@sdsrs/code-graph 0.4.3 → 0.4.5

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,6 +4,6 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.4.3",
+  "version": "0.4.5",
   "keywords": ["code-graph", "ast", "navigation", "mcp", "knowledge-graph"]
 }

package/claude-plugin/scripts/auto-update.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 'use strict';
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { CACHE_DIR, PLUGIN_ID, readManifest, readJson, writeJsonAtomic } = require('./lifecycle');
+const { CACHE_DIR, PLUGIN_ID, MARKETPLACE_NAME, readManifest, readJson, writeJsonAtomic } = require('./lifecycle');
 
 // ── Configuration ──────────────────────────────────────────
 const GITHUB_REPO = 'sdsrss/code-graph-mcp';
@@ -87,6 +87,21 @@ async function fetchLatestRelease() {
   } catch { return null; }
 }
 
+// ── Helpers ────────────────────────────────────────────────
+
+function copyDirSync(src, dst) {
+  fs.mkdirSync(dst, { recursive: true });
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path.join(src, entry.name);
+    const dstPath = path.join(dst, entry.name);
+    if (entry.isDirectory()) {
+      copyDirSync(srcPath, dstPath);
+    } else {
+      fs.copyFileSync(srcPath, dstPath);
+    }
+  }
+}
+
 // ── Download & Install ─────────────────────────────────────
 
 async function downloadAndInstall(latest) {
@@ -94,25 +109,31 @@ async function downloadAndInstall(latest) {
   try {
     fs.mkdirSync(tmpDir, { recursive: true });
 
-    // 1. Download and extract tarball (plugin files)
-    execSync(
-      `curl -sL -H "Accept: application/vnd.github+json" "${latest.tarballUrl}" | tar xz -C "${tmpDir}" --strip-components=1`,
-      { timeout: 30000, stdio: 'pipe' }
-    );
+    // 1. Download tarball (safe: no shell interpolation)
+    const tarballPath = path.join(tmpDir, 'release.tar.gz');
+    execFileSync('curl', [
+      '-sL', '-o', tarballPath,
+      '-H', 'Accept: application/vnd.github+json',
+      latest.tarballUrl,
+    ], { timeout: 30000, stdio: 'pipe' });
+
+    // 2. Extract tarball
+    execFileSync('tar', [
+      'xzf', tarballPath, '-C', tmpDir, '--strip-components=1',
+    ], { timeout: 15000, stdio: 'pipe' });
 
-    // 2. Copy plugin files to cache
+    // 3. Copy plugin files to cache (cross-platform)
     const pluginSrc = path.join(tmpDir, 'claude-plugin');
     const pluginDst = path.join(
-      os.homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'code-graph', latest.version
+      os.homedir(), '.claude', 'plugins', 'cache', MARKETPLACE_NAME, 'code-graph', latest.version
     );
 
     if (fs.existsSync(pluginSrc)) {
       fs.mkdirSync(pluginDst, { recursive: true });
-      // Copy recursively
-      execSync(`cp -r "${pluginSrc}/." "${pluginDst}/"`, { stdio: 'pipe' });
+      copyDirSync(pluginSrc, pluginDst);
     }
 
-    // 3. Update installed_plugins.json to point to new version
+    // 4. Update installed_plugins.json to point to new version
     const installedPath = path.join(os.homedir(), '.claude', 'plugins', 'installed_plugins.json');
     try {
       const installed = readJson(installedPath);
@@ -124,7 +145,7 @@ async function downloadAndInstall(latest) {
       }
     } catch { /* installed_plugins update failed — not fatal */ }
 
-    // 4. Update install manifest with tag version
+    // 5. Update install manifest with tag version
     try {
       const manifest = readManifest();
       manifest.version = latest.version;
@@ -132,9 +153,9 @@ async function downloadAndInstall(latest) {
       writeJsonAtomic(path.join(CACHE_DIR, 'install-manifest.json'), manifest);
     } catch { /* manifest update failed — not fatal */ }
 
-    // 5. Update npm binary (non-blocking, best-effort)
+    // 6. Update npm binary (non-blocking, best-effort)
     try {
-      execSync(`npm install -g ${NPM_PACKAGE}@${latest.version}`, {
+      execFileSync('npm', ['install', '-g', `${NPM_PACKAGE}@${latest.version}`], {
         timeout: 60000,
         stdio: 'pipe',
       });

package/claude-plugin/scripts/lifecycle.js

@@ -4,7 +4,9 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-const PLUGIN_ID = 'code-graph@sdsrss';
+const PLUGIN_ID = 'code-graph@sdsrss-code-graph';
+const OLD_PLUGIN_ID = 'code-graph@sdsrss'; // Legacy ID — kept for migration cleanup
+const MARKETPLACE_NAME = 'sdsrss-code-graph';
 const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
 const PLUGIN_ROOT = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(__dirname, '..');
 const MANIFEST_FILE = path.join(CACHE_DIR, 'install-manifest.json');
@@ -88,6 +90,45 @@ function unregisterStatuslineProvider(id) {
   return true;
 }
 
