@sdsrs/code-graph 0.30.0 → 0.32.2

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.30.0",
+  "version": "0.32.2",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/hooks/hooks.json

@@ -1,6 +1,6 @@
 {
-  "description": "code-graph-mcp hooks — loaded directly by Claude Code from the plugin cache.",
-  "_note": "Authoritative source. settings.json is no longer used for hook registration as of v0.8.3 — session-init.js actively removes any legacy code-graph entries it finds there. Paths use ${CLAUDE_PLUGIN_ROOT} so they follow version directory updates automatically.",
+  "description": "code-graph-mcp hooks — only SessionStart is loaded by Claude Code from plugin-cache. All other event types are registered by lifecycle.js into ~/.claude/settings.json (v0.32.0+).",
+  "_note": "Empirical 2026-05-24: current Claude Code only loads SessionStart entries from plugin-cache hooks.json. PreToolUse / PostToolUse / UserPromptSubmit / Stop / SessionEnd entries here are SILENTLY IGNORED. lifecycle.js install/update writes those to ~/.claude/settings.json instead (pattern from claude-mem-lite). Re-adding non-SessionStart entries here would NOT make them fire — they would just be dead config. See feedback_pretooluse_dark_under_green_health.md for the jsonl evidence chain.",
   "hooks": {
     "SessionStart": [
       {
@@ -13,62 +13,6 @@
           }
         ]
       }
-    ],
-    "PreToolUse": [
-      {
-        "matcher": "tool == \"Edit\"",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/pre-edit-guide.js\"",
-            "timeout": 4
-          }
-        ]
-      },
-      {
-        "matcher": "tool == \"Bash\"",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/pre-grep-guide.js\"",
-            "timeout": 3
-          }
-        ]
-      },
-      {
-        "matcher": "tool == \"Read\"",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/pre-read-guide.js\"",
-            "timeout": 3
-          }
-        ]
-      }
-    ],
-    "PostToolUse": [
-      {
-        "matcher": "tool == \"Write\" || tool == \"Edit\"",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/incremental-index.js\"",
-            "timeout": 10
-          }
-        ]
-      }
-    ],
-    "UserPromptSubmit": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/user-prompt-context.js\"",
-            "timeout": 5
-          }
-        ]
-      }
     ]
   }
 }

package/claude-plugin/scripts/adopt.js

@@ -269,9 +269,14 @@ const TARGET_NAME = 'plugin_code_graph_mcp.md';
 // Claude Code slug convention: every non-alphanumeric-non-hyphen char → `-`.
 // `/mnt/data_ssd/dev/proj` → `-mnt-data-ssd-dev-proj`
 // `/home/sds/.claude/x`   → `-home-sds--claude-x`  (double-dash from `/.`)
+//
+// `home` is the OS home dir (default `os.homedir()`). When `CLAUDE_CONFIG_DIR`
+// is set it overrides `home/.claude`, so multi-account users (personal vs work)
+// land in the directory Claude Code itself is using for `projects/`.
 function memoryDir(cwd = process.cwd(), home = os.homedir()) {
   const slug = cwd.replace(/[^a-zA-Z0-9-]/g, '-');
-  return path.join(home, '.claude', 'projects', slug, 'memory');
+  const claudeDir = process.env.CLAUDE_CONFIG_DIR || path.join(home, '.claude');
+  return path.join(claudeDir, 'projects', slug, 'memory');
 }
 
 function escapeRegex(s) {
@@ -421,9 +426,17 @@ function needsRefresh({ cwd, home, templatePath } = {}) {
 // 检测脚本是否从 Claude Code 插件 cache 运行。
 // 走 __dirname 而非 CLAUDE_PLUGIN_ROOT — 后者在多插件共存时会互相污染
 // （见 feedback_plugin_env_isolation.md）。
+// 默认匹配 `.claude/plugins/` 路径；CLAUDE_CONFIG_DIR 自定义目录时
+// 走 startsWith(CLAUDE_CONFIG_DIR/plugins/) 兜底。
 function isPluginModeInstall(scriptPath = __dirname) {
   const sep = path.sep;
-  return scriptPath.includes(`${sep}.claude${sep}plugins${sep}`);
+  if (scriptPath.includes(`${sep}.claude${sep}plugins${sep}`)) return true;
+  const envDir = process.env.CLAUDE_CONFIG_DIR;
+  if (envDir) {
+    const marker = path.join(envDir, 'plugins') + sep;
+    if (scriptPath.startsWith(marker)) return true;
+  }
+  return false;
 }
 
