@sdsrs/code-graph 0.134.0 → 0.136.0

package/claude-plugin/scripts/find-binary.js

@@ -12,6 +12,27 @@ const PLATFORM = os.platform();
 const ARCH = os.arch();
 const CACHE_FILE = path.join(os.homedir(), '.cache', 'code-graph', 'binary-path');
 const BINARY_NAME = PLATFORM === 'win32' ? 'code-graph-mcp.exe' : 'code-graph-mcp';
+// PATH lookup bound (NEW-07). 2 s matches the sibling `npm root -g` probe; the
+// floor is what a budget-exhausted hook still gives it, because a `which` that
+// cannot answer in 250 ms was not going to rescue this hook anyway.
+const PATH_PROBE_TIMEOUT_MS = 2000;
+const PATH_PROBE_MIN_MS = 250;
+
+/**
+ * How long the PATH probe may run: the hook budget when one is armed, the
+ * default otherwise, never 0 and never fractional.
+ *
+ * Both edges matter. `timeout: 0` is read by node as NO TIMEOUT AT ALL — it
+ * would restore the exact unbounded call this replaced — and a fractional value
+ * makes `child_process` throw ERR_OUT_OF_RANGE, which the `catch` below would
+ * silently turn into "not on PATH" (bugfix #7's shape, in a function that runs
+ * before any hook has spent a millisecond).
+ */
+function pathProbeTimeoutMs(remaining = require('./hook-fail-open').remainingMs) {
+  const left = remaining(PATH_PROBE_TIMEOUT_MS);
+  const ms = left === null ? PATH_PROBE_MIN_MS : Math.floor(left);
+  return Math.max(ms, PATH_PROBE_MIN_MS);
+}
 const PLATFORM_PKG = `@sdsrs/code-graph-${PLATFORM}-${ARCH}`;
 
 /**
@@ -471,9 +492,28 @@ function findBinaryUncached() {
   }
 
   // --- PATH lookup (last resort for intentionally installed binaries) ---
+  //
+  // BOUNDED. This had no timeout at all, and it runs BEFORE any hook has called
+  // `remainingMs` even once — `findBinary()` is the first thing every hook does
+  // (audit 2026-09-05 NEW-07). It was called "the only unbounded child on the
+  // hook path" when it was fixed; the pre-ship review then found `ps` in
+  // `lifecycle.js`, so that was never true. Do not restore the superlative
+  // without re-deriving it. A `which` against a wedged PATH entry (a dead NFS mount, an
+  // automounter) hangs until Claude Code kills the hook, which surfaces to the
+  // user as an error on THEIR tool call.
+  //
+  // Spends the hook budget when one is armed, floored at 250 ms so the probe is
+  // always actually attempted: skipping it outright would make `findBinary`
+  // answer "no binary" for one that is on PATH, and a fabricated absence is
+  // worse than a probe that ran out of time. Outside a hook `remainingMs`
+  // returns the default, so nothing changes for doctor / statusline / the
+  // launcher.
   try {
     const which = PLATFORM === 'win32' ? 'where' : 'which';
-    const found = execFileSync(which, [BINARY_NAME], hidden({ stdio: ['pipe', 'pipe', 'pipe'] }))
+    const found = execFileSync(which, [BINARY_NAME], hidden({
+      timeout: pathProbeTimeoutMs(),
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }))
       .toString().trim().split('\n')[0];
     const hit = gate.consider(found);
     if (hit) return hit;
@@ -513,6 +553,7 @@ module.exports = {
   getPackageVersion, compareVersions, isCachedBinaryFresh,
   detectLibc, unsupportedPlatformHint,
   CACHE_FILE, BINARY_NAME, PLATFORM_PKG,
+  pathProbeTimeoutMs, PATH_PROBE_TIMEOUT_MS, PATH_PROBE_MIN_MS,
 };
 
