@sdsrs/code-graph 0.127.0 → 0.129.0

package/README.md

@@ -55,17 +55,18 @@ Every design decision — from token-aware compression to node_id-based snippet
 ## Performance
 
 Every row below is a line `code-graph-mcp benchmark` prints, measured on this
-repository (278 files, 5,065 nodes, 10,731 edges) with a release build. Run the
-same command on your own project — the numbers that matter are yours, and these
-scale with tree size and machine.
+repository (283 files, 5,311 nodes, 11,215 edges) with a release build — median
+of three consecutive runs on an otherwise idle machine. Run the same command on
+your own project: the numbers that matter are yours, and these scale with tree
+size and machine.
 
-| `benchmark` line | This repo, v0.123.0 |
+| `benchmark` line | This repo, v0.129.0 |
 |--------|-------|
-| Full index | **~1.9s** (≈145 files/second, single-threaded) |
-| Incremental (noop) | **~30ms** no-change detection via BLAKE3 Merkle tree |
-| Query latency P50 / P99 | **~575us / ~1.9ms** |
-| DB size | **~21.8MB** (≈4.4MB per 1,000 nodes) |
-| Avg tokens/node | **~239** |
+| Full index | **~2.0s** (≈139 files/second, single-threaded) |
+| Incremental (noop) | **~28ms** no-change detection via BLAKE3 Merkle tree |
+| Query latency P50 / P99 | **~655us / ~2.1ms** |
+| DB size | **~22.4MB** (≈4.2MB per 1,000 nodes) |
+| Avg tokens/node | **~242** |
 
 ## Efficiency: code-graph vs Traditional Tools
 
@@ -286,6 +287,18 @@ code-graph-mcp uninstall     # restore statusline, strip hooks, drop the cache
 npm uninstall -g @sdsrs/code-graph
 ```
 
+### Built from source (cargo)
+
+`uninstall` lives in the npm wrapper, so a `cargo install` / `cargo build` binary
+does not carry it — that binary tells you as much and points here. Run the
+teardown through npx without installing globally (npx still downloads the package
+and its platform binary into the npm cache), then remove your binary:
+
+```bash
+npx -y @sdsrs/code-graph uninstall   # statusline, hooks, cache
+cargo uninstall code-graph-mcp       # or delete the target/release binary
+```
+
 ## MCP Tools
 
 `tools/list` advertises exactly these seven. Several older niche tools were folded into flags on them, so one call now covers what used to take a separate tool:
@@ -338,6 +351,7 @@ All tools are also available as CLI subcommands for shell scripts, hooks, and te
 | `doctor` | — | Diagnose and repair environment issues |
 | `adopt` | — | Install the steering block into the project `CLAUDE.md` + detail doc |
 | `unadopt` | — | Remove the steering block + detail doc |
+| `uninstall` | — | Full local teardown (statusline, hooks, cache). npm/npx installs only — a `cargo install` build prints where to get it |
 | `serve` | — | Start the MCP JSON-RPC server on stdio (the default with no subcommand) |
 
 Common options: `--json` (JSON output), `--compact` (compact output), `--limit N`, `--depth N`, `--file <path>`.

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.127.0",
+  "version": "0.129.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/agents/code-explorer.md

@@ -1,12 +1,15 @@
 ---
 name: code-explorer
 description: Deep code understanding expert using AST knowledge graph. Use when exploring unfamiliar code, tracing complex relationships, or understanding module architecture.
-tools: ["Read", "Grep", "Glob", "Bash", "mcp__code-graph__semantic_code_search", "mcp__code-graph__get_call_graph", "mcp__code-graph__get_ast_node", "mcp__code-graph__project_map", "mcp__code-graph__module_overview", "mcp__code-graph__ast_search", "mcp__code-graph__find_references"]
+tools: ["Read", "Grep", "Glob", "Bash", "mcp__code-graph__semantic_code_search", "mcp__code-graph__get_call_graph", "mcp__code-graph__get_ast_node", "mcp__code-graph__project_map", "mcp__code-graph__module_overview", "mcp__code-graph__ast_search", "mcp__code-graph__find_references", "mcp__plugin_code-graph-mcp_code-graph__semantic_code_search", "mcp__plugin_code-graph-mcp_code-graph__get_call_graph", "mcp__plugin_code-graph-mcp_code-graph__get_ast_node", "mcp__plugin_code-graph-mcp_code-graph__project_map", "mcp__plugin_code-graph-mcp_code-graph__module_overview", "mcp__plugin_code-graph-mcp_code-graph__ast_search", "mcp__plugin_code-graph-mcp_code-graph__find_references"]
 model: sonnet
 ---
 
 You are a code exploration specialist with access to an AST knowledge graph.
