@4da/mcp-server 5.0.1 → 5.0.3

package/dist/live/http-utils.js

@@ -17,4 +17,3 @@ export async function fetchJson(url, options = {}, timeoutMs = DEFAULT_TIMEOUT_M
     }
     return (await response.json());
 }
-//# sourceMappingURL=http-utils.js.map

package/dist/live/index.d.ts

@@ -93,4 +93,3 @@ export declare class LiveIntelligence {
     fetchRegistryHealth(deps: ResolvedDependency[]): Promise<RegistryPackageInfo[]>;
     getStatus(): LiveIntelligenceStatus;
 }
-//# sourceMappingURL=index.d.ts.map

package/dist/live/index.js

@@ -295,4 +295,3 @@ function emptyVulnResult(projectPath, offline) {
         offline,
     };
 }
-//# sourceMappingURL=index.js.map

package/dist/live/npm-registry.d.ts

@@ -16,4 +16,3 @@ export declare class NpmRegistry {
     getPackageInfo(name: string, currentVersion: string | null, isDev: boolean): Promise<RegistryPackageInfo>;
     getBulkDownloads(names: string[]): Promise<Map<string, number>>;
 }
-//# sourceMappingURL=npm-registry.d.ts.map

package/dist/live/npm-registry.js

@@ -8,7 +8,7 @@
  * Privacy: sends only package names — public manifest data.
  */
 import { fetchJson, fetchWithTimeout } from "./http-utils.js";
-import { computeSemverDistance, isPreRelease } from "./semver-utils.js";
+import { computeSemverDistance, maxStableSemver } from "./semver-utils.js";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
 const NPM_DOWNLOADS_URL = "https://api.npmjs.org/downloads/point/last-week";
 const NPM_TIMEOUT_MS = 8_000;
@@ -127,13 +127,10 @@ export class NpmRegistry {
         return result;
     }
 }
+// Semver-max, not last-published: maintenance releases of older lines are
+// published after newer lines (see maxStableSemver).
 function findLatestStable(versions) {
-    for (let i = versions.length - 1; i >= 0; i--) {
-        if (!isPreRelease(versions[i])) {
-            return versions[i];
-        }
-    }
-    return null;
+    return maxStableSemver(versions);
 }
 function errorResult(name, currentVersion, isDev, fetchError) {
     return {
@@ -152,4 +149,3 @@ function errorResult(name, currentVersion, isDev, fetchError) {
         fetchError,
     };
 }
-//# sourceMappingURL=npm-registry.js.map

package/dist/live/osv-scanner.d.ts

@@ -28,4 +28,3 @@ export declare function extractCvssScore(severity: Array<{
     type: string;
     score: string;
 }> | undefined): number | null;
-//# sourceMappingURL=osv-scanner.d.ts.map

package/dist/live/osv-scanner.js

@@ -275,4 +275,3 @@ function extractFixedVersion(affected, packageName, ecosystem) {
     }
     return null;
 }
-//# sourceMappingURL=osv-scanner.js.map

package/dist/live/platform.d.ts

@@ -29,4 +29,3 @@ export declare function hostTarget(): HostTarget;
 export declare function targetActiveOnHost(target: string | null | undefined, host?: HostTarget): boolean;
 /** Evaluate a cfg predicate body (already unwrapped from `cfg( ... )`). */
 export declare function evalCfg(expr: string, host?: HostTarget): boolean;
-//# sourceMappingURL=platform.d.ts.map

package/dist/live/platform.js

@@ -153,4 +153,3 @@ function tripleActiveOnHost(triple, host) {
         return false;
     return true;
 }
-//# sourceMappingURL=platform.js.map

package/dist/live/pypi-registry.d.ts

@@ -15,4 +15,3 @@ export declare class PyPIRegistry {
     constructor(cache: LiveCache, rateLimiter: RateLimiter);
     getPackageInfo(name: string, currentVersion: string | null, isDev: boolean): Promise<RegistryPackageInfo>;
 }
-//# sourceMappingURL=pypi-registry.d.ts.map

