@sdsrs/code-graph 0.116.0 → 0.118.0

package/claude-plugin/scripts/lifecycle.js

@@ -57,7 +57,15 @@ function pluginsCacheDir() { return path.join(claudeHome(), 'plugins', 'cache');
 // unparseable case and left the unreadable one behind — a `chmod 000`
 // settings.json was still destroyed, silently, with no backup. `err.code` is the
 // whole gate; do not widen it back to a bare `catch`.
-function readJsonResult(filePath) {
+// `accept` decides what counts as a USABLE parsed value. It defaults to the
+// settings shape (a plain object) but the statusline registry is a top-level
+// ARRAY, which the default predicate calls corrupt — so the registry gets
+// `accept: Array.isArray` rather than a second, drifting copy of this function.
+function isSettingsObject(value) {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function readJsonResult(filePath, { accept = isSettingsObject } = {}) {
   // Read BYTES, decode separately. `readFileSync(p, 'utf8')` replaces every
   // invalid byte with U+FFFD, and `raw` is what backupCorruptFile writes to the
   // `.corrupt-*` copy before the original is overwritten — so a settings.json
@@ -88,7 +96,7 @@ function readJsonResult(filePath) {
     const value = JSON.parse(raw.trim());
     // `null` / `"str"` / `[]` parse fine but are not a settings object; treating
     // them as "absent" would rebuild over them just the same.
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    if (!accept(value)) {
       return { value: null, missing: false, corrupt: true, raw: bytes };
     }
     // VALID JSON can still have been decoded lossily. `toString('utf8')`
@@ -247,9 +255,25 @@ function readManifest() {
   return readJson(MANIFEST_FILE) || { version: null, config: {} };
 }
 
+// Same tolerant shape as tryWriteSettings, and for the same reason: this is the
+// one write in install()/update() that could still throw. `~/.cache` on a
+// read-only mount, a root-owned cache dir left by a `sudo` run, or a full disk
+// turned a SessionStart into a raw ENOSPC/EACCES stack trace out of a hook whose
+// settings work had already SUCCEEDED (audit 2026-08-16 P1-16). Report it,
+// change nothing else, and let the caller decide.
+// @returns {Error|null} the write error, or null on success
 function writeManifest(manifest) {
-  fs.mkdirSync(CACHE_DIR, { recursive: true });
-  writeJsonAtomic(MANIFEST_FILE, manifest);
+  try {
+    fs.mkdirSync(CACHE_DIR, { recursive: true });
+    writeJsonAtomic(MANIFEST_FILE, manifest);
+    return null;
+  } catch (err) {
+    console.error(
+      `[code-graph] cannot write ${MANIFEST_FILE} (${err.code || err.name}: ${err.message}). ` +
+      'Settings changes (if any) still applied; the next run will redo the version stamp.'
+    );
+    return err;
+  }
 }
 
 function getPluginVersion() {
@@ -325,17 +349,86 @@ function isOurComposite(settings) {
 // --- StatusLine Registry ---
 // Multiple providers can register. The composite script runs them all.
 
