@sdsrs/code-graph 0.19.0 → 0.21.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.19.0",
+  "version": "0.21.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/adopt.js

@@ -28,12 +28,234 @@ function readAdoptedBy(filePath) {
 // line is a structural fix, not a signal change. Decision table lives in the
 // linked plugin_code_graph_mcp.md; this line is the router. Tag syntax
 // `[tag1, tag2]` per spec for explicit keyword matching.
+//
+// Generic default — used when no project-type markers detected (e.g. /tmp,
+// scratch dirs, mixed repos). Per-type variants live in `buildIndexLine` and
+// are computed per-cwd at adopt + needsRefresh time. Adopted-project receives
+// the typed variant; everyone else falls back to this canonical line.
 const INDEX_LINE =
   '- [code-graph-mcp](plugin_code_graph_mcp.md) ' +
   '[impact, callgraph, refs, overview, semantic, ast-search, dead-code, similar, deps, trace] — ' +
   '改 X 影响面/谁调用 X/X 被谁用/看 X 源码/Y 模块长啥样/概念查询 优先于 Grep；字面匹配走 Grep。' +
   '核心 7（get_call_graph/module_overview/semantic_code_search/ast_search/find_references/get_ast_node/project_map）' +
   '+ 进阶 5（impact_analysis/trace_http_chain/dependency_graph/find_similar_code/find_dead_code），决策表见全文';
+
+// memdir L1 升格 (per sdscc 重构方案 §5.0): the INDEX_LINE that lands in
+// MEMORY.md is what Claude sees first on every keyword match. Tailoring it
+// per project type primes the right tools and demotes the irrelevant ones —
+// e.g. a Rust CLI never benefits from `trace_http_chain` priming, and a React
+// frontend cares more about `find_references` for rename audits than `impact`.
+//
+// Detection is cheap substring-on-marker (no AST, no graph): the cost is one
+// fs.readFileSync per cwd. Failure mode is silent fall-back to 'generic' —
+// false-negatives are strictly safer than false-positives that promote the
+// wrong tool.
+function readFileQuiet(p) {
+  try { return fs.readFileSync(p, 'utf8'); } catch { return ''; }
+}
+
+// Valid project type buckets — also serves as the allow-list for
+// `CODE_GRAPH_PROJECT_TYPE` env override. Anything not in this set falls back
+// to file-based detection (so a typo'd env var does not silently break).
+const PROJECT_TYPES = new Set([
+  'rust', 'web-rs', 'web-node', 'web-py', 'web-go',
+  'frontend', 'python', 'go', 'node', 'generic',
+]);
+
+// Cargo.toml: strip `# ...` comment lines (line-leading or trailing). Then
+// extract the contents of the [dependencies] section only — dev/build/target
+// deps don't characterize the project's runtime web-vs-cli posture.
+//
+// Why a state machine and not a TOML parser: we have zero deps and don't
+// want to add one for a coarse classification. This handles the >95% case
+// (well-formed [dependencies] block); pathological TOML (e.g. inline-table
+// dependencies) falls through to false-negative `rust` which is safer than
+// false-positive `web-rs`.
+function extractCargoRuntimeDeps(cargo) {
+  const lines = cargo.split(/\r?\n/);
+  const out = [];
+  let inDeps = false;
+  for (const raw of lines) {
+    // Strip `# comment` (line-leading or trailing). Inside string literals
+    // `#` is rare in Cargo dep specs; accept the false-strip risk.
+    const line = raw.replace(/(^|\s)#.*$/, '$1').trim();
+    if (line.startsWith('[')) {
+      // New section heading — only `[dependencies]` (canonical, exact match)
+      // gates web-framework detection. `[dev-dependencies]`,
+      // `[build-dependencies]`, `[target.'...'.dependencies]` deliberately
+      // skipped: a project that pulls in axum only for tests is not a web
+      // project for routing purposes.
+      inDeps = (line === '[dependencies]');
+      continue;
+    }
+    if (inDeps && line) out.push(line);
+  }
+  return out.join('\n');
+}
+
+// pyproject.toml: same pattern as Cargo.toml — strip comments, scan only
+// [tool.poetry.dependencies] (Poetry) or [project.dependencies] (PEP 621).
+function extractPyRuntimeDeps(pyproj) {
+  const lines = pyproj.split(/\r?\n/);
+  const out = [];
+  let inDeps = false;
+  for (const raw of lines) {
+    const line = raw.replace(/(^|\s)#.*$/, '$1').trim();
+    if (line.startsWith('[')) {
+      inDeps = (
+        line === '[tool.poetry.dependencies]' ||
+        line === '[project.dependencies]' ||
+        line === '[project]'  // PEP 621 inline `dependencies = [...]` lives here
+      );
+      continue;
+    }
+    if (inDeps && line) out.push(line);
+  }
+  return out.join('\n');
+}
+
+// go.mod: skip `// indirect` lines (transitive deps) and `// comment` lines.
+// Direct require blocks are what matter for "is this a web service?" — a
+// project that transitively pulls gin via a CLI dep is still a CLI.
+function extractGoDirectRequires(gomod) {
+  const lines = gomod.split(/\r?\n/);
+  const out = [];
+  let inRequire = false;
+  for (const raw of lines) {
+    const trimmed = raw.trim();
+    if (trimmed.startsWith('//')) continue;       // pure comment line
+    if (/\/\/\s*indirect\b/.test(raw)) continue;  // indirect dep marker
+    if (trimmed === 'require (') { inRequire = true; continue; }
+    if (inRequire && trimmed === ')') { inRequire = false; continue; }
+    if (trimmed.startsWith('require ')) out.push(trimmed.slice(8).trim());
+    else if (inRequire && trimmed) out.push(trimmed);
+  }
+  return out.join('\n');
+}
+
+function detectProjectType(cwd = process.cwd(), env = process.env) {
+  // 2D: env override beats file-based detection. Honors only valid bucket
+  // names; invalid override silently falls through to detection (avoids a
+  // typo'd env var silently classifying everything as 'generic'). Power
+  // users / CI can pin without touching the heuristics.
+  const override = env && env.CODE_GRAPH_PROJECT_TYPE;
+  if (override && PROJECT_TYPES.has(override)) {
+    return override;
+  }
+
+  const cargo = readFileQuiet(path.join(cwd, 'Cargo.toml'));
+  if (cargo) {
+    const deps = extractCargoRuntimeDeps(cargo);
+    // Web-framework detection: match on the dep name token (start-of-line
+    // or after whitespace/quote) to avoid hits inside path strings or
+    // unrelated metadata. `hyper` deliberately omitted from web-rs — it is
+    // also commonly used as a plain HTTP client in CLI tools (false-positive
+    // risk too high). axum/actix-web/etc. are unambiguous server stacks.
+    if (/^(actix-web|axum|rocket|warp|poem|tide|salvo)\s*=/m.test(deps)) {
+      return 'web-rs';
+    }
+    return 'rust';
+  }
+
+  const pkgRaw = readFileQuiet(path.join(cwd, 'package.json'));
+  if (pkgRaw) {
+    let pkg = null;
+    try { pkg = JSON.parse(pkgRaw); } catch { /* malformed → fall through */ }
+    if (pkg && typeof pkg === 'object') {
+      // Only `dependencies` matters — devDependencies are build/test only,
+      // and a project with `react` only in devDependencies is likely a
+      // component library, not a frontend app.
+      const deps = pkg.dependencies && typeof pkg.dependencies === 'object'
+        ? Object.keys(pkg.dependencies)
+        : [];
+      const has = (name) => deps.includes(name);
+      if (has('next') || has('react') || has('vue') || has('svelte') ||
+          has('@angular/core') || has('nuxt') || has('astro') ||
+          has('remix') || has('solid-js')) {
+        return 'frontend';
+      }
+      if (has('express') || has('fastify') || has('koa') || has('hono') ||
+          has('@nestjs/core') || has('@hapi/hapi')) {
+        return 'web-node';
+      }
+    }
+    return 'node';
+  }
+
+  const pyproj = readFileQuiet(path.join(cwd, 'pyproject.toml'));
+  if (pyproj) {
+    const deps = extractPyRuntimeDeps(pyproj);
+    if (/\b(django|flask|fastapi|starlette|sanic|tornado|quart)\b/i.test(deps)) {
+      return 'web-py';
+    }
+    return 'python';
+  }
+  // requirements.txt fallback: line-format `pkg==ver` / `pkg>=ver`. Strip
+  // `#` comment lines; scan remaining as a flat list (no section headers
+  // in this format).
+  const reqs = readFileQuiet(path.join(cwd, 'requirements.txt'));
+  if (reqs) {
+    const cleaned = reqs.split(/\r?\n/)
+      .map(l => l.replace(/(^|\s)#.*$/, '$1').trim())
+      .filter(Boolean)
+      .join('\n');
+    if (/^(django|flask|fastapi|starlette|sanic|tornado|quart)\b/im.test(cleaned)) {
+      return 'web-py';
+    }
+    return 'python';
+  }
+
+  const gomod = readFileQuiet(path.join(cwd, 'go.mod'));
+  if (gomod) {
+    const direct = extractGoDirectRequires(gomod);
+    if (/\b(gin-gonic|labstack\/echo|gofiber|go-chi|gorilla\/mux)\b/.test(direct)) {
+      return 'web-go';
+    }
+    return 'go';
+  }
+  return 'generic';
+}
+
+// Build the MEMORY.md index line for a project type. The 'generic' bucket
+// returns the canonical INDEX_LINE so untyped projects (and the existing
+// adopt.test.js fixtures, which use empty tmp dirs) stay byte-identical.
+//
+// For typed projects, the difference from generic is the tag set + the lead
+// sentence — body of plugin_code_graph_mcp.md is unchanged. Decision table
+// stays one source of truth; the index line just primes which subset matters
+// most for THIS project.
+function buildIndexLine(projectType = 'generic') {
+  const prefix = '- [code-graph-mcp](plugin_code_graph_mcp.md) ';
+  const coreSuffix =
+    '核心 7（get_call_graph/module_overview/semantic_code_search/ast_search/find_references/get_ast_node/project_map）' +
+    '+ 进阶 5（impact_analysis/trace_http_chain/dependency_graph/find_similar_code/find_dead_code），决策表见全文';
+  switch (projectType) {
+    case 'web-rs':
+    case 'web-node':
+    case 'web-py':
+    case 'web-go':
+      return prefix +
+        '[trace, route, callgraph, impact, refs, overview, semantic, deps] — ' +
+        'HTTP 路由→handler 链路用 trace_http_chain（或 get_call_graph route_path=）；改 handler 影响面用 impact；' +
+        '其他结构化查询同上 优先于 Grep。' + coreSuffix;
+    case 'frontend':
+      return prefix +
+        '[refs, overview, semantic, callgraph, impact, ast-search] — ' +
+        '组件重命名/重构用 find_references（含 imports/inherits）；模块层级用 module_overview；' +
+        '改 props/接口前用 impact 看下游；HTTP route 通常不适用。' + coreSuffix;
+    case 'rust':
+    case 'go':
+    case 'python':
+    case 'node':
+      return prefix +
+        '[callgraph, impact, refs, overview, semantic, ast-search, dead-code, deps] — ' +
+        '改 X 影响面/谁调用 X/Y 模块 优先于 Grep；HTTP route 追踪通常不适用（无 web 框架）；' +
+        '字面匹配走 Grep。' + coreSuffix;
+    case 'generic':
+    default:
+      return INDEX_LINE;
+  }
+}
 const TEMPLATE_PATH = path.resolve(__dirname, '..', 'templates', 'plugin_code_graph_mcp.md');
 const TARGET_NAME = 'plugin_code_graph_mcp.md';
 
