kirograph 0.27.2 → 0.28.1

package/dist/mcp/tools.js

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,76 +15,17 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var tools_exports = {};
 __export(tools_exports, {
   KIROGRAPH_TOOL_NAMES: () => import_tool_names.KIROGRAPH_TOOL_NAMES,
   LIVE_SEARCH_TOOL_DEFINITION: () => LIVE_SEARCH_TOOL_DEFINITION,
-  ToolHandler: () => ToolHandler,
+  ToolHandler: () => import_handler.ToolHandler,
   tools: () => tools
 });
 module.exports = __toCommonJS(tools_exports);
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var crypto = __toESM(require("crypto"));
-var import_child_process = require("child_process");
-var import__ = __toESM(require("../index"));
-var import_errors = require("../errors");
-var import_compression = require("../compression/index");
-var import_tracker = require("../compression/tracker");
 var import_tool_names = require("./tool-names");
-const MAX_OUTPUT = 15e3;
-function truncate(s) {
-  return s.length > MAX_OUTPUT ? s.slice(0, MAX_OUTPUT) + "\n\u2026[truncated]" : s;
-}
-function estimateFileTokens(projectRoot, filePaths) {
-  let total = 0;
-  for (const fp of filePaths) {
-    try {
-      const fullPath = path.isAbsolute(fp) ? fp : path.join(projectRoot, fp);
-      const stat = fs.statSync(fullPath);
-      total += Math.round(stat.size / 4);
-    } catch {
-    }
-  }
-  return total;
-}
-function clampLimit(value, defaultValue) {
-  const n = typeof value === "number" ? value : defaultValue;
-  return Math.max(1, Math.min(100, Math.round(n)));
-}
-function mapKind(kind) {
-  if (kind === "type_alias") return "type";
-  return kind;
-}
-function writeSessionMarker(projectRoot) {
-  try {
-    const hash = crypto.createHash("sha256").update(projectRoot).digest("hex").slice(0, 16);
-    fs.writeFileSync(`/tmp/kirograph-consulted-${hash}`, String(Date.now()));
-  } catch {
-  }
-}
-function formatAge(timestamp) {
-  const diff = Date.now() - timestamp;
-  const minutes = Math.floor(diff / 6e4);
-  if (minutes < 60) return `${minutes}m ago`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24) return `${hours}h ago`;
-  const days = Math.floor(hours / 24);
-  if (days < 7) return `${days}d ago`;
-  const weeks = Math.floor(days / 7);
-  if (weeks < 5) return `${weeks}w ago`;
-  const months = Math.floor(days / 30);
-  return `${months}mo ago`;
-}
+var import_handler = require("./handler");
 const tools = [
   {
     name: "kirograph_search",
@@ -95,6 +34,12 @@ const tools = [
       type: "object",
       properties: {
         query: { type: "string", description: 'Symbol name or partial name (e.g., "auth", "signIn", "UserService")' },
+        mode: {
+          type: "string",
+          description: 'Search mode: "name" (default, FTS prefix match) or "similar" (fuzzy substring match, broader results)',
+          enum: ["name", "similar"],
+          default: "name"
+        },
         kind: {
           type: "string",
           description: "Filter by node kind",
@@ -171,7 +116,8 @@ const tools = [
     inputSchema: {
       type: "object",
       properties: {
-        symbol: { type: "string", description: "Symbol name to look up" },
+        symbol: { type: "string", description: "Symbol name or fully-qualified name to look up" },
+        qualified: { type: "boolean", description: "When true, treat symbol as a fully-qualified name (exact match, bypasses FTS \u2014 use when you have the exact qualifiedName from a previous result)", default: false },
         includeCode: { type: "boolean", description: "Include full source code. Deprecated \u2014 prefer detail.", default: false },
         detail: {
           type: "string",
@@ -295,6 +241,19 @@ const tools = [
       required: ["package"]
     }
   },
+  {
+    name: "kirograph_manifest",
+    description: "Workspace manifest summary: list all packages across ecosystems with versions, external dep counts, and license. Pass package= to drill into one package. Pass ecosystem= to filter (npm, cargo, go, python, maven, gradle, csproj). Pass showDrift=true to surface packages that appear in multiple manifest files with differing versions.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        package: { type: "string", description: "Package name or path for a focused view (partial match accepted)" },
+        ecosystem: { type: "string", description: 'Filter by ecosystem / language (e.g. "npm", "cargo", "go", "python")' },
+        showDrift: { type: "boolean", description: "Highlight packages declared in multiple manifests with different versions (default: false)", default: false },
+        projectPath: { type: "string" }
+      }
+    }
+  },
   {
     name: "kirograph_hotspots",
     description: "Find the most-connected symbols in the codebase by total edge degree (incoming + outgoing). Useful for identifying load-bearing code, core abstractions, or blast-radius hot zones.",
@@ -367,6 +326,179 @@ const tools = [
       required: ["symbol"]
     }
   },
+  {
+    name: "kirograph_module_api",
+    description: "List all exported symbols in a file or directory \u2014 the public API surface.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: 'File path (e.g. "src/auth/service.ts") or directory prefix (e.g. "src/auth/"). Omit for the whole project.' },
+        limit: { type: "number", description: "Max results (default: 100)", default: 100 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_rename_preview",
+    description: "Show every reference site for a symbol \u2014 blast-radius preview before a rename.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        symbol: { type: "string", description: "Symbol name to find all references for" },
+        projectPath: { type: "string" }
+      },
+      required: ["symbol"]
+    }
+  },
+  {
+    name: "kirograph_doc_coverage",
+    description: "Find exported symbols that are missing docstrings.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "number", description: "Max results (default: 50)", default: 50 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_god_class",
+    description: "List classes ranked by member count to identify god classes.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        threshold: { type: "number", description: "Member count threshold for flagging (default: 10)", default: 10 },
+        limit: { type: "number", description: "Max results (default: 20)", default: 20 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_inheritance_depth",
+    description: "Show the deepest inheritance chains (BFS on extends/implements edges).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "number", description: "Max results (default: 20)", default: 20 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_recursion",
+    description: "Find recursive and mutually-recursive functions (SCC on call edges).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "number", description: "Max results (default: 30)", default: 30 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_largest",
+    description: "List symbols ranked by lines of code (end_line \u2212 start_line).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "number", description: "Max results (default: 30)", default: 30 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_rank",
+    description: "Rank symbols by fan-in (callers) or fan-out (callees) edge count.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        by: { type: "string", description: 'Ranking dimension: "fan-in" (default) or "fan-out"', enum: ["fan-in", "fan-out"], default: "fan-in" },
+        limit: { type: "number", description: "Max results (default: 30)", default: 30 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_distribution",
+    description: "Symbol-kind breakdown (function, class, method\u2026) for a file, directory, or the whole project.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "Directory or file path prefix to scope. Omit for whole project." },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_annotations",
+    description: "Decorator/annotation histogram for the whole project, or list of symbols using a specific decorator.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        decorator: { type: "string", description: 'Decorator name to filter (e.g. "Injectable"). Omit for full histogram.' },
+        limit: { type: "number", description: "Max results (default: 50)", default: 50 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_session_start",
+    description: "Save the current graph metrics as a session baseline.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_session_end",
+    description: "Diff current graph metrics against the session baseline and report per-dimension deltas.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_unused_imports",
+    description: "Find import nodes with zero resolved downstream edges (i.e. nothing in the codebase references the imported symbol).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "number", description: "Max results (default: 50)" },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_gini",
+    description: "Compute the Gini inequality coefficient for a size metric (loc, fan-in, or fan-out) across all function/method nodes. Returns the coefficient plus top/bottom 5.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        metric: {
+          type: "string",
+          description: 'Metric to measure: "loc" (lines of code), "fan-in" (incoming calls), "fan-out" (outgoing calls)',
+          enum: ["loc", "fan-in", "fan-out"],
+          default: "loc"
+        },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_dependency_depth",
+    description: "Run a Kahn topological sort on the file import graph and report each file's longest path from a root (depth). Useful for spotting deeply layered dependency chains.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: { type: "number", description: "Max files to show sorted by depth DESC (default: 20)" },
+        projectPath: { type: "string" }
+      }
+    }
+  },
   {
     name: "kirograph_exec",
     description: "Run a shell command with token-optimized, noise-filtered output.",
@@ -490,6 +622,93 @@ const tools = [
       }
     }
   },
+  // ── Complexity tools (require enableComplexity=true) ──────────────────────────
+  {
+    name: "kirograph_complexity",
+    description: "Rank symbols by cyclomatic complexity, cognitive complexity, or maintainability index. Requires enableComplexity: true and a re-index.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        metric: { type: "string", description: 'Ranking metric: "cyclomatic" (default), "cognitive", or "maintainability"', enum: ["cyclomatic", "cognitive", "maintainability"], default: "cyclomatic" },
+        threshold: { type: "number", description: "Flag symbols above (CC/cog) or below (MI) this threshold" },
+        limit: { type: "number", description: "Max results (default: 30)", default: 30 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_simplify_scan",
+    description: "Find functions/methods that exceed complexity, size, or maintainability thresholds \u2014 simplification candidates.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        thresholdCC: { type: "number", description: "Cyclomatic complexity threshold (default: 10)", default: 10 },
+        thresholdMI: { type: "number", description: "Maintainability index lower bound \u2014 flag below this (default: 50)", default: 50 },
+        thresholdLOC: { type: "number", description: "Lines of code threshold (default: 50)", default: 50 },
+        limit: { type: "number", description: "Max results (default: 30)", default: 30 },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  // ── Git context tools (require enableGitContext=true) ─────────────────────────
+  {
+    name: "kirograph_diff_context",
+    description: "Identify symbols changed in the working tree (or staged), with their callers and callees for immediate blast-radius context.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        staged: { type: "boolean", description: "If true, show staged changes (git diff --cached) instead of unstaged", default: false },
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_commit_context",
+    description: "Structured summary of staged changes \u2014 affected symbols, diff stat, staged files. Use to craft precise commit messages.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        projectPath: { type: "string" }
+      }
+    }
+  },
+  {
+    name: "kirograph_pr_context",
+    description: "Semantic diff between two git refs \u2014 changed symbols with callers/callees. Use to write PR descriptions.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        base: { type: "string", description: "Base ref (branch name, tag, or commit hash)" },
+        head: { type: "string", description: "Head ref (default: HEAD)", default: "HEAD" },
+        projectPath: { type: "string" }
+      },
+      required: ["base"]
+    }
+  },
+  {
+    name: "kirograph_changelog",
+    description: "Human-readable semantic changelog between two git refs: commit log + affected symbols.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        ref1: { type: "string", description: "Start ref (older)" },
+        ref2: { type: "string", description: "End ref (default: HEAD)", default: "HEAD" },
+        projectPath: { type: "string" }
+      },
+      required: ["ref1"]
+    }
+  },
+  {
+    name: "kirograph_test_map",
+    description: "Find test files covering a symbol, or list exported symbols with no test coverage.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        symbol: { type: "string", description: "Symbol name to find tests for. Omit to list all uncovered exported symbols." },
+        projectPath: { type: "string" }
+      }
+    }
+  },
   {
     name: "kirograph_refactor",
     description: "Rename preview (all references) or function summarization.",
@@ -504,6 +723,74 @@ const tools = [
       required: ["mode"]
     }
   },
+  // ── Edit primitives (require enableEditPrimitives=true) ───────────────────────
+  {
+    name: "kirograph_str_replace",
+    description: "Replace a unique string anchor in a file; fails if the anchor appears 0 or >1 times.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        file: { type: "string", description: "File path relative to project root" },
+        old_str: { type: "string", description: "Exact string to find (must be unique in the file)" },
+        new_str: { type: "string", description: "Replacement string" },
+        projectPath: { type: "string" }
+      },
+      required: ["file", "old_str", "new_str"]
+    }
+  },
+  {
+    name: "kirograph_multi_str_replace",
+    description: "Apply N replacements as an all-or-nothing transaction; aborts if any anchor is ambiguous or missing.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        file: { type: "string", description: "File path relative to project root" },
+        pairs: {
+          type: "array",
+          description: "Array of {old_str, new_str} replacement pairs applied in order",
+          items: {
+            type: "object",
+            properties: {
+              old_str: { type: "string", description: "Exact string to find (must be unique)" },
+              new_str: { type: "string", description: "Replacement string" }
+            }
+          }
+        },
+        projectPath: { type: "string" }
+      },
+      required: ["file", "pairs"]
+    }
+  },
+  {
+    name: "kirograph_insert_at",
+    description: "Insert content before or after a unique anchor string or line number.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        file: { type: "string", description: "File path relative to project root" },
+        anchor: { type: "string", description: "Unique string anchor to insert relative to (mutually exclusive with line)" },
+        line: { type: "number", description: "1-based line number to insert relative to (mutually exclusive with anchor)" },
+        content: { type: "string", description: "Content to insert (include newline if needed)" },
+        position: { type: "string", description: '"before" or "after" the anchor/line (default: "after")', enum: ["before", "after"], default: "after" },
+        projectPath: { type: "string" }
+      },
+      required: ["file", "content"]
+    }
+  },
+  {
+    name: "kirograph_ast_grep_rewrite",
+    description: "Structural AST rewrite via ast-grep. Skipped if ast-grep is not installed.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        file: { type: "string", description: "File path relative to project root" },
+        pattern: { type: "string", description: "ast-grep pattern to match" },
+        rewrite: { type: "string", description: "ast-grep rewrite template" },
+        projectPath: { type: "string" }
+      },
+      required: ["file", "pattern", "rewrite"]
+    }
+  },
   // ── Memory tools (require enableMemory=true) ────────────────────────────────
   {
     name: "kirograph_mem_search",
@@ -1252,10 +1539,10 @@ const tools = [
       }
     }
   },
-  // ── Pattern tools (require enablePatterns=true) ─────────────────────────────
+  // ── Phase 3 complexity tools ──────────────────────────────────────────────────
   {
-    name: "kirograph_pattern_coverage",
-    description: "OWASP Top 10 coverage report: categories covered and match counts.",
+    name: "kirograph_health",
+    description: "Composite graph health score (0\u201310000) across complexity, dead code, coupling, and circular dependencies. Higher is better.",
     inputSchema: {
       type: "object",
       properties: {
@@ -1264,3179 +1551,127 @@ const tools = [
     }
   },
   {
-    name: "kirograph_pattern_save_baseline",
-    description: "Save current pattern match counts as a baseline.",
+    name: "kirograph_dsm",
+    description: "Design Structure Matrix \u2014 dependency counts between top-level modules. Reveals architectural coupling and layering violations.",
     inputSchema: {
       type: "object",
       properties: {
-        label: { type: "string", description: 'Baseline label (default: "default")', default: "default" },
+        limit: { type: "number", description: "Max module groups to include (default 15)", default: 15 },
         projectPath: { type: "string" }
       }
     }
   },
   {
-    name: "kirograph_pattern_diff",
-    description: "Diff pattern matches against a saved baseline.",
+    name: "kirograph_test_risk",
+    description: "Risk-ranked list of functions: complexity \xD7 fan-in. Highest-risk functions are most likely to break when changed.",
     inputSchema: {
       type: "object",
       properties: {
-        label: { type: "string", description: 'Baseline label (default: "default")', default: "default" },
+        limit: { type: "number", description: "Max results (default 20)", default: 20 },
+        threshold: { type: "number", description: "Min risk score to include (default 0)", default: 0 },
         projectPath: { type: "string" }
       }
     }
-  }
-];
-const LIVE_SEARCH_TOOL_DEFINITION = {
-  name: "kirograph_live_search",
-  description: "Run a live AST pattern search against the indexed file list using @ast-grep/napi. Finds structural code patterns (SQL injection, eval, path traversal, etc.) without needing the codebase to be re-indexed. Only available when enablePatterns: true.",
-  inputSchema: {
-    type: "object",
-    required: ["pattern", "language"],
-    properties: {
-      pattern: { type: "string", description: 'ast-grep inline pattern (e.g. "eval($X)")' },
-      language: { type: "string", description: "Language to search: javascript, typescript, python, go, rust, java, etc." },
-      limit: { type: "number", description: "Max results (default 20, max 100)", default: 20 },
-      projectPath: { type: "string" }
-    }
-  }
-};
-class ToolHandler {
-  constructor(cg) {
-    this.connections = /* @__PURE__ */ new Map();
-    /** Anti-loop: track recent data_query calls per dataset for pagination detection. */
-    this.queryTracker = /* @__PURE__ */ new Map();
-    this.defaultCg = cg;
-  }
-  setDefaultKiroGraph(cg) {
-    this.defaultCg = cg;
-  }
-  /** Close all cached cross-project connections. */
-  closeAll() {
-    for (const cg of this.connections.values()) {
-      try {
-        cg.close();
-      } catch {
-      }
-    }
-    this.connections.clear();
-  }
-  /** Anti-loop: detect pagination patterns and warn the agent. */
-  checkPaginationLoop(dataset, offset, response) {
-    const now = Date.now();
-    const key = dataset;
-    const currentOffset = offset ?? 0;
-    for (const [k, v] of this.queryTracker) {
-      if (now - v.lastCall > 6e4) this.queryTracker.delete(k);
-    }
-    const entry = this.queryTracker.get(key) ?? { offsets: [], lastCall: 0 };
-    entry.offsets.push(currentOffset);
-    entry.lastCall = now;
-    if (entry.offsets.length > 10) entry.offsets = entry.offsets.slice(-10);
-    this.queryTracker.set(key, entry);
-    if (entry.offsets.length > 5) {
-      const recent = entry.offsets.slice(-6);
-      let isIncrementing = true;
-      for (let i = 1; i < recent.length; i++) {
-        if (recent[i] <= recent[i - 1]) {
-          isIncrementing = false;
-          break;
-        }
-      }
-      if (isIncrementing) {
-        return response + "\n\n\u26A0 Pagination detected. Consider using kirograph_data_aggregate for summary statistics instead of paginating through all rows.";
-      }
-    }
-    return response;
-  }
-  async getConnection(projectPath) {
-    if (!projectPath) return this.defaultCg;
-    const resolved = path.resolve(projectPath);
-    if (!path.isAbsolute(resolved)) return null;
-    if (this.connections.has(resolved)) return this.connections.get(resolved);
-    try {
-      const cg = await import__.default.open(resolved);
-      this.connections.set(resolved, cg);
-      return cg;
-    } catch {
