@sdsrs/code-graph 0.85.6 → 0.85.8

package/claude-plugin/.claude-plugin/plugin.json

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.85.6",
+  "version": "0.85.8",
   "keywords": [
     "code-graph",
     "ast",

package/claude-plugin/scripts/auto-update.js

@@ -33,7 +33,9 @@ function commandExists(cmd) {
 const GITHUB_REPO = 'sdsrss/code-graph-mcp';
 const STATE_FILE = path.join(CACHE_DIR, 'update-state.json');
 const BINARY_CACHE_DIR = path.join(CACHE_DIR, 'bin');
-const CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;        // 6h
+const CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;        // 6h — steady-state re-check
+const UP_TO_DATE_RECHECK_MS = 30 * 60 * 1000;        // 30min — re-verify an "up to date" result (release-race guard)
+const SESSION_START_MIN_GAP_MS = 2 * 60 * 1000;      // 2min — anti-hammer floor for forced (session-start) checks
 const RATE_LIMIT_INTERVAL_MS = 24 * 60 * 60 * 1000;  // 24h if rate-limited
 const FETCH_TIMEOUT_MS = 3000;
 
@@ -45,6 +47,13 @@ function isInstallMissingMode(argv = process.argv.slice(2)) {
   return argv.includes('--install-missing');
 }
 
+// High-intent trigger (session start / explicit reload) → bypass the soft
+// throttle so an available update is picked up immediately, not on the next
+// 6h/30min tick. Passed by session-init's launchBackgroundAutoUpdate.
+function isForceMode(argv = process.argv.slice(2)) {
+  return argv.includes('--force');
+}
+
 // ── Platform → GitHub release asset name mapping ──────────
 function getPlatformAssetName() {
   const platform = os.platform();
@@ -74,10 +83,25 @@ function saveState(state) {
 
 // ── Throttle ───────────────────────────────────────────────
 
-function shouldCheck(state) {
+// Whether to hit GitHub now. Keyed to the previous check's outcome, with a force
+// override for high-intent triggers (session start / explicit reload). Ordering:
+//   1. rate-limit backoff (24h) wins over everything — never push more requests
+//      into a GitHub 403.
+//   2. force → only the short SESSION_START_MIN_GAP_MS floor applies, so opening
+//      a new session re-checks immediately while a crash/reopen loop still can't
+//      hammer the API.
+//   3. otherwise → an "up to date" result is re-verified on a short cadence
+//      (UP_TO_DATE_RECHECK_MS). This is the release-publish race guard: a version
+//      can go live seconds AFTER a check that said "up to date", and the plain 6h
+//      interval left it invisible for the full 6h (observed live — v0.85.7
+//      published 8s after a check pinned v0.85.6). A pending-but-unfinished update
+//      keeps the 6h steady-state interval.
+function shouldCheck(state, { force = false } = {}) {
   if (!state.lastCheck) return true;
   const elapsed = Date.now() - new Date(state.lastCheck).getTime();
-  const interval = state.rateLimited ? RATE_LIMIT_INTERVAL_MS : CHECK_INTERVAL_MS;
+  if (state.rateLimited) return elapsed >= RATE_LIMIT_INTERVAL_MS;
+  if (force) return elapsed >= SESSION_START_MIN_GAP_MS;
+  const interval = state.updateAvailable === false ? UP_TO_DATE_RECHECK_MS : CHECK_INTERVAL_MS;
   return elapsed >= interval;
 }
 
@@ -472,7 +496,7 @@ async function selfHealStaleBinary(latest, { needsUpdate = cachedBinaryNeedsUpda
   return await download(latest);
 }
 
-async function checkForUpdate({ installMissing = false } = {}) {
+async function checkForUpdate({ installMissing = false, force = false } = {}) {
   try {
     // Skip in dev mode — unless the launcher explicitly requested a missing-
     // binary install, in which case we MUST proceed regardless of mode (the
@@ -491,7 +515,7 @@ async function checkForUpdate({ installMissing = false } = {}) {
     // fetch + self-heal path below.
     const binaryMissing = !fs.existsSync(cachedBinaryPath());
     const binaryStale = cachedBinaryStaleVsState(state);
-    if (!binaryMissing && !binaryStale && !shouldCheck(state)) {
+    if (!binaryMissing && !binaryStale && !shouldCheck(state, { force })) {
       if (state.installedVersion !== installedVersion) {
         saveState({ ...state, installedVersion });
       }
@@ -567,9 +591,9 @@ async function checkForUpdate({ installMissing = false } = {}) {
 }
 
