@sdsrs/code-graph 0.153.0 → 0.155.0

package/README.md

@@ -427,7 +427,7 @@ skill does is also runnable by hand.
 - **Rust has no `inherits` edges** — the language has no class inheritance, so `impl Trait for Type` is recorded as `implements` and an `inherits`-filtered query returns empty for Rust.
 - **Kotlin/Swift interface conformance** is recorded as `inherits` (both use a single `: Type` grammar for base classes and protocols/interfaces), so `implements`-filtered queries return empty for these two languages.
 - **Cross-file dead-code detection** may false-positive a type whose only cross-file reference sits beyond the 4096-byte stored-content cap per node (documented accepted limitation, v0.97.1).
-- **Rust: borrowing a binding named `raw`** (`&raw`, `&raw[..]`, `&raw.field`) is misread by the pinned `tree-sitter-rust` 0.23 grammar as the start of the `&raw const` / `&raw mut` pointer operator, so the enclosing expression can be dropped from the index. `&mut raw`, `&self.raw` and the genuine `&raw const x` operator all parse correctly. The index reports the damage rather than hiding it. A run prints `Syntax errors in <file> — symbols may be incomplete` per file plus an `N file(s) parsed with syntax errors` total, and the verdict is stored with the index, so it survives the run: `health-check` names the files (`Parse: N file(s) indexed over a damaged parse`, plus `files_with_parse_errors` / `parse_error_files` under `--json`), `doctor` shows a `Parse` row, and the MCP `get_index_status` carries the same two fields. An incremental run over unrelated files does not clear it — only re-parsing the offending file, or deleting it, does. Workaround: rename the binding. Measured on this repo by indexing it fresh at v0.150.0: **9 of 163** tracked Rust files trip the warning, and the run's total says 10 — a Markdown file trips the same counter for an unrelated reason. The stored set names the same ten, which is the cheapest way to check this table has not drifted again: it is a reading of one tree at one commit, not a constant, and an earlier revision of this bullet carried 8/161/9 long after they stopped being true. Recovery is usually partial rather than total: across a fixture covering every trigger shape, the surrounding functions and their call edges survived.
+- **A file tree-sitter cannot fully parse is indexed over a damaged parse.** Symbols inside the damaged region can be missing or mis-scoped — e.g. a Swift class whose body holds `#if`/`#error` directives, or macro-heavy C++ headers. The index reports the damage rather than hiding it. A run prints `Syntax errors in <file> — symbols may be incomplete` per file plus an `N file(s) parsed with syntax errors` total, and the verdict is stored with the index, so it survives the run: `health-check` names the files (`Parse: N file(s) indexed over a damaged parse`, plus `files_with_parse_errors` / `parse_error_files` under `--json`), `doctor` shows a `Parse` row, and the MCP `get_index_status` carries the same two fields. An incremental run over unrelated files does not clear it — only re-parsing the offending file, or deleting it, does. Rust borrows of a binding named `raw` (`&raw`, `&raw[..]`, `&raw.field`), which the old `tree-sitter-rust` 0.23 grammar misread as the `&raw const` operator, parse cleanly since the tree-sitter 0.25 upgrade: this repo indexed fresh went from 9 damaged Rust files to 0.
 
 ## Team-shared graph snapshot
 

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.153.0",
+  "version": "0.155.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/cg-answer.js

@@ -170,16 +170,22 @@ const SHELL_SAFE_ARG = /^[A-Za-z0-9_.,:@%+=/-]+$/;
 // POSIX single-quote escape: close, emit an escaped quote, reopen.
 const SQ_ESCAPED = "'\\''";
 
-function formatCgCommand(args) {
+function shellQuoteArg(a) {
   // Deliberately no nested template literal, and no regex holding a quote.
   // windows-hide.test.js masks literals with a character scanner that pairs
   // backticks like any other quote, so a `${…`…`…}` inside a template closes the
   // outer one early and swallows the rest of the file — which took all three of
   // THIS file's spawn call sites out of that guard's view until it was written
   // this way. Code a guard cannot parse is code the guard is not checking.
-  const shown = args.map((a) =>
-    (SHELL_SAFE_ARG.test(a) ? a : "'" + a.split("'").join(SQ_ESCAPED) + "'"));
-  return 'code-graph-mcp ' + shown.join(' ');
+  const s = String(a);
+  return SHELL_SAFE_ARG.test(s) ? s : "'" + s.split("'").join(SQ_ESCAPED) + "'";
+}
+
+// `invocation` is what names the binary. The default is the name a reader can
+// paste; pre-grep-guide's rewrite passes an already-quoted absolute path when
+// that name would not resolve in the Bash tool's shell.
+function formatCgCommand(args, invocation = 'code-graph-mcp') {
+  return invocation + ' ' + args.map(shellQuoteArg).join(' ');
 }
 
