@sdsrs/code-graph 0.61.0 → 0.63.0

package/bin/cli.js

@@ -12,6 +12,24 @@ process.env._FIND_BINARY_ROOT = path.resolve(__dirname, "..");
 // Lets `code-graph-mcp adopt` / `unadopt` work uniformly across plugin / npm / npx.
 const sub = process.argv[2];
 if (sub === "adopt" || sub === "unadopt") {
+  // `--help`/`-h` must be side-effect-free: adopt() writes the memory file +
+  // MEMORY.md sentinel, unadopt() removes them. The Rust binary guards this for
+  // direct invocation, but npm/npx routes through this wrapper, which intercepts
+  // adopt/unadopt *before* the binary — so the guard must be repeated here, or
+  // `code-graph-mcp adopt --help` rewrites MEMORY.md (the common new-user path).
+  if (process.argv.slice(3).some((a) => a === "--help" || a === "-h")) {
+    process.stdout.write(sub === "adopt"
+      ? "code-graph-mcp adopt — install the code-graph memory file + MEMORY.md sentinel\n\n" +
+        "USAGE:\n    code-graph-mcp adopt\n\n" +
+        "Writes plugin_code_graph_mcp.md and a sentinel block into this project's\n" +
+        "~/.claude memory so Claude Code auto-loads the decision table. Run\n" +
+        "`code-graph-mcp unadopt` to remove it.\n"
+      : "code-graph-mcp unadopt — remove the code-graph memory file + sentinel\n\n" +
+        "USAGE:\n    code-graph-mcp unadopt\n\n" +
+        "Reverses `code-graph-mcp adopt`: deletes the memory file and the MEMORY.md\n" +
+        "sentinel block. User content outside the sentinel is kept.\n");
+    process.exit(0);
+  }
   const { adopt, unadopt, formatResult } = require("../claude-plugin/scripts/adopt");
   const result = sub === "unadopt" ? unadopt() : adopt();
   process.stdout.write(formatResult(sub, result) + "\n");

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.61.0",
+  "version": "0.63.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/pre-edit-guide.js

@@ -168,7 +168,9 @@ if (directCallers < 1) process.exit(0);
 try { fs.writeFileSync(cooldownFile, ''); } catch { /* ok */ }
 
 // Funnel visibility (v0.49): an injected impact summary is a delivered answer.
-recordRecommendation(cwd, { hook: 'edit', action: 'hint', answered: true });
+// v0.63 — ack:true marks that this injection carries a salience-forcing directive
+// (the per-caller verdict line below), so a later A/B can segment ack vs non-ack.
+recordRecommendation(cwd, { hook: 'edit', action: 'hint', answered: true, ack: true });
 
 // --- Inject compact impact summary ---
 const routeCount = jsonResult.affected_routes || 0;
@@ -186,4 +188,14 @@ if (callers.length > 0) {
   summary += '  Callers: ' + callers.map(c => `${c.name} (${c.file})`).join(', ') + '\n';
 }
 
+// Salience forcing (v0.63) — an injected impact summary that the model merely
+// reads is wasted context. mem's PreToolUse edit hook lifts cite-recall to ~94%
+// by making the model ACT on the injection ("apply each lesson or rule it out")
+// rather than passively receive it. Mirror that: force an explicit per-caller
+// verdict so the blast radius is reconciled against the edit, not skimmed.
+// Wording references "each caller of X()" not "above" (finding #5): the name list
+// is only printed when callers[] is populated, but the directCallers>=1 gate can
+// fire with the count alone — the verdict must stay coherent either way.
+summary += `  → Before this edit: confirm each caller of ${symbol}() still holds with your change, or note why it is unaffected.\n`;
+
 process.stdout.write(summary);

package/claude-plugin/scripts/pre-edit-guide.test.js

@@ -150,6 +150,23 @@ test('fn-extract: short strings return null', () => {
 // ── Pattern consistency check ───────────────────────────
 // Verify fnPatterns in this test match what's in pre-edit-guide.js
 