 
+<!-- The tool allowlist carries both MCP namespace spellings on purpose (DOC-07);
+     rationale in CHANGELOG. Delete at most one half, never both. -->
+
 ## Strategy
 
 1. **Start with semantic_code_search** to locate relevant code by meaning, or **module_overview** / **project_map** to map an unfamiliar directory or the whole repo

package/claude-plugin/hooks/hooks.json

@@ -4,7 +4,7 @@
   "hooks": {
     "SessionStart": [
       {
-        "matcher": "startup|clear|compact",
+        "matcher": "startup|clear|compact|resume",
         "hooks": [
           {
             "type": "command",

package/claude-plugin/scripts/auto-update.js

@@ -507,9 +507,23 @@ function cachedBinaryStaleVsState(state, { binaryPath = cachedBinaryPath(), read
  *      install dropped the platform package).
  *
  * Returns true on successful promote, false otherwise. Never throws.
+ *
+ * JS-03: gated on `cachedBinaryNeedsUpdate` so an already-current binary is
+ * never re-fetched. The gate lives HERE rather than at the call sites because
+ * all four of them wanted it: `downloadAndInstall` Step 2 called this
+ * unconditionally, and its two early-return arms (no plugin tarball / tarball
+ * integrity failure) call it again on the way out. On the normal update path
+ * the binary really is behind, so the gate is a no-op; it pays off on every
+ * REPEATED round — e.g. the JS-02 treadmill, where a blocked repoint replayed
+ * `downloadAndInstall` about every 30 minutes and each replay re-downloaded and
+ * re-promoted a ~40 MB binary that was already latest.
+ *
+ * `needsUpdate` is injectable for tests only; production always uses the real
+ * predicate. Returning false on a skip is accurate: nothing was updated.
  */
-async function downloadBinary(latest) {
+async function downloadBinary(latest, { needsUpdate = cachedBinaryNeedsUpdate } = {}) {
   if (!latest || !latest.binaryUrl) return false;
+  if (!needsUpdate(latest)) return false; // already at latest.version — no fetch
   if (!commandExists('curl')) {
     console.error('[code-graph] Binary download skipped: curl not on PATH.');
     return false;
@@ -700,6 +714,16 @@ async function downloadAndInstall(latest, {
   let pluginUpdated = false;
   let binaryUpdated = false;
   let marketplaceRefreshed = false;
+  // JS-02 (audit 2026-08-29): declared out here so it can be RETURNED. It used
+  // to live inside the `if (pluginUpdated)` block, correctly stopping the
+  // manifest from advancing, and then evaporate — the caller saw
+  // `pluginUpdated: true`, wrote `updateAttempts: 0, updateAvailable: false,
+  // suspendedAt: null`, and re-read the un-advanced registry next round. With
+  // `updateAvailable:false` the recheck interval is 30 minutes, so a registry
+  // that stays broken drives ~48 full download-and-install rounds a day —
+  // exactly the treadmill MAX_UPDATE_ATTEMPTS and the suspension mechanism
+  // exist to stop, both of which stayed dormant because every round "succeeded".
+  let repointBlocked = false;
 
   try {
     fs.mkdirSync(tmpDir, { recursive: true });
@@ -808,7 +832,6 @@ async function downloadAndInstall(latest, {
       // behind, the ordinary check interval retries the whole install and
       // re-reports, and the repoint lands by itself the moment the file is
       // repaired. `missing` is not blocked: no registry means nothing to repoint.
-      let repointBlocked = false;
       if (installedRead.corrupt) {
         // Value unusable — the bytes are not ours to guess at.
         const why = installedRead.error
@@ -848,7 +871,28 @@ async function downloadAndInstall(latest, {
             repointBlocked = true;
           }
         }
-        if (installed && installed.plugins && installed.plugins[PLUGIN_ID]) {
+        // JS-05 (audit 2026-08-29): `plugins[PLUGIN_ID]` was assumed to be a
+        // non-empty array. A registry holding `[]` — or any other truthy
+        // non-array — made `[0].installPath = …` throw a TypeError, which the
+        // outer catch reported as "Plugin download/extract failed": a diagnosis
+        // pointing at the download for a malformed local file. `activeInstallPath`
+        // in lifecycle.js already reads this same field the careful way; this is
+        // the sibling that did not.
+        const records = installed && installed.plugins && installed.plugins[PLUGIN_ID];
+        const repointable =
+          Array.isArray(records) && records[0] && typeof records[0] === 'object';
+        if (installed && !repointable && installed.plugins && installed.plugins[PLUGIN_ID]) {
+          // Present but not the shape we can write into (`[]`, or a truthy
+          // non-array). Blocked, NOT skipped: a silent skip here would feed the
+          // JS-02 treadmill through a new door.
