@sdsrs/code-graph 0.128.0 → 0.129.0

package/README.md

@@ -55,17 +55,18 @@ Every design decision — from token-aware compression to node_id-based snippet
 ## Performance
 
 Every row below is a line `code-graph-mcp benchmark` prints, measured on this
-repository (278 files, 5,065 nodes, 10,731 edges) with a release build. Run the
-same command on your own project — the numbers that matter are yours, and these
-scale with tree size and machine.
+repository (283 files, 5,311 nodes, 11,215 edges) with a release build — median
+of three consecutive runs on an otherwise idle machine. Run the same command on
+your own project: the numbers that matter are yours, and these scale with tree
+size and machine.
 
-| `benchmark` line | This repo, v0.123.0 |
+| `benchmark` line | This repo, v0.129.0 |
 |--------|-------|
-| Full index | **~1.9s** (≈145 files/second, single-threaded) |
-| Incremental (noop) | **~30ms** no-change detection via BLAKE3 Merkle tree |
-| Query latency P50 / P99 | **~575us / ~1.9ms** |
-| DB size | **~21.8MB** (≈4.4MB per 1,000 nodes) |
-| Avg tokens/node | **~239** |
+| Full index | **~2.0s** (≈139 files/second, single-threaded) |
+| Incremental (noop) | **~28ms** no-change detection via BLAKE3 Merkle tree |
+| Query latency P50 / P99 | **~655us / ~2.1ms** |
+| DB size | **~22.4MB** (≈4.2MB per 1,000 nodes) |
+| Avg tokens/node | **~242** |
 
