@sdsrs/code-graph 0.154.0 → 0.156.0

package/README.md

@@ -427,7 +427,7 @@ skill does is also runnable by hand.
 - **Rust has no `inherits` edges** — the language has no class inheritance, so `impl Trait for Type` is recorded as `implements` and an `inherits`-filtered query returns empty for Rust.
 - **Kotlin/Swift interface conformance** is recorded as `inherits` (both use a single `: Type` grammar for base classes and protocols/interfaces), so `implements`-filtered queries return empty for these two languages.
 - **Cross-file dead-code detection** may false-positive a type whose only cross-file reference sits beyond the 4096-byte stored-content cap per node (documented accepted limitation, v0.97.1).
-- **Rust: borrowing a binding named `raw`** (`&raw`, `&raw[..]`, `&raw.field`) is misread by the pinned `tree-sitter-rust` 0.23 grammar as the start of the `&raw const` / `&raw mut` pointer operator, so the enclosing expression can be dropped from the index. `&mut raw`, `&self.raw` and the genuine `&raw const x` operator all parse correctly. The index reports the damage rather than hiding it. A run prints `Syntax errors in <file> — symbols may be incomplete` per file plus an `N file(s) parsed with syntax errors` total, and the verdict is stored with the index, so it survives the run: `health-check` names the files (`Parse: N file(s) indexed over a damaged parse`, plus `files_with_parse_errors` / `parse_error_files` under `--json`), `doctor` shows a `Parse` row, and the MCP `get_index_status` carries the same two fields. An incremental run over unrelated files does not clear it — only re-parsing the offending file, or deleting it, does. Workaround: rename the binding. Measured on this repo by indexing it fresh at v0.150.0: **9 of 163** tracked Rust files trip the warning, and the run's total says 10 — a Markdown file trips the same counter for an unrelated reason. The stored set names the same ten, which is the cheapest way to check this table has not drifted again: it is a reading of one tree at one commit, not a constant, and an earlier revision of this bullet carried 8/161/9 long after they stopped being true. Recovery is usually partial rather than total: across a fixture covering every trigger shape, the surrounding functions and their call edges survived.
+- **A file tree-sitter cannot fully parse is indexed over a damaged parse.** Symbols inside the damaged region can be missing or mis-scoped — e.g. a Swift class whose body holds `#if`/`#error` directives, or macro-heavy C++ headers. The index reports the damage rather than hiding it. A run prints `Syntax errors in <file> — symbols may be incomplete` per file plus an `N file(s) parsed with syntax errors` total, and the verdict is stored with the index, so it survives the run: `health-check` names the files (`Parse: N file(s) indexed over a damaged parse`, plus `files_with_parse_errors` / `parse_error_files` under `--json`), `doctor` shows a `Parse` row, and the MCP `get_index_status` carries the same two fields. An incremental run over unrelated files does not clear it — only re-parsing the offending file, or deleting it, does. Rust borrows of a binding named `raw` (`&raw`, `&raw[..]`, `&raw.field`), which the old `tree-sitter-rust` 0.23 grammar misread as the `&raw const` operator, parse cleanly since the tree-sitter 0.25 upgrade: this repo indexed fresh went from 9 damaged Rust files to 0.
 
 ## Team-shared graph snapshot
 

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.154.0",
+  "version": "0.156.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/pre-grep-guide.js

