@sdsrs/code-graph 0.7.15 → 0.7.16

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.7.15",
+  "version": "0.7.16",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/hooks/hooks.json

@@ -1,4 +1,16 @@
 {
-  "_note": "Hooks registered to settings.json by lifecycle.js — hooks.json auto-loading is unreliable",
-  "hooks": {}
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/session-init.js\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ]
+  }
 }

package/claude-plugin/scripts/auto-update.js

@@ -68,7 +68,8 @@ function saveState(state) {
 // ── Dev Mode Detection ─────────────────────────────────────
 
 function isDevMode() {
-  const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(__dirname, '..');
+  // Always derive from __dirname — CLAUDE_PLUGIN_ROOT can leak from other plugins
+  const pluginRoot = path.resolve(__dirname, '..');
   // Dev mode: running from source repo (has Cargo.toml nearby)
   if (fs.existsSync(path.join(pluginRoot, '..', 'Cargo.toml'))) return true;
   // Dev mode: plugin root is a symlink
@@ -281,6 +282,20 @@ async function downloadAndInstall(latest) {
       writeJsonAtomic(path.join(CACHE_DIR, 'install-manifest.json'), manifest);
     } catch { /* not fatal */ }
 
+    // Run the NEW lifecycle.js to update settings.json hooks with new paths.
+    // Without this, settings.json hooks still point to the old version directory
+    // until the next session's self-heal corrects them.
+    if (pluginUpdated) {
+      try {
+        const newLifecycle = path.join(pluginDst, 'scripts', 'lifecycle.js');
+        if (fs.existsSync(newLifecycle)) {
+          execFileSync(process.execPath, [newLifecycle, 'update'], {
+            timeout: 5000, stdio: 'pipe',
+          });
+        }
+      } catch { /* not fatal — syncLifecycleConfig will self-heal on next session */ }
+    }
+
     // ── Step 2: Download platform binary directly from GitHub release ──
     if (latest.binaryUrl) {
       try {

package/claude-plugin/scripts/lifecycle.e2e.test.js

@@ -26,9 +26,13 @@ function readJson(filePath) {
 }
 
 function runScript(homeDir, scriptPath, args = [], options = {}) {
+  const env = { ...process.env, HOME: homeDir };
+  // Do NOT set CLAUDE_PLUGIN_ROOT — lifecycle.js derives PLUGIN_ROOT from __dirname
+  // to avoid env var leakage from other plugins in shared hook execution context.
+  delete env.CLAUDE_PLUGIN_ROOT;
   return execFileSync(process.execPath, [scriptPath, ...args], {
     cwd: options.cwd || repoRoot,
-    env: { ...process.env, HOME: homeDir, CLAUDE_PLUGIN_ROOT: pluginRoot },
+    env,
     input: options.input,
     stdio: ['pipe', 'pipe', 'pipe'],
   }).toString();

package/claude-plugin/scripts/lifecycle.js

@@ -11,7 +11,10 @@ const OLD_PLUGIN_IDS = [
 ];
 const MARKETPLACE_NAME = 'code-graph-mcp';
 const CACHE_DIR = path.join(os.homedir(), '.cache', 'code-graph');
-const PLUGIN_ROOT = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(__dirname, '..');
+// Always derive from __dirname — CLAUDE_PLUGIN_ROOT env var can leak from other
+// plugins when hooks run in shared process context (e.g. claude-mem-lite sets it
+// to its own marketplace path, polluting all subsequent settings.json hook processes).
+const PLUGIN_ROOT = path.resolve(__dirname, '..');
 const MANIFEST_FILE = path.join(CACHE_DIR, 'install-manifest.json');
 const SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
 const INSTALLED_PLUGINS_PATH = path.join(os.homedir(), '.claude', 'plugins', 'installed_plugins.json');
@@ -223,9 +226,18 @@ function migrateOldPluginIds(settings) {
 // Same strategy as claude-mem-lite. hooks.json is kept empty to prevent double-firing.
 
 const OUR_HOOK_SCRIPTS = ['session-init.js', 'incremental-index.js', 'user-prompt-context.js', 'pre-edit-guide.js'];
+const OUR_DESCRIPTIONS = [
+  'StatusLine self-heal, lifecycle sync, project map injection',
+  'Auto-inject impact analysis when editing functions with 2+ callers',
+  'Auto-update code graph index after file edits',
+  'Inject code-graph structural context based on user intent',
+];
 
 function isOurHookEntry(entry) {
   if (!entry || !entry.hooks) return false;
+  // Primary: match by description (immune to path pollution)
+  if (entry.description && OUR_DESCRIPTIONS.includes(entry.description)) return true;
+  // Fallback: match by script name + 'code-graph' in path
   return entry.hooks.some(h =>
     h.command && OUR_HOOK_SCRIPTS.some(s => h.command.includes(s)) &&
     h.command.includes('code-graph')
@@ -269,17 +281,17 @@ function registerHooksToSettings(settings) {
   for (const [event, newEntries] of Object.entries(defs)) {
     if (!settings.hooks[event]) settings.hooks[event] = [];
 