+// ── Salience forcing (v0.63) ────────────────────────────
+// pre-edit-guide.js top-level-exits on require (reads stdin / checks db), so we
+// assert on the source text — same convention as pattern-sync below.
+
+test('salience: impact summary forces a per-caller verdict before the edit', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const source = fs.readFileSync(path.join(__dirname, 'pre-edit-guide.js'), 'utf8');
+  // mem lifts cite-recall to ~94% by making the model ACT on the injection; the
+  // impact summary must do the same rather than be passively skimmed. Wording
+  // references "each caller of X()" not "above" (finding #5) so it stays coherent
+  // when only the caller COUNT is shown (callers[] empty but directCallers>=1).
+  assert.match(source, /Before this edit: confirm each caller of/);
+  assert.match(source, /still holds with your change, or note why it is unaffected/);
+  assert.doesNotMatch(source, /caller\(s\) above you will update/); // old wording removed
+});
+
 test('pattern-sync: fnPatterns count matches source', () => {
   const fs = require('node:fs');
   const path = require('node:path');

package/claude-plugin/scripts/pre-grep-guide.js

@@ -366,6 +366,12 @@ function buildBlockReasonWithAnswer(pattern, searchPath, answer, unansweredTail)
   lines.push(
     'Each hit shows its containing fn/module — use these results directly instead of re-running the search.',
   );
+  // NOTE (v0.63): a forced-ack salience line was trialed here and removed. The
+  // answer is ALREADY in context, so demanding the model restate which hit it
+  // will use risks performative compliance + friction with no measured gain
+  // (deny-with-answer already satisfies in-place, 5/5 in the daagu replay). The
+  // engagement nudge is kept only where it pays — the pre-edit impact summary,
+  // a true before-you-edit reconciliation moment. Re-add here only behind an A/B.
   appendUnansweredTailNote(lines, unansweredTail);
   return lines.join('\n');
 }
@@ -383,6 +389,8 @@ function buildShowDenyReason(answer, unansweredTail) {
     lines.push('(truncated — re-run the `code-graph-mcp show <symbol>` command above for full source)');
   }
   lines.push('Use these directly instead of re-running the search.');
+  // NOTE (v0.63): forced-ack salience trialed + removed here too — see
+  // buildBlockReasonWithAnswer. The definitions are already delivered.
   appendUnansweredTailNote(lines, unansweredTail);
   return lines.join('\n');
 }

package/claude-plugin/scripts/pre-grep-guide.test.js

@@ -728,6 +728,22 @@ test('buildBlockReasonWithAnswer: NEVER advertises the bypass (v0.48 — one den
   assert.doesNotMatch(reason, /CODE_GRAPH_NO_BLOCK_GREP/);
 });
 
+test('buildBlockReasonWithAnswer: no salience restatement — answer is already in context (v0.63 removed)', () => {
+  // A forced "name the hit you will act on" line was trialed and removed: the
+  // answer is delivered, so restatement is performative friction. Keep the deny
+  // copy to delivery + the plain "use directly" nudge only.
+  const reason = buildBlockReasonWithAnswer('fts5_search', 'src/storage/', {
+    status: 'hits', text: 'hit', truncated: false,
+  });
+  assert.doesNotMatch(reason, /name the hit you will act on/i);
+  assert.match(reason, /use these results directly/i);
+});
+
+test('buildShowDenyReason: no salience restatement (v0.63 removed)', () => {
+  const reason = buildShowDenyReason({ status: 'hits', text: 'fn body', truncated: false });
+  assert.doesNotMatch(reason, /name which definition above you will change/i);
+});
+
 test('buildBlockReasonWithAnswer: no searchPath → command has no path arg', () => {
   const reason = buildBlockReasonWithAnswer('fts5_search', undefined, {
     status: 'hits', text: 'hit', truncated: false,

package/claude-plugin/scripts/session-init.js

@@ -40,6 +40,132 @@ function shouldInjectMap({ available, quietHooks, adopted } = {}) {
   return !!(available && !quietHooks && adopted);
 }
 
