weavatrix 1.11.0 → 1.11.1

package/README.md

@@ -205,7 +205,7 @@ coding agent
     |
     | MCP over stdio
     v
-weavatrix 1.11.0
+weavatrix 1.11.1
     profile catalog · refresh · watcher · MCP framing
     |
     v

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "weavatrixEngineVersion": "2.10.0",
   "description": "Native repository intelligence for coding agents: 47 read-only MCP operations backed by typed evidence graphs, impact, architecture, APIs, Git, search, semantics, and memory.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",

package/server.json

@@ -7,14 +7,14 @@
     "url": "https://github.com/Weavatrix/weavatrix",
     "source": "github"
   },
-  "version": "1.11.0",
+  "version": "1.11.1",
   "websiteUrl": "https://weavatrix.com",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "weavatrix",
-      "version": "1.11.0",
+      "version": "1.11.1",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/skill/SKILL.md

@@ -17,7 +17,9 @@ contracts. Do not call it merely because the server is available.
 
 ## Minimal workflow
 
-1. Call `graph_stats` to confirm the active repository and graph revision.
+1. Call `graph_stats` and confirm `repository_context.root` matches the workspace
+   you intend. The MCP process is pinned to its launch root; it will not silently
+   answer for another repository.
 2. Use `module_map` for orientation or `search_code` for a known literal.
 3. Pin decisive evidence with `inspect_symbol`, `go_to_definition`,
    `find_references`, `context_bundle`, or `read_source`.
@@ -26,6 +28,10 @@ contracts. Do not call it merely because the server is available.
    `verify_architecture` for policy, and `run_audit` for a broad health pass.
 5. Use repository-native tests or benchmarks for behavioral proof.
 
+Do not call `open_repo` "just in case". Cross-repository tools take explicit
+roots in their arguments. Multi-root retarget requires launching with
+`--allow-retarget`.
+
 Prefer `output_format:"text"` and a small `token_budget` for conversational
 work. Use JSON only for automation or retained evidence. Call `rebuild_graph`
 only when the repository changed before automatic refresh completed or when

package/skill/references/tool-routing.md

@@ -3,8 +3,10 @@
 Open only the card for the method you are about to call. Each card explains
 when to use the method, its exact published inputs, and a minimal compact call.
 The live MCP `tools/list` schema is authoritative. Every answer carries
-`repository_context` (root, scan revision, Git HEAD, graph age); pass
-`expected_repository` to fail fast when the active repository differs.
+`repository_context` (root, scan revision, Git HEAD, graph age). The process
+pins its launch root and injects `expected_repository` when omitted, so answers
+cannot silently switch to another repository. Pass an explicit
+`expected_repository` to fail fast when you already know the intended folder.
 
 ## Graph, source, and orientation
 
@@ -60,7 +62,7 @@ The live MCP `tools/list` schema is authoritative. Every answer carries
 
 ## Repositories and refresh
 
-- [`open_repo`](tools/open_repo.md) — Retarget to another local repository. Graphs unused for 20 minutes unload; asking for one again rescans that folder.
+- [`open_repo`](tools/open_repo.md) — Retarget to another local repository. Default launches refuse this unless started with `--allow-retarget`. Graphs unused for 20 minutes unload; asking for one again rescans that folder.
 - [`list_known_repos`](tools/list_known_repos.md) — List repositories with an in-process graph.
 - [`rebuild_graph`](tools/rebuild_graph.md) — Rebuild the derived in-memory graph without source writes.