 // C' 上下文感知默认（v0.9.0）：插件模式下首次 SessionStart 静默 adopt。

package/claude-plugin/scripts/adopt.test.js

@@ -278,6 +278,44 @@ test('isPluginModeInstall rejects npx cache paths', () => {
   assert.strictEqual(isPluginModeInstall(npxPath), false);
 });
 
+test('memoryDir honors CLAUDE_CONFIG_DIR override (multi-account isolation)', () => {
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  process.env.CLAUDE_CONFIG_DIR = '/home/alice/work-claude';
+  try {
+    // home arg is irrelevant when env var is set — projects live under the
+    // configured claude dir, not home/.claude.
+    assert.strictEqual(
+      memoryDir('/home/alice/proj', '/home/alice'),
+      '/home/alice/work-claude/projects/-home-alice-proj/memory'
+    );
+  } finally {
+    if (prev === undefined) delete process.env.CLAUDE_CONFIG_DIR;
+    else process.env.CLAUDE_CONFIG_DIR = prev;
+  }
+});
+
+test('isPluginModeInstall recognizes CLAUDE_CONFIG_DIR/plugins/... paths', () => {
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  process.env.CLAUDE_CONFIG_DIR = '/home/alice/work-claude';
+  try {
+    const pluginPath = '/home/alice/work-claude/plugins/cache/code-graph-mcp@0.31.0/scripts';
+    assert.strictEqual(isPluginModeInstall(pluginPath), true);
+    // Legacy ~/.claude/plugins/ path still works even with env var set.
+    assert.strictEqual(
+      isPluginModeInstall('/home/user/.claude/plugins/cache/code-graph-mcp/scripts'),
+      true
+    );
+    // Unrelated path under same prefix is still rejected.
+    assert.strictEqual(
+      isPluginModeInstall('/home/alice/work-claude/projects/foo/memory'),
+      false
+    );
+  } finally {
+    if (prev === undefined) delete process.env.CLAUDE_CONFIG_DIR;
+    else process.env.CLAUDE_CONFIG_DIR = prev;
+  }
+});
+
 test('maybeAutoAdopt skips when CODE_GRAPH_NO_AUTO_ADOPT=1', () => {
   const sb = makeSandbox();
   try {

package/claude-plugin/scripts/auto-update.js

@@ -5,9 +5,10 @@ const fs = require('fs');
 const https = require('https');
 const path = require('path');
 const os = require('os');
-const { CACHE_DIR, PLUGIN_ID, MARKETPLACE_NAME, readManifest, readJson, writeJsonAtomic } = require('./lifecycle');
+const { CACHE_DIR, PLUGIN_ID, MARKETPLACE_NAME, readManifest, readJson, writeJsonAtomic, installedPluginsPath, pluginsCacheDir } = require('./lifecycle');
 const { clearCache: clearBinaryCache } = require('./find-binary');
 const { readBinaryVersion, isDevMode } = require('./version-utils');
+const { cgTmpDir } = require('./tmp-dir');
 
 // ── Environment Checks ────────────────────────────────────
 
@@ -251,7 +252,7 @@ async function downloadAndInstall(latest) {
     return { pluginUpdated: false, binaryUpdated: false };
   }
 
-  const tmpDir = path.join(os.tmpdir(), `code-graph-update-${Date.now()}`);
+  const tmpDir = path.join(cgTmpDir(), `update-${Date.now()}`);
   let pluginUpdated = false;
   let binaryUpdated = false;
 
@@ -272,7 +273,7 @@ async function downloadAndInstall(latest) {
 
     const pluginSrc = path.join(tmpDir, 'claude-plugin');
     const pluginDst = path.join(
-      os.homedir(), '.claude', 'plugins', 'cache', MARKETPLACE_NAME, 'code-graph-mcp', latest.version
+      pluginsCacheDir(), MARKETPLACE_NAME, 'code-graph-mcp', latest.version
     );
 
     if (fs.existsSync(pluginSrc) && getExtractedPluginVersion(pluginSrc) === latest.version) {
@@ -282,7 +283,7 @@ async function downloadAndInstall(latest) {
     }
 
