weavatrix 0.3.14 → 1.1.0

package/src/mcp/health/audit-format.mjs

@@ -1,199 +0,0 @@
-import {summarizeFindings} from '../../analysis/findings.js'
-import {runGit} from '../../git-exec.js'
-import {createPathClassifier, hasPathClass} from '../../path-classification.js'
-
-const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
-const AUDIT_NON_PRODUCT_CLASSES = ['test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp']
-
-export function formatAuditFinding(f) {
-    const where = f.file ? `  (${f.file}${f.symbol ? ` ${f.symbol}` : ''})` : f.package ? `  (pkg ${f.package}${f.version ? `@${f.version}` : ''}${f.manifest ? `; ${f.manifest}` : ''})` : ''
-    const verification = f.verification?.evidenceModel
-        ? `\n      verification: ${f.verification.evidenceModel}; manifest ${f.verification.manifestDeclaration?.status || 'N/A'}; indexed imports ${f.verification.indexedSourceImports?.status || 'N/A'}; decision ${f.verification.decision || 'REVIEW_REQUIRED'}`
-        : ''
-    return `  [${f.severity}/${f.confidence || '?'}] ${f.rule}: ${f.title}${where}${f.reason ? `\n      reason: ${f.reason}` : ''}${verification}${f.cycleRoute ? `\n      route: ${f.cycleRoute}` : ''}${f.fixHint ? `\n      fix: ${f.fixHint}` : ''}`
-}
-
-const auditFindingPaths = (finding) => {
-    const paths = []
-    if (finding?.file) paths.push(String(finding.file))
-    if (Array.isArray(finding?.files)) paths.push(...finding.files.map(String))
-    if (finding?.cycleRoute) paths.push(...String(finding.cycleRoute).split(/\s*(?:→|→|->)\s*/))
-    return [...new Set(paths.map((file) => file.replace(/\\/g, '/').trim()).filter(Boolean))]
-}
-
-export function auditFindingPathScope(findings, {includeClassified = false, repoRoot = null} = {}) {
-    const all = Array.isArray(findings) ? findings : []
-    if (includeClassified) return {findings: all, suppressed: 0}
-    const classifier = createPathClassifier(repoRoot)
-    const cache = new Map()
-    const classified = (file) => {
-        if (!cache.has(file)) cache.set(file, classifier.explain(file, {content: ''}))
-        const info = cache.get(file)
-        return info?.excluded || AUDIT_NON_PRODUCT_CLASSES.some((name) => hasPathClass(info, name))
-    }
-    const kept = all.filter((finding) => {
-        const paths = auditFindingPaths(finding)
-        return !paths.length || paths.some((file) => !classified(file))
-    })
-    return {findings: kept, suppressed: all.length - kept.length}
-}
-
-const DEPENDENCY_AUDIT_RULES = new Set(['unused-dep', 'missing-dep', 'duplicate-dep', 'unresolved-import', 'lockfile-drift'])
-export const isDependencyAuditFinding = (finding) => DEPENDENCY_AUDIT_RULES.has(String(finding?.rule || ''))
-
-export const auditFilter = (audit, args, findings = audit.findings, repoRoot = null) => {
-    const minSev = SEVERITY_RANK[args.min_severity] ?? 4
-    const category = args.category ? String(args.category) : null
-    return auditFindingPathScope(findings, {includeClassified: args.include_classified === true, repoRoot}).findings
-        .filter((finding) => (SEVERITY_RANK[finding.severity] ?? 4) <= minSev)
-        .filter((finding) => !category || (category === 'dependencies' ? isDependencyAuditFinding(finding) : finding.category === category))
-}
-
-const auditChecksLine = (audit) => {
-    const check = (name, state) => `${name} ${state?.status || 'ERROR'}${state?.detail ? ` — ${state.detail}` : ''}`
-    return `Checks: ${check('OSV', audit.checks?.osv)}; ${check('RustSec report', audit.checks?.rustsec)}; ${check('malware', audit.checks?.malware)}. A NOT_CHECKED/PARTIAL/ERROR check is incomplete or unknown, never a clean zero.`
-}
-
-const auditCapabilityLines = (audit) => {
-    const matrix = audit.healthCapabilities || {}
-    const rows = [
-        ['structure', 'structure'],
-        ['dependencies', 'dependencies'],
-        ['runtimeCorrectness', 'runtime correctness'],
-        ['concurrency', 'concurrency'],
-        ['advisories', 'advisories'],
-        ['malware', 'malware'],
-        ['coverage', 'coverage'],
-    ]
-    const lines = ['Health capability matrix (status/completeness):']
-    for (const [key, label] of rows) {
-        const item = matrix[key]
-        lines.push(`  ${label}: ${item?.status || 'NOT_CHECKED'}/${item?.completeness || 'PARTIAL'} — ${item?.detail || 'Capability evidence was not reported.'}`)
-    }
-    return lines
-}
-
-const auditExtensionLines = (audit) => {
-    const items = audit.extensionCapabilities || []
-    if (!items.length) return []
-    return [
-        'Extension analyzer matrix (status/completeness):',
-        ...items.map((item) => `  ${item.extension ? `${item.extension}/` : ''}${item.id}: ${item.status}/${item.completeness} — ${item.detail} (${item.findingCount} finding(s)).`),
-    ]
-}
-
-const auditDependencyCoverageLines = (deps) => {
-    const ecosystems = Object.values(deps.ecosystems || {}).filter((item) => item?.present)
-    const verification = Object.entries(deps.verificationCoverage || {})
-    return [
-        ecosystems.length
