@sdsrs/code-graph 0.163.0 → 0.165.0

package/claude-plugin/scripts/post-grep-inject.js

@@ -36,7 +36,7 @@ const { recordRecommendation } = require('./recommendation-log');
 // `sanitizeSearchPath` is deliberately NOT imported any more: this hook passes
 // the RAW path so buildGrepArgs can split a glob into scope + `-g` instead of
 // widening it away. Leaving the require behind would read as "still used".
-const { runGrepAnswer, runShowAnswer, runCallgraphAnswer } = require('./cg-answer');
+const { runGrepAnswer, runShowAnswer, runCallgraphAnswer, shellQuoteArg, formatCgCommand } = require('./cg-answer');
 const { emitPostToolContext } = require('./hook-emit');
 const {
   splitTopLevelSegments,
@@ -58,10 +58,14 @@ const {
   extractPatterns,
   rebaseRelativePaths,
   resolveProjectRoot,
+  readSourceRoots,
+  useSourceRoots,
+  grepListsBinaryMatches,
   rewritePlan,
   showAnswersPattern,
   searchesSameFiles,
 } = require('./pre-grep-guide');
+const { indexBuildInProgress } = require('./project-root');
 
 // The command HEAD is grep/rg/ag (or git grep, or a KEY=VALUE/env prefix). Kept
 // loosely aligned with pre-grep-guide's GREP_VERB; this only gates "is this
@@ -205,6 +209,38 @@ const INJECT_HEADER = '[code-graph] AST-aware view of your grep (ran alongside):
 const CALLGRAPH_HEADER =
   '[code-graph] Cross-file call graph for the symbol you grepped (grep can\'t show this):';
 
+// B11 (2026-09-29 usage evaluation) — a call graph about a symbol defined
+// outside the path the grep searched. The grep's own scope says where the model
+// is looking; a same-named symbol's 4 KB call tree from elsewhere is not about
+// that place (a grep in tests/cli_e2e.rs got `indexed_project`'s tree from
+// src/indexer/resync.rs). Its location was the useful part, so that is what it
+// gets: one pointer line.
+
+/** The file on a `callgraph` answer's root line (`name (path)`), or null. */
+function definitionFile(text) {
+  const m = /^\S+ \(([^()\n]+)\)/.exec(String(text || ''));
+  return m ? m[1] : null;
+}
+
+/**
+ * Whether a grep over root-relative `searchPath` reads `file`. No path, `.`,
+ * or an unknown file count as covered (the full answer, as before); a glob
+ * counts as its directory.
+ */
+function searchCovers(searchPath, file) {
+  if (!file) return true;
+  let p = String(searchPath || '').replace(/^\.\//, '').replace(/\/+$/, '');
+  const glob = p.search(/[*?[]/);
+  if (glob !== -1) p = p.slice(0, glob).replace(/\/?[^/]*$/, '');
+  if (p === '' || p === '.') return true;
+  return file === p || file.startsWith(p + '/');
+}
+
+function buildPointerText(symbol, file, searchPath) {
+  return `[code-graph] ${symbol} is defined in ${shellQuoteArg(file)}, outside the path your grep ` +
+    `searched (${shellQuoteArg(searchPath)}). Its callers and callees: ${formatCgCommand(['callgraph', symbol])}`;
+}
+
 function buildInjectText(answer, mode) {
   if (mode === 'callgraph') {
     const lines = [CALLGRAPH_HEADER, answer.text];
@@ -251,6 +287,8 @@ function runMain() {
   const shellCwd = process.cwd();
   const root = resolveProjectRoot(shellCwd);
   if (root === null) return;  // no index anywhere up to $HOME
+  // The same source dirs the PreToolUse half recognized (F1).
+  useSourceRoots(readSourceRoots(root));
 
