weavatrix 0.1.2 → 0.1.4

package/src/mcp/sync-payload.mjs

@@ -9,6 +9,27 @@ function metadataString(value, max = 4096) {
         : undefined;
 }
 
+// graph.json is derived data and may be edited independently of the repository. Never trust a path
+// merely because it occupies an allowlisted field: sync only accepts canonical-looking repo-relative
+// paths, on every host OS. Graph IDs append `#symbol@line`, so validate their file portion separately
+// while preserving the complete ID on the wire.
+function repoRelativePathString(value, max = 4096) {
+    const path = metadataString(value, max);
+    if (!path) return undefined;
+    if (/^(?:[a-z][a-z0-9+.-]*:|[\\/])/i.test(path)) return undefined; // URI, drive path, POSIX or UNC absolute
+    const segments = path.split(/[\\/]/);
+    if (segments.some((segment) => segment === '.' || segment === '..')) return undefined;
+    return path;
+}
+
+function graphIdString(value) {
+    const id = metadataString(value);
+    if (!id) return undefined;
+    const hash = id.indexOf('#');
+    const file = hash < 0 ? id : id.slice(0, hash);
+    return repoRelativePathString(file) ? id : undefined;
+}
+
 function finiteNumber(value) {
     return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
 }
@@ -37,12 +58,12 @@ function sanitizeComplexity(value) {
 
 function sanitizeNode(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-    const id = metadataString(value.id);
+    const id = graphIdString(value.id);
     if (!id) return null;
     const out = {id};
     setIf(out, 'label', metadataString(value.label, 1024));
     setIf(out, 'file_type', metadataString(value.file_type, 32));
-    setIf(out, 'source_file', metadataString(value.source_file));
+    setIf(out, 'source_file', repoRelativePathString(value.source_file));
     const sourceLocation = metadataString(value.source_location, 32);
     const sourceEnd = metadataString(value.source_end, 32);
     if (sourceLocation && /^L\d+$/.test(sourceLocation)) out.source_location = sourceLocation;
@@ -57,18 +78,23 @@ function sanitizeNode(value) {
 
 function sanitizeLink(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-    const source = metadataString(value.source);
-    const target = metadataString(value.target);
+    const source = graphIdString(value.source);
+    const target = graphIdString(value.target);
     if (!source || !target) return null;
     const out = {source, target};
     setIf(out, 'relation', metadataString(value.relation, 32));
     setIf(out, 'confidence', metadataString(value.confidence, 32));
+    if (value.typeOnly === true) out.typeOnly = true;
+    if (value.compileOnly === true) out.compileOnly = true;
+    const line = finiteNumber(value.line);
+    if (line !== undefined && Number.isInteger(line) && line >= 0) out.line = line;
+    setIf(out, 'specifier', metadataString(value.specifier));
     return out;
 }
 
 function sanitizeExternalImport(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-    const file = metadataString(value.file);
+    const file = repoRelativePathString(value.file);
     if (!file) return null;
     const out = {file};
     for (const key of ['spec', 'target']) setIf(out, key, metadataString(value[key]));
@@ -85,14 +111,18 @@ export function createSyncPayload(raw) {
     if (!raw || typeof raw !== 'object' || Array.isArray(raw) || raw.repoBoundaryV !== 1) {
         throw new Error('graph predates repository-boundary hardening');
     }
+    if (!Number.isInteger(raw.edgeTypesV) || raw.edgeTypesV < 2) {
+        throw new Error('graph predates compile-only edge metadata');
+    }
     const nodes = Array.isArray(raw.nodes) ? raw.nodes.map(sanitizeNode).filter(Boolean) : [];
     const links = Array.isArray(raw.links) ? raw.links.map(sanitizeLink).filter(Boolean) : [];
     const externalImports = Array.isArray(raw.externalImports)
         ? raw.externalImports.map(sanitizeExternalImport).filter(Boolean)
         : [];
     return {
-        syncPayloadV: 1,
+        syncPayloadV: 2,
         repoBoundaryV: 1,
+        edgeTypesV: 2,
         extImportsV: Number.isInteger(raw.extImportsV) ? raw.extImportsV : 0,
         complexityV: Number.isInteger(raw.complexityV) ? raw.complexityV : 0,
         nodes,

