fix: prevent .code-graph pollution + sync update-state + test leak cleanup (v0.8.4)

- cli: resolve_project_root() climbs to .git before using cwd, stops
  orphan .code-graph/ indexes when CLI runs from subdirs
- cli: cleanup_legacy_db_files() auto-removes 0-byte legacy
  code-graph.db/code_graph.db/graph.db on index open
- auto-update: always sync installedVersion from manifest.version so
  /plugin update (which bypasses auto-update.js) doesn't leave state stale
- tests: add t.after(rmSync) cleanup to 7 test files to stop
  ~/.claude/tmp/ from accumulating mkdtempSync leftovers across runs

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sdsrss

.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "AST knowledge graph plugin for Claude Code — semantic search, call graph, HTTP tracing, impact analysis",
-    "version": "0.8.3"
+    "version": "0.8.4"
   },
   "plugins": [
     {
       "name": "code-graph-mcp",
       "source": "./claude-plugin",
       "description": "AST knowledge graph for intelligent code navigation — auto-indexes your codebase and provides semantic search, call graph traversal, HTTP route tracing, and impact analysis via MCP tools",
-      "version": "0.8.3",
+      "version": "0.8.4",
       "author": {
         "name": "sdsrs"
       },

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "code-graph-mcp"
-version = "0.8.3"
+version = "0.8.4"
 edition = "2021"
 
 [features]

Cargo.toml

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.8.3",
+  "version": "0.8.4",
   "keywords": [
     "code-graph",
     "ast",

claude-plugin/.claude-plugin/plugin.json

@@ -310,33 +310,38 @@ async function checkForUpdate() {
     if (isDevMode()) return null;
 
     const state = readState();
+    // manifest.version is authoritative — /plugin update writes it directly and
+    // bypasses auto-update.js, so re-sync state.installedVersion every call.
+    const installedVersion = readManifest().version || '0.0.0';
 
     // Time-based throttle
     if (!shouldCheck(state)) {
-      if (state.updateAvailable && state.latestVersion) {
-        return { updateAvailable: true, from: state.installedVersion, to: state.latestVersion };
+      if (state.installedVersion !== installedVersion) {
+        saveState({ ...state, installedVersion });
+      }
+      if (state.updateAvailable && state.latestVersion
+          && compareVersions(state.latestVersion, installedVersion) > 0) {
+        return { updateAvailable: true, from: installedVersion, to: state.latestVersion };
       }
       return null;
     }
 
     // Check GitHub for latest release
     const latest = await fetchLatestRelease();
     if (!latest) {
-      saveState({ ...state, lastCheck: new Date().toISOString() });
+      saveState({ ...state, installedVersion, lastCheck: new Date().toISOString() });
       return null;
     }
 
     // Compare versions
-    const manifest = readManifest();
-    const currentVersion = manifest.version || '0.0.0';
-    const hasUpdate = compareVersions(latest.version, currentVersion) > 0;
+    const hasUpdate = compareVersions(latest.version, installedVersion) > 0;
 
     if (hasUpdate) {
       const result = await downloadAndInstall(latest);
       const success = result.pluginUpdated;
       const newState = {
         lastCheck: new Date().toISOString(),
-        installedVersion: success ? latest.version : currentVersion,
+        installedVersion: success ? latest.version : installedVersion,
         latestVersion: latest.version,
         updateAvailable: !success,
         lastUpdate: success ? new Date().toISOString() : state.lastUpdate,
@@ -349,14 +354,15 @@ async function checkForUpdate() {
         updateAvailable: !success,
         updated: success,
         binaryUpdated: result.binaryUpdated,
-        from: currentVersion,
+        from: installedVersion,
         to: latest.version,
       };
     }
 
     // No update needed
     saveState({
       ...state,
+      installedVersion,
       lastCheck: new Date().toISOString(),
       latestVersion: latest.version,
       updateAvailable: false,

claude-plugin/scripts/auto-update.js

@@ -14,12 +14,14 @@ const {
   promoteVerifiedBinary,
 } = require('./auto-update');
 
-function mkDir(prefix) {
-  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+function mkDir(t, prefix) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  return dir;
 }
 
