@sdsrs/code-graph 0.136.0 → 0.138.0

package/README.md

@@ -536,6 +536,7 @@ defaults are what you get by doing nothing.
 | `CODE_GRAPH_HOOK_INDEX=on\|off` | Force the incremental-index hook on or off instead of letting it decide. |
 | `CODE_GRAPH_MODEL_DIR=<dir>` | Load the embedding model from here (air-gapped installs). |
 | `CODE_GRAPH_DISABLE_MODEL_DOWNLOAD=1` | Never fetch the model; fail instead. |
+| `CODE_GRAPH_REQUIRE_MODEL=1` | Test-only: make the embedding tests FAIL when no model can be loaded instead of self-skipping. Set by the release gate and the cache-warm cron, which supply pinned weights — without it those tests pass by doing nothing on any runner with no cached model. |
 | `CODE_GRAPH_MAX_FILE_SIZE=<bytes>` | Skip files larger than this (default 1 MiB). |
 | `CODE_GRAPH_MAX_CODE_LEN=<bytes>` | Truncate stored per-node source at this length. |
 | `CODE_GRAPH_PARSE_TIMEOUT_MS=<ms>` | Per-file parse timeout. |
@@ -589,6 +590,7 @@ plugins' entries. An installer that reads exit codes must not treat it as
 | Variable | Set by | Purpose |
 |---|---|---|
 | `CODE_GRAPH_STATUSLINE_CWD` | statusline-composite | Forwards Claude Code's authoritative cwd to each statusline provider. |
+| `CODE_GRAPH_STATUSLINE_DEBUG` | test suite | Makes statusline-composite print why it dropped a provider instead of swallowing the error. Off by default so a broken third-party provider stays silent in a real statusline. |
 | `CODE_GRAPH_INSTALL_LOCK_HELD` | launcher | Tells a child that the parent already holds the install lock, so it does not deadlock. |
 | `CODE_GRAPH_AUTO_UPDATE_SILENT` | session-init | Runs the update check without console output. |
 | `CODE_GRAPH_NO_ANSWER_IN_DENY` | lifecycle | Keeps `cg-answer` out of the deny path. |

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.136.0",
+  "version": "0.138.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/cg-answer.js

@@ -336,7 +336,13 @@ function runOverviewAnswer(opts = {}) {
     // green against it.
     const verdict = classifyRun(res, { exitOneIsNoHits: false });
     if (verdict !== 'ok') {
-      return { status: verdict };
+      // Same arm as the three sibling runners: an exhausted hook budget reaches
+      // `classifyRun` as a synthetic timeout, so without this it is reported as
+      // a bare `unavailable` — indistinguishable from a wedged or broken binary.
+      // This runner is the read-fanout hint's only answer path, and its budget is
+      // the one most often already spent (pre-read runs after a SessionStart that
+      // already burned six children), so it is the worst place to lose the cause.
+      return { status: verdict, ...(res.budgetExhausted ? { reason: 'budget' } : {}) };
     }
     const out = (res.stdout || '').trim();
     if (isEmptyAnswer(out)) return { status: 'no-hits' };

package/claude-plugin/scripts/post-grep-inject.js

@@ -316,6 +316,13 @@ function runMain() {
       ...(pattern ? { pattern } : {}),
       fallthrough: answer.status,
       reason: answer.status,
+      // Sub-divides `unavailable` without touching it: a starved hook and a
+      // wedged binary arrive under the same word and only one of them means
+      // something is broken. It cannot ride in `reason` — src/cli/usage.rs:448
+      // scores `reason:"unavailable"` as an inconclusive follow-up, so a new
+      // value there would silently re-file every budget skip as "the inline
+      // answer was insufficient". Same field pre-grep-guide.js:790 uses.
+      ...(answer.reason ? { fallthrough_reason: answer.reason } : {}),
       // Attribute the skip to the mode that burned the attempt — the LAST mode
       // tried, so a callgraph miss that fell through to grep is charged to grep,
       // matching the fallback order above. Without this the aggregator files

package/claude-plugin/scripts/pre-read-guide.js

@@ -192,7 +192,15 @@ function trackReadAndMaybeHint(root, rel, now = Date.now()) {
     // 'no-binary' (delivered overview dark — binary missing) vs 'unavailable'
     // (binary ran but failed/timed out) vs 'no-hits'. Mirrors pre-grep-guide
     // so the read-fanout funnel can tell a dark flagship apart from no result.
+    //
+    // `fallthrough_reason` sub-divides 'unavailable' rather than replacing it:
+    // a spent hook budget and a wedged binary are the same word here, and only
+    // the former is the healthy-hook-answers-nothing case NEW-08 traded a kill
+    // for. It cannot go in `reason` — src/cli/usage.rs:448 scores
+    // `reason:"unavailable"` as an inconclusive follow-up, so a new value there
+    // would re-file every budget skip as "the answer was insufficient".
     ...(answered ? {} : { reason: answer.status }),
+    ...(answered || !answer.reason ? {} : { fallthrough_reason: answer.reason }),
   });
   // Compound-grep sibling sweep: emit via the PreToolUse allow+additionalContext
   // envelope (shared hook-emit.js). Bare stdout on a PreToolUse exit-0 lands in

