@sdsrs/code-graph 0.124.0 → 0.125.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.124.0",
+  "version": "0.125.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -7,7 +7,7 @@ const http = require('http');
 const crypto = require('crypto');
 const path = require('path');
 const os = require('os');
-const { CACHE_DIR, PLUGIN_ID, MARKETPLACE_NAME, readManifest, readJson, readJsonResult, writeJsonAtomic, installedPluginsPath, pluginsCacheDir } = require('./lifecycle');
+const { CACHE_DIR, PLUGIN_ID, MARKETPLACE_NAME, readManifest, readJson, readJsonResult, backupCorruptFile, writeJsonAtomic, installedPluginsPath, pluginsCacheDir } = require('./lifecycle');
 const { claudeHome } = require('./claude-config');
 const { clearCache: clearBinaryCache, globalNodeModulesCandidates, nvmNodeModulesDirs, PLATFORM_PKG, detectLibc } = require('./find-binary');
 const { readBinaryVersion, compareVersions, isDevMode } = require('./version-utils');
@@ -785,25 +785,96 @@ async function downloadAndInstall(latest, {
     // fragile), pluginDst was never created. Advancing installPath/manifest to it anyway
     // pointed Claude Code at a nonexistent install dir while state read "up to date".
     if (pluginUpdated) {
-      // Update installed_plugins.json to point to new version
+      // Update installed_plugins.json to point to new version.
+      //
+      // Through the same three-way read the lifecycle.js site uses. The lenient
+      // `readJson` returns null for ENOENT, EACCES and unparseable alike, and
+      // the `if (installed && …)` guard below then skipped the repoint in
+      // SILENCE — while the plugin copy had landed and the manifest below is
+      // about to be advanced. Claude Code keeps launching the old install dir
+      // with state reading "up to date": the split-brain shape the binary-pin
+      // incident was made of, and one this file cannot fix by guessing at bytes
+      // it could not read. So it says so instead, which keeps `/plugin update`
+      // reachable as the manual way out.
       const installedPath = installedPluginsPath();
-      try {
-        const installed = readJson(installedPath);
+      const installedRead = readJsonResult(installedPath);
+      // Whether the registry entry is STILL pointing at the old version when this
+      // block ends. It gates the manifest advance below, and that gate is the
+      // whole difference between a report and a fix: `checkForUpdate` reads
+      // `readManifest().version` as the authoritative installed version, so
+      // advancing it past a repoint that did not happen makes the next session
+      // compute "up to date" — the message below prints ONCE, into a SessionStart
+      // hook's stderr, and the split-brain then has nothing behind it. Left
+      // behind, the ordinary check interval retries the whole install and
+      // re-reports, and the repoint lands by itself the moment the file is
+      // repaired. `missing` is not blocked: no registry means nothing to repoint.
+      let repointBlocked = false;
+      if (installedRead.corrupt) {
+        // Value unusable — the bytes are not ours to guess at.
+        const why = installedRead.error
+          ? (installedRead.error.code || installedRead.error.message)
+          : 'it does not contain a JSON object';
+        console.error(
+          `[code-graph] plugin ${latest.version} is installed, but ${installedPath} ` +
+          `could not be read (${why}) — its entry for this plugin still points at the ` +
+          'previous version. Run `/plugin update` or repair that file by hand.'
+        );
+        repointBlocked = true;
+      } else {
+        let installed = installedRead.value;
+        // `lossy` is NOT `corrupt`: the value parsed and is usable, it is the
+        // BYTES that will not survive our rewrite (a cp1252 byte inside a path,
+        // see readJsonResult). lifecycle.js's readSettingsForWrite route applies
+        // here for the same reason — preserve the true bytes, then proceed, since
+        // refusing outright strands the install over a byte we can work around.
+        // Collapsing this into the corrupt arm also misreported it: a lossy result
+        // carries no `error`, so the message called a parseable file unparseable.
+        if (installed && installedRead.lossy) {
+          const backup = backupCorruptFile(installedPath, installedRead.raw);
+          if (backup) {
+            console.error(
+              `[code-graph] ${installedPath} contains bytes that are not valid UTF-8; ` +
+              `repointing it at ${latest.version} will replace them. Saved the original ` +
+              `to ${backup} first.`
+            );
+          } else {
+            console.error(
+              `[code-graph] plugin ${latest.version} is installed, but ${installedPath} ` +
+              'contains bytes that are not valid UTF-8 and no backup copy could be made — ' +
+              'its entry for this plugin still points at the previous version. Rewriting it ' +
+              'would replace those bytes permanently. Run `/plugin update` after repairing it.'
+            );
+            installed = null;
+            repointBlocked = true;
+          }
+        }
         if (installed && installed.plugins && installed.plugins[PLUGIN_ID]) {
           installed.plugins[PLUGIN_ID][0].installPath = pluginDst;
           installed.plugins[PLUGIN_ID][0].version = latest.version;
           installed.plugins[PLUGIN_ID][0].lastUpdated = new Date().toISOString();
-          writeJsonAtomic(installedPath, installed);
+          try {
+            writeJsonAtomic(installedPath, installed);
+          } catch (err) {
+            console.error(
+              `[code-graph] plugin ${latest.version} is installed, but ${installedPath} ` +
+              `could not be written (${err.code || err.name}) — its entry for this plugin ` +
+              'still points at the previous version. Run `/plugin update`.'
+            );
+            repointBlocked = true;
+          }
         }
-      } catch { /* not fatal */ }
+      }
 
