@sdsrs/code-graph 0.111.0 → 0.112.0

package/README.md

@@ -5,14 +5,16 @@ A high-performance code knowledge graph server implementing the [Model Context P
 ## Features
 
 - **Multi-language parsing** — Tree-sitter AST extraction across tiers of depth:
-  - **Full** (calls + imports + inheritance + test markers): TypeScript/TSX, JavaScript, Go, Python, Rust, Java. HTTP route extraction additionally covers TypeScript/TSX + JavaScript (Express/Connect), Go (`net/http`), and Python (Flask/FastAPI) only — Rust and Java web frameworks are not yet route-extracted
+  - **Full** (calls + imports + inheritance): TypeScript/TSX, JavaScript, Go, Python, Rust, Java. HTTP route extraction additionally covers TypeScript/TSX + JavaScript (Express/Connect), Go (`net/http`), Python (Flask/FastAPI), and Rust axum (`.route()` chains with inline `.nest()` prefixes; named handlers only) — actix/rocket and Java Spring are not yet route-extracted
   - **Smoke-tested** (calls + imports + inheritance): C#, Kotlin, Ruby, PHP, Swift, Dart
-  - **Limited** (functions + calls + `#include` imports + gtest test markers + C++ base-class inheritance; `Class::method` scope qualification deferred): C, C++
+  - **Limited** (functions + calls + `#include` imports + gtest test markers + C++ base-class inheritance + `Class::method` scope qualification): C, C++
   - **Scripting**: Bash (functions + commands + `source`/`.` imports), Markdown (headings)
   - **File-FTS only** (no AST symbol extraction): HTML, CSS, JSON
+  - **Test markers** — detected from the AST for Rust (`#[test]` / `#[cfg(test)]`), JavaScript/TypeScript/TSX (`describe`/`it`/`test` blocks and their callbacks) and C/C++ (gtest `TEST` macros). Go, Python, Java and the rest fall back to path/name heuristics (`tests/`, `src/test/java/`, `*_test.*`, `*.test.js`, `test_*`, `*Test`)
+  - **Value/type references** — a `references` relation for symbols that are used without being called, imported or inherited (path-qualified constants, type-position uses, functions passed as values): Rust, TypeScript/TSX, JavaScript, Python, Go, Java, C, C++
 - **Semantic code search** — Hybrid BM25 full-text + vector semantic search with Reciprocal Rank Fusion (RRF), powered by sqlite-vec
 - **Call graph traversal** — Recursive CTE queries to trace callers/callees with cycle detection
-- **HTTP route tracing** — Map route paths to backend handler functions (Express, Flask/FastAPI, Go `net/http`)
+- **HTTP route tracing** — Map route paths to backend handler functions (Express, Flask/FastAPI, Go `net/http`, Rust axum)
 - **Dead code detection** — Find unreferenced symbols with smart Orphan/Exported-Unused classification
 - **Impact analysis** — Determine the blast radius of code changes by tracing all dependents
 - **Incremental indexing** — Merkle tree change detection with file system watcher for real-time updates. Smart event filtering skips metadata-only changes (chmod, xattr)
@@ -36,11 +38,11 @@ Combines BM25 full-text ranking (FTS5) with vector semantic similarity (sqlite-v
 
 ### Scope-Aware Relation Extraction
 
-The parser doesn't just find function calls — it tracks them within their proper scope context. Extracts calls, imports, inheritance, interface implementations, exports, and HTTP route bindings. Same-file targets are preferred over cross-file matches to minimize false-positive edges.
+The parser doesn't just find function calls — it tracks them within their proper scope context. Extracts calls, imports, inheritance, interface implementations, exports (ESM `export` **and** CommonJS `module.exports = { … }` / `exports.name = …`), value/type references, and HTTP route bindings. Same-file targets are preferred over cross-file matches to minimize false-positive edges.
 
 ### HTTP Request Flow Tracing
 
-Unique to code-graph-mcp: trace from `GET /api/users` → route handler → service layer → database call in a single query. Supports Express, Flask/FastAPI, and Go HTTP frameworks.
+Unique to code-graph-mcp: trace from `GET /api/users` → route handler → service layer → database call in a single query. Supports Express/Connect, Flask/FastAPI, Go `net/http`, and Rust axum.
 
 ### Zero External Dependencies at Runtime
 
@@ -73,10 +75,10 @@ Real-world benchmarks comparing code-graph-mcp tools against traditional approac
 | Project architecture overview | 5-8 calls | 1 call (`project_map`) | **~85%** |
 | Find function by concept | 3-5 calls | 1 call (`semantic_code_search`) | **~75%** |
 | Trace 2-level call chain | 8-15 calls | 1 call (`get_call_graph`) | **~90%** |
-| Pre-change impact analysis | 10-20+ calls | 1 call (`impact_analysis`) | **~95%** |
+| Pre-change impact analysis | 10-20+ calls | 1 call (`get_ast_node` + `include_impact`) | **~95%** |
 | Module structure & exports | 5+ calls | 1 call (`module_overview`) | **~80%** |
-| File dependency mapping | 3-5 calls | 1 call (`dependency_graph`) | **~75%** |
-| Similar code detection | N/A | 1 call (`find_similar_code`) | **unique** |
+| File dependency mapping | 3-5 calls | 1 call (`module_overview` + `include_deps`) | **~75%** |
+| Similar code detection | N/A | 1 call (`get_ast_node` + `include_similar`) | **unique** |
 
 ### Overall Session Efficiency
 
@@ -160,9 +162,11 @@ Then reconnect the MCP server in Claude Code with `/mcp`.
 Set it in the `env` block of `~/.claude/settings.json` (the environment of the
 process hosting the MCP server), then reconnect with `/mcp`.
 
-An update that keeps failing also stops retrying on its own: after 5 failed
-attempts at the *same* release, the updater goes check-only until a newer
-release is published. Run `code-graph-mcp doctor` to see the state.
+An update that keeps failing also stops hammering: after 5 failed attempts at
+the *same* release the updater drops to one retry per day (and retries
+immediately when a newer release is published), instead of re-downloading on
+every session. While it is in that state the statusline shows `⚠ update stuck`
+and `code-graph-mcp doctor` prints the manual update command.
 
