@sdsrs/code-graph 0.16.6 → 0.16.7

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.16.6",
+  "version": "0.16.7",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -172,6 +172,46 @@ function getExtractedPluginVersion(pluginSrc) {
   return manifest && typeof manifest.version === 'string' ? manifest.version : null;
 }
 
+function cachedBinaryPath() {
+  const name = os.platform() === 'win32' ? 'code-graph-mcp.exe' : 'code-graph-mcp';
+  return path.join(BINARY_CACHE_DIR, name);
+}
+
+/**
+ * Download just the platform binary from a GitHub release into the cache.
+ * Used in two paths:
+ *   1. As part of `downloadAndInstall` after a plugin tarball update.
+ *   2. As a standalone self-heal when the cached binary is missing but the
+ *      installed plugin version already matches `latest` (e.g. previous
+ *      download failed silently, cache was wiped, optionalDependency
+ *      install dropped the platform package).
+ *
+ * Returns true on successful promote, false otherwise. Never throws.
+ */
+async function downloadBinary(latest) {
+  if (!latest || !latest.binaryUrl) return false;
+  if (!commandExists('curl')) {
+    console.error('[code-graph] Binary download skipped: curl not on PATH.');
+    return false;
+  }
+
+  const binaryDst = cachedBinaryPath();
+  const binaryTmp = binaryDst + '.tmp.' + process.pid;
+
+  try {
+    fs.mkdirSync(BINARY_CACHE_DIR, { recursive: true });
+    execFileSync('curl', [
+      '-sL', '-o', binaryTmp,
+      latest.binaryUrl,
+    ], { timeout: 60000, stdio: 'pipe' });
+
+    return promoteVerifiedBinary(binaryTmp, binaryDst, latest.version);
+  } catch (e) {
+    console.error(`[code-graph] Binary download failed: ${e.message}`);
+    return false;
+  }
+}
+
 function promoteVerifiedBinary(binaryTmp, binaryDst, expectedVersion) {
   try {
     const stat = fs.statSync(binaryTmp);
@@ -272,25 +312,8 @@ async function downloadAndInstall(latest) {
     }
 
     // ── Step 2: Download platform binary directly from GitHub release ──
-    if (latest.binaryUrl) {
-      try {
-        const binaryName = os.platform() === 'win32' ? 'code-graph-mcp.exe' : 'code-graph-mcp';
-        const binaryDst = path.join(BINARY_CACHE_DIR, binaryName);
-        const binaryTmp = binaryDst + '.tmp.' + process.pid;
-
-        fs.mkdirSync(BINARY_CACHE_DIR, { recursive: true });
-        execFileSync('curl', [
-          '-sL', '-o', binaryTmp,
-          latest.binaryUrl,
-        ], { timeout: 60000, stdio: 'pipe' });
-
-        if (promoteVerifiedBinary(binaryTmp, binaryDst, latest.version)) {
-          binaryUpdated = true;
-        }
-      } catch (e) {
-        // Binary download failed — plugin update still counts as success
-        console.error(`[code-graph] Binary download failed: ${e.message}`);
-      }
+    if (await downloadBinary(latest)) {
+      binaryUpdated = true;
     }
 
     return { pluginUpdated, binaryUpdated };
@@ -314,8 +337,11 @@ async function checkForUpdate() {
     // bypasses auto-update.js, so re-sync state.installedVersion every call.
     const installedVersion = readManifest().version || '0.0.0';
 
-    // Time-based throttle
-    if (!shouldCheck(state)) {
+    // Time-based throttle. A missing cache binary is a hard failure (launcher
+    // cannot start) so it overrides the throttle — without this bypass the
+    // session wedges for up to 6h waiting for the next check window.
+    const binaryMissing = !fs.existsSync(cachedBinaryPath());
+    if (!binaryMissing && !shouldCheck(state)) {
       if (state.installedVersion !== installedVersion) {
         saveState({ ...state, installedVersion });
       }
@@ -359,7 +385,15 @@ async function checkForUpdate() {
       };
     }
 