-      return null;
-    }
-  }
-  async handle(toolName, args) {
-    try {
-      const text = await this.dispatch(toolName, args);
-      const truncated = truncate(text);
-      if (toolName !== "kirograph_exec" && toolName !== "kirograph_gain") {
-        try {
-          const projectRoot = args.projectPath || this.defaultCg?.getProjectRoot() || process.cwd();
-          const { estimateNaiveCost } = await Promise.resolve().then(() => require("../compression/naive-cost.js"));
-          const { estimateTokens: estimateTokens2 } = await Promise.resolve().then(() => require("../compression/index.js"));
-          const outputTokens = estimateTokens2(truncated);
-          const naiveCost = estimateNaiveCost(toolName, outputTokens, args);
-          if (naiveCost !== null && naiveCost > outputTokens) {
-            const tracker = new import_tracker.TokenTracker(projectRoot);
-            if (toolName.startsWith("kirograph_mem_")) {
-              tracker.recordMemorySaving(toolName, outputTokens, naiveCost);
-            } else if (toolName.startsWith("kirograph_docs_")) {
-              tracker.recordDocsSaving(toolName, outputTokens, naiveCost);
-            } else if (toolName.startsWith("kirograph_data_")) {
-              tracker.recordDataSaving(toolName, outputTokens, naiveCost);
-            } else {
-              tracker.recordGraphSaving(toolName, outputTokens, naiveCost);
-            }
-          }
-        } catch {
-        }
+  },
+  // ── Phase 3 git context tools ─────────────────────────────────────────────────
+  {
+    name: "kirograph_test_coverage",
+    description: "Parse lcov/Istanbul/Cobertura coverage files and show per-file coverage percentage. Sorted worst-first by default.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        sortBy: { type: "string", description: "Sort order: asc (worst first) or desc (best first)", enum: ["asc", "desc"], default: "asc" },
+        limit: { type: "number", description: "Max results (default 30)", default: 30 },
+        projectPath: { type: "string" }
       }
-      return { content: [{ type: "text", text: truncated }] };
-    } catch (err) {
-      (0, import_errors.logError)("MCP tool error", { tool: toolName, error: err });
-      const message = err instanceof Error ? err.message : String(err);
-      return { content: [{ type: "text", text: `Error: ${message}` }], isError: true };
     }
-  }
-  async dispatch(toolName, args) {
-    if (toolName === "kirograph_exec") {
-      const cmd = args.command;
-      if (!cmd) return "Error: command is required.";
-      const projectRoot = args.projectPath || args.cwd || process.cwd();
-      const execCwd = args.cwd || projectRoot;
-      let defaultLevel = "normal";
-      try {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const config = await loadConfig(projectRoot);
-        if (config.shellCompressionLevel && config.shellCompressionLevel !== "off") {
-          defaultLevel = config.shellCompressionLevel;
-        }
-      } catch {
-      }
-      const level = args.level ?? defaultLevel;
-      const timeout = (args.timeout ?? 60) * 1e3;
-      let rawOutput;
-      let exitCode = 0;
-      try {
-        rawOutput = (0, import_child_process.execSync)(cmd, {
-          cwd: execCwd,
-          timeout,
-          encoding: "utf8",
-          stdio: ["pipe", "pipe", "pipe"],
-          maxBuffer: 10 * 1024 * 1024
-        });
-      } catch (err) {
-        rawOutput = (err.stdout || "") + (err.stderr || "");
-        exitCode = err.status ?? 1;
+  },
+  // ── Phase 4 branch tools ──────────────────────────────────────────────────────
+  {
+    name: "kirograph_branch_list",
+    description: "List tracked branches with their DB sizes and last sync times.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        projectPath: { type: "string" }
       }
-      const result = (0, import_compression.compress)(cmd, rawOutput, { level, preserveErrors: exitCode !== 0 });
-      const tracker = new import_tracker.TokenTracker(projectRoot);
-      tracker.record(cmd, result.originalTokens, result.compressedTokens, result.strategy);
-      const header = exitCode !== 0 ? `[exit ${exitCode}] ` : "";
-      const footer = result.savings > 5 ? `
-
-[${result.savings}% tokens saved | ${result.originalTokens}\u2192${result.compressedTokens} | ${result.strategy}]` : "";
-      return `${header}${result.output}${footer}`;
     }
-    if (toolName === "kirograph_gain") {
-      const projectRoot = args.projectPath || process.cwd();
-      const period = args.period ?? "session";
-      const tracker = new import_tracker.TokenTracker(projectRoot);
-      const stats = tracker.getStats(period);
-      if (stats.totalCommands === 0) {
-        return "No savings recorded yet. Use kirograph tools and kirograph_exec \u2014 savings are tracked automatically.";
-      }
-      const lines = [
-        `Token Savings (${period}):`,
-        `  Total calls: ${stats.totalCommands}`,
-        `  Tokens without KiroGraph: ~${stats.totalOriginal.toLocaleString()}`,
-        `  Tokens with KiroGraph:    ~${stats.totalCompressed.toLocaleString()}`,
-        `  Saved: ${stats.totalSaved.toLocaleString()} tokens (${stats.savingsPercent}%)`
-      ];
-      if (stats.bySource.exec.count > 0 || stats.bySource.graph.count > 0 || stats.bySource.memory.count > 0 || stats.bySource.docs.count > 0) {
-        lines.push("", "By source:");
-        if (stats.bySource.graph.count > 0) {
-          lines.push(`  Graph tools: ${stats.bySource.graph.count} calls, ~${stats.bySource.graph.saved.toLocaleString()} tokens saved (vs file reads/grep)`);
-        }
-        if (stats.bySource.docs.count > 0) {
-          lines.push(`  Docs tools: ${stats.bySource.docs.count} calls, ~${stats.bySource.docs.saved.toLocaleString()} tokens saved (vs reading full doc files)`);
-        }
-        if (stats.bySource.data.count > 0) {
-          lines.push(`  Data tools: ${stats.bySource.data.count} calls, ~${stats.bySource.data.saved.toLocaleString()} tokens saved (vs loading raw data files)`);
-        }
-        if (stats.bySource.exec.count > 0) {
-          lines.push(`  Compression: ${stats.bySource.exec.count} calls, ~${stats.bySource.exec.saved.toLocaleString()} tokens saved (vs raw output)`);
-        }
-        if (stats.bySource.memory.count > 0) {
-          lines.push(`  Memory: ${stats.bySource.memory.count} calls, ~${stats.bySource.memory.saved.toLocaleString()} tokens saved (vs re-discovering context)`);
-        }
-      }
-      if (Object.keys(stats.byFamily).length > 0) {
-        lines.push("", "Top families:");
-        for (const [family, data] of Object.entries(stats.byFamily).slice(0, 7)) {
-          lines.push(`  ${family}: ${data.count} calls, ${data.savings}% avg savings`);
-        }
-      }
-      if (stats.recentCommands.length > 0) {
-        lines.push("", "Recent:");
-        for (const cmd of stats.recentCommands.slice(0, 5)) {
-          const tag = cmd.source === "graph" ? "\u{1F4CA}" : "\u26A1";
-          lines.push(`  ${tag} ${cmd.command.slice(0, 40)} \u2192 ${cmd.savings}% saved`);
-        }
+  },
+  {
+    name: "kirograph_branch_diff",
+    description: "Symbols added, removed, or changed between two tracked branches.",
+    inputSchema: {
+      type: "object",
+      required: ["branchA"],
+      properties: {
+        branchA: { type: "string", description: "First branch name (required)" },
+        branchB: { type: "string", description: "Second branch name (default: main)", default: "main" },
+        projectPath: { type: "string" }
       }
-      return lines.join("\n");
     }
-    if (toolName === "kirograph_read") {
-      const filePath = args.path;
-      if (!filePath) return "Error: path is required.";
-      const projectRoot = args.projectPath || process.cwd();
-      const resolvedPath = path.isAbsolute(filePath) ? filePath : path.join(projectRoot, filePath);
-      const mode = args.mode ?? "full";
-      const noCache = args.noCache ?? false;
-      if (!fs.existsSync(resolvedPath)) {
-        return `Error: File not found: ${resolvedPath}`;
-      }
-      const { getFileReadCache } = await Promise.resolve().then(() => require("./cache.js"));
-      const { executeReadMode } = await Promise.resolve().then(() => require("./read-modes.js"));
-      const cache = getFileReadCache();
-      if (mode !== "full") {
-        let cg2 = null;
-        try {
-          cg2 = await this.getConnection(args.projectPath);
-        } catch {
-        }
-        const result2 = executeReadMode({
-          mode,
-          filePath: resolvedPath,
-          start: args.start,
-          end: args.end,
-          cg: cg2
-        });
-        cache.read(resolvedPath, true);
-        return result2.content;
-      }
-      const result = cache.read(resolvedPath, noCache);
-      if (result.cached) {
-        return result.content;
-      }
-      if (result.changed) {
-        return `[file changed since last read]
-
-${result.content}`;
+  },
+  {
+    name: "kirograph_branch_search",
+    description: "Search for symbols in a specific tracked branch graph.",
+    inputSchema: {
+      type: "object",
+      required: ["query", "branch"],
+      properties: {
+        query: { type: "string", description: "Search query (symbol name, partial match)" },
+        branch: { type: "string", description: "Branch name to search in" },
+        limit: { type: "number", description: "Max results (default 20)", default: 20 },
+        projectPath: { type: "string" }
       }
-      return result.content;
     }
-    if (toolName === "kirograph_retrieve") {
-      const filePath = args.path;
-      if (!filePath) return "Error: path is required.";
-      const projectRoot = args.projectPath || process.cwd();
-      const resolvedPath = path.isAbsolute(filePath) ? filePath : path.join(projectRoot, filePath);
-      const { getFileReadCache } = await Promise.resolve().then(() => require("./cache.js"));
-      const cache = getFileReadCache();
-      const cached = cache.getPreviousContent(resolvedPath);
-      if (cached !== void 0) {
-        return cached;
-      }
-      if (!fs.existsSync(resolvedPath)) {
-        return `Error: File not found: ${resolvedPath}`;
+  },
+  // ── Pattern tools (require enablePatterns=true) ─────────────────────────────
+  {
+    name: "kirograph_pattern_coverage",
+    description: "OWASP Top 10 coverage report: categories covered and match counts.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        projectPath: { type: "string" }
       }
-      const result = cache.read(resolvedPath, true);
-      return result.content;
     }
-    if (toolName === "kirograph_compress") {
-      const text = args.text;
-      if (!text) return "Error: text is required.";
-      const rawLevel = args.level ?? "full";
-      const command = args.command;
-      const { estimateTokens: est } = await Promise.resolve().then(() => require("../compression/index.js"));
-      const originalTokens = est(text);
-      let compressed;
-      let strategy;
-      if (command) {
-        const shellLevel = rawLevel === "ultra" ? "ultra" : rawLevel === "lite" || rawLevel === "normal" ? "normal" : "aggressive";
-        const { compress: compress2 } = await Promise.resolve().then(() => require("../compression/index.js"));
-        const result = compress2(command, text, { level: shellLevel });
-        compressed = result.output;
-        strategy = `rtk:${result.commandFamily}:${shellLevel}`;
-      } else {
-        const cavemanLevel = rawLevel === "normal" || rawLevel === "lite" ? "lite" : rawLevel === "aggressive" ? "full" : rawLevel;
-        const { compressObservation } = await Promise.resolve().then(() => require("../memory/compress.js"));
-        const result = compressObservation(text, cavemanLevel);
-        compressed = result.compressed;
-        strategy = `caveman:${cavemanLevel}`;
+  },
+  {
+    name: "kirograph_pattern_save_baseline",
+    description: "Save current pattern match counts as a baseline.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        label: { type: "string", description: 'Baseline label (default: "default")', default: "default" },
+        projectPath: { type: "string" }
       }
-      const compressedTokens = est(compressed);
-      const savings = originalTokens > 0 ? Math.round((originalTokens - compressedTokens) / originalTokens * 100) : 0;
-      const footer = savings > 5 ? `
-
-[${savings}% tokens saved | ${originalTokens}\u2192${compressedTokens} | ${strategy}]` : "";
-      return compressed + footer;
     }
-    if (toolName === "kirograph_budget") {
-      const projectRoot = args.projectPath || process.cwd();
-      const reset = args.reset ?? false;
-      const { BudgetTracker } = await Promise.resolve().then(() => require("../compression/tracker.js"));
-      const budget = BudgetTracker.getInstance(projectRoot);
-      if (reset) {
-        budget.reset();
-        return "Context budget counters reset.";
-      }
-      const status = budget.getStatus();
-      const lines = [
-        "Context Budget:",
-        `  Tokens consumed: ${status.consumed.toLocaleString()}`,
-        `  Budget limit:    ${status.limit > 0 ? status.limit.toLocaleString() : "unlimited"}`,
-        `  Remaining:       ${status.limit > 0 ? status.remaining.toLocaleString() : "\u221E"}`,
-        `  Utilization:     ${status.utilization}%`
-      ];
-      if (status.warning) {
-        lines.push(`
-  \u26A0 ${status.warning}`);
+  },
+  {
+    name: "kirograph_pattern_diff",
+    description: "Diff pattern matches against a saved baseline.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        label: { type: "string", description: 'Baseline label (default: "default")', default: "default" },
+        projectPath: { type: "string" }
       }
-      return lines.join("\n");
     }
-    const cg = await this.getConnection(args.projectPath);
-    if (!cg) return "KiroGraph not initialized. Run `kirograph init` in your project first.";
-    writeSessionMarker(cg.getProjectRoot());
-    switch (toolName) {
-      case "kirograph_search": {
-        const limit = clampLimit(args.limit, 10);
-        const results = cg.searchNodes(
-          args.query,
-          args.kind,
-          limit
-        );
-        if (results.length === 0) return `No symbols found matching "${args.query}".`;
-        return results.map(
-          (r) => `${mapKind(r.node.kind)} ${r.node.name}
-  File: ${r.node.filePath}:${r.node.startLine}
-  Qualified: ${r.node.qualifiedName}`
-        ).join("\n\n");
-      }
-      case "kirograph_context": {
-        const detail = args.detail ?? (args.includeCode === false ? "summary" : "full");
-        const ctx = await cg.buildContext(args.task, {
-          maxNodes: args.maxNodes ?? 20,
-          includeCode: detail === "full"
-        });
-        const lines = [ctx.summary, ""];
-        if (ctx.entryPoints.length === 0) {
-          lines.push("No matching symbols found. If this is a new feature, consider using kirograph_files to explore the codebase structure.");
-        } else {
-          lines.push("## Entry Points");
-          for (const n of ctx.entryPoints) {
-            lines.push(`- ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}:${n.startLine}`);
-            if (detail === "full" && ctx.codeSnippets.has(n.id)) {
-              lines.push("```", ctx.codeSnippets.get(n.id), "```");
-            } else if (detail === "signatures") {
-              if (n.signature) lines.push(`  Signature: ${n.signature}`);
-              if (n.docstring) lines.push(`  Docs: ${n.docstring}`);
-            }
-          }
-          if (ctx.relatedNodes.length > 0) {
-            lines.push("", "## Related Symbols");
-            for (const n of ctx.relatedNodes.slice(0, 10)) {
-              lines.push(`- ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}:${n.startLine}`);
-            }
-          }
-        }
-        try {
-          const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-          const projectRoot = cg.getProjectRoot();
-          const config = await loadConfig(projectRoot);
-          if (config.enableMemory) {
-            const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-            const db = cg.getDatabase();
-            db.applyMemorySchema();
-            const mem = new MemoryManager(config, db.getRawDb());
-            mem.initialize();
-            const qualifiedNames = [
-              ...ctx.entryPoints.map((n) => n.qualifiedName),
-              ...ctx.relatedNodes.slice(0, 5).map((n) => n.qualifiedName)
-            ].filter(Boolean);
-            const contextLimit = config.memoryContextLimit ?? 3;
-            const contextThreshold = config.memoryContextThreshold ?? 0.3;
-            let memResults = mem.getLinkedObservations(qualifiedNames, contextLimit, contextThreshold);
-            if (memResults.length === 0) {
-              memResults = (await mem.search(args.task, { limit: contextLimit })).filter((r) => r.score >= contextThreshold);
-            }
-            if (memResults.length > 0) {
-              lines.push("", "## Related Memory");
-              for (const r of memResults.slice(0, contextLimit)) {
-                lines.push(`- [${r.observation.kind}] ${r.observation.content}`);
-              }
-            }
-          }
-        } catch {
-        }
-        try {
-          const projectRoot2 = cg.getProjectRoot();
-          const config2 = await (await Promise.resolve().then(() => require("../config.js"))).loadConfig(projectRoot2);
-          if (config2.enableDocs && config2.docsContextLimit > 0) {
-            const db2 = cg.getDatabase();
-            db2.applyDocsSchema();
-            const { DocsQueries } = await Promise.resolve().then(() => require("../docs/queries.js"));
-            const docsQueries = new DocsQueries(db2.getRawDb(), projectRoot2);
-            const qNames = ctx.entryPoints.map((n) => n.qualifiedName).filter(Boolean);
-            if (qNames.length > 0) {
-              const docRefs = docsQueries.getRefs({ qualifiedName: qNames[0] });
-              const additionalRefs = qNames.slice(1, 5).flatMap((qn) => docsQueries.getRefs({ qualifiedName: qn }));
-              const allDocRefs = [...docRefs, ...additionalRefs];
-              const seenSections = /* @__PURE__ */ new Set();
-              const uniqueRefs = allDocRefs.filter((r) => {
-                if (seenSections.has(r.sectionId)) return false;
-                seenSections.add(r.sectionId);
-                return r.confidence >= config2.docsContextThreshold;
-              }).slice(0, config2.docsContextLimit);
-              if (uniqueRefs.length > 0) {
-                lines.push("", "## Related Documentation");
-                for (const ref of uniqueRefs) {
-                  const section = docsQueries.getSection(ref.sectionId);
-                  if (section) {
-                    const summary = section.section.summary ?? section.section.title;
-                    lines.push(`- [${ref.refType}] ${summary} \u2014 ${section.section.filePath} (ID: ${ref.sectionId})`);
-                  }
-                }
-              }
-            }
-          }
-        } catch {
-        }
-        try {
-          const projectRoot3 = cg.getProjectRoot();
-          const config3 = await (await Promise.resolve().then(() => require("../config.js"))).loadConfig(projectRoot3);
-          if (config3.enableData && config3.dataContextLimit > 0) {
-            const db3 = cg.getDatabase();
-            db3.applyDataSchema();
-            const entryFiles = ctx.entryPoints.map((n) => n.filePath).filter(Boolean);
-            if (entryFiles.length > 0) {
-              const placeholders = entryFiles.map(() => "?").join(", ");
-              const dataRefs = db3.getRawDb().all(
-                `SELECT DISTINCT d.id, d.file_path, d.row_count, d.column_count
-                 FROM data_code_refs r JOIN data_datasets d ON r.dataset_id = d.id
-                 WHERE r.qualified_name IN (${placeholders})`,
-                entryFiles
-              );
-              if (dataRefs.length > 0) {
-                const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-                const dq = new DataQueries(db3.getRawDb());
-                const limit = config3.dataContextLimit;
-                lines.push("", "## Related Data");
-                for (const ref of dataRefs.slice(0, limit)) {
-                  const info = dq.describeDataset(ref.id);
-                  if (info) {
-                    const colSummary = info.columns.map((c) => `${c.name}:${c.inferredType}`).join(", ");
-                    lines.push(`- **${ref.id}** (${ref.file_path}) \u2014 ${ref.row_count} rows, ${ref.column_count} cols`);
-                    lines.push(`  Schema: ${colSummary}`);
-                  }
-                }
-              }
-            }
-          }
-        } catch {
-        }
-        try {
-          const projectRootSec = cg.getProjectRoot();
-          const configSec = await (await Promise.resolve().then(() => require("../config.js"))).loadConfig(projectRootSec);
-          if (configSec.enableSecurity) {
-            const dbSec = cg.getDatabase();
-            dbSec.applySecuritySchema();
-            const rawDbSec = dbSec.getRawDb();
-            const contextNodeIds = [
-              ...ctx.entryPoints.map((n) => n.id),
-              ...ctx.relatedNodes.map((n) => n.id)
-            ].filter(Boolean);
-            if (contextNodeIds.length > 0) {
-              const { getSecurityWarningsForNodes, formatSecurityWarnings } = await Promise.resolve().then(() => require("../security/context-warnings.js"));
-              const warnings = getSecurityWarningsForNodes(rawDbSec, contextNodeIds);
-              if (warnings.length > 0) {
-                const nodeNames = /* @__PURE__ */ new Map();
-                for (const n of ctx.entryPoints) {