+// --- Scope Conflict Detection ---
+
+function checkScopeConflict() {
+  const installed = readJson(INSTALLED_PLUGINS_PATH);
+  if (!installed || !installed.plugins) return null;
+  for (const [key, entries] of Object.entries(installed.plugins)) {
+    if (key === PLUGIN_ID) continue;
+    if (key.startsWith('code-graph@')) {
+      return { existingId: key, scope: entries[0] && entries[0].scope, entries };
+    }
+  }
+  return null;
+}
+
+// --- Migration: clean up old PLUGIN_ID remnants ---
+
+function migrateOldPluginId(settings) {
+  let changed = false;
+
+  // Clean old ID from enabledPlugins
+  if (settings.enabledPlugins && OLD_PLUGIN_ID in settings.enabledPlugins) {
+    delete settings.enabledPlugins[OLD_PLUGIN_ID];
+    changed = true;
+  }
+
+  // Clean old ID from installed_plugins.json
+  const installed = readJson(INSTALLED_PLUGINS_PATH);
+  if (installed && installed.plugins && OLD_PLUGIN_ID in installed.plugins) {
+    delete installed.plugins[OLD_PLUGIN_ID];
+    writeJsonAtomic(INSTALLED_PLUGINS_PATH, installed);
+  }
+
+  // Clean old cache path (was using 'sdsrss' instead of 'sdsrss-code-graph')
+  const oldCacheDir = path.join(os.homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'code-graph');
+  try { fs.rmSync(oldCacheDir, { recursive: true, force: true }); } catch { /* ok */ }
+
+  return changed;
+}
+
 // --- Install (idempotent) ---
 
 function install() {
@@ -96,6 +137,11 @@ function install() {
   const settings = readJson(SETTINGS_PATH) || {};
   let settingsChanged = false;
 
+  // 0. Migrate from old PLUGIN_ID
+  if (migrateOldPluginId(settings)) {
+    settingsChanged = true;
+  }
+
   // 1. StatusLine — composite approach
   //    a. Capture existing statusline as a provider (if not already composite)
   //    b. Register code-graph as a provider
@@ -114,20 +160,16 @@ function install() {
   // Register code-graph provider
   registerStatuslineProvider('code-graph', codeGraphStatuslineCommand(), false);
 
-  // 2. enabledPlugins — add if missing
-  if (!settings.enabledPlugins) settings.enabledPlugins = {};
-  if (!(PLUGIN_ID in settings.enabledPlugins)) {
-    settings.enabledPlugins[PLUGIN_ID] = true;
-    settingsChanged = true;
-    manifest.config.enabledPlugins = true;
-  }
+  // NOTE: enabledPlugins is managed by Claude Code's plugin system, not by lifecycle.
+  // Do NOT add enabledPlugins entries here — it causes phantom plugin entries
+  // when the ID doesn't match the marketplace name.
 
-  // 3. Write settings atomically if changed
+  // 2. Write settings atomically if changed
   if (settingsChanged) {
     writeJsonAtomic(SETTINGS_PATH, settings);
   }
 
-  // 4. Write manifest with version
+  // 3. Write manifest with version
   manifest.version = version;
   manifest.installedAt = manifest.installedAt || new Date().toISOString();
   manifest.updatedAt = new Date().toISOString();
@@ -161,10 +203,14 @@ function uninstall() {
       // else: other providers still using composite — leave it
     }
 
-    // 2. Remove from enabledPlugins
-    if (settings.enabledPlugins && PLUGIN_ID in settings.enabledPlugins) {
-      delete settings.enabledPlugins[PLUGIN_ID];
-      settingsChanged = true;
+    // 2. Remove both old and new IDs from enabledPlugins
+    if (settings.enabledPlugins) {
+      for (const id of [PLUGIN_ID, OLD_PLUGIN_ID]) {
+        if (id in settings.enabledPlugins) {
+          delete settings.enabledPlugins[id];
+          settingsChanged = true;
+        }
+      }
     }
 
     // 3. Write settings if changed
@@ -173,19 +219,30 @@ function uninstall() {
     }
   }
 
-  // 4. Remove from installed_plugins.json
+  // 4. Remove both old and new IDs from installed_plugins.json
   const installedPlugins = readJson(INSTALLED_PLUGINS_PATH);
-  if (installedPlugins && installedPlugins.plugins && PLUGIN_ID in installedPlugins.plugins) {
-    delete installedPlugins.plugins[PLUGIN_ID];
-    writeJsonAtomic(INSTALLED_PLUGINS_PATH, installedPlugins);
+  if (installedPlugins && installedPlugins.plugins) {
+    let ipChanged = false;
+    for (const id of [PLUGIN_ID, OLD_PLUGIN_ID]) {
+      if (id in installedPlugins.plugins) {
+        delete installedPlugins.plugins[id];
+        ipChanged = true;
+      }
+    }
+    if (ipChanged) writeJsonAtomic(INSTALLED_PLUGINS_PATH, installedPlugins);
   }
 
   // 5. Remove cache directory
   try { fs.rmSync(CACHE_DIR, { recursive: true, force: true }); } catch { /* ok */ }
 
