weavatrix 0.2.8 → 0.2.9

package/src/mcp/tools-context.mjs

@@ -2,6 +2,7 @@ import {isStructuralRelation} from '../graph/relations.js'
 import {boundedInteger} from '../bounds.js'
 import {isSymbol, labelOf} from './graph-context.mjs'
 import {toolResult} from './tool-result.mjs'
+import {sourceExcerpt} from './tools-source.mjs'
 
 const MAX_LINE_SAMPLES = 5
 
@@ -10,7 +11,7 @@ const fileOf = (g, id) => {
     return String(node?.source_file || (isSymbol(id) ? String(id).split('#')[0] : id))
 }
 
-function aggregateEdges(g, edges, cap) {
+function aggregateEdges(g, edges, cap, {callsiteFile = null} = {}) {
     const groups = new Map()
     for (const edge of edges || []) {
         if (isStructuralRelation(edge.relation) || edge.barrelProxy === true) continue
@@ -19,7 +20,12 @@ function aggregateEdges(g, edges, cap) {
         const key = `${id}\0${relation}`
         let group = groups.get(key)
         if (!group) {
-            group = {id, label: labelOf(g, id), file: fileOf(g, id), relation, count: 0, lines: []}
+            const targetFile = fileOf(g, id)
+            group = {
+                id, label: labelOf(g, id), relation, count: 0, lines: [],
+                file: callsiteFile || targetFile,
+                ...(callsiteFile && callsiteFile !== targetFile ? {targetFile} : {}),
+            }
             groups.set(key, group)
         }
         group.count++
@@ -95,7 +101,8 @@ function linesForGroups(title, groups) {
     const lines = [`${title}: ${groups.total} container(s)${groups.capped ? ` (${groups.shown.length} shown)` : ''}`]
     for (const group of groups.shown) {
         const sites = group.lines.length ? `:${group.lines.join(',')}` : ''
-        lines.push(`  ${group.count}× ${group.relation}  ${group.label}  [${group.file}${sites}]`)
+        const destination = group.targetFile ? ` → ${group.targetFile}` : ''
+        lines.push(`  ${group.count}× ${group.relation}  ${group.label}  [call site ${group.file}${sites}${destination}]`)
     }
     return lines
 }
@@ -133,14 +140,24 @@ export async function tContextBundle(g, args = {}, ctx = {}, inspectSymbol) {
         name: String(g.byId.get(inspection.definition.id)?.label || '').replace(/\(\)$/, ''),
     }
     const inbound = aggregateEdges(g, g.inn.get(definition.id), maxRelated)
-    const outbound = aggregateEdges(g, g.out.get(definition.id), maxRelated)
+    const outbound = aggregateEdges(g, g.out.get(definition.id), maxRelated, {callsiteFile: definition.file})
     const reExports = exactReExportSites(g, definition, maxReExports)
     const source = []
-    if (inspection.source.definition) source.push({role: 'Definition', ...inspection.source.definition})
+    const append = (role, excerpt) => {
+        if (!excerpt || source.length >= maxSourceFiles) return
+        if (source.some((item) => item.file === excerpt.file && item.focusLine === excerpt.focusLine)) return
+        source.push({role, ...excerpt})
+    }
+    append('Definition', inspection.source.definition)
+    const contextLines = boundedInteger(args.context_lines, 4, 0, 12)
+    for (const group of outbound.shown) {
+        for (const line of group.lines) append('Outbound call site', sourceExcerpt(ctx.repoRoot, group.file, line, contextLines))
+    }
+    for (const group of inbound.shown) {
+        for (const line of group.lines) append('Inbound call site', sourceExcerpt(ctx.repoRoot, group.file, line, contextLines))
+    }
     for (const excerpt of inspection.source.callers || []) {
-        if (source.length >= maxSourceFiles) break
-        if (source.some((item) => item.file === excerpt.file && item.focusLine === excerpt.focusLine)) continue
-        source.push({role: 'Caller', ...excerpt})
+        append('Reference', excerpt)
     }
     const result = {
         status: 'OK', definition, evidence: inspection.evidence,

