weavatrix 0.2.7 → 0.2.9

package/src/mcp/tools-health.mjs

@@ -9,7 +9,7 @@ import {classifyChangeImpact} from '../analysis/change-classification.js'
 import {compareAuditDebt, normalizeAuditScopeFiles, scopeAuditFindings} from '../analysis/audit-debt.js'
 import {summarizeFindings} from '../analysis/findings.js'
 import {summarizeCommunities, aggregateGraph} from '../analysis/graph-analysis.js'
-import {detectEndpoints} from '../analysis/endpoints.js'
+import {analyzeEndpointInventory} from '../analysis/endpoints.js'
 import {computeStaticTestReachability} from '../analysis/static-test-reachability.js'
 import {computeDeadCodeReview} from '../analysis/dead-code-review.js'
 import {computeHotPathReview} from '../analysis/hot-path-review.js'
@@ -22,6 +22,7 @@ import {toolResult} from './tool-result.mjs'
 import {createPathClassifier, hasPathClass} from '../path-classification.js'
 import {createRepoBoundary} from '../repo-path.js'
 import {filterGraphForMode} from '../graph/graph-filter.js'
+import {readCachedSymbolPrecisionEvidence} from '../precision/symbol-query.js'
 
 const NON_PRODUCT_DUPLICATE_CLASSES = new Set(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const fragmentEligible = (fragment, {tokMin, skipTests, includeClassified}) => {
@@ -85,7 +86,10 @@ export function tFindDuplicates(g, args, ctx) {
     const suppressionNote = suppressed && !includeClassified
         ? ` ${suppressed} fragment(s) classified as tests/e2e/generated/mock/story/docs/benchmark/temp or matched by .weavatrix.json exclude were suppressed; pass include_classified:true (and include_tests:true for tests) to inspect them explicitly.`
         : ''
-    if (!groups.length) return `No clones at ≥${simMin}% similarity / ≥${tokMin} tokens (${mode} mode). Try lowering the thresholds.${smallPolicy}${suppressionNote}`
+    const boilerplateNote = analysis.boilerplateSuppressed
+        ? ` ${analysis.boilerplateSuppressed} all-router framework boilerplate group(s) were suppressed; pass include_boilerplate:true to inspect them.`
+        : ''
+    if (!groups.length) return `No clones at ≥${simMin}% similarity / ≥${tokMin} tokens (${mode} mode). Try lowering the thresholds.${smallPolicy}${suppressionNote}${boilerplateNote}`
     const top = groups.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
     const lines = top.map((grp, k) => {
         const isStr = grp.members.some((f) => f.kind === 'string')
@@ -93,7 +97,7 @@ export function tFindDuplicates(g, args, ctx) {
         const sites = grp.members.slice(0, 8).map((f) => `     ${f.file}:${f.start}-${f.end}`)
         return [head, ...sites].join('\n')
     })
-    return `Found ${groups.length} clone group(s) (${mode} mode, ≥${simMin}%, ≥${tokMin} tok${includeStrings ? ', incl. large string literals' : ''}). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nUse read_source on any two sites to compare, then extract shared logic.${smallPolicy}${suppressionNote}`
+    return `Found ${groups.length} clone group(s) (${mode} mode, ≥${simMin}%, ≥${tokMin} tok${includeStrings ? ', incl. large string literals' : ''}). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nUse read_source on any two sites to compare, then extract shared logic.${smallPolicy}${suppressionNote}${boilerplateNote}`
 }
 
 // Focused dead-code review queue. Unlike the broad run_audit surface, this includes functions and
@@ -101,7 +105,27 @@ export function tFindDuplicates(g, args, ctx) {
 // candidates. It never returns an automatic-delete verdict.
 export function tFindDeadCode(g, args, ctx) {
     if (!ctx.repoRoot) return 'Dead-code review needs the repo root (not provided to this server).'
-    const graph = effectiveRawGraph(ctx)
+    const effectiveGraph = effectiveRawGraph(ctx)
+    const pointEvidence = readCachedSymbolPrecisionEvidence({repoRoot: ctx.repoRoot, graphPath: ctx.graphPath, graph: effectiveGraph})
+    const graph = {
+        ...effectiveGraph,
+        precisionReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionReferenceSymbols || []),
+            ...pointEvidence.referenceSymbols,
+        ])],
+        precisionProductionReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionProductionReferenceSymbols || []),
+            ...pointEvidence.productionReferenceSymbols,
+        ])],
+        precisionTestReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionTestReferenceSymbols || []),
+            ...pointEvidence.testReferenceSymbols,
+        ])],
+        precisionNoReferenceSymbols: [...new Set([
+            ...(effectiveGraph.precisionNoReferenceSymbols || []),
+            ...pointEvidence.noReferenceSymbols,
+        ])],
+    }
     const boundary = createRepoBoundary(ctx.repoRoot)
     const pkg = readRepoJson(boundary, 'package.json') || {}
     const rules = readRepoJson(boundary, '.weavatrix-deps.json') || {}
@@ -176,6 +200,7 @@ export function tFindDeadCode(g, args, ctx) {
 }
 
