@sdsrs/code-graph 0.116.0 → 0.117.0

package/claude-plugin/scripts/session-init.js

@@ -609,7 +609,36 @@ function runSessionInit({ source } = {}) {
   // 上下文感知默认：插件模式下首次 SessionStart 自动安装（创建/注入 CLAUDE.md 块 +
   // .claude/ detail 文件），并清理旧 memory-dir 制品（升级自动迁移）。shipped 漂移
   // 时刷新。三种情况发一次 stderr 提示，让用户知道发生了什么 + 如何回退。
-  const autoAdopt = isRelic ? { attempted: false, result: null } : maybeAutoAdopt({ scriptPath: __dirname });
+  // Adoption is OPTIONAL; the rest of this hook is not. It touches files the
+  // user owns (CLAUDE.md, .claude/) which can be unreadable, a directory, or on
+  // a read-only mount — and a throw here used to abort every remaining step
+  // (map injection, recent impact, consistency check, both hook canaries) with a
+  // raw stack trace (audit 2026-08-16 P1-16). adopt() now returns reasons rather
+  // than throwing; this is the belt to that suspenders, so a future unguarded
+  // read inside it cannot take the session down again.
+  let autoAdopt = { attempted: false, result: null };
+  if (!isRelic) {
+    try {
+      autoAdopt = maybeAutoAdopt({ scriptPath: __dirname });
+    } catch (e) {
+      autoAdopt = { attempted: true, reason: 'threw', result: null, error: (e && e.message) || String(e) };
+      process.stderr.write(
+        `[code-graph] Skipped CLAUDE.md adoption for this project (${(e && e.code) || (e && e.message) || 'unknown error'}).\n` +
+        '            Everything else in this session start continues normally.\n'
+      );
+    }
+  }
+  if (autoAdopt.result && autoAdopt.result.ok === false &&
+      (autoAdopt.result.reason === 'claude-md-unreadable' || autoAdopt.result.reason === 'claude-md-unwritable' ||
+       autoAdopt.result.reason === 'detail-unwritable')) {
+    // A refusal is not a silent no-op: the user's steering block is NOT
+    // installed/refreshed, and only this line says so.
+    process.stderr.write(
+      `[code-graph] Could not install the CLAUDE.md steering block (${autoAdopt.result.reason}: ` +
+      `${autoAdopt.result.error || 'unknown'}). Nothing was changed.\n` +
+      '            Opt out permanently: CODE_GRAPH_NO_AUTO_ADOPT=1\n'
+    );
+  }
   const migrated = autoAdopt.migrated || {};
   if (migrated.memoryIndexPruned || migrated.legacyDetailRemoved) {
     process.stderr.write(
@@ -889,5 +918,18 @@ if (require.main === module) {
       source = JSON.parse(fs.readFileSync(0, 'utf8')).source;
     }
   } catch { /* no/garbled stdin → treat as unknown source */ }
-  runSessionInit({ source });
+  // Hooks FAIL OPEN. This one had no wrapper at all, so anything unhandled
+  // anywhere in the sequence surfaced as a node stack trace plus a non-zero exit
+  // in the user's session start — for work that is entirely optional
+  // housekeeping (audit 2026-08-16 P1-16). One `[code-graph]` line, exit 0.
+  try {
+    runSessionInit({ source });
+  } catch (e) {
+    process.stderr.write(
+      `[code-graph] SessionStart hook error (${(e && e.code) || (e && e.name) || 'Error'}): ` +
+      `${(e && e.message) || String(e)}\n` +
+      '            The session continues; run `code-graph-mcp doctor` if this repeats.\n'
+    );
+    process.exit(0);
+  }
 }

package/claude-plugin/scripts/statusline-chain.js

@@ -16,7 +16,21 @@
 // (this plugin's own provider). Third parties should use stable ids like
 // "gsd", "claude-mem", etc.
 
-const { readRegistry, registerStatuslineProvider, unregisterStatuslineProvider } = require('./lifecycle');
+const {
+  readRegistry, readRegistryForWrite, registerStatuslineProvider, unregisterStatuslineProvider,
+} = require('./lifecycle');
+
+// A registry that EXISTS but cannot be read is a refusal, not a no-op: the
+// mutation functions leave it alone (they must — it holds the user's previous
+// statusline and other plugins' entries), which would otherwise surface here as
+// the cheerful "unchanged <id>" / "not-found <id>" at exit 0. A third-party
+// installer reading that exit code would believe it is wired in.
+function bailIfRegistryUnusable(action) {
+  const { refuse, why } = readRegistryForWrite();
+  if (!refuse) return;
+  process.stderr.write(`error: ${why} — nothing ${action}. Repair or move that file aside and retry.\n`);
+  process.exit(2);
+}
 
 function usage(code = 1) {
   process.stderr.write(
@@ -34,12 +48,14 @@ function runRegister(id, command, needsStdin) {
     process.exit(2);
   }
   if (!id || !command) usage();
+  bailIfRegistryUnusable('registered');
   const changed = registerStatuslineProvider(id, command, needsStdin);
   process.stdout.write(changed ? `registered ${id}\n` : `unchanged ${id}\n`);
 }
 