package/src/mcp/tools-endpoints.mjs

@@ -0,0 +1,162 @@
+import {posix} from 'node:path'
+import {analyzeEndpointInventory} from '../analysis/endpoints.js'
+import {createPathClassifier, hasPathClass} from '../path-classification.js'
+import {sourceExcerpt} from './tools-source.mjs'
+import {toolResult} from './tool-result.mjs'
+
+const NON_PRODUCT = ['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
+
+const symbolLine = (node) => Number(String(node?.source_location || '').match(/L(\d+)/)?.[1]
+    || String(node?.id || '').match(/@(\d+)$/)?.[1] || 0)
+
+const symbolName = (node) => String(node?.label || node?.id || '')
+    .replace(/\([^)]*\).*$/, '')
+    .split(/[.#]/).at(-1)
+    .trim()
+
+function codeFiles(graph) {
+    return [...new Set((graph?.nodes || [])
+        .filter((node) => !String(node.id).includes('#') && node.source_file && node.file_type === 'code')
+        .map((node) => node.source_file))]
+}
+
+function endpointCandidates(inventory, args) {
+    const path = String(args.path || '').trim()
+    const method = args.method ? String(args.method).toUpperCase() : null
+    if (!path) return []
+    const eligible = inventory.endpoints.filter((endpoint) => !method || endpoint.method === method)
+    const exact = eligible.filter((endpoint) => endpoint.path === path)
+    return exact.length ? exact : eligible.filter((endpoint) => endpoint.path.endsWith(path))
+}
+
+function handlerCandidates(graph, endpoint) {
+    if (!endpoint.handler) return []
+    const wanted = endpoint.handler.toLowerCase()
+    const qualifier = String(endpoint.handlerRef || '').split('.').slice(-2, -1)[0]?.toLowerCase() || ''
+    const routeDir = posix.dirname(endpoint.file)
+    const scored = (graph.nodes || [])
+        .filter((node) => String(node.id).includes('#') && node.source_file && symbolName(node).toLowerCase() === wanted)
+        .map((node) => {
+            const file = String(node.source_file).replace(/\\/g, '/')
+            let score = 0
+            if (file === endpoint.file) score += 100
+            if (posix.dirname(file) === routeDir) score += 40
+            if (file.startsWith(`${routeDir}/`)) score += 15
+            if (qualifier) {
+                const basename = posix.basename(file).replace(/\.[^.]+$/, '').toLowerCase()
+                if (basename === qualifier || basename.endsWith(`.${qualifier}`) || basename.endsWith(`-${qualifier}`)) score += 60
+            }
+            const line = symbolLine(node)
+            if (file === endpoint.file && line >= endpoint.line && line - endpoint.line <= 250) score += 20
+            return {node, score}
+        })
+        .sort((a, b) => b.score - a.score || String(a.node.id).localeCompare(String(b.node.id)))
+    if (!scored.length) return []
+    const best = scored[0].score
+    return scored.filter((item) => item.score === best).map((item) => item.node)
+}
+
+function traceCalls(graph, start, {maxDepth, maxNodes, includeClassified, repoRoot}) {
+    const classifier = createPathClassifier(repoRoot)
+    const allowed = (node) => {
+        if (!node?.source_file) return false
+        if (includeClassified) return true
+        const info = classifier.explain(node.source_file, {content: ''})
+        return !info?.excluded && !NON_PRODUCT.some((name) => hasPathClass(info, name))
+    }
+    const queue = [{id: String(start.id), depth: 0}]
+    const seen = new Set([String(start.id)])
+    const edges = []
+    let truncated = false
+    for (let cursor = 0; cursor < queue.length; cursor++) {
+        const current = queue[cursor]
+        if (current.depth >= maxDepth) continue
+        const outgoing = (graph.out.get(current.id) || [])
+            .filter((edge) => edge.relation === 'calls' && edge.typeOnly !== true && edge.compileOnly !== true && edge.barrelProxy !== true)
+            .map((edge) => ({edge, target: graph.byId.get(String(edge.id))}))
+            .filter(({target}) => target && String(target.id).includes('#') && allowed(target))
+            .sort((a, b) => (Number(a.edge.line) || 0) - (Number(b.edge.line) || 0) || String(a.target.id).localeCompare(String(b.target.id)))
+        const unique = new Set()
+        for (const {edge, target} of outgoing) {
+            const targetId = String(target.id)
+            if (unique.has(targetId)) continue
+            unique.add(targetId)
+            if (edges.length >= maxNodes - 1) { truncated = true; break }
+            edges.push({
+                from: current.id,
+                to: targetId,
+                depth: current.depth + 1,
+                relation: edge.relation,
+                provenance: edge.provenance || 'UNKNOWN',
+                line: Number(edge.line) || symbolLine(graph.byId.get(current.id)) || 1,
