fix(plugin): restore fresh-install bootstrap via cache hooks.json (v0.8.3)

Fresh `/plugin install code-graph-mcp` users got no hooks firing because
claude-plugin/hooks/hooks.json was emptied in v0.7.18 (to prevent double-
fire with settings.json) and nothing else ever populated settings.json
without that hook first running. Result: no auto-index, no StatusLine,
no project-map injection, no impact analysis, no auto-update — only
MCP tools/commands/agents worked. Migration users kept working because
their settings.json still had the legacy registrations.

Invert the authority: cache/<ver>/hooks/hooks.json is now the source of
truth (same pattern superpowers uses). install/update strip any legacy
code-graph entries from settings.json instead of writing them. StatusLine
stays in settings.json — it's the only channel Claude Code exposes for it.

Secondary fixes:
- `lifecycle.js uninstall` CLI prints a reminder to also run
  `/plugin uninstall code-graph-mcp` inside Claude Code to sync the UI.
- README gains an "Invited-memory mode" section documenting the
  `code-graph-mcp adopt` + CODE_GRAPH_QUIET_HOOKS env var path.
- Doctor's "Plugin cache" diagnostic is inverted to "Legacy hooks" —
  flags leftover code-graph entries in settings.json with auto-fix.

Removed from lifecycle.js as obsolete: registerHooksToSettings,
getHookDefinitions, scanPluginHooksJsonCopies, findStalePluginHooksJson,
clearStalePluginCacheHooks, EMPTY_HOOKS_STUB, isOurPluginMarketplace.
session-init.js loses healStaleCacheHooks.

Verification:
- Fresh-install sandbox: cache hooks.json populated → session-init fires
  → statusLine composite installed → manifest written → no code-graph
  entries leak into settings.json.
- Migration sandbox (v0.8.2 legacy hooks + other plugin hook present):
  legacy entries stripped, other plugin's hook preserved, manifest
  bumped 0.8.2 → 0.8.3.
- 115/115 Node tests, 206/206 cargo tests, doctor runs clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sdsrss

.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "AST knowledge graph plugin for Claude Code — semantic search, call graph, HTTP tracing, impact analysis",
-    "version": "0.8.2"
+    "version": "0.8.3"
   },
   "plugins": [
     {
       "name": "code-graph-mcp",
       "source": "./claude-plugin",
       "description": "AST knowledge graph for intelligent code navigation — auto-indexes your codebase and provides semantic search, call graph traversal, HTTP route tracing, and impact analysis via MCP tools",
-      "version": "0.8.2",
+      "version": "0.8.3",
       "author": {
         "name": "sdsrs"
       },

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "code-graph-mcp"
-version = "0.8.2"
+version = "0.8.3"
 edition = "2021"
 
 [features]

Cargo.toml

@@ -146,6 +146,23 @@ Then reconnect the MCP server in Claude Code with `/mcp`.
 
 > **Note:** Auto-update is disabled in the source repo directory (dev mode). Use manual update when developing the plugin itself.
 
+#### Invited-memory mode (quieter prompts)
+
+By default, every user prompt the plugin deems code-related gets a small context injection from `code-graph` CLI output. If you'd rather rely on MEMORY.md + explicit tool calls, opt into invited-memory mode:
+
+1. Adopt the plugin contract into your project's memory index (idempotent, self-heals):
+   ```bash
+   code-graph-mcp adopt
+   ```
+   This writes `plugin_code_graph_mcp.md` (decision rules) into `~/.claude/projects/<slug>/memory/` and links it from `MEMORY.md` inside a sentinel block. Run `code-graph-mcp unadopt` to remove.
+2. Set the activation env var in `~/.claude/settings.json`:
+   ```json
+   {
+     "env": { "CODE_GRAPH_QUIET_HOOKS": "1" }
+   }
+   ```
+3. Restart Claude Code. Session startup skips the project-map injection, UserPromptSubmit stops auto-injecting context, and the MCP `instructions` become a short pointer to the MEMORY.md file.
+
 ### Option 2: Claude Code MCP Server Only
 
 Register as an MCP server without the plugin features:

