weavatrix 0.3.13 → 0.3.14

package/docs/releases/v0.3.14.md

@@ -0,0 +1,37 @@
+# Weavatrix 0.3.14
+
+0.3.14 is a Repo Lens dogfood hardening release. It keeps the 34-tool,
+network-free Core surface while making large JavaScript graphs practical for
+UI consumers and reducing production-analysis noise.
+
+## Structured results and performance
+
+- `find_duplicates` and ordinary `run_audit` results now include bounded
+  structured groups/findings alongside their existing text summaries, so MCP
+  clients can render native views without parsing prose.
+- Local symbol references are indexed once per file and declaration ranges are
+  subtracted with binary search instead of rescanning the whole file for every
+  symbol. On the 8,117-node Repo Lens graph, aggregation fell from more than
+  64 seconds to about 0.93 seconds while preserving graph totals.
+
+## Production-first precision
+
+- `vendor`, `vendored`, and `third-party` paths are classified explicitly and
+  suppressed consistently across duplicates, audit, endpoints, context,
+  architecture, dead-code, hot-path, and graph-query surfaces.
+- Electron preload files are treated as entry points only when another source
+  contains a bounded `BrowserWindow` `preload:` option.
+- Endpoint extraction masks JavaScript regex literals and comments correctly
+  and recognizes bounded `node:http` method plus `url.pathname` guards. Repo
+  Lens now reports its four production control routes without comment/test
+  false positives in the production view.
+
+## Coverage interoperability
+
+- `coverage_map` reads Cargo Tarpaulin's official JSON report shape, including
+  component paths and `traces[].stats.Line`, and advertises both Tarpaulin JSON
+  and `cargo llvm-cov` LCOV workflows for Rust repositories.
+
+This Core release is paired with `weavatrix-refactor` 0.1.2 and
+`weavatrix-online` 0.2.0. Each layer keeps its own package, license, version,
+and release provenance.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: an always-fresh architecture graph with production-first evidence — blast radius, dead code, endpoints, clones, history, Health and architecture safeguards, with honestly labeled precision.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -48,6 +48,7 @@
     "docs/releases/v0.3.11.md",
     "docs/releases/v0.3.12.md",
     "docs/releases/v0.3.13.md",
+    "docs/releases/v0.3.14.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/src/analysis/coverage-reports-tarpaulin.js

@@ -0,0 +1,112 @@
+import { readFileSync } from "node:fs";
+
+function pct01(value) {
+  const n = Number(value);
+  if (!Number.isFinite(n)) return null;
+  return Math.max(0, Math.min(1, n > 1 ? n / 100 : n));
+}
+
+function pctFromCounts(covered, total) {
+  const c = Number(covered);
+  const t = Number(total);
+  if (!Number.isFinite(c) || !Number.isFinite(t) || t <= 0) return null;
+  return Math.max(0, Math.min(1, c / t));
+}
+
+function addLineHit(lines, line, hit) {
+  const value = Number(line);
+  if (!Number.isFinite(value) || value <= 0) return;
+  const n = Math.round(value);
+  if (n < 1) return;
+  const current = lines.get(n);
+  lines.set(n, Math.max(Number(current) || 0, Number(hit) || 0));
+}
+
+function numericLineList(value) {
+  const input = Array.isArray(value) ? value : [];
+  return input
+    .map((line) => Number(line))
+    .filter((line) => Number.isFinite(line) && line > 0)
+    .map((line) => Math.round(line));
+}
+
+function legacyLineGroups(record) {
+  if (!record || typeof record !== "object") return { covered: [], uncovered: [] };
+  const lines = record.lines && typeof record.lines === "object" ? record.lines : {};
+  return {
+    covered: [
+      ...numericLineList(record.covered),
+      ...numericLineList(record.covered_lines),
+      ...numericLineList(record.coveredLines),
+      ...numericLineList(lines.covered),
+      ...numericLineList(lines.covered_lines),
+    ],
+    uncovered: [
+      ...numericLineList(record.uncovered),
+      ...numericLineList(record.uncovered_lines),
+      ...numericLineList(record.uncoveredLines),
+      ...numericLineList(record.missing),
+      ...numericLineList(record.missing_lines),
+      ...numericLineList(lines.uncovered),
+      ...numericLineList(lines.uncovered_lines),
+      ...numericLineList(lines.missing),
+    ],
+  };
+}
+
+function recordPath(record) {
+  const raw = record?.path || record?.file || record?.filename || record?.name;
+  if (Array.isArray(raw)) return raw.map(String).filter(Boolean).join("/");
+  return raw;
+}
+
+function reportEntries(json) {
+  const files = json?.files || json?.coverage || json;
+  if (Array.isArray(files)) {
+    return files.map((record) => [recordPath(record), record]).filter(([raw]) => raw);
+  }
+  if (files && typeof files === "object") return Object.entries(files);
+  return [];
+}
+
+function coveragePct(record, covered, total) {
+  const summary = record?.summary && typeof record.summary === "object" ? record.summary : {};
+  return pct01(
+    record?.coverage
+    ?? record?.coverage_percentage
+    ?? record?.line_coverage
+    ?? summary.coverage
+    ?? summary.coverage_percentage
+    ?? summary.percent
+  )
+    ?? pctFromCounts(record?.covered, record?.coverable)
+    ?? pctFromCounts(covered, total);
+}
+
+export function readTarpaulinCoverage(filePath) {
+  const json = JSON.parse(readFileSync(filePath, "utf8"));
+  return reportEntries(json).map(([path, record]) => {
+    const lines = new Map();
+    for (const trace of Array.isArray(record?.traces) ? record.traces : []) {
+      if (!trace?.stats || typeof trace.stats !== "object" || !("Line" in trace.stats)) continue;
+      addLineHit(lines, trace.line, trace.stats.Line);
+    }
+    const legacy = legacyLineGroups(record);
+    for (const line of legacy.uncovered) addLineHit(lines, line, 0);
+    for (const line of legacy.covered) addLineHit(lines, line, 1);
+    const measuredTotal = lines.size;
+    const measuredCovered = [...lines.values()].filter((hit) => Number(hit) > 0).length;
+    const reportedTotal = Number(record?.coverable);
+    const reportedCovered = Number(record?.covered);
+    return {
+      path,
+      entry: {
+        pct: coveragePct(record, measuredCovered, measuredTotal),
+        total: Number.isFinite(reportedTotal) ? reportedTotal : measuredTotal,
+        covered: Number.isFinite(reportedCovered) ? reportedCovered : measuredCovered,
+        lines,
+        source: "tarpaulin-report.json",
+      },
+    };
+  });
+}

package/src/analysis/coverage-reports.js

@@ -4,6 +4,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
 import { createRepoBoundary } from "../repo-path.js";
+import { readTarpaulinCoverage } from "./coverage-reports-tarpaulin.js";
 
 export function normRepoPath(value) {
   return String(value || "").replace(/\\/g, "/").replace(/^\.\//, "");
@@ -84,8 +85,10 @@ function mergeCoverageEntry(map, rawPath, entry, knownFiles, repoRoot) {
 }
 
 function addLineHit(lines, line, hit) {
-  const n = Math.max(1, Math.round(Number(line) || 0));
-  if (!n) return;
+  const value = Number(line);
+  if (!Number.isFinite(value) || value <= 0) return;
+  const n = Math.round(value);
+  if (n < 1) return;
   const current = lines.get(n);
   lines.set(n, Math.max(Number(current) || 0, Number(hit) || 0));
 }
@@ -208,6 +211,12 @@ function parseGoCoverage(map, filePath, knownFiles, repoRoot) {
   }
 }
 