+// v0.63 — SessionStart "live context": the recent-change blast radius from the
+// AST index. UNLIKE injectProjectMap (default-OFF because the static module map
+// duplicates MEMORY.md + the on-demand project_map tool), this is git-delta-
+// derived — it changes every session and MEMORY.md cannot carry it, so it earns
+// being ON by default for adopted projects. It is the graph-unique, actionable
+// counterpart to mem's SessionStart dashboard (which pushes recent activity to
+// create engagement). Selectivity is automatic: a session with no recently
+// changed *source* files (a deps-only or release commit, a clean checkout off a
+// non-code commit) injects nothing — zero standing-context cost when idle.
+//
+// Gating differs from the static map on purpose: it respects only the hard
+// kill-switch (CODE_GRAPH_QUIET_HOOKS=1) and a dedicated opt-out, NOT the
+// default-quiet flag that suppresses the duplicative map.
+function shouldInjectRecentImpact({ available, adopted, env = {} } = {}) {
+  if (!available || !adopted) return false;
+  if (env.CODE_GRAPH_QUIET_HOOKS === '1') return false;
+  if (env.CODE_GRAPH_NO_RECENT_IMPACT === '1') return false;
+  return true;
+}
+
+// Pure: given whether there are uncommitted (WIP) source changes and the
+// SessionStart `source`, decide if the recent-impact injection is worth its
+// standing-context cost. Marginal-information argument, not measured:
+//   - WIP present → active work; the blast radius of what you're editing is the
+//     highest-value case → always show.
+//   - clean tree → we fall back to the LAST COMMIT. On a cold `startup` that's
+//     low value (you just made it, or you're starting on something unrelated),
+//     and the project's own evidence is that SessionStart dumps tend to go
+//     unreferenced ([[project_cross_project_interference]]) → suppress. On a
+//     resume (`clear`/`compact`/`resume`) the same last-commit reminder helps
+//     re-establish context → show.
+// Unknown source (direct calls / tests) defaults to showing — only an explicit
+// cold `startup` with no WIP is suppressed.
+function recentImpactWorthShowing({ isWip, source } = {}) {
+  if (isWip) return true;
+  return source !== 'startup';
+}
+
+// Source-file extensions the indexer extracts symbols from (AST-bearing). Config
+// /lockfile/doc changes have no graph blast radius, so they're filtered out
+// before the `affected` call — keeps the "Changed:" line free of Cargo.lock noise
+// and avoids spending the CLI call on a commit that only bumped versions.
+const RECENT_SRC_EXT =
+  /\.(rs|ts|tsx|js|jsx|mjs|cjs|py|go|java|rb|php|swift|kt|kts|dart|c|h|cc|cpp|hpp|cs|sh|bash)$/i;
+
+// Pure: filter file paths to indexed source files, capped. Accepts EITHER a raw
+// `git diff --name-only` blob (string, split on newline) OR an already-parsed
+// path array (from parseGitStatusPaths) — the array form is essential: passing
+// the parser's array output to a string-only signature silently returned [] and
+// broke WIP detection (caught by the composing test). Cap guards message length
+// and the affected call's argv on a sweeping refactor.
+function filterSourceFiles(input, cap = 25) {
+  const lines = Array.isArray(input)
+    ? input
+    : (typeof input === 'string' ? input.split('\n') : []);
+  return lines
+    .map(s => s.trim())
+    .filter(Boolean)
+    .filter(f => RECENT_SRC_EXT.test(f))
+    .slice(0, cap);
+}
+
+// Pure: extract file paths from `git status --porcelain` output. One call covers
+// tracked changes (staged + unstaged) AND untracked files — the diff-only path
+// MISSED untracked new source files you're actively editing (finding #3). Format
+// is `XY␣PATH`, or `XY␣ORIG -> PATH` for renames (take the new path). Git quotes
+// paths with special chars; best-effort unquote.
+function parseGitStatusPaths(statusOutput) {
+  if (!statusOutput || typeof statusOutput !== 'string') return [];
+  const paths = [];
+  for (const line of statusOutput.split('\n')) {
+    if (line.length < 4) continue;        // need 2 status chars + space + ≥1 path char
+    let rest = line.slice(3);             // skip the XY status columns + separator space
+    const arrow = rest.indexOf(' -> ');   // rename/copy → the path after the arrow is current
+    if (arrow >= 0) rest = rest.slice(arrow + 4);
+    rest = rest.trim();
+    if (rest.startsWith('"') && rest.endsWith('"')) rest = rest.slice(1, -1);
+    if (rest) paths.push(rest);
+  }
+  return paths;
+}
+
+// Above ~15 direct dependents the per-name list is noise, not signal:
+// information scales INVERSELY with blast size. A high-fanout node (a constants
+// module, a shared util) "touches everything", so its actionable content
+// collapses to "this is high-risk — run the full suite"; the arbitrary first-N
+// dependent names add nothing. Below the threshold the specific dependents ARE
+// the signal (edit one fn → these 3 callers). So scale detail to actionability.
+const FANOUT_LIST_MAX = 15;
+
+// Pure: render the injected text from the parsed `affected --json` payload.
+// Returns null when there's nothing graph-relevant to say (no indexed dependents),
+// so the caller injects nothing rather than an empty banner.
+function formatRecentImpact(changed, affected, dependentCap = 6) {
+  if (!Array.isArray(changed) || changed.length === 0) return null;
+  const all = (affected && Array.isArray(affected.affected_files)) ? affected.affected_files : [];
+  if (all.length === 0) return null;
+  const direct = all.filter(a => a.depth === 1 && !a.is_test).map(a => a.path);
+  const testCount = Array.isArray(affected.tests) ? affected.tests.length : all.filter(a => a.is_test).length;
+
+  const changedShown = changed.slice(0, 8).join(', ') + (changed.length > 8 ? `, +${changed.length - 8}` : '');
+  const lines = [
+    '[code-graph] Recent changes — blast radius from the AST index (graph-only; not in MEMORY.md):',
+    `  Changed: ${changedShown}`,
+  ];
+  if (direct.length > FANOUT_LIST_MAX) {
+    // High fanout: the name list is noise; surface risk + test scope only.
+    lines.push(`  High-fanout change — ${all.length} file(s) impacted (${direct.length} direct); run the full suite (${testCount} test file(s)).`);
+  } else {
+    lines.push(`  Impacts ${all.length} file(s) (${direct.length} direct dependent(s)), ${testCount} test file(s) to re-run.`);
+    if (direct.length > 0) {
+      const shown = direct.slice(0, dependentCap).join(', ');
+      const more = direct.length > dependentCap ? `, +${direct.length - dependentCap} more` : '';
+      lines.push(`  Direct dependents: ${shown}${more}`);
+    }
+  }
+  // Runnable verbatim when ≤4 changed; above that, show 4 + an explicit count
+  // rather than a bare "…" — a pasted "…" command yields a SMALLER blast than the
+  // numbers above (the computation used all changed files, up to the cap) — finding #4.
+  const runCmd = changed.length <= 4
+    ? `code-graph-mcp affected ${changed.join(' ')}`
+    : `code-graph-mcp affected ${changed.slice(0, 4).join(' ')}  (+${changed.length - 4} more changed file(s) — pass all for the full blast)`;
+  lines.push(`  Re-run impacted tests: ${runCmd}`);
+  return lines.join('\n');
+}
+
 function launchBackgroundAutoUpdate(spawnFn = spawn, env = process.env) {
   try {
     const child = spawnFn(process.execPath, [path.join(__dirname, 'auto-update.js'), 'check', '--silent'], {
@@ -292,7 +418,7 @@ function consistencyCheck(binary) {
   return issues;
 }
 