-test('getExtractedPluginVersion reads extracted plugin manifest version', () => {
-  const root = mkDir('code-graph-plugin-');
+test('getExtractedPluginVersion reads extracted plugin manifest version', (t) => {
+  const root = mkDir(t, 'code-graph-plugin-');
   const manifest = path.join(root, '.claude-plugin', 'plugin.json');
   fs.mkdirSync(path.dirname(manifest), { recursive: true });
   fs.writeFileSync(manifest, JSON.stringify({ version: '1.2.3' }, null, 2));
@@ -41,8 +43,8 @@ function writeFakeBinary(filePath, version) {
   fs.chmodSync(filePath, 0o755);
 }
 
-test('promoteVerifiedBinary accepts a runnable binary with the expected version', () => {
-  const dir = mkDir('code-graph-bin-');
+test('promoteVerifiedBinary accepts a runnable binary with the expected version', (t) => {
+  const dir = mkDir(t, 'code-graph-bin-');
   const tmp = path.join(dir, 'code-graph-mcp.tmp');
   const dst = path.join(dir, 'code-graph-mcp');
   writeFakeBinary(tmp, '1.2.3');
@@ -53,8 +55,8 @@ test('promoteVerifiedBinary accepts a runnable binary with the expected version'
   assert.equal(fs.existsSync(dst), true);
 });
 
-test('promoteVerifiedBinary rejects binaries with mismatched version', () => {
-  const dir = mkDir('code-graph-bin-');
+test('promoteVerifiedBinary rejects binaries with mismatched version', (t) => {
+  const dir = mkDir(t, 'code-graph-bin-');
   const tmp = path.join(dir, 'code-graph-mcp.tmp');
   const dst = path.join(dir, 'code-graph-mcp');
   writeFakeBinary(tmp, '1.2.2');

claude-plugin/scripts/auto-update.test.js

@@ -12,8 +12,10 @@ const lifecycleCli = path.join(__dirname, 'lifecycle.js');
 const compositeCli = path.join(__dirname, 'statusline-composite.js');
 const currentVersion = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8')).version;
 
-function mkHome() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'code-graph-e2e-'));
+function mkHome(t) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-graph-e2e-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  return dir;
 }
 
 function writeJson(filePath, value) {
@@ -38,8 +40,8 @@ function runScript(homeDir, scriptPath, args = [], options = {}) {
   }).toString();
 }
 
-test('lifecycle CLI handles install, disable self-heal, re-enable, and uninstall', () => {
-  const homeDir = mkHome();
+test('lifecycle CLI handles install, disable self-heal, re-enable, and uninstall', (t) => {
+  const homeDir = mkHome(t);
   const settingsPath = path.join(homeDir, '.claude', 'settings.json');
   const installedPath = path.join(homeDir, '.claude', 'plugins', 'installed_plugins.json');
   const registryPath = path.join(homeDir, '.cache', 'code-graph', 'statusline-registry.json');

claude-plugin/scripts/lifecycle.e2e.test.js

@@ -9,8 +9,10 @@ const { execFileSync } = require('child_process');
 const lifecyclePath = path.join(__dirname, 'lifecycle.js');
 const statuslinePath = path.join(__dirname, 'statusline.js');
 
-function mkHome() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'code-graph-home-'));
+function mkHome(t) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-graph-home-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  return dir;
 }
 
 function writeJson(filePath, value) {
@@ -48,8 +50,8 @@ function seedOrphanedComposite(homeDir) {
   return { settingsPath, registryPath };
 }
 
-test('cleanupDisabledStatusline restores previous statusline and removes registry', () => {
-  const homeDir = mkHome();
+test('cleanupDisabledStatusline restores previous statusline and removes registry', (t) => {
+  const homeDir = mkHome(t);
   const { settingsPath, registryPath } = seedDisabledComposite(homeDir);
 
   const out = execFileSync(process.execPath, ['-e', `
@@ -63,10 +65,11 @@ test('cleanupDisabledStatusline restores previous statusline and removes registr
   assert.equal(fs.existsSync(registryPath), false);
 });
 
-test('statusline exits cleanly and self-heals when plugin is disabled', () => {
-  const homeDir = mkHome();
+test('statusline exits cleanly and self-heals when plugin is disabled', (t) => {
+  const homeDir = mkHome(t);
   const { settingsPath, registryPath } = seedDisabledComposite(homeDir);
   const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'code-graph-project-'));
+  t.after(() => fs.rmSync(projectDir, { recursive: true, force: true }));
   fs.mkdirSync(path.join(projectDir, '.code-graph'), { recursive: true });
   fs.writeFileSync(path.join(projectDir, '.code-graph', 'index.db'), '');
 
