weavatrix 0.2.12 → 0.2.14

package/src/mcp/health/audit-format.mjs

@@ -0,0 +1,172 @@
+import {spawnSync} from 'node:child_process'
+import {summarizeFindings} from '../../analysis/findings.js'
+import {childProcessEnv} from '../../child-env.js'
+import {createPathClassifier, hasPathClass} from '../../path-classification.js'
+
+const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
+const AUDIT_NON_PRODUCT_CLASSES = ['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
+
+export function formatAuditFinding(f) {
+    const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''}${f.manifest ? `; ${f.manifest}` : ''})` : ''
+    const verification = f.verification?.evidenceModel
+        ? `\n      verification: ${f.verification.evidenceModel}; manifest ${f.verification.manifestDeclaration?.status || 'N/A'}; indexed imports ${f.verification.indexedSourceImports?.status || 'N/A'}; decision ${f.verification.decision || 'REVIEW_REQUIRED'}`
+        : ''
+    return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.reason ? `\n      reason: ${f.reason}` : ''}${verification}${f.cycleRoute ? `\n      route: ${f.cycleRoute}` : ''}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
+}
+
+const auditFindingPaths = (finding) => {
+    const paths = []
+    if (finding?.file) paths.push(String(finding.file))
+    if (Array.isArray(finding?.files)) paths.push(...finding.files.map(String))
+    if (finding?.cycleRoute) paths.push(...String(finding.cycleRoute).split(/\s*(?:→|→|->)\s*/))
+    return [...new Set(paths.map((file) => file.replace(/\\/g, '/').trim()).filter(Boolean))]
+}
+
+export function auditFindingPathScope(findings, {includeClassified = false, repoRoot = null} = {}) {
+    const all = Array.isArray(findings) ? findings : []
+    if (includeClassified) return {findings: all, suppressed: 0}
+    const classifier = createPathClassifier(repoRoot)
+    const cache = new Map()
+    const classified = (file) => {
+        if (!cache.has(file)) cache.set(file, classifier.explain(file, {content: ''}))
+        const info = cache.get(file)
+        return info?.excluded || AUDIT_NON_PRODUCT_CLASSES.some((name) => hasPathClass(info, name))
+    }
+    const kept = all.filter((finding) => {
+        const paths = auditFindingPaths(finding)
+        return !paths.length || paths.some((file) => !classified(file))
+    })
+    return {findings: kept, suppressed: all.length - kept.length}
+}
+
+const DEPENDENCY_AUDIT_RULES = new Set(['unused-dep', 'missing-dep', 'duplicate-dep', 'unresolved-import', 'lockfile-drift'])
+export const isDependencyAuditFinding = (finding) => DEPENDENCY_AUDIT_RULES.has(String(finding?.rule || ''))
+
+export const auditFilter = (audit, args, findings = audit.findings, repoRoot = null) => {
+    const minSev = SEVERITY_RANK[args.min_severity] ?? 4
+    const category = args.category ? String(args.category) : null
+    return auditFindingPathScope(findings, {includeClassified: args.include_classified === true, repoRoot}).findings
+        .filter((finding) => (SEVERITY_RANK[finding.severity] ?? 4) <= minSev)
+        .filter((finding) => !category || (category === 'dependencies' ? isDependencyAuditFinding(finding) : finding.category === category))
+}
+
+const auditChecksLine = (audit) => {
+    const check = (name, state) => `${name} ${state?.status || 'ERROR'}${state?.detail ? ` — ${state.detail}` : ''}`
+    return `Checks: ${check('OSV', audit.checks?.osv)}; ${check('malware', audit.checks?.malware)}. A NOT_CHECKED/PARTIAL/ERROR check is incomplete or unknown, never a clean zero.`
+}
+
+const auditCapabilityLines = (audit) => {
+    const matrix = audit.healthCapabilities || {}
+    const rows = [
+        ['structure', 'structure'],
+        ['dependencies', 'dependencies'],
+        ['runtimeCorrectness', 'runtime correctness'],
+        ['concurrency', 'concurrency'],
+        ['advisories', 'advisories'],
+        ['malware', 'malware'],
+        ['coverage', 'coverage'],
+    ]
+    const lines = ['Health capability matrix (status/completeness):']
+    for (const [key, label] of rows) {
+        const item = matrix[key]
+        lines.push(`  ${label}: ${item?.status || 'NOT_CHECKED'}/${item?.completeness || 'PARTIAL'} — ${item?.detail || 'Capability evidence was not reported.'}`)
+    }
+    return lines
+}
+
+const auditDependencyCoverageLines = (deps) => {
+    const ecosystems = Object.values(deps.ecosystems || {}).filter((item) => item?.present)
+    const verification = Object.entries(deps.verificationCoverage || {})
+    return [
+        ecosystems.length
+            ? `Dependency ecosystems: ${ecosystems.map((item) => `${item.ecosystem} ${item.status}/${item.completeness} (${item.manifests?.length || 0} manifest(s), ${item.declared || 0} declaration(s))`).join('; ')}.`
+            : 'Dependency ecosystems: no supported or unsupported dependency manifest was discovered.',
+        verification.length
+            ? `Dependency verification coverage: ${verification.map(([ecosystem, state]) => `${ecosystem} ${state}`).join('; ')}. Per-finding evidence: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`
+            : 'Dependency verification coverage: NOT_CHECKED; no manifest evidence was available.',
+    ]
+}
+
+const auditDependencySummaryLine = (audit, deps) => {
+    const ecosystems = Object.values(deps.ecosystems || {}).filter((item) => item?.present)
+    const checked = ecosystems.filter((item) => item.status === 'CHECKED')
+    const unsupported = ecosystems.filter((item) => item.status === 'NOT_SUPPORTED')
+    if (!ecosystems.length || deps.status === 'NOT_CHECKED') {
+        return 'Dependency manifests: NOT_CHECKED — no dependency manifest was discovered; manifest-to-import verification did not run and no dependency verdict was produced.'