package/dist/live/pypi-registry.js

@@ -8,7 +8,7 @@
  * Privacy: sends only package names -- public manifest data.
  */
 import { fetchJson } from "./http-utils.js";
-import { computeSemverDistance, isPreRelease } from "./semver-utils.js";
+import { computeSemverDistance, isPreRelease, maxStableSemver } from "./semver-utils.js";
 const PYPI_BASE_URL = "https://pypi.org/pypi";
 const PYPI_TIMEOUT_MS = 8_000;
 const PYPI_CACHE_TTL = 86_400; // 24 hours
@@ -83,17 +83,15 @@ export class PyPIRegistry {
     }
 }
 function findLatestStable(versions, releases) {
-    for (let i = versions.length - 1; i >= 0; i--) {
-        const v = versions[i];
+    // Semver-max among eligible versions, not last-listed (see maxStableSemver).
+    const eligible = versions.filter((v) => {
         if (isPreRelease(v))
-            continue;
+            return false;
         // Skip if all files for this version are yanked
         const files = releases[v];
-        if (files && files.length > 0 && files.every((f) => f.yanked))
-            continue;
-        return v;
-    }
-    return null;
+        return !(files && files.length > 0 && files.every((f) => f.yanked));
+    });
+    return maxStableSemver(eligible);
 }
 function getLastPublished(files) {
     if (!files || files.length === 0)
@@ -139,4 +137,3 @@ function errorResult(name, currentVersion, isDev, fetchError) {
         fetchError,
     };
 }
-//# sourceMappingURL=pypi-registry.js.map

package/dist/live/rate-limiter.d.ts

@@ -28,4 +28,3 @@ export declare const DEFAULT_RATE_LIMITS: {
         maxPerMinute: number;
     };
 };
-//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/live/rate-limiter.js

@@ -53,4 +53,3 @@ export const DEFAULT_RATE_LIMITS = {
     pypi: { maxPerMinute: 60 },
     go: { maxPerMinute: 60 },
 };
-//# sourceMappingURL=rate-limiter.js.map

package/dist/live/semver-utils.d.ts

@@ -10,4 +10,14 @@ export declare function isPreRelease(version: string): boolean;
 export declare function compareSemver(a: string, b: string): number;
 /** Highest version (by MAJOR.MINOR.PATCH) from a list, or null if empty. */
 export declare function maxSemver(versions: string[]): string | null;
-//# sourceMappingURL=semver-utils.d.ts.map
+/**
+ * Highest NON-prerelease version by semver from a list.
+ *
+ * Registries list versions in publish order, and maintenance releases for an
+ * older line land AFTER newer lines (React published 19.0.8 after 19.2.x; rsa
+ * published 0.9.10 after 0.10.0-rc.*). Taking the "last stable entry" therefore
+ * reported an older line as the latest stable — which surfaced as a bogus
+ * stable version in dependency_health and a literal DOWNGRADE recommendation
+ * in upgrade_planner. Order-independent max fixes the class.
+ */
+export declare function maxStableSemver(versions: string[]): string | null;

package/dist/live/semver-utils.js

@@ -49,4 +49,17 @@ export function maxSemver(versions) {
         return null;
     return versions.reduce((max, v) => (compareSemver(v, max) > 0 ? v : max), versions[0]);
 }
-//# sourceMappingURL=semver-utils.js.map
+/**
+ * Highest NON-prerelease version by semver from a list.
+ *
+ * Registries list versions in publish order, and maintenance releases for an
+ * older line land AFTER newer lines (React published 19.0.8 after 19.2.x; rsa
+ * published 0.9.10 after 0.10.0-rc.*). Taking the "last stable entry" therefore
+ * reported an older line as the latest stable — which surfaced as a bogus
+ * stable version in dependency_health and a literal DOWNGRADE recommendation
+ * in upgrade_planner. Order-independent max fixes the class.
+ */
+export function maxStableSemver(versions) {
+    const stable = versions.filter((v) => parseSemver(v) !== null && !isPreRelease(v));
+    return maxSemver(stable);
+}

package/dist/live/types.d.ts

@@ -153,4 +153,3 @@ export interface DependencyHealthResult {
     scanDurationMs: number;
     cached: boolean;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/live/types.js

