@sdsrs/code-graph 0.126.2 → 0.128.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.126.2",
+  "version": "0.128.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -700,6 +700,16 @@ async function downloadAndInstall(latest, {
   let pluginUpdated = false;
   let binaryUpdated = false;
   let marketplaceRefreshed = false;
+  // JS-02 (audit 2026-08-29): declared out here so it can be RETURNED. It used
+  // to live inside the `if (pluginUpdated)` block, correctly stopping the
+  // manifest from advancing, and then evaporate — the caller saw
+  // `pluginUpdated: true`, wrote `updateAttempts: 0, updateAvailable: false,
+  // suspendedAt: null`, and re-read the un-advanced registry next round. With
+  // `updateAvailable:false` the recheck interval is 30 minutes, so a registry
+  // that stays broken drives ~48 full download-and-install rounds a day —
+  // exactly the treadmill MAX_UPDATE_ATTEMPTS and the suspension mechanism
+  // exist to stop, both of which stayed dormant because every round "succeeded".
+  let repointBlocked = false;
 
   try {
     fs.mkdirSync(tmpDir, { recursive: true });
@@ -808,7 +818,6 @@ async function downloadAndInstall(latest, {
       // behind, the ordinary check interval retries the whole install and
       // re-reports, and the repoint lands by itself the moment the file is
       // repaired. `missing` is not blocked: no registry means nothing to repoint.
-      let repointBlocked = false;
       if (installedRead.corrupt) {
         // Value unusable — the bytes are not ours to guess at.
         const why = installedRead.error
@@ -848,7 +857,28 @@ async function downloadAndInstall(latest, {
             repointBlocked = true;
           }
         }
-        if (installed && installed.plugins && installed.plugins[PLUGIN_ID]) {
+        // JS-05 (audit 2026-08-29): `plugins[PLUGIN_ID]` was assumed to be a
+        // non-empty array. A registry holding `[]` — or any other truthy
+        // non-array — made `[0].installPath = …` throw a TypeError, which the
+        // outer catch reported as "Plugin download/extract failed": a diagnosis
+        // pointing at the download for a malformed local file. `activeInstallPath`
+        // in lifecycle.js already reads this same field the careful way; this is
+        // the sibling that did not.
+        const records = installed && installed.plugins && installed.plugins[PLUGIN_ID];
+        const repointable =
+          Array.isArray(records) && records[0] && typeof records[0] === 'object';
+        if (installed && !repointable && installed.plugins && installed.plugins[PLUGIN_ID]) {
+          // Present but not the shape we can write into (`[]`, or a truthy
+          // non-array). Blocked, NOT skipped: a silent skip here would feed the
+          // JS-02 treadmill through a new door.
+          console.error(
+            `[code-graph] plugin ${latest.version} is installed, but this plugin's entry in ` +
+            `${installedPath} is malformed (expected a non-empty array) — it still points at ` +
+            'the previous version. Run `/plugin update` or repair that file by hand.'
+          );
+          repointBlocked = true;
+        }
+        if (repointable) {
           installed.plugins[PLUGIN_ID][0].installPath = pluginDst;
           installed.plugins[PLUGIN_ID][0].version = latest.version;
           installed.plugins[PLUGIN_ID][0].lastUpdated = new Date().toISOString();
@@ -900,7 +930,7 @@ async function downloadAndInstall(latest, {
       binaryUpdated = true;
     }
 
-    return { pluginUpdated, binaryUpdated, marketplaceRefreshed };
+    return { pluginUpdated, binaryUpdated, marketplaceRefreshed, repointBlocked };
   } catch (e) {
     console.error(`[code-graph] Plugin download/extract failed: ${e.message}`);
     return { pluginUpdated: false, binaryUpdated: false, marketplaceRefreshed };
@@ -1278,7 +1308,11 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
         return { updateAvailable: true, suspended: true, from: installedVersion, to: latest.version };
       }
       const result = await downloadAndInstall(latest);
-      const success = result.pluginUpdated;
+      // A refused repoint is NOT a success (JS-02): the bytes landed, but the
+      // registry Claude Code reads still names the old version, so the next round
+      // sees the same update available. Counting it as success reset the attempt
+      // counter and the suspension stamp every time.
+      const success = result.pluginUpdated && !result.repointBlocked;
       // Suspension clock. It restarts when the daily retry is spent and fails,
       // which is what keeps `retryDue` from staying true and turning the retry
       // back into a per-session treadmill; it clears on success and on a new