-                  nodeNames.set(n.id, n.name);
-                }
-                for (const n of ctx.relatedNodes) {
-                  nodeNames.set(n.id, n.name);
-                }
-                const secSection = formatSecurityWarnings(warnings, nodeNames);
-                if (secSection) {
-                  lines.push(secSection);
-                }
-              }
-            }
-          }
-        } catch {
-        }
-        try {
-          const projectRootPat = cg.getProjectRoot();
-          const configPat = await (await Promise.resolve().then(() => require("../config.js"))).loadConfig(projectRootPat);
-          if (configPat.enablePatterns) {
-            const dbPat = cg.getDatabase();
-            dbPat.applyPatternsSchema();
-            const rawDbPat = dbPat.getRawDb();
-            const tableExists = rawDbPat.get("SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'");
-            if (tableExists) {
-              const contextFiles = [
-                ...ctx.entryPoints.map((n) => n.filePath),
-                ...ctx.relatedNodes.map((n) => n.filePath)
-              ].filter(Boolean);
-              const uniqueContextFiles = [...new Set(contextFiles)];
-              if (uniqueContextFiles.length > 0) {
-                const placeholders = uniqueContextFiles.map(() => "?").join(",");
-                const patternRows = rawDbPat.all(
-                  `SELECT file_path, pattern_id, severity, owasp_category, line FROM pattern_matches WHERE file_path IN (${placeholders}) ORDER BY severity DESC LIMIT 5`,
-                  uniqueContextFiles
-                );
-                if (patternRows.length > 0) {
-                  const patternWarnings = patternRows.map(
-                    (p) => `- **${p.pattern_id}** [${p.severity.toUpperCase()}/${p.owasp_category}]: ${p.file_path}:${p.line}`
-                  ).join("\n");
-                  lines.push("", "## \u26A0 Pattern Findings", "", patternWarnings);
-                  if (patternRows.length === 5) lines.push("", "More findings \u2014 run `kirograph pattern --list` to see all rules.");
-                }
-              }
-            }
-          }
-        } catch {
-        }
-        const graphTokens = lines.join("\n").length / 4;
-        const uniqueFiles = /* @__PURE__ */ new Set([
-          ...ctx.entryPoints.map((n) => n.filePath),
-          ...ctx.relatedNodes.map((n) => n.filePath)
-        ]);
-        if (uniqueFiles.size > 0) {
-          const naiveTokens = estimateFileTokens(cg.getProjectRoot(), [...uniqueFiles]);
-          if (naiveTokens > 0) {
-            const savingsPct = Math.round((1 - graphTokens / naiveTokens) * 100);
-            if (savingsPct > 0) {
-              lines.push("", `---`, `Context savings: ~${Math.round(graphTokens)} tokens (graph) vs ~${naiveTokens} tokens (full files) \u2014 ${savingsPct}% reduction`);
-            }
-          }
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_callers": {
-        const limit = clampLimit(args.limit, 20);
-        const results = cg.searchNodes(args.symbol, void 0, 5);
-        if (results.length === 0) return `Symbol "${args.symbol}" not found in index.`;
-        const node = results[0].node;
-        const callers = await cg.getCallers(node.id, limit);
-        if (callers.length === 0) return `No callers found for \`${node.name}\`.`;
-        return `Callers of \`${node.name}\`:
-` + callers.map(
-          (n) => `- ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}:${n.startLine}`
-        ).join("\n");
-      }
-      case "kirograph_callees": {
-        const limit = clampLimit(args.limit, 20);
-        const results = cg.searchNodes(args.symbol, void 0, 5);
-        if (results.length === 0) return `Symbol "${args.symbol}" not found in index.`;
-        const node = results[0].node;
-        const callees = await cg.getCallees(node.id, limit);
-        if (callees.length === 0) return `\`${node.name}\` doesn't call any indexed symbols.`;
-        return `\`${node.name}\` calls:
-` + callees.map(
-          (n) => `- ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}:${n.startLine}`
-        ).join("\n");
-      }
-      case "kirograph_impact": {
-        const results = cg.searchNodes(args.symbol, void 0, 5);
-        if (results.length === 0) return `Symbol "${args.symbol}" not found in index.`;
-        const node = results[0].node;
-        const affected = await cg.getImpactRadius(node.id, args.depth ?? 2);
-        if (affected.length === 0) return `No dependents found for \`${node.name}\`.`;
-        let output = `Changing \`${node.name}\` may affect ${affected.length} symbol(s):
-` + affected.map((n) => `- ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}:${n.startLine}`).join("\n");
-        try {
-          const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-          const projectRoot = cg.getProjectRoot();
-          const config = await loadConfig(projectRoot);
-          if (config.enableMemory) {
-            const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-            const db = cg.getDatabase();
-            db.applyMemorySchema();
-            const mem = new MemoryManager(config, db.getRawDb());
-            mem.initialize();
-            const contextLimit = config.memoryContextLimit ?? 3;
-            const contextThreshold = config.memoryContextThreshold ?? 0.3;
-            const memResults = mem.getLinkedObservations(
-              [node.qualifiedName],
-              contextLimit,
-              contextThreshold
-            );
-            if (memResults.length > 0) {
-              output += "\n\nRelated Memory:";
-              for (const r of memResults) {
-                const age = formatAge(r.observation.createdAt);
-                output += `
-- [${r.observation.kind}] ${r.observation.content} (${age})`;
-              }
-            }
-          }
-        } catch {
-        }
-        try {
-          const rawDbImp = cg.getDatabase().getRawDb();
-          const tableExistsImp = rawDbImp.get("SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'");
-          if (tableExistsImp) {
-            const symNode = rawDbImp.get("SELECT id FROM nodes WHERE name = ? LIMIT 1", [args.symbol]);
-            if (symNode) {
-              const patternMatches = rawDbImp.all(
-                "SELECT pattern_id, severity, line FROM pattern_matches WHERE symbol_node_id = ?",
-                [symNode.id]
-              );
-              if (patternMatches.length > 0) {
-                output += "\n\n\u26A0 This symbol has pattern matches:";
-                for (const pm of patternMatches) {
-                  output += `
-  [${pm.severity.toUpperCase()}] ${pm.pattern_id} at line ${pm.line}`;
-                }
-              }
-            }
-          }
-        } catch {
-        }
-        return output;
-      }
-      case "kirograph_node": {
-        const results = cg.searchNodes(args.symbol, void 0, 5);
-        if (results.length === 0) return `Symbol "${args.symbol}" not found in index.`;
-        const node = results[0].node;
-        const nodeDetail = args.detail ?? (args.includeCode ? "full" : "summary");
-        const lines = [
-          `${mapKind(node.kind)} \`${node.name}\``,
-          `File: ${node.filePath}:${node.startLine}-${node.endLine}`,
-          `Qualified: ${node.qualifiedName}`
-        ];
-        if (nodeDetail === "signatures" || nodeDetail === "full") {
-          if (node.signature) lines.push(`Signature: ${node.signature}`);
-          if (node.docstring) lines.push(`Docs: ${node.docstring}`);
-        }
-        if (nodeDetail === "full") {
-          const src = cg.getNodeSource(node);
-          if (src) lines.push("", "```", src, "```");
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_status": {
-        const stats = await cg.getStats();
-        const langLine = Object.entries(stats.filesByLanguage).sort((a, b) => b[1] - a[1]).map(([k, v]) => `${k}=${v}`).join(", ");
-        const dbMb = (stats.dbSizeBytes / 1024 / 1024).toFixed(2);
-        const semanticLines = stats.embeddingsEnabled ? [
-          `  Semantic search: enabled`,
-          `  Semantic model:  ${stats.embeddingModel}`,
-          `  Semantic engine: ${stats.semanticEngine === "turboquant" ? `turboquant (${stats.vecIndexCount} entries \xB7 ANN)` : stats.semanticEngine === "turbovec" ? `turbovec (${stats.vecIndexCount} entries \xB7 ${stats.turbovecBits ?? 4} bits \xB7 Rust/SIMD)` : stats.semanticEngine === "sqlite-vec" ? `sqlite-vec (${stats.vecIndexCount} entries in ANN index)` : stats.semanticEngine === "orama" ? `orama hybrid (${stats.vecIndexCount} docs in index)` : stats.semanticEngine === "pglite" ? `pglite+pgvector (${stats.vecIndexCount} rows in DB)` : stats.semanticEngine === "lancedb" ? `lancedb (${stats.vecIndexCount} entries in ANN index)` : stats.semanticEngine === "qdrant" ? `qdrant (${stats.vecIndexCount} points in collection)` : stats.semanticEngine === "typesense" ? `typesense (${stats.vecIndexCount} documents in collection)` : "in-process cosine"}`,
-          `  Embeddings:      ${stats.embeddingCount} / ${stats.embeddableNodeCount || stats.nodes} embeddable symbols`,
-          ...stats.engineFallback ? [`  \u26A0 Engine fallback: ${stats.engineFallback}`] : []
-        ] : [`  Semantic search: disabled`];
-        const frameworkLine = stats.frameworks.length > 0 ? `  Frameworks: ${stats.frameworks.join(", ")}` : `  Frameworks: none detected`;
-        const archLine = stats.architectureEnabled ? stats.architectureStats ? `  Architecture: enabled \u2014 ${stats.architectureStats.packages} packages, ${stats.architectureStats.layers} layers, ${stats.architectureStats.packageDeps} deps` : `  Architecture: enabled (not yet analyzed \u2014 run kirograph index)` : `  Architecture: disabled`;
-        let docsLine = "  Documentation: disabled";
-        try {
-          const { loadConfig: loadCfg } = await Promise.resolve().then(() => require("../config.js"));
-          const cfg = await loadCfg(cg.getProjectRoot());
-          if (cfg.enableDocs) {
-            const db = cg.getDatabase();
-            db.applyDocsSchema();
-            const rawDb = db.getRawDb();
-            const docFiles = rawDb.get("SELECT COUNT(DISTINCT file_path) as cnt FROM doc_sections")?.cnt ?? 0;
-            const docSections = rawDb.get("SELECT COUNT(*) as cnt FROM doc_sections")?.cnt ?? 0;
-            const docRefs = rawDb.get("SELECT COUNT(*) as cnt FROM doc_code_refs")?.cnt ?? 0;
-            docsLine = `  Documentation: enabled \u2014 ${docFiles} files, ${docSections} sections, ${docRefs} code refs`;
-          }
-        } catch {
-        }
-        let dataLine = "  Data: disabled";
-        try {
-          const { loadConfig: loadCfg2 } = await Promise.resolve().then(() => require("../config.js"));
-          const cfg2 = await loadCfg2(cg.getProjectRoot());
-          if (cfg2.enableData) {
-            const rawDb2 = cg.getDatabase().getRawDb();
-            cg.getDatabase().applyDataSchema();
-            const datasetCount = rawDb2.get("SELECT COUNT(*) as cnt FROM data_datasets")?.cnt ?? 0;
-            if (datasetCount > 0) {
-              const totalRows = rawDb2.get("SELECT SUM(row_count) as total FROM data_datasets")?.total ?? 0;
-              const totalCols = rawDb2.get("SELECT SUM(column_count) as total FROM data_datasets")?.total ?? 0;
-              const totalSize = rawDb2.get("SELECT SUM(file_size) as total FROM data_datasets")?.total ?? 0;
-              const sizeMb = (totalSize / 1024 / 1024).toFixed(2);
-              dataLine = `  Data: enabled \u2014 ${datasetCount} datasets, ${totalRows.toLocaleString()} rows, ${totalCols} columns (${sizeMb} MB source)`;
-            } else {
-              dataLine = `  Data: enabled (no datasets indexed yet \u2014 run kirograph index)`;
-            }
-          }
-        } catch {
-        }
-        let securityLine = "  Security: disabled";
-        try {
-          const { loadConfig: loadCfgSec } = await Promise.resolve().then(() => require("../config.js"));
-          const cfgSec = await loadCfgSec(cg.getProjectRoot());
-          if (cfgSec.enableSecurity) {
-            const db = cg.getDatabase();
-            db.applySecuritySchema();
-            const rawDb = db.getRawDb();
-            const depCount = rawDb.get("SELECT COUNT(*) as cnt FROM sec_dependencies")?.cnt ?? 0;
-            const vulnCount = rawDb.get("SELECT COUNT(*) as cnt FROM sec_vulnerabilities")?.cnt ?? 0;
-            const affectedCount = rawDb.get("SELECT COUNT(*) as cnt FROM sec_reachability WHERE verdict = 'affected'")?.cnt ?? 0;
-            const staleCount = rawDb.get("SELECT COUNT(*) as cnt FROM sec_dependencies WHERE vuln_data_stale = 1")?.cnt ?? 0;
-            const staleNote = staleCount > 0 ? ` \u26A0 ${staleCount} stale` : "";
-            securityLine = `  Security: enabled \u2014 ${depCount} deps, ${vulnCount} vulns (${affectedCount} affected)${staleNote}`;
-          }
-        } catch {
-        }
-        let patternsLine = "  Patterns: disabled";
-        try {
-          const { loadConfig: loadCfgPat } = await Promise.resolve().then(() => require("../config.js"));
-          const cfgP = await loadCfgPat(cg.getProjectRoot());
-          if (cfgP.enablePatterns) {
-            const rawDbP = cg.getDatabase().getRawDb();
-            const tableExistsP = rawDbP.get("SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'");
-            if (tableExistsP) {
-              const matchCount = rawDbP.get("SELECT COUNT(*) as cnt FROM pattern_matches")?.cnt ?? 0;
-              const fileCount = rawDbP.get("SELECT COUNT(DISTINCT file_path) as cnt FROM pattern_matches")?.cnt ?? 0;
-              const ruleCount = rawDbP.get("SELECT COUNT(DISTINCT pattern_id) as cnt FROM pattern_matches")?.cnt ?? 0;
-              patternsLine = `  Patterns: enabled \u2014 ${matchCount} matches, ${ruleCount} rules triggered, ${fileCount} files`;
-            } else {
-              patternsLine = `  Patterns: enabled (no data yet \u2014 run kirograph index)`;
-            }
-          }
-        } catch {
-        }
-        const threshold = stats.syncWarningThreshold ?? 10;
-        const pendingFiles = stats.pendingFiles ?? 0;
-        const syncRunning = stats.syncRunning ?? false;
-        const syncLines = [];
-        if (syncRunning) {
-          syncLines.push(`  \u26A0 Sync is currently running in the background.`);
-        }
-        if (threshold > 0 && pendingFiles >= threshold) {
-          syncLines.push(
-            `  \u26A0 Index may be incomplete \u2014 ${pendingFiles} file${pendingFiles !== 1 ? "s" : ""} pending sync.` + (syncRunning ? " Sync is running in background." : " Run `kirograph sync` to update.") + ` Would you like to wait before proceeding?`
-          );
-        }
-        const tracker = new import_tracker.TokenTracker(cg.getProjectRoot());
-        const gainStats = tracker.getStats("session");
-        const gainLines = [];
-        if (gainStats.totalCommands > 0) {
-          gainLines.push(`  Compression: ${gainStats.totalCommands} commands, ${gainStats.savingsPercent}% avg savings (${gainStats.totalSaved.toLocaleString()} tokens saved this session)`);
-        }
-        return [
-          `KiroGraph Status`,
-          `  Project: ${cg.getProjectRoot()}`,
-          `  Files indexed: ${stats.files}`,
-          `  Symbols: ${stats.nodes}`,
-          `  Relationships: ${stats.edges}`,
-          `  By kind: ${Object.entries(stats.nodesByKind).map(([k, v]) => `${k}=${v}`).join(", ")}`,
-          langLine ? `  By language: ${langLine}` : "",
-          frameworkLine,
-          archLine,
-          docsLine,
-          dataLine,
-          securityLine,
-          patternsLine,
-          `  DB size: ${dbMb} MB`,
-          ...semanticLines,
-          ...syncLines,
-          ...gainLines
-        ].filter(Boolean).join("\n");
-      }
-      case "kirograph_files": {
-        let renderTree2 = function(nodes, prefix) {
-          for (let i = 0; i < nodes.length; i++) {
-            const node = nodes[i];
-            const isLast = i === nodes.length - 1;
-            const connector = isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 ";
-            const childPrefix = prefix + (isLast ? "    " : "\u2502   ");
-            const meta = includeMetadata && node.type === "file" && node.language ? `  [${node.language}${node.symbolCount ? ` \xB7 ${node.symbolCount} symbols` : ""}]` : "";
-            lines.push(`${prefix}${connector}${node.name}${meta}`);
-            if (node.children?.length) renderTree2(node.children, childPrefix);
-          }
-        };
-        var renderTree = renderTree2;
-        const format = args.format ?? "tree";
-        const includeMetadata = args.includeMetadata !== false;
-        const tree = cg.getFiles({
-          filterPath: args.filterPath,
-          pattern: args.pattern,
-          maxDepth: args.maxDepth
-        });
-        if (format === "flat") {
-          let flattenTree2 = function(nodes) {
-            for (const node of nodes) {
-              if (node.type === "file") {
-                const meta = includeMetadata && node.language ? ` [${node.language}${node.symbolCount ? ` \xB7 ${node.symbolCount}` : ""}]` : "";
-                flat.push(`${node.path}${meta}`);
-              }
-              if (node.children?.length) flattenTree2(node.children);
-            }
-          };
-          var flattenTree = flattenTree2;
-          const flat = [];
-          flattenTree2(tree);
-          return flat.length > 0 ? flat.join("\n") : "No indexed files found.";
-        }
-        if (format === "grouped") {
-          let groupTree2 = function(nodes) {
-            for (const node of nodes) {
-              if (node.type === "file") {
-                const dir = node.path.includes("/") ? node.path.slice(0, node.path.lastIndexOf("/")) : ".";
-                if (!groups.has(dir)) groups.set(dir, []);
-                groups.get(dir).push(node);
-              }
-              if (node.children?.length) groupTree2(node.children);
-            }
-          };
-          var groupTree = groupTree2;
-          const groups = /* @__PURE__ */ new Map();
-          groupTree2(tree);
-          const lines2 = [];
-          for (const [dir, files] of [...groups.entries()].sort()) {
-            lines2.push(`${dir}/`);
-            for (const f of files) {
-              const meta = includeMetadata && f.language ? ` [${f.language}${f.symbolCount ? ` \xB7 ${f.symbolCount}` : ""}]` : "";
-              lines2.push(`  ${f.name}${meta}`);
-            }
-          }
-          return lines2.length > 0 ? lines2.join("\n") : "No indexed files found.";
-        }
-        if (format === "compact") {
-          let compactTree2 = function(nodes) {
-            for (const node of nodes) {
-              if (node.type === "file") {
-                const dir = node.path.includes("/") ? node.path.slice(0, node.path.lastIndexOf("/")) : ".";
-                const stat = dirStats.get(dir) || { files: 0, symbols: 0, langs: /* @__PURE__ */ new Map() };
-                stat.files++;
-                stat.symbols += node.symbolCount || 0;
-                if (node.language) stat.langs.set(node.language, (stat.langs.get(node.language) || 0) + 1);
-                dirStats.set(dir, stat);
-              }
-              if (node.children?.length) compactTree2(node.children);
-            }
-          };
-          var compactTree = compactTree2;
-          const dirStats = /* @__PURE__ */ new Map();
-          compactTree2(tree);
-          const totalFiles = [...dirStats.values()].reduce((s, d) => s + d.files, 0);
-          const totalSymbols = [...dirStats.values()].reduce((s, d) => s + d.symbols, 0);
-          const lines2 = [`${totalFiles} files, ${totalSymbols} symbols in ${dirStats.size} directories:
-`];
-          for (const [dir, stat] of [...dirStats.entries()].sort()) {
-            const langSummary = [...stat.langs.entries()].map(([l, c]) => `${l}:${c}`).join(" ");
-            lines2.push(`${dir}/ (${stat.files} files, ${stat.symbols} symbols) ${langSummary}`);
-          }
-          return lines2.join("\n");
-        }
-        const lines = [];
-        renderTree2(tree, "");
-        return lines.length > 0 ? lines.join("\n") : "No indexed files found.";
-      }
-      case "kirograph_dead_code": {
-        const limit = clampLimit(args.limit, 50);
-        const dead = cg.findDeadCode(limit);
-        if (dead.length === 0) return "No dead code detected.";
-        return `Potential dead code (${dead.length} unexported symbols with no incoming references):
-` + dead.map((n) => `- ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}:${n.startLine}`).join("\n");
-      }
-      case "kirograph_circular_deps": {
-        const cycles = cg.findCircularDependencies();
-        if (cycles.length === 0) return "No circular dependencies found.";
-        return `Found ${cycles.length} circular dependency cycle(s):
-` + cycles.map((cycle, i) => `Cycle ${i + 1}: ${cycle.join(" \u2192 ")}`).join("\n");
-      }
-      case "kirograph_path": {
-        const fromResults = cg.searchNodes(args.from, void 0, 3);
-        const toResults = cg.searchNodes(args.to, void 0, 3);
-        if (fromResults.length === 0) return `Symbol "${args.from}" not found in index.`;
-        if (toResults.length === 0) return `Symbol "${args.to}" not found in index.`;
-        const fromNode = fromResults[0].node;
-        const toNode = toResults[0].node;
-        const pathNodes = await cg.findPath(fromNode.id, toNode.id);
-        if (pathNodes.length === 0) return `No path found between \`${fromNode.name}\` and \`${toNode.name}\`.`;
-        return `Path from \`${fromNode.name}\` to \`${toNode.name}\` (${pathNodes.length} nodes):
-` + pathNodes.map((n, i) => `${i + 1}. ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}:${n.startLine}`).join("\n");