-            ? `Dependency ecosystems: ${ecosystems.map((item) => `${item.ecosystem} ${item.status}/${item.completeness} (${item.manifests?.length || 0} manifest(s), ${item.declared || 0} declaration(s))`).join('; ')}.`
-            : 'Dependency ecosystems: no supported or unsupported dependency manifest was discovered.',
-        verification.length
-            ? `Dependency verification coverage: ${verification.map(([ecosystem, state]) => `${ecosystem} ${state}`).join('; ')}. Per-finding evidence: ${deps.perFindingVerification ? 'AVAILABLE' : 'UNAVAILABLE'}.`
-            : 'Dependency verification coverage: NOT_CHECKED; no manifest evidence was available.',
-    ]
-}
-
-const scopedDependencyFindingCounts = (allFindings, scopedFindings) => {
-    const dependencyFindings = (items) => (items || []).filter(isDependencyAuditFinding)
-    const all = dependencyFindings(allFindings)
-    const scoped = dependencyFindings(scopedFindings)
-    const count = (rule) => scoped.filter((finding) => finding.rule === rule).length
-    return {
-        unused: count('unused-dep'),
-        missing: count('missing-dep'),
-        duplicateDeclarations: count('duplicate-dep'),
-        suppressed: Math.max(0, all.length - scoped.length),
-    }
-}
-
-const auditDependencySummaryLine = (audit, deps, scopedCounts = null) => {
-    const ecosystems = Object.values(deps.ecosystems || {}).filter((item) => item?.present)
-    const checked = ecosystems.filter((item) => item.status === 'CHECKED')
-    const unsupported = ecosystems.filter((item) => item.status === 'NOT_SUPPORTED')
-    const unused = scopedCounts?.unused ?? deps.unused ?? 'unknown'
-    const missing = scopedCounts?.missing ?? deps.missing ?? 'unknown'
-    const duplicateDeclarations = scopedCounts?.duplicateDeclarations ?? deps.duplicateDeclarations ?? 'unknown'
-    const scopedSuffix = scopedCounts?.suppressed
-        ? ` Production-first path policy suppressed ${scopedCounts.suppressed} classified dependency finding(s).`
-        : ''
-    if (!ecosystems.length || deps.status === 'NOT_CHECKED') {
-        return 'Dependency manifests: NOT_CHECKED — no dependency manifest was discovered; manifest-to-import verification did not run and no dependency verdict was produced.'
-    }
-    if (!checked.length && unsupported.length) {
-        const manifests = unsupported.reduce((total, item) => total + (item.manifests?.length || 0), 0)
-        const declared = unsupported.reduce((total, item) => total + (item.declared || 0), 0)
-        const names = unsupported.map((item) => item.ecosystem).join(', ')
-        return `Dependency manifests: ${deps.status || 'PARTIAL'} — discovered ${declared} declaration(s) in ${manifests} ${names} manifest(s), but package-to-artifact verification is NOT_SUPPORTED; no unused, missing, or duplicate-declaration verdict was produced for those ecosystems.`
-    }
-    if (checked.length && unsupported.length) {
-        const checkedManifests = checked.reduce((total, item) => total + (item.manifests?.length || 0), 0)
-        const checkedDeclared = checked.reduce((total, item) => total + (item.declared || 0), 0)
-        const unsupportedManifests = unsupported.reduce((total, item) => total + (item.manifests?.length || 0), 0)
-        const unsupportedDeclared = unsupported.reduce((total, item) => total + (item.declared || 0), 0)
-        const checkedNames = checked.map((item) => item.ecosystem).join(', ')
-        const unsupportedNames = unsupported.map((item) => item.ecosystem).join(', ')
-        return `Dependency manifests: ${deps.status || 'PARTIAL'} — checked ${checkedDeclared} declaration(s) across ${checkedManifests} supported manifest(s) (${checkedNames}); inventoried ${unsupportedDeclared} declaration(s) across ${unsupportedManifests} unsupported manifest(s) (${unsupportedNames}), where package-to-artifact verification is NOT_SUPPORTED. Supported-ecosystem findings: unused ${unused}, missing ${missing}, duplicate declarations ${duplicateDeclarations}.${scopedSuffix}`
-    }
-    return `Dependency manifests: ${deps.status || 'UNKNOWN'} — checked ${deps.declared ?? audit.scanned.manifestDeps ?? 0} declared package(s) against ${deps.importRecords ?? audit.scanned.externalImports ?? 0} external import record(s); unused ${unused}, missing ${missing}, duplicate declarations ${duplicateDeclarations}.${scopedSuffix}`
-}
-
-const auditConventionLines = (audit) => {
-    const entries = audit.conventionReachability?.entries || []
-    if (!entries.length) return []
-    return [
-        `Convention reachability: ${audit.conventionReachability.count} framework-managed file(s) are external entry points, not orphan/dead findings${audit.conventionReachability.truncated ? ' (evidence capped)' : ''}:`,
-        ...entries.slice(0, 5).map((entry) => `  [${entry.confidence}] ${entry.file} — ${entry.marker}: ${entry.reason}`),
-        audit.conventionReachability.count > 5 ? `  … +${audit.conventionReachability.count - 5} more in bounded JSON result data` : null,
-    ].filter((line) => line != null)
