@sdsrs/code-graph 0.79.0 → 0.80.0

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.79.0",
+  "version": "0.80.0",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/project-detect.js

@@ -22,6 +22,7 @@
 // this tool, so counting it would let a once-polluted /tmp self-certify as a
 // project on the next session (circular).
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 
 const PROJECT_MARKERS = [
@@ -33,11 +34,32 @@ function isProjectRoot(cwd) {
   return PROJECT_MARKERS.some(m => fs.existsSync(path.join(cwd, m)));
 }
 
-// A cwd is "non-project" when it carries none of the recognized project
-// markers. The plugin's activation gates short-circuit there: no MCP tools,
-// no index creation, no SessionStart map injection, no auto-adoption.
+// Walk up from `cwd` to the nearest ancestor carrying a project marker, bounded
+// by $HOME (exclusive) and the filesystem root. Returns the marker dir, or null
+// if none. Mirrors the Rust binary's `resolve_project_root_bounded` so the JS
+// activation gate and the binary AGREE: before this, the gate checked ONLY the
+// literal cwd, so launching from a marker-less monorepo SUBDIR (e.g.
+// `repo/backend/` with `.git` only at `repo/`) classified it non-project and
+// served the 0-tool stub — even though the binary would have resolved `repo/`
+// and answered queries. The $HOME-exclusive bound keeps every /tmp / headless
+// cwd non-project (a stray marker in $HOME must not certify them).
+function findProjectRoot(cwd = process.cwd()) {
+  const home = os.homedir();
+  let dir = path.resolve(cwd);
+  for (;;) {
+    if (dir === home) return null;        // $HOME-exclusive: don't certify $HOME or above
+    if (isProjectRoot(dir)) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;      // filesystem root
+    dir = parent;
+  }
+}
+
+// A cwd is "non-project" when neither it NOR any ancestor (up to $HOME) carries a
+// recognized project marker. The plugin's activation gates short-circuit there:
+// no MCP tools, no index creation, no SessionStart map injection, no auto-adoption.
 function isNonProjectCwd(cwd = process.cwd()) {
-  return !isProjectRoot(cwd);
+  return findProjectRoot(cwd) === null;
 }
 
-module.exports = { PROJECT_MARKERS, isProjectRoot, isNonProjectCwd };
+module.exports = { PROJECT_MARKERS, isProjectRoot, findProjectRoot, isNonProjectCwd };

package/claude-plugin/scripts/project-detect.test.js

@@ -7,7 +7,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-const { PROJECT_MARKERS, isProjectRoot, isNonProjectCwd } = require('./project-detect');
+const { PROJECT_MARKERS, isProjectRoot, findProjectRoot, isNonProjectCwd } = require('./project-detect');
 
 function mkTmp(t) {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-pd-'));
@@ -71,3 +71,25 @@ test('isProjectRoot detects each marker', (t) => {
     assert.equal(isProjectRoot(dir), true, `${marker} should make cwd a project`);
   }
 });
+
+test('isNonProjectCwd: a marker-less SUBDIR of a project resolves to the project (walk-up, monorepo fix)', (t) => {
+  // Regression (v0.79.1 audit #7): the gate checked ONLY the literal cwd, so a
+  // monorepo subdir (`.git` only at the repo root) served the 0-tool stub even
+  // though the Rust binary's resolver walks up and would answer queries. The
+  // gate now walks up too.
+  const root = mkTmp(t);
+  fs.mkdirSync(path.join(root, '.git'));
+  const sub = path.join(root, 'backend', 'src');
+  fs.mkdirSync(sub, { recursive: true });
+  assert.equal(isProjectRoot(sub), false, 'the subdir itself has no marker');
+  assert.equal(isNonProjectCwd(sub), false, 'but it is INSIDE a project → not non-project');
+  assert.equal(findProjectRoot(sub), root, 'walk-up returns the repo root');
+});
+
+test('findProjectRoot: a marker-less tree with no ancestor marker → null (tmp/headless stays gated)', (t) => {
+  const dir = mkTmp(t);
+  const sub = path.join(dir, 'a', 'b');
+  fs.mkdirSync(sub, { recursive: true });
+  assert.equal(findProjectRoot(sub), null);
+  assert.equal(isNonProjectCwd(sub), true);
+});

package/claude-plugin/scripts/user-prompt-context.js

@@ -7,6 +7,12 @@ const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+// Hook cooldown flags + the restart notice go under cgTmpDir() (a code-graph-mcp/
+// subdir of os.tmpdir()), NOT bare os.tmpdir(): Claude Code overrides $TMPDIR to
+// ~/.claude/tmp/, so bare-tmp flags interleave with transcript captures —
+// diagnostic blindness + the §8 recursive-grep footgun (see tmp-dir.js). The
+// other hook scripts already route through here; this one was the lone holdout.
+const { cgTmpDir } = require('./tmp-dir');
 
 // Mid-session install detection: hook fires but no manifest yet.
 const MANIFEST_PATH = path.join(os.homedir(), '.cache', 'code-graph', 'install-manifest.json');
@@ -22,7 +28,7 @@ const COOLDOWNS = {
 
 function isCoolingDown(type) {
   try {
-    const flag = path.join(os.tmpdir(), `.code-graph-ctx-${type}`);
+    const flag = path.join(cgTmpDir(), `.code-graph-ctx-${type}`);
     const stat = fs.statSync(flag);
     return Date.now() - stat.mtimeMs < (COOLDOWNS[type] || 60000);
   } catch { return false; }
@@ -30,7 +36,7 @@ function isCoolingDown(type) {
 
 function markCooldown(type) {
   try {
-    fs.writeFileSync(path.join(os.tmpdir(), `.code-graph-ctx-${type}`), '');
+    fs.writeFileSync(path.join(cgTmpDir(), `.code-graph-ctx-${type}`), '');
   } catch { /* ok */ }
 }
 
@@ -398,7 +404,7 @@ function runMain() {
   // Mid-session install: lifecycle.js install() hasn't run yet (no manifest).
   // MCP server only starts at session startup — tell the user to restart.
   if (!fs.existsSync(MANIFEST_PATH)) {
-    const noticeFile = path.join(os.tmpdir(), '.code-graph-mcp-restart-notice');
+    const noticeFile = path.join(cgTmpDir(), '.code-graph-mcp-restart-notice');
     try {
       // Show once per hour to avoid spam
       if (Date.now() - fs.statSync(noticeFile).mtimeMs < 3600000) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.79.0",
+  "version": "0.80.0",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.79.0",
-    "@sdsrs/code-graph-linux-arm64": "0.79.0",
-    "@sdsrs/code-graph-darwin-x64": "0.79.0",
-    "@sdsrs/code-graph-darwin-arm64": "0.79.0",
-    "@sdsrs/code-graph-win32-x64": "0.79.0"
+    "@sdsrs/code-graph-linux-x64": "0.80.0",
+    "@sdsrs/code-graph-linux-arm64": "0.80.0",
+    "@sdsrs/code-graph-darwin-x64": "0.80.0",
+    "@sdsrs/code-graph-darwin-arm64": "0.80.0",
+    "@sdsrs/code-graph-win32-x64": "0.80.0"
   }
 }