+    }
+    if (!checked.length && unsupported.length) {
+        const manifests = unsupported.reduce((total, item) => total + (item.manifests?.length || 0), 0)
+        const declared = unsupported.reduce((total, item) => total + (item.declared || 0), 0)
+        const names = unsupported.map((item) => item.ecosystem).join(', ')
+        return `Dependency manifests: ${deps.status || 'PARTIAL'} — discovered ${declared} declaration(s) in ${manifests} ${names} manifest(s), but package-to-artifact verification is NOT_SUPPORTED; no unused, missing, or duplicate-declaration verdict was produced for those ecosystems.`
+    }
+    if (checked.length && unsupported.length) {
+        const checkedManifests = checked.reduce((total, item) => total + (item.manifests?.length || 0), 0)
+        const checkedDeclared = checked.reduce((total, item) => total + (item.declared || 0), 0)
+        const unsupportedManifests = unsupported.reduce((total, item) => total + (item.manifests?.length || 0), 0)
+        const unsupportedDeclared = unsupported.reduce((total, item) => total + (item.declared || 0), 0)
+        const checkedNames = checked.map((item) => item.ecosystem).join(', ')
+        const unsupportedNames = unsupported.map((item) => item.ecosystem).join(', ')
+        return `Dependency manifests: ${deps.status || 'PARTIAL'} — checked ${checkedDeclared} declaration(s) across ${checkedManifests} supported manifest(s) (${checkedNames}); inventoried ${unsupportedDeclared} declaration(s) across ${unsupportedManifests} unsupported manifest(s) (${unsupportedNames}), where package-to-artifact verification is NOT_SUPPORTED. Supported-ecosystem findings: unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`
+    }
+    return `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}.`
+}
+
+const auditConventionLines = (audit) => {
+    const entries = audit.conventionReachability?.entries || []
+    if (!entries.length) return []
+    return [
+        `Convention reachability: ${audit.conventionReachability.count} framework-managed file(s) are external entry points, not orphan/dead findings${audit.conventionReachability.truncated ? ' (evidence capped)' : ''}:`,
+        ...entries.slice(0, 5).map((entry) => `  [${entry.confidence}] ${entry.file} — ${entry.marker}: ${entry.reason}`),
+        audit.conventionReachability.count > 5 ? `  … +${audit.conventionReachability.count - 5} more in bounded JSON result data` : null,
+    ].filter((line) => line != null)
+}
+
+export const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = null, repoRoot = null) => {
+    const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
+    const pathScope = auditFindingPathScope(findings, {includeClassified: args.include_classified === true, repoRoot})
+    const filtered = auditFilter(audit, args, pathScope.findings, repoRoot)
+    const shown = filtered.slice(0, max)
+    const summary = summarizeFindings(pathScope.findings)
+    const sev = summary.bySeverity
+    const bycat = summary.byCategory
+    const deps = audit.dependencyReport || {}
+    return [
+        heading,
+        `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
+        ...auditConventionLines(audit),
+        auditDependencySummaryLine(audit, deps),
+        ...auditDependencyCoverageLines(deps),
+        ...auditCapabilityLines(audit),
+        `Scoped severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Scoped categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
+        pathScope.suppressed ? `Path policy: production-first; suppressed ${pathScope.suppressed} finding(s) whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded. Pass include_classified:true to include them.` : 'Path policy: production-first; no classified-only findings were suppressed.',
+        `Repository-level ${auditChecksLine(audit)}`,
+        '',
+        `Showing ${shown.length} of ${filtered.length} finding(s)${args.category ? ` in category "${args.category}"` : ''}${args.min_severity ? ` at ≥${args.min_severity}` : ''}:`,
+        ...shown.map(formatAuditFinding),