-    // No update needed
+    // No update needed — but self-heal if cache binary is missing.
+    // State file alone is not authoritative; previous download may have failed
+    // silently, cache may have been wiped, or `npm install -g` optionalDependency
+    // may have dropped the platform package.
+    let selfHealedBinary = false;
+    if (latest.binaryUrl && !fs.existsSync(cachedBinaryPath())) {
+      selfHealedBinary = await downloadBinary(latest);
+    }
+
     saveState({
       ...state,
       installedVersion,
@@ -367,8 +401,11 @@ async function checkForUpdate() {
       latestVersion: latest.version,
       updateAvailable: false,
       rateLimited: false,
+      binaryUpdated: selfHealedBinary || state.binaryUpdated,
     });
-    return null;
+    return selfHealedBinary
+      ? { updated: false, binaryUpdated: true, from: installedVersion, to: installedVersion }
+      : null;
   } catch {
     // Silent failure — never block session
     return null;
@@ -379,6 +416,7 @@ module.exports = {
   checkForUpdate, commandExists, isDevMode, readState, compareVersions,
   getExtractedPluginVersion, readBinaryVersion, promoteVerifiedBinary, isSilentMode,
   requestJson, parseLatestRelease, fetchLatestRelease,
+  downloadBinary, cachedBinaryPath,
 };
 
 // CLI: node auto-update.js [check|status]
@@ -398,6 +436,8 @@ if (require.main === module) {
         console.log(`Updated: v${result.from} → v${result.to} (binary: ${result.binaryUpdated ? 'yes' : 'no'})`);
       } else if (result && result.updateAvailable) {
         console.log(`Update available: v${result.to} (auto-install failed)`);
+      } else if (result && result.binaryUpdated) {
+        console.log(`Repaired binary cache (v${result.to})`);
       } else if (isDevMode()) {
         console.log('Dev mode — auto-update skipped');
       } else {

package/claude-plugin/scripts/auto-update.test.js

@@ -12,6 +12,8 @@ const {
   parseLatestRelease,
   readBinaryVersion,
   promoteVerifiedBinary,
+  cachedBinaryPath,
+  downloadBinary,
 } = require('./auto-update');
 
 function mkDir(t, prefix) {
@@ -93,6 +95,24 @@ test('commandExists returns false for a non-existent command', () => {
   assert.equal(commandExists('__nonexistent_cmd_xyz_12345__'), false);
 });
 
+test('cachedBinaryPath returns expected platform binary path', () => {
+  const p = cachedBinaryPath();
+  const expectedName = process.platform === 'win32' ? 'code-graph-mcp.exe' : 'code-graph-mcp';
+  assert.equal(path.basename(p), expectedName);
+  assert.ok(p.includes('.cache') && p.includes('code-graph'),
+    `expected cache path to live under ~/.cache/code-graph: ${p}`);
+});
+
+test('downloadBinary returns false for missing binaryUrl (no-op safety)', async () => {
+  const result = await downloadBinary({ version: '1.0.0', binaryUrl: null });
+  assert.equal(result, false);
+});
+
+test('downloadBinary returns false when latest is null', async () => {
+  const result = await downloadBinary(null);
+  assert.equal(result, false);
+});
+
 test('fetchLatestRelease parses JSON without relying on global fetch', async () => {
   const latest = await fetchLatestRelease(async () => ({
     statusCode: 200,

