@sdsrs/code-graph 0.30.0 → 0.32.2

package/claude-plugin/scripts/lifecycle.js

@@ -3,6 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { claudeHome } = require('./claude-config');
 
 const PLUGIN_ID = 'code-graph-mcp@code-graph-mcp';
 const OLD_PLUGIN_IDS = [
@@ -16,13 +17,18 @@ const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
 // to its own marketplace path, polluting all subsequent settings.json hook processes).
 const PLUGIN_ROOT = path.resolve(__dirname, '..');
 const MANIFEST_FILE = path.join(CACHE_DIR, 'install-manifest.json');
-const SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
-const INSTALLED_PLUGINS_PATH = path.join(os.homedir(), '.claude', 'plugins', 'installed_plugins.json');
 const REGISTRY_FILE = path.join(CACHE_DIR, 'statusline-registry.json');
+
+// Lazy resolvers — Claude Code's config dir can be overridden by CLAUDE_CONFIG_DIR
+// (multi-account isolation). Re-read every call so test subprocesses with a
+// different env see the right path.
+function settingsPath() { return path.join(claudeHome(), 'settings.json'); }
+function installedPluginsPath() { return path.join(claudeHome(), 'plugins', 'installed_plugins.json'); }
 // Durable mirror outside ~/.cache/ — survives cache cleanup. Captures the
 // `_previous` snapshot (pre-install statusline) and any third-party providers
 // (GSD, etc.). readRegistry() self-heals from this file when primary is missing.
-const PROVIDERS_BACKUP_FILE = path.join(os.homedir(), '.claude', 'statusline-providers.json');
+function providersBackupFile() { return path.join(claudeHome(), 'statusline-providers.json'); }
+function pluginsCacheDir() { return path.join(claudeHome(), 'plugins', 'cache'); }
 
 // --- Helpers ---
 
@@ -65,7 +71,7 @@ function hasOwn(obj, key) {
 }
 
 function hasInstalledPluginRecord() {
-  const installed = readJson(INSTALLED_PLUGINS_PATH);
+  const installed = readJson(installedPluginsPath());
   return !!(installed && installed.plugins && Array.isArray(installed.plugins[PLUGIN_ID]) && installed.plugins[PLUGIN_ID].length > 0);
 }
 
@@ -83,7 +89,7 @@ function readRegistry() {
   if (primary && Array.isArray(primary) && primary.length > 0) return primary;
   // Self-heal: primary missing or empty (e.g. user cleaned ~/.cache/code-graph/).
   // Durable backup in ~/.claude/ retains `_previous` + third-party providers.
-  const backup = readJson(PROVIDERS_BACKUP_FILE);
+  const backup = readJson(providersBackupFile());
   if (backup && Array.isArray(backup) && backup.length > 0) {
     try { writeJsonAtomic(REGISTRY_FILE, backup); } catch { /* ok */ }
     return backup;
@@ -94,13 +100,13 @@ function readRegistry() {
 function writeRegistry(registry) {
   if (!registry || registry.length === 0) {
     try { fs.unlinkSync(REGISTRY_FILE); } catch { /* ok */ }
-    try { fs.unlinkSync(PROVIDERS_BACKUP_FILE); } catch { /* ok */ }
+    try { fs.unlinkSync(providersBackupFile()); } catch { /* ok */ }
     return;
   }
   writeJsonAtomic(REGISTRY_FILE, registry);
   // Mirror to durable location so cache cleanup doesn't strand `_previous`
   // or third-party provider entries.
-  try { writeJsonAtomic(PROVIDERS_BACKUP_FILE, registry); } catch { /* ok */ }
+  try { writeJsonAtomic(providersBackupFile(), registry); } catch { /* ok */ }
 }
 
 function registerStatuslineProvider(id, command, needsStdin) {
@@ -126,18 +132,18 @@ function unregisterStatuslineProvider(id) {
   return true;
 }
 
-function isPluginExplicitlyDisabled(settings = readJson(SETTINGS_PATH) || {}) {
+function isPluginExplicitlyDisabled(settings = readJson(settingsPath()) || {}) {
   return hasOwn(settings.enabledPlugins, PLUGIN_ID) && settings.enabledPlugins[PLUGIN_ID] === false;
 }
 