 /**
@@ -356,6 +362,9 @@ function runShowAnswer(opts = {}) {
     if (!binary) return { status: 'no-binary' };
 
     const parts = [];
+    // Which symbols actually resolved — the rewrite re-runs exactly these, so a
+    // symbol that printed nothing here cannot turn into an exit-1 in the Bash call.
+    const resolved = [];
     for (const sym of symbols.slice(0, 3)) {
       if (typeof sym !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(sym)) continue;
       const res = runCg(binary, ['show', sym], { cwd, timeoutMs });
@@ -375,10 +384,11 @@ function runShowAnswer(opts = {}) {
       const out = (res.stdout || '').trim();
       if (isEmptyAnswer(out)) continue;
       parts.push(`$ code-graph-mcp show ${sym}\n${out}`);
+      resolved.push(sym);
     }
     if (parts.length === 0) return { status: 'no-hits' };
     const { text, truncated } = truncateAtLine(parts.join('\n\n'), maxBytes);
-    return { status: 'hits', text, truncated };
+    return { status: 'hits', text, truncated, symbols: resolved };
   } catch {
     return { status: 'unavailable' };
   }
@@ -498,7 +508,9 @@ module.exports = {
   truncateAtLine, sanitizeSearchPath,
   // The one argv builder + its renderer, so the deny copy and the child process
   // cannot describe different commands.
-  splitSearchPathGlob, buildGrepArgs, formatCgCommand,
+  splitSearchPathGlob, buildGrepArgs, formatCgCommand, shellQuoteArg,
+  // pre-grep-guide names this binary in the command it rewrites a grep into.
+  resolveAnswerBinary,
   // Exported so the integer property can be asserted where it is ESTABLISHED.
   // Asserting it end-to-end instead passes either way: `remainingMs` floors
   // again downstream, so such a test cannot fail and proves nothing (NEW-02).

package/claude-plugin/scripts/doctor.js

@@ -1393,9 +1393,9 @@ const DOCTOR_USAGE = [
   'By default doctor repairs detected issues (re-registers hooks in',
   '~/.claude/settings.json, fixes stale binary/model paths). Pass',
   '--check-only to report issues without repairing: it never writes',
-  '~/.claude/settings.json. Reaching the diagnostics still resolves',
-  'the binary through the Node layer, which memoizes it under',
-  '~/.cache/code-graph/.',
+  '~/.claude/settings.json. It is not otherwise write-free — the Node',
+  'layer memoizes the resolved binary under ~/.cache/code-graph/, and',
+  'the npm checks let npm write its own logs.',
 ].join('\n');
 
 function parseDoctorArgs(args) {

package/claude-plugin/scripts/hook-emit.js

@@ -100,6 +100,44 @@ function emitPreToolAllowContext(text) {
   });
 }
 
+/**
+ * PreToolUse rewrite envelope: allow + updatedInput + additionalContext.
+ *
+ * pre-grep-guide ONLY. A raw source grep the index can answer is rewritten into
+ * the `code-graph-mcp grep`/`show` command that answers it, instead of being
+ * denied with the answer in the reason. A deny is rendered as a failed tool call
+ * (the red `Error` block every intercepted grep used to print), and the model
+ * reads it as one; a rewrite runs as an ordinary successful call.
+ *
+ * Why `allow` rather than no decision. Claude Code 2.1.282 honours
+ * `updatedInput` WITHOUT a decision too (pre-ship review reproduced it; an
+ * earlier version of this comment said otherwise). But then the rewritten call
+ * goes through the permission flow as a command the user never approved: a user
+ * who allowlisted `grep` and not this binary would be prompted on every
+ * intercepted search — worse than the red deny this replaces. `"ask"` prompts
+ * by definition. So this carries `allow`, argued the same way as
+ * pre-read-guide's: the command that runs is one this hook assembled from a
+ * fixed argv (read-only `grep`/`show`, every argument shell-quoted, the binary
+ * by absolute path), never the model's text. The docs state deny and ask rules
+ * are still evaluated against the rewritten input.
+ *
+ * `updatedInput` REPLACES the tool input, so the caller passes the whole object.
+ * `reason` is shown to the user, not the model; `context` reaches the model.
+ * @param {{updatedInput: object, reason: string, context: string}} opts
+ * @returns {string} JSON line
+ */
+function emitPreToolRewrite({ updatedInput, reason, context }) {
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'allow',
+      permissionDecisionReason: reason,
+      updatedInput,
+      additionalContext: capContext(context),
+    },
+  });
+}
+
 /**
  * PostToolUse additionalContext envelope (string, no trailing newline).
  * Permission-neutral: NO permissionDecision, so the underlying Bash tool call's
@@ -117,6 +155,6 @@ function emitPostToolContext(text) {
 }
 