-function readRegistry() {
-  const primary = readJson(REGISTRY_FILE);
-  if (primary && Array.isArray(primary) && primary.length > 0) return primary;
+// Read the registry for a caller that may WRITE it back.
+//
+// The registry is USER DATA: `_previous` is the statusline they had before we
+// installed (the only record of it), and third-party providers registered
+// through us live beside it. The lenient reader collapsed "exists but
+// unreadable/corrupt" into the same `[]` as "absent", and the very next
+// writeRegistry() then persisted that empty list over the primary AND the
+// durable backup — one `chmod 000` (a stray sudo, a restrictive umask) and the
+// user's original statusline was unrecoverable, silently, from a call that
+// reported success (audit 2026-08-16 P1-12). Exactly the settings.json bug
+// readJsonResult was written for, on the file two functions below it.
+//
+// Returns `{ registry, refuse }`:
+//   registry — entries to work with (possibly empty)
+//   refuse   — a copy EXISTS and could not be read: write nothing, change nothing
+function readRegistryForWrite() {
+  const asArray = { accept: Array.isArray };
+  const primary = readJsonResult(REGISTRY_FILE, asArray);
+  if (primary.value && primary.value.length > 0) return { registry: primary.value, refuse: false };
+  if (primary.corrupt) {
+    // Fall through to the backup for READING (so callers still see the user's
+    // providers) but never write while the primary is unusable: an atomic
+    // rename replaces an unreadable file just fine, which is precisely how the
+    // data was lost.
+    const backup = readJsonResult(providersBackupFile(), asArray);
+    return {
+      registry: backup.value && backup.value.length > 0 ? backup.value : [],
+      refuse: true,
+      why: `${REGISTRY_FILE} exists but cannot be read as a provider list`,
+    };
+  }
   // Self-heal: primary missing or empty (e.g. user cleaned ~/.cache/code-graph/).
   // Durable backup in ~/.claude/ retains `_previous` + third-party providers.
-  const backup = readJson(providersBackupFile());
-  if (backup && Array.isArray(backup) && backup.length > 0) {
-    try { writeJsonAtomic(REGISTRY_FILE, backup); } catch { /* ok */ }
-    return backup;
+  //
+  // Our OWN entry is dropped unless it names the composite this install would
+  // register right now. The backup lives in `~/.claude/`, which survives the
+  // plugin cache — including an uninstall that refused to rewrite the registry
+  // (`detachStatuslineIntegration`'s oneShot refusal leaves it in place by
+  // design, because rewriting is how the data got lost the first time). So the
+  // NEXT install self-healed the previous install's `code-graph` entry back to
+  // life, pointing at a versioned cache directory that no longer exists — a
+  // zombie provider in the composite chain (2026-08-16 audit §四). `_previous`
+  // and third-party entries are kept: those are the user's data and the reason
+  // this backup exists, and nothing else would restore them.
+  const backup = readJsonResult(providersBackupFile(), asArray);
+  if (backup.value && backup.value.length > 0) {
+    // `codeGraphStatuslineCommand()`, NOT `compositeCommand()`. The registry row
+    // for `code-graph` is written with the former (see the two
+    // `registerStatuslineProvider('code-graph', …)` call sites); the composite is
+    // only ever the value of `settings.statusLine.command`. Comparing against the
+    // composite made this filter drop the row unconditionally — the CURRENT
+    // install's own segment vanished after a cache wipe, which is worse than the
+    // stale-entry resurrection the filter exists to prevent (found by the
+    // v0.118.0 pre-tag review; CI could not see it).
+    const live = codeGraphStatuslineCommand();
+    const healed = backup.value.filter(p => p && (p.id !== 'code-graph' || p.command === live));
+    if (healed.length > 0) {
+      try { writeJsonAtomic(REGISTRY_FILE, healed); } catch { /* ok */ }
+      return { registry: healed, refuse: false };
+    }
   }
-  return [];
+  if (backup.corrupt) {
+    return { registry: [], refuse: true, why: `${providersBackupFile()} exists but cannot be read as a provider list` };
+  }
+  return { registry: [], refuse: false };
+}
+
+function readRegistry() {
+  return readRegistryForWrite().registry;
+}
+
+// One place to say why a registry mutation did nothing. Stderr, not silence:
+// the caller returns `false`, which is indistinguishable from "already
+// registered" to everything upstream.
+function warnRegistryUnusable(action, why) {
+  console.error(
+    `[code-graph] ${why}. Skipping the statusline ${action} — rewriting it would ` +
+    'destroy your previous statusline and any third-party provider entries. ' +
+    'Repair or move the file aside and re-run.'
+  );
 }
 
 function writeRegistry(registry) {
@@ -351,7 +444,11 @@ function writeRegistry(registry) {
 }
 
 function registerStatuslineProvider(id, command, needsStdin) {
-  const registry = readRegistry();
+  const { registry, refuse, why } = readRegistryForWrite();
+  if (refuse) {
+    warnRegistryUnusable('registration', why);
+    return false;
+  }
   const idx = registry.findIndex(p => p.id === id);
   const entry = { id, command, needsStdin: !!needsStdin };
   if (idx >= 0) {
@@ -366,7 +463,11 @@ function registerStatuslineProvider(id, command, needsStdin) {
 }
 
 function unregisterStatuslineProvider(id) {
-  const registry = readRegistry();
+  const { registry, refuse, why } = readRegistryForWrite();
+  if (refuse) {
+    warnRegistryUnusable('removal', why);
+    return false;
+  }
   const filtered = registry.filter(p => p.id !== id);
   if (filtered.length === registry.length) return false;
   writeRegistry(filtered);
@@ -389,11 +490,37 @@ function isPluginInactive(settings = readJson(settingsPath()) || {}) {
   return !hasInstalledPluginRecord();
 }
 
