weavatrix 0.1.1 → 0.1.3

package/src/graph/builder/lang-js.js

@@ -32,37 +32,56 @@ export default {
     // on deeply-nested / minified / bundled JS (regression). An export_statement is always a NEAR ancestor of
     // the declaration head (≤ ~5 hops), and hitting a statement_block means we're nested inside a function →
     // not a module-level export → bail immediately. See [[graph-builder-internalization]].
-    // early-out on statement_block (we're nested inside a function → not a module-level export) keeps this
-    // O(1) for nested symbols; program is the top; the hop cap is the backstop. A method of an EXPORTED class
-    // is only ~4 hops to its export_statement (method → class_body → class_declaration → export_statement),
-    // so we do NOT bail at class_body — that preserves the exported flag for such methods.
+    // Early-out for nested scopes keeps this O(1); class members are intentionally never module exports even
+    // when their owner class is exported. The hop cap remains a backstop for malformed/deep syntax trees.
     const isExportedDecl = (node) => {
       let p = node.parent;
       for (let hops = 0; p && hops < 6; hops++) {
         if (p.type === "export_statement") return true;
-        if (p.type === "program" || p.type === "statement_block") return false;
+        if (p.type === "program" || p.type === "statement_block" || p.type === "class_body") return false;
+        p = p.parent;
+      }
+      return false;
+    };
+    const isModuleDeclaration = (node) => {
+      let p = node.parent;
+      for (let hops = 0; p && hops < 8; hops++) {
+        if (p.type === "program") return true;
+        if (p.type === "statement_block" || p.type === "class_body") return false;
         p = p.parent;
       }
       return false;
     };
     // a bare (package) specifier = non-relative AND not a path alias; alias-that-missed is a broken local, not a dep
-    const isBareSpec = (spec) => !!spec && !spec.startsWith(".") && resolveAlias(spec) == null;
+    const isBareSpec = (spec) => !!spec && !spec.startsWith(".") && resolveAlias(fileRel, spec) == null;
     // broken local import (relative or alias path resolving to no file) — recorded for the "unresolved-import"
     // finding. Asset imports (svg/css-modules-adjacent/fonts/…) and ?query-suffixed specs that resolve once
     // the query is stripped (Vite ?raw/?url/?worker) are NOT code-graph concerns.
     const ASSET_RE = /\.(svg|png|jpe?g|gif|webp|avif|ico|bmp|woff2?|ttf|eot|otf|mp[34]|webm|wasm|pdf|txt|md|html?)$/i;
-    const recordUnresolved = (rawSpec, kind, line) => {
+    const recordUnresolved = (rawSpec, kind, line, typeOnly = false) => {
       const clean = String(rawSpec || "").split("?")[0];
       if (!clean || ASSET_RE.test(clean)) return;
       if (clean !== rawSpec && resolveJsImport(fileRel, clean)) return; // only the ?query broke resolution
-      addExternalImport({ spec: rawSpec, kind, line, unresolved: true });
+      addExternalImport({ spec: rawSpec, kind, line, unresolved: true, typeOnly });
     };
 
     // ---- symbols (export flag captured at declaration time) ----
+    const methodMetadata = (nameNode) => {
+      let method = nameNode.parent;
+      while (method && method.type !== "method_definition") method = method.parent;
+      let owner = method?.parent;
+      while (owner && !["class_declaration", "class"].includes(owner.type)) owner = owner.parent;
+      const ownerName = owner && field(owner, "name")?.text;
+      const visibility = /^\s*private\b/.test(method?.text || "") ? "private"
+        : /^\s*protected\b/.test(method?.text || "") ? "protected" : "public";
+      return { symbolKind: "method", ...(ownerName ? { memberOf: ownerName } : {}), visibility };
+    };
     for (const cap of caps(grammar, FUNCS, tree.rootNode)) {
+      const isMethod = cap.name === "method";
       addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name !== "class", {
         sourceNode: cap.node.parent,
-        ...(isExportedDecl(cap.node) ? { exported: true } : {})
+        ...(!isMethod && isExportedDecl(cap.node) ? { exported: true } : {}),
+        ...(isMethod ? methodMetadata(cap.node) : { symbolKind: cap.name === "class" ? "class" : "function", moduleDeclaration: isModuleDeclaration(cap.node) })
       });
     }
     for (const cap of caps(grammar, TOPVARS, tree.rootNode)) {
@@ -70,26 +89,47 @@ export default {
       const val = field(cap.node, "value");
       addSym(nameNode.text, nameNode.startPosition.row + 1, !!(val && CALLABLE.test(val.type)), {
         sourceNode: val || cap.node,
-        ...(isExportedDecl(cap.node) ? { exported: true } : {})
+        ...(isExportedDecl(cap.node) ? { exported: true } : {}),
+        symbolKind: "variable",
+        moduleDeclaration: true
       });
     }
 