     // Update installed_plugins.json to point to new version
-    const installedPath = path.join(os.homedir(), '.claude', 'plugins', 'installed_plugins.json');
+    const installedPath = installedPluginsPath();
     try {
       const installed = readJson(installedPath);
       if (installed && installed.plugins && installed.plugins[PLUGIN_ID]) {

package/claude-plugin/scripts/claude-config.js

@@ -0,0 +1,21 @@
+'use strict';
+const path = require('path');
+const os = require('os');
+
+// Resolve Claude Code's config directory. Honors CLAUDE_CONFIG_DIR — when set
+// (commonly used to keep multiple accounts isolated, e.g. personal vs work),
+// Claude Code reads `settings.json`, `plugins/`, `projects/`, etc. from there
+// instead of `~/.claude/`. Our plugin must follow the same override so its
+// hook registrations, statusline, adoption files, and cache cleanup land in
+// the directory Claude Code is actually using.
+//
+// Read fresh on every call so per-process env mutation (tests, child procs
+// spawned with a different env) takes effect immediately. Unlike
+// CLAUDE_PLUGIN_ROOT (which leaks across plugins — see
+// feedback_plugin_env_isolation.md), CLAUDE_CONFIG_DIR is user-set and
+// process-wide, so reading it is safe.
+function claudeHome() {
+  return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
+}
+
+module.exports = { claudeHome };

package/claude-plugin/scripts/claude-config.test.js

@@ -0,0 +1,58 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const os = require('os');
+const { claudeHome } = require('./claude-config');
+
+test('claudeHome defaults to ~/.claude when CLAUDE_CONFIG_DIR unset', () => {
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  delete process.env.CLAUDE_CONFIG_DIR;
+  try {
+    assert.strictEqual(claudeHome(), path.join(os.homedir(), '.claude'));
+  } finally {
+    if (prev !== undefined) process.env.CLAUDE_CONFIG_DIR = prev;
+  }
+});
+
+test('claudeHome honors CLAUDE_CONFIG_DIR when set', () => {
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  process.env.CLAUDE_CONFIG_DIR = '/tmp/work-claude';
+  try {
+    assert.strictEqual(claudeHome(), '/tmp/work-claude');
+  } finally {
+    if (prev === undefined) delete process.env.CLAUDE_CONFIG_DIR;
+    else process.env.CLAUDE_CONFIG_DIR = prev;
+  }
+});
+
+test('claudeHome re-reads env on every call (not cached)', () => {
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  delete process.env.CLAUDE_CONFIG_DIR;
+  try {
+    const before = claudeHome();
+    process.env.CLAUDE_CONFIG_DIR = '/tmp/account-A';
+    const during = claudeHome();
+    delete process.env.CLAUDE_CONFIG_DIR;
+    const after = claudeHome();
+    assert.strictEqual(before, path.join(os.homedir(), '.claude'));
+    assert.strictEqual(during, '/tmp/account-A');
+    assert.strictEqual(after, path.join(os.homedir(), '.claude'));
+  } finally {
+    if (prev !== undefined) process.env.CLAUDE_CONFIG_DIR = prev;
+  }
+});
+
+test('claudeHome ignores empty CLAUDE_CONFIG_DIR (falls back to ~/.claude)', () => {
+  // Empty string is falsy in JS — sanity-check the `||` fallback path so an
+  // accidentally `CLAUDE_CONFIG_DIR=` (unset-style) shell line does not strand
+  // us writing to the literal repository root `/`.
+  const prev = process.env.CLAUDE_CONFIG_DIR;
+  process.env.CLAUDE_CONFIG_DIR = '';
+  try {
+    assert.strictEqual(claudeHome(), path.join(os.homedir(), '.claude'));
+  } finally {
+    if (prev === undefined) delete process.env.CLAUDE_CONFIG_DIR;
+    else process.env.CLAUDE_CONFIG_DIR = prev;
+  }
+});

package/claude-plugin/scripts/doctor.js

@@ -7,7 +7,7 @@ const os = require('os');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const {
   getPluginVersion, readJson, healthCheck, CACHE_DIR,
-  removeHooksFromSettings, isOurHookEntry, writeJsonAtomic,
+  isOurHookEntry, settingsPath, buildSettingsHookEntries,
 } = require('./lifecycle');
 const { findBinary, clearCache: clearBinaryCache } = require('./find-binary');
 