-}
-
-export const formatOrdinaryAudit = (audit, args, findings = audit.findings, heading = null, repoRoot = null) => {
-    const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
-    const pathScope = auditFindingPathScope(findings, {includeClassified: args.include_classified === true, repoRoot})
-    const filtered = auditFilter(audit, args, pathScope.findings, repoRoot)
-    const shown = filtered.slice(0, max)
-    const summary = summarizeFindings(pathScope.findings)
-    const sev = summary.bySeverity
-    const bycat = summary.byCategory
-    const deps = audit.dependencyReport || {}
-    const dependencyCounts = scopedDependencyFindingCounts(findings, pathScope.findings)
-    return [
-        heading,
-        `Internal audit of ${audit.repo} (${audit.scanned.files} files, ${audit.scanned.symbols} symbols, ${audit.scanned.externalImports} external imports; malware scan: ${audit.scanned.malwareScanMode}).`,
-        ...auditConventionLines(audit),
-        auditDependencySummaryLine(audit, deps, dependencyCounts),
-        ...auditDependencyCoverageLines(deps),
-        ...auditCapabilityLines(audit),
-        ...auditExtensionLines(audit),
-        `Scoped severity: critical ${sev.critical}, high ${sev.high}, medium ${sev.medium}, low ${sev.low}, info ${sev.info}. Scoped categories: unused ${bycat.unused}, structure ${bycat.structure}, vulnerability ${bycat.vulnerability}, malware ${bycat.malware}.`,
-        pathScope.suppressed ? `Path policy: production-first; suppressed ${pathScope.suppressed} finding(s) whose evidence is entirely test/e2e/generated/vendored/mock/story/docs/benchmark/temp or explicitly excluded. Pass include_classified:true to include them.` : 'Path policy: production-first; no classified-only findings were suppressed.',
-        `Repository-level ${auditChecksLine(audit)}`,
-        '',
-        `Showing ${shown.length} of ${filtered.length} finding(s)${args.category ? ` in category "${args.category}"` : ''}${args.min_severity ? ` at ≥${args.min_severity}` : ''}:`,
-        ...shown.map(formatAuditFinding),
-        filtered.length > shown.length ? `  … +${filtered.length - shown.length} more (raise max_findings or filter by category/min_severity)` : null,
-    ].filter((line) => line != null).join('\n')
-}
-
-export const gitUntracked = (repoRoot) => {
-    const result = runGit(repoRoot, ['ls-files', '--others', '--exclude-standard'], {maxBuffer: 2 * 1024 * 1024})
-    if (result.status !== 0) return {
-        ok: false,
-        files: [],
-        error: String(result.stderr || result.error?.message || 'git ls-files failed').trim(),
-    }
-    return {
-        ok: true,
-        files: String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean),
-        error: null,
-    }
-}
-
-export const pathsFromClassification = (classification) => [...new Set(classification.files
-    .flatMap((file) => [file.oldPath, file.newPath])
-    .filter((file) => file && file !== '(diff unavailable)'))]
-    .sort((left, right) => left.localeCompare(right))
-
-export const formatDebtFinding = (finding, state) => `  [${state}] ${formatAuditFinding(finding).trimStart()}`

package/src/mcp/health/audit.mjs

@@ -1,199 +0,0 @@
-import {rawGraph, effectiveRawGraph} from '../graph-context.mjs'
-import {runInternalAudit} from '../../analysis/internal-audit.js'
-import {applyAuditExtensions} from '../../analysis/audit-extensions.js'
-import {classifyChangeImpact} from '../../analysis/change-classification.js'
-import {
-  compareAuditDebt,
-  normalizeAuditScopeFiles,
-  scopeAuditFindings,
-} from '../../analysis/audit-debt.js'
-import {buildInternalGraph} from '../../graph/internal-builder.js'
-import {resolveGitCommit, withGitRefCheckout} from '../../analysis/git-ref-graph.js'
-import {filterGraphForMode} from '../../graph/graph-filter.js'
-import {toolResult} from '../tool-result.mjs'
-import {summarizeFindings} from '../../analysis/findings.js'
-const auditFormatVersion = new URL(import.meta.url).search
-const {
-  auditFilter,
-  formatDebtFinding,
-  formatOrdinaryAudit,
-  gitUntracked,
-  pathsFromClassification,
-} = await import(new URL(`./audit-format.mjs${auditFormatVersion}`, import.meta.url).href)
-
-const runAudit = async (repoRoot, graph, args, ctx, options = {}) => applyAuditExtensions(
-    await runInternalAudit(repoRoot, {graph, ...options}),
-    {providers: ctx.extensions?.auditProviders || [], repoRoot, graph, args},
-)
-
-async function runAuditWithBaseline(args, ctx, currentGraph) {
-    const resolved = resolveGitCommit(ctx.repoRoot, args.base_ref)
-    if (!resolved.ok) return toolResult(`Audit baseline unavailable: ${resolved.error}.`, {
-        status: 'INVALID', comparison: {status: 'UNAVAILABLE', reason: resolved.error}, findings: [],
-    }, {completeness: {status: 'PARTIAL', reason: resolved.error}})
-
-    let currentAudit
-    try {
-        currentAudit = await runAudit(ctx.repoRoot, currentGraph, args, ctx, {skipMalwareScan: !args.include_malware_scan})
-    } catch (error) {