 // Allow direct invocation for testing

package/claude-plugin/scripts/hook-fail-open.js

@@ -19,7 +19,94 @@
 //
 // EPIPE is silent by design. It means the consumer closed the pipe — Claude
 // Code moved on, or a `| head` upstream exited. There is nobody left to tell.
+// The budget Claude Code kills each hook at, in SECONDS — the single source for
+// both halves of that contract: `lifecycle.js` registers these numbers into
+// settings.json, and `remainingMs` below spends against them. `hooks.test.js`
+// pins both registration sites to this table so a bump in one cannot drift from
+// the other.
+//
+// `session-init.js` is registered from `claude-plugin/hooks/hooks.json` rather
+// than by `lifecycle.js` (SessionStart is the one event Claude Code loads from
+// plugin-cache), so `hooks.test.js` pins that file to this table too. It was
+// the last unclamped hook — 21.5 s of serial children against the 5 s below,
+// the largest overrun of the seven — until audit 2026-09-05 NEW-05 wired it.
+// Its skips are not uniform: see the budget block at the top of
+// `session-init.js` for which children may be dropped silently and which two
+// report a distinct result instead of a fabricated all-clear.
+const HOOK_TIMEOUT_SECONDS = {
+  'pre-edit-guide.js': 4,
+  'pre-grep-guide.js': 3,
+  'pre-read-guide.js': 3,
+  'incremental-index.js': 10,
+  'post-grep-inject.js': 5,
+  'user-prompt-context.js': 5,
+  'session-init.js': 5,
+};
+
+// Left for the hook to render its answer and exit after the last child returns.
+const WRITE_RESERVE_MS = 400;
+
+// Wall-clock instant this process must be finished by, or null when nothing
+// armed one (a hook `require`d by a test, or an unlisted script).
+let deadlineAt = null;
+
+/**
+ * Arm the process deadline from the registered budget of `script`.
+ *
+ * The hooks' internal timeouts were each sized in isolation and run in SERIES:
+ * pre-edit-guide alone could spend 5 × 2000 ms of candidate greps plus 2500 ms
+ * of impact against a 4 s budget, and post-grep-inject looped callgraph over
+ * every symbol in the pattern before its show/grep fallbacks — 2–3× the budget
+ * either way. Nothing enforced the sum, so a binary wedged on `index.lock` got
+ * the hook killed by Claude Code, which surfaces to the user as a hook error on
+ * THEIR tool call (audit 2026-09-05 JS-03).
+ *
+ * `process.uptime()` is subtracted because the budget starts when Claude Code
+ * spawns us, not when this line runs: cold node startup is real time already
+ * spent, and on a loaded machine it is hundreds of milliseconds.
+ */
+function armHookDeadline(script) {
+  const seconds = HOOK_TIMEOUT_SECONDS[script];
+  if (!seconds) return;
+  deadlineAt = Math.floor(Date.now() + seconds * 1000 - process.uptime() * 1000 - WRITE_RESERVE_MS);
+}
+
+/**
+ * How long a child may run: `defaultMs`, or whatever is left of the budget.
+ *
+ * Returns `null` when there is nothing left — meaning DO NOT RUN, not "run
+ * unbounded". Callers must branch on it: node reads `timeout: 0` as no timeout
+ * at all, so a numeric zero here would turn the last child into the unbounded
+ * one, which is the exact failure this exists to prevent.
+ *
+ * Always an INTEGER. `child_process` validates `timeout` with
+ * `validateTimeout` and throws `ERR_OUT_OF_RANGE` on a fraction — and the one
+ * fractional term here (`process.uptime()`) made every spawn throw, which the
+ * runners' own try/catch turned into a silent `unavailable`: the hooks stopped
+ * answering and still exited 0. Caught by pre-grep-guide's e2e suite.
+ */
+function remainingMs(defaultMs) {
+  if (deadlineAt === null) return Math.floor(defaultMs);
+  const left = deadlineAt - Date.now();
+  if (left <= 0) return null;
+  return Math.floor(Math.min(defaultMs, left));
+}
+
+/**
+ * Test seam: drop any armed deadline so one test file can't leak into another.
+ *
+ * `at` (an absolute epoch ms) arms one directly instead. `armHookDeadline`
+ * derives its instant from `process.uptime()`, so a test that wants the
+ * budget-EXHAUSTED branch would otherwise have to wait out a real budget — a
+ * clock race dressed up as a test. Pass `Date.now() - 1` to make every
+ * `remainingMs` return null deterministically.
+ */
+function resetHookDeadline(at = null) {
+  deadlineAt = at === null ? null : Math.floor(at);
+}
+
 function installHookFailOpen(label) {
+  armHookDeadline(require('path').basename(process.argv[1] || ''));
   const bail = (err) => {
     const code = (err && err.code) || (err && err.name) || 'Error';
     if (code !== 'EPIPE') {
@@ -46,4 +133,10 @@ function installHookFailOpen(label) {
   process.on('unhandledRejection', bail);
 }
 