@@ -1,3 +1,2 @@
 // SPDX-License-Identifier: Apache-2.0
 export {};
-//# sourceMappingURL=types.js.map

package/dist/live/version-resolver.d.ts

@@ -23,4 +23,3 @@ export declare function resolveVersions(cwd: string, deps: string[], devDeps: st
  * Direct dependency health and upgrade planning continue to use resolveVersions.
  */
 export declare function resolveAuditVersions(cwd: string, deps: string[], devDeps: string[], language: string, targets?: Record<string, string>): ResolvedDependency[];
-//# sourceMappingURL=version-resolver.d.ts.map

package/dist/live/version-resolver.js

@@ -411,4 +411,3 @@ function extractVersionFromSpec(spec) {
     const match = spec.match(/(\d+\.\d+\.\d+(?:-[\w.]+)?)/);
     return match ? match[1] : null;
 }
-//# sourceMappingURL=version-resolver.js.map

package/dist/live-singleton.d.ts

@@ -6,4 +6,3 @@
 import type { LiveIntelligence } from "./live/index.js";
 export declare function setLiveIntelligence(li: LiveIntelligence): void;
 export declare function getLiveIntelligence(): LiveIntelligence | null;
-//# sourceMappingURL=live-singleton.d.ts.map

package/dist/live-singleton.js

@@ -11,4 +11,3 @@ export function setLiveIntelligence(li) {
 export function getLiveIntelligence() {
     return instance;
 }
-//# sourceMappingURL=live-singleton.js.map

package/dist/project-scanner.d.ts

@@ -31,4 +31,3 @@ export interface ProjectScanResult {
  * Only reads manifest files at the root level — no recursion.
  */
 export declare function scanCurrentProject(cwd: string): ProjectScanResult;
-//# sourceMappingURL=project-scanner.d.ts.map

package/dist/project-scanner.js

@@ -453,4 +453,3 @@ function isNotableTopic(name) {
     ]);
     return notable.has(name);
 }
-//# sourceMappingURL=project-scanner.js.map

package/dist/schema-registry.d.ts

@@ -1,8 +1,14 @@
 /**
  * Schema Registry for Dynamic Context Discovery
  *
- * Reduces tool listing from ~4500 tokens to ~500 tokens by:
- * - Returning only one-liner summaries in list_tools
+ * Reduces tool listing from ~4500 tokens to ~1300 tokens by:
+ * - Returning one-liner summaries in list_tools
+ * - Serving the REAL inputSchema only for tools with REQUIRED parameters
+ *   (AD-032): a client cannot construct a valid call to those without the
+ *   schema, and most clients never read MCP Resources — so a slim
+ *   `{type:"object"}` made required-param tools effectively uncallable.
+ *   All-optional tools stay slim (`{}` is a valid call) with the full
+ *   schema still available as a Resource.
  * - Storing full schemas as MCP Resources (lazy-loaded)
  *
  * Also provides category/tag metadata for tool discovery and filtering.
@@ -39,16 +45,20 @@ export interface ToolRegistryEntry {
  * 14 tools total: 9 standalone + 5 full-mode.
  */
 export declare const TOOL_REGISTRY: Record<string, ToolRegistryEntry>;
+/** An inputSchema as tools/list serves it — the MCP Tool contract requires
+ * the literal `type: "object"` at the root. */
+export type ToolInputSchema = {
+    type: "object";
+} & Record<string, unknown>;
 /**
- * Get slim tool list for list_tools response
- * Returns minimal schema (just type: object) — full schema via resources
+ * Get the tool list for the tools/list response: slim summaries throughout,
+ * real inputSchema for required-param tools, `{type:"object"}` otherwise
+ * (full schema via resources).
  */
 export declare function getSlimToolList(standaloneOnly?: boolean): Array<{
     name: string;
     description: string;
-    inputSchema: {
-        type: "object";
-    };
+    inputSchema: ToolInputSchema;
     annotations: ToolAnnotations;
 }>;
 /**
@@ -77,4 +87,3 @@ export declare function getCategoryManifest(): {
 };
 /** Find tools matching any of the given tags */
 export declare function getToolsByTags(tags: string[]): string[];
-//# sourceMappingURL=schema-registry.d.ts.map