@@ -126,7 +348,11 @@ function adopt({ cwd, home, templatePath } = {}) {
 
   const indexPath = path.join(dir, 'MEMORY.md');
   const index = fs.existsSync(indexPath) ? fs.readFileSync(indexPath, 'utf8') : '# Memory Index\n';
-  const desiredBlock = `${SENTINEL_BEGIN}\n${INDEX_LINE}\n${SENTINEL_END}`;
+  // Per-project index line: tagged tools + lead sentence tailored to the
+  // detected project type. Falls back to the canonical INDEX_LINE for
+  // generic / untyped cwds (preserves byte-identity with prior versions).
+  const indexLine = buildIndexLine(detectProjectType(effectiveCwd));
+  const desiredBlock = `${SENTINEL_BEGIN}\n${indexLine}\n${SENTINEL_END}`;
 
   // Already-adopted-and-well-formed: skip the write entirely.
   if (index.includes(desiredBlock)) {
@@ -175,7 +401,13 @@ function needsRefresh({ cwd, home, templatePath } = {}) {
   }
   if (!shipped.equals(body)) return true;
   const index = fs.readFileSync(indexPath, 'utf8');
-  const desiredBlock = `${SENTINEL_BEGIN}\n${INDEX_LINE}\n${SENTINEL_END}`;
+  // Compare against the typed INDEX_LINE for this project. Detection is
+  // deterministic (file-existence + substring scan) so adopt and needsRefresh
+  // always agree on the variant. Drift triggers refresh — including when a
+  // project gains a web framework dep and switches type bucket.
+  const effectiveCwd = cwd || process.cwd();
+  const indexLine = buildIndexLine(detectProjectType(effectiveCwd));
+  const desiredBlock = `${SENTINEL_BEGIN}\n${indexLine}\n${SENTINEL_END}`;
   return !index.includes(desiredBlock);
 }
 