+function parseTarpaulinJson(map, filePath, knownFiles, repoRoot) {
+  for (const record of readTarpaulinCoverage(filePath)) {
+    mergeCoverageEntry(map, record.path, record.entry, knownFiles, repoRoot);
+  }
+}
+
 export function readCoverageForRepo(repoRoot, knownFiles) {
   const out = new Map();
   if (!repoRoot) return out;
@@ -219,6 +228,8 @@ export function readCoverageForRepo(repoRoot, knownFiles) {
     ["lcov.info", parseLcov],
     ["coverage/coverage.json", parseCoveragePyJson],
     ["coverage.json", parseCoveragePyJson],
+    ["tarpaulin-report.json", parseTarpaulinJson],
+    ["coverage/tarpaulin-report.json", parseTarpaulinJson],
     ["coverage.out", parseGoCoverage],
     ["cover.out", parseGoCoverage]
   ];

package/src/analysis/dead-code-review/policy.js

@@ -12,7 +12,7 @@ export function hasDynamicCode(source, file = '') {
     return DYNAMIC_CODE_RE.test(text) || (JS_LIKE_PATH_RE.test(String(file)) && JS_DYNAMIC_IMPORT_RE.test(text))
 }
 
-const NON_PRODUCT_CLASSES = Object.freeze(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const NON_PRODUCT_CLASSES = Object.freeze(['generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 
 export function deadCodePathAllowed(info, {includeTests, includeClassified}) {
     if (!includeTests && hasPathClass(info, 'test', 'e2e')) return {ok: false, bucket: 'tests'}

package/src/analysis/duplicate-groups.js

@@ -6,7 +6,7 @@ import {withGitRefCheckout} from './git-ref-graph.js'
 import {buildInternalGraph} from '../graph/internal-builder.js'
 import {filterGraphForMode} from '../graph/graph-filter.js'
 
-const NON_PRODUCT = new Set(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const NON_PRODUCT = new Set(['generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const eligible = (fragment, settings) => {
   const classes = new Set(fragment.classes || [])
   if (fragment.n < settings.tokMin) return false

package/src/analysis/endpoints/common.js

@@ -11,7 +11,15 @@ export function lineAt(text, index) {
 // Preserve offsets and literals while hiding comments from regex extractors.
 export function maskComments(text, { hashComments = false } = {}) {
   const chars = String(text || "").split("");
-  let quote = "", escaped = false, lineComment = false, blockComment = false;
+  let quote = "", escaped = false, lineComment = false, blockComment = false, regex = false, regexClass = false;
+  const startsRegex = (index) => {
+    let cursor = index - 1;
+    while (cursor >= 0 && /\s/.test(chars[cursor])) cursor--;
+    if (cursor < 0) return true;
+    if (/[=(:,!&|?{}[\];]/.test(chars[cursor])) return true;
+    const prefix = chars.slice(Math.max(0, cursor - 12), cursor + 1).join("");
+    return /(?:^|\b)(?:return|throw|case|yield|await)\s*$/i.test(prefix) || /=>\s*$/.test(prefix);
+  };
   for (let i = 0; i < chars.length; i++) {
     const ch = chars[i], next = chars[i + 1];
     if (lineComment) {
@@ -24,6 +32,14 @@ export function maskComments(text, { hashComments = false } = {}) {
       else if (ch !== "\n" && ch !== "\r") chars[i] = " ";
       continue;
     }
+    if (regex) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === "[") regexClass = true;
+      else if (ch === "]") regexClass = false;
+      else if (ch === "/" && !regexClass) regex = false;
+      continue;
+    }
     if (quote) {
       if (escaped) escaped = false;
       else if (ch === "\\") escaped = true;
@@ -33,6 +49,7 @@ export function maskComments(text, { hashComments = false } = {}) {
     if (ch === '"' || ch === "'" || ch === "`") { quote = ch; continue; }
     if (ch === "/" && next === "/") { chars[i] = chars[i + 1] = " "; i++; lineComment = true; continue; }
     if (ch === "/" && next === "*") { chars[i] = chars[i + 1] = " "; i++; blockComment = true; continue; }
+    if (!hashComments && ch === "/" && startsRegex(i)) { regex = true; regexClass = false; escaped = false; continue; }
     if (hashComments && ch === "#") { chars[i] = " "; lineComment = true; }
   }
   return chars.join("");

package/src/analysis/endpoints/extract.js

@@ -92,6 +92,19 @@ export function extractEndpointsFromText(text, file) {
     if (!HTTP_CLIENT_CALLER.test(match[1]) && handler && handler[0] !== "{") add(match[2], match[4], match[5], match.index);
   }
 
+  // Bare node:http servers commonly dispatch through request-method and URL-pathname guards rather
+  // than a router API. Keep the extraction bounded to files that actually construct an HTTP server;
+  // test assertions and arbitrary `object.method` comparisons are not enough to create endpoints.
+  if (!py && /\bcreateServer\s*\(|\b(?:node:)?https?\b/.test(scanText)) {
+    const guardedRoute = /\bif\s*\(([\s\S]{0,600}?)\)\s*(?:\{|return\b)/g;
+    while ((match = guardedRoute.exec(scanText))) {
+      const condition = match[1];
+      const methodMatch = /\b[A-Za-z_$][\w$]*\.method\s*={2,3}\s*(["'`])(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|CONNECT)\1/i.exec(condition);
+      const pathMatch = /\b[A-Za-z_$][\w$]*\.pathname\s*={2,3}\s*(["'`])(\/[^"'`]*)\1/i.exec(condition);
+      if (methodMatch && pathMatch) add(methodMatch[2], pathMatch[2], "", match.index);
+    }
+  }
+
   const go = /\.\s*(?:HandleFunc|Handle)\s*\(\s*(["'`])(\/[^"'`]*)\1\s*,\s*([\s\S]{0,120}?)\)/g;
   while ((match = go.exec(scanText))) add("ANY", match[2], match[3], match.index);
 

package/src/analysis/graph-analysis.aggregate.js

@@ -4,7 +4,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { normalizeRepoParts, readCoverageForRepo, pctFromCounts } from "./coverage-reports.js";
-import { bareSymbolName, countLocalRefsOutsideOwnRange, computeSymbolExternalRefs } from "./graph-analysis.refs.js";
+import { bareSymbolName, computeLocalSymbolRefs, computeSymbolExternalRefs } from "./graph-analysis.refs.js";
 import { createRepoBoundary } from "../repo-path.js";
 import { edgeList, folderModuleOf } from "./graph-analysis.edges.js";
 export { folderModuleOf } from "./graph-analysis.edges.js";
@@ -223,6 +223,7 @@ export function aggregateGraph(graph, repoRoot) {
       .map((s) => ({ id: s.id, label: s.label, start: parseInt(s.line, 10), end: parseInt(s.endLine, 10), ref: s }))
       .filter((s) => Number.isFinite(s.start) && s.start > 0)
       .sort((a, b) => a.start - b.start);
+    const ranges = [];
     for (let i = 0; i < sorted.length; i++) {
       const start = sorted[i].start;
       const next = i + 1 < sorted.length ? sorted[i + 1].start : total > start ? total + 1 : start + 1;
@@ -234,9 +235,9 @@ export function aggregateGraph(graph, repoRoot) {
       sorted[i].ref.endLine = end;
       const cov = coverageForRange(fid, start, end);
       if (cov != null) symbolCoverage.set(sorted[i].id, cov);
-      const refs = countLocalRefsOutsideOwnRange(txt, bareSymbolName(sorted[i].label), start, end);
-      if (refs > 0) symbolLocalRefs.set(sorted[i].id, refs);
+      ranges.push({id: sorted[i].id, name: bareSymbolName(sorted[i].label), startLine: start, endLine: end});
     }
+    for (const [id, refs] of computeLocalSymbolRefs(txt, ranges)) symbolLocalRefs.set(id, refs);
   }
   for (const s of symbols) {
     const fid = id2file.get(s.id);

package/src/analysis/graph-analysis.refs.js

@@ -41,6 +41,54 @@ export function countLocalRefsOutsideOwnRange(text, name, startLine, endLine) {
   return refs;
 }
 