-function detachStatuslineIntegration(settings, { compositeDoomed = true } = {}) {
+function detachStatuslineIntegration(settings, { compositeDoomed = true, oneShot = false } = {}) {
   let settingsChanged = false;
 
-  unregisterStatuslineProvider('code-graph');
-  const registry = readRegistry();
+  // An unusable (not merely absent) registry means we may not WRITE it, and it
+  // may leave us unable to tell whether a `_previous` or third-party entry
+  // exists — which every branch below that rewrites `settings.statusLine`
+  // depends on (batch review of audit 2026-08-16 P1-12: the register path
+  // refused correctly while this detach path still destroyed the slot).
+  //
+  // Whether refusing is safe depends on the CALLER, so it is a parameter:
+  //   retryable (statusline render) — leave everything alone; the next frame
+  //     retries once the file is usable. Touching the slot on a bad read is
+  //     how the user's statusline got destroyed in the first place.
+  //   oneShot (uninstall) — the composite script dies with the plugin cache in
+  //     this same run, so leaving the slot pointing at it is PERMANENT
+  //     breakage with no plugin code left to repair it (pre-tag review). We
+  //     still must not write the registry, but the entries we already READ are
+  //     enough to choose the slot: `readRegistryForWrite` reads through to the
+  //     durable backup even while refusing, so a corrupt primary alone does
+  //     not lose `_previous`. When even that is unreadable the list is empty
+  //     and we clear the slot — Claude Code's default beats a dead path.
+  const { registry, refuse, why } = readRegistryForWrite();
+  if (refuse && !oneShot) {
+    warnRegistryUnusable('detach', why);
+    return false;
+  }
+  if (refuse) {
+    warnRegistryUnusable('registry rewrite (the settings slot is still neutralized — uninstall cannot retry)', why);
+  } else {
+    unregisterStatuslineProvider('code-graph');
+  }
   const previous = registry.find(p => p.id === '_previous' && p.command);
   // Third-party providers registered through our registry (e.g. gsd). They
   // must not be silently orphaned: with the composite gone from settings
@@ -422,8 +549,9 @@ function detachStatuslineIntegration(settings, { compositeDoomed = true } = {})
   }
 
   // _previous only becomes removable once no third party still relies on the
-  // registry file (writeRegistry unlinks primary+backup when emptied).
-  if (thirdParty.length === 0) unregisterStatuslineProvider('_previous');
+  // registry file (writeRegistry unlinks primary+backup when emptied). Skipped
+  // entirely while refusing: that path may not write the registry at all.
+  if (!refuse && thirdParty.length === 0) unregisterStatuslineProvider('_previous');
   return settingsChanged;
 }
 
@@ -1061,13 +1189,17 @@ function install({ reclaimStatusline = false } = {}) {
   manifest.version = version;
   manifest.installedAt = manifest.installedAt || new Date().toISOString();
   manifest.updatedAt = new Date().toISOString();
-  writeManifest(manifest);
+  const manifestErr = writeManifest(manifest);
 
   return {
     version,
     settingsChanged,
     statusLineClaimed: manifest.config.statusLine,
     hooksRegistered,
+    // Unstamped manifest: the install DID land in settings.json, but the next
+    // run will not know it and will redo the work (idempotent). Surfaced so
+    // doctor/session-init can say so instead of implying a clean install.
+    manifestUnwritable: manifestErr ? (manifestErr.code || manifestErr.name) : undefined,
     // Non-null => the previous settings.json was REPLACED and lives here now.
     settingsRebuiltFrom: backedUpTo,
   };
@@ -1109,7 +1241,10 @@ function uninstall({ purgeGlobal = false, unadoptAll = false, runNpm = defaultRu
 
   if (settings) {
     // 1. StatusLine: remove code-graph integration and restore prior statusline.
-    if (detachStatuslineIntegration(settings)) {
+    // `oneShot`: steps 6-7 below delete the plugin cache, taking
+    // statusline-composite.js with it, so this is the last chance to move the
+    // slot off a script that is about to stop existing (pre-tag review).
+    if (detachStatuslineIntegration(settings, { oneShot: true })) {
       settingsChanged = true;
     }
 
@@ -1136,7 +1271,16 @@ function uninstall({ purgeGlobal = false, unadoptAll = false, runNpm = defaultRu
   }
 
