@sdsrs/code-graph 0.45.1 → 0.45.3

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.45.1",
+  "version": "0.45.3",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -197,6 +197,20 @@ function cachedBinaryNeedsUpdate(latest, { binaryPath = cachedBinaryPath(), read
   return readVersion(binaryPath) !== latest.version;
 }
 
+/**
+ * Throttle-bypass predicate: is a *present* cached binary stale relative to the
+ * last known latest release (`state.latestVersion`, set on the previous fetch —
+ * no network here)? Used so a present-but-stale binary skips the time-based
+ * throttle instead of staying pinned for up to a full check interval. Returns
+ * false when there is no prior latestVersion (first run fetches anyway) or the
+ * binary is missing (handled by the separate `binaryMissing` bypass).
+ */
+function cachedBinaryStaleVsState(state, { binaryPath = cachedBinaryPath(), readVersion = readBinaryVersion } = {}) {
+  if (!state || !state.latestVersion) return false;
+  if (!fs.existsSync(binaryPath)) return false;
+  return readVersion(binaryPath) !== state.latestVersion;
+}
+
 /**
  * Download just the platform binary from a GitHub release into the cache.
  * Used in two paths:
@@ -353,6 +367,19 @@ async function downloadAndInstall(latest) {
 
 // ── Main Entry ─────────────────────────────────────────────
 
+/**
+ * Self-heal the cached native binary when the plugin shell is already at latest
+ * but the binary lags (missing OR a different version). This is the orchestration
+ * glue that broke twice in the field (v0.45.1, v0.45.2): the decision predicate
+ * was correct, but nothing guaranteed checkForUpdate actually invoked the download
+ * on the shell-matches-latest path. Extracted + injectable so the wiring itself is
+ * regression-tested, not just the predicate. Returns true iff a download promoted.
+ */
+async function selfHealStaleBinary(latest, { needsUpdate = cachedBinaryNeedsUpdate, download = downloadBinary } = {}) {
+  if (!needsUpdate(latest)) return false;
+  return await download(latest);
+}
+
 async function checkForUpdate({ installMissing = false } = {}) {
   try {
     // Skip in dev mode — unless the launcher explicitly requested a missing-
@@ -365,11 +392,14 @@ async function checkForUpdate({ installMissing = false } = {}) {
     // bypasses auto-update.js, so re-sync state.installedVersion every call.
     const installedVersion = readManifest().version || '0.0.0';
 
-    // Time-based throttle. A missing cache binary is a hard failure (launcher
-    // cannot start) so it overrides the throttle — without this bypass the
-    // session wedges for up to 6h waiting for the next check window.
+    // Time-based throttle. Two conditions override it: a missing cache binary
+    // (launcher cannot start) and a present-but-stale binary (otherwise it stays
+    // pinned to the old version for up to a full check interval — the binary
+    // self-heal would never run inside the throttle window). Both bypass to the
+    // fetch + self-heal path below.
     const binaryMissing = !fs.existsSync(cachedBinaryPath());
-    if (!binaryMissing && !shouldCheck(state)) {
+    const binaryStale = cachedBinaryStaleVsState(state);
+    if (!binaryMissing && !binaryStale && !shouldCheck(state)) {
       if (state.installedVersion !== installedVersion) {
         saveState({ ...state, installedVersion });
       }
@@ -414,14 +444,10 @@ async function checkForUpdate({ installMissing = false } = {}) {
     }
 
     // No plugin-shell update — but self-heal the native binary if it is missing
-    // OR stale. The shell version (manifest.version) can match latest while the
-    // cached binary lags (a previous download failed silently, the cache was
-    // wiped, an `npm install -g` optionalDependency dropped the platform package,
-    // or the marketplace bumped the shell without re-fetching the binary).
-    let selfHealedBinary = false;
-    if (cachedBinaryNeedsUpdate(latest)) {
-      selfHealedBinary = await downloadBinary(latest);
-    }
+    // OR stale (see selfHealStaleBinary). The shell version (manifest.version)
+    // can match latest while the cached binary lags — this is exactly the wild
+    // failure observed in the field (shell at v0.45, binary pinned at v0.16.6).
+    const selfHealedBinary = await selfHealStaleBinary(latest);
 
     saveState({
       ...state,
@@ -446,7 +472,8 @@ module.exports = {
   getExtractedPluginVersion, readBinaryVersion, promoteVerifiedBinary,
   isSilentMode, isInstallMissingMode,
   requestJson, parseLatestRelease, fetchLatestRelease,
-  downloadBinary, cachedBinaryPath, cachedBinaryNeedsUpdate,
+  downloadBinary, cachedBinaryPath, cachedBinaryNeedsUpdate, cachedBinaryStaleVsState,
+  selfHealStaleBinary,
 };
 