-module.exports = { installHookFailOpen };
+module.exports = {
+  installHookFailOpen,
+  HOOK_TIMEOUT_SECONDS,
+  armHookDeadline,
+  remainingMs,
+  resetHookDeadline,
+};

package/claude-plugin/scripts/lifecycle.js

@@ -13,6 +13,11 @@ const OLD_PLUGIN_IDS = [
 ];
 const MARKETPLACE_NAME = 'code-graph-mcp';
 const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
+// Bound for the `ps` fallback in getActiveCmdlines (pre-ship review 2026-09-06).
+// 2 s matches the other hook-path probes; the floor is what a budget-exhausted
+// hook still gives it, since an empty list degrades to recency-only.
+const PS_PROBE_TIMEOUT_MS = 2000;
+const PS_PROBE_MIN_MS = 250;
 // Always derive from __dirname — CLAUDE_PLUGIN_ROOT env var can leak from other
 // plugins when hooks run in shared process context (e.g. claude-mem-lite sets it
 // to its own marketplace path, polluting all subsequent settings.json hook processes).
@@ -142,6 +147,41 @@ function readJson(filePath) {
 /** How many `.corrupt-*` copies of one file to keep. */
 const MAX_CORRUPT_BACKUPS = 5;
 
+/**
+ * Owner-only. What every file this module creates under `~/.claude` gets when
+ * there is no prior file whose bits to preserve, and what a `.corrupt-*` copy
+ * gets unconditionally: settings.json routinely carries an `env` block with API
+ * keys, and a backup of one is the same secret in a second file (audit
+ * 2026-09-05 JS-01).
+ */
+const SECRET_FILE_MODE = 0o600;
+
+/**
+ * Pin `target` at exactly `mode`, because neither route that creates our files
+ * does it on its own: `writeFileSync`'s `mode` option goes to `open(O_CREAT)`
+ * and is masked by umask (and ignored outright when the file already exists),
+ * and `copyFileSync` carries the SOURCE's bits.
+ *
+ * Reported, not swallowed: the whole point of the call is that the file may
+ * hold a key, so a permission we could not set is exactly the thing the user
+ * needs to hear about. The write itself has already succeeded — a failure here
+ * is a disclosure, not a reason to unwind it.
+ */
+function restrictMode(target, mode) {
+  try {
+    fs.chmodSync(target, mode);
+  } catch (err) {
+    // No return value: both call sites act on the stderr line, not on a bool,
+    // and a discarded success flag is an invitation to branch on it later
+    // without noticing that nothing ever did (pre-ship review 2026-09-05).
+    console.error(
+      `[code-graph] wrote ${target} but could not set its permissions to ` +
+      `0${mode.toString(8)} (${err.code || err.name}). If it contains an API key, ` +
+      `it may be readable by other users on this machine.`
+    );
+  }
+}
+
 /**
  * Delete all but the newest `MAX_CORRUPT_BACKUPS` copies of `filePath`.
  *
@@ -180,9 +220,14 @@ function backupCorruptFile(filePath, raw) {
   const dest = `${filePath}.corrupt-${stamp}`;
   try {
     // Buffer, not string: see readJsonResult. A string here would re-encode.
-    if (Buffer.isBuffer(raw)) fs.writeFileSync(dest, raw);
-    else if (typeof raw === 'string') fs.writeFileSync(dest, Buffer.from(raw, 'utf8'));
-    else fs.copyFileSync(filePath, dest);
+    if (Buffer.isBuffer(raw)) fs.writeFileSync(dest, raw, { mode: SECRET_FILE_MODE });
+    else if (typeof raw === 'string') {
+      fs.writeFileSync(dest, Buffer.from(raw, 'utf8'), { mode: SECRET_FILE_MODE });
+    } else fs.copyFileSync(filePath, dest);
+    // Owner-only regardless of what the original was: up to MAX_CORRUPT_BACKUPS
+    // of these accumulate beside settings.json with its `env` block copied
+    // verbatim, so a 0644 original must not mint 0644 duplicates.
+    restrictMode(dest, SECRET_FILE_MODE);
     pruneCorruptBackups(filePath);
     return dest;
   } catch {
@@ -261,11 +306,23 @@ function readSettingsForWrite(pre) {
   return { settings: {}, backedUpTo: backup };
 }
 