 ## Efficiency: code-graph vs Traditional Tools
 
@@ -286,6 +287,18 @@ code-graph-mcp uninstall     # restore statusline, strip hooks, drop the cache
 npm uninstall -g @sdsrs/code-graph
 ```
 
+### Built from source (cargo)
+
+`uninstall` lives in the npm wrapper, so a `cargo install` / `cargo build` binary
+does not carry it — that binary tells you as much and points here. Run the
+teardown through npx without installing globally (npx still downloads the package
+and its platform binary into the npm cache), then remove your binary:
+
+```bash
+npx -y @sdsrs/code-graph uninstall   # statusline, hooks, cache
+cargo uninstall code-graph-mcp       # or delete the target/release binary
+```
+
 ## MCP Tools
 
 `tools/list` advertises exactly these seven. Several older niche tools were folded into flags on them, so one call now covers what used to take a separate tool:
@@ -338,6 +351,7 @@ All tools are also available as CLI subcommands for shell scripts, hooks, and te
 | `doctor` | — | Diagnose and repair environment issues |
 | `adopt` | — | Install the steering block into the project `CLAUDE.md` + detail doc |
 | `unadopt` | — | Remove the steering block + detail doc |
+| `uninstall` | — | Full local teardown (statusline, hooks, cache). npm/npx installs only — a `cargo install` build prints where to get it |
 | `serve` | — | Start the MCP JSON-RPC server on stdio (the default with no subcommand) |
 
 Common options: `--json` (JSON output), `--compact` (compact output), `--limit N`, `--depth N`, `--file <path>`.

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.128.0",
+  "version": "0.129.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/agents/code-explorer.md

@@ -1,12 +1,15 @@
 ---
 name: code-explorer
 description: Deep code understanding expert using AST knowledge graph. Use when exploring unfamiliar code, tracing complex relationships, or understanding module architecture.
-tools: ["Read", "Grep", "Glob", "Bash", "mcp__code-graph__semantic_code_search", "mcp__code-graph__get_call_graph", "mcp__code-graph__get_ast_node", "mcp__code-graph__project_map", "mcp__code-graph__module_overview", "mcp__code-graph__ast_search", "mcp__code-graph__find_references"]
+tools: ["Read", "Grep", "Glob", "Bash", "mcp__code-graph__semantic_code_search", "mcp__code-graph__get_call_graph", "mcp__code-graph__get_ast_node", "mcp__code-graph__project_map", "mcp__code-graph__module_overview", "mcp__code-graph__ast_search", "mcp__code-graph__find_references", "mcp__plugin_code-graph-mcp_code-graph__semantic_code_search", "mcp__plugin_code-graph-mcp_code-graph__get_call_graph", "mcp__plugin_code-graph-mcp_code-graph__get_ast_node", "mcp__plugin_code-graph-mcp_code-graph__project_map", "mcp__plugin_code-graph-mcp_code-graph__module_overview", "mcp__plugin_code-graph-mcp_code-graph__ast_search", "mcp__plugin_code-graph-mcp_code-graph__find_references"]
 model: sonnet
 ---
 
 You are a code exploration specialist with access to an AST knowledge graph.
 
+<!-- The tool allowlist carries both MCP namespace spellings on purpose (DOC-07);
+     rationale in CHANGELOG. Delete at most one half, never both. -->
+
 ## Strategy
 
 1. **Start with semantic_code_search** to locate relevant code by meaning, or **module_overview** / **project_map** to map an unfamiliar directory or the whole repo

package/claude-plugin/hooks/hooks.json

@@ -4,7 +4,7 @@
   "hooks": {
     "SessionStart": [
       {
-        "matcher": "startup|clear|compact",
+        "matcher": "startup|clear|compact|resume",
         "hooks": [
           {
             "type": "command",

package/claude-plugin/scripts/auto-update.js

@@ -507,9 +507,23 @@ function cachedBinaryStaleVsState(state, { binaryPath = cachedBinaryPath(), read
  *      install dropped the platform package).
  *
  * Returns true on successful promote, false otherwise. Never throws.
+ *
+ * JS-03: gated on `cachedBinaryNeedsUpdate` so an already-current binary is
+ * never re-fetched. The gate lives HERE rather than at the call sites because
+ * all four of them wanted it: `downloadAndInstall` Step 2 called this
+ * unconditionally, and its two early-return arms (no plugin tarball / tarball
+ * integrity failure) call it again on the way out. On the normal update path
+ * the binary really is behind, so the gate is a no-op; it pays off on every
+ * REPEATED round — e.g. the JS-02 treadmill, where a blocked repoint replayed
+ * `downloadAndInstall` about every 30 minutes and each replay re-downloaded and
+ * re-promoted a ~40 MB binary that was already latest.
+ *
+ * `needsUpdate` is injectable for tests only; production always uses the real
+ * predicate. Returning false on a skip is accurate: nothing was updated.
  */
-async function downloadBinary(latest) {
+async function downloadBinary(latest, { needsUpdate = cachedBinaryNeedsUpdate } = {}) {
   if (!latest || !latest.binaryUrl) return false;
+  if (!needsUpdate(latest)) return false; // already at latest.version — no fetch
   if (!commandExists('curl')) {
     console.error('[code-graph] Binary download skipped: curl not on PATH.');
     return false;

package/claude-plugin/scripts/session-init.js

@@ -12,6 +12,10 @@ const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-util
 const { maybeAutoAdopt, isAdopted, unadopt } = require('./adopt');
 const { isNonProjectCwd } = require('./project-detect');
 const { hidden } = require('./proc-opts');
+// Module scope on purpose: `detectHookDark` reads it inside a try/catch that
+// treats any throw as "nothing to conclude", so a lazy require in there would
+// turn a resolution failure into a silent disable (pre-tag review, JS-08).
+const { resolveProjectRoot } = require('./project-root');
 
 // v0.17.0 — quietHooks: unconditional quiet 默认。
 // 项目地图与 MEMORY.md plugin contract + on-demand `project_map` 工具高度重叠，
@@ -954,7 +958,20 @@ function analyzeHookDark(recText) {
 
 function detectHookDark() {
   try {
-    const recPath = path.join(process.cwd(), '.code-graph', 'recommendations.jsonl');
+    // JS-08 (audit 2026-08-29). Every WRITER of this file records into the
+    // RESOLVED root — subdir cwd walks up to the project root, a linked worktree
+    // reads the main checkout's index — while this reader used a bare
+    // `process.cwd()`. So in exactly the sessions the subdir-cwd fix exists for,
+    // the dark DETECTOR was itself dark: no file at that path, no claim made,
+    // nothing said. `resolveProjectRoot` returns null when nothing on the walk is
+    // indexed; cwd remains the fallback for that case (unchanged behaviour).
+    //
+    // Required at module scope (see top of file), not here: inside this
+    // try/catch a module-resolution failure would be indistinguishable from
+    // "no recommendations.jsonl", which is the silent-disable shape this whole
+    // finding is about. The sibling hooks all require it at top level too.
+    const root = resolveProjectRoot(process.cwd()) || process.cwd();
+    const recPath = path.join(root, '.code-graph', 'recommendations.jsonl');
     return analyzeHookDark(fs.readFileSync(recPath, 'utf8'));
   } catch { return null; } // no recommendations.jsonl → nothing to conclude
 }

package/claude-plugin/skills/index.md

@@ -2,8 +2,8 @@
 name: index
 description: |
   Diagnose and fix code-graph index issues. Use when: search returns unexpected/empty
-  results, or after major codebase restructuring. These management commands are NOT
-  exposed via MCP tools — this skill is the only way to access them.
+  results, or after major codebase restructuring. Covers the health check and both
+  rebuild paths from the CLI.
 ---
 
 # Index Maintenance
@@ -20,5 +20,15 @@ code-graph-mcp incremental-index
 
 ## Full rebuild (when incremental isn't enough)
 ```bash
-rm -rf .code-graph/ && code-graph-mcp incremental-index
+code-graph-mcp rebuild-index --confirm
 ```
+
+This builds the new index in a temporary location and swaps it in with an atomic
+rename, so a running MCP server (and its open WAL) never observes a half-built
+index. Deleting the `.code-graph/` directory by hand skips that swap, which is
+the exact situation the atomic path exists for.
+
+`get_index_status` and `rebuild_index` do dispatch over JSON-RPC, but they are
+deliberately kept out of `tools/list` to save tokens (`src/mcp/tools.rs`), so
+they are not in your callable tool set — the CLI above is the surface you have.
+It is also the only one that works with no server running.

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.128.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.129.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.128.0",
+  "version": "0.129.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.128.0",
-    "@sdsrs/code-graph-linux-arm64": "0.128.0",
-    "@sdsrs/code-graph-darwin-x64": "0.128.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.128.0",
-    "@sdsrs/code-graph-win32-x64": "0.128.0"
+    "@sdsrs/code-graph-linux-x64": "0.129.0",
+    "@sdsrs/code-graph-linux-arm64": "0.129.0",
+    "@sdsrs/code-graph-darwin-x64": "0.129.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.129.0",
+    "@sdsrs/code-graph-win32-x64": "0.129.0"
   }
 }