package/claude-plugin/scripts/statusline-composite.js

@@ -140,7 +140,65 @@ function runProvider(command, needsStdin, stdin, id) {
     })).toString().trim();
 
     return out || null;
-  } catch { return null; }
+  } catch (err) {
+    // EPIPE is OUR failure to deliver, not the provider's failure to answer.
+    // `execFileSync` writes `input` into the child's stdin; a provider that
+    // exits without reading it (a static `echo`, an env-var-only line) makes
+    // that write fail — and by then the child has already produced its output
+    // in full. Discarding it drops the user's original statusline for a reason
+    // that has nothing to do with the provider. `_previous` is registered with
+    // needsStdin unconditionally true (lifecycle.js), so every such user is
+    // exposed. Measured: 10/10 EPIPE with a payload past the pipe buffer and
+    // the child's stdout complete in 10 of 10; on ordinary payloads the same
+    // discard happens as a timing race, which is what made
+    // lifecycle.e2e.test.js's "issue #24" intermittent for two releases.
+    // An empty stdout still falls through: nothing was produced, nothing to keep.
+    // Gated on a CLEAN exit. A provider that genuinely failed can EPIPE too, and
+    // its stdout is then partial by definition. Measured: a `set -e` script that
+    // prints one segment and exits 1 salvages as "SEGMENT-ONE |" — half a line,
+    // rendered as if whole, and rendering differently run to run depending on
+    // which side of the race it lands. `err.status` is 0 in the case this exists
+    // for (pre-ship delta review 2026-09-06).
+    //
+    // `status === 0`, not `!status`: a signal-killed child reports `status:
+    // null`, which `!status` would wave through — and that is a live path, not a
+    // defensive one. A provider that prints and then takes a signal while we
+    // still have stdin to write lands HERE, with `code: 'EPIPE'`, `status: null`
+    // and half a line; measured 6 runs of 6 across SIGTERM and SIGKILL. Only our
+    // OWN 3 s timeout misses this branch, surfacing as ETIMEDOUT instead.
+    // Measured set: clean → EPIPE / 0 / whole line; `exit 1` → EPIPE / 1 / half;
+    // self-signal → EPIPE / null / half; our timeout → ETIMEDOUT / null / half.
+    const salvaged =
+      err && err.code === 'EPIPE' && err.status === 0
+        ? (err.stdout || '').toString().trim()
+        : '';
+    // Swallowing is correct in production and stays the default: a third-party
+    // provider that throws must not take the user's whole statusline with it.
+    // But a swallowed error is also why `lifecycle.e2e.test.js`'s "issue #24"
+    // has gone intermittently red with nothing to go on — a dropped provider and
+    // a provider that printed nothing are the same observation from outside, so
+    // every diagnosis of it so far has been a guess. Opt-in, off unless the env
+    // var is set, so no shipped behavior changes.
+    if (process.env.CODE_GRAPH_STATUSLINE_DEBUG) {
+      // Its own try/catch. On Linux this is belt-and-braces rather than
+      // load-bearing: a write to a closed stderr does NOT throw synchronously —
+      // measured both shapes, `fs.closeSync(2)` is a silent no-op and a piped
+      // reader that exits surfaces one tick later as an uncaughtException, which
+      // no try/catch here can see (hook-fail-open.js already handles that path
+      // and skips its own stderr write on EPIPE). It earns its place on Windows,
+      // where piped stderr writes are synchronous, and it costs nothing: this
+      // sits inside the catch that keeps a bad provider from taking the whole
+      // statusline down, so a debug switch must not be the thing that does.
+      try {
+        const why = err && (err.code || err.message) ? (err.code || err.message) : String(err);
+        // Report BOTH outcomes. Returning early on a salvage would make the
+        // channel silent on the exact failure it was built to diagnose.
+        const verb = salvaged ? 'recovered after' : 'dropped';
+        process.stderr.write(`[statusline] provider '${id}' ${verb}: ${why}\n`);
+      } catch { /* diagnostics are best-effort; rendering is not */ }
+    }
+    return salvaged || null;
+  }
 }
 
 // Extract Claude Code's current working directory from the stdin JSON context.

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.136.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.138.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.136.0",
+  "version": "0.138.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.136.0",
-    "@sdsrs/code-graph-linux-arm64": "0.136.0",
-    "@sdsrs/code-graph-darwin-x64": "0.136.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.136.0",
-    "@sdsrs/code-graph-win32-x64": "0.136.0"
+    "@sdsrs/code-graph-linux-x64": "0.138.0",
+    "@sdsrs/code-graph-linux-arm64": "0.138.0",
+    "@sdsrs/code-graph-darwin-x64": "0.138.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.138.0",
+    "@sdsrs/code-graph-win32-x64": "0.138.0"
   }
 }