@sdsrs/code-graph 0.5.26 → 0.5.28

package/README.md

@@ -118,7 +118,7 @@ What you get:
 - **Code Explorer Agent** — Deep code understanding expert via `code-explorer`
 - **Auto-indexing Hook** — Incremental index on every file edit (PostToolUse)
 - **StatusLine** — Real-time health display (nodes, files, watch status) — compatible with other plugins' StatusLine via composite multiplexer
-- **Auto-update** — Checks for new versions every 24h, updates silently
+- **Auto-update** — Checks for new versions every 6h, updates silently
 
 #### Manual Update
 

package/bin/cli.js

@@ -1,62 +1,23 @@
 #!/usr/bin/env node
 
-const { execFileSync, spawn } = require("child_process");
+const { spawn } = require("child_process");
 const path = require("path");
-const fs = require("fs");
-const os = require("os");
 
-function getBinaryName() {
-  return os.platform() === "win32" ? "code-graph-mcp.exe" : "code-graph-mcp";
-}
-
-function findBinary() {
-  const binaryName = getBinaryName();
-
-  // 1. Check platform-specific npm package (code-graph-<os>-<arch>)
-  const platformPkg = `@sdsrs/code-graph-${os.platform()}-${os.arch()}`;
-  try {
-    const pkgPath = require.resolve(`${platformPkg}/package.json`);
-    const pkgDir = path.dirname(pkgPath);
-    const platBinary = path.join(pkgDir, binaryName);
-    if (fs.existsSync(platBinary)) {
-      return platBinary;
-    }
-  } catch {
-    // Platform package not installed
-  }
-
-  // 2. Check bundled binary in the same directory
-  const bundled = path.join(__dirname, binaryName);
-  if (fs.existsSync(bundled)) {
-    return bundled;
-  }
+// Tell find-binary.js our package root so it can locate bundled binaries
+// and detect dev mode from bin/ → repo root (one level up)
+process.env._FIND_BINARY_ROOT = path.resolve(__dirname, "..");
 
-  // 3. Check cargo build output (for development)
-  const cargoRelease = path.join(__dirname, "..", "target", "release", binaryName);
-  if (fs.existsSync(cargoRelease)) {
-    return cargoRelease;
-  }
-
-  // 4. Check if available in PATH
-  try {
-    const which = os.platform() === "win32" ? "where" : "which";
-    const result = execFileSync(which, [binaryName], { encoding: "utf8" }).trim();
-    if (result) return result;
-  } catch {
-    // not in PATH
-  }
-
-  return null;
-}
+const { findBinary } = require("../claude-plugin/scripts/find-binary");
 
 const binary = findBinary();
 
 if (!binary) {
   console.error(
     "Error: code-graph-mcp binary not found.\n\n" +
+    "To install:\n" +
+    "  npm install -g @sdsrs/code-graph\n\n" +
     "To build from source:\n" +
-    "  cargo build --release --no-default-features\n\n" +
-    "Or install the platform-specific binary."
+    "  cargo build --release\n"
   );
   process.exit(1);
 }

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,6 +4,12 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.5.26",
-  "keywords": ["code-graph", "ast", "navigation", "mcp", "knowledge-graph"]
+  "version": "0.5.28",
+  "keywords": [
+    "code-graph",
+    "ast",
+    "navigation",
+    "mcp",
+    "knowledge-graph"
+  ]
 }

package/claude-plugin/hooks/hooks.json

@@ -66,10 +66,10 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/session-init.js\"",
-            "timeout": 20
+            "timeout": 5
           }
         ],
-        "description": "Health check, StatusLine registration, and update check at session start"
+        "description": "StatusLine self-heal, lifecycle sync, and background update launch at session start"
       }
     ]
   }

package/claude-plugin/scripts/auto-update.js

@@ -2,17 +2,39 @@
 'use strict';
 const { execFileSync } = require('child_process');
 const fs = require('fs');
+const https = require('https');
 const path = require('path');
 const os = require('os');
 const { CACHE_DIR, PLUGIN_ID, MARKETPLACE_NAME, readManifest, readJson, writeJsonAtomic } = require('./lifecycle');
+const { clearCache: clearBinaryCache } = require('./find-binary');
 
 // ── Configuration ──────────────────────────────────────────
 const GITHUB_REPO = 'sdsrss/code-graph-mcp';
-const NPM_PACKAGE = '@sdsrs/code-graph';
 const STATE_FILE = path.join(CACHE_DIR, 'update-state.json');
-const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;       // 24h
-const RATE_LIMIT_INTERVAL_MS = 6 * 60 * 60 * 1000;   // 6h if rate-limited
+const BINARY_CACHE_DIR = path.join(CACHE_DIR, 'bin');
+const CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;        // 6h
+const RATE_LIMIT_INTERVAL_MS = 24 * 60 * 60 * 1000;  // 24h if rate-limited
 const FETCH_TIMEOUT_MS = 3000;
+const VERSION_OUTPUT_RE = /^code-graph-mcp\s+(\d+\.\d+\.\d+)$/;
+
+function isSilentMode(argv = process.argv.slice(2), env = process.env) {
+  return argv.includes('--silent') || env.CODE_GRAPH_AUTO_UPDATE_SILENT === '1';
+}
+
+// ── Platform → GitHub release asset name mapping ──────────
+function getPlatformAssetName() {
+  const platform = os.platform();
+  const arch = os.arch();
+  const key = `${platform}-${arch}`;
+  const map = {
+    'linux-x64': 'code-graph-mcp-linux-x64',
+    'linux-arm64': 'code-graph-mcp-linux-arm64',
+    'darwin-x64': 'code-graph-mcp-darwin-x64',
+    'darwin-arm64': 'code-graph-mcp-darwin-arm64',
+    'win32-x64': 'code-graph-mcp-win32-x64.exe',
+  };
+  return map[key] || null;
+}
 
 // ── State Persistence ──────────────────────────────────────
 
@@ -60,30 +82,67 @@ function compareVersions(a, b) {
 
 // ── GitHub API ─────────────────────────────────────────────
 
-async function fetchLatestRelease() {
-  const url = `https://api.github.com/repos/${GITHUB_REPO}/releases/latest`;
-  try {
-    const res = await fetch(url, {
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+function requestJson(url, timeoutMs = FETCH_TIMEOUT_MS) {
+  return new Promise((resolve, reject) => {
+    const req = https.request(url, {
+      method: 'GET',
       headers: {
         'Accept': 'application/vnd.github+json',
         'User-Agent': 'code-graph-auto-update/1.0',
       },
+    }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (chunk) => { body += chunk; });
+      res.on('end', () => {
+        if (!res.statusCode) {
+          reject(new Error('missing status code'));
+          return;
+        }
+        resolve({ statusCode: res.statusCode, body });
+      });
     });
 