@@ -294,6 +526,8 @@ if (require.main === module) {
 module.exports = {
   adopt, unadopt, memoryDir, formatResult, stripSentinelBlock,
   isAdopted, isPluginModeInstall, maybeAutoAdopt, needsRefresh, isProjectRoot,
+  detectProjectType, buildIndexLine,
+  extractCargoRuntimeDeps, extractPyRuntimeDeps, extractGoDirectRequires,
   SENTINEL_BEGIN, SENTINEL_END, INDEX_LINE, TEMPLATE_PATH, TARGET_NAME,
-  PROJECT_MARKERS,
+  PROJECT_MARKERS, PROJECT_TYPES,
 };

package/claude-plugin/scripts/adopt.test.js

@@ -7,6 +7,7 @@ const os = require('os');
 const {
   adopt, unadopt, memoryDir, stripSentinelBlock,
   isAdopted, isPluginModeInstall, maybeAutoAdopt, needsRefresh, isProjectRoot,
+  detectProjectType, buildIndexLine,
   SENTINEL_BEGIN, SENTINEL_END, INDEX_LINE, TEMPLATE_PATH, TARGET_NAME,
   PROJECT_MARKERS,
 } = require('./adopt');
@@ -585,3 +586,234 @@ test('needsRefresh ignores the adopted-by marker when bytewise comparing', () =>
       'needsRefresh should be false right after adopt — marker must not trigger drift');
   } finally { sb.cleanup(); }
 });
+
+// memdir L1 升格 — project-typed INDEX_LINE coverage.
+
+test('detectProjectType returns generic for an empty cwd', () => {
+  const sb = makeSandbox();
+  try {
+    assert.strictEqual(detectProjectType(sb.cwd), 'generic');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType returns rust for a Cargo.toml without web framework', () => {
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'), '[package]\nname="x"\n[dependencies]\nserde="1"\n');
+    assert.strictEqual(detectProjectType(sb.cwd), 'rust');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType returns web-rs when Cargo.toml has axum/actix/etc', () => {
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'), '[dependencies]\naxum = "0.7"\n');
+    assert.strictEqual(detectProjectType(sb.cwd), 'web-rs');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType returns frontend for package.json with React/Next/Vue', () => {
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'package.json'),
+      '{"dependencies":{"next":"^14","react":"^18"}}');
+    assert.strictEqual(detectProjectType(sb.cwd), 'frontend');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType returns web-node for package.json with express/fastify', () => {
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'package.json'),
+      '{"dependencies":{"express":"^4"}}');
+    assert.strictEqual(detectProjectType(sb.cwd), 'web-node');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType returns web-py for FastAPI in pyproject.toml', () => {
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'pyproject.toml'),
+      '[tool.poetry.dependencies]\nfastapi = "^0.115"\n');
+    assert.strictEqual(detectProjectType(sb.cwd), 'web-py');
+  } finally { sb.cleanup(); }
+});
+
+test('buildIndexLine generic returns the canonical INDEX_LINE byte-for-byte', () => {
+  // Critical: keeps backward compatibility with adopted projects that have no
+  // markers. Any drift here invalidates needsRefresh's idempotency assumption.
+  assert.strictEqual(buildIndexLine('generic'), INDEX_LINE);
+  assert.strictEqual(buildIndexLine(undefined), INDEX_LINE);
+});
+
+test('buildIndexLine web-rs prepends route/trace tags + handler-focused lead', () => {
+  const line = buildIndexLine('web-rs');
+  assert.match(line, /\[trace, route,/, 'web-rs index line should lead with trace/route tags');
+  assert.match(line, /HTTP 路由/, 'lead sentence should mention HTTP routes');
+});
+
+test('buildIndexLine frontend emphasizes refs/overview, drops HTTP route priming', () => {
+  const line = buildIndexLine('frontend');
+  assert.match(line, /组件重命名|find_references/, 'frontend should mention rename audit / refs');
+  assert.match(line, /HTTP route 通常不适用/, 'frontend should explicitly demote HTTP route tracing');
+});
+
+test('adopt + needsRefresh agree on typed INDEX_LINE — no spurious refresh in a Rust project', () => {
+  // The detection function is deterministic + adopt and needsRefresh both call
+  // it; together they must produce a consistent indexLine, otherwise every
+  // SessionStart triggers a rewrite.
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'), '[package]\nname="x"\n');
+    adopt({ cwd: sb.cwd, home: sb.home });
+    assert.strictEqual(needsRefresh({ cwd: sb.cwd, home: sb.home }), false,
+      'needsRefresh must be false right after adopt for a Rust project');
+    const indexPath = path.join(sb.dir, 'MEMORY.md');
+    const index = fs.readFileSync(indexPath, 'utf8');
+    assert.ok(index.includes('优先于 Grep'),
+      'MEMORY.md should contain the rust-typed index line');
+  } finally { sb.cleanup(); }
+});
+
+// 2A — false-positive hardening: comment-strip + section-aware scan.
+
+test('detectProjectType ignores commented-out web-framework deps in Cargo.toml', () => {
+  // Pre-fix: `# axum = "0.7"` substring-matched and falsely promoted to web-rs.
+  // Post-fix: comment stripping happens before section scan.
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'),
+      '[package]\nname="x"\n[dependencies]\n# axum = "0.7"  # disabled, was for prototype\nserde = "1"\n');
+    assert.strictEqual(detectProjectType(sb.cwd), 'rust',
+      'commented dep must not promote to web-rs');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType ignores axum in [dev-dependencies] only', () => {
+  // axum used solely for tests does not make this a web project.
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'),
+      '[package]\nname="x"\n[dependencies]\nserde = "1"\n[dev-dependencies]\naxum = "0.7"\n');
+    assert.strictEqual(detectProjectType(sb.cwd), 'rust',
+      'axum in dev-dependencies must not promote to web-rs');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType ignores axum in [build-dependencies] only', () => {
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'),
+      '[package]\nname="x"\n[dependencies]\nserde = "1"\n[build-dependencies]\naxum = "0.7"\n');
+    assert.strictEqual(detectProjectType(sb.cwd), 'rust',
+      'axum in build-dependencies must not promote to web-rs');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType ignores react in devDependencies of package.json', () => {
+  // A library that lists react in devDependencies for testing should not
+  // be classified as a frontend app.
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'package.json'),
+      JSON.stringify({
+        dependencies: { lodash: '^4' },
+        devDependencies: { react: '^18', 'react-dom': '^18' },
+      }));
+    assert.strictEqual(detectProjectType(sb.cwd), 'node',
+      'react in devDependencies must not promote to frontend');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType ignores // indirect deps in go.mod', () => {
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'go.mod'),
+      'module example.com/x\n\nrequire (\n\tgithub.com/some/cli v1.0.0\n\tgithub.com/gin-gonic/gin v1.9.0 // indirect\n)\n');
+    assert.strictEqual(detectProjectType(sb.cwd), 'go',
+      'indirect gin must not promote to web-go');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType handles malformed package.json without throwing', () => {
+  // JSON.parse failure must not crash detection; falls back to 'node' since
+  // package.json exists but is unreadable.
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'package.json'), '{not valid json');
+    assert.strictEqual(detectProjectType(sb.cwd), 'node',
+      'malformed package.json should fall back to node bucket');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType detects PEP 621 [project] dependencies block', () => {
+  // PEP 621 puts `dependencies = [...]` inside [project], not a separate
+  // [project.dependencies] section — our state machine accepts both.
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'pyproject.toml'),
+      '[project]\nname = "x"\ndependencies = ["fastapi>=0.115", "uvicorn"]\n');
+    assert.strictEqual(detectProjectType(sb.cwd), 'web-py');
+  } finally { sb.cleanup(); }
+});
+
+test('detectProjectType reads requirements.txt as fallback', () => {
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'requirements.txt'),
+      '# web stack\nflask>=3.0\ngunicorn\n');
+    assert.strictEqual(detectProjectType(sb.cwd), 'web-py');
+  } finally { sb.cleanup(); }
+});
+
+// 2D — env override.
+
+test('CODE_GRAPH_PROJECT_TYPE env override beats file-based detection', () => {
+  const sb = makeSandbox();
+  try {
+    // Cargo.toml says rust — env says web-rs. Env wins.
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'), '[package]\nname="x"\n');
+    assert.strictEqual(
+      detectProjectType(sb.cwd, { CODE_GRAPH_PROJECT_TYPE: 'web-rs' }),
+      'web-rs',
+    );
+  } finally { sb.cleanup(); }
+});
+
+test('CODE_GRAPH_PROJECT_TYPE env override falls through on invalid value', () => {
+  // Typo'd / unknown bucket name should not silently classify everything as
+  // 'generic' — fall through to file-based detection so the project still
+  // gets a meaningful index line.
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'), '[package]\nname="x"\n');
+    assert.strictEqual(
+      detectProjectType(sb.cwd, { CODE_GRAPH_PROJECT_TYPE: 'web-rust' /* typo */ }),
+      'rust',
+      'invalid override must fall through to file detection',
+    );
+  } finally { sb.cleanup(); }
+});
+
+test('CODE_GRAPH_PROJECT_TYPE env override unset uses file detection', () => {
+  // Empty env reaches file-based detection unchanged.
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'), '[package]\nname="x"\n');
+    assert.strictEqual(detectProjectType(sb.cwd, {}), 'rust');
+  } finally { sb.cleanup(); }
+});
+
+test('CODE_GRAPH_PROJECT_TYPE env override forces generic in a Rust project', () => {
+  // Power-user case: explicit opt-out of typed routing for a project that
+  // would otherwise be auto-classified.
+  const sb = makeSandbox();
+  try {
+    fs.writeFileSync(path.join(sb.cwd, 'Cargo.toml'),
+      '[package]\nname="x"\n[dependencies]\naxum = "0.7"\n');
+    assert.strictEqual(
+      detectProjectType(sb.cwd, { CODE_GRAPH_PROJECT_TYPE: 'generic' }),
+      'generic',
+    );
+  } finally { sb.cleanup(); }
+});