 // CLI: node auto-update.js [check|status] [--silent] [--install-missing]

package/claude-plugin/scripts/auto-update.test.js

@@ -14,7 +14,9 @@ const {
   promoteVerifiedBinary,
   cachedBinaryPath,
   cachedBinaryNeedsUpdate,
+  cachedBinaryStaleVsState,
   downloadBinary,
+  selfHealStaleBinary,
   isInstallMissingMode,
   isSilentMode,
 } = require('./auto-update');
@@ -116,6 +118,61 @@ test('cachedBinaryNeedsUpdate is version-aware, not existence-only', (t) => {
   assert.equal(cachedBinaryNeedsUpdate(null, { binaryPath }), false);
 });
 
+test('cachedBinaryStaleVsState bypasses throttle only for a present-but-stale binary', (t) => {
+  const dir = mkDir(t, 'code-graph-throttle-');
+  const binaryPath = path.join(dir, 'code-graph-mcp');
+  fs.writeFileSync(binaryPath, 'x'); // present
+
+  // no prior latestVersion → don't bypass (first run fetches anyway)
+  assert.equal(cachedBinaryStaleVsState({}, { binaryPath }), false);
+  assert.equal(cachedBinaryStaleVsState(null, { binaryPath }), false);
+
+  // present + stale vs last known latest → bypass throttle (the 6h-gap fix)
+  assert.equal(
+    cachedBinaryStaleVsState({ latestVersion: '0.45.1' }, { binaryPath, readVersion: () => '0.16.6' }),
+    true,
+  );
+
+  // present + current → stay throttled
+  assert.equal(
+    cachedBinaryStaleVsState({ latestVersion: '0.45.1' }, { binaryPath, readVersion: () => '0.45.1' }),
+    false,
+  );
+
+  // missing binary → false here (the separate binaryMissing bypass handles it)
+  fs.rmSync(binaryPath);
+  assert.equal(cachedBinaryStaleVsState({ latestVersion: '0.45.1' }, { binaryPath }), false);
+});
+
+test('selfHealStaleBinary wires the stale-binary check to a download (the v0.45.x glue)', async () => {
+  const latest = { version: '0.45.2', binaryUrl: 'https://example/bin' };
+
+  // Field failure mode: shell already at latest, binary pinned stale → MUST download.
+  let downloaded = false;
+  const healed = await selfHealStaleBinary(latest, {
+    needsUpdate: () => true,
+    download: async () => { downloaded = true; return true; },
+  });
+  assert.equal(downloaded, true, 'stale binary must trigger a download');
+  assert.equal(healed, true);
+
+  // Binary current → no download, no-op.
+  let touched = false;
+  const noop = await selfHealStaleBinary(latest, {
+    needsUpdate: () => false,
+    download: async () => { touched = true; return true; },
+  });
+  assert.equal(touched, false, 'current binary must not download');
+  assert.equal(noop, false);
+
+  // Download fails (no curl / network) → returns false so the next session retries.
+  const failed = await selfHealStaleBinary(latest, {
+    needsUpdate: () => true,
+    download: async () => false,
+  });
+  assert.equal(failed, false);
+});
+
 test('parseLatestRelease selects the matching platform asset', () => {
   const latest = parseLatestRelease({
     tag_name: 'v1.2.3',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.45.1",
+  "version": "0.45.3",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.45.1",
-    "@sdsrs/code-graph-linux-arm64": "0.45.1",
-    "@sdsrs/code-graph-darwin-x64": "0.45.1",
-    "@sdsrs/code-graph-darwin-arm64": "0.45.1",
-    "@sdsrs/code-graph-win32-x64": "0.45.1"
+    "@sdsrs/code-graph-linux-x64": "0.45.3",
+    "@sdsrs/code-graph-linux-arm64": "0.45.3",
+    "@sdsrs/code-graph-darwin-x64": "0.45.3",
+    "@sdsrs/code-graph-darwin-arm64": "0.45.3",
+    "@sdsrs/code-graph-win32-x64": "0.45.3"
   }
 }