+    const importTypeOnly = (node) => {
+      if (/^\s*import\s+type\b/.test(node.text)) return true;
+      const clause = node.namedChildren.find((c) => c.type === "import_clause");
+      if (!clause) return false; // side-effect import executes the target module
+      const parts = clause.namedChildren;
+      if (parts.some((c) => c.type === "identifier" || c.type === "namespace_import")) return false;
+      const named = parts.find((c) => c.type === "named_imports");
+      const specs = named?.namedChildren.filter((c) => c.type === "import_specifier") || [];
+      return specs.length > 0 && specs.every((s) => /^\s*type\b/.test(s.text));
+    };
+    const reexportTypeOnly = (node) => {
+      if (/^\s*export\s+type\b/.test(node.text)) return true;
+      const clause = node.namedChildren.find((c) => c.type === "export_clause");
+      const specs = clause?.namedChildren.filter((c) => c.type === "export_specifier") || [];
+      return specs.length > 0 && specs.every((s) => /^\s*type\b/.test(s.text));
+    };
+
     // ---- ESM imports ----
     for (const cap of caps(grammar, `(import_statement) @imp`, tree.rootNode)) {
       const node = cap.node; const srcNode = field(node, "source");
       const rawSpec = srcNode ? srcNode.text.replace(/^['"`]|['"`]$/g, "") : "";
+      const line = node.startPosition.row + 1;
+      const typeOnly = importTypeOnly(node);
       const tgt = resolveJsImport(fileRel, rawSpec);
       if (!tgt) {
-        if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "esm", line: node.startPosition.row + 1 });
-        else if (rawSpec) recordUnresolved(rawSpec, "esm", node.startPosition.row + 1);
+        if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "esm", line, typeOnly });
+        else if (rawSpec) recordUnresolved(rawSpec, "esm", line, typeOnly);
         continue;
       }
-      addImportEdge(tgt);
+      addImportEdge(tgt, { typeOnly, line, specifier: rawSpec });
       const clause = node.namedChildren.find((c) => c.type === "import_clause"); if (!clause) continue;
       for (const c of clause.namedChildren) {
-        if (c.type === "identifier") imports.set(c.text, { imported: "default", targetFile: tgt });
-        else if (c.type === "namespace_import") { const id = c.namedChildren.find((x) => x.type === "identifier"); if (id) imports.set(id.text, { imported: "*", targetFile: tgt }); }
-        else if (c.type === "named_imports") for (const s of c.namedChildren) { if (s.type !== "import_specifier") continue; const nm = field(s, "name"), al = field(s, "alias"); if (nm) imports.set((al || nm).text, { imported: nm.text, targetFile: tgt }); }
+        if (c.type === "identifier") imports.set(c.text, { imported: "default", targetFile: tgt, typeOnly });
+        else if (c.type === "namespace_import") { const id = c.namedChildren.find((x) => x.type === "identifier"); if (id) imports.set(id.text, { imported: "*", targetFile: tgt, typeOnly }); }
+        else if (c.type === "named_imports") for (const s of c.namedChildren) { if (s.type !== "import_specifier") continue; const nm = field(s, "name"), al = field(s, "alias"); if (nm) imports.set((al || nm).text, { imported: nm.text, targetFile: tgt, typeOnly: typeOnly || /^\s*type\b/.test(s.text) }); }
       }
     }
 
@@ -98,7 +138,7 @@ export default {
       if (cap.name !== "src") continue;
       let dv = cap.node; while (dv && dv.type !== "variable_declarator") dv = dv.parent;
       const tgt = resolveJsImport(fileRel, cap.node.text); if (!tgt) continue;
-      addImportEdge(tgt);
+      addImportEdge(tgt, { typeOnly: false, line: cap.node.startPosition.row + 1, specifier: cap.node.text });
       const lhs = dv && field(dv, "name");
       if (lhs && lhs.type === "identifier") imports.set(lhs.text, { imported: "*", targetFile: tgt });
       else if (lhs && lhs.type === "object_pattern") for (const p of lhs.namedChildren) { const key = field(p, "key") || (p.type === "shorthand_property_identifier_pattern" ? p : null); const val = field(p, "value"); const local = (val && val.type === "identifier") ? val : key; if (key && local) imports.set(local.text, { imported: key.text, targetFile: tgt }); }
@@ -139,13 +179,16 @@ export default {
     }
 
     // ---- re-exports (barrel/index files): edge so the real target isn't falsely DEAD; bare source → external ----
-    for (const cap of caps(grammar, `(export_statement source: (string (string_fragment) @src))`, tree.rootNode)) {
-      if (cap.name !== "src") continue;
-      const rawSpec = cap.node.text;
+    for (const cap of caps(grammar, `(export_statement) @exp`, tree.rootNode)) {
+      const node = cap.node; const srcNode = field(node, "source");
+      if (!srcNode) continue;
+      const rawSpec = srcNode.text.replace(/^['"`]|['"`]$/g, "");
+      const line = node.startPosition.row + 1;
+      const typeOnly = reexportTypeOnly(node);
       const tgt = resolveJsImport(fileRel, rawSpec);
-      if (tgt) addImportEdge(tgt);
-      else if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "reexport", line: cap.node.startPosition.row + 1 });
-      else if (rawSpec) recordUnresolved(rawSpec, "reexport", cap.node.startPosition.row + 1);
+      if (tgt) addImportEdge(tgt, { relation: "re_exports", typeOnly, line, specifier: rawSpec });
+      else if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "reexport", line, typeOnly });
+      else if (rawSpec) recordUnresolved(rawSpec, "reexport", line, typeOnly);
     }
 
     // ---- export markers beyond declarations: `export { a, b }`, `export default X`, CJS module.exports ----

package/src/graph/internal-builder.build.js

@@ -53,7 +53,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
     const parser = new Parser(); parser.setLanguage(langs[grammar]);
     let tree; try { tree = parser.parse(code); } catch { continue; }
 