 module.exports = {
-  emitPreToolContext, emitPreToolAllowContext, emitPostToolContext,
+  emitPreToolContext, emitPreToolAllowContext, emitPreToolRewrite, emitPostToolContext,
   capContext, MAX_INJECTED_BYTES,
 };

package/claude-plugin/scripts/pre-grep-guide.js

@@ -14,6 +14,10 @@ if (require.main === module) require('./hook-fail-open').installHookFailOpen('Pr
 // ~13× more than the indexed CLI on bash-heavy days (15-day baseline: 429 raw
 // grep vs 191 functional CLI). v0.25.0 hint-only had ~0% transfer rate; v0.32.0
 // upgrades the narrowest "I'm searching for a symbol" subset to block-with-reason.
+// Since the rewrite change, an ANSWERED block no longer denies: the grep is
+// rewritten (PreToolUse `updatedInput`) into the cg command that answers it, so
+// the call succeeds instead of rendering as a red failed tool call. Only the
+// opt-in static deny (CODE_GRAPH_NO_ANSWER_IN_DENY=1) still denies.
 //
 // HINT fires when ALL conditions met (shouldHint):
 //   1. Command HEAD is grep/rg/ag (NOT piped — pipe-greps are output filters)
@@ -48,7 +52,11 @@ const fs = require('fs');
 const path = require('path');
 const { cgTmpDir, cwdHash, makeCooldown } = require('./tmp-dir');
 const { recordRecommendation } = require('./recommendation-log');
-const { runGrepAnswer, runShowAnswer, sanitizeSearchPath, buildGrepArgs, formatCgCommand } = require('./cg-answer');
+const {
+  runGrepAnswer, runShowAnswer, sanitizeSearchPath, buildGrepArgs, formatCgCommand, shellQuoteArg,
+  resolveAnswerBinary,
+} = require('./cg-answer');
+const { emitPreToolRewrite } = require('./hook-emit');
 
