@sdsrs/code-graph 0.117.0 → 0.118.0

package/README.md

@@ -109,6 +109,9 @@ Real-world benchmarks comparing code-graph-mcp tools against traditional approac
 ```
 src/
 ├── domain.rs     # Shared constants, relation types, env-var config
+├── resolve.rs    # Shared symbol resolution + ambiguity verdicts (CLI and MCP)
+├── outcome.rs    # Retrieval-adoption metrics from session transcripts
+├── cli/          # Every `code-graph-mcp <cmd>` subcommand (one file per command)
 ├── mcp/          # MCP protocol layer (JSON-RPC, tool registry, server)
 │   └── server/   # McpServer with IndexingState + CacheState sub-structs
 ├── parser/       # Tree-sitter parsing, relation extraction, LanguageConfig dispatch
@@ -117,6 +120,7 @@ src/
 ├── graph/        # Recursive CTE call graph queries
 ├── search/       # RRF fusion search combining BM25 + vector
 ├── embedding/    # Candle embedding model (optional, masked mean pooling)
+├── snapshot/     # Portable graph snapshots (create / verify / install)
 ├── sandbox/      # Context compressor with token estimation
 └── utils/        # Language detection, config
 ```
@@ -301,6 +305,21 @@ All tools are also available as CLI subcommands for shell scripts, hooks, and te
 | `incremental-index` | — | Run incremental index update (auto-creates DB if needed) |
 | `health-check` | `get_index_status` | Query index status and freshness |
 | `benchmark` | — | Benchmark index speed, query latency, token savings |
+| `affected [files…]` | — | Changed files → the test files to re-run (`--stdin`, `--depth`) |
+| `tour [path]` | — | Dependency-ordered reading order for a repo or subtree |
+| `centrality` | `project_map` (`include_centrality=true`) | Rank architectural chokepoints (betweenness over the call graph) |
+| `cycles` | — | Detect circular import dependencies (file-level) |
+| `surprising` | — | Surface unexpected cross-module couplings (uncertain edges) |
+| `report` | — | Consolidated code-health report (summary + all analyses) |
+| `stats` | — | Aggregate session metrics from `.code-graph/usage.jsonl` |
+| `outcome` | — | Retrieval adoption from session transcripts (field-MRR; read-only) |
+| `rebuild-index` | `rebuild_index` | Drop and rebuild the index from scratch (requires `--confirm`) |
+| `reindex` | — | Incremental refresh; `--from-snapshot` refetches the published snapshot |
+| `snapshot create\|inspect` | — | Build or inspect a portable graph snapshot |
+| `doctor` | — | Diagnose and repair environment issues |
+| `adopt` | — | Install the steering block into the project `CLAUDE.md` + detail doc |
+| `unadopt` | — | Remove the steering block + detail doc |
+| `serve` | — | Start the MCP JSON-RPC server on stdio (the default with no subcommand) |
 
 Common options: `--json` (JSON output), `--compact` (compact output), `--limit N`, `--depth N`, `--file <path>`.
 

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.117.0",
+  "version": "0.118.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -7,7 +7,7 @@ const http = require('http');
 const crypto = require('crypto');
 const path = require('path');
 const os = require('os');
-const { CACHE_DIR, PLUGIN_ID, MARKETPLACE_NAME, readManifest, readJson, writeJsonAtomic, installedPluginsPath, pluginsCacheDir } = require('./lifecycle');
+const { CACHE_DIR, PLUGIN_ID, MARKETPLACE_NAME, readManifest, readJson, readJsonResult, writeJsonAtomic, installedPluginsPath, pluginsCacheDir } = require('./lifecycle');
 const { claudeHome } = require('./claude-config');
 const { clearCache: clearBinaryCache, globalNodeModulesCandidates, nvmNodeModulesDirs, PLATFORM_PKG, detectLibc } = require('./find-binary');
 const { readBinaryVersion, compareVersions, isDevMode } = require('./version-utils');
@@ -118,14 +118,53 @@ function getPlatformAssetName({ platform = os.platform(), arch = os.arch(), libc
 