+const lowerBound = (values, target) => {
+  let low = 0, high = values.length;
+  while (low < high) {
+    const middle = (low + high) >>> 1;
+    if (values[middle] < target) low = middle + 1;
+    else high = middle;
+  }
+  return low;
+};
+
+// Count every wanted identifier in a file once, then subtract occurrences inside each declaration
+// with binary searches over occurrence line numbers. The former per-symbol full-file scan became
+// quadratic on large vendored files (thousands of symbols over tens of thousands of lines).
+export function computeLocalSymbolRefs(text, symbols) {
+  const candidates = (symbols || []).map((symbol) => ({
+    id: symbol.id,
+    name: bareSymbolName(symbol.name ?? symbol.label),
+    start: Number(symbol.startLine ?? symbol.start),
+    end: Number(symbol.endLine ?? symbol.end),
+  })).filter((symbol) => symbol.id && isIdentifierName(symbol.name));
+  if (!text || !candidates.length) return new Map();
+  const wanted = new Set(candidates.map((symbol) => symbol.name));
+  const occurrenceLines = new Map();
+  const identifier = /[A-Za-z_$][\w$]*/g;
+  const lines = String(text).split(/\r?\n/);
+  for (let index = 0; index < lines.length; index++) {
+    identifier.lastIndex = 0;
+    let match;
+    while ((match = identifier.exec(lines[index]))) {
+      const name = match[0];
+      if (!wanted.has(name)) continue;
+      const positions = occurrenceLines.get(name) || [];
+      positions.push(index + 1);
+      occurrenceLines.set(name, positions);
+    }
+  }
+  const refs = new Map();
+  for (const symbol of candidates) {
+    const positions = occurrenceLines.get(symbol.name) || [];
+    const start = Number.isFinite(symbol.start) && symbol.start > 0 ? symbol.start : 0;
+    const end = Number.isFinite(symbol.end) && symbol.end >= start ? symbol.end : start;
+    const inside = start ? lowerBound(positions, end + 1) - lowerBound(positions, start) : 0;
+    const outside = Math.max(0, positions.length - inside);
+    if (outside > 0) refs.set(symbol.id, outside);
+  }
+  return refs;
+}
+
 function importCandidates(fromFile, spec) {
   const raw = String(spec || "");
   if (!raw.startsWith(".")) return [];

package/src/analysis/hot-path-review.js

@@ -7,7 +7,7 @@ import {createPathClassifier, hasPathClass} from '../path-classification.js'
 import {isStructuralRelation} from '../graph/relations.js'
 import {boundedInteger} from '../util.js'
 
-const NON_PRODUCT = ['generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
+const NON_PRODUCT = ['generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp']
 const endpoint = (value) => String(value && typeof value === 'object' ? value.id : value || '')
 const normalize = (value) => String(value || '').replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/, '')
 const boundedInt = boundedInteger

package/src/analysis/internal-audit.reach.js

@@ -53,6 +53,30 @@ export function springConventionEntries(sources, fileSet = null) {
   return out.sort((a, b) => a.file.localeCompare(b.file));
 }
 
+// Electron loads preload scripts from BrowserWindow.webPreferences rather than through a normal
+// import edge. Require both a conventional preload filename and a bounded `preload:` option that
+// names that exact file, so an unrelated helper called preload.js is not silently blessed.
+export function electronPreloadEntries(sources, fileSet = null) {
+  const files = fileSet || new Set((sources || new Map()).keys());
+  const out = [];
+  for (const rawFile of files) {
+    const file = String(rawFile || "").replace(/\\/g, "/");
+    if (!/(^|\/)preload\.[cm]?[jt]s$/i.test(file)) continue;
+    const basename = posix.basename(file).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const marker = new RegExp(`\\bpreload\\s*:\\s*[\\s\\S]{0,240}?["'\\x60]${basename}["'\\x60]`, "i");
+    const owner = [...(sources || [])].find(([other, text]) => String(other).replace(/\\/g, "/") !== file && marker.test(String(text || "")));
+    if (!owner) continue;
+    out.push({
+      file,
+      framework: "electron",
+      marker: `BrowserWindow preload option in ${String(owner[0]).replace(/\\/g, "/")}`,
+      confidence: "high",
+      reason: "Electron loads this exact preload script outside the static import graph",
+    });
+  }
+  return out.sort((a, b) => a.file.localeCompare(b.file));
+}
+
 // Entry set for reachability: conventional entry names + package.json main/module/browser/bin/exports +
 // html pages (they root classic-script apps) + test files (the runner enters them) + root config files +
 // dynamic-import targets. Anything reachable from here is "used"; the rest corroborates unused-file.
@@ -136,6 +160,10 @@ export function entryFiles(graph, pkgOrScopes, dynamicTargets = new Set(), { dec
     entries.add(evidence.file);
     conventionEvidence.push(evidence);
   }
+  for (const evidence of electronPreloadEntries(sources, fileSet)) {
+    entries.add(evidence.file);
+    conventionEvidence.push(evidence);
+  }
   for (const raw of Array.isArray(declaredEntries) ? declaredEntries : [declaredEntries]) {
     const resolved = resolveEntry("", raw);
     if (resolved && fileSet.has(resolved)) entries.add(resolved);

package/src/analysis/internal-audit.run.js

@@ -61,7 +61,7 @@ export async function runInternalAudit(repoPath, {
   };
   const isNonProductPath = (file) => {
     const info = classifyPath(file);
-    return info.excluded || hasPathClass(info, "test", "e2e", "generated", "mock", "story", "docs", "benchmark", "temp");
+    return info.excluded || hasPathClass(info, "test", "e2e", "generated", "vendored", "mock", "story", "docs", "benchmark", "temp");
   };
 
   const conventionEvidence = [];

package/src/analysis/static-test-reachability.js

@@ -47,7 +47,7 @@ export function computeStaticTestReachability(graph, {
   const isTest = (file) => hasPathClass(classify(file), "test", "e2e");
   const isProduct = (file) => {
     const info = classify(file);
-    return !info.excluded && !hasPathClass(info, "test", "e2e", "generated", "mock", "story", "docs", "benchmark", "temp");
+    return !info.excluded && !hasPathClass(info, "test", "e2e", "generated", "vendored", "mock", "story", "docs", "benchmark", "temp");
   };
 
   const idToFile = new Map();