 #### Invited-memory mode (quieter prompts)
 
@@ -261,20 +265,19 @@ npm uninstall -g @sdsrs/code-graph
 
 ## MCP Tools
 
+`tools/list` advertises exactly these seven. Several older niche tools were folded into flags on them, so one call now covers what used to take a separate tool:
+
 | Tool | Description |
 |------|-------------|
-| `project_map` | Full project architecture: modules, dependencies, entry points, hot functions |
-| `semantic_code_search` | Hybrid BM25 + vector + graph search for AST nodes |
-| `get_call_graph` | Trace upstream/downstream call chains for a function |
-| `trace_http_chain` | Full request flow: route → handler → downstream call chain |
-| `impact_analysis` | Analyze the blast radius of changing a symbol |
-| `module_overview` | High-level overview of a module's structure and exports |
-| `dependency_graph` | Visualize dependency relationships between modules. Supports `compact` mode |
-| `find_similar_code` | Find semantically similar code via embeddings. Requires `symbol_name` or `node_id` |
-| `get_ast_node` | Extract a specific code symbol with signature, body, and relations. Supports `compact` mode |
+| `project_map` | Full project architecture: modules, dependencies, entry points, hot functions. `include_centrality` adds architectural chokepoints |
+| `semantic_code_search` | Hybrid BM25 + vector search (RRF) for AST nodes. Supports `compact` mode |
+| `get_call_graph` | Trace upstream/downstream call chains for a function. Pass `route_path='GET /api/x'` to trace an HTTP route → handler → downstream instead |
+| `get_ast_node` | One symbol with signature, body and relations. `include_impact` adds the blast radius, `include_similar` embedding-similar nodes, `include_references` callers/callees. Supports `compact` mode |
+| `module_overview` | Symbols in a directory or file, grouped by type and caller count. `include_dead` lists unreferenced symbols under the path; `include_deps` adds the file dependency graph (single-file paths only) |
 | `ast_search` | Search AST nodes by text and/or structural filters (type, return type, params) |
-| `find_references` | Find all references to a symbol (callers, importers, inheritors). Supports `compact` mode |
-| `find_dead_code` | Find unused code — orphan symbols and exported-but-unused public APIs |
+| `find_references` | Find all references to a symbol (callers, importers, inheritors, implementors, value/type references). Supports `compact` mode |
+
+**Hidden aliases.** These names are not in `tools/list` but still dispatch via `tools/call`, so existing clients keep working: `trace_http_chain` / `find_http_route` (→ `get_call_graph` with `route_path`), `read_snippet` (→ `get_ast_node`), `dependency_graph`, `find_similar_code`, `find_dead_code`, plus the management tools `start_watch`, `stop_watch`, `get_index_status` and `rebuild_index`. `impact_analysis` is **removed** — calling it returns `Unknown tool`; use `get_ast_node` with `include_impact=true`, or the CLI's `impact --json` for the full report.
 
 ## CLI Commands
 
@@ -285,15 +288,15 @@ All tools are also available as CLI subcommands for shell scripts, hooks, and te
 | `search <query>` | `semantic_code_search` | FTS5 search by concept |
 | `ast-search [query]` | `ast_search` | Structural search with `--type`/`--returns`/`--params` filters |
 | `callgraph <symbol>` | `get_call_graph` | Show call graph (callers/callees) |
-| `impact <symbol>` | `impact_analysis` | Impact analysis (callers, routes, risk level) |
+| `impact <symbol>` | `get_ast_node` (`include_impact=true`) | Impact analysis (callers, routes, risk level) |
 | `show <symbol>` | `get_ast_node` | Show symbol details (code, type, signature) |
 | `map` | `project_map` | Project architecture map |
 | `overview <path>` | `module_overview` | Module symbols grouped by file and type |
-| `deps <file>` | `dependency_graph` | File-level dependency graph |
-| `trace <route>` | `trace_http_chain` | Trace HTTP route → handler → downstream calls |
-| `similar <symbol>` | `find_similar_code` | Find semantically similar code (requires embeddings) |
+| `deps <file>` | `module_overview` (`include_deps=true`) | File-level dependency graph |
+| `trace <route>` | `get_call_graph` (`route_path=…`) | Trace HTTP route → handler → downstream calls |
+| `similar <symbol>` | `get_ast_node` (`include_similar=true`) | Find semantically similar code (requires embeddings) |
 | `refs <symbol>` | `find_references` | Find all references to a symbol |
-| `dead-code [path]` | `find_dead_code` | Find unused code (orphans and exported-unused) |
+| `dead-code [path]` | `module_overview` (`include_dead=true`) | Find unused code (orphans and exported-unused) |
 | `grep <pattern>` | — | AST-context grep (ripgrep + containing function/class) |
 | `incremental-index` | — | Run incremental index update (auto-creates DB if needed) |
 | `health-check` | `get_index_status` | Query index status and freshness |
@@ -319,20 +322,20 @@ Available when installed as a Claude Code plugin:
 
 | Language | Extensions | Relations Extracted |
 |----------|-----------|-------------------|
-| TypeScript | .ts, .tsx | calls, imports, exports, inherits, implements, routes_to |
-| JavaScript | .js, .jsx, .mjs, .cjs | calls, imports, exports, inherits, routes_to |
-| Go | .go | calls, imports, inherits, routes_to |
-| Python | .py, .pyi | calls, imports, inherits, routes_to |
-| Rust | .rs | calls, imports, inherits, implements |
-| Java | .java | calls, imports, inherits, implements |
+| TypeScript | .ts, .tsx | calls, imports, exports, inherits, implements, routes_to, references |
+| JavaScript | .js, .jsx, .mjs, .cjs | calls, imports, exports (ESM + CommonJS), inherits, routes_to, references |
+| Go | .go | calls, imports, inherits, routes_to, references |
+| Python | .py, .pyi | calls, imports, inherits, routes_to, references |
+| Rust | .rs | calls, imports, implements, routes_to (axum), references |
+| Java | .java | calls, imports, inherits, implements, references |
 | C# | .cs | calls, imports, inherits, implements |
 | Kotlin | .kt, .kts | calls, imports, inherits |
 | Ruby | .rb | calls, imports, inherits |
 | PHP | .php | calls, imports, inherits, implements |
 | Swift | .swift | calls, imports, inherits |
 | Dart | .dart | calls, imports, inherits, implements |
-| C | .c, .h | calls, imports |
-| C++ | .cpp, .cc, .cxx, .hpp | calls, imports, inherits |
+| C | .c, .h | calls, imports, references |
+| C++ | .cpp, .cc, .cxx, .hpp, .hh, .hxx | calls, imports, inherits, references |
 | Bash | .sh, .bash | functions, commands, `source`/`.` imports |
 | Markdown | .md, .mdx, .markdown | headings |
 | HTML | .html, .htm | file-FTS only (no AST symbols) |
@@ -340,6 +343,7 @@ Available when installed as a Claude Code plugin:
 | JSON | .json | file-FTS only (no AST symbols) |
 
 **Known limitations:**
+- **Rust has no `inherits` edges** — the language has no class inheritance, so `impl Trait for Type` is recorded as `implements` and an `inherits`-filtered query returns empty for Rust.
 - **Kotlin/Swift interface conformance** is recorded as `inherits` (both use a single `: Type` grammar for base classes and protocols/interfaces), so `implements`-filtered queries return empty for these two languages.
 - **Cross-file dead-code detection** may false-positive a type whose only cross-file reference sits beyond the 4096-byte stored-content cap per node (documented accepted limitation, v0.97.1).
 