-function runSessionInit() {
+function runSessionInit({ source } = {}) {
   if (isPluginInactive()) {
     cleanupDisabledStatusline();
     return { inactive: true, lifecycle: 'noop', autoUpdateLaunched: false };
@@ -358,12 +484,18 @@ function runSessionInit() {
   const mapInjected = shouldInjectMap({ available: binaryCheck.available, quietHooks, adopted })
     ? injectProjectMap()
     : false;
+  // v0.63 — live context: recent-change blast radius. Default-ON for adopted
+  // projects (separate gate from the duplicative static map); self-selecting
+  // (nothing injected when no source files changed recently).
+  const recentImpactInjected = shouldInjectRecentImpact({ available: binaryCheck.available, adopted, env: process.env })
+    ? injectRecentImpact({ source })
+    : false;
   const consistencyIssues = binaryCheck.available
     ? consistencyCheck(binaryCheck.binary)
     : [];
   return {
     inactive: false, lifecycle,
-    autoUpdateLaunched, indexFreshness, mapInjected, binaryCheck, consistencyIssues,
+    autoUpdateLaunched, indexFreshness, mapInjected, recentImpactInjected, binaryCheck, consistencyIssues,
     quietHooks, adopted, autoAdopted: autoAdopt.attempted,
   };
 }
@@ -378,7 +510,15 @@ function injectProjectMap() {
     const dbPath = path.join(cwd, '.code-graph', 'index.db');
     if (!fs.existsSync(dbPath)) return false;
 