+        filtered.length > shown.length ? `  … +${filtered.length - shown.length} more (raise max_findings or filter by category/min_severity)` : null,
+    ].filter((line) => line != null).join('\n')
+}
+
+export const gitUntracked = (repoRoot) => {
+    const result = spawnSync('git', ['-C', repoRoot, 'ls-files', '--others', '--exclude-standard'], {
+        encoding: 'utf8', timeout: 8000, maxBuffer: 2 * 1024 * 1024, env: childProcessEnv(), windowsHide: true,
+    })
+    if (result.status !== 0) return {
+        ok: false,
+        files: [],
+        error: String(result.stderr || result.error?.message || 'git ls-files failed').trim(),
+    }
+    return {
+        ok: true,
+        files: String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean),
+        error: null,
+    }
+}
+
+export const pathsFromClassification = (classification) => [...new Set(classification.files
+    .flatMap((file) => [file.oldPath, file.newPath])
+    .filter((file) => file && file !== '(diff unavailable)'))]
+    .sort((left, right) => left.localeCompare(right))
+
+export const formatDebtFinding = (finding, state) => `  [${state}] ${formatAuditFinding(finding).trimStart()}`

package/src/mcp/health/audit.mjs

@@ -0,0 +1,171 @@
+import {rawGraph, effectiveRawGraph} from '../graph-context.mjs'
+import {runInternalAudit} from '../../analysis/internal-audit.js'
+import {classifyChangeImpact} from '../../analysis/change-classification.js'
+import {
+  compareAuditDebt,
+  normalizeAuditScopeFiles,
+  scopeAuditFindings,
+} from '../../analysis/audit-debt.js'
+import {buildInternalGraph} from '../../graph/internal-builder.js'
+import {resolveGitCommit, withGitRefCheckout} from '../../analysis/git-ref-graph.js'
+import {filterGraphForMode} from '../../graph/graph-filter.js'
+import {toolResult} from '../tool-result.mjs'
+const auditFormatVersion = new URL(import.meta.url).search
+const {
+  auditFilter,
+  formatDebtFinding,
+  formatOrdinaryAudit,
+  gitUntracked,
+  pathsFromClassification,
+} = await import(new URL(`./audit-format.mjs${auditFormatVersion}`, import.meta.url).href)
+
+async function runAuditWithBaseline(args, ctx, currentGraph) {
+    const resolved = resolveGitCommit(ctx.repoRoot, args.base_ref)
+    if (!resolved.ok) return toolResult(`Audit baseline unavailable: ${resolved.error}.`, {
+        status: 'INVALID', comparison: {status: 'UNAVAILABLE', reason: resolved.error}, findings: [],
+    }, {completeness: {status: 'PARTIAL', reason: resolved.error}})
+
+    let currentAudit
+    try {
+        currentAudit = await runInternalAudit(ctx.repoRoot, {
+            graph: currentGraph,
+            skipMalwareScan: !args.include_malware_scan,
+        })
+    } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error)
+        return toolResult(`Audit failed while building the current graph: ${reason}`, {
+            status: 'ERROR', comparison: {status: 'UNAVAILABLE', reason}, findings: [],
+        }, {completeness: {status: 'PARTIAL', reason}})
+    }
+    if (!currentAudit.ok) return toolResult(`Audit failed: ${currentAudit.error}`, {
+        status: 'ERROR', comparison: {status: 'UNAVAILABLE', reason: currentAudit.error}, findings: [],
+    }, {completeness: {status: 'PARTIAL', reason: currentAudit.error}})
+
+    const normalized = normalizeAuditScopeFiles(args.changed_files)
+    if (!normalized.ok) return toolResult(`Audit scope invalid: ${normalized.error}.`, {
+        status: 'INVALID', comparison: {status: 'UNAVAILABLE', reason: normalized.error}, findings: [],
+    }, {completeness: {status: 'PARTIAL', reason: normalized.error}})
+    let changedFiles = normalized.files
+    let completeChangeSet = false
+    let scopeSource = 'explicit changed_files'
+    let changeEvidence = null
+    if (changedFiles == null) {
+        completeChangeSet = true
+        const untracked = gitUntracked(ctx.repoRoot)
+        if (!untracked.ok) {
+            return toolResult(`Audit comparison stopped: untracked-file discovery failed (${untracked.error}). Pass changed_files explicitly to establish the scope.`, {