+            })
+            if (!seen.has(targetId)) {
+                seen.add(targetId)
+                queue.push({id: targetId, depth: current.depth + 1})
+            }
+            if (unique.size >= 6) { truncated = outgoing.length > unique.size; break }
+        }
+        if (truncated && edges.length >= maxNodes - 1) break
+    }
+    return {edges, truncated, nodeCount: seen.size}
+}
+
+function endpointLine(endpoint) {
+    const mount = endpoint.mountChain?.length
+        ? endpoint.mountChain.map((item) => `${item.file}:${item.line} ${item.path}`).join(' → ')
+        : 'no static router mount chain'
+    return `${endpoint.method} ${endpoint.path} → ${endpoint.handler || 'inline/unknown'} (${endpoint.file}:${endpoint.line}; ${endpoint.mountState}/${endpoint.confidence}; declared ${endpoint.declaredPath}; ${mount})`
+}
+
+export function tTraceEndpoint(graph, args, ctx) {
+    if (!ctx?.repoRoot) return 'Endpoint tracing needs the repo root (not provided to this server).'
+    const inventory = analyzeEndpointInventory(ctx.repoRoot, codeFiles(graph))
+    const candidates = endpointCandidates(inventory, args)
+    if (!candidates.length) return toolResult(`No endpoint matched ${args.method ? `${String(args.method).toUpperCase()} ` : ''}${args.path || '(missing path)'}.`, {
+        status: 'NOT_FOUND', query: {path: args.path || null, method: args.method || null}, inventory: inventory.stats,
+    })
+    if (candidates.length > 1) return toolResult([
+        `Endpoint query is ambiguous (${candidates.length} matches). Pass the exact composed path and method:`,
+        ...candidates.slice(0, 20).map((endpoint) => `  ${endpointLine(endpoint)}`),
+    ].join('\n'), {status: 'AMBIGUOUS', candidates: candidates.slice(0, 20), inventory: inventory.stats}, {
+        completeness: {status: 'PARTIAL', reason: 'ambiguous endpoint'},
+    })
+    const endpoint = candidates[0]
+    const handlers = handlerCandidates(graph, endpoint)
+    if (handlers.length !== 1) return toolResult([
+        `Endpoint resolved, but its handler symbol is ${handlers.length ? 'ambiguous' : 'not present in the graph'}:`,
+        `  ${endpointLine(endpoint)}`,
+        ...handlers.slice(0, 12).map((node) => `  candidate ${node.label || node.id} (${node.source_file}:${symbolLine(node) || '?'}) [${node.id}]`),
+    ].join('\n'), {status: handlers.length ? 'AMBIGUOUS_HANDLER' : 'HANDLER_NOT_FOUND', endpoint, handlers}, {
+        completeness: {status: 'PARTIAL', reason: handlers.length ? 'ambiguous handler symbol' : 'handler symbol not found'},
+    })
+
+    const maxDepth = Math.max(1, Math.min(4, Number(args.max_depth) || 3))
+    const maxNodes = Math.max(2, Math.min(40, Number(args.max_nodes) || 20))
+    const contextLines = Math.max(0, Math.min(6, Number(args.context_lines) || 2))
+    const maxExcerpts = Math.max(0, Math.min(12, Number(args.max_excerpts) || 6))
+    const handler = handlers[0]
+    const traced = traceCalls(graph, handler, {
+        maxDepth, maxNodes, includeClassified: args.include_classified === true, repoRoot: ctx.repoRoot,
+    })
+    const excerpts = traced.edges.slice(0, maxExcerpts).map((edge) => {
+        const source = graph.byId.get(edge.from)
+        return sourceExcerpt(ctx.repoRoot, source?.source_file, edge.line, contextLines)
+    }).filter(Boolean)
+    const lines = [
+        `Endpoint trace (${traced.truncated ? 'PARTIAL' : 'COMPLETE'}; depth ≤${maxDepth}, nodes ${traced.nodeCount}/${maxNodes}):`,
+        `  ${endpointLine(endpoint)}`,
+        `  handler ${handler.label || handler.id} (${handler.source_file}:${symbolLine(handler) || '?'}) [${handler.id}]`,
+        traced.edges.length ? 'Call graph:' : 'Call graph: no outgoing call edges from the resolved handler.',
+        ...traced.edges.map((edge) => {
+            const from = graph.byId.get(edge.from), to = graph.byId.get(edge.to)
+            return `  ${'  '.repeat(Math.max(0, edge.depth - 1))}${from?.label || edge.from} → ${to?.label || edge.to} (${from?.source_file}:${edge.line}; ${edge.provenance})`
+        }),
+        ...excerpts.flatMap((excerpt) => ['', `Call-site excerpt (${excerpt.file}:${excerpt.startLine}-${excerpt.endLine}, focus ${excerpt.focusLine}):`, excerpt.text]),
+    ]
+    return toolResult(lines.join('\n'), {
+        status: traced.truncated ? 'PARTIAL' : 'COMPLETE', endpoint, handler: {
+            id: String(handler.id), label: handler.label || String(handler.id), file: handler.source_file, line: symbolLine(handler),
+        }, trace: traced, excerpts, inventory: inventory.stats,
+    }, {completeness: {status: traced.truncated ? 'PARTIAL' : 'COMPLETE', reason: traced.truncated ? 'bounded trace cap reached' : 'bounded outgoing call graph exhausted'}})
+}

