fix(plugin): adopt self-heals malformed sentinel + Windows guard (v0.8.1)

Code-review follow-ups for v0.8.0:

- adopt.js: stripSentinelBlock now self-heals orphan BEGIN (truncated
  prior run) and orphan END lines; collapses 3+ blank lines after strip.
  adopt rewrites the block when content drifts from canonical (was a
  silent no-op when sentinel present but stale).
- adopt.js: platformGuard rejects win32 — claude-mem-lite slug convention
  on Windows is unverified, and silent dir-mismatch was the failure mode.
- adopt.js: formatResult distinguishes healed vs fresh-indexed vs no-op.
- main.rs: SAFETY comment on run_node_script — `script` must be a literal,
  never user input (concatenated into a path then exec'd via node).
- user-prompt-context.test.js: quiet-mode test now asserts stderr empty
  and exit 0, not just stdout (a stderr leak would still surface in
  Claude's display).
- adopt.test.js: 7 new tests — strip well-formed/orphan-BEGIN/orphan-END,
  adopt heal-on-malformed, true-noop verification (mtime check), unadopt
  heal, Windows rejection.

Tests: 76 plugin pass (was 69); 206 Rust unchanged.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sdsrss

.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "AST knowledge graph plugin for Claude Code — semantic search, call graph, HTTP tracing, impact analysis",
-    "version": "0.8.0"
+    "version": "0.8.1"
   },
   "plugins": [
     {
       "name": "code-graph-mcp",
       "source": "./claude-plugin",
       "description": "AST knowledge graph for intelligent code navigation — auto-indexes your codebase and provides semantic search, call graph traversal, HTTP route tracing, and impact analysis via MCP tools",
-      "version": "0.8.0",
+      "version": "0.8.1",
       "author": {
         "name": "sdsrs"
       },

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "code-graph-mcp"
-version = "0.8.0"
+version = "0.8.1"
 edition = "2021"
 
 [features]

Cargo.toml

@@ -4,7 +4,7 @@
   "author": {
     "name": "sdsrs"
   },
-  "version": "0.8.0",
+  "version": "0.8.1",
   "keywords": [
     "code-graph",
     "ast",

claude-plugin/.claude-plugin/plugin.json

@@ -22,7 +22,41 @@ function escapeRegex(s) {
   return s.replace(/[\\/[\]^$.*+?()|{}]/g, '\\$&');
 }
 
+// Strip our sentinel block — well-formed first, then self-heal orphan begin/end.
+// Shared by adopt (so re-adopt rewrites a stale/malformed block) and unadopt.
+function stripSentinelBlock(text) {
+  const wellFormed = new RegExp(
+    `${escapeRegex(SENTINEL_BEGIN)}[\\s\\S]*?${escapeRegex(SENTINEL_END)}\\n?`, 'g'
+  );
+  let out = text.replace(wellFormed, '');
+  // Orphan BEGIN with no matching END (truncation / partial edit).
+  // Strip from BEGIN to the next blank line or EOF — the file is shared with
+  // claude-mem-lite, so we must not eat past a blank-line boundary.
+  if (out.includes(SENTINEL_BEGIN)) {
+    out = out.replace(
+      new RegExp(`${escapeRegex(SENTINEL_BEGIN)}[\\s\\S]*?(?=\\n\\n|$)`, 'g'),
+      ''
+    );
+  }
+  // Orphan END line by itself.
+  if (out.includes(SENTINEL_END)) {
+    out = out.split('\n').filter(l => l.trim() !== SENTINEL_END).join('\n');
+  }
+  // Collapse blank-line runs introduced by stripping mid-paragraph blocks.
+  return out.replace(/\n{3,}/g, '\n\n');
+}
+
+function platformGuard() {
+  if (process.platform === 'win32') {
+    return { ok: false, reason: 'windows-not-supported' };
+  }
+  return null;
+}
+
 function adopt({ cwd, home, templatePath } = {}) {
+  const blocked = platformGuard();
+  if (blocked) return blocked;
+
   const dir = memoryDir(cwd, home);
   if (!fs.existsSync(dir)) {
     return { ok: false, reason: 'no-memory-dir', dir };
@@ -35,18 +69,25 @@ function adopt({ cwd, home, templatePath } = {}) {
   fs.copyFileSync(tpl, target);
 
