weavatrix 1.17.7 → 1.17.9

package/README.md

@@ -12,7 +12,7 @@
 Weavatrix answers the questions agents otherwise invent: what breaks if this
 file changes, who consumes this n8n field, whether an MCP schema still
 accepts yesterday’s request, which viem call sites follow an ABI layout
-change, and whether `.weavatrix/architecture.json` still holds. **64
+change, and whether `.weavatrix/architecture.json` still holds. **65
 read-only operations**, one revision-bound graph, no LSP and no prompt pack.
 
 Codex, Claude Code, Cursor, and Grok get impact, architecture, APIs, Git
@@ -28,7 +28,7 @@ It does not answer from a larger grep or an invented confidence score. Every
 bounded result can carry the repository revision, file, line, extractor,
 evidence kind, and confidence that produced it. `search_code` keeps a
 resident content index for the process: the first search builds it, and
-later searches read it. A `glob` still walks files.
+later searches read it. A `glob` filters that index. The filesystem is scanned only when the widened search is truncated and the filter kept fewer hits than requested.
 
 This npm package is the convenient **prebuilt native tarball**. That is the
 only reason it exists on npm. It is not a TypeScript rewrite, not a Serena
@@ -60,7 +60,7 @@ weavatrix mcp .
 ```toml
 [mcp_servers.weavatrix]
 command = "npx"
-args = ["-y", "weavatrix@1.17.7", "mcp", "."]
+args = ["-y", "weavatrix@1.17.9", "mcp", "."]
 ```
 
 Pass an absolute repository path when the Codex process cwd is not the project
@@ -69,7 +69,7 @@ you intend to analyze.
 ### Claude Code
 
 ```sh
-claude mcp add weavatrix -- npx -y weavatrix@1.17.7 mcp .
+claude mcp add weavatrix -- npx -y weavatrix@1.17.9 mcp .
 ```
 
 ### Cursor
@@ -82,7 +82,7 @@ the plugin for the same server name:
   "mcpServers": {
     "weavatrix": {
       "command": "npx",
-      "args": ["-y", "weavatrix@1.17.7", "mcp", "${workspaceFolder}", "--output-format=structured"]
+      "args": ["-y", "weavatrix@1.17.9", "mcp", "${workspaceFolder}", "--output-format=structured"]
     }
   }
 }
@@ -91,14 +91,14 @@ the plugin for the same server name:
 Profiles expose bounded views of the same engine:
 
 ```sh
-npx -y weavatrix@1.17.7 mcp . --profile=all
-npx -y weavatrix@1.17.7 mcp . --profile=code
-npx -y weavatrix@1.17.7 mcp . --profile=seo
-npx -y weavatrix@1.17.7 mcp . --profile=n8n
-npx -y weavatrix@1.17.7 mcp . --profile=dify
-npx -y weavatrix@1.17.7 mcp . --profile=agent
-npx -y weavatrix@1.17.7 mcp . --profile=diagram
-npx -y weavatrix@1.17.7 mcp . --profile=web3
+npx -y weavatrix@1.17.9 mcp . --profile=all
+npx -y weavatrix@1.17.9 mcp . --profile=code
+npx -y weavatrix@1.17.9 mcp . --profile=seo
+npx -y weavatrix@1.17.9 mcp . --profile=n8n
+npx -y weavatrix@1.17.9 mcp . --profile=dify
+npx -y weavatrix@1.17.9 mcp . --profile=agent
+npx -y weavatrix@1.17.9 mcp . --profile=diagram
+npx -y weavatrix@1.17.9 mcp . --profile=web3
 ```
 
 The package contains native binaries for Windows x64/arm64, macOS x64/arm64,
@@ -233,7 +233,7 @@ Three commits before `ec8bf30` this package was 1.9.2; the agent reads that
 follow-up to a diff without touching the worktree. Binary blobs fail closed
 instead of being decoded into garbage.
 