+// Replace-by-rename loses the permission bits unless they are carried over
+// deliberately: the new inode is the TMP file's, created under our umask, so a
+// settings.json the user had put at 0600 came back 0644 on the first
+// install()/update()/cleanupDisabledStatusline() — with its `env` API keys in
+// it, silently, on a file we were only meant to add two hook entries to (audit
+// 2026-09-05 JS-01). Stat the original and restore its exact mode; when there
+// is no original, create owner-only rather than at whatever umask says.
 function writeJsonAtomic(filePath, data) {
   const dir = path.dirname(filePath);
   fs.mkdirSync(dir, { recursive: true });
+  let mode = null;
+  try { mode = fs.statSync(filePath).mode & 0o777; } catch { /* new file */ }
   const tmp = filePath + '.tmp.' + process.pid;
-  fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n');
+  fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { mode: mode ?? SECRET_FILE_MODE });
+  // umask can only have cleared bits the original had, so chmod is what makes
+  // this preservation rather than tightening.
+  restrictMode(tmp, mode ?? SECRET_FILE_MODE);
   fs.renameSync(tmp, filePath);
 }
 
@@ -907,7 +964,13 @@ function removeHooksFromSettings(settings) {
 
 function buildSettingsHookEntries() {
   const root = PLUGIN_ROOT;
-  const scriptCmd = (name, timeout) => {
+  // The budget is read from the table the hooks THEMSELVES spend against
+  // (hook-fail-open.js), not written twice: a number registered here that the
+  // hook does not know about is the JS-03 shape — the hook overruns a limit it
+  // cannot see and Claude Code kills it mid-tool-call.
+  const { HOOK_TIMEOUT_SECONDS } = require('./hook-fail-open');
+  const scriptCmd = (name) => {
+    const timeout = HOOK_TIMEOUT_SECONDS[name];
     const script = path.join(root, 'scripts', name);
     // POSIX: existence-guarded. After `/plugin uninstall`, CC may delete the
     // plugin-cache dir before our statusline teardown gets to strip these
@@ -924,16 +987,16 @@ function buildSettingsHookEntries() {
 
   return {
     PreToolUse: [
-      { description: SETTINGS_HOOK_DESC.preToolUse, matcher: 'Edit', hooks: [scriptCmd('pre-edit-guide.js', 4)] },
-      { description: SETTINGS_HOOK_DESC.preToolUse, matcher: 'Bash', hooks: [scriptCmd('pre-grep-guide.js', 3)] },
-      { description: SETTINGS_HOOK_DESC.preToolUse, matcher: 'Read', hooks: [scriptCmd('pre-read-guide.js', 3)] },
+      { description: SETTINGS_HOOK_DESC.preToolUse, matcher: 'Edit', hooks: [scriptCmd('pre-edit-guide.js')] },
+      { description: SETTINGS_HOOK_DESC.preToolUse, matcher: 'Bash', hooks: [scriptCmd('pre-grep-guide.js')] },
+      { description: SETTINGS_HOOK_DESC.preToolUse, matcher: 'Read', hooks: [scriptCmd('pre-read-guide.js')] },
     ],
     PostToolUse: [
-      { description: SETTINGS_HOOK_DESC.postToolUseEdit, matcher: 'Write|Edit', hooks: [scriptCmd('incremental-index.js', 10)] },
-      { description: SETTINGS_HOOK_DESC.postToolUseInject, matcher: 'Bash', hooks: [scriptCmd('post-grep-inject.js', 5)] },
+      { description: SETTINGS_HOOK_DESC.postToolUseEdit, matcher: 'Write|Edit', hooks: [scriptCmd('incremental-index.js')] },
+      { description: SETTINGS_HOOK_DESC.postToolUseInject, matcher: 'Bash', hooks: [scriptCmd('post-grep-inject.js')] },
     ],
     UserPromptSubmit: [
-      { description: SETTINGS_HOOK_DESC.userPromptSubmit, matcher: '', hooks: [scriptCmd('user-prompt-context.js', 5)] },
+      { description: SETTINGS_HOOK_DESC.userPromptSubmit, matcher: '', hooks: [scriptCmd('user-prompt-context.js')] },
     ],
   };
 }
@@ -1589,10 +1652,19 @@ function update() {
     settingsChanged = true;
   }
 
