@sdsrs/code-graph 0.137.0 → 0.139.0

package/README.md

@@ -590,6 +590,7 @@ plugins' entries. An installer that reads exit codes must not treat it as
 | Variable | Set by | Purpose |
 |---|---|---|
 | `CODE_GRAPH_STATUSLINE_CWD` | statusline-composite | Forwards Claude Code's authoritative cwd to each statusline provider. |
+| `CODE_GRAPH_STATUSLINE_DEBUG` | test suite | Makes statusline-composite print why it dropped a provider instead of swallowing the error. Off by default so a broken third-party provider stays silent in a real statusline. |
 | `CODE_GRAPH_INSTALL_LOCK_HELD` | launcher | Tells a child that the parent already holds the install lock, so it does not deadlock. |
 | `CODE_GRAPH_AUTO_UPDATE_SILENT` | session-init | Runs the update check without console output. |
 | `CODE_GRAPH_NO_ANSWER_IN_DENY` | lifecycle | Keeps `cg-answer` out of the deny path. |

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.137.0",
+  "version": "0.139.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -35,7 +35,7 @@ function commandExists(cmd) {
 
 // ── Configuration ──────────────────────────────────────────
 const GITHUB_REPO = 'sdsrss/code-graph-mcp';
-const STATE_FILE = path.join(CACHE_DIR, 'update-state.json');
+const { UPDATE_STATE_FILE: STATE_FILE, MANIFEST_FILE, INSTALL_LOCK_FILE } = require('./cache-paths');
 const BINARY_CACHE_DIR = path.join(CACHE_DIR, 'bin');
 const CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;        // 6h — steady-state re-check
 const UP_TO_DATE_RECHECK_MS = 30 * 60 * 1000;        // 30min — re-verify an "up to date" result (release-race guard)
@@ -956,7 +956,7 @@ async function downloadAndInstall(latest, {
           const manifest = readManifest();
           manifest.version = latest.version;
           manifest.updatedAt = new Date().toISOString();
-          writeJsonAtomic(path.join(CACHE_DIR, 'install-manifest.json'), manifest);
+          writeJsonAtomic(MANIFEST_FILE, manifest);
         } catch { /* not fatal */ }
       }
 
@@ -1272,7 +1272,7 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
       // shouldHealGlobalsOnThrottle). Cheap local check first; only the actually-
       // stale case takes the slow, lock-guarded npm path.
       if (shouldHealGlobalsOnThrottle(state)) {
-        installLock = acquireLock(path.join(CACHE_DIR, 'install.lock'));
+        installLock = acquireLock(INSTALL_LOCK_FILE);
         if (installLock) {
           const globalHeal = await selfHealGlobalPkgs({ version: state.latestVersion }, state);
           saveState({ ...readState(), ...globalHeal });
@@ -1317,7 +1317,7 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
     // it marks that with CODE_GRAPH_INSTALL_LOCK_HELD so we don't deadlock
     // against our own parent.
     if (process.env.CODE_GRAPH_INSTALL_LOCK_HELD !== '1') {
-      installLock = acquireLock(path.join(CACHE_DIR, 'install.lock'));
+      installLock = acquireLock(INSTALL_LOCK_FILE);
       // Reason, not null — same misreport as the fetch failure above: the
       // holder is mid-update, so "Up to date (v<old>)" is exactly wrong.
       if (!installLock) return { noop: true, reason: 'install-lock-held', from: installedVersion };