package/src/mcp/tools-actions.mjs

@@ -16,7 +16,7 @@ export async function tRebuildGraph(g, args, ctx) {
     // snapshot the outgoing state: bytes → graph.prev.json (for graph_diff later), struct → inline delta
     let prevBytes = null
     try { prevBytes = readFileSync(ctx.graphPath) } catch { /* first build — nothing to diff against */ }
-    const before = g?.nodes ? {nodes: g.nodes, links: g.links} : null
+    const before = g?.nodes ? {nodes: g.nodes, links: g.links, edgeTypesV: g.edgeTypesV || 0} : null
     const res = await buildGraphForRepo(ctx.repoRoot, {mode, scope: args.scope || ''})
     if (!res || !res.ok) return `Graph rebuild failed: ${(res && res.error) || 'unknown error'}`
     if (prevBytes) { try { writeFileSync(prevGraphPathFor(ctx.graphPath), prevBytes) } catch { /* snapshot is best-effort */ } }
@@ -41,8 +41,21 @@ export async function tOpenRepo(g, args, ctx) {
     if (!existsSync(join(repoPath, '.git'))) return `Not a Git repository: ${requestedPath}`
     const graphPath = join(graphOutDirForRepo(repoPath), 'graph.json')
     let built = false
-    if (!existsSync(graphPath)) {
-        if (args.build === false) return `No graph yet for ${repoPath} (expected at ${graphPath}). Re-call without build:false to build one — large repos can take minutes.`
+    let upgrade = false
+    if (existsSync(graphPath)) {
+        try {
+            const saved = JSON.parse(readFileSync(graphPath, 'utf8'))
+            upgrade = !Number.isInteger(saved.edgeTypesV) || saved.edgeTypesV < 2
+        } catch {
+            upgrade = true
+        }
+    }
+    if (!existsSync(graphPath) || upgrade) {
+        if (args.build === false) {
+            return upgrade
+                ? `The existing graph for ${repoPath} predates compile-only edge metadata (edge schema v2). Re-call without build:false to upgrade it before switching.`
+                : `No graph yet for ${repoPath} (expected at ${graphPath}). Re-call without build:false to build one — large repos can take minutes.`
+        }
         const mode = ['no-tests', 'tests-only', 'full'].includes(args.mode) ? args.mode : 'full'
         const res = await buildGraphForRepo(repoPath, {mode, scope: ''})
         if (!res || !res.ok) return `Graph build failed for ${repoPath}: ${(res && res.error) || 'unknown error'}`
@@ -58,7 +71,8 @@ export async function tOpenRepo(g, args, ctx) {
         ctx.reload()
         return `Failed to load ${graphPath} — still targeting the previous repo (${prev.repoRoot || 'none'}).`
     }
-    return `Opened ${repoPath}${built ? ' (graph built fresh)' : ''}: ${loaded.nodes.length} nodes / ${loaded.links.length} edges. All tools now target this repo.`
+    const buildNote = built ? (upgrade ? ' (graph upgraded to edge metadata v2)' : ' (graph built fresh)') : ''
+    return `Opened ${repoPath}${buildNote}: ${loaded.nodes.length} nodes / ${loaded.links.length} edges. All tools now target this repo.`
 }
 
 // Sibling repos that already have a built graph in the central weavatrix-graphs folder — open_repo candidates.
@@ -99,7 +113,7 @@ export async function tRefreshAdvisories(g, args, ctx) {
     if (res.ok === false) return `Advisory refresh failed: ${res.error}`
     const meta = storeMeta()
     return [
-        `Advisory store refreshed from OSV.dev: ${res.queried} package versions queried, ${res.vulnerable} with known advisories (${res.fetched} advisory records fetched).`,
+        `Advisory store ${res.status === 'PARTIAL' ? 'partially refreshed' : 'refreshed'} from OSV.dev: ${res.queriedOk ?? res.queried}/${res.queried} package versions queried successfully, ${res.vulnerable} with known advisories (${res.fetched} advisory records fetched).`,
         res.unsupported ? `${res.unsupported} packages skipped (ecosystem not OSV-queryable — npm/PyPI/Go only).` : null,
         res.errors?.length ? `Partial: ${res.errors.length} request error(s), first: ${res.errors[0]}` : null,
         `Store: ${DEFAULT_STORE} (${meta.advisoryCount} advisories, fetched ${meta.fetchedAt}). run_audit now reflects it — offline.`,
@@ -118,8 +132,8 @@ export async function tSyncGraph(g, args, ctx) {
     let raw
     try { raw = JSON.parse(readFileSync(ctx.graphPath, 'utf8')) } catch (e) { return `Cannot read ${ctx.graphPath}: ${e.message}` }
     let payload
-    try { payload = createSyncPayload(raw) } catch {
-        return 'This graph predates repository-boundary hardening. Run rebuild_graph once before sync_graph.'
+    try { payload = createSyncPayload(raw) } catch (e) {
+        return `Cannot sync: ${e.message}. Run rebuild_graph once before sync_graph.`
     }
     const body = JSON.stringify(payload)
     const repoName = String(ctx.repoRoot || '').replace(/[\\/]+$/, '').split(/[\\/]/).pop() || 'repo'
@@ -128,6 +142,7 @@ export async function tSyncGraph(g, args, ctx) {
             method: 'POST',
             headers: {
                 'content-type': 'application/json',
+                'x-weavatrix-payload-version': String(payload.syncPayloadV),
                 'x-weavatrix-repo': repoName,
                 ...(process.env.WEAVATRIX_SYNC_TOKEN ? {authorization: `Bearer ${process.env.WEAVATRIX_SYNC_TOKEN}`} : {}),
             },