package/bin/cli.js

@@ -131,9 +131,14 @@ if (!binary) {
 }
 
 // Spawn the binary, forwarding stdio for MCP JSON-RPC communication
+// windowsHide as a literal rather than via claude-plugin/scripts/proc-opts:
+// this file is the npm package's bin entry and ships in tarballs that may not
+// carry claude-plugin/. Same meaning — CREATE_NO_WINDOW, so a console-less
+// parent (the MCP client) does not flash a window; inherited stdio still works.
 const child = spawn(binary, process.argv.slice(2), {
   stdio: "inherit",
   env: process.env,
+  windowsHide: true,
 });
 
 child.on("error", (err) => {

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.111.0",
+  "version": "0.112.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -57,6 +57,20 @@ const FETCH_TIMEOUT_MS = 3000;
 // STUCK_UPDATE_ATTEMPTS (drift-guarded in statusline.test.js) so the moment the
 // updater gives up is the moment the statusline stops promising "↻ updating".
 const MAX_UPDATE_ATTEMPTS = 5;
+// ...but suspension is not permanent. The cap alone assumed every repeated
+// failure is permanent, and the causes are not distinguishable at the failure
+// site: a briefly-missing `.sha256` sidecar, a captive portal, a temporarily
+// full disk burn the budget just as fast as a broken tar — and SessionStart
+// forces a check with only a 2-minute floor, so ~5 Claude Code restarts in ~10
+// minutes exhaust it. Before this, recovery required a NEWER release (or
+// hand-deleting update-state.json, which nothing tells the user to do), so a
+// ten-minute outage could park the updater for days. One retry per day keeps
+// the per-session treadmill dead while guaranteeing self-heal.
+//
+// Note the retry can NOT be keyed to `--force`: session-init passes --force on
+// every session start, so re-arming there would restore the exact treadmill
+// this cap exists to stop.
+const SUSPENSION_RETRY_MS = 24 * 60 * 60 * 1000;
 
 function isSilentMode(argv = process.argv.slice(2), env = process.env) {
   return argv.includes('--silent') || env.CODE_GRAPH_AUTO_UPDATE_SILENT === '1';
@@ -880,8 +894,17 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
       // always starts with a full budget. The counter used to be unscoped, which
       // only mattered because nothing ever read it: the download chain re-ran on
       // every single session no matter how many times it had already failed.
-      const attempts = state.latestVersion === latest.version ? (state.updateAttempts || 0) : 0;
-      if (attempts >= MAX_UPDATE_ATTEMPTS) {
+      const sameTarget = state.latestVersion === latest.version;
+      const attempts = sameTarget ? (state.updateAttempts || 0) : 0;
+      // A suspended release gets one retry per day (SUSPENSION_RETRY_MS), so a
+      // transient cause — sidecar blip, captive portal, briefly-full disk —
+      // heals itself instead of parking the updater until the next release.
+      // Spend the retry by entering the attempt path with the budget one short:
+      // if it fails again it re-suspends immediately (and re-stamps the clock),
+      // costing at most one download per day rather than one per session.
+      const suspendedAt = sameTarget && state.suspendedAt ? Date.parse(state.suspendedAt) : NaN;
+      const retryDue = Number.isFinite(suspendedAt) && (Date.now() - suspendedAt) >= SUSPENSION_RETRY_MS;
+      if (attempts >= MAX_UPDATE_ATTEMPTS && !retryDue) {
         // Suspended — check-only from here until a newer release moves the
         // target. The one thing still worth attempting is a MISSING cached
         // binary: without it the MCP server has no engine at all, so that
@@ -895,19 +918,44 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
           latestVersion: latest.version,
           updateAvailable: true,
           updateAttempts: attempts,
+          // Stamp on ENTRY to suspension, then leave it alone: the retry clock
+          // must measure time since we gave up, not time since the last check
+          // (which every session would reset, making the retry unreachable).
+          suspendedAt: (sameTarget && state.suspendedAt) || new Date().toISOString(),
           rateLimited: false,
           binaryUpdated: healedMissing || state.binaryUpdated,
         });
         console.error(
           `[code-graph] Auto-update to v${latest.version} suspended after ${attempts} failed attempts on this machine. ` +
           'Update manually (`/plugin update code-graph-mcp`, or `npm install -g @sdsrs/code-graph`) or run `code-graph-mcp doctor`. ' +
-          'Retries resume automatically when a newer release is published.'
+          'Retried automatically once a day, and immediately when a newer release is published.'
         );
         return { updateAvailable: true, suspended: true, from: installedVersion, to: latest.version };
       }
       const result = await downloadAndInstall(latest);
       const success = result.pluginUpdated;
+      // Suspension clock. It restarts when the daily retry is spent and fails,
+      // which is what keeps `retryDue` from staying true and turning the retry
+      // back into a per-session treadmill; it clears on success and on a new
+      // target version, so a stale stamp from the previous release cannot make
+      // the next one look instantly retry-due.
+      let nextSuspendedAt;
+      if (success) nextSuspendedAt = null;
+      else if (retryDue) nextSuspendedAt = new Date().toISOString();
+      else if (!sameTarget) nextSuspendedAt = null;
+      else nextSuspendedAt = state.suspendedAt || null;
       const newState = {
+        // Carry the prior state forward. Every OTHER saveState in this function
+        // spreads `...state`; this one rebuilt from scratch, so any key it does
+        // not name was dropped on every update check that found a new release.
+        // The keys that matter are selfHealGlobalPkgs' — globalPkgHealAttempts /
+        // globalPkgHealVersion — because that function returns `{}` once the
+        // attempt cap is hit, meaning the spread below contributes nothing and
+        // the counter reset to zero. A capped-out global heal therefore got a
+        // fresh budget on every release, which is precisely the retry treadmill
+        // the cap exists to stop. Keys this object sets are overwritten below;
+        // nothing stale leaks through.
+        ...state,
         lastCheck: new Date().toISOString(),
         installedVersion: success ? latest.version : installedVersion,
         latestVersion: latest.version,
@@ -918,6 +966,7 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
         // forever, asserting a self-heal that never happens. The statusline stops
         // trusting it past STUCK_UPDATE_ATTEMPTS; success resets to 0.
         updateAttempts: success ? 0 : attempts + 1,
+        suspendedAt: nextSuspendedAt,
         lastUpdate: success ? new Date().toISOString() : state.lastUpdate,
         rateLimited: false,
         binaryUpdated: result.binaryUpdated,
@@ -955,6 +1004,16 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
       lastCheck: new Date().toISOString(),
       latestVersion: latest.version,
       updateAvailable: false,
+      // Reaching here means the installed shell IS the latest release, so any
+      // failure record describes an update that is no longer pending. Leaving it
+      // set kept `doctor` warning "vX failed to install 5× — auto-retry
+      // throttled" about a version already installed, and left a suspension
+      // stamp that the next release then had to age out. The common way to get
+      // here from a suspended state is the manual route the suspension notice
+      // itself recommends (`npm install -g` / `/plugin update`) — the updater
+      // has to notice that its advice was taken.
+      updateAttempts: 0,
+      suspendedAt: null,
       rateLimited: false,
       binaryUpdated: selfHealedBinary || state.binaryUpdated,
       ...globalHeal,

package/claude-plugin/scripts/doctor.js

@@ -214,7 +214,7 @@ function runDiagnostics({ checkOnly = false } = {}) {
       results.push({
         name: 'Auto-update',
         status: 'warn',
-        detail: `v${state.latestVersion} failed to install ${attempts}× — auto-retry suspended until a newer release. `
+        detail: `v${state.latestVersion} failed to install ${attempts}× — auto-retry throttled to once a day. `
           + 'Update manually: `npm install -g @sdsrs/code-graph` (or `/plugin update code-graph-mcp`)',
       });
     } else if (state && state.updateAvailable && state.binaryUpdated === false) {
@@ -482,9 +482,9 @@ function relicRepairGuard({ log = console.log, relic = undefined } = {}) {
 function detectEmbedModel(binary, run = execFileSync) {
   if (!binary) return null;
   try {
-    const out = run(binary, ['health-check', '--json'], {
+    const out = run(binary, ['health-check', '--json'], hidden({
       timeout: 10000, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
-    });
+    }));
     return JSON.parse(out).model_available === true;
   } catch { return null; }
 }