-        const reason = error instanceof Error ? error.message : String(error)
-        return toolResult(`Audit failed while building the current graph: ${reason}`, {
-            status: 'ERROR', comparison: {status: 'UNAVAILABLE', reason}, findings: [],
-        }, {completeness: {status: 'PARTIAL', reason}})
-    }
-    if (!currentAudit.ok) return toolResult(`Audit failed: ${currentAudit.error}`, {
-        status: 'ERROR', comparison: {status: 'UNAVAILABLE', reason: currentAudit.error}, findings: [],
-    }, {completeness: {status: 'PARTIAL', reason: currentAudit.error}})
-
-    const normalized = normalizeAuditScopeFiles(args.changed_files)
-    if (!normalized.ok) return toolResult(`Audit scope invalid: ${normalized.error}.`, {
-        status: 'INVALID', comparison: {status: 'UNAVAILABLE', reason: normalized.error}, findings: [],
-    }, {completeness: {status: 'PARTIAL', reason: normalized.error}})
-    let changedFiles = normalized.files
-    let completeChangeSet = false
-    let scopeSource = 'explicit changed_files'
-    let changeEvidence = null
-    if (changedFiles == null) {
-        completeChangeSet = true
-        const untracked = gitUntracked(ctx.repoRoot)
-        if (!untracked.ok) {
-            return toolResult(`Audit comparison stopped: untracked-file discovery failed (${untracked.error}). Pass changed_files explicitly to establish the scope.`, {
-                status: 'PARTIAL', comparison: {status: 'UNAVAILABLE', reason: untracked.error}, findings: [],
-            }, {completeness: {status: 'PARTIAL', reason: untracked.error}})
-        }
-        changeEvidence = classifyChangeImpact({
-            repoRoot: ctx.repoRoot,
-            graph: currentGraph,
-            base: resolved.commit,
-            files: untracked.files,
-        })
-        if (!changeEvidence.ok || changeEvidence.bounds?.truncated) {
-            const reason = changeEvidence.reasons.join(' ')
-            return toolResult(`Audit comparison stopped: changed-file derivation against ${resolved.ref} was incomplete. ${reason} Pass changed_files explicitly to establish a complete scope.`, {
-                status: 'PARTIAL', comparison: {status: 'UNAVAILABLE', reason}, findings: [], changeEvidence,
-            }, {completeness: {status: 'PARTIAL', reason}})
-        }
-        changedFiles = pathsFromClassification(changeEvidence)
-        if (changedFiles.length > 500) {
-            const reason = `derived changed-file scope contains ${changedFiles.length} files, above the 500-file comparison bound`
-            return toolResult(`Audit comparison stopped: ${reason}. Pass a narrower explicit changed_files scope.`, {
-                status: 'PARTIAL', comparison: {status: 'UNAVAILABLE', reason}, findings: [], changeEvidence,
-            }, {completeness: {status: 'PARTIAL', reason}})
-        }
-        scopeSource = `git diff ${resolved.commit.slice(0, 12)}…working-tree`
-    }
-
-    const baseline = await withGitRefCheckout(ctx.repoRoot, resolved.commit, async (checkout) => {
-        let graph = await buildInternalGraph(checkout)
-        const currentMode = ['full', 'no-tests', 'tests-only'].includes(currentGraph?.graphBuildMode)
-            ? currentGraph.graphBuildMode : 'full'
-        if (currentMode !== 'full') graph = filterGraphForMode(graph, currentMode, {repoRoot: checkout})
-        graph.graphBuildMode = currentMode
-        graph.graphBuildScope = ''
-        return runAudit(checkout, graph, args, ctx, {skipMalwareScan: true})
-    })
-    if (!baseline.ok || !baseline.value?.ok) {
-        const reason = baseline.error || baseline.value?.error || 'baseline audit failed'
-        return toolResult(`Audit baseline unavailable: ${reason}.`, {
-            status: 'ERROR', comparison: {status: 'UNAVAILABLE', reason}, findings: [],
-        }, {completeness: {status: 'PARTIAL', reason}})
-    }
-
-    const comparison = compareAuditDebt(currentAudit, baseline.value, changedFiles, {completeChangeSet})
-    const mode = ['new', 'existing', 'all'].includes(args.debt) ? args.debt : 'new'
-    const selectedRaw = mode === 'new' ? comparison.new : mode === 'existing' ? comparison.existing : comparison.all
-    const selected = auditFilter(currentAudit, args, selectedRaw, ctx.repoRoot)
-    const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
-    const shown = selected.slice(0, max)
-    const optional = comparison.optional.checks.map((check) => `${check.name.toUpperCase()} UNCOMPARABLE (current ${check.current}; baseline ${check.baseline})`).join('; ')
-    const stateOf = (finding) => mode === 'all' ? finding.debtState : mode
-    const fixedShown = auditFilter(baseline.value, args, comparison.fixed, ctx.repoRoot).slice(0, Math.min(10, max))
-    const text = [
-        `${mode.toUpperCase()} DEBT — deterministic internal audit vs ${resolved.ref} (${resolved.commit.slice(0, 12)})`,
-        `Changed scope: ${changedFiles.length} file(s) from ${scopeSource}${changedFiles.length ? ` — ${changedFiles.slice(0, 12).join(', ')}${changedFiles.length > 12 ? ', …' : ''}` : ' — working tree matches the baseline'}.`,