   const indexPath = path.join(dir, 'MEMORY.md');
-  let index = fs.existsSync(indexPath) ? fs.readFileSync(indexPath, 'utf8') : '# Memory Index\n';
-  let indexed = false;
-  if (!index.includes(SENTINEL_BEGIN)) {
-    if (!index.endsWith('\n')) index += '\n';
-    index += `${SENTINEL_BEGIN}\n${INDEX_LINE}\n${SENTINEL_END}\n`;
-    fs.writeFileSync(indexPath, index);
-    indexed = true;
+  const index = fs.existsSync(indexPath) ? fs.readFileSync(indexPath, 'utf8') : '# Memory Index\n';
+  const desiredBlock = `${SENTINEL_BEGIN}\n${INDEX_LINE}\n${SENTINEL_END}`;
+
+  // Already-adopted-and-well-formed: skip the write entirely.
+  if (index.includes(desiredBlock)) {
+    return { ok: true, target, indexPath, indexed: false, healed: false };
   }
-  return { ok: true, target, indexPath, indexed };
+
+  const cleaned = stripSentinelBlock(index);
+  const healed = cleaned !== index;
+  const base = cleaned.endsWith('\n') ? cleaned : cleaned + '\n';
+  fs.writeFileSync(indexPath, base + desiredBlock + '\n');
+  return { ok: true, target, indexPath, indexed: true, healed };
 }
 
 function unadopt({ cwd, home } = {}) {
+  const blocked = platformGuard();
+  if (blocked) return blocked;
+
   const dir = memoryDir(cwd, home);
   const target = path.join(dir, TARGET_NAME);
   const indexPath = path.join(dir, 'MEMORY.md');
@@ -59,8 +100,7 @@ function unadopt({ cwd, home } = {}) {
   }
   if (fs.existsSync(indexPath)) {
     const before = fs.readFileSync(indexPath, 'utf8');
-    const re = new RegExp(`${escapeRegex(SENTINEL_BEGIN)}[\\s\\S]*?${escapeRegex(SENTINEL_END)}\\n?`, 'g');
-    const after = before.replace(re, '');
+    const after = stripSentinelBlock(before);
     if (after !== before) {
       fs.writeFileSync(indexPath, after);
       indexPruned = true;
@@ -70,6 +110,10 @@ function unadopt({ cwd, home } = {}) {
 }
 
 function formatResult(action, result) {
+  if (!result.ok && result.reason === 'windows-not-supported') {
+    return '[code-graph] adopt/unadopt are POSIX-only — claude-mem-lite slug ' +
+           'convention on Windows is unverified. Edit MEMORY.md manually to opt in.';
+  }
   if (action === 'adopt') {
     if (!result.ok) {
       if (result.reason === 'no-memory-dir') {
@@ -82,8 +126,9 @@ function formatResult(action, result) {
       return `[code-graph] adopt failed: ${result.reason || 'unknown'}`;
     }
     const lines = [`[code-graph] Adopted → ${result.target}`];
-    if (result.indexed) lines.push(`[code-graph] Indexed → ${result.indexPath}`);
-    else lines.push(`[code-graph] Index already contains sentinel — left as-is`);
+    if (result.healed) lines.push(`[code-graph] Healed malformed sentinel block → ${result.indexPath}`);
+    else if (result.indexed) lines.push(`[code-graph] Indexed → ${result.indexPath}`);
+    else lines.push(`[code-graph] Index already up-to-date — no write`);
     lines.push('[code-graph] Activate: set CODE_GRAPH_QUIET_HOOKS=1 in ~/.claude/settings.json env');
     return lines.join('\n');
   }
@@ -105,6 +150,6 @@ if (require.main === module) {
 }
 
 module.exports = {
-  adopt, unadopt, memoryDir, formatResult,
+  adopt, unadopt, memoryDir, formatResult, stripSentinelBlock,
   SENTINEL_BEGIN, SENTINEL_END, INDEX_LINE, TEMPLATE_PATH, TARGET_NAME,
 };