@@ -172,35 +172,52 @@ function runDiagnostics() {
   }
 
   // 6. Hook paths validity
+  // healthCheck() auto-attempts install() when broken paths are detected and
+  // re-scans to verify; repaired:true is now contingent on the re-scan
+  // returning clean. If repaired:false despite install() running, the
+  // re-scan still found broken paths — surfacing 'remaining' makes that
+  // honest instead of telling the user we fixed nothing.
   const hookResult = healthCheck();
   if (hookResult.healthy) {
     results.push({ name: 'Hooks', status: 'ok', detail: 'all paths valid' });
+  } else if (hookResult.repaired) {
+    results.push({
+      name: 'Hooks',
+      status: 'ok',
+      detail: `${hookResult.issues.length} issue(s) auto-repaired`,
+    });
   } else {
+    const remainingCount = Array.isArray(hookResult.remaining)
+      ? hookResult.remaining.length
+      : hookResult.issues.length;
     results.push({
       name: 'Hooks',
-      status: hookResult.repaired ? 'ok' : 'warn',
-      detail: hookResult.repaired
-        ? `${hookResult.issues.length} issue(s) auto-repaired`
-        : `${hookResult.issues.length} invalid path(s)`,
-      fixId: hookResult.repaired ? undefined : 'hooks-invalid',
+      status: 'warn',
+      detail: `${remainingCount} invalid path(s) — auto-repair did not resolve`,
+      fixId: 'hooks-invalid',
     });
   }
 
-  // 7. Legacy hooks in settings.json — v0.8.2 and earlier wrote hooks there;
-  //    cache/<ver>/hooks/hooks.json is now authoritative. Duplicates cause
-  //    every hook to fire twice until settings.json is cleaned.
+  // 7. settings.json hook coverage — v0.32.0 inversion. Current Claude Code
+  //    silently ignores plugin-cache hooks.json for PreToolUse/PostToolUse/
+  //    UserPromptSubmit. lifecycle.js install/update is responsible for
+  //    registering them in settings.json. "Missing" is the bug (previously
+  //    "present" was treated as legacy debris — that was wrong).
   try {
-    const SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
-    const settings = readJson(SETTINGS_PATH) || {};
-    const legacyCount = countLegacyHookEntries(settings);
-    if (legacyCount === 0) {
-      results.push({ name: 'Legacy hooks', status: 'ok', detail: 'settings.json is clean' });
+    const settings = readJson(settingsPath()) || {};
+    const cov = surveyHookCoverage(settings);
+    if (cov.missing.length === 0) {
+      results.push({
+        name: 'Hook coverage',
+        status: 'ok',
+        detail: `settings.json has all ${cov.expected.length} expected entries`,
+      });
     } else {
       results.push({
-        name: 'Legacy hooks',
+        name: 'Hook coverage',
         status: 'warn',
-        detail: `${legacyCount} entries in settings.json (fire twice per event)`,
-        fixId: 'legacy-hooks-in-settings',
+        detail: `missing ${cov.missing.length}/${cov.expected.length} settings.json entries: ${cov.missing.join(', ')}`,
+        fixId: 'missing-hooks-in-settings',
       });
     }
   } catch { /* probe failed — skip */ }
@@ -208,16 +225,31 @@ function runDiagnostics() {
   return results;
 }
 
