@sdsrs/code-graph 0.126.1 → 0.127.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.126.1",
+  "version": "0.127.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/find-binary.js

@@ -401,8 +401,21 @@ function findBinaryUncached() {
   if (process.env._FIND_BINARY_ROOT) {
     possibleRoots.add(path.resolve(process.env._FIND_BINARY_ROOT));
   }
-  // From CLAUDE_PROJECT_DIR
-  if (process.env.CLAUDE_PROJECT_DIR) {
+  // From CLAUDE_PROJECT_DIR — behind an explicit opt-in, and ONLY that.
+  //
+  // This root is the arbitrary directory the developer opened; the two above are
+  // derived from the plugin's own install. Accepting it made "clone an untrusted
+  // repo and open it" arbitrary code execution: this tier sits above the version
+  // gate, `isDevRepo` asks only whether a `Cargo.toml` exists, and resolution
+  // itself runs the file (`writeCacheEntry` → `readBinaryVersion`) — all before
+  // any file is read or any tool approved. A tracked, mode-755
+  // `target/release/code-graph-mcp` survives `.gitignore` into a fresh clone,
+  // so supplying one costs the attacker nothing.
+  //
+  // No property of the opened directory can re-establish trust here (an attacker
+  // supplies all of them), so the gate is the developer's own opt-in, spelled
+  // the same way `version-utils.js:isDevMode` spells it.
+  if (process.env.CLAUDE_PROJECT_DIR && process.env.CODE_GRAPH_DEV === '1') {
     possibleRoots.add(path.resolve(process.env.CLAUDE_PROJECT_DIR));
   }
 

package/claude-plugin/scripts/lifecycle.js

@@ -1089,7 +1089,16 @@ function hookFirePayload(matcher) {
     case 'Write|Edit':
       return { tool_name: 'Edit', tool_input: { file_path: 'src/example.rs', old_string: 'a', new_string: 'b' } };
     case '': // UserPromptSubmit
-      return { prompt: 'where is the parse function defined' };
+      // A SYMPTOM-flavoured prompt, for the same reason the Bash probe uses a
+      // quoted identifier: it must reach a path that actually emits. The old
+      // payload ('where is the parse function defined') produced
+      // `determineQueryType(...) === null` — no query, no output — and the two
+      // result-injecting paths that would emit need a real indexed binary, which
+      // this throwaway fixture does not have. `symptom-hint` is prose-only, so it
+      // engages on the fixture alone. Field name is `prompt`: this constructor
+      // has always had it right, while the hook itself read `message`
+      // (audit 2026-08-29 JS-01).
+      return { prompt: 'why does the parser crash on empty input' };
     default:
       return { tool_name: 'Unknown', tool_input: {} };
   }

package/claude-plugin/scripts/user-prompt-context.js

@@ -437,7 +437,24 @@ function runMain() {
     // sibling hooks already did this; this one was the holdout, so it read
     // nothing under exactly the conditions verifyHooksFire spawns it with.
     const input = JSON.parse(fs.readFileSync(0, 'utf8'));
-    message = (input && input.message) || '';
+    // `prompt` FIRST: that is the field Claude Code puts the user's text in on
+    // UserPromptSubmit, and this hook read only `message` — so in production it
+    // parsed a payload, found nothing, and exited 0 in silence. The whole
+    // intent-driven injection surface (impact / callgraph / overview / search +
+    // the symptom hint) was dead from the day it shipped, and its adoption
+    // metrics read as a structural zero.
+    //
+    // Two things hid it, both worth naming because either alone would have been
+    // enough: the entire test suite fed `{message:…}` — a self-consistent copy
+    // of the defect — and `verifyHooksFire` only asserts exit 0, which is
+    // exactly what a hook that reads nothing does. The production tell was
+    // outside both: zero `.code-graph-ctx-*` cooldown flags in a heavily
+    // dogfooded tmp dir that held 93 flags from the sibling hooks
+    // (audit 2026-08-29 JS-01).
+    //
+    // `message` is kept as a fallback rather than replaced — it costs one `||`
+    // and covers any host that spells it the other way.
+    message = (input && (input.prompt || input.message)) || '';
   } catch {
     return;
   }

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.126.1 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.127.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.126.1",
+  "version": "0.127.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.126.1",
-    "@sdsrs/code-graph-linux-arm64": "0.126.1",
-    "@sdsrs/code-graph-darwin-x64": "0.126.1",
-    "@sdsrs/code-graph-darwin-arm64": "0.126.1",
-    "@sdsrs/code-graph-win32-x64": "0.126.1"
+    "@sdsrs/code-graph-linux-x64": "0.127.0",
+    "@sdsrs/code-graph-linux-arm64": "0.127.0",
+    "@sdsrs/code-graph-darwin-x64": "0.127.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.127.0",
+    "@sdsrs/code-graph-win32-x64": "0.127.0"
   }
 }