package/src/mcp/tools-graph-hubs.mjs

@@ -0,0 +1,58 @@
+// Connectivity-hub reporting, split from the general graph query tools.
+import {connList} from './graph-context.mjs'
+
+const isCompileTimeEdge = (edge) => edge?.typeOnly === true || edge?.compileOnly === true
+
+export function tGodNodes(g, {top_n = 10} = {}) {
+    const n = Math.max(1, Math.min(100, Number(top_n) || 10))
+    const scored = g.nodes
+        .map((node) => {
+            const rawOuts = g.out.get(String(node.id)) || []
+            const rawIns = g.inn.get(String(node.id)) || []
+            const outs = connList(rawOuts)
+            const ins = connList(rawIns)
+            const ownedMethods = new Set(rawOuts.filter((e) => e.relation === 'method').map((e) => String(e.id)))
+            const outIds = new Set(outs.map((e) => String(e.id)))
+            const inIds = new Set(ins.map((e) => String(e.id)))
+            const allIds = new Set([...outIds, ...inIds])
+            const runtimeIds = new Set([...outs, ...ins].filter((e) => !isCompileTimeEdge(e)).map((e) => String(e.id)))
+            const compileOnlyIds = new Set([...outs, ...ins].filter(isCompileTimeEdge).map((e) => String(e.id)))
+            for (const id of runtimeIds) compileOnlyIds.delete(id)
+            const occurrences = outs.length + ins.length
+            return {
+                node,
+                deg: allIds.size,
+                runtime: runtimeIds.size,
+                compileOnly: compileOnlyIds.size,
+                out: outIds.size,
+                in: inIds.size,
+                occurrences,
+                ownedMethods: ownedMethods.size,
+            }
+        })
+        .filter((entry) => entry.deg > 0 || entry.ownedMethods > 0)
+        .sort((a, b) => b.runtime - a.runtime || b.deg - a.deg || b.ownedMethods - a.ownedMethods || b.occurrences - a.occurrences)
+    const ranked = scored.slice(0, n)
+    const rankedIds = new Set(ranked.map((entry) => String(entry.node.id)))
+    // Unique neighbors measure coupling, but a large component repeatedly calling the same helper (for
+    // example i18n) can still be a valuable complexity hotspot. Preserve that second lens explicitly
+    // instead of letting repeated sites inflate the coupling rank.
+    const occurrenceHotspots = scored
+        .filter((entry) => !rankedIds.has(String(entry.node.id)))
+        .filter((entry) => entry.occurrences >= 20 && entry.occurrences - entry.deg >= 10)
+        .sort((a, b) => (b.occurrences - b.deg) - (a.occurrences - a.deg) || b.occurrences - a.occurrences)
+        .slice(0, Math.min(5, n))
+    return [
+        `Top ${ranked.length} connectivity hubs (ranked by unique runtime call/import/reference neighbors; structural ownership shown separately):`,
+        ...ranked.map(
+            (r, i) =>
+                `${String(i + 1).padStart(2)}. ${r.node.label ?? r.node.id}  (${r.deg} unique: ${r.runtime} runtime, ${r.compileOnly} compile-only; out ${r.out}, in ${r.in}; ${r.occurrences} edge occurrence${r.occurrences === 1 ? '' : 's'}${r.ownedMethods ? `; owns ${r.ownedMethods} method${r.ownedMethods === 1 ? '' : 's'}` : ''})  [${r.node.id}]`
+        ),
+        `Repeated call sites affect the occurrence count, not the connectivity rank; compile-only neighbors are secondary to runtime coupling.`,
+        occurrenceHotspots.length ? `` : null,
+        occurrenceHotspots.length ? `High occurrence hotspots outside the connectivity rank (repeated call/reference sites; complexity signal, not broader coupling):` : null,
+        ...occurrenceHotspots.map((r) =>
+            `  ${r.node.label ?? r.node.id}  (${r.occurrences} occurrences across ${r.deg} unique neighbors; ${r.occurrences - r.deg} repeats)  [${r.node.id}]`
+        ),
+    ].filter((line) => line != null).join('\n')
+}

package/src/mcp/tools-graph.mjs

@@ -7,14 +7,20 @@ import {
     graphStaleness, fileStalenessNote,
 } from './graph-context.mjs'
 