-## The 64 read-only operations
+## The 65 read-only operations
 
 | Workflow | Operations |
 | --- | --- |
@@ -243,7 +243,7 @@ instead of being decoded into garbage.
 | Health and quality | `find_duplicates`, `find_dead_code`, `run_audit`, `coverage_map`, `hot_path_review`, `perf_attribution` |
 | APIs and transports | `list_endpoints`, `trace_endpoint`, `trace_api_contract` |
 | Architecture | `architecture_inventory`, `get_architecture_contract`, `verify_architecture`, `verify_capabilities`, `explain_architecture_violation`, `propose_architecture_exception` |
-| Local CI | `ci_restrictions`, `explain_restriction` |
+| Local CI | `ci_restrictions`, `ci_protection`, `explain_restriction` |
 | Git and repositories | `git_history`, `git_read_blob`, `cross_repo_git`, `open_repo`, `list_known_repos`, `rebuild_graph` |
 | Native extensions | `semantic_link` |
 | n8n workflows | `n8n_inventory`, `n8n_trace`, `n8n_context` |
@@ -329,12 +329,12 @@ coding agent
     |
     | MCP over stdio
     v
-weavatrix 1.17.7
+weavatrix 1.17.9
     profile catalog · refresh · watcher · MCP framing
     |
     v
-weavatrix-rust 2.17.7
-    typed graph · analysis · 64 product operations including local CI, n8n, Dify, agent packages, Mermaid, and Web3
+weavatrix-rust 2.17.9
+    typed graph · analysis · 65 product operations including local CI, n8n, Dify, agent packages, Mermaid, and Web3
 ```
 
 This npm product owns MCP transport and native distribution. The

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "weavatrix",
-  "version": "1.17.7",
-  "weavatrixEngineVersion": "2.17.7",
-  "description": "Native repository intelligence for coding agents: 64 read-only MCP operations backed by typed evidence graphs, impact, architecture, local CI restrictions, APIs, Git, search, semantic links, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
+  "version": "1.17.9",
+  "weavatrixEngineVersion": "2.17.9",
+  "description": "Native repository intelligence for coding agents: 65 read-only MCP operations backed by typed evidence graphs, impact, architecture, local CI restrictions, APIs, Git, search, semantic links, n8n workflows, Dify apps, agent packages, Mermaid diagrams, and Web3 ABIs.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
   "license": "MIT",
   "homepage": "https://weavatrix.com",

package/server.json

@@ -2,19 +2,19 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.Weavatrix/weavatrix",
   "title": "Weavatrix",
-  "description": "Native Weavatrix MCP: 64 read-only tools for code, local CI, n8n, Dify, agents, Mermaid, Web3.",
+  "description": "Native Weavatrix MCP: 65 read-only tools for code, local CI, n8n, Dify, agents, Mermaid, Web3.",
   "repository": {
     "url": "https://github.com/Weavatrix/weavatrix",
     "source": "github"
   },
-  "version": "1.17.7",
+  "version": "1.17.9",
   "websiteUrl": "https://weavatrix.com",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "weavatrix",
-      "version": "1.17.7",
+      "version": "1.17.9",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/skill/references/tool-routing.md

@@ -10,9 +10,9 @@ cannot silently switch to another repository. Pass an explicit
 
 ## Graph, source, and orientation
 
-- [`graph_stats`](tools/graph_stats.md) — Graph size, evidence and build freshness.
+- [`graph_stats`](tools/graph_stats.md) — Graph size, edge evidence and build freshness of the loaded snapshot.
 - [`get_node`](tools/get_node.md) — Resolve one exact graph node.
-- [`get_neighbors`](tools/get_neighbors.md) — Direct typed incoming and outgoing relationships.
+- [`get_neighbors`](tools/get_neighbors.md) — Direct typed incoming and outgoing relationships. The seed is compact unless `response_detail` is `full`.
 - [`query_graph`](tools/query_graph.md) — Bounded BFS or DFS around exact or textual seeds.
 - [`god_nodes`](tools/god_nodes.md) — Rank high-connectivity production nodes.
 - [`shortest_path`](tools/shortest_path.md) — Shortest typed dependency path between two nodes.
@@ -20,18 +20,18 @@ cannot silently switch to another repository. Pass an explicit
 - [`list_communities`](tools/list_communities.md) — List deterministic coupling communities (containment and package edges excluded).
 - [`module_map`](tools/module_map.md) — Production folder map at a requested directory depth.
 - [`build_graph`](tools/build_graph.md) — Typed workspace, target, configuration, task, and runner topology from captured manifest evidence.
-- [`search_code`](tools/search_code.md) — Literal or Rust-regex search on the resident content index. A glob still walks files.