 module.exports = {
-  checkForUpdate, commandExists, isDevMode, readState, compareVersions,
+  checkForUpdate, commandExists, isDevMode, readState, compareVersions, shouldCheck,
   getExtractedPluginVersion, readBinaryVersion, promoteVerifiedBinary,
-  isSilentMode, isInstallMissingMode,
+  isSilentMode, isInstallMissingMode, isForceMode,
   requestJson, parseLatestRelease, fetchLatestRelease,
   downloadBinary, cachedBinaryPath, cachedBinaryNeedsUpdate, cachedBinaryStaleVsState,
   selfHealStaleBinary,
@@ -583,12 +607,13 @@ if (require.main === module) {
     const cmd = argv.find(arg => !arg.startsWith('--')) || 'check';
     const silent = isSilentMode(argv);
     const installMissing = isInstallMissingMode(argv);
+    const force = isForceMode(argv);
     if (cmd === 'status') {
       const state = readState();
       console.log(JSON.stringify(state, null, 2));
     } else {
       if (!silent) console.log('Checking for updates...');
-      const result = await checkForUpdate({ installMissing });
+      const result = await checkForUpdate({ installMissing, force });
       if (silent) return;
       if (result && result.updated) {
         console.log(`Updated: v${result.from} → v${result.to} (binary: ${result.binaryUpdated ? 'yes' : 'no'})`);

package/claude-plugin/scripts/auto-update.test.js

@@ -20,6 +20,7 @@ const {
   selfHealStaleBinary,
   isInstallMissingMode,
   isSilentMode,
+  shouldCheck,
 } = require('./auto-update');
 
 function mkDir(t, prefix) {
@@ -180,6 +181,45 @@ test('cachedBinaryStaleVsState bypasses throttle only for a present-but-stale bi
   assert.equal(cachedBinaryStaleVsState({ latestVersion: '0.45.1' }, { binaryPath }), false);
 });
 
+test('shouldCheck re-verifies an up-to-date state on a short cadence (release-publish race)', () => {
+  const minsAgo = (m) => new Date(Date.now() - m * 60 * 1000).toISOString();
+
+  // never checked → always check
+  assert.equal(shouldCheck({}), true);
+
+  // Bug repro: the last check reported "up to date" (updateAvailable:false) and a
+  // release published moments later. 45min on, the plain 6h throttle kept the
+  // stale answer latched (every session reopen re-reported up-to-date); the short
+  // up-to-date cadence must allow a re-check so the new release is discovered.
+  assert.equal(shouldCheck({ lastCheck: minsAgo(45), updateAvailable: false }), true);
+
+  // within the short window → still throttled (don't hammer the API every call)
+  assert.equal(shouldCheck({ lastCheck: minsAgo(10), updateAvailable: false }), false);
+
+  // a pending-but-unfinished update keeps the 6h steady-state interval
+  assert.equal(shouldCheck({ lastCheck: minsAgo(45), updateAvailable: true }), false);
+
+  // rate-limit backoff (24h) wins even over the up-to-date short cadence
+  assert.equal(shouldCheck({ lastCheck: minsAgo(120), updateAvailable: false, rateLimited: true }), false);
+});
+
+test('shouldCheck lets a forced (session-start) check bypass the soft throttle', () => {
+  const minsAgo = (m) => new Date(Date.now() - m * 60 * 1000).toISOString();
+
+  // A new session / explicit reload is a strong "get me latest" signal: a forced
+  // check runs even inside the 30min up-to-date window (contrast the non-forced
+  // call on the same state, which stays throttled).
+  assert.equal(shouldCheck({ lastCheck: minsAgo(10), updateAvailable: false }, { force: true }), true);
+  assert.equal(shouldCheck({ lastCheck: minsAgo(10), updateAvailable: false }), false);
+
+  // ...but a short anti-hammer floor still applies, so a crash/reopen loop can't
+  // pound the GitHub API on every restart.
+  assert.equal(shouldCheck({ lastCheck: minsAgo(0.5), updateAvailable: false }, { force: true }), false);
+
+  // Rate-limit backoff wins even over force — never push more requests into a 403.
+  assert.equal(shouldCheck({ lastCheck: minsAgo(60), updateAvailable: false, rateLimited: true }, { force: true }), false);
+});
+
 test('selfHealStaleBinary wires the stale-binary check to a download (the v0.45.x glue)', async () => {
   const latest = { version: '0.45.2', binaryUrl: 'https://example/bin' };
 

package/claude-plugin/scripts/session-init.js

@@ -166,9 +166,14 @@ function formatRecentImpact(changed, affected, dependentCap = 6) {
   return lines.join('\n');
 }
 
-function launchBackgroundAutoUpdate(spawnFn = spawn, env = process.env) {
+function launchBackgroundAutoUpdate(spawnFn = spawn, env = process.env, { force = false } = {}) {
   try {
-    const child = spawnFn(process.execPath, [path.join(__dirname, 'auto-update.js'), 'check', '--silent'], {
+    const args = [path.join(__dirname, 'auto-update.js'), 'check', '--silent'];
+    // A session start / reload forces an immediate check (bypasses the soft
+    // throttle down to auto-update.js's short anti-hammer floor + rate-limit
+    // backoff), so an available update is picked up now rather than on the next tick.
+    if (force) args.push('--force');
+    const child = spawnFn(process.execPath, args, {
       detached: true,
       stdio: 'ignore',
       env: { ...env, CODE_GRAPH_AUTO_UPDATE_SILENT: '1' },
@@ -180,6 +185,14 @@ function launchBackgroundAutoUpdate(spawnFn = spawn, env = process.env) {
   }
 }
 