+const compileKind = (edge) => edge?.typeOnly === true ? 'type-only' : edge?.compileOnly === true ? 'compile-only' : null
+
 export function tGraphStats(g, ctx) {
     const files = g.nodes.filter((n) => !isSymbol(n.id)).length
     const symbols = g.nodes.length - files
     const relCount = {}
     const confCount = {}
+    let typeOnlyEdges = 0
+    let compileOnlyEdges = 0
     for (const e of g.links) {
         relCount[e.relation ?? '?'] = (relCount[e.relation ?? '?'] || 0) + 1
         if (e.confidence != null) confCount[e.confidence] = (confCount[e.confidence] || 0) + 1
+        if (e.typeOnly === true) typeOnlyEdges++
+        if (e.compileOnly === true) compileOnlyEdges++
     }
     const comm = new Map()
     for (const n of g.nodes) {
@@ -33,6 +39,7 @@ export function tGraphStats(g, ctx) {
         ctx?.repoRoot ? `- Repo: ${ctx.repoRoot}` : null,
         `- Nodes: ${g.nodes.length} (${files} files, ${symbols} symbols)`,
         `- Edges: ${g.links.length}`,
+        g.edgeTypesV ? `- Typed-edge metadata: v${g.edgeTypesV} (${typeOnlyEdges} type-only, ${compileOnlyEdges} compile-only edges)` : `- Typed-edge metadata: unavailable (rebuild_graph required)`,
         `- Relations: ${fmt(relCount)}`,
         Object.keys(confCount).length ? `- Confidence: ${fmt(confCount)}` : null,
         `- Communities: ${comm.size} (top by size: ${topComm.map(([c, n]) => `#${c}=${n}`).join(', ')})`,
@@ -54,7 +61,7 @@ export function tGetNode(g, {label} = {}, ctx) {
     const sample = (list, dir) =>
         list
             .slice(0, 12)
-            .map((e) => `  ${dir === 'out' ? '→' : '←'} ${e.relation || 'rel'}  ${labelOf(g, e.id)}  [${e.id}]`)
+            .map((e) => `  ${dir === 'out' ? '→' : '←'} ${compileKind(e) ? `${compileKind(e)} ` : ''}${e.relation || 'rel'}  ${labelOf(g, e.id)}  [${e.id}]`)
             .join('\n') || '  (none)'
     return [
         note,
@@ -77,10 +84,10 @@ export function tGetNode(g, {label} = {}, ctx) {
 function dedupeEdges(list) {
     const grouped = new Map()
     for (const e of list) {
-        const key = `${e.relation || 'rel'}|${e.id}`
+        const key = `${e.relation || 'rel'}|${compileKind(e) || 'runtime'}|${e.id}`
         const cur = grouped.get(key)
         if (cur) cur.count += 1
-        else grouped.set(key, {id: e.id, relation: e.relation, count: 1})
+        else grouped.set(key, {id: e.id, relation: e.relation, typeOnly: e.typeOnly === true, compileOnly: e.compileOnly === true, count: 1})
     }
     return [...grouped.values()]
 }
@@ -99,7 +106,7 @@ export function tGetNeighbors(g, {label, relation_filter} = {}, ctx) {
     const outs = dedupeEdges(outsRaw)
     const ins = dedupeEdges(insRaw)
     const line = (e, dir) =>
-        `  ${dir === 'out' ? '→' : '←'} ${e.relation || 'rel'}  ${labelOf(g, e.id)}  [${e.id}]${e.count > 1 ? `  (${e.count} sites)` : ''}`
+        `  ${dir === 'out' ? '→' : '←'} ${compileKind(e) ? `${compileKind(e)} ` : ''}${e.relation || 'rel'}  ${labelOf(g, e.id)}  [${e.id}]${e.count > 1 ? `  (${e.count} sites)` : ''}`
     return [
         note,
         `Neighbors of ${n.label ?? id}${rf ? ` (relation=${rf})` : ''}: ${outs.length + ins.length} unique (${outsRaw.length + insRaw.length} edges)`,
@@ -111,24 +118,8 @@ export function tGetNeighbors(g, {label, relation_filter} = {}, ctx) {
     ].filter(Boolean).join('\n')
 }
 
-export function tGodNodes(g, {top_n = 10} = {}) {
-    const n = Math.max(1, Math.min(100, Number(top_n) || 10))
-    const ranked = g.nodes
-        .map((node) => {
-            const o = connList(g.out.get(String(node.id))).length
-            const i = connList(g.inn.get(String(node.id))).length
-            return {node, deg: o + i, out: o, in: i}
-        })
-        .sort((a, b) => b.deg - a.deg)
-        .slice(0, n)
-    return [
-        `Top ${n} most-connected nodes (call/import/reference edges, excluding structural containment):`,
-        ...ranked.map(
-            (r, i) =>
-                `${String(i + 1).padStart(2)}. ${r.node.label ?? r.node.id}  (${r.deg} edges: out ${r.out}, in ${r.in})  [${r.node.id}]`
-        ),
-    ].join('\n')
-}
+export {tGodNodes} from './tools-graph-hubs.mjs'
+
 
 export function tGetCommunity(g, {community_id} = {}) {
     const groups = new Map()

