@ -749,10 +754,10 @@ function injectRecentImpact({ source } = {}) {
 
     let affected;
     try {
-      const raw = execFileSync(bin, ['affected', ...changed, '--json'], {
+      const raw = execFileSync(bin, ['affected', ...changed, '--json'], hidden({
         cwd, timeout: 1500, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
         env: { ...process.env, CODE_GRAPH_INTERNAL: '1' },
-      });
+      }));
       affected = JSON.parse(raw);
     } catch {
       return false;
@@ -803,9 +808,9 @@ function checkHookFiring({ now = Date.now() } = {}) {
       // surface from the next start. Re-checks daily (catches post-install drift,
       // e.g. a node upgrade that breaks a hook).
       try {
-        const child = spawn(process.execPath, [path.join(__dirname, 'lifecycle.js'), 'verify-hooks-fire'], {
+        const child = spawn(process.execPath, [path.join(__dirname, 'lifecycle.js'), 'verify-hooks-fire'], hidden({
           detached: true, stdio: 'ignore',
-        });
+        }));
         if (child && typeof child.unref === 'function') child.unref();
       } catch { /* ok */ }
     }

package/claude-plugin/scripts/statusline-composite.js

@@ -9,6 +9,7 @@ const { execFileSync } = require('child_process');
 const path = require('path');
 const os = require('os');
 const lifecycle = require('./lifecycle');
+const { hidden } = require('./proc-opts');
 const { readRegistry } = lifecycle;
 const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() => ({ cleaned: false }));
 
@@ -79,12 +80,12 @@ function runProvider(command, needsStdin, stdin) {
     const cwd = cwdFromStdin(stdin);
     const env = cwd ? { ...process.env, CODE_GRAPH_STATUSLINE_CWD: cwd } : process.env;
 
-    const out = execFileSync(argv[0], argv.slice(1), {
+    const out = execFileSync(argv[0], argv.slice(1), hidden({
       timeout: 3000,
       stdio: ['pipe', 'pipe', 'pipe'],
       input: needsStdin ? stdin : '',
       env,
-    }).toString().trim();
+    })).toString().trim();
 
     return out || null;
   } catch { return null; }

package/claude-plugin/scripts/statusline.js

@@ -7,6 +7,7 @@ const path = require('path');
 const { findBinary } = require('./find-binary');
 const { resolveProjectRoot } = require('./project-root');
 const lifecycle = require('./lifecycle');
+const { hidden } = require('./proc-opts');
 const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() => ({ cleaned: false }));
 
 // True when auto-update has a newer release queued or in flight (the background
@@ -155,14 +156,14 @@ try {
   // health-check (e.g. CPU saturated by the embedding backfill) and the segment
   // silently vanished. Keeping the inner budget well under the outer one turns
   // "slow health-check" into a rendered "offline"/"updating" instead of a blank.
-  report = parseReport(execFileSync(bin, ['health-check', '--format', 'json'], {
+  report = parseReport(execFileSync(bin, ['health-check', '--format', 'json'], hidden({
     timeout: 1500,
     stdio: ['pipe', 'pipe', 'pipe'],
     // Run the binary FROM the resolved root so its own project-root resolution
     // lands on the same DB the gate above picked (a subdir cwd would otherwise
     // re-resolve to a stray nested index inside the binary).
     cwd: root
-  }).toString());
+  })).toString());
 } catch (e) {
   // health-check exits NON-ZERO on an unhealthy/empty index but still writes the
   // full JSON report to stdout. The binary ran fine \u2014 recover the report from the

package/claude-plugin/scripts/user-prompt-context.js

@@ -13,6 +13,7 @@ const os = require('os');
 // diagnostic blindness + the §8 recursive-grep footgun (see tmp-dir.js). The
 // other hook scripts already route through here; this one was the lone holdout.
 const { cgTmpDir } = require('./tmp-dir');
+const { hidden } = require('./proc-opts');
 
 // Mid-session install detection: hook fires but no manifest yet.
 const MANIFEST_PATH = path.join(os.homedir(), '.cache', 'code-graph', 'install-manifest.json');
@@ -467,13 +468,13 @@ function runMain() {
   };
 
   function run(cmd, args) {
-    return execFileSync(cmd, args, {
+    return execFileSync(cmd, args, hidden({
       cwd,
       timeout: 3000,
       encoding: 'utf8',
       stdio: ['pipe', 'pipe', 'pipe'],
       env: buildRunEnv(),
-    });
+    }));
   }
 
   try {

package/claude-plugin/scripts/version-utils.js

@@ -2,6 +2,7 @@
 const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
+const { hidden } = require('./proc-opts');
 
 // Tolerant match: the version line anywhere in the output (m flag), optional
 // "v" prefix, and anything after the numeric triple (build-metadata suffixes
@@ -13,12 +14,12 @@ const VERSION_OUTPUT_RE = /^code-graph-mcp\s+v?(\d+\.\d+\.\d+)/m;
 
 function readBinaryVersion(binaryPath) {
   try {
-    const out = execFileSync(binaryPath, ['--version'], {
+    const out = execFileSync(binaryPath, ['--version'], hidden({
       // 5s: a cold exec of a freshly-written ~40MB binary (page-in, Windows AV
       // scan) regularly exceeded the old 2s, misclassifying a good binary.
       timeout: 5000,
       stdio: ['pipe', 'pipe', 'pipe'],
-    }).toString().trim();
+    })).toString().trim();
     const match = out.match(VERSION_OUTPUT_RE);
     return match ? match[1] : null;
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.109.0",
+  "version": "0.111.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.109.0",
-    "@sdsrs/code-graph-linux-arm64": "0.109.0",
-    "@sdsrs/code-graph-darwin-x64": "0.109.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.109.0",
-    "@sdsrs/code-graph-win32-x64": "0.109.0"
+    "@sdsrs/code-graph-linux-x64": "0.111.0",
+    "@sdsrs/code-graph-linux-arm64": "0.111.0",
+    "@sdsrs/code-graph-darwin-x64": "0.111.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.111.0",
+    "@sdsrs/code-graph-win32-x64": "0.111.0"
   }
 }