-  // 1. Update composite command path if version changed
+  // 1. Update composite command path if version changed.
+  //
+  // Same predicate as install()'s heal arm, not a bare string comparison: an
+  // exact mismatch is NOT staleness. Two copies of this plugin (plugin cache +
+  // global npm, or a dev checkout) derive different absolute paths for the SAME
+  // current composite, so rewriting on mismatch makes each surface take the slot
+  // back from the other. install() has carried the guard since that ping-pong
+  // was diagnosed; update() kept the string test, which reopened the pair for
+  // one round on every version bump and walked straight past the
+  // `statuslineDisplaced` stand-down (audit 2026-09-05 JS-08).
   if (isOurComposite(settings)) {
     const cmd = compositeCommand();
-    if (settings.statusLine.command !== cmd) {
+    if (settings.statusLine.command !== cmd && compositeSlotIsStale(settings.statusLine.command)) {
       settings.statusLine.command = cmd;
       settingsChanged = true;
     }
@@ -1717,10 +1789,33 @@ function readActiveProcessCmdlines() {
   } catch { /* fall through to ps */ }
   try {
     const { execFileSync } = require('child_process');
+    // BOUNDED. Reached in-process from the SessionStart hook —
+    // runSessionInit -> syncLifecycleConfig -> update() ->
+    // cleanupOldCacheVersions -> here, unconditionally, on the first session
+    // after every plugin update, which is precisely the session the hook budget
+    // work targets. It carried no timeout, so a wedged `ps` (a stuck process
+    // table, a paused container) hung the hook until Claude Code killed it —
+    // which the user sees as an error on their own tool call. Found by pre-ship
+    // review 2026-09-06 after find-binary's `which` was fixed and the release
+    // notes called it "the only unbounded child a hook could reach".
+    //
+    // Spends the hook budget when one is armed, floored so the probe is always
+    // attempted.
+    //
+    // Be honest about the cost: an empty answer drops pruning back to
+    // recency-only, which is exactly the state this guard exists to escape —
+    // see cleanupOldCacheVersions, where pruning a version a live process is
+    // bound to breaks `/mcp` reconnect with MODULE_NOT_FOUND. So a timeout is a
+    // NEW route to the guard being off, not a free fallback. It is still the
+    // right trade: a `ps` slow enough to hit this is rare, and hanging the hook
+    // past its budget is a certain failure rather than a possible one.
+    const { remainingMs } = require('./hook-fail-open');
+    const budget = remainingMs(PS_PROBE_TIMEOUT_MS);
     return execFileSync('ps', ['-axww', '-o', 'command='], hidden({
+      timeout: budget === null ? PS_PROBE_MIN_MS : Math.max(budget, PS_PROBE_MIN_MS),
       encoding: 'utf8', maxBuffer: 8 * 1024 * 1024,
     })).split('\n').filter(Boolean);
-  } catch { /* unsupported platform — caller falls back to recency-only */ }
+  } catch { /* unsupported platform, or out of time — caller falls back to recency-only */ }
   return [];
 }
 

package/claude-plugin/scripts/pre-edit-guide.js

@@ -24,6 +24,7 @@ const { recordRecommendation } = require('./recommendation-log');
 const { formatCoveringTests } = require('./covering-tests');
 const { emitPreToolContext } = require('./hook-emit');
 const { hidden } = require('./proc-opts');
+const { remainingMs } = require('./hook-fail-open');
 
