@sdsrs/code-graph 0.155.0 → 0.156.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.155.0",
+  "version": "0.156.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/pre-grep-guide.js

@@ -129,6 +129,11 @@ function firstShellClause(cmd) {
       if (c === quote) quote = null;
       continue;
     }
+    // Outside quotes a backslash escapes the next character: `\"` opens no
+    // quote and `\;` / `\|` are literal. quotedSpans reads patterns by the same
+    // rule; a splitter that disagreed let `grep \"X\" src/ && echo "Y"` hand the
+    // echo's `Y` to the pattern reader (pre-ship review F1).
+    if (c === '\\') { i++; continue; }
     if (c === '"' || c === "'") { quote = c; continue; }
     // Control operators END the grep's argument list → truncate. NOT redirects
     // (`>` `<`): `2>&1`, `>out`, and process substitution `-f <(cat pats) src/`
@@ -227,8 +232,47 @@ function extractPatterns(cmd) {
   // Collect every quoted argument — first one is the pattern in standard grep
   // usage; subsequent ones (e.g. `-e "second"`) are also patterns or filter
   // expressions and worth screening too.
-  const matches = [...stripped.matchAll(/"([^"]+)"|'([^']+)'/g)];
-  return matches.map(m => m[1] !== undefined ? m[1] : m[2]);
+  return quotedSpans(stripped).map(s => s.body).filter(Boolean);
+}
+
+/**
+ * The quoted spans of a shell clause, read the way the shell reads them — the
+ * rules firstShellClause, splitTopLevelSegments and extractUnansweredTail also
+ * follow (lesson #9656 inside quotes; pre-ship review F1 outside), which a span regex (`"([^"]+)"|'([^']+)'`) did not: it closed a
+ * double-quoted argument at the first `\"`, so
+ * `grep "if:\s*'\|\"if\"\|statusMessage"` yielded `\|statusMessage`, and its
+ * translation `|statusMessage` matches every line (observed 2026-09-25).
+ *   - `'…'` is literal to the next `'`.
+ *   - `"…"`: a backslash escapes `"` `\` `$` and backtick (the backslash is
+ *     dropped) and, before a newline, removes both characters (a line
+ *     continuation); before anything else it is literal (`"a\|b"`).
+ *   - Outside quotes a backslash escapes the next character, so `\"` opens
+ *     nothing — the shell hands grep the quote character itself.
+ * An unterminated quote ends the scan: what follows is not a span we can read.
+ * @returns {{start: number, end: number, body: string}[]} `end` is exclusive,
+ *   covering both quote characters.
+ */
+function quotedSpans(s) {
+  const spans = [];
+  if (typeof s !== 'string') return spans;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (c === '\\') { i++; continue; }
+    if (c !== '"' && c !== "'") continue;
+    let body = '';
+    let j = i + 1;
+    for (; j < s.length && s[j] !== c; j++) {
+      if (c === '"' && s[j] === '\\' && j + 1 < s.length && '"\\$`\n'.includes(s[j + 1])) {
+        j++;
+        if (s[j] === '\n') continue;  // backslash-newline is a line continuation: both go
+      }
+      body += s[j];
+    }
+    if (j >= s.length) break;
+    spans.push({ start: i, end: j + 1, body });
+    i = j;
+  }
+  return spans;
 }
 
 // Declaration anchors inside a pattern (`def cascade_failure|class TaskState`)
@@ -349,7 +393,16 @@ function isAgFilenameSearch(clause) {
   // argument can contain whitespace, so `ag "some_symbol -g x" src/` splits into
   // three tokens and the middle one looks exactly like a flag. Blanking leaves
   // an attached value's flag behind (`-g"x"` → `-g`), which is what we want.
-  const scan = clause.replace(VERB_STRIP, '').replace(/"[^"]*"|'[^']*'/g, ' ');
+  // Spans come from quotedSpans, not a span regex: `"a\" -g x"` is ONE
+  // argument, and a regex that closed it at the `\"` left `-g` bare.
+  const unverbed = clause.replace(VERB_STRIP, '');
+  let scan = '';
+  let at = 0;
+  for (const sp of quotedSpans(unverbed)) {
+    scan += unverbed.slice(at, sp.start) + ' ';
+    at = sp.end;
+  }
+  scan += unverbed.slice(at);
   for (const tok of scan.trim().split(/\s+/)) {
     if (!tok || tok[0] !== '-') continue;
     if (tok.startsWith('--')) {
@@ -602,6 +655,7 @@ function extractUnansweredTail(cmd) {
       if (c === quote) quote = null;
       continue;
     }
+    if (c === '\\') { i++; continue; }  // outside quotes: escapes the next char (see firstShellClause)
     if (c === '"' || c === "'") { quote = c; continue; }
     if (c === ';' || (c === '&' && cmd[i + 1] === '&')) {
       const tail = cmd.slice(i + (c === ';' ? 1 : 2)).trim();
@@ -695,6 +749,15 @@ function splitTopLevelSegments(cmd) {
       if (c === quote) quote = null;
       continue;
     }
+    // Outside quotes: escapes the next char, kept verbatim (see firstShellClause)
+    // — except a newline, where the pair is a line continuation and the shell
+    // removes both. Keeping them left `&& \⏎ grep …` a segment that starts
+    // with `\`, which GREP_HEAD rejects (pre-ship review round 2 F1).
+    if (c === '\\' && i + 1 < cmd.length) {
+      if (cmd[i + 1] !== '\n') cur += c + cmd[i + 1];
+      i++;
+      continue;
+    }
     if (c === '"' || c === "'") { quote = c; cur += c; continue; }
     // `&&` and `||` (a single `&`/`|` is NOT a split — `|` is an output-filter
     // pipe, lone `&` is background and rare in tool calls).

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.155.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.156.0 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.155.0",
+  "version": "0.156.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.155.0",
-    "@sdsrs/code-graph-linux-arm64": "0.155.0",
-    "@sdsrs/code-graph-darwin-x64": "0.155.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.155.0",
-    "@sdsrs/code-graph-win32-x64": "0.155.0"
+    "@sdsrs/code-graph-linux-x64": "0.156.0",
+    "@sdsrs/code-graph-linux-arm64": "0.156.0",
+    "@sdsrs/code-graph-darwin-x64": "0.156.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.156.0",
+    "@sdsrs/code-graph-win32-x64": "0.156.0"
   }
 }