@sdsrs/code-graph 0.164.0 → 0.165.1

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.164.0",
+  "version": "0.165.1",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/adopt.js

@@ -667,6 +667,19 @@ function needsRefresh({ cwd, templatePath } = {}) {
   } catch { return false; }
 }
 
+// What a stale notice is about: the shipped template plus the block this
+// project would get now. SessionStart shows the notice once per value, so the
+// user's own copy is deliberately not an input — a hand edit is not news, a
+// newer shipped template is. null when the template cannot be read.
+function shippedFingerprint({ cwd, templatePath } = {}) {
+  const effectiveCwd = cwd || process.cwd();
+  let tpl;
+  try { tpl = fs.readFileSync(templatePath || TEMPLATE_PATH); } catch { return null; }
+  return require('crypto').createHash('sha256')
+    .update(tpl).update('\0').update(buildBlock(detectProjectType(effectiveCwd)))
+    .digest('hex').slice(0, 16);
+}
+
 // 检测脚本是否从 Claude Code 插件 cache 运行。
 // 走 __dirname 而非 CLAUDE_PLUGIN_ROOT — 后者在多插件共存时会互相污染
 // （见 feedback_plugin_env_isolation.md）。
@@ -752,7 +765,7 @@ function maybeAutoAdopt({ cwd, home, env, scriptPath } = {}) {
   // name is kept: SessionStart, tests and the uninstall paths all call it.
   if (isAdopted({ cwd })) {
     if (env.CODE_GRAPH_NO_TEMPLATE_REFRESH !== '1' && needsRefresh({ cwd })) {
-      return { attempted: false, reason: 'stale', migrated };
+      return { attempted: false, reason: 'stale', fingerprint: shippedFingerprint({ cwd }), migrated };
     }
     return { attempted: false, reason: 'already-adopted', migrated };
   }
@@ -990,7 +1003,7 @@ if (require.main === module) {
 module.exports = {
   adopt, unadopt, memoryDir, formatResult, unadoptCommand, shellQuote, stripSentinelBlock,
   readAdoptedProjects, readAdoptedResult, recordAdopted, removeAdopted, adoptedRegistryFile,
-  isAdopted, isPluginModeInstall, maybeAutoAdopt, needsRefresh, isProjectRoot, adoptCommand,
+  isAdopted, isPluginModeInstall, maybeAutoAdopt, needsRefresh, shippedFingerprint, isProjectRoot, adoptCommand,
   detectProjectType, buildBlock, buildTriggerRows, migrateLegacyMemoryDir,
   claudeMdPath, detailDir, detailPath,
   extractCargoRuntimeDeps, extractPyRuntimeDeps, extractGoDirectRequires,

package/claude-plugin/scripts/recommendation-log.js

@@ -39,11 +39,11 @@ const O_NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
 // this is ever required from something long-lived.
 const warnedPaths = new Set();
 
-function warnNotOwned(p, why) {
+function warnNotOwned(p, why, what = 'adoption metrics') {
   if (warnedPaths.has(p)) return;
   warnedPaths.add(p);
   try {
-    process.stderr.write(`[code-graph] skipping adoption metrics: ${p} ${why}\n`);
+    process.stderr.write(`[code-graph] skipping ${what}: ${p} ${why}\n`);
   } catch {
     /* stderr closed → nothing to do */
   }
@@ -67,9 +67,10 @@ function warnNotOwned(p, why) {
  * @param {string} p    absolute path
  * @param {'file'|'dir'} kind
  * @param {fs.Stats} [known]  an lstat the caller already took, to avoid a second
+ * @param {string} [what]  what is skipped, for the diagnostic
  * @returns {boolean} true if `p` is safe to write
  */
-function isOwnedPath(p, kind, known) {
+function isOwnedPath(p, kind, known, what) {
   let st = known;
   if (!st) {
     try {
@@ -79,11 +80,11 @@ function isOwnedPath(p, kind, known) {
     }
   }
   if (st.isSymbolicLink()) {
-    warnNotOwned(p, 'is a symlink (following it would write outside the project)');
+    warnNotOwned(p, 'is a symlink (following it would write outside the project)', what);
     return false;
   }
   if (kind === 'dir' ? st.isDirectory() : st.isFile()) return true;
-  warnNotOwned(p, 'is not a regular file');
+  warnNotOwned(p, 'is not a regular file', what);
   return false;
 }
 