package/claude-plugin/scripts/find-binary.js

@@ -9,6 +9,53 @@ const PLATFORM = os.platform();
 const ARCH = os.arch();
 const CACHE_FILE = path.join(os.homedir(), '.cache', 'code-graph', 'binary-path');
 const BINARY_NAME = PLATFORM === 'win32' ? 'code-graph-mcp.exe' : 'code-graph-mcp';
+const PLATFORM_PKG = `@sdsrs/code-graph-${PLATFORM}-${ARCH}`;
+
+/**
+ * Candidate paths for npm global `node_modules`.
+ *
+ * `require.resolve` only searches `node_modules` walking up from the requiring
+ * file — it does NOT search global installations (no NODE_PATH set in default
+ * Node setups, including nvm). When a user runs `npm install -g`, the platform
+ * package lands somewhere we have to discover ourselves.
+ */
+function globalNodeModulesCandidates() {
+  const out = [];
+  const nodeBinDir = path.dirname(process.execPath);
+
+  // 1. Derive from process.execPath. Works for nvm + standard Unix prefixes
+  //    (`<prefix>/bin/node` → globals at `<prefix>/lib/node_modules`); on
+  //    Windows globals sit next to `node.exe`.
+  if (PLATFORM === 'win32') {
+    out.push(path.join(nodeBinDir, 'node_modules'));
+  } else {
+    out.push(path.resolve(nodeBinDir, '..', 'lib', 'node_modules'));
+  }
+
+  // 2. NPM_CONFIG_PREFIX env override (set by users using `~/.npm-global` etc.)
+  const envPrefix = process.env.NPM_CONFIG_PREFIX || process.env.npm_config_prefix;
+  if (envPrefix) {
+    out.push(PLATFORM === 'win32'
+      ? path.join(envPrefix, 'node_modules')
+      : path.join(envPrefix, 'lib', 'node_modules'));
+  }
+
+  // 3. Common no-sudo user prefix
+  out.push(path.join(os.homedir(), '.npm-global', 'lib', 'node_modules'));
+
+  // 4. Last resort: ask npm directly. Slow (~50-200ms) but most accurate when
+  //    user has a non-standard prefix. Cached at the disk-cache layer above.
+  try {
+    const root = execFileSync('npm', ['root', '-g'], {
+      timeout: 2000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+      encoding: 'utf8',
+    }).trim();
+    if (root) out.push(root);
+  } catch { /* npm not on PATH or timed out */ }
+
+  return [...new Set(out)];
+}
 
 function isNativeBinary(candidate) {
   if (!candidate) return false;
@@ -60,6 +107,32 @@ function isDevRepo(rootDir) {
   return fs.existsSync(path.join(rootDir, 'Cargo.toml'));
 }
 
+/**
+ * Locate the platform-specific binary in npm package layouts.
+ *   - First via `require.resolve` (parent-walk node_modules / linked / npx).
+ *   - Then by explicit probe of npm global `node_modules` candidates.
+ *
+ * `require.resolve` does NOT search global installs (no NODE_PATH on
+ * nvm/standard setups), so a working `npm install -g @sdsrs/code-graph` can
+ * still be invisible without the fallback.
+ */
+function findPlatformBinary() {
+  // Fast path: standard module resolution.
+  try {
+    const pkgPath = require.resolve(`${PLATFORM_PKG}/package.json`);
+    const bin = path.join(path.dirname(pkgPath), BINARY_NAME);
+    if (isNativeBinary(bin)) return bin;
+  } catch { /* not in node_modules walk-up */ }
+
+  // Slow path: explicit global node_modules probe.
+  for (const globalRoot of globalNodeModulesCandidates()) {
+    const bin = path.join(globalRoot, '@sdsrs', `code-graph-${PLATFORM}-${ARCH}`, BINARY_NAME);
+    if (isNativeBinary(bin)) return bin;
+  }
+
+  return null;
+}
+
 function findBinaryUncached() {
   // --- Dev mode: always prefer cargo build output when running from source repo ---
   // This covers: npm link, direct invocation from repo, CLAUDE_PROJECT_DIR set to repo
@@ -88,12 +161,8 @@ function findBinaryUncached() {
   if (isNativeBinary(autoUpdateBin)) return autoUpdateBin;
 
   // --- Platform-specific npm package (@sdsrs/code-graph-{os}-{arch}) ---
-  const platformPkg = `@sdsrs/code-graph-${PLATFORM}-${ARCH}`;
-  try {
-    const pkgPath = require.resolve(`${platformPkg}/package.json`);
-    const bin = path.join(path.dirname(pkgPath), BINARY_NAME);
-    if (isNativeBinary(bin)) return bin;
-  } catch { /* not installed via npm */ }
+  const platformBin = findPlatformBinary();
+  if (platformBin) return platformBin;
 