package/dist/schema-registry.js

@@ -2,8 +2,14 @@
 /**
  * Schema Registry for Dynamic Context Discovery
  *
- * Reduces tool listing from ~4500 tokens to ~500 tokens by:
- * - Returning only one-liner summaries in list_tools
+ * Reduces tool listing from ~4500 tokens to ~1300 tokens by:
+ * - Returning one-liner summaries in list_tools
+ * - Serving the REAL inputSchema only for tools with REQUIRED parameters
+ *   (AD-032): a client cannot construct a valid call to those without the
+ *   schema, and most clients never read MCP Resources — so a slim
+ *   `{type:"object"}` made required-param tools effectively uncallable.
+ *   All-optional tools stay slim (`{}` is a valid call) with the full
+ *   schema still available as a Resource.
  * - Storing full schemas as MCP Resources (lazy-loaded)
  *
  * Also provides category/tag metadata for tool discovery and filtering.
@@ -11,6 +17,9 @@
  * Full schemas available at: 4da://schema/{tool_name}
  * Category manifest at: 4da://categories
  */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
 /**
  * Slim tool registry — one-liner descriptions + category/tag metadata.
  * Full schemas are stored in schemas/*.json and exposed as MCP Resources.
@@ -61,7 +70,7 @@ export const TOOL_REGISTRY = {
         annotations: { readOnlyHint: true, openWorldHint: true },
     },
     get_context: {
-        summary: "What 4DA knows about the user: role, tech stack, interests, and learned affinities. Call FIRST when you need to know what the user works on before answering or recommending.",
+        summary: "What 4DA knows about the user: role, tech stack, interests, exclusions, and ACE-detected context. Call FIRST when you need to know what the user works on before answering or recommending.",
         schemaFile: "get-context.json",
         category: "intelligence",
         tags: ["context", "interests", "tech-stack", "profile"],
@@ -93,10 +102,10 @@ export const TOOL_REGISTRY = {
         annotations: { readOnlyHint: true, openWorldHint: false },
     },
     record_feedback: {
-        summary: "Record click/save/dismiss on a content item to sharpen future scoring. Call AFTER the user reacts to a surfaced item (opens, saves, or dismisses it).",
+        summary: "Record click/save/dismiss on a content item as explicit interaction history. Call AFTER the user reacts to a surfaced item (opens, saves, or dismisses it).",
         schemaFile: "record-feedback.json",
         category: "intelligence",
-        tags: ["feedback", "learning", "save", "dismiss"],
+        tags: ["feedback", "history", "save", "dismiss"],
         standalone: false,
         annotations: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, idempotentHint: false },
     },
@@ -136,9 +145,46 @@ export const TOOL_REGISTRY = {
         annotations: { readOnlyHint: true, openWorldHint: false },
     },
 };
+/** Schemas live beside this module in both layouts: src/schemas (vitest) and
+ * dist/schemas (compiled — populated by the copy-schemas build step). */
+const SCHEMAS_DIR = join(dirname(fileURLToPath(import.meta.url)), "schemas");
+/** Lazy cache: tool name → its real inputSchema when the schema declares
+ * required parameters, else null (tool stays slim). */
+const requiredParamSchemas = new Map();
 /**
- * Get slim tool list for list_tools response
- * Returns minimal schema (just type: object) — full schema via resources
+ * The tools/list discoverability line (AD-032): a tool whose schema declares
+ * REQUIRED parameters serves its real inputSchema — `{type:"object"}` hid the
+ * required params from every client that never reads MCP Resources, making
+ * those tools fail on first call (GPT adversarial audit, finding 7). Tools
+ * whose parameters are all optional keep the slim schema: `{}` is a valid
+ * call, and the full schema stays one Resource read away. Fail-open: an
+ * unreadable or malformed schema file falls back to slim rather than
+ * breaking tools/list.
+ */
+function inputSchemaIfRequired(name, schemaFile) {
+    if (!requiredParamSchemas.has(name)) {
+        let loaded = null;
+        try {
+            const parsed = JSON.parse(readFileSync(join(SCHEMAS_DIR, schemaFile), "utf-8"));
+            const schema = parsed.inputSchema;
+            if (schema &&
+                schema.type === "object" &&
+                Array.isArray(schema.required) &&
+                schema.required.length > 0) {
+                loaded = schema;
+            }
+        }
+        catch {
+            loaded = null;
+        }
+        requiredParamSchemas.set(name, loaded);
+    }
+    return requiredParamSchemas.get(name) ?? null;
+}
+/**
+ * Get the tool list for the tools/list response: slim summaries throughout,
+ * real inputSchema for required-param tools, `{type:"object"}` otherwise
+ * (full schema via resources).
  */
 export function getSlimToolList(standaloneOnly) {
     return Object.entries(TOOL_REGISTRY)
@@ -146,7 +192,7 @@ export function getSlimToolList(standaloneOnly) {
         .map(([name, info]) => ({
         name,
         description: info.summary,
-        inputSchema: { type: "object" },
+        inputSchema: inputSchemaIfRequired(name, info.schemaFile) ?? { type: "object" },
         annotations: info.annotations,
     }));
 }
@@ -200,4 +246,3 @@ export function getToolsByTags(tags) {
         .filter(([, entry]) => entry.tags.some((t) => tagSet.has(t.toLowerCase())))
         .map(([name]) => name);
 }
-//# sourceMappingURL=schema-registry.js.map