package/claude-plugin/scripts/find-binary.js

@@ -401,8 +401,21 @@ function findBinaryUncached() {
   if (process.env._FIND_BINARY_ROOT) {
     possibleRoots.add(path.resolve(process.env._FIND_BINARY_ROOT));
   }
-  // From CLAUDE_PROJECT_DIR
-  if (process.env.CLAUDE_PROJECT_DIR) {
+  // From CLAUDE_PROJECT_DIR — behind an explicit opt-in, and ONLY that.
+  //
+  // This root is the arbitrary directory the developer opened; the two above are
+  // derived from the plugin's own install. Accepting it made "clone an untrusted
+  // repo and open it" arbitrary code execution: this tier sits above the version
+  // gate, `isDevRepo` asks only whether a `Cargo.toml` exists, and resolution
+  // itself runs the file (`writeCacheEntry` → `readBinaryVersion`) — all before
+  // any file is read or any tool approved. A tracked, mode-755
+  // `target/release/code-graph-mcp` survives `.gitignore` into a fresh clone,
+  // so supplying one costs the attacker nothing.
+  //
+  // No property of the opened directory can re-establish trust here (an attacker
+  // supplies all of them), so the gate is the developer's own opt-in, spelled
+  // the same way `version-utils.js:isDevMode` spells it.
+  if (process.env.CLAUDE_PROJECT_DIR && process.env.CODE_GRAPH_DEV === '1') {
     possibleRoots.add(path.resolve(process.env.CLAUDE_PROJECT_DIR));
   }
 

package/claude-plugin/scripts/lifecycle.js

@@ -639,9 +639,18 @@ function unadoptRegisteredProjects() {
   for (const project of (res && res.list) || []) {
     try {
       const r = unadopt({ cwd: project });
-      out.push({ project, cleaned: !!(r && (r.blockPruned || r.fileRemoved || r.claudeMdRemoved)) });
+      // Three outcomes, not two (audit 2026-08-29 JS-06). A project whose block
+      // the user already removed by hand comes back with nothing pruned and NO
+      // error — which used to land in the "Could NOT clean" list, sending them
+      // to hand-edit a file that is already clean. `unadopt` reports real
+      // failure separately (`claudeMdUnreadable` / `claudeMdUnwritable`, the
+      // same pair adopt.js folds into its own `cleanupFailed`), so use it rather
+      // than inferring failure from "nothing happened".
+      const cleaned = !!(r && (r.blockPruned || r.fileRemoved || r.claudeMdRemoved));
+      const failed = !!(r && (r.claudeMdUnreadable || r.claudeMdUnwritable));
+      out.push({ project, cleaned, failed });
     } catch (e) {
-      out.push({ project, cleaned: false, error: (e && e.message) || String(e) });
+      out.push({ project, cleaned: false, failed: true, error: (e && e.message) || String(e) });
     }
   }
   reportUnadoptSweep(out);
@@ -659,7 +668,9 @@ function unadoptRegisteredProjects() {
 function reportUnadoptSweep(entries) {
   try {
     const cleaned = entries.filter((e) => e && e.cleaned).map((e) => e.project);
-    const failed = entries.filter((e) => e && !e.cleaned).map((e) => e.project);
+    // Only genuine failures. "Nothing to clean" is neither a success worth
+    // announcing nor a problem worth sending someone to fix (JS-06).
+    const failed = entries.filter((e) => e && !e.cleaned && e.failed).map((e) => e.project);
     if (!cleaned.length && !failed.length) return;
     const lines = [];
     if (cleaned.length) {
@@ -1089,7 +1100,16 @@ function hookFirePayload(matcher) {
     case 'Write|Edit':
       return { tool_name: 'Edit', tool_input: { file_path: 'src/example.rs', old_string: 'a', new_string: 'b' } };
     case '': // UserPromptSubmit
-      return { prompt: 'where is the parse function defined' };
+      // A SYMPTOM-flavoured prompt, for the same reason the Bash probe uses a
+      // quoted identifier: it must reach a path that actually emits. The old
+      // payload ('where is the parse function defined') produced
+      // `determineQueryType(...) === null` — no query, no output — and the two
+      // result-injecting paths that would emit need a real indexed binary, which
+      // this throwaway fixture does not have. `symptom-hint` is prose-only, so it
+      // engages on the fixture alone. Field name is `prompt`: this constructor
+      // has always had it right, while the hook itself read `message`
+      // (audit 2026-08-29 JS-01).
+      return { prompt: 'why does the parser crash on empty input' };
     default:
       return { tool_name: 'Unknown', tool_input: {} };
   }
@@ -1816,6 +1836,7 @@ module.exports = {
   install, uninstall, update, healthCheck, scanForBrokenPaths, checkScopeConflict,
   isPluginExplicitlyDisabled, isPluginInactive, isPluginUninstalled, removeCacheResidue,
   cleanupDisabledStatusline, unadoptRegisteredProjects,
+  reportUnadoptSweep,                                                  // exported so its three-way bucketing is testable (audit 2026-08-29 JS-06)
   readManifest, readJson, readJsonResult, readSettingsForWrite, writeJsonAtomic,
   backupCorruptFile,                                                   // auto-update.js repoints installed_plugins.json and owes the same preserve-then-proceed route
   migrateOldPluginIds,                                                 // exported so its failure arms are testable (audit 2026-08-22 P2-10)