-    if (res.status === 403) {
-      // Rate limited
+    req.setTimeout(timeoutMs, () => req.destroy(new Error('request timeout')));
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+function parseLatestRelease(data, assetName = getPlatformAssetName()) {
+  if (!data || typeof data.tag_name !== 'string' || typeof data.tarball_url !== 'string') {
+    return null;
+  }
+
+  let binaryUrl = null;
+  if (assetName && Array.isArray(data.assets)) {
+    const asset = data.assets.find((entry) => entry && entry.name === assetName);
+    if (asset && typeof asset.browser_download_url === 'string') {
+      binaryUrl = asset.browser_download_url;
+    }
+  }
+
+  return {
+    version: data.tag_name.replace(/^v/, ''),
+    tarballUrl: data.tarball_url,
+    binaryUrl,
+  };
+}
+
+async function fetchLatestRelease(requestJsonFn = requestJson) {
+  const url = `https://api.github.com/repos/${GITHUB_REPO}/releases/latest`;
+  try {
+    const res = await requestJsonFn(url, FETCH_TIMEOUT_MS);
+
+    if (res.statusCode === 403) {
       const state = readState();
       saveState({ ...state, rateLimited: true });
       return null;
     }
-    if (!res.ok) return null;
+    if (res.statusCode < 200 || res.statusCode >= 300) return null;
 
-    const data = await res.json();
-    return {
-      version: data.tag_name.replace(/^v/, ''),
-      tarballUrl: data.tarball_url,
-    };
+    const data = JSON.parse(res.body);
+    return parseLatestRelease(data);
   } catch { return null; }
 }
 
@@ -102,14 +161,60 @@ function copyDirSync(src, dst) {
   }
 }
 
+function getExtractedPluginVersion(pluginSrc) {
+  const manifest = readJson(path.join(pluginSrc, '.claude-plugin', 'plugin.json'));
+  return manifest && typeof manifest.version === 'string' ? manifest.version : null;
+}
+
+function readBinaryVersion(binaryPath) {
+  try {
+    const out = execFileSync(binaryPath, ['--version'], {
+      timeout: 2000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).toString().trim();
+    const match = out.match(VERSION_OUTPUT_RE);
+    return match ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+
+function promoteVerifiedBinary(binaryTmp, binaryDst, expectedVersion) {
+  try {
+    const stat = fs.statSync(binaryTmp);
+    if (stat.size <= 1_000_000) return false;
+
+    const actualVersion = readBinaryVersion(binaryTmp);
+    if (!actualVersion || (expectedVersion && actualVersion !== expectedVersion)) {
+      return false;
+    }
+
+    fs.renameSync(binaryTmp, binaryDst);
+    if (os.platform() !== 'win32') {
+      fs.chmodSync(binaryDst, 0o755);
+    }
+    clearBinaryCache();
+    return true;
+  } catch {
+    return false;
+  } finally {
+    try {
+      if (fs.existsSync(binaryTmp)) fs.unlinkSync(binaryTmp);
+    } catch { /* ok */ }
+  }
+}
+
 // ── Download & Install ─────────────────────────────────────
 
 async function downloadAndInstall(latest) {
   const tmpDir = path.join(os.tmpdir(), `code-graph-update-${Date.now()}`);
+  let pluginUpdated = false;
+  let binaryUpdated = false;
+
   try {
     fs.mkdirSync(tmpDir, { recursive: true });
 
-    // 1. Download tarball (safe: no shell interpolation)
+    // ── Step 1: Download and install plugin files from tarball ──
     const tarballPath = path.join(tmpDir, 'release.tar.gz');
     execFileSync('curl', [
       '-sL', '-o', tarballPath,
@@ -117,23 +222,22 @@ async function downloadAndInstall(latest) {
       latest.tarballUrl,
     ], { timeout: 30000, stdio: 'pipe' });
 
-    // 2. Extract tarball
     execFileSync('tar', [
       'xzf', tarballPath, '-C', tmpDir, '--strip-components=1',
     ], { timeout: 15000, stdio: 'pipe' });
 
-    // 3. Copy plugin files to cache (cross-platform)
     const pluginSrc = path.join(tmpDir, 'claude-plugin');
     const pluginDst = path.join(
       os.homedir(), '.claude', 'plugins', 'cache', MARKETPLACE_NAME, 'code-graph-mcp', latest.version
     );
 
-    if (fs.existsSync(pluginSrc)) {
+    if (fs.existsSync(pluginSrc) && getExtractedPluginVersion(pluginSrc) === latest.version) {
       fs.mkdirSync(pluginDst, { recursive: true });
       copyDirSync(pluginSrc, pluginDst);
+      pluginUpdated = true;
     }
 
-    // 4. Update installed_plugins.json to point to new version
+    // Update installed_plugins.json to point to new version
     const installedPath = path.join(os.homedir(), '.claude', 'plugins', 'installed_plugins.json');
     try {
       const installed = readJson(installedPath);
@@ -143,30 +247,41 @@ async function downloadAndInstall(latest) {
         installed.plugins[PLUGIN_ID][0].lastUpdated = new Date().toISOString();
         writeJsonAtomic(installedPath, installed);
       }
-    } catch { /* installed_plugins update failed — not fatal */ }
+    } catch { /* not fatal */ }
 