 // ── State Persistence ──────────────────────────────────────
 
+// `readJson(STATE_FILE) || {}` was the lossy-read shape the audit swept for on
+// settings.json — still live here, on the one file that holds THREE independent
+// give-up budgets: the update suspension (`updateAttempts` / `suspendedAt`), the
+// binary self-heal budget (`binaryHealAttempts`) and the GitHub rate-limit
+// backoff (`rateLimited` + `lastCheck`). Collapsing "could not read it" into
+// "fresh install" re-armed all three at once, so one corrupt or unreadable cache
+// file turned off every guard that exists to stop an unbounded retry loop —
+// silently, and on every session thereafter (audit 2026-08-16 review Minor tail).
+//
+// Only a genuine ENOENT (or an empty file, which is what a crash mid-write
+// leaves) may be read as a fresh start. Anything else returns the marker below;
+// `checkForUpdate` skips the session and rewrites a clean file, so the next
+// session starts from real state rather than looping here.
 function readState() {
-  return readJson(STATE_FILE) || {};
+  const res = readJsonResult(STATE_FILE);
+  if (res.value) return res.value;
+  if (res.missing) return {};
+  return { stateUnreadable: (res.error && res.error.code) || 'invalid-json' };
 }
 
+// One stderr line per process when the state file cannot be written. Not a
+// throw: the caller's job (checking for an update) is unaffected, and a hook that
+// dies over its own bookkeeping is worse than one that keeps going. But not
+// silence either — every throttle in this file (update cooldown, GitHub
+// rate-limit backoff, binary self-heal budget) is stored in that one file, so a
+// read-only or full ~/.claude means the updater re-runs its whole check EVERY
+// session, forever, with nothing anywhere saying why (2026-08-16 audit §四).
+// The unlink/cleanup `catch {}`s elsewhere in this file stay silent on purpose:
+// a failed cleanup costs a stale temp file, not a broken invariant.
+let stateWriteWarned = false;
 function saveState(state) {
   try {
-    writeJsonAtomic(STATE_FILE, state);
-  } catch { /* ok */ }
+    // The marker is an in-memory signal, never a persisted field: several call
+    // sites do `saveState({ ...readState(), ... })`, and a persisted
+    // `stateUnreadable` would park the updater permanently.
+    const { stateUnreadable, ...clean } = state || {};
+    void stateUnreadable;
+    writeJsonAtomic(STATE_FILE, clean);
+  } catch (e) {
+    if (!stateWriteWarned) {
+      stateWriteWarned = true;
+      console.error(
+        `[code-graph] Could not save update state to ${STATE_FILE} (${e && e.message ? e.message : e}). ` +
+        'Update throttling and rate-limit backoff will not persist across sessions.',
+      );
+    }
+  }
 }
 
 // ── Throttle ───────────────────────────────────────────────
@@ -610,8 +649,13 @@ async function downloadAndInstall(latest, {
       return { pluginUpdated: false, binaryUpdated: await downloadBin(latest), marketplaceRefreshed: false };
     }
     const tarballPath = path.join(tmpDir, PLUGIN_ASSET_NAME);
+    // `-f` like every sibling fetch in this file (the binary at :435 and both
+    // sha256 sidecars). This was the one download without it, so a 404/503 wrote
+    // GitHub's HTML body here and exited 0; the checksum below still failed
+    // closed, but as "sha mismatch" — a wrong diagnosis of a fetch that never
+    // succeeded (2026-08-16 audit §四).
     exec('curl', [
-      '-sL', '-o', tarballPath,
+      '-sfL', '-o', tarballPath,
       '-H', 'Accept: application/octet-stream',
       latest.pluginTarballUrl,
     ], hidden({ timeout: 30000, stdio: 'pipe' }));
@@ -966,6 +1010,16 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
     // bypasses auto-update.js, so re-sync state.installedVersion every call.
     const installedVersion = readManifest().version || '0.0.0';
 
