@sdsrs/code-graph 0.141.0 → 0.143.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.141.0",
+  "version": "0.143.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/adopt.js

@@ -844,6 +844,48 @@ function unadopt({ cwd, home } = {}) {
   };
 }
 
+/**
+ * The `unadopt` invocation to hand the user, spelled so their shell can run it.
+ *
+ * Issue #41: the reporter drives this plugin through `/plugin install` only and
+ * has no `code-graph-mcp` on PATH, so every remedy printed with the bare name is
+ * answered by their shell with "command not found".
+ *
+ * The obvious repair — print the binary `verifyBinary()` resolved — is WRONG,
+ * and a pre-ship review caught it as a net regression. `unadopt` is one of the
+ * three JS-dispatched subcommands (`main.rs`: doctor / adopt / unadopt): the
+ * native binary re-execs this file, which it locates via `$_FIND_BINARY_ROOT`
+ * or a path relative to its own exe. The plugin's cached binary at
+ * ~/.cache/code-graph/bin has no such neighbour, so `<cache>/code-graph-mcp
+ * unadopt` exits 1 with "adopt.js not found" — reproduced. Worse, npm-global
+ * users reach this file today through the `bin/cli.js` shim that sets
+ * `_FIND_BINARY_ROOT`, so printing a resolved platform-package binary would
+ * BREAK a path that currently works.
+ *
+ * So point at this script. It carries its own `require.main === module` arm, and
+ * `__filename` is the one locator that cannot be wrong in any install layout —
+ * plugin cache, npm package, dev checkout. Quoted, since a plugin cache path
+ * under a home directory with a space is otherwise not runnable as printed.
+ *
+ * Lives here rather than in session-init.js (0.141.0's home for it) because
+ * BOTH printers that hand a user this command must agree, and the other one is
+ * `formatResult` directly below — the site 0.141.0's sweep missed.
+ */
+function shellQuote(value) {
+  // SINGLE quotes, not JSON.stringify. `JSON.stringify` emits DOUBLE quotes, and
+  // a POSIX shell still expands `$`, backticks and `$(...)` inside those — so a
+  // path holding any of them would be rewritten, or executed, when the user
+  // pastes the line we printed. Single quotes are literal for everything except
+  // `'` itself, which is closed, escaped and reopened. POSIX-only is fine here:
+  // `platformGuard()` refuses adopt on win32, so this string never targets cmd
+  // or PowerShell. (CodeRabbit on PR #46; inherited from the 0.141.0 spelling.)
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+
+function unadoptCommand() {
+  return `node ${shellQuote(__filename)} unadopt`;
+}
+
 function formatResult(action, result) {
   if (!result.ok && result.reason === 'windows-not-supported') {
     return '[code-graph] adopt/unadopt are POSIX-only on this build. ' +
@@ -881,7 +923,7 @@ function formatResult(action, result) {
     lines.push(`[code-graph] Detail table → ${result.detailPath}`);
     lines.push('[code-graph] CLAUDE.md is git-tracked — commit the block, or gitignore');
     lines.push('[code-graph]   .claude/plugin_code_graph_mcp.md (a generated copy) as you prefer.');
-    lines.push('[code-graph] Reverse:  code-graph-mcp unadopt');
+    lines.push(`[code-graph] Reverse:  ${unadoptCommand()}`);
     lines.push('[code-graph] Opt out:  CODE_GRAPH_NO_AUTO_ADOPT=1 in ~/.claude/settings.json env');
     return lines.join('\n');
   }
@@ -934,7 +976,7 @@ if (require.main === module) {
 }
 
 module.exports = {
-  adopt, unadopt, memoryDir, formatResult, stripSentinelBlock,
+  adopt, unadopt, memoryDir, formatResult, unadoptCommand, shellQuote, stripSentinelBlock,
   readAdoptedProjects, readAdoptedResult, recordAdopted, removeAdopted, adoptedRegistryFile,
   isAdopted, isPluginModeInstall, maybeAutoAdopt, needsRefresh, isProjectRoot,
   detectProjectType, buildBlock, buildTriggerRows, migrateLegacyMemoryDir,