+- [`search_code`](tools/search_code.md) — Literal or Rust-regex search on the resident content index. A glob filters that index.
 - [`read_source`](tools/read_source.md) — Bounded source context by node or repository path.
 - [`inspect_symbol`](tools/inspect_symbol.md) — Definition, direct relationships and source evidence.
-- [`go_to_definition`](tools/go_to_definition.md) — Resolve the symbol at a source position to its definition without guessing by name.
-- [`find_references`](tools/find_references.md) — Occurrences of the symbol at a position or label, from the graph and an on-disk SCIP index if present.
+- [`go_to_definition`](tools/go_to_definition.md) — Resolve the symbol at a source position to its definition without guessing by name. An unresolved position omits definition.
+- [`find_references`](tools/find_references.md) — Occurrences of the symbol at a position or label, from the graph and an on-disk SCIP index if present. Test and classified rows stay out unless opted in.
 - [`context_bundle`](tools/context_bundle.md) — Compact graph and source bundle for one symbol.
 - [`map_stacktrace`](tools/map_stacktrace.md) — Map stack-trace text onto repository files and symbols.
 
 ## Change impact and Git
 
 - [`get_dependents`](tools/get_dependents.md) — Bounded transitive reverse blast radius.
-- [`change_impact`](tools/change_impact.md) — Read-only Git change impact with graph evidence.
+- [`change_impact`](tools/change_impact.md) — Read-only Git change impact with graph evidence. Impacted nodes are id, label, kind, language, and span.
 - [`select_tests`](tools/select_tests.md) — Select the test suites a change most plausibly needs to run.
 - [`git_history`](tools/git_history.md) — Bounded direct Git history without launching git.
 - [`git_read_blob`](tools/git_read_blob.md) — Bounded UTF-8 file content at an immutable Git revision or blob OID; binary blobs are refused.
@@ -43,10 +43,11 @@ cannot silently switch to another repository. Pass an explicit
 
 - [`architecture_inventory`](tools/architecture_inventory.md) — Bounded architecture overview and evidence-bounded style hypotheses by default, with complete edge/cycle-candidate totals; `detail:"full"` gives paged evidence. Explain statuses and witnesses in prose, not as a JSON dump.
 - [`ci_restrictions`](tools/ci_restrictions.md) — Local GitHub Actions checks and conditional applicability.
+- [`ci_protection`](tools/ci_protection.md) — Candidate checks and declared rule bindings for an explicit file list. Membership ids in the answer are path labels. Not included in change or diff answers.
 - [`explain_restriction`](tools/explain_restriction.md) — One restriction and its evidence limits.
-- [`find_duplicates`](tools/find_duplicates.md) — Deterministic Type-1/2/3 clone families.
-- [`find_dead_code`](tools/find_dead_code.md) — Conservative unreferenced-symbol review queue.
-- [`run_audit`](tools/run_audit.md) — Repository structure and evidence completeness audit.
+- [`find_duplicates`](tools/find_duplicates.md) — Deterministic Type-1/2/3 clone families. `.gen.` and `.generated.` files stay out unless `include_boilerplate` is set.
+- [`find_dead_code`](tools/find_dead_code.md) — Conservative unreferenced-symbol review queue. A type-only import does not keep its target live.
+- [`run_audit`](tools/run_audit.md) — Repository structure and evidence completeness audit. A named category collects only that section.
 - [`coverage_map`](tools/coverage_map.md) — Ingest a report Quality already built. Does not run tests. Missing report is unmeasured, not 0%.
 - [`hot_path_review`](tools/hot_path_review.md) — Rank functions by static complexity times resolved call fan-in.
 - [`perf_attribution`](tools/perf_attribution.md) — Correlate a measurement series with the declarations that changed between the revisions that produced it.
@@ -59,7 +60,7 @@ cannot silently switch to another repository. Pass an explicit
 
 ## APIs and transports
 
-- [`list_endpoints`](tools/list_endpoints.md) — Inventory statically extracted HTTP endpoints, including hand-rolled req.method/pathname conditions.
+- [`list_endpoints`](tools/list_endpoints.md) — Compact HTTP endpoint inventory. `max_results` pages it and reports `endpoints_total`.
 - [`trace_endpoint`](tools/trace_endpoint.md) — Resolve an endpoint and its bounded call neighborhood.
 - [`trace_api_contract`](tools/trace_api_contract.md) — Cross-repository HTTP, GraphQL, gRPC and event-transport contract evidence for named backend and client roots.
 
@@ -71,7 +72,7 @@ cannot silently switch to another repository. Pass an explicit
 