claude-plugin/scripts/adopt.js

@@ -5,7 +5,8 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const {
-  adopt, unadopt, memoryDir, SENTINEL_BEGIN, SENTINEL_END, INDEX_LINE, TEMPLATE_PATH,
+  adopt, unadopt, memoryDir, stripSentinelBlock,
+  SENTINEL_BEGIN, SENTINEL_END, INDEX_LINE, TEMPLATE_PATH,
 } = require('./adopt');
 
 function makeSandbox() {
@@ -112,3 +113,102 @@ test('template file exists and contains decision table', () => {
   assert.ok(content.includes('impact_analysis'), 'mentions impact_analysis');
   assert.ok(content.includes('CODE_GRAPH_QUIET_HOOKS'), 'mentions env gate');
 });
+
+test('stripSentinelBlock removes well-formed block', () => {
+  const before = `# Index\n${SENTINEL_BEGIN}\n${INDEX_LINE}\n${SENTINEL_END}\n- [x.md](x.md)\n`;
+  const after = stripSentinelBlock(before);
+  assert.ok(!after.includes(SENTINEL_BEGIN));
+  assert.ok(!after.includes(SENTINEL_END));
+  assert.ok(after.includes('- [x.md](x.md)'), 'preserves neighbors');
+});
+
+test('stripSentinelBlock self-heals orphan BEGIN without END', () => {
+  // Truncation / partial edit scenario
+  const before = `# Index\n- [a.md](a.md) — entry\n${SENTINEL_BEGIN}\n${INDEX_LINE}\n\n- [b.md](b.md) — survivor\n`;
+  const after = stripSentinelBlock(before);
+  assert.ok(!after.includes(SENTINEL_BEGIN), 'orphan BEGIN removed');
+  assert.ok(after.includes('survivor'), 'content past blank-line boundary preserved');
+  assert.ok(after.includes('entry'), 'content before BEGIN preserved');
+});
+
+test('stripSentinelBlock self-heals orphan END line', () => {
+  const before = `# Index\n- [a.md](a.md)\n${SENTINEL_END}\n- [b.md](b.md)\n`;
+  const after = stripSentinelBlock(before);
+  assert.ok(!after.includes(SENTINEL_END));
+  assert.ok(after.includes('- [a.md](a.md)') && after.includes('- [b.md](b.md)'));
+});
+
+test('adopt heals malformed sentinel (orphan BEGIN) on re-run', () => {
+  const sb = makeSandbox();
+  try {
+    const indexPath = path.join(sb.dir, 'MEMORY.md');
+    // Simulate truncated prior adopt — BEGIN line + stale entry, no END
+    fs.writeFileSync(
+      indexPath,
+      `# Memory Index\n- [old.md](old.md) — preserved\n${SENTINEL_BEGIN}\n- [stale](stale.md) — wrong entry\n\n- [neighbor.md](neighbor.md) — survives\n`
+    );
+    const res = adopt({ cwd: sb.cwd, home: sb.home });
+    assert.strictEqual(res.ok, true);
+    assert.strictEqual(res.healed, true, 'reports healed');
+    const final = fs.readFileSync(indexPath, 'utf8');
+    // Exactly one well-formed block now
+    const beginCount = (final.match(new RegExp(SENTINEL_BEGIN.replace(/[\\/[\]^$.*+?()|{}]/g, '\\$&'), 'g')) || []).length;
+    const endCount = (final.match(new RegExp(SENTINEL_END.replace(/[\\/[\]^$.*+?()|{}]/g, '\\$&'), 'g')) || []).length;
+    assert.strictEqual(beginCount, 1, 'one BEGIN');
+    assert.strictEqual(endCount, 1, 'one END');
+    assert.ok(final.includes('preserved'), 'preserves pre-BEGIN content');
+    assert.ok(final.includes('neighbor.md'), 'preserves post-malformed-block content');
+    assert.ok(!final.includes('stale.md'), 'old wrong entry purged');
+    assert.ok(final.includes(INDEX_LINE), 'fresh canonical line written');
+  } finally { sb.cleanup(); }
+});
+
+test('adopt is a true no-op when desired block is already present verbatim', () => {
+  const sb = makeSandbox();
+  try {
+    adopt({ cwd: sb.cwd, home: sb.home });
+    const indexPath = path.join(sb.dir, 'MEMORY.md');
+    const before = fs.readFileSync(indexPath, 'utf8');
+    const beforeMtime = fs.statSync(indexPath).mtimeMs;
+    const res2 = adopt({ cwd: sb.cwd, home: sb.home });
+    assert.strictEqual(res2.indexed, false);
+    assert.strictEqual(res2.healed, false);
+    assert.strictEqual(fs.readFileSync(indexPath, 'utf8'), before, 'file content identical');
+    // mtime may equal beforeMtime since we skipped the write
+    assert.strictEqual(fs.statSync(indexPath).mtimeMs, beforeMtime, 'no write occurred');
+  } finally { sb.cleanup(); }
+});
+
+test('unadopt heals malformed sentinel (orphan BEGIN)', () => {
+  const sb = makeSandbox();
+  try {
+    const indexPath = path.join(sb.dir, 'MEMORY.md');
+    fs.writeFileSync(
+      indexPath,
+      `# Index\n${SENTINEL_BEGIN}\n${INDEX_LINE}\n\n- [keep.md](keep.md) — survives\n`
+    );
+    const res = unadopt({ cwd: sb.cwd, home: sb.home });
+    assert.strictEqual(res.indexPruned, true);
+    const final = fs.readFileSync(indexPath, 'utf8');
+    assert.ok(!final.includes(SENTINEL_BEGIN), 'orphan BEGIN purged');
+    assert.ok(final.includes('keep.md'), 'content past blank-line preserved');
+  } finally { sb.cleanup(); }
+});
+
+test('Windows platform is rejected with clear reason', { skip: process.platform === 'win32' }, () => {
+  const orig = process.platform;
+  Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+  try {
+    const sb = makeSandbox();
+    try {
+      const adoptRes = adopt({ cwd: sb.cwd, home: sb.home });
+      assert.strictEqual(adoptRes.ok, false);
+      assert.strictEqual(adoptRes.reason, 'windows-not-supported');
+      const unadoptRes = unadopt({ cwd: sb.cwd, home: sb.home });
+      assert.strictEqual(unadoptRes.ok, false);
+      assert.strictEqual(unadoptRes.reason, 'windows-not-supported');
+    } finally { sb.cleanup(); }
+  } finally {
+    Object.defineProperty(process, 'platform', { value: orig, configurable: true });
+  }
+});