-      }
-      case "kirograph_type_hierarchy": {
-        const results = cg.searchNodes(args.symbol, void 0, 5);
-        if (results.length === 0) return `Symbol "${args.symbol}" not found in index.`;
-        const node = results[0].node;
-        const direction = args.direction ?? "both";
-        const hierarchy = cg.getTypeHierarchy(node.id, direction);
-        if (hierarchy.length === 0) return `No type hierarchy found for \`${node.name}\`.`;
-        return `Type hierarchy for \`${node.name}\` (direction: ${direction}):
-` + hierarchy.map((n) => `- ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}:${n.startLine}`).join("\n");
-      }
-      case "kirograph_architecture": {
-        if (!cg.isArchitectureEnabled()) {
-          return "Architecture analysis is disabled. Set enableArchitecture=true in .kirograph/config.json and re-index.";
-        }
-        const level = args.level ?? "both";
-        const includeFiles = args.includeFiles === true;
-        const arch = cg.getArchitecture();
-        const lines = ["# Architecture"];
-        if ((level === "packages" || level === "both") && arch.packages.length > 0) {
-          lines.push("\n## Packages");
-          for (const pkg of arch.packages) {
-            const meta = [pkg.language, pkg.version].filter(Boolean).join(", ");
-            lines.push(`- **${pkg.name}** (${pkg.path}) [${pkg.source}${meta ? " \xB7 " + meta : ""}]`);
-          }
-          if (arch.packageDeps.length > 0) {
-            lines.push("\n## Package Dependencies");
-            for (const dep of arch.packageDeps) {
-              const src = arch.packages.find((p) => p.id === dep.sourcePkg)?.name ?? dep.sourcePkg;
-              const tgt = arch.packages.find((p) => p.id === dep.targetPkg)?.name ?? dep.targetPkg;
-              lines.push(`- ${src} \u2192 ${tgt} (${dep.depCount} import${dep.depCount !== 1 ? "s" : ""})`);
-            }
-          }
-        }
-        if ((level === "layers" || level === "both") && arch.layers.length > 0) {
-          lines.push("\n## Layers");
-          for (const layer of arch.layers) {
-            const fileCount = Object.values(arch.fileLayers).filter((fl) => fl.some((l) => l.layerId === layer.id)).length;
-            lines.push(`- **${layer.name}** [${layer.source}] \u2014 ${fileCount} file${fileCount !== 1 ? "s" : ""}`);
-          }
-          if (arch.layerDeps.length > 0) {
-            lines.push("\n## Layer Dependencies");
-            for (const dep of arch.layerDeps) {
-              const src = dep.sourceLayer.replace("layer:", "");
-              const tgt = dep.targetLayer.replace("layer:", "");
-              lines.push(`- ${src} \u2192 ${tgt} (${dep.depCount})`);
-            }
-          }
-        }
-        if (includeFiles && (level === "packages" || level === "both")) {
-          lines.push("\n## File \u2192 Package");
-          for (const [file, pkgIds] of Object.entries(arch.filePackages).slice(0, 50)) {
-            const names = pkgIds.map((id) => arch.packages.find((p) => p.id === id)?.name ?? id).join(", ");
-            lines.push(`- ${file}: ${names}`);
-          }
-          if (Object.keys(arch.filePackages).length > 50) lines.push("  \u2026(truncated)");
-        }
-        if (arch.packages.length === 0 && arch.layers.length === 0) {
-          return "No architecture data found. Run `kirograph index` with enableArchitecture=true.";
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_coupling": {
-        if (!cg.isArchitectureEnabled()) {
-          return "Architecture analysis is disabled. Set enableArchitecture=true in .kirograph/config.json and re-index.";
-        }
-        const sortBy = args.sortBy ?? "instability";
-        const limit = clampLimit(args.limit, 20);
-        const arch = cg.getArchitecture();
-        if (arch.coupling.length === 0) {
-          return "No coupling data. Run `kirograph index` with enableArchitecture=true.";
-        }
-        const sorted = [...arch.coupling].sort((a, b) => {
-          if (sortBy === "afferent") return b.afferent - a.afferent;
-          if (sortBy === "efferent") return b.efferent - a.efferent;
-          return b.instability - a.instability;
-        }).slice(0, limit);
-        const lines = [
-          `Coupling Metrics (sorted by ${sortBy}):`,
-          "",
-          "Package                          Ca    Ce    I",
-          "\u2500".repeat(52)
-        ];
-        for (const c of sorted) {
-          const pkg = arch.packages.find((p) => p.id === c.packageId);
-          const name = (pkg?.name ?? c.packageId).slice(0, 32).padEnd(32);
-          const ca = String(c.afferent).padStart(4);
-          const ce = String(c.efferent).padStart(4);
-          const inst = c.instability.toFixed(2).padStart(5);
-          lines.push(`${name}  ${ca}  ${ce}  ${inst}`);
-        }
-        lines.push("", "Ca=afferent (depended on by), Ce=efferent (depends on), I=instability (Ce/(Ca+Ce))");
-        return lines.join("\n");
-      }
-      case "kirograph_package": {
-        if (!cg.isArchitectureEnabled()) {
-          return "Architecture analysis is disabled. Set enableArchitecture=true in .kirograph/config.json and re-index.";
-        }
-        const query = args.package.toLowerCase();
-        const includeFiles = args.includeFiles !== false;
-        const arch = cg.getArchitecture();
-        const pkg = arch.packages.find(
-          (p) => p.name.toLowerCase().includes(query) || p.path.toLowerCase().includes(query) || p.id.toLowerCase().includes(query)
-        );
-        if (!pkg) return `Package "${args.package}" not found. Use kirograph_architecture to list all packages.`;
-        const lines = [
-          `## Package: ${pkg.name}`,
-          `Path: ${pkg.path}`,
-          `Source: ${pkg.source}${pkg.manifestPath ? ` (${pkg.manifestPath})` : ""}`,
-          ...pkg.version ? [`Version: ${pkg.version}`] : [],
-          ...pkg.language ? [`Language: ${pkg.language}`] : []
-        ];
-        const deps = arch.packageDeps.filter((d) => d.sourcePkg === pkg.id);
-        const dependents = arch.packageDeps.filter((d) => d.targetPkg === pkg.id);
-        const coupling = arch.coupling.find((c) => c.packageId === pkg.id);
-        if (coupling) {
-          lines.push("", `Coupling: Ca=${coupling.afferent} Ce=${coupling.efferent} I=${coupling.instability.toFixed(2)}`);
-        }
-        if (deps.length > 0) {
-          lines.push("", `Depends on (${deps.length}):`);
-          for (const dep of deps) {
-            const name = arch.packages.find((p) => p.id === dep.targetPkg)?.name ?? dep.targetPkg;
-            lines.push(`  \u2192 ${name} (${dep.depCount} import${dep.depCount !== 1 ? "s" : ""})`);
-          }
-        }
-        if (dependents.length > 0) {
-          lines.push("", `Depended on by (${dependents.length}):`);
-          for (const dep of dependents) {
-            const name = arch.packages.find((p) => p.id === dep.sourcePkg)?.name ?? dep.sourcePkg;
-            lines.push(`  \u2190 ${name} (${dep.depCount} import${dep.depCount !== 1 ? "s" : ""})`);
-          }
-        }
-        if (pkg.externalDeps && pkg.externalDeps.length > 0) {
-          lines.push("", `External deps (${pkg.externalDeps.length}): ${pkg.externalDeps.slice(0, 10).join(", ")}${pkg.externalDeps.length > 10 ? "\u2026" : ""}`);
-        }
-        if (includeFiles) {
-          const files = Object.entries(arch.filePackages).filter(([, ids]) => ids.includes(pkg.id)).map(([f]) => f).sort();
-          if (files.length > 0) {
-            lines.push("", `Files (${files.length}):`);
-            for (const f of files.slice(0, 30)) lines.push(`  ${f}`);
-            if (files.length > 30) lines.push(`  \u2026and ${files.length - 30} more`);
-          }
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_hotspots": {
-        const limit = clampLimit(args.limit, 20);
-        const hotspots = cg.findHotspots(limit);
-        if (hotspots.length === 0) return "No symbols found in index.";
-        const lines = [`Top ${hotspots.length} most-connected symbols (by edge degree):
-`];
-        for (const n of hotspots) {
-          lines.push(`${mapKind(n.kind)} \`${n.name}\` \u2014 degree ${n.degree} (in: ${n.inDegree}, out: ${n.outDegree})`);
-          lines.push(`  File: ${n.filePath}:${n.startLine}`);
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_surprising": {
-        const limit = clampLimit(args.limit, 20);
-        const connections = cg.findSurprisingConnections(limit);
-        if (connections.length === 0) return "No surprising cross-file connections found.";
-        const lines = [`Top ${connections.length} surprising cross-file connections:
-`];
-        for (const c of connections) {
-          lines.push(`${mapKind(c.source.kind)} \`${c.source.name}\` ${c.kind}\u2192 ${mapKind(c.target.kind)} \`${c.target.name}\` (score: ${c.score.toFixed(2)})`);
-          lines.push(`  ${c.source.filePath} \u2192 ${c.target.filePath}`);
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_diff": {
-        const sm = cg.createSnapshotManager();
-        const snapshot = args.snapshot ? sm.load(args.snapshot) : sm.loadLatest();
-        if (!snapshot) {
-          return args.snapshot ? `Snapshot "${args.snapshot}" not found. Use \`kirograph snapshot list\` to see available snapshots.` : "No snapshots found. Run `kirograph snapshot` to save one first.";
-        }
-        const diff = sm.diff(snapshot, sm.currentSnapshot());
-        const fromDate = new Date(diff.from.timestamp).toISOString().slice(0, 19).replace("T", " ");
-        const lines = [
-          `Graph diff: "${diff.from.label}" (${fromDate}) \u2192 current`,
-          ``,
-          `Symbols: +${diff.addedNodes.length} added, -${diff.removedNodes.length} removed`,
-          `Edges:   +${diff.addedEdges.length} added, -${diff.removedEdges.length} removed`
-        ];
-        if (diff.addedNodes.length > 0) {
-          lines.push(`
-## Added symbols (${diff.addedNodes.length})`);
-          for (const n of diff.addedNodes.slice(0, 30)) {
-            lines.push(`+ ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}`);
-          }
-          if (diff.addedNodes.length > 30) lines.push(`  \u2026and ${diff.addedNodes.length - 30} more`);
-        }
-        if (diff.removedNodes.length > 0) {
-          lines.push(`
-## Removed symbols (${diff.removedNodes.length})`);
-          for (const n of diff.removedNodes.slice(0, 30)) {
-            lines.push(`- ${mapKind(n.kind)} \`${n.name}\` \u2014 ${n.filePath}`);
-          }
-          if (diff.removedNodes.length > 30) lines.push(`  \u2026and ${diff.removedNodes.length - 30} more`);
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_snapshot_save": {
-        const sm = cg.createSnapshotManager();
-        const snapshot = sm.save(args.label);
-        return `Snapshot saved: "${snapshot.label}" \u2014 ${snapshot.nodeCount} symbols, ${snapshot.edgeCount} edges`;
-      }
-      case "kirograph_snapshot_list": {
-        const sm = cg.createSnapshotManager();
-        const snapshots = sm.list();
-        if (snapshots.length === 0) return "No snapshots yet. Use kirograph_snapshot_save to save one first.";
-        const lines = [`Saved snapshots (${snapshots.length}):
-`];
-        for (const s of snapshots) {
-          const date = new Date(s.timestamp).toISOString().slice(0, 19).replace("T", " ");
-          lines.push(`- ${s.label}  (${date}, ${s.nodeCount} symbols, ${s.edgeCount} edges)`);
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_flows": {
-        const { getExecutionFlows, traceFlow, detectEntryPoints } = await Promise.resolve().then(() => require("../graph/flows.js"));
-        const db = cg.getDatabase();
-        if (args.entryPoint) {
-          const results = cg.searchNodes(args.entryPoint, void 0, 5);
-          if (results.length === 0) return `Symbol "${args.entryPoint}" not found in index.`;
-          const hops = traceFlow(db, results[0].node.id, args.maxDepth ?? 10);
-          if (hops.length < 2) return `No outgoing call chain found from "${args.entryPoint}".`;
-          const lines2 = [`## Execution flow from \`${args.entryPoint}\``, ""];
-          for (let i = 0; i < hops.length; i++) {
-            const hop = hops[i];
-            const indent = "  ".repeat(i);
-            const arrow = i === 0 ? "\u2192" : "\u21B3";
-            const conf = hop.confidence && hop.confidence !== "extracted" ? ` [${hop.confidence}]` : "";
-            lines2.push(`${indent}${arrow} ${hop.kind} \`${hop.symbol}\` \u2014 ${hop.filePath}:${hop.line}${conf}`);
-          }
-          return lines2.join("\n");
-        }
-        const flows = getExecutionFlows(db, {
-          maxFlows: args.maxFlows ?? 10,
-          maxDepth: args.maxDepth ?? 10
-        });
-        if (flows.length === 0) return "No execution flows detected. The graph may be too small or have no call edges.";
-        const lines = [`## Execution Flows (${flows.length} detected)`, ""];
-        for (const flow of flows) {
-          lines.push(`### \`${flow.entryPoint}\` (${flow.entryPointKind}) \u2014 criticality: ${flow.criticality.toFixed(2)}`);
-          lines.push(`File: ${flow.entryPointFile}`, "");
-          for (let i = 0; i < flow.hops.length; i++) {
-            const hop = flow.hops[i];
-            const indent = "  ".repeat(Math.min(i, 5));
-            const arrow = i === 0 ? "\u2192" : "\u21B3";
-            const conf = hop.confidence && hop.confidence !== "extracted" ? ` [${hop.confidence}]` : "";
-            lines.push(`${indent}${arrow} \`${hop.symbol}\` (${hop.kind}) \u2014 ${hop.filePath}:${hop.line}${conf}`);
-          }
-          lines.push("");
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_communities": {
-        const { detectCommunities } = await Promise.resolve().then(() => require("../graph/communities.js"));
-        const db = cg.getDatabase();
-        const result = detectCommunities(db, {
-          resolution: args.resolution ?? 1
-        });
-        if (result.communities.length === 0) return "No communities detected. The graph may be too small or have no edges.";
-        const limit = Math.min(args.limit ?? 15, result.communities.length);
-        const lines = [
-          `## Communities (${result.communities.length} detected, modularity: ${result.modularity.toFixed(3)})`,
-          `Graph: ${result.totalNodes} nodes, ${result.totalEdges} edges`,
-          ""
-        ];
-        for (const c of result.communities.slice(0, limit)) {
-          lines.push(`### ${c.label} (${c.memberCount} symbols)`);
-          lines.push(`- Directory: \`${c.dominantDirectory}\``);
-          lines.push(`- Language: ${c.dominantLanguage}`);
-          lines.push(`- Inter-community edges: ${c.interCommunityEdges}`);
-          lines.push(`- Top members:`);
-          for (const m of c.members.slice(0, 8)) {
-            lines.push(`  - ${m.kind} \`${m.name}\` \u2014 ${m.filePath}`);
-          }
-          if (c.memberCount > 8) lines.push(`  - \u2026and ${c.memberCount - 8} more`);
-          lines.push("");
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_refactor": {
-        const { renamePreview, suggestRefactorings } = await Promise.resolve().then(() => require("../graph/refactor.js"));
-        const db = cg.getDatabase();
-        const mode = args.mode;
-        if (mode === "rename") {
-          if (!args.symbol) return 'Error: "symbol" parameter is required for rename mode.';
-          const preview = renamePreview(db, args.symbol);
-          if (!preview) return `Symbol "${args.symbol}" not found in index.`;
-          const lines = [
-            `## Rename Preview: \`${preview.symbol}\``,
-            `Kind: ${preview.kind}`,
-            `Defined at: ${preview.filePath}:${preview.line}`,
-            `Total references: ${preview.totalReferences}`,
-            ""
-          ];
-          if (preview.references.length === 0) {
-            lines.push("No references found \u2014 this symbol can be safely renamed without affecting other code.");
-          } else {
-            const byFile = /* @__PURE__ */ new Map();
-            for (const ref of preview.references) {
-              if (!byFile.has(ref.filePath)) byFile.set(ref.filePath, []);
-              byFile.get(ref.filePath).push(ref);
-            }
-            for (const [file, refs] of byFile) {
-              lines.push(`### ${file} (${refs.length} references)`);
-              for (const ref of refs.slice(0, 10)) {
-                lines.push(`- Line ${ref.line}: \`${ref.context}\` (${ref.edgeKind})`);
-              }
-              if (refs.length > 10) lines.push(`  \u2026and ${refs.length - 10} more`);
-              lines.push("");
-            }
-          }
-          return lines.join("\n");
-        }
-        if (mode === "suggest") {
-          const suggestions = suggestRefactorings(db, args.limit ?? 10);
-          if (suggestions.length === 0) return "No refactoring suggestions \u2014 the codebase structure looks clean.";
-          const lines = [`## Refactoring Suggestions (${suggestions.length})`, ""];
-          for (const s of suggestions) {
-            const icon = s.priority === "high" ? "\u{1F534}" : s.priority === "medium" ? "\u{1F7E1}" : "\u{1F7E2}";
-            lines.push(`${icon} **${s.type}** [${s.priority}]: ${s.description}`);
-            lines.push(`   Rationale: ${s.rationale}`);
-            if (s.symbols.length > 0) {
-              lines.push(`   Symbols: ${s.symbols.slice(0, 3).join(", ")}`);
-            }
-            lines.push("");
-          }
-          return lines.join("\n");
-        }
-        return 'Unknown mode. Use "rename" or "suggest".';
-      }
-      // ── Memory tools ────────────────────────────────────────────────────────
-      case "kirograph_mem_search": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled. Set enableMemory: true in .kirograph/config.json";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const results = await mem.search(args.query, {
-          limit: args.limit ?? 10,
-          kind: args.kind,
-          sessionId: args.sessionId,
-          asOf: args.asOf
-        });
-        if (results.length === 0) return `No memory observations found for "${args.query}".`;
-        return results.map((r, i) => {
-          const age = formatAge(r.observation.createdAt);
-          const lines = [`${i + 1}. [${r.observation.kind}] ${r.observation.content} (${age})`];
-          if (r.relations && r.relations.length > 0) {
-            for (const rel of r.relations) {
-              const other = rel.observationA === r.observation.id ? rel.observationB : rel.observationA;
-              const icon = rel.relation === "conflicts_with" ? "\u26A1" : rel.relation === "supersedes" ? "\u21A9" : "~";
-              lines.push(`  ${icon} ${rel.relation} ${other} (confidence: ${rel.confidence})${rel.judgmentStatus === "judged" ? " (judged)" : ""}`);
-            }
-          }
-          return lines.join("\n");
-        }).join("\n");
-      }
-      case "kirograph_mem_store": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled. Set enableMemory: true in .kirograph/config.json";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const id = await mem.store({
-          content: args.content,
-          kind: args.kind ?? "note",
-          source: "agent",
-          topicKey: args.topicKey,
-          reviewAfter: args.reviewAfter
-        });
-        if (!id) return "Observation already exists (duplicate content).";
-        return `Stored observation ${id} [${args.kind ?? "note"}]`;
-      }
-      case "kirograph_mem_timeline": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled. Set enableMemory: true in .kirograph/config.json";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const { sessions, observations } = mem.timeline({
-          limit: args.limit ?? 5,
-          sessionId: args.sessionId
-        });
-        if (sessions.length === 0) return "No memory sessions found.";
-        const lines = [];
-        for (const session of sessions) {
-          const start = new Date(session.startedAt).toISOString().slice(0, 16).replace("T", " ");
-          const status = session.endedAt ? "ended" : "active";
-          const obs = observations.get(session.id) ?? [];
-          lines.push(`## ${start} [${session.ide ?? "unknown"}] (${status}, ${obs.length} observations)`);
-          for (const o of obs.slice(0, 5)) {
-            lines.push(`  - [${o.kind}] ${o.content.slice(0, 120)}`);
-          }
-          if (obs.length > 5) lines.push(`  \u2026and ${obs.length - 5} more`);
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_mem_status": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled. Set enableMemory: true in .kirograph/config.json";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const stats = mem.getStats();
-        const lines = [
-          "KiroGraph Memory Status",
-          `  Sessions: ${stats.sessions} (${stats.activeSessions} active)`,
-          `  Observations: ${stats.observations}`,
-          `  Symbol links: ${stats.links}`,
-          `  Embeddings: ${stats.vectors} / ${stats.embeddableCount}`,
-          `  Model mismatch: ${stats.modelMismatch ? "\u26A0 yes \u2014 run kirograph mem reembed" : "no"}`,
-          `  Relations: ${stats.relations} (${stats.pendingConflicts} pending)`,
-          `  Caveman compression: ${config.cavemanMode !== "off" ? config.cavemanMode : "off (storing raw)"}`
-        ];
-        return lines.join("\n");
-      }
-      case "kirograph_mem_review": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const obs = mem.getObservationsForReview(args.limit ?? 20);
-        if (obs.length === 0) return "No overdue observations \u2014 all review_after dates are in the future.";
-        const now = Date.now();
-        return obs.map((o, i) => {