 const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
+const AUDIT_NON_PRODUCT_CLASSES = ['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
 
 export function formatAuditFinding(f) {
     const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''}${f.manifest ? `; ${f.manifest}` : ''})` : ''
@@ -185,12 +210,40 @@ export function formatAuditFinding(f) {
     return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.reason ? `\n      reason: ${f.reason}` : ''}${verification}${f.cycleRoute ? `\n      route: ${f.cycleRoute}` : ''}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
 }
 
-const auditFilter = (audit, args, findings = audit.findings) => {
+const auditFindingPaths = (finding) => {
+    const paths = []
+    if (finding?.file) paths.push(String(finding.file))
+    if (Array.isArray(finding?.files)) paths.push(...finding.files.map(String))
+    if (finding?.cycleRoute) paths.push(...String(finding.cycleRoute).split(/\s*(?:→|→|->)\s*/))
+    return [...new Set(paths.map((file) => file.replace(/\\/g, '/').trim()).filter(Boolean))]
+}
+
+export function auditFindingPathScope(findings, {includeClassified = false, repoRoot = null} = {}) {
+    const all = Array.isArray(findings) ? findings : []
+    if (includeClassified) return {findings: all, suppressed: 0}
+    const classifier = createPathClassifier(repoRoot)
+    const cache = new Map()
+    const classified = (file) => {
+        if (!cache.has(file)) cache.set(file, classifier.explain(file, {content: ''}))
+        const info = cache.get(file)
+        return info?.excluded || AUDIT_NON_PRODUCT_CLASSES.some((name) => hasPathClass(info, name))
+    }
+    const kept = all.filter((finding) => {
+        const paths = auditFindingPaths(finding)
+        return !paths.length || paths.some((file) => !classified(file))
+    })
+    return {findings: kept, suppressed: all.length - kept.length}
+}
+
+const DEPENDENCY_AUDIT_RULES = new Set(['unused-dep', 'missing-dep', 'duplicate-dep', 'unresolved-import', 'lockfile-drift'])
+export const isDependencyAuditFinding = (finding) => DEPENDENCY_AUDIT_RULES.has(String(finding?.rule || ''))
+
+const auditFilter = (audit, args, findings = audit.findings, repoRoot = null) => {
     const minSev = SEVERITY_RANK[args.min_severity] ?? 4
     const category = args.category ? String(args.category) : null
-    return findings
+    return auditFindingPathScope(findings, {includeClassified: args.include_classified === true, repoRoot}).findings
         .filter((finding) => (SEVERITY_RANK[finding.severity] ?? 4) <= minSev)
-        .filter((finding) => !category || finding.category === category)
+        .filter((finding) => !category || (category === 'dependencies' ? isDependencyAuditFinding(finding) : finding.category === category))
 }
 
 const auditChecksLine = (audit) => {
@@ -208,11 +261,12 @@ const auditConventionLines = (audit) => {
     ].filter((line) => line != null)
 }
 