+                status: 'PARTIAL', comparison: {status: 'UNAVAILABLE', reason: untracked.error}, findings: [],
+            }, {completeness: {status: 'PARTIAL', reason: untracked.error}})
+        }
+        changeEvidence = classifyChangeImpact({
+            repoRoot: ctx.repoRoot,
+            graph: currentGraph,
+            base: resolved.commit,
+            files: untracked.files,
+        })
+        if (!changeEvidence.ok || changeEvidence.bounds?.truncated) {
+            const reason = changeEvidence.reasons.join(' ')
+            return toolResult(`Audit comparison stopped: changed-file derivation against ${resolved.ref} was incomplete. ${reason} Pass changed_files explicitly to establish a complete scope.`, {
+                status: 'PARTIAL', comparison: {status: 'UNAVAILABLE', reason}, findings: [], changeEvidence,
+            }, {completeness: {status: 'PARTIAL', reason}})
+        }
+        changedFiles = pathsFromClassification(changeEvidence)
+        if (changedFiles.length > 500) {
+            const reason = `derived changed-file scope contains ${changedFiles.length} files, above the 500-file comparison bound`
+            return toolResult(`Audit comparison stopped: ${reason}. Pass a narrower explicit changed_files scope.`, {
+                status: 'PARTIAL', comparison: {status: 'UNAVAILABLE', reason}, findings: [], changeEvidence,
+            }, {completeness: {status: 'PARTIAL', reason}})
+        }
+        scopeSource = `git diff ${resolved.commit.slice(0, 12)}…working-tree`
+    }
+
+    const baseline = await withGitRefCheckout(ctx.repoRoot, resolved.commit, async (checkout) => {
+        let graph = await buildInternalGraph(checkout)
+        const currentMode = ['full', 'no-tests', 'tests-only'].includes(currentGraph?.graphBuildMode)
+            ? currentGraph.graphBuildMode : 'full'
+        if (currentMode !== 'full') graph = filterGraphForMode(graph, currentMode, {repoRoot: checkout})
+        graph.graphBuildMode = currentMode
+        graph.graphBuildScope = ''
+        return runInternalAudit(checkout, {graph, skipMalwareScan: true})
+    })
+    if (!baseline.ok || !baseline.value?.ok) {
+        const reason = baseline.error || baseline.value?.error || 'baseline audit failed'
+        return toolResult(`Audit baseline unavailable: ${reason}.`, {
+            status: 'ERROR', comparison: {status: 'UNAVAILABLE', reason}, findings: [],
+        }, {completeness: {status: 'PARTIAL', reason}})
+    }
+
+    const comparison = compareAuditDebt(currentAudit, baseline.value, changedFiles, {completeChangeSet})
+    const mode = ['new', 'existing', 'all'].includes(args.debt) ? args.debt : 'new'
+    const selectedRaw = mode === 'new' ? comparison.new : mode === 'existing' ? comparison.existing : comparison.all
+    const selected = auditFilter(currentAudit, args, selectedRaw, ctx.repoRoot)
+    const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
+    const shown = selected.slice(0, max)
+    const optional = comparison.optional.checks.map((check) => `${check.name.toUpperCase()} UNCOMPARABLE (current ${check.current}; baseline ${check.baseline})`).join('; ')
+    const stateOf = (finding) => mode === 'all' ? finding.debtState : mode
+    const fixedShown = auditFilter(baseline.value, args, comparison.fixed, ctx.repoRoot).slice(0, Math.min(10, max))
+    const text = [
+        `${mode.toUpperCase()} DEBT — deterministic internal audit vs ${resolved.ref} (${resolved.commit.slice(0, 12)})`,
+        `Changed scope: ${changedFiles.length} file(s) from ${scopeSource}${changedFiles.length ? ` — ${changedFiles.slice(0, 12).join(', ')}${changedFiles.length > 12 ? ', …' : ''}` : ' — working tree matches the baseline'}.`,
+        `Scope comparison: ${comparison.totals.scope.new} new, ${comparison.totals.scope.existing} existing, ${comparison.totals.scope.fixed} fixed deterministic finding(s). Repository totals: ${comparison.totals.repository.new} new, ${comparison.totals.repository.existing} existing, ${comparison.totals.repository.fixed} fixed.`,
+        `Optional checks: ${optional}. Supply-chain findings are not assigned new/existing/fixed state from a source-only checkout.`,