+    // A state we could not read authorises nothing: every throttle, budget and
+    // suspension below is derived from it, so acting on a blank stand-in would
+    // bypass all of them at once. Skip this session and rewrite a clean file —
+    // `lastCheck` stamped now means the ordinary interval applies from here, so
+    // the recovery is bounded rather than an immediate retry.
+    if (state.stateUnreadable) {
+      saveState({ installedVersion, lastCheck: new Date().toISOString() });
+      return null;
+    }
+
     // Time-based throttle. Two conditions override it: a missing cache binary
     // (launcher cannot start) and a present-but-stale binary (otherwise it stays
     // pinned to the old version for up to a full check interval — the binary

package/claude-plugin/scripts/doctor.js

@@ -12,7 +12,7 @@ const {
 } = require('./lifecycle');
 const { findBinary, clearCache: clearBinaryCache } = require('./find-binary');
 const { hidden } = require('./proc-opts');
-const { MAX_UPDATE_ATTEMPTS } = require('./auto-update');
+const { MAX_UPDATE_ATTEMPTS, isBinaryHealExhausted } = require('./auto-update');
 
 // ── Diagnostics ───────────────────────────────────────────
 
@@ -29,7 +29,7 @@ function classifyEmbeddings(hc) {
   const ep = (hc && hc.embedding_progress) || '0/0';
   const [done, total] = ep.split('/').map(Number);
   if (hc && hc.model_available === false) {
-    return { name: 'Embeddings', status: 'warn',
+    return { name: 'Embeddings', status: 'warn', advisory: true,
       detail: 'binary built without embed-model — semantic search is FTS5-only; reinstall via npm/plugin for the hybrid binary' };
   }
   if (!total) {
@@ -65,7 +65,7 @@ function classifyEmbeddings(hc) {
               ? `last model download: ${hc.model_download}`
               : 'model not loaded and NO download has ever been attempted on this machine — restart the MCP server, or set CODE_GRAPH_MODEL_DIR to a manually populated model dir (see README → Offline usage)')
       : `embedding_status=${(hc && hc.embedding_status) || 'unknown'}`;
-    return { name: 'Embeddings', status: 'warn',
+    return { name: 'Embeddings', status: 'warn', advisory: true,
       detail: `vector INACTIVE — ${total} embeddable nodes, 0 embedded; semantic search is FTS5-only (${why})` };
   }
   if (done < total) {
@@ -156,7 +156,10 @@ function classifyHealthReport(hc) {
   }
   const rows = [];
   if (hc.issue && String(hc.issue).includes('schema')) {
-    rows.push({ name: 'Schema', status: 'warn', detail: hc.issue, fixId: 'schema-mismatch' });
+    // advisory: its "repair" only prints guidance (migration happens when the
+    // binary next runs), so it can never be counted fixed and would pin the
+    // exit code at 1 forever.
+    rows.push({ name: 'Schema', status: 'warn', advisory: true, detail: hc.issue, fixId: 'schema-mismatch' });
   } else {
     rows.push({ name: 'Schema', status: 'ok', detail: `v${hc.schema_version}` });
   }
@@ -406,6 +409,7 @@ function runDiagnostics({ checkOnly = false } = {}) {
     results.push({
       name: 'Hooks',
       status: 'warn',
+      advisory: true,
       detail:
         `settings.json was unusable and has been REBUILT — your original is at ` +
         `${hookResult.rebuiltFrom}. Merge anything you need back by hand.`,
@@ -534,6 +538,7 @@ function runDiagnostics({ checkOnly = false } = {}) {
       results.push({
         name: 'Global npm relics',
         status: 'warn',
+        advisory: true,
         detail: relics.map((r) => `${r.name}@${r.version} (${r.nodeModulesDir.replace(home, '~')})`).join('; ')
           + ' — installed under a non-active node version; auto-heal cannot reach another node\'s prefix. '
           + 'Remove each via `nvm use <that node> && npm rm -g <pkg>`, or uninstall the unused node (`nvm uninstall <ver>`).',
@@ -800,6 +805,20 @@ function autoUpdateNoOpReason(state = readUpdateState(), env = process.env) {
     return `auto-update is SUSPENDED after ${state.updateAttempts} failed attempts on v${state.latestVersion} `
       + '(it retries once a day, and immediately when a newer release is published)';
   }
+  // The BINARY self-heal carries its own budget, independent of the update
+  // suspension above: the updater can be perfectly healthy while the binary
+  // download has given up on this release. That is precisely the state a
+  // `binary-broken` / stale-version row comes from, and it was the one parked
+  // state doctor could not name — so the user was told to update manually with
+  // no hint that the automatic repair had already stopped trying (audit
+  // 2026-08-16 review Minor tail). Uses the updater's own predicate rather than
+  // a second copy of the condition, which is keyed to `latestVersion` and so
+  // re-arms itself when a newer release appears.
+  if (isBinaryHealExhausted(state)) {
+    return `the binary self-heal has given up on v${state.latestVersion} after `
+      + `${state.binaryHealAttempts} failed download attempts (it re-arms when a newer `
+      + 'release is published)';
+  }
   if (state.rateLimited) {
     return 'the updater is in its GitHub rate-limit backoff (up to 1h)';
   }
@@ -1126,17 +1145,30 @@ function runRepairs(results, {
 // ── Main ──────────────────────────────────────────────────
 