-const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = null) => {
+const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = null, repoRoot = null) => {
     const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
-    const filtered = auditFilter(audit, args, findings)
+    const pathScope = auditFindingPathScope(findings, {includeClassified: args.include_classified === true, repoRoot})
+    const filtered = auditFilter(audit, args, pathScope.findings, repoRoot)
     const shown = filtered.slice(0, max)
-    const summary = summarizeFindings(findings)
+    const summary = summarizeFindings(pathScope.findings)
     const sev = summary.bySeverity
     const bycat = summary.byCategory
     const deps = audit.dependencyReport || {}
@@ -220,8 +274,9 @@ const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = n
         heading,
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         ...auditConventionLines(audit),
-        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
+        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
         `Scoped severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Scoped categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
+        pathScope.suppressed ? `Path policy: production-first; suppressed ${pathScope.suppressed} finding(s) whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded. Pass include_classified:true to include them.` : 'Path policy: production-first; no classified-only findings were suppressed.',
         `Repository-level ${auditChecksLine(audit)}`,
         '',
         `Showing ${shown.length} of ${filtered.length} finding(s)${args.category ? ` in category "${args.category}"` : ''}${args.min_severity ? ` at ≥${args.min_severity}` : ''}:`,
@@ -332,12 +387,12 @@ async function runAuditWithBaseline(args, ctx, currentGraph) {
     const comparison = compareAuditDebt(currentAudit, baseline.value, changedFiles, {completeChangeSet})
     const mode = ['new', 'existing', 'all'].includes(args.debt) ? args.debt : 'new'
     const selectedRaw = mode === 'new' ? comparison.new : mode === 'existing' ? comparison.existing : comparison.all
-    const selected = auditFilter(currentAudit, args, selectedRaw)
+    const selected = auditFilter(currentAudit, args, selectedRaw, ctx.repoRoot)
     const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
     const shown = selected.slice(0, max)
     const optional = comparison.optional.checks.map((check) => `${check.name.toUpperCase()} UNCOMPARABLE (current ${check.current}; baseline ${check.baseline})`).join('; ')
     const stateOf = (finding) => mode === 'all' ? finding.debtState : mode
-    const fixedShown = auditFilter(baseline.value, args, comparison.fixed).slice(0, Math.min(10, max))
+    const fixedShown = auditFilter(baseline.value, args, comparison.fixed, ctx.repoRoot).slice(0, Math.min(10, max))
     const text = [
         `${mode.toUpperCase()} DEBT — deterministic internal audit vs ${resolved.ref} (${resolved.commit.slice(0, 12)})`,
         `Changed scope: ${changedFiles.length} file(s) from ${scopeSource}${changedFiles.length ? ` — ${changedFiles.slice(0, 12).join(', ')}${changedFiles.length > 12 ? ', …' : ''}` : ' — working tree matches the baseline'}.`,
@@ -390,38 +445,16 @@ export async function tRunAudit(g, args, ctx) {
         if (!normalized.ok) return `Changed-scope audit invalid: ${normalized.error}.`
         const scoped = scopeAuditFindings(audit.findings, normalized.files)
         const text = formatOrdinaryAudit(audit, args, scoped,
-            `CHANGED-SCOPE ONLY — ${normalized.files.length} explicitly supplied file(s); no baseline was provided, so these findings are not classified as new, existing, or fixed.`)
+            `CHANGED-SCOPE ONLY — ${normalized.files.length} explicitly supplied file(s); no baseline was provided, so these findings are not classified as new, existing, or fixed.`, ctx.repoRoot)
         return toolResult(text, {
             status: 'COMPLETE',
             mode: 'changed-scope',
             scope: {files: normalized.files, source: 'explicit changed_files'},
             comparison: {status: 'UNAVAILABLE', reason: 'base_ref was not provided; changed-scope is not a new-debt claim'},
-            findings: auditFilter(audit, args, scoped),
+            findings: auditFilter(audit, args, scoped, ctx.repoRoot),
         }, {completeness: {status: 'COMPLETE'}})
     }
-    const minSev = SEVERITY_RANK[args.min_severity] ?? 4
-    const cat = args.category ? String(args.category) : null
-    const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
-    const filtered = audit.findings
-        .filter((f) => (SEVERITY_RANK[f.severity] ?? 4) <= minSev)
-        .filter((f) => !cat || f.category === cat)
-    const shown = filtered.slice(0, max)
-    const sev = audit.summary.bySeverity
-    const bycat = audit.summary.byCategory
-    const deps = audit.dependencyReport || {}
-    const check = (name, state) => `${name} ${state?.status || 'ERROR'}${state?.detail ? ` — ${state.detail}` : ''}`
-    return [
-        `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
-        `Severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
-        `Structure: ${audit.structureReport?.runtimeCycles ?? audit.structureReport?.cycles ?? 0} runtime cycle(s), ${audit.structureReport?.compileTimeCouplings ?? audit.structureReport?.typeCouplings ?? 0} compile-time coupling group(s), ${audit.structureReport?.orphans ?? 0} orphan(s); import edges: ${audit.structureReport?.runtimeImportEdges ?? audit.structureReport?.importEdges ?? 0} runtime + ${audit.structureReport?.typeOnlyImportEdges ?? 0} type-only + ${audit.structureReport?.compileOnlyImportEdges ?? 0} compile-only. Dead: ${audit.deadReport.deadFiles} file(s), ${audit.deadReport.unusedExports} unused export(s).`,
-        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
-        ...auditConventionLines(audit),
-        `Checks: ${check('OSV', audit.checks?.osv)}; ${check('malware', audit.checks?.malware)}. A NOT_CHECKED/PARTIAL/ERROR check is incomplete or unknown, never a clean zero.`,
-        ``,
-        `Showing ${shown.length} of ${filtered.length} finding(s)${cat ? ` in category "${cat}"` : ''}${args.min_severity ? ` at ≥${args.min_severity}` : ''}:`,
-        ...shown.map(formatAuditFinding),
-        filtered.length > shown.length ? `  … +${filtered.length - shown.length} more (raise max_findings or filter by category/min_severity)` : null,
-    ].filter((x) => x != null).join('\n')
+    return formatOrdinaryAudit(audit, args, audit.findings, null, ctx.repoRoot)
 }
 
