@sdsrs/code-graph 0.17.3 → 0.18.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.17.3",
+  "version": "0.18.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -38,6 +38,10 @@ function isSilentMode(argv = process.argv.slice(2), env = process.env) {
   return argv.includes('--silent') || env.CODE_GRAPH_AUTO_UPDATE_SILENT === '1';
 }
 
+function isInstallMissingMode(argv = process.argv.slice(2)) {
+  return argv.includes('--install-missing');
+}
+
 // ── Platform → GitHub release asset name mapping ──────────
 function getPlatformAssetName() {
   const platform = os.platform();
@@ -327,10 +331,12 @@ async function downloadAndInstall(latest) {
 
 // ── Main Entry ─────────────────────────────────────────────
 
-async function checkForUpdate() {
+async function checkForUpdate({ installMissing = false } = {}) {
   try {
-    // Skip in dev mode
-    if (isDevMode()) return null;
+    // Skip in dev mode — unless the launcher explicitly requested a missing-
+    // binary install, in which case we MUST proceed regardless of mode (the
+    // alternative is wedging the MCP server with no binary on disk).
+    if (!installMissing && isDevMode()) return null;
 
     const state = readState();
     // manifest.version is authoritative — /plugin update writes it directly and
@@ -414,23 +420,25 @@ async function checkForUpdate() {
 
 module.exports = {
   checkForUpdate, commandExists, isDevMode, readState, compareVersions,
-  getExtractedPluginVersion, readBinaryVersion, promoteVerifiedBinary, isSilentMode,
+  getExtractedPluginVersion, readBinaryVersion, promoteVerifiedBinary,
+  isSilentMode, isInstallMissingMode,
   requestJson, parseLatestRelease, fetchLatestRelease,
   downloadBinary, cachedBinaryPath,
 };
 
-// CLI: node auto-update.js [check|status]
+// CLI: node auto-update.js [check|status] [--silent] [--install-missing]
 if (require.main === module) {
   (async () => {
     const argv = process.argv.slice(2);
     const cmd = argv.find(arg => !arg.startsWith('--')) || 'check';
     const silent = isSilentMode(argv);
+    const installMissing = isInstallMissingMode(argv);
     if (cmd === 'status') {
       const state = readState();
       console.log(JSON.stringify(state, null, 2));
     } else {
       if (!silent) console.log('Checking for updates...');
-      const result = await checkForUpdate();
+      const result = await checkForUpdate({ installMissing });
       if (silent) return;
       if (result && result.updated) {
         console.log(`Updated: v${result.from} → v${result.to} (binary: ${result.binaryUpdated ? 'yes' : 'no'})`);
@@ -438,7 +446,7 @@ if (require.main === module) {
         console.log(`Update available: v${result.to} (auto-install failed)`);
       } else if (result && result.binaryUpdated) {
         console.log(`Repaired binary cache (v${result.to})`);
-      } else if (isDevMode()) {
+      } else if (!installMissing && isDevMode()) {
         console.log('Dev mode — auto-update skipped');
       } else {
         const manifest = readManifest();

package/claude-plugin/scripts/auto-update.test.js

@@ -14,6 +14,8 @@ const {
   promoteVerifiedBinary,
   cachedBinaryPath,
   downloadBinary,
+  isInstallMissingMode,
+  isSilentMode,
 } = require('./auto-update');
 
 function mkDir(t, prefix) {
@@ -113,6 +115,21 @@ test('downloadBinary returns false when latest is null', async () => {
   assert.equal(result, false);
 });
 
+// ── Flag parsing ───────────────────────────────────────────
+
+test('isInstallMissingMode detects --install-missing in argv', () => {
+  assert.equal(isInstallMissingMode(['--install-missing']), true);
+  assert.equal(isInstallMissingMode(['check', '--install-missing']), true);
+  assert.equal(isInstallMissingMode(['check']), false);
+  assert.equal(isInstallMissingMode([]), false);
+});
+
+test('isSilentMode honors --silent flag and CODE_GRAPH_AUTO_UPDATE_SILENT env', () => {
+  assert.equal(isSilentMode(['--silent'], {}), true);
+  assert.equal(isSilentMode([], { CODE_GRAPH_AUTO_UPDATE_SILENT: '1' }), true);
+  assert.equal(isSilentMode([], {}), false);
+});
+
 test('fetchLatestRelease parses JSON without relying on global fetch', async () => {
   const latest = await fetchLatestRelease(async () => ({
     statusCode: 200,

package/claude-plugin/scripts/mcp-launcher.js

@@ -7,7 +7,7 @@
  * Used by .mcp.json so the plugin controls binary discovery instead of
  * relying on the binary being in PATH.
  */
-const { spawn, execFileSync } = require('child_process');
+const { spawn, spawnSync } = require('child_process');
 const path = require('path');
 const fs = require('fs');
 