   // 5. Remove all known IDs from installed_plugins.json
-  const installedPlugins = readJson(installedPluginsPath());
+  //
+  // Read-modify-write of Claude Code's OWN file. The write is already gated on a
+  // successful parse, so an unusable file is skipped rather than clobbered (the
+  // destructive `|| {}` shape never existed here) — but the skip was SILENT, and
+  // steps 6-7 below still delete the plugin cache. The user then keeps a plugin
+  // record pointing at a directory we removed, with `uninstall` reporting
+  // success. Say so instead (audit 2026-08-16 P1-12 sweep).
+  const installedRead = readJsonResult(installedPluginsPath());
+  const installedPlugins = installedRead.value;
+  let installedPluginsUnusable = false;
   if (installedPlugins && installedPlugins.plugins) {
     let ipChanged = false;
     for (const id of [PLUGIN_ID, ...OLD_PLUGIN_IDS]) {
@@ -1145,7 +1289,24 @@ function uninstall({ purgeGlobal = false, unadoptAll = false, runNpm = defaultRu
         ipChanged = true;
       }
     }
-    if (ipChanged) writeJsonAtomic(installedPluginsPath(), installedPlugins);
+    if (ipChanged) {
+      try {
+        writeJsonAtomic(installedPluginsPath(), installedPlugins);
+      } catch (err) {
+        installedPluginsUnusable = true;
+        console.error(
+          `[code-graph] cannot write ${installedPluginsPath()} (${err.code || err.name}). ` +
+          'Claude Code still lists this plugin — remove it with `/plugin uninstall code-graph-mcp`.'
+        );
+      }
+    }
+  } else if (!installedRead.missing) {
+    installedPluginsUnusable = true;
+    console.error(
+      `[code-graph] cannot read ${installedPluginsPath()} ` +
+      `(${installedRead.error ? installedRead.error.code || installedRead.error.message : 'not a JSON object'}). ` +
+      'Left untouched — Claude Code may still list this plugin; remove it with `/plugin uninstall code-graph-mcp`.'
+    );
   }
 
   // 5.5. Global npm packages + adoption inventory — read BEFORE step 6 wipes
@@ -1208,7 +1369,7 @@ function uninstall({ purgeGlobal = false, unadoptAll = false, runNpm = defaultRu
     try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* ok */ }
   }
 
-  return { settingsChanged, pluginInstalledGlobals, globalPkgsRemoved, globalPkgsRemaining, adoptedProjects, unadopted };
+  return { settingsChanged, pluginInstalledGlobals, globalPkgsRemoved, globalPkgsRemaining, adoptedProjects, unadopted, installedPluginsUnusable };
 }
 
 // --- Update (refresh config points) ---
@@ -1270,7 +1431,7 @@ function update() {
   // 6. Update manifest
   manifest.version = version;
   manifest.updatedAt = new Date().toISOString();
-  writeManifest(manifest);
+  const manifestErr = writeManifest(manifest);
 
   // 7. Clean up old cached versions (keep the newest few). NOTE: older cache
   //    dirs are NOT always inert — a running MCP server's launcher path
@@ -1280,7 +1441,10 @@ function update() {
   //    therefore skips any version still referenced by a live process cmdline.
   cleanupOldCacheVersions(5);
 
-  return { oldVersion, version, settingsChanged, hooksRegistered, settingsRebuiltFrom: backedUpTo };
+  return {
+    oldVersion, version, settingsChanged, hooksRegistered, settingsRebuiltFrom: backedUpTo,
+    manifestUnwritable: manifestErr ? (manifestErr.code || manifestErr.name) : undefined,
+  };
 }
 
 /**
@@ -1528,11 +1692,12 @@ module.exports = {
   isPluginExplicitlyDisabled, isPluginInactive, isPluginUninstalled, removeCacheResidue,
   cleanupDisabledStatusline,
   readManifest, readJson, readJsonResult, readSettingsForWrite, writeJsonAtomic,
-  readRegistry, writeRegistry,
+  readRegistry, readRegistryForWrite, writeRegistry,
   getPluginVersion, cleanupOldCacheVersions,
   removeHooksFromSettings, isOurHookEntry,
   registerHooksToSettings, buildSettingsHookEntries,                  // v0.32.0
   surveyHookCoverage, compositeCommand, compositeSlotIsStale,          // v0.49.1 — version-aware self-heal
+  codeGraphStatuslineCommand,   // exported so a test asserts the row shape the product really writes
   hookCmdScript,                                                       // the ONE hook-command path parser (session-init reuses it)
   cacheDirVersion,                                                     // exported for the separator-agnostic test
 