-function countLegacyHookEntries(settings) {
-  if (!settings || !settings.hooks) return 0;
-  let count = 0;
-  for (const entries of Object.values(settings.hooks)) {
-    if (!Array.isArray(entries)) continue;
-    for (const entry of entries) {
-      if (isOurHookEntry(entry)) count++;
+// Inventory of (event, matcher) tuples we expect to find in settings.json after
+// install. Used by doctor to detect missing entries.
+function surveyHookCoverage(settings) {
+  const desired = buildSettingsHookEntries();
+  const expected = [];
+  for (const [event, entries] of Object.entries(desired)) {
+    for (const e of entries) {
+      expected.push(`${event}:${e.matcher || '*'}`);
+    }
+  }
+
+  const present = new Set();
+  if (settings && settings.hooks) {
+    for (const [event, entries] of Object.entries(settings.hooks)) {
+      if (!Array.isArray(entries)) continue;
+      for (const entry of entries) {
+        if (isOurHookEntry(entry)) {
+          present.add(`${event}:${entry.matcher || '*'}`);
+        }
+      }
     }
   }
-  return count;
+
+  const missing = expected.filter(k => !present.has(k));
+  return { expected, present: [...present], missing };
 }
 
 // ── Report Formatting ─────────────────────────────────────
@@ -370,21 +402,20 @@ function runRepairs(results) {
         console.log('\n  Repairing hooks...');
         const { install } = require('./lifecycle');
         install();
-        console.log('  \u2705 Hooks repaired');
+        console.log('  \u2705 Hooks repaired \u2014 restart Claude Code to apply');
         fixed++;
         break;
       }
 
-      case 'legacy-hooks-in-settings': {
-        console.log('\n  Removing legacy code-graph hooks from settings.json...');
-        const SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
-        const settings = readJson(SETTINGS_PATH) || {};
-        if (removeHooksFromSettings(settings)) {
-          writeJsonAtomic(SETTINGS_PATH, settings);
-          console.log('  \u2705 settings.json cleaned — restart Claude Code to apply');
+      case 'missing-hooks-in-settings': {
+        console.log('\n  Registering code-graph hooks in settings.json...');
+        const { install } = require('./lifecycle');
+        const r = install();
+        if (r.hooksRegistered) {
+          console.log('  \u2705 settings.json updated — restart Claude Code to apply');
           fixed++;
         } else {
-          console.log('  \u2796 No legacy entries found');
+          console.log('  \u2796 install reported no change (settings already had entries)');
         }
         break;
       }