   let input;
   try {
@@ -391,11 +429,16 @@ function runMain() {
   // stopping at the first symbol with real edges. runCallgraphAnswer returns `hits`
   // ONLY when the symbol has edges → a leaf/absent symbol self-filters to the
   // show/grep echo below.
-  for (const symbol of extractCallgraphSymbols(rawPattern)) {
+  // Not while the startup index is being written: its call edges are a subset
+  // shown as the whole graph (D5). The grep echo below reads the files.
+  const callgraphSymbols = indexBuildInProgress(root) ? [] : extractCallgraphSymbols(rawPattern);
+  let answeredSymbol = null;
+  for (const symbol of callgraphSymbols) {
     const cg = runCallgraphAnswer({ cwd: root, symbol });
     if (cg.status === 'hits') {
       answer = cg;
       answeredMode = 'callgraph';
+      answeredSymbol = symbol;
       break;
     }
   }
@@ -463,14 +506,23 @@ function runMain() {
   // which skips more (review of D#133, H-2).
   if (answeredMode !== 'callgraph' && !searchesSameFiles({
     root, target: searchPath, verb: plan.verb, show: answeredMode === 'show',
+    binaryCacheOk: !grepListsBinaryMatches(segment),
   })) return;
 
+  // B11: `scope:'outside'` marks a pointer in place of the tree; `mode` stays
+  // `callgraph`, the one the funnel aggregator buckets.
+  const rootFile = answeredMode === 'callgraph' ? definitionFile(answer.text) : null;
+  const outside = answeredMode === 'callgraph' && !searchCovers(searchPath, rootFile);
   recordRecommendation(root, {
     hook: 'grep', action: 'inject', answered: true,
     ...(pattern ? { pattern } : {}),
     mode: answeredMode,
+    ...(outside ? { scope: 'outside' } : {}),
   });
-  process.stdout.write(emitPostToolContext(buildInjectText(answer, answeredMode)) + '\n');
+  const text = outside
+    ? buildPointerText(answeredSymbol, rootFile, searchPath)
+    : buildInjectText(answer, answeredMode);
+  process.stdout.write(emitPostToolContext(text) + '\n');
 }
 
 if (require.main === module) {
@@ -483,6 +535,9 @@ module.exports = {
   extractGrepOutput,
   grepFoundPattern,
   buildInjectText,
+  definitionFile,
+  searchCovers,
+  buildPointerText,
   isSilenced,
   isInjectDisabled,
   commandHash,

package/claude-plugin/scripts/pre-edit-guide.js

@@ -9,17 +9,20 @@
 if (require.main === module) require('./hook-fail-open').installHookFailOpen('PreToolUse:Edit');
 
 // PreToolUse(Edit) hook: auto-inject impact analysis when editing function definitions.
-// Only fires when:
-//   1. The old_string contains a function/method definition (signature being modified)
-//   2. The symbol has 2+ production callers (high impact)
-//   3. Same symbol not queried in last 2 minutes
-// Silently exits otherwise — zero noise for normal edits.
+// Write reaches it too (Q1): only logged for the Stop check, never answered. For Edit, it only fires when:
+//   1. The old_string contains a function/method definition AND the edit changes
+//      that definition's header (a body-only edit cannot break a caller)
+//   2. The edited file is inside the project
+//   3. The symbol has 1+ production callers
+//   4. Same symbol not queried in last 2 minutes
+// Silently exits otherwise — zero noise for normal edits. CODE_GRAPH_QUIET_HOOKS=1
+// silences it like the other injecting hooks.
 const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const { findBinary } = require('./find-binary');
 const { cgTmpDir, cwdHash } = require('./tmp-dir');
-const { resolveProjectRoot } = require('./project-root');
+const { resolveProjectRoot, indexBuildInProgress } = require('./project-root');
 const { recordRecommendation } = require('./recommendation-log');
 const { formatCoveringTests } = require('./covering-tests');
 const { emitPreToolContext } = require('./hook-emit');
@@ -56,16 +59,37 @@ try {
 // edits the signature extraction below gives up on), then again with the
 // symbol once one is known. Append-only, best-effort: it cannot fail the Edit.
 const sessionEdits = require('./session-edits');
-const editedAbs = (input.tool_input && input.tool_input.file_path) || '';
+const toolInput = input.tool_input || {};
+const editedAbs = toolInput.file_path || '';
 const editedRel = editedAbs ? path.relative(cwd, path.resolve(cwd, editedAbs)) : '';
-const logEdit = (symbol) => {
-  if (editedRel && !editedRel.startsWith('..') && !path.isAbsolute(editedRel)) {
-    sessionEdits.recordEdit(cwd, input.session_id, { file: editedRel.split(path.sep).join('/'), symbol });
+const insideProject = editedRel && !editedRel.startsWith('..') && !path.isAbsolute(editedRel);
+const editedKey = insideProject ? editedRel.split(path.sep).join('/') : '';
+
+// Q1 — a Write (matcher `Edit|Write`) is logged for the Stop check and never
+// answered: it carries the whole file, and the pick below would name
+// whichever definition its first matching pattern finds, not the one that
+// changed. A Write over
+// an existing file records a baseline for each definition whose header its
+// content changes.
+if (input.tool_name === 'Write') {
+  if (editedKey) {
+    const newText = typeof toolInput.content === 'string' ? toolInput.content : null;
+    sessionEdits.recordFileEdit(cwd, input.session_id, editedKey, { newText });
   }
+  process.exit(0);
+}
+
+const logEdit = (symbol) => {
+  if (editedKey) sessionEdits.recordEdit(cwd, input.session_id, { file: editedKey, symbol });
 };
 logEdit(null);
 