-    const output = execSync('code-graph-mcp map --compact', {
+    // findBinary, not bare 'code-graph-mcp' on PATH (finding #8): a stale/global
+    // PATH binary reads a different/older index and returns "(empty project)"
+    // even when the local index is populated — the sibling bug injectRecentImpact
+    // already avoided via findBinary().
+    const { findBinary } = require('./find-binary');
+    const bin = findBinary();
+    if (!bin) return false;
+
+    const output = execFileSync(bin, ['map', '--compact'], {
       cwd,
       timeout: 5000,
       encoding: 'utf8',
@@ -397,18 +537,107 @@ function injectProjectMap() {
   return false;
 }
 
+/**
+ * v0.63 — inject the recent-change blast radius (graph-unique "live" context).
+ * Changed source files = working-tree changes vs HEAD (WIP), else the last commit.
+ * The last-commit fallback is suppressed on a cold `startup` (low marginal value)
+ * via recentImpactWorthShowing. One bounded `affected --json` call; degrades to
+ * silent no-op on any error. Records a `live_impact` event so `stats` can see the
+ * feature fire (else it's a dark metric). Returns true iff something was injected.
+ */
+function injectRecentImpact({ source } = {}) {
+  try {
+    const cwd = process.cwd();
+    const dbPath = path.join(cwd, '.code-graph', 'index.db');
+    if (!fs.existsSync(dbPath)) return false;
+
+    // WIP = ALL working-tree changes (staged + unstaged + UNTRACKED) in one
+    // `git status` call — the old diff-only path missed untracked new source
+    // files you're actively editing (finding #3). Clean tree → fall back to the
+    // last commit. Timeouts tightened (finding #1): worst-case cap sum is now
+    // status(1s) + HEAD~1(1s) + affected(1.5s) = 3.5s, comfortably under the 5s
+    // SessionStart hook budget; the old 2+2+3=7s could get the whole hook killed.
+    const gitOpts = { cwd, timeout: 1000, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] };
+    let changed = [];
+    let isWip = false;
+    try {
+      changed = filterSourceFiles(parseGitStatusPaths(
+        execSync('git status --porcelain --untracked-files=all', gitOpts)));
+      isWip = changed.length > 0;
+      // Clean tree → fall back to what the last commit touched.
+      if (!isWip) {
+        changed = filterSourceFiles(execSync('git diff --name-only HEAD~1 HEAD', gitOpts));
+      }
+    } catch {
+      return false; // not a git repo / no commits — nothing to diff
+    }
+    if (changed.length === 0) return false;
+
+    // Marginal-value gate: cold startup + clean tree (last-commit fallback) → skip,
+    // before spending the affected CLI call.
+    if (!recentImpactWorthShowing({ isWip, source })) return false;
+
+    const { findBinary } = require('./find-binary');
+    const bin = findBinary();
+    if (!bin) return false;
+
+    let affected;
+    try {
+      const raw = execFileSync(bin, ['affected', ...changed, '--json'], {
+        cwd, timeout: 1500, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
+        env: { ...process.env, CODE_GRAPH_INTERNAL: '1' },
+      });
+      affected = JSON.parse(raw);
+    } catch {
+      return false;
+    }
+
+    const text = formatRecentImpact(changed, affected);
+    if (!text) return false;
+    process.stdout.write(text + '\n');
+
+    // Instrumentation (step 3a): record that the injection fired so `stats`
+    // surfaces it instead of the feature being dark. Carries the blast/direct
+    // counts + WIP flag for later reference-rate / A-B analysis. Best-effort.
+    try {
+      const all = Array.isArray(affected.affected_files) ? affected.affected_files : [];
+      const direct = all.filter(a => a.depth === 1 && !a.is_test).length;
+      const { recordRecommendation } = require('./recommendation-log');
+      recordRecommendation(cwd, { hook: 'session', action: 'live_impact', blast: all.length, direct, wip: isWip });
+    } catch { /* telemetry must never break the injection */ }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 module.exports = {
   launchBackgroundAutoUpdate,
   syncLifecycleConfig,
   ensureIndexFresh,
   injectProjectMap,
+  injectRecentImpact,
   verifyBinary,
   consistencyCheck,
   runSessionInit,
   computeQuietHooks,
   shouldInjectMap,
+  shouldInjectRecentImpact,
+  recentImpactWorthShowing,
+  filterSourceFiles,
+  parseGitStatusPaths,
+  formatRecentImpact,
 };
 