+        '',
+        `Showing ${shown.length} of ${selected.length} ${mode} finding(s) after filters:`,
+        ...shown.map((finding) => formatDebtFinding(finding, stateOf(finding))),
+        selected.length > shown.length ? `  … +${selected.length - shown.length} more` : null,
+        '',
+        `Fixed in this changed scope: ${comparison.fixed.length}${fixedShown.length ? ' (sample below)' : ''}.`,
+        ...fixedShown.map((finding) => formatDebtFinding(finding, 'fixed')),
+    ].filter((line) => line != null).join('\n')
+    return toolResult(text, {
+        status: 'COMPLETE',
+        mode: 'baseline-comparison',
+        debt: mode,
+        baseline: {ref: resolved.ref, commit: resolved.commit},
+        scope: {files: changedFiles, source: scopeSource},
+        comparison: {
+            status: 'COMPLETE',
+            scope: comparison.scope,
+            totals: comparison.totals,
+            new: comparison.new,
+            existing: comparison.existing,
+            fixed: comparison.fixed,
+            optional: comparison.optional,
+        },
+        findings: selected,
+        changeEvidence,
+    }, {
+        page: {shown: shown.length, total: selected.length, capped: shown.length < selected.length},
+        completeness: {status: 'COMPLETE'},
+    })
+}
+
+// Full internal health audit: dead code + unused exports, dependency findings (npm/go/py missing &
+// unused deps), structure (import cycles / orphans / boundary rules), supply-chain (offline OSV
+// advisories, typosquat, lockfile drift), optional malware heuristics.
+export async function tRunAudit(g, args, ctx) {
+    if (!ctx.repoRoot) return 'Audit needs the repo root (not provided to this server).'
+    if (args.base_ref) return runAuditWithBaseline(args, ctx, rawGraph(ctx))
+    const audit = await runInternalAudit(ctx.repoRoot, {
+        graph: effectiveRawGraph(ctx),
+        skipMalwareScan: !args.include_malware_scan, // greps installed packages — slow, so opt-in
+    })
+    if (!audit.ok) return `Audit failed: ${audit.error}`
+    if (Array.isArray(args.changed_files)) {
+        const normalized = normalizeAuditScopeFiles(args.changed_files)
+        if (!normalized.ok) return `Changed-scope audit invalid: ${normalized.error}.`
+        const scoped = scopeAuditFindings(audit.findings, normalized.files)
+        const text = formatOrdinaryAudit(audit, args, scoped,
+            `CHANGED-SCOPE ONLY — ${normalized.files.length} explicitly supplied file(s); no baseline was provided, so these findings are not classified as new, existing, or fixed.`, ctx.repoRoot)
+        return toolResult(text, {
+            status: 'COMPLETE',
+            mode: 'changed-scope',
+            scope: {files: normalized.files, source: 'explicit changed_files'},
+            comparison: {status: 'UNAVAILABLE', reason: 'base_ref was not provided; changed-scope is not a new-debt claim'},
+            findings: auditFilter(audit, args, scoped, ctx.repoRoot),
+        }, {completeness: {status: 'COMPLETE'}})
+    }
+    return formatOrdinaryAudit(audit, args, audit.findings, null, ctx.repoRoot)
+}
+
+// Named module clusters: graph communities labeled by their dominant folder instead of bare numbers.

package/src/mcp/health/dead-code.mjs

@@ -0,0 +1,110 @@
+import {effectiveRawGraph} from '../graph-context.mjs'
+import {computeDeadCodeReview} from '../../analysis/dead-code-review.js'
+import {
+  collectNonRuntimeRoots,
+  collectPackageScopes,
+  collectSourceTexts,
+  readRepoJson,
+} from '../../analysis/internal-audit.collect.js'
+import {entryFiles} from '../../analysis/internal-audit.reach.js'
+import {createPathClassifier} from '../../path-classification.js'
+import {createRepoBoundary} from '../../repo-path.js'
+import {readCachedSymbolPrecisionEvidence} from '../../precision/symbol-query.js'
+import {toolResult} from '../tool-result.mjs'
+
+export function tFindDeadCode(g, args, ctx) {
+    if (!ctx.repoRoot) return 'Dead-code review needs the repo root (not provided to this server).'