 // Named module clusters: graph communities labeled by their dominant folder instead of bare numbers.
@@ -644,12 +677,29 @@ export function tListEndpoints(g, args, ctx) {
             .filter((n) => !String(n.id).includes('#') && n.source_file && n.file_type === 'code')
             .map((n) => n.source_file)
     )]
-    const eps = detectEndpoints(ctx.repoRoot, codeFiles)
+    const inventory = analyzeEndpointInventory(ctx.repoRoot, codeFiles)
+    let eps = inventory.endpoints
+    const method = args.method ? String(args.method).toUpperCase() : null
+    const path = args.path ? String(args.path) : null
+    if (method) eps = eps.filter((endpoint) => endpoint.method === method)
+    if (path) eps = eps.filter((endpoint) => endpoint.path === path || endpoint.path.endsWith(path))
     if (!eps.length) return 'No HTTP endpoints detected in the indexed code files.'
     const max = Math.max(1, Math.min(300, Number(args.max_results) || 100))
     const shown = eps.slice(0, max)
-    return [
-        `${eps.length} endpoint(s) detected${eps.length > shown.length ? `, showing ${shown.length}` : ''}:`,
-        ...shown.map((e) => `  ${e.method.toUpperCase().padEnd(6)} ${e.path}${e.handler ? `  → ${e.handler}` : ''}  (${e.file}${e.line ? `:${e.line}` : ''})`),
+    const stats = inventory.stats
+    const text = [
+        `${eps.length} endpoint(s) matched${eps.length > shown.length ? `, showing ${shown.length}` : ''}. Inventory: ${stats.declaredRoutes} declaration(s); ${stats.reachableStaticRoutes} statically reachable composed route(s); ${stats.localDeclarations} local/root declaration candidate(s); ${stats.staticMounts} static router mount(s)${stats.truncated ? `; TRUNCATED at ${stats.maxEndpoints}` : ''}.`,
+        ...shown.map((e) => {
+            const via = e.mountChain?.length
+                ? `\n           declared ${e.declaredPath} in ${e.file}${e.line ? `:${e.line}` : ''}; mount chain ${e.mountChain.map((mount) => `${mount.file}:${mount.line} ${mount.path}`).join(' → ')}`
+                : ''
+            return `  ${e.method.toUpperCase().padEnd(6)} ${e.path}${e.handler ? `  → ${e.handler}` : ''}  (${e.file}${e.line ? `:${e.line}` : ''}; ${e.mountState}/${e.confidence})${via}`
+        }),
     ].join('\n')
+    return toolResult(text, {
+        filters: {method, path},
+        stats,
+        endpoints: shown,
+        page: {shown: shown.length, total: eps.length, truncated: eps.length > shown.length || stats.truncated},
+    }, {completeness: {status: stats.truncated ? 'PARTIAL' : 'COMPLETE', reason: stats.truncated ? `endpoint cap ${stats.maxEndpoints} reached` : 'all indexed code files scanned'}})
 }

package/src/mcp/tools-source.mjs

@@ -27,7 +27,7 @@ function candidateNodes(g, query, limit = 20) {
     }))
 }
 
-function excerpt(repoRoot, file, focusLine, contextLines) {
+export function sourceExcerpt(repoRoot, file, focusLine, contextLines) {
     const resolved = resolveRepoPath(repoRoot, file)
     if (!resolved.ok) return null
     let size
@@ -198,8 +198,8 @@ export async function tInspectSymbol(g, args = {}, ctx = {}) {
         ...(node.source_range ? {range: node.source_range} : {}),
         ...(node.complexity ? {complexity: node.complexity} : {}),
     }
-    const definitionSource = excerpt(ctx.repoRoot, definition.file, definition.line, contextLines)
-    const callerSources = grouped.shown.slice(0, 5).map((group) => excerpt(ctx.repoRoot, group.file, group.locations[0]?.line || 1, contextLines)).filter(Boolean)
+    const definitionSource = sourceExcerpt(ctx.repoRoot, definition.file, definition.line, contextLines)
+    const callerSources = grouped.shown.slice(0, 5).map((group) => sourceExcerpt(ctx.repoRoot, group.file, group.locations[0]?.line || 1, contextLines)).filter(Boolean)
     const result = {
         status: 'OK',
         definition,

package/src/mcp/tools-verified-change.mjs

@@ -62,6 +62,21 @@ function architectureState(result) {
   return result.verification.new?.length || String(result.verification.status).toUpperCase() === 'FAIL' ? 'BLOCKED' : 'PASS'
 }
 