 // --- Pure logic (testable) ---
 
@@ -758,56 +766,245 @@ function buildBlockReason() {
   ].join('\n');
 }
 
-// v0.47.0 — deny WITH the answer inline. Hint-only had ~0% transfer and a bare
-// deny still asks the model to initiate a new tool call; embedding the actual
-// results removes that choice entirely.
-// v0.48 — NO escape-hatch line here: the model already has the results, and
-// advertising the bypass taught it a permanent prefix within 5 seconds (daagu
-// 2026-06-11: one deny → 14 bypassed greps). The static deny keeps a scoped
-// escape because there we give no answer.
-// `cmdShown` is rendered by the caller from the SAME argv array it handed the
-// child process (cg-answer.buildGrepArgs → formatCgCommand). It used to be
-// re-assembled here from `(pattern, searchPath)` alone, which is how a deny came
-// to print `code-graph-mcp grep "X" tests` above an answer that had actually run
-// with different arguments — the flags nobody forwarded, and a glob silently
-// widened to its parent directory.
-function buildBlockReasonWithAnswer(cmdShown, answer) {
-  const lines = [
-    '[code-graph] Raw `grep` on indexed source — denied; the AST-aware equivalent already ran for you:',
-    `$ ${cmdShown}`,
-    answer.text,
-  ];
-  if (answer.truncated) {
-    lines.push(`(truncated — run \`${cmdShown}\` yourself for the full list)`);
-  }
-  lines.push(
-    'Each hit shows its containing fn/module — use these results directly instead of re-running the search.',
-  );
-  // NOTE (v0.63): a forced-ack salience line was trialed here and removed. The
-  // answer is ALREADY in context, so demanding the model restate which hit it
-  // will use risks performative compliance + friction with no measured gain
-  // (deny-with-answer already satisfies in-place, 5/5 in the daagu replay). The
-  // engagement nudge is kept only where it pays — the pre-edit impact summary,
-  // a true before-you-edit reconciliation moment. Re-add here only behind an A/B.
+// Answered interceptions are REWRITES, not denies. Until this release the hook
+// ran the cg equivalent itself and denied the grep with the output in the
+// reason. It worked — the model used the answer — but Claude Code renders every
+// deny as a failed tool call, so each intercepted search printed a red `Error`
+// block over a perfectly good result. Now the grep is replaced (PreToolUse
+// `updatedInput`) by the command whose output it would have embedded, and the
+// call runs as an ordinary success. The hook still runs the answer first: it is
+// what tells an answerable grep (rewrite) from a dialect miss or a broken binary
+// (let the raw grep run), and a rewrite must never turn into an empty result.
+//
+// v0.48/v0.63 copy rules still hold for the context line: no escape-hatch
+// advertisement (one deny once taught a 14-grep bypass prefix) and no forced
+// restatement of which hit the model will use.
+
+// The command the grep is rewritten into. One argv per cg call (several for a
+// multi-symbol `show`), each run with CODE_GRAPH_INTERNAL=1 so the CLI's `use`
+// record does not count a delivered answer as a model-initiated conversion —
+// per command, because a `;`-joined list would scope a bare prefix to the first
+// one only, and `export` would leak into the persistent shell. Paths in the argv
+// are root-relative, so a shell sitting in a subdirectory runs them from the
+// root in a subshell, leaving its own cwd alone.
+//
+// `invocation` is the binary that ANSWERED, by quoted absolute path — runMain
+// passes it. Pre-ship review of the first cut: naming it `code-graph-mcp` let
+// the Bash shell resolve a different, older copy (exit 2 on `-g`, a red error
+// again) or a non-executable match (exit 127), bypassing the version gate
+// `findBinary` exists for. The bare default is for the printed copy only.
+function buildRewriteCommand(argvList, { invocation = 'code-graph-mcp', root, shellCwd } = {}) {
+  const body = argvList
+    .map((args) => 'CODE_GRAPH_INTERNAL=1 ' + formatCgCommand(args, invocation))
+    .join('; echo; ');
+  if (!root || !shellCwd || path.resolve(shellCwd) === path.resolve(root)) return body;
+  return '(cd ' + shellQuoteArg(root) + ' || exit 1; ' + body + ')';
+}
+
+// What the model is told alongside the rewritten call's output. `cmdShown` is
+// rendered from the SAME argv the rewrite runs (no env prefix, bare name — the
+// form a reader re-runs).
+function buildRewriteContext(mode, cmdShown) {
+  const lines = mode === 'show'
+    ? ['[code-graph] Raw grep for symbol definitions on indexed source was rewritten to `code-graph-mcp show` — this call\'s output is the definitions from the AST index:',
+      `$ ${cmdShown}`,
+      'Use these directly instead of re-running the search.']
+    : ['[code-graph] Raw `grep` on indexed source was rewritten to its AST-aware equivalent — this call\'s output comes from:',
+      `$ ${cmdShown}`,
+      'Each hit shows its containing fn/module — use these results directly instead of re-running the search.'];
   return lines.join('\n');
 }
 