package/dist/schemas/developer-dna.json

@@ -1,6 +1,6 @@
 {
   "name": "developer_dna",
-  "description": "Export your Developer DNA — a comprehensive profile of your tech identity built from project scans, engagement data, and learned preferences. Includes primary stack, adjacent tech, top dependencies, engaged topics, blind spots, source engagement rates, and aggregate stats. Call when the user asks for a summary of their developer profile, identity, or tech fingerprint.",
+  "description": "Export your Developer DNA — a comprehensive profile of your tech identity built from project scans, explicit interests, and local interaction history. Includes primary stack, adjacent tech, top dependencies, engaged topics, blind spots, source engagement rates, and aggregate stats. Call when the user asks for a summary of their developer profile, identity, or tech fingerprint.",
   "inputSchema": {
     "type": "object",
     "properties": {

package/dist/schemas/get-context.json

@@ -1,6 +1,6 @@
 {
   "name": "get_context",
-  "description": "Get the user's context - what 4DA knows about them.\n\nReturns information about:\n- Static Identity: User-declared role, tech stack, domains, interests, and exclusions\n- ACE Context (optional): Auto-detected technologies and active topics from recent activity\n- Learned Preferences (optional): Topic affinities learned from user behavior\n\nCall FIRST when you need to understand what the user works on or cares about before answering or recommending.",
+  "description": "Get the user's context - what 4DA knows about them.\n\nReturns information about:\n- Static Identity: User-declared role, tech stack, domains, interests, and exclusions\n- ACE Context (optional): Auto-detected technologies and active topics from recent activity\n- Learned Preferences (optional): retained compatibility field; implicit preference learning no longer contributes to scoring\n\nCall FIRST when you need to understand what the user works on or cares about before answering or recommending.",
   "inputSchema": {
     "type": "object",
     "properties": {
@@ -10,7 +10,7 @@
       },
       "include_learned": {
         "type": "boolean",
-        "description": "Include learned preferences (topic affinities, anti-topics). Default: true"
+        "description": "Include the retained learned-preferences compatibility field. Default: true"
       }
     }
   }