package/src/mcp/tools-health.mjs

@@ -38,19 +38,38 @@ export function tFindDuplicates(g, args, ctx) {
     if (args.mode === 'semantic') {
         const data = computeDuplicates(ctx.repoRoot, ctx.graphPath, {nameTwins: true})
         const frags = data.frags
-        const groups = (data.nameTwins || [])
-            .map((t) => ({...t, members: t.members.filter((i) => (!skipTests || !frags[i].test) && frags[i].n >= tokMin)}))
-            .map((t) => ({...t, fileCount: new Set(t.members.map((i) => frags[i].file)).size}))
-            .filter((t) => t.members.length >= 2 && t.fileCount >= 2)
-        if (!groups.length) return 'No same-name symbol groups across files (semantic mode).'
-        const top = groups.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
-        const lines = top.map((t, k) => {
-            const verdict = t.simMax < 60 ? '  ⚠ DIVERGENT — same name, different bodies (drift hazard)' : t.simMin >= 90 ? '  near-identical — extract a shared module' : ''
-            const head = `${k + 1}. "${t.label}" — ${t.members.length} definitions in ${t.fileCount} files, similarity ${t.simMin}–${t.simMax}%${verdict}`
-            const sites = t.members.slice(0, 8).map((i) => `     ${frags[i].file}:${frags[i].start}-${frags[i].end}  (${frags[i].n} tok)`)
-            return [head, ...sites].join('\n')
+        const candidates = []
+        for (const twin of data.nameTwins || []) {
+            const allowed = new Set(twin.members.filter((i) => (!skipTests || !frags[i].test) && frags[i].n >= tokMin))
+            const pairs = (twin.pairs || []).filter((p) => allowed.has(p.a) && allowed.has(p.b))
+            if (!pairs.length) continue
+            const closest = pairs.slice().sort((a, b) => b.similarity - a.similarity)[0]
+            const farthest = pairs.slice().sort((a, b) => a.similarity - b.similarity)[0]
+            if (closest.similarity >= 85) candidates.push({kind: 'clone', label: twin.label, pair: closest})
+            if (farthest.similarity <= 45) candidates.push({kind: 'collision', label: twin.label, pair: farthest})
+        }
+        for (const item of candidates) item.tokens = frags[item.pair.a].n + frags[item.pair.b].n
+        candidates.sort((a, b) => {
+            if (a.kind !== b.kind) return a.kind === 'clone' ? -1 : 1
+            return a.kind === 'clone'
+                ? b.pair.similarity - a.pair.similarity || b.tokens - a.tokens
+                : b.tokens - a.tokens || a.pair.similarity - b.pair.similarity
         })
-        return `Found ${groups.length} same-name symbol group(s) across files (semantic mode; similarity = renamed-token jaccard, LOW = divergent copies). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nLow-similarity groups are the risky ones — same name, drifted behavior. read_source both sites to compare.`
+        if (!candidates.length) return 'No actionable same-name pairs across files (semantic mode; ambiguous middle-similarity pairs are suppressed).'
+        const top = candidates.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
+        const lines = top.map((item, k) => {
+            const a = frags[item.pair.a]
+            const b = frags[item.pair.b]
+            const verdict = item.kind === 'clone'
+                ? 'near-identical duplicate candidate — review, then extract shared logic if the contract is truly shared'
+                : 'name collision, not a duplicate — inspect only if these definitions should share a contract'
+            return [
+                `${k + 1}. "${item.label}" — ${item.pair.similarity}% similar; ${verdict}`,
+                `     ${a.file}:${a.start}-${a.end}  (${a.n} tok)`,
+                `     ${b.file}:${b.start}-${b.end}  (${b.n} tok)`,
+            ].join('\n')
+        })
+        return `Found ${candidates.length} actionable same-name pair(s) across files (semantic mode; one closest clone and/or farthest collision per name). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nThese are review candidates, not automatic refactors. Use read_source on both sites before changing code.`
     }
     const data = computeDuplicates(ctx.repoRoot, ctx.graphPath, {includeStrings})
     const groups = groupClones(data, {simMin, tokMin, mode, skipTests})
@@ -87,14 +106,15 @@ export async function tRunAudit(g, args, ctx) {
     const sev = audit.summary.bySeverity
     const bycat = audit.summary.byCategory
     const line = (f) => {
-        const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''})` : ''
+        const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''}${f.manifest ? `; ${f.manifest}` : ''})` : ''
         return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
     }
+    const check = (name, state) => `${name} ${state?.status || 'ERROR'}${state?.detail ? ` — ${state.detail}` : ''}`
     return [
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         `Severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
-        `Structure: ${audit.structureReport?.cycles ?? 0} cycle(s), ${audit.structureReport?.orphans ?? 0} orphan(s). Dead: ${audit.deadReport.deadFiles} file(s), ${audit.deadReport.unusedExports} unused export(s).`,
-        audit.scanned.advisoryDbDate ? `Advisory DB: ${audit.scanned.advisoryDbDate}.` : 'Advisory DB: never refreshed for this repo — known-vuln matching skipped (see refresh_advisories).',
+        `Structure: ${audit.structureReport?.runtimeCycles ?? audit.structureReport?.cycles ?? 0} runtime cycle(s), ${audit.structureReport?.compileTimeCouplings ?? audit.structureReport?.typeCouplings ?? 0} compile-time coupling group(s), ${audit.structureReport?.orphans ?? 0} orphan(s); import edges: ${audit.structureReport?.runtimeImportEdges ?? audit.structureReport?.importEdges ?? 0} runtime + ${audit.structureReport?.typeOnlyImportEdges ?? 0} type-only + ${audit.structureReport?.compileOnlyImportEdges ?? 0} compile-only. Dead: ${audit.deadReport.deadFiles} file(s), ${audit.deadReport.unusedExports} unused export(s).`,
+        `Checks: ${check('OSV', audit.checks?.osv)}; ${check('malware', audit.checks?.malware)}. A NOT_CHECKED/PARTIAL/ERROR check is incomplete or unknown, never a clean zero.`,
         ``,
         `Showing ${shown.length} of ${filtered.length} finding(s)${cat ? ` in category "${cat}"` : ''}${args.min_severity ? ` at ≥${args.min_severity}` : ''}:`,
         ...shown.map(line),
@@ -120,13 +140,29 @@ export function tModuleMap(g, args, ctx) {
     const topN = Math.max(1, Math.min(60, Number(args.top_n) || 25))
     const mods = agg.modules.slice(0, topN)
     const edges = agg.moduleEdges.slice(0, Math.min(50, topN * 2))
+    const compileEdges = new Map()
+    const collectCompileEdges = (list, kind) => {
+        for (const edge of list || []) {
+            const key = `${edge.from}\0${edge.to}`
+            const current = compileEdges.get(key) || {from: edge.from, to: edge.to, count: 0, typeOnly: 0, compileOnly: 0}
+            current.count += edge.count
+            current[kind] += edge.count
+            compileEdges.set(key, current)
+        }
+    }
+    collectCompileEdges(agg.typeOnlyModuleEdges, 'typeOnly')
+    collectCompileEdges(agg.compileOnlyModuleEdges, 'compileOnly')
+    const compiled = [...compileEdges.values()].sort((a, b) => b.count - a.count).slice(0, Math.min(50, topN * 2))
     return [
-        `Module map: ${agg.totals.files} files in ${agg.modules.length} folder-modules, ${agg.totals.moduleEdges} module edges. Top ${mods.length}:`,
+        `Module map: ${agg.totals.files} files in ${agg.modules.length} folder-modules, ${agg.totals.moduleEdges} runtime module dependencies and ${agg.totals.compileTimeModuleEdges || 0} compile-time dependencies (${agg.totals.typeOnlyModuleEdges || 0} type-only, ${agg.totals.compileOnlyModuleEdges || 0} compile-only). Top ${mods.length}:`,
         ...mods.map((m) => `  ${m.name} — ${m.fileCount} files, ${m.symbolCount} symbols`),
         ``,
-        `Strongest module dependencies:`,
+        `Strongest runtime module dependencies:`,
         ...edges.map((e) => `  ${e.from} → ${e.to}  (${e.count})`),
-    ].join('\n')
+        compiled.length ? `` : null,
+        compiled.length ? `Compile-time module dependencies (not runtime coupling):` : null,
+        ...compiled.map((e) => `  ${e.from} → ${e.to}  (${e.count}; ${e.typeOnly} type-only, ${e.compileOnly} compile-only)`),
+    ].filter((line) => line != null).join('\n')
 }
 