@@ -1540,7 +1705,7 @@ module.exports = {
   activeInstallPath, isStaleRelicContext,                              // v0.49.1 — stale-relic downgrade guard
   SETTINGS_HOOK_DESC, OUR_HOOK_SCRIPTS, OUR_DESCRIPTIONS,              // v0.32.0 — for tests
   PLUGIN_ROOT,                                                         // v0.32.1 — for tests / consumers
-  registerStatuslineProvider, unregisterStatuslineProvider,
+  registerStatuslineProvider, unregisterStatuslineProvider, detachStatuslineIntegration,
   installedGlobalPkgs, GLOBAL_INSTALL_MARKER, INSTALL_LOCK_FILE, SHELL_PKG,   // uninstall residue
   PLUGIN_ID, OLD_PLUGIN_IDS, MARKETPLACE_NAME, CACHE_DIR, REGISTRY_FILE,
   settingsPath, installedPluginsPath, providersBackupFile, pluginsCacheDir,

package/claude-plugin/scripts/pr-impact-comment.js

@@ -124,11 +124,20 @@ function computeReview(binary, changedFiles, cwd) {
   // Per-file test-gap: a changed PRODUCTION (non-test) file is "uncovered" when
   // running `affected` on it alone surfaces zero test files. Run per-file so the
   // signal is attributable (the aggregate union can't be split back per file).
+  //
+  // `runAffected` returns null for BOTH "spawn failed / timed out / non-zero
+  // exit" and "unparseable output" — none of which say anything about test
+  // coverage. Those files go to `unanalyzed` and are disclosed. Folding them
+  // into the same else-branch as "has tests" made a 60s timeout render as a
+  // covered file: the most dangerous direction for a test-gap report to fail in.
   const uncovered = [];
+  const unanalyzed = [];
   for (const f of changed) {
     if (isTestPath(f)) continue;
     const single = runAffected(binary, ['affected', f, '--json'], cwd, '');
-    if (single && (single.tests || []).length === 0) {
+    if (!single) {
+      unanalyzed.push(f);
+    } else if ((single.tests || []).length === 0) {
       uncovered.push(f);
     }
   }
@@ -145,6 +154,7 @@ function computeReview(binary, changedFiles, cwd) {
     blast_radius: affectedFiles.length,
     top_affected: topAffected,
     uncovered: uncovered.sort(),
+    unanalyzed: unanalyzed.sort(),
   };
 }
 
@@ -177,6 +187,16 @@ function renderMarkdown(review) {
     lines.push('');
   }
 
+  // Absence of a result is not a result. These files are listed apart from the
+  // test gaps because the analysis never produced an answer for them.
+  const unanalyzed = review.unanalyzed || [];
+  if (unanalyzed.length > 0) {
+    lines.push(`### ❔ Not analyzed (${unanalyzed.length})`);
+    lines.push('The `affected` run for these files failed or timed out, so their test coverage is unknown:');
+    for (const p of unanalyzed) lines.push(`- \`${p}\``);
+    lines.push('');
+  }
+
   if (review.tests.length > 0) {
     lines.push('<details><summary>Tests to re-run</summary>', '');
     for (const t of review.tests) lines.push(`- \`${t}\``);
@@ -265,11 +285,23 @@ function main(argv) {
     process.stdout.write(body + '\n');
   }
 
+  const unanalyzed = review.unanalyzed || [];
+  if (unanalyzed.length > 0) {
+    console.error(`[pr-impact] ${unanalyzed.length} changed file(s) could not be analyzed: ${unanalyzed.join(', ')}`);
+  }
+
   const failOnRisk = /^(1|true|yes)$/i.test(process.env.CODE_GRAPH_FAIL_ON_RISK || '');
   if (failOnRisk && review.uncovered.length > 0) {
     console.error(`[pr-impact] fail-on-risk: ${review.uncovered.length} changed file(s) have no covering test.`);
     process.exit(1);
   }
+  // A file the analyzer never answered for is unmeasured risk, not cleared
+  // risk: under an explicit fail-on-risk gate it blocks like a test gap does,
+  // with its own message so the two causes stay distinguishable in CI logs.
+  if (failOnRisk && unanalyzed.length > 0) {
+    console.error(`[pr-impact] fail-on-risk: ${unanalyzed.length} changed file(s) could not be analyzed.`);
+    process.exit(1);
+  }
 }
 