package/claude-plugin/scripts/cache-paths.js

@@ -0,0 +1,39 @@
+'use strict';
+// Single home for the `~/.cache/code-graph` file names.
+//
+// JS-05 (audit 2026-09-05): `update-state.json` was spelled in five modules,
+// `install.lock` in two, `install-manifest.json` in three — and two of those
+// rebuilt the whole path out of `os.homedir()` rather than joining `CACHE_DIR`,
+// so the modules that would break first if the cache layout moved were also the
+// two that never load the module where it was defined. A rename had to be found
+// by grep. `tests/hardening.rs::cache_file_names_have_exactly_one_spelling`
+// keeps this the only file that may spell them.
+//
+// Deliberately tiny and dependency-free beyond node builtins, for ONE consumer:
+// `user-prompt-context.js` runs on the UserPromptSubmit hook path and does not
+// load `lifecycle.js`, so taking a path string from there would cost it the
+// whole module. Measured at 30.1 ms as shipped versus 34.5 ms if it also loaded
+// `lifecycle.js` (+14%).
+//
+// `statusline.js` was the other hardcoded spelling and is NOT a reason for this
+// file — it already does `require('./lifecycle')`, so its copy of the three path
+// segments bought nothing. An earlier version of this comment claimed both
+// modules needed the split (pre-ship review 2026-09-07).
+const os = require('os');
+const path = require('path');
+
+const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
+
+/** Auto-update bookkeeping: available version, attempt counters, last error. */
+const UPDATE_STATE_FILE = path.join(CACHE_DIR, 'update-state.json');
+/** What the last install wrote, and where. Absent = never installed. */
+const MANIFEST_FILE = path.join(CACHE_DIR, 'install-manifest.json');
+/** Inter-process install lock (see install-lock.js). */
+const INSTALL_LOCK_FILE = path.join(CACHE_DIR, 'install.lock');
+
+module.exports = {
+  CACHE_DIR,
+  UPDATE_STATE_FILE,
+  MANIFEST_FILE,
+  INSTALL_LOCK_FILE,
+};

package/claude-plugin/scripts/doctor.js

@@ -6,10 +6,11 @@ const path = require('path');
 const os = require('os');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const {
-  getPluginVersion, readJson, readJsonResult, healthCheck, scanForBrokenPaths, CACHE_DIR,
+  getPluginVersion, readJson, readJsonResult, healthCheck, scanForBrokenPaths,
   settingsPath, surveyHookCoverage,
   installedGlobalPkgs, GLOBAL_INSTALL_MARKER, SHELL_PKG,
 } = require('./lifecycle');
+const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { findBinary, clearCache: clearBinaryCache } = require('./find-binary');
 const { hidden } = require('./proc-opts');
 const { MAX_UPDATE_ATTEMPTS, GLOBAL_PKG_HEAL_MAX_ATTEMPTS, isBinaryHealExhausted, readState } = require('./auto-update');
@@ -589,7 +590,7 @@ function runDiagnostics({ checkOnly = false } = {}) {
       // this line used to hardcode 3 while the comment named the constant, so
       // raising the cap in auto-update.js would have left this diagnosis
       // reporting the old one (audit 2026-08-29 JS-07).
-      const state = readJson(path.join(CACHE_DIR, 'update-state.json')) || {};
+      const state = readJson(UPDATE_STATE_FILE) || {};
       const healGaveUp = (state.globalPkgHealAttempts || 0) >= GLOBAL_PKG_HEAL_MAX_ATTEMPTS;
       results.push({
         name: 'Global npm packages',
@@ -858,7 +859,7 @@ function probeHealth({ find = findBinary } = {}) {
 }
 
 function readUpdateState() {
-  try { return readJson(path.join(CACHE_DIR, 'update-state.json')); } catch { return null; }
+  try { return readJson(UPDATE_STATE_FILE); } catch { return null; }
 }
 
 /**

package/claude-plugin/scripts/lifecycle.js

@@ -12,7 +12,15 @@ const OLD_PLUGIN_IDS = [
   'code-graph@sdsrss-code-graph', // v2 legacy ID (pre-rename)
 ];
 const MARKETPLACE_NAME = 'code-graph-mcp';
-const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
+// Imported, not defined here: five other modules needed these three names and
+// one of them — `user-prompt-context.js`, on the UserPromptSubmit hook path —
+// cannot afford to load this file for them (see cache-paths.js, JS-05).
+//
+// The export surface below is unchanged. Measured rather than asserted, after
+// the first version of this comment claimed `MANIFEST_FILE` was exported from
+// here: `CACHE_DIR` and `INSTALL_LOCK_FILE` are exported and still are;
+// `MANIFEST_FILE` is module-private and always was, so nothing importable moved.
+const { CACHE_DIR, MANIFEST_FILE, INSTALL_LOCK_FILE } = require('./cache-paths');
 // Bound for the `ps` fallback in getActiveCmdlines (pre-ship review 2026-09-06).
 // 2 s matches the other hook-path probes; the floor is what a budget-exhausted
 // hook still gives it, since an empty list degrades to recency-only.
@@ -22,14 +30,12 @@ const PS_PROBE_MIN_MS = 250;
 // plugins when hooks run in shared process context (e.g. claude-mem-lite sets it
 // to its own marketplace path, polluting all subsequent settings.json hook processes).
 const PLUGIN_ROOT = path.resolve(__dirname, '..');
-const MANIFEST_FILE = path.join(CACHE_DIR, 'install-manifest.json');
 const REGISTRY_FILE = path.join(CACHE_DIR, 'statusline-registry.json');
 // Written by the launcher's background install when ITS `npm install -g` step
 // introduced the global shell + platform packages. Uninstall only removes
 // global packages it can prove the plugin installed (marker present) or when
 // the user passes --purge-global — a deliberate user install is never yanked.
 const GLOBAL_INSTALL_MARKER = path.join(CACHE_DIR, 'global-install-marker.json');
-const INSTALL_LOCK_FILE = path.join(CACHE_DIR, 'install.lock');
 const SHELL_PKG = '@sdsrs/code-graph';
 