README.md

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.8.2",
+  "version": "0.8.3",
   "keywords": [
     "code-graph",
     "ast",

claude-plugin/.claude-plugin/plugin.json

@@ -1,5 +1,54 @@
 {
-  "description": "code-graph-mcp hooks",
-  "_note": "Hooks are registered to ~/.claude/settings.json by scripts/lifecycle.js. This file is intentionally empty to prevent double-firing — Claude Code would otherwise load hooks from both the plugin cache copy AND settings.json, causing each hook to run twice per event.",
-  "hooks": {}
+  "description": "code-graph-mcp hooks — loaded directly by Claude Code from the plugin cache.",
+  "_note": "Authoritative source. settings.json is no longer used for hook registration as of v0.8.3 — session-init.js actively removes any legacy code-graph entries it finds there. Paths use ${CLAUDE_PLUGIN_ROOT} so they follow version directory updates automatically.",
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/session-init.js\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "tool == \"Edit\"",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/pre-edit-guide.js\"",
+            "timeout": 4
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "tool == \"Write\" || tool == \"Edit\"",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/incremental-index.js\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/user-prompt-context.js\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ]
+  }
 }

claude-plugin/hooks/hooks.json

@@ -7,7 +7,7 @@ const os = require('os');
 const { readBinaryVersion, isDevMode, getNewestMtime } = require('./version-utils');
 const {
   getPluginVersion, readJson, healthCheck, CACHE_DIR,
-  findStalePluginHooksJson, clearStalePluginCacheHooks,
+  removeHooksFromSettings, isOurHookEntry, writeJsonAtomic,
 } = require('./lifecycle');
 const { findBinary, clearCache: clearBinaryCache } = require('./find-binary');
 
@@ -166,24 +166,40 @@ function runDiagnostics() {
     });
   }
 
-  // 7. Plugin cache hooks.json sanity — non-empty copies cause every hook to fire twice
+  // 7. Legacy hooks in settings.json — v0.8.2 and earlier wrote hooks there;
+  //    cache/<ver>/hooks/hooks.json is now authoritative. Duplicates cause
+  //    every hook to fire twice until settings.json is cleaned.
   try {
-    const stale = findStalePluginHooksJson();
-    if (stale.length === 0) {
-      results.push({ name: 'Plugin cache', status: 'ok', detail: 'no stale hooks.json' });
+    const SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
+    const settings = readJson(SETTINGS_PATH) || {};
+    const legacyCount = countLegacyHookEntries(settings);
+    if (legacyCount === 0) {
+      results.push({ name: 'Legacy hooks', status: 'ok', detail: 'settings.json is clean' });
     } else {
       results.push({
-        name: 'Plugin cache',
+        name: 'Legacy hooks',
         status: 'warn',
-        detail: `${stale.length} stale hooks.json (hooks fire twice per event)`,
-        fixId: 'hooks-cache-stale',
+        detail: `${legacyCount} entries in settings.json (fire twice per event)`,
+        fixId: 'legacy-hooks-in-settings',
       });
     }
-  } catch { /* lifecycle probe failed — skip */ }
+  } catch { /* probe failed — skip */ }
 
   return results;
 }
 
+function countLegacyHookEntries(settings) {
+  if (!settings || !settings.hooks) return 0;
+  let count = 0;
+  for (const entries of Object.values(settings.hooks)) {
+    if (!Array.isArray(entries)) continue;
+    for (const entry of entries) {
+      if (isOurHookEntry(entry)) count++;
+    }
+  }
+  return count;
+}
+
 // ── Report Formatting ─────────────────────────────────────
 
 const STATUS_ICONS = { ok: '\u2705', warn: '\u26a0\ufe0f', error: '\u274c', skip: '\u2796' };
@@ -339,12 +355,17 @@ function runRepairs(results) {
         break;
       }
 
-      case 'hooks-cache-stale': {
-        console.log('\n  Clearing stale plugin cache hooks.json...');
-        const cleared = clearStalePluginCacheHooks();
-        console.log(`  \u2705 Cleared ${cleared.length} file(s) — restart Claude Code to apply`);
-        for (const p of cleared) console.log(`     - ${p}`);
-        fixed++;
+      case 'legacy-hooks-in-settings': {
+        console.log('\n  Removing legacy code-graph hooks from settings.json...');
+        const SETTINGS_PATH = path.join(os.homedir(), '.claude', 'settings.json');
+        const settings = readJson(SETTINGS_PATH) || {};
+        if (removeHooksFromSettings(settings)) {
+          writeJsonAtomic(SETTINGS_PATH, settings);
+          console.log('  \u2705 settings.json cleaned — restart Claude Code to apply');
+          fixed++;
+        } else {
+          console.log('  \u2796 No legacy entries found');
+        }
         break;
       }