package/claude-plugin/scripts/incremental-index.js

@@ -3,12 +3,41 @@
 const { execFileSync } = require('child_process');
 const { findBinary } = require('./find-binary');
 
-const bin = findBinary();
-if (!bin) process.exit(0); // silent — binary not installed yet
-
-try {
-  execFileSync(bin, ['incremental-index', '--quiet'], {
-    timeout: 8000,
-    stdio: ['pipe', 'pipe', 'pipe']
-  });
-} catch { /* timeout or error — silent for hook */ }
+// v0.21 — gated default-off. v0.18.0 added query-time freshness
+// (ensure_file_indexed) inside MCP tools that take a file_path arg, so a
+// PostToolUse hook spawning a fresh process on every Edit/Write was redundant
+// for the MCP-driven workflow and just burnt ~80ms cold-start per edit.
+//
+// CLI-only workflows (running `code-graph-mcp search` after Bash-side edits
+// without going through MCP) need the hook to keep the DB fresh, so the knob
+// lets users opt back in.
+//
+// Priority (high → low):
+//   1. CODE_GRAPH_HOOK_INDEX=on  → run the hook (opt-in)
+//   2. CODE_GRAPH_HOOK_INDEX=off → skip
+//   3. default                   → skip (v0.21 flip)
+function shouldRun(env = process.env) {
+  const v = (env.CODE_GRAPH_HOOK_INDEX || '').toLowerCase();
+  if (v === 'on' || v === '1' || v === 'true') return true;
+  return false;
+}
+
+function runMain() {
+  if (!shouldRun()) return;
+
+  const bin = findBinary();
+  if (!bin) return; // silent — binary not installed yet
+
+  try {
+    execFileSync(bin, ['incremental-index', '--quiet'], {
+      timeout: 8000,
+      stdio: ['pipe', 'pipe', 'pipe']
+    });
+  } catch { /* timeout or error — silent for hook */ }
+}
+
+if (require.main === module) {
+  runMain();
+}
+
+module.exports = { shouldRun };

package/claude-plugin/scripts/incremental-index.test.js

@@ -7,6 +7,61 @@ const os = require('os');
 const { spawnSync } = require('child_process');
 