-      // Update install manifest
-      try {
-        const manifest = readManifest();
-        manifest.version = latest.version;
-        manifest.updatedAt = new Date().toISOString();
-        writeJsonAtomic(path.join(CACHE_DIR, 'install-manifest.json'), manifest);
-      } catch { /* not fatal */ }
+      // Update install manifest — only when nothing is left pointing at the old
+      // version. See `repointBlocked` above: this value IS the update gate.
+      if (!repointBlocked) {
+        try {
+          const manifest = readManifest();
+          manifest.version = latest.version;
+          manifest.updatedAt = new Date().toISOString();
+          writeJsonAtomic(path.join(CACHE_DIR, 'install-manifest.json'), manifest);
+        } catch { /* not fatal */ }
+      }
 
       // Run the NEW lifecycle.js to update settings.json hooks with new paths.
       // Without this, settings.json hooks still point to the old version directory

package/claude-plugin/scripts/cg-answer.js

@@ -61,7 +61,14 @@ function truncateAtLine(text, maxBytes) {
   if (lastNl > 0) {
     return { text: head.slice(0, lastNl), truncated: true };
   }
-  return { text: buf.subarray(0, maxBytes).toString('latin1'), truncated: true };
+  // Hard cut, when even the first line does not fit. Back the cut off to a
+  // UTF-8 character boundary instead of re-decoding the bytes: `latin1` maps
+  // each byte to its own character, so a CJK line came back as mojibake rather
+  // than as a shortened line, and `utf8` alone would leave a U+FFFD where the
+  // cut landed mid-character. A continuation byte is `10xxxxxx`.
+  let end = maxBytes;
+  while (end > 0 && (buf[end] & 0xc0) === 0x80) end--;
+  return { text: buf.subarray(0, end).toString('utf8'), truncated: true };
 }
 
 /**

package/claude-plugin/scripts/lifecycle.js

@@ -1817,6 +1817,7 @@ module.exports = {
   isPluginExplicitlyDisabled, isPluginInactive, isPluginUninstalled, removeCacheResidue,
   cleanupDisabledStatusline, unadoptRegisteredProjects,
   readManifest, readJson, readJsonResult, readSettingsForWrite, writeJsonAtomic,
+  backupCorruptFile,                                                   // auto-update.js repoints installed_plugins.json and owes the same preserve-then-proceed route
   migrateOldPluginIds,                                                 // exported so its failure arms are testable (audit 2026-08-22 P2-10)
   readRegistry, readRegistryForWrite, writeRegistry,
   getPluginVersion, cleanupOldCacheVersions,

package/claude-plugin/scripts/statusline-composite.js

@@ -42,7 +42,7 @@ function run(stdin) {
   const registry = readRegistry();
   if (registry.length === 0) {
     // Fallback: no registry, run code-graph only
-    const cg = runProvider(codeGraphCommand(), false, stdin);
+    const cg = runProvider(codeGraphCommand(), false, stdin, 'code-graph');
     if (cg) process.stdout.write(cg);
     return;
   }
@@ -57,7 +57,7 @@ function run(stdin) {
 
   const outputs = [];
   for (const provider of sorted) {
-    const out = runProvider(provider.command, provider.needsStdin, stdin);
+    const out = runProvider(provider.command, provider.needsStdin, stdin, provider.id);
     if (out) outputs.push(out);
   }
   if (outputs.length > 0) {
@@ -65,26 +65,41 @@ function run(stdin) {
   }
 }
 