 // Coverage × graph: map an EXISTING coverage report (istanbul/lcov/coverage.py/Go — read offline,

package/src/mcp/tools-impact.mjs

@@ -9,6 +9,47 @@ import {
     rawGraph, prevGraphPathFor, edgeEndpoint, diffGraphs, formatGraphDiff,
 } from './graph-context.mjs'
 import {readCoverageForRepo} from '../analysis/coverage-reports.js'
+import {isStructuralRelation} from '../graph/relations.js'
+
+function reverseReach(g, seeds, maxDepth) {
+    const states = new Map([...seeds].map((id) => [String(id), {
+        runtimeDepth: 0, runtimeRelation: null, compileDepth: null, compileRelation: null,
+    }]))
+    const frontier = [...seeds].map((id) => ({id: String(id), depth: 0, compileOnly: false}))
+    for (let cursor = 0; cursor < frontier.length; cursor++) {
+        const current = frontier[cursor]
+        if (current.depth >= maxDepth) continue
+        for (const e of g.inn.get(current.id) || []) {
+            if (isStructuralRelation(e.relation)) continue
+            const id = String(e.id)
+            const compileOnly = current.compileOnly || e.typeOnly === true || e.compileOnly === true
+            const depth = current.depth + 1
+            const entry = states.get(id) || {
+                runtimeDepth: null, runtimeRelation: null, compileDepth: null, compileRelation: null,
+            }
+            const depthKey = compileOnly ? 'compileDepth' : 'runtimeDepth'
+            const relationKey = compileOnly ? 'compileRelation' : 'runtimeRelation'
+            if (entry[depthKey] != null && entry[depthKey] <= depth) continue
+            entry[depthKey] = depth
+            entry[relationKey] = e.relation || 'rel'
+            states.set(id, entry)
+            frontier.push({id, depth, compileOnly})
+        }
+    }
+    return new Map([...states].map(([id, entry]) => [id, {
+        ...entry,
+        depth: entry.runtimeDepth ?? entry.compileDepth ?? 0,
+        compileOnly: entry.runtimeDepth == null,
+        relation: entry.runtimeDepth != null ? entry.runtimeRelation : entry.compileRelation,
+    }]))
+}
+
+const impactKind = (entry) => {
+    if (entry?.runtimeDepth != null) {
+        return entry.compileDepth != null ? `runtime + compile-time(d${entry.compileDepth})` : 'runtime'
+    }
+    return 'compile-time'
+}
 