 // Exit status for a doctor run reflects what remains BROKEN, not what was found:
-//   --check-only → every found issue is unresolved (report cleanliness, no repair).
-//   repair mode  → issueCount minus what runRepairs resolved. A run that fixes
+//   --check-only → every found BLOCKING issue is unresolved (report cleanliness,
+//                  no repair).
+//   repair mode  → blocking count minus what runRepairs resolved. A run that fixes
 //                  everything ("N/N addressed") reports 0 so `doctor && …` and
 //                  self-heal automation don't read a successful repair as a
 //                  failure. runRepairs counts an issue fixed only when its repair
 //                  reports success — and the hooks arm re-scans after install() to
 //                  confirm, so a still-broken re-scan is NOT counted (stays
-//                  unresolved → exit 1). An issue with no working repair
-//                  (schema-mismatch is advisory only) likewise keeps this > 0.
+//                  unresolved → exit 1).
+//
+// `advisory: true` rows are excluded. They are reported like any other warn but
+// describe something this tool cannot act on and that is not broken: a binary
+// deliberately built without embed-model, npm relics under a node version whose
+// prefix we cannot reach, a settings.json we already rebuilt, a schema note whose
+// "repair" only prints guidance. Every one of those used to pin the exit code at
+// 1 for the life of the install, so `doctor && <next step>` could never proceed —
+// a permanently-red check is one nobody reads (2026-08-16 audit §四).
+//
+// Advisory is an EXPLICIT marker, never inferred from a missing fixId: inferring
+// it would silently exempt the next row somebody forgets to wire to a repair,
+// which is the opposite failure. `doctor_rows_are_repairable_or_advisory`
+// (doctor.test.js) holds that line.
 function unresolvedCount({ checkOnly, issueCount, fixed }) {
-  return checkOnly ? issueCount : issueCount - fixed;
+  return checkOnly ? issueCount : Math.max(0, issueCount - fixed);
 }
 
 function runDoctor(opts = {}) {
@@ -1144,15 +1176,20 @@ function runDoctor(opts = {}) {
   console.log(formatReport(results, { checkOnly: opts.checkOnly }));
 
   const issues = results.filter(r => r.status === 'warn' || r.status === 'error');
+  const blocking = issues.filter(r => !r.advisory);
 