 if (require.main === module) {

package/claude-plugin/scripts/pre-edit-guide.js

@@ -14,7 +14,7 @@ const { cgTmpDir, cwdHash } = require('./tmp-dir');
 const { resolveProjectRoot } = require('./project-root');
 const { recordRecommendation } = require('./recommendation-log');
 const { formatCoveringTests } = require('./covering-tests');
-const { emitPreToolAllowContext } = require('./hook-emit');
+const { emitPreToolContext } = require('./hook-emit');
 const { hidden } = require('./proc-opts');
 
 // v0.49 — walk up from the shell cwd (subdir-cwd fix). The per-cwd index.db
@@ -217,10 +217,18 @@ summary += formatCoveringTests(jsonResult.test_callers, editedFile);
 // fire with the count alone — the verdict must stay coherent either way.
 summary += `  → Before this edit: confirm each caller of ${symbol}() still holds with your change, or note why it is unaffected.\n`;
 
-// Compound-grep sibling sweep: deliver via the PreToolUse allow+additionalContext
-// envelope (shared hook-emit.js). Bare stdout on a PreToolUse exit-0 lands in the
-// debug log only and never reaches the model (CC docs v2026-06); additionalContext
-// is what actually surfaces the impact summary. Impact must stay PRE-edit (so the
-// reconciliation happens before the change), hence allow + additionalContext, not
-// a PostToolUse inject.
-process.stdout.write(emitPreToolAllowContext(summary) + '\n');
+// Deliver via the PERMISSION-NEUTRAL PreToolUse additionalContext envelope
+// (shared hook-emit.js). Bare stdout on a PreToolUse exit-0 lands in the debug
+// log only and never reaches the model (CC docs v2026-06); additionalContext is
+// what surfaces the impact summary, and it is delivered without any
+// permissionDecision — the tool's normal permission flow is untouched.
+//
+// It used to send `permissionDecision: 'allow'` alongside it. That is documented
+// as "skip the interactive permission prompt", so on a machine that prompts for
+// Edit this hook silently answered that prompt for the user, for every symbol
+// with >=1 caller outside the 2-minute cooldown (audit 2026-08-16 P0-2). Context
+// delivery is never worth a write consent: if a future CC requires a decision to
+// carry additionalContext, this summary goes quiet rather than elevating again.
+// Impact must stay PRE-edit (the reconciliation happens before the change), so a
+// PostToolUse inject is not an alternative here.
+process.stdout.write(emitPreToolContext(summary) + '\n');

package/claude-plugin/scripts/proc-opts.js

@@ -16,6 +16,21 @@
  * ALLOCATING a console — inherited stdio handles still work, so an interactive
  * `doctor` run in a real terminal is unaffected. No-op on non-Windows.
  *
+ * `killSignal` is deliberately NOT defaulted here. Node's `timeout` option
+ * sends SIGTERM and then WAITS, so a child that traps SIGTERM makes the
+ * timeout unreachable (audit 2026-08-16 P1-17: one deaf third-party statusline
+ * provider blanked the status line on every frame). The two statusline call
+ * sites pass `killSignal: 'SIGKILL'` themselves — they run UNTRUSTED provider
+ * commands / a possibly-wedged binary on the render hot path, and nothing
+ * there shuts down gracefully at timeout anyway. It is not a global default
+ * because our other timed children DO need SIGTERM's grace: a timed-out
+ * `git pull` hard-killed mid-write leaves `.git/index.lock` behind and every
+ * later marketplace refresh then fails silently; npm has equivalent lock
+ * files (batch review of the P1-17 fix). New call sites that run untrusted or
+ * hang-prone children with a timeout should opt in the same way.
+ * (Caveat SIGKILL does not fix: it reaches the direct child only. A grandchild
+ * holding the same stdout pipe can still stall a *Sync call until it exits.)
+ *
  * Every child_process call site under claude-plugin/scripts/ must route through
  * here (or set windowsHide itself); `windows-hide.test.js` fails the build on a
  * new call site that doesn't.

