feat(mcp): --wiki-root auto — resolve at MCP startup, not install time

[aomerk]

Summary

• keeba mcp install --tool claude-code now writes --wiki-root auto by default. The MCP server resolves the wiki root at startup by walking up from the editor's cwd for .keeba/symbols.json, instead of baking the install-time cwd into the editor config.
• Cross-repo investigations now hit the right symbol graph. Open Claude Code in any indexed repo; keeba follows you.
• Explicit pin via --wiki-root-override <path> still works — opt-out of auto for users who want to lock the install to one repo.

Why

Real-world A/B run yesterday surfaced this as the single biggest savings leak keeba ships with — bigger than any codec layer.

User installed keeba from /home/ali/keeba-go (the keeba repo itself). Install baked --wiki-root /home/ali/keeba-go into ~/.claude.json. They later opened Claude Code in /home/ali/forta/codebase/risk-graph/risk-graph-indexer to investigate a different bug. That repo has its own .keeba/symbols.json, but the MCP server was still serving the keeba-go graph.

Claude correctly bailed:

Keeba index pointing at wrong repo. Fall back to grep.
MCP rooted elsewhere. Use Read on prompt-context paths.

Half the investigation ran on Read + rg against full files instead of keeba tools. Output tokens stayed at 17.7k, dollar cost stayed at $2.57 — savings would have been substantially better if keeba had served the right graph from the start.

This is a routing bug that codec layers, output styles, and CLAUDE.md guidance can't fix. Has to be fixed at the install/serve layer.

How --wiki-root auto resolves

At server startup, walk up from os.Getwd():

1. .keeba/symbols.json (canonical signal — what the MCP server actually consumes)
2. keeba.config.yaml (back-compat fallback for wiki-only repos without a compiled graph)
3. Cwd itself (last resort — server still boots, tools return the "no symbol graph — run keeba compile first" hint)

Stderr receipt at every startup so the user sees which root the session bound to:

keeba mcp serve: auto-resolved --wiki-root to /home/ali/risk-graph-indexer
  (via .keeba/symbols.json; cwd=/home/ali/risk-graph-indexer/pkg/enrichment)

Backwards compat

• --wiki-root-override <path> at install time bakes an explicit absolute path. Treated as opt-out — no auto-resolution.
• Empty --wiki-root (older configs) is treated identically to auto. Existing installs keep working.
• The worktree-warning in mcp_install.go only fires when the user explicitly pinned a worktree path; auto-mode makes the warning unnecessary because each worktree's own .keeba/ is what gets served.

Test plan

• go test ./internal/config/... ./internal/cli/... — all green (3 new config tests, 5 new CLI tests)
• golangci-lint run — 0 issues
• End-to-end: install with no args writes --wiki-root auto to ~/.claude.json
• End-to-end: keeba mcp serve --wiki-root auto from a subdir of an indexed repo prints the receipt and serves the correct root
• End-to-end: --wiki-root auto from a non-indexed dir falls back to cwd, server still starts
• Verification (post-merge, run by user): rebuild keeba, re-run keeba mcp install, restart Claude Code, open it in risk-graph-indexer, re-run the same investigation prompt. Expected: 16+ keeba calls (no more grep fallbacks), output drops below 17.7k, cost drops below $2.57.

🤖 Generated with Claude Code