-const oldStr = (input.tool_input && input.tool_input.old_string) || '';
+// An edit outside the project cannot be about this project's symbols; asking
+// the index anyway injected a same-named project function's callers.
+if (!insideProject) process.exit(0);
+
+const oldStr = toolInput.old_string || '';
+const newStr = toolInput.new_string || '';
 if (!oldStr || oldStr.length < 10) process.exit(0);
 
 // --- Extract function/method signature from the edited text ---
@@ -107,63 +131,27 @@ const fnPatterns = [
 // future author adds to the array without reading the note above.
 const scanned = oldStr.length > 8192 ? oldStr.slice(0, 8192) : oldStr;
 
+// Which definition the hunk names: the first pattern, in array order, that
+// matches — 0.163.0's rule. Three replacements (the earliest match, then an
+// allow-list of what may precede a method name, then keyword-anchored arms
+// first) each fixed shapes and broke others, and three review rounds found a
+// regression in each (pre-tag review 2026-09-29), so the released rule stays
+// until a per-language design with a corpus for each language replaces it.
+//
+// Where the definition starts is its name's line: `// TODO: make this
+// async\nfn f(` matches from the comment line, and the same-file pick below
+// counts lines from here. That moves no name, only the line.
 let symbol = null;
+let symbolAt = -1;
 for (const pat of fnPatterns) {
-  const m = scanned.match(pat);
+  const m = scanned.match(new RegExp(pat.source, `${pat.flags}d`));
   if (m) {
-    // Find the first captured group
     symbol = m[1] || m[2];
+    const nameAt = (m.indices[1] || m.indices[2])[0];
+    symbolAt = Math.max(m.index, scanned.lastIndexOf('\n', nameAt - 1) + 1);
     break;
   }
 }
-
-// Fallback: if old_string is inside a function body (not a definition),
-// extract a unique identifier from the code and grep for it to find the containing function
-if (!symbol || symbol.length < 3) {
-  const filePath = (input.tool_input && input.tool_input.file_path) || '';
-  if (filePath && oldStr.length >= 10) {
-    try {
-      // Extract identifiers from old_string, try the most specific one first
-      const identifiers = (oldStr.match(/\b([a-z]\w*(?:_\w+)+|[a-z]\w*(?:[A-Z]\w*)+|[A-Z]\w+\.\w+|[A-Z]\w+::\w+)\b/g) || [])
-        .filter(id => id.length >= 6);
-      const skipWords = new Set(['return', 'function', 'default', 'require', 'module', 'exports', 'import', 'console']);
-      // Sort by length descending (longer = more specific = fewer matches)
-      const candidates = [...new Set(identifiers)]
-        .filter(id => !skipWords.has(id.toLowerCase()))
-        .sort((a, b) => b.length - a.length);
-      // Two candidates, not five. They are sorted most-specific-first, so the
-      // 3rd–5th were the least likely to resolve AND the ones that pushed this
-      // loop past the hook's whole 4 s budget (5 × 2000 ms here + 2500 ms of
-      // impact below); the impact query they starve is the hook's actual output
-      // (audit 2026-09-05 JS-03).
-      for (const candidate of candidates.slice(0, 2)) {
-        const budget = remainingMs(2000);
-        if (budget === null) break;
-        try {
-          const raw = execFileSync(binary, ['grep', candidate, filePath, '--json'], hidden({
-            cwd, timeout: budget, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-            env: internalEnv,
-          }));
-          const grepResult = JSON.parse(raw);
-          // Pick this candidate if it has few matches (precise location)
-          const withContainer = (grepResult || []).filter(m => m.container && m.container.name);
-          if (withContainer.length > 0 && withContainer.length <= 5) {
-            // If multiple containers, vote for the most common one
-            const votes = {};
-            for (const m of withContainer) {
-              const cn = m.container.name;
-              votes[cn] = (votes[cn] || 0) + 1;
-            }
-            const best = Object.entries(votes).sort((a, b) => b[1] - a[1])[0][0];
-            symbol = best.includes('.') ? best.split('.').pop() : best.includes('::') ? best.split('::').pop() : best;
-            break;
-          }
-        } catch { /* try next candidate */ }
-      }
-    } catch { /* grep failed or no match — fall through */ }
-  }
-}
-
 if (!symbol || symbol.length < 3) process.exit(0);
 