 const { findBinary } = require('./find-binary');
+const { shouldRun } = require('./incremental-index');
+
+// ── shouldRun gate (v0.21 opt-in flip) ──────────────────
+
+test('shouldRun: default (no env) is OFF', () => {
+  // v0.21: hook-driven incremental-index is opt-in. Rely on
+  // ensure_file_indexed query-time freshness for MCP workflows.
+  assert.equal(shouldRun({}), false);
+});
+
+test('shouldRun: CODE_GRAPH_HOOK_INDEX=on enables hook (opt-in)', () => {
+  assert.equal(shouldRun({ CODE_GRAPH_HOOK_INDEX: 'on' }), true);
+});
+
+test('shouldRun: CODE_GRAPH_HOOK_INDEX=1 enables hook (truthy alias)', () => {
+  assert.equal(shouldRun({ CODE_GRAPH_HOOK_INDEX: '1' }), true);
+});
+
+test('shouldRun: CODE_GRAPH_HOOK_INDEX=true enables hook (truthy alias)', () => {
+  assert.equal(shouldRun({ CODE_GRAPH_HOOK_INDEX: 'true' }), true);
+});
+
+test('shouldRun: CODE_GRAPH_HOOK_INDEX=off keeps hook off (explicit)', () => {
+  assert.equal(shouldRun({ CODE_GRAPH_HOOK_INDEX: 'off' }), false);
+});
+
+test('shouldRun: CODE_GRAPH_HOOK_INDEX with empty string is OFF', () => {
+  assert.equal(shouldRun({ CODE_GRAPH_HOOK_INDEX: '' }), false);
+});
+
+test('shouldRun: CODE_GRAPH_HOOK_INDEX is case-insensitive', () => {
+  assert.equal(shouldRun({ CODE_GRAPH_HOOK_INDEX: 'ON' }), true);
+  assert.equal(shouldRun({ CODE_GRAPH_HOOK_INDEX: 'On' }), true);
+  assert.equal(shouldRun({ CODE_GRAPH_HOOK_INDEX: 'TRUE' }), true);
+});
+
+test('hook script default-env spawn does not invoke the binary (default OFF)', () => {
+  // End-to-end check: with the v0.21 opt-in flip, a default-env spawn of
+  // incremental-index.js exits 0 immediately without touching the binary.
+  const script = path.join(__dirname, 'incremental-index.js');
+  const cleanEnv = { ...process.env };
+  delete cleanEnv.CODE_GRAPH_HOOK_INDEX;
+  const t0 = Date.now();
+  const proc = spawnSync(process.execPath, [script], {
+    env: cleanEnv,
+    encoding: 'utf8',
+    timeout: 2000,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+  // Should be much faster than the 80ms+ cold-start of running the binary.
+  // 500ms is generous — actual is ~30-50ms node startup.
+  assert.equal(proc.status, 0, `expected exit 0, got ${proc.status}; stderr: ${proc.stderr}`);
+  assert.equal(proc.stdout, '', 'stdout must be empty when default-OFF');
+  assert.ok(Date.now() - t0 < 500, 'default-OFF must short-circuit fast (< 500ms)');
+});
 
 test('incremental-index bails silently when cwd is not a git repo', (t) => {
   const bin = findBinary();

package/claude-plugin/scripts/user-prompt-context.js

@@ -8,28 +8,8 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-// --- Mid-session install detection ---
-// If hooks are running but lifecycle install() hasn't executed yet (no manifest),
-// the plugin was installed mid-session and the MCP server isn't connected.
-// Claude Code only starts MCP servers at session startup; /mcp reconnect cannot
-// start servers that were never initialized.
+// Mid-session install detection: hook fires but no manifest yet.
 const MANIFEST_PATH = path.join(os.homedir(), '.cache', 'code-graph', 'install-manifest.json');
-if (!fs.existsSync(MANIFEST_PATH)) {
-  const noticeFile = path.join(os.tmpdir(), '.code-graph-mcp-restart-notice');
-  try {
-    // Show once per hour to avoid spam
-    if (Date.now() - fs.statSync(noticeFile).mtimeMs < 3600000) process.exit(0);
-  } catch { /* first notice */ }
-  try { fs.writeFileSync(noticeFile, ''); } catch { /* ok */ }
-  process.stdout.write(
-    '[code-graph] Plugin installed — MCP server requires a session restart to connect.\n' +
-    'MCP servers are only initialized at session startup. To activate:\n' +
-    '  1. Press Ctrl+C to exit the current session\n' +
-    '  2. Re-run `claude` to start a new session\n' +
-    'Meanwhile, CLI tools work directly: code-graph-mcp search <query>, code-graph-mcp map, etc.\n'
-  );
-  process.exit(0);
-}
 
 // --- Per-type rate limiting (replaces single global cooldown) ---
 const COOLDOWNS = {
@@ -53,25 +33,24 @@ function markCooldown(type) {
   } catch { /* ok */ }
 }
 
-// CODE_GRAPH_QUIET_HOOKS=1 → skip passive per-prompt injection entirely.
-// Users opt in to this mode when MEMORY.md + explicit tool calls cover their needs.
-if (process.env.CODE_GRAPH_QUIET_HOOKS === '1') process.exit(0);
-
-// --- Read user message ---
-let message;
-try {
-  const input = JSON.parse(fs.readFileSync('/dev/stdin', 'utf8'));
-  message = (input && input.message) || '';
-} catch {
-  process.exit(0);
+// v0.21 — flipped to opt-in default. Routing-bench backend P@1=100% (v0.20.0)
+// proves Sonnet 4.5 picks tools correctly without push injection; per-prompt
+// CLI exec was costing 200-500 tokens/turn across N turns to repeat what the
+// agent would have called itself. Mirrors session-init.js computeQuietHooks
+// priority chain so a single env knob covers both hooks.
+//
+// Priority (high → low):
+//   1. CODE_GRAPH_QUIET_HOOKS=0 → forced noisy (legacy back-compat)
+//   2. CODE_GRAPH_QUIET_HOOKS=1 → forced quiet (legacy back-compat)
+//   3. CODE_GRAPH_VERBOSE_HOOKS=1 → opt-in noisy (new, recommended)
+//   4. default → quiet
+function computeQuietHooks(env = process.env) {
+  const envQuiet = env.CODE_GRAPH_QUIET_HOOKS;
+  if (envQuiet === '0') return false;
+  if (envQuiet === '1') return true;
+  if (env.CODE_GRAPH_VERBOSE_HOOKS === '1') return false;
+  return true;
 }
-// Chinese chars are ~3 bytes but 1 char; "看看 fts5_search" is only 16 chars
-if (!message || message.length < 8) process.exit(0);
-
-// --- Check index ---
-const cwd = process.cwd();
-const dbPath = path.join(cwd, '.code-graph', 'index.db');
-if (!fs.existsSync(dbPath)) process.exit(0);
 
 // --- Pure logic (exported for testing) ---
 
@@ -121,14 +100,203 @@ function extractSymbols(msg) {
   return { symbols: candidates, lowConfidence };
 }
 