package/src/mcp/tools-graph.mjs

@@ -180,7 +180,7 @@ export function tQueryGraph(g, {
     // Callers can opt back into augmentation when they explicitly want both behaviors.
     const automatic = pinned.seeds.length && augment_seeds !== true
         ? []
-        : findSeeds(g, question, Math.max(0, 8 - pinned.seeds.length), {repoRoot: toolCtx.repoRoot || null})
+        : findSeeds(g, question, Math.max(0, 6 - pinned.seeds.length), {repoRoot: toolCtx.repoRoot || null})
     const seeds = [...pinned.seeds, ...automatic.filter((node) => !pinned.seeds.some((seed) => String(seed.id) === String(node.id)))]
     if (!seeds.length) return `No nodes matched "${question}".`
     const maxDepth = Math.max(1, Math.min(6, Number(depth) || 3))

package/src/mcp/tools-health.mjs

@@ -9,7 +9,7 @@ import {classifyChangeImpact} from '../analysis/change-classification.js'
 import {compareAuditDebt, normalizeAuditScopeFiles, scopeAuditFindings} from '../analysis/audit-debt.js'
 import {summarizeFindings} from '../analysis/findings.js'
 import {summarizeCommunities, aggregateGraph} from '../analysis/graph-analysis.js'
-import {detectEndpoints} from '../analysis/endpoints.js'
+import {analyzeEndpointInventory} from '../analysis/endpoints.js'
 import {computeStaticTestReachability} from '../analysis/static-test-reachability.js'
 import {computeDeadCodeReview} from '../analysis/dead-code-review.js'
 import {computeHotPathReview} from '../analysis/hot-path-review.js'
@@ -86,7 +86,10 @@ export function tFindDuplicates(g, args, ctx) {
     const suppressionNote = suppressed && !includeClassified
         ? ` ${suppressed} fragment(s) classified as tests/e2e/generated/mock/story/docs/benchmark/temp or matched by .weavatrix.json exclude were suppressed; pass include_classified:true (and include_tests:true for tests) to inspect them explicitly.`
         : ''
-    if (!groups.length) return `No clones at ≥${simMin}% similarity / ≥${tokMin} tokens (${mode} mode). Try lowering the thresholds.${smallPolicy}${suppressionNote}`
+    const boilerplateNote = analysis.boilerplateSuppressed
+        ? ` ${analysis.boilerplateSuppressed} all-router framework boilerplate group(s) were suppressed; pass include_boilerplate:true to inspect them.`
+        : ''
+    if (!groups.length) return `No clones at ≥${simMin}% similarity / ≥${tokMin} tokens (${mode} mode). Try lowering the thresholds.${smallPolicy}${suppressionNote}${boilerplateNote}`
     const top = groups.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
     const lines = top.map((grp, k) => {
         const isStr = grp.members.some((f) => f.kind === 'string')
@@ -94,7 +97,7 @@ export function tFindDuplicates(g, args, ctx) {
         const sites = grp.members.slice(0, 8).map((f) => `     ${f.file}:${f.start}-${f.end}`)
         return [head, ...sites].join('\n')
     })
-    return `Found ${groups.length} clone group(s) (${mode} mode, ≥${simMin}%, ≥${tokMin} tok${includeStrings ? ', incl. large string literals' : ''}). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nUse read_source on any two sites to compare, then extract shared logic.${smallPolicy}${suppressionNote}`
+    return `Found ${groups.length} clone group(s) (${mode} mode, ≥${simMin}%, ≥${tokMin} tok${includeStrings ? ', incl. large string literals' : ''}). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nUse read_source on any two sites to compare, then extract shared logic.${smallPolicy}${suppressionNote}${boilerplateNote}`
 }
 
 // Focused dead-code review queue. Unlike the broad run_audit surface, this includes functions and
@@ -197,6 +200,7 @@ export function tFindDeadCode(g, args, ctx) {
 }
 
 const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
+const AUDIT_NON_PRODUCT_CLASSES = ['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
 
 export function formatAuditFinding(f) {
     const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''}${f.manifest ? `; ${f.manifest}` : ''})` : ''
@@ -206,12 +210,40 @@ export function formatAuditFinding(f) {
     return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.reason ? `\n      reason: ${f.reason}` : ''}${verification}${f.cycleRoute ? `\n      route: ${f.cycleRoute}` : ''}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
 }
 