@@ -129,6 +129,11 @@ function firstShellClause(cmd) {
       if (c === quote) quote = null;
       continue;
     }
+    // Outside quotes a backslash escapes the next character: `\"` opens no
+    // quote and `\;` / `\|` are literal. quotedSpans reads patterns by the same
+    // rule; a splitter that disagreed let `grep \"X\" src/ && echo "Y"` hand the
+    // echo's `Y` to the pattern reader (pre-ship review F1).
+    if (c === '\\') { i++; continue; }
     if (c === '"' || c === "'") { quote = c; continue; }
     // Control operators END the grep's argument list → truncate. NOT redirects
     // (`>` `<`): `2>&1`, `>out`, and process substitution `-f <(cat pats) src/`
@@ -227,8 +232,47 @@ function extractPatterns(cmd) {
   // Collect every quoted argument — first one is the pattern in standard grep
   // usage; subsequent ones (e.g. `-e "second"`) are also patterns or filter
   // expressions and worth screening too.
-  const matches = [...stripped.matchAll(/"([^"]+)"|'([^']+)'/g)];
-  return matches.map(m => m[1] !== undefined ? m[1] : m[2]);
+  return quotedSpans(stripped).map(s => s.body).filter(Boolean);
+}
+
+/**
+ * The quoted spans of a shell clause, read the way the shell reads them — the
+ * rules firstShellClause, splitTopLevelSegments and extractUnansweredTail also
+ * follow (lesson #9656 inside quotes; pre-ship review F1 outside), which a span regex (`"([^"]+)"|'([^']+)'`) did not: it closed a
+ * double-quoted argument at the first `\"`, so
+ * `grep "if:\s*'\|\"if\"\|statusMessage"` yielded `\|statusMessage`, and its
+ * translation `|statusMessage` matches every line (observed 2026-09-25).
+ *   - `'…'` is literal to the next `'`.
+ *   - `"…"`: a backslash escapes `"` `\` `$` and backtick (the backslash is
+ *     dropped) and, before a newline, removes both characters (a line
+ *     continuation); before anything else it is literal (`"a\|b"`).
+ *   - Outside quotes a backslash escapes the next character, so `\"` opens
+ *     nothing — the shell hands grep the quote character itself.
+ * An unterminated quote ends the scan: what follows is not a span we can read.
+ * @returns {{start: number, end: number, body: string}[]} `end` is exclusive,
+ *   covering both quote characters.
+ */
+function quotedSpans(s) {
+  const spans = [];
+  if (typeof s !== 'string') return spans;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (c === '\\') { i++; continue; }
+    if (c !== '"' && c !== "'") continue;
+    let body = '';
+    let j = i + 1;
+    for (; j < s.length && s[j] !== c; j++) {
+      if (c === '"' && s[j] === '\\' && j + 1 < s.length && '"\\$`\n'.includes(s[j + 1])) {
+        j++;
+        if (s[j] === '\n') continue;  // backslash-newline is a line continuation: both go
+      }
+      body += s[j];
+    }
+    if (j >= s.length) break;
+    spans.push({ start: i, end: j + 1, body });
+    i = j;
+  }
+  return spans;
 }
 
 // Declaration anchors inside a pattern (`def cascade_failure|class TaskState`)
@@ -349,7 +393,16 @@ function isAgFilenameSearch(clause) {
   // argument can contain whitespace, so `ag "some_symbol -g x" src/` splits into
   // three tokens and the middle one looks exactly like a flag. Blanking leaves
   // an attached value's flag behind (`-g"x"` → `-g`), which is what we want.
-  const scan = clause.replace(VERB_STRIP, '').replace(/"[^"]*"|'[^']*'/g, ' ');
+  // Spans come from quotedSpans, not a span regex: `"a\" -g x"` is ONE
+  // argument, and a regex that closed it at the `\"` left `-g` bare.
+  const unverbed = clause.replace(VERB_STRIP, '');
+  let scan = '';
+  let at = 0;
+  for (const sp of quotedSpans(unverbed)) {
+    scan += unverbed.slice(at, sp.start) + ' ';
+    at = sp.end;
+  }
+  scan += unverbed.slice(at);
   for (const tok of scan.trim().split(/\s+/)) {
     if (!tok || tok[0] !== '-') continue;
     if (tok.startsWith('--')) {
@@ -602,6 +655,7 @@ function extractUnansweredTail(cmd) {
       if (c === quote) quote = null;
       continue;
     }
+    if (c === '\\') { i++; continue; }  // outside quotes: escapes the next char (see firstShellClause)
     if (c === '"' || c === "'") { quote = c; continue; }
     if (c === ';' || (c === '&' && cmd[i + 1] === '&')) {
       const tail = cmd.slice(i + (c === ';' ? 1 : 2)).trim();
@@ -695,6 +749,15 @@ function splitTopLevelSegments(cmd) {
       if (c === quote) quote = null;
       continue;
     }
+    // Outside quotes: escapes the next char, kept verbatim (see firstShellClause)
+    // — except a newline, where the pair is a line continuation and the shell
+    // removes both. Keeping them left `&& \⏎ grep …` a segment that starts
+    // with `\`, which GREP_HEAD rejects (pre-ship review round 2 F1).
+    if (c === '\\' && i + 1 < cmd.length) {
+      if (cmd[i + 1] !== '\n') cur += c + cmd[i + 1];
+      i++;
+      continue;
+    }
     if (c === '"' || c === "'") { quote = c; cur += c; continue; }
     // `&&` and `||` (a single `&`/`|` is NOT a split — `|` is an output-filter
     // pipe, lone `&` is background and rare in tool calls).

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.154.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.156.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.154.0",
+  "version": "0.156.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.154.0",
-    "@sdsrs/code-graph-linux-arm64": "0.154.0",
-    "@sdsrs/code-graph-darwin-x64": "0.154.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.154.0",
-    "@sdsrs/code-graph-win32-x64": "0.154.0"
+    "@sdsrs/code-graph-linux-x64": "0.156.0",
+    "@sdsrs/code-graph-linux-arm64": "0.156.0",
+    "@sdsrs/code-graph-darwin-x64": "0.156.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.156.0",
+    "@sdsrs/code-graph-win32-x64": "0.156.0"
   }
 }