-    const syms = []; const nameToId = new Map();
+    const syms = []; const nameToId = new Map(); const moduleNameToId = new Map();
     const addSym = (name, line, callable, extra) => {
       if (!name || !/^[A-Za-z_$][\w$]*$/.test(name)) return;
       const id = `${fileRel}#${name}@${line}`; if (nodeIds.has(id)) return;
@@ -73,28 +73,44 @@ export async function buildInternalGraph(repoDir, opts = {}) {
         ...(endLine >= line ? { source_end: `L${endLine}` } : {}),
         ...(complexity ? { complexity } : {}),
         ...(extra && extra.exported ? { exported: true } : {}),
-        ...(extra && extra.decorated ? { decorated: true } : {})
+        ...(extra && extra.decorated ? { decorated: true } : {}),
+        ...(extra && extra.symbolKind ? { symbol_kind: extra.symbolKind } : {}),
+        ...(extra && extra.memberOf ? { member_of: extra.memberOf } : {}),
+        ...(extra && extra.visibility ? { visibility: extra.visibility } : {})
       });
       links.push({ source: fileRel, target: id, relation: "contains", confidence: "EXTRACTED" });
-      syms.push({ id, name, start: line, end: endLine >= line ? endLine : 0 }); if (!nameToId.has(name)) nameToId.set(name, id);
+      syms.push({ id, name, start: line, end: endLine >= line ? endLine : 0 });
+      if (!nameToId.has(name)) nameToId.set(name, id);
+      if (extra?.moduleDeclaration && !moduleNameToId.has(name)) moduleNameToId.set(name, id);
     };
     const imports = new Map(); importedLocals.set(fileRel, imports);
-    const addImportEdge = (tgt) => { if (tgt && tgt !== fileRel) links.push({ source: fileRel, target: tgt, relation: "imports", confidence: "EXTRACTED" }); };
+    const addImportEdge = (tgt, meta = {}) => {
+      if (!tgt || tgt === fileRel) return;
+      links.push({
+        source: fileRel,
+        target: tgt,
+        relation: meta.relation || "imports",
+        confidence: "EXTRACTED",
+        ...(typeof meta.typeOnly === "boolean" ? { typeOnly: meta.typeOnly } : {}),
+        ...(meta.line ? { line: meta.line } : {}),
+        ...(meta.specifier ? { specifier: meta.specifier } : {}),
+      });
+    };
     // rec: {spec, kind, line} bare-pkg import · {dynamic:true, spec?, target?} dynamic import marker
     // (target = internally-resolved dynamic import; suppresses false "unused file" in dep analysis) ·
     // {unresolved:true, spec} broken local import (relative or alias path that resolves to no file).
     const addExternalImport = (rec) => {
       if (!rec) return;
-      if (rec.dynamic) { externalImports.push({ file: fileRel, spec: rec.spec || null, kind: rec.kind || "dynamic", dynamic: true, line: rec.line || 0, ...(rec.target ? { target: rec.target } : {}) }); return; }
-      if (rec.unresolved) { externalImports.push({ file: fileRel, spec: rec.spec, kind: rec.kind || "esm", unresolved: true, line: rec.line || 0 }); return; }
+      if (rec.dynamic) { externalImports.push({ file: fileRel, spec: rec.spec || null, kind: rec.kind || "dynamic", dynamic: true, line: rec.line || 0, ...(rec.target ? { target: rec.target } : {}), ...(rec.typeOnly ? { typeOnly: true } : {}) }); return; }
+      if (rec.unresolved) { externalImports.push({ file: fileRel, spec: rec.spec, kind: rec.kind || "esm", unresolved: true, line: rec.line || 0, ...(rec.typeOnly ? { typeOnly: true } : {}) }); return; }
       // non-npm extractors (go/python) classify their own specs and pass pkg/builtin/ecosystem precomputed
-      if (rec.pkg) { externalImports.push({ file: fileRel, spec: rec.spec, pkg: rec.pkg, builtin: !!rec.builtin, kind: rec.kind || "import", line: rec.line || 0, ...(rec.ecosystem ? { ecosystem: rec.ecosystem } : {}) }); return; }
+      if (rec.pkg) { externalImports.push({ file: fileRel, spec: rec.spec, pkg: rec.pkg, builtin: !!rec.builtin, kind: rec.kind || "import", line: rec.line || 0, ...(rec.ecosystem ? { ecosystem: rec.ecosystem } : {}), ...(rec.typeOnly ? { typeOnly: true } : {}) }); return; }
       const r = specToPkg(rec.spec);
       if (!r) return;
-      externalImports.push({ file: fileRel, spec: rec.spec, pkg: r.pkg, builtin: !!r.builtin, kind: rec.kind || "esm", line: rec.line || 0 });
+      externalImports.push({ file: fileRel, spec: rec.spec, pkg: r.pkg, builtin: !!r.builtin, kind: rec.kind || "esm", line: rec.line || 0, ...(rec.typeOnly ? { typeOnly: true } : {}) });
     };
     // Post-hoc export flag (export {a}, export default X, CJS module.exports) — declarations are flagged at addSym time.
-    const markExported = (name) => { const id = nameToId.get(name); const n = id && nodeById.get(id); if (n) n.exported = true; };
+    const markExported = (name) => { const id = moduleNameToId.get(name); const n = id && nodeById.get(id); if (n) n.exported = true; };
 