 if (require.main === module) {
-  runSessionInit();
+  // SessionStart passes {source:"startup"|"clear"|"compact"|"resume"} on stdin.
+  // Best-effort + TTY-guarded: a hook gets piped JSON (EOF closes it), but a
+  // manual `node session-init.js` in a terminal must not block on fd 0.
+  let source;
+  try {
+    if (!process.stdin.isTTY) {
+      source = JSON.parse(fs.readFileSync(0, 'utf8')).source;
+    }
+  } catch { /* no/garbled stdin → treat as unknown source */ }
+  runSessionInit({ source });
 }

package/claude-plugin/scripts/session-init.test.js

@@ -4,7 +4,7 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const path = require('path');
 
-const { launchBackgroundAutoUpdate, syncLifecycleConfig, ensureIndexFresh, verifyBinary, computeQuietHooks, shouldInjectMap } = require('./session-init');
+const { launchBackgroundAutoUpdate, syncLifecycleConfig, ensureIndexFresh, verifyBinary, computeQuietHooks, shouldInjectMap, shouldInjectRecentImpact, recentImpactWorthShowing, filterSourceFiles, parseGitStatusPaths, formatRecentImpact } = require('./session-init');
 
 test('syncLifecycleConfig is exported as a callable helper', () => {
   assert.equal(typeof syncLifecycleConfig, 'function');
@@ -161,6 +161,171 @@ test('shouldInjectMap: only injects when available + not-quiet + adopted', () =>
   assert.equal(shouldInjectMap(), false);
 });
 