   let fixed = 0;
   if (issues.length > 0 && !opts.checkOnly) {
     fixed = runRepairs(results);
-    console.log(`\n  ${fixed}/${issues.length} issue(s) addressed.`);
+    console.log(`\n  ${fixed}/${blocking.length} issue(s) addressed.`);
+    const advisoryCount = issues.length - blocking.length;
+    if (advisoryCount > 0) {
+      console.log(`  ${advisoryCount} advisory note(s) above need no action here.`);
+    }
   }
 
   const unresolved = unresolvedCount({
-    checkOnly: opts.checkOnly, issueCount: issues.length, fixed,
+    checkOnly: opts.checkOnly, issueCount: blocking.length, fixed,
   });
   return { results, issueCount: issues.length, unresolved };
 }

package/claude-plugin/scripts/hook-emit.js

@@ -26,6 +26,44 @@
 //     permissionDecision), so the Bash-side grep answer can be injected without
 //     skipping CC's default permission prompt for the underlying tool call.
 
+// Ceiling on injected context, applied at the ONE place all three hooks emit
+// through. `cg-answer.js` has capped its own output at 4000 bytes since it was
+// written; the hook payloads it sits alongside had no cap at all, and they are
+// assembled from unbounded lists — pre-edit-guide joins every direct caller's
+// `name (file)` onto a single line, so editing a 200-caller symbol injected a
+// multi-kilobyte wall into the model's context on every Edit (2026-08-16 audit
+// §四). This is the model's context window, not a log: the whole value of an
+// impact summary is that it is small enough to read.
+//
+// Truncation is announced, never silent — a summary that stops mid-list without
+// saying so is worse than one that says it was cut, because the reader cannot
+// tell a short blast radius from a clipped one.
+const MAX_INJECTED_BYTES = 4000;
+
+function capContext(text) {
+  const s = String(text == null ? '' : text);
+  if (Buffer.byteLength(s, 'utf8') <= MAX_INJECTED_BYTES) return s;
+  const notice = `\n  … truncated at ${MAX_INJECTED_BYTES} bytes — re-run the CLI command above for the full result.\n`;
+  const budget = MAX_INJECTED_BYTES - Buffer.byteLength(notice, 'utf8');
+  // Slice on a UTF-16 code-unit boundary that fits the byte budget. This keeps
+  // the byte cap exact and never splits a 1-3 byte UTF-8 character (ASCII, Latin,
+  // CJK — what file paths and symbol names actually contain). It CAN split an
+  // astral-plane character (emoji, 2 code units) into a lone surrogate:
+  // `JSON.stringify` escapes that, so the envelope stays parseable and the model
+  // sees one replacement character at the cut. Saying so rather than claiming
+  // "never cut in half", which is what this comment used to claim (v0.118.0
+  // pre-tag review verified the emoji case).
+  let end = s.length;
+  while (end > 0 && Buffer.byteLength(s.slice(0, end), 'utf8') > budget) {
+    end -= Math.max(1, Math.ceil((Buffer.byteLength(s.slice(0, end), 'utf8') - budget) / 4));
+  }
+  // Prefer cutting at the last newline inside the budget, so the truncated text
+  // ends on a whole line rather than mid-token.
+  const nl = s.lastIndexOf('\n', end);
+  if (nl > budget / 2) end = nl;
+  return s.slice(0, end) + notice;
+}
+
 /**
  * PreToolUse additionalContext envelope with NO permissionDecision (string, no
  * trailing newline). The permission-neutral shape: the tool's normal permission
@@ -37,7 +75,7 @@ function emitPreToolContext(text) {
   return JSON.stringify({
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',
-      additionalContext: text,
+      additionalContext: capContext(text),
     },
   });
 }
@@ -57,7 +95,7 @@ function emitPreToolAllowContext(text) {
     hookSpecificOutput: {
       hookEventName: 'PreToolUse',
       permissionDecision: 'allow',
-      additionalContext: text,
+      additionalContext: capContext(text),
     },
   });
 }
@@ -73,9 +111,12 @@ function emitPostToolContext(text) {
   return JSON.stringify({
     hookSpecificOutput: {
       hookEventName: 'PostToolUse',
-      additionalContext: text,
+      additionalContext: capContext(text),
     },
   });
 }
 