package/src/mcp/architecture-starter.mjs

@@ -30,7 +30,7 @@ const CODE_EXTENSIONS = new Set([
     '.cjs', '.cs', '.css', '.go', '.htm', '.html', '.java', '.js', '.jsx', '.less', '.mjs', '.py', '.pyi',
     '.rs', '.scss', '.sol', '.sql', '.ts', '.tsx',
 ])
-const CLASSIFIED = ['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
+const CLASSIFIED = ['test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp']
 const EDGE_RELATIONS = new Set(['imports', 're_exports', 'calls', 'references'])
 
 const slash = (value) => String(value || '').replace(/\\/g, '/').replace(/^\.\//, '')

package/src/mcp/catalog.mjs

@@ -124,12 +124,12 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {cap: 'search', name: 'search_code', description: 'Full-text or regex search across the repo source (ripgrep-backed, Node fallback). The graph only stores structure — use this to find literal text/patterns, then get_node/get_neighbors for structure.', inputSchema: {type: 'object', properties: {query: {type: 'string', description: 'text or regex to search for'}, is_regex: {type: 'boolean', default: false}, glob: {type: 'string', description: 'optional path glob, e.g. "*.js" or "src/**"'}, max_results: {type: 'integer', default: 40}}, required: ['query']}, run: (g, a, ctx) => searchCode({repoRoot: ctx.repoRoot, resolveRg}, a)},
           {cap: 'source', name: 'read_source', description: "Read the actual source of a node (by label/ID) or a repo-relative file path — the symbol's lines with context. The graph stores only locations, not source text. For a path read, pass start_line to anchor the window anywhere in the file (otherwise it shows the head).", inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'node label or ID'}, path: {type: 'string', description: 'or a repo-relative file path'}, start_line: {type: 'integer', description: 'anchor line: window = start_line-before .. start_line+after'}, before: {type: 'integer', default: 3}, after: {type: 'integer', default: 40}}}, run: (g, a, ctx) => readSource({repoRoot: ctx.repoRoot, resolveNode, isSymbol}, g, a)},
           {cap: 'source', refreshGraph: true, name: 'inspect_symbol', description: 'Inspect one exact symbol with an on-demand TypeScript/JavaScript LSP reference query, grouped occurrence containers, graph blast radius, complexity facts and bounded local source context. Ambiguous labels fail closed; point queries never replace the broad precision overlay.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_containers: {type: 'integer', minimum: 1, maximum: 50, default: 15}, context_lines: {type: 'integer', minimum: 0, maximum: 40, default: 8}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => ts.tInspectSymbol(g, a, ctx)},
-          {cap: 'source', refreshGraph: true, name: 'context_bundle', description: 'Return one compact, bounded source bundle for an exact symbol: definition, production-first inbound/outbound containers, exact re-export sites, on-demand TS/JS reference evidence and diverse excerpts around call sites. Use before an edit when query_graph would be too broad.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_related: {type: 'integer', minimum: 1, maximum: 30, default: 10}, max_reexports: {type: 'integer', minimum: 1, maximum: 100, default: 20}, max_source_files: {type: 'integer', minimum: 1, maximum: 8, default: 4}, context_lines: {type: 'integer', minimum: 0, maximum: 12, default: 4}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp callers after production callers'}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => tb.tContextBundle(g, a, ctx, ts.tInspectSymbol)},
-        {cap: 'health', name: 'find_duplicates', description: "Content-based clone detection over production code (MOSS winnowing over method bodies). Supports high-confidence small clones down to 12 tokens when min_tokens is lowered. Tests, classified non-product paths, all-router framework boilerplate and immutable declarative catalogs are excluded by default; opt them in explicitly.", inputSchema: {type: 'object', properties: {min_similarity: {type: 'integer', description: '50-100, default 80 (ignored in semantic mode)'}, min_tokens: {type: 'integer', minimum: 12, maximum: 400, description: 'min fragment size, 12-400; default 50'}, mode: {type: 'string', enum: ['renamed', 'strict', 'semantic'], default: 'renamed'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, include_boilerplate: {type: 'boolean', default: false, description: 'Include clone groups made entirely of conventional *.router.js/ts router symbols'}, include_declarative: {type: 'boolean', default: false, description: 'Include repeated immutable array/object catalogs that contain no executable control flow'}, include_strings: {type: 'boolean', description: 'Also clone-check large multi-line string literals', default: false}, top_n: {type: 'integer', default: 15}}}, run: (g, a, ctx) => th.tFindDuplicates(g, a, ctx)},
-        {cap: 'health', name: 'find_dead_code', description: 'Conservative review queue for statically unreferenced files, functions, methods and symbols. Returns confidence, reason, bounded evidence and explicit framework/dynamic/reflection/public-API caveats; never an auto-delete verdict. Tests, generated code, mocks, stories, docs, benchmarks and temporary roots are excluded by default.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repo-relative path prefix'}, kinds: {type: 'array', items: {type: 'string', enum: ['file', 'function', 'method', 'symbol']}, maxItems: 4, uniqueItems: true, description: 'Optional candidate kinds; defaults to all'}, min_confidence: {type: 'string', enum: ['high', 'medium', 'low'], default: 'medium', description: 'Minimum confidence to include. low explicitly includes public/framework/dynamic review candidates'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 30}}}, run: (g, a, ctx) => th.tFindDeadCode(g, a, ctx)},
-        {cap: 'health', name: 'run_audit', description: 'Core production-first repository Health review with an explicit capability/completeness matrix for structure, dependencies, bounded runtime-correctness/concurrency patterns, advisories, malware and coverage. Unsupported Maven/Gradle import verification is NOT_SUPPORTED/PARTIAL, never a clean zero. Findings whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded are suppressed by default; opt them in with include_classified. category=dependencies is a dedicated dependency-health projection across missing, unused and duplicate declarations while preserving each finding\'s native category. With base_ref, builds and audits an immutable Git checkout and compares stable deterministic finding IDs; debt defaults to genuinely new findings. Supply-chain checks remain explicitly uncomparable across the source-only baseline. changed_files without base_ref is only changed-scope, never a new-debt claim.', inputSchema: {type: 'object', properties: {category: {type: 'string', enum: ['dependencies', 'unused', 'structure', 'vulnerability', 'malware'], description: 'Only findings of this category; dependencies selects dependency manifest/import findings across native categories'}, min_severity: {type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'], description: 'Minimum severity to include'}, max_findings: {type: 'integer', description: 'Max findings to list, default 30'}, include_classified: {type: 'boolean', default: false, description: 'Include findings whose evidence is entirely tests/e2e/generated/mocks/stories/docs/benchmarks/temp or explicitly excluded'}, include_malware_scan: {type: 'boolean', description: 'Also grep installed packages for malware heuristics (slow)', default: false}, base_ref: {type: 'string', maxLength: 200, description: 'Optional immutable Git baseline (for example HEAD~1 or origin/main). Enables honest new/existing/fixed debt comparison'}, changed_files: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 500, description: 'Optional explicit repo-relative scope. Without base_ref this is changed-scope only; when omitted with base_ref, files are derived from the Git diff'}, debt: {type: 'string', enum: ['new', 'existing', 'all'], default: 'new', description: 'Baseline comparison view. Defaults to genuinely new deterministic findings when base_ref is present'}}}, run: (g, a, ctx) => th.tRunAudit(g, a, ctx)},
+          {cap: 'source', refreshGraph: true, name: 'context_bundle', description: 'Return one compact, bounded source bundle for an exact symbol: definition, production-first inbound/outbound containers, exact re-export sites, on-demand TS/JS reference evidence and diverse excerpts around call sites. Use before an edit when query_graph would be too broad.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_related: {type: 'integer', minimum: 1, maximum: 30, default: 10}, max_reexports: {type: 'integer', minimum: 1, maximum: 100, default: 20}, max_source_files: {type: 'integer', minimum: 1, maximum: 8, default: 4}, context_lines: {type: 'integer', minimum: 0, maximum: 12, default: 4}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/vendored/mock/story/docs/benchmark/temp callers after production callers'}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => tb.tContextBundle(g, a, ctx, ts.tInspectSymbol)},