+// ──────────────────────────────────────────────────────────────────────────
+// v0.63 — SessionStart "live context": recent-change blast radius injection.
+// ──────────────────────────────────────────────────────────────────────────
+
+test('shouldInjectRecentImpact: default-ON for adopted projects (separate gate from the static map)', () => {
+  // Unlike shouldInjectMap, this does NOT require the verbose opt-in — it earns
+  // standing context because it's git-delta-derived, not duplicative of MEMORY.md.
+  assert.equal(shouldInjectRecentImpact({ available: true, adopted: true, env: {} }), true);
+});
+
+test('shouldInjectRecentImpact: hard kill-switch and dedicated opt-out suppress it', () => {
+  assert.equal(shouldInjectRecentImpact({ available: true, adopted: true, env: { CODE_GRAPH_QUIET_HOOKS: '1' } }), false);
+  assert.equal(shouldInjectRecentImpact({ available: true, adopted: true, env: { CODE_GRAPH_NO_RECENT_IMPACT: '1' } }), false);
+});
+
+test('shouldInjectRecentImpact: needs binary + adoption', () => {
+  assert.equal(shouldInjectRecentImpact({ available: false, adopted: true, env: {} }), false);
+  assert.equal(shouldInjectRecentImpact({ available: true, adopted: false, env: {} }), false);
+  assert.equal(shouldInjectRecentImpact(), false);
+});
+
+test('filterSourceFiles: keeps AST-bearing source, drops config/lock/doc', () => {
+  const diff = [
+    'src/domain.rs', 'Cargo.lock', 'Cargo.toml', 'CHANGELOG.md',
+    'package.json', 'src/parser/relations/mod.rs', 'claude-plugin/scripts/session-init.js',
+    'npm/linux-x64/package.json',
+  ].join('\n');
+  assert.deepEqual(filterSourceFiles(diff), [
+    'src/domain.rs', 'src/parser/relations/mod.rs', 'claude-plugin/scripts/session-init.js',
+  ]);
+});
+
+test('parseGitStatusPaths: extracts paths from modified / staged / untracked lines (finding #3)', () => {
+  // `git status --porcelain` columns: " M" unstaged-mod, "M " staged, "??" untracked,
+  // "A " added. The untracked line is exactly what diff-only missed.
+  const out = [
+    ' M src/domain.rs',
+    'M  src/cli.rs',
+    '?? src/brand_new.rs',
+    'A  src/staged_new.rs',
+    'D  src/gone.rs',
+  ].join('\n');
+  assert.deepEqual(parseGitStatusPaths(out), [
+    'src/domain.rs', 'src/cli.rs', 'src/brand_new.rs', 'src/staged_new.rs', 'src/gone.rs',
+  ]);
+});
+
+test('parseGitStatusPaths: rename takes the NEW path; quoted path is unquoted', () => {
+  assert.deepEqual(parseGitStatusPaths('R  src/old.rs -> src/new.rs'), ['src/new.rs']);
+  assert.deepEqual(parseGitStatusPaths('?? "src/with space.rs"'), ['src/with space.rs']);
+});
+
+test('parseGitStatusPaths: blank / too-short / non-string input → []', () => {
+  assert.deepEqual(parseGitStatusPaths(''), []);
+  assert.deepEqual(parseGitStatusPaths(null), []);
+  assert.deepEqual(parseGitStatusPaths('\n\n'), []);
+  assert.deepEqual(parseGitStatusPaths('??'), []); // no path after status
+});
+
+test('parseGitStatusPaths composes with filterSourceFiles: untracked source kept, config dropped', () => {
+  const out = [' M Cargo.toml', '?? src/new_feature.rs', '?? notes.txt'].join('\n');
+  assert.deepEqual(filterSourceFiles(parseGitStatusPaths(out)), ['src/new_feature.rs']);
+});
+
+test('formatRecentImpact: re-run command is runnable verbatim when ≤4 changed (finding #4)', () => {
+  const affected = { affected_files: [{ depth: 1, is_test: false, path: 'src/a.rs' }], tests: [] };
+  const text = formatRecentImpact(['src/x.rs', 'src/y.rs'], affected);
+  assert.match(text, /Re-run impacted tests: code-graph-mcp affected src\/x\.rs src\/y\.rs$/m);
+  assert.doesNotMatch(text, /more changed file/);
+  assert.doesNotMatch(text, / …/); // no bare ellipsis
+});
+
+test('formatRecentImpact: >4 changed → explicit "+N more", not a bare ellipsis (finding #4)', () => {
+  const affected = { affected_files: [{ depth: 1, is_test: false, path: 'src/a.rs' }], tests: [] };
+  const changed = ['s/1.rs', 's/2.rs', 's/3.rs', 's/4.rs', 's/5.rs', 's/6.rs'];
+  const text = formatRecentImpact(changed, affected);
+  assert.match(text, /code-graph-mcp affected s\/1\.rs s\/2\.rs s\/3\.rs s\/4\.rs {2}\(\+2 more changed file\(s\)/);
+  assert.doesNotMatch(text, / …/); // the misleading bare ellipsis is gone
+});
+
+test('filterSourceFiles: caps the list and tolerates blank/garbage input', () => {
+  assert.deepEqual(filterSourceFiles(''), []);
+  assert.deepEqual(filterSourceFiles(null), []);
+  const many = Array.from({ length: 40 }, (_, i) => `src/m${i}.rs`).join('\n');
+  assert.equal(filterSourceFiles(many).length, 25);
+  assert.equal(filterSourceFiles(many, 3).length, 3);
+});
+