package/claude-plugin/scripts/session-init.js

@@ -216,6 +216,21 @@ function reportRebuild(r) {
       `still need (model / env / permissions / your own hooks) back by hand.\n`
     );
   }
+  // install()/update() have reported `manifestUnwritable` since they learned not
+  // to throw on it, and NOBODY read the field — so a manifest that could not be
+  // written (EACCES after a stray sudo, EROFS, a full disk) produced a silent
+  // partial install. It is not cosmetic: `syncLifecycleConfig` keys entirely off
+  // `manifest.version`, so an unwritten manifest makes every future SessionStart
+  // re-run install() and re-report 'installed', forever, with nothing to show
+  // for it (audit 2026-08-16 review Minor tail).
+  if (r && r.manifestUnwritable) {
+    process.stdout.write(
+      `[code-graph] The plugin manifest could not be written (${r.manifestUnwritable}). ` +
+      'Hooks are registered but the install will not be remembered, so this runs again ' +
+      'every session. Check permissions on ~/.claude/plugins/, then run ' +
+      '`code-graph-mcp doctor`.\n'
+    );
+  }
   return r;
 }
 function installReporting(...args) { return reportRebuild(install(...args)); }
@@ -609,7 +624,36 @@ function runSessionInit({ source } = {}) {
   // 上下文感知默认：插件模式下首次 SessionStart 自动安装（创建/注入 CLAUDE.md 块 +
   // .claude/ detail 文件），并清理旧 memory-dir 制品（升级自动迁移）。shipped 漂移
   // 时刷新。三种情况发一次 stderr 提示，让用户知道发生了什么 + 如何回退。
-  const autoAdopt = isRelic ? { attempted: false, result: null } : maybeAutoAdopt({ scriptPath: __dirname });
+  // Adoption is OPTIONAL; the rest of this hook is not. It touches files the
+  // user owns (CLAUDE.md, .claude/) which can be unreadable, a directory, or on
+  // a read-only mount — and a throw here used to abort every remaining step
+  // (map injection, recent impact, consistency check, both hook canaries) with a
+  // raw stack trace (audit 2026-08-16 P1-16). adopt() now returns reasons rather
+  // than throwing; this is the belt to that suspenders, so a future unguarded
+  // read inside it cannot take the session down again.
+  let autoAdopt = { attempted: false, result: null };
+  if (!isRelic) {
+    try {
+      autoAdopt = maybeAutoAdopt({ scriptPath: __dirname });
+    } catch (e) {
+      autoAdopt = { attempted: true, reason: 'threw', result: null, error: (e && e.message) || String(e) };
+      process.stderr.write(
+        `[code-graph] Skipped CLAUDE.md adoption for this project (${(e && e.code) || (e && e.message) || 'unknown error'}).\n` +
+        '            Everything else in this session start continues normally.\n'
+      );
+    }
+  }
+  if (autoAdopt.result && autoAdopt.result.ok === false &&
+      (autoAdopt.result.reason === 'claude-md-unreadable' || autoAdopt.result.reason === 'claude-md-unwritable' ||
+       autoAdopt.result.reason === 'detail-unwritable')) {
+    // A refusal is not a silent no-op: the user's steering block is NOT
+    // installed/refreshed, and only this line says so.
+    process.stderr.write(
+      `[code-graph] Could not install the CLAUDE.md steering block (${autoAdopt.result.reason}: ` +
+      `${autoAdopt.result.error || 'unknown'}). Nothing was changed.\n` +
+      '            Opt out permanently: CODE_GRAPH_NO_AUTO_ADOPT=1\n'
+    );
+  }
   const migrated = autoAdopt.migrated || {};
   if (migrated.memoryIndexPruned || migrated.legacyDetailRemoved) {
     process.stderr.write(
@@ -637,6 +681,20 @@ function runSessionInit({ source } = {}) {
         '            Reverse:    code-graph-mcp unadopt\n'
       );
     }
+    // `adopt()` has returned `registryRecorded` since it stopped throwing on a
+    // broken registry, and nothing read it. The consequence is not cosmetic:
+    // `uninstall()` walks that registry to strip our managed block from every
+    // adopted project's CLAUDE.md, so an unrecorded project keeps the block
+    // FOREVER after uninstall, with no plugin code left to remove it — the
+    // teardown-asymmetry class this repo has already been bitten by (audit
+    // 2026-08-16 review Minor tail).
+    if (autoAdopt.result.registryRecorded === false) {
+      process.stderr.write(
+        '[code-graph] Note: this project could not be recorded in the adopted-projects registry,\n' +
+        '            so `/plugin uninstall` will NOT strip the block from this CLAUDE.md.\n' +
+        '            Remove it by hand with `code-graph-mcp unadopt` before uninstalling.\n'
+      );
+    }
   }
 