+    const effectiveGraph = effectiveRawGraph(ctx)
+    const pointEvidence = readCachedSymbolPrecisionEvidence({repoRoot: ctx.repoRoot, graphPath: ctx.graphPath, graph: effectiveGraph})
+    const graph = {
+        ...effectiveGraph,
+        precisionReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionReferenceSymbols || []),
+            ...pointEvidence.referenceSymbols,
+        ])],
+        precisionProductionReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionProductionReferenceSymbols || []),
+            ...pointEvidence.productionReferenceSymbols,
+        ])],
+        precisionTestReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionTestReferenceSymbols || []),
+            ...pointEvidence.testReferenceSymbols,
+        ])],
+        precisionNoReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionNoReferenceSymbols || []),
+            ...pointEvidence.noReferenceSymbols,
+        ])],
+    }
+    const boundary = createRepoBoundary(ctx.repoRoot)
+    const pkg = readRepoJson(boundary, 'package.json') || {}
+    const rules = readRepoJson(boundary, '.weavatrix-deps.json') || {}
+    const sources = collectSourceTexts(ctx.repoRoot, graph)
+    const dynamicTargets = new Set((graph.externalImports || [])
+        .filter((entry) => entry?.dynamic && entry?.target)
+        .map((entry) => String(entry.target).replace(/\\/g, '/')))
+    const frameworkEvidence = []
+    const entries = entryFiles(graph, collectPackageScopes(ctx.repoRoot, pkg), dynamicTargets, {
+        declaredEntries: rules.entrypoints || rules.entries || [],
+        sources,
+        conventionEvidence: frameworkEvidence,
+    })
+    for (const root of collectNonRuntimeRoots(ctx.repoRoot, rules)) {
+        for (const file of sources.keys()) if (file === root || file.startsWith(`${root}/`)) entries.add(file)
+    }
+
+    const review = computeDeadCodeReview(graph, sources, {
+        entrySet: entries,
+        dynamicTargets,
+        frameworkEvidence,
+        pathClassifier: createPathClassifier(ctx.repoRoot),
+        includeTests: args.include_tests === true,
+        includeClassified: args.include_classified === true,
+        minConfidence: args.min_confidence,
+        path: args.path,
+        kinds: args.kinds,
+    })
+    const max = Math.max(1, Math.min(100, Number(args.top_n) || 30))
+    const shown = review.candidates.slice(0, max)
+    const counts = review.totals.byConfidence
+    const suppression = Object.entries(review.suppressed)
+        .filter(([, count]) => count)
+        .map(([name, count]) => `${name} ${count}`)
+        .join(', ')
+    const lines = shown.map((candidate, index) => {
+        const subject = candidate.kind === 'file'
+            ? candidate.file
+            : `${candidate.owner ? `${candidate.owner}.` : ''}${candidate.symbol || candidate.id}`
+        const where = `${candidate.file}${candidate.line ? `:${candidate.line}` : ''}`
+        return [
+            `${index + 1}. [${candidate.confidence}/${candidate.evidenceTier}/${candidate.classification}] ${subject} (${where})`,
+            `     evidence: ${candidate.evidence.map((item) => item.fact).join(' ')}`,
+            candidate.caveats.length ? `     caution: ${candidate.caveats.join(' ')}` : null,
+            `     remaining: ${candidate.remainingChecks.join(' ')}`,
+        ].filter(Boolean).join('\n')
+    })
+    const text = [
+        `Dead-code review: ${shown.length} of ${review.candidates.length} candidate(s) shown (high ${counts.high}, medium ${counts.medium}, low ${counts.low}).`,
+        `Evidence tiers: strong static ${review.totals.byEvidenceTier.strongStatic}, bounded static ${review.totals.byEvidenceTier.boundedStatic}, high uncertainty ${review.totals.byEvidenceTier.highUncertainty}.`,
+        `Verdict: REVIEW_REQUIRED. This is static evidence, never permission to auto-delete or bulk-delete.`,
+        suppression ? `Suppressed by current filters: ${suppression}.` : null,
+        review.suppressed.confidence ? 'Use min_confidence=low only when public/framework/dynamic candidates need explicit review.' : null,
+        '',
+        ...(lines.length ? lines : ['No candidates matched the current production/path/kind/confidence filters.']),
+        '',
+        'Before removal: read_source, get_dependents, exact search, framework/config/manifest inspection, and the repository tests.',
+    ].filter((line) => line != null).join('\n')
+    return toolResult(text, {
+        status: 'COMPLETE',
+        verdict: 'REVIEW_REQUIRED',
+        candidates: shown,
+        totals: review.totals,
+        suppressed: review.suppressed,
+        repoSignals: review.repoSignals,
+        policy: review.policy,
+    }, {
+        warnings: review.warnings,
+        page: {shown: shown.length, total: review.candidates.length, capped: shown.length < review.candidates.length},
+        completeness: {status: 'COMPLETE'},
+    })
+}
+

package/src/mcp/health/duplicates.mjs

@@ -0,0 +1,83 @@
+import {computeDuplicates} from '../../analysis/duplicates.js'
+import {analyzeDuplicateGroups} from '../../analysis/duplicate-groups.js'
+
+const NON_PRODUCT_DUPLICATE_CLASSES = new Set(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const fragmentEligible = (fragment, {tokMin, skipTests, includeClassified}) => {
+    if (fragment.n < tokMin) return false
+    const classes = new Set(fragment.classes || [])
+    if (skipTests && (fragment.test || classes.has('test') || classes.has('e2e'))) return false
+    if (!includeClassified && (fragment.excluded || [...classes].some((name) => NON_PRODUCT_DUPLICATE_CLASSES.has(name)))) return false
+    return true
+}
+
+export function tFindDuplicates(g, args, ctx) {
+    if (!ctx.repoRoot) return 'Duplicate scan needs the repo root (not provided to this server).'