+    // First, remove ALL existing entries that match ours (cleans up duplicates
+    // from prior PLUGIN_ROOT pollution where isOurHookEntry couldn't match,
+    // causing infinite re-adds each session).
+    const beforeLen = settings.hooks[event].length;
+    settings.hooks[event] = settings.hooks[event].filter(e => !isOurHookEntry(e));
+    if (settings.hooks[event].length !== beforeLen) changed = true;
+
+    // Then add our entries fresh with correct paths
     for (const newEntry of newEntries) {
-      const existingIdx = settings.hooks[event].findIndex(e => isOurHookEntry(e));
-      if (existingIdx >= 0) {
-        if (JSON.stringify(settings.hooks[event][existingIdx]) !== JSON.stringify(newEntry)) {
-          settings.hooks[event][existingIdx] = newEntry;
-          changed = true;
-        }
-      } else {
-        settings.hooks[event].push(newEntry);
-        changed = true;
-      }
+      settings.hooks[event].push(newEntry);
+      changed = true;
     }
   }
 
@@ -328,6 +340,13 @@ function install() {
     settings.statusLine = { type: 'command', command: compositeCommand() };
     settingsChanged = true;
     manifest.config.statusLine = true;
+  } else {
+    // Composite exists — ensure path is correct (may have been polluted by env leak)
+    const cmd = compositeCommand();
+    if (settings.statusLine.command !== cmd) {
+      settings.statusLine.command = cmd;
+      settingsChanged = true;
+    }
   }
 
   // Register code-graph provider
@@ -506,8 +525,60 @@ function cleanupOldCacheVersions(keep = 3) {
   } catch { /* cache dir doesn't exist — nothing to clean */ }
 }
 
+// --- Health Check ---
+// Validates all registered paths in settings.json point to existing scripts.
+// Returns { healthy, issues, repaired }.
+
+function healthCheck() {
+  const settings = readJson(SETTINGS_PATH) || {};
+  const issues = [];
+
+  // Check statusLine path
+  if (isOurComposite(settings)) {
+    const m = settings.statusLine.command.match(/node\s+"([^"]+)"/);
+    if (m && m[1] && !fs.existsSync(m[1])) {
+      issues.push({ type: 'statusLine', path: m[1] });
+    }
+  }
+
+  // Check hook paths
+  if (settings.hooks) {
+    for (const [event, entries] of Object.entries(settings.hooks)) {
+      if (!Array.isArray(entries)) continue;
+      for (const entry of entries) {
+        if (!isOurHookEntry(entry) || !entry.hooks) continue;
+        for (const h of entry.hooks) {
+          const m = h.command && h.command.match(/node\s+"([^"]+)"/);
+          if (m && m[1] && !fs.existsSync(m[1])) {
+            issues.push({ type: 'hook', event, path: m[1] });
+          }
+        }
+      }
+    }
+  }
+
+  // Check registry paths
+  const registry = readRegistry();
+  for (const provider of registry) {
+    if (provider.id === '_previous') continue;
+    const m = provider.command && provider.command.match(/node\s+"([^"]+)"/);
+    if (m && m[1] && !fs.existsSync(m[1])) {
+      issues.push({ type: 'registry', id: provider.id, path: m[1] });
+    }
+  }
+
+  // Auto-repair if issues found
+  let repaired = false;
+  if (issues.length > 0) {
+    install();
+    repaired = true;
+  }
+
+  return { healthy: issues.length === 0, issues, repaired };
+}
+
 module.exports = {
-  install, uninstall, update, checkScopeConflict,
+  install, uninstall, update, healthCheck, checkScopeConflict,
   isPluginExplicitlyDisabled, isPluginInactive, cleanupDisabledStatusline,
   readManifest, readJson, writeJsonAtomic,
   readRegistry, writeRegistry,
@@ -516,7 +587,7 @@ module.exports = {
   PLUGIN_ID, OLD_PLUGIN_IDS, MARKETPLACE_NAME, CACHE_DIR, REGISTRY_FILE,
 };
 