+test('formatRecentImpact: renders changed + blast radius + direct dependents', () => {
+  const affected = {
+    affected_files: [
+      { depth: 1, is_test: false, path: 'src/cli.rs' },
+      { depth: 1, is_test: false, path: 'src/graph/impact.rs' },
+      { depth: 1, is_test: true, path: 'src/parser/relations/tests.rs' },
+      { depth: 2, is_test: false, path: 'src/main.rs' },
+    ],
+    changed: ['src/domain.rs'],
+    tests: ['src/parser/relations/tests.rs', 'tests/integration.rs'],
+  };
+  const text = formatRecentImpact(['src/domain.rs'], affected);
+  assert.match(text, /Recent changes/);
+  assert.match(text, /Changed: src\/domain\.rs/);
+  assert.match(text, /Impacts 4 file\(s\) \(2 direct dependent\(s\)\), 2 test file\(s\)/);
+  assert.match(text, /Direct dependents: src\/cli\.rs, src\/graph\/impact\.rs/);
+  assert.match(text, /code-graph-mcp affected src\/domain\.rs/);
+  // It is graph-unique — the copy says so (the whole point vs the static map).
+  assert.match(text, /not in MEMORY\.md/);
+});
+
+test('recentImpactWorthShowing: WIP always shows, regardless of source', () => {
+  assert.equal(recentImpactWorthShowing({ isWip: true, source: 'startup' }), true);
+  assert.equal(recentImpactWorthShowing({ isWip: true, source: 'compact' }), true);
+});
+
+test('recentImpactWorthShowing: clean tree (last-commit fallback) suppressed on cold startup, shown on resume', () => {
+  assert.equal(recentImpactWorthShowing({ isWip: false, source: 'startup' }), false);
+  assert.equal(recentImpactWorthShowing({ isWip: false, source: 'clear' }), true);
+  assert.equal(recentImpactWorthShowing({ isWip: false, source: 'compact' }), true);
+  assert.equal(recentImpactWorthShowing({ isWip: false, source: 'resume' }), true);
+  // Unknown source (direct call / test) defaults to showing — only explicit
+  // cold startup is the suppressed case.
+  assert.equal(recentImpactWorthShowing({ isWip: false }), true);
+  assert.equal(recentImpactWorthShowing(), true);
+});
+
+test('formatRecentImpact: high-fanout change drops the noisy name list, keeps risk + test scope', () => {
+  // >15 direct dependents = a constants/util node "touches everything"; the
+  // first-N names are arbitrary noise, so only risk + test count is surfaced.
+  const affected = {
+    affected_files: Array.from({ length: 20 }, (_, i) => ({ depth: 1, is_test: false, path: `src/f${i}.rs` })),
+    tests: ['tests/a.rs', 'tests/b.rs'],
+  };
+  const text = formatRecentImpact(['src/domain.rs'], affected);
+  assert.match(text, /High-fanout change/);
+  assert.match(text, /run the full suite \(2 test file\(s\)\)/);
+  assert.doesNotMatch(text, /Direct dependents:/); // name list suppressed
+});
+
+test('formatRecentImpact: at/under the fanout threshold the name list IS the signal', () => {
+  const affected = {
+    affected_files: Array.from({ length: 15 }, (_, i) => ({ depth: 1, is_test: false, path: `src/f${i}.rs` })),
+    tests: [],
+  };
+  const text = formatRecentImpact(['src/x.rs'], affected);
+  assert.doesNotMatch(text, /High-fanout/);
+  assert.match(text, /Direct dependents:/);
+});
+
+test('formatRecentImpact: caps direct-dependent list with a "+N more" overflow', () => {
+  const affected = {
+    affected_files: Array.from({ length: 10 }, (_, i) => ({ depth: 1, is_test: false, path: `src/f${i}.rs` })),
+    tests: [],
+  };
+  const text = formatRecentImpact(['src/domain.rs'], affected);
+  assert.match(text, /\+4 more/); // 10 direct, cap 6 → 4 hidden
+});
+
+test('formatRecentImpact: returns null when nothing graph-relevant (no dependents / no changes)', () => {
+  // A deps-only commit: changed files filtered to empty upstream → caller skips.
+  assert.equal(formatRecentImpact([], { affected_files: [] }), null);
+  // Changed source but zero indexed dependents → nothing actionable to say.
+  assert.equal(formatRecentImpact(['src/x.rs'], { affected_files: [], tests: [] }), null);
+  assert.equal(formatRecentImpact(['src/x.rs'], {}), null);
+});
+
 test('consistencyCheck returns version-mismatch when versions differ', (t) => {
   const os = require('os');
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cc-'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.61.0",
-    "@sdsrs/code-graph-linux-arm64": "0.61.0",
-    "@sdsrs/code-graph-darwin-x64": "0.61.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.61.0",
-    "@sdsrs/code-graph-win32-x64": "0.61.0"
+    "@sdsrs/code-graph-linux-x64": "0.63.0",
+    "@sdsrs/code-graph-linux-arm64": "0.63.0",
+    "@sdsrs/code-graph-darwin-x64": "0.63.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.63.0",
+    "@sdsrs/code-graph-win32-x64": "0.63.0"
   }
 }