-        `Scope comparison: ${comparison.totals.scope.new} new, ${comparison.totals.scope.existing} existing, ${comparison.totals.scope.fixed} fixed deterministic finding(s). Repository totals: ${comparison.totals.repository.new} new, ${comparison.totals.repository.existing} existing, ${comparison.totals.repository.fixed} fixed.`,
-        `Optional checks: ${optional}. Supply-chain findings are not assigned new/existing/fixed state from a source-only checkout.`,
-        '',
-        `Showing ${shown.length} of ${selected.length} ${mode} finding(s) after filters:`,
-        ...shown.map((finding) => formatDebtFinding(finding, stateOf(finding))),
-        selected.length > shown.length ? `  … +${selected.length - shown.length} more` : null,
-        '',
-        `Fixed in this changed scope: ${comparison.fixed.length}${fixedShown.length ? ' (sample below)' : ''}.`,
-        ...fixedShown.map((finding) => formatDebtFinding(finding, 'fixed')),
-    ].filter((line) => line != null).join('\n')
-    return toolResult(text, {
-        status: 'COMPLETE',
-        mode: 'baseline-comparison',
-        debt: mode,
-        baseline: {ref: resolved.ref, commit: resolved.commit},
-        scope: {files: changedFiles, source: scopeSource},
-        comparison: {
-            status: 'COMPLETE',
-            scope: comparison.scope,
-            totals: comparison.totals,
-            new: comparison.new,
-            existing: comparison.existing,
-            fixed: comparison.fixed,
-            optional: comparison.optional,
-        },
-        findings: selected,
-        changeEvidence,
-    }, {
-        page: {shown: shown.length, total: selected.length, capped: shown.length < selected.length},
-        completeness: {status: 'COMPLETE'},
-    })
-}
-
-// Full internal health audit: dead code + unused exports, dependency findings (npm/go/py missing &
-// unused deps), structure (import cycles / orphans / boundary rules), supply-chain (offline OSV
-// advisories, typosquat, lockfile drift), optional malware heuristics.
-export async function tRunAudit(g, args, ctx) {
-    if (!ctx.repoRoot) return toolResult('Audit needs the repo root (not provided to this server).', {
-        status: 'INVALID', findings: [], reason: 'repo root unavailable',
-    }, {completeness: {status: 'PARTIAL', reason: 'repo root unavailable'}})
-    if (args.base_ref) return runAuditWithBaseline(args, ctx, rawGraph(ctx))
-    const graph = effectiveRawGraph(ctx)
-    const audit = await runAudit(ctx.repoRoot, graph, args, ctx, {
-        skipMalwareScan: !args.include_malware_scan, // greps installed packages — slow, so opt-in
-    })
-    if (!audit.ok) return toolResult(`Audit failed: ${audit.error}`, {
-        status: 'ERROR', findings: [], reason: audit.error,
-    }, {completeness: {status: 'PARTIAL', reason: audit.error}})
-    if (Array.isArray(args.changed_files)) {
-        const normalized = normalizeAuditScopeFiles(args.changed_files)
-        if (!normalized.ok) return toolResult(`Changed-scope audit invalid: ${normalized.error}.`, {
-            status: 'INVALID', mode: 'changed-scope', findings: [], reason: normalized.error,
-        }, {completeness: {status: 'PARTIAL', reason: normalized.error}})
-        const scoped = scopeAuditFindings(audit.findings, normalized.files)
-        const text = formatOrdinaryAudit(audit, args, scoped,
-            `CHANGED-SCOPE ONLY — ${normalized.files.length} explicitly supplied file(s); no baseline was provided, so these findings are not classified as new, existing, or fixed.`, ctx.repoRoot)
-        return toolResult(text, {
-            status: 'COMPLETE',
-            mode: 'changed-scope',
-            scope: {files: normalized.files, source: 'explicit changed_files'},
-            comparison: {status: 'UNAVAILABLE', reason: 'base_ref was not provided; changed-scope is not a new-debt claim'},
-            findings: auditFilter(audit, args, scoped, ctx.repoRoot),
-        }, {completeness: {status: 'COMPLETE'}})
-    }
-    const filtered = auditFilter(audit, args, audit.findings, ctx.repoRoot)
-    const max = Math.max(1, Math.min(100, Number(args.max_findings) || 30))
-    const shown = filtered.slice(0, max)
-    return toolResult(formatOrdinaryAudit(audit, args, audit.findings, null, ctx.repoRoot), {
-        status: 'COMPLETE',
-        mode: 'ordinary',
-        repo: audit.repo,
-        scanned: audit.scanned,
-        summary: summarizeFindings(filtered),
-        findings: shown,
-        healthCapabilities: audit.healthCapabilities,
-        extensionCapabilities: audit.extensionCapabilities || [],
-        dependencyReport: audit.dependencyReport,
-        conventionReachability: audit.conventionReachability,
-        checks: audit.checks,
-    }, {
-        page: {shown: shown.length, total: filtered.length, capped: shown.length < filtered.length},
-        completeness: {status: 'COMPLETE'},
-    })
-}
-
-// Named module clusters: graph communities labeled by their dominant folder instead of bare numbers.

