Scope the analyze health and clones kinds to the caller's workspace

[zzet]

Fixes #349.

What the report got right

Both reproductions are real, and the root cause is the one the reporter isolated: analyze kind=health accepts a target.repo selector and silently ignores it, while kind=clones honours it.

One correction to the framing. The title says "MCP analyze ignores workspace scoping", but that is not true of analyze generally — it is true of exactly the two kinds tested. Kinds dispatched by the analyze handler (health_score, dead_code, hotspots, …) source their rows through the scoped-node accessors and are already workspace-clamped, with a cross-workspace-leak sweep over the whole scope-aware kind set guarding it. health and clones are different: they are not analyze kinds at all.

Root cause

The analyze facade resolves kind to an operation, and the legacy-migration table maps a handful of operation names to a different legacy tool:

addFacadeGroup(&specs, "analyze", facadeEffectRead, map[string]string{
    "clones": "find_clones",  ...
    "health": "audit_health", ...
})

That table is consulted before the fall-through that synthesises a spec for a real analyze kind, so health and clones shadow the dispatcher and are forwarded straight to audit_health / find_clones. Neither ever reaches the dispatcher's resolveScope, so neither gets the workspace clamp or the repo allow-set.

From there the two diverge, which is exactly why the reporter saw the selector work for one and not the other. The facade does lower target.repo to a plain repo argument for both:

• find_clones reads repo and filters on it — hence repro 3 — but as a bare RepoPrefix equality, with no workspace ceiling at all. So an unnarrowed call from a bound session returns sibling workspaces' clusters, and the path form of the selector matches no prefix and narrows to nothing.
• handleAuditHealth was declared (_ context.Context, _ mcp.CallToolRequest) — it discarded the entire request — and ComputeAuditReport walked graph.AllNodes(). It could not see the selector or the session, which is why both selector forms returned the identical global report.

The invalid-key rejection the reporter noticed is the facade's own selector validation, which runs before the handler; that is why the key was policed but its value was dropped.

The fix

Two commits, one per handler.

audit_health resolves the uniform repo/project/workspace/scope narrowing the way the dispatcher does and grades symbols sourced from scopedNodesByKinds, which applies both the workspace ceiling and the resolved allow-set. ComputeAuditReport now takes the node set to grade rather than reading the whole store, the selectors are declared on the tool instead of being tolerated undocumented, and the response carries scope_applied. Fan-in/fan-out are still counted over the whole graph, so a cross-repo caller keeps contributing to a symbol's score — only which symbols get graded is scoped, matching health_score.

find_clones resolves the same narrowing and gates members on analyzeNodeVisible, replacing the bare prefix equality. It gains the tracked-name-or-path selector handling and the out-of-workspace error the rest of the analyze surface has.

One CLI change rides along: gortex audit --path sent {}, so the flag only picked the daemon connection and the badge was graded against every tracked repo — its own help text promises "audit a different tracked tree". It now forwards the path as the selector.

On single-repo daemons

Worth calling out since this backs the README badge. A single-repo daemon mints nodes with an empty RepoPrefix and has no multi-indexer to resolve a path against, so the new repo argument matches no registry prefix. QueryOptions.ScopeAllows deliberately admits unprefixed nodes rather than letting a repo narrow match vacuously, so the report is unchanged there. Pinned by a test.

Tests

Seven new tests across two files, each verified to fail against the pre-fix handlers:

• workspace isolation for both kinds (an alpha-bound session must not see beta rows)
• repro 2 directly: an explicit repo selector must narrow the graded set, and scope_applied must disclose it
• both selector forms — tracked name and absolute path — narrow identically
• an out-of-workspace selector errors instead of returning a plausible global report
• single-repo and unbound-session behaviour unchanged

go test -race ./... passes: 11643 tests across 179 packages. golangci-lint clean.

Follow-up, deliberately not in scope here

health and clones are the two aliases with concrete reproductions, and they are fixed. The same shadowing applies to other entries in that table, and a few of those handlers are also globally unscoped — run_inspections, get_communities, get_processes, get_recent_changes, with audit_agent_config root-pinned by design. Each needs its own scoping decision (community detection runs one partition over the whole index and already has a dedicated clamp helper; agent_config is arguably correct as-is), so folding them in would mean several unrelated design calls in one change. Worth a follow-up issue.