-function isPluginInactive(settings = readJson(SETTINGS_PATH) || {}) {
+function isPluginInactive(settings = readJson(settingsPath()) || {}) {
   if (isPluginExplicitlyDisabled(settings)) return true;
 
   const hasComposite = isOurComposite(settings);
   const hasCodeGraphRegistry = readRegistry().some((provider) => provider.id === 'code-graph');
   if (!hasComposite && !hasCodeGraphRegistry) return false;
 
-  const installed = readJson(INSTALLED_PLUGINS_PATH);
+  const installed = readJson(installedPluginsPath());
   if (!installed || !installed.plugins) return false;
   return !hasInstalledPluginRecord();
 }
@@ -165,7 +171,7 @@ function detachStatuslineIntegration(settings) {
 }
 
 function cleanupDisabledStatusline() {
-  const settings = readJson(SETTINGS_PATH);
+  const settings = readJson(settingsPath());
   if (!settings || !isPluginInactive(settings)) {
     return { cleaned: false, settingsChanged: false };
   }
@@ -173,7 +179,7 @@ function cleanupDisabledStatusline() {
   let settingsChanged = detachStatuslineIntegration(settings);
   if (removeHooksFromSettings(settings)) settingsChanged = true;
   if (settingsChanged) {
-    writeJsonAtomic(SETTINGS_PATH, settings);
+    writeJsonAtomic(settingsPath(), settings);
   }
 
   return { cleaned: true, settingsChanged };
@@ -182,7 +188,7 @@ function cleanupDisabledStatusline() {
 // --- Scope Conflict Detection ---
 
 function checkScopeConflict() {
-  const installed = readJson(INSTALLED_PLUGINS_PATH);
+  const installed = readJson(installedPluginsPath());
   if (!installed || !installed.plugins) return null;
   for (const [key, entries] of Object.entries(installed.plugins)) {
     if (key === PLUGIN_ID) continue;
@@ -207,10 +213,10 @@ function migrateOldPluginIds(settings) {
     }
 
     // Clean old ID from installed_plugins.json
-    const installed = readJson(INSTALLED_PLUGINS_PATH);
+    const installed = readJson(installedPluginsPath());
     if (installed && installed.plugins && oldId in installed.plugins) {
       delete installed.plugins[oldId];
-      writeJsonAtomic(INSTALLED_PLUGINS_PATH, installed);
+      writeJsonAtomic(installedPluginsPath(), installed);
     }
   }
 
@@ -225,10 +231,11 @@ function migrateOldPluginIds(settings) {
   }
 
   // Clean old cache paths
+  const cacheRoot = pluginsCacheDir();
   const oldCacheDirs = [
-    path.join(os.homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'code-graph'),
-    path.join(os.homedir(), '.claude', 'plugins', 'cache', 'sdsrss-code-graph', 'code-graph'),
-    path.join(os.homedir(), '.claude', 'plugins', 'cache', 'sdsrss-code-graph'),
+    path.join(cacheRoot, 'sdsrss', 'code-graph'),
+    path.join(cacheRoot, 'sdsrss-code-graph', 'code-graph'),
+    path.join(cacheRoot, 'sdsrss-code-graph'),
   ];
   for (const dir of oldCacheDirs) {
     try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* ok */ }
@@ -238,28 +245,63 @@ function migrateOldPluginIds(settings) {
 }
 