 // Lazy resolvers — Claude Code's config dir can be overridden by CLAUDE_CONFIG_DIR

package/claude-plugin/scripts/session-init.js

@@ -8,6 +8,7 @@ const {
   cleanupDisabledStatusline, isPluginInactive, isPluginUninstalled, removeCacheResidue,
   readJson, CACHE_DIR, settingsPath, isStaleRelicContext, hookCmdScript,
 } = require('./lifecycle');
+const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const { maybeAutoAdopt, isAdopted, unadopt } = require('./adopt');
 const { isNonProjectCwd } = require('./project-detect');
@@ -604,7 +605,7 @@ function consistencyCheck(binary) {
 
   // Check 3: Auto-update incomplete
   try {
-    const statePath = path.join(CACHE_DIR, 'update-state.json');
+    const statePath = UPDATE_STATE_FILE;
     const state = readJson(statePath);
     if (state && state.updateAvailable && state.binaryUpdated === false) {
       issues.push({

package/claude-plugin/scripts/statusline-composite.js

@@ -140,7 +140,65 @@ function runProvider(command, needsStdin, stdin, id) {
     })).toString().trim();
 
     return out || null;
-  } catch { return null; }
+  } catch (err) {
+    // EPIPE is OUR failure to deliver, not the provider's failure to answer.
+    // `execFileSync` writes `input` into the child's stdin; a provider that
+    // exits without reading it (a static `echo`, an env-var-only line) makes
+    // that write fail — and by then the child has already produced its output
+    // in full. Discarding it drops the user's original statusline for a reason
+    // that has nothing to do with the provider. `_previous` is registered with
+    // needsStdin unconditionally true (lifecycle.js), so every such user is
+    // exposed. Measured: 10/10 EPIPE with a payload past the pipe buffer and
+    // the child's stdout complete in 10 of 10; on ordinary payloads the same
+    // discard happens as a timing race, which is what made
+    // lifecycle.e2e.test.js's "issue #24" intermittent for two releases.
+    // An empty stdout still falls through: nothing was produced, nothing to keep.
+    // Gated on a CLEAN exit. A provider that genuinely failed can EPIPE too, and
+    // its stdout is then partial by definition. Measured: a `set -e` script that
+    // prints one segment and exits 1 salvages as "SEGMENT-ONE |" — half a line,
+    // rendered as if whole, and rendering differently run to run depending on
+    // which side of the race it lands. `err.status` is 0 in the case this exists
+    // for (pre-ship delta review 2026-09-06).
+    //
+    // `status === 0`, not `!status`: a signal-killed child reports `status:
+    // null`, which `!status` would wave through — and that is a live path, not a
+    // defensive one. A provider that prints and then takes a signal while we
+    // still have stdin to write lands HERE, with `code: 'EPIPE'`, `status: null`
+    // and half a line; measured 6 runs of 6 across SIGTERM and SIGKILL. Only our
+    // OWN 3 s timeout misses this branch, surfacing as ETIMEDOUT instead.
+    // Measured set: clean → EPIPE / 0 / whole line; `exit 1` → EPIPE / 1 / half;
+    // self-signal → EPIPE / null / half; our timeout → ETIMEDOUT / null / half.
+    const salvaged =
+      err && err.code === 'EPIPE' && err.status === 0
+        ? (err.stdout || '').toString().trim()
+        : '';
+    // Swallowing is correct in production and stays the default: a third-party
+    // provider that throws must not take the user's whole statusline with it.
+    // But a swallowed error is also why `lifecycle.e2e.test.js`'s "issue #24"
+    // has gone intermittently red with nothing to go on — a dropped provider and
+    // a provider that printed nothing are the same observation from outside, so
+    // every diagnosis of it so far has been a guess. Opt-in, off unless the env
+    // var is set, so no shipped behavior changes.
+    if (process.env.CODE_GRAPH_STATUSLINE_DEBUG) {
+      // Its own try/catch. On Linux this is belt-and-braces rather than
+      // load-bearing: a write to a closed stderr does NOT throw synchronously —
+      // measured both shapes, `fs.closeSync(2)` is a silent no-op and a piped
+      // reader that exits surfaces one tick later as an uncaughtException, which
+      // no try/catch here can see (hook-fail-open.js already handles that path
+      // and skips its own stderr write on EPIPE). It earns its place on Windows,
+      // where piped stderr writes are synchronous, and it costs nothing: this
+      // sits inside the catch that keeps a bad provider from taking the whole
+      // statusline down, so a debug switch must not be the thing that does.
+      try {
+        const why = err && (err.code || err.message) ? (err.code || err.message) : String(err);
+        // Report BOTH outcomes. Returning early on a salvage would make the
+        // channel silent on the exact failure it was built to diagnose.
+        const verb = salvaged ? 'recovered after' : 'dropped';
+        process.stderr.write(`[statusline] provider '${id}' ${verb}: ${why}\n`);
+      } catch { /* diagnostics are best-effort; rendering is not */ }
+    }
+    return salvaged || null;
+  }
 }
 
