@sdsrs/code-graph 0.145.0 → 0.146.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.145.0",
+  "version": "0.146.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/hooks/hooks.json

@@ -1,6 +1,5 @@
 {
-  "description": "code-graph-mcp hooks — only SessionStart is loaded by Claude Code from plugin-cache. All other event types are registered by lifecycle.js into ~/.claude/settings.json (v0.32.0+).",
-  "_note": "Empirical 2026-05-24: current Claude Code only loads SessionStart entries from plugin-cache hooks.json. PreToolUse / PostToolUse / UserPromptSubmit / Stop / SessionEnd entries here are SILENTLY IGNORED. lifecycle.js install/update writes those to ~/.claude/settings.json instead (pattern from claude-mem-lite). Re-adding non-SessionStart entries here would NOT make them fire — they would just be dead config. See feedback_pretooluse_dark_under_green_health.md for the jsonl evidence chain.",
+  "description": "code-graph-mcp hooks — only SessionStart is loaded by Claude Code from plugin-cache; PreToolUse / PostToolUse / UserPromptSubmit / Stop / SessionEnd entries here are SILENTLY IGNORED (empirical 2026-05-24). lifecycle.js install/update registers those into ~/.claude/settings.json instead (v0.32.0+), so re-adding them here would be dead config, not a second chance — pinned by the SessionStart-only guard in hooks.test.js. Keep this file to the keys Claude Code's schema allows (description, hooks, modules, surface); anything else is warned about at startup and dropped.",
   "hooks": {
     "SessionStart": [
       {

package/claude-plugin/scripts/auto-update.js

@@ -18,15 +18,33 @@ const { acquireLock } = require('./install-lock');
 
 // ── Environment Checks ────────────────────────────────────
 
+// `which`/`where` walks every PATH entry, so a slow network mount on PATH drags
+// the probe out with it. Not a hook-budget path, but `downloadAndInstall` holds
+// INSTALL_LOCK_FILE across its probes and that lock is only reclaimed after 10
+// minutes, so an unbounded probe parks installs and self-heal for every other
+// session too. 5s is far above any real PATH walk and far below that window
+// (audit 2026-09-07 JS-21).
+//
+// What this does NOT fix, stated because the first version of this comment
+// claimed it did: a mount that is HUNG rather than slow leaves the child in
+// uninterruptible sleep, where neither the timeout's signal nor anything else
+// in userspace reaches it. The bound covers slow; it cannot cover wedged.
+// `killSignal` is opted in per `proc-opts.js`'s rule — it is deliberately not a
+// `hidden()` default, and a hang-prone child is exactly the case it names — so
+// the probe does not additionally wait out SIGTERM's grace period.
+const PATH_PROBE_TIMEOUT_MS = 5000;
+
 /**
  * Check if a command-line tool is available on the system PATH.
  * @param {string} cmd - Command name (e.g., 'curl', 'tar')
+ * @param {{exec?: Function, timeoutMs?: number}} [opts] - Injection seam for tests,
+ *   same shape as `refreshMarketplaceClone`.
  * @returns {boolean}
  */
-function commandExists(cmd) {
+function commandExists(cmd, { exec = execFileSync, timeoutMs = PATH_PROBE_TIMEOUT_MS } = {}) {
   try {
     const whichCmd = process.platform === 'win32' ? 'where' : 'which';
-    execFileSync(whichCmd, [cmd], hidden({ stdio: 'ignore' }));
+    exec(whichCmd, [cmd], hidden({ stdio: 'ignore', timeout: timeoutMs, killSignal: 'SIGKILL' }));
     return true;
   } catch {
     return false;
@@ -249,7 +267,14 @@ function isUpdateSuspended(state) {
 //      keeps the 6h steady-state interval.
 function shouldCheck(state, { force = false, binaryMissing = false, binaryStale = false } = {}) {
   if (!state.lastCheck) return true;
-  const elapsed = Date.now() - new Date(state.lastCheck).getTime();
+  // A truncated or hand-edited `lastCheck` that Date cannot parse yields NaN,
+  // and NaN fails EVERY `elapsed >= X` below — including the `force` arm, the
+  // one bypass a user has. The updater then never checks again while `doctor`,
+  // reading the same file, still reports up-to-date. Treat unreadable as "no
+  // idea when, assume long ago", which is what a MISSING lastCheck already does
+  // one line up (audit 2026-09-07 JS-22).
+  const lastCheckMs = new Date(state.lastCheck).getTime();
+  const elapsed = Number.isFinite(lastCheckMs) ? Date.now() - lastCheckMs : Infinity;
   if (state.rateLimited) return elapsed >= RATE_LIMIT_INTERVAL_MS;
   if (binaryMissing) return true;
   if (!isUpdateSuspended(state)) {

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.145.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.146.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.145.0",
+  "version": "0.146.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.145.0",
-    "@sdsrs/code-graph-linux-arm64": "0.145.0",
-    "@sdsrs/code-graph-darwin-x64": "0.145.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.145.0",
-    "@sdsrs/code-graph-win32-x64": "0.145.0"
+    "@sdsrs/code-graph-linux-x64": "0.146.0",
+    "@sdsrs/code-graph-linux-arm64": "0.146.0",
+    "@sdsrs/code-graph-darwin-x64": "0.146.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.146.0",
+    "@sdsrs/code-graph-win32-x64": "0.146.0"
   }
 }