package/claude-plugin/scripts/pre-edit-guide.js

@@ -45,20 +45,46 @@ if (!oldStr || oldStr.length < 10) process.exit(0);
 
 // --- Extract function/method signature from the edited text ---
 // Match function definitions across languages: Rust, JS/TS, Python, Go, Java/C#/Kotlin, Ruby, PHP
+//
+// Every unbounded run that is FOLLOWED BY A REQUIRED LITERAL carries an explicit
+// `{1,128}` cap — longer than any real identifier, short enough that the engine
+// gives up after 128 steps per start position. Without it those three patterns
+// are quadratic: on a long
+// unbroken \w run with no `name(...)` construct in it, the greedy run swallows to
+// the end at EVERY start position and then backtracks a character at a time.
+// Measured at HEAD on this box, pattern 4 alone: 10 KB 28 ms, 100 KB 2.8 s,
+// 200 KB 11.0 s, 400 KB 43.4 s — doubling the input quadrupled the time.
+//
+// This needs no malice to hit. `old_string` is whatever the model is editing, so
+// one benign blob without brackets — a base64 asset, a hex dump, a minified
+// bundle, a long snake_case table — stalls a BLOCKING PreToolUse hook for
+// seconds. Real code is unaffected either way (225 KB of this repo's own
+// source: 0.3 ms), because a bracket ends the run almost immediately.
+//
+// The runs that are NOT capped are the ones nothing is required after
+// (`fn\s+(\w+)`, `def\s+(\w+)`, …): those anchor on a keyword first and their
+// trailing capture cannot backtrack, so a cap there would only truncate a long
+// symbol name.
 const fnPatterns = [
   /(?:pub\s+)?(?:async\s+)?fn\s+(\w+)/,                        // Rust
   /(?:export\s+)?(?:async\s+)?function\s+(\w+)/,                // JS/TS
-  /(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?(?:\([^)]*\)|_)\s*=>/, // JS arrow
-  /(?:async\s+)?(\w+)\s*\([^)]*\)\s*\{/,                       // JS method / Go func
+  /(?:const|let|var)\s+(\w{1,128})\s*=\s*(?:async\s+)?(?:\([^)]*\)|_)\s*=>/, // JS arrow
+  /(?:async\s+)?(\w{1,128})\s*\([^)]*\)\s*\{/,                 // JS method / Go func
   /def\s+(\w+)/,                                                // Python/Ruby
   /func\s+(\w+)/,                                               // Go/Swift
-  /(?:public|private|protected|static|override|virtual|abstract|internal)\s+\S+\s+(\w+)\s*\(/, // Java/C#/Kotlin
+  /(?:public|private|protected|static|override|virtual|abstract|internal)\s+\S{1,128}\s+(\w{1,128})\s*\(/, // Java/C#/Kotlin
   /(?:public\s+)?function\s+(\w+)/,                             // PHP
 ];
 