-const auditFilter = (audit, args, findings = audit.findings) => {
+const auditFindingPaths = (finding) => {
+    const paths = []
+    if (finding?.file) paths.push(String(finding.file))
+    if (Array.isArray(finding?.files)) paths.push(...finding.files.map(String))
+    if (finding?.cycleRoute) paths.push(...String(finding.cycleRoute).split(/\s*(?:→|→|->)\s*/))
+    return [...new Set(paths.map((file) => file.replace(/\\/g, '/').trim()).filter(Boolean))]
+}
+
+export function auditFindingPathScope(findings, {includeClassified = false, repoRoot = null} = {}) {
+    const all = Array.isArray(findings) ? findings : []
+    if (includeClassified) return {findings: all, suppressed: 0}
+    const classifier = createPathClassifier(repoRoot)
+    const cache = new Map()
+    const classified = (file) => {
+        if (!cache.has(file)) cache.set(file, classifier.explain(file, {content: ''}))
+        const info = cache.get(file)
+        return info?.excluded || AUDIT_NON_PRODUCT_CLASSES.some((name) => hasPathClass(info, name))
+    }
+    const kept = all.filter((finding) => {
+        const paths = auditFindingPaths(finding)
+        return !paths.length || paths.some((file) => !classified(file))
+    })
+    return {findings: kept, suppressed: all.length - kept.length}
+}
+
+const DEPENDENCY_AUDIT_RULES = new Set(['unused-dep', 'missing-dep', 'duplicate-dep', 'unresolved-import', 'lockfile-drift'])
+export const isDependencyAuditFinding = (finding) => DEPENDENCY_AUDIT_RULES.has(String(finding?.rule || ''))
+
+const auditFilter = (audit, args, findings = audit.findings, repoRoot = null) => {
     const minSev = SEVERITY_RANK[args.min_severity] ?? 4
     const category = args.category ? String(args.category) : null
-    return findings
+    return auditFindingPathScope(findings, {includeClassified: args.include_classified === true, repoRoot}).findings
         .filter((finding) => (SEVERITY_RANK[finding.severity] ?? 4) <= minSev)
-        .filter((finding) => !category || finding.category === category)
+        .filter((finding) => !category || (category === 'dependencies' ? isDependencyAuditFinding(finding) : finding.category === category))
 }
 
 const auditChecksLine = (audit) => {
@@ -229,11 +261,12 @@ const auditConventionLines = (audit) => {
     ].filter((line) => line != null)
 }
 