+// v0.21 — replaced 6 mixed-language regex piles with per-keyword weighted
+// patterns. Each row is testable in isolation, weights ready for tuning when
+// false-positive data accumulates. Threshold 0.5 + uniform weight 1.0
+// preserves the original OR-of-alternatives behavior 1:1; future tuning can
+// downweight noisy short keywords like "bug" or "什么" that currently fire
+// too eagerly. Maintenance cost: ~150 lines of table vs 6 × 200-char regex —
+// regression history (#5754, #7713) shows the regex form was the higher
+// silent-bug surface.
+const INTENT_PATTERNS = {
+  impact: [
+    [/impact/i, 1.0],
+    [/影响/, 1.0],
+    [/修改前/, 1.0],
+    [/改之前/, 1.0],
+    [/blast radius/i, 1.0],
+    [/before (?:edit|chang|modif)/i, 1.0],
+    [/risk/i, 1.0],
+    [/风险/, 1.0],
+    [/改动范围/, 1.0],
+    [/波及/, 1.0],
+    [/问题在/, 1.0],
+    [/bug/i, 1.0],
+    [/干扰/, 1.0],
+    [/冲突/, 1.0],
+    [/卡/, 1.0],
+  ],
+  modify: [
+    [/改(?!变)/, 1.0],
+    [/修改/, 1.0],
+    [/修复/, 1.0],
+    [/重构/, 1.0],
+    [/优化/, 1.0],
+    [/简化/, 1.0],
+    [/精简/, 1.0],
+    [/适配/, 1.0],
+    [/统一/, 1.0],
+    [/修正/, 1.0],
+    [/调整/, 1.0],
+    [/去掉/, 1.0],
+    [/整理/, 1.0],
+    [/清理/, 1.0],
+    [/解耦/, 1.0],
+    [/更新/, 1.0],
+    [/\brefactor\b/i, 1.0],
+    [/\bchange\b/i, 1.0],
+    [/\brename\b/i, 1.0],
+    [/\bfix\b/i, 1.0],
+    [/移动/, 1.0],
+    [/\bmove\b/i, 1.0],
+    [/删(?!除文件)/, 1.0],
+    [/\bremove\b/i, 1.0],
+    [/替换/, 1.0],
+    [/\breplace\b/i, 1.0],
+    [/\bupdate\b/i, 1.0],
+    [/升级/, 1.0],
+    [/\bmigrate\b/i, 1.0],
+    [/迁移/, 1.0],
+    [/拆分/, 1.0],
+    [/\bsplit\b/i, 1.0],
+    [/合并/, 1.0],
+    [/\bmerge\b/i, 1.0],
+    [/提取/, 1.0],
+    [/\bextract\b/i, 1.0],
+    [/改成/, 1.0],
+    [/改为/, 1.0],
+    [/换成/, 1.0],
+    [/转为/, 1.0],
+    [/异步/, 1.0],
+    [/同步/, 1.0],
+  ],
+  implement: [
+    [/\badd\b/i, 1.0],
+    [/\bimplement\b/i, 1.0],
+    [/\bcreate\b/i, 1.0],
+    [/\bbuild\b/i, 1.0],
+    [/\bwrite\b/i, 1.0],
+    [/新增/, 1.0],
+    [/添加/, 1.0],
+    [/实现/, 1.0],
+    [/创建/, 1.0],
+    [/编写/, 1.0],
+    [/开发/, 1.0],
+    [/增加/, 1.0],
+    [/加上/, 1.0],
+    [/加个/, 1.0],
+    [/写/, 1.0],
+    [/做个/, 1.0],
+    [/搭建/, 1.0],
+    [/补充/, 1.0],
+    [/引入/, 1.0],
+    [/支持/, 1.0],
+    [/封装/, 1.0],
+    [/接入/, 1.0],
+    [/对接/, 1.0],
+    [/配置/, 1.0],
+  ],
+  understand: [
+    [/how does/i, 1.0],
+    [/怎么工作/, 1.0],
+    [/怎么实现/, 1.0],
+    [/怎么做/, 1.0],
+    [/什么/, 1.0],
+    [/理解/, 1.0],
+    [/看看/, 1.0],
+    [/看一下/, 1.0],
+    [/了解/, 1.0],
+    [/分析/, 1.0],
+    [/explain/i, 1.0],
+    [/understand/i, 1.0],
+    [/架构/, 1.0],
+    [/architecture/i, 1.0],
+    [/structure/i, 1.0],
+    [/overview/i, 1.0],
+    [/模块/, 1.0],
+    [/概览/, 1.0],
+    [/干什么/, 1.0],
+    [/做什么/, 1.0],
+    [/工作原理/, 1.0],
+    [/逻辑/, 1.0],
+    [/机制/, 1.0],
+    [/流程/, 1.0],
+    [/功能/, 1.0],
+    [/结合度/, 1.0],
+    [/效率/, 1.0],
+    [/评估/, 1.0],
+    [/调研/, 1.0],
+    [/是什么/, 1.0],
+    [/有什么/, 1.0],
+    [/能用不/, 1.0],
+    [/高效不/, 1.0],
+    [/达标/, 1.0],
+    [/起作用/, 1.0],
+    [/科学/, 1.0],
+    [/深入思考/, 1.0],
+    [/源码/, 1.0],
+    [/检查/, 1.0],
+    [/审核/, 1.0],
+    [/审查/, 1.0],
+    [/验证/, 1.0],
+    [/诊断/, 1.0],
+  ],
+  callgraph: [
+    [/who calls/i, 1.0],
+    [/what calls/i, 1.0],
+    [/调用/, 1.0],
+    [/call(?:graph|er|ee)/i, 1.0],
+    [/trace/i, 1.0],
+    [/链路/, 1.0],
+    [/追踪/, 1.0],
+    [/谁调/, 1.0],
+    [/被谁调/, 1.0],
+    [/调了谁/, 1.0],
+    [/上下游/, 1.0],
+    [/依赖关系/, 1.0],
+    [/触发/, 1.0],
+    [/路径/, 1.0],
+    [/覆盖/, 1.0],
+    [/介入/, 1.0],
+  ],
+  search: [
+    [/where is/i, 1.0],
+    [/在哪/, 1.0],
+    [/find/i, 1.0],
+    [/search/i, 1.0],
+    [/搜索/, 1.0],
+    [/找/, 1.0],
+    [/locate/i, 1.0],
+    [/哪里用/, 1.0],
+    [/哪里定义/, 1.0],
+    [/定义在/, 1.0],
+    [/实现在/, 1.0],
+    [/处理没/, 1.0],
+    [/在源码/, 1.0],
+    [/加不加/, 1.0],
+  ],
+};
+
+const INTENT_THRESHOLD = 0.5;
+
+function scoreIntent(msg, intent) {
+  const patterns = INTENT_PATTERNS[intent];
+  if (!patterns) return 0;
+  let max = 0;
+  for (const [pattern, weight] of patterns) {
+    if (pattern.test(msg) && weight > max) max = weight;
+  }
+  return max;
+}
+
 function detectIntents(msg) {
   return {
-    impact: /(?:impact|影响|修改前|改之前|blast radius|before (?:edit|chang|modif)|risk|风险|改动范围|波及|问题在|bug|干扰|冲突|卡)/i.test(msg),
-    modify: /(?:改(?!变)|修改|修复|重构|优化|简化|精简|适配|统一|修正|调整|去掉|整理|清理|解耦|更新|\brefactor\b|\bchange\b|\brename\b|\bfix\b|移动|\bmove\b|删(?!除文件)|\bremove\b|替换|\breplace\b|\bupdate\b|升级|\bmigrate\b|迁移|拆分|\bsplit\b|合并|\bmerge\b|提取|\bextract\b|改成|改为|换成|转为|异步|同步)/i.test(msg),
-    implement: /(?:\badd\b|\bimplement\b|\bcreate\b|\bbuild\b|\bwrite\b|新增|添加|实现|创建|编写|开发|增加|加上|加个|写|做个|搭建|补充|引入|支持|封装|接入|对接|配置)/i.test(msg),
-    understand: /(?:how does|怎么工作|怎么实现|怎么做|什么|理解|看看|看一下|了解|分析|explain|understand|架构|architecture|structure|overview|模块|概览|干什么|做什么|工作原理|逻辑|机制|流程|功能|结合度|效率|评估|调研|是什么|有什么|能用不|高效不|达标|起作用|科学|深入思考|源码|检查|审核|审查|验证|诊断)/i.test(msg),
-    callgraph: /(?:who calls|what calls|调用|call(?:graph|er|ee)|trace|链路|追踪|谁调|被谁调|调了谁|上下游|依赖关系|触发|路径|覆盖|介入)/i.test(msg),
-    search: /(?:where is|在哪|find|search|搜索|找|locate|哪里用|哪里定义|定义在|实现在|处理没|在源码|加不加)/i.test(msg),
+    impact: scoreIntent(msg, 'impact') >= INTENT_THRESHOLD,
+    modify: scoreIntent(msg, 'modify') >= INTENT_THRESHOLD,
+    implement: scoreIntent(msg, 'implement') >= INTENT_THRESHOLD,
+    understand: scoreIntent(msg, 'understand') >= INTENT_THRESHOLD,
+    callgraph: scoreIntent(msg, 'callgraph') >= INTENT_THRESHOLD,
+    search: scoreIntent(msg, 'search') >= INTENT_THRESHOLD,
   };
 }
 