+function exactUsageLines(contexts, g) {
+  if (!contexts.length) return []
+  return contexts.map((context) => {
+    const node = g.byId.get(String(context.symbol || context.definition?.id || ''))
+    const label = String(context.definition?.label || node?.label || context.symbol || 'symbol')
+    if (context.status !== 'OK') return `Exact usage: ${label} — unavailable (${context.status || 'UNKNOWN'}).`
+    const exact = context.evidence?.state === 'EXACT'
+    const occurrences = Number(context.references?.occurrences) || 0
+    const files = Number(context.references?.files) || 0
+    const inbound = Array.isArray(context.inbound?.shown) ? context.inbound.shown.slice(0, 3) : []
+    const callers = inbound.map((item) => `${item.label || item.id}${item.file ? ` [${item.file}]` : ''}`).join(', ')
+    return `${exact ? 'Exact usage' : 'Bounded usage'}: ${label} — ${occurrences} reference occurrence(s)${files ? ` in ${files} file(s)` : ''}; ${Number(context.inbound?.total) || 0} inbound container(s)${callers ? `: ${callers}` : ''}.`
+  })
+}
+
 function decide({phase, impact, graph, architecture, duplicates, api, tests, suggestedTests, testCoverageState}) {
   if (phase === 'plan') return tests.state === 'BLOCKED'
     ? {verdict: 'BLOCKED', blockers: [`targeted test plan was rejected: ${tests.reason || 'invalid request'}`], unknowns: []}
@@ -162,6 +177,7 @@ export async function tVerifiedChange(g, args = {}, ctx = {}, tools = {}, permis
     `${decision.verdict} — verified_change ${phase}`, `Task: ${String(args.task).slice(0, 500)}`,
     `Change: ${changedFiles.length} file(s), ${impact.seeds?.ids?.length || 0} exact seed(s), blast radius ${impact.blastRadius?.impacted || 0}.`,
     `Edit context: ${retrieval.selected.length} symbol(s); ${contexts.length} exact bundle(s); data-flow ${dataFlow.status} (${dataFlow.edges.length} call edge(s)).`,
+    ...exactUsageLines(contexts, g),
     `Ratchets: graph ${graph.state}; architecture ${architecture.state}; duplicates ${duplicates.state}; API ${api.state}; tests ${testProof.state}.`,
     ...decision.blockers.map((item) => `BLOCKER: ${item}`), ...decision.unknowns.map((item) => `UNKNOWN: ${item}`),
   ].join('\n')

package/src/mcp-server.mjs

@@ -270,6 +270,7 @@ async function main() {
             const graphSnapshot = graph
             const callCtx = mutatesTarget ? ctx : {...ctx}
             const execute = async () => {
+                const startedAt = performance.now()
                 try {
                     // A queued rebuild must see a preceding retarget's graph, while non-mutating calls stay
                     // pinned to the graph that was active when their request arrived.
@@ -302,12 +303,39 @@ async function main() {
                         if (schemaWarning) text += `\n\nWarning: ${schemaWarning.message}`
                         if (staleLine && staleNotices.shouldShow({line: staleLine, graphPath: callCtx.graphPath, force: tool.name === 'graph_stats'})) text += `\n\n${staleLine}`
                     }
-                    const response = {content: [{type: 'text', text}]}
+                    const structuredBytes = normalized.structured ? Buffer.byteLength(JSON.stringify(normalized.structured)) : 0
+                    const textBytes = Buffer.byteLength(text)
+                    const durationMs = Math.max(0, performance.now() - startedAt)
+                    const response = {
+                        content: [{type: 'text', text}],
+                        _meta: {
+                            'weavatrix/metrics': {
+                                schemaVersion: 'weavatrix.metrics.v1',
+                                durationMs: Math.round(durationMs * 10) / 10,
+                                textBytes,
+                                structuredBytes,
+                                estimatedOutputTokens: Math.ceil((textBytes + structuredBytes) / 4),
+                                graphFreshness: staleLine ? 'stale' : (refresh?.error ? 'stale' : 'fresh'),
+                                graphUpdate: refresh?.kind || 'none',
+                                graphRevision: refresh?.revision || callGraph?.graphRevision || null,
+                                cache: refreshesGraph ? (refresh?.kind === 'none' ? 'graph-hit' : 'graph-refreshed') : 'not-applicable',
+                            },
+                        },
+                    }
                     if (normalized.structured) response.structuredContent = normalized.structured
                     return reply(id, response)
                 } catch (e) {
                     log(`tool ${params?.name} threw: ${e.stack || e.message}`)
-                    return reply(id, {content: [{type: 'text', text: `Tool error: ${e.message}`}], isError: true})
+                    const text = `Tool error: ${e.message}`
+                    return reply(id, {
+                        content: [{type: 'text', text}], isError: true,
+                        _meta: {'weavatrix/metrics': {
+                            schemaVersion: 'weavatrix.metrics.v1', durationMs: Math.round(Math.max(0, performance.now() - startedAt) * 10) / 10,
+                            textBytes: Buffer.byteLength(text), structuredBytes: 0,
+                            estimatedOutputTokens: Math.ceil(Buffer.byteLength(text) / 4), graphFreshness: 'unknown',
+                            graphUpdate: 'none', graphRevision: graphSnapshot?.graphRevision || null, cache: 'not-applicable',
+                        }},
+                    })
                 }
             }
             if (!mutatesTarget && !refreshesGraph) return execute()