package/claude-plugin/scripts/launcher-install.js

@@ -129,7 +129,20 @@ function installBinaryInBackground({
   // `npm.cmd` (needs a shell) and passing `args` alongside `shell: true` is
   // DEP0190 — runtime-deprecated in Node 24, and unescaped. It pre-quotes the
   // whole command into `file` with empty `args`, and carries windowsHide.
-  const npm = npmInvocation(['install', '-g', `@sdsrs/code-graph@${version}`]);
+  // try/catch because quoteCmdArg THROWS on an argument it cannot quote, and
+  // `version` is read from plugin.json — our own file, but a parse of somebody
+  // else's disk. Uncaught, the throw escapes mcp-launcher.js and kills the MCP
+  // server AFTER the 0-tool stub is already serving, turning a bad version
+  // string into a dead server instead of a failed install. Every sibling call
+  // in auto-update.js is already inside a try.
+  let npm;
+  try {
+    npm = npmInvocation(['install', '-g', `@sdsrs/code-graph@${version}`]);
+  } catch (e) {
+    process.stderr.write(`[code-graph] cannot build the npm install command: ${e.message}\n`);
+    finish(onFailed);
+    return;
+  }
   runStep(npm.file, npm.args, npmTimeoutMs, '[code-graph][npm]', spawnFn, (npmExit) => {
     if (resolved()) {
       if (npmExit === 0 && recordGlobalInstall) {

package/claude-plugin/scripts/lifecycle.js

@@ -114,7 +114,13 @@ function readJsonResult(filePath) {
 
 // Lenient reader kept exactly as-is for its 20+ callers (manifests, registries,
 // plugin.json …) where "absent" and "unreadable" genuinely mean the same thing.
-// Only the settings write path needs readJsonResult's distinction.
+// A caller that will WRITE settings.json back must use readSettingsForWrite()
+// + tryWriteSettings() instead — the pair that detects the lossy/corrupt cases
+// and preserves the original bytes. Reading settings.json with THIS function is
+// fine as long as nothing is written back (isPluginInactive, syncLifecycleConfig's
+// self-heal probe); the destructive combination is `readJson(settingsPath())`
+// followed by a write, which is how cleanupDisabledStatusline and uninstall
+// destroyed non-UTF-8 bytes for four releases after the detector landed.
 function readJson(filePath) {
   try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); } catch { return null; }
 }
@@ -158,9 +164,18 @@ function backupCorruptFile(filePath, raw) {
 // printing "Hooks ✅ 1 issue(s) auto-repaired" for a run that moved the user's
 // model / env / permissions into a `.corrupt-*` file it never mentioned. A
 // destructive repair has to be reported as one, with the path to get it back.
-function readSettingsForWrite() {
+//
+// `pre` lets a caller that ALREADY probed the file with readJsonResult reuse
+// that result instead of reading twice. It matters for more than speed: the
+// backup this function may take is a side effect, and a caller which only
+// writes conditionally (cleanupDisabledStatusline runs on every statusline
+// render) must be able to probe first and pay the backup only on the write
+// path — otherwise a lossy settings.json accumulates one `.corrupt-*` copy per
+// prompt. Passing `pre` also keeps the returned `settings` object IDENTICAL to
+// the one the caller already mutated.
+function readSettingsForWrite(pre) {
   const p = settingsPath();
-  const res = readJsonResult(p);
+  const res = pre || readJsonResult(p);
   if (res.value && res.lossy) {
     // Usable JSON whose bytes will not survive our rewrite (see readJsonResult).
     // Preserve the true bytes, then proceed with the parsed value — refusing
@@ -413,7 +428,11 @@ function detachStatuslineIntegration(settings, { compositeDoomed = true } = {})
 }
 
 function cleanupDisabledStatusline() {
-  const settings = readJson(settingsPath());
+  // Probe without side effects first — this runs on every statusline render and
+  // usually finds nothing to do. A corrupt/unreadable file yields no value and
+  // is left strictly alone (same outcome the old lenient readJson produced).
+  const probe = readJsonResult(settingsPath());
+  const settings = probe.value;
   if (!settings || !isPluginInactive(settings)) {
     return { cleaned: false, settingsChanged: false };
   }
@@ -425,7 +444,15 @@ function cleanupDisabledStatusline() {
   let settingsChanged = detachStatuslineIntegration(settings, { compositeDoomed: uninstalled });
   if (removeHooksFromSettings(settings)) settingsChanged = true;
   if (settingsChanged) {
-    writeJsonAtomic(settingsPath(), settings);
+    // Now that a write is certain, take the guarded path: readSettingsForWrite
+    // preserves bytes JSON.stringify would destroy (the lossy-UTF8 case) and
+    // returns null when it could not, and tryWriteSettings turns a read-only
+    // ~/.claude into a diagnosed no-op instead of an uncaught EACCES — this
+    // function is called at the top of statusline.js, where a throw blanks the
+    // user's status line. `guarded` is the same object we just mutated.
+    const { settings: guarded } = readSettingsForWrite(probe);
+    if (!guarded) return { cleaned: false, settingsChanged: false };
+    if (tryWriteSettings(guarded)) settingsChanged = false;
   }
 
   // Genuine uninstall (not a temporary disable): reclaim ~/.cache/code-graph
@@ -1071,7 +1098,13 @@ function defaultRunNpm(args) {
 }
 
 function uninstall({ purgeGlobal = false, unadoptAll = false, runNpm = defaultRunNpm, scanGlobalPkgs = installedGlobalPkgs } = {}) {
-  const settings = readJson(settingsPath());
+  // Same guarded pair as install()/update(): probe without side effects, and
+  // only take the backup + write path once there is something to write. Reading
+  // this file with the lenient readJson and writing it back raw is what
+  // destroyed non-UTF-8 bytes here — a teardown has even less license to lose
+  // the user's model / env / permissions than an install does.
+  const probe = readJsonResult(settingsPath());
+  const settings = probe.value;
   let settingsChanged = false;
 
   if (settings) {
@@ -1097,7 +1130,8 @@ function uninstall({ purgeGlobal = false, unadoptAll = false, runNpm = defaultRu
 
     // 4. Write settings if changed
     if (settingsChanged) {
-      writeJsonAtomic(settingsPath(), settings);
+      const { settings: guarded } = readSettingsForWrite(probe);
+      if (!guarded || tryWriteSettings(guarded)) settingsChanged = false;
     }
   }
 
@@ -1155,6 +1189,14 @@ function uninstall({ purgeGlobal = false, unadoptAll = false, runNpm = defaultRu
   // 6. Remove cache directory
   try { fs.rmSync(CACHE_DIR, { recursive: true, force: true }); } catch { /* ok */ }
 
+  // 6.5. The shared tmp dir (cooldown flags, read-fanout state, interrupted
+  // `update-*` staging). Nothing in it outlives an uninstall, and the periodic
+  // prune that keeps it bounded stops running the moment the hooks are gone —
+  // so without this it is residue with no remaining owner.
+  try {
+    fs.rmSync(require('./tmp-dir').CG_TMP_DIR, { recursive: true, force: true });
+  } catch { /* ok */ }
+
   // 7. Remove plugin files from cache (all known paths, including parent dirs)
   const cacheRoot = pluginsCacheDir();
   const pluginCacheDirs = [
@@ -1354,11 +1396,22 @@ function scanForBrokenPaths() {
   const settings = settingsRead.value || {};
   const issues = [];
 