-const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = null) => {
+const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = null, repoRoot = null) => {
     const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
-    const filtered = auditFilter(audit, args, findings)
+    const pathScope = auditFindingPathScope(findings, {includeClassified: args.include_classified === true, repoRoot})
+    const filtered = auditFilter(audit, args, pathScope.findings, repoRoot)
     const shown = filtered.slice(0, max)
-    const summary = summarizeFindings(findings)
+    const summary = summarizeFindings(pathScope.findings)
     const sev = summary.bySeverity
     const bycat = summary.byCategory
     const deps = audit.dependencyReport || {}
@@ -241,8 +274,9 @@ const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = n
         heading,
         `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
         ...auditConventionLines(audit),
-        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
+        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
         `Scoped severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Scoped categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
+        pathScope.suppressed ? `Path policy: production-first; suppressed ${pathScope.suppressed} finding(s) whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded. Pass include_classified:true to include them.` : 'Path policy: production-first; no classified-only findings were suppressed.',
         `Repository-level ${auditChecksLine(audit)}`,
         '',
         `Showing ${shown.length} of ${filtered.length} finding(s)${args.category ? ` in category "${args.category}"` : ''}${args.min_severity ? ` at ≥${args.min_severity}` : ''}:`,
@@ -353,12 +387,12 @@ async function runAuditWithBaseline(args, ctx, currentGraph) {
     const comparison = compareAuditDebt(currentAudit, baseline.value, changedFiles, {completeChangeSet})
     const mode = ['new', 'existing', 'all'].includes(args.debt) ? args.debt : 'new'
     const selectedRaw = mode === 'new' ? comparison.new : mode === 'existing' ? comparison.existing : comparison.all
-    const selected = auditFilter(currentAudit, args, selectedRaw)
+    const selected = auditFilter(currentAudit, args, selectedRaw, ctx.repoRoot)
     const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
     const shown = selected.slice(0, max)
     const optional = comparison.optional.checks.map((check) => `${check.name.toUpperCase()} UNCOMPARABLE (current ${check.current}; baseline ${check.baseline})`).join('; ')
     const stateOf = (finding) => mode === 'all' ? finding.debtState : mode
-    const fixedShown = auditFilter(baseline.value, args, comparison.fixed).slice(0, Math.min(10, max))
+    const fixedShown = auditFilter(baseline.value, args, comparison.fixed, ctx.repoRoot).slice(0, Math.min(10, max))
     const text = [
         `${mode.toUpperCase()} DEBT — deterministic internal audit vs ${resolved.ref} (${resolved.commit.slice(0, 12)})`,
         `Changed scope: ${changedFiles.length} file(s) from ${scopeSource}${changedFiles.length ? ` — ${changedFiles.slice(0, 12).join(', ')}${changedFiles.length > 12 ? ', …' : ''}` : ' — working tree matches the baseline'}.`,
@@ -411,38 +445,16 @@ export async function tRunAudit(g, args, ctx) {
         if (!normalized.ok) return `Changed-scope audit invalid: ${normalized.error}.`
         const scoped = scopeAuditFindings(audit.findings, normalized.files)
         const text = formatOrdinaryAudit(audit, args, scoped,
-            `CHANGED-SCOPE ONLY — ${normalized.files.length} explicitly supplied file(s); no baseline was provided, so these findings are not classified as new, existing, or fixed.`)
+            `CHANGED-SCOPE ONLY — ${normalized.files.length} explicitly supplied file(s); no baseline was provided, so these findings are not classified as new, existing, or fixed.`, ctx.repoRoot)
         return toolResult(text, {
             status: 'COMPLETE',
             mode: 'changed-scope',
             scope: {files: normalized.files, source: 'explicit changed_files'},
             comparison: {status: 'UNAVAILABLE', reason: 'base_ref was not provided; changed-scope is not a new-debt claim'},
-            findings: auditFilter(audit, args, scoped),
+            findings: auditFilter(audit, args, scoped, ctx.repoRoot),
         }, {completeness: {status: 'COMPLETE'}})
     }
-    const minSev = SEVERITY_RANK[args.min_severity] ?? 4
-    const cat = args.category ? String(args.category) : null
-    const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
-    const filtered = audit.findings
-        .filter((f) => (SEVERITY_RANK[f.severity] ?? 4) <= minSev)
-        .filter((f) => !cat || f.category === cat)
-    const shown = filtered.slice(0, max)
-    const sev = audit.summary.bySeverity
-    const bycat = audit.summary.byCategory
-    const deps = audit.dependencyReport || {}
-    const check = (name, state) => `${name} ${state?.status || 'ERROR'}${state?.detail ? ` — ${state.detail}` : ''}`
-    return [
-        `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
-        `Severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
-        `Structure: ${audit.structureReport?.runtimeCycles ?? audit.structureReport?.cycles ?? 0} runtime cycle(s), ${audit.structureReport?.compileTimeCouplings ?? audit.structureReport?.typeCouplings ?? 0} compile-time coupling group(s), ${audit.structureReport?.orphans ?? 0} orphan(s); import edges: ${audit.structureReport?.runtimeImportEdges ?? audit.structureReport?.importEdges ?? 0} runtime + ${audit.structureReport?.typeOnlyImportEdges ?? 0} type-only + ${audit.structureReport?.compileOnlyImportEdges ?? 0} compile-only. Dead: ${audit.deadReport.deadFiles} file(s), ${audit.deadReport.unusedExports} unused export(s).`,
-        `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${deps.unused ?? 'unknown'}, missing ${deps.missing ?? 'unknown'}, duplicate declarations ${deps.duplicateDeclarations ?? 'unknown'}. npm per-finding manifest/source/config verification: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`,
-        ...auditConventionLines(audit),
-        `Checks: ${check('OSV', audit.checks?.osv)}; ${check('malware', audit.checks?.malware)}. A NOT_CHECKED/PARTIAL/ERROR check is incomplete or unknown, never a clean zero.`,
-        ``,
-        `Showing ${shown.length} of ${filtered.length} finding(s)${cat ? ` in category "${cat}"` : ''}${args.min_severity ? ` at ≥${args.min_severity}` : ''}:`,
-        ...shown.map(formatAuditFinding),
-        filtered.length > shown.length ? `  … +${filtered.length - shown.length} more (raise max_findings or filter by category/min_severity)` : null,
-    ].filter((x) => x != null).join('\n')
+    return formatOrdinaryAudit(audit, args, audit.findings, null, ctx.repoRoot)
 }
 