-          const daysOverdue = Math.floor((now - (o.reviewAfter ?? now)) / 864e5);
-          return `${i + 1}. [${o.kind}]${o.topicKey ? ` (${o.topicKey})` : ""} ${o.content.slice(0, 120)} \u2014 overdue by ${daysOverdue}d`;
-        }).join("\n");
-      }
-      case "kirograph_mem_mark_reviewed": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        mem.markReviewed(args.id);
-        return `Observation ${args.id} marked as reviewed.`;
-      }
-      case "kirograph_mem_compare": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const relationId = mem.compareObservations({
-          observationA: args.observationA,
-          observationB: args.observationB,
-          relation: args.relation,
-          confidence: args.confidence ?? 1,
-          reason: args.reason,
-          evidence: args.evidence
-        });
-        return `Relation ${relationId} created (${args.relation}, confidence: ${args.confidence ?? 1}). Use kirograph_mem_judge to finalize.`;
-      }
-      case "kirograph_mem_judge": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        mem.judgeRelation(
-          args.relationId,
-          args.relation,
-          args.confidence,
-          args.reason,
-          args.evidence
-        );
-        return `Relation ${args.relationId} judged as [${args.relation}] (confidence: ${args.confidence}).`;
-      }
-      case "kirograph_mem_capture": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const extracted = mem.capturePassive(args.content);
-        if (extracted.length === 0) return "No structured sections found. Use ## Key Learnings, ## Observations, ## Decisions, or ## Key Changes headings.";
-        return `Captured ${extracted.length} observation(s):
-` + extracted.map((e, i) => `${i + 1}. [${e.kind}] ${e.content.slice(0, 100)}${e.id ? "" : " (duplicate)"}`).join("\n");
-      }
-      case "kirograph_mem_save_prompt": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const id = await mem.savePrompt(args.content);
-        return `Prompt saved as ${id}.`;
-      }
-      case "kirograph_mem_suggest_topic_key": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const key = mem.suggestTopicKey(args.kind, args.title);
-        return `Suggested topic_key: ${key}`;
-      }
-      case "kirograph_mem_conflicts_scan": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const candidates = mem.scanConflicts(args.limit ?? 50);
-        if (candidates.length === 0) return "No potential conflicts found among recent observations.";
-        return `Found ${candidates.length} potential conflict(s):
-` + candidates.map(
-          (c, i) => `${i + 1}. [${c.observationA.kind}] "${c.observationA.content.slice(0, 80)}" \u2194 [${c.observationB.kind}] "${c.observationB.content.slice(0, 80)}" (similarity: ${c.similarity.toFixed(2)})`
-        ).join("\n") + "\n\nUse kirograph_mem_compare to establish relations.";
-      }
-      case "kirograph_mem_prune": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const olderThan = args.olderThan ?? "90d";
-        const durationMs = (() => {
-          const m = olderThan.match(/^(\d+)(d|m|w|h)$/);
-          if (!m) return 90 * 864e5;
-          const v = parseInt(m[1]);
-          switch (m[2]) {
-            case "h":
-              return v * 36e5;
-            case "d":
-              return v * 864e5;
-            case "w":
-              return v * 7 * 864e5;
-            case "m":
-              return v * 30 * 864e5;
-            default:
-              return 90 * 864e5;
-          }
-        })();
-        const deleted = mem.prune(durationMs);
-        return `Pruned ${deleted} observation(s) older than ${olderThan}.`;
-      }
-      case "kirograph_mem_lint": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const result = mem.lint();
-        const lines = ["Memory Lint Results:"];
-        lines.push(`  Stale links:    ${result.staleLinks}`);
-        lines.push(`  Model mismatch: ${result.modelMismatch ? "yes" : "no"}`);
-        lines.push(`  Stale sessions: ${result.staleSessions} (auto-closed)`);
-        if (args.fix && result.staleLinks > 0) {
-          const removed = mem.removeStaleLinks();
-          lines.push(`
-\u2713 Removed ${removed} stale link(s)`);
-        } else if (result.staleLinks > 0) {
-          lines.push(`
-Pass fix: true to remove stale links.`);
-        }
-        if (result.modelMismatch) {
-          lines.push(`
-Run 'kirograph mem reembed' to fix model mismatch.`);
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_mem_conflicts_list": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const limit = clampLimit(args.limit, 20);
-        const pending = mem.getPendingRelations(limit);
-        if (pending.length === 0) return "No pending conflict relations.";
-        return `Pending relations (${pending.length}):
-
-` + pending.map(
-          (r) => `[${r.id}] ${r.relation}
-  A: ${r.observationA}
-  B: ${r.observationB}${r.reason ? `
-  Reason: ${r.reason}` : ""}`
-        ).join("\n\n") + "\n\nUse kirograph_mem_conflicts_ignore to dismiss, or kirograph_mem_judge to finalize.";
-      }
-      case "kirograph_mem_conflicts_ignore": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mem = new MemoryManager(config, db.getRawDb());
-        mem.initialize();
-        const relationId = args.relationId;
-        mem.ignoreRelation(relationId);
-        return `Relation "${relationId}" ignored.`;
-      }
-      // ── Docs tools ────────────────────────────────────────────────────────────
-      case "kirograph_docs_toc": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableDocs) return "Documentation indexing is not enabled. Set enableDocs: true in .kirograph/config.json and run kirograph index.";
-        const { DocsQueries } = await Promise.resolve().then(() => require("../docs/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDocsSchema();
-        const docs = new DocsQueries(db.getRawDb(), projectRoot);
-        const toc = docs.getToc({ file: args.file, tree: args.tree });
-        if (toc.length === 0) return args.file ? `No sections found in "${args.file}".` : "No documentation indexed. Run kirograph index.";
-        const lines = [];
-        const renderEntry = (entry, indent) => {
-          const prefix = "#".repeat(entry.level || 1);
-          const summary = entry.summary ? ` \u2014 ${entry.summary}` : "";
-          lines.push(`${indent}${prefix} ${entry.title}${summary}`);
-          lines.push(`${indent}  ID: ${entry.id}`);
-          if (entry.children?.length) {
-            for (const child of entry.children) renderEntry(child, indent + "  ");
-          }
-        };
-        if (args.tree) {
-          for (const entry of toc) renderEntry(entry, "");
-        } else {
-          for (const entry of toc) {
-            const prefix = "#".repeat(entry.level || 1);
-            const summary = entry.summary ? ` \u2014 ${entry.summary}` : "";
-            lines.push(`${prefix} ${entry.title} [${entry.filePath}]${summary}`);
-            lines.push(`  ID: ${entry.id}`);
-          }
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_docs_search": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableDocs) return "Documentation indexing is not enabled. Set enableDocs: true in .kirograph/config.json and run kirograph index.";
-        const { DocsQueries } = await Promise.resolve().then(() => require("../docs/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDocsSchema();
-        const docs = new DocsQueries(db.getRawDb(), projectRoot, config);
-        const results = await docs.searchSections(args.query, {
-          file: args.file,
-          limit: args.limit ?? 10
-        });
-        if (results.length === 0) return `No documentation sections found matching "${args.query}".`;
-        return results.map((r, i) => {
-          const summary = r.section.summary ? `
-  ${r.section.summary}` : "";
-          return `${i + 1}. ${r.section.title} [${r.section.filePath}]${summary}
-  ID: ${r.section.id}`;
-        }).join("\n\n");
-      }
-      case "kirograph_docs_section": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableDocs) return "Documentation indexing is not enabled. Set enableDocs: true in .kirograph/config.json and run kirograph index.";
-        const { DocsQueries } = await Promise.resolve().then(() => require("../docs/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDocsSchema();
-        const docs = new DocsQueries(db.getRawDb(), projectRoot);
-        const result = docs.getSection(args.id, { context: args.context });
-        if (!result) return `Section "${args.id}" not found.`;
-        const lines = [];
-        if (result.ancestors?.length) {
-          lines.push("Breadcrumb: " + result.ancestors.map((a) => a.title).join(" > ") + " > " + result.section.title);
-          lines.push("");
-        }
-        lines.push(result.content);
-        if (result.children?.length) {
-          lines.push("", "## Child sections:");
-          for (const child of result.children) {
-            const summary = child.summary ? ` \u2014 ${child.summary}` : "";
-            lines.push(`  - ${child.title}${summary} (ID: ${child.id})`);
-          }
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_docs_outline": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableDocs) return "Documentation indexing is not enabled. Set enableDocs: true in .kirograph/config.json and run kirograph index.";
-        const { DocsQueries } = await Promise.resolve().then(() => require("../docs/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDocsSchema();
-        const docs = new DocsQueries(db.getRawDb(), projectRoot);
-        const outline = docs.getOutline(args.file);
-        if (outline.length === 0) return `No sections found in "${args.file}". Is the file indexed?`;
-        const lines = [`Outline: ${args.file}`, ""];
-        const renderOutline = (entries, indent) => {
-          for (const entry of entries) {
-            const summary = entry.summary ? ` \u2014 ${entry.summary}` : "";
-            lines.push(`${indent}${"#".repeat(entry.level || 1)} ${entry.title}${summary}`);
-            if (entry.children?.length) renderOutline(entry.children, indent + "  ");
-          }
-        };
-        renderOutline(outline, "");
-        return lines.join("\n");
-      }
-      case "kirograph_docs_refs": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableDocs) return "Documentation indexing is not enabled. Set enableDocs: true in .kirograph/config.json and run kirograph index.";
-        const { DocsQueries } = await Promise.resolve().then(() => require("../docs/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDocsSchema();
-        const docs = new DocsQueries(db.getRawDb(), projectRoot);
-        const refs = docs.getRefs({
-          sectionId: args.sectionId,
-          qualifiedName: args.nodeId
-        });
-        if (refs.length === 0) {
-          if (args.sectionId) return `No code references found in section "${args.sectionId}".`;
-          if (args.nodeId) return `No documentation sections reference "${args.nodeId}".`;
-          return "Provide either sectionId or nodeId to look up cross-references.";
-        }
-        return refs.map((r) => {
-          const direction = args.sectionId ? `\u2192 ${r.qualifiedName}` : `\u2190 ${r.sectionTitle ?? r.sectionId}`;
-          return `[${r.refType}] ${direction} (confidence: ${r.confidence.toFixed(2)})`;
-        }).join("\n");
-      }
-      // ── Data tools ────────────────────────────────────────────────────────────
-      case "kirograph_data_list": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        const datasets = dq.listDatasets();
-        if (datasets.length === 0) return "No datasets indexed. Run kirograph index or kirograph data reindex.";
-        return datasets.map((ds) => {
-          const sizeMb = (ds.fileSize / 1024 / 1024).toFixed(2);
-          return `${ds.id} (${ds.format})
-  File: ${ds.filePath}
-  Rows: ${ds.rowCount.toLocaleString()} | Columns: ${ds.columnCount} | Size: ${sizeMb} MB`;
-        }).join("\n\n");
-      }
-      case "kirograph_data_describe": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        if (args.column) {
-          const col = dq.describeColumn(args.dataset, args.column);
-          if (!col) return `Column "${args.column}" not found in dataset "${args.dataset}".`;
-          return [
-            `Column: ${col.name}`,
-            `Type: ${col.inferredType}`,
-            `Nullable: ${col.nullable} (${(col.nullPct * 100).toFixed(1)}% null)`,
-            `Cardinality: ${col.cardinality}`,
-            col.minValue ? `Min: ${col.minValue}` : "",
-            col.maxValue ? `Max: ${col.maxValue}` : "",
-            col.meanValue !== null ? `Mean: ${col.meanValue.toFixed(2)}` : "",
-            `Samples: ${col.sampleValues.join(", ")}`
-          ].filter(Boolean).join("\n");
-        }
-        const result = dq.describeDataset(args.dataset);
-        if (!result) return `Dataset "${args.dataset}" not found. Use kirograph_data_list to see available datasets.`;
-        const lines = [
-          `Dataset: ${result.dataset.id} (${result.dataset.format})`,
-          `File: ${result.dataset.filePath}`,
-          `Rows: ${result.dataset.rowCount.toLocaleString()} | Columns: ${result.dataset.columnCount}`,
-          "",
-          "Columns:"
-        ];
-        for (const col of result.columns) {
-          const nullInfo = col.nullable ? ` (${(col.nullPct * 100).toFixed(0)}% null)` : "";
-          const samples = col.sampleValues.length > 0 ? ` \u2014 samples: ${col.sampleValues.slice(0, 3).join(", ")}` : "";
-          const summary = col.summary ? ` [${col.summary}]` : "";
-          lines.push(`  ${col.name}: ${col.inferredType}${nullInfo} [${col.cardinality} distinct]${samples}${summary}`);
-        }
-        const rules = dq.validationRules(args.dataset);
-        if (rules && rules.length > 0) {
-          lines.push("", "Validation rules:");
-          for (const r of rules.slice(0, 10)) {
-            lines.push(`  ${r.column}: ${r.rules.join("; ")}`);
-          }
-        }
-        const hints = dq.sampleHints(args.dataset);
-        if (hints && hints.length > 0) {
-          lines.push("", "Sample data hints:");
-          for (const h of hints.slice(0, 10)) {
-            lines.push(`  ${h.column}: ${h.hint}`);
-          }
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_data_query": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        const result = dq.queryRows(args.dataset, {
-          filters: args.filters,
-          columns: args.columns,
-          limit: args.limit ?? 100,
-          offset: args.offset ?? 0
-        });
-        if (!result) return `Dataset "${args.dataset}" not found.`;
-        if (result.rows.length === 0) return `No rows match the given filters (${result.totalMatching} total in dataset).`;
-        const header = `${result.rows.length} rows returned (${result.totalMatching} total matching):
-`;
-        const rowStrs = result.rows.slice(0, 50).map((row, i) => {
-          const vals = Object.entries(row).map(([k, v]) => `${k}=${v ?? "null"}`).join(", ");
-          return `  ${i + 1}. ${vals}`;
-        });
-        if (result.rows.length > 50) rowStrs.push(`  \u2026and ${result.rows.length - 50} more rows`);
-        let response = header + rowStrs.join("\n");
-        const maxChars = config.dataMaxResponseTokens * 4;
-        if (response.length > maxChars) {
-          response = response.slice(0, maxChars) + "\n\n[truncated: response exceeded token budget]";
-        }
-        response = this.checkPaginationLoop(args.dataset, args.offset, response);
-        return response;
-      }
-      case "kirograph_data_aggregate": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        const result = dq.aggregate(args.dataset, {
-          groupBy: args.groupBy ?? [],
-          metrics: args.metrics ?? [],
-          filters: args.filters
-        });
-        if (!result) return `Dataset "${args.dataset}" not found.`;
-        if (result.rows.length === 0) return "No results (empty dataset or all rows filtered out).";
-        const keys = Object.keys(result.rows[0]);
-        const header = keys.join(" | ");
-        const separator = keys.map(() => "---").join(" | ");
-        const rows = result.rows.slice(0, 100).map((row) => keys.map((k) => row[k] ?? "null").join(" | "));
-        let response = `${header}
-${separator}
-${rows.join("\n")}${result.rows.length > 100 ? `
-\u2026and ${result.rows.length - 100} more groups` : ""}`;
-        const maxChars = config.dataMaxResponseTokens * 4;
-        if (response.length > maxChars) {
-          response = response.slice(0, maxChars) + "\n\n[truncated: response exceeded token budget]";
-        }
-        return response;
-      }
-      case "kirograph_data_search": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        const cols = dq.searchColumns(args.dataset, args.query);
-        if (cols.length === 0) return `No columns matching "${args.query}" in dataset "${args.dataset}".`;
-        return cols.map((c) => {
-          const samples = c.sampleValues.length > 0 ? ` \u2014 samples: ${c.sampleValues.slice(0, 3).join(", ")}` : "";
-          return `${c.name}: ${c.inferredType} [${c.cardinality} distinct]${samples}`;
-        }).join("\n");
-      }
-      case "kirograph_data_join": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        try {
-          const result = dq.join({
-            left: args.left,
-            right: args.right,
-            leftColumn: args.leftColumn,
-            rightColumn: args.rightColumn,
-            type: args.type ?? "inner",
-            columns: args.columns,
-            limit: args.limit
-          });
-          if (!result) return `Dataset not found. Verify both dataset IDs with kirograph_data_list.`;
-          const joinTypeStr = String(args.type ?? "inner").toUpperCase();
-          const header = `Join: ${args.left}.${args.leftColumn} ${joinTypeStr} JOIN ${args.right}.${args.rightColumn}
-Matching rows: ${result.totalMatching} (showing ${result.rows.length})`;
-          if (result.rows.length === 0) return `${header}
-
-No matching rows.`;
-          const lines = result.rows.map((r) => JSON.stringify(r));
-          let response = `${header}
-
-${lines.join("\n")}`;
-          const maxChars = config.dataMaxResponseTokens * 4;
-          if (response.length > maxChars) {
-            response = response.slice(0, maxChars) + "\n\n[truncated: response exceeded token budget]";
-          }
-          return response;
-        } catch (err) {
-          return `Error: ${err instanceof Error ? err.message : String(err)}`;
-        }
-      }
-      case "kirograph_data_correlations": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        const pairs = dq.correlations(args.dataset, args.threshold);
-        if (pairs === null) return `Dataset "${args.dataset}" not found.`;
-        if (pairs.length === 0) return `No correlations above threshold ${args.threshold ?? 0.3} found. The dataset may have fewer than 2 numeric columns or no significant correlations.`;
-        const lines = pairs.map(
-          (p) => `${p.column1} \u2194 ${p.column2}: ${p.correlation > 0 ? "+" : ""}${p.correlation.toFixed(4)} (${p.strength})`
-        );
-        return `Correlations for "${args.dataset}" (threshold: ${args.threshold ?? 0.3}):
-
-${lines.join("\n")}`;
-      }
-      case "kirograph_data_quality": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        const quality = dq.quality(args.dataset);
-        if (quality === null) return `Dataset "${args.dataset}" not found.`;
-        if (quality.length === 0) return `No quality issues detected in "${args.dataset}". All columns look healthy.`;
-        const lines = quality.map(
-          (q) => `${q.column} (risk: ${(q.riskScore * 100).toFixed(0)}%): ${q.issues.join("; ")}`
-        );
-        return `Quality report for "${args.dataset}" (${quality.length} columns with issues):
-
-${lines.join("\n")}`;
-      }
-      case "kirograph_data_drift": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        const drift = dq.detectDrift(args.dataset);
-        if (drift === null) return `Dataset "${args.dataset}" not found.`;
-        if (!drift.hasDrift) {
-          const rowDelta = drift.rowCountDelta !== 0 ? ` (rows: ${drift.rowCountDelta > 0 ? "+" : ""}${drift.rowCountDelta})` : "";
-          return `No schema drift detected for "${args.dataset}".${rowDelta}`;
-        }
-        const driftLines = [`Schema drift detected for "${args.dataset}":`];
-        if (drift.addedColumns?.length) driftLines.push(`  Added columns: ${drift.addedColumns.join(", ")}`);
-        if (drift.removedColumns?.length) driftLines.push(`  Removed columns: ${drift.removedColumns.join(", ")}`);
-        if (drift.typeChanges?.length) {
-          for (const tc of drift.typeChanges) {
-            driftLines.push(`  Type change: ${tc.column} ${tc.from} \u2192 ${tc.to}`);
-          }
-        }
-        if (drift.rowCountDelta !== 0) driftLines.push(`  Row count delta: ${drift.rowCountDelta > 0 ? "+" : ""}${drift.rowCountDelta}`);
-        return driftLines.join("\n");
-      }
-      case "kirograph_data_history": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableData) return "Data indexing is not enabled. Set enableData: true in .kirograph/config.json and run kirograph index.";
-        const { DataQueries } = await Promise.resolve().then(() => require("../data/queries.js"));
-        const db = cg.getDatabase();
-        db.applyDataSchema();
-        const dq = new DataQueries(db.getRawDb());
-        const limit = Math.min(Number(args.limit ?? 10), 50);
-        const history = dq.getHistory(args.dataset, limit);
-        if (history === null) return `Dataset "${args.dataset}" not found.`;
-        if (history.length === 0) return `No history snapshots for "${args.dataset}".`;