     try { lang.pass1({ grammar, tree, fileRel, code, caps, field, addSym, addNode, links, nodeIds, syms, nameToId, imports, addImportEdge, addExternalImport, markExported, fileSet, ...resolvers }); }
     catch (e) { /* one bad file never sinks the whole build */ void e; }
@@ -164,6 +180,28 @@ export async function buildInternalGraph(repoDir, opts = {}) {
       const target = resolveCall(cap.node.text, fileRel);
       if (target && target !== cls.id) links.push({ source: cls.id, target, relation: "inherits", confidence: "INFERRED" });
     }
+    // JSX is a real symbol use even though it is not a call_expression. Resolve imported components to their
+    // declaration so component fan-in and unused-export checks do not claim `<SettingsView />` is unreferenced.
+    if (FAMILY[grammar] === "js") {
+      for (const cap of caps(grammar, `[
+        (jsx_opening_element name: (_) @jsx)
+        (jsx_self_closing_element name: (_) @jsx)
+      ]`, tree.rootNode)) {
+        const jsxName = cap.node.text;
+        const parts = jsxName.split(".");
+        const localName = parts[0];
+        if (parts.length === 1 && !/^[A-Z_$]/.test(localName)) continue; // undotted lowercase tags are platform/intrinsic elements
+        const imp = importedLocals.get(fileRel)?.get(localName);
+        if (!imp || !imp.targetFile || imp.typeOnly) continue;
+        const targetSymbols = symByFileName.get(imp.targetFile);
+        if (!targetSymbols) continue;
+        const importedName = imp.imported === "*" && parts.length > 1 ? parts[parts.length - 1] : imp.imported;
+        const target = targetSymbols.get(importedName) || targetSymbols.get(localName);
+        if (!target) continue;
+        const owner = enclosing(fileRel, cap.node.startPosition.row + 1);
+        links.push({ source: owner?.id || fileRel, target, relation: "references", confidence: "INFERRED", usage: "jsx", line: cap.node.startPosition.row + 1 });
+      }
+    }
     // Go value references: a top-level const/var/type/func used BY NAME (bare `X`, or cross-package `pkg.X`) in
     // another file/scope → a `references` edge, so used-but-never-called symbols (message-type consts, etc.) are
     // not falsely DEAD. (Same-file usage is already covered by graph-builder-analysis localRefs.) Go-only for now.
@@ -206,7 +244,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
 
   // extImportsV: bump when the externalImports schema/coverage changes (v2 = go/python ecosystems) —
   // deps-engine rebuilds in memory when a saved graph is older than this.
-  return { nodes, links, externalImports, extImportsV: 2, complexityV: 1 };
+  return { nodes, links, externalImports, extImportsV: 2, edgeTypesV: 1, complexityV: 1, repoBoundaryV: 1 };
 }
 
 // Build + write graph.json to outPath (creating the dir). Returns { ok, nodes, links, graphJson }.

package/src/graph/internal-builder.langs.js

@@ -5,7 +5,10 @@
 // build works — and Electron main runs Node, so this needs no external runtime.
 import { readdirSync, statSync, realpathSync } from "node:fs";
 import { join, extname, dirname } from "node:path";
+import { execFileSync } from "node:child_process";
 import { createRequire } from "node:module";
+import { isPathInside } from "../repo-path.js";
+import { childProcessEnv } from "../child-env.js";
 import LANG_JS from "./builder/lang-js.js";
 import LANG_PY from "./builder/lang-python.js";
 import LANG_GO from "./builder/lang-go.js";
@@ -67,9 +70,11 @@ async function ensureParser(opts = {}, wanted = null) {
 // Cycle-safe directory walk. statSync FOLLOWS symlinks/junctions, so a link pointing at an ancestor would
 // otherwise recurse forever (a/b/link/b/link/…). We dedupe by REAL path (a visited dir is never re-entered)
 // and cap depth as a backstop, so a symlink loop can't wedge the build.
-function walk(dir, acc = [], seen = new Set(), depth = 0) {
+function walkFallback(dir, acc = [], seen = new Set(), depth = 0, rootReal = null) {
   if (depth > 40) return acc;
-  let real; try { real = realpathSync.native(dir); } catch { real = dir; }
+  let real; try { real = realpathSync.native(dir); } catch { return acc; }
+  if (rootReal == null) rootReal = real;
+  if (!isPathInside(rootReal, real)) return acc;
   if (seen.has(real)) return acc;
   seen.add(real);
   let entries;
@@ -80,8 +85,10 @@ function walk(dir, acc = [], seen = new Set(), depth = 0) {
     // never match AGENT_DOTFILE, so we still never recurse into them (.git/.github/.cursor stay out).
     if (name.startsWith(".") && !AGENT_DOTFILE.test(name)) continue;
     const full = join(dir, name);
+    let entryReal; try { entryReal = realpathSync.native(full); } catch { continue; }
+    if (!isPathInside(rootReal, entryReal)) continue;
     let st; try { st = statSync(full); } catch { continue; }
-    if (st.isDirectory()) walk(full, acc, seen, depth + 1);
+    if (st.isDirectory()) walkFallback(full, acc, seen, depth + 1, rootReal);
     // include by KNOWN extension, not by loaded grammar — grammars now load lazily AFTER the walk
     // (the parse passes skip files whose grammar failed to load, so the guarantee is unchanged)
     else { const e = extname(name); if (EXT_LANG[e] || isDataFile(name) || isDocFile(name)) acc.push(full); }
@@ -89,4 +96,43 @@ function walk(dir, acc = [], seen = new Set(), depth = 0) {
   return acc;
 }
 