package/src/mcp/health/dead-code.mjs

@@ -1,110 +0,0 @@
-import {effectiveRawGraph} from '../graph-context.mjs'
-import {computeDeadCodeReview} from '../../analysis/dead-code-review.js'
-import {
-  collectNonRuntimeRoots,
-  collectPackageScopes,
-  collectSourceTexts,
-  readRepoJson,
-} from '../../analysis/internal-audit.collect.js'
-import {entryFiles} from '../../analysis/internal-audit.reach.js'
-import {createPathClassifier} from '../../path-classification.js'
-import {createRepoBoundary} from '../../repo-path.js'
-import {readCachedSymbolPrecisionEvidence} from '../../precision/symbol-query.js'
-import {toolResult} from '../tool-result.mjs'
-
-export function tFindDeadCode(g, args, ctx) {
-    if (!ctx.repoRoot) return 'Dead-code review needs the repo root (not provided to this server).'
-    const effectiveGraph = effectiveRawGraph(ctx)
-    const pointEvidence = readCachedSymbolPrecisionEvidence({repoRoot: ctx.repoRoot, graphPath: ctx.graphPath, graph: effectiveGraph})
-    const graph = {
-        ...effectiveGraph,
-        precisionReferenceSymbols: [...new Set([
-            ...(effectiveGraph.precisionReferenceSymbols || []),
-            ...pointEvidence.referenceSymbols,
-        ])],
-        precisionProductionReferenceSymbols: [...new Set([
-            ...(effectiveGraph.precisionProductionReferenceSymbols || []),
-            ...pointEvidence.productionReferenceSymbols,
-        ])],
-        precisionTestReferenceSymbols: [...new Set([
-            ...(effectiveGraph.precisionTestReferenceSymbols || []),
-            ...pointEvidence.testReferenceSymbols,
-        ])],
-        precisionNoReferenceSymbols: [...new Set([
-            ...(effectiveGraph.precisionNoReferenceSymbols || []),
-            ...pointEvidence.noReferenceSymbols,
-        ])],
-    }
-    const boundary = createRepoBoundary(ctx.repoRoot)
-    const pkg = readRepoJson(boundary, 'package.json') || {}
-    const rules = readRepoJson(boundary, '.weavatrix-deps.json') || {}
-    const sources = collectSourceTexts(ctx.repoRoot, graph)
-    const dynamicTargets = new Set((graph.externalImports || [])
-        .filter((entry) => entry?.dynamic && entry?.target)
-        .map((entry) => String(entry.target).replace(/\\/g, '/')))
-    const frameworkEvidence = []
-    const entries = entryFiles(graph, collectPackageScopes(ctx.repoRoot, pkg), dynamicTargets, {
-        declaredEntries: rules.entrypoints || rules.entries || [],
-        sources,
-        conventionEvidence: frameworkEvidence,
-    })
-    for (const root of collectNonRuntimeRoots(ctx.repoRoot, rules)) {
-        for (const file of sources.keys()) if (file === root || file.startsWith(`${root}/`)) entries.add(file)
-    }
-
-    const review = computeDeadCodeReview(graph, sources, {
-        entrySet: entries,
-        dynamicTargets,
-        frameworkEvidence,
-        pathClassifier: createPathClassifier(ctx.repoRoot),
-        includeTests: args.include_tests === true,
-        includeClassified: args.include_classified === true,
-        minConfidence: args.min_confidence,
-        path: args.path,
-        kinds: args.kinds,
-    })
-    const max = Math.max(1, Math.min(100, Number(args.top_n) || 30))
-    const shown = review.candidates.slice(0, max)
-    const counts = review.totals.byConfidence
-    const suppression = Object.entries(review.suppressed)
-        .filter(([, count]) => count)
-        .map(([name, count]) => `${name} ${count}`)
-        .join(', ')
-    const lines = shown.map((candidate, index) => {
-        const subject = candidate.kind === 'file'
-            ? candidate.file
-            : `${candidate.owner ? `${candidate.owner}.` : ''}${candidate.symbol || candidate.id}`
-        const where = `${candidate.file}${candidate.line ? `:${candidate.line}` : ''}`
-        return [
-            `${index + 1}. [${candidate.confidence}/${candidate.evidenceTier}/${candidate.classification}] ${subject} (${where})`,
-            `     evidence: ${candidate.evidence.map((item) => item.fact).join(' ')}`,
-            candidate.caveats.length ? `     caution: ${candidate.caveats.join(' ')}` : null,
-            `     remaining: ${candidate.remainingChecks.join(' ')}`,
-        ].filter(Boolean).join('\n')
-    })
-    const text = [
-        `Dead-code review: ${shown.length} of ${review.candidates.length} candidate(s) shown (high ${counts.high}, medium ${counts.medium}, low ${counts.low}).`,
-        `Evidence tiers: strong static ${review.totals.byEvidenceTier.strongStatic}, bounded static ${review.totals.byEvidenceTier.boundedStatic}, high uncertainty ${review.totals.byEvidenceTier.highUncertainty}.`,
-        `Verdict: REVIEW_REQUIRED. This is static evidence, never permission to auto-delete or bulk-delete.`,
-        suppression ? `Suppressed by current filters: ${suppression}.` : null,
-        review.suppressed.confidence ? 'Use min_confidence=low only when public/framework/dynamic candidates need explicit review.' : null,