-        const histLines = [`Schema history for "${args.dataset}" (${history.length} snapshot(s)):
-`];
-        for (const snap of history) {
-          const date = new Date(snap.snapshotAt).toISOString().replace("T", " ").slice(0, 19);
-          const colNames = snap.columns.map((c) => c.name).join(", ");
-          histLines.push(`${date}  rows: ${snap.rowCount.toLocaleString()}  cols: ${snap.columnCount}  schema: ${colNames}`);
-        }
-        return histLines.join("\n");
-      }
-      // ── Watchmen tools (require enableMemory + enableWatchmen) ────────────────
-      case "kirograph_watchmen_status": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled. Set enableMemory: true in .kirograph/config.json";
-        if (!config.enableWatchmen) return "Watchmen is not enabled. Set enableWatchmen: true in .kirograph/config.json";
-        const { WatchmenChecker } = await Promise.resolve().then(() => require("../watchmen/index.js"));
-        const { MemoryDatabase } = await Promise.resolve().then(() => require("../memory/database.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const memDb = new MemoryDatabase(db.getRawDb());
-        memDb.initialize();
-        const checker = new WatchmenChecker(config.watchmenThreshold);
-        const { ready, pendingCount } = checker.shouldSynthesize(memDb);
-        const { targetFiles } = checker.buildReadyResponse("", pendingCount, projectRoot);
-        const statusLines = [
-          `Watchmen Status:`,
-          `  Pending observations: ${pendingCount} / ${config.watchmenThreshold} threshold`,
-          `  Ready to synthesize:  ${ready ? "yes" : "no"}`,
-          `  Target files:`
-        ];
-        for (const f of targetFiles) statusLines.push(`    \xB7 ${f}`);
-        return statusLines.join("\n");
-      }
-      case "kirograph_watchmen_synthesize": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory || !config.enableWatchmen) return "Watchmen is not enabled (enableMemory + enableWatchmen required).";
-        if (config.watchmenSynthesisMode !== "local") return 'watchmenSynthesisMode is not "local" \u2014 use the agent hook instead.';
-        const { WatchmenChecker } = await Promise.resolve().then(() => require("../watchmen/index.js"));
-        const { MemoryDatabase } = await Promise.resolve().then(() => require("../memory/database.js"));
-        const { runLocalSynthesis } = await Promise.resolve().then(() => require("../watchmen/synthesize.js"));
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const memDb = new MemoryDatabase(db.getRawDb());
-        memDb.initialize();
-        const checker = new WatchmenChecker(config.watchmenThreshold);
-        const { ready, pendingCount } = checker.shouldSynthesize(memDb);
-        if (!ready && !args.force) {
-          return `Watchmen: ${pendingCount}/${config.watchmenThreshold} observations \u2014 threshold not reached. Pass force: true to run anyway.`;
-        }
-        const observations = memDb.getObservationsSinceLastSummary(50);
-        if (observations.length === 0) return "No observations to synthesize.";
-        const readyResult = checker.buildReadyResponse("", pendingCount, projectRoot);
-        const result = await runLocalSynthesis(observations, readyResult, config.watchmenLocalModel, projectRoot, true);
-        const mgr = new MemoryManager(config, db.getRawDb(), projectRoot);
-        mgr.initialize();
-        await mgr.store({ content: result.summaryObservation, kind: "summary", source: "agent" });
-        const synthLines = [`Watchmen synthesis complete.`];
-        if (result.filesWritten.length) synthLines.push(`Brief written to: ${result.filesWritten.join(", ")}`);
-        if (result.skillsWritten.length) synthLines.push(`Skills written: ${result.skillsWritten.join(", ")}`);
-        if (result.skillsPruned.length) synthLines.push(`Pruned stale: ${result.skillsPruned.join(", ")}`);
-        return synthLines.join("\n");
-      }
-      case "kirograph_watchmen_reset": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableMemory) return "Memory is not enabled.";
-        if (!config.enableWatchmen) return "Watchmen is not enabled.";
-        const { MemoryManager } = await Promise.resolve().then(() => require("../memory/index.js"));
-        const db = cg.getDatabase();
-        db.applyMemorySchema();
-        const mgr = new MemoryManager(config, db.getRawDb(), projectRoot);
-        mgr.initialize();
-        const id = await mgr.store({ content: `Watchmen counter reset via MCP at ${(/* @__PURE__ */ new Date()).toISOString()}.`, kind: "summary", source: "manual" });
-        return id ? "Watchmen counter reset \u2014 pending observations set back to 0." : "Already at zero \u2014 nothing to reset.";
-      }
-      // ── Affected tests ────────────────────────────────────────────────────────
-      case "kirograph_affected": {
-        const files = args.files ?? [];
-        if (files.length === 0) return 'No files provided. Pass file paths in the "files" array.';
-        const affected = cg.getAffectedTests(files, {
-          depth: args.depth ?? 5,
-          testPattern: args.testPattern
-        });
-        if (affected.length === 0) return `No affected test files found for the provided ${files.length} changed file(s).`;
-        return `Affected test files (${affected.length}) for ${files.length} changed file(s):
-
-` + affected.map((f) => `- ${f}`).join("\n");
-      }
-      // ── Security tools (require enableSecurity=true) ──────────────────────────
-      case "kirograph_security": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        if (!config.enableArchitecture) return "Security requires architecture analysis. Set enableArchitecture: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const rawDb = db.getRawDb();
-        const depCount = rawDb.get(
-          `SELECT COUNT(*) as count FROM sec_dependencies`
-        ) ?? { count: 0 };
-        const vulnCount = rawDb.get(
-          `SELECT COUNT(*) as count FROM sec_vulnerabilities`
-        ) ?? { count: 0 };
-        const verdictRows = rawDb.all(
-          `SELECT verdict, COUNT(*) as count FROM sec_reachability GROUP BY verdict`
-        );
-        const verdicts = {};
-        for (const row of verdictRows) {
-          verdicts[row.verdict] = row.count;
-        }
-        const staleCount = rawDb.get(
-          `SELECT COUNT(*) as count FROM sec_dependencies WHERE vuln_data_stale = 1`
-        ) ?? { count: 0 };
-        const { SuppressionManager: SecSuppressionManager } = await Promise.resolve().then(() => require("../security/suppressions.js"));
-        const secSuppressions = new SecSuppressionManager(projectRoot);
-        const allCveIds = rawDb.all(`SELECT cve_id FROM sec_vulnerabilities`);
-        const suppressedCveCount = allCveIds.filter((r) => secSuppressions.isSuppressed(r.cve_id)).length;
-        const visibleVulnCount = vulnCount.count - suppressedCveCount;
-        const lines = [
-          "# Security Overview",
-          "",
-          `Dependencies: ${depCount.count}`,
-          `Vulnerabilities: ${visibleVulnCount}${suppressedCveCount > 0 ? ` (${suppressedCveCount} suppressed)` : ""}`
-        ];
-        if (visibleVulnCount > 0) {
-          const affected = verdicts["affected"] ?? 0;
-          const notAffected = verdicts["not_affected"] ?? 0;
-          const underInvestigation = verdicts["under_investigation"] ?? 0;
-          const pending = visibleVulnCount - affected - notAffected - underInvestigation;
-          lines.push("", "## Reachability Verdicts", "");
-          if (affected > 0) lines.push(`\u25CF Affected: ${affected}`);
-          if (notAffected > 0) lines.push(`\u25CF Not affected: ${notAffected}`);
-          if (underInvestigation > 0) lines.push(`\u25CF Under investigation: ${underInvestigation}`);
-          if (pending > 0) lines.push(`\u25CF Pending analysis: ${pending}`);
-        }
-        if (staleCount.count > 0) {
-          lines.push("", `\u26A0 ${staleCount.count} dependenc${staleCount.count === 1 ? "y has" : "ies have"} stale vulnerability data. Use kirograph_vulns with refresh=true to update.`);
-        }
-        const lastVulnCheck = rawDb.get(
-          `SELECT MIN(last_vuln_check) as oldest FROM sec_dependencies WHERE last_vuln_check IS NOT NULL`
-        )?.oldest;
-        if (lastVulnCheck != null) {
-          const ageMs = Date.now() - lastVulnCheck;
-          const ageDays = ageMs / (1e3 * 60 * 60 * 24);
-          const maxAge = config.securityEnrichMaxAgeDays ?? 7;
-          if (ageDays > maxAge) {
-            lines.push("", `\u26A0 Vulnerability data is ${Math.floor(ageDays)} days old (max: ${maxAge}). Run kirograph vulns --refresh to update.`);
-          }
-        }
-        try {
-          const rawDbSec = db.getRawDb();
-          const tableExistsSec = rawDbSec.get("SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'");
-          if (tableExistsSec) {
-            const patternCount = rawDbSec.get("SELECT COUNT(*) as cnt FROM pattern_matches")?.cnt ?? 0;
-            if (patternCount > 0) {
-              const critCount = rawDbSec.get("SELECT COUNT(*) as cnt FROM pattern_matches WHERE severity = 'critical'")?.cnt ?? 0;
-              lines.push(`SAST findings: ${patternCount} pattern matches (${critCount} critical)`);
-            }
-          }
-        } catch {
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_vulns": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const rawDb = db.getRawDb();
-        if (args.refresh === true) {
-          const { OsvAdapter } = await Promise.resolve().then(() => require("../security/vuln/osv-adapter.js"));
-          const { VulnerabilityDatabaseClient } = await Promise.resolve().then(() => require("../security/vuln/client.js"));
-          const adapters = config.securityDatabases.map((dbName) => {
-            if (dbName.toUpperCase() === "OSV") return new OsvAdapter();
-            return null;
-          }).filter(Boolean);
-          const client = new VulnerabilityDatabaseClient(adapters, db);
-          await client.enrichAll();
-        }
-        let query = `
-          SELECT
-            v.node_id, v.cve_id, v.severity_score, v.fixed_version, v.summary,
-            v.epss_score, v.epss_percentile, v.risk_score,
-            d.package_name, d.ecosystem, d.resolved_version, d.declared_constraint,
-            r.verdict
-          FROM sec_vulnerabilities v
-          LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
-          LEFT JOIN sec_dependencies d ON d.node_id = e.source
-          LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id
-          WHERE 1=1
-        `;
-        const params = [];
-        if (args.severity) {
-          const severityRanges = {
-            critical: [9, 10],
-            high: [7, 8.9],
-            medium: [4, 6.9],
-            low: [0.1, 3.9]
-          };
-          const range = severityRanges[args.severity.toLowerCase()];
-          if (!range) return `Invalid severity: ${args.severity}. Use: critical, high, medium, low`;
-          query += ` AND v.severity_score >= ? AND v.severity_score <= ?`;
-          params.push(range[0], range[1]);
-        }
-        if (args.verdict) {
-          const validVerdicts = ["affected", "not_affected", "under_investigation"];
-          if (!validVerdicts.includes(args.verdict)) {
-            return `Invalid verdict: ${args.verdict}. Use: affected, not_affected, under_investigation`;
-          }
-          query += ` AND r.verdict = ?`;
-          params.push(args.verdict);
-        }
-        const limit = clampLimit(args.limit, 20);
-        query += ` ORDER BY v.risk_score DESC NULLS LAST LIMIT ?`;
-        params.push(limit);
-        const rows = rawDb.all(query, params);
-        const verdictRankMcp = (v) => v === "affected" ? 3 : v === "under_investigation" ? 2 : v === "not_affected" ? 1 : 0;
-        const dedupMapMcp = /* @__PURE__ */ new Map();
-        for (const row of rows) {
-          const key = `${row.cve_id}::${row.package_name ?? ""}::${row.ecosystem ?? ""}`;
-          const ex = dedupMapMcp.get(key);
-          if (!ex || verdictRankMcp(row.verdict) > verdictRankMcp(ex.verdict)) dedupMapMcp.set(key, row);
-        }
-        const dedupedRowsMcp = [...dedupMapMcp.values()];
-        const { SuppressionManager } = await Promise.resolve().then(() => require("../security/suppressions.js"));
-        const suppressionMgr = new SuppressionManager(projectRoot);
-        const suppressedCount = dedupedRowsMcp.filter((row) => suppressionMgr.isSuppressed(row.cve_id)).length;
-        const filteredRows = dedupedRowsMcp.filter((row) => !suppressionMgr.isSuppressed(row.cve_id));
-        if (filteredRows.length === 0) {
-          const noMatch = "No vulnerabilities found" + (args.severity || args.verdict ? " matching filters." : ".");
-          return suppressedCount > 0 ? `${noMatch} (${suppressedCount} suppressed)` : noMatch;
-        }
-        const { formatFixSuggestion } = await Promise.resolve().then(() => require("../security/export/fix-suggestions.js"));
-        const lines = [`Vulnerabilities (${filteredRows.length}${suppressedCount > 0 ? `, ${suppressedCount} suppressed` : ""}):
-`];
-        for (const row of filteredRows) {
-          const score = row.severity_score;
-          let severityLabel;
-          if (score == null) severityLabel = "UNKNOWN";
-          else if (score >= 9) severityLabel = "CRITICAL";
-          else if (score >= 7) severityLabel = "HIGH";
-          else if (score >= 4) severityLabel = "MEDIUM";
-          else severityLabel = "LOW";
-          let verdictLabel;
-          if (!row.verdict) verdictLabel = "pending";
-          else if (row.verdict === "affected") verdictLabel = "affected";
-          else if (row.verdict === "not_affected") verdictLabel = "not affected";
-          else verdictLabel = "investigating";
-          const pkg = row.package_name ? `${row.package_name}@${row.resolved_version || row.declared_constraint || "?"}` : "unknown package";
-          const epssNote = row.epss_score != null ? ` [EPSS: ${row.epss_score.toFixed(2)}]` : "";
-          const riskNote = row.risk_score != null ? ` [Risk: ${row.risk_score.toFixed(1)}]` : "";
-          lines.push(`${severityLabel}  ${row.cve_id}  ${pkg}  [${verdictLabel}]${epssNote}${riskNote}`);
-          if (row.summary && row.summary !== "Manually registered") {
-            const truncSummary = row.summary.length > 120 ? row.summary.slice(0, 120) + "\u2026" : row.summary;
-            lines.push(`  ${truncSummary}`);
-          }
-          if (row.fixed_version && row.ecosystem && row.package_name) {
-            const fix = formatFixSuggestion(row.ecosystem, row.package_name, row.fixed_version);
-            if (fix) lines.push(`  ${fix}`);
-          }
-        }
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_vuln_add": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const cveId = args.cveId;
-        const pkgName = args.package;
-        if (!cveId) return "Error: cveId is required.";
-        if (!pkgName) return "Error: package is required.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const rawDb = db.getRawDb();
-        const depRow = rawDb.get(
-          `SELECT node_id, ecosystem FROM sec_dependencies WHERE package_name = ?`,
-          [pkgName]
-        );
-        if (!depRow) {
-          return `No dependency found matching "${pkgName}". Run kirograph index first to discover dependencies.`;
-        }
-        const vulnNodeId = `vuln:${cveId}`;
-        const now = Date.now();
-        const severity = args.severity;
-        const summary = args.summary ?? "Manually registered";
-        const fixedVersion = args.fixedVersion ?? null;
-        rawDb.run(
-          `INSERT OR REPLACE INTO nodes
-            (id, kind, name, qualified_name, file_path, language,
-             start_line, end_line, start_column, end_column,
-             is_exported, is_async, is_static, is_abstract, updated_at)
-           VALUES (?, 'vulnerability', ?, ?, '', 'unknown', 0, 0, 0, 0, 0, 0, 0, 0, ?)`,
-          [vulnNodeId, cveId, cveId, now]
-        );
-        rawDb.run(
-          `INSERT OR REPLACE INTO sec_vulnerabilities
-            (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)
-           VALUES (?, ?, ?, '[]', ?, ?, 'manual')`,
-          [vulnNodeId, cveId, severity ?? null, fixedVersion, summary]
-        );
-        rawDb.run(
-          `INSERT OR IGNORE INTO edges (source, target, kind, confidence, confidence_score)
-           VALUES (?, ?, 'has_vulnerability', 'extracted', 1.0)`,
-          [depRow.node_id, vulnNodeId]
-        );
-        return `Registered ${cveId} against ${pkgName}.`;
-      }
-      case "kirograph_vuln_suppress": {
-        const projectRoot = cg.getProjectRoot();
-        const cveId = args.cveId;
-        if (!cveId) return "Error: cveId is required.";
-        const { SuppressionManager } = await Promise.resolve().then(() => require("../security/suppressions.js"));
-        const manager = new SuppressionManager(projectRoot);
-        manager.add(cveId, args.reason, args.expires);
-        const reasonNote = args.reason ? ` Reason: ${args.reason}.` : "";
-        const expiresNote = args.expires ? ` Expires: ${args.expires}.` : "";
-        return `${cveId} suppressed.${reasonNote}${expiresNote}`;
-      }
-      case "kirograph_sbom": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const { SBOMExporter } = await Promise.resolve().then(() => require("../security/export/sbom.js"));
-        const exporter = new SBOMExporter(db, projectRoot);
-        const json = exporter.exportJSON();
-        return truncate(json);
-      }
-      case "kirograph_vex": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const { VEXExporter } = await Promise.resolve().then(() => require("../security/export/vex.js"));
-        const exporter = new VEXExporter(db, projectRoot);
-        const json = exporter.exportJSON();
-        return truncate(json);
-      }
-      case "kirograph_reachability": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const target = args.target;
-        if (!target) return "Error: target is required (dependency name or CVE ID).";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const rawDb = db.getRawDb();
-        let vulnerabilityNodeId = null;
-        let targetLabel = target;
-        const vulnRow = rawDb.get(
-          `SELECT node_id FROM sec_vulnerabilities WHERE cve_id = ?`,
-          [target]
-        );
-        if (vulnRow) {
-          vulnerabilityNodeId = vulnRow.node_id;
-        } else {
-          const depRow = rawDb.get(
-            `SELECT node_id, package_name FROM sec_dependencies WHERE package_name = ?`,
-            [target]
-          );
-          if (depRow) {
-            targetLabel = depRow.package_name;
-            const vulnEdge = rawDb.get(
-              `SELECT target FROM edges WHERE source = ? AND kind = 'has_vulnerability' LIMIT 1`,
-              [depRow.node_id]
-            );
-            if (vulnEdge) {
-              vulnerabilityNodeId = vulnEdge.target;
-            } else {
-              return `No vulnerabilities found for dependency "${target}". The dependency exists but has no known vulnerabilities.`;
-            }
-          } else {
-            return `Target "${target}" not found. Provide a valid CVE ID or dependency package name.`;
-          }
-        }
-        const { ReachabilityAnalyzer } = await Promise.resolve().then(() => require("../security/reachability.js"));
-        const analyzer = new ReachabilityAnalyzer(db, config);
-        const result = await analyzer.analyze(vulnerabilityNodeId);
-        const lines = [
-          `# Reachability: ${targetLabel}`,
-          "",
-          `Verdict: ${result.verdict}`,
-          `Reaching entry points: ${result.reachingEntryPointCount}`
-        ];
-        if (result.paths.length > 0) {
-          lines.push("", "## Paths");
-          for (const p of result.paths.slice(0, 5)) {
-            lines.push(`- From ${p.entryPoint}: ${p.path.join(" \u2192 ")}`);
-          }
-          if (result.paths.length > 5) {
-            lines.push(`  \u2026and ${result.paths.length - 5} more paths`);
-          }
-        }
-        if (result.unresolvedSymbols.length > 0) {
-          lines.push("", "## Unresolved Symbols");
-          for (const sym of result.unresolvedSymbols.slice(0, 10)) {
-            lines.push(`- ${sym}`);
-          }
-          if (result.unresolvedSymbols.length > 10) {
-            lines.push(`  \u2026and ${result.unresolvedSymbols.length - 10} more`);
-          }
-        }
-        if (result.verdict === "affected") {
-          const impact = await analyzer.getImpactSummary(vulnerabilityNodeId);
-          if (impact) {
-            lines.push("", "## Impact Summary");
-            if (impact.affectedLayers.length > 0) {
-              lines.push(`Affected layers: ${impact.affectedLayers.join(", ")}`);
-            }
-            lines.push(`Affected entry points: ${impact.affectedEntryPoints.length}`);
-            lines.push(`Distinct paths: ${impact.distinctPathCount}`);
-          }
-        }
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_staleness": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const rawDb = db.getRawDb();
-        const threshold = typeof args.threshold === "number" ? args.threshold : 0.3;
-        if (args.refresh === true) {
-          const { StalenessChecker } = await Promise.resolve().then(() => require("../security/staleness.js"));
-          const checker = new StalenessChecker(db);
-          await checker.checkAll();
-        }
-        const rows = rawDb.all(
-          `SELECT package_name, ecosystem, resolved_version, declared_constraint,
-                  latest_version, latest_published, staleness_score
-           FROM sec_dependencies
-           WHERE staleness_score >= ?
