Weavatrix v1.3.1

Full Changelog: v1.3.0...v1.3.1

Weavatrix v1.2.0

Full Changelog: v1.1.2...v1.2.0

Weavatrix v1.1.2

Full Changelog: v1.1.1...v1.1.2

Weavatrix v1.1.1

Full Changelog: v1.1.0...v1.1.1

Weavatrix v1.1.0

Weavatrix 1.1.0

Weavatrix 1.1.0 makes the canonical weavatrix package the native MCP product while weavatrix-rust 2.0.0 remains the reusable, protocol-independent repository-intelligence engine.

Highlights

• Ships 39 read-only repository-intelligence MCP operations across 24 code, API, infrastructure, configuration, document, and UI-source surfaces.
• Replaces duplicated engine implementation with a focused ports -> application -> adapters -> server boundary over weavatrix-rust.
• Packages the same native CLI and MCP adapter for Cargo and a zero-runtime-dependency npm bundle covering Windows, macOS, and glibc Linux on x64 and arm64.
• Adds synchronized product/engine identity checks, official MCP Registry metadata, provenance verification, and cross-platform native binary validation.
• Expands the README and documentation for installation, tool contracts, supported languages, evidence semantics, architecture, safety, and npm distribution.
• Adds installed-package smoke coverage plus a bounded 1,000-call native short-load gate without relabeling historical competitor measurements as current.

Included commits

• b4cd89b release: ship canonical Weavatrix 1.1.0
• 2e3c8e2 ci: resolve local npm package paths explicitly
• 4f7927a ci: bootstrap weavatrix-git from its verified source
• 31f73d2 ci: verify crates through the Cargo index

Verified distribution

• npm: weavatrix@1.1.0
• Official MCP Registry: io.github.sergii-ziborov/weavatrix 1.1.0
• Cross-platform npm release run

Full comparison: v1.0.0...v1.1.0

v1.0.0

Full Changelog: v0.3.14...v1.0.0

v0.3.14

Weavatrix 0.3.14

0.3.14 is a Repo Lens dogfood hardening release. It keeps the 34-tool,
network-free Core surface while making large JavaScript graphs practical for
UI consumers and reducing production-analysis noise.

Structured results and performance

• find_duplicates and ordinary run_audit results now include bounded
  structured groups/findings alongside their existing text summaries, so MCP
  clients can render native views without parsing prose.
• Local symbol references are indexed once per file and declaration ranges are
  subtracted with binary search instead of rescanning the whole file for every
  symbol. On the 8,117-node Repo Lens graph, aggregation fell from more than
  64 seconds to about 0.93 seconds while preserving graph totals.

Production-first precision

• vendor, vendored, and third-party paths are classified explicitly and
  suppressed consistently across duplicates, audit, endpoints, context,
  architecture, dead-code, hot-path, and graph-query surfaces.
• Electron preload files are treated as entry points only when another source
  contains a bounded BrowserWindow preload: option.
• Endpoint extraction masks JavaScript regex literals and comments correctly
  and recognizes bounded node:http method plus url.pathname guards. Repo
  Lens now reports its four production control routes without comment/test
  false positives in the production view.

Coverage interoperability

• coverage_map reads Cargo Tarpaulin's official JSON report shape, including
  component paths and traces[].stats.Line, and advertises both Tarpaulin JSON
  and cargo llvm-cov LCOV workflows for Rust repositories.

This Core release is paired with weavatrix-refactor 0.1.2 and
weavatrix-online 0.2.0. Each layer keeps its own package, license, version,
and release provenance.

Full Changelog: v0.3.13...v0.3.14

v0.3.13

Weavatrix 0.3.13

0.3.13 fixes two misleading verification and graph-path signals found while
dogfooding a real duplicate-removal refactor. It also bounds cross-repository
contract responses with revision-bound pagination.

Honest refactor verification

• verified_change no longer reports an enabled duplicate ratchet as
  SKIPPED: duplicate ratchet disabled during the planning phase. An enabled
  plan now reports PLANNED, enabled: true, and states that the ratchet runs
  during phase="verify". An explicit duplicate_ratchet: false remains the
  only disabled state.
• shortest_path remains an undirected connectivity query, but every rendered
  hop now preserves the stored graph-edge direction. Reverse traversal renders
  <--imports-- or <--calls-- instead of inventing a forward dependency.
  Repeated and generic file names are widened in both the header and hop lines.

Bounded cross-repository contract evidence

• trace_api_contract response schema v4 returns compact, paginated evidence
  by default. page_size, per_item_limit, and a revision/filter-bound opaque
  cursor keep responses bounded; response_detail="full" remains an explicit
  opt-in and is still paginated.
• Invalid, stale, or cross-query cursors fail closed with INVALID_CURSOR.
• Repository graph reconciliation now reuses a persisted fresh graph before
  invoking a rebuild, while stale or failed refreshes retain their explicit
  completeness status.

Layer compatibility

The read-only core keeps its 34-tool surface and weavatrix.edit-plan.v1
contract unchanged. weavatrix-refactor 0.1.1 and weavatrix-online 0.2.0
are the paired upper-layer releases for this core version.