package/src/mcp-source-tools.mjs

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { spawnSync } from 'node:child_process'
-import { extname, join, relative } from 'node:path'
+import { extname, isAbsolute, join, relative, resolve } from 'node:path'
 import { resolveRepoPath } from './repo-path.js'
 import { childProcessEnv } from './child-env.js'
 import { toolResult } from './mcp/tool-result.mjs'
@@ -11,21 +11,24 @@ const MAX_SEARCH_FILE_BYTES = 1024 * 1024
 const MAX_SOURCE_FILE_BYTES = 2 * 1024 * 1024
 const MAX_SOURCE_CONTEXT_LINES = 1000
 
-function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }) {
+function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }, spawnRg = spawnSync) {
     const rg = resolveRg()
     if (!rg) return null
     const args = ['--line-number', '--no-heading', '--color', 'never', '--hidden', '-g', '!.git/**', '-m', '100', '-i']
     if (!isRegex) args.push('--fixed-strings')
     if (glob) args.push('-g', glob)
-    args.push('--', query, repoRoot)
-    const res = spawnSync(rg, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000, env: childProcessEnv() })
+    // Run from the repository root and search `.` so path globs such as `src/**` are evaluated
+    // against repository-relative paths on Windows too. Passing an absolute search root makes rg
+    // compare the glob with a drive-prefixed path and silently return no matches.
+    args.push('--', query, '.')
+    const res = spawnRg(rg, args, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000, env: childProcessEnv() })
     if (res.status !== 0 && res.status !== 1) return null
     const out = []
     for (const line of (res.stdout || '').split(/\r?\n/)) {
         const match = line.match(/^(.*?):(\d+):(.*)$/)
         if (!match) continue
         out.push({
-            file: relative(repoRoot, match[1]).replace(/\\/g, '/'),
+            file: relative(repoRoot, isAbsolute(match[1]) ? match[1] : resolve(repoRoot, match[1])).replace(/\\/g, '/'),
             line: Number(match[2]),
             text: match[3].trim().slice(0, 300),
         })
@@ -87,12 +90,12 @@ function nodeGrep(repoRoot, query, { isRegex, glob, maxResults }) {
     return out
 }
 
-export function searchCode({ repoRoot, resolveRg }, { query, is_regex = false, max_results = 40, glob } = {}) {
+export function searchCode({ repoRoot, resolveRg, spawnRg = spawnSync }, { query, is_regex = false, max_results = 40, glob } = {}) {
     if (!query) return 'Provide a "query" string.'
     if (!repoRoot || !existsSync(repoRoot)) return 'Source search unavailable: repo root not provided to this MCP server.'
     const max = Math.max(1, Math.min(200, Number(max_results) || 40))
     const opts = { isRegex: !!is_regex, glob: glob || null, maxResults: max }
-    let matches = rgSearch(repoRoot, resolveRg, query, opts)
+    let matches = rgSearch(repoRoot, resolveRg, query, opts, spawnRg)
     const engine = matches ? 'ripgrep' : 'node'
     if (!matches) matches = nodeGrep(repoRoot, query, opts)
     const what = is_regex ? `/${query}/i` : `"${query}"`

package/src/path-classification.js

@@ -46,7 +46,7 @@ const DEFAULT_RULES = [
   {
     category: "test",
     pattern: "test/spec roots and conventional test filenames",
-    regex: /(^|\/)(?:__tests?__|tests?|spec)(\/|$)|\.(?:test|itest|spec)\.[^.\/]+$|_test\.go$|(^|\/)test_[^/]*\.py$/i,
+    regex: /(^|\/)(?:__tests?__|tests?|spec)(\/|$)|\.(?:test|itest|spec)\.[^.\/]+$|_test\.go$|(^|\/)test(?:_[^/]*)?\.py$/i,
   },
   {
     category: "generated",