@@ -28,42 +28,69 @@ if (!binary) {
   } catch { /* use latest */ }
 
   process.stderr.write(`[code-graph] Binary not found, installing @sdsrs/code-graph@${version}...\n`);
-  try {
-    execFileSync('npm', ['install', '-g', `@sdsrs/code-graph@${version}`], {
-      timeout: 60000, stdio: 'pipe',
-    });
+  const npmResult = spawnSync('npm', ['install', '-g', `@sdsrs/code-graph@${version}`], {
+    timeout: 60000, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8',
+  });
+  if (npmResult.error || npmResult.status !== 0) {
+    process.stderr.write('[code-graph] npm install failed.\n');
+    if (npmResult.stderr) {
+      process.stderr.write(npmResult.stderr.trim().split('\n').map(l => `[code-graph][npm] ${l}\n`).join(''));
+    }
+  } else {
     clearCache();
     binary = findBinary();
     if (binary) {
       process.stderr.write(`[code-graph] Installed at ${binary}\n`);
     }
-  } catch {
-    process.stderr.write('[code-graph] npm install failed.\n');
   }
 }
 
 // Fallback: npm install may have succeeded but optionalDependencies for the
 // platform binary can fail silently (npm tolerates OS-mismatch + flaky
 // registry). Pull the platform binary directly from the GitHub release.
+//
+// --install-missing bypasses auto-update.js's isDevMode() short-circuit. The
+// marketplace ships the full repo (including Cargo.toml at the workspace root),
+// so dev-mode heuristics that look for Cargo.toml were misclassifying every
+// marketplace install as dev mode and skipping this fallback (issue #12).
 if (!binary) {
   process.stderr.write('[code-graph] Falling back to GitHub release download...\n');
-  try {
-    execFileSync(process.execPath, [path.join(__dirname, 'auto-update.js'), '--silent'], {
-      timeout: 90000, stdio: 'pipe',
-    });
-    clearCache();
-    binary = findBinary();
-    if (binary) {
-      process.stderr.write(`[code-graph] Installed at ${binary}\n`);
-    }
-  } catch { /* fall through to manual-install message */ }
+  const result = spawnSync(
+    process.execPath,
+    [path.join(__dirname, 'auto-update.js'), '--silent', '--install-missing'],
+    { timeout: 90000, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' }
+  );
+  if (result.stderr && result.stderr.trim()) {
+    process.stderr.write(result.stderr.trim().split('\n').map(l => `[code-graph][auto-update] ${l}\n`).join(''));
+  }
+  if (result.error) {
+    process.stderr.write(`[code-graph] auto-update spawn failed: ${result.error.message}\n`);
+  } else if (result.status !== 0) {
+    process.stderr.write(`[code-graph] auto-update exited with status ${result.status}\n`);
+  }
+  clearCache();
+  binary = findBinary();
+  if (binary) {
+    process.stderr.write(`[code-graph] Installed at ${binary}\n`);
+  }
 }
 
 if (!binary) {
+  const installedViaMarketplace = fs.existsSync(
+    path.join(__dirname, '..', '.claude-plugin', 'plugin.json')
+  );
+  process.stderr.write('[code-graph] Binary not found. Install manually:\n');
+  if (installedViaMarketplace) {
+    process.stderr.write(
+      '  # Re-install the plugin via Claude Code marketplace:\n' +
+      '  /plugin uninstall code-graph-mcp && /plugin install code-graph-mcp@code-graph-mcp\n' +
+      '  # Or install the binary directly via npm:\n'
+    );
+  }
   process.stderr.write(
-    '[code-graph] Binary not found. Install manually:\n' +
+    '  npm install -g @sdsrs/code-graph @sdsrs/code-graph-' + process.platform + '-' + process.arch + '\n' +
+    '  # or, equivalent split form:\n' +
     '  npm install -g @sdsrs/code-graph\n' +
-    '  # or\n' +
     '  npm install -g @sdsrs/code-graph-' + process.platform + '-' + process.arch + '\n'
   );
   process.exit(1);

package/claude-plugin/scripts/version-utils.js

@@ -18,13 +18,22 @@ function readBinaryVersion(binaryPath) {
   }
 }
 
-function isDevMode() {
-  // Always derive from __dirname — CLAUDE_PLUGIN_ROOT can leak from other plugins
-  const pluginRoot = path.resolve(__dirname, '..');
-  // Dev mode: running from source repo (has Cargo.toml nearby)
-  if (fs.existsSync(path.join(pluginRoot, '..', 'Cargo.toml'))) return true;
-  // Dev mode: plugin root is a symlink
+function isDevMode(pluginRoot = path.resolve(__dirname, '..')) {
+  // Explicit opt-in always wins (also lets users force dev mode in any layout)
+  if (process.env.CODE_GRAPH_DEV === '1') return true;
+  // Plugin root is a symlink (e.g. `npm link`)
   try { if (fs.lstatSync(pluginRoot).isSymbolicLink()) return true; } catch { /* ok */ }
+  // Source repo: Cargo.toml AND target/ at parent. Marketplace installs ship
+  // Cargo.toml (git-tracked) but NOT target/ (gitignored), so target/ is the
+  // discriminator — without it, a marketplace clone was being misclassified as
+  // dev mode and the launcher's GitHub-release fallback was unreachable
+  // (see GitHub issue #12). If a dev hasn't built yet, they fall through to
+  // the user-mode auto-install path, which still produces a working binary.
+  const parent = path.dirname(pluginRoot);
+  if (fs.existsSync(path.join(parent, 'Cargo.toml')) &&
+      fs.existsSync(path.join(parent, 'target'))) {
+    return true;
+  }
   return false;
 }
 

