@sdsrs/code-graph 0.77.1 → 0.78.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.77.1",
+  "version": "0.78.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/statusline-composite.js

@@ -72,11 +72,12 @@ function runProvider(command, needsStdin, stdin) {
     const argv = parts.map(expandTilde);
 
     // Forward Claude Code's authoritative current dir (from the stdin payload) as
-    // an env var. The code-graph provider gates on it instead of its own
-    // process.cwd(), which need not track the session's working dir. Harmless to
-    // `_previous`/third-party providers, which ignore the unknown var.
+    // a plugin-scoped env var. The code-graph provider gates on it instead of its
+    // own process.cwd(), which need not track the session's working dir. Harmless
+    // to `_previous`/third-party providers, which ignore the unknown var. The
+    // CODE_GRAPH_ prefix (not CLAUDE_) keeps it out of Claude Code's own namespace.
     const cwd = cwdFromStdin(stdin);
-    const env = cwd ? { ...process.env, CLAUDE_STATUSLINE_CWD: cwd } : process.env;
+    const env = cwd ? { ...process.env, CODE_GRAPH_STATUSLINE_CWD: cwd } : process.env;
 
     const out = execFileSync(argv[0], argv.slice(1), {
       timeout: 3000,
@@ -93,11 +94,15 @@ function runProvider(command, needsStdin, stdin) {
 // Prefer the top-level `cwd`, then `workspace.current_dir`; both track the
 // session's working dir (after the model runs `cd`). Returns null for empty,
 // non-JSON, or cwd-less payloads (e.g. the stdin-timeout fallback passes '').
+// Only a non-empty STRING is accepted: a malformed `cwd` (number/object) would
+// otherwise be coerced to a bogus env path that resolves nowhere and silently
+// blanks the segment — null keeps the gate on the safe process.cwd() fallback.
 function cwdFromStdin(stdin) {
   if (!stdin) return null;
   try {
     const ctx = JSON.parse(stdin);
-    return (ctx && (ctx.cwd || (ctx.workspace && ctx.workspace.current_dir))) || null;
+    const v = ctx && (ctx.cwd || (ctx.workspace && ctx.workspace.current_dir));
+    return typeof v === 'string' && v ? v : null;
   } catch { return null; }
 }
 

package/claude-plugin/scripts/statusline-composite.test.js

@@ -3,7 +3,7 @@
 // JSON context on stdin and fans out to each provider. This pins the cwd bridge:
 // the code-graph provider keys its gate on process.cwd(), but Claude Code may
 // spawn the statusline from a cwd unrelated to the session. The composite must
-// extract the authoritative cwd from stdin and forward it (CLAUDE_STATUSLINE_CWD)
+// extract the authoritative cwd from stdin and forward it (CODE_GRAPH_STATUSLINE_CWD)
 // so the provider resolves the right project regardless of the spawn's cwd.
 const test = require('node:test');
 const assert = require('node:assert/strict');
@@ -31,20 +31,35 @@ test('cwdFromStdin returns null for empty / non-JSON / cwd-less payloads', () =>
   assert.equal(cwdFromStdin('{"workspace":{}}'), null);
 });
 
-test('runProvider forwards the stdin cwd to the provider as CLAUDE_STATUSLINE_CWD', (t) => {
+test('cwdFromStdin returns null for a non-string cwd (no bogus env path)', () => {
+  // A malformed payload must not coerce a number/object into an env path that
+  // resolves to nowhere and silently blanks the segment. Only a real string wins.
+  assert.equal(cwdFromStdin('{"cwd":123}'), null);
+  assert.equal(cwdFromStdin('{"cwd":{"x":1}}'), null);
+  assert.equal(cwdFromStdin('{"cwd":""}'), null);
+  assert.equal(cwdFromStdin('{"workspace":{"current_dir":42}}'), null);
+});
+
+test('runProvider forwards the stdin cwd to the provider as CODE_GRAPH_STATUSLINE_CWD', (t) => {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-composite-'));
   t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
   const fixture = path.join(dir, 'echo-cwd.js');
-  fs.writeFileSync(fixture, "process.stdout.write('CWD='+(process.env.CLAUDE_STATUSLINE_CWD||'NONE'));");
+  fs.writeFileSync(fixture, "process.stdout.write('CWD='+(process.env.CODE_GRAPH_STATUSLINE_CWD||'NONE'));");
   const out = runProvider(`node ${JSON.stringify(fixture)}`, false, '{"cwd":"/x/y"}');
   assert.equal(out, 'CWD=/x/y');
 });
 
-test('runProvider leaves CLAUDE_STATUSLINE_CWD unset when stdin carries no cwd', (t) => {
+test('runProvider leaves CODE_GRAPH_STATUSLINE_CWD unset when stdin carries no cwd', (t) => {
+  // Hermetic against an ambient var: with no stdin cwd, runProvider passes
+  // process.env through unchanged, so a value inherited by the test runner would
+  // leak into the child. Clear it for this case, restore after.
+  const saved = process.env.CODE_GRAPH_STATUSLINE_CWD;
+  delete process.env.CODE_GRAPH_STATUSLINE_CWD;
+  t.after(() => { if (saved !== undefined) process.env.CODE_GRAPH_STATUSLINE_CWD = saved; });
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-composite-'));
   t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
   const fixture = path.join(dir, 'echo-cwd.js');
-  fs.writeFileSync(fixture, "process.stdout.write('CWD='+(process.env.CLAUDE_STATUSLINE_CWD||'NONE'));");
+  fs.writeFileSync(fixture, "process.stdout.write('CWD='+(process.env.CODE_GRAPH_STATUSLINE_CWD||'NONE'));");
   const out = runProvider(`node ${JSON.stringify(fixture)}`, false, '');
   assert.equal(out, 'CWD=NONE');
 });

