@sdsrs/code-graph 0.138.0 → 0.139.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.138.0",
+  "version": "0.139.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -35,7 +35,7 @@ function commandExists(cmd) {
 
 // ── Configuration ──────────────────────────────────────────
 const GITHUB_REPO = 'sdsrss/code-graph-mcp';
-const STATE_FILE = path.join(CACHE_DIR, 'update-state.json');
+const { UPDATE_STATE_FILE: STATE_FILE, MANIFEST_FILE, INSTALL_LOCK_FILE } = require('./cache-paths');
 const BINARY_CACHE_DIR = path.join(CACHE_DIR, 'bin');
 const CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;        // 6h — steady-state re-check
 const UP_TO_DATE_RECHECK_MS = 30 * 60 * 1000;        // 30min — re-verify an "up to date" result (release-race guard)
@@ -956,7 +956,7 @@ async function downloadAndInstall(latest, {
           const manifest = readManifest();
           manifest.version = latest.version;
           manifest.updatedAt = new Date().toISOString();
-          writeJsonAtomic(path.join(CACHE_DIR, 'install-manifest.json'), manifest);
+          writeJsonAtomic(MANIFEST_FILE, manifest);
         } catch { /* not fatal */ }
       }
 
@@ -1272,7 +1272,7 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
       // shouldHealGlobalsOnThrottle). Cheap local check first; only the actually-
       // stale case takes the slow, lock-guarded npm path.
       if (shouldHealGlobalsOnThrottle(state)) {
-        installLock = acquireLock(path.join(CACHE_DIR, 'install.lock'));
+        installLock = acquireLock(INSTALL_LOCK_FILE);
         if (installLock) {
           const globalHeal = await selfHealGlobalPkgs({ version: state.latestVersion }, state);
           saveState({ ...readState(), ...globalHeal });
@@ -1317,7 +1317,7 @@ async function checkForUpdate({ installMissing = false, force = false, requestJs
     // it marks that with CODE_GRAPH_INSTALL_LOCK_HELD so we don't deadlock
     // against our own parent.
     if (process.env.CODE_GRAPH_INSTALL_LOCK_HELD !== '1') {
-      installLock = acquireLock(path.join(CACHE_DIR, 'install.lock'));
+      installLock = acquireLock(INSTALL_LOCK_FILE);
       // Reason, not null — same misreport as the fetch failure above: the
       // holder is mid-update, so "Up to date (v<old>)" is exactly wrong.
       if (!installLock) return { noop: true, reason: 'install-lock-held', from: installedVersion };

package/claude-plugin/scripts/cache-paths.js

@@ -0,0 +1,39 @@
+'use strict';
+// Single home for the `~/.cache/code-graph` file names.
+//
+// JS-05 (audit 2026-09-05): `update-state.json` was spelled in five modules,
+// `install.lock` in two, `install-manifest.json` in three — and two of those
+// rebuilt the whole path out of `os.homedir()` rather than joining `CACHE_DIR`,
+// so the modules that would break first if the cache layout moved were also the
+// two that never load the module where it was defined. A rename had to be found
+// by grep. `tests/hardening.rs::cache_file_names_have_exactly_one_spelling`
+// keeps this the only file that may spell them.
+//
+// Deliberately tiny and dependency-free beyond node builtins, for ONE consumer:
+// `user-prompt-context.js` runs on the UserPromptSubmit hook path and does not
+// load `lifecycle.js`, so taking a path string from there would cost it the
+// whole module. Measured at 30.1 ms as shipped versus 34.5 ms if it also loaded
+// `lifecycle.js` (+14%).
+//
+// `statusline.js` was the other hardcoded spelling and is NOT a reason for this
+// file — it already does `require('./lifecycle')`, so its copy of the three path
+// segments bought nothing. An earlier version of this comment claimed both
+// modules needed the split (pre-ship review 2026-09-07).
+const os = require('os');
+const path = require('path');
+
+const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
+
+/** Auto-update bookkeeping: available version, attempt counters, last error. */
+const UPDATE_STATE_FILE = path.join(CACHE_DIR, 'update-state.json');
+/** What the last install wrote, and where. Absent = never installed. */
+const MANIFEST_FILE = path.join(CACHE_DIR, 'install-manifest.json');
+/** Inter-process install lock (see install-lock.js). */
+const INSTALL_LOCK_FILE = path.join(CACHE_DIR, 'install.lock');
+
+module.exports = {
+  CACHE_DIR,
+  UPDATE_STATE_FILE,
+  MANIFEST_FILE,
+  INSTALL_LOCK_FILE,
+};