 // v0.49 — walk up from the shell cwd (subdir-cwd fix). The per-cwd index.db
 // gate kept this hook dark for entire sessions after `cd backend/` — daagu
@@ -114,10 +115,17 @@ if (!symbol || symbol.length < 3) {
       const candidates = [...new Set(identifiers)]
         .filter(id => !skipWords.has(id.toLowerCase()))
         .sort((a, b) => b.length - a.length);
-      for (const candidate of candidates.slice(0, 5)) {
+      // Two candidates, not five. They are sorted most-specific-first, so the
+      // 3rd–5th were the least likely to resolve AND the ones that pushed this
+      // loop past the hook's whole 4 s budget (5 × 2000 ms here + 2500 ms of
+      // impact below); the impact query they starve is the hook's actual output
+      // (audit 2026-09-05 JS-03).
+      for (const candidate of candidates.slice(0, 2)) {
+        const budget = remainingMs(2000);
+        if (budget === null) break;
         try {
           const raw = execFileSync(binary, ['grep', candidate, filePath, '--json'], hidden({
-            cwd, timeout: 2000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
+            cwd, timeout: budget, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
             env: internalEnv,
           }));
           const grepResult = JSON.parse(raw);
@@ -170,6 +178,11 @@ try {
 const editedFile = (input.tool_input && input.tool_input.file_path) || '';
 const relFile = editedFile ? path.relative(cwd, editedFile) : '';
 let jsonResult;
+// Whatever is left of the registered 4 s, capped at this call's own 2500 ms.
+// `null` = the candidate loop above already spent the budget; running anyway is
+// what got the hook killed by Claude Code mid-Edit (audit 2026-09-05 JS-03).
+const impactBudget = remainingMs(2500);
+if (impactBudget === null) process.exit(0);
 try {
   const args = ['impact', symbol, '--json'];
   if (relFile && !relFile.startsWith('..')) args.push('--file', relFile);
@@ -177,7 +190,7 @@ try {
   // diverging from the findBinary() result the rest of the hook trusts).
   const raw = execFileSync(binary, args, hidden({
     cwd,
-    timeout: 2500,
+    timeout: impactBudget,
     encoding: 'utf8',
     stdio: ['pipe', 'pipe', 'pipe'],
     env: internalEnv,

package/claude-plugin/scripts/pre-grep-guide.js

@@ -642,8 +642,14 @@ function buildNoHitsFyi(pattern) {
 // only (PreToolUse exit-0 stdout → debug log, never the model); the operative
 // effect at the call site is the ALLOW (no deny emitted) so the raw grep runs
 // intact instead of a static deny that would hand the model nothing.
-function buildUnavailableFyi(pattern, status) {
-  const why = status === 'no-binary' ? 'binary not found' : 'ran but failed';
+function buildUnavailableFyi(pattern, status, reason) {
+  // Three causes, not two. A hook whose budget was already spent at startup
+  // (cold node on a loaded machine — see the reserve note in cg-answer.js)
+  // deliberately runs no children at all; calling that "ran but failed" blames
+  // the binary for something it was never asked to do (audit 2026-09-05 NEW-08).
+  const why = status === 'no-binary' ? 'binary not found'
+    : reason === 'budget' ? 'no time left in the hook budget'
+      : 'ran but failed';
   return `[code-graph] FYI: \`code-graph-mcp grep "${pattern}"\` unavailable (${why}) — raw grep proceeding.`;
 }
 
@@ -777,11 +783,16 @@ function runMain() {
     // static deny (the answer never ran → status stays the default 'unavailable')
     // — that path falls through to the v0.46 static deny below.
     if (answer.status !== 'hits' && !isAnswerDisabled()) {
-      recordRecommendation(root, { hook: 'grep', action: 'hint', fallthrough: answer.status });
+      recordRecommendation(root, {
+        hook: 'grep', action: 'hint', fallthrough: answer.status,
+        // So the funnel can tell a starved hook from a broken binary; both
+        // arrive as `unavailable` and only one of them means anything is wrong.
+        ...(answer.reason ? { fallthrough_reason: answer.reason } : {}),
+      });
       process.stdout.write(
         (answer.status === 'no-hits'
           ? buildNoHitsFyi(pattern)
-          : buildUnavailableFyi(pattern, answer.status)) + '\n');
+          : buildUnavailableFyi(pattern, answer.status, answer.reason)) + '\n');
       return;
     }