   // --- Bundled binary (in same directory as cli.js or plugin scripts) ---
   // Check bin/ directory of the npm package
@@ -140,7 +209,11 @@ function clearCache() {
   try { fs.unlinkSync(CACHE_FILE); } catch { /* ok */ }
 }
 
-module.exports = { findBinary, findBinaryUncached, clearCache, CACHE_FILE, BINARY_NAME };
+module.exports = {
+  findBinary, findBinaryUncached, clearCache,
+  globalNodeModulesCandidates, findPlatformBinary,
+  CACHE_FILE, BINARY_NAME, PLATFORM_PKG,
+};
 
 // Allow direct invocation for testing
 if (require.main === module) {

package/claude-plugin/scripts/find-binary.test.js

@@ -0,0 +1,110 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const { globalNodeModulesCandidates, findPlatformBinary, BINARY_NAME } = require('./find-binary');
+
+function mkDir(t, prefix) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  return dir;
+}
+
+test('globalNodeModulesCandidates includes derivation from process.execPath', () => {
+  const candidates = globalNodeModulesCandidates();
+  assert.ok(candidates.length > 0, 'at least one candidate path');
+
+  const nodeBinDir = path.dirname(process.execPath);
+  const expected = process.platform === 'win32'
+    ? path.join(nodeBinDir, 'node_modules')
+    : path.resolve(nodeBinDir, '..', 'lib', 'node_modules');
+  assert.ok(candidates.includes(expected), `expected ${expected} in ${JSON.stringify(candidates)}`);
+});
+
+test('globalNodeModulesCandidates honors NPM_CONFIG_PREFIX', (t) => {
+  const original = process.env.NPM_CONFIG_PREFIX;
+  process.env.NPM_CONFIG_PREFIX = '/tmp/fake-npm-prefix';
+  t.after(() => {
+    if (original === undefined) delete process.env.NPM_CONFIG_PREFIX;
+    else process.env.NPM_CONFIG_PREFIX = original;
+  });
+
+  const candidates = globalNodeModulesCandidates();
+  const expected = process.platform === 'win32'
+    ? path.join('/tmp/fake-npm-prefix', 'node_modules')
+    : path.join('/tmp/fake-npm-prefix', 'lib', 'node_modules');
+  assert.ok(candidates.includes(expected),
+    `expected NPM_CONFIG_PREFIX-derived path in candidates: ${JSON.stringify(candidates)}`);
+});
+
+test('globalNodeModulesCandidates dedupes overlapping paths', (t) => {
+  const original = process.env.NPM_CONFIG_PREFIX;
+  // Force NPM_CONFIG_PREFIX to match the execPath-derived prefix
+  const nodeBinDir = path.dirname(process.execPath);
+  const matchedPrefix = process.platform === 'win32'
+    ? nodeBinDir
+    : path.resolve(nodeBinDir, '..');
+  process.env.NPM_CONFIG_PREFIX = matchedPrefix;
+  t.after(() => {
+    if (original === undefined) delete process.env.NPM_CONFIG_PREFIX;
+    else process.env.NPM_CONFIG_PREFIX = original;
+  });
+
+  const candidates = globalNodeModulesCandidates();
+  const seen = new Set();
+  for (const c of candidates) {
+    assert.ok(!seen.has(c), `duplicate candidate: ${c}`);
+    seen.add(c);
+  }
+});
+
+test('findPlatformBinary locates platform pkg in NPM_CONFIG_PREFIX-derived global node_modules', (t) => {
+  // Mirror what `npm install -g` produces for @sdsrs/code-graph-{platform}-{arch}.
+  const fakePrefix = mkDir(t, 'find-binary-test-');
+  const platDir = process.platform === 'win32'
+    ? path.join(fakePrefix, 'node_modules', '@sdsrs', `code-graph-${process.platform}-${process.arch}`)
+    : path.join(fakePrefix, 'lib', 'node_modules', '@sdsrs', `code-graph-${process.platform}-${process.arch}`);
+  fs.mkdirSync(platDir, { recursive: true });
+
+  // Copy node executable so realpathSync(candidate)'s basename === BINARY_NAME
+  // (isNativeBinary check). Plain copy, not symlink, so basename matches.
+  const fakeBinary = path.join(platDir, BINARY_NAME);
+  fs.copyFileSync(process.execPath, fakeBinary);
+  if (process.platform !== 'win32') fs.chmodSync(fakeBinary, 0o755);
+
+  const original = process.env.NPM_CONFIG_PREFIX;
+  process.env.NPM_CONFIG_PREFIX = fakePrefix;
+  t.after(() => {
+    if (original === undefined) delete process.env.NPM_CONFIG_PREFIX;
+    else process.env.NPM_CONFIG_PREFIX = original;
+  });
+
+  const found = findPlatformBinary();
+  assert.equal(found, fakeBinary, `expected ${fakeBinary}, got ${found}`);
+});
+
+test('findPlatformBinary returns null when no platform pkg installed anywhere reachable', (t) => {
+  // Point NPM_CONFIG_PREFIX at an empty dir so global probe cannot match.
+  const fakePrefix = mkDir(t, 'find-binary-empty-');
+  const original = process.env.NPM_CONFIG_PREFIX;
+  process.env.NPM_CONFIG_PREFIX = fakePrefix;
+  t.after(() => {
+    if (original === undefined) delete process.env.NPM_CONFIG_PREFIX;
+    else process.env.NPM_CONFIG_PREFIX = original;
+  });
+
+  // Note: this test only proves the negative if no real install of the platform
+  // package is reachable via require.resolve OR any other candidate path. On a
+  // dev machine that has `@sdsrs/code-graph-linux-x64` installed globally, this
+  // assertion will fail — that's not a defect of the helper but of test setup.
+  // Skip if a real install is detected.
+  const real = findPlatformBinary();
+  if (real && !real.startsWith(fakePrefix)) {
+    t.skip(`real platform pkg installed at ${real}, cannot test the null path here`);
+    return;
+  }
+  assert.equal(real, null);
+});