-// v0.49 — show-mode deny: the model grepped for symbol DEFINITIONS with
-// context flags (-A/-B/-C = "show me the body"); the answer IS the bodies,
-// fetched via `code-graph-mcp show`. answer.text already carries per-symbol
-// `$ code-graph-mcp show <sym>` headers.
-function buildShowDenyReason(answer) {
-  const lines = [
-    '[code-graph] Raw grep for symbol definitions — denied; here are the definitions from the AST index:',
-    answer.text,
-  ];
-  if (answer.truncated) {
-    lines.push('(truncated — re-run the `code-graph-mcp show <symbol>` command above for full source)');
+// A rewrite REPLACES the whole command and reports success, so it is only
+// honest when the cg call does everything the command would have done. Three
+// rounds of pre-ship review each found a way past the previous gate: a
+// side-effecting pipe stage, a command after `|| …` on the next line, flags a
+// denylist did not name, then a redirect in a flag's value slot, filters whose
+// hit count did not survive cg's output format, and globs cg reads differently
+// from the shell. So the accepted shape is deliberately NARROW — a command
+// outside it is not intercepted and runs as typed, which also shows no red
+// block; narrowing costs interception, never the user's command:
+//
+//   (grep | rg | ag | git grep) ARG… [2>&1 | 2>/dev/null]
+//
+// (`2>/dev/null` parses, but countNamedPaths counts it as a path, so it
+// reaches a rewrite only when the command names no other path.)
+//
+// Every ARG is a flag from the verb's allowlist (values, where a flag takes
+// one, are checked like any other word) or a plain/quoted operand: exactly one
+// pattern and at most one path. Not accepted: any pipe, any other redirect, a
+// NAME=value or `env` prefix (RIPGREP_CONFIG_PATH, GREP_OPTIONS, LC_ALL change
+// the search), a glob in a path or an unquoted pattern, a pattern starting with
+// `-`, and anything the tokenizer does not know — newline, `;`, `&`, `\`, `$`,
+// a backtick, parentheses, braces, `~`. Returns a plan or null.
+const WORD_CHAR = /[A-Za-z0-9_.,:@%+=/*?<>&-]/;
+function shellWords(s) {
+  const words = [];
+  let cur = null;
+  const push = () => { if (cur) words.push(cur); cur = null; };
+  const start = (quoted) => { if (!cur) cur = { text: '', startsQuoted: quoted, anyQuoted: false, bareSpecial: false, bareOp: false }; };
+  for (let i = 0; i < s.length;) {
+    const c = s[i];
+    if (c === ' ' || c === '\t') { push(); i++; continue; }
+    if (c === '|') { push(); words.push({ op: '|' }); i++; continue; }
+    if (c === "'" || c === '"') {
+      const j = s.indexOf(c, i + 1);
+      if (j === -1) return null;
+      const body = s.slice(i + 1, j);
+      // Inside double quotes the shell still expands `$`/backticks, and a
+      // backslash escapes `"` `\` `$` backtick — so the span may not be what
+      // it looks like. A backslash before anything else is literal (`"a\|b"`,
+      // the BRE alternation models write constantly).
+      if (c === '"' && (/[$`!]|\\["\\$`]/.test(body) || body.endsWith('\\'))) return null;
+      start(true);
+      cur.anyQuoted = true;
+      cur.text += body;
+      i = j + 1;
+      continue;
+    }
+    if (!WORD_CHAR.test(c)) return null;
+    start(false);
+    if ('<>&*?'.includes(c)) cur.bareSpecial = true;
+    // Per character, independent of quoting elsewhere in the word: `-g'!x'>out`
+    // is one word whose quoted part must not excuse the redirect after it
+    // (pre-ship review round 4 M1).
+    if ('<>&'.includes(c)) cur.bareOp = true;
+    cur.text += c;
+    i++;
   }
-  lines.push('Use these directly instead of re-running the search.');
-  // NOTE (v0.63): forced-ack salience trialed + removed here too — see
-  // buildBlockReasonWithAnswer. The definitions are already delivered.
-  return lines.join('\n');
+  push();
+  return words;
+}
+
+// Flags cg honors (`-i -w -F -l -c`, extractCgFlags) or that are no-ops for it
+// (recursion, line numbers, filenames, binary skipping, the regex dialect).
+// Per verb, because letters differ: ag's `-n` is --norecurse and `-H` is
+// --heading, rg's `-r` is --replace. Context letters (A/B/C, a count value)
+// only reach the rewrite in `show` mode, which answers with the body.
+const ALLOWED_SHORT = { grep: 'rRnHsIiwFlcEPABC', git: 'rnHIiwFlcEPABC', rg: 'nHiwFlcsABC', ag: 'iwlcsABC' };
+const VALUE_SHORT_BY_VERB = { grep: 'ABC', git: 'ABC', rg: 'gtABC', ag: 'ABC' };
+const COMMON_LONG = ['ignore-case', 'word-regexp', 'fixed-strings', 'files-with-matches', 'count', 'line-number'];
+const ALLOWED_LONG = {
+  grep: new Set([...COMMON_LONG, 'recursive', 'with-filename', 'extended-regexp', 'perl-regexp', 'no-messages', 'include']),
+  git: new Set([...COMMON_LONG, 'extended-regexp', 'perl-regexp']),
+  rg: new Set([...COMMON_LONG, 'with-filename', 'no-heading', 'glob', 'type']),
+  ag: new Set(['ignore-case', 'word-regexp', 'files-with-matches', 'count', 'case-sensitive']),
+};
+const VALUE_LONG = new Set(['include', 'glob', 'type']);
+
+// A flag's value word gets the same scrutiny as any other word: round 3 put
+// `&`/`>` in the `-A 3&` slot and dropped a command. Counts are digits; a glob
+// value is fine only quoted (unquoted, the shell would expand it first).