-    // 5. Update install manifest with tag version
+    // Update install manifest
     try {
       const manifest = readManifest();
       manifest.version = latest.version;
       manifest.updatedAt = new Date().toISOString();
       writeJsonAtomic(path.join(CACHE_DIR, 'install-manifest.json'), manifest);
-    } catch { /* manifest update failed — not fatal */ }
-
-    // 6. Update npm binary (non-blocking, best-effort)
-    try {
-      execFileSync('npm', ['install', '-g', `${NPM_PACKAGE}@${latest.version}`], {
-        timeout: 60000,
-        stdio: 'pipe',
-      });
-    } catch {
-      // npm install failed — plugin files still updated
-      // User can manually update binary later
+    } catch { /* not fatal */ }
+
+    // ── Step 2: Download platform binary directly from GitHub release ──
+    if (latest.binaryUrl) {
+      try {
+        const binaryName = os.platform() === 'win32' ? 'code-graph-mcp.exe' : 'code-graph-mcp';
+        const binaryDst = path.join(BINARY_CACHE_DIR, binaryName);
+        const binaryTmp = binaryDst + '.tmp.' + process.pid;
+
+        fs.mkdirSync(BINARY_CACHE_DIR, { recursive: true });
+        execFileSync('curl', [
+          '-sL', '-o', binaryTmp,
+          latest.binaryUrl,
+        ], { timeout: 60000, stdio: 'pipe' });
+
+        if (promoteVerifiedBinary(binaryTmp, binaryDst, latest.version)) {
+          binaryUpdated = true;
+        }
+      } catch {
+        // Binary download failed — plugin update still counts as success
+      }
     }
 
-    return true;
-  } catch { return false; }
-  finally {
+    return { pluginUpdated, binaryUpdated };
+  } catch {
+    return { pluginUpdated: false, binaryUpdated: false };
+  } finally {
     try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch { /* ok */ }
   }
 }
@@ -182,7 +297,6 @@ async function checkForUpdate() {
 
     // Time-based throttle
     if (!shouldCheck(state)) {
-      // Report pending update from previous check
       if (state.updateAvailable && state.latestVersion) {
         return { updateAvailable: true, from: state.installedVersion, to: state.latestVersion };
       }
@@ -202,8 +316,8 @@ async function checkForUpdate() {
     const hasUpdate = compareVersions(latest.version, currentVersion) > 0;
 
     if (hasUpdate) {
-      // Auto-update
-      const success = await downloadAndInstall(latest);
+      const result = await downloadAndInstall(latest);
+      const success = result.pluginUpdated;
       const newState = {
         lastCheck: new Date().toISOString(),
         installedVersion: success ? latest.version : currentVersion,
@@ -211,12 +325,14 @@ async function checkForUpdate() {
         updateAvailable: !success,
         lastUpdate: success ? new Date().toISOString() : state.lastUpdate,
         rateLimited: false,
+        binaryUpdated: result.binaryUpdated,
       };
       saveState(newState);
 
       return {
         updateAvailable: !success,
         updated: success,
+        binaryUpdated: result.binaryUpdated,
         from: currentVersion,
         to: latest.version,
       };
@@ -237,20 +353,27 @@ async function checkForUpdate() {
   }
 }
 
-module.exports = { checkForUpdate, isDevMode, readState };
+module.exports = {
+  checkForUpdate, isDevMode, readState, compareVersions,
+  getExtractedPluginVersion, readBinaryVersion, promoteVerifiedBinary, isSilentMode,
+  requestJson, parseLatestRelease, fetchLatestRelease,
+};
 
 // CLI: node auto-update.js [check|status]
 if (require.main === module) {
   (async () => {
-    const cmd = process.argv[2] || 'check';
+    const argv = process.argv.slice(2);
+    const cmd = argv.find(arg => !arg.startsWith('--')) || 'check';
+    const silent = isSilentMode(argv);
     if (cmd === 'status') {
       const state = readState();
       console.log(JSON.stringify(state, null, 2));
     } else {
-      console.log('Checking for updates...');
+      if (!silent) console.log('Checking for updates...');
       const result = await checkForUpdate();
+      if (silent) return;
       if (result && result.updated) {
-        console.log(`Updated: v${result.from} → v${result.to}`);
+        console.log(`Updated: v${result.from} → v${result.to} (binary: ${result.binaryUpdated ? 'yes' : 'no'})`);
       } else if (result && result.updateAvailable) {
         console.log(`Update available: v${result.to} (auto-install failed)`);
       } else if (isDevMode()) {

package/claude-plugin/scripts/auto-update.test.js

@@ -0,0 +1,97 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const {
+  fetchLatestRelease,
+  getExtractedPluginVersion,
+  parseLatestRelease,
+  readBinaryVersion,
+  promoteVerifiedBinary,
+} = require('./auto-update');
+
+function mkDir(prefix) {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+test('getExtractedPluginVersion reads extracted plugin manifest version', () => {
+  const root = mkDir('code-graph-plugin-');
+  const manifest = path.join(root, '.claude-plugin', 'plugin.json');
+  fs.mkdirSync(path.dirname(manifest), { recursive: true });
+  fs.writeFileSync(manifest, JSON.stringify({ version: '1.2.3' }, null, 2));
+  assert.equal(getExtractedPluginVersion(root), '1.2.3');
+});
+
+function writeFakeBinary(filePath, version) {
+  const script = [
+    '#!/usr/bin/env bash',
+    'if [ "$1" = "--version" ]; then',
+    `  echo "code-graph-mcp ${version}"`,
+    '  exit 0',
+    'fi',
+    'exit 0',
+    `# ${'x'.repeat(1_100_000)}`,
+    '',
+  ].join('\n');
+  fs.writeFileSync(filePath, script);
+  fs.chmodSync(filePath, 0o755);
+}
+
+test('promoteVerifiedBinary accepts a runnable binary with the expected version', () => {
+  const dir = mkDir('code-graph-bin-');
+  const tmp = path.join(dir, 'code-graph-mcp.tmp');
+  const dst = path.join(dir, 'code-graph-mcp');
+  writeFakeBinary(tmp, '1.2.3');
+
+  assert.equal(readBinaryVersion(tmp), '1.2.3');
+  assert.equal(promoteVerifiedBinary(tmp, dst, '1.2.3'), true);
+  assert.equal(fs.existsSync(tmp), false);
+  assert.equal(fs.existsSync(dst), true);
+});
+
+test('promoteVerifiedBinary rejects binaries with mismatched version', () => {
+  const dir = mkDir('code-graph-bin-');
+  const tmp = path.join(dir, 'code-graph-mcp.tmp');
+  const dst = path.join(dir, 'code-graph-mcp');
+  writeFakeBinary(tmp, '1.2.2');
+
+  assert.equal(promoteVerifiedBinary(tmp, dst, '1.2.3'), false);
+  assert.equal(fs.existsSync(tmp), false);
+  assert.equal(fs.existsSync(dst), false);
+});
+
+test('parseLatestRelease selects the matching platform asset', () => {
+  const latest = parseLatestRelease({
+    tag_name: 'v1.2.3',
+    tarball_url: 'https://example.com/tarball.tgz',
+    assets: [
+      { name: 'code-graph-mcp-linux-x64', browser_download_url: 'https://example.com/linux-x64' },
+      { name: 'other', browser_download_url: 'https://example.com/other' },
+    ],
+  }, 'code-graph-mcp-linux-x64');
+
+  assert.deepEqual(latest, {
+    version: '1.2.3',
+    tarballUrl: 'https://example.com/tarball.tgz',
+    binaryUrl: 'https://example.com/linux-x64',
+  });
+});
+
+test('fetchLatestRelease parses JSON without relying on global fetch', async () => {
+  const latest = await fetchLatestRelease(async () => ({
+    statusCode: 200,
+    body: JSON.stringify({
+      tag_name: 'v2.0.0',
+      tarball_url: 'https://example.com/release.tgz',
+      assets: [
+        { name: 'code-graph-mcp-linux-x64', browser_download_url: 'https://example.com/bin' },
+      ],
+    }),
+  }));
+
+  assert.equal(latest.version, '2.0.0');
+  assert.equal(latest.tarballUrl, 'https://example.com/release.tgz');
+});