+          console.error(
+            `[code-graph] plugin ${latest.version} is installed, but this plugin's entry in ` +
+            `${installedPath} is malformed (expected a non-empty array) — it still points at ` +
+            'the previous version. Run `/plugin update` or repair that file by hand.'
+          );
+          repointBlocked = true;
+        }
+        if (repointable) {
           installed.plugins[PLUGIN_ID][0].installPath = pluginDst;
           installed.plugins[PLUGIN_ID][0].version = latest.version;
           installed.plugins[PLUGIN_ID][0].lastUpdated = new Date().toISOString();
@@ -900,7 +944,7 @@ async function downloadAndInstall(latest, {
       binaryUpdated = true;
     }
 
-    return { pluginUpdated, binaryUpdated, marketplaceRefreshed };
+    return { pluginUpdated, binaryUpdated, marketplaceRefreshed, repointBlocked };
   } catch (e) {
     console.error(`[code-graph] Plugin download/extract failed: ${e.message}`);
     return { pluginUpdated: false, binaryUpdated: false, marketplaceRefreshed };
@@ -1278,7 +1322,11 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
         return { updateAvailable: true, suspended: true, from: installedVersion, to: latest.version };
       }
       const result = await downloadAndInstall(latest);
-      const success = result.pluginUpdated;
+      // A refused repoint is NOT a success (JS-02): the bytes landed, but the
+      // registry Claude Code reads still names the old version, so the next round
+      // sees the same update available. Counting it as success reset the attempt
+      // counter and the suspension stamp every time.
+      const success = result.pluginUpdated && !result.repointBlocked;
       // Suspension clock. It restarts when the daily retry is spent and fails,
       // which is what keeps `retryDue` from staying true and turning the retry
       // back into a per-session treadmill; it clears on success and on a new

package/claude-plugin/scripts/lifecycle.js

@@ -639,9 +639,18 @@ function unadoptRegisteredProjects() {
   for (const project of (res && res.list) || []) {
     try {
       const r = unadopt({ cwd: project });
-      out.push({ project, cleaned: !!(r && (r.blockPruned || r.fileRemoved || r.claudeMdRemoved)) });
+      // Three outcomes, not two (audit 2026-08-29 JS-06). A project whose block
+      // the user already removed by hand comes back with nothing pruned and NO
+      // error — which used to land in the "Could NOT clean" list, sending them
+      // to hand-edit a file that is already clean. `unadopt` reports real
+      // failure separately (`claudeMdUnreadable` / `claudeMdUnwritable`, the
+      // same pair adopt.js folds into its own `cleanupFailed`), so use it rather
+      // than inferring failure from "nothing happened".
+      const cleaned = !!(r && (r.blockPruned || r.fileRemoved || r.claudeMdRemoved));
+      const failed = !!(r && (r.claudeMdUnreadable || r.claudeMdUnwritable));
+      out.push({ project, cleaned, failed });
     } catch (e) {
-      out.push({ project, cleaned: false, error: (e && e.message) || String(e) });
+      out.push({ project, cleaned: false, failed: true, error: (e && e.message) || String(e) });
     }
   }
   reportUnadoptSweep(out);
@@ -659,7 +668,9 @@ function unadoptRegisteredProjects() {
 function reportUnadoptSweep(entries) {
   try {
     const cleaned = entries.filter((e) => e && e.cleaned).map((e) => e.project);
-    const failed = entries.filter((e) => e && !e.cleaned).map((e) => e.project);
+    // Only genuine failures. "Nothing to clean" is neither a success worth
+    // announcing nor a problem worth sending someone to fix (JS-06).