@@ -102,9 +103,10 @@ function isOwnedPath(p, kind, known) {
  *
  * Callers must NOT pass `O_TRUNC`: truncation would happen on the open, before
  * any of this could look. Truncate through the returned descriptor instead.
+ * @param {string} [what]  what is skipped, for the diagnostic
  * @returns {number|null} an open fd the caller must close, or null if refused
  */
-function openOwned(file, flags) {
+function openOwned(file, flags, what) {
   const fd = fs.openSync(file, flags | O_NOFOLLOW);
   let st;
   try {
@@ -114,12 +116,12 @@ function openOwned(file, flags) {
     throw e;
   }
   if (!st.isFile()) {
-    warnNotOwned(file, 'is not a regular file');
+    warnNotOwned(file, 'is not a regular file', what);
     fs.closeSync(fd);
     return null;
   }
   if (st.nlink > 1) {
-    warnNotOwned(file, 'has more than one hard link (the write would reach another path)');
+    warnNotOwned(file, 'has more than one hard link (the write would reach another path)', what);
     fs.closeSync(fd);
     return null;
   }
@@ -202,4 +204,4 @@ function recordRecommendation(cwd, event = {}) {
   }
 }
 
-module.exports = { recordRecommendation, REC_FILE };
+module.exports = { recordRecommendation, REC_FILE, isOwnedPath, openOwned };

package/claude-plugin/scripts/session-init.js

@@ -19,6 +19,7 @@ const { installHookFailOpen, remainingMs } = require('./hook-fail-open');
 // treats any throw as "nothing to conclude", so a lazy require in there would
 // turn a resolution failure into a silent disable (pre-tag review, JS-08).
 const { resolveProjectRoot } = require('./project-root');
+const { isOwnedPath, openOwned } = require('./recommendation-log');
 
 // ── SessionStart budget (audit 2026-09-05 NEW-05) ─────────────────────────
 //
@@ -565,6 +566,50 @@ function samePath(a, b) {
   return real(a) === real(b);
 }
 