package/claude-plugin/scripts/find-binary.js

@@ -6,25 +6,43 @@ const fs = require('fs');
 const os = require('os');
 
 const PLATFORM = os.platform();
+const ARCH = os.arch();
 const CACHE_FILE = path.join(os.homedir(), '.cache', 'code-graph', 'binary-path');
+const BINARY_NAME = PLATFORM === 'win32' ? 'code-graph-mcp.exe' : 'code-graph-mcp';
+
+function isNativeBinary(candidate) {
+  if (!candidate) return false;
+  try {
+    if (!fs.existsSync(candidate)) return false;
+    const realPath = fs.realpathSync(candidate);
+    return path.basename(realPath) === BINARY_NAME;
+  } catch {
+    return false;
+  }
+}
 
 /**
  * Locate the code-graph-mcp binary using multiple strategies.
  * Results are cached to disk so repeated calls (e.g. per-hook) are fast.
- * Priority: cache > PATH > local dev build > cargo install > npm platform pkg > npx cache
+ *
+ * Priority:
+ *   cache (if valid) → dev-mode (target/release) → auto-update cache
+ *   → platform npm pkg → bundled (bin/) → cargo install → PATH → npx cache
+ *
  * Returns the absolute path or null if not found.
  */
 function findBinary() {
   // Try disk cache first (avoids spawning `which` on hot paths)
   try {
     const cached = fs.readFileSync(CACHE_FILE, 'utf8').trim();
-    if (cached && fs.existsSync(cached)) return cached;
+    if (isNativeBinary(cached)) return cached;
+    if (cached) clearCache();
   } catch { /* no cache or stale */ }
 
   const result = findBinaryUncached();
 
   // Write cache for subsequent calls
-  if (result) {
+  if (isNativeBinary(result)) {
     try {
       fs.mkdirSync(path.dirname(CACHE_FILE), { recursive: true });
       fs.writeFileSync(CACHE_FILE, result);
@@ -34,50 +52,95 @@ function findBinary() {
   return result;
 }
 
+/**
+ * Detect if we're running from the source repo (e.g. npm link).
+ * Checks relative to a given root directory for Cargo.toml.
+ */
+function isDevRepo(rootDir) {
+  return fs.existsSync(path.join(rootDir, 'Cargo.toml'));
+}
+
 function findBinaryUncached() {
-  const name = PLATFORM === 'win32' ? 'code-graph-mcp.exe' : 'code-graph-mcp';
+  // --- Dev mode: always prefer cargo build output when running from source repo ---
+  // This covers: npm link, direct invocation from repo, CLAUDE_PROJECT_DIR set to repo
+  const possibleRoots = new Set();
 
-  // 1. PATH lookup (user has intentionally installed it)
-  try {
-    const which = PLATFORM === 'win32' ? 'where' : 'which';
-    const found = execFileSync(which, [name], { stdio: ['pipe', 'pipe', 'pipe'] })
-      .toString().trim().split('\n')[0];
-    if (found && fs.existsSync(found)) return found;
-  } catch { /* not in PATH */ }
+  // From plugin scripts context (claude-plugin/scripts/ → repo root is ../..)
+  possibleRoots.add(path.resolve(__dirname, '..', '..'));
+  // From bin/ context (cli.js sets FIND_BINARY_ROOT)
+  if (process.env._FIND_BINARY_ROOT) {
+    possibleRoots.add(path.resolve(process.env._FIND_BINARY_ROOT));
+  }
+  // From CLAUDE_PROJECT_DIR
+  if (process.env.CLAUDE_PROJECT_DIR) {
+    possibleRoots.add(path.resolve(process.env.CLAUDE_PROJECT_DIR));
+  }
 
-  // 2. Local dev build (target/release in project directory)
-  const projectRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
-  const devBin = path.join(projectRoot, 'target', 'release', name);
-  if (fs.existsSync(devBin)) return devBin;
+  for (const root of possibleRoots) {
+    if (isDevRepo(root)) {
+      const devBin = path.join(root, 'target', 'release', BINARY_NAME);
+      if (isNativeBinary(devBin)) return devBin;
+    }
+  }
 
-  // 3. Cargo install (~/.cargo/bin)
-  const cargoBin = path.join(os.homedir(), '.cargo', 'bin', name);
-  if (fs.existsSync(cargoBin)) return cargoBin;
+  // --- Auto-update cache (binary downloaded directly from GitHub release) ---
+  const autoUpdateBin = path.join(os.homedir(), '.cache', 'code-graph', 'bin', BINARY_NAME);
+  if (isNativeBinary(autoUpdateBin)) return autoUpdateBin;
 
-  // 4. npm platform package (installed via @sdsrs/code-graph)
-  const platformPkg = `@sdsrs/code-graph-${PLATFORM}-${os.arch()}`;
+  // --- Platform-specific npm package (@sdsrs/code-graph-{os}-{arch}) ---
+  const platformPkg = `@sdsrs/code-graph-${PLATFORM}-${ARCH}`;
   try {
     const pkgPath = require.resolve(`${platformPkg}/package.json`);
-    const bin = path.join(path.dirname(pkgPath), name);
-    if (fs.existsSync(bin)) return bin;
+    const bin = path.join(path.dirname(pkgPath), BINARY_NAME);
+    if (isNativeBinary(bin)) return bin;
   } catch { /* not installed via npm */ }
 