+        {cap: 'health', name: 'find_duplicates', description: "Content-based clone detection over production code (MOSS winnowing over method bodies). Supports high-confidence small clones down to 12 tokens when min_tokens is lowered. Tests, classified non-product paths, all-router framework boilerplate and immutable declarative catalogs are excluded by default; opt them in explicitly.", inputSchema: {type: 'object', properties: {min_similarity: {type: 'integer', description: '50-100, default 80 (ignored in semantic mode)'}, min_tokens: {type: 'integer', minimum: 12, maximum: 400, description: 'min fragment size, 12-400; default 50'}, mode: {type: 'string', enum: ['renamed', 'strict', 'semantic'], default: 'renamed'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/vendored/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, include_boilerplate: {type: 'boolean', default: false, description: 'Include clone groups made entirely of conventional *.router.js/ts router symbols'}, include_declarative: {type: 'boolean', default: false, description: 'Include repeated immutable array/object catalogs that contain no executable control flow'}, include_strings: {type: 'boolean', description: 'Also clone-check large multi-line string literals', default: false}, top_n: {type: 'integer', default: 15}}}, run: (g, a, ctx) => th.tFindDuplicates(g, a, ctx)},
+        {cap: 'health', name: 'find_dead_code', description: 'Conservative review queue for statically unreferenced files, functions, methods and symbols. Returns confidence, reason, bounded evidence and explicit framework/dynamic/reflection/public-API caveats; never an auto-delete verdict. Tests, generated/vendored code, mocks, stories, docs, benchmarks and temporary roots are excluded by default.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repo-relative path prefix'}, kinds: {type: 'array', items: {type: 'string', enum: ['file', 'function', 'method', 'symbol']}, maxItems: 4, uniqueItems: true, description: 'Optional candidate kinds; defaults to all'}, min_confidence: {type: 'string', enum: ['high', 'medium', 'low'], default: 'medium', description: 'Minimum confidence to include. low explicitly includes public/framework/dynamic review candidates'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/vendored/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 30}}}, run: (g, a, ctx) => th.tFindDeadCode(g, a, ctx)},
+        {cap: 'health', name: 'run_audit', description: 'Core production-first repository Health review with an explicit capability/completeness matrix for structure, dependencies, bounded runtime-correctness/concurrency patterns, advisories, malware and coverage. Unsupported Maven/Gradle import verification is NOT_SUPPORTED/PARTIAL, never a clean zero. Findings whose evidence is entirely test/e2e/generated/vendored/mock/story/docs/benchmark/temp or explicitly excluded are suppressed by default; opt them in with include_classified. category=dependencies is a dedicated dependency-health projection across missing, unused and duplicate declarations while preserving each finding\'s native category. With base_ref, builds and audits an immutable Git checkout and compares stable deterministic finding IDs; debt defaults to genuinely new findings. Supply-chain checks remain explicitly uncomparable across the source-only baseline. changed_files without base_ref is only changed-scope, never a new-debt claim.', inputSchema: {type: 'object', properties: {category: {type: 'string', enum: ['dependencies', 'unused', 'structure', 'vulnerability', 'malware'], description: 'Only findings of this category; dependencies selects dependency manifest/import findings across native categories'}, min_severity: {type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'], description: 'Minimum severity to include'}, max_findings: {type: 'integer', description: 'Max findings to list, default 30'}, include_classified: {type: 'boolean', default: false, description: 'Include findings whose evidence is entirely tests/e2e/generated/vendored/mocks/stories/docs/benchmarks/temp or explicitly excluded'}, include_malware_scan: {type: 'boolean', description: 'Also grep installed packages for malware heuristics (slow)', default: false}, base_ref: {type: 'string', maxLength: 200, description: 'Optional immutable Git baseline (for example HEAD~1 or origin/main). Enables honest new/existing/fixed debt comparison'}, changed_files: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 500, description: 'Optional explicit repo-relative scope. Without base_ref this is changed-scope only; when omitted with base_ref, files are derived from the Git diff'}, debt: {type: 'string', enum: ['new', 'existing', 'all'], default: 'new', description: 'Baseline comparison view. Defaults to genuinely new deterministic findings when base_ref is present'}}}, run: (g, a, ctx) => th.tRunAudit(g, a, ctx)},
         {cap: 'health', name: 'coverage_map', description: 'Map a real existing coverage report onto the graph. If no report exists, return clearly labelled static test reachability (a test imports/reaches a source file) with actualCoverage=NOT_AVAILABLE; reachability is never presented as measured coverage.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max risk hotspots to list, default 15'}, path: {type: 'string', description: 'Optional repo-relative path prefix filter, e.g. src/query'}}}, run: (g, a, ctx) => th.tCoverageMap(g, a, ctx)},
-        {cap: 'health', name: 'hot_path_review', description: 'Rank a focused production-symbol hot-path queue from parser-derived local complexity, inside-loop allocations/copies/scans/sorts/recursion, graph fan-in/fan-out, and measured coverage or clearly labelled static test reachability. The default score gate is 85 with a narrow strong-local fallback; set min_score=0 for the full diagnostic queue. This is not profiler data or interprocedural Big-O.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repository-relative path prefix'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 20}, min_score: {type: 'integer', minimum: 0, maximum: 100, default: 85, description: 'Focused default is 85; lower explicitly to broaden, or use 0 for every threshold-matching diagnostic candidate'}, cyclomatic_threshold: {type: 'integer', minimum: 2, maximum: 1000, default: 8}, call_threshold: {type: 'integer', minimum: 1, maximum: 10000, default: 12}, loop_depth_threshold: {type: 'integer', minimum: 1, maximum: 10, default: 2}, time_rank_threshold: {type: 'integer', minimum: 0, maximum: 5, default: 2}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and explicitly excluded paths; tests still require include_tests'}}}, run: (g, a, ctx) => th.tHotPathReview(g, a, ctx)},
+        {cap: 'health', name: 'hot_path_review', description: 'Rank a focused production-symbol hot-path queue from parser-derived local complexity, inside-loop allocations/copies/scans/sorts/recursion, graph fan-in/fan-out, and measured coverage or clearly labelled static test reachability. The default score gate is 85 with a narrow strong-local fallback; set min_score=0 for the full diagnostic queue. This is not profiler data or interprocedural Big-O.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repository-relative path prefix'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 20}, min_score: {type: 'integer', minimum: 0, maximum: 100, default: 85, description: 'Focused default is 85; lower explicitly to broaden, or use 0 for every threshold-matching diagnostic candidate'}, cyclomatic_threshold: {type: 'integer', minimum: 2, maximum: 1000, default: 8}, call_threshold: {type: 'integer', minimum: 1, maximum: 10000, default: 12}, loop_depth_threshold: {type: 'integer', minimum: 1, maximum: 10, default: 2}, time_rank_threshold: {type: 'integer', minimum: 0, maximum: 5, default: 2}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/vendored/mock/story/docs/benchmark/temp and explicitly excluded paths; tests still require include_tests'}}}, run: (g, a, ctx) => th.tHotPathReview(g, a, ctx)},
         {cap: 'graph', name: 'list_communities', description: 'List graph communities named by their dominant folder (largest first) with sample files — a readable module overview; feed the list position into get_community.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max communities to list, default 20'}}}, run: (g, a, ctx) => th.tListCommunities(g, a, ctx)},
         {cap: 'graph', name: 'module_map', description: 'First orientation view for understanding an unfamiliar application with little context: a production-first folder architecture map with file/symbol counts and strongest module dependencies, separating runtime, TypeScript type-only and language compile-only coupling.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max modules to list, default 25'}, include_non_product: {type: 'boolean', default: false, description: 'Include tests, fixtures, benchmarks, generated output, docs and other classified non-product files; false by default'}}}, run: (g, a, ctx) => th.tModuleMap(g, a, ctx)},
         {cap: 'source', refreshGraph: true, name: 'list_endpoints', description: 'Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web/Spring MVC and WebFlux): declared and reachable composed paths, static mount provenance, confidence, handler, file:line, and Spring conditional/default-active state.', inputSchema: {type: 'object', properties: {method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, path: {type: 'string', maxLength: 2048, description: 'Optional exact composed path or segment-aligned suffix'}, max_results: {type: 'integer', description: 'Max endpoints to list, default 100'}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp and explicitly excluded targets'}}}, run: (g, a, ctx) => th.tListEndpoints(g, a, ctx)},