 // Skip common patterns that aren't real function names
@@ -180,6 +168,21 @@ function isCommonKeyword(s) {
 // the one the Stop check must still see.
 logEdit(symbol);
 
+// The definition's header, from where it starts to where its body opens. An
+// edit that leaves it verbatim changes only the body, which no caller can see.
+// (A body-only hunk with no definition in it exited above: the grep fallback
+// that used to guess its enclosing function named a wrong one for 108 of 608
+// TypeScript definitions, 2026-09-28 hook audit.)
+function headerAt(text, at) {
+  const rest = text.slice(at, at + 400);
+  const ends = [rest.indexOf('{'), rest.indexOf('=>'), rest.search(/:\s*(?:\n|$)/)]
+    .filter((i) => i >= 0);
+  return ends.length ? rest.slice(0, Math.min(...ends)) : rest.split('\n', 1)[0];
+}
+if (newStr.includes(headerAt(scanned, symbolAt))) process.exit(0);
+
+if (process.env.CODE_GRAPH_QUIET_HOOKS === '1') process.exit(0);
+
 // --- Per-symbol cooldown: 2 minutes ---
 // Project-scoped (see cwdHash in tmp-dir.js). A symbol name is the LEAST
 // project-unique key there is — `main`, `run`, `new`, `parse` collide across
@@ -190,6 +193,10 @@ try {
   if (Date.now() - fs.statSync(cooldownFile).mtimeMs < 120000) process.exit(0);
 } catch { /* first time for this symbol */ }
 