Full Changelog: v0.3.12...v0.3.13

v0.3.12

Weavatrix 0.3.12

0.3.12 makes the read-only core the provably-pure base of a layered stack. The
core stays exactly what it was for its users — the same 34 offline analysis tools
— but it now exposes a small read-only analysis surface for the packages built on
top of it, and machine gates prove it can neither modify code nor reach anything
external. Rust cross-crate call resolution and a query_graph seeding fix round
out the release.

The read-only base of the stack

Weavatrix now anchors a stack of growing responsibility:
weavatrix-online ⊃ weavatrix-refactor ⊃ weavatrix. You install one package and
get everything below it. This release adds only what the base owes the layers
above; it registers no new tools and changes no existing tool.

• New weavatrix/analysis-kit export: a narrow, read-only surface (graph
  identity, cycle detection, architecture verification, the bundled tree-sitter
  grammars, the read-only TypeScript language-server client, dead-code signals)
  that upper-layer packages compose. Nothing here writes, applies, or describes
  an edit.
• Two release gates make the base's guarantees machine-checked, alongside the
  existing ADR 0001 no-network gate: the core source contains no edit-plan,
  applier, or refactoring-builder marker, and no literal URL at all. A
  vulnerability finding references the advisory id rather than an external link;
  the URL-matching malware heuristics are matchers over scanned code, not links
  the core follows. Installing the base alone can neither modify your code nor
  reach the network.

Rust cross-crate call resolution

Rust call edges now resolve across crates, inline-test coverage is reported
honestly, and same-crate call noise is reduced — cross-crate references edges
land where a caller reaches a definition in another crate.

query_graph seeding

A query_graph question that reduced entirely to stop words (a bare
architecture), or inferred a language absent from the repository (contract
inferring Solidity where there are no .sol files), previously returned a
misleading "No nodes matched". Both now fall back only when they would otherwise
return nothing: the stop filter relaxes when every token is a stop word, and a
requested language that matches zero nodes is dropped. Queries that already
worked are unchanged.

Full Changelog: v0.3.11...v0.3.12

v0.3.11

Weavatrix 0.3.11

0.3.11 teaches the graph two new surfaces. SQL schemas become first-class graph
citizens with honest, evidence-gated dead-code verdicts, and Solidity joins the
parsed languages at zero dependency cost. The weavatrix.com site moved to its
own repository, so the engine repo now ships engine only.

SQL: the graph reaches the database schema

No SQL grammar ships in the pinned tree-sitter-wasms, so .sql indexing runs
on a dependency-free statement scanner (a new textOnly language-module class)
built for the graph's needs — symbols and references, not SQL semantics.
String literals and comments are blanked before structural scanning, so quoted
text can never fabricate a reference.

• CREATE TABLE/VIEW/FUNCTION/PROCEDURE/INDEX/TRIGGER become graph
  symbols; table columns (including ALTER TABLE ADD COLUMN) are member
  symbols with member_of, and tables carry their columns as field_types.
• References resolve inside .sql files (a view's SELECT, an index's ON
  table, a trigger's EXECUTE FUNCTION, foreign-key REFERENCES) — and, the
  real point, from application code: literal SQL found in string literals of
  any indexed language links the enclosing function to the table it queries.
  change_impact and get_dependents on a table now answer "which code
  touches this?"
• Dead-code verdicts stay honest. Schema objects are judged only when the
  repository demonstrably uses literal SQL the scanner can read — an
  ORM-driven repo produces silence, not guesses. Columns of a
  SELECT *-consumed table are never judged by name, and indexes/triggers
  (DB-engine surface) are never judged at all. A flagged column reports
  "no SQL statement in the indexed sources references it".

Solidity

The tree-sitter-solidity grammar already shipped inside the pinned
tree-sitter-wasms package — 0.3.11 registers it (and pins its SHA-256 in the
parser-artifact allowlist), so Solidity support adds zero new dependencies.
Contracts, interfaces, libraries, functions, constructors, modifiers, events,
errors, structs, enums and state variables are extracted with visibility and
membership; is inheritance, modifier invocations, emit, new Contract()
and using X for Y all feed the call/heritage resolvers. Imports resolve
through relative paths, Foundry remappings (remappings.txt / foundry.toml)
and root-anchored specs; npm-style specs (@openzeppelin/...) are recorded as
external dependencies. .sol files share directory scope like Go/C#/Rust,
which makes Solidity's plain import "./Base.sol" — a statement that names no
symbols — resolvable for siblings without guessing.

extractorSchemaV 6 → 7; cached graphs rebuild once, automatically.

Repository

The weavatrix.com landing site (pages, Cloudflare Worker config, deploy
workflow and its asset checks) moved byte-identically to the separate
weavatrix-site repository, removing ~1.2 MB of page assets from the engine
repo. The MCPB icon the site used to own is vendored at mcpb/icon.png; the
published npm package contents are unchanged.

Full Changelog: v0.3.10...v0.3.11