+// A session start / resume / clear / explicit reload is a strong "I'm here, get
+// me the latest" signal → force an immediate update check. Automatic mid-session
+// compaction is not high-intent, so it keeps auto-update.js's gentle background
+// cadence. Unknown source (direct calls / tests) is treated as high-intent.
+function isHighIntentSource(source) {
+  return source !== 'compact';
+}
+
 function syncLifecycleConfig() {
   // v0.49.1: stale-relic guard. A still-running Claude Code process fires
   // SessionStart from the plugin-cache dir it loaded at startup; after
@@ -509,7 +522,7 @@ function runSessionInit({ source } = {}) {
   // Verify binary availability — catch issues early with actionable diagnostics
   const binaryCheck = verifyBinary();
 
-  const autoUpdateLaunched = launchBackgroundAutoUpdate();
+  const autoUpdateLaunched = launchBackgroundAutoUpdate(spawn, process.env, { force: isHighIntentSource(source) });
   const indexFreshness = binaryCheck.available ? ensureIndexFresh() : 'skipped';
 
   // 上下文感知默认：插件模式下首次 SessionStart 自动安装（创建/注入 CLAUDE.md 块 +
@@ -752,6 +765,7 @@ function detectHookDark() {
 
 module.exports = {
   launchBackgroundAutoUpdate,
+  isHighIntentSource,
   syncLifecycleConfig,
   ensureIndexFresh,
   indexNeedsRevalidation,

package/claude-plugin/scripts/session-init.test.js

@@ -5,7 +5,7 @@ const fs = require('fs');
 const path = require('path');
 
 const os = require('os');
-const { launchBackgroundAutoUpdate, syncLifecycleConfig, ensureIndexFresh, indexNeedsRevalidation, verifyBinary, computeQuietHooks, shouldInjectMap, shouldInjectRecentImpact, recentImpactWorthShowing, filterSourceFiles, parseGitStatusPaths, formatRecentImpact } = require('./session-init');
+const { launchBackgroundAutoUpdate, isHighIntentSource, syncLifecycleConfig, ensureIndexFresh, indexNeedsRevalidation, verifyBinary, computeQuietHooks, shouldInjectMap, shouldInjectRecentImpact, recentImpactWorthShowing, filterSourceFiles, parseGitStatusPaths, formatRecentImpact } = require('./session-init');
 
 // Write an executable stub named `code-graph-mcp` that emits `json` to stdout on
 // `health-check` and exits with `exitCode`. Mirrors how the real binary behaves:
@@ -121,6 +121,28 @@ test('launchBackgroundAutoUpdate spawns detached silent updater', () => {
   assert.equal(calls[0].unrefCalled, true);
 });
 
+test('launchBackgroundAutoUpdate forwards --force only when asked (session-start bypass)', () => {
+  const calls = [];
+  const capture = (_command, args) => {
+    calls.push({ args });
+    return { unref() {} };
+  };
+
+  launchBackgroundAutoUpdate(capture, {}, { force: true });
+  assert.deepEqual(calls[0].args.slice(1), ['check', '--silent', '--force']);
+
+  launchBackgroundAutoUpdate(capture, {}); // default → no --force
+  assert.deepEqual(calls[1].args.slice(1), ['check', '--silent']);
+});
+
+test('isHighIntentSource forces on session start/resume/clear but not automatic compaction', () => {
+  assert.equal(isHighIntentSource('startup'), true);
+  assert.equal(isHighIntentSource('resume'), true);
+  assert.equal(isHighIntentSource('clear'), true);
+  assert.equal(isHighIntentSource(undefined), true); // direct call / unknown → high intent
+  assert.equal(isHighIntentSource('compact'), false); // frequent + automatic → gentle cadence
+});
+
 const { consistencyCheck, runSessionInit } = require('./session-init');
 
 test('consistencyCheck is exported as a function', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph",
-  "version": "0.85.6",
+  "version": "0.85.8",
   "description": "MCP server that indexes codebases into an AST knowledge graph with semantic search, call graph traversal, and HTTP route tracing",
   "license": "MIT",
   "repository": {
@@ -35,10 +35,10 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@sdsrs/code-graph-linux-x64": "0.85.6",
-    "@sdsrs/code-graph-linux-arm64": "0.85.6",
-    "@sdsrs/code-graph-darwin-x64": "0.85.6",
-    "@sdsrs/code-graph-darwin-arm64": "0.85.6",
-    "@sdsrs/code-graph-win32-x64": "0.85.6"
+    "@sdsrs/code-graph-linux-x64": "0.85.8",
+    "@sdsrs/code-graph-linux-arm64": "0.85.8",
+    "@sdsrs/code-graph-darwin-x64": "0.85.8",
+    "@sdsrs/code-graph-darwin-arm64": "0.85.8",
+    "@sdsrs/code-graph-win32-x64": "0.85.8"
   }
 }