 // --- Hook identity ---
-// Claude Code loads hooks from cache/<mp>/<plugin>/<ver>/hooks/hooks.json —
-// that file is the authoritative source. Any entries matching our hooks
-// inside settings.json are legacy migration debris (v0.8.2 and earlier wrote
-// there) and must be stripped on every install/update/session-init so events
-// don't fire twice.
+//
+// v0.32.0 ARCHITECTURE CORRECTION (see project_hooks_settings.md / feedback_pretooluse_dark_under_green_health.md):
+//
+// Empirical finding 2026-05-24: current Claude Code only loads SessionStart
+// hooks from cache/<mp>/<plugin>/<ver>/hooks/hooks.json. PreToolUse, PostToolUse,
+// UserPromptSubmit, Stop, SessionEnd entries in plugin-cache hooks.json are
+// SILENTLY IGNORED. Only ~/.claude/settings.json entries reach CC for those events.
+//
+// Therefore lifecycle.js now ACTIVELY WRITES non-SessionStart hook entries to
+// settings.json (with description markers for cleanup), and the shipped
+// claude-plugin/hooks/hooks.json carries only SessionStart. SessionStart entries
+// in claude-plugin/hooks/hooks.json continue to be CC-loaded as before.
+//
+// Pattern mirrors claude-mem-lite's install.mjs (cache hooks.json cleared
+// to prevent duplicate registration).
+
+const OUR_HOOK_SCRIPTS = [
+  'session-init.js',
+  'incremental-index.js',
+  'user-prompt-context.js',
+  'pre-edit-guide.js',
+  'pre-grep-guide.js',   // v0.32.0 — was in plugin-cache only, never fired
+  'pre-read-guide.js',   // v0.32.0 — was in plugin-cache only, never fired
+];
+
+// Description markers — primary cleanup discriminator (immune to env/path
+// pollution per feedback_plugin_env_isolation.md). New v0.32.0 markers carry
+// the version so older lifecycle.js still recognizes them as ours.
+const SETTINGS_HOOK_DESC = {
+  preToolUse:       '[code-graph-mcp v0.32+] PreToolUse re-routed via settings.json (cache hooks.json silently ignored for this event by current CC)',
+  postToolUseEdit:  '[code-graph-mcp v0.32+] PostToolUse Write|Edit incremental-index update',
+  userPromptSubmit: '[code-graph-mcp v0.32+] UserPromptSubmit context push',
+};
 
-const OUR_HOOK_SCRIPTS = ['session-init.js', 'incremental-index.js', 'user-prompt-context.js', 'pre-edit-guide.js'];
 const OUR_DESCRIPTIONS = [
+  // Legacy v0.7.x / 0.8.x descriptions — kept so very-old installs still get cleaned up.
   'StatusLine self-heal, lifecycle sync, project map injection',
   'Auto-inject impact analysis when editing functions with 2+ callers',
   'Auto-update code graph index after file edits',
   'Inject code-graph structural context based on user intent',
+  // v0.32.0 — new re-route markers
+  SETTINGS_HOOK_DESC.preToolUse,
+  SETTINGS_HOOK_DESC.postToolUseEdit,
+  SETTINGS_HOOK_DESC.userPromptSubmit,
 ];
 
 function isOurHookEntry(entry) {
   if (!entry || !entry.hooks) return false;
-  // Primary: match by description (legacy v0.7.x/0.8.x registrations).
+  // Primary: match by description (immune to path pollution).
   if (entry.description && OUR_DESCRIPTIONS.includes(entry.description)) return true;
-  // Fallback: match by script name + 'code-graph' in path.
+  // Fallback: script name + MARKETPLACE_NAME in path. v0.32.1: tightened from
+  // bare 'code-graph' (which would claim a user's own ~/code-graph/foo.js) to
+  // the actual marketplace dir name 'code-graph-mcp' — Requirement 3 says
+  // foreign-entry strip is unacceptable, so be conservative.
   return entry.hooks.some(h =>
     h.command && OUR_HOOK_SCRIPTS.some(s => h.command.includes(s)) &&
-    h.command.includes('code-graph')
+    h.command.includes(MARKETPLACE_NAME)
   );
 }
 
@@ -279,12 +321,68 @@ function removeHooksFromSettings(settings) {
   return changed;
 }
 