+function valueWordOk(w, isCount) {
+  if (!w || w.op) return false;
+  if (isCount) return !w.anyQuoted && /^\d+$/.test(w.text);
+  return !(w.bareSpecial);
+}
+
+function rewritePlan(cmd) {
+  if (!cmd || typeof cmd !== 'string' || cmd.length > 1000) return null;
+  const words = shellWords(cmd);
+  if (!words || words.some((w) => w.op)) return null;
+  let i = 0;
+  let verb = !words[0].anyQuoted ? words[0].text : '';
+  if (verb === 'git') {
+    if (!words[1] || words[1].anyQuoted || words[1].text !== 'grep') return null;
+    i = 1;
+  } else if (!['grep', 'rg', 'ag'].includes(verb)) {
+    return null;
+  }
+  i++;
+  const allowed = ALLOWED_SHORT[verb];
+  const valueShort = VALUE_SHORT_BY_VERB[verb];
+  const operands = [];
+  let caseFlag = false;
+  let context = false;
+  let endOfFlags = false;
+  for (; i < words.length; i++) {
+    const w = words[i];
+    if (!w.anyQuoted && (w.text === '2>&1' || w.text === '2>/dev/null')) continue;
+    if (w.startsQuoted || endOfFlags || w.text[0] !== '-' || w.text === '-') {
+      operands.push(w);
+      continue;
+    }
+    if (w.anyQuoted || w.bareSpecial) {
+      // Only an ATTACHED file-filter value may be quoted or carry a glob
+      // (`--include='*.rs'`, rg `-g'*.rs'`); an unquoted `<>&` is shell syntax.
+      const attachedFilter = /^--(?:include|glob|type)=/.test(w.text) || (verb === 'rg' && /^-[gt]./.test(w.text));
+      if (!attachedFilter || w.bareOp) return null;
+      // GNU grep's --include has no `!` negation; cg's -g does (round 4 L2).
+      if (/^--include=!/.test(w.text)) return null;
+    }
+    if (w.text === '--') { endOfFlags = true; continue; }
+    if (w.text.startsWith('--')) {
+      const eq = w.text.indexOf('=');
+      const name = w.text.slice(2, eq === -1 ? undefined : eq);
+      if (!ALLOWED_LONG[verb].has(name)) return null;
+      if (VALUE_LONG.has(name) && eq === -1) {
+        const v = words[++i];
+        if (!valueWordOk(v, false) || (name === 'include' && v.text.startsWith('!'))) return null;
+      }
+      if (name === 'ignore-case' || name === 'case-sensitive') caseFlag = true;
+      continue;
+    }
+    const letters = w.text.slice(1);
+    for (let k = 0; k < letters.length; k++) {
+      const ch = letters[k];
+      if (valueShort.includes(ch)) {
+        const isCount = 'ABC'.includes(ch);
+        if (isCount) context = true;
+        const attached = letters.slice(k + 1);
+        if (attached) {
+          if (isCount && !/^\d+$/.test(attached)) return null;
+        } else if (!valueWordOk(words[++i], isCount)) {
+          return null;
+        }
+        break;
+      }
+      if (!allowed.includes(ch)) return null;
+      if (ch === 'i' || ch === 's') caseFlag = true;
+    }
+  }
+  if (operands.length === 0 || operands.length > 2) return null;
+  const [pattern, target] = operands;
+  // The pattern: unquoted glob characters would be expanded by the shell, and
+  // a leading `-` would reach cg as flags.
+  if ((!pattern.anyQuoted && pattern.bareSpecial) || pattern.text.startsWith('-')) return null;
+  // The path: bash expands a glob at one level with no dotfiles; cg's `-g`
+  // matches recursively and includes them (round 3 M5). Not reproducible.
+  if (target && (/[*?[\]{}]/.test(target.text) || target.bareSpecial)) return null;
+  // A `..` segment: extractSearchPath refuses to scope it, so the answer would
+  // search the whole repo (round 4 M2).
+  if (target && /(?:^|\/)\.\.(?:\/|$)/.test(target.text)) return null;
+  // ag is smart-case by default: an all-lowercase pattern matches any case,
+  // and cg's search is case-sensitive, so the answer would find less.
+  if (verb === 'ag' && !caseFlag && !/[A-Z]/.test(pattern.text)) return null;
+  return { pattern: pattern.text, target: target ? target.text : undefined, context };
+}
+
+// The plan must describe the same search classifyBlock decided on. The pattern
+// the answer ran is picked from quoted spans (pickBlockPattern); the grammar's
+// pattern operand is the one the shell passes — `"is"'Foo'` or an unquoted
+// pattern with a quoted path made them differ (round 3 L3). A context count the
+// raw-text CONTEXT_FLAG check missed (`-A"3"`) sent a context grep to grep mode,
+// which drops the context (L2). `show` answers with bodies, so a grep asking
+// for a file list or counts (`-l`/`-c`) is not its equivalent (M6).
+function rewriteMatchesBlock(plan, block, cmd, rawPattern) {
+  if (!plan || !block) return false;
+  if (plan.pattern !== rawPattern) return false;
+  // Same for the path: extractSearchPath takes the first src-prefixed token,
+  // which can be a quoted PATTERN (`grep -rn "src/foo_mod" tmp/` searched
+  // src/foo_mod — round 4 H1, inherited from the deny's answer).
+  const norm = (p) => (p === undefined ? undefined : p.replace(/^\.\//, '').replace(/\/+$/, ''));
+  if (norm(plan.target) !== norm(extractSearchPath(cmd))) return false;
+  if (block.mode === 'grep' && plan.context) return false;
+  if (block.mode === 'show') {
+    const f = cgFlagSet(extractCgFlags(cmd));
+    if (f.has('-l') || f.has('-c')) return false;
+    // show answers at most three symbols; a fourth would silently vanish.
+    if (extractDeclSymbols(extractPatterns(cmd)).length > 3) return false;
+  }
+  return true;
 }
 