package/claude-plugin/scripts/doctor.js

@@ -6,10 +6,11 @@ const path = require('path');
 const os = require('os');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const {
-  getPluginVersion, readJson, readJsonResult, healthCheck, scanForBrokenPaths, CACHE_DIR,
+  getPluginVersion, readJson, readJsonResult, healthCheck, scanForBrokenPaths,
   settingsPath, surveyHookCoverage,
   installedGlobalPkgs, GLOBAL_INSTALL_MARKER, SHELL_PKG,
 } = require('./lifecycle');
+const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { findBinary, clearCache: clearBinaryCache } = require('./find-binary');
 const { hidden } = require('./proc-opts');
 const { MAX_UPDATE_ATTEMPTS, GLOBAL_PKG_HEAL_MAX_ATTEMPTS, isBinaryHealExhausted, readState } = require('./auto-update');
@@ -589,7 +590,7 @@ function runDiagnostics({ checkOnly = false } = {}) {
       // this line used to hardcode 3 while the comment named the constant, so
       // raising the cap in auto-update.js would have left this diagnosis
       // reporting the old one (audit 2026-08-29 JS-07).
-      const state = readJson(path.join(CACHE_DIR, 'update-state.json')) || {};
+      const state = readJson(UPDATE_STATE_FILE) || {};
       const healGaveUp = (state.globalPkgHealAttempts || 0) >= GLOBAL_PKG_HEAL_MAX_ATTEMPTS;
       results.push({
         name: 'Global npm packages',
@@ -858,7 +859,7 @@ function probeHealth({ find = findBinary } = {}) {
 }
 
 function readUpdateState() {
-  try { return readJson(path.join(CACHE_DIR, 'update-state.json')); } catch { return null; }
+  try { return readJson(UPDATE_STATE_FILE); } catch { return null; }
 }
 
 /**

package/claude-plugin/scripts/lifecycle.js

@@ -12,7 +12,15 @@ const OLD_PLUGIN_IDS = [
   'code-graph@sdsrss-code-graph', // v2 legacy ID (pre-rename)
 ];
 const MARKETPLACE_NAME = 'code-graph-mcp';
-const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
+// Imported, not defined here: five other modules needed these three names and
+// one of them — `user-prompt-context.js`, on the UserPromptSubmit hook path —
+// cannot afford to load this file for them (see cache-paths.js, JS-05).
+//
+// The export surface below is unchanged. Measured rather than asserted, after
+// the first version of this comment claimed `MANIFEST_FILE` was exported from
+// here: `CACHE_DIR` and `INSTALL_LOCK_FILE` are exported and still are;
+// `MANIFEST_FILE` is module-private and always was, so nothing importable moved.
+const { CACHE_DIR, MANIFEST_FILE, INSTALL_LOCK_FILE } = require('./cache-paths');
 // Bound for the `ps` fallback in getActiveCmdlines (pre-ship review 2026-09-06).
 // 2 s matches the other hook-path probes; the floor is what a budget-exhausted
 // hook still gives it, since an empty list degrades to recency-only.
@@ -22,14 +30,12 @@ const PS_PROBE_MIN_MS = 250;
 // plugins when hooks run in shared process context (e.g. claude-mem-lite sets it
 // to its own marketplace path, polluting all subsequent settings.json hook processes).
 const PLUGIN_ROOT = path.resolve(__dirname, '..');
-const MANIFEST_FILE = path.join(CACHE_DIR, 'install-manifest.json');
 const REGISTRY_FILE = path.join(CACHE_DIR, 'statusline-registry.json');
 // Written by the launcher's background install when ITS `npm install -g` step
 // introduced the global shell + platform packages. Uninstall only removes
 // global packages it can prove the plugin installed (marker present) or when
 // the user passes --purge-global — a deliberate user install is never yanked.
 const GLOBAL_INSTALL_MARKER = path.join(CACHE_DIR, 'global-install-marker.json');
-const INSTALL_LOCK_FILE = path.join(CACHE_DIR, 'install.lock');
 const SHELL_PKG = '@sdsrs/code-graph';
 