package/src/precision/symbol-query.js

@@ -7,6 +7,7 @@ import {
     precisionOverlayMatches,
     precisionSemanticInputsMatch,
 } from './lsp-overlay.js'
+import {createPathClassifier, hasPathClass} from '../path-classification.js'
 
 export const SYMBOL_PRECISION_CACHE_V = 1
 export const SYMBOL_PRECISION_CACHE_FILE = 'precision-symbols.json'
@@ -79,6 +80,56 @@ function cacheable(overlay) {
         && overlay?.reason === 'semantic precision stopped at a configured safety limit'
 }
 
+// Point-query results intentionally live outside the broad precision overlay. Health tools still
+// need to consume revision-bound positive evidence: once an exact query found a reference, the
+// same symbol must not remain in a dead-code queue. This reader is synchronous and fail-closed;
+// stale, malformed, incomplete no-reference, or semantically changed entries contribute nothing.
+export function readCachedSymbolPrecisionEvidence({repoRoot, graphPath, graph} = {}) {
+    const empty = {referenceSymbols: [], productionReferenceSymbols: [], testReferenceSymbols: [], noReferenceSymbols: []}
+    if (!repoRoot || !graphPath || !graph) return empty
+    const precisionGraph = graph.graphPrecisionMode === 'off' ? {...graph, graphPrecisionMode: 'lsp'} : graph
+    const nodesById = new Map((precisionGraph.nodes || []).map((node) => [String(node.id), node]))
+    const classifier = createPathClassifier(repoRoot)
+    const referenced = new Set()
+    const production = new Set()
+    const tests = new Set()
+    const noReference = new Set()
+    const semanticMatches = new Map()
+    for (const entry of readCache(symbolPrecisionCachePath(graphPath)).entries) {
+        const overlay = entry?.overlay
+        if (!overlay || !precisionOverlayMatches(overlay, precisionGraph, {request: overlay.request})) continue
+        const fingerprint = String(overlay.semanticInputFingerprint || '')
+        if (!semanticMatches.has(fingerprint)) semanticMatches.set(
+            fingerprint,
+            precisionSemanticInputsMatch(overlay, repoRoot, precisionGraph),
+        )
+        if (!semanticMatches.get(fingerprint)) continue
+        const targetId = String(entry.targetId || '')
+        if (!nodesById.has(targetId)) continue
+        const locations = Array.isArray(overlay.locations)
+            ? overlay.locations.filter((location) => String(location?.target || '') === targetId)
+            : []
+        if (locations.length) {
+            referenced.add(targetId)
+            for (const location of locations) {
+                const file = String(location?.file || nodesById.get(String(location?.source || ''))?.source_file || '')
+                if (!file) continue
+                const info = classifier.explain(file, {content: ''})
+                if (hasPathClass(info, 'test', 'e2e')) tests.add(targetId)
+                else production.add(targetId)
+            }
+        }
+        if (overlay.state === 'COMPLETE' && Array.isArray(overlay.noReferenceSymbols)
+            && overlay.noReferenceSymbols.some((id) => String(id) === targetId)) noReference.add(targetId)
+    }
+    return {
+        referenceSymbols: [...referenced],
+        productionReferenceSymbols: [...production],
+        testReferenceSymbols: [...tests],
+        noReferenceSymbols: [...noReference],
+    }
+}
+
 export async function querySymbolPrecision({
     repoRoot,
     graphPath,