package/dist/schemas/get-relevant-content.json

@@ -1,6 +1,6 @@
 {
   "name": "get_relevant_content",
-  "description": "Get filtered relevant content from 4DA's personalized feed.\n\nReturns content items that match the user's interests, tech stack, and learned preferences.\nItems are scored based on:\n- Explicit interests declared by the user\n- Tech stack and domains\n- ACE-detected context (recent files, projects, git activity)\n- Learned preferences from past interactions\n\nIMPORTANT for autonomous use: each item carries an `evidence_class` describing how it is grounded. The relevance_score float is NOT comparable across classes — gate actions on evidence_class, not the number:\n- \"osv_verified\": a security advisory matching one of the user's INSTALLED dependencies — safe to act on\n- \"dependency_grounded\": matched one of the user's declared dependencies — trustworthy\n- \"semantic_only\": topical/embedding relevance with NO dependency edge — surface to the human, verify before acting\n- \"keyword_heuristic\": standalone-mode keyword score (no Rust pipeline) — weakest signal\n\nCall when the user asks what to read, what is relevant to them, or for content on a topic.",
+  "description": "Get filtered relevant content from 4DA's personalized feed.\n\nReturns content items that match the user's explicit interests, tech stack, and ACE-detected context.\nItems are scored based on:\n- Explicit interests declared by the user\n- Tech stack and domains\n- ACE-detected context (recent files, projects, git activity)\n\nIMPORTANT for autonomous use: each item carries an `evidence_class` describing how it is grounded. The relevance_score float is NOT comparable across classes — gate actions on evidence_class, not the number:\n- \"osv_verified\": a security advisory matching one of the user's INSTALLED dependencies — safe to act on\n- \"dependency_grounded\": matched one of the user's declared dependencies — trustworthy\n- \"semantic_only\": topical/embedding relevance with NO dependency edge — surface to the human, verify before acting\n- \"keyword_heuristic\": standalone-mode keyword score (no Rust pipeline) — weakest signal\n\nCall when the user asks what to read, what is relevant to them, or for content on a topic.",
   "inputSchema": {
     "type": "object",
     "properties": {

package/dist/schemas/record-feedback.json

@@ -1,6 +1,6 @@
 {
   "name": "record_feedback",
-  "description": "Record user feedback on a content item.\n\nFeedback actions:\n- \"click\": User clicked/opened the item (moderate positive signal)\n- \"save\": User saved/bookmarked the item (strong positive signal)\n- \"dismiss\": User dismissed the item (weak negative signal)\n- \"mark_irrelevant\": User marked item as not relevant (strong negative signal)\n\nThis feedback helps 4DA learn user preferences over time. Call after the user reacts to a surfaced item (opens, saves, or dismisses it).",
+  "description": "Record explicit user interaction history for a content item.\n\nFeedback actions:\n- \"click\": User clicked/opened the item\n- \"save\": User saved/bookmarked the item\n- \"dismiss\": User dismissed the item\n- \"mark_irrelevant\": User marked item as not relevant\n\nThis records what happened; it does not train content preferences (interaction counts only graduate scoring's bootstrap gate). Call after the user reacts to a surfaced item (opens, saves, or dismisses it).",
   "inputSchema": {
     "type": "object",
     "properties": {

package/dist/setup.d.ts

@@ -15,4 +15,3 @@
  * @param dryRun If true, only report what would be written without modifying files.
  */
 export declare function runSetup(dryRun?: boolean): void;
-//# sourceMappingURL=setup.d.ts.map

package/dist/setup.js

@@ -168,4 +168,3 @@ if (isDirectRun) {
     const dryRun = process.argv.includes("--dry-run");
     runSetup(dryRun);
 }
-//# sourceMappingURL=setup.js.map

package/dist/tool-dispatch.d.ts

@@ -24,4 +24,3 @@ export declare function dispatchTool(name: string, db: FourDADatabase, args: Rec
 export declare function hasDispatchTool(name: string): boolean;
 /** Get count of registered tool executors */
 export declare function getDispatchToolCount(): number;
-//# sourceMappingURL=tool-dispatch.d.ts.map

