claude-crap 0.3.3 → 0.3.5

package/plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-crap-plugin",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "private": true,
   "description": "Runtime dependencies for the claude-crap plugin bundle",
   "type": "module",
@@ -14,5 +14,9 @@
   },
   "engines": {
     "node": ">=20.0.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.2.0"
   }
 }

package/scripts/bundle-plugin.mjs

@@ -1,6 +1,7 @@
 // scripts/bundle-plugin.mjs
 import { build } from "esbuild";
 import { cp, mkdir, rm } from "node:fs/promises";
+import { execFileSync } from "node:child_process";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -66,6 +67,35 @@ async function main() {
     resolve(BUNDLE_DIR, "dashboard/public"),
     { recursive: true },
   );
+
+  // 4. Copy the launcher wrapper into the bundle directory.
+  //    launcher.mjs is the .mcp.json entry point and is hand-written
+  //    (not bundled by esbuild). It ensures node_modules/ exist before
+  //    dynamically importing the real MCP server.
+  await cp(
+    resolve(ROOT, "plugin/launcher.mjs"),
+    resolve(BUNDLE_DIR, "launcher.mjs"),
+  );
+
+  // 5. Generate plugin/package-lock.json for deterministic installs.
+  //    This lockfile ships with the plugin so that the launcher's
+  //    `npm install --omit=dev` resolves the exact same versions on
+  //    every developer's machine. `--package-lock-only` does NOT
+  //    create node_modules/, keeping the repo light.
+  try {
+    execFileSync("npm", [
+      "install",
+      "--package-lock-only",
+      "--omit=dev",
+    ], {
+      cwd: resolve(ROOT, "plugin"),
+      stdio: ["ignore", "inherit", "inherit"],
+    });
+  } catch (err) {
+    process.stderr.write(
+      `warning: could not generate plugin/package-lock.json: ${err.message}\n`,
+    );
+  }
 }
 
 main().catch((err) => {

package/scripts/doctor.mjs

@@ -152,13 +152,13 @@ async function checkDist(pluginRoot) {
     const stat = await fs.stat(npmEntry);
     npmAge = Math.round((Date.now() - stat.mtimeMs) / (1000 * 60 * 60));
     npmOk = true;
-  } catch {}
+  } catch { /* probe — absence is expected */ }
 
   try {
     const stat = await fs.stat(gitEntry);
     gitAge = Math.round((Date.now() - stat.mtimeMs) / (1000 * 60 * 60));
     gitOk = true;
-  } catch {}
+  } catch { /* probe — absence is expected */ }
 
   const details = [];
   if (npmOk) details.push(`dist/index.js (~${npmAge}h)`);

package/src/dashboard/server.ts

@@ -24,8 +24,8 @@
  * @module dashboard/server
  */
 
-import { promises as fs } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { promises as fs, existsSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import Fastify, { type FastifyInstance } from "fastify";
@@ -99,7 +99,7 @@ export async function startDashboard(options: StartDashboardOptions): Promise<Da
   // ------------------------------------------------------------------
   // /api/health — liveness probe
   // ------------------------------------------------------------------
-  fastify.get("/api/health", async () => ({ status: "ok", server: "claude-crap", version: "0.3.2" }));
+  fastify.get("/api/health", async () => ({ status: "ok", server: "claude-crap", version: "0.3.5" }));
 
   // ------------------------------------------------------------------
   // /api/score — live project score
@@ -125,13 +125,24 @@ export async function startDashboard(options: StartDashboardOptions): Promise<Da
     return reply.sendFile("index.html");
   });
 
+  // Kill any stale dashboard from a previous session so we always
+  // bind to the configured port. This mirrors claude-mem's PID file
+  // pattern: write a PID file when alive, check + kill on next boot.
+  const pidFilePath = resolvePidFilePath(config);
+  await killStaleDashboard(pidFilePath, config.dashboardPort, logger);
+
   await fastify.listen({ port: config.dashboardPort, host: "127.0.0.1" });
+
   const url = `http://127.0.0.1:${config.dashboardPort}`;
   logger.info({ url, publicRoot }, "claude-crap dashboard listening");
 
+  // Write PID file so the next session can find and kill us.
+  writePidFile(pidFilePath, config.dashboardPort);
+
   return {
     url,
     async close() {
+      removePidFile(pidFilePath);
       await fastify.close();
     },
   };
@@ -188,6 +199,136 @@ function urlOf(fastify: FastifyInstance, config: CrapConfig): string {
   return `http://127.0.0.1:${config.dashboardPort}`;
 }
 