+/**
+ * Whether to show the out-of-date-block notice in this project, recording it
+ * as shown. Once per shipped-template fingerprint: 0.164.0 showed it at every
+ * session start. Recorded in `.code-graph/` only when that directory already
+ * exists — creating it would put an unexcluded directory in `git status`, the
+ * side effect D3/D4 removed. Anything unrecordable (no fingerprint, no
+ * directory, a failed write) shows the notice: a failure must never silence it.
+ * `record: false` reads the record and never creates or writes it, for a
+ * session nobody attends.
+ */
+function staleNoticeDue(cwd, fingerprint, { record = true } = {}) {
+  if (!fingerprint) return true;
+  const dir = path.join(cwd, '.code-graph');
+  const marker = path.join(dir, 'stale-block-notice');
+  // `.code-graph/` is repo content: a clone can put a symlink or a hard link
+  // where the record goes (tar a FIFO), and a plain read or write follows it
+  // out of the project. Only a single-link regular file in a real directory is
+  // read or written — recommendation-log.js's guards; anything else is
+  // unrecordable.
+  const what = 'the stale-block notice record';
+  let dirStat;
+  try { dirStat = fs.lstatSync(dir); } catch { return true; }
+  if (!isOwnedPath(dir, 'dir', dirStat, what) || !isOwnedPath(marker, 'file', undefined, what)) return true;
+  let fd;
+  try {
+    fd = openOwned(marker,
+      (record ? fs.constants.O_RDWR | fs.constants.O_CREAT : fs.constants.O_RDONLY)
+        | (fs.constants.O_NONBLOCK || 0), what);
+  } catch { return true; }
+  if (fd === null) return true;
+  try {
+    // A read that fills the buffer (64 bytes or more) is not a record this
+    // plugin wrote, whatever its first bytes.
+    const buf = Buffer.alloc(64);
+    const n = fs.readSync(fd, buf, 0, buf.length, 0);
+    if (n < buf.length && buf.toString('utf8', 0, n).trim() === fingerprint) return false;
+    if (!record) return true;
+    fs.ftruncateSync(fd, 0);
+    fs.writeSync(fd, fingerprint + '\n', 0);
+  } catch { /* unrecorded: shown again next session */ }
+  finally { fs.closeSync(fd); }
+  return true;
+}
+
 function runSessionInit({ source } = {}) {
   // Fresh per run: this is module state, and the test suite calls this function
   // many times in one process. A carried-over array would report last run's
@@ -684,12 +729,19 @@ function runSessionInit({ source } = {}) {
       autoAdopt = { attempted: false, reason: 'threw', error: (e && e.message) || String(e) };
     }
   }
-  if (autoAdopt.reason === 'stale') {
+  // `claude -p` and SDK sessions run this hook too, and nobody reads their
+  // notice. Claude Code sets CLAUDE_CODE_SESSION_ATTENDED to '0' for them ('1'
+  // in the terminal UI, the IDE and desktop apps), so they read the record but
+  // never write it. Unset (an older Claude Code): recorded, as before.
+  const attended = process.env.CLAUDE_CODE_SESSION_ATTENDED !== '0';
+  if (autoAdopt.reason === 'stale'
+    && staleNoticeDue(process.cwd(), autoAdopt.fingerprint, { record: attended })) {
     notices.push(
       "[code-graph] This project's CLAUDE.md carries an out-of-date code-graph block.\n" +
       `            Refresh it: ${adoptCommand()}\n` +
       `            Remove it:  ${unadoptCommand()}\n` +
-      '            (SessionStart no longer edits CLAUDE.md itself; CODE_GRAPH_NO_TEMPLATE_REFRESH=1 silences this.)'
+      '            (Shown once per shipped template. SessionStart no longer edits CLAUDE.md itself;\n' +
+      '            CODE_GRAPH_NO_TEMPLATE_REFRESH=1 silences this.)'
     );
   }
 
@@ -855,7 +907,7 @@ module.exports = {
   injectProjectMap,
   verifyBinary, missingBinaryMessage, unadoptCommand,
   consistencyCheck,
-  runSessionInit,
+  runSessionInit, staleNoticeDue,
   computeQuietHooks,
   shouldInjectMap,
   hookFireWarning, checkHookFiring, analyzeHookDark, detectHookDark, // v0.67.0

package/claude-plugin/templates/code-graph-snapshot.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
       - name: Build snapshot
         run: |
-          npx -y -p @sdsrs/code-graph@0.164.0 code-graph-mcp snapshot create --out snapshot.db
+          npx -y -p @sdsrs/code-graph@0.165.1 code-graph-mcp snapshot create --out snapshot.db
           zstd -9 snapshot.db -o snapshot.db.zst
           mv snapshot.db.zst "code-graph-snapshot-${GITHUB_SHA:0:7}.db.zst"
       - name: Upload to release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.164.0",
+  "version": "0.165.1",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.164.0",
-    "@sdsrs/code-graph-linux-arm64": "0.164.0",
-    "@sdsrs/code-graph-darwin-x64": "0.164.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.164.0",
-    "@sdsrs/code-graph-win32-x64": "0.164.0"
+    "@sdsrs/code-graph-linux-x64": "0.165.1",
+    "@sdsrs/code-graph-linux-arm64": "0.165.1",
+    "@sdsrs/code-graph-darwin-x64": "0.165.1",
+    "@sdsrs/code-graph-darwin-arm64": "0.165.1",
+    "@sdsrs/code-graph-win32-x64": "0.165.1"
   }
 }