+// Git already owns the repository's file-universe rules. Asking it for tracked files plus untracked,
+// non-ignored files prevents generated outputs (Electron release/, custom cache dirs, ignored agent files,
+// etc.) from contaminating graph/duplicate/audit results while still indexing new source before it is staged.
+// A repository may be opened without Git (or Git may be unavailable), so failure is deliberately a signal to
+// use the boundary-safe walker above rather than a build failure.
+function gitFileUniverse(dir) {
+  let raw;
+  try {
+    raw = execFileSync("git", ["-C", dir, "ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
+      encoding: "utf8",
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15_000,
+      maxBuffer: 64 * 1024 * 1024,
+      env: childProcessEnv(),
+    });
+  } catch { return null; }
+
+  let rootReal;
+  try { rootReal = realpathSync.native(dir); } catch { return null; }
+  const files = [];
+  for (const rel of raw.split("\0")) {
+    if (!rel) continue;
+    const full = join(dir, rel);
+    let real; try { real = realpathSync.native(full); } catch { continue; } // deleted index entry
+    if (!isPathInside(rootReal, real)) continue; // tracked symlink/junction escaping the repo
+    let st; try { st = statSync(full); } catch { continue; }
+    if (!st.isFile()) continue; // includes neither submodule dirs nor directory-like junctions
+    const name = rel.split(/[\\/]/).pop() || "";
+    const ext = extname(name);
+    if (EXT_LANG[ext] || isDataFile(name) || isDocFile(name)) files.push(full);
+  }
+  return files;
+}
+
+function walk(dir) {
+  return gitFileUniverse(dir) ?? walkFallback(dir);
+}
+
 export { Parser, Query, GRAMMARS, LANGS, EXT_LANG, FAMILY, isDataFile, isDocFile, MAX_PARSE_BYTES, ensureParser, walk };

package/src/graph/internal-builder.resolvers.js

@@ -4,14 +4,21 @@
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { parseGoMod } from "../analysis/manifests.js";
+import { createRepoBoundary } from "../repo-path.js";
 
 export function buildResolvers(repoDir, fileSet) {
+  const boundary = createRepoBoundary(repoDir);
+  const readLocal = (relativePath) => {
+    const resolved = boundary.resolve(relativePath);
+    if (!resolved.ok) throw new Error("resolver input is outside the repository");
+    return readFileSync(resolved.path, "utf8");
+  };
   // Go package = directory (resolved via go.mod module prefix); Java class = file (basename index).
   // go.mod requires also feed goSpecToPkg so external Go imports map to their declared module.
   let goModule = "";
   let goRequires = [];
   try {
-    const gomod = parseGoMod(readFileSync(join(repoDir, "go.mod"), "utf8"));
+    const gomod = parseGoMod(readLocal("go.mod"));
     goModule = gomod.module;
     goRequires = gomod.requires.map((r) => r.path);
   } catch { /* no go.mod */ }
@@ -40,29 +47,98 @@ export function buildResolvers(repoDir, fileSet) {
     return cands.find((f) => f === full || f.endsWith("/" + full)) || cands[0] || null;
   };
 