+  // Every path extraction below goes through hookCmdScript, the same parser
+  // compositeSlotIsStale and surveyHookCoverage use. These three sites each had
+  // their own inline `/node\s+"([^"]+)"/`, which requires the literal word
+  // `node` followed by whitespace — so a command naming the interpreter by
+  // absolute path, the spelling a Windows install produces
+  // (`"C:\Program Files\nodejs\node.exe" "C:\…\script.js"`), matched nothing.
+  // A path this scan cannot READ is reported as no path at all, i.e. as healthy,
+  // which is the failure mode the whole function exists to prevent. Six sites,
+  // two spellings, one of them blind: collapse to one.
+  const scriptOf = (cmd) => hookCmdScript(cmd);
+
   // Check statusLine path
   if (isOurComposite(settings)) {
-    const m = settings.statusLine.command.match(/node\s+"([^"]+)"/);
-    if (m && m[1] && !fs.existsSync(m[1])) {
-      issues.push({ type: 'statusLine', path: m[1] });
+    const script = scriptOf(settings.statusLine.command);
+    if (script && !fs.existsSync(script)) {
+      issues.push({ type: 'statusLine', path: script });
     }
   }
 
@@ -1369,9 +1422,9 @@ function scanForBrokenPaths() {
       for (const entry of entries) {
         if (!isOurHookEntry(entry) || !entry.hooks) continue;
         for (const h of entry.hooks) {
-          const m = h.command && h.command.match(/node\s+"([^"]+)"/);
-          if (m && m[1] && !fs.existsSync(m[1])) {
-            issues.push({ type: 'hook', event, path: m[1] });
+          const script = h.command && scriptOf(h.command);
+          if (script && !fs.existsSync(script)) {
+            issues.push({ type: 'hook', event, path: script });
           }
         }
       }
@@ -1382,9 +1435,9 @@ function scanForBrokenPaths() {
   const registry = readRegistry();
   for (const provider of registry) {
     if (provider.id === '_previous') continue;
-    const m = provider.command && provider.command.match(/node\s+"([^"]+)"/);
-    if (m && m[1] && !fs.existsSync(m[1])) {
-      issues.push({ type: 'registry', id: provider.id, path: m[1] });
+    const script = provider.command && scriptOf(provider.command);
+    if (script && !fs.existsSync(script)) {
+      issues.push({ type: 'registry', id: provider.id, path: script });
     }
   }
 
@@ -1480,6 +1533,7 @@ module.exports = {
   removeHooksFromSettings, isOurHookEntry,
   registerHooksToSettings, buildSettingsHookEntries,                  // v0.32.0
   surveyHookCoverage, compositeCommand, compositeSlotIsStale,          // v0.49.1 — version-aware self-heal
+  hookCmdScript,                                                       // the ONE hook-command path parser (session-init reuses it)
   cacheDirVersion,                                                     // exported for the separator-agnostic test
 
   verifyHooksFire, defaultHookFireProbes,                              // v0.67.0 — firing self-test

package/claude-plugin/scripts/npm-exec.js

@@ -30,7 +30,13 @@ function quoteCmdArg(arg) {
   if (/["%!\r\n]/.test(s)) {
     throw new Error(`npm argument cannot be safely quoted for cmd.exe: ${JSON.stringify(s)}`);
   }
-  return `"${s}"`;
+  // Double a trailing run of backslashes. cmd.exe itself does not treat `\` as
+  // an escape, but the RECEIVING program's MSVCRT argv parser does: `"C:\x\"`
+  // reads the final `\"` as an escaped quote and swallows the rest of the
+  // command line into that argument. Only reachable for path-shaped args, which
+  // no current call site passes — but this helper reads as general-purpose.
+  const trailing = /\\+$/.exec(s);
+  return `"${trailing ? s + trailing[0] : s}"`;
 }
 
 /**

package/claude-plugin/scripts/post-grep-inject.js

@@ -23,7 +23,7 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
-const { cgTmpDir } = require('./tmp-dir');
+const { cgTmpDir, cwdHash } = require('./tmp-dir');
 const { recordRecommendation } = require('./recommendation-log');
 const { runGrepAnswer, runShowAnswer, runCallgraphAnswer, sanitizeSearchPath } = require('./cg-answer');
 const { emitPostToolContext } = require('./hook-emit');
@@ -217,18 +217,20 @@ function commandHash(cmd) {
   return crypto.createHash('sha1').update(String(cmd)).digest('hex').slice(0, 12);
 }
 
-function flagPath(cmd) {
-  return path.join(cgTmpDir(), `.code-graph-postinject-${commandHash(cmd)}`);
+// Project-scoped for the same reason as pre-grep-guide's (see cwdHash in
+// tmp-dir.js): one shared tmp dir means an un-scoped flag is machine-global.
+function flagPath(cmd, cwd = process.cwd()) {
+  return path.join(cgTmpDir(), `.code-graph-postinject-${cwdHash(cwd)}-${commandHash(cmd)}`);
 }
 
-function isOnCooldown(cmd, now = Date.now(), windowMs = 60000) {
+function isOnCooldown(cmd, now = Date.now(), windowMs = 60000, cwd = process.cwd()) {
   try {
-    return now - fs.statSync(flagPath(cmd)).mtimeMs < windowMs;
+    return now - fs.statSync(flagPath(cmd, cwd)).mtimeMs < windowMs;
   } catch { return false; }
 }
 
-function markCooldown(cmd) {
-  try { fs.writeFileSync(flagPath(cmd), ''); } catch { /* ok */ }
+function markCooldown(cmd, cwd = process.cwd()) {
+  try { fs.writeFileSync(flagPath(cmd, cwd), ''); } catch { /* ok */ }
 }
 
 // --- Main execution ---
@@ -259,8 +261,8 @@ function runMain() {
   const found = findFoldableGrepSegment(cmd);
   if (!found) return;
 
-  if (isOnCooldown(rawCmd)) return;
-  markCooldown(rawCmd);
+  if (isOnCooldown(rawCmd, Date.now(), 60000, root)) return;
+  markCooldown(rawCmd, root);
 
   const { segment, block } = found;
   // Run the answer exactly like the deny path.

package/claude-plugin/scripts/pre-edit-guide.js

@@ -10,7 +10,7 @@ const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const { findBinary } = require('./find-binary');
-const { cgTmpDir } = require('./tmp-dir');
+const { cgTmpDir, cwdHash } = require('./tmp-dir');
 const { resolveProjectRoot } = require('./project-root');
 const { recordRecommendation } = require('./recommendation-log');
 const { formatCoveringTests } = require('./covering-tests');
@@ -118,7 +118,11 @@ function isCommonKeyword(s) {
 }
 
 // --- Per-symbol cooldown: 2 minutes ---
-const cooldownFile = path.join(cgTmpDir(), `.cg-impact-${symbol}`);
+// Project-scoped (see cwdHash in tmp-dir.js). A symbol name is the LEAST
+// project-unique key there is — `main`, `run`, `new`, `parse` collide across
+// every repo on the machine, so editing `parse` in one project suppressed the
+// impact push for a completely different `parse` in another for two minutes.
+const cooldownFile = path.join(cgTmpDir(), `.cg-impact-${cwdHash(cwd)}-${symbol}`);
 try {
   if (Date.now() - fs.statSync(cooldownFile).mtimeMs < 120000) process.exit(0);
 } catch { /* first time for this symbol */ }

package/claude-plugin/scripts/pre-grep-guide.js

@@ -39,7 +39,7 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
-const { cgTmpDir } = require('./tmp-dir');
+const { cgTmpDir, cwdHash } = require('./tmp-dir');
 const { recordRecommendation } = require('./recommendation-log');
 const { runGrepAnswer, runShowAnswer, sanitizeSearchPath } = require('./cg-answer');
 