+    const failed = entries.filter((e) => e && !e.cleaned && e.failed).map((e) => e.project);
     if (!cleaned.length && !failed.length) return;
     const lines = [];
     if (cleaned.length) {
@@ -1825,6 +1836,7 @@ module.exports = {
   install, uninstall, update, healthCheck, scanForBrokenPaths, checkScopeConflict,
   isPluginExplicitlyDisabled, isPluginInactive, isPluginUninstalled, removeCacheResidue,
   cleanupDisabledStatusline, unadoptRegisteredProjects,
+  reportUnadoptSweep,                                                  // exported so its three-way bucketing is testable (audit 2026-08-29 JS-06)
   readManifest, readJson, readJsonResult, readSettingsForWrite, writeJsonAtomic,
   backupCorruptFile,                                                   // auto-update.js repoints installed_plugins.json and owes the same preserve-then-proceed route
   migrateOldPluginIds,                                                 // exported so its failure arms are testable (audit 2026-08-22 P2-10)

package/claude-plugin/scripts/pre-edit-guide.js

@@ -45,20 +45,46 @@ if (!oldStr || oldStr.length < 10) process.exit(0);
 
 // --- Extract function/method signature from the edited text ---
 // Match function definitions across languages: Rust, JS/TS, Python, Go, Java/C#/Kotlin, Ruby, PHP
+//
+// Every unbounded run that is FOLLOWED BY A REQUIRED LITERAL carries an explicit
+// `{1,128}` cap — longer than any real identifier, short enough that the engine
+// gives up after 128 steps per start position. Without it those three patterns
+// are quadratic: on a long
+// unbroken \w run with no `name(...)` construct in it, the greedy run swallows to
+// the end at EVERY start position and then backtracks a character at a time.
+// Measured at HEAD on this box, pattern 4 alone: 10 KB 28 ms, 100 KB 2.8 s,
+// 200 KB 11.0 s, 400 KB 43.4 s — doubling the input quadrupled the time.
+//
+// This needs no malice to hit. `old_string` is whatever the model is editing, so
+// one benign blob without brackets — a base64 asset, a hex dump, a minified
+// bundle, a long snake_case table — stalls a BLOCKING PreToolUse hook for
+// seconds. Real code is unaffected either way (225 KB of this repo's own
+// source: 0.3 ms), because a bracket ends the run almost immediately.
+//
+// The runs that are NOT capped are the ones nothing is required after
+// (`fn\s+(\w+)`, `def\s+(\w+)`, …): those anchor on a keyword first and their
+// trailing capture cannot backtrack, so a cap there would only truncate a long
+// symbol name.
 const fnPatterns = [
   /(?:pub\s+)?(?:async\s+)?fn\s+(\w+)/,                        // Rust
   /(?:export\s+)?(?:async\s+)?function\s+(\w+)/,                // JS/TS
-  /(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?(?:\([^)]*\)|_)\s*=>/, // JS arrow
-  /(?:async\s+)?(\w+)\s*\([^)]*\)\s*\{/,                       // JS method / Go func
+  /(?:const|let|var)\s+(\w{1,128})\s*=\s*(?:async\s+)?(?:\([^)]*\)|_)\s*=>/, // JS arrow
+  /(?:async\s+)?(\w{1,128})\s*\([^)]*\)\s*\{/,                 // JS method / Go func
   /def\s+(\w+)/,                                                // Python/Ruby
   /func\s+(\w+)/,                                               // Go/Swift
-  /(?:public|private|protected|static|override|virtual|abstract|internal)\s+\S+\s+(\w+)\s*\(/, // Java/C#/Kotlin
+  /(?:public|private|protected|static|override|virtual|abstract|internal)\s+\S{1,128}\s+(\w{1,128})\s*\(/, // Java/C#/Kotlin
   /(?:public\s+)?function\s+(\w+)/,                             // PHP
 ];
 
+// Second bound, on the INPUT rather than the patterns: a signature sits at the
+// head of the edited hunk, so matching past the first 8 KB buys nothing and
+// costs linearly. Belt to the caps' braces — it also bounds whatever pattern a
+// future author adds to the array without reading the note above.
+const scanned = oldStr.length > 8192 ? oldStr.slice(0, 8192) : oldStr;
+
 let symbol = null;
 for (const pat of fnPatterns) {
-  const m = oldStr.match(pat);
+  const m = scanned.match(pat);
   if (m) {
     // Find the first captured group
     symbol = m[1] || m[2];

package/claude-plugin/scripts/pre-grep-guide.js

@@ -291,6 +291,20 @@ const { resolveProjectRoot } = require('./project-root');
 // (the exact shape that would re-create the answered:false glob failure).
 function rebaseRelativePaths(cmd, relPrefix, rootDir, exists = fs.existsSync) {
   if (!cmd || typeof cmd !== 'string' || !relPrefix || !rootDir) return cmd;
+  // SEC-05 (audit 2026-08-29): one `exists()` syscall per surviving token, and
+  // this runs BEFORE every length gate in the file — `shouldHint`'s 1000-char
+  // sanity check (:159) and the 2000-char ones on the sed/tail extractors are all
+  // downstream of it, so the guard sat below the thing it was guarding. Measured
+  // with a counting stub: 100k tokens is 100,001 probes, 2.2 s of real
+  // `fs.existsSync` on this box, paid inside a BLOCKING PreToolUse hook.