package/claude-plugin/scripts/hooks.test.js

@@ -0,0 +1,151 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const path = require('path');
+
+// Regression gate for v0.31.1: hooks.json matchers must be Claude Code's
+// literal/regex form, NOT the expression DSL `tool == "X"`. The earlier
+// matchers parsed as regex against tool names, never matched anything,
+// and left every PreToolUse hook silently inert from v0.25.0 through
+// v0.31.0. The bug was invisible to the existing unit tests because they
+// spawn the hook scripts directly via stdin, bypassing Claude Code's
+// matcher dispatch.
+
+const HOOKS_JSON = path.resolve(__dirname, '..', 'hooks', 'hooks.json');
+
+function loadHooks() {
+  const raw = fs.readFileSync(HOOKS_JSON, 'utf8');
+  return JSON.parse(raw);
+}
+
+function* iterMatchers(hooksByEvent) {
+  for (const [event, entries] of Object.entries(hooksByEvent || {})) {
+    if (!Array.isArray(entries)) continue;
+    for (let i = 0; i < entries.length; i++) {
+      const e = entries[i];
+      yield { event, idx: i, matcher: e && e.matcher };
+    }
+  }
+}
+
+test('hooks.json: file parses as JSON', () => {
+  assert.doesNotThrow(loadHooks);
+});
+
+test('hooks.json: every entry has a string matcher', () => {
+  const cfg = loadHooks();
+  let count = 0;
+  for (const { event, idx, matcher } of iterMatchers(cfg.hooks)) {
+    assert.equal(typeof matcher, 'string',
+      `hooks.${event}[${idx}].matcher should be a string, got ${typeof matcher}`);
+    count++;
+  }
+  assert.ok(count > 0, 'expected at least one matcher in hooks.json');
+});
+
+// The actual regression gate. Each banned token reflects a specific
+// failure mode we hit and want to keep out forever.
+const BANNED_TOKENS = [
+  // The original v0.25.0 → v0.31.0 bug: expression-style matcher treated
+  // as regex against tool name → never matched.
+  { token: '==', why: 'expression DSL (e.g. `tool == "Edit"`) is not supported; use literal tool name' },
+  // `tool ==` or `tool name == "X"` — same family, different spelling.
+  { token: 'tool ', why: 'expression DSL with `tool` variable is not supported' },
+  // Boolean ORs as expression operators (regex uses `|`, not `||`).
+  { token: '||', why: 'use `|` for pipe-list (e.g. `Write|Edit`), not `||`' },
+  // Boolean AND has no meaning in tool-name matching.
+  { token: '&&', why: '`&&` has no meaning in matchers' },
+  // Double-quotes inside the matcher are a strong hint of expression DSL
+  // (the broken syntax was `"tool == \"Edit\""`).
+  { token: '"', why: 'literal double-quote in matcher is almost always a copy-paste of expression DSL' },
+];
+
+test('hooks.json: matchers avoid banned expression-DSL tokens', () => {
+  const cfg = loadHooks();
+  const offenders = [];
+  for (const { event, idx, matcher } of iterMatchers(cfg.hooks)) {
+    for (const { token, why } of BANNED_TOKENS) {
+      if (matcher.includes(token)) {
+        offenders.push(`hooks.${event}[${idx}].matcher = ${JSON.stringify(matcher)} — contains banned ${JSON.stringify(token)} (${why})`);
+      }
+    }
+  }
+  assert.deepEqual(offenders, [],
+    'hooks.json matcher syntax regression — see v0.31.1 CHANGELOG:\n  ' + offenders.join('\n  '));
+});
+
+// v0.32.0 architecture: plugin-cache hooks.json ONLY carries SessionStart.
+// PreToolUse / PostToolUse / UserPromptSubmit are registered into
+// ~/.claude/settings.json by lifecycle.js (current Claude Code silently
+// ignores plugin-cache hooks.json entries for those events — confirmed
+// 2026-05-24 via session jsonl, see feedback_pretooluse_dark_under_green_health.md).
+test('hooks.json: contains SessionStart only (v0.32.0)', () => {
+  const cfg = loadHooks();
+  assert.deepEqual(Object.keys(cfg.hooks || {}), ['SessionStart'],
+    'plugin-cache hooks.json must contain only SessionStart; other events go via settings.json. ' +
+    'Adding entries here for PreToolUse/PostToolUse/UserPromptSubmit would be dead config — CC does not load them.');
+});
+
+test('hooks.json: SessionStart wires session-init.js', () => {
+  const cfg = loadHooks();
+  const entries = (cfg.hooks && cfg.hooks.SessionStart) || [];
+  assert.ok(entries.length > 0, 'SessionStart entry missing');
+  const cmd = entries[0].hooks && entries[0].hooks[0] && entries[0].hooks[0].command;
+  assert.match(cmd || '', /session-init\.js/);
+});
+
+// Cross-validate that lifecycle.js's buildSettingsHookEntries covers the
+// matchers we removed from hooks.json — keeps the migration whole. If a
+// future refactor accidentally drops a matcher in one place, this fails.
+test('lifecycle.buildSettingsHookEntries covers PreToolUse Edit/Bash/Read', () => {
+  const { buildSettingsHookEntries } = require('./lifecycle');
+  const desired = buildSettingsHookEntries();
+  const ptu = (desired.PreToolUse || []).map(e => e.matcher);
+  for (const tool of ['Edit', 'Bash', 'Read']) {
+    assert.ok(ptu.includes(tool), `lifecycle.js PreToolUse missing matcher: ${tool}; got ${JSON.stringify(ptu)}`);
+  }
+});
+
+test('lifecycle.buildSettingsHookEntries covers PostToolUse Write|Edit + UserPromptSubmit', () => {
+  const { buildSettingsHookEntries } = require('./lifecycle');
+  const desired = buildSettingsHookEntries();
+  const postMatchers = (desired.PostToolUse || []).map(e => e.matcher);
+  assert.ok(postMatchers.some(m => m === 'Write|Edit'),
+    `PostToolUse must have 'Write|Edit' matcher; got ${JSON.stringify(postMatchers)}`);
+  const upsMatchers = (desired.UserPromptSubmit || []).map(e => e.matcher);
+  assert.ok(upsMatchers.length > 0, 'UserPromptSubmit must have at least one matcher');
+});
+
+test('lifecycle.buildSettingsHookEntries: every entry carries description marker', () => {
+  // Description marker is the primary cleanup discriminator (immune to
+  // path/env pollution per feedback_plugin_env_isolation.md). If an entry
+  // lacks a description, isOurHookEntry falls back to path-fragment match
+  // which is less reliable. Force every entry to have one.
+  const { buildSettingsHookEntries } = require('./lifecycle');
+  const desired = buildSettingsHookEntries();
+  for (const [event, entries] of Object.entries(desired)) {
+    for (let i = 0; i < entries.length; i++) {
+      assert.ok(entries[i].description && entries[i].description.includes('[code-graph-mcp'),
+        `${event}[${i}] missing or malformed description marker`);
+    }
+  }
+});
+
+test('lifecycle.buildSettingsHookEntries: hook commands use absolute paths (no env vars)', () => {
+  // settings.json hook commands run with env pollution risk
+  // (feedback_plugin_env_isolation.md). Paths MUST be absolute, derived
+  // from __dirname, never from ${CLAUDE_PLUGIN_ROOT}.
+  const { buildSettingsHookEntries } = require('./lifecycle');
+  const desired = buildSettingsHookEntries();
+  for (const entries of Object.values(desired)) {
+    for (const e of entries) {
+      for (const h of e.hooks) {
+        assert.ok(!h.command.includes('${CLAUDE_PLUGIN_ROOT}'),
+          `command must not use \${CLAUDE_PLUGIN_ROOT}: ${h.command}`);
+        assert.ok(h.command.startsWith('node "/') || h.command.match(/node "[A-Z]:\\/),
+          `command path must be absolute: ${h.command}`);
+      }
+    }
+  }
+});