@@ -513,18 +513,20 @@ function commandHash(cmd) {
   return crypto.createHash('sha1').update(cmd).digest('hex').slice(0, 12);
 }
 
-function flagPath(cmd) {
-  return path.join(cgTmpDir(), `.code-graph-bash-${commandHash(cmd)}`);
+// Project-scoped: the same `grep -rn "foo" src/` in two repos is two different
+// questions and must not share one 60s cooldown (see cwdHash in tmp-dir.js).
+function flagPath(cmd, cwd = process.cwd()) {
+  return path.join(cgTmpDir(), `.code-graph-bash-${cwdHash(cwd)}-${commandHash(cmd)}`);
 }
 
-function isOnCooldown(cmd, now = Date.now(), windowMs = 60000) {
+function isOnCooldown(cmd, now = Date.now(), windowMs = 60000, cwd = process.cwd()) {
   try {
-    return now - fs.statSync(flagPath(cmd)).mtimeMs < windowMs;
+    return now - fs.statSync(flagPath(cmd, cwd)).mtimeMs < windowMs;
   } catch { return false; }
 }
 
-function markCooldown(cmd) {
-  try { fs.writeFileSync(flagPath(cmd), ''); } catch { /* ok */ }
+function markCooldown(cmd, cwd = process.cwd()) {
+  try { fs.writeFileSync(flagPath(cmd, cwd), ''); } catch { /* ok */ }
 }
 
 function buildHint() {
@@ -720,7 +722,7 @@ function runMain() {
     return;
   }
 
-  if (isOnCooldown(rawCmd)) {
+  if (isOnCooldown(rawCmd, Date.now(), 60000, root)) {
     // Outcome proxy: a source grep re-issued within the cooldown window runs
     // silently (no deny/hint). Record it so `stats` sees the model's grep
     // fan-out — especially a re-grep right after cg answered the same query.
@@ -728,7 +730,7 @@ function runMain() {
     return;
   }
 
-  markCooldown(rawCmd);
+  markCooldown(rawCmd, root);
 
   const block = isBlockDisabled() ? null : classifyBlock(cmd);
   if (block) {

package/claude-plugin/scripts/session-init.js

@@ -6,7 +6,7 @@ const fs = require('fs');
 const {
   install, update, readManifest, getPluginVersion, checkScopeConflict,
   cleanupDisabledStatusline, isPluginInactive, isPluginUninstalled, removeCacheResidue,
-  readJson, CACHE_DIR, settingsPath, isStaleRelicContext,
+  readJson, CACHE_DIR, settingsPath, isStaleRelicContext, hookCmdScript,
 } = require('./lifecycle');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const { maybeAutoAdopt, isAdopted, unadopt } = require('./adopt');
@@ -251,9 +251,13 @@ function syncLifecycleConfig() {
     installReporting();
     return 'self-healed';
   }
-  // Also self-heal if composite path points to a non-existent script (path pollution)
-  const scriptMatch = settings.statusLine.command.match(/node\s+"([^"]+)"/);
-  if (scriptMatch && scriptMatch[1] && !fs.existsSync(scriptMatch[1])) {
+  // Also self-heal if composite path points to a non-existent script (path
+  // pollution). hookCmdScript, not another inline `/node\s+"…"/`: that spelling
+  // cannot read a command whose interpreter is an absolute path
+  // (`"C:\Program Files\nodejs\node.exe" "…\statusline-composite.js"`), and an
+  // unreadable command silently reads as a healthy one.
+  const compositeScript = hookCmdScript(settings.statusLine.command);
+  if (compositeScript && !fs.existsSync(compositeScript)) {
     installReporting();
     return 'self-healed-bad-path';
   }
@@ -282,8 +286,8 @@ function syncLifecycleConfig() {
       for (const entry of entries) {
         if (!entry.hooks) continue;
         for (const h of entry.hooks) {
-          const m = h.command && h.command.match(/node\s+"([^"]+)"/);
-          if (m && m[1] && m[1].includes('code-graph') && !fs.existsSync(m[1])) {
+          const script = h.command && hookCmdScript(h.command);
+          if (script && script.includes('code-graph') && !fs.existsSync(script)) {
             installReporting();
             return 'self-healed-bad-hook';
           }
@@ -509,13 +513,22 @@ function consistencyCheck(binary) {
 }
 
 function runSessionInit({ source } = {}) {
+  // GC the shared tmp dir before anything else, so it happens even on the
+  // inactive / non-project early returns below — those sessions still wrote
+  // cooldown flags on the way in. Cheap (one readdir + a stat per entry) and
+  // fully swallowed: reclaiming disk must never be able to fail a SessionStart.
+  try { require('./tmp-dir').pruneCgTmp(); } catch { /* best-effort GC */ }
+
   if (isPluginInactive()) {
     // Capture the uninstalled-vs-disabled verdict BEFORE cleanupDisabledStatusline()
     // runs — it removes our composite + registry entry, which are the very signals
     // isPluginUninstalled()/isPluginInactive() read, so calling it afterwards would
     // always see "no composite/registry" and report not-uninstalled (teardown skipped).
     const uninstalled = isPluginUninstalled();
-    cleanupDisabledStatusline();
+    // Third caller of the same unguarded teardown (statusline.js and
+    // statusline-composite.js are the others): a read-only ~/.claude turns this
+    // into an uncaught throw that takes down the whole SessionStart hook.
+    try { cleanupDisabledStatusline(); } catch { /* best-effort teardown */ }
     // Genuine uninstall (not a temporary disable) leaves residue the settings-only
     // self-heal can't reach: ~/.cache/code-graph (the ~40MB binary + state) and the
     // current project's CLAUDE.md adoption block. CC fires no uninstall hook, AND it

package/claude-plugin/scripts/statusline-composite.js

@@ -16,7 +16,14 @@ const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() =>
 const SEPARATOR = ' \x1b[2m|\x1b[0m ';
 
 function main() {
-  const disabledCleanup = cleanupDisabledStatusline();
+  // Same reasoning as statusline.js: the teardown writes settings.json and the
+  // registry, both of which throw on a read-only config dir, and this is THE
+  // command Claude Code runs for the status line — an uncaught throw here blanks
+  // every provider's segment, not just ours.
+  let disabledCleanup = { cleaned: false };
+  try {
+    disabledCleanup = cleanupDisabledStatusline();
+  } catch { /* teardown is optional; rendering is not */ }
   if (disabledCleanup.cleaned) process.exit(0);
 
