weavatrix 0.3.8 → 0.3.10

package/src/graph/builder/lang-rust.js

@@ -59,6 +59,37 @@ function pathAttribute(modNode) {
   return "";
 }
 
+// Test-only classification must mean "compiled exclusively under `cargo test`": #[cfg(test)] and
+// #[cfg(all(test, ...))] guarantee that; #[cfg(any(test, ...))] also compiles into production builds
+// and deliberately stays unclassified. #[test]/#[bench] (incl. #[tokio::test]-style harness paths)
+// mark the annotated function itself.
+const CFG_TEST_RE = /#\s*!?\s*\[\s*cfg\s*\(\s*(?:test\s*\)|all\s*\(\s*test\b)/;
+const TEST_FN_ATTR_RE = /#\s*\[\s*(?:[\w]+(?:\s*::\s*[\w]+)*\s*::\s*)?(?:test|bench)\s*(?:\]|\()/;
+const CFG_TEST_CARRIERS = new Set(["mod_item", "impl_item", "trait_item", "function_item"]);
+const COMMENT_TYPES = new Set(["line_comment", "block_comment"]);
+const itemAttributeText = (item) => {
+  // Comments are NAMED siblings in tree-sitter-rust — `#[test]` + `// note` + `fn` must still classify.
+  let text = "";
+  for (let prev = item?.previousNamedSibling; prev; prev = prev.previousNamedSibling) {
+    if (COMMENT_TYPES.has(prev.type)) continue;
+    if (prev.type !== "attribute_item") break;
+    text += prev.text + "\n";
+  }
+  return text;
+};
+// `#![cfg(test)]` at the top of a file or module body gates everything below it. tree-sitter-rust
+// tokenizes a file-leading `#!...` as `shebang`; a real shebang line never matches CFG_TEST_RE.
+const innerCfgTest = (body) => (body?.namedChildren || [])
+  .some((child) => (child.type === "inner_attribute_item" || child.type === "shebang") && CFG_TEST_RE.test(child.text));
+const underCfgTest = (node) => {
+  for (let parent = node?.parent; parent; parent = parent.parent) {
+    if (parent.type === "declaration_list" && innerCfgTest(parent)) return true;
+    if (CFG_TEST_CARRIERS.has(parent.type) && CFG_TEST_RE.test(itemAttributeText(parent))) return true;
+    if (!parent.parent && innerCfgTest(parent)) return true; // source_file root
+  }
+  return false;
+};
+
 function inlineAncestors(node) {
   const result = [];
   for (let p = node?.parent; p; p = p.parent) {
@@ -129,10 +160,15 @@ export default {
         const memberOf = ownerName(owner, field);
         const symbolKind = cap.name === "function" ? (memberOf ? "method" : "function") : cap.name;
         const visibility = publicVisibility(declaration, owner);
+        const attrs = itemAttributeText(declaration);
+        const testSurface = CFG_TEST_RE.test(attrs)
+          || (cap.name === "function" && TEST_FN_ATTR_RE.test(attrs))
+          || underCfgTest(declaration);
         const id = addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name === "function", {
           sourceNode: declaration,
           selectionNode: cap.node,
           symbolKind,
+          ...(testSurface ? { testSurface: true } : {}),
           ...(memberOf ? { memberOf, visibility } : { moduleDeclaration: true }),
           ...(!memberOf && visibility === "public" ? { exported: true } : {}),
         });

package/src/graph/freshness-probe.js

@@ -2,10 +2,9 @@
 // authority when something changed; this exact Git/worktree token is safe to cache in-process and in
 // versioned graph metadata when HEAD + dirty/untracked/control-file content remain unchanged.
 import {createHash} from 'node:crypto'
-import {spawnSync} from 'node:child_process'
 import {readFileSync, statSync} from 'node:fs'
 import {createRequire} from 'node:module'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 import {createRepoBoundary} from '../repo-path.js'
 
 const REPOSITORY_FRESHNESS_PROBE_V = 1
@@ -28,15 +27,13 @@ const CURRENT_GRAPH_SCHEMA = Object.freeze({
     barrelResolutionV: 1,
     reExportOccurrencesV: 1,
     symbolSpacesV: 1,
-    extractorSchemaV: 5,
+    extractorSchemaV: 6,
 })
 const CONTROL_FILES = ['.gitignore', '.weavatrixignore', '.weavatrix.json']
 const MAX_CONTROL_BYTES = 1_000_000
 
 function git(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {
-        encoding: 'buffer', timeout: 8000, windowsHide: true, env: childProcessEnv(), maxBuffer: 16 * 1024 * 1024,
-    })
+    const result = runGit(repoRoot, args, {encoding: 'buffer', maxBuffer: 16 * 1024 * 1024})
     return result.status === 0 ? Buffer.from(result.stdout || '') : null
 }
 

package/src/graph/graph-filter.js

@@ -22,12 +22,14 @@ export function filterGraphForMode(graph, mode, { repoRoot = null } = {}) {
   const links = graph.links || [];
   const endpoint = (value) => (value && typeof value === "object" ? value.id : value);
   const classifier = createPathClassifier(repoRoot);
-  const isTest = (path) => hasPathClass(classifier.explain(path), "test", "e2e");
+  // A node is a test surface when its file is test-classified OR the extractor proved the symbol
+  // itself is compiled only under test (Rust #[cfg(test)] inline modules live in production files).
+  const isTest = (node) => node.test_surface === true || hasPathClass(classifier.explain(node.source_file), "test", "e2e");
   let keep;
   if (mode === "no-tests") {
-    keep = new Set(nodes.filter((node) => !isTest(node.source_file)).map((node) => node.id));
+    keep = new Set(nodes.filter((node) => !isTest(node)).map((node) => node.id));
   } else {
-    const testIds = new Set(nodes.filter((node) => isTest(node.source_file)).map((node) => node.id));
+    const testIds = new Set(nodes.filter((node) => isTest(node)).map((node) => node.id));
     keep = new Set(testIds);
     for (const link of links) {
       if (testIds.has(endpoint(link.source))) keep.add(endpoint(link.target)); // a test's dependency

