fix: honour workspace grep scopes in CLI and MCP

[ryanduguid]

Summary

Forward workspace grep's existing --in option through the CLI and MCP entry points, restrict federation to the selected child, and pass any nested scope to the existing graph search. Unknown scopes remain errors, and unindexed children retain the coverage warning.

Integrate current upstream main while preserving both the scope normaliser and the branding helper imports.

Evidence

• The published branch has a merge conflict with current main. The local merge resolves the import conflict and has no unmerged paths.
• All 65 workspace, MCP and grep tests pass on Windows. npm run build passes both TypeScript builds and the viewer bundle.
• A bounded broader test run reports 1,414 passes, 21 failures and 12 skips. The same 21 failing cases reproduce in five test files on unchanged upstream with the same installation and environment.
• The hosted Blast viewer workflow passes on the integrated head. The main CI, Blast radius and CodeQL workflows are waiting for maintainer approval.

Risk

Unknown workspace scopes now return a scope error instead of unrelated results. The upstream branding changes and default unscoped searches are preserved.

Unverified

The main hosted checks require maintainer approval before they can run. Linux/macOS checks have not run for the integrated head, and the broader suite is not passing in the local Windows environment.

CI workflow maintenance

Use Ubuntu 24.04 for the affected Linux jobs. Keep the existing event, permission and test-matrix contracts.

Evidence

The previous head reported 1 matching action-runtime or runner annotations. Actionlint and the Git whitespace check pass.

Risk

Action or runner upgrades can affect CI behaviour. The workflow changes can be reverted.

Unverified

Hosted CI observed at 2026-10-17T11:24:41Z for a14fabd: 1 skipped, 1 success. 1 action-runtime or Ubuntu-label annotations remain in publish. 3 workflow runs await approval or dispatch. Application tests were not run locally for these workflow changes.

[trailhq-graft]

🌱 graft blast radius

3 areas changed → 1 area can be affected. 1 dependent symbol, depth 2.
Tests: no test reaches Workspace Tool Integration; 1 area updated its tests.
Tag: @anirudhkumar-nanonets — 4 of 4 areas · @shhdwi — 4 of 4 areas

flowchart TB
  A0(("MCP Server<br/>1 symbol"))
  classDef reached fill:#D9EDF3,stroke:#3AA7C9,stroke-width:1.5px,color:#0E313C;
  class A0 reached;

Loading

Can be affected	Symbols	Nearest hop	Reached from
MCP Server	1	src/mcp/server.ts:L73-L155 startMcpServer — calls, depth 2	Workspace Tool Integration

Who knows this code — 2 people across 4 areas

Area	Who knows it
Workspace Tool Integration · changed	@shhdwi — 15 commits, last 3d ago · @anirudhkumar-nanonets — 7 commits, last 2mo ago
Workspace Federation · changed	@shhdwi — 8 commits, last 3d ago · @anirudhkumar-nanonets — 3 commits, last 2mo ago
CLI · changed	@anirudhkumar-nanonets — 58 commits, last 2d ago · @shhdwi — 26 commits, last 2d ago
MCP Server · affected	@anirudhkumar-nanonets — 6 commits, last 4d ago · @shhdwi — 2 commits, last 3mo ago

Ownership is git history over each area's own files, weighted towards recent work (120-day half-life). Merge commits and bots are dropped, and you are dropped from your own PR. A name with no @ has no GitHub handle in its commit email — tag them by hand, or add a .mailmap entry. A suggestion from history, not a CODEOWNERS rule.

All 1 dependent symbol, grouped by area

MCP Server — 1 symbol in 1 file

• src/mcp/server.ts:L73-L155 — startMcpServer (calls, depth 2)

Test signal per changed area — 1 ✓ · 1 ✗ · 1 –

Reached = a node under a test path has a resolved edge into the changed symbol. It undercounts anything called indirectly — through a CLI, a spawned process or a dynamic import — so read a low ratio as “look here”, never as a coverage gate.

• ✗ Workspace Tool Integration — 0 of 1 reached · no test file reaches it
  • not reached: callWorkspaceTool
• ✓ Workspace Federation — 2 of 4 reached · 1 test file changed here: test/workspace.test.ts
  • not reached: runWorkspaceGrep, resolveWorkspaceIn
• – CLI — no function, method or class changed here

5 test suites also reference this code

5 symbols, kept out of the diagram and the table so they cannot crowd out the areas a reviewer has to look at.

• test/graph-follow-submodules.test.ts
• test/graph-load.test.ts
• test/graph-refresh.test.ts
• test/graph-seed.test.ts
• test/mcp-tools.test.ts

⚠️ 1 changed file not in the graph (.github/workflows/blast-pages.yml) — no parser claims the extension, or the index predates the file.

_{graft blast · origin/main...HEAD · depth 2 · 6 changed files}

Open the interactive graph → — click an area to see its dependent symbols at file:line.