package/dist/tool-dispatch.js

@@ -58,7 +58,27 @@ export async function dispatchTool(name, db, args) {
         throw new Error(`Unknown tool: ${name}`);
     }
     assertToolPermission(name);
-    const result = await executor(db, (args || {}));
+    // BUSY/LOCKED retry at the single choke point every tool passes through.
+    // The desktop engine writes to the same database every 30 minutes; a read
+    // that collides with its transaction deserves one backoff retry rather than
+    // an immediate error JSON. (db.queryWithRetry existed for this but had no
+    // production caller — it is sync and the executors are async, so the retry
+    // lives here.)
+    const toolArgs = (args || {});
+    let result;
+    try {
+        result = await executor(db, toolArgs);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "SQLITE_BUSY" || code === "SQLITE_LOCKED") {
+            await new Promise((resolve) => setTimeout(resolve, 150));
+            result = await executor(db, toolArgs);
+        }
+        else {
+            throw error;
+        }
+    }
     const payload = FRESHNESS_TOOLS.has(name) ? attachFreshness(db, result) : result;
     return {
         content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
@@ -94,4 +114,3 @@ export function hasDispatchTool(name) {
 export function getDispatchToolCount() {
     return Object.keys(DISPATCH_MAP).length;
 }
-//# sourceMappingURL=tool-dispatch.js.map

package/dist/tools/agent-memory.d.ts

@@ -101,4 +101,3 @@ export declare function memoryEmbedText(row: {
     content: string;
 }): string;
 export declare function executeAgentMemory(db: FourDADatabase, params: AgentMemoryParams): object | Promise<object>;
-//# sourceMappingURL=agent-memory.d.ts.map

package/dist/tools/agent-memory.js

@@ -365,4 +365,3 @@ async function enhanceRecallWithSemantics(db, query, rows, limit, config) {
         recall_mode: sem.embeddedCount > 0 ? "hybrid" : "ranked_lexical",
     };
 }
-//# sourceMappingURL=agent-memory.js.map

package/dist/tools/decision-enforcement.d.ts

@@ -72,4 +72,3 @@ export declare const checkDecisionAlignmentTool: {
 };
 export declare function executeCheckDecisionAlignment(db: FourDADatabase, params: CheckDecisionAlignmentParams): AlignmentResult | Promise<AlignmentResult>;
 export {};
-//# sourceMappingURL=decision-enforcement.d.ts.map

package/dist/tools/decision-enforcement.js

@@ -210,4 +210,3 @@ export function executeCheckDecisionAlignment(db, params) {
     // Provider configured -> hybrid retrieval (returns a Promise; dispatch awaits).
     return hybridDecisionRecall(db, query, candidates, 50, config).then(({ ranked, semanticById, recall_mode }) => assembleAlignment(params, ranked, semanticById, recall_mode));
 }
-//# sourceMappingURL=decision-enforcement.js.map

package/dist/tools/decision-memory.d.ts

@@ -127,4 +127,3 @@ export declare const decisionMemoryTool: {
     };
 };
 export declare function executeDecisionMemory(db: FourDADatabase, params: DecisionMemoryParams): object | Promise<object>;
-//# sourceMappingURL=decision-memory.d.ts.map

package/dist/tools/decision-memory.js

@@ -293,4 +293,3 @@ export function executeDecisionMemory(db, params) {
             return { error: `Unknown action: ${params.action}` };
     }
 }
-//# sourceMappingURL=decision-memory.js.map

package/dist/tools/decision-recall.d.ts

@@ -56,4 +56,3 @@ export declare function decisionEmbedText(row: DecisionLike): string;
  * be embedded.
  */
 export declare function hybridDecisionRecall<T extends DecisionLike>(db: FourDADatabase, query: string, rows: T[], limit: number, config: EmbeddingConfig): Promise<DecisionRecallResult<T>>;
-//# sourceMappingURL=decision-recall.d.ts.map