+// ------------------------------------------------------------------
+// PID file management — mirrors claude-mem's worker.pid pattern
+// ------------------------------------------------------------------
+
+/**
+ * Shape of the PID file written by the dashboard process.
+ */
+interface DashboardPidFile {
+  pid: number;
+  port: number;
+  startedAt: string;
+}
+
+/**
+ * Resolve the path to the PID file. Stored under
+ * `.claude-crap/dashboard.pid` in the workspace so it survives
+ * across sessions but is gitignored with the rest of `.claude-crap/`.
+ */
+function resolvePidFilePath(config: CrapConfig): string {
+  return join(config.pluginRoot, ".claude-crap", "dashboard.pid");
+}
+
+/**
+ * Write the PID file atomically after the dashboard has started.
+ */
+function writePidFile(path: string, port: number): void {
+  const data: DashboardPidFile = {
+    pid: process.pid,
+    port,
+    startedAt: new Date().toISOString(),
+  };
+  try {
+    writeFileSync(path, JSON.stringify(data, null, 2) + "\n");
+  } catch {
+    /* best effort — dashboard still works without a PID file */
+  }
+}
+
+/**
+ * Remove the PID file during graceful shutdown.
+ */
+function removePidFile(path: string): void {
+  try {
+    unlinkSync(path);
+  } catch {
+    /* already gone or never written */
+  }
+}
+
+/**
+ * Check whether a process is alive using the signal-0 probe.
+ * Returns `true` when the process exists and is reachable.
+ */
+function isPidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Read the PID file, kill any stale dashboard process, and free the
+ * port so the current session can bind to it. This is the key
+ * difference from the port-fallback approach: instead of drifting to
+ * 5118, 5119, etc., we reclaim the configured port every time.
+ *
+ * @param pidFilePath  Absolute path to `dashboard.pid`.
+ * @param port         The configured dashboard port.
+ * @param logger       Pino logger for diagnostics.
+ */
+async function killStaleDashboard(
+  pidFilePath: string,
+  port: number,
+  logger: Logger,
+): Promise<void> {
+  if (!existsSync(pidFilePath)) return;
+
+  let stale: DashboardPidFile;
+  try {
+    stale = JSON.parse(readFileSync(pidFilePath, "utf8"));
+  } catch {
+    // Corrupted PID file — remove it and move on.
+    removePidFile(pidFilePath);
+    return;
+  }
+
+  if (!isPidAlive(stale.pid)) {
+    logger.info({ stalePid: stale.pid }, "stale dashboard PID file found (process dead), removing");
+    removePidFile(pidFilePath);
+    return;
+  }
+
+  // Process is alive — kill it so we can reclaim the port.
+  logger.info(
+    { stalePid: stale.pid, port: stale.port, startedAt: stale.startedAt },
+    "killing stale dashboard process from previous session",
+  );
+
+  try {
+    process.kill(stale.pid, "SIGTERM");
+  } catch {
+    // Permission denied or already gone — remove PID file either way.
+    removePidFile(pidFilePath);
+    return;
+  }
+
+  // Wait up to 3 seconds for the process to exit.
+  for (let i = 0; i < 30; i++) {
+    if (!isPidAlive(stale.pid)) break;
+    await new Promise((r) => setTimeout(r, 100));
+  }
+
+  // If still alive after 3s, escalate to SIGKILL.
+  if (isPidAlive(stale.pid)) {
+    try {
+      process.kill(stale.pid, "SIGKILL");
+    } catch {
+      /* best effort */
+    }
+    await new Promise((r) => setTimeout(r, 200));
+  }
+
+  removePidFile(pidFilePath);
+
+  // Give the OS a moment to release the TCP port after the process dies.
+  await new Promise((r) => setTimeout(r, 300));
+}
+
 /**
  * Wrap {@link computeProjectScore} so the dashboard endpoint can call
  * it with the live store and provide consistent location metadata.

package/src/sarif/sarif-store.ts

@@ -184,6 +184,7 @@ export class SarifStore {
       }
       throw new Error(
         `[sarif-store] Failed to load consolidated report at ${this.filePath}: ${error.message}`,
+        { cause: err },
       );
     }
   }