 // Transitive blast-radius: who is affected if this node changes. Walks REVERSE dependency edges
 // (calls/imports/inherits — not structural `contains`) out to `depth`. For a symbol, also seeds its
@@ -30,34 +71,20 @@ export function tGetDependents(g, {label, depth = 3, max_nodes = 40} = {}) {
             seeds.add(containingFile)
         }
     }
-    const depthOf = new Map([...seeds].map((s) => [s, 0]))
-    const relOf = new Map()
-    let frontier = [...seeds]
-    for (let d = 0; d < maxDepth && frontier.length; d++) {
-        const next = []
-        for (const cur of frontier) {
-            for (const e of g.inn.get(cur) || []) {
-                if (e.relation === 'contains') continue // structural nesting is not a dependency
-                const nid = String(e.id)
-                if (depthOf.has(nid)) continue
-                depthOf.set(nid, d + 1)
-                relOf.set(nid, e.relation || 'rel')
-                next.push(nid)
-            }
-        }
-        frontier = next
-    }
-    const ranked = [...depthOf.entries()]
+    const reached = reverseReach(g, seeds, maxDepth)
+    const ranked = [...reached.entries()]
         .filter(([nid]) => !seeds.has(nid))
-        .map(([nid, d]) => ({id: nid, d, deg: degreeOf(g, nid)}))
-        .sort((a, b) => a.d - b.d || b.deg - a.deg)
+        .map(([nid, entry]) => ({id: nid, d: entry.depth, entry, deg: degreeOf(g, nid)}))
+        .sort((a, b) => a.d - b.d || Number(a.entry.compileOnly) - Number(b.entry.compileOnly) || b.deg - a.deg)
     if (!ranked.length) return [note, `No dependents found for ${n.label ?? id} within depth ${maxDepth} — nothing in the graph calls, imports, or inherits it.`].filter(Boolean).join('\n')
     const shown = ranked.slice(0, cap)
+    const runtimeCount = ranked.filter((entry) => !entry.entry.compileOnly).length
+    const compileCount = ranked.length - runtimeCount
     return [
         note,
-        `Dependents of ${n.label ?? id} (reverse calls/imports/inherits, depth ≤${maxDepth}): ${ranked.length} found, showing ${shown.length} by proximity + connectivity.`,
+        `Dependents of ${n.label ?? id} (reverse calls/imports/inherits, depth ≤${maxDepth}): ${ranked.length} found (${runtimeCount} runtime, ${compileCount} compile-time-only), showing ${shown.length} by proximity + connectivity.`,
         containingFile ? `Includes importers of its containing file ${labelOf(g, containingFile)}.` : null,
-        ...shown.map((r) => `  [d${r.d}] ${relOf.get(r.id) || 'rel'}  ${labelOf(g, r.id)}  (deg ${r.deg})  [${r.id}]`),
+        ...shown.map((r) => `  [d${r.d} ${impactKind(r.entry)}] ${r.entry.relation || 'rel'}  ${labelOf(g, r.id)}  (deg ${r.deg})  [${r.id}]`),
     ].filter(Boolean).join('\n')
 }
 
@@ -72,7 +99,8 @@ export function tGraphDiff(g, args, ctx) {
     const filter = args.path ? String(args.path).replace(/\\/g, '/') : null
     const scope = (graph) => filter ? {
         nodes: (graph.nodes || []).filter((n) => String(n.id).startsWith(filter)),
-        links: (graph.links || []).filter((l) => String(edgeEndpoint(l.source)).startsWith(filter) || String(edgeEndpoint(l.target)).startsWith(filter))
+        links: (graph.links || []).filter((l) => String(edgeEndpoint(l.source)).startsWith(filter) || String(edgeEndpoint(l.target)).startsWith(filter)),
+        edgeTypesV: graph.edgeTypesV || 0,
     } : graph
     return [
         `Graph diff (previous rebuild state → current)${filter ? `, scoped to ${filter}` : ''}:`,
@@ -144,43 +172,31 @@ export function tChangeImpact(g, args, ctx) {
 