package/src/mcp/evidence-snapshot.duplicates.mjs

@@ -8,7 +8,7 @@ import {compareDuplicateMember} from './evidence/duplicate-member-order.mjs'
 const CLONE_MIN_SIMILARITY = 80
 const DIVERGENCE_MAX_SIMILARITY = 45
 const MIN_TOKENS = 50
-const FILTERED_CLASSES = new Set(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const FILTERED_CLASSES = new Set(['test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const SAFE_SYMBOL = /^[A-Za-z_$][A-Za-z0-9_$]*$/
 
 const DUPLICATE_EVIDENCE_THRESHOLDS = Object.freeze({

package/src/mcp/graph/tools-query.mjs

@@ -4,7 +4,7 @@ import {
 } from '../graph-context.mjs'
 import {createPathClassifier, hasPathClass} from '../../path-classification.js'
 
-const QUERY_NON_PRODUCT = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const QUERY_NON_PRODUCT = Object.freeze(['test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const LOW_SIGNAL_SYMBOL_RE = /^(?:const(?:ant)?|variable|property|field|enum_member)$/i
 const AMBIGUOUS_FILE_BASENAME_RE = /^(mod|lib|main)\.rs$|^index\.[a-z0-9]+$|^__init__\.py$/
 const querySourceFile = (node) => String(node?.source_file || String(node?.id || '').split('#', 1)[0]).replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase()

package/src/mcp/health/audit-format.mjs

@@ -3,7 +3,7 @@ import {runGit} from '../../git-exec.js'
 import {createPathClassifier, hasPathClass} from '../../path-classification.js'
 
 const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
-const AUDIT_NON_PRODUCT_CLASSES = ['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
+const AUDIT_NON_PRODUCT_CLASSES = ['test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp']
 
 export function formatAuditFinding(f) {
     const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''}${f.manifest ? `; ${f.manifest}` : ''})` : ''
@@ -168,7 +168,7 @@ export const formatOrdinaryAudit = (audit, args, findings = audit.findings, head
         ...auditCapabilityLines(audit),
         ...auditExtensionLines(audit),
         `Scoped severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Scoped categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
-        pathScope.suppressed ? `Path policy: production-first; suppressed ${pathScope.suppressed} finding(s) whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded. Pass include_classified:true to include them.` : 'Path policy: production-first; no classified-only findings were suppressed.',
+        pathScope.suppressed ? `Path policy: production-first; suppressed ${pathScope.suppressed} finding(s) whose evidence is entirely test/e2e/generated/vendored/mock/story/docs/benchmark/temp or explicitly excluded. Pass include_classified:true to include them.` : 'Path policy: production-first; no classified-only findings were suppressed.',
         `Repository-level ${auditChecksLine(audit)}`,
         '',
         `Showing ${shown.length} of ${filtered.length} finding(s)${args.category ? ` in category "${args.category}"` : ''}${args.min_severity ? ` at ≥${args.min_severity}` : ''}:`,

package/src/mcp/health/audit.mjs

@@ -11,6 +11,7 @@ import {buildInternalGraph} from '../../graph/internal-builder.js'
 import {resolveGitCommit, withGitRefCheckout} from '../../analysis/git-ref-graph.js'
 import {filterGraphForMode} from '../../graph/graph-filter.js'
 import {toolResult} from '../tool-result.mjs'
+import {summarizeFindings} from '../../analysis/findings.js'
 const auditFormatVersion = new URL(import.meta.url).search
 const {
   auditFilter,
@@ -147,16 +148,22 @@ async function runAuditWithBaseline(args, ctx, currentGraph) {
 // unused deps), structure (import cycles / orphans / boundary rules), supply-chain (offline OSV
 // advisories, typosquat, lockfile drift), optional malware heuristics.
 export async function tRunAudit(g, args, ctx) {
-    if (!ctx.repoRoot) return 'Audit needs the repo root (not provided to this server).'
+    if (!ctx.repoRoot) return toolResult('Audit needs the repo root (not provided to this server).', {
+        status: 'INVALID', findings: [], reason: 'repo root unavailable',
+    }, {completeness: {status: 'PARTIAL', reason: 'repo root unavailable'}})
     if (args.base_ref) return runAuditWithBaseline(args, ctx, rawGraph(ctx))
     const graph = effectiveRawGraph(ctx)
     const audit = await runAudit(ctx.repoRoot, graph, args, ctx, {
         skipMalwareScan: !args.include_malware_scan, // greps installed packages — slow, so opt-in
     })
-    if (!audit.ok) return `Audit failed: ${audit.error}`
+    if (!audit.ok) return toolResult(`Audit failed: ${audit.error}`, {
+        status: 'ERROR', findings: [], reason: audit.error,
+    }, {completeness: {status: 'PARTIAL', reason: audit.error}})
     if (Array.isArray(args.changed_files)) {
         const normalized = normalizeAuditScopeFiles(args.changed_files)
-        if (!normalized.ok) return `Changed-scope audit invalid: ${normalized.error}.`
+        if (!normalized.ok) return toolResult(`Changed-scope audit invalid: ${normalized.error}.`, {
+            status: 'INVALID', mode: 'changed-scope', findings: [], reason: normalized.error,
+        }, {completeness: {status: 'PARTIAL', reason: normalized.error}})
         const scoped = scopeAuditFindings(audit.findings, normalized.files)
         const text = formatOrdinaryAudit(audit, args, scoped,
             `CHANGED-SCOPE ONLY — ${normalized.files.length} explicitly supplied file(s); no baseline was provided, so these findings are not classified as new, existing, or fixed.`, ctx.repoRoot)
@@ -168,7 +175,25 @@ export async function tRunAudit(g, args, ctx) {
             findings: auditFilter(audit, args, scoped, ctx.repoRoot),
         }, {completeness: {status: 'COMPLETE'}})
     }
-    return formatOrdinaryAudit(audit, args, audit.findings, null, ctx.repoRoot)
+    const filtered = auditFilter(audit, args, audit.findings, ctx.repoRoot)
+    const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
+    const shown = filtered.slice(0, max)
+    return toolResult(formatOrdinaryAudit(audit, args, audit.findings, null, ctx.repoRoot), {
+        status: 'COMPLETE',
+        mode: 'ordinary',
+        repo: audit.repo,
+        scanned: audit.scanned,
+        summary: summarizeFindings(filtered),
+        findings: shown,
+        healthCapabilities: audit.healthCapabilities,
+        extensionCapabilities: audit.extensionCapabilities || [],
+        dependencyReport: audit.dependencyReport,
+        conventionReachability: audit.conventionReachability,
+        checks: audit.checks,
+    }, {
+        page: {shown: shown.length, total: filtered.length, capped: shown.length < filtered.length},
+        completeness: {status: 'COMPLETE'},
+    })
 }
 