+    const simMin = Math.min(100, Math.max(50, Number(args.min_similarity) || 80))
+    const tokMin = Math.min(400, Math.max(12, Number(args.min_tokens) || 50))
+    const mode = args.mode === 'strict' ? 'strict' : 'renamed'
+    const skipTests = args.include_tests ? false : true
+    const includeClassified = args.include_classified === true || args.include_non_product === true
+    const includeStrings = !!args.include_strings
+    // semantic mode: same-name symbols across files, ranked by size — LOW similarity is the signal
+    // (same name, drifted behavior). Token-clone pairing is skipped entirely.
+    if (args.mode === 'semantic') {
+        const data = computeDuplicates(ctx.repoRoot, ctx.graphPath, {nameTwins: true, minTokens: tokMin})
+        const frags = data.frags
+        const candidates = []
+        for (const twin of data.nameTwins || []) {
+            const allowed = new Set(twin.members.filter((i) => fragmentEligible(frags[i], {tokMin, skipTests, includeClassified})))
+            const pairs = (twin.pairs || []).filter((p) => allowed.has(p.a) && allowed.has(p.b))
+            if (!pairs.length) continue
+            const closest = pairs.slice().sort((a, b) => b.similarity - a.similarity)[0]
+            const farthest = pairs.slice().sort((a, b) => a.similarity - b.similarity)[0]
+            if (closest.similarity >= 85) candidates.push({kind: 'clone', label: twin.label, pair: closest})
+            if (farthest.similarity <= 45) candidates.push({kind: 'collision', label: twin.label, pair: farthest})
+        }
+        for (const item of candidates) item.tokens = frags[item.pair.a].n + frags[item.pair.b].n
+        candidates.sort((a, b) => {
+            if (a.kind !== b.kind) return a.kind === 'clone' ? -1 : 1
+            return a.kind === 'clone'
+                ? b.pair.similarity - a.pair.similarity || b.tokens - a.tokens
+                : b.tokens - a.tokens || a.pair.similarity - b.pair.similarity
+        })
+        if (!candidates.length) return 'No actionable same-name pairs across files (semantic mode; ambiguous middle-similarity pairs are suppressed).'
+        const top = candidates.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
+        const lines = top.map((item, k) => {
+            const a = frags[item.pair.a]
+            const b = frags[item.pair.b]
+            const verdict = item.kind === 'clone'
+                ? 'near-identical duplicate candidate — review, then extract shared logic if the contract is truly shared'
+                : 'name collision, not a duplicate — inspect only if these definitions should share a contract'
+            return [
+                `${k + 1}. "${item.label}" — ${item.pair.similarity}% similar; ${verdict}`,
+                `     ${a.file}:${a.start}-${a.end}  (${a.n} tok)`,
+                `     ${b.file}:${b.start}-${b.end}  (${b.n} tok)`,
+            ].join('\n')
+        })
+        return `Found ${candidates.length} actionable same-name pair(s) across files (semantic mode; one closest clone and/or farthest collision per name). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nThese are review candidates, not automatic refactors. Use read_source on both sites before changing code.`
+    }
+    const analysis = analyzeDuplicateGroups(ctx.repoRoot, ctx.graphPath, args)
+    const groups = analysis.groups
+    const smallPolicy = tokMin < 30 ? ' Small fragments below 30 tokens require at least 95% similarity and two shared bounded fingerprints.' : ''
+    const suppressed = analysis.suppressed
+    const suppressionNote = suppressed && !includeClassified
+        ? ` ${suppressed} fragment(s) classified as tests/e2e/generated/mock/story/docs/benchmark/temp or matched by .weavatrix.json exclude were suppressed; pass include_classified:true (and include_tests:true for tests) to inspect them explicitly.`
+        : ''
+    const boilerplateNote = analysis.boilerplateSuppressed
+        ? ` ${analysis.boilerplateSuppressed} all-router framework boilerplate group(s) were suppressed; pass include_boilerplate:true to inspect them.`
+        : ''