     const maxDepth = Math.max(1, Math.min(4, Number(args.depth) || 2))
     const cap = Math.max(5, Math.min(120, Number(args.max_nodes) || 40))
-    const depthOf = new Map([...seeds].map((s) => [s, 0]))
-    const relOf = new Map()
-    let frontier = [...seeds]
-    for (let d = 0; d < maxDepth && frontier.length; d++) {
-        const next = []
-        for (const cur of frontier) {
-            for (const e of g.inn.get(cur) || []) {
-                if (e.relation === 'contains') continue
-                const nid = String(e.id)
-                if (depthOf.has(nid)) continue
-                depthOf.set(nid, d + 1)
-                relOf.set(nid, e.relation || 'rel')
-                next.push(nid)
-            }
-        }
-        frontier = next
-    }
+    const reached = reverseReach(g, seeds, maxDepth)
     const fileOfNode = (id) => { const s = String(id); const h = s.indexOf('#'); return h < 0 ? s : s.slice(0, h) }
-    const impacted = [...depthOf.entries()]
+    const impacted = [...reached.entries()]
         .filter(([nid]) => !seeds.has(nid) && !changedSet.has(fileOfNode(nid)))
-        .map(([nid, d]) => ({id: nid, d, deg: degreeOf(g, nid), file: fileOfNode(nid)}))
-        .sort((a, b) => a.d - b.d || b.deg - a.deg)
+        .map(([nid, entry]) => ({id: nid, d: entry.depth, entry, deg: degreeOf(g, nid), file: fileOfNode(nid)}))
+        .sort((a, b) => a.d - b.d || Number(a.entry.compileOnly) - Number(b.entry.compileOnly) || b.deg - a.deg)
 
     // coverage overlay from EXISTING reports (fractions 0..1) — see coverage_map for details
     const knownFiles = (rawGraph(ctx).nodes || []).filter((n) => !String(n.id).includes('#') && n.source_file).map((n) => n.source_file)
     const coverage = readCoverageForRepo(ctx.repoRoot, knownFiles)
     const covOf = (file) => coverage.get(String(file).replace(/\\/g, '/'))?.pct ?? null
     const pctStr = (v) => (v == null ? 'cov n/a' : `cov ${Math.round(v * 100)}%`)
+    const hasCoverage = coverage.size > 0
 
     const shown = impacted.slice(0, cap)
+    const runtimeImpacted = impacted.filter((entry) => !entry.entry.compileOnly).length
+    const compileImpacted = impacted.length - runtimeImpacted
     const untestedHotspots = shown.filter((n) => { const c = covOf(n.file); return c != null && c < 0.5 && n.deg >= 5 })
     return [
         `Change impact ${sourceLabel}: ${changed.length} changed file(s) → ${seeds.size} graph seed(s) incl. their symbols${unmapped.length ? `; ${unmapped.length} file(s) not in the graph (new/non-code — rebuild_graph refreshes)` : ''}.`,
         impacted.length
-            ? `${impacted.length} impacted node(s) within ${maxDepth} reverse hop(s), showing ${shown.length}:`
+            ? `${impacted.length} impacted node(s) within ${maxDepth} reverse hop(s) (${runtimeImpacted} runtime, ${compileImpacted} compile-time-only), showing ${shown.length}:`
             : `Nothing else in the graph depends on the changed code within ${maxDepth} hop(s).`,
-        ...shown.map((n) => `  [d${n.d}] ${relOf.get(n.id) || 'rel'}  ${labelOf(g, n.id)}  (deg ${n.deg}, ${pctStr(covOf(n.file))})  [${n.id}]`),
+        hasCoverage ? `Coverage: existing report mapped where available.` : `Coverage: unavailable (no supported report found); per-node coverage labels omitted.`,
+        ...shown.map((n) => `  [d${n.d} ${impactKind(n.entry)}] ${n.entry.relation || 'rel'}  ${labelOf(g, n.id)}  (deg ${n.deg}${hasCoverage ? `, ${pctStr(covOf(n.file))}` : ''})  [${n.id}]`),
         untestedHotspots.length ? `` : null,
         untestedHotspots.length ? `Untested hotspots in the blast radius (<50% coverage, deg ≥5) — cover these before shipping:` : null,
         ...untestedHotspots.slice(0, 10).map((n) => `  ${labelOf(g, n.id)}  (${pctStr(covOf(n.file))}, deg ${n.deg})  ${n.file}`),

package/src/mcp-server.mjs

@@ -131,6 +131,9 @@ async function main() {
             if (!graph && tool.cap !== 'build' && tool.cap !== 'retarget') return reply(id, {content: [{type: 'text', text: `Graph unavailable: ${graphError}`}], isError: true})
             try {
                 let text = String(await tool.run(graph, params?.arguments || {}, ctx))
+                if (graph && graph.edgeTypesV < 2 && (tool.cap === 'graph' || tool.cap === 'health')) {
+                    text += '\n\nWarning: this saved graph predates compile-only edge metadata (edge schema v2), so Rust module/use dependencies may be absent or misclassified. Call rebuild_graph once before acting on cycle, boundary, dependency, or blast-radius findings.'
+                }
                 // Graph answers silently reflect a point-in-time build — surface staleness on every graph tool.
                 if (tool.cap === 'graph') {
                     const warn = api.stalenessLine(ctx)