-  // 5. npx cache (last resort — may be outdated)
+  // --- Bundled binary (in same directory as cli.js or plugin scripts) ---
+  // Check bin/ directory of the npm package
+  const binDirs = new Set();
+  if (process.env._FIND_BINARY_ROOT) {
+    binDirs.add(path.join(process.env._FIND_BINARY_ROOT, 'bin'));
+  }
+  binDirs.add(path.resolve(__dirname, '..', '..', 'bin'));
+  for (const dir of binDirs) {
+    const bundled = path.join(dir, BINARY_NAME);
+    if (isNativeBinary(bundled)) return bundled;
+  }
+
+  // --- Cargo install (~/.cargo/bin) ---
+  const cargoBin = path.join(os.homedir(), '.cargo', 'bin', BINARY_NAME);
+  if (isNativeBinary(cargoBin)) return cargoBin;
+
+  // --- PATH lookup (last resort for intentionally installed binaries) ---
+  try {
+    const which = PLATFORM === 'win32' ? 'where' : 'which';
+    const found = execFileSync(which, [BINARY_NAME], { stdio: ['pipe', 'pipe', 'pipe'] })
+      .toString().trim().split('\n')[0];
+    if (isNativeBinary(found)) return found;
+  } catch { /* not in PATH */ }
+
+  // --- npx cache (very last resort — may be outdated) ---
   const npxDir = path.join(os.homedir(), '.npm', '_npx');
   try {
     for (const entry of fs.readdirSync(npxDir)) {
-      const pkgJsonPath = path.join(npxDir, entry, 'node_modules', '@sdsrs', 'code-graph', 'package.json');
-      if (!fs.existsSync(pkgJsonPath)) continue;
-      const platDir = path.join(npxDir, entry, 'node_modules', '@sdsrs', `code-graph-${PLATFORM}-${os.arch()}`);
-      const platBin = path.join(platDir, name);
-      if (fs.existsSync(platBin)) return platBin;
+      const platDir = path.join(npxDir, entry, 'node_modules', '@sdsrs', `code-graph-${PLATFORM}-${ARCH}`);
+      const platBin = path.join(platDir, BINARY_NAME);
+      if (isNativeBinary(platBin)) return platBin;
     }
   } catch { /* no npx cache */ }
 
   return null;
 }
 
-module.exports = { findBinary };
+/**
+ * Clear the disk cache. Call this after binary updates so the next
+ * findBinary() picks up the new location.
+ */
+function clearCache() {
+  try { fs.unlinkSync(CACHE_FILE); } catch { /* ok */ }
+}
+
+module.exports = { findBinary, findBinaryUncached, clearCache, CACHE_FILE, BINARY_NAME };
 
 // Allow direct invocation for testing
 if (require.main === module) {

package/claude-plugin/scripts/lifecycle.e2e.test.js

@@ -0,0 +1,91 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const repoRoot = path.resolve(__dirname, '..', '..');
+const pluginRoot = path.resolve(__dirname, '..');
+const lifecycleCli = path.join(__dirname, 'lifecycle.js');
+const compositeCli = path.join(__dirname, 'statusline-composite.js');
+const currentVersion = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8')).version;
+
+function mkHome() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'code-graph-e2e-'));
+}
+
+function writeJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value, null, 2) + '\n');
+}
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+function runScript(homeDir, scriptPath, args = [], options = {}) {
+  return execFileSync(process.execPath, [scriptPath, ...args], {
+    cwd: options.cwd || repoRoot,
+    env: { ...process.env, HOME: homeDir, CLAUDE_PLUGIN_ROOT: pluginRoot },
+    input: options.input,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  }).toString();
+}
+
+test('lifecycle CLI handles install, disable self-heal, re-enable, and uninstall', () => {
+  const homeDir = mkHome();
+  const settingsPath = path.join(homeDir, '.claude', 'settings.json');
+  const installedPath = path.join(homeDir, '.claude', 'plugins', 'installed_plugins.json');
+  const registryPath = path.join(homeDir, '.cache', 'code-graph', 'statusline-registry.json');
+  const manifestPath = path.join(homeDir, '.cache', 'code-graph', 'install-manifest.json');
+  const cacheDir = path.join(homeDir, '.cache', 'code-graph');
+
+  writeJson(settingsPath, {
+    statusLine: { type: 'command', command: 'echo previous-status' },
+    enabledPlugins: { 'code-graph-mcp@code-graph-mcp': true },
+  });
+  writeJson(installedPath, {
+    plugins: {
+      'code-graph-mcp@code-graph-mcp': [{
+        installPath: pluginRoot,
+        version: currentVersion,
+        scope: 'user',
+      }],
+    },
+  });
+
+  runScript(homeDir, lifecycleCli, ['install']);
+  let settings = readJson(settingsPath);
+  let registry = readJson(registryPath);
+  let manifest = readJson(manifestPath);
+  assert.match(settings.statusLine.command, /statusline-composite\.js/);
+  assert.equal(registry[0].id, '_previous');
+  assert.equal(registry[1].id, 'code-graph');
+  assert.equal(manifest.version, currentVersion);
+
+  settings.enabledPlugins['code-graph-mcp@code-graph-mcp'] = false;
+  writeJson(settingsPath, settings);
+  runScript(homeDir, compositeCli, [], { input: '{}' });
+  settings = readJson(settingsPath);
+  assert.equal(settings.statusLine.command, 'echo previous-status');
+  assert.equal(fs.existsSync(registryPath), false);
+
+  settings.enabledPlugins['code-graph-mcp@code-graph-mcp'] = true;
+  writeJson(settingsPath, settings);
+  runScript(homeDir, lifecycleCli, ['install']);
+  settings = readJson(settingsPath);
+  registry = readJson(registryPath);
+  assert.match(settings.statusLine.command, /statusline-composite\.js/);
+  assert.equal(registry.length, 2);
+
+  runScript(homeDir, lifecycleCli, ['uninstall']);
+  settings = readJson(settingsPath);
+  const installed = readJson(installedPath);
+  assert.equal(settings.statusLine.command, 'echo previous-status');
+  assert.deepEqual(settings.enabledPlugins, {});
+  assert.deepEqual(installed.plugins, {});
+  assert.equal(fs.existsSync(cacheDir), false);
+});
+

package/claude-plugin/scripts/lifecycle.js

@@ -53,6 +53,15 @@ function codeGraphStatuslineCommand() {
   return `node ${JSON.stringify(path.join(PLUGIN_ROOT, 'scripts', 'statusline.js'))}`;
 }
 