 // v0.49 — plain `grep` speaks BRE: alternation/grouping arrive escaped
@@ -979,6 +1176,11 @@ function runMain() {
   // switch silencing the hook that carries the telemetry is coherent; silently
   // claiming coverage it does not have is not.
   const block = isBlockDisabled() ? null : classifyDeny(cmd);
+  // The rewrite replaces the WHOLE command. One it cannot reproduce runs as
+  // typed (see rewritePlan) — decided before the answer is spent on it. The
+  // opt-in static deny keeps its own, older scope.
+  const plan = block && !isAnswerDisabled() ? rewritePlan(cmd) : null;
+  if (block && !isAnswerDisabled() && !rewriteMatchesBlock(plan, block, cmd, rawGrepPattern)) return;
   if (block) {
     // v0.47.0 — run the AST-aware equivalent inside the hook and embed the
     // results in the deny reason ("answer in the deny"). Degrades to the
@@ -996,14 +1198,13 @@ function runMain() {
     const flags = cgFlags;  // computed once above, beside the -F pattern guard
     // ONE argv, used to run the child AND to render the command the deny prints.
     const args = buildGrepArgs({ pattern, searchPath, flags });
-    let answeredMode = block.mode;
+    const answeredMode = block.mode;
     if (!isAnswerDisabled()) {
       if (block.mode === 'show') {
+        // No fallback to a grep answer: a context grep (`-A5`) asked for the
+        // body, and the grep rewrite would drop the context silently (pre-ship
+        // review round 2). A show miss lets the raw grep run.
         answer = runShowAnswer({ cwd: root, symbols: block.symbols });
-        if (answer.status !== 'hits' && pattern) {
-          answeredMode = 'grep';
-          answer = runGrepAnswer({ cwd: root, pattern, searchPath, flags });
-        }
       } else if (pattern) {
         answer = runGrepAnswer({ cwd: root, pattern, searchPath, flags });
       }
@@ -1035,35 +1236,62 @@ function runMain() {
       return;
     }
 