+    if (!groups.length) return `No clones at ≥${simMin}% similarity / ≥${tokMin} tokens (${mode} mode). Try lowering the thresholds.${smallPolicy}${suppressionNote}${boilerplateNote}`
+    const top = groups.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
+    const lines = top.map((grp, k) => {
+        const isStr = grp.members.some((f) => f.kind === 'string')
+        const head = `${k + 1}. ${grp.members.length}× "${grp.members[0].label}"${isStr ? ' [string literal]' : ''} — ≤${grp.maxSim}% similar, ${grp.tokens} duplicated tokens`
+        const sites = grp.members.slice(0, 8).map((f) => `     ${f.file}:${f.start}-${f.end}`)
+        return [head, ...sites].join('\n')
+    })
+    return `Found ${groups.length} clone group(s) (${mode} mode, ≥${simMin}%, ≥${tokMin} tok${includeStrings ? ', incl. large string literals' : ''}). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nUse read_source on any two sites to compare, then extract shared logic.${smallPolicy}${suppressionNote}${boilerplateNote}`
+}
+
+// Focused dead-code review queue. Unlike the broad run_audit surface, this includes functions and
+// methods with bounded source-free evidence, and explicitly demotes framework/dynamic/public API
+// candidates. It never returns an automatic-delete verdict.
+

package/src/mcp/health/endpoints.mjs

@@ -0,0 +1,42 @@
+import {rawGraph} from '../graph-context.mjs'
+import {analyzeEndpointInventory} from '../../analysis/endpoints.js'
+import {toolResult} from '../tool-result.mjs'
+
+export function tListEndpoints(g, args, ctx) {
+    if (!ctx.repoRoot) return 'Endpoint detection needs the repo root (not provided to this server).'
+    const graph = rawGraph(ctx)
+    const codeFiles = [...new Set(
+        (graph.nodes || [])
+            .filter((n) => !String(n.id).includes('#') && n.source_file && n.file_type === 'code')
+            .map((n) => n.source_file)
+    )]
+    const inventory = analyzeEndpointInventory(ctx.repoRoot, codeFiles)
+    let eps = inventory.endpoints
+    const method = args.method ? String(args.method).toUpperCase() : null
+    const path = args.path ? String(args.path) : null
+    if (method) eps = eps.filter((endpoint) => endpoint.method === method)
+    if (path) eps = eps.filter((endpoint) => endpoint.path === path || endpoint.path.endsWith(path))
+    if (!eps.length) return 'No HTTP endpoints detected in the indexed code files.'
+    const max = Math.max(1, Math.min(300, Number(args.max_results) || 100))
+    const shown = eps.slice(0, max)
+    const stats = inventory.stats
+    const text = [
+        `${eps.length} endpoint(s) matched${eps.length > shown.length ? `, showing ${shown.length}` : ''}. Inventory: ${stats.declaredRoutes} declaration(s); ${stats.reachableStaticRoutes} statically reachable composed route(s); ${stats.localDeclarations} local/root declaration candidate(s); ${stats.staticMounts} static router mount(s)${stats.truncated ? `; TRUNCATED at ${stats.maxEndpoints}` : ''}.`,
+        ...shown.map((e) => {
+            const via = e.mountChain?.length
+                ? `\n           declared ${e.declaredPath} in ${e.file}${e.line ? `:${e.line}` : ''}; mount chain ${e.mountChain.map((mount) => `${mount.file}:${mount.line} ${mount.path}`).join(' → ')}`
+                : ''
+            const activation = e.conditional
+                ? `; conditional default ${e.defaultActive === false ? 'inactive' : e.defaultActive === true ? 'active' : 'unknown'}`
+                : ''
+            return `  ${e.method.toUpperCase().padEnd(6)} ${e.path}${e.handler ? `  → ${e.handler}` : ''}  (${e.file}${e.line ? `:${e.line}` : ''}; ${e.mountState}/${e.confidence}${activation})${via}`
+        }),
+    ].join('\n')
+    return toolResult(text, {
+        filters: {method, path},
+        stats,
+        endpoints: shown,
+        page: {shown: shown.length, total: eps.length, truncated: eps.length > shown.length || stats.truncated},
+    }, {completeness: {status: stats.truncated ? 'PARTIAL' : 'COMPLETE', reason: stats.truncated ? `endpoint cap ${stats.maxEndpoints} reached` : 'all indexed code files scanned'}})
+}
+