package/dist/tools/decision-recall.js

@@ -84,4 +84,3 @@ export async function hybridDecisionRecall(db, query, rows, limit, config) {
         .map((x) => x.row);
     return { ranked, semanticById: sem.semanticById, recall_mode: "hybrid" };
 }
-//# sourceMappingURL=decision-recall.js.map

package/dist/tools/dependency-health.d.ts

@@ -42,4 +42,3 @@ export declare const dependencyHealthTool: {
     };
 };
 export declare function executeDependencyHealth(_db: FourDADatabase, params: DependencyHealthParams, liveIntel: LiveIntelligence | null): Promise<DependencyHealthResult>;
-//# sourceMappingURL=dependency-health.d.ts.map

package/dist/tools/dependency-health.js

@@ -112,11 +112,38 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
     });
     const limit = params.limit ?? 50;
     const limited = sorted.slice(0, limit);
-    // Health score: 100 = perfect, 0 = everything is on fire
+    // Health score: 100 = perfect. Proportional and severity-weighted — the old
+    // absolute-count formula (15 points per vulnerable package, 2 per outdated,
+    // regardless of severity, degree, or project size) pinned any real-sized
+    // project at 0/100: a patch-behind dep cost the same as a critical CVE and
+    // the number informed nothing.
     const total = registryData.length || 1;
-    const vulnPenalty = Math.min(vulnerable * 15, 50);
-    const deprecatedPenalty = Math.min(deprecated * 10, 30);
-    const outdatedPenalty = Math.min(outdated * 2, 40);
+    // Vulnerabilities: severity-weighted; transitive findings at one-third
+    // weight (their fix arrives via a parent bump — the direct surface is what
+    // the user controls directly).
+    const sevWeight = { critical: 20, high: 10, medium: 4, low: 1 };
+    let vulnPenaltyRaw = 0;
+    if (vulnResult) {
+        for (const v of vulnResult.vulnerabilities) {
+            const w = sevWeight[v.severity] ?? 2; // "unknown" (mostly unmaintained-notices) counts low
+            vulnPenaltyRaw += v.isDirect ? w : w / 3;
+        }
+    }
+    const vulnPenalty = Math.min(Math.round(vulnPenaltyRaw), 55);
+    // Staleness: degree-weighted and proportional to the tracked set — a major
+    // behind is a real liability, a patch behind is routine drift.
+    let stalenessWeight = 0;
+    for (const dep of registryData) {
+        const label = dep.versionsBehind?.label;
+        if (label === "major")
+            stalenessWeight += 1;
+        else if (label === "minor")
+            stalenessWeight += 0.35;
+        else if (label === "patch")
+            stalenessWeight += 0.1;
+    }
+    const outdatedPenalty = Math.min(30, Math.round((stalenessWeight / total) * 60));
+    const deprecatedPenalty = Math.min(deprecated * 8, 15);
     const healthScore = Math.max(0, 100 - vulnPenalty - deprecatedPenalty - outdatedPenalty);
     const vulnSummary = vulnResult ? {
         critical: vulnResult.bySeverity.critical,
@@ -151,4 +178,3 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
         cached: false,
     };
 }
-//# sourceMappingURL=dependency-health.js.map

package/dist/tools/developer-dna.d.ts

@@ -2,7 +2,7 @@
  * developer_dna tool
  *
  * Export a comprehensive Developer DNA profile built from project scans,
- * engagement data, and learned preferences.
+ * explicit interests, and local interaction history.
  */
 import type { FourDADatabase } from "../db.js";
 export interface DeveloperDnaParams {
@@ -46,7 +46,8 @@ interface EngagedTopic {
 interface BlindSpotEntry {
     dependency: string;
     severity: string;
-    days_stale: number;
+    /** Days since last engagement with content about this dep; null = never engaged. */
+    days_stale: number | null;
 }
 interface SourceEngagement {
     source_type: string;
@@ -76,4 +77,3 @@ interface DeveloperDna {
 }
 export declare function executeDeveloperDna(db: FourDADatabase, params: DeveloperDnaParams): DeveloperDna;
 export {};
-//# sourceMappingURL=developer-dna.d.ts.map