-    // PreToolUse block via current CC schema (`hookSpecificOutput.permissionDecision`).
-    // Verified empirically 2026-05-24: legacy `{decision:"block",reason}` was
-    // ignored by Claude Code — the grep ran anyway. The hookSpecificOutput form
-    // is the documented modern path. Exit 0 — this is a routing decision, not
-    // a hook failure (exit 2 would mark the tool call as "hook errored").
     const answered = answer.status === 'hits';
     recordRecommendation(root, {
+      // Still `deny` in the funnel: the event it counts — a raw grep intercepted
+      // and answered in place — is unchanged, and the Rust aggregator keys on
+      // it. `delivery` says HOW the answer arrived.
       hook: 'grep', action: 'deny', answered,
       // pattern fingerprints the denied search so the funnel can score a verbatim
       // re-grep of it (the inline answer was ignored) as fall-through, not a win.
       ...(pattern ? { pattern } : {}),
       // mode segments which answer type converts (show=bodies, grep=hits).
-      ...(answered ? { mode: answeredMode } : {}),
+      ...(answered ? { mode: answeredMode, delivery: 'rewrite' } : {}),
       // reason segments WHY an unanswered deny fell back to the static copy:
       // 'no-binary' (flagship answer-in-deny dark — binary missing) vs
       // 'unavailable' (binary ran but failed/timed out). Without this the two
       // are indistinguishable in the funnel ("broken" looks like "no hits").
       ...(answered ? {} : { reason: answer.status }),
     });
-    process.stdout.write(JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: 'PreToolUse',
-        permissionDecision: 'deny',
-        permissionDecisionReason: !answered
-          ? buildBlockReason()
-          : answeredMode === 'show'
-            ? buildShowDenyReason(answer)
-            : buildBlockReasonWithAnswer(formatCgCommand(args), answer),
-      },
+
+    if (!answered) {
+      // CODE_GRAPH_NO_ANSWER_IN_DENY=1 — the user opted into the v0.46 static
+      // deny, so nothing ran and there is nothing to rewrite into. Current CC
+      // schema (`hookSpecificOutput.permissionDecision`): the legacy
+      // `{decision:"block"}` was ignored (verified 2026-05-24). Exit 0 — a
+      // routing decision, not a hook failure.
+      process.stdout.write(JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: 'deny',
+          permissionDecisionReason: buildBlockReason(),
+        },
+      }) + '\n');
+      return;
+    }
+
+    // Re-run exactly what answered: the resolved symbols for `show`, the same
+    // argv for `grep`.
+    // `-m 0`: cg caps matches at 100 per file by default and says so only on
+    // stderr; the grep being replaced has no cap (round 3 M4). Only here, not
+    // in the in-hook answer, which is a has-hits probe.
+    const argvList = answeredMode === 'show'
+      ? answer.symbols.map((sym) => ['show', sym])
+      : [[...args.slice(0, 1), '-m', '0', ...args.slice(1)]];
+    const command = buildRewriteCommand(argvList, {
+      invocation: shellQuoteArg(resolveAnswerBinary({})),
+      root,
+      shellCwd,
+    });
+    const cmdShown = argvList.map((a) => formatCgCommand(a)).join('; ');
+    // Not carried over: a model-set `dangerouslyDisableSandbox`. The call this
+    // hook auto-allows is its own read-only cg command, and it needs no escape
+    // from a sandbox the model's grep would have run inside.
+    const { dangerouslyDisableSandbox, ...toolInput } = input.tool_input || {};
+    process.stdout.write(emitPreToolRewrite({
+      updatedInput: { ...toolInput, command },
+      reason: '[code-graph] raw grep → AST-aware equivalent',
+      context: buildRewriteContext(answeredMode, cmdShown),
     }) + '\n');
     return;
   }
@@ -1093,7 +1321,11 @@ module.exports = {
   firstShellClause,      // v0.96 — grep's own clause (up to first top-level separator)
   extractDeclSymbols,    // v0.49 — show-mode symbol extraction
   translateBreToRg,      // v0.49 — BRE→rust-regex dialect bridge
-  buildShowDenyReason,   // v0.49 — show-mode deny copy
+  buildRewriteCommand,   // rewrite — the command the grep becomes
+  buildRewriteContext,   // rewrite — what the model is told about it
+  shellWords,            // rewrite — the tokenizer rewritePlan's grammar reads
+  rewritePlan,           // rewrite — does the whole command parse as one the rewrite reproduces
+  rewriteMatchesBlock,   // rewrite — does that plan describe the search classifyBlock chose
   extractSedReadTargets, // v0.49 — sed-range reads feed the read-fanout state
   extractUnansweredTail, // v0.50 — compound-tail honesty in answered denies
   extractPatterns,    // v0.32.1 — exposed for tests
@@ -1107,7 +1339,6 @@ module.exports = {
   pickBlockPattern,
   buildHint,
   buildBlockReason,
-  buildBlockReasonWithAnswer,
   buildNoHitsFyi,
   buildUnavailableFyi,   // v0.92 — allow-on-unavailable breadcrumb
   commandHash,

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.153.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.155.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.153.0",
+  "version": "0.155.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.153.0",
-    "@sdsrs/code-graph-linux-arm64": "0.153.0",
-    "@sdsrs/code-graph-darwin-x64": "0.153.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.153.0",
-    "@sdsrs/code-graph-win32-x64": "0.153.0"
+    "@sdsrs/code-graph-linux-x64": "0.155.0",
+    "@sdsrs/code-graph-linux-arm64": "0.155.0",
+    "@sdsrs/code-graph-darwin-x64": "0.155.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.155.0",
+    "@sdsrs/code-graph-win32-x64": "0.155.0"
   }
 }