+function hasOwn(obj, key) {
+  return !!obj && Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+function hasInstalledPluginRecord() {
+  const installed = readJson(INSTALLED_PLUGINS_PATH);
+  return !!(installed && installed.plugins && Array.isArray(installed.plugins[PLUGIN_ID]) && installed.plugins[PLUGIN_ID].length > 0);
+}
+
 function isOurComposite(settings) {
   return settings.statusLine &&
     settings.statusLine.command &&
@@ -67,6 +76,10 @@ function readRegistry() {
 }
 
 function writeRegistry(registry) {
+  if (!registry || registry.length === 0) {
+    try { fs.unlinkSync(REGISTRY_FILE); } catch { /* ok */ }
+    return;
+  }
   writeJsonAtomic(REGISTRY_FILE, registry);
 }
 
@@ -93,6 +106,58 @@ function unregisterStatuslineProvider(id) {
   return true;
 }
 
+function isPluginExplicitlyDisabled(settings = readJson(SETTINGS_PATH) || {}) {
+  return hasOwn(settings.enabledPlugins, PLUGIN_ID) && settings.enabledPlugins[PLUGIN_ID] === false;
+}
+
+function isPluginInactive(settings = readJson(SETTINGS_PATH) || {}) {
+  if (isPluginExplicitlyDisabled(settings)) return true;
+
+  const hasComposite = isOurComposite(settings);
+  const hasCodeGraphRegistry = readRegistry().some((provider) => provider.id === 'code-graph');
+  if (!hasComposite && !hasCodeGraphRegistry) return false;
+
+  const installed = readJson(INSTALLED_PLUGINS_PATH);
+  if (!installed || !installed.plugins) return false;
+  return !hasInstalledPluginRecord();
+}
+
+function detachStatuslineIntegration(settings) {
+  let settingsChanged = false;
+
+  unregisterStatuslineProvider('code-graph');
+  const previous = readRegistry().find(p => p.id === '_previous' && p.command);
+
+  // If our composite is still configured while the plugin is disabled/uninstalled,
+  // prefer restoring the prior statusline (or removing ours entirely) so the plugin
+  // truly stops affecting Claude Code.
+  if (isOurComposite(settings)) {
+    if (previous) {
+      settings.statusLine = { type: 'command', command: previous.command };
+    } else {
+      delete settings.statusLine;
+    }
+    settingsChanged = true;
+  }
+
+  unregisterStatuslineProvider('_previous');
+  return settingsChanged;
+}
+
+function cleanupDisabledStatusline() {
+  const settings = readJson(SETTINGS_PATH);
+  if (!settings || !isPluginInactive(settings)) {
+    return { cleaned: false, settingsChanged: false };
+  }
+
+  const settingsChanged = detachStatuslineIntegration(settings);
+  if (settingsChanged) {
+    writeJsonAtomic(SETTINGS_PATH, settings);
+  }
+
+  return { cleaned: true, settingsChanged };
+}
+
 // --- Scope Conflict Detection ---
 
 function checkScopeConflict() {
@@ -207,22 +272,9 @@ function uninstall() {
   let settingsChanged = false;
 
   if (settings) {
-    // 1. StatusLine: remove code-graph from registry
-    unregisterStatuslineProvider('code-graph');
-    const remaining = readRegistry();
-
-    if (isOurComposite(settings)) {
-      if (remaining.length === 1 && remaining[0].id === '_previous') {
-        // Only the previous provider remains — restore it directly
-        settings.statusLine = { type: 'command', command: remaining[0].command };
-        unregisterStatuslineProvider('_previous');
-        settingsChanged = true;
-      } else if (remaining.length === 0) {
-        // No providers left — remove statusLine entirely
-        delete settings.statusLine;
-        settingsChanged = true;
-      }
-      // else: other providers still using composite — leave it
+    // 1. StatusLine: remove code-graph integration and restore prior statusline.
+    if (detachStatuslineIntegration(settings)) {
+      settingsChanged = true;
     }
 
     // 2. Remove all known IDs from enabledPlugins
@@ -317,6 +369,7 @@ function update() {
 
 module.exports = {
   install, uninstall, update, checkScopeConflict,
+  isPluginExplicitlyDisabled, isPluginInactive, cleanupDisabledStatusline,
   readManifest, readJson, writeJsonAtomic,
   readRegistry, writeRegistry,
   getPluginVersion,