-  // 6. Remove plugin files from cache
-  const pluginCacheDir = path.join(os.homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'code-graph');
-  try { fs.rmSync(pluginCacheDir, { recursive: true, force: true }); } catch { /* ok */ }
+  // 6. Remove plugin files from cache (both old and new paths)
+  const pluginCacheDirs = [
+    path.join(os.homedir(), '.claude', 'plugins', 'cache', MARKETPLACE_NAME, 'code-graph'),
+    path.join(os.homedir(), '.claude', 'plugins', 'cache', 'sdsrss', 'code-graph'), // legacy
+  ];
+  for (const dir of pluginCacheDirs) {
+    try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* ok */ }
+  }
 
   return { settingsChanged };
 }
@@ -199,6 +256,11 @@ function update() {
   const settings = readJson(SETTINGS_PATH) || {};
   let settingsChanged = false;
 
+  // 0. Migrate from old PLUGIN_ID
+  if (migrateOldPluginId(settings)) {
+    settingsChanged = true;
+  }
+
   // 1. Update composite command path if version changed
   if (isOurComposite(settings)) {
     const cmd = compositeCommand();
@@ -211,23 +273,18 @@ function update() {
   // 2. Update code-graph provider in registry
   registerStatuslineProvider('code-graph', codeGraphStatuslineCommand(), false);
 
-  // 3. Ensure enabledPlugins entry exists
-  if (!settings.enabledPlugins) settings.enabledPlugins = {};
-  if (!(PLUGIN_ID in settings.enabledPlugins)) {
-    settings.enabledPlugins[PLUGIN_ID] = true;
-    settingsChanged = true;
-  }
+  // NOTE: enabledPlugins is managed by Claude Code's plugin system, not by lifecycle.
 
-  // 4. Write settings if changed
+  // 3. Write settings if changed
   if (settingsChanged) {
     writeJsonAtomic(SETTINGS_PATH, settings);
   }
 
-  // 5. Clear update-check cache (force re-check after update)
+  // 4. Clear update-check cache (force re-check after update)
   const updateCache = path.join(CACHE_DIR, 'update-check');
   try { fs.unlinkSync(updateCache); } catch { /* ok */ }
 
-  // 6. Update manifest
+  // 5. Update manifest
   manifest.version = version;
   manifest.updatedAt = new Date().toISOString();
   writeManifest(manifest);
@@ -236,11 +293,11 @@ function update() {
 }
 
 module.exports = {
-  install, uninstall, update,
+  install, uninstall, update, checkScopeConflict,
   readManifest, readJson, writeJsonAtomic,
   readRegistry, writeRegistry,
   getPluginVersion,
-  PLUGIN_ID, CACHE_DIR, REGISTRY_FILE,
+  PLUGIN_ID, OLD_PLUGIN_ID, MARKETPLACE_NAME, CACHE_DIR, REGISTRY_FILE,
 };
 
 // CLI: node lifecycle.js <install|uninstall|update>

package/claude-plugin/scripts/session-init.js

@@ -2,7 +2,7 @@
 'use strict';
 const { execFileSync } = require('child_process');
 const { findBinary } = require('./find-binary');
-const { install, update, readManifest, getPluginVersion } = require('./lifecycle');
+const { install, update, readManifest, getPluginVersion, checkScopeConflict } = require('./lifecycle');
 const { checkForUpdate } = require('./auto-update');
 
 const BIN = findBinary();
@@ -18,7 +18,16 @@ if (BIN) {
   } catch { /* timeout — silent */ }
 }
 
-// --- 2. Lifecycle: install or update config (idempotent) ---
+// --- 2. Scope conflict warning ---
+const conflict = checkScopeConflict();
+if (conflict) {
+  process.stderr.write(
+    `[code-graph] Warning: conflicting install detected — ${conflict.existingId} (${conflict.scope || 'unknown'} scope). ` +
+    `Use /plugin to remove one to avoid config conflicts.\n`
+  );
+}
+
+// --- 3. Lifecycle: install or update config (idempotent) ---
 const manifest = readManifest();
 const currentVersion = getPluginVersion();
 
@@ -28,7 +37,7 @@ if (!manifest.version) {
   update();
 }
 
-// --- 3. Auto-update (throttled, non-blocking) ---
+// --- 4. Auto-update (throttled, non-blocking) ---
 (async () => {
   const result = await checkForUpdate();
   if (result && result.updated) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -33,10 +33,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.4.3",
-    "@sdsrs/code-graph-linux-arm64": "0.4.3",
-    "@sdsrs/code-graph-darwin-x64": "0.4.3",
-    "@sdsrs/code-graph-darwin-arm64": "0.4.3",
-    "@sdsrs/code-graph-win32-x64": "0.4.3"
+    "@sdsrs/code-graph-linux-x64": "0.4.5",
+    "@sdsrs/code-graph-linux-arm64": "0.4.5",
+    "@sdsrs/code-graph-darwin-x64": "0.4.5",
+    "@sdsrs/code-graph-darwin-arm64": "0.4.5",
+    "@sdsrs/code-graph-win32-x64": "0.4.5"
   }
 }