package/claude-plugin/scripts/statusline.js

@@ -34,13 +34,13 @@ if (disabledCleanup.cleaned) process.exit(0);
 // with no local index, showed nothing at all. The resolver skips stray nested
 // indexes, so the statusline tracks one DB — the project root — from any subdir.
 //
-// Start from Claude Code's AUTHORITATIVE current dir (CLAUDE_STATUSLINE_CWD,
+// Start from Claude Code's AUTHORITATIVE current dir (CODE_GRAPH_STATUSLINE_CWD,
 // forwarded by the composite from its stdin payload) rather than process.cwd().
 // The spawned statusline's process.cwd() is an implementation detail of how
 // Claude Code launches the command and need not track the session's working dir;
 // the stdin `cwd` always does. Fall back to process.cwd() when unset (direct
 // invocation, tests).
-const startDir = process.env.CLAUDE_STATUSLINE_CWD || process.cwd();
+const startDir = process.env.CODE_GRAPH_STATUSLINE_CWD || process.cwd();
 const root = resolveProjectRoot(startDir);
 if (!root) {
   process.exit(0);

package/claude-plugin/scripts/statusline.test.js

@@ -70,7 +70,7 @@ function runStatusline(home, projectDir) {
 }
 
 // Run statusline.js from an arbitrary process.cwd() with extra env vars. Used to
-// prove the gate keys on Claude Code's authoritative cwd (CLAUDE_STATUSLINE_CWD,
+// prove the gate keys on Claude Code's authoritative cwd (CODE_GRAPH_STATUSLINE_CWD,
 // forwarded by the composite from the stdin payload), NOT the spawn's cwd.
 function runStatuslineIn(home, processCwd, extraEnv) {
   return execFileSync('node', [STATUSLINE], {
@@ -176,12 +176,12 @@ test('version-stale index shows rebuilding marker', (t) => {
   assert.equal(runStatusline(home, project), 'code-graph: ✓ 14119 nodes | 922 files | ↻ rebuilding');
 });
 
-// CLAUDE_STATUSLINE_CWD is Claude Code's authoritative current dir, forwarded by
+// CODE_GRAPH_STATUSLINE_CWD is Claude Code's authoritative current dir, forwarded by
 // the composite from its stdin payload. The gate must trust it over process.cwd():
 // Claude Code may spawn the statusline from a cwd unrelated to the session (the
 // classic regression — the segment vanished when the shell sat in a subdir whose
 // process.cwd() didn't resolve to the project root).
-test('CLAUDE_STATUSLINE_CWD overrides process.cwd() for the gate', (t) => {
+test('CODE_GRAPH_STATUSLINE_CWD overrides process.cwd() for the gate', (t) => {
   const home = mkHome(t);
   const project = mkProject(home);
   installStubBinary(home, {
@@ -190,11 +190,11 @@ test('CLAUDE_STATUSLINE_CWD overrides process.cwd() for the gate', (t) => {
   });
   // process.cwd() = home (no .code-graph → resolves null → would be blank), but
   // the authoritative cwd points at the project → must render the health line.
-  const out = runStatuslineIn(home, home, { CLAUDE_STATUSLINE_CWD: project });
+  const out = runStatuslineIn(home, home, { CODE_GRAPH_STATUSLINE_CWD: project });
   assert.equal(out, 'code-graph: ✓ 3145 nodes | 205 files');
 });
 
-test('CLAUDE_STATUSLINE_CWD in a subdir walks up to the project root', (t) => {
+test('CODE_GRAPH_STATUSLINE_CWD in a subdir walks up to the project root', (t) => {
   const home = mkHome(t);
   const project = mkProject(home);
   const subdir = path.join(project, 'claude-plugin', 'scripts');
@@ -205,6 +205,6 @@ test('CLAUDE_STATUSLINE_CWD in a subdir walks up to the project root', (t) => {
   });
   // The reported symptom: shell in <root>/claude-plugin/scripts. The subdir has
   // no .code-graph of its own; resolveProjectRoot must walk up to <root>.
-  const out = runStatuslineIn(home, home, { CLAUDE_STATUSLINE_CWD: subdir });
+  const out = runStatuslineIn(home, home, { CODE_GRAPH_STATUSLINE_CWD: subdir });
   assert.equal(out, 'code-graph: ✓ 3145 nodes | 205 files');
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.77.1",
+  "version": "0.78.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.77.1",
-    "@sdsrs/code-graph-linux-arm64": "0.77.1",
-    "@sdsrs/code-graph-darwin-x64": "0.77.1",
-    "@sdsrs/code-graph-darwin-arm64": "0.77.1",
-    "@sdsrs/code-graph-win32-x64": "0.77.1"
+    "@sdsrs/code-graph-linux-x64": "0.78.0",
+    "@sdsrs/code-graph-linux-arm64": "0.78.0",
+    "@sdsrs/code-graph-darwin-x64": "0.78.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.78.0",
+    "@sdsrs/code-graph-win32-x64": "0.78.0"
   }
 }