@@ -152,15 +320,55 @@ function determineQueryType(intents, symbols, filePaths, isCoolingDownFn) {
 }
 
 // --- Main execution (only when run directly) ---
-if (require.main === module) {
-  if (shouldSkip(message)) process.exit(0);
+// All exit-on-condition checks (manifest, computeQuietHooks, message length,
+// db presence) live INSIDE this guard so `require()` from tests doesn't
+// terminate the test process on module load.
+function runMain() {
+  // Mid-session install: lifecycle.js install() hasn't run yet (no manifest).
+  // MCP server only starts at session startup — tell the user to restart.
+  if (!fs.existsSync(MANIFEST_PATH)) {
+    const noticeFile = path.join(os.tmpdir(), '.code-graph-mcp-restart-notice');
+    try {
+      // Show once per hour to avoid spam
+      if (Date.now() - fs.statSync(noticeFile).mtimeMs < 3600000) return;
+    } catch { /* first notice */ }
+    try { fs.writeFileSync(noticeFile, ''); } catch { /* ok */ }
+    process.stdout.write(
+      '[code-graph] Plugin installed — MCP server requires a session restart to connect.\n' +
+      'MCP servers are only initialized at session startup. To activate:\n' +
+      '  1. Press Ctrl+C to exit the current session\n' +
+      '  2. Re-run `claude` to start a new session\n' +
+      'Meanwhile, CLI tools work directly: code-graph-mcp search <query>, code-graph-mcp map, etc.\n'
+    );
+    return;
+  }
+
+  if (computeQuietHooks()) return;
+
+  // --- Read user message ---
+  let message;
+  try {
+    const input = JSON.parse(fs.readFileSync('/dev/stdin', 'utf8'));
+    message = (input && input.message) || '';
+  } catch {
+    return;
+  }
+  // Chinese chars are ~3 bytes but 1 char; "看看 fts5_search" is only 16 chars
+  if (!message || message.length < 8) return;
+
+  // --- Check index ---
+  const cwd = process.cwd();
+  const dbPath = path.join(cwd, '.code-graph', 'index.db');
+  if (!fs.existsSync(dbPath)) return;
+
+  if (shouldSkip(message)) return;
 
   const filePaths = extractFilePaths(message);
   const symbols = extractSymbols(message);
   const intents = detectIntents(message);
   const query = determineQueryType(intents, symbols, filePaths, isCoolingDown);
 
-  if (!query) process.exit(0);
+  if (!query) return;
 
   const PREFIXES = {
     impact:    '[code-graph:impact] Blast radius — review before editing:',
@@ -169,6 +377,15 @@ if (require.main === module) {
     search:    '[code-graph:search] Relevant code:',
   };
 
+  function run(cmd, args) {
+    return execFileSync(cmd, args, {
+      cwd,
+      timeout: 3000,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  }
+
   try {
     let result = '';
     if (query.type === 'impact') result = run('code-graph-mcp', ['impact', query.symbol]);
@@ -181,19 +398,12 @@ if (require.main === module) {
       process.stdout.write(`${PREFIXES[query.type]}\n${result.trim()}\n`);
     }
   } catch {
-    process.exit(0);
+    /* return silently */
   }
 }
 
-module.exports = { shouldSkip, extractFilePaths, extractSymbols, detectIntents, determineQueryType, STOP_WORDS, PLAIN_WORD_EXCLUDE };
-
-// --- Helpers ---
-
-function run(cmd, args) {
-  return execFileSync(cmd, args, {
-    cwd,
-    timeout: 3000,
-    encoding: 'utf8',
-    stdio: ['pipe', 'pipe', 'pipe'],
-  });
+if (require.main === module) {
+  runMain();
 }
+
+module.exports = { shouldSkip, extractFilePaths, extractSymbols, detectIntents, scoreIntent, INTENT_PATTERNS, INTENT_THRESHOLD, determineQueryType, computeQuietHooks, STOP_WORDS, PLAIN_WORD_EXCLUDE };

package/claude-plugin/scripts/user-prompt-context.test.js

@@ -9,7 +9,11 @@ const {
   extractFilePaths,
   extractSymbols,
   detectIntents,
+  scoreIntent,
+  INTENT_PATTERNS,
+  INTENT_THRESHOLD,
   determineQueryType,
+  computeQuietHooks,
 } = require('./user-prompt-context');
 