-           ORDER BY staleness_score DESC`,
-          [threshold]
-        );
-        if (rows.length === 0) {
-          return `No dependencies found with staleness_score >= ${threshold}.` + (args.refresh ? "" : " Use refresh=true to fetch latest version data from registries.");
-        }
-        const lines = [`Stale Dependencies (threshold: ${threshold}):
-`];
-        for (const row of rows) {
-          const resolved = row.resolved_version ?? row.declared_constraint ?? "?";
-          const latest = row.latest_version ?? "?";
-          const score = row.staleness_score ?? 0;
-          const months = row.latest_published ? Math.round((Date.now() - row.latest_published) / (1e3 * 60 * 60 * 24 * 30)) : null;
-          const bar = "\u2588".repeat(Math.round(score * 10)) + "\u2591".repeat(10 - Math.round(score * 10));
-          const monthsStr = months !== null ? `, ${months}mo since latest` : "";
-          lines.push(`${row.package_name} (${row.ecosystem}): ${resolved} \u2192 ${latest}${monthsStr}`);
-          lines.push(`  ${bar} ${score.toFixed(2)}`);
-        }
-        const totalCount = rawDb.get(`SELECT COUNT(*) as count FROM sec_dependencies`) ?? { count: 0 };
-        lines.push("", `${rows.length} of ${totalCount.count} dependencies are stale (score >= ${threshold})`);
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_licenses": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const rawDb = db.getRawDb();
-        const deps = rawDb.all(
-          `SELECT package_name, ecosystem, license FROM sec_dependencies ORDER BY ecosystem, package_name`
-        );
-        const { checkLicensePolicy } = await Promise.resolve().then(() => require("../security/license.js"));
-        const policy = config.securityLicensePolicy;
-        const violations = checkLicensePolicy(deps, policy);
-        if (args.policy === true) {
-          if (violations.length === 0) {
-            return "No license policy violations found.";
-          }
-          const lines2 = ["# License Policy Violations\n"];
-          for (const v of violations) {
-            lines2.push(`${v.severity.toUpperCase()}  ${v.packageName} [${v.ecosystem}]  ${v.license}`);
-          }
-          const denyCount2 = violations.filter((v) => v.severity === "deny").length;
-          const warnCount2 = violations.filter((v) => v.severity === "warn").length;
-          lines2.push("");
-          if (denyCount2 > 0) lines2.push(`${denyCount2} denied license${denyCount2 !== 1 ? "s" : ""}`);
-          if (warnCount2 > 0) lines2.push(`${warnCount2} license warning${warnCount2 !== 1 ? "s" : ""}`);
-          return truncate(lines2.join("\n"));
-        }
-        if (deps.length === 0) {
-          return "No dependencies found. Run kirograph index first.";
-        }
-        const violationMap = /* @__PURE__ */ new Map();
-        for (const v of violations) {
-          violationMap.set(`${v.ecosystem}:${v.packageName}`, v.severity);
-        }
-        const lines = [`# License Report (${deps.length} dependencies)
-`];
-        if (violations.length > 0) {
-          lines.push("## Policy Violations\n");
-          for (const v of violations) {
-            lines.push(`${v.severity.toUpperCase()}  ${v.packageName} [${v.ecosystem}]  ${v.license}`);
-          }
-          lines.push("");
-        }
-        lines.push("## All Dependencies\n");
-        lines.push("package | ecosystem | license | status");
-        lines.push("------- | --------- | ------- | ------");
-        for (const dep of deps) {
-          const key = `${dep.ecosystem}:${dep.package_name}`;
-          const violation = violationMap.get(key);
-          const license = dep.license ?? "(unknown)";
-          const status = violation ?? (dep.license ? "ok" : "unknown");
-          lines.push(`${dep.package_name} | ${dep.ecosystem} | ${license} | ${status}`);
-        }
-        const denyCount = violations.filter((v) => v.severity === "deny").length;
-        const warnCount = violations.filter((v) => v.severity === "warn").length;
-        const unknownCount = deps.filter((d) => !d.license).length;
-        lines.push("");
-        if (denyCount > 0) lines.push(`${denyCount} denied license${denyCount !== 1 ? "s" : ""}`);
-        if (warnCount > 0) lines.push(`${warnCount} license warning${warnCount !== 1 ? "s" : ""}`);
-        if (unknownCount > 0) lines.push(`${unknownCount} unknown license${unknownCount !== 1 ? "s" : ""}`);
-        if (denyCount === 0 && warnCount === 0) lines.push("No policy violations");
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_attack_surface": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const { AttackSurfaceAnalyzer } = await Promise.resolve().then(() => require("../security/attack-surface.js"));
-        const analyzer = new AttackSurfaceAnalyzer(db);
-        const result = await analyzer.analyze();
-        if (result.totalRoutes === 0) {
-          return "No route nodes found in the graph. Ensure the project has been indexed with architecture analysis enabled.";
-        }
-        const limit = clampLimit(args.limit, 20);
-        const routes = args.publicOnly === true ? result.criticalPaths.filter((r) => r.exposureLevel === "public") : result.criticalPaths;
-        const lines = [
-          "# Attack Surface",
-          "",
-          `Total routes: ${result.totalRoutes}  Public: ${result.publicRoutes}  Authenticated: ${result.authenticatedRoutes}  Routes with vulns: ${result.routesWithVulns}`,
-          ""
-        ];
-        const displayed = routes.slice(0, limit);
-        if (displayed.length === 0) {
-          lines.push(args.publicOnly === true ? "No public routes with vulnerable dependencies found." : "No routes with vulnerable dependencies found.");
-        } else {
-          for (const entry of displayed) {
-            const authTag = entry.isAuthenticated ? "[auth]" : "[public]";
-            const riskTag = entry.riskScore > 0 ? ` risk=${entry.riskScore.toFixed(1)}` : "";
-            lines.push(`${authTag} ${entry.route} (${entry.exposureLevel})${riskTag}  ${entry.filePath}`);
-            for (const dep of entry.vulnerableDeps.slice(0, 3)) {
-              lines.push(`  \u2514 ${dep.cveId} via ${dep.packageName} (${dep.hopCount} hop${dep.hopCount !== 1 ? "s" : ""}${dep.verdict ? `, ${dep.verdict}` : ""})`);
-            }
-            if (entry.vulnerableDeps.length > 3) {
-              lines.push(`  \u2514 \u2026and ${entry.vulnerableDeps.length - 3} more vulns`);
-            }
-          }
-          if (routes.length > limit) {
-            lines.push("", `\u2026and ${routes.length - limit} more routes (increase limit to see all)`);
-          }
-        }
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_secrets": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const { SecretsScanner } = await Promise.resolve().then(() => require("../security/secrets.js"));
-        const scanner = new SecretsScanner(db, projectRoot);
-        const result = await scanner.scan({ includeTests: args.includeTests === true });
-        if (result.totalFindings === 0) {
-          return `No secrets found. Scanned ${result.filesScanned} file${result.filesScanned !== 1 ? "s" : ""}.`;
-        }
-        let findings = result.findings;
-        if (args.severity) {
-          findings = findings.filter((f) => f.severity === args.severity);
-        }
-        if (findings.length === 0) {
-          return `No secrets found matching severity "${args.severity}". Total findings (all severities): ${result.totalFindings}.`;
-        }
-        const lines = [
-          `# Secrets Scan (${result.filesScanned} files scanned)`,
-          "",
-          `Found: ${result.totalFindings}  Critical: ${result.criticalCount}  High: ${result.highCount}`,
-          ""
-        ];
-        for (const f of findings) {
-          lines.push(`${f.severity.toUpperCase()}  ${f.type}`);
-          lines.push(`  ${f.filePath}:${f.line}:${f.column}  snippet: ${f.snippet}`);
-          if (f.nodeName) {
-            lines.push(`  in function: ${f.nodeName}`);
-          }
-          if (f.entryPointCount > 0) {
-            lines.push(`  reachable from ${f.entryPointCount} entry point${f.entryPointCount !== 1 ? "s" : ""}`);
-          }
-        }
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_security_flows": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const { DataFlowAnalyzer } = await Promise.resolve().then(() => require("../security/data-flows.js"));
-        const analyzer = new DataFlowAnalyzer(db);
-        let findings = await analyzer.analyze();
-        const typeFilter = args.type ?? "all";
-        const TYPE_MAP = {
-          sql: "sql-injection",
-          eval: "dangerous-eval",
-          deserialize: "unsafe-deserialize",
-          path: "path-traversal",
-          crypto: "hardcoded-crypto"
-        };
-        if (typeFilter !== "all") {
-          const mapped = TYPE_MAP[typeFilter];
-          if (!mapped) return `Invalid type filter "${typeFilter}". Use: sql, eval, deserialize, path, crypto, all`;
-          findings = findings.filter((f) => f.type === mapped);
-        }
-        if (findings.length === 0) {
-          return typeFilter === "all" ? "No dangerous data flows detected." : `No "${typeFilter}" findings detected.`;
-        }
-        const lines = [
-          `# Security Flows (${findings.length} finding${findings.length !== 1 ? "s" : ""})`,
-          ""
-        ];
-        for (const f of findings) {
-          lines.push(`${f.severity.toUpperCase()}  [${f.owaspCategory}]  ${f.type}`);
-          lines.push(`  ${f.filePath}:${f.line}  symbol: ${f.symbol}`);
-          lines.push(`  ${f.description}`);
-          lines.push(`  Fix: ${f.recommendation}`);
-          lines.push("");
-        }
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_supply_chain": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const { SupplyChainChecker } = await Promise.resolve().then(() => require("../security/supply-chain.js"));
-        const checker = new SupplyChainChecker(db);
-        const { results, errors } = await checker.checkAll();
-        const RISK_ORDER = { critical: 0, high: 1, medium: 2, low: 3, unknown: 4 };
-        const thresholdArg = args.threshold;
-        const thresholdOrder = thresholdArg ? RISK_ORDER[thresholdArg] ?? 4 : 2;
-        const filtered = results.filter((r) => (RISK_ORDER[r.riskLevel] ?? 4) <= thresholdOrder).sort((a, b) => (RISK_ORDER[a.riskLevel] ?? 4) - (RISK_ORDER[b.riskLevel] ?? 4));
-        if (filtered.length === 0) {
-          return `No supply chain risks found at threshold "${thresholdArg ?? "medium"}" or above. Checked ${results.length} dependencies.`;
-        }
-        const lines = [
-          `# Supply Chain Health (${filtered.length} risks, threshold: ${thresholdArg ?? "medium"})`,
-          ""
-        ];
-        for (const r of filtered) {
-          const scoreStr = r.scorecardScore !== null ? ` scorecard=${r.scorecardScore.toFixed(1)}/10` : "";
-          const maintainerStr = r.maintainerCount !== null ? ` maintainers=${r.maintainerCount}` : "";
-          lines.push(`${r.riskLevel.toUpperCase()}  ${r.packageName} (${r.ecosystem})${scoreStr}${maintainerStr}`);
-          for (const reason of r.riskReasons) {
-            lines.push(`  \u2022 ${reason}`);
-          }
-        }
-        if (errors.length > 0) {
-          lines.push("", `\u26A0 ${errors.length} package${errors.length !== 1 ? "s" : ""} could not be checked (network errors)`);
-        }
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_dep_confusion": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const { DepConfusionChecker } = await Promise.resolve().then(() => require("../security/dep-confusion.js"));
-        const checker = new DepConfusionChecker(db);
-        const findings = await checker.check();
-        if (findings.length === 0) {
-          return "No dependency confusion vulnerabilities detected.";
-        }
-        const RISK_ORDER = { critical: 0, high: 1, medium: 2 };
-        const sorted = [...findings].sort((a, b) => (RISK_ORDER[a.riskLevel] ?? 3) - (RISK_ORDER[b.riskLevel] ?? 3));
-        const lines = [
-          `# Dependency Confusion (${findings.length} finding${findings.length !== 1 ? "s" : ""})`,
-          ""
-        ];
-        for (const f of sorted) {
-          lines.push(`${f.riskLevel.toUpperCase()}  ${f.packageName} (${f.ecosystem})`);
-          lines.push(`  ${f.explanation}`);
-          if (f.publicExists && f.publicVersion) {
-            lines.push(`  Public version: ${f.publicVersion}${f.publicPublishedAt ? `  published: ${f.publicPublishedAt}` : ""}`);
-          }
-        }
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_remediation": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableSecurity) return "Security analysis is not enabled. Set enableSecurity: true in .kirograph/config.json and run kirograph index.";
-        const db = cg.getDatabase();
-        db.applySecuritySchema();
-        const { RemediationTracker } = await Promise.resolve().then(() => require("../security/remediation.js"));
-        const tracker = new RemediationTracker(db);
-        let statuses = tracker.getStatus();
-        if (args.overdueOnly === true) {
-          statuses = statuses.filter((s) => s.isOverdue);
-        }
-        if (statuses.length === 0) {
-          return args.overdueOnly === true ? "No overdue vulnerabilities found." : "No open vulnerabilities with SLA tracking data found.";
-        }
-        const SLA_ORDER = { overdue: 0, warning: 1, no_fix: 2, ok: 3 };
-        statuses.sort((a, b) => {
-          const slaA = SLA_ORDER[a.slaStatus] ?? 3;
-          const slaB = SLA_ORDER[b.slaStatus] ?? 3;
-          if (slaA !== slaB) return slaA - slaB;
-          return (b.severity ?? 0) - (a.severity ?? 0);
-        });
-        const overdueCount = statuses.filter((s) => s.isOverdue).length;
-        const warningCount = statuses.filter((s) => s.slaStatus === "warning").length;
-        const lines = [
-          `# Remediation SLA (${statuses.length} open${overdueCount > 0 ? `, ${overdueCount} overdue` : ""}${warningCount > 0 ? `, ${warningCount} warning` : ""})`,
-          ""
-        ];
-        for (const s of statuses) {
-          const severityLabel = s.severity == null ? "UNKNOWN" : s.severity >= 9 ? "CRITICAL" : s.severity >= 7 ? "HIGH" : s.severity >= 4 ? "MEDIUM" : "LOW";
-          const slaTag = s.slaStatus === "overdue" ? "[OVERDUE]" : s.slaStatus === "warning" ? "[WARNING]" : s.slaStatus === "no_fix" ? "[NO_FIX]" : "[OK]";
-          lines.push(`${slaTag}  ${severityLabel}  ${s.cveId}  ${s.packageName}`);
-          if (s.daysOpen !== null) lines.push(`  Open for ${s.daysOpen} day${s.daysOpen !== 1 ? "s" : ""}`);
-          if (s.daysWithFixAvailable !== null) lines.push(`  Fix available for ${s.daysWithFixAvailable} day${s.daysWithFixAvailable !== 1 ? "s" : ""}`);
-          if (s.slaDeadline !== null) {
-            const deadlineDate = new Date(s.slaDeadline).toISOString().slice(0, 10);
-            lines.push(`  SLA deadline: ${deadlineDate}`);
-          }
-        }
-        return truncate(lines.join("\n"));
-      }
-      case "kirograph_live_search": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enablePatterns) {
-          return "kirograph_live_search requires enablePatterns: true in .kirograph/config.json";
-        }
-        const { PatternRunner } = await Promise.resolve().then(() => require("../patterns/runner.js"));
-        const runner = new PatternRunner();
-        if (!runner.isAvailable()) {
-          return "kirograph_live_search requires @ast-grep/napi. Run: npm install @ast-grep/napi";
-        }
-        const pattern = args.pattern;
-        const language = args.language;
-        const rawLimit = typeof args.limit === "number" ? args.limit : 20;
-        const limit = Math.max(1, Math.min(100, Math.round(rawLimit)));
-        const db = cg.getDatabase();
-        const rawDb = db.getRawDb();
-        const files = rawDb.all(
-          "SELECT path FROM files WHERE language = ? LIMIT 5000",
-          [language]
-        );
-        const results = [];
-        let truncated = false;
-        for (const file of files) {
-          if (results.length >= limit) {
-            truncated = true;
-            break;
-          }
-          let content;
-          try {
-            const fullPath = path.isAbsolute(file.path) ? file.path : path.join(projectRoot, file.path);
-            content = fs.readFileSync(fullPath, "utf8");
-          } catch {
-            continue;
-          }
-          const matches = await runner.runInline(pattern, language, content);
-          for (const m of matches) {
-            if (results.length >= limit) {
-              truncated = true;
-              break;
-            }
-            results.push({ filePath: file.path, line: m.line, matchText: m.matchText });
-          }
-        }
-        if (results.length === 0) {
-          return `0 matches for '${pattern}' in ${language} files`;
-        }
-        const lines = [
-          `${results.length} match${results.length !== 1 ? "es" : ""} for '${pattern}' in ${language} files`,
-          ""
-        ];
-        for (const r of results) {
-          lines.push(` ${r.filePath}:${r.line}`);
-          lines.push(`   ${r.matchText}`);
-          lines.push("");
-        }
-        if (truncated) {