+// A half-built index gives a wrong caller count and risk, not a short one (D5).
+// The edit itself is already logged above for the Stop hook.
+if (indexBuildInProgress(cwd)) process.exit(0);
+
 // --- Run impact analysis (JSON mode for programmatic parsing) ---
 // Disambiguate via --file: file_path from tool_input is absolute, but the
 // indexer stores files as repo-relative paths — converting here is what makes
@@ -198,33 +205,65 @@ try {
 // path, which previously caused silent exits for the most common edit cases.
 const editedFile = (input.tool_input && input.tool_input.file_path) || '';
 const relFile = editedFile ? path.relative(cwd, editedFile) : '';
-let jsonResult;
 // Whatever is left of the registered 4 s, capped at this call's own 2500 ms.
 // `null` = the candidate loop above already spent the budget; running anyway is
 // what got the hook killed by Claude Code mid-Edit (audit 2026-09-05 JS-03).
-const impactBudget = remainingMs(2500);
-if (impactBudget === null) process.exit(0);
-try {
-  const args = ['impact', symbol, '--json'];
-  if (relFile && !relFile.startsWith('..')) args.push('--file', relFile);
-  // v0.49 — use the resolved binary (bare 'code-graph-mcp' was PATH-dependent,
-  // diverging from the findBinary() result the rest of the hook trusts).
-  const raw = execFileSync(binary, args, hidden({
-    cwd,
-    timeout: impactBudget,
-    encoding: 'utf8',
-    stdio: ['pipe', 'pipe', 'pipe'],
-    env: internalEnv,
-  }));
-  jsonResult = JSON.parse(raw);
-} catch {
-  // Symbol not found, timeout, or parse error — exit silently
-  process.exit(0);
+// A refusal exits 1 with its JSON on stdout, which is read too.
+function runImpact(args) {
+  const budget = remainingMs(2500);
+  if (budget === null) return null;
+  let raw;
+  try {
+    // v0.49 — use the resolved binary (bare 'code-graph-mcp' was PATH-dependent,
+    // diverging from the findBinary() result the rest of the hook trusts).
+    raw = execFileSync(binary, args, hidden({
+      cwd,
+      timeout: budget,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      env: internalEnv,
+    }));
+  } catch (e) {
+    raw = e && typeof e.stdout === 'string' ? e.stdout : '';
+  }
+  try { return JSON.parse(raw); } catch { return null; }
+}
+
+// Q4 — the definition this edit changes, among same-file same-name ones: the
+// last candidate starting at or before the edited header's line. null when
+// the old_string is not in the file (the Edit will fail) or no candidate fits.
+// The CLI lists at most five, in source order, and says how many exist in
+// `total`: past the last listed one an unlisted definition may start, so an
+// edit there is not guessed at (pre-tag review 2026-09-29).
+function editedNodeId(suggestions, fileKey, total) {
+  let text;
+  try { text = fs.readFileSync(path.join(cwd, fileKey), 'utf8'); } catch { return null; }
+  const at = text.indexOf(oldStr);
+  if (at === -1) return null;
+  const line = text.slice(0, at + symbolAt).split('\n').length;
+  let best = null;
+  for (const c of suggestions) {
+    if (!c || c.file_path !== fileKey || !Number.isInteger(c.node_id) || !Number.isInteger(c.start_line)) continue;
+    if (c.start_line <= line && (best === null || c.start_line > best.start_line)) best = c;
+  }
+  const lastListed = Math.max(...suggestions.map((c) => (c && Number.isInteger(c.start_line) ? c.start_line : -Infinity)));
+  if (Number.isInteger(total) && total > suggestions.length && line > lastListed) return null;
+  return best ? best.node_id : null;
+}
+
+const impactArgs = ['impact', symbol, '--json'];
+if (relFile && !relFile.startsWith('..')) impactArgs.push('--file', relFile);
+let jsonResult = runImpact(impactArgs);
+// A file that defines the name more than once (two classes' `get`) makes
+// `--file` refuse and list each definition's node_id (174f9b6). Ask again for
+// the one being edited.
+if (jsonResult && jsonResult.error && Array.isArray(jsonResult.suggestions)) {
+  const nodeId = editedNodeId(jsonResult.suggestions, editedKey, jsonResult.total);
+  jsonResult = nodeId === null ? null : runImpact(['impact', '--node-id', String(nodeId), '--json']);
 }
 
-// CLI returns {"error": "..."} on ambiguous / not-found instead of throwing.
-// Treat as silent skip — direct_callers will be undefined.
-if (jsonResult && jsonResult.error) process.exit(0);
+// Symbol not found, another refusal, timeout, or unparsable output — silent.
+if (!jsonResult || jsonResult.error) process.exit(0);
 
 // --- Inject when the symbol has any caller (1+) ---
 // Earlier gate was 2+ direct callers; reality is that editing a function with