   // Collect stdin (Claude Code pipes JSON context)

package/claude-plugin/scripts/statusline.js

@@ -19,18 +19,41 @@ const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() =>
 // real status instead. Without this, a persistently-failing update (missing
 // tar/curl, full disk, blocked network) pins "updating" forever.
 const STUCK_UPDATE_ATTEMPTS = 5;
-function updatePending() {
+function readUpdateState() {
   try {
-    const st = JSON.parse(fs.readFileSync(
+    return JSON.parse(fs.readFileSync(
       path.join(os.homedir(), '.cache', 'code-graph', 'update-state.json'), 'utf8'));
-    if ((st.updateAttempts || 0) >= STUCK_UPDATE_ATTEMPTS) return false;
-    if (st.updateAvailable) return true;
-    if (st.latestVersion && st.installedVersion && st.latestVersion !== st.installedVersion) return true;
-  } catch { /* no state file or unreadable — treat as no pending update */ }
+  } catch { return null; /* no state file or unreadable */ }
+}
+function updatePending(st = readUpdateState()) {
+  if (!st) return false;
+  if ((st.updateAttempts || 0) >= STUCK_UPDATE_ATTEMPTS) return false;
+  if (st.updateAvailable) return true;
+  if (st.latestVersion && st.installedVersion && st.latestVersion !== st.installedVersion) return true;
   return false;
 }
+// The updater has given up on this release (auto-update.js MAX_UPDATE_ATTEMPTS).
+// This has to be SHOWN, not merely not-lied-about: the updater's own stderr
+// notice is written by a process session-init spawns `detached` with
+// `stdio: 'ignore'`, so nobody ever sees it, and updatePending() going quiet
+// above means the only remaining signal was running `doctor` by hand. A user
+// who never runs doctor would sit on a permanently parked updater with no way
+// to know (found by pre-release review of v0.111.0, fixed in v0.111.1).
+function updateStuck(st = readUpdateState()) {
+  return !!(st && st.updateAvailable && (st.updateAttempts || 0) >= STUCK_UPDATE_ATTEMPTS);
+}
 
-const disabledCleanup = cleanupDisabledStatusline();
+// The teardown is best-effort housekeeping, never a precondition for rendering.
+// It writes ~/.claude/settings.json and ~/.cache/code-graph/statusline-registry.json,
+// and on a read-only config dir (EROFS container mount, a `sudo` that left root
+// ownership behind, restrictive umask) those writes throw — from module scope,
+// where nothing catches them. The user's whole status line then goes blank plus a
+// node stack trace, for a cleanup they never asked for. Swallow it: the next run
+// with a writable dir does the work.
+let disabledCleanup = { cleaned: false };
+try {
+  disabledCleanup = cleanupDisabledStatusline();
+} catch { /* teardown is optional; rendering is not */ }
 if (disabledCleanup.cleaned) process.exit(0);
 
 // Only show status in projects that have a code-graph directory. The statusLine
@@ -94,7 +117,10 @@ const bin = findBinary();
 if (!bin) {
   // No usable binary yet. If an update is queued, the background downloader is
   // still fetching it \u2014 that is "updating", not a broken "offline" state.
-  process.stdout.write(updatePending() ? 'code-graph: \u21bb updating' : 'code-graph: offline');
+  process.stdout.write(
+    updateStuck() ? 'code-graph: \u26a0 update stuck'
+      : updatePending() ? 'code-graph: \u21bb updating'
+        : 'code-graph: offline');
   process.exit(0);
 }
 
@@ -121,6 +147,8 @@ function renderHealth(s) {
   // index doesn't masquerade as fully current.
   if (s.index_version_stale) line += ' | \u21bb rebuilding';
   if (s.watching) line += ' | watching';
+  // A parked updater is otherwise invisible in normal use — see updateStuck().
+  if (updateStuck()) line += ' | \u26a0 update stuck';
   return line;
 }
 
@@ -144,7 +172,8 @@ function statusUnavailable(errText) {
   // phrase so a cached binary predating the marker still reads as "updating".
   const errStr = errText || '';
   const binaryOutdated = errStr.includes('code-graph:schema-too-new') || /schema version/i.test(errStr);
-  return (binaryOutdated || updatePending()) ? 'code-graph: \u21bb updating' : 'code-graph: offline';
+  if (binaryOutdated || updatePending()) return 'code-graph: \u21bb updating';
+  return updateStuck() ? 'code-graph: \u26a0 update stuck' : 'code-graph: offline';
 }
 
 let report = null;

package/claude-plugin/scripts/tmp-dir.js

@@ -18,6 +18,7 @@
 //
 // Fix: pin all hook + auto-update artifacts to a `code-graph-mcp/` subdir of
 // whatever `os.tmpdir()` resolves to. Contained, deterministic, easy to GC.
+const crypto = require('crypto');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
@@ -29,4 +30,60 @@ function cgTmpDir() {
   return CG_TMP_DIR;
 }
 
-module.exports = { cgTmpDir, CG_TMP_DIR };
+// Short, filename-safe digest of a project root. Cooldown flags live in ONE
+// shared tmp dir for the whole machine, so a flag named only after its subject
+// (a command, a symbol, a context type) is global: an `impact` push in project A
+// silenced the identical prompt in project B for the next 30s, and a grep
+// cooldown followed the developer across every repo they had open. Folding the
+// cwd in makes the flag mean what it always claimed to — "recently done HERE".
+// pre-read-guide.js already did this; the other four hooks did not.
+function cwdHash(cwd) {
+  return crypto.createHash('sha1').update(String(cwd)).digest('hex').slice(0, 12);
+}
+
+// Nothing ever deleted what cgTmpDir() collects. Every cooldown flag, read-fanout
+// state file and interrupted `update-*` download stayed forever: measured 281
+// entries on a working dev box, 232 of them older than a day. They are 0-byte
+// flags, so the cost is inode churn and a directory that makes `ls` in the shared
+// tmp useless — but the `update-*` dirs hold a partly-extracted release tarball,
+// which is megabytes each.
+//
+// The window has to exceed the longest cooldown that reads these files, or the
+// prune would silently shorten it. The longest is user-prompt-context's
+// `overview` at 5 minutes, so 24h is ~288× the margin — this is garbage
+// collection, not expiry.
+const PRUNE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Delete cgTmpDir() entries older than `maxAgeMs`. Best-effort and total: any
+ * failure (missing dir, a file another process just removed, a permission
+ * problem) is skipped rather than raised — this runs from a SessionStart hook,
+ * where a throw is a visible failure and unreclaimed disk is not.
+ * @returns {number} entries removed
+ */
+function pruneCgTmp({ now = Date.now(), maxAgeMs = PRUNE_MAX_AGE_MS, dir = CG_TMP_DIR } = {}) {
+  // The recursive delete below is the reason for this check. `dir` is a
+  // parameter only so tests can point it at a sandbox, and a future caller
+  // passing the wrong path must not be able to turn this into `rm -rf` on
+  // something that isn't ours.
+  if (path.basename(dir) !== 'code-graph-mcp') return 0;
+  let removed = 0;
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch { return 0; }
+  for (const entry of entries) {
+    const target = path.join(dir, entry.name);
+    try {
+      if (now - fs.statSync(target).mtimeMs <= maxAgeMs) continue;
+      // `update-*` staging dirs from an interrupted auto-update are the only
+      // subdirectories here, and they are the ones that actually hold bytes.
+      if (entry.isDirectory()) fs.rmSync(target, { recursive: true, force: true });
+      else fs.unlinkSync(target);
+      removed++;
+    } catch { /* raced, unreadable, or already gone — the next run retries */ }
+  }
+  return removed;
+}
+
+module.exports = { cgTmpDir, CG_TMP_DIR, cwdHash, pruneCgTmp, PRUNE_MAX_AGE_MS };

package/claude-plugin/scripts/user-prompt-context.js

@@ -12,7 +12,7 @@ const os = require('os');
 // ~/.claude/tmp/, so bare-tmp flags interleave with transcript captures —
 // diagnostic blindness + the §8 recursive-grep footgun (see tmp-dir.js). The
 // other hook scripts already route through here; this one was the lone holdout.
-const { cgTmpDir } = require('./tmp-dir');
+const { cgTmpDir, cwdHash } = require('./tmp-dir');
 const { hidden } = require('./proc-opts');
 