package/claude-plugin/scripts/version-utils.test.js

@@ -45,10 +45,66 @@ test('readBinaryVersion returns null for binary with unexpected output', (t) =>
 
 // ── isDevMode ──
 
-test('isDevMode returns true in source repo (Cargo.toml nearby)', () => {
+function makeFakePluginRoot(t, { withCargo = false, withTarget = false, asSymlink = false } = {}) {
+  const parent = mkDir(t, 'vu-dev-');
+  const pluginRoot = path.join(parent, 'claude-plugin');
+  fs.mkdirSync(pluginRoot, { recursive: true });
+  if (withCargo) fs.writeFileSync(path.join(parent, 'Cargo.toml'), '[package]\nname = "x"\n');
+  if (withTarget) fs.mkdirSync(path.join(parent, 'target'), { recursive: true });
+
+  if (asSymlink) {
+    const real = path.join(parent, 'real-plugin');
+    fs.mkdirSync(real, { recursive: true });
+    fs.rmSync(pluginRoot, { recursive: true, force: true });
+    fs.symlinkSync(real, pluginRoot);
+  }
+  return pluginRoot;
+}
+
+function withEnv(t, key, value) {
+  const original = process.env[key];
+  if (value === undefined) delete process.env[key]; else process.env[key] = value;
+  t.after(() => {
+    if (original === undefined) delete process.env[key]; else process.env[key] = original;
+  });
+}
+
+test('isDevMode returns true in source repo when Cargo.toml AND target/ both exist', (t) => {
+  const { isDevMode } = require('./version-utils');
+  withEnv(t, 'CODE_GRAPH_DEV', undefined);
+  const pluginRoot = makeFakePluginRoot(t, { withCargo: true, withTarget: true });
+  assert.equal(isDevMode(pluginRoot), true);
+});
+
+test('isDevMode returns false for marketplace clone (Cargo.toml without target/)', (t) => {
+  const { isDevMode } = require('./version-utils');
+  withEnv(t, 'CODE_GRAPH_DEV', undefined);
+  // Marketplace clones the full repo (Cargo.toml is git-tracked) but `target/`
+  // is gitignored, so a fresh marketplace install has no target/. This is the
+  // exact misclassification fixed for issue #12.
+  const pluginRoot = makeFakePluginRoot(t, { withCargo: true, withTarget: false });
+  assert.equal(isDevMode(pluginRoot), false);
+});
+
+test('isDevMode returns false for fully unrelated install (no Cargo.toml, no target/)', (t) => {
+  const { isDevMode } = require('./version-utils');
+  withEnv(t, 'CODE_GRAPH_DEV', undefined);
+  const pluginRoot = makeFakePluginRoot(t);
+  assert.equal(isDevMode(pluginRoot), false);
+});
+
+test('isDevMode honors CODE_GRAPH_DEV=1 even when neither Cargo.toml nor target/ exist', (t) => {
+  const { isDevMode } = require('./version-utils');
+  withEnv(t, 'CODE_GRAPH_DEV', '1');
+  const pluginRoot = makeFakePluginRoot(t);
+  assert.equal(isDevMode(pluginRoot), true);
+});
+
+test('isDevMode returns true when plugin root is a symlink', (t) => {
   const { isDevMode } = require('./version-utils');
-  // Running from source repo: __dirname/../.. has Cargo.toml → true
-  assert.equal(isDevMode(), true);
+  withEnv(t, 'CODE_GRAPH_DEV', undefined);
+  const pluginRoot = makeFakePluginRoot(t, { asSymlink: true });
+  assert.equal(isDevMode(pluginRoot), true);
 });
 
 // ── getNewestMtime ──

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.17.3",
+  "version": "0.18.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.17.3",
-    "@sdsrs/code-graph-linux-arm64": "0.17.3",
-    "@sdsrs/code-graph-darwin-x64": "0.17.3",
-    "@sdsrs/code-graph-darwin-arm64": "0.17.3",
-    "@sdsrs/code-graph-win32-x64": "0.17.3"
+    "@sdsrs/code-graph-linux-x64": "0.18.0",
+    "@sdsrs/code-graph-linux-arm64": "0.18.0",
+    "@sdsrs/code-graph-darwin-x64": "0.18.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.18.0",
+    "@sdsrs/code-graph-win32-x64": "0.18.0"
   }
 }