@@ -81,8 +84,8 @@ test('statusline exits cleanly and self-heals when plugin is disabled', () => {
   assert.equal(fs.existsSync(registryPath), false);
 });
 
-test('cleanupDisabledStatusline also heals orphaned statusline after uninstall', () => {
-  const homeDir = mkHome();
+test('cleanupDisabledStatusline also heals orphaned statusline after uninstall', (t) => {
+  const homeDir = mkHome(t);
   const { settingsPath, registryPath } = seedOrphanedComposite(homeDir);
 
   const out = execFileSync(process.execPath, ['-e', `
@@ -175,8 +178,8 @@ test('removeHooksFromSettings strips our entries but keeps unrelated hooks', ()
   assert.ok(!s.hooks.PostToolUse, 'empty event key should be deleted');
 });
 
-test('install() removes legacy code-graph hooks from settings.json without re-registering', () => {
-  const homeDir = mkHome();
+test('install() removes legacy code-graph hooks from settings.json without re-registering', (t) => {
+  const homeDir = mkHome(t);
   const settingsPath = path.join(homeDir, '.claude', 'settings.json');
   writeJson(settingsPath, {
     statusLine: { type: 'command', command: 'echo previous-status' },

claude-plugin/scripts/lifecycle.test.js

@@ -83,9 +83,10 @@ test('consistencyCheck returns empty array when binary version matches plugin',
   assert.ok(Array.isArray(result));
 });
 
-test('consistencyCheck returns version-mismatch when versions differ', () => {
+test('consistencyCheck returns version-mismatch when versions differ', (t) => {
   const os = require('os');
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cc-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
   const bin = path.join(dir, 'code-graph-mcp');
   fs.writeFileSync(bin, [
     '#!/usr/bin/env bash',

claude-plugin/scripts/session-init.test.js

@@ -5,15 +5,17 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 
-function mkDir(prefix) {
-  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+function mkDir(t, prefix) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  return dir;
 }
 
 // ── readBinaryVersion ──
 
-test('readBinaryVersion returns version from valid binary', () => {
+test('readBinaryVersion returns version from valid binary', (t) => {
   const { readBinaryVersion } = require('./version-utils');
-  const dir = mkDir('vu-');
+  const dir = mkDir(t, 'vu-');
   const bin = path.join(dir, 'code-graph-mcp');
   fs.writeFileSync(bin, [
     '#!/usr/bin/env bash',
@@ -32,9 +34,9 @@ test('readBinaryVersion returns null for non-existent binary', () => {
   assert.equal(readBinaryVersion('/tmp/does-not-exist-binary'), null);
 });
 
-test('readBinaryVersion returns null for binary with unexpected output', () => {
+test('readBinaryVersion returns null for binary with unexpected output', (t) => {
   const { readBinaryVersion } = require('./version-utils');
-  const dir = mkDir('vu-');
+  const dir = mkDir(t, 'vu-');
   const bin = path.join(dir, 'code-graph-mcp');
   fs.writeFileSync(bin, '#!/usr/bin/env bash\necho "something else"');
   fs.chmodSync(bin, 0o755);
@@ -56,9 +58,9 @@ test('getNewestMtime returns 0 for non-existent directory', () => {
   assert.equal(getNewestMtime('/tmp/no-such-dir-xyz'), 0);
 });
 
-test('getNewestMtime finds newest .rs file mtime', () => {
+test('getNewestMtime finds newest .rs file mtime', (t) => {
   const { getNewestMtime } = require('./version-utils');
-  const dir = mkDir('vu-mtime-');
+  const dir = mkDir(t, 'vu-mtime-');
   const sub = path.join(dir, 'sub');
   fs.mkdirSync(sub);
 
@@ -75,9 +77,9 @@ test('getNewestMtime finds newest .rs file mtime', () => {
   assert.equal(result, newerMtime, 'should return exactly the newest file mtime');
 });
 
-test('getNewestMtime ignores non-matching extensions', () => {
+test('getNewestMtime ignores non-matching extensions', (t) => {
   const { getNewestMtime } = require('./version-utils');
-  const dir = mkDir('vu-ext-');
+  const dir = mkDir(t, 'vu-ext-');
   fs.writeFileSync(path.join(dir, 'file.js'), 'hello');
   assert.equal(getNewestMtime(dir, '.rs'), 0);
 });