 // Mid-session install detection: hook fires but no manifest yet.
@@ -27,17 +27,24 @@ const COOLDOWNS = {
   symptom:   10 * 60 * 1000, // 10min — Phase E meta-advisory hint, low value to repeat
 };
 
-function isCoolingDown(type) {
+// Project-scoped (see cwdHash in tmp-dir.js). There are only five flag names
+// here, so an un-scoped flag was effectively a machine-wide mute: one `impact`
+// push in any repo silenced the next 30s of impact pushes in every other repo,
+// and `overview` did it for five minutes.
+function ctxFlagPath(type, cwd) {
+  return path.join(cgTmpDir(), `.code-graph-ctx-${cwdHash(cwd)}-${type}`);
+}
+
+function isCoolingDown(type, cwd = process.cwd()) {
   try {
-    const flag = path.join(cgTmpDir(), `.code-graph-ctx-${type}`);
-    const stat = fs.statSync(flag);
+    const stat = fs.statSync(ctxFlagPath(type, cwd));
     return Date.now() - stat.mtimeMs < (COOLDOWNS[type] || 60000);
   } catch { return false; }
 }
 
-function markCooldown(type) {
+function markCooldown(type, cwd = process.cwd()) {
   try {
-    fs.writeFileSync(path.join(cgTmpDir(), `.code-graph-ctx-${type}`), '');
+    fs.writeFileSync(ctxFlagPath(type, cwd), '');
   } catch { /* ok */ }
 }
 
@@ -424,7 +431,12 @@ function runMain() {
   // --- Read user message ---
   let message;
   try {
-    const input = JSON.parse(fs.readFileSync('/dev/stdin', 'utf8'));
+    // fd 0, not '/dev/stdin': the path form open(2)s the symlink target, which
+    // fails with ENXIO when stdin is a socketpair (e.g. spawnSync {input}).
+    // Reading the fd directly works for pipes, sockets, and files alike. Five
+    // sibling hooks already did this; this one was the holdout, so it read
+    // nothing under exactly the conditions verifyHooksFire spawns it with.
+    const input = JSON.parse(fs.readFileSync(0, 'utf8'));
     message = (input && input.message) || '';
   } catch {
     return;
@@ -445,14 +457,16 @@ function runMain() {
   const filePaths = extractFilePaths(message);
   const symbols = extractSymbols(message);
   const intents = detectIntents(message);
-  const query = determineQueryType(intents, symbols, filePaths, isCoolingDown, message);
+  // Key the cooldowns on the resolved project root, not the raw shell cwd, so a
+  // `cd` into a subdir does not read as a different project and re-fire.
+  const query = determineQueryType(intents, symbols, filePaths, (type) => isCoolingDown(type, cwd), message);
 
   if (!query) return;
 
   // Phase E: symptom-hint is prose-only (no CLI execution). Emit + cooldown
   // before the result-fetching paths so it can short-circuit cleanly.
   if (query.type === 'symptom-hint') {
-    markCooldown('symptom');
+    markCooldown('symptom', cwd);
     process.stdout.write(
       '[code-graph:hint] indexed repo — for vague-symptom prompts, try `semantic_code_search "<symptom>"` ' +
       'or `module_overview <suspected-dir>` to surface candidate code structurally. Skip if not searching code.\n'
@@ -467,8 +481,17 @@ function runMain() {
     search:    '[code-graph:search] Relevant code:',
   };
 
-  function run(cmd, args) {
-    return execFileSync(cmd, args, hidden({
+  // Resolve the binary the way every other hook does. The bare name relied on
+  // `code-graph-mcp` being on PATH, which it is not for plugin-only installs
+  // (the binary lives in ~/.cache/code-graph/bin), and when it IS on PATH it may
+  // be an unrelated or years-stale global shim — the same finding cg-answer.js
+  // and session-init.js were already fixed for. Null means no engine: nothing to
+  // run, and nothing to say about it.
+  const binary = require('./find-binary').findBinary();
+  if (!binary) return;
+
+  function run(args) {
+    return execFileSync(binary, args, hidden({
       cwd,
       timeout: 3000,
       encoding: 'utf8',
@@ -477,15 +500,21 @@ function runMain() {
     }));
   }
 
+  // Stamp the cooldown on ATTEMPT, not on success. Keyed on the outcome, a
+  // binary that fails or times out produced no flag, so the very next prompt of
+  // the same shape re-ran it — a 3s execFileSync timeout on EVERY turn, which is
+  // the worst case wearing the cheapest disguise. The cooldown's job is rate
+  // limiting; whether the run had something to say is a separate question.
+  markCooldown(query.type, cwd);
+
   try {
     let result = '';
-    if (query.type === 'impact') result = run('code-graph-mcp', ['impact', query.symbol]);
-    else if (query.type === 'callgraph') result = run('code-graph-mcp', ['callgraph', query.symbol, '--depth', '2']);
-    else if (query.type === 'overview') result = run('code-graph-mcp', ['overview', query.path]);
-    else if (query.type === 'search') result = run('code-graph-mcp', ['search', query.symbol, '--limit', '8']);
+    if (query.type === 'impact') result = run(['impact', query.symbol]);
+    else if (query.type === 'callgraph') result = run(['callgraph', query.symbol, '--depth', '2']);
+    else if (query.type === 'overview') result = run(['overview', query.path]);
+    else if (query.type === 'search') result = run(['search', query.symbol, '--limit', '8']);
 
     if (result && result.trim()) {
-      markCooldown(query.type);
       process.stdout.write(`${PREFIXES[query.type]}\n${result.trim()}\n`);
     }
   } catch {
@@ -497,4 +526,4 @@ if (require.main === module) {
   runMain();
 }
 
-module.exports = { shouldSkip, extractFilePaths, extractSymbols, detectIntents, scoreIntent, INTENT_PATTERNS, INTENT_THRESHOLD, determineQueryType, computeQuietHooks, STOP_WORDS, PLAIN_WORD_EXCLUDE, hasSymptom, SYMPTOM_PATTERNS, buildRunEnv };
+module.exports = { COOLDOWNS, shouldSkip, extractFilePaths, extractSymbols, detectIntents, scoreIntent, INTENT_PATTERNS, INTENT_THRESHOLD, determineQueryType, computeQuietHooks, STOP_WORDS, PLAIN_WORD_EXCLUDE, hasSymptom, SYMPTOM_PATTERNS, buildRunEnv };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.111.0",
+  "version": "0.112.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.111.0",
-    "@sdsrs/code-graph-linux-arm64": "0.111.0",
-    "@sdsrs/code-graph-darwin-x64": "0.111.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.111.0",
-    "@sdsrs/code-graph-win32-x64": "0.111.0"
+    "@sdsrs/code-graph-linux-x64": "0.112.0",
+    "@sdsrs/code-graph-linux-arm64": "0.112.0",
+    "@sdsrs/code-graph-darwin-x64": "0.112.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.112.0",
+    "@sdsrs/code-graph-win32-x64": "0.112.0"
   }
 }