-          lines.push(`[truncated \u2014 showing first ${limit} results; refine your pattern or use --lang to narrow scope]`);
-        }
-        return truncate(lines.join("\n"));
-      }
-      // ── Pattern tools ──────────────────────────────────────────────────────────
-      case "kirograph_pattern_coverage": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enablePatterns) {
-          return "Pattern analysis is not enabled. Set enablePatterns: true in .kirograph/config.json and run kirograph index.";
-        }
-        const { PatternLibraryLoader } = await Promise.resolve().then(() => require("../patterns/loader.js"));
-        const loader = new PatternLibraryLoader();
-        const builtinPath = path.join(__dirname, "../patterns/library");
-        const customPath = config.patternLibraryPath;
-        let rules = [];
-        try {
-          rules = loader.load(builtinPath, customPath);
-        } catch {
-        }
-        const rulesByCategory = /* @__PURE__ */ new Map();
-        for (const rule of rules) {
-          const prefix = rule.owaspCategory.match(/^(A\d{2})/)?.[1] ?? rule.owaspCategory;
-          if (!rulesByCategory.has(prefix)) rulesByCategory.set(prefix, []);
-          rulesByCategory.get(prefix).push(rule);
-        }
-        const db = cg.getDatabase();
-        db.applyPatternsSchema();
-        const rawDb = db.getRawDb();
-        const matchCountsByCategory = /* @__PURE__ */ new Map();
-        try {
-          const tableExists = rawDb.get("SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'");
-          if (tableExists) {
-            const rows = rawDb.all(
-              "SELECT owasp_category, COUNT(*) as cnt FROM pattern_matches GROUP BY owasp_category"
-            );
-            for (const row of rows) {
-              const prefix = row.owasp_category.match(/^(A\d{2})/)?.[1] ?? row.owasp_category;
-              matchCountsByCategory.set(prefix, (matchCountsByCategory.get(prefix) ?? 0) + row.cnt);
-            }
-          }
-        } catch {
-        }
-        const owaspTop10 = [
-          "A01",
-          "A02",
-          "A03",
-          "A04",
-          "A05",
-          "A06",
-          "A07",
-          "A08",
-          "A09",
-          "A10"
-        ];
-        const owaspNames = {
-          A01: "Broken Access Control",
-          A02: "Cryptographic Failures",
-          A03: "Injection",
-          A04: "Insecure Design",
-          A05: "Security Misconfiguration",
-          A06: "Vulnerable and Outdated Components",
-          A07: "Identification and Authentication Failures",
-          A08: "Software and Data Integrity Failures",
-          A09: "Security Logging and Monitoring Failures",
-          A10: "Server-Side Request Forgery"
-        };
-        const covered = [];
-        const uncovered = [];
-        const lines = [
-          "# OWASP Top 10 Pattern Coverage",
-          "",
-          `Total rules loaded: ${rules.length}`,
-          "",
-          "Category | Rules | Matches",
-          "-------- | ----- | -------"
-        ];
-        for (const cat of owaspTop10) {
-          const catRules = rulesByCategory.get(cat) ?? [];
-          const matchCount = matchCountsByCategory.get(cat) ?? 0;
-          const label = `${cat}: ${owaspNames[cat] ?? cat}`;
-          if (catRules.length > 0) {
-            covered.push(label);
-            lines.push(`${label} | ${catRules.length} | ${matchCount}`);
-          } else {
-            uncovered.push(label);
-          }
-        }
-        for (const [cat, catRules] of rulesByCategory.entries()) {
-          if (!owaspTop10.includes(cat)) {
-            const matchCount = matchCountsByCategory.get(cat) ?? 0;
-            lines.push(`${cat} | ${catRules.length} | ${matchCount}`);
-          }
-        }
-        if (uncovered.length > 0) {
-          lines.push("", `Uncovered categories (${uncovered.length}):`, ...uncovered.map((c) => `  - ${c}`));
-        }
-        lines.push("", `Coverage: ${covered.length} / ${owaspTop10.length} OWASP Top 10 categories`);
-        return lines.join("\n");
-      }
-      case "kirograph_pattern_save_baseline": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enablePatterns) {
-          return "Pattern analysis is not enabled. Set enablePatterns: true in .kirograph/config.json and run kirograph index.";
-        }
-        const label = args.label ?? "default";
-        const db = cg.getDatabase();
-        db.applyPatternsSchema();
-        const rawDb = db.getRawDb();
-        const tableExists = rawDb.get("SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'");
-        if (!tableExists) {
-          return "No pattern_matches table found. Run kirograph index first to populate pattern data.";
-        }
-        const rows = rawDb.all(
-          "SELECT pattern_id, COUNT(*) as cnt FROM pattern_matches GROUP BY pattern_id"
-        );
-        const baseline = {};
-        for (const row of rows) {
-          baseline[row.pattern_id] = row.cnt;
-        }
-        const kirographDir = path.join(projectRoot, ".kirograph");
-        if (!fs.existsSync(kirographDir)) fs.mkdirSync(kirographDir, { recursive: true });
-        const baselinePath = path.join(kirographDir, `pattern-baseline-${label}.json`);
-        fs.writeFileSync(baselinePath, JSON.stringify({ label, savedAt: Date.now(), counts: baseline }, null, 2));
-        const totalMatches = Object.values(baseline).reduce((s, c) => s + c, 0);
-        return `Baseline "${label}" saved: ${Object.keys(baseline).length} patterns, ${totalMatches} total matches \u2192 ${baselinePath}`;
-      }
-      case "kirograph_pattern_diff": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enablePatterns) {
-          return "Pattern analysis is not enabled. Set enablePatterns: true in .kirograph/config.json and run kirograph index.";
-        }
-        const label = args.label ?? "default";
-        const baselinePath = path.join(projectRoot, ".kirograph", `pattern-baseline-${label}.json`);
-        if (!fs.existsSync(baselinePath)) {
-          return `Baseline "${label}" not found. Run kirograph_pattern_save_baseline first.`;
-        }
-        let baseline;
-        try {
-          baseline = JSON.parse(fs.readFileSync(baselinePath, "utf8"));
-        } catch {
-          return `Failed to read baseline file: ${baselinePath}`;
-        }
-        const db = cg.getDatabase();
-        db.applyPatternsSchema();
-        const rawDb = db.getRawDb();
-        const tableExists = rawDb.get("SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'");
-        const currentCounts = {};
-        if (tableExists) {
-          const rows = rawDb.all(
-            "SELECT pattern_id, COUNT(*) as cnt FROM pattern_matches GROUP BY pattern_id"
-          );
-          for (const row of rows) {
-            currentCounts[row.pattern_id] = row.cnt;
-          }
-        }
-        const allPatternIds = /* @__PURE__ */ new Set([...Object.keys(baseline.counts), ...Object.keys(currentCounts)]);
-        const newFindings = [];
-        const resolvedFindings = [];
-        const unchanged = [];
-        const changed = [];
-        for (const id of allPatternIds) {
-          const before = baseline.counts[id] ?? 0;
-          const after = currentCounts[id] ?? 0;
-          if (before === 0 && after > 0) {
-            newFindings.push({ id, count: after });
-          } else if (before > 0 && after === 0) {
-            resolvedFindings.push({ id, count: before });
-          } else if (before === after) {
-            unchanged.push({ id, count: after });
-          } else {
-            changed.push({ id, before, after, delta: after - before });
-          }
-        }
-        const savedDate = new Date(baseline.savedAt).toISOString().slice(0, 16).replace("T", " ");
-        const lines = [
-          `# Pattern Diff: "${label}" (saved ${savedDate}) \u2192 current`,
-          "",
-          `NEW: ${newFindings.length}  RESOLVED: ${resolvedFindings.length}  CHANGED: ${changed.length}  UNCHANGED: ${unchanged.length}`
-        ];
-        if (newFindings.length > 0) {
-          lines.push("", "## New Findings (not in baseline)");
-          for (const f of newFindings.sort((a, b) => b.count - a.count)) {
-            lines.push(`  + ${f.id}: ${f.count} matches`);
-          }
-        }
-        if (resolvedFindings.length > 0) {
-          lines.push("", "## Resolved (in baseline, not in current)");
-          for (const f of resolvedFindings.sort((a, b) => b.count - a.count)) {
-            lines.push(`  - ${f.id}: was ${f.count} matches`);
-          }
-        }
-        if (changed.length > 0) {
-          lines.push("", "## Changed");
-          for (const f of changed.sort((a, b) => Math.abs(b.delta) - Math.abs(a.delta))) {
-            const sign = f.delta > 0 ? "+" : "";
-            lines.push(`  ~ ${f.id}: ${f.before} \u2192 ${f.after} (${sign}${f.delta})`);
-          }
-        }
-        return lines.join("\n");
-      }
-      // ── Wiki tools ────────────────────────────────────────────────────────────
-      case "kirograph_wiki_ingest": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph", {
-          autoResolveConflicts: config.wikiAutoResolveConflicts ?? false
-        });
-        wiki.initialize();
-        const source = args.source ?? "";
-        const sourceName = args.sourceName ?? "source";
-        if (!source) return "source is required";
-        if (config.wikiSynthesisMode === "local") {
-          wiki.queueSource(source, sourceName);
-          const count = wiki.getQueueCount();
-          return `Source "${sourceName}" queued for local wiki synthesis (${count} in queue). The agentStop hook will run "kirograph wiki synthesize" automatically.`;
-        }
-        const prompt = wiki.getIngestPrompt(source, sourceName);
-        return `WIKI_INGEST_PROMPT
-${prompt}
-
-Produce WIKI_DIFF blocks following SCHEMA.md, then call kirograph_wiki_apply_diff with the diff string.`;
-      }
-      case "kirograph_wiki_apply_diff": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph", {
-          autoResolveConflicts: config.wikiAutoResolveConflicts ?? false
-        });
-        wiki.initialize();
-        const diff = args.diff ?? "";
-        if (!diff) return "diff is required";
-        const result = wiki.applyDiff(diff);
-        const lines = ["\u2713 Wiki diff applied"];
-        if (result.created.length) lines.push(`  Created: ${result.created.join(", ")}`);
-        if (result.updated.length) lines.push(`  Updated: ${result.updated.join(", ")}`);
-        if (result.conflictsResolved.length) lines.push(`  Conflicts auto-resolved: ${result.conflictsResolved.join(", ")}`);
-        if (result.conflictsPending.length) {
-          lines.push(`  \u26A1 Conflicts pending (${result.conflictsPending.length}):`);
-          for (const c of result.conflictsPending) {
-            lines.push(`    ${c.page} \xA7${c.section}: "${c.existing}" vs "${c.incoming}" (source: ${c.source})`);
-          }
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_wiki_search": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph");
-        wiki.initialize();
-        const query = args.query ?? "";
-        if (!query) return "query is required";
-        const limit = Math.min(Number(args.limit ?? 5), 20);
-        const results = wiki.search(query, limit);
-        if (results.length === 0) return `No wiki pages found for "${query}".`;
-        const lines = [`Wiki Search: ${query}`, ""];
-        for (const { page, score } of results) {
-          lines.push(`[${page.slug}] ${page.title}  (score: ${score.toFixed(3)})`);
-          const preview = page.content.split("\n").find((l) => l.trim() && !l.startsWith("#"));
-          if (preview) lines.push(`  ${preview.trim().slice(0, 120)}`);
-          lines.push("");
-        }
-        return lines.join("\n").trim();
-      }
-      case "kirograph_wiki_page": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph");
-        wiki.initialize();
-        const slug = args.slug ?? "";
-        if (!slug) return "slug is required";
-        const page = wiki.getPage(slug);
-        if (!page) return `Wiki page "${slug}" not found. Use kirograph_wiki_list to see available pages.`;
-        return page.content;
-      }
-      case "kirograph_wiki_lint": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph");
-        wiki.initialize();
-        const issues = wiki.lint();
-        if (issues.length === 0) return "\u2713 Wiki lint passed \u2014 no issues found.";
-        const lines = [`Wiki Lint \u2014 ${issues.length} issue(s)`, ""];
-        for (const issue of issues) {
-          const icon = issue.kind === "contradiction" ? "\u26A1" : issue.kind === "orphan" ? "\u25CB" : issue.kind === "broken_link" ? "\u{1F517}" : "\u26A0";
-          lines.push(`${icon} [${issue.kind}] ${issue.slug}`);
-          lines.push(`  ${issue.detail}`);
-          lines.push("");
-        }
-        return lines.join("\n").trim();
-      }
-      case "kirograph_wiki_list": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph");
-        wiki.initialize();
-        const pages = wiki.listPages();
-        if (pages.length === 0) return "Wiki is empty. Use kirograph_wiki_ingest to add pages.";
-        const stats = wiki.getStats();
-        const lines = [
-          `Wiki \u2014 ${stats.pageCount} page(s), ${stats.totalSources} total sources`,
-          ""
-        ];
-        for (const page of pages) {
-          const date = new Date(page.updatedAt).toISOString().slice(0, 10);
-          lines.push(`  ${page.slug.padEnd(32)} ${page.title}  (${page.sourceCount} src, ${date})`);
-        }
-        return lines.join("\n");
-      }
-      case "kirograph_wiki_synthesize": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        if (config.wikiSynthesisMode !== "local") return 'wikiSynthesisMode is not "local". This tool is for local-model synthesis only.';
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph", {
-          autoResolveConflicts: config.wikiAutoResolveConflicts ?? false
-        });
-        wiki.initialize();
-        const queueCount = wiki.getQueueCount();
-        if (queueCount === 0) return "Wiki queue is empty \u2014 nothing to synthesize.";
-        const result = await wiki.synthesize(config.wikiLocalModel, true);
-        const synthLines = [`Wiki synthesis complete \u2014 processed ${result.processed} source(s).`];
-        if (result.created.length) synthLines.push(`Created: ${result.created.join(", ")}`);
-        if (result.updated.length) synthLines.push(`Updated: ${result.updated.join(", ")}`);
-        if (result.errors.length) synthLines.push(`Errors: ${result.errors.join("; ")}`);
-        return synthLines.join("\n");
-      }
-      case "kirograph_wiki_init": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph", {
-          autoResolveConflicts: config.wikiAutoResolveConflicts ?? false
-        });
-        wiki.initWiki();
-        return "Wiki initialized. SCHEMA.md and MANIFEST.md created in .kirograph/wiki/.";
-      }
-      case "kirograph_wiki_reindex": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph");
-        wiki.initialize();
-        const count = wiki.reindex();
-        return `Reindexed ${count} wiki page(s) from .kirograph/wiki/*.md.`;
-      }
-      case "kirograph_wiki_status": {
-        const { loadConfig } = await Promise.resolve().then(() => require("../config.js"));
-        const projectRoot = args.projectPath ?? cg.getProjectRoot();
-        const config = await loadConfig(projectRoot);
-        if (!config.enableWiki) return "Wiki is not enabled. Set enableWiki: true in .kirograph/config.json";
-        const { KiroGraphWiki } = await Promise.resolve().then(() => require("../wiki/index.js"));
-        const db = cg.getDatabase();
-        db.applyWikiSchema();
-        const wiki = new KiroGraphWiki(db.getRawDb(), projectRoot + "/.kirograph");
-        wiki.initialize();
-        const stats = wiki.getStats();
-        const oldest = stats.oldestPage ? new Date(stats.oldestPage).toISOString().slice(0, 10) : "n/a";
-        const newest = stats.newestPage ? new Date(stats.newestPage).toISOString().slice(0, 10) : "n/a";
-        return [
-          "Wiki Status:",
-          `  Pages:         ${stats.pageCount}`,
-          `  Total sources: ${stats.totalSources}`,
-          `  Oldest page:   ${oldest}`,
-          `  Newest page:   ${newest}`,
-          `  Wiki dir:      .kirograph/wiki/`
-        ].join("\n");
-      }
-      default:
-        return `Unknown tool: ${toolName}`;
+  }
+];
+const LIVE_SEARCH_TOOL_DEFINITION = {
+  name: "kirograph_live_search",
+  description: "Run a live AST pattern search against the indexed file list using @ast-grep/napi. Finds structural code patterns (SQL injection, eval, path traversal, etc.) without needing the codebase to be re-indexed. Only available when enablePatterns: true.",
+  inputSchema: {
+    type: "object",
+    required: ["pattern", "language"],
+    properties: {
+      pattern: { type: "string", description: 'ast-grep inline pattern (e.g. "eval($X)")' },
+      language: { type: "string", description: "Language to search: javascript, typescript, python, go, rust, java, etc." },
+      limit: { type: "number", description: "Max results (default 20, max 100)", default: 20 },
+      projectPath: { type: "string" }
     }
   }
-}
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   KIROGRAPH_TOOL_NAMES,