-module.exports = { emitPreToolContext, emitPreToolAllowContext, emitPostToolContext };
+module.exports = {
+  emitPreToolContext, emitPreToolAllowContext, emitPostToolContext,
+  capContext, MAX_INJECTED_BYTES,
+};

package/claude-plugin/scripts/lifecycle.js

@@ -382,10 +382,33 @@ function readRegistryForWrite() {
   }
   // Self-heal: primary missing or empty (e.g. user cleaned ~/.cache/code-graph/).
   // Durable backup in ~/.claude/ retains `_previous` + third-party providers.
+  //
+  // Our OWN entry is dropped unless it names the composite this install would
+  // register right now. The backup lives in `~/.claude/`, which survives the
+  // plugin cache — including an uninstall that refused to rewrite the registry
+  // (`detachStatuslineIntegration`'s oneShot refusal leaves it in place by
+  // design, because rewriting is how the data got lost the first time). So the
+  // NEXT install self-healed the previous install's `code-graph` entry back to
+  // life, pointing at a versioned cache directory that no longer exists — a
+  // zombie provider in the composite chain (2026-08-16 audit §四). `_previous`
+  // and third-party entries are kept: those are the user's data and the reason
+  // this backup exists, and nothing else would restore them.
   const backup = readJsonResult(providersBackupFile(), asArray);
   if (backup.value && backup.value.length > 0) {
-    try { writeJsonAtomic(REGISTRY_FILE, backup.value); } catch { /* ok */ }
-    return { registry: backup.value, refuse: false };
+    // `codeGraphStatuslineCommand()`, NOT `compositeCommand()`. The registry row
+    // for `code-graph` is written with the former (see the two
+    // `registerStatuslineProvider('code-graph', …)` call sites); the composite is
+    // only ever the value of `settings.statusLine.command`. Comparing against the
+    // composite made this filter drop the row unconditionally — the CURRENT
+    // install's own segment vanished after a cache wipe, which is worse than the
+    // stale-entry resurrection the filter exists to prevent (found by the
+    // v0.118.0 pre-tag review; CI could not see it).
+    const live = codeGraphStatuslineCommand();
+    const healed = backup.value.filter(p => p && (p.id !== 'code-graph' || p.command === live));
+    if (healed.length > 0) {
+      try { writeJsonAtomic(REGISTRY_FILE, healed); } catch { /* ok */ }
+      return { registry: healed, refuse: false };
+    }
   }
   if (backup.corrupt) {
     return { registry: [], refuse: true, why: `${providersBackupFile()} exists but cannot be read as a provider list` };
@@ -1674,6 +1697,7 @@ module.exports = {
   removeHooksFromSettings, isOurHookEntry,
   registerHooksToSettings, buildSettingsHookEntries,                  // v0.32.0
   surveyHookCoverage, compositeCommand, compositeSlotIsStale,          // v0.49.1 — version-aware self-heal
+  codeGraphStatuslineCommand,   // exported so a test asserts the row shape the product really writes
   hookCmdScript,                                                       // the ONE hook-command path parser (session-init reuses it)
   cacheDirVersion,                                                     // exported for the separator-agnostic test
 