+// --- v0.32.0: settings.json hook registration ---
+
+// PLUGIN_ROOT (module-level, line 18) is the canonical __dirname-derived
+// absolute path — never CLAUDE_PLUGIN_ROOT env (env leaks across plugins
+// in settings.json hook execution context per feedback_plugin_env_isolation.md).
+
+function buildSettingsHookEntries() {
+  const root = PLUGIN_ROOT;
+  const scriptCmd = (name, timeout) => ({
+    type: 'command',
+    command: `node "${path.join(root, 'scripts', name)}"`,
+    timeout,
+  });
+
+  return {
+    PreToolUse: [
+      { description: SETTINGS_HOOK_DESC.preToolUse, matcher: 'Edit', hooks: [scriptCmd('pre-edit-guide.js', 4)] },
+      { description: SETTINGS_HOOK_DESC.preToolUse, matcher: 'Bash', hooks: [scriptCmd('pre-grep-guide.js', 3)] },
+      { description: SETTINGS_HOOK_DESC.preToolUse, matcher: 'Read', hooks: [scriptCmd('pre-read-guide.js', 3)] },
+    ],
+    PostToolUse: [
+      { description: SETTINGS_HOOK_DESC.postToolUseEdit, matcher: 'Write|Edit', hooks: [scriptCmd('incremental-index.js', 10)] },
+    ],
+    UserPromptSubmit: [
+      { description: SETTINGS_HOOK_DESC.userPromptSubmit, matcher: '', hooks: [scriptCmd('user-prompt-context.js', 5)] },
+    ],
+  };
+}
+
+// Idempotent two-pass: (1) evict ALL our entries (legacy v0.7+/0.8+ markers
+// AND v0.32+ markers) across EVERY event — catches legacy SessionStart/
+// PostToolUse entries in settings.json pointing to stale plugin-cache paths;
+// (2) write fresh v0.32+ entries for the events we own. SessionStart stays
+// in plugin-cache hooks.json (it's still loaded from there), so we don't
+// re-write it to settings.json.
+function registerHooksToSettings(settings) {
+  settings.hooks = settings.hooks || {};
+  const before = JSON.stringify(settings.hooks);
+
+  // Pass 1: evict our entries across every event.
+  for (const event of Object.keys(settings.hooks)) {
+    if (!Array.isArray(settings.hooks[event])) continue;
+    settings.hooks[event] = settings.hooks[event].filter(e => !isOurHookEntry(e));
+    if (settings.hooks[event].length === 0) delete settings.hooks[event];
+  }
+
+  // Pass 2: write fresh entries for our desired events.
+  const desired = buildSettingsHookEntries();
+  for (const [event, desiredEntries] of Object.entries(desired)) {
+    const existing = Array.isArray(settings.hooks[event]) ? settings.hooks[event] : [];
+    settings.hooks[event] = [...existing, ...desiredEntries];
+  }
+
+  return before !== JSON.stringify(settings.hooks);
+}
+
 // --- Install (idempotent) ---
 
 function install() {
   const version = getPluginVersion();
   const manifest = readManifest();
-  const settings = readJson(SETTINGS_PATH) || {};
+  const settings = readJson(settingsPath()) || {};
   let settingsChanged = false;
 
   // 0. Migrate from old plugin IDs
@@ -317,11 +415,12 @@ function install() {
   // Register code-graph provider
   registerStatuslineProvider('code-graph', codeGraphStatuslineCommand(), false);
 
-  // 2. Hooks — cache/<ver>/hooks/hooks.json is authoritative. Strip any legacy
-  //    entries from settings.json that v0.8.2 or earlier registered, so events
-  //    don't fire twice.
-  const legacyHooksRemoved = removeHooksFromSettings(settings);
-  if (legacyHooksRemoved) settingsChanged = true;
+  // 2. Hooks — v0.32.0: actively write PreToolUse/PostToolUse/UserPromptSubmit
+  //    to settings.json. Plugin-cache hooks.json is silently ignored by current
+  //    Claude Code for these events (SessionStart still loads from cache).
+  //    registerHooksToSettings is idempotent: strips priors then appends fresh.
+  const hooksRegistered = registerHooksToSettings(settings);
+  if (hooksRegistered) settingsChanged = true;
 
   // NOTE: enabledPlugins is managed by Claude Code's plugin system, not by lifecycle.
   // Do NOT add enabledPlugins entries here — it causes phantom plugin entries
@@ -329,7 +428,7 @@ function install() {
 