+// Second bound, on the INPUT rather than the patterns: a signature sits at the
+// head of the edited hunk, so matching past the first 8 KB buys nothing and
+// costs linearly. Belt to the caps' braces — it also bounds whatever pattern a
+// future author adds to the array without reading the note above.
+const scanned = oldStr.length > 8192 ? oldStr.slice(0, 8192) : oldStr;
+
 let symbol = null;
 for (const pat of fnPatterns) {
-  const m = oldStr.match(pat);
+  const m = scanned.match(pat);
   if (m) {
     // Find the first captured group
     symbol = m[1] || m[2];

package/claude-plugin/scripts/pre-grep-guide.js

@@ -291,6 +291,20 @@ const { resolveProjectRoot } = require('./project-root');
 // (the exact shape that would re-create the answered:false glob failure).
 function rebaseRelativePaths(cmd, relPrefix, rootDir, exists = fs.existsSync) {
   if (!cmd || typeof cmd !== 'string' || !relPrefix || !rootDir) return cmd;
+  // SEC-05 (audit 2026-08-29): one `exists()` syscall per surviving token, and
+  // this runs BEFORE every length gate in the file — `shouldHint`'s 1000-char
+  // sanity check (:159) and the 2000-char ones on the sed/tail extractors are all
+  // downstream of it, so the guard sat below the thing it was guarding. Measured
+  // with a counting stub: 100k tokens is 100,001 probes, 2.2 s of real
+  // `fs.existsSync` on this box, paid inside a BLOCKING PreToolUse hook.
+  //
+  // The bound is the loosest one the file already uses, so nothing that any
+  // downstream gate would still have processed changes behavior: a command this
+  // long is past the sed/tail extractors' limit and twice past `shouldHint`'s.
+  // Placed here rather than at the two call sites because both of them
+  // (`pre-grep-guide` runMain, `post-grep-inject` runMain) need it, and a guard
+  // that lives in the callers is one refactor away from being dropped.
+  if (cmd.length > 2000) return cmd;
   const prefix = relPrefix.split(path.sep).join('/');
   // Shell sits outside any known source dir (docs/, target/, …) — don't guess.
   if (!SRC_PATH_TOKEN.test(prefix + '/')) return cmd;

package/claude-plugin/scripts/user-prompt-context.js

@@ -437,7 +437,24 @@ function runMain() {
     // sibling hooks already did this; this one was the holdout, so it read
     // nothing under exactly the conditions verifyHooksFire spawns it with.
     const input = JSON.parse(fs.readFileSync(0, 'utf8'));
-    message = (input && input.message) || '';
+    // `prompt` FIRST: that is the field Claude Code puts the user's text in on
+    // UserPromptSubmit, and this hook read only `message` — so in production it
+    // parsed a payload, found nothing, and exited 0 in silence. The whole
+    // intent-driven injection surface (impact / callgraph / overview / search +
+    // the symptom hint) was dead from the day it shipped, and its adoption
+    // metrics read as a structural zero.
+    //
+    // Two things hid it, both worth naming because either alone would have been
+    // enough: the entire test suite fed `{message:…}` — a self-consistent copy
+    // of the defect — and `verifyHooksFire` only asserts exit 0, which is
+    // exactly what a hook that reads nothing does. The production tell was
+    // outside both: zero `.code-graph-ctx-*` cooldown flags in a heavily
+    // dogfooded tmp dir that held 93 flags from the sibling hooks
+    // (audit 2026-08-29 JS-01).
+    //
+    // `message` is kept as a fallback rather than replaced — it costs one `||`
+    // and covers any host that spells it the other way.
+    message = (input && (input.prompt || input.message)) || '';
   } catch {
     return;
   }

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.126.2 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.128.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.126.2",
+  "version": "0.128.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.126.2",
-    "@sdsrs/code-graph-linux-arm64": "0.126.2",
-    "@sdsrs/code-graph-darwin-x64": "0.126.2",
-    "@sdsrs/code-graph-darwin-arm64": "0.126.2",
-    "@sdsrs/code-graph-win32-x64": "0.126.2"
+    "@sdsrs/code-graph-linux-x64": "0.128.0",
+    "@sdsrs/code-graph-linux-arm64": "0.128.0",
+    "@sdsrs/code-graph-darwin-x64": "0.128.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.128.0",
+    "@sdsrs/code-graph-win32-x64": "0.128.0"
   }
 }