claude-plugin/scripts/adopt.test.js

@@ -465,16 +465,17 @@ test('skills: only expected skills exist', () => {
   assert.deepEqual(files, ['explore.md', 'index.md']);
 });
 
-test('CODE_GRAPH_QUIET_HOOKS=1 short-circuits before reading stdin', () => {
-  const { execFileSync } = require('node:child_process');
+test('CODE_GRAPH_QUIET_HOOKS=1 short-circuits silently on stdout, stderr, exit 0', () => {
+  const { spawnSync } = require('node:child_process');
   const script = path.join(__dirname, 'user-prompt-context.js');
-  const out = execFileSync(process.execPath, [script], {
+  const proc = spawnSync(process.execPath, [script], {
     input: JSON.stringify({ message: 'impact analysis for fn_that_would_trigger_search' }),
     env: { ...process.env, CODE_GRAPH_QUIET_HOOKS: '1' },
     encoding: 'utf8',
-    stdio: ['pipe', 'pipe', 'pipe'],
     timeout: 2000,
   });
-  // Quiet mode must produce no stdout — no [code-graph:*] prefix, nothing.
-  assert.equal(out, '');
+  // Quiet mode must be fully silent — any stderr leaks into Claude's display.
+  assert.equal(proc.stdout, '', 'stdout must be empty');
+  assert.equal(proc.stderr, '', 'stderr must be empty');
+  assert.equal(proc.status, 0, 'must exit 0');
 });

claude-plugin/scripts/user-prompt-context.test.js

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph-darwin-arm64",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "code-graph-mcp binary for macOS ARM64",
   "license": "MIT",
   "repository": {

npm/darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph-darwin-x64",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "code-graph-mcp binary for macOS x64",
   "license": "MIT",
   "repository": {

npm/darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdsrs/code-graph-linux-arm64",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "code-graph-mcp binary for Linux ARM64",
   "license": "MIT",
   "repository": {