   // 3. Write settings atomically if changed
   if (settingsChanged) {
-    writeJsonAtomic(SETTINGS_PATH, settings);
+    writeJsonAtomic(settingsPath(), settings);
   }
 
   // 4. Write manifest with version
@@ -338,13 +437,13 @@ function install() {
   manifest.updatedAt = new Date().toISOString();
   writeManifest(manifest);
 
-  return { version, settingsChanged, statusLineClaimed: manifest.config.statusLine, legacyHooksRemoved };
+  return { version, settingsChanged, statusLineClaimed: manifest.config.statusLine, hooksRegistered };
 }
 
 // --- Uninstall (clean all config) ---
 
 function uninstall() {
-  const settings = readJson(SETTINGS_PATH);
+  const settings = readJson(settingsPath());
   let settingsChanged = false;
 
   if (settings) {
@@ -370,12 +469,12 @@ function uninstall() {
 
     // 4. Write settings if changed
     if (settingsChanged) {
-      writeJsonAtomic(SETTINGS_PATH, settings);
+      writeJsonAtomic(settingsPath(), settings);
     }
   }
 
   // 5. Remove all known IDs from installed_plugins.json
-  const installedPlugins = readJson(INSTALLED_PLUGINS_PATH);
+  const installedPlugins = readJson(installedPluginsPath());
   if (installedPlugins && installedPlugins.plugins) {
     let ipChanged = false;
     for (const id of [PLUGIN_ID, ...OLD_PLUGIN_IDS]) {
@@ -384,17 +483,18 @@ function uninstall() {
         ipChanged = true;
       }
     }
-    if (ipChanged) writeJsonAtomic(INSTALLED_PLUGINS_PATH, installedPlugins);
+    if (ipChanged) writeJsonAtomic(installedPluginsPath(), installedPlugins);
   }
 
   // 6. Remove cache directory
   try { fs.rmSync(CACHE_DIR, { recursive: true, force: true }); } catch { /* ok */ }
 
   // 7. Remove plugin files from cache (all known paths, including parent dirs)
+  const cacheRoot = pluginsCacheDir();
   const pluginCacheDirs = [
-    path.join(os.homedir(), '.claude', 'plugins', 'cache', MARKETPLACE_NAME),
-    path.join(os.homedir(), '.claude', 'plugins', 'cache', 'sdsrss-code-graph'),
-    path.join(os.homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'code-graph'),
+    path.join(cacheRoot, MARKETPLACE_NAME),
+    path.join(cacheRoot, 'sdsrss-code-graph'),
+    path.join(cacheRoot, 'sdsrss', 'code-graph'),
   ];
   for (const dir of pluginCacheDirs) {
     try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* ok */ }
@@ -409,7 +509,7 @@ function update() {
   const version = getPluginVersion();
   const manifest = readManifest();
   const oldVersion = manifest.version;
-  const settings = readJson(SETTINGS_PATH) || {};
+  const settings = readJson(settingsPath()) || {};
   let settingsChanged = false;
 
   // 0. Migrate from old plugin IDs
@@ -429,16 +529,16 @@ function update() {
   // 2. Update code-graph provider in registry
   registerStatuslineProvider('code-graph', codeGraphStatuslineCommand(), false);
 
-  // 3. Hooks — strip any legacy entries from settings.json. cache hooks.json
-  //    is the new authoritative source and always has the up-to-date paths.
-  const legacyHooksRemoved = removeHooksFromSettings(settings);
-  if (legacyHooksRemoved) settingsChanged = true;
+  // 3. Hooks — v0.32.0: register PreToolUse/PostToolUse/UserPromptSubmit in
+  //    settings.json (idempotent; absolute paths re-anchor on every update).
+  const hooksRegistered = registerHooksToSettings(settings);
+  if (hooksRegistered) settingsChanged = true;
 
   // NOTE: enabledPlugins is managed by Claude Code's plugin system, not by lifecycle.
 