-// CLI: node lifecycle.js <install|uninstall|update>
+// CLI: node lifecycle.js <install|uninstall|update|health>
 if (require.main === module) {
   const cmd = process.argv[2];
   if (cmd === 'install') {
@@ -528,8 +599,18 @@ if (require.main === module) {
   } else if (cmd === 'update') {
     const r = update();
     console.log(`Updated ${r.oldVersion} → ${r.version} | settings=${r.settingsChanged}`);
+  } else if (cmd === 'health') {
+    const r = healthCheck();
+    if (r.healthy) {
+      console.log('Health: OK — all paths valid');
+    } else {
+      console.log(`Health: ${r.issues.length} issue(s) found${r.repaired ? ' — repaired' : ''}`);
+      for (const issue of r.issues) {
+        console.log(`  ${issue.type}: ${issue.path || issue.id}`);
+      }
+    }
   } else {
-    console.error('Usage: lifecycle.js <install|uninstall|update>');
+    console.error('Usage: lifecycle.js <install|uninstall|update|health>');
     process.exit(1);
   }
 }

package/claude-plugin/scripts/mcp-launcher.js

@@ -12,7 +12,8 @@ const path = require('path');
 const fs = require('fs');
 
 // Set plugin root so find-binary.js can locate bundled/dev binaries
-process.env._FIND_BINARY_ROOT = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(__dirname, '..');
+// Always derive from __dirname — CLAUDE_PLUGIN_ROOT can leak from other plugins
+process.env._FIND_BINARY_ROOT = path.resolve(__dirname, '..');
 
 const { findBinary, clearCache } = require('./find-binary');
 

package/claude-plugin/scripts/session-init.js

@@ -35,8 +35,8 @@ function syncLifecycleConfig() {
     update();
     return 'updated';
   }
-  // Self-heal: version matches but statusLine may have been lost
-  // (e.g. plugin removed and reinstalled without lifecycle uninstall).
+  // Self-heal: version matches but statusLine may have been lost or path corrupted
+  // (e.g. plugin removed and reinstalled, or CLAUDE_PLUGIN_ROOT leaked from another plugin).
   // install() is idempotent — isOurComposite guard prevents duplicate work.
   const settings = readJson(path.join(os.homedir(), '.claude', 'settings.json')) || {};
   if (!settings.statusLine || !settings.statusLine.command ||
@@ -44,6 +44,28 @@ function syncLifecycleConfig() {
     install();
     return 'self-healed';
   }
+  // Also self-heal if composite path points to a non-existent script (path pollution)
+  const scriptMatch = settings.statusLine.command.match(/node\s+"([^"]+)"/);
+  if (scriptMatch && scriptMatch[1] && !fs.existsSync(scriptMatch[1])) {
+    install();
+    return 'self-healed-bad-path';
+  }
+  // Self-heal if any hook command points to a non-existent script (path pollution)
+  if (settings.hooks) {
+    for (const entries of Object.values(settings.hooks)) {
+      if (!Array.isArray(entries)) continue;
+      for (const entry of entries) {
+        if (!entry.hooks) continue;
+        for (const h of entry.hooks) {
+          const m = h.command && h.command.match(/node\s+"([^"]+)"/);
+          if (m && m[1] && m[1].includes('code-graph') && !fs.existsSync(m[1])) {
+            install();
+            return 'self-healed-bad-hook';
+          }
+        }
+      }
+    }
+  }
   return 'noop';
 }
 

package/claude-plugin/scripts/statusline-composite.js

@@ -82,8 +82,8 @@ function parseCommand(cmd) {
 }
 
 function codeGraphCommand() {
-  const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(__dirname, '..');
-  return `node "${path.join(pluginRoot, 'scripts', 'statusline.js')}"`;
+  // Always derive from __dirname — CLAUDE_PLUGIN_ROOT can leak from other plugins
+  return `node "${path.join(__dirname, 'statusline.js')}"`;
 }
 
 module.exports = { run };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.7.15",
+  "version": "0.7.16",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -34,10 +34,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.7.15",
-    "@sdsrs/code-graph-linux-arm64": "0.7.15",
-    "@sdsrs/code-graph-darwin-x64": "0.7.15",
-    "@sdsrs/code-graph-darwin-arm64": "0.7.15",
-    "@sdsrs/code-graph-win32-x64": "0.7.15"
+    "@sdsrs/code-graph-linux-x64": "0.7.16",
+    "@sdsrs/code-graph-linux-arm64": "0.7.16",
+    "@sdsrs/code-graph-darwin-x64": "0.7.16",
+    "@sdsrs/code-graph-darwin-arm64": "0.7.16",
+    "@sdsrs/code-graph-win32-x64": "0.7.16"
   }
 }