 // Named module clusters: graph communities labeled by their dominant folder instead of bare numbers.

package/src/mcp/health/duplicates.mjs

@@ -1,7 +1,8 @@
 import {computeDuplicates} from '../../analysis/duplicates.js'
 import {analyzeDuplicateGroups} from '../../analysis/duplicate-groups.js'
+import {toolResult} from '../tool-result.mjs'
 
-const NON_PRODUCT_DUPLICATE_CLASSES = new Set(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const NON_PRODUCT_DUPLICATE_CLASSES = new Set(['generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const fragmentEligible = (fragment, {tokMin, skipTests, includeClassified}) => {
     if (fragment.n < tokMin) return false
     const classes = new Set(fragment.classes || [])
@@ -11,7 +12,9 @@ const fragmentEligible = (fragment, {tokMin, skipTests, includeClassified}) => {
 }
 
 export function tFindDuplicates(g, args, ctx) {
-    if (!ctx.repoRoot) return 'Duplicate scan needs the repo root (not provided to this server).'
+    if (!ctx.repoRoot) return toolResult('Duplicate scan needs the repo root (not provided to this server).', {
+        status: 'INVALID', groups: [], reason: 'repo root unavailable',
+    }, {completeness: {status: 'PARTIAL', reason: 'repo root unavailable'}})
     const simMin = Math.min(100, Math.max(50, Number(args.min_similarity) || 80))
     const tokMin = Math.min(400, Math.max(12, Number(args.min_tokens) || 50))
     const mode = args.mode === 'strict' ? 'strict' : 'renamed'
@@ -40,7 +43,11 @@ export function tFindDuplicates(g, args, ctx) {
                 ? b.pair.similarity - a.pair.similarity || b.tokens - a.tokens
                 : b.tokens - a.tokens || a.pair.similarity - b.pair.similarity
         })
-        if (!candidates.length) return 'No actionable same-name pairs across files (semantic mode; ambiguous middle-similarity pairs are suppressed).'
+        if (!candidates.length) return toolResult(
+            'No actionable same-name pairs across files (semantic mode; ambiguous middle-similarity pairs are suppressed).',
+            {status: 'COMPLETE', mode: 'semantic', total: 0, groups: [], thresholds: {minTokens: tokMin}},
+            {page: {shown: 0, total: 0, capped: false}, completeness: {status: 'COMPLETE'}},
+        )
         const top = candidates.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
         const lines = top.map((item, k) => {
             const a = frags[item.pair.a]
@@ -54,14 +61,23 @@ export function tFindDuplicates(g, args, ctx) {
                 `     ${b.file}:${b.start}-${b.end}  (${b.n} tok)`,
             ].join('\n')
         })
-        return `Found ${candidates.length} actionable same-name pair(s) across files (semantic mode; one closest clone and/or farthest collision per name). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nThese are review candidates, not automatic refactors. Use read_source on both sites before changing code.`
+        const text = `Found ${candidates.length} actionable same-name pair(s) across files (semantic mode; one closest clone and/or farthest collision per name). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nThese are review candidates, not automatic refactors. Use read_source on both sites before changing code.`
+        return toolResult(text, {
+            status: 'COMPLETE', mode: 'semantic', total: candidates.length, thresholds: {minTokens: tokMin},
+            groups: top.map((item) => ({
+                kind: item.kind, label: item.label, similarity: item.pair.similarity,
+                members: [frags[item.pair.a], frags[item.pair.b]].map((fragment) => ({
+                    file: fragment.file, start: fragment.start, end: fragment.end, tokens: fragment.n, label: fragment.label,
+                })),
+            })),
+        }, {page: {shown: top.length, total: candidates.length, capped: top.length < candidates.length}, completeness: {status: 'COMPLETE'}})
     }
     const analysis = analyzeDuplicateGroups(ctx.repoRoot, ctx.graphPath, args)
     const groups = analysis.groups
     const smallPolicy = tokMin < 30 ? ' Small fragments below 30 tokens require at least 95% similarity and two shared bounded fingerprints.' : ''
     const suppressed = analysis.suppressed
     const suppressionNote = suppressed && !includeClassified
-        ? ` ${suppressed} fragment(s) classified as tests/e2e/generated/mock/story/docs/benchmark/temp or matched by .weavatrix.json exclude were suppressed; pass include_classified:true (and include_tests:true for tests) to inspect them explicitly.`
+        ? ` ${suppressed} fragment(s) classified as tests/e2e/generated/vendored/mock/story/docs/benchmark/temp or matched by .weavatrix.json exclude were suppressed; pass include_classified:true (and include_tests:true for tests) to inspect them explicitly.`
         : ''
     const boilerplateNote = analysis.boilerplateSuppressed
         ? ` ${analysis.boilerplateSuppressed} all-router framework boilerplate group(s) were suppressed; pass include_boilerplate:true to inspect them.`
@@ -69,7 +85,14 @@ export function tFindDuplicates(g, args, ctx) {
     const declarativeNote = analysis.declarativeSuppressed
         ? ` ${analysis.declarativeSuppressed} immutable declarative catalog group(s) were suppressed; pass include_declarative:true to inspect repeated data shapes.`
         : ''
-    if (!groups.length) return `No clones at ≥${simMin}% similarity / ≥${tokMin} tokens (${mode} mode). Try lowering the thresholds.${smallPolicy}${suppressionNote}${boilerplateNote}${declarativeNote}`
+    if (!groups.length) return toolResult(
+        `No clones at ≥${simMin}% similarity / ≥${tokMin} tokens (${mode} mode). Try lowering the thresholds.${smallPolicy}${suppressionNote}${boilerplateNote}${declarativeNote}`,
+        {
+            status: 'COMPLETE', mode, total: 0, groups: [], thresholds: {minSimilarity: simMin, minTokens: tokMin},
+            suppressed: {classifiedFragments: suppressed, boilerplateGroups: analysis.boilerplateSuppressed, declarativeGroups: analysis.declarativeSuppressed},
+        },
+        {page: {shown: 0, total: 0, capped: false}, completeness: {status: 'COMPLETE'}},
+    )
     const top = groups.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
     const lines = top.map((grp, k) => {
         const isStr = grp.members.some((f) => f.kind === 'string')
@@ -77,7 +100,20 @@ export function tFindDuplicates(g, args, ctx) {
         const sites = grp.members.slice(0, 8).map((f) => `     ${f.file}:${f.start}-${f.end}`)
         return [head, ...sites].join('\n')
     })
-    return `Found ${groups.length} clone group(s) (${mode} mode, ≥${simMin}%, ≥${tokMin} tok${includeStrings ? ', incl. large string literals' : ''}). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nUse read_source on any two sites to compare, then extract shared logic.${smallPolicy}${suppressionNote}${boilerplateNote}${declarativeNote}`
+    const text = `Found ${groups.length} clone group(s) (${mode} mode, ≥${simMin}%, ≥${tokMin} tok${includeStrings ? ', incl. large string literals' : ''}). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nUse read_source on any two sites to compare, then extract shared logic.${smallPolicy}${suppressionNote}${boilerplateNote}${declarativeNote}`
+    return toolResult(text, {
+        status: 'COMPLETE', mode, total: groups.length, thresholds: {minSimilarity: simMin, minTokens: tokMin},
+        includeStrings,
+        suppressed: {classifiedFragments: suppressed, boilerplateGroups: analysis.boilerplateSuppressed, declarativeGroups: analysis.declarativeSuppressed},
+        groups: top.map((group) => ({
+            similarity: group.maxSim, duplicatedTokens: group.tokens,
+            members: group.members.slice(0, 8).map((fragment) => ({
+                file: fragment.file, start: fragment.start, end: fragment.end, tokens: fragment.n,
+                label: fragment.label, kind: fragment.kind || 'symbol', classes: fragment.classes || [],
+            })),
+            memberCount: group.members.length,
+        })),
+    }, {page: {shown: top.length, total: groups.length, capped: top.length < groups.length}, completeness: {status: 'COMPLETE'}})
 }
 