-  // path aliases (tsconfig compilerOptions.paths + vite/webpack alias) — without these, @components/@/etc
-  // imports are missed and their targets look falsely DEAD.
-  const aliasList = [];
-  const addAlias = (a, t) => {
+  // Path aliases (tsconfig compilerOptions.paths + vite/webpack alias) are scoped to their config folder.
+  // Without nearest-config resolution, a monorepo's root `@/*` can hijack the same alias in web/.
+  const aliasContexts = new Map();
+  const cleanRel = (p) => String(p || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+/g, "/").replace(/\/$/, "").replace(/^\.$/, "");
+  const contextFor = (dir) => {
+    dir = cleanRel(dir);
+    let ctx = aliasContexts.get(dir);
+    if (!ctx) aliasContexts.set(dir, (ctx = { dir, aliases: [], baseUrls: [] }));
+    return ctx;
+  };
+  const addAlias = (ctx, a, t) => {
     a = String(a).replace(/\/\*$/, "").replace(/\/$/, "");
-    t = String(t).replace(/\/\*$/, "").replace(/^\.\//, "").replace(/\/$/, "");
-    if (a && t && !aliasList.some((x) => x.alias === a)) aliasList.push({ alias: a, target: t });
+    t = cleanRel(String(t)).replace(/\/\*$/, "");
+    if (a && t && !ctx.aliases.some((x) => x.alias === a)) ctx.aliases.push({ alias: a, target: t });
+  };
+  const parseJsonc = (raw) => {
+    // Regex comment stripping corrupts perfectly valid path strings such as `"@/*"` followed later by
+    // `"**/*.ts"`. Strip comments/trailing commas only while outside JSON strings.
+    raw = String(raw).replace(/^\uFEFF/, "");
+    let clean = ""; let inString = false; let escaped = false;
+    for (let i = 0; i < raw.length; i++) {
+      const ch = raw[i], next = raw[i + 1];
+      if (inString) {
+        clean += ch;
+        if (escaped) escaped = false;
+        else if (ch === "\\") escaped = true;
+        else if (ch === '"') inString = false;
+        continue;
+      }
+      if (ch === '"') { inString = true; clean += ch; continue; }
+      if (ch === "/" && next === "/") { while (i < raw.length && raw[i] !== "\n") i++; clean += "\n"; continue; }
+      if (ch === "/" && next === "*") {
+        i += 2;
+        while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/")) { if (raw[i] === "\n") clean += "\n"; i++; }
+        i++;
+        continue;
+      }
+      clean += ch;
+    }
+    let withoutTrailing = ""; inString = false; escaped = false;
+    for (let i = 0; i < clean.length; i++) {
+      const ch = clean[i];
+      if (inString) {
+        withoutTrailing += ch;
+        if (escaped) escaped = false;
+        else if (ch === "\\") escaped = true;
+        else if (ch === '"') inString = false;
+        continue;
+      }
+      if (ch === '"') { inString = true; withoutTrailing += ch; continue; }
+      if (ch === ",") {
+        let j = i + 1; while (/\s/.test(clean[j] || "")) j++;
+        if (clean[j] === "}" || clean[j] === "]") continue;
+      }
+      withoutTrailing += ch;
+    }
+    return JSON.parse(withoutTrailing);
   };
-  const jsBaseUrls = []; // tsconfig/jsconfig baseUrl roots — bare "components/Button" may be baseUrl-rooted, not an npm package
-  for (const cfg of ["tsconfig.json", "tsconfig.app.json", "tsconfig.base.json", "jsconfig.json"]) {
+  const configRank = (fr) => /(^|\/)tsconfig\.json$/i.test(fr) ? 0 : /(^|\/)jsconfig\.json$/i.test(fr) ? 1 : 2;
+  const configFiles = [...fileSet]
+    .filter((fr) => /(^|\/)(?:tsconfig(?:\.[^/]+)?|jsconfig)\.json$/i.test(fr))
+    .sort((a, b) => dirname(a).localeCompare(dirname(b)) || configRank(a) - configRank(b) || a.localeCompare(b));
+  for (const cfg of configFiles) {
     try {
-      const raw = readFileSync(join(repoDir, cfg), "utf8").replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "").replace(/,(\s*[}\]])/g, "$1");
-      const tj = JSON.parse(raw); const co = tj.compilerOptions || {}; const paths = co.paths || {};
-      const baseUrl = String(co.baseUrl || ".").replace(/^\.\/?/, "").replace(/\/$/, "");
-      if (co.baseUrl != null && !jsBaseUrls.includes(baseUrl)) jsBaseUrls.push(baseUrl);
-      for (const [k, v] of Object.entries(paths)) { const t = Array.isArray(v) ? v[0] : v; if (t) addAlias(k, (baseUrl && !String(t).startsWith("./") ? baseUrl + "/" : "") + t); }
+      const tj = parseJsonc(readLocal(cfg)); const co = tj.compilerOptions || {}; const paths = co.paths || {};
+      const cfgDir = cleanRel(dirname(cfg)); const ctx = contextFor(cfgDir);
+      const baseRoot = cleanRel(join(cfgDir || ".", String(co.baseUrl || ".")));
+      if (co.baseUrl != null && !ctx.baseUrls.includes(baseRoot)) ctx.baseUrls.push(baseRoot);
+      for (const [k, v] of Object.entries(paths)) {
+        const t = Array.isArray(v) ? v[0] : v;
+        if (t) addAlias(ctx, k, join(baseRoot || ".", String(t)));
+      }
     } catch { /* no/invalid tsconfig */ }
   }
-  for (const vc of ["vite.config.ts", "vite.config.js", "vite.config.mjs", "webpack.config.js"]) {
-    try { const src = readFileSync(join(repoDir, vc), "utf8"); for (const m of src.matchAll(/['"`]([^'"`]+)['"`]\s*:\s*path\.resolve\([^,]+,\s*['"`]([^'"`]+)['"`]\s*\)/g)) addAlias(m[1], m[2]); } catch { /* no bundler config */ }
+  for (const vc of [...fileSet].filter((fr) => /(^|\/)(?:vite\.config\.(?:ts|js|mjs)|webpack\.config\.js)$/.test(fr))) {
+    try {
+      const cfgDir = cleanRel(dirname(vc)); const ctx = contextFor(cfgDir); const src = readLocal(vc);
+      for (const m of src.matchAll(/['"`]([^'"`]+)['"`]\s*:\s*path\.resolve\([^,]+,\s*['"`]([^'"`]+)['"`]\s*\)/g)) addAlias(ctx, m[1], join(cfgDir || ".", m[2]));
+    } catch { /* no/invalid bundler config */ }
   }
-  aliasList.sort((a, b) => b.alias.length - a.alias.length);
-  const resolveAlias = (spec) => { for (const { alias, target } of aliasList) { if (spec === alias) return target; if (spec.startsWith(alias + "/")) return target + spec.slice(alias.length); } return null; };
+  for (const ctx of aliasContexts.values()) ctx.aliases.sort((a, b) => b.alias.length - a.alias.length);
+  const contextsForFile = (fromRel) => [...aliasContexts.values()]
+    .filter((ctx) => !ctx.dir || fromRel === ctx.dir || fromRel.startsWith(ctx.dir + "/"))
+    .sort((a, b) => b.dir.length - a.dir.length);
+  const resolveAlias = (fromRel, spec) => {
+    if (spec === undefined) { spec = fromRel; fromRel = ""; }
+    for (const ctx of contextsForFile(fromRel)) for (const { alias, target } of ctx.aliases) {
+      if (spec === alias) return target;
+      if (spec.startsWith(alias + "/")) return target + spec.slice(alias.length);
+    }
+    return null;
+  };
 