-        '',
-        ...(lines.length ? lines : ['No candidates matched the current production/path/kind/confidence filters.']),
-        '',
-        'Before removal: read_source, get_dependents, exact search, framework/config/manifest inspection, and the repository tests.',
-    ].filter((line) => line != null).join('\n')
-    return toolResult(text, {
-        status: 'COMPLETE',
-        verdict: 'REVIEW_REQUIRED',
-        candidates: shown,
-        totals: review.totals,
-        suppressed: review.suppressed,
-        repoSignals: review.repoSignals,
-        policy: review.policy,
-    }, {
-        warnings: review.warnings,
-        page: {shown: shown.length, total: review.candidates.length, capped: shown.length < review.candidates.length},
-        completeness: {status: 'COMPLETE'},
-    })
-}
-

package/src/mcp/health/duplicates.mjs

@@ -1,121 +0,0 @@
-import {computeDuplicates} from '../../analysis/duplicates.js'
-import {analyzeDuplicateGroups} from '../../analysis/duplicate-groups.js'
-import {toolResult} from '../tool-result.mjs'
-
-const NON_PRODUCT_DUPLICATE_CLASSES = new Set(['generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
-const fragmentEligible = (fragment, {tokMin, skipTests, includeClassified}) => {
-    if (fragment.n < tokMin) return false
-    const classes = new Set(fragment.classes || [])
-    if (skipTests && (fragment.test || classes.has('test') || classes.has('e2e'))) return false
-    if (!includeClassified && (fragment.excluded || [...classes].some((name) => NON_PRODUCT_DUPLICATE_CLASSES.has(name)))) return false
-    return true
-}
-
-export function tFindDuplicates(g, args, ctx) {
-    if (!ctx.repoRoot) return toolResult('Duplicate scan needs the repo root (not provided to this server).', {
-        status: 'INVALID', groups: [], reason: 'repo root unavailable',
-    }, {completeness: {status: 'PARTIAL', reason: 'repo root unavailable'}})
-    const simMin = Math.min(100, Math.max(50, Number(args.min_similarity) || 80))
-    const tokMin = Math.min(400, Math.max(12, Number(args.min_tokens) || 50))
-    const mode = args.mode === 'strict' ? 'strict' : 'renamed'
-    const skipTests = args.include_tests ? false : true
-    const includeClassified = args.include_classified === true || args.include_non_product === true
-    const includeStrings = !!args.include_strings
-    // semantic mode: same-name symbols across files, ranked by size — LOW similarity is the signal
-    // (same name, drifted behavior). Token-clone pairing is skipped entirely.
-    if (args.mode === 'semantic') {
-        const data = computeDuplicates(ctx.repoRoot, ctx.graphPath, {nameTwins: true, minTokens: tokMin})
-        const frags = data.frags
-        const candidates = []
-        for (const twin of data.nameTwins || []) {
-            const allowed = new Set(twin.members.filter((i) => fragmentEligible(frags[i], {tokMin, skipTests, includeClassified})))
-            const pairs = (twin.pairs || []).filter((p) => allowed.has(p.a) && allowed.has(p.b))
-            if (!pairs.length) continue
-            const closest = pairs.slice().sort((a, b) => b.similarity - a.similarity)[0]
-            const farthest = pairs.slice().sort((a, b) => a.similarity - b.similarity)[0]
-            if (closest.similarity >= 85) candidates.push({kind: 'clone', label: twin.label, pair: closest})
-            if (farthest.similarity <= 45) candidates.push({kind: 'collision', label: twin.label, pair: farthest})
-        }
-        for (const item of candidates) item.tokens = frags[item.pair.a].n + frags[item.pair.b].n
-        candidates.sort((a, b) => {
-            if (a.kind !== b.kind) return a.kind === 'clone' ? -1 : 1
-            return a.kind === 'clone'
-                ? b.pair.similarity - a.pair.similarity || b.tokens - a.tokens
-                : b.tokens - a.tokens || a.pair.similarity - b.pair.similarity
-        })
-        if (!candidates.length) return toolResult(
-            'No actionable same-name pairs across files (semantic mode; ambiguous middle-similarity pairs are suppressed).',
-            {status: 'COMPLETE', mode: 'semantic', total: 0, groups: [], thresholds: {minTokens: tokMin}},
-            {page: {shown: 0, total: 0, capped: false}, completeness: {status: 'COMPLETE'}},
-        )
-        const top = candidates.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
-        const lines = top.map((item, k) => {
-            const a = frags[item.pair.a]
-            const b = frags[item.pair.b]
-            const verdict = item.kind === 'clone'
-                ? 'near-identical duplicate candidate — review, then extract shared logic if the contract is truly shared'
-                : 'name collision, not a duplicate — inspect only if these definitions should share a contract'
-            return [
-                `${k + 1}. "${item.label}" — ${item.pair.similarity}% similar; ${verdict}`,