 // Lazy resolvers — Claude Code's config dir can be overridden by CLAUDE_CONFIG_DIR

package/claude-plugin/scripts/session-init.js

@@ -8,6 +8,7 @@ const {
   cleanupDisabledStatusline, isPluginInactive, isPluginUninstalled, removeCacheResidue,
   readJson, CACHE_DIR, settingsPath, isStaleRelicContext, hookCmdScript,
 } = require('./lifecycle');
+const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const { maybeAutoAdopt, isAdopted, unadopt } = require('./adopt');
 const { isNonProjectCwd } = require('./project-detect');
@@ -604,7 +605,7 @@ function consistencyCheck(binary) {
 
   // Check 3: Auto-update incomplete
   try {
-    const statePath = path.join(CACHE_DIR, 'update-state.json');
+    const statePath = UPDATE_STATE_FILE;
     const state = readJson(statePath);
     if (state && state.updateAvailable && state.binaryUpdated === false) {
       issues.push({

package/claude-plugin/scripts/statusline.js

@@ -10,11 +10,11 @@ if (require.main === module) require('./hook-fail-open').installHookFailOpen('st
 
 const { execFileSync } = require('child_process');
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
 const { findBinary } = require('./find-binary');
 const { resolveProjectRoot } = require('./project-root');
 const lifecycle = require('./lifecycle');
+const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { hidden } = require('./proc-opts');
 const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() => ({ cleaned: false }));
 
@@ -29,8 +29,7 @@ const cleanupDisabledStatusline = lifecycle.cleanupDisabledStatusline || (() =>
 const STUCK_UPDATE_ATTEMPTS = 5;
 function readUpdateState() {
   try {
-    return JSON.parse(fs.readFileSync(
-      path.join(os.homedir(), '.cache', 'code-graph', 'update-state.json'), 'utf8'));
+    return JSON.parse(fs.readFileSync(UPDATE_STATE_FILE, 'utf8'));
   } catch { return null; /* no state file or unreadable */ }
 }
 function updatePending(st = readUpdateState()) {

package/claude-plugin/scripts/user-prompt-context.js

@@ -14,7 +14,6 @@ if (require.main === module) require('./hook-fail-open').installHookFailOpen('Us
 const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
 // Hook cooldown flags + the restart notice go under cgTmpDir() (a code-graph-mcp/
 // subdir of os.tmpdir()), NOT bare os.tmpdir(): Claude Code overrides $TMPDIR to
 // ~/.claude/tmp/, so bare-tmp flags interleave with transcript captures —
@@ -23,8 +22,11 @@ const os = require('os');
 const { cgTmpDir, cwdHash } = require('./tmp-dir');
 const { hidden } = require('./proc-opts');
 
-// Mid-session install detection: hook fires but no manifest yet.
-const MANIFEST_PATH = path.join(os.homedir(), '.cache', 'code-graph', 'install-manifest.json');
+// Mid-session install detection: hook fires but no manifest yet. The path comes
+// from `cache-paths.js` — deliberately NOT from `lifecycle.js`, which this hook
+// must not load (startup budget); it used to be a third hand-spelled copy of the
+// same three path segments (JS-05).
+const { MANIFEST_FILE: MANIFEST_PATH } = require('./cache-paths');
 
 // --- Per-type rate limiting (replaces single global cooldown) ---
 const COOLDOWNS = {

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.138.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.139.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.138.0",
+  "version": "0.139.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.138.0",
-    "@sdsrs/code-graph-linux-arm64": "0.138.0",
-    "@sdsrs/code-graph-darwin-x64": "0.138.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.138.0",
-    "@sdsrs/code-graph-win32-x64": "0.138.0"
+    "@sdsrs/code-graph-linux-x64": "0.139.0",
+    "@sdsrs/code-graph-linux-arm64": "0.139.0",
+    "@sdsrs/code-graph-darwin-x64": "0.139.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.139.0",
+    "@sdsrs/code-graph-win32-x64": "0.139.0"
   }
 }