package/claude-plugin/scripts/lifecycle.test.js

@@ -0,0 +1,97 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const lifecyclePath = path.join(__dirname, 'lifecycle.js');
+const statuslinePath = path.join(__dirname, 'statusline.js');
+
+function mkHome() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'code-graph-home-'));
+}
+
+function writeJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value, null, 2) + '\n');
+}
+
+function seedDisabledComposite(homeDir) {
+  const settingsPath = path.join(homeDir, '.claude', 'settings.json');
+  const registryPath = path.join(homeDir, '.cache', 'code-graph', 'statusline-registry.json');
+  writeJson(settingsPath, {
+    statusLine: { type: 'command', command: 'node "/plugin/statusline-composite.js"' },
+    enabledPlugins: { 'code-graph-mcp@code-graph-mcp': false },
+  });
+  writeJson(registryPath, [
+    { id: '_previous', command: 'echo previous-status', needsStdin: true },
+    { id: 'code-graph', command: 'node "/plugin/statusline.js"', needsStdin: false },
+  ]);
+  return { settingsPath, registryPath };
+}
+
+function seedOrphanedComposite(homeDir) {
+  const settingsPath = path.join(homeDir, '.claude', 'settings.json');
+  const registryPath = path.join(homeDir, '.cache', 'code-graph', 'statusline-registry.json');
+  const installedPath = path.join(homeDir, '.claude', 'plugins', 'installed_plugins.json');
+  writeJson(settingsPath, {
+    statusLine: { type: 'command', command: 'node "/plugin/statusline-composite.js"' },
+    enabledPlugins: {},
+  });
+  writeJson(installedPath, { plugins: {} });
+  writeJson(registryPath, [
+    { id: '_previous', command: 'echo previous-status', needsStdin: true },
+    { id: 'code-graph', command: 'node "/plugin/statusline.js"', needsStdin: false },
+  ]);
+  return { settingsPath, registryPath };
+}
+
+test('cleanupDisabledStatusline restores previous statusline and removes registry', () => {
+  const homeDir = mkHome();
+  const { settingsPath, registryPath } = seedDisabledComposite(homeDir);
+
+  const out = execFileSync(process.execPath, ['-e', `
+    const { cleanupDisabledStatusline } = require(${JSON.stringify(lifecyclePath)});
+    process.stdout.write(JSON.stringify(cleanupDisabledStatusline()));
+  `], { env: { ...process.env, HOME: homeDir } }).toString();
+
+  assert.deepEqual(JSON.parse(out), { cleaned: true, settingsChanged: true });
+  const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+  assert.equal(settings.statusLine.command, 'echo previous-status');
+  assert.equal(fs.existsSync(registryPath), false);
+});
+
+test('statusline exits cleanly and self-heals when plugin is disabled', () => {
+  const homeDir = mkHome();
+  const { settingsPath, registryPath } = seedDisabledComposite(homeDir);
+  const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-graph-project-'));
+  fs.mkdirSync(path.join(projectDir, '.code-graph'), { recursive: true });
+  fs.writeFileSync(path.join(projectDir, '.code-graph', 'index.db'), '');
+
+  const stdout = execFileSync(process.execPath, [statuslinePath], {
+    env: { ...process.env, HOME: homeDir },
+    cwd: projectDir,
+  }).toString();
+
+  assert.equal(stdout, '');
+  const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+  assert.equal(settings.statusLine.command, 'echo previous-status');
+  assert.equal(fs.existsSync(registryPath), false);
+});
+
+test('cleanupDisabledStatusline also heals orphaned statusline after uninstall', () => {
+  const homeDir = mkHome();
+  const { settingsPath, registryPath } = seedOrphanedComposite(homeDir);
+
+  const out = execFileSync(process.execPath, ['-e', `
+    const { cleanupDisabledStatusline } = require(${JSON.stringify(lifecyclePath)});
+    process.stdout.write(JSON.stringify(cleanupDisabledStatusline()));
+  `], { env: { ...process.env, HOME: homeDir } }).toString();
+
+  assert.deepEqual(JSON.parse(out), { cleaned: true, settingsChanged: true });
+  const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+  assert.equal(settings.statusLine.command, 'echo previous-status');
+  assert.equal(fs.existsSync(registryPath), false);
+});

package/claude-plugin/scripts/session-init.js

@@ -1,116 +1,66 @@
 #!/usr/bin/env node
 'use strict';
-const { execFileSync } = require('child_process');
-const fs = require('fs');
+const { spawn } = require('child_process');
 const path = require('path');
-const os = require('os');
-const { findBinary } = require('./find-binary');
-const { install, update, readManifest, getPluginVersion, checkScopeConflict } = require('./lifecycle');
-const { checkForUpdate } = require('./auto-update');
+const {
+  install, update, readManifest, getPluginVersion, checkScopeConflict,
+  cleanupDisabledStatusline, isPluginInactive,
+} = require('./lifecycle');
 
-let BIN = findBinary();
-
-// --- 0. Auto-install binary if missing ---
-if (!BIN) {
-  const version = getPluginVersion();
-  process.stderr.write(`[code-graph] Binary not found, installing @sdsrs/code-graph@${version}...\n`);
+function launchBackgroundAutoUpdate(spawnFn = spawn, env = process.env) {
   try {
-    execFileSync('npm', ['install', '-g', `@sdsrs/code-graph@${version}`], {
-      timeout: 60000, stdio: 'pipe'
+    const child = spawnFn(process.execPath, [path.join(__dirname, 'auto-update.js'), 'check', '--silent'], {
+      detached: true,
+      stdio: 'ignore',
+      env: { ...env, CODE_GRAPH_AUTO_UPDATE_SILENT: '1' },
     });
-    // Clear cached path so findBinary picks up the new install
-    try { fs.unlinkSync(path.join(os.homedir(), '.cache', 'code-graph', 'binary-path')); } catch {}
-    BIN = findBinary();
-    if (BIN) {
-      process.stderr.write(`[code-graph] Installed v${version} at ${BIN}\n`);
-    } else {
-      process.stderr.write('[code-graph] Install succeeded but binary not found in PATH. Try: npx @sdsrs/code-graph@latest\n');
-    }
+    if (child && typeof child.unref === 'function') child.unref();
+    return true;
   } catch {
-    process.stderr.write(
-      `[code-graph] Auto-install failed. Run manually: npm install -g @sdsrs/code-graph@${version}\n`
-    );
+    return false;
   }
 }
 
-// --- 1. Health check (always runs) ---
-if (BIN) {
-  try {
-    const out = execFileSync(BIN, ['health-check', '--format', 'oneline'], {
-      timeout: 2000,
-      stdio: ['pipe', 'pipe', 'pipe']
-    }).toString().trim();
-    if (out) process.stdout.write(out);
-  } catch { /* timeout — silent */ }
-}
+function syncLifecycleConfig() {
+  const manifest = readManifest();
+  const currentVersion = getPluginVersion();
 
-// --- 1b. Suggest project_map as first action ---
-if (BIN) {
-  process.stdout.write(
-    '\n[code-graph] TIP: Call project_map first to get a full architecture overview ' +
-    '(modules, dependencies, hot functions, entry points) in one call.\n'
-  );
+  if (!manifest.version) {
+    install();
+    return 'installed';
+  }
+  if (manifest.version !== currentVersion) {
+    update();
+    return 'updated';
+  }
+  return 'noop';
 }
 