   // quietHooks: default quiet (project_map injection duplicates MEMORY.md +
@@ -889,5 +947,18 @@ if (require.main === module) {
       source = JSON.parse(fs.readFileSync(0, 'utf8')).source;
     }
   } catch { /* no/garbled stdin → treat as unknown source */ }
-  runSessionInit({ source });
+  // Hooks FAIL OPEN. This one had no wrapper at all, so anything unhandled
+  // anywhere in the sequence surfaced as a node stack trace plus a non-zero exit
+  // in the user's session start — for work that is entirely optional
+  // housekeeping (audit 2026-08-16 P1-16). One `[code-graph]` line, exit 0.
+  try {
+    runSessionInit({ source });
+  } catch (e) {
+    process.stderr.write(
+      `[code-graph] SessionStart hook error (${(e && e.code) || (e && e.name) || 'Error'}): ` +
+      `${(e && e.message) || String(e)}\n` +
+      '            The session continues; run `code-graph-mcp doctor` if this repeats.\n'
+    );
+    process.exit(0);
+  }
 }

package/claude-plugin/scripts/statusline-chain.js

@@ -16,7 +16,21 @@
 // (this plugin's own provider). Third parties should use stable ids like
 // "gsd", "claude-mem", etc.
 
-const { readRegistry, registerStatuslineProvider, unregisterStatuslineProvider } = require('./lifecycle');
+const {
+  readRegistry, readRegistryForWrite, registerStatuslineProvider, unregisterStatuslineProvider,
+} = require('./lifecycle');
+
+// A registry that EXISTS but cannot be read is a refusal, not a no-op: the
+// mutation functions leave it alone (they must — it holds the user's previous
+// statusline and other plugins' entries), which would otherwise surface here as
+// the cheerful "unchanged <id>" / "not-found <id>" at exit 0. A third-party
+// installer reading that exit code would believe it is wired in.
+function bailIfRegistryUnusable(action) {
+  const { refuse, why } = readRegistryForWrite();
+  if (!refuse) return;
+  process.stderr.write(`error: ${why} — nothing ${action}. Repair or move that file aside and retry.\n`);
+  process.exit(2);
+}
 
 function usage(code = 1) {
   process.stderr.write(
@@ -34,12 +48,14 @@ function runRegister(id, command, needsStdin) {
     process.exit(2);
   }
   if (!id || !command) usage();
+  bailIfRegistryUnusable('registered');
   const changed = registerStatuslineProvider(id, command, needsStdin);
   process.stdout.write(changed ? `registered ${id}\n` : `unchanged ${id}\n`);
 }
 
 function runUnregister(id) {
   if (!id) usage();
+  bailIfRegistryUnusable('unregistered');
   const changed = unregisterStatuslineProvider(id);
   process.stdout.write(changed ? `unregistered ${id}\n` : `not-found ${id}\n`);
 }

package/claude-plugin/scripts/statusline-composite.js

@@ -89,6 +89,9 @@ function runProvider(command, needsStdin, stdin) {
 
     const out = execFileSync(argv[0], argv.slice(1), hidden({
       timeout: 3000,
+      // SIGKILL, not the SIGTERM default: a provider that traps SIGTERM makes
+      // Node's timeout unreachable and hangs every render (audit P1-17).
+      killSignal: 'SIGKILL',
       stdio: ['pipe', 'pipe', 'pipe'],
       input: needsStdin ? stdin : '',
       env,

package/claude-plugin/scripts/statusline.js

@@ -187,6 +187,9 @@ try {
   // "slow health-check" into a rendered "offline"/"updating" instead of a blank.
   report = parseReport(execFileSync(bin, ['health-check', '--format', 'json'], hidden({
     timeout: 1500,
+    // Render hot path: a wedged binary ignoring SIGTERM must not outlive the
+    // budget (same reasoning as the composite's provider spawn, audit P1-17).
+    killSignal: 'SIGKILL',
     stdio: ['pipe', 'pipe', 'pipe'],
     // Run the binary FROM the resolved root so its own project-root resolution
     // lands on the same DB the gate above picked (a subdir cwd would otherwise