+  //
+  // The bound is the loosest one the file already uses, so nothing that any
+  // downstream gate would still have processed changes behavior: a command this
+  // long is past the sed/tail extractors' limit and twice past `shouldHint`'s.
+  // Placed here rather than at the two call sites because both of them
+  // (`pre-grep-guide` runMain, `post-grep-inject` runMain) need it, and a guard
+  // that lives in the callers is one refactor away from being dropped.
+  if (cmd.length > 2000) return cmd;
   const prefix = relPrefix.split(path.sep).join('/');
   // Shell sits outside any known source dir (docs/, target/, …) — don't guess.
   if (!SRC_PATH_TOKEN.test(prefix + '/')) return cmd;

package/claude-plugin/scripts/session-init.js

@@ -12,6 +12,10 @@ const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-util
 const { maybeAutoAdopt, isAdopted, unadopt } = require('./adopt');
 const { isNonProjectCwd } = require('./project-detect');
 const { hidden } = require('./proc-opts');
+// Module scope on purpose: `detectHookDark` reads it inside a try/catch that
+// treats any throw as "nothing to conclude", so a lazy require in there would
+// turn a resolution failure into a silent disable (pre-tag review, JS-08).
+const { resolveProjectRoot } = require('./project-root');
 
 // v0.17.0 — quietHooks: unconditional quiet 默认。
 // 项目地图与 MEMORY.md plugin contract + on-demand `project_map` 工具高度重叠，
@@ -954,7 +958,20 @@ function analyzeHookDark(recText) {
 
 function detectHookDark() {
   try {
-    const recPath = path.join(process.cwd(), '.code-graph', 'recommendations.jsonl');
+    // JS-08 (audit 2026-08-29). Every WRITER of this file records into the
+    // RESOLVED root — subdir cwd walks up to the project root, a linked worktree
+    // reads the main checkout's index — while this reader used a bare
+    // `process.cwd()`. So in exactly the sessions the subdir-cwd fix exists for,
+    // the dark DETECTOR was itself dark: no file at that path, no claim made,
+    // nothing said. `resolveProjectRoot` returns null when nothing on the walk is
+    // indexed; cwd remains the fallback for that case (unchanged behaviour).
+    //
+    // Required at module scope (see top of file), not here: inside this
+    // try/catch a module-resolution failure would be indistinguishable from
+    // "no recommendations.jsonl", which is the silent-disable shape this whole
+    // finding is about. The sibling hooks all require it at top level too.
+    const root = resolveProjectRoot(process.cwd()) || process.cwd();
+    const recPath = path.join(root, '.code-graph', 'recommendations.jsonl');
     return analyzeHookDark(fs.readFileSync(recPath, 'utf8'));
   } catch { return null; } // no recommendations.jsonl → nothing to conclude
 }

package/claude-plugin/skills/index.md

@@ -2,8 +2,8 @@
 name: index
 description: |
   Diagnose and fix code-graph index issues. Use when: search returns unexpected/empty
-  results, or after major codebase restructuring. These management commands are NOT
-  exposed via MCP tools — this skill is the only way to access them.
+  results, or after major codebase restructuring. Covers the health check and both
+  rebuild paths from the CLI.
 ---
 
 # Index Maintenance
@@ -20,5 +20,15 @@ code-graph-mcp incremental-index
 
 ## Full rebuild (when incremental isn't enough)
 ```bash
-rm -rf .code-graph/ && code-graph-mcp incremental-index
+code-graph-mcp rebuild-index --confirm
 ```
+
+This builds the new index in a temporary location and swaps it in with an atomic
+rename, so a running MCP server (and its open WAL) never observes a half-built
+index. Deleting the `.code-graph/` directory by hand skips that swap, which is
+the exact situation the atomic path exists for.
+
+`get_index_status` and `rebuild_index` do dispatch over JSON-RPC, but they are
+deliberately kept out of `tools/list` to save tokens (`src/mcp/tools.rs`), so
+they are not in your callable tool set — the CLI above is the surface you have.
+It is also the only one that works with no server running.

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.127.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.129.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.127.0",
+  "version": "0.129.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.127.0",
-    "@sdsrs/code-graph-linux-arm64": "0.127.0",
-    "@sdsrs/code-graph-darwin-x64": "0.127.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.127.0",
-    "@sdsrs/code-graph-win32-x64": "0.127.0"
+    "@sdsrs/code-graph-linux-x64": "0.129.0",
+    "@sdsrs/code-graph-linux-arm64": "0.129.0",
+    "@sdsrs/code-graph-darwin-x64": "0.129.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.129.0",
+    "@sdsrs/code-graph-win32-x64": "0.129.0"
   }
 }