 ## Semantic link
 
-- [`semantic_link`](tools/semantic_link.md) — Rank a text query with the local token hash `weavatrix-token-hash-v1`, or link a non-empty caller-supplied vectors array. Nearest-neighbor search, SEO page links, and the event journal are library crates, not MCP tools.
+- [`semantic_link`](tools/semantic_link.md) — Rank a text query with `weavatrix-token-hash-v1` (name, path, doc comment, declaration, short body; test paths rank lower), or link a non-empty caller-supplied vectors array. Nearest-neighbor search, SEO page links, and the event journal are library crates, not MCP tools.
 
 ## n8n workflows
 

package/skill/references/tools/change_impact.md

@@ -4,7 +4,7 @@ Read-only Git change impact with graph evidence.
 
 ## When to use
 
-Map a working-tree diff, explicit files, or Git revisions onto affected graph nodes. Naming `files` or `target` when that file matches HEAD still returns its symbols as `change: "file_scope"` and `change_basis: "explicit_file"`. That is a hypothetical blast radius, not a measured edit. A dirty file keeps the real symbol diff. `status` stays COMPLETE when the tool ran. Read `evidence_completeness` and `stop_reason`. `MAX_NODES` means the combined cap omitted nodes.
+Map a working-tree diff, explicit files, or Git revisions onto affected graph nodes. Naming `files` or `target` when that file matches HEAD still returns its symbols as `change: "file_scope"` and `change_basis: "explicit_file"`. That is a hypothetical blast radius, not a measured edit. A dirty file keeps the real symbol diff. `status` stays COMPLETE when the tool ran. Read `evidence_completeness` and `stop_reason`. `MAX_NODES` means the combined cap omitted nodes. Impacted nodes are id, label, kind, language, and span.
 
 Static impact is not proof that selected behavior executed.
 

package/skill/references/tools/ci_protection.md

@@ -0,0 +1,30 @@
+# `ci_protection`
+
+Bind an explicit file list to local CI checks and declared architecture rules.
+It does not run a workflow, read the git diff, or ride along on `change_impact`,
+`graph_diff`, `verified_change`, or `prepare_change`.
+
+## When to use
+
+After you already know the paths, ask which configured checks and declared
+rules are candidates for those paths. For the full restriction inventory,
+call `ci_restrictions`. For one finding, call `explain_restriction`.
+
+## Inputs
+
+- `files` (required): repository paths. The call does not discover them.
+- `output_format` and `expected_repository`: common MCP arguments.
+
+## Minimal call
+
+```json
+{"name":"ci_protection","arguments":{"files":["src/lib.rs"],"output_format":"structured"}}
+```
+
+`candidate_checks` and `declared_rule_bindings` are static candidates.
+Component and build membership in the answer are path labels
+(`component:directory:src/api`, `test:architecture`, `Cargo.toml`), not
+repository hashes. `restrictions_unresolved` returns at most 20 strings and
+`restrictions_unresolved_total` is the full count. Execution, path filters,
+and remote enforcement are not proven. The live MCP `tools/list` schema is
+authoritative.

package/skill/references/tools/find_dead_code.md

@@ -4,7 +4,7 @@ Conservative unreferenced-symbol review queue.
 
 ## When to use
 
-Build a conservative dead-code review queue. Every `main.go` and every Go `func main` is an entry, so `main` itself is reachable. Receiver names and function-literal parameters are not symbols. Exported symbols with no callers stay at confidence 50; private ones at 85. `REVIEW_ONLY` means the queue is a review list.
+Build a conservative dead-code review queue. Every `main.go` and every Go `func main` is an entry, so `main` itself is reachable. Receiver names and function-literal parameters are not symbols. Exported symbols with no callers stay at confidence 50; private ones at 85. `REVIEW_ONLY` means the queue is a review list. Each candidate is id, label, kind, language, and span. A type-only import does not keep its target live.
 
 Never delete from this result alone; confirm source and framework registration points.
 

package/skill/references/tools/find_duplicates.md

@@ -4,7 +4,7 @@ Deterministic Type-1/2/3 clone families.
 
 ## When to use
 
-Review bounded Type-1, Type-2, or Type-3 clone families before confirming candidates in source.
+Review bounded Type-1, Type-2, or Type-3 clone families before confirming candidates in source. Files named `.gen.` or `.generated.` stay out unless `include_boilerplate` is set.
 
 ## Inputs
 

package/skill/references/tools/find_references.md

@@ -5,7 +5,7 @@ Occurrences of the symbol at a position or label, from the graph and an on-disk