package/src/graph/incremental-refresh.js

@@ -184,7 +184,7 @@ export async function refreshGraphIncrementally(repoDir, existingGraph, {
 
   if (!existingGraph || !existingGraph.fileHashes || !existingGraph.fileExportSignatures
     || !existingGraph.controlHashes || !existingGraph.jsExportRecords || Number(existingGraph.barrelResolutionV) < 1
-    || Number(existingGraph.extractorSchemaV) < 5 || Number(existingGraph.physicalFileLocV) < 1
+    || Number(existingGraph.extractorSchemaV) < 6 || Number(existingGraph.physicalFileLocV) < 1
     || Number(existingGraph.reExportOccurrencesV) < 1
     || Number(existingGraph.symbolSpacesV) < 1 || Number(existingGraph.edgeProvenanceV) < 1) {
     return full("incremental-baseline-unavailable");

package/src/graph/internal-builder.build.js

@@ -148,6 +148,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
         } : {}),
         ...(complexity ? { complexity } : {}),
         ...(extra && extra.exported ? { exported: true } : {}),
+        ...(extra && extra.testSurface ? { test_surface: true } : {}),
         ...(extra && extra.decorated ? { decorated: true } : {}),
         ...(extra && extra.symbolKind ? { symbol_kind: extra.symbolKind } : {}),
         ...(extra && extra.symbolSpace ? { symbol_space: extra.symbolSpace } : {}),
@@ -265,7 +266,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
     barrelResolutionV: 1,
     reExportOccurrencesV: 1,
     symbolSpacesV: 1,
-    extractorSchemaV: 5,
+    extractorSchemaV: 6,
     reExportOccurrences,
     jsExportRecords: Object.fromEntries([...jsExports.entries()].sort(([a], [b]) => a.localeCompare(b))),
     fileHashes: snapshot.fileHashes,

package/src/graph/internal-builder.langs.js

@@ -5,10 +5,9 @@
 // build works — and Electron main runs Node, so this needs no external runtime.
 import { readdirSync, statSync, realpathSync } from "node:fs";
 import { join, extname, dirname } from "node:path";
-import { execFileSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { isPathInside } from "../repo-path.js";
-import { childProcessEnv } from "../child-env.js";
+import { runGit } from "../git-exec.js";
 import { filterWeavatrixIgnored } from "../path-ignore.js";
 import {trustedGrammarWasm, trustedRuntimeWasm} from './parser-artifact-boundary.js'
 import LANG_JS from "./builder/lang-js.js";
@@ -112,17 +111,11 @@ function walkFallback(dir, acc = [], seen = new Set(), depth = 0, rootReal = nul
 // A repository may be opened without Git (or Git may be unavailable), so failure is deliberately a signal to
 // use the boundary-safe walker above rather than a build failure.
 function gitFileUniverse(dir) {
-  let raw;
-  try {
-    raw = execFileSync("git", ["-C", dir, "ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
-      encoding: "utf8",
-      windowsHide: true,
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 15_000,
-      maxBuffer: 64 * 1024 * 1024,
-      env: childProcessEnv(),
-    });
-  } catch { return null; }
+  const lsFiles = runGit(dir, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
+    stdio: ["ignore", "pipe", "ignore"], timeout: 15_000, maxBuffer: 64 * 1024 * 1024,
+  });
+  if (lsFiles.status !== 0 || lsFiles.error) return null;
+  const raw = lsFiles.stdout;
 
   // `git -C <dir>` also succeeds when <dir> is merely nested under some parent repository. If that
   // nested directory is ignored by the parent, `ls-files` is empty even though <dir> can be a valid
@@ -130,17 +123,11 @@ function gitFileUniverse(dir) {
   // that one ambiguous case, fall back to the boundary-safe walker. Preserve an empty universe for
   // an actual Git root so ignored files do not leak back into its graph.
   if (!raw) {
-    try {
-      const top = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
-        encoding: "utf8",
-        windowsHide: true,
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 15_000,
-        maxBuffer: 1024 * 1024,
-        env: childProcessEnv(),
-      }).trim();
-      if (realpathSync.native(top) !== realpathSync.native(dir)) return null;
-    } catch { return null; }
+    const top = runGit(dir, ["rev-parse", "--show-toplevel"], {
+      stdio: ["ignore", "pipe", "ignore"], timeout: 15_000, maxBuffer: 1024 * 1024,
+    });
+    if (top.status !== 0 || top.error) return null;
+    if (realpathSync.native(String(top.stdout).trim()) !== realpathSync.native(dir)) return null;
   }
 
   let rootReal;

package/src/mcp/actions/graph-lifecycle.mjs

@@ -1,7 +1,7 @@
 import {existsSync, readFileSync, realpathSync, statSync, writeFileSync} from 'node:fs'
 import {dirname, isAbsolute, join} from 'node:path'
 import {diffGraphs, formatGraphDiff, prevGraphPathFor} from '../graph-context.mjs'
-import {buildGraphForRepo, defaultPrecisionMode} from '../../build-graph.js'
+import {buildGraphForRepo, defaultPrecisionMode, precisionStatusLine} from '../../build-graph.js'
 import {graphHomeDir, graphOutDirForModule, graphOutDirForRepo} from '../../graph/layout.js'
 import {liveRepositoryRecords, registerRepository} from '../../graph/repo-registry.js'
 import {precisionSemanticInputsMatch, readPrecisionOverlay} from '../../precision/lsp-overlay.js'
@@ -76,7 +76,7 @@ export async function tOpenRepo(g, args, ctx) {
             savedPrecision = ['lsp', 'off'].includes(saved.graphPrecisionMode) ? saved.graphPrecisionMode : defaultPrecisionMode()
             schemaUpgrade = !Number.isInteger(saved.edgeTypesV) || saved.edgeTypesV < 2
                 || !Number.isInteger(saved.edgeProvenanceV) || saved.edgeProvenanceV < 1
-                || !Number.isInteger(saved.extractorSchemaV) || saved.extractorSchemaV < 5
+                || !Number.isInteger(saved.extractorSchemaV) || saved.extractorSchemaV < 6
                 || !Number.isInteger(saved.reExportOccurrencesV) || saved.reExportOccurrencesV < 1
                 || !Number.isInteger(saved.symbolSpacesV) || saved.symbolSpacesV < 1
                 || !Number.isInteger(saved.physicalFileLocV) || saved.physicalFileLocV < 1
@@ -128,7 +128,7 @@ export async function tOpenRepo(g, args, ctx) {
         `Opened ${repoPath}${buildNote}: ${loaded.nodes.length} nodes / ${loaded.links.length} edges. All tools now target this repo.`,
         `Graph: ${graphPath}`,
         `Build mode: ${loaded.graphBuildMode || 'full'}`,
-        `Semantic precision: ${loaded.precision?.state || 'UNAVAILABLE'} (${loaded.precision?.verifiedEdges || 0} EXACT_LSP edge(s))`,
+        precisionStatusLine(loaded.precision),
     ].join('\n')
 }
 

package/src/mcp/catalog.mjs

@@ -128,8 +128,8 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {cap: 'health', name: 'hot_path_review', description: 'Rank a focused production-symbol hot-path queue from parser-derived local complexity, inside-loop allocations/copies/scans/sorts/recursion, graph fan-in/fan-out, and measured coverage or clearly labelled static test reachability. The default score gate is 85 with a narrow strong-local fallback; set min_score=0 for the full diagnostic queue. This is not profiler data or interprocedural Big-O.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repository-relative path prefix'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 20}, min_score: {type: 'integer', minimum: 0, maximum: 100, default: 85, description: 'Focused default is 85; lower explicitly to broaden, or use 0 for every threshold-matching diagnostic candidate'}, cyclomatic_threshold: {type: 'integer', minimum: 2, maximum: 1000, default: 8}, call_threshold: {type: 'integer', minimum: 1, maximum: 10000, default: 12}, loop_depth_threshold: {type: 'integer', minimum: 1, maximum: 10, default: 2}, time_rank_threshold: {type: 'integer', minimum: 0, maximum: 5, default: 2}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and explicitly excluded paths; tests still require include_tests'}}}, run: (g, a, ctx) => th.tHotPathReview(g, a, ctx)},
         {cap: 'graph', name: 'list_communities', description: 'List graph communities named by their dominant folder (largest first) with sample files — a readable module overview; feed the list position into get_community.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max communities to list, default 20'}}}, run: (g, a, ctx) => th.tListCommunities(g, a, ctx)},
         {cap: 'graph', name: 'module_map', description: 'First orientation view for understanding an unfamiliar application with little context: a production-first folder architecture map with file/symbol counts and strongest module dependencies, separating runtime, TypeScript type-only and language compile-only coupling.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max modules to list, default 25'}, include_non_product: {type: 'boolean', default: false, description: 'Include tests, fixtures, benchmarks, generated output, docs and other classified non-product files; false by default'}}}, run: (g, a, ctx) => th.tModuleMap(g, a, ctx)},
-        {cap: 'source', refreshGraph: true, name: 'list_endpoints', description: 'Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web/Spring MVC and WebFlux): declared and reachable composed paths, static mount provenance, confidence, handler, file:line, and Spring conditional/default-active state.', inputSchema: {type: 'object', properties: {method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, path: {type: 'string', maxLength: 2048, description: 'Optional exact composed path or segment-aligned suffix'}, max_results: {type: 'integer', description: 'Max endpoints to list, default 100'}}}, run: (g, a, ctx) => th.tListEndpoints(g, a, ctx)},
-        {cap: 'source', refreshGraph: true, name: 'trace_endpoint', description: 'Resolve one exact reachable HTTP endpoint, prove its router mount chain, bind its handler symbol, and return a bounded production-only multi-hop call graph with call-site excerpts. This is a focused projection of the repository graph, not text-search inference.', inputSchema: {type: 'object', properties: {path: {type: 'string', minLength: 1, maxLength: 2048, description: 'Exact composed path; a suffix is accepted only when unambiguous'}, method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, max_depth: {type: 'integer', minimum: 1, maximum: 4, default: 3}, max_nodes: {type: 'integer', minimum: 2, maximum: 40, default: 20}, max_excerpts: {type: 'integer', minimum: 0, maximum: 12, default: 6}, context_lines: {type: 'integer', minimum: 0, maximum: 6, default: 2}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp and explicitly excluded targets'}}, required: ['path']}, run: (g, a, ctx) => te.tTraceEndpoint(g, a, ctx)},
+        {cap: 'source', refreshGraph: true, name: 'list_endpoints', description: 'Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web/Spring MVC and WebFlux): declared and reachable composed paths, static mount provenance, confidence, handler, file:line, and Spring conditional/default-active state.', inputSchema: {type: 'object', properties: {method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, path: {type: 'string', maxLength: 2048, description: 'Optional exact composed path or segment-aligned suffix'}, max_results: {type: 'integer', description: 'Max endpoints to list, default 100'}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp and explicitly excluded targets'}}}, run: (g, a, ctx) => th.tListEndpoints(g, a, ctx)},
+        {cap: 'source', refreshGraph: true, name: 'trace_endpoint', description: 'Resolve one exact reachable HTTP endpoint, prove its router mount chain, bind its handler symbol, and return a bounded production-only multi-hop call graph with call-site excerpts. This is a focused projection of the repository graph, not text-search inference.', inputSchema: {type: 'object', properties: {path: {type: 'string', minLength: 1, maxLength: 2048, description: 'Exact composed path; a suffix is accepted only when unambiguous'}, method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, handler_file: {type: 'string', maxLength: 1024, description: 'Repo-relative file path (or unambiguous path suffix) declaring the handler; use after an AMBIGUOUS_HANDLER result.'}, max_depth: {type: 'integer', minimum: 1, maximum: 4, default: 3}, max_nodes: {type: 'integer', minimum: 2, maximum: 40, default: 20}, max_excerpts: {type: 'integer', minimum: 0, maximum: 12, default: 6}, context_lines: {type: 'integer', minimum: 0, maximum: 6, default: 2}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp and explicitly excluded targets'}}, required: ['path']}, run: (g, a, ctx) => te.tTraceEndpoint(g, a, ctx)},
         {cap: 'build', name: 'rebuild_graph', description: "Rebuild the active full-repository graph and report a structural delta. Omitted mode/precision preserve the active graph; a first build uses full and the startup precision setting (lsp unless WEAVATRIX_PRECISION=off). The local TypeScript/JavaScript LSP overlay validates bounded ambiguous edges; precision:off is an explicit fallback. With scope, build an isolated diagnostic graph without replacing or diffing the full graph.", inputSchema: {type: 'object', properties: {mode: {type: 'string', enum: ['full', 'no-tests', 'tests-only'], description: 'Build mode; omit to preserve the active mode (or use full for a first build)'}, precision: {type: 'string', enum: ['lsp', 'off'], description: 'Semantic precision; omit to preserve the active mode (or use the startup setting for a first build)'}, scope: {type: 'string', description: 'Optional isolated diagnostic path prefix; never replaces the active full graph'}}}, run: (g, a, ctx) => ta.tRebuildGraph(g, a, ctx)},
         {cap: 'graph', name: 'graph_diff', description: 'Structural graph diff: compare the current graph with an immutable Git-ref baseline (base_ref such as HEAD~1 or main), or with graph.prev.json from the last rebuild when base_ref is omitted. Reports architecture drift, cycle changes and symbols that lost their last caller.', inputSchema: {type: 'object', properties: {base_ref: {type: 'string', maxLength: 256, description: 'Optional immutable Git baseline to build in isolation, e.g. HEAD~1, main or origin/main; never checks out or mutates the working tree'}, path: {type: 'string', description: 'Optional node-id/path prefix to scope the diff, e.g. src/query'}}}, run: (g, a, ctx) => ti.tGraphDiff(g, a, ctx)},
         {cap: 'graph', name: 'get_architecture_contract', description: 'Read the owner-approved architecture target or safely bootstrap one. With action=preview, returns an adaptive candidate, observed-but-not-enforced dependency directions, verification, exact file content/hash and a short-lived confirmation token. action=approve creates the local contract only after explicit token confirmation and never overwrites an active target.', inputSchema: {type: 'object', properties: {action: {type: 'string', enum: ['preview', 'approve'], description: 'Omit to read; preview is dry-run only; approve requires the preview token'}, candidate_contract: {type: 'object', description: 'Optional reviewed candidate to normalize and verify during preview'}, baseline_mode: {type: 'string', enum: ['none', 'accept-current'], default: 'none', description: 'Whether preview should materialize current violations as an explicit ratchet baseline'}, confirm_token: {type: 'string', description: 'One-time token returned by preview; required for approve'}}}, run: (g, a, ctx) => tar.tGetArchitectureContract(g, a, ctx)},

package/src/mcp/evidence-snapshot.structure.mjs

@@ -1,6 +1,6 @@
 import {createHash} from 'node:crypto'
 import {readFileSync} from 'node:fs'
-import {buildFileImportGraph, checkBoundaries, findSccs, representativeCycle} from '../analysis/dep-rules.js'
+import {buildFileImportGraph, checkBoundaries, findSccs, isRustModuleTreeComponent, representativeCycle} from '../analysis/dep-rules.js'
 import {createRepoBoundary} from '../repo-path.js'
 import {CAPS, bounded, compareText, repoRelativePath, safeToken} from './evidence-snapshot.common.mjs'
 
@@ -59,7 +59,10 @@ export function buildStructureEvidence(graph, repoRoot) {
         const imports = buildFileImportGraph(graph)
         const runtimeSccs = sortedSccs(imports.runtimeAdj)
         const runtimeKeys = new Set(runtimeSccs.map((members) => members.join('\0')))
-        const compileSccs = sortedSccs(imports.allAdj).filter((members) => !runtimeKeys.has(members.join('\0')))
+        // Same suppression as computeStructureFindings: a synced snapshot must not contradict the
+        // local structure findings on idiomatic Rust module trees.
+        const compileSccs = sortedSccs(imports.allAdj)
+            .filter((members) => !runtimeKeys.has(members.join('\0')) && !isRustModuleTreeComponent(members))
         const allCycles = [
             ...runtimeSccs.map((members) => cycleFact('runtime', imports.runtimeAdj, members)),
             ...compileSccs.map((members) => cycleFact('compile-time', imports.allAdj, members)),

package/src/mcp/git-output.mjs

@@ -1,10 +1,7 @@
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../child-env.js'
+import {runGit} from '../git-exec.js'
 
 export function gitLines(repoRoot, args) {
-    const result = spawnSync('git', ['-C', repoRoot, ...args], {
-        encoding: 'utf8', timeout: 8000, env: childProcessEnv(), windowsHide: true,
-    })
+    const result = runGit(repoRoot, args)
     if (result.status !== 0) return null
     return String(result.stdout || '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
 }

package/src/mcp/graph/context-seeds.mjs

@@ -52,6 +52,7 @@ export function requestedPathClasses(query) {
 }
 
 function isQueryEligible(node, requestedClasses, classificationCache, classifier) {
+    if (node?.test_surface === true && !requestedClasses.has('test')) return false
     const source = sourceFileOf(node)
     if (!source) return true
     if (!classificationCache.has(source)) classificationCache.set(source, classifier.explain(source, {content: ''}))

package/src/mcp/graph/context-state.mjs

@@ -1,7 +1,6 @@
 import {readFileSync, statSync} from 'node:fs'
 import {join} from 'node:path'
-import {spawnSync} from 'node:child_process'
-import {childProcessEnv} from '../../child-env.js'
+import {runGit} from '../../git-exec.js'
 import {resolveRepoPath} from '../../repo-path.js'
 import {mergePrecisionOverlay, precisionSemanticInputsMatch, readPrecisionOverlay} from '../../precision/lsp-overlay.js'
 
@@ -14,19 +13,19 @@ export function graphStaleness(ctx) {
     try { info.builtAt = statSync(ctx.graphPath).mtime } catch { /* no graph file */ }
     if (ctx.repoRoot && info.builtAt) {
         try {
-            const head = spawnSync('git', ['-C', ctx.repoRoot, 'log', '-1', '--format=%cI'], {encoding: 'utf8', timeout: 4000, env: childProcessEnv()})
+            const head = runGit(ctx.repoRoot, ['log', '-1', '--format=%cI'], {timeout: 4000})
             const iso = (head.stdout || '').trim()
             if (head.status === 0 && iso) {
                 info.headAt = new Date(iso)
                 if (info.headAt > info.builtAt) {
                     info.stale = true
-                    const count = spawnSync('git', ['-C', ctx.repoRoot, 'rev-list', '--count', `--since=${info.builtAt.toISOString()}`, 'HEAD'], {encoding: 'utf8', timeout: 4000, env: childProcessEnv()})
+                    const count = runGit(ctx.repoRoot, ['rev-list', '--count', `--since=${info.builtAt.toISOString()}`, 'HEAD'], {timeout: 4000})
                     if (count.status === 0) info.behind = Number(count.stdout.trim()) || null
                 }
             }
         } catch { /* git unavailable */ }
         try {
-            const status = spawnSync('git', ['-C', ctx.repoRoot, 'status', '--porcelain'], {encoding: 'utf8', timeout: 4000, env: childProcessEnv()})
+            const status = runGit(ctx.repoRoot, ['status', '--porcelain'], {timeout: 4000})
             if (status.status === 0) {
                 let newer = 0
                 for (const line of String(status.stdout || '').split(/\r?\n/).filter(Boolean).slice(0, 200)) {

package/src/mcp/graph/tools-query.mjs

@@ -6,6 +6,7 @@ import {createPathClassifier, hasPathClass} from '../../path-classification.js'
 
 const QUERY_NON_PRODUCT = Object.freeze(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
 const LOW_SIGNAL_SYMBOL_RE = /^(?:const(?:ant)?|variable|property|field|enum_member)$/i
+const AMBIGUOUS_FILE_BASENAME_RE = /^(mod|lib|main)\.rs$|^index\.[a-z0-9]+$|^__init__\.py$/
 const querySourceFile = (node) => String(node?.source_file || String(node?.id || '').split('#', 1)[0]).replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase()
 const queryWords = (value) => new Set(String(value || '').replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean))
 const exactSymbolName = (node) => {
@@ -34,6 +35,23 @@ function resolveExactSeedSymbols(g, requested, limit = 12) {
     return {seeds, missing, ambiguous}
 }
 
+// Edge/hop lines print bare labels without the [id] suffix node lines carry, so repeated or
+// conventionally-generic file basenames (mod.rs, index.ts, __init__.py) become indistinguishable —
+// widen those, scoped to the shown ids, to the last two path segments.
+const makeEdgeLabel = (g, shownIds) => {
+    const counts = new Map()
+    for (const id of shownIds) {
+        const label = labelOf(g, id)
+        counts.set(label, (counts.get(label) || 0) + 1)
+    }
+    return (id) => {
+        const label = labelOf(g, id)
+        const isFile = String(id).includes('/') && !String(id).includes('#')
+        if (isFile && ((counts.get(label) || 0) > 1 || AMBIGUOUS_FILE_BASENAME_RE.test(label))) return String(id).split('/').slice(-2).join('/')
+        return label
+    }
+}
+
 const relationSet = (relationFilter, legacyFilter) => {
     const raw = relationFilter ?? legacyFilter
     const values = Array.isArray(raw) ? raw : (raw == null ? [] : String(raw).split(','))
@@ -89,6 +107,12 @@ export function tQueryGraph(g, {
         const node = g.byId.get(String(id))
         const file = querySourceFile(node)
         if (!file || pinnedFiles.has(file) || include_classified === true) return {ok: true}
+        // Extractor-proven test symbols (Rust #[cfg(test)]) live in production files; suppress them
+        // under the same policy as path-classified tests unless the question asks about tests.
+        if (node?.test_surface === true && !requestedClasses.has('test')) {
+            classifiedSuppressed.add(String(id))
+            return {ok: false, bucket: 'classified'}
+        }
         if (!classificationCache.has(file)) classificationCache.set(file, classifier.explain(file, {content: ''}))
         const info = classificationCache.get(file)
         const classes = QUERY_NON_PRODUCT.filter((name) => hasPathClass(info, name))
@@ -180,7 +204,8 @@ export function tQueryGraph(g, {
         'Nodes:',
     ]
     const nodeLines = shown.map((node) => `  [d${node.distance}] ${labelOf(g, node.id)}  (deg ${node.degree})  [${node.id}]`)
-    const edgeLines = ['', 'Edges:', ...shownEdges.map(([source, relation, target]) => `  ${labelOf(g, source)} --${relation || 'rel'}--> ${labelOf(g, target)}`)]
+    const edgeLabel = makeEdgeLabel(g, shownIds)
+    const edgeLines = ['', 'Edges:', ...shownEdges.map(([source, relation, target]) => `  ${edgeLabel(source)} --${relation || 'rel'}--> ${edgeLabel(target)}`)]
     let text = [...head.filter(Boolean), ...nodeLines, ...edgeLines].join('\n')
     if (text.length > charBudget) text = text.slice(0, charBudget) + `\n... (truncated to ~${token_budget} tokens)`
     return text
@@ -218,6 +243,7 @@ export function tShortestPath(g, {source, target, max_hops = 8} = {}) {
     if (!previous.has(targetId)) return `No path found between "${sourceNode.label ?? sourceId}" and "${targetNode.label ?? targetId}" within ${limit} hops.`
     const path = []
     for (let current = targetId; current != null; current = previous.get(current)) path.unshift(current)
-    const lines = path.map((id, index) => index === 0 ? `  ${labelOf(g, id)}` : `  --${relationTo.get(id) || 'rel'}--> ${labelOf(g, id)}`)
+    const edgeLabel = makeEdgeLabel(g, path)
+    const lines = path.map((id, index) => index === 0 ? `  ${edgeLabel(id)}` : `  --${relationTo.get(id) || 'rel'}--> ${edgeLabel(id)}`)
     return [`Shortest path (${path.length - 1} hops): ${sourceNode.label ?? sourceId} → ${targetNode.label ?? targetId}`, ...lines].join('\n')
 }

package/src/mcp/health/audit-format.mjs

@@ -1,6 +1,5 @@
-import {spawnSync} from 'node:child_process'
 import {summarizeFindings} from '../../analysis/findings.js'
-import {childProcessEnv} from '../../child-env.js'
+import {runGit} from '../../git-exec.js'
 import {createPathClassifier, hasPathClass} from '../../path-classification.js'
 
 const SEVERITY_RANK = {critical: 0, high: 1, medium: 2, low: 3, info: 4}
@@ -179,9 +178,7 @@ export const formatOrdinaryAudit = (audit, args, findings = audit.findings, head
 }
 
 export const gitUntracked = (repoRoot) => {
-    const result = spawnSync('git', ['-C', repoRoot, 'ls-files', '--others', '--exclude-standard'], {
-        encoding: 'utf8', timeout: 8000, maxBuffer: 2 * 1024 * 1024, env: childProcessEnv(), windowsHide: true,
-    })
+    const result = runGit(repoRoot, ['ls-files', '--others', '--exclude-standard'], {maxBuffer: 2 * 1024 * 1024})
     if (result.status !== 0) return {
         ok: false,
         files: [],

package/src/mcp/health/endpoints.mjs

@@ -1,5 +1,6 @@
 import {rawGraph} from '../graph-context.mjs'
 import {analyzeEndpointInventory} from '../../analysis/endpoints.js'
+import {PATH_CLASS_NAMES, createPathClassifier, hasPathClass} from '../../path-classification.js'
 import {toolResult} from '../tool-result.mjs'
 
 export function tListEndpoints(g, args, ctx) {
@@ -16,12 +17,34 @@ export function tListEndpoints(g, args, ctx) {
     const path = args.path ? String(args.path) : null
     if (method) eps = eps.filter((endpoint) => endpoint.method === method)
     if (path) eps = eps.filter((endpoint) => endpoint.path === path || endpoint.path.endsWith(path))
-    if (!eps.length) return 'No HTTP endpoints detected in the indexed code files.'
+    // Production-first: classified endpoints are suppressed by default; a tests-only graph would
+    // suppress everything, so that build mode auto-includes them (same precedent as module_map).
+    const includeClassified = args.include_classified === true || graph.graphBuildMode === 'tests-only'
+    const classifier = createPathClassifier(ctx.repoRoot)
+    const byFile = new Map()
+    const classesOf = (file) => {
+        const key = String(file || '')
+        if (!byFile.has(key)) {
+            const info = classifier.explain(key, {content: ''})
+            byFile.set(key, {classified: info.excluded || hasPathClass(info, ...PATH_CLASS_NAMES), pathClasses: info.classes})
+        }
+        return byFile.get(key)
+    }
+    const production = eps.filter((endpoint) => !classesOf(endpoint.file).classified)
+    const classified = eps.filter((endpoint) => classesOf(endpoint.file).classified)
+    const suppressed = includeClassified ? 0 : classified.length
+    eps = includeClassified ? [...production, ...classified] : production
+    const suppressionNote = suppressed
+        ? `${suppressed} endpoint(s) in classified test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded paths were suppressed; pass include_classified:true to inspect them.`
+        : ''
+    if (!eps.length) return suppressed
+        ? `No production HTTP endpoints detected; ${suppressionNote}`
+        : 'No HTTP endpoints detected in the indexed code files.'
     const max = Math.max(1, Math.min(300, Number(args.max_results) || 100))
     const shown = eps.slice(0, max)
     const stats = inventory.stats
     const text = [
-        `${eps.length} endpoint(s) matched${eps.length > shown.length ? `, showing ${shown.length}` : ''}. Inventory: ${stats.declaredRoutes} declaration(s); ${stats.reachableStaticRoutes} statically reachable composed route(s); ${stats.localDeclarations} local/root declaration candidate(s); ${stats.staticMounts} static router mount(s)${stats.truncated ? `; TRUNCATED at ${stats.maxEndpoints}` : ''}.`,
+        `${eps.length} endpoint(s) matched${eps.length > shown.length ? `, showing ${shown.length}` : ''}. Inventory: ${stats.declaredRoutes} declaration(s); ${stats.reachableStaticRoutes} statically reachable composed route(s); ${stats.localDeclarations} local/root declaration candidate(s); ${stats.staticMounts} static router mount(s)${stats.truncated ? `; TRUNCATED at ${stats.maxEndpoints}` : ''}.${suppressed ? ` ${suppressionNote}` : ''}`,
         ...shown.map((e) => {
             const via = e.mountChain?.length
                 ? `\n           declared ${e.declaredPath} in ${e.file}${e.line ? `:${e.line}` : ''}; mount chain ${e.mountChain.map((mount) => `${mount.file}:${mount.line} ${mount.path}`).join(' → ')}`
@@ -29,14 +52,20 @@ export function tListEndpoints(g, args, ctx) {
             const activation = e.conditional
                 ? `; conditional default ${e.defaultActive === false ? 'inactive' : e.defaultActive === true ? 'active' : 'unknown'}`
                 : ''
-            return `  ${e.method.toUpperCase().padEnd(6)} ${e.path}${e.handler ? `  → ${e.handler}` : ''}  (${e.file}${e.line ? `:${e.line}` : ''}; ${e.mountState}/${e.confidence}${activation})${via}`
+            const info = classesOf(e.file)
+            const tag = info.classified ? ` [classified${info.pathClasses.length ? `:${info.pathClasses.join('+')}` : ''}]` : ''
+            return `  ${e.method.toUpperCase().padEnd(6)} ${e.path}${e.handler ? `  → ${e.handler}` : ''}  (${e.file}${e.line ? `:${e.line}` : ''}; ${e.mountState}/${e.confidence}${activation})${tag}${via}`
         }),
     ].join('\n')
     return toolResult(text, {
         filters: {method, path},
         stats,
-        endpoints: shown,
+        pathPolicy: includeClassified ? 'all' : 'production-first',
+        suppressed,
+        endpoints: shown.map((e) => {
+            const info = classesOf(e.file)
+            return info.classified ? {...e, classified: true, pathClasses: info.pathClasses} : e
+        }),
         page: {shown: shown.length, total: eps.length, truncated: eps.length > shown.length || stats.truncated},
     }, {completeness: {status: stats.truncated ? 'PARTIAL' : 'COMPLETE', reason: stats.truncated ? `endpoint cap ${stats.maxEndpoints} reached` : 'all indexed code files scanned'}})
 }
-

package/src/mcp/sync/payload-v2.mjs

@@ -19,6 +19,7 @@ export function sanitizeNode(value) {
     if (community !== undefined && Number.isInteger(community) && community >= 0) out.community = community;
     if (typeof value.exported === 'boolean') out.exported = value.exported;
     if (typeof value.decorated === 'boolean') out.decorated = value.decorated;
+    if (value.test_surface === true) out.test_surface = true;
     setIf(out, 'complexity', sanitizeComplexity(value.complexity));
     return out;
 }

package/src/mcp/tools-company.mjs

@@ -231,6 +231,15 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
                     ...screens,
                 ]
             }),
+            // Mismatch-only endpoints rarely rank into top_n (zero callsites), yet they drive the
+            // *_METHOD_MISMATCH verdicts — always surface them, citing the verdict's own total.
+            ...(analysis.totals.methodMismatches > 0 ? [
+                `  Method mismatches (${verdict.methodMismatches} call(s)):`,
+                ...analysis.endpoints.filter((endpoint) => endpoint.methodMismatches > 0).slice(0, 5).flatMap((endpoint) => [
+                    `    ${endpoint.method} ${endpoint.path} — ${endpoint.methodMismatches} call(s) use a different method`,
+                    ...(endpoint.methodMismatchSites || []).slice(0, 2).map((site) => `      caller ${site.clientRepo}:${site.file}:${site.line} uses ${site.method}`),
+                ]),
+            ] : []),
             ...transportAnalysis.contracts.filter((contract) => contract.callsites.length).slice(0, topN).map((contract) =>
                 `  ${contract.transport.toUpperCase()} ${contract.service ? `${contract.service}.` : contract.operation ? `${contract.operation} ` : ''}${contract.name} (${contract.file}:${contract.line}) [${contract.liveness}] → ${contract.callsites.length} callsite(s), ${contract.affected.files.length} affected file(s)`),
             completeness.complete

package/src/mcp/tools-endpoints.mjs

@@ -29,17 +29,47 @@ function endpointCandidates(inventory, args) {
     return exact.length ? exact : eligible.filter((endpoint) => endpoint.path.endsWith(path))
 }
 
-function handlerCandidates(graph, endpoint) {
+// A handler_file hint narrows the FULL same-named pool before any scoring, so it can rescue a
+// candidate the ranking would otherwise collapse away. An exact repo-relative match beats suffix
+// matches; comparison is case-insensitive (Windows paths and human-typed hints disagree on casing).
+function matchesHandlerHint(file, hint) {
+    if (!hint) return true
+    const lower = file.toLowerCase()
+    return lower === hint || lower.endsWith(`/${hint}`)
+}
+
+function handlerCandidates(graph, endpoint, hint = '') {
     if (!endpoint.handler) return []
     const wanted = endpoint.handler.toLowerCase()
     const qualifier = String(endpoint.handlerRef || '').split('.').slice(-2, -1)[0]?.toLowerCase() || ''
     const routeDir = posix.dirname(endpoint.file)
-    const scored = (graph.nodes || [])
+    // File-level import/re-export bindings at the route file break same-name ties between otherwise
+    // unranked candidates. The bonus deliberately sits BELOW same-directory proximity (+40): a
+    // file-level edge proves coupling, not symbol identity, and must never outrank the conventional
+    // same-package/same-dir handler (Go same-package files have no import edge at all).
+    const importBound = new Set()
+    for (const edge of graph.out.get(endpoint.file) || []) {
+        if (edge.relation !== 'imports' && edge.relation !== 're_exports') continue
+        if (edge.typeOnly === true || edge.barrelProxy === true) continue
+        const targetId = String(edge.id)
+        if (targetId.includes('#')) continue
+        const target = graph.byId.get(targetId)
+        importBound.add(String(target?.source_file || targetId).replace(/\\/g, '/'))
+    }
+    let pool = (graph.nodes || [])
         .filter((node) => String(node.id).includes('#') && node.source_file && symbolName(node).toLowerCase() === wanted)
+    if (hint) {
+        pool = pool.filter((node) => matchesHandlerHint(String(node.source_file).replace(/\\/g, '/').toLowerCase(), hint))
+        const exact = pool.filter((node) => String(node.source_file).replace(/\\/g, '/').toLowerCase() === hint)
+        if (exact.length) pool = exact
+    }
+    const scored = pool
         .map((node) => {
             const file = String(node.source_file).replace(/\\/g, '/')
             let score = 0
+            const importBoundAtRoute = importBound.has(file)
             if (file === endpoint.file) score += 100
+            if (importBoundAtRoute) score += 35
             if (posix.dirname(file) === routeDir) score += 40
             if (file.startsWith(`${routeDir}/`)) score += 15
             if (qualifier) {
@@ -48,16 +78,15 @@ function handlerCandidates(graph, endpoint) {
             }
             const line = symbolLine(node)
             if (file === endpoint.file && line >= endpoint.line && line - endpoint.line <= 250) score += 20
-            return {node, score}
+            return {node, score, importBoundAtRoute}
         })
         .sort((a, b) => b.score - a.score || String(a.node.id).localeCompare(String(b.node.id)))
     if (!scored.length) return []
     const best = scored[0].score
-    return scored.filter((item) => item.score === best).map((item) => item.node)
+    return scored.filter((item) => item.score === best).map(({node, importBoundAtRoute}) => ({node, importBoundAtRoute}))
 }
 
-function traceCalls(graph, start, {maxDepth, maxNodes, includeClassified, repoRoot}) {
-    const classifier = createPathClassifier(repoRoot)
+function traceCalls(graph, start, {maxDepth, maxNodes, includeClassified, classifier}) {
     const allowed = (node) => {
         if (!node?.source_file) return false
         if (includeClassified) return true
@@ -125,12 +154,25 @@ export function tTraceEndpoint(graph, args, ctx) {
         completeness: {status: 'PARTIAL', reason: 'ambiguous endpoint'},
     })
     const endpoint = candidates[0]
-    const handlers = handlerCandidates(graph, endpoint)
+    const classifier = createPathClassifier(ctx.repoRoot)
+    const classify = (file) => {
+        const info = classifier.explain(file, {content: ''})
+        return {classified: info.excluded || NON_PRODUCT.some((name) => hasPathClass(info, name)), pathClasses: info.classes}
+    }
+    const hint = String(args.handler_file || '').trim().replace(/\\/g, '/').replace(/^\.\//, '').toLowerCase()
+    let handlers = handlerCandidates(graph, endpoint, hint)
+        .map((item) => ({...item, ...classify(String(item.node.source_file).replace(/\\/g, '/'))}))
+    // Production-first: a classified twin (tests/mocks/…) never ties with a production candidate,
+    // but an all-classified candidate set is kept rather than emptied.
+    if (args.include_classified !== true && handlers.some((item) => !item.classified)) {
+        handlers = handlers.filter((item) => !item.classified)
+    }
     if (handlers.length !== 1) return toolResult([
-        `Endpoint resolved, but its handler symbol is ${handlers.length ? 'ambiguous' : 'not present in the graph'}:`,
+        `Endpoint resolved, but its handler symbol is ${handlers.length ? 'ambiguous' : `not present in the graph${hint ? ` (no candidate matched handler_file "${hint}")` : ''}`}:`,
         `  ${endpointLine(endpoint)}`,
-        ...handlers.slice(0, 12).map((node) => `  candidate ${node.label || node.id} (${node.source_file}:${symbolLine(node) || '?'}) [${node.id}]`),
-    ].join('\n'), {status: handlers.length ? 'AMBIGUOUS_HANDLER' : 'HANDLER_NOT_FOUND', endpoint, handlers}, {
+        ...handlers.slice(0, 12).map(({node, importBoundAtRoute, pathClasses}) => `  candidate ${node.label || node.id} (${node.source_file}:${symbolLine(node) || '?'}; import-bound at route: ${importBoundAtRoute ? 'yes' : 'no'}${pathClasses.length ? `; classified:${pathClasses.join('+')}` : ''}) [${node.id}]`),
+        ...(handlers.length > 1 ? ['  Next: pass handler_file with the repo-relative path (or an unambiguous path suffix) of the file that declares the intended handler.'] : []),
+    ].join('\n'), {status: handlers.length ? 'AMBIGUOUS_HANDLER' : 'HANDLER_NOT_FOUND', endpoint, handlers: handlers.map(({node, importBoundAtRoute, pathClasses}) => ({...node, importBoundAtRoute, pathClasses}))}, {
         completeness: {status: 'PARTIAL', reason: handlers.length ? 'ambiguous handler symbol' : 'handler symbol not found'},
     })
 
@@ -138,9 +180,9 @@ export function tTraceEndpoint(graph, args, ctx) {
     const maxNodes = Math.max(2, Math.min(40, Number(args.max_nodes) || 20))
     const contextLines = Math.max(0, Math.min(6, Number(args.context_lines) || 2))
     const maxExcerpts = Math.max(0, Math.min(12, Number(args.max_excerpts) || 6))
-    const handler = handlers[0]
+    const handler = handlers[0].node
     const traced = traceCalls(graph, handler, {
-        maxDepth, maxNodes, includeClassified: args.include_classified === true, repoRoot: ctx.repoRoot,
+        maxDepth, maxNodes, includeClassified: args.include_classified === true, classifier,
     })
     const excerpts = traced.edges.slice(0, maxExcerpts).map((edge) => {
         const source = graph.byId.get(edge.from)