 // Extract Claude Code's current working directory from the stdin JSON context.

package/claude-plugin/scripts/statusline.js

@@ -10,11 +10,11 @@ if (require.main === module) require('./hook-fail-open').installHookFailOpen('st
 
 const { execFileSync } = require('child_process');
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
 const { findBinary } = require('./find-binary');
 const { resolveProjectRoot } = require('./project-root');
 const lifecycle = require('./lifecycle');
+const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { hidden } = require('./proc-opts');
 const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() => ({ cleaned: false }));
 
@@ -29,8 +29,7 @@ const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() =>
 const STUCK_UPDATE_ATTEMPTS = 5;
 function readUpdateState() {
   try {
-    return JSON.parse(fs.readFileSync(
-      path.join(os.homedir(), '.cache', 'code-graph', 'update-state.json'), 'utf8'));
+    return JSON.parse(fs.readFileSync(UPDATE_STATE_FILE, 'utf8'));
   } catch { return null; /* no state file or unreadable */ }
 }
 function updatePending(st = readUpdateState()) {

package/claude-plugin/scripts/user-prompt-context.js

@@ -14,7 +14,6 @@ if (require.main === module) require('./hook-fail-open').installHookFailOpen('Us
 const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
 // Hook cooldown flags + the restart notice go under cgTmpDir() (a code-graph-mcp/
 // subdir of os.tmpdir()), NOT bare os.tmpdir(): Claude Code overrides $TMPDIR to
 // ~/.claude/tmp/, so bare-tmp flags interleave with transcript captures —
@@ -23,8 +22,11 @@ const os = require('os');
 const { cgTmpDir, cwdHash } = require('./tmp-dir');
 const { hidden } = require('./proc-opts');
 
-// Mid-session install detection: hook fires but no manifest yet.
-const MANIFEST_PATH = path.join(os.homedir(), '.cache', 'code-graph', 'install-manifest.json');
+// Mid-session install detection: hook fires but no manifest yet. The path comes
+// from `cache-paths.js` — deliberately NOT from `lifecycle.js`, which this hook
+// must not load (startup budget); it used to be a third hand-spelled copy of the
+// same three path segments (JS-05).
+const { MANIFEST_FILE: MANIFEST_PATH } = require('./cache-paths');
 
 // --- Per-type rate limiting (replaces single global cooldown) ---
 const COOLDOWNS = {

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.137.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.139.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.137.0",
+  "version": "0.139.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.137.0",
-    "@sdsrs/code-graph-linux-arm64": "0.137.0",
-    "@sdsrs/code-graph-darwin-x64": "0.137.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.137.0",
-    "@sdsrs/code-graph-win32-x64": "0.137.0"
+    "@sdsrs/code-graph-linux-x64": "0.139.0",
+    "@sdsrs/code-graph-linux-arm64": "0.139.0",
+    "@sdsrs/code-graph-darwin-x64": "0.139.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.139.0",
+    "@sdsrs/code-graph-win32-x64": "0.139.0"
   }
 }