package/docs/releases/v0.2.7.md

@@ -1,93 +0,0 @@
-# Weavatrix 0.2.7
-
-## Proof-carrying changes
-
-`verified_change` is a new high-level MCP workflow for planning and verifying a code change. It
-accepts a natural-language task, an optional unified diff or changed-file hints, and an immutable Git
-baseline. Its stable result is one of:
-
-- `PASS`: every applicable enabled proof completed and no ratchet failed;
-- `BLOCKED`: a test failed, a new duplicate intersects changed code, a runtime cycle appeared, an
-  architecture ratchet failed, or bounded API evidence found an HTTP method mismatch;
-- `UNKNOWN`: required evidence is missing, partial, disabled, or not configured.
-
-The structured result contains intent-expanded task retrieval combined with exact changed-symbol
-seeds, up to five compact LSP/graph edit contexts, symbol-aware blast radius, affected-test paths,
-bounded JS/TS call-argument-to-parameter evidence, Git graph drift, architecture verification, a
-new-duplicate baseline comparison, and optional cross-repository HTTP contract evidence.
-
-The workflow respects the existing capability boundary. Exact source/LSP context requires `source`,
-duplicate comparison and architecture verification require `health`, and API tracing requires
-`crossrepo`. A narrow custom profile is never silently bypassed.
-
-## Safe targeted tests
-
-The workflow does not accept shell commands. It can execute at most five existing `package.json`
-scripts whose names match the test/check/verify allowlist. Execution requires both
-`run_tests:true` on the tool call and `WEAVATRIX_ALLOW_TEST_RUNS=1` in the server environment. The
-default remains read-only and returns the test plan or `UNKNOWN` when runtime evidence was requested
-but not authorized.
-
-## Malware scanner correction
-
-The npm content sweep now starts at actual installed package roots instead of the entire
-`node_modules` container. Hidden package-manager caches and hosted release snapshots are therefore
-not attributed as dependencies and cannot make Weavatrix flag its own malware-signature source.
-
-Heuristic remediation no longer says to treat a package as compromised or rotate all reachable
-secrets. It asks the operator to quarantine and inspect the package, verify origin and lockfile
-integrity, and rotate secrets only after execution or credential exposure is confirmed.
-
-Static heuristic findings now have a hard `high` severity ceiling. They expose
-`confirmedExecution:false` plus explicit runtime/origin/lockfile/exposure verification states;
-`critical` is reserved for independently confirmed malicious advisories or runtime evidence.
-
-Package-lock install-script drift now compares only `preinstall`, `install`, and `postinstall`.
-Development/publication hooks such as `prepare` no longer create false high-severity drift findings.
-
-## Signal-quality corrections
-
-- `query_graph` applies production-first path classification to the traversal, not only seed
-  selection. Tests, generated code, fixtures, docs, benchmarks and excluded paths require an
-  explicit question class or `include_classified:true`. Exact non-product seed files remain usable.
-- `verified_change` task retrieval uses the same production-first policy while always retaining
-  exact changed symbols. The bundled routing microbenchmark moved from one test-symbol false
-  positive (`0.25`) to zero (`0`) without losing any of its three expected production targets.
-- Unreferenced constant/field leaves that do not match the query are hidden by default; use
-  `include_low_signal:true` for diagnostic expansion.
-- `hot_path_review` now defaults to a focused score gate of 85 plus a narrow strong-local fallback.
-  On the 0.2.7 source tree this reduced the default queue from 717 diagnostic candidates to 116 of
-  1,043 analyzed symbols; `min_score:0` restores the full diagnostic set.
-- `find_dead_code` adds `STRONG_STATIC_EVIDENCE`, `BOUNDED_STATIC_EVIDENCE`, and
-  `HIGH_UNCERTAINTY` tiers, structured completed/remaining checks, and `autoDelete:false` on every
-  candidate. Strong static evidence means exact zero LSP references, not permission to delete.
-- npm unused/missing/duplicate dependency findings now carry manifest section, indexed-source,
-  script/config, package-scope and unresolved dynamic/plugin verification state. Unused dependencies
-  remain `REVIEW_REQUIRED`; missing dependencies retain the exact importing-file evidence.
-
-## Benchmark contract
-
-`npm run benchmark:agent` runs a deterministic task-to-symbol routing microbenchmark and reports task
-success, false-positive rate, estimated output tokens, and duration. This is intentionally labelled
-as a routing microbenchmark, not an autonomous end-to-end change benchmark.
-
-Independent Codebase Memory and Serena results may be supplied with
-`--independent-results <json>` using the blind evaluator contract in
-[`docs/agent-task-benchmark.md`](../agent-task-benchmark.md). Without same-task results for all three
-systems, comparison status is `INCOMPLETE`; `npm run benchmark:agent:release` fails closed. The
-repository does not manufacture competitor scores.
-
-## Scope and limitations
-
-- The interprocedural evidence maps call arguments to declared callee parameters for bounded JS/TS
-  graph call edges. It is not a CFG, value-propagation engine, or taint analysis.
-- An absent architecture contract produces `UNKNOWN`; provisional budgets are guidance, not policy.
-- A static path to a test is not proof that the test executed. A `PASS` that depends on runtime
-  behavior requires explicitly authorized test execution.
-- API proof is optional and registry-scoped. No client match is `UNKNOWN`, never proof of no external
-  consumers.
-
-## Tool catalog
-
-0.2.7 exposes 36 MCP tools. The default offline profile exposes 33; pinned exposes 30. Network tools
-remain absent from the offline and pinned profiles.