 function runUnregister(id) {
   if (!id) usage();
+  bailIfRegistryUnusable('unregistered');
   const changed = unregisterStatuslineProvider(id);
   process.stdout.write(changed ? `unregistered ${id}\n` : `not-found ${id}\n`);
 }

package/claude-plugin/scripts/statusline-composite.js

@@ -89,6 +89,9 @@ function runProvider(command, needsStdin, stdin) {
 
     const out = execFileSync(argv[0], argv.slice(1), hidden({
       timeout: 3000,
+      // SIGKILL, not the SIGTERM default: a provider that traps SIGTERM makes
+      // Node's timeout unreachable and hangs every render (audit P1-17).
+      killSignal: 'SIGKILL',
       stdio: ['pipe', 'pipe', 'pipe'],
       input: needsStdin ? stdin : '',
       env,

package/claude-plugin/scripts/statusline.js

@@ -187,6 +187,9 @@ try {
   // "slow health-check" into a rendered "offline"/"updating" instead of a blank.
   report = parseReport(execFileSync(bin, ['health-check', '--format', 'json'], hidden({
     timeout: 1500,
+    // Render hot path: a wedged binary ignoring SIGTERM must not outlive the
+    // budget (same reasoning as the composite's provider spawn, audit P1-17).
+    killSignal: 'SIGKILL',
     stdio: ['pipe', 'pipe', 'pipe'],
     // Run the binary FROM the resolved root so its own project-root resolution
     // lands on the same DB the gate above picked (a subdir cwd would otherwise

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -22,15 +22,20 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      # SHA-pinned, not `@v4`: a floating major tag is mutable, so anyone who can
+      # move it runs their code in a job that holds `contents: write` on your
+      # repo. These are the same commits code-graph-mcp's own workflows pin.
+      # Update by copying a new SHA from the action's release page, not by
+      # switching back to a tag.
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.116.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.117.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/claude-plugin/templates/plugin_code_graph_mcp.md

@@ -35,8 +35,12 @@ type: reference
 > - `module_overview include_deps=true` / `include_dead=true`
 > - `get_call_graph route_path="GET /api/x"`
 >
-> 旧名（`impact_analysis` 等）仍作为向后兼容 dispatcher 别名可调（raw JSON-RPC /
-> SDK 脚本场景），但 Claude Code 内强烈建议用上面的新 flag 形式。CLI 子命令
+> `impact_analysis` **已删除**——dispatcher 里没有这个 arm，按名调用返回
+> `Unknown tool`。改用 `get_ast_node include_impact=true`，或 CLI `impact`。
+> 其余旧名（`read_snippet` / `dependency_graph` / `find_similar_code` /
+> `find_dead_code` / `trace_http_chain` + alias `find_http_route`）仍是向后兼容
+> dispatcher 别名（raw JSON-RPC / SDK 脚本场景），但 Claude Code 内一律用上面的
+> 新 flag 形式。CLI 子命令
 > （`code-graph-mcp impact|similar|deps|dead-code|trace`）保持不变，给 Bash 工作流。
 
 ## 何时调用 MCP/CLI（替代多步 Grep/Read）
@@ -73,10 +77,14 @@ type: reference
 ### 旧名兼容 + CLI 速查（v0.18.4 fold 后）
 
 v0.18.4 把原"进阶 5"折叠进核心 7 的 flag。**Claude Code 内**首选上表的新 flag 形式。
-旧名（`impact_analysis` / `find_similar_code` / `dependency_graph` / `find_dead_code` /
-`trace_http_chain` + alias `find_http_route`）作为 dispatcher 向后兼容**仍可调用**
-（raw JSON-RPC / MCP SDK / 既有脚本不破），但 Claude Code 的 ToolSearch 仍然不为
-hidden 5 加载 schema —— 实操中走新 flag。CLI 子命令保持原样：
+
+可按名调用的只有这 7 个：`project_map` / `semantic_code_search` / `get_call_graph` /
+`get_ast_node` / `module_overview` / `ast_search` / `find_references`。
+`impact_analysis` **不在其列，已从 dispatcher 删除**——按名调用返回 `Unknown tool`。
+隐藏旧名 `read_snippet` / `dependency_graph` / `find_similar_code` / `find_dead_code` /
+`trace_http_chain`（+ alias `find_http_route`）仍有 dispatcher arm，raw JSON-RPC / MCP
+SDK / 既有脚本不破；但它们不在 `tools/list`，Claude Code 的 ToolSearch 不为其加载
+schema —— 实操中一律走新 flag。CLI 子命令保持原样：
 
 | 意图 | CLI（Bash 工作流） | 等价 MCP 新形式 |
 |------|--------------------|------------------|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.116.0",
+  "version": "0.117.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.116.0",
-    "@sdsrs/code-graph-linux-arm64": "0.116.0",
-    "@sdsrs/code-graph-darwin-x64": "0.116.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.116.0",
-    "@sdsrs/code-graph-win32-x64": "0.116.0"
+    "@sdsrs/code-graph-linux-x64": "0.117.0",
+    "@sdsrs/code-graph-linux-arm64": "0.117.0",
+    "@sdsrs/code-graph-darwin-x64": "0.117.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.117.0",
+    "@sdsrs/code-graph-win32-x64": "0.117.0"
   }
 }