package/claude-plugin/scripts/session-init.js

@@ -216,6 +216,21 @@ function reportRebuild(r) {
       `still need (model / env / permissions / your own hooks) back by hand.\n`
     );
   }
+  // install()/update() have reported `manifestUnwritable` since they learned not
+  // to throw on it, and NOBODY read the field — so a manifest that could not be
+  // written (EACCES after a stray sudo, EROFS, a full disk) produced a silent
+  // partial install. It is not cosmetic: `syncLifecycleConfig` keys entirely off
+  // `manifest.version`, so an unwritten manifest makes every future SessionStart
+  // re-run install() and re-report 'installed', forever, with nothing to show
+  // for it (audit 2026-08-16 review Minor tail).
+  if (r && r.manifestUnwritable) {
+    process.stdout.write(
+      `[code-graph] The plugin manifest could not be written (${r.manifestUnwritable}). ` +
+      'Hooks are registered but the install will not be remembered, so this runs again ' +
+      'every session. Check permissions on ~/.claude/plugins/, then run ' +
+      '`code-graph-mcp doctor`.\n'
+    );
+  }
   return r;
 }
 function installReporting(...args) { return reportRebuild(install(...args)); }
@@ -666,6 +681,20 @@ function runSessionInit({ source } = {}) {
         '            Reverse:    code-graph-mcp unadopt\n'
       );
     }
+    // `adopt()` has returned `registryRecorded` since it stopped throwing on a
+    // broken registry, and nothing read it. The consequence is not cosmetic:
+    // `uninstall()` walks that registry to strip our managed block from every
+    // adopted project's CLAUDE.md, so an unrecorded project keeps the block
+    // FOREVER after uninstall, with no plugin code left to remove it — the
+    // teardown-asymmetry class this repo has already been bitten by (audit
+    // 2026-08-16 review Minor tail).
+    if (autoAdopt.result.registryRecorded === false) {
+      process.stderr.write(
+        '[code-graph] Note: this project could not be recorded in the adopted-projects registry,\n' +
+        '            so `/plugin uninstall` will NOT strip the block from this CLAUDE.md.\n' +
+        '            Remove it by hand with `code-graph-mcp unadopt` before uninstalling.\n'
+      );
+    }
   }
 
   // quietHooks: default quiet (project_map injection duplicates MEMORY.md +

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.117.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.118.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/claude-plugin/templates/plugin_code_graph_mcp.md

@@ -129,7 +129,7 @@ code-graph-mcp overview src/mcp/         # 模块总览
 code-graph-mcp callgraph SYMBOL          # 调用图
 code-graph-mcp impact SYMBOL             # 影响面（--change-type ∈ signature|behavior|remove，默认 behavior）
 code-graph-mcp show SYMBOL                # 节点详情
-code-graph-mcp refs SYMBOL --relation calls  # --relation ∈ calls|imports|inherits|implements|references|all
+code-graph-mcp refs SYMBOL --relation calls  # --relation ∈ calls|imports|inherits|implements|references|exports|routes_to|all
 code-graph-mcp refs SYMBOL --min-confidence extracted  # ∈ extracted|inferred|ambiguous；extracted=只看精确边（callgraph/impact/trace 同款）
 code-graph-mcp centrality                 # 架构咽喉（betweenness 桥节点；补 map 的 caller_count）
 code-graph-mcp cycles                     # 循环导入依赖（文件级 import 环 / SCC）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.117.0",
+  "version": "0.118.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -29,16 +29,16 @@
   ],
   "scripts": {
     "build": "cargo build --release --no-default-features && node scripts/copy-binary.js",
-    "prepare": "git rev-parse --git-dir > /dev/null 2>&1 && git config core.hooksPath scripts/githooks || true"
+    "prepare": "node scripts/setup-git-hooks.js"
   },
   "engines": {
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.117.0",
-    "@sdsrs/code-graph-linux-arm64": "0.117.0",
-    "@sdsrs/code-graph-darwin-x64": "0.117.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.117.0",
-    "@sdsrs/code-graph-win32-x64": "0.117.0"
+    "@sdsrs/code-graph-linux-x64": "0.118.0",
+    "@sdsrs/code-graph-linux-arm64": "0.118.0",
+    "@sdsrs/code-graph-darwin-x64": "0.118.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.118.0",
+    "@sdsrs/code-graph-win32-x64": "0.118.0"
   }
 }