   const JS_EXTS = ["", ".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs", ".json", "/index.js", "/index.ts", "/index.jsx", "/index.tsx"];
   const resolveJsImport = (fromRel, spec) => {
@@ -70,10 +146,10 @@ export function buildResolvers(repoDir, fileSet) {
     let base;
     if (spec.startsWith(".")) base = join(dirname(fromRel), spec).replace(/\\/g, "/").replace(/^\.\//, "");
     else {
-      base = resolveAlias(spec);
+      base = resolveAlias(fromRel, spec);
       if (base == null) {
         // baseUrl-rooted internal import ("components/Button" with baseUrl:"src") — try before calling it an npm package
-        for (const b of jsBaseUrls) {
+        for (const ctx of contextsForFile(fromRel)) for (const b of ctx.baseUrls) {
           const root = (b ? b + "/" : "") + spec;
           for (const e of JS_EXTS) { const cand = (root + e).replace(/\/+/g, "/"); if (fileSet.has(cand)) return cand; }
         }

package/src/mcp/catalog.mjs

@@ -11,6 +11,7 @@ import {readSource, searchCode} from '../mcp-source-tools.mjs'
 
 const SELF_DIR = dirname(fileURLToPath(import.meta.url))
 const resolveRg = createRgResolver(SELF_DIR)
+export const DEFAULT_CAPS = Object.freeze(['graph', 'search', 'source', 'health', 'build', 'retarget'])
 
 // The files whose mtime the stdio shell watches for hot reload — keep in sync with the imports in
 // loadHotApi below (catalog.mjs itself is last: a change here re-derives the whole table).
@@ -22,7 +23,7 @@ function buildTools({tg, ti, th, ta}) {
         {cap: 'graph', name: 'get_node', description: 'Get full details for a specific node by label or ID.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID to look up'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNode(g, a, ctx)},
         {cap: 'graph', name: 'get_neighbors', description: 'Get all direct neighbors of a node with edge details (1 hop, call sites deduped). For transitive impact use get_dependents; for the impact of your current branch changes use change_impact.', inputSchema: {type: 'object', properties: {label: {type: 'string'}, relation_filter: {type: 'string', description: 'Optional: filter by relation type'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNeighbors(g, a, ctx)},
         {cap: 'graph', name: 'query_graph', description: 'Explore the graph around a concept (BFS/DFS). Returns a focused, ranked subgraph — the closest, most-connected nodes near the matched seeds, with edges among them — not the full flood; states how many nodes were reached vs shown.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Natural language question or keyword search'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, required: ['question']}, run: (g, a) => tg.tQueryGraph(g, a)},
-        {cap: 'graph', name: 'god_nodes', description: 'Return the most connected nodes - the core abstractions of the knowledge graph.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', default: 10}}}, run: (g, a) => tg.tGodNodes(g, a)},
+        {cap: 'graph', name: 'god_nodes', description: 'Rank connectivity hubs by unique call/import/reference neighbors, excluding structural containment. Repeated call sites are reported separately and do not inflate the rank.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', default: 10}}}, run: (g, a) => tg.tGodNodes(g, a)},
         {cap: 'graph', name: 'shortest_path', description: 'Find the shortest path between two concepts in the knowledge graph.', inputSchema: {type: 'object', properties: {source: {type: 'string'}, target: {type: 'string'}, max_hops: {type: 'integer', default: 8}}, required: ['source', 'target']}, run: (g, a) => tg.tShortestPath(g, a)},
         {cap: 'graph', name: 'get_dependents', description: 'Transitive blast-radius of ONE node: everything that calls/imports/inherits it, directly or through intermediaries (reverse edges, ranked by proximity then connectivity). For a symbol, also follows importers of its containing file. Use before refactoring; get_neighbors shows only 1 hop, change_impact covers your whole current diff at once.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID'}, depth: {type: 'integer', description: 'Max reverse hops, default 3', default: 3}, max_nodes: {type: 'integer', description: 'Max dependents to list, default 40', default: 40}}, required: ['label']}, run: (g, a) => ti.tGetDependents(g, a)},
         {cap: 'graph', name: 'change_impact', description: 'Blast radius of a change: by default diffs branch commits + staged/unstaged/untracked work against a base ref (auto merge-base with origin/main|master), OR takes an explicit `files` list (e.g. a PR\'s changed files — assesses a NOT-checked-out PR). Maps changed files/symbols onto the graph and lists everything depending on them (reverse edges, ranked by proximity + connectivity) with test coverage attached — untested hotspots called out. Run before opening or reviewing a PR; drill down with get_dependents, coverage detail via coverage_map.', inputSchema: {type: 'object', properties: {base: {type: 'string', description: 'Base ref, e.g. origin/main or HEAD~1 (default: first existing of origin/HEAD, origin/main, origin/master, main, master)'}, files: {type: 'array', items: {type: 'string'}, description: 'Explicit repo-relative changed-file list — skips the local git diff; use for PRs that are not checked out'}, depth: {type: 'integer', description: 'Max reverse hops, default 2'}, max_nodes: {type: 'integer', description: 'Max impacted nodes to list, default 40'}}}, run: (g, a, ctx) => ti.tChangeImpact(g, a, ctx)},
@@ -37,16 +38,16 @@ function buildTools({tg, ti, th, ta}) {
         {cap: 'source', name: 'list_endpoints', description: 'Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux …): method, path, handler, and file:line, deduped across code and OpenAPI docs.', inputSchema: {type: 'object', properties: {max_results: {type: 'integer', description: 'Max endpoints to list, default 100'}}}, run: (g, a, ctx) => th.tListEndpoints(g, a, ctx)},
         {cap: 'build', name: 'rebuild_graph', description: "Rebuild this repo's code graph from current source (weavatrix's own web-tree-sitter builder), reload it in-memory, and report the STRUCTURAL DELTA vs the previous state — new/removed module dependencies, cycle changes, newly orphaned symbols. The prior state is saved as graph.prev.json for graph_diff. Call after significant edits.", inputSchema: {type: 'object', properties: {mode: {type: 'string', enum: ['full', 'no-tests', 'tests-only'], default: 'full'}, scope: {type: 'string', description: 'optional path prefix to limit the graph'}}}, run: (g, a, ctx) => ta.tRebuildGraph(g, a, ctx)},
         {cap: 'graph', name: 'graph_diff', description: 'Structural diff of the last rebuild: previous graph state (graph.prev.json, saved by rebuild_graph) vs current — architecture drift (new module dependencies), broken or introduced import cycles, symbols that lost their last caller. The semantic complement to the textual git diff for validating a refactor.', inputSchema: {type: 'object', properties: {path: {type: 'string', description: 'Optional node-id/path prefix to scope the diff, e.g. src/query'}}}, run: (g, a, ctx) => ti.tGraphDiff(g, a, ctx)},
-        {cap: 'build', name: 'open_repo', description: 'Retarget this server at another local repository: loads its graph from the central weavatrix-graphs layout next to the repo, building it first when missing (large repos can take minutes; pass build:false to probe without building). Afterwards every tool answers for the new repo.', inputSchema: {type: 'object', properties: {path: {type: 'string', description: 'Absolute path to the repository folder'}, build: {type: 'boolean', description: 'Build the graph when missing (default true)', default: true}, mode: {type: 'string', enum: ['full', 'no-tests', 'tests-only'], default: 'full'}}, required: ['path']}, run: (g, a, ctx) => ta.tOpenRepo(g, a, ctx)},
-        {cap: 'graph', name: 'list_known_repos', description: 'List sibling repositories that already have a built graph in the central weavatrix-graphs folder next to the current repo — ready targets for open_repo.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => ta.tListKnownRepos(g, a, ctx)},
+        {cap: 'retarget', name: 'open_repo', description: 'OFFLINE RETARGET: switch this server to another local Git repository, building its graph when missing. This explicit tool call changes the active repository boundary; pass build:false to probe without building. Omit the retarget capability at registration to pin one repository.', inputSchema: {type: 'object', properties: {path: {type: 'string', description: 'Absolute path to a Git working tree'}, build: {type: 'boolean', description: 'Build the graph when missing (default true)', default: true}, mode: {type: 'string', enum: ['full', 'no-tests', 'tests-only'], default: 'full'}}, required: ['path']}, run: (g, a, ctx) => ta.tOpenRepo(g, a, ctx)},
+        {cap: 'retarget', name: 'list_known_repos', description: 'OFFLINE RETARGET: list sibling repositories with existing graphs that can be selected through open_repo.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => ta.tListKnownRepos(g, a, ctx)},
         {cap: 'online', name: 'refresh_advisories', description: "ONLINE, explicit opt-in: refresh the local OSV advisory store for this repo's lockfile-pinned packages (npm/PyPI/Go). Sends package names + versions to OSV.dev — never automatic, never source code. Afterwards run_audit reads the refreshed store fully offline (~/.weavatrix/advisories.json).", inputSchema: {type: 'object', properties: {timeout_ms: {type: 'integer', description: 'Per-request timeout, default 20000'}}}, run: (g, a, ctx) => ta.tRefreshAdvisories(g, a, ctx)},
-        {cap: 'online', name: 'sync_graph', description: 'ONLINE, explicit opt-in, off until configured: push the current graph.json to your weavatrix site or self-hosted endpoint (env WEAVATRIX_SYNC_URL, optional WEAVATRIX_SYNC_TOKEN bearer auth) for a hosted graph view. Payload is the graph only — file paths, symbol names, edges — never file contents.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => ta.tSyncGraph(g, a, ctx)},
+        {cap: 'online', name: 'sync_graph', description: 'ONLINE, explicit opt-in, off until configured: send a versioned allowlist of graph metadata to an endpoint you configure (env WEAVATRIX_SYNC_URL, optional WEAVATRIX_SYNC_TOKEN bearer auth). Unknown graph fields are discarded and source file bodies are never read for sync. Rebuild graphs created before 0.1.3 once to add typed-edge metadata.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => ta.tSyncGraph(g, a, ctx)},
     ]
 }
 