-                `     ${a.file}:${a.start}-${a.end}  (${a.n} tok)`,
-                `     ${b.file}:${b.start}-${b.end}  (${b.n} tok)`,
-            ].join('\n')
-        })
-        const text = `Found ${candidates.length} actionable same-name pair(s) across files (semantic mode; one closest clone and/or farthest collision per name). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nThese are review candidates, not automatic refactors. Use read_source on both sites before changing code.`
-        return toolResult(text, {
-            status: 'COMPLETE', mode: 'semantic', total: candidates.length, thresholds: {minTokens: tokMin},
-            groups: top.map((item) => ({
-                kind: item.kind, label: item.label, similarity: item.pair.similarity,
-                members: [frags[item.pair.a], frags[item.pair.b]].map((fragment) => ({
-                    file: fragment.file, start: fragment.start, end: fragment.end, tokens: fragment.n, label: fragment.label,
-                })),
-            })),
-        }, {page: {shown: top.length, total: candidates.length, capped: top.length < candidates.length}, completeness: {status: 'COMPLETE'}})
-    }
-    const analysis = analyzeDuplicateGroups(ctx.repoRoot, ctx.graphPath, args)
-    const groups = analysis.groups
-    const smallPolicy = tokMin < 30 ? ' Small fragments below 30 tokens require at least 95% similarity and two shared bounded fingerprints.' : ''
-    const suppressed = analysis.suppressed
-    const suppressionNote = suppressed && !includeClassified
-        ? ` ${suppressed} fragment(s) classified as tests/e2e/generated/vendored/mock/story/docs/benchmark/temp or matched by .weavatrix.json exclude were suppressed; pass include_classified:true (and include_tests:true for tests) to inspect them explicitly.`
-        : ''
-    const boilerplateNote = analysis.boilerplateSuppressed
-        ? ` ${analysis.boilerplateSuppressed} all-router framework boilerplate group(s) were suppressed; pass include_boilerplate:true to inspect them.`
-        : ''
-    const declarativeNote = analysis.declarativeSuppressed
-        ? ` ${analysis.declarativeSuppressed} immutable declarative catalog group(s) were suppressed; pass include_declarative:true to inspect repeated data shapes.`
-        : ''
-    if (!groups.length) return toolResult(
-        `No clones at ≥${simMin}% similarity / ≥${tokMin} tokens (${mode} mode). Try lowering the thresholds.${smallPolicy}${suppressionNote}${boilerplateNote}${declarativeNote}`,
-        {
-            status: 'COMPLETE', mode, total: 0, groups: [], thresholds: {minSimilarity: simMin, minTokens: tokMin},
-            suppressed: {classifiedFragments: suppressed, boilerplateGroups: analysis.boilerplateSuppressed, declarativeGroups: analysis.declarativeSuppressed},
-        },
-        {page: {shown: 0, total: 0, capped: false}, completeness: {status: 'COMPLETE'}},
-    )
-    const top = groups.slice(0, Math.min(30, Math.max(1, Number(args.top_n) || 15)))
-    const lines = top.map((grp, k) => {
-        const isStr = grp.members.some((f) => f.kind === 'string')
-        const head = `${k + 1}. ${grp.members.length}× "${grp.members[0].label}"${isStr ? ' [string literal]' : ''} — ≤${grp.maxSim}% similar, ${grp.tokens} duplicated tokens`
-        const sites = grp.members.slice(0, 8).map((f) => `     ${f.file}:${f.start}-${f.end}`)
-        return [head, ...sites].join('\n')
-    })
-    const text = `Found ${groups.length} clone group(s) (${mode} mode, ≥${simMin}%, ≥${tokMin} tok${includeStrings ? ', incl. large string literals' : ''}). Top ${top.length}:\n\n${lines.join('\n\n')}\n\nUse read_source on any two sites to compare, then extract shared logic.${smallPolicy}${suppressionNote}${boilerplateNote}${declarativeNote}`
-    return toolResult(text, {
-        status: 'COMPLETE', mode, total: groups.length, thresholds: {minSimilarity: simMin, minTokens: tokMin},
-        includeStrings,
-        suppressed: {classifiedFragments: suppressed, boilerplateGroups: analysis.boilerplateSuppressed, declarativeGroups: analysis.declarativeSuppressed},
-        groups: top.map((group) => ({
-            similarity: group.maxSim, duplicatedTokens: group.tokens,
-            members: group.members.slice(0, 8).map((fragment) => ({
-                file: fragment.file, start: fragment.start, end: fragment.end, tokens: fragment.n,
-                label: fragment.label, kind: fragment.kind || 'symbol', classes: fragment.classes || [],
-            })),
-            memberCount: group.members.length,
-        })),
-    }, {page: {shown: top.length, total: groups.length, capped: top.length < groups.length}, completeness: {status: 'COMPLETE'}})
-}
-
-// Focused dead-code review queue. Unlike the broad run_audit surface, this includes functions and
-// methods with bounded source-free evidence, and explicitly demotes framework/dynamic/public API
-// candidates. It never returns an automatic-delete verdict.