package/claude-plugin/scripts/lifecycle.js

@@ -780,7 +780,24 @@ function reportUnadoptSweep(entries) {
       lines.push('             Your own text outside the block was kept; .code-graph/ index dirs are untouched.');
     }
     if (failed.length) {
-      lines.push(`[code-graph] Could NOT clean ${failed.length} project(s) — remove the block by hand or run \`code-graph-mcp unadopt\` there:`);
+      // Issue #41's third printer. The other two now spend `unadoptCommand()`,
+      // and that IS still runnable at the instant this line prints — the reclaim
+      // below never touches the plugin's script dir. But this is advice acted on
+      // minutes or days later, in OTHER repositories, and the plugin directory is
+      // Claude Code's to reap once the uninstall settles. A path into it is
+      // correct-when-printed and possibly-stale-when-pasted, and the bare name it
+      // replaced was never runnable for a plugin-only install at all.
+      //
+      // So lead with the remedy that cannot go stale: the block is
+      // sentinel-delimited, so deleting the lines between the two markers is a
+      // complete instruction that needs no tooling, no network and no surviving
+      // install. The tool route follows it, named as optional.
+      const { SENTINEL_BEGIN, SENTINEL_END } = require('./adopt');
+      lines.push(`[code-graph] Could NOT clean ${failed.length} project(s). In each CLAUDE.md below, delete`);
+      lines.push(`             everything from  ${SENTINEL_BEGIN}`);
+      lines.push(`             through          ${SENTINEL_END}`);
+      lines.push('             (your own text outside those markers is not ours to remove), or run');
+      lines.push('             `npx -y @sdsrs/code-graph unadopt` in the project:');
       for (const p of failed.slice(0, 10)) lines.push(`             ${p}`);
     }
     process.stderr.write(lines.join('\n') + '\n');

package/claude-plugin/scripts/session-init.js

@@ -10,7 +10,7 @@ const {
 } = require('./lifecycle');
 const { UPDATE_STATE_FILE } = require('./cache-paths');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
-const { maybeAutoAdopt, isAdopted, unadopt } = require('./adopt');
+const { maybeAutoAdopt, isAdopted, unadopt, unadoptCommand } = require('./adopt');
 const { isNonProjectCwd } = require('./project-detect');
 const { hidden } = require('./proc-opts');
 const { installHookFailOpen, remainingMs } = require('./hook-fail-open');
@@ -557,34 +557,12 @@ function verifyBinary() {
   return { available: true, binary };
 }
 
-/**
- * The `unadopt` invocation to hand the user, spelled so their shell can run it.
- *
- * Issue #41: the reporter drives this plugin through `/plugin install` only and
- * has no `code-graph-mcp` on PATH, so every remedy this hook printed spent a
- * bare name their shell answers with "command not found".
- *
- * The obvious repair — print the binary `verifyBinary()` resolved — is WRONG,
- * and a pre-ship review caught it as a net regression. `unadopt` is one of the
- * three JS-dispatched subcommands (`main.rs`: doctor / adopt / unadopt): the
- * native binary re-execs `claude-plugin/scripts/adopt.js`, which it locates via
- * `$_FIND_BINARY_ROOT` or a path relative to its own exe. The plugin's cached
- * binary at ~/.cache/code-graph/bin has no such neighbour, so
- * `<cache>/code-graph-mcp unadopt` exits 1 with "adopt.js not found" —
- * reproduced. Worse, npm-global users reach adopt.js today through the
- * `bin/cli.js` shim that sets `_FIND_BINARY_ROOT`, so printing a resolved
- * platform-package binary would BREAK a path that currently works.
- *
- * So point at the script itself. `adopt.js` carries its own
- * `require.main === module` arm (`node adopt.js unadopt`), and this file is its
- * neighbour in every install layout — plugin cache, npm package, dev checkout —
- * because both are shipped inside `claude-plugin/scripts/`. `__dirname` is
- * therefore the one locator that cannot be wrong. Quoted, since a plugin cache
- * path under a home directory with a space is otherwise not runnable as printed.
- */
-function unadoptCommand() {
-  return `node ${JSON.stringify(path.join(__dirname, 'adopt.js'))} unadopt`;
-}
+// `unadoptCommand` now lives in adopt.js (issue #41's rationale travels with
+// it). It moved because THIS file was not the only printer handing a user that
+// command — adopt.js's own `formatResult` prints a `Reverse:` line too, and it
+// was still spending the bare name after 0.141.0 fixed the announcement below.
+// Two spellings of one remedy is what let that survive; re-exported here so the
+// name stays importable from this module.
 
 /**
  * Lightweight consistency checks — called from runSessionInit().

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.141.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.143.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.141.0",
+  "version": "0.143.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.141.0",
-    "@sdsrs/code-graph-linux-arm64": "0.141.0",
-    "@sdsrs/code-graph-darwin-x64": "0.141.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.141.0",
-    "@sdsrs/code-graph-win32-x64": "0.141.0"
+    "@sdsrs/code-graph-linux-x64": "0.143.0",
+    "@sdsrs/code-graph-linux-arm64": "0.143.0",
+    "@sdsrs/code-graph-darwin-x64": "0.143.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.143.0",
+    "@sdsrs/code-graph-win32-x64": "0.143.0"
   }
 }