 ## When to use
 
 List every recorded occurrence of one symbol after you have a label or a pinned
-`(path, line, column)` usage.
+`(path, line, column)` usage. Test and classified rows stay out unless `include_tests` or `include_classified` is set. The definition row stays.
 
 ## Inputs
 

package/skill/references/tools/get_neighbors.md

@@ -4,7 +4,7 @@ Direct typed incoming and outgoing relationships.
 
 ## When to use
 
-Inspect only the direct typed incoming and outgoing relationships of one exact node.
+Inspect only the direct typed incoming and outgoing relationships of one exact node. The seed is id, label, kind, language, and span unless `response_detail` is `full`. Test and classified neighbors stay out unless `include_tests` or `include_classified` is set.
 
 For transitive reverse impact use `get_dependents`; for bounded multi-hop exploration use `query_graph`.
 

package/skill/references/tools/go_to_definition.md

@@ -5,7 +5,7 @@ Resolve the symbol at a source position to its definition without guessing by na
 ## When to use
 
 You already have `(path, line, column)` for a usage and need the definition the
-graph recorded for that occurrence - not a same-named overload elsewhere.
+graph recorded for that occurrence - not a same-named overload elsewhere. An unresolved position omits `definition`.
 
 ## Inputs
 

package/skill/references/tools/graph_stats.md

@@ -1,6 +1,6 @@
 # `graph_stats`
 
-Graph size, evidence and build freshness.
+Graph size, evidence and build freshness. `evidence` counts edges, not a percentage; `evidence_share` is that split. `freshness.state` `CURRENT` means the loaded snapshot, not a new disk walk.
 
 ## When to use
 

package/skill/references/tools/list_endpoints.md

@@ -4,7 +4,7 @@ Inventory statically extracted HTTP endpoints.
 
 ## When to use
 
-Inventory statically extracted HTTP endpoints with optional method and path filters.
+Inventory statically extracted HTTP endpoints with optional method and path filters. Each row is a compact node: id, label, kind, language, and span. `max_results` pages that list and the answer reports `endpoints_total`; omit it to return every visible endpoint.
 
 ## Inputs
 

package/skill/references/tools/run_audit.md

@@ -4,7 +4,7 @@ Repository structure and evidence completeness audit.
 
 ## When to use
 
-Run a broad repository health and evidence-completeness pass before targeted investigation.
+Run a broad repository health and evidence-completeness pass before targeted investigation. A named category collects only that section. At least 200 parsed edges with resolved edges under one fifth of that is REVIEW.
 
 ## Inputs
 

package/skill/references/tools/search_code.md

@@ -4,7 +4,7 @@ Literal or Rust-regex repository search without ripgrep.
 
 ## When to use
 
-Find bounded literal or regular-expression matches in file text when the source text is known but its location is not. The process keeps a resident content index: the first search builds it and later searches read it (`backend` `liveindex`). A `glob` still walks the filesystem. This is not a symbol-graph search. Use `find_references` or `go_to_definition` for a symbol.
+Find bounded literal or regular-expression matches in file text when the source text is known but its location is not. The process keeps a resident content index: the first search builds it and later searches read it (`backend` `liveindex`). A `glob` filters that index. The filesystem is scanned only when the widened search is truncated and the filter kept fewer hits than requested. This is not a symbol-graph search. Use `find_references` or `go_to_definition` for a symbol.
 
 ## Inputs
 

package/skill/references/tools/semantic_link.md

@@ -4,7 +4,7 @@ Rank symbols for a phrase, or link caller-supplied vectors.
 
 ## When to use
 
-Pass `query` to rank functions, methods, and types by the local deterministic token hash `weavatrix-token-hash-v1` (name, path, and the declaration line). That hash is not a neural embedding, and Weavatrix does not create one.
+Pass `query` to rank functions, methods, and types by the local deterministic token hash `weavatrix-token-hash-v1` (name, path, a short doc comment above the declaration, the declaration line, and a short body). Test paths rank lower. That hash is not a neural embedding, and Weavatrix does not create one.
 
 Pass a non-empty `vectors` array only when you already have embeddings. An empty `vectors` array without `query` is an error and builds no links. When both are set, the supplied vectors are linked and the phrase is not ranked.