 // Named module clusters: graph communities labeled by their dominant folder instead of bare numbers.
@@ -665,12 +677,29 @@ export function tListEndpoints(g, args, ctx) {
             .filter((n) => !String(n.id).includes('#') && n.source_file && n.file_type === 'code')
             .map((n) => n.source_file)
     )]
-    const eps = detectEndpoints(ctx.repoRoot, codeFiles)
+    const inventory = analyzeEndpointInventory(ctx.repoRoot, codeFiles)
+    let eps = inventory.endpoints
+    const method = args.method ? String(args.method).toUpperCase() : null
+    const path = args.path ? String(args.path) : null
+    if (method) eps = eps.filter((endpoint) => endpoint.method === method)
+    if (path) eps = eps.filter((endpoint) => endpoint.path === path || endpoint.path.endsWith(path))
     if (!eps.length) return 'No HTTP endpoints detected in the indexed code files.'
     const max = Math.max(1, Math.min(300, Number(args.max_results) || 100))
     const shown = eps.slice(0, max)
-    return [
-        `${eps.length} endpoint(s) detected${eps.length > shown.length ? `, showing ${shown.length}` : ''}:`,
-        ...shown.map((e) => `  ${e.method.toUpperCase().padEnd(6)} ${e.path}${e.handler ? `  → ${e.handler}` : ''}  (${e.file}${e.line ? `:${e.line}` : ''})`),
+    const stats = inventory.stats
+    const text = [
+        `${eps.length} endpoint(s) matched${eps.length > shown.length ? `, showing ${shown.length}` : ''}. Inventory: ${stats.declaredRoutes} declaration(s); ${stats.reachableStaticRoutes} statically reachable composed route(s); ${stats.localDeclarations} local/root declaration candidate(s); ${stats.staticMounts} static router mount(s)${stats.truncated ? `; TRUNCATED at ${stats.maxEndpoints}` : ''}.`,
+        ...shown.map((e) => {
+            const via = e.mountChain?.length
+                ? `\n           declared ${e.declaredPath} in ${e.file}${e.line ? `:${e.line}` : ''}; mount chain ${e.mountChain.map((mount) => `${mount.file}:${mount.line} ${mount.path}`).join(' → ')}`
+                : ''
+            return `  ${e.method.toUpperCase().padEnd(6)} ${e.path}${e.handler ? `  → ${e.handler}` : ''}  (${e.file}${e.line ? `:${e.line}` : ''}; ${e.mountState}/${e.confidence})${via}`
+        }),
     ].join('\n')
+    return toolResult(text, {
+        filters: {method, path},
+        stats,
+        endpoints: shown,
+        page: {shown: shown.length, total: eps.length, truncated: eps.length > shown.length || stats.truncated},
+    }, {completeness: {status: stats.truncated ? 'PARTIAL' : 'COMPLETE', reason: stats.truncated ? `endpoint cap ${stats.maxEndpoints} reached` : 'all indexed code files scanned'}})
 }

package/src/mcp/tools-source.mjs

@@ -27,7 +27,7 @@ function candidateNodes(g, query, limit = 20) {
     }))
 }
 
-function excerpt(repoRoot, file, focusLine, contextLines) {
+export function sourceExcerpt(repoRoot, file, focusLine, contextLines) {
     const resolved = resolveRepoPath(repoRoot, file)
     if (!resolved.ok) return null
     let size
@@ -198,8 +198,8 @@ export async function tInspectSymbol(g, args = {}, ctx = {}) {
         ...(node.source_range ? {range: node.source_range} : {}),
         ...(node.complexity ? {complexity: node.complexity} : {}),
     }
-    const definitionSource = excerpt(ctx.repoRoot, definition.file, definition.line, contextLines)
-    const callerSources = grouped.shown.slice(0, 5).map((group) => excerpt(ctx.repoRoot, group.file, group.locations[0]?.line || 1, contextLines)).filter(Boolean)
+    const definitionSource = sourceExcerpt(ctx.repoRoot, definition.file, definition.line, contextLines)
+    const callerSources = grouped.shown.slice(0, 5).map((group) => sourceExcerpt(ctx.repoRoot, group.file, group.locations[0]?.line || 1, contextLines)).filter(Boolean)
     const result = {
         status: 'OK',
         definition,