 // ── shouldSkip ──────────────────────────────────────────
@@ -250,6 +254,48 @@ test('detectIntents: search (ZH)', () => {
   assert.ok(detectIntents('在哪里用了这个常量').search);
 });
 
+// --- Per-keyword scoring (v0.21 weighted-scorer refactor) ---
+test('scoreIntent: matched keyword returns its weight, unmatched returns 0', () => {
+  // Each pattern in INTENT_PATTERNS is testable in isolation now.
+  assert.equal(scoreIntent('this bug is critical', 'impact'), 1.0);
+  assert.equal(scoreIntent('hello world', 'impact'), 0);
+  assert.equal(scoreIntent('refactor this module', 'modify'), 1.0);
+  assert.equal(scoreIntent('refactor this module', 'implement'), 0);
+});
+
+test('scoreIntent: max weight wins when multiple patterns match', () => {
+  // "this bug needs a fix and impact analysis" matches `impact`, `bug`,
+  // `risk`-no, all three impact rows are weight 1.0 currently — score is 1.0.
+  // Spec: scoreIntent returns max(weight) of matching patterns, never sum.
+  const score = scoreIntent('this bug needs impact analysis', 'impact');
+  assert.equal(score, 1.0);
+});
+
+test('scoreIntent: unknown intent returns 0 (no throw)', () => {
+  assert.equal(scoreIntent('anything', 'nonexistent_intent'), 0);
+});
+
+test('INTENT_PATTERNS: every intent has at least 5 patterns and uniform weights', () => {
+  // v0.21 starts with uniform weights; future tuning can vary them per-pattern.
+  // This test guards against regression to the giant single-regex form.
+  const intents = ['impact', 'modify', 'implement', 'understand', 'callgraph', 'search'];
+  for (const intent of intents) {
+    const patterns = INTENT_PATTERNS[intent];
+    assert.ok(Array.isArray(patterns), `${intent} must have patterns array`);
+    assert.ok(patterns.length >= 5, `${intent} must have >=5 patterns, got ${patterns.length}`);
+    for (const [pattern, weight] of patterns) {
+      assert.ok(pattern instanceof RegExp, `${intent} pattern must be RegExp`);
+      assert.ok(typeof weight === 'number' && weight > 0 && weight <= 1, `${intent} weight must be (0, 1]`);
+    }
+  }
+});
+
+test('INTENT_THRESHOLD is 0.5 — single weight-1.0 match fires the intent', () => {
+  // Threshold contract: any pattern @ weight >= 0.5 → intent fires.
+  // If we lower a pattern to weight 0.4, it must NOT fire alone.
+  assert.equal(INTENT_THRESHOLD, 0.5);
+});
+
 // --- No false positives ---
 test('detectIntents: simple confirmations have no code intent', () => {
   const r = detectIntents('好的');
@@ -479,3 +525,48 @@ test('CODE_GRAPH_QUIET_HOOKS=1 short-circuits silently on stdout, stderr, exit 0
   assert.equal(proc.stderr, '', 'stderr must be empty');
   assert.equal(proc.status, 0, 'must exit 0');
 });
+
+// ── computeQuietHooks priority chain (v0.21 opt-in flip) ────────
+
+test('computeQuietHooks: default (no env) is QUIET', () => {
+  // v0.21: flipped from opt-out to opt-in. Routing-bench P@1=100% earned
+  // the right to stop pushing context the agent would have requested.
+  assert.equal(computeQuietHooks({}), true);
+});
+
+test('computeQuietHooks: CODE_GRAPH_VERBOSE_HOOKS=1 enables push (opt-in)', () => {
+  assert.equal(computeQuietHooks({ CODE_GRAPH_VERBOSE_HOOKS: '1' }), false);
+});
+
+test('computeQuietHooks: legacy CODE_GRAPH_QUIET_HOOKS=0 forces noisy (back-compat)', () => {
+  assert.equal(computeQuietHooks({ CODE_GRAPH_QUIET_HOOKS: '0' }), false);
+});
+
+test('computeQuietHooks: legacy CODE_GRAPH_QUIET_HOOKS=1 forces quiet (back-compat)', () => {
+  assert.equal(computeQuietHooks({ CODE_GRAPH_QUIET_HOOKS: '1' }), true);
+});
+
+test('computeQuietHooks: legacy QUIET_HOOKS=0 wins over VERBOSE_HOOKS=1 (priority chain)', () => {
+  // Priority order: CODE_GRAPH_QUIET_HOOKS=0/1 > CODE_GRAPH_VERBOSE_HOOKS > default.
+  assert.equal(computeQuietHooks({ CODE_GRAPH_QUIET_HOOKS: '0', CODE_GRAPH_VERBOSE_HOOKS: '0' }), false);
+  assert.equal(computeQuietHooks({ CODE_GRAPH_QUIET_HOOKS: '1', CODE_GRAPH_VERBOSE_HOOKS: '1' }), true);
+});
+
+test('default env (no flags) short-circuits silently — opt-in flip', () => {
+  // End-to-end check: with the opt-in flip, a default-env spawn produces
+  // no stdout/stderr even on a message that previously would have injected.
+  const { spawnSync } = require('node:child_process');
+  const script = path.join(__dirname, 'user-prompt-context.js');
+  const cleanEnv = { ...process.env };
+  delete cleanEnv.CODE_GRAPH_QUIET_HOOKS;
+  delete cleanEnv.CODE_GRAPH_VERBOSE_HOOKS;
+  const proc = spawnSync(process.execPath, [script], {
+    input: JSON.stringify({ message: 'impact of refactoring parse_code function' }),
+    env: cleanEnv,
+    encoding: 'utf8',
+    timeout: 2000,
+  });
+  assert.equal(proc.stdout, '', 'default must be silent on stdout');
+  assert.equal(proc.stderr, '', 'default must be silent on stderr');
+  assert.equal(proc.status, 0, 'default must exit 0');
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.19.0",
-    "@sdsrs/code-graph-linux-arm64": "0.19.0",
-    "@sdsrs/code-graph-darwin-x64": "0.19.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.19.0",
-    "@sdsrs/code-graph-win32-x64": "0.19.0"
+    "@sdsrs/code-graph-linux-x64": "0.21.0",
+    "@sdsrs/code-graph-linux-arm64": "0.21.0",
+    "@sdsrs/code-graph-darwin-x64": "0.21.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.21.0",
+    "@sdsrs/code-graph-win32-x64": "0.21.0"
   }
 }