package/claude-plugin/scripts/mcp-launcher.js

@@ -42,10 +42,29 @@ if (!binary) {
   }
 }
 
+// Fallback: npm install may have succeeded but optionalDependencies for the
+// platform binary can fail silently (npm tolerates OS-mismatch + flaky
+// registry). Pull the platform binary directly from the GitHub release.
+if (!binary) {
+  process.stderr.write('[code-graph] Falling back to GitHub release download...\n');
+  try {
+    execFileSync(process.execPath, [path.join(__dirname, 'auto-update.js'), '--silent'], {
+      timeout: 90000, stdio: 'pipe',
+    });
+    clearCache();
+    binary = findBinary();
+    if (binary) {
+      process.stderr.write(`[code-graph] Installed at ${binary}\n`);
+    }
+  } catch { /* fall through to manual-install message */ }
+}
+
 if (!binary) {
   process.stderr.write(
     '[code-graph] Binary not found. Install manually:\n' +
-    '  npm install -g @sdsrs/code-graph\n'
+    '  npm install -g @sdsrs/code-graph\n' +
+    '  # or\n' +
+    '  npm install -g @sdsrs/code-graph-' + process.platform + '-' + process.arch + '\n'
   );
   process.exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.16.6",
+  "version": "0.16.7",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -34,10 +34,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.16.6",
-    "@sdsrs/code-graph-linux-arm64": "0.16.6",
-    "@sdsrs/code-graph-darwin-x64": "0.16.6",
-    "@sdsrs/code-graph-darwin-arm64": "0.16.6",
-    "@sdsrs/code-graph-win32-x64": "0.16.6"
+    "@sdsrs/code-graph-linux-x64": "0.16.7",
+    "@sdsrs/code-graph-linux-arm64": "0.16.7",
+    "@sdsrs/code-graph-darwin-x64": "0.16.7",
+    "@sdsrs/code-graph-darwin-arm64": "0.16.7",
+    "@sdsrs/code-graph-win32-x64": "0.16.7"
   }
 }