package/src/mcp-server.mjs

@@ -270,6 +270,7 @@ async function main() {
             const graphSnapshot = graph
             const callCtx = mutatesTarget ? ctx : {...ctx}
             const execute = async () => {
+                const startedAt = performance.now()
                 try {
                     // A queued rebuild must see a preceding retarget's graph, while non-mutating calls stay
                     // pinned to the graph that was active when their request arrived.
@@ -302,12 +303,39 @@ async function main() {
                         if (schemaWarning) text += `\n\nWarning: ${schemaWarning.message}`
                         if (staleLine && staleNotices.shouldShow({line: staleLine, graphPath: callCtx.graphPath, force: tool.name === 'graph_stats'})) text += `\n\n${staleLine}`
                     }
-                    const response = {content: [{type: 'text', text}]}
+                    const structuredBytes = normalized.structured ? Buffer.byteLength(JSON.stringify(normalized.structured)) : 0
+                    const textBytes = Buffer.byteLength(text)
+                    const durationMs = Math.max(0, performance.now() - startedAt)
+                    const response = {
+                        content: [{type: 'text', text}],
+                        _meta: {
+                            'weavatrix/metrics': {
+                                schemaVersion: 'weavatrix.metrics.v1',
+                                durationMs: Math.round(durationMs * 10) / 10,
+                                textBytes,
+                                structuredBytes,
+                                estimatedOutputTokens: Math.ceil((textBytes + structuredBytes) / 4),
+                                graphFreshness: staleLine ? 'stale' : (refresh?.error ? 'stale' : 'fresh'),
+                                graphUpdate: refresh?.kind || 'none',
+                                graphRevision: refresh?.revision || callGraph?.graphRevision || null,
+                                cache: refreshesGraph ? (refresh?.kind === 'none' ? 'graph-hit' : 'graph-refreshed') : 'not-applicable',
+                            },
+                        },
+                    }
                     if (normalized.structured) response.structuredContent = normalized.structured
                     return reply(id, response)
                 } catch (e) {
                     log(`tool ${params?.name} threw: ${e.stack || e.message}`)
-                    return reply(id, {content: [{type: 'text', text: `Tool error: ${e.message}`}], isError: true})
+                    const text = `Tool error: ${e.message}`
+                    return reply(id, {
+                        content: [{type: 'text', text}], isError: true,
+                        _meta: {'weavatrix/metrics': {
+                            schemaVersion: 'weavatrix.metrics.v1', durationMs: Math.round(Math.max(0, performance.now() - startedAt) * 10) / 10,
+                            textBytes: Buffer.byteLength(text), structuredBytes: 0,
+                            estimatedOutputTokens: Math.ceil(Buffer.byteLength(text) / 4), graphFreshness: 'unknown',
+                            graphUpdate: 'none', graphRevision: graphSnapshot?.graphRevision || null, cache: 'not-applicable',
+                        }},
+                    })
                 }
             }
             if (!mutatesTarget && !refreshesGraph) return execute()

package/src/mcp-source-tools.mjs

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { spawnSync } from 'node:child_process'
-import { extname, join, relative } from 'node:path'
+import { extname, isAbsolute, join, relative, resolve } from 'node:path'
 import { resolveRepoPath } from './repo-path.js'
 import { childProcessEnv } from './child-env.js'
 import { toolResult } from './mcp/tool-result.mjs'
@@ -11,21 +11,24 @@ const MAX_SEARCH_FILE_BYTES = 1024 * 1024
 const MAX_SOURCE_FILE_BYTES = 2 * 1024 * 1024
 const MAX_SOURCE_CONTEXT_LINES = 1000
 
-function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }) {
+function rgSearch(repoRoot, resolveRg, query, { isRegex, glob, maxResults }, spawnRg = spawnSync) {
     const rg = resolveRg()
     if (!rg) return null
     const args = ['--line-number', '--no-heading', '--color', 'never', '--hidden', '-g', '!.git/**', '-m', '100', '-i']
     if (!isRegex) args.push('--fixed-strings')
     if (glob) args.push('-g', glob)
-    args.push('--', query, repoRoot)
-    const res = spawnSync(rg, args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000, env: childProcessEnv() })
+    // Run from the repository root and search `.` so path globs such as `src/**` are evaluated
+    // against repository-relative paths on Windows too. Passing an absolute search root makes rg
+    // compare the glob with a drive-prefixed path and silently return no matches.
+    args.push('--', query, '.')
+    const res = spawnRg(rg, args, { cwd: repoRoot, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: 15000, env: childProcessEnv() })
     if (res.status !== 0 && res.status !== 1) return null
     const out = []
     for (const line of (res.stdout || '').split(/\r?\n/)) {
         const match = line.match(/^(.*?):(\d+):(.*)$/)
         if (!match) continue
         out.push({
-            file: relative(repoRoot, match[1]).replace(/\\/g, '/'),
+            file: relative(repoRoot, isAbsolute(match[1]) ? match[1] : resolve(repoRoot, match[1])).replace(/\\/g, '/'),
             line: Number(match[2]),
             text: match[3].trim().slice(0, 300),
         })
@@ -87,12 +90,12 @@ function nodeGrep(repoRoot, query, { isRegex, glob, maxResults }) {
     return out
 }
 
-export function searchCode({ repoRoot, resolveRg }, { query, is_regex = false, max_results = 40, glob } = {}) {
+export function searchCode({ repoRoot, resolveRg, spawnRg = spawnSync }, { query, is_regex = false, max_results = 40, glob } = {}) {
     if (!query) return 'Provide a "query" string.'
     if (!repoRoot || !existsSync(repoRoot)) return 'Source search unavailable: repo root not provided to this MCP server.'
     const max = Math.max(1, Math.min(200, Number(max_results) || 40))
     const opts = { isRegex: !!is_regex, glob: glob || null, maxResults: max }
-    let matches = rgSearch(repoRoot, resolveRg, query, opts)
+    let matches = rgSearch(repoRoot, resolveRg, query, opts, spawnRg)
     const engine = matches ? 'ripgrep' : 'node'
     if (!matches) matches = nodeGrep(repoRoot, query, opts)
     const what = is_regex ? `/${query}/i` : `"${query}"`