-// --- 1c. Binary version sync (plugin may update before npm binary) ---
-if (BIN) {
-  try {
-    const binOut = execFileSync(BIN, ['--version'], { timeout: 2000, stdio: 'pipe' }).toString().trim();
-    const binVersion = binOut.replace(/^code-graph-mcp\s+/, '');
-    const pluginVersion = getPluginVersion();
-    if (binVersion && pluginVersion && /^\d+\.\d+\.\d+$/.test(binVersion)) {
-      const bv = binVersion.split('.').map(Number);
-      const pv = pluginVersion.split('.').map(Number);
-      const pluginNewer = (pv[0] > bv[0]) ||
-        (pv[0] === bv[0] && pv[1] > bv[1]) ||
-        (pv[0] === bv[0] && pv[1] === bv[1] && pv[2] > bv[2]);
-      if (pluginNewer) {
-        process.stderr.write(`[code-graph] Binary v${binVersion} < plugin v${pluginVersion}, updating...\n`);
-        try {
-          execFileSync('npm', ['install', '-g', `@sdsrs/code-graph@${pluginVersion}`], {
-            timeout: 30000, stdio: 'pipe'
-          });
-          // Clear cached binary path so next lookup finds the new binary
-          try { fs.unlinkSync(path.join(os.homedir(), '.cache', 'code-graph', 'binary-path')); } catch {}
-          process.stderr.write(`[code-graph] Binary updated to v${pluginVersion}\n`);
-        } catch {
-          process.stderr.write(
-            `[code-graph] Auto-update failed. Run: npm install -g @sdsrs/code-graph@${pluginVersion}\n`
-          );
-        }
-      }
-    }
-  } catch { /* version check failed — not critical */ }
-}
+function runSessionInit() {
+  if (isPluginInactive()) {
+    cleanupDisabledStatusline();
+    return { inactive: true, lifecycle: 'noop', autoUpdateLaunched: false };
+  }
+
+  const conflict = checkScopeConflict();
+  if (conflict) {
+    process.stderr.write(
+      `[code-graph] Warning: conflicting install detected — ${conflict.existingId} (${conflict.scope || 'unknown'} scope). ` +
+      `Use /plugin to remove one to avoid config conflicts.\n`
+    );
+  }
 
-// --- 2. Scope conflict warning ---
-const conflict = checkScopeConflict();
-if (conflict) {
-  process.stderr.write(
-    `[code-graph] Warning: conflicting install detected — ${conflict.existingId} (${conflict.scope || 'unknown'} scope). ` +
-    `Use /plugin to remove one to avoid config conflicts.\n`
-  );
+  const lifecycle = syncLifecycleConfig();
+  const autoUpdateLaunched = launchBackgroundAutoUpdate();
+  return { inactive: false, lifecycle, autoUpdateLaunched };
 }
 
-// --- 3. Lifecycle: install or update config (idempotent) ---
-const manifest = readManifest();
-const currentVersion = getPluginVersion();
+module.exports = {
+  launchBackgroundAutoUpdate,
+  syncLifecycleConfig,
+  runSessionInit,
+};
 
-if (!manifest.version) {
-  install();
-} else if (manifest.version !== currentVersion) {
-  update();
+if (require.main === module) {
+  runSessionInit();
 }
-
-// --- 4. Auto-update (throttled, non-blocking) ---
-(async () => {
-  const result = await checkForUpdate();
-  if (result && result.updated) {
-    process.stderr.write(`[code-graph] Updated: v${result.from} \u2192 v${result.to}\n`);
-  } else if (result && result.updateAvailable) {
-    process.stderr.write(
-      `[code-graph] Update available: v${result.from} \u2192 v${result.to}. ` +
-      `Run: npx @sdsrs/code-graph@latest\n`
-    );
-  }
-})();

package/claude-plugin/scripts/session-init.test.js

@@ -0,0 +1,35 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const { launchBackgroundAutoUpdate, syncLifecycleConfig } = require('./session-init');
+
+test('syncLifecycleConfig is exported as a callable helper', () => {
+  assert.equal(typeof syncLifecycleConfig, 'function');
+});
+
+test('launchBackgroundAutoUpdate spawns detached silent updater', () => {
+  const calls = [];
+
+  const ok = launchBackgroundAutoUpdate((command, args, options) => {
+    const record = { command, args, options, unrefCalled: false };
+    calls.push(record);
+    return {
+      unref() {
+        record.unrefCalled = true;
+      },
+    };
+  }, { HOME: '/tmp/fake-home' });
+
+  assert.equal(ok, true);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].command, process.execPath);
+  assert.match(calls[0].args[0], /auto-update\.js$/);
+  assert.equal(calls[0].args[1], 'check');
+  assert.equal(calls[0].args[2], '--silent');
+  assert.equal(calls[0].options.detached, true);
+  assert.equal(calls[0].options.stdio, 'ignore');
+  assert.equal(calls[0].options.env.CODE_GRAPH_AUTO_UPDATE_SILENT, '1');
+  assert.equal(calls[0].unrefCalled, true);
+});
+

package/claude-plugin/scripts/statusline-composite.js

@@ -7,10 +7,13 @@
  */
 const { execFileSync } = require('child_process');
 const path = require('path');
-const { readRegistry } = require('./lifecycle');
+const { cleanupDisabledStatusline, readRegistry } = require('./lifecycle');
 
 const SEPARATOR = ' \x1b[2m|\x1b[0m ';
 
+const disabledCleanup = cleanupDisabledStatusline();
+if (disabledCleanup.cleaned) process.exit(0);
+
 // Collect stdin (Claude Code pipes JSON context)
 let stdinData = '';
 let ran = false;

package/claude-plugin/scripts/statusline.js

@@ -4,6 +4,10 @@ const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const { findBinary } = require('./find-binary');
+const { cleanupDisabledStatusline } = require('./lifecycle');
+
+const disabledCleanup = cleanupDisabledStatusline();
+if (disabledCleanup.cleaned) process.exit(0);
 
 // Only show status in projects that have a code-graph index.
 // The statusLine config is global, so we must exit silently for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.5.26",
+  "version": "0.5.28",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -33,10 +33,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.5.26",
-    "@sdsrs/code-graph-linux-arm64": "0.5.26",
-    "@sdsrs/code-graph-darwin-x64": "0.5.26",
-    "@sdsrs/code-graph-darwin-arm64": "0.5.26",
-    "@sdsrs/code-graph-win32-x64": "0.5.26"
+    "@sdsrs/code-graph-linux-x64": "0.5.28",
+    "@sdsrs/code-graph-linux-arm64": "0.5.28",
+    "@sdsrs/code-graph-darwin-x64": "0.5.28",
+    "@sdsrs/code-graph-darwin-arm64": "0.5.28",
+    "@sdsrs/code-graph-win32-x64": "0.5.28"
   }
 }