   // 4. Write settings if changed
   if (settingsChanged) {
-    writeJsonAtomic(SETTINGS_PATH, settings);
+    writeJsonAtomic(settingsPath(), settings);
   }
 
   // 5. Clear update-check cache (force re-check after update)
@@ -455,7 +555,7 @@ function update() {
   //    cache dirs are inert disk clutter, not correctness risks.
   cleanupOldCacheVersions(3);
 
-  return { oldVersion, version, settingsChanged, legacyHooksRemoved };
+  return { oldVersion, version, settingsChanged, hooksRegistered };
 }
 
 /**
@@ -463,7 +563,7 @@ function update() {
  * Cache layout: ~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/
  */
 function cleanupOldCacheVersions(keep = 3) {
-  const cacheParent = path.join(os.homedir(), '.claude', 'plugins', 'cache', MARKETPLACE_NAME);
+  const cacheParent = path.join(pluginsCacheDir(), MARKETPLACE_NAME);
   try {
     // List all subdirectories under the marketplace cache
     const entries = fs.readdirSync(cacheParent, { withFileTypes: true });
@@ -495,10 +595,16 @@ function cleanupOldCacheVersions(keep = 3) {
 
 // --- Health Check ---
 // Validates all registered paths in settings.json point to existing scripts.
-// Returns { healthy, issues, repaired }.
-
-function healthCheck() {
-  const settings = readJson(SETTINGS_PATH) || {};
+// Returns { healthy, issues, repaired, remaining }.
+//   issues:    pre-repair detection list (what was wrong on entry)
+//   repaired:  true only after a post-repair re-scan returned zero issues
+//              (was previously set blindly to true whenever install() ran,
+//              which would lie if install() couldn't actually fix something)
+//   remaining: post-repair detection list — present iff install() was invoked;
+//              empty array means repair succeeded
+
+function scanForBrokenPaths() {
+  const settings = readJson(settingsPath()) || {};
   const issues = [];
 
   // Check statusLine path
@@ -535,26 +641,43 @@ function healthCheck() {
     }
   }
 
-  // Auto-repair if issues found
-  let repaired = false;
-  if (issues.length > 0) {
-    install();
-    repaired = true;
+  return issues;
+}
+
+function healthCheck() {
+  const issues = scanForBrokenPaths();
+
+  if (issues.length === 0) {
+    return { healthy: true, issues, repaired: false };
   }
 
-  return { healthy: issues.length === 0, issues, repaired };
+  // Attempt auto-repair, then re-scan to confirm the issues actually went
+  // away. install() may legitimately fail to resolve a problem (binary path
+  // permanently gone, registry corrupted, etc.) and the previous code lied
+  // by always returning repaired:true.
+  install();
+  const remaining = scanForBrokenPaths();
+  return {
+    healthy: false,
+    issues,
+    repaired: remaining.length === 0,
+    remaining,
+  };
 }
 
 module.exports = {
-  install, uninstall, update, healthCheck, checkScopeConflict,
+  install, uninstall, update, healthCheck, scanForBrokenPaths, checkScopeConflict,
   isPluginExplicitlyDisabled, isPluginInactive, cleanupDisabledStatusline,
   readManifest, readJson, writeJsonAtomic,
   readRegistry, writeRegistry,
   getPluginVersion, cleanupOldCacheVersions,
   removeHooksFromSettings, isOurHookEntry,
+  registerHooksToSettings, buildSettingsHookEntries,                  // v0.32.0
+  SETTINGS_HOOK_DESC, OUR_HOOK_SCRIPTS, OUR_DESCRIPTIONS,              // v0.32.0 — for tests
+  PLUGIN_ROOT,                                                         // v0.32.1 — for tests / consumers
   registerStatuslineProvider, unregisterStatuslineProvider,
   PLUGIN_ID, OLD_PLUGIN_IDS, MARKETPLACE_NAME, CACHE_DIR, REGISTRY_FILE,
-  PROVIDERS_BACKUP_FILE,
+  settingsPath, installedPluginsPath, providersBackupFile, pluginsCacheDir,
 };
 
 // CLI: node lifecycle.js <install|uninstall|update|health>