 // Import the tool modules (cache-busted when version > 0), build the catalog, apply the caps filter.
-// capsArg semantics: undefined/null = no per-repo config → ALL tools; a present string (even '') is an
-// explicit selection → expose exactly those groups, so "select nothing" really exposes nothing.
+// capsArg semantics: undefined/null = offline defaults (including explicit-call repo retargeting); a
+// present string (even '') is an explicit selection, so "select nothing" really exposes nothing.
 export async function loadHotApi(version, capsArg) {
     const v = version ? `?v=${version}` : ''
     const [tg, ti, th, ta] = await Promise.all([
@@ -56,8 +57,9 @@ export async function loadHotApi(version, capsArg) {
         import(new URL(`./tools-actions.mjs${v}`, import.meta.url).href),
     ])
     const all = buildTools({tg, ti, th, ta})
-    const caps = capsArg == null ? null : new Set(String(capsArg).split(',').map((s) => s.trim()).filter(Boolean))
-    const tools = caps ? all.filter((t) => caps.has(t.cap)) : all
+    const selected = capsArg == null ? DEFAULT_CAPS : String(capsArg).split(',').map((s) => s.trim()).filter(Boolean)
+    const caps = new Set(selected)
+    const tools = all.filter((t) => caps.has(t.cap))
     return {
         tools,
         byName: new Map(tools.map((t) => [t.name, t])),