-/// True when the command needs a shell to mean what it says. Claude Code runs
-/// `statusLine.command` through one, so a captured `_previous` legitimately
-/// contains pipelines — and a pipeline cannot run through `execFileSync` under
-/// any splitting, so today it produces ENOENT and a silently missing segment.
+/// True when the command needs a shell to mean what it says.
+///
+/// Gated on the entry being `_previous`, and that gate is the whole point.
+/// `_previous` IS the user's `statusLine.command`, which Claude Code runs
+/// through a shell — so a captured pipeline is legitimate there, and a pipeline
+/// cannot run through `execFileSync` under any splitting: it produces ENOENT and
+/// a silently missing segment.
+///
+/// The other two registry classes were never shell strings. `codeGraphCommand()`
+/// composes `node "<__dirname>/statusline.js"`, and third-party entries arrive
+/// through `statusline-chain.js register`, whose only executor has ever been
+/// `execFileSync`. Handing those to a shell imposes semantics they never had,
+/// and OUR segment is the one that dies: measured, a plugin installed under a
+/// directory named `dev$work` produced `node "…/dev$work/statusline.js"`, which
+/// a shell reads as `…/dev/statusline.js` — segment gone, `catch` swallows it.
+/// Inside double quotes only `$` and a backtick break, which is why this stayed
+/// invisible until someone had one in an install path.
 ///
 /// Trade-off, stated because it is a real one: through `sh -c`, the timeout's
 /// SIGKILL reaches the SHELL, not necessarily a grandchild that traps signals
-/// (the hazard the direct-exec path was hardened against). It applies only to
-/// commands that cannot run at all today, so nothing that currently works loses
-/// the guarantee. Windows has no `sh`, so there the command stays on the direct
-/// path and a pipeline keeps failing as before rather than failing differently.
-function needsShell(command) {
-  return process.platform !== 'win32' && SHELL_METACHARS.test(command);
+/// (the hazard the direct-exec path was hardened against). Confining the shell
+/// to `_previous` also confines that loss to the entry that cannot work without
+/// it. Windows keeps everything on the direct path — note that Claude Code
+/// itself runs statusline commands through Git Bash there, so a `_previous`
+/// pipeline works in Claude Code and still dies here; the fix is half-applied by
+/// platform, which is a gap rather than a regression (it never worked here).
+function needsShell(command, id) {
+  return id === '_previous' && process.platform !== 'win32' && SHELL_METACHARS.test(command);
 }
 
-function runProvider(command, needsStdin, stdin) {
+function runProvider(command, needsStdin, stdin, id) {
   if (!command) return null;
   try {
     // Parse command into executable + args
-    const parts = needsShell(command) ? ['/bin/sh', '-c', command] : parseCommand(command);
+    const parts = needsShell(command, id) ? ['/bin/sh', '-c', command] : parseCommand(command);
     if (!parts) return null;
 
     // Claude Code runs statusLine.command through a shell, so a leading `~`
@@ -94,7 +109,7 @@ function runProvider(command, needsStdin, stdin) {
     // swallowed below, silently dropping the user's original statusline.
     // `sh -c` does its own tilde expansion; expanding our own would corrupt the
     // script text (`~` inside a quoted string is not a home directory).
-    const argv = needsShell(command) ? parts : parts.map(expandTilde);
+    const argv = needsShell(command, id) ? parts : parts.map(expandTilde);
 
     // Forward Claude Code's authoritative current dir (from the stdin payload) as
     // a plugin-scoped env var. The code-graph provider gates on it instead of its

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.124.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.125.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.124.0",
+  "version": "0.125.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.124.0",
-    "@sdsrs/code-graph-linux-arm64": "0.124.0",
-    "@sdsrs/code-graph-darwin-x64": "0.124.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.124.0",
-    "@sdsrs/code-graph-win32-x64": "0.124.0"
+    "@sdsrs/code-graph-linux-x64": "0.125.0",
+    "@sdsrs/code-graph-linux-arm64": "0.125.0",
+    "@sdsrs/code-graph-darwin-x64": "0.125.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.125.0",
+    "@sdsrs/code-graph-win32-x64": "0.125.0"
   }
 }