@4da/mcp-server 5.0.2 → 5.0.4

package/README.md

@@ -134,11 +134,11 @@ Results are cached (24h for registry data, 1h for vulnerabilities, 30min for new
 |------|-------------|
 | `what_should_i_know` | Pre-task intelligence briefing: vulns, decisions, signals, ecosystem updates. |
 | `ecosystem_pulse` | Live ