weavatrix 1.10.0 → 1.11.1

package/README.md

@@ -10,7 +10,7 @@
 **Give your coding agent repository evidence before it starts guessing.**
 
 Weavatrix is the native MCP product for repository intelligence. It gives
-Codex, Claude Code, and other coding agents 44 read-only operations over one
+Codex, Claude Code, and other coding agents 47 read-only operations over one
 revision-bound evidence graph: impact, architecture, APIs, Git history,
 duplicates, dead code, search, semantic links, and temporal memory.
 
@@ -169,14 +169,14 @@ Three commits before `ec8bf30` this package was 1.9.2; the agent reads that
 follow-up to a diff without touching the worktree. Binary blobs fail closed
 instead of being decoded into garbage.
 
-## The 44 read-only operations
+## The 47 read-only operations
 
 | Workflow | Operations |
 | --- | --- |
 | Graph orientation | `graph_stats`, `get_node`, `get_neighbors`, `query_graph`, `god_nodes`, `shortest_path`, `get_community`, `list_communities`, `module_map`, `build_graph` |
 | Change impact | `get_dependents`, `change_impact`, `select_tests`, `verified_change`, `prepare_change`, `graph_diff` |
-| Exact source context | `search_code`, `read_source`, `inspect_symbol`, `context_bundle`, `map_stacktrace` |
-| Health and quality | `find_duplicates`, `find_dead_code`, `run_audit`, `coverage_map`, `hot_path_review` |
+| Exact source context | `search_code`, `read_source`, `inspect_symbol`, `go_to_definition`, `find_references`, `context_bundle`, `map_stacktrace` |
+| Health and quality | `find_duplicates`, `find_dead_code`, `run_audit`, `coverage_map`, `hot_path_review`, `perf_attribution` |
 | APIs and transports | `list_endpoints`, `trace_endpoint`, `trace_api_contract` |
 | Architecture | `get_architecture_contract`, `verify_architecture`, `verify_capabilities`, `explain_architecture_violation`, `propose_architecture_exception` |
 | Git and repositories | `git_history`, `git_read_blob`, `cross_repo_git`, `open_repo`, `list_known_repos`, `rebuild_graph` |
@@ -205,12 +205,12 @@ coding agent
     |
     | MCP over stdio
     v
-weavatrix 1.10.0
+weavatrix 1.11.1
     profile catalog · refresh · watcher · MCP framing
     |
     v
-weavatrix-rust 2.9.0
-    typed graph · analysis · 44 read-only operations
+weavatrix-rust 2.10.0
+    typed graph · analysis · 47 read-only operations
 ```
 
 This npm product owns MCP transport and native distribution. The

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "weavatrix",
-  "version": "1.10.0",
-  "weavatrixEngineVersion": "2.9.0",
-  "description": "Native repository intelligence for coding agents: 44 read-only MCP operations backed by typed evidence graphs, impact, architecture, APIs, Git, search, semantics, and memory.",
+  "version": "1.11.1",
+  "weavatrixEngineVersion": "2.10.0",
+  "description": "Native repository intelligence for coding agents: 47 read-only MCP operations backed by typed evidence graphs, impact, architecture, APIs, Git, search, semantics, and memory.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
   "license": "MIT",
   "homepage": "https://weavatrix.com",

package/server.json

@@ -2,19 +2,19 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.Weavatrix/weavatrix",
   "title": "Weavatrix",
-  "description": "Native Weavatrix MCP: 44 read-only repository tools across 24 code and configuration surfaces.",
+  "description": "Native Weavatrix MCP: 47 read-only repository tools across 24 code and configuration surfaces.",
   "repository": {
     "url": "https://github.com/Weavatrix/weavatrix",
     "source": "github"
   },
-  "version": "1.10.0",
+  "version": "1.11.1",
   "websiteUrl": "https://weavatrix.com",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "weavatrix",
-      "version": "1.10.0",
+      "version": "1.11.1",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/skill/SKILL.md

@@ -17,15 +17,21 @@ contracts. Do not call it merely because the server is available.
 
 ## Minimal workflow
 
-1. Call `graph_stats` to confirm the active repository and graph revision.
+1. Call `graph_stats` and confirm `repository_context.root` matches the workspace
+   you intend. The MCP process is pinned to its launch root; it will not silently
+   answer for another repository.
 2. Use `module_map` for orientation or `search_code` for a known literal.
-3. Pin decisive evidence with `inspect_symbol`, `context_bundle`, or
-   `read_source`.
+3. Pin decisive evidence with `inspect_symbol`, `go_to_definition`,
+   `find_references`, `context_bundle`, or `read_source`.
 4. Expand only when needed: `get_dependents` or `change_impact` for risk,
    `trace_endpoint` or `trace_api_contract` for runtime contracts,
    `verify_architecture` for policy, and `run_audit` for a broad health pass.
 5. Use repository-native tests or benchmarks for behavioral proof.
 
+Do not call `open_repo` "just in case". Cross-repository tools take explicit
+roots in their arguments. Multi-root retarget requires launching with
+`--allow-retarget`.
+
 Prefer `output_format:"text"` and a small `token_budget` for conversational
 work. Use JSON only for automation or retained evidence. Call `rebuild_graph`
 only when the repository changed before automatic refresh completed or when

package/skill/references/tool-routing.md

@@ -3,8 +3,10 @@
 Open only the card for the method you are about to call. Each card explains
 when to use the method, its exact published inputs, and a minimal compact call.
 The live MCP `tools/list` schema is authoritative. Every answer carries
-`repository_context` (root, scan revision, Git HEAD, graph age); pass
-`expected_repository` to fail fast when the active repository differs.
+`repository_context` (root, scan revision, Git HEAD, graph age). The process
+pins its launch root and injects `expected_repository` when omitted, so answers
+cannot silently switch to another repository. Pass an explicit
+`expected_repository` to fail fast when you already know the intended folder.
 
 ## Graph, source, and orientation
 
@@ -21,6 +23,8 @@ The live MCP `tools/list` schema is authoritative. Every answer carries
 - [`search_code`](tools/search_code.md) — Literal or Rust-regex repository search without ripgrep.
 - [`read_source`](tools/read_source.md) — Bounded source context by node or repository path.
 - [`inspect_symbol`](tools/inspect_symbol.md) — Definition, direct relationships and source evidence.
+- [`go_to_definition`](tools/go_to_definition.md) — Resolve the symbol at a source position to its definition without guessing by name.
+- [`find_references`](tools/find_references.md) — Occurrences of the symbol at a position or label, from the graph and an on-disk SCIP index if present.
 - [`context_bundle`](tools/context_bundle.md) — Compact graph and source bundle for one symbol.
 - [`map_stacktrace`](tools/map_stacktrace.md) — Map stack-trace text onto repository files and symbols.
 
@@ -42,6 +46,7 @@ The live MCP `tools/list` schema is authoritative. Every answer carries
 - [`run_audit`](tools/run_audit.md) — Repository structure and evidence completeness audit.
 - [`coverage_map`](tools/coverage_map.md) — Measured coverage discovery or explicit static reachability.
 - [`hot_path_review`](tools/hot_path_review.md) — Rank functions by static complexity times resolved call fan-in.
+- [`perf_attribution`](tools/perf_attribution.md) — Correlate a measurement series with the declarations that changed between the revisions that produced it.
 - [`get_architecture_contract`](tools/get_architecture_contract.md) — Read or preview the local target-architecture contract.
 - [`prepare_change`](tools/prepare_change.md) — Select architecture rules for intended changed files.
 - [`verify_architecture`](tools/verify_architecture.md) — Verify graph dependencies against the active contract.
@@ -57,7 +62,7 @@ The live MCP `tools/list` schema is authoritative. Every answer carries
 
 ## Repositories and refresh
 
-- [`open_repo`](tools/open_repo.md) — Retarget to another local repository. Graphs unused for 20 minutes unload; asking for one again rescans that folder.
+- [`open_repo`](tools/open_repo.md) — Retarget to another local repository. Default launches refuse this unless started with `--allow-retarget`. Graphs unused for 20 minutes unload; asking for one again rescans that folder.
 - [`list_known_repos`](tools/list_known_repos.md) — List repositories with an in-process graph.
 - [`rebuild_graph`](tools/rebuild_graph.md) — Rebuild the derived in-memory graph without source writes.
 

package/skill/references/tools/find_references.md

@@ -0,0 +1,36 @@
+# `find_references`
+
+Occurrences of the symbol at a position or label, from the graph and an on-disk SCIP index if present.
+
+## When to use
+
+List every recorded occurrence of one symbol after you have a label or a pinned
+`(path, line, column)` usage.
+
+## Inputs
+
+- `label` (string) — exact node label; mutually exclusive with a full position.
+- `path` (string) — repository-relative file when resolving by position.
+- `line` (integer, min 1) — 1-based line when resolving by position.
+- `column` (integer, min 1) — 1-based column when resolving by position.
+- `scip_path` (string) — optional on-disk SCIP index; never spawned.
+- `max_results` (integer, min 1).
+- `cursor` (string).
+- `output_format` ("text" | "json" | "structured", default "json") — text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is safe only where the client reads structuredContent.
+
+## Minimal call
+
+```json
+{
+  "name": "find_references",
+  "arguments": {
+    "path": "src/main.rs",
+    "line": 42,
+    "column": 12,
+    "output_format": "text"
+  }
+}
+```
+
+Requires `label` or a complete position. The live MCP `tools/list` schema
+remains authoritative for this installed version.

package/skill/references/tools/go_to_definition.md

@@ -0,0 +1,34 @@
+# `go_to_definition`
+
+Resolve the symbol at a source position to its definition without guessing by name.
+
+## When to use
+
+You already have `(path, line, column)` for a usage and need the definition the
+graph recorded for that occurrence - not a same-named overload elsewhere.
+
+## Inputs
+
+- `path` (string, required) — repository-relative file.
+- `line` (integer, required, min 1) — 1-based line of the usage.
+- `column` (integer, required, min 1) — 1-based column of the usage.
+- `scip_path` (string) — optional on-disk SCIP index; never spawned.
+- `output_format` ("text" | "json" | "structured", default "json") — text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is safe only where the client reads structuredContent.
+
+## Minimal call
+
+```json
+{
+  "name": "go_to_definition",
+  "arguments": {
+    "path": "src/main.rs",
+    "line": 42,
+    "column": 12,
+    "output_format": "text"
+  }
+}
+```
+
+Unresolved positions stay `UNRESOLVED`; a unique repository name is not a
+definition. The live MCP `tools/list` schema remains authoritative for this
+installed version.

package/skill/references/tools/perf_attribution.md

@@ -0,0 +1,39 @@
+# `perf_attribution`
+
+Correlate a measurement series with the declarations that changed between the revisions that produced it.
+
+## When to use
+
+You already have a harness table of measurements per Git revision and want
+co-occurrence with structural change - not a profiler sample.
+
+## Inputs
+
+- `measurements_file` (string, required) — repository-relative TSV/CSV the harness wrote; `#` comment rows are ignored.
+- `metric` (string, required) — column with the measured number.
+- `revision_column` (string, default `"commit"`) — column with the Git revision.
+- `direction` ("lower_is_better" | "higher_is_better", default `"lower_is_better"`).
+- `max_revisions` (integer, min 2).
+- `min_delta_percent` (integer, min 0).
+- `top_n` (integer, min 0).
+- `path` (string).
+- `include_tests` (boolean).
+- `include_classified` (boolean).
+- `output_format` ("text" | "json" | "structured", default "json") — text returns the concise text block only; json returns structured output and mirrors it into text for clients that read only content; structured drops that mirror, which is the larger copy, and is safe only where the client reads structuredContent.
+
+## Minimal call
+
+```json
+{
+  "name": "perf_attribution",
+  "arguments": {
+    "measurements_file": "bench/results.tsv",
+    "metric": "ns_per_op",
+    "output_format": "text"
+  }
+}
+```
+
+This is co-occurrence between caller measurements and static change, not CPU
+profiler attribution. The live MCP `tools/list` schema remains authoritative
+for this installed version.