package/claude-plugin/scripts/lifecycle.e2e.test.js

@@ -95,3 +95,49 @@ test('lifecycle CLI handles install, disable self-heal, re-enable, and uninstall
   assert.equal(fs.existsSync(cacheDir), false);
 });
 
+test('lifecycle install writes to CLAUDE_CONFIG_DIR instead of ~/.claude when set', (t) => {
+  // Multi-account isolation: a user with CLAUDE_CONFIG_DIR=~/work-claude
+  // expects all plugin config (settings.json, installed_plugins.json,
+  // statusline-providers backup) to land under that directory, not the
+  // default ~/.claude. Default path must remain untouched.
+  const homeDir = mkHome(t);
+  const configDir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-graph-cfgdir-'));
+  t.after(() => fs.rmSync(configDir, { recursive: true, force: true }));
+
+  const cfgSettings = path.join(configDir, 'settings.json');
+  const cfgInstalled = path.join(configDir, 'plugins', 'installed_plugins.json');
+  const cfgBackup = path.join(configDir, 'statusline-providers.json');
+  const defaultSettings = path.join(homeDir, '.claude', 'settings.json');
+
+  writeJson(cfgSettings, {
+    statusLine: { type: 'command', command: 'echo prior-work-status' },
+    enabledPlugins: { 'code-graph-mcp@code-graph-mcp': true },
+  });
+  writeJson(cfgInstalled, {
+    plugins: {
+      'code-graph-mcp@code-graph-mcp': [{
+        installPath: pluginRoot,
+        version: currentVersion,
+        scope: 'user',
+      }],
+    },
+  });
+
+  // Run install with CLAUDE_CONFIG_DIR set; HOME points elsewhere.
+  const env = { ...process.env, HOME: homeDir, CLAUDE_CONFIG_DIR: configDir };
+  delete env.CLAUDE_PLUGIN_ROOT;
+  execFileSync(process.execPath, [lifecycleCli, 'install'], {
+    cwd: repoRoot, env, stdio: ['pipe', 'pipe', 'pipe'],
+  });
+
+  // Config landed in the override dir...
+  const settings = readJson(cfgSettings);
+  assert.match(settings.statusLine.command, /statusline-composite\.js/);
+  assert.equal(fs.existsSync(cfgBackup), true,
+    'statusline-providers backup should land in CLAUDE_CONFIG_DIR');
+
+  // ...and default ~/.claude was never touched.
+  assert.equal(fs.existsSync(defaultSettings), false,
+    'default ~/.claude/settings.json must not be written when override is set');
+});
+