 // Focused dead-code review queue. Unlike the broad run_audit surface, this includes functions and

package/src/mcp/health/endpoints.mjs

@@ -35,7 +35,7 @@ export function tListEndpoints(g, args, ctx) {
     const suppressed = includeClassified ? 0 : classified.length
     eps = includeClassified ? [...production, ...classified] : production
     const suppressionNote = suppressed
-        ? `${suppressed} endpoint(s) in classified test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded paths were suppressed; pass include_classified:true to inspect them.`
+        ? `${suppressed} endpoint(s) in classified test/e2e/generated/vendored/mock/story/docs/benchmark/temp or explicitly excluded paths were suppressed; pass include_classified:true to inspect them.`
         : ''
     if (!eps.length) return suppressed
         ? `No production HTTP endpoints detected; ${suppressionNote}`

package/src/mcp/health/structure.mjs

@@ -31,7 +31,7 @@ export function tModuleMap(g, args, ctx) {
             if (classifiedFiles.has(sourceFile)) continue
             classifiedFiles.add(sourceFile)
             const explanation = classifier.explain(sourceFile)
-            if (explanation.excluded || hasPathClass(explanation, 'test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp')) {
+            if (explanation.excluded || hasPathClass(explanation, 'test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp')) {
                 nonProductFiles.add(sourceFile)
             }
         }
@@ -173,7 +173,9 @@ export function tCoverageMap(g, args, ctx) {
             '  JS/TS:  npx vitest run --coverage   (or jest --coverage)',
             '  Python: pytest --cov --cov-report=json',
             '  Go:     go test ./... -coverprofile=coverage.out',
-            'Read locations: coverage/coverage-summary.json, coverage/coverage-final.json, (coverage/)lcov.info, coverage.json, coverage.out.',
+            '  Rust:   cargo tarpaulin --out Json --output-dir .',
+            '          or cargo llvm-cov --lcov --output-path lcov.info',
+            'Read locations: coverage/coverage-summary.json, coverage/coverage-final.json, (coverage/)lcov.info, coverage.json, tarpaulin-report.json, coverage.out.',
         ].filter((line) => line != null).join('\n')
     }
     const pctStr = (v) => (v == null ? 'n/a' : `${Math.round(v * 100)}%`)
@@ -216,4 +218,3 @@ export function tCoverageMap(g, args, ctx) {
 }
 
 // HTTP endpoint inventory: Express/Fastify/Nest/Flask/FastAPI/Go/Rust/Spring route definitions.
-

package/src/mcp/tools-context.mjs

@@ -6,7 +6,7 @@ import {sourceExcerpt} from './tools-source.mjs'
 import {createPathClassifier, hasPathClass} from '../path-classification.js'
 
 const MAX_LINE_SAMPLES = 5
-const CONTEXT_NON_PRODUCT = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const CONTEXT_NON_PRODUCT = Object.freeze(['test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 
 const fileOf = (g, id) => {
     const node = g.byId.get(String(id))

package/src/mcp/tools-endpoints.mjs

@@ -4,7 +4,7 @@ import {createPathClassifier, hasPathClass} from '../path-classification.js'
 import {sourceExcerpt} from './tools-source.mjs'
 import {toolResult} from './tool-result.mjs'
 
-const NON_PRODUCT = ['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
+const NON_PRODUCT = ['test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp']
 
 const symbolLine = (node) => Number(String(node?.source_location || '').match(/L(\d+)/)?.[1]
     || String(node?.id || '').match(/@(\d+)$/)?.[1] || 0)

package/src/mcp/tools-graph-hubs.mjs

@@ -3,7 +3,7 @@ import {connList} from './graph-context.mjs'
 import {createPathClassifier, hasPathClass} from '../path-classification.js'
 
 const isCompileTimeEdge = (edge) => edge?.typeOnly === true || edge?.compileOnly === true
-const NON_PRODUCT_CLASSES = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const NON_PRODUCT_CLASSES = Object.freeze(['test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const sourceFileOf = (node) => String(node?.source_file || (node?.file_type === 'code' ? node?.id : '') || '').replace(/\\/g, '/')
 
 export function tGodNodes(g, {top_n = 10, include_classified = false} = {}, ctx = {}) {

package/src/path-classification.js

@@ -4,11 +4,12 @@
 import { openSync, closeSync, readSync, readFileSync, statSync } from "node:fs";
 import { createRepoBoundary } from "./repo-path.js";
 
-export const PATH_CLASS_NAMES = Object.freeze(["test", "e2e", "generated", "mock", "story", "docs", "benchmark", "temp"]);
+export const PATH_CLASS_NAMES = Object.freeze(["test", "e2e", "generated", "vendored", "mock", "story", "docs", "benchmark", "temp"]);
 export const PATH_CLASS_QUERY_TERMS = Object.freeze({
   test: Object.freeze(["test", "tests", "testing", "unit"]),
   e2e: Object.freeze(["e2e", "playwright", "cypress"]),
   generated: Object.freeze(["generated", "autogenerated", "dist"]),
+  vendored: Object.freeze(["vendor", "vendored", "third-party", "third_party"]),
   mock: Object.freeze(["mock", "mocks", "fixture", "fixtures", "fake"]),
   story: Object.freeze(["story", "stories", "storybook"]),
   docs: Object.freeze(["doc", "docs", "documentation", "readme", "guide"]),
@@ -72,6 +73,11 @@ const DEFAULT_RULES = [
     pattern: "conventional build output path",
     regex: /(^|\/)(?:dist|build|out|coverage|\.next)(\/|$)/i,
   },
+  {
+    category: "vendored",
+    pattern: "vendored or third-party source root",
+    regex: /(^|\/)(?:vendor|vendored|third[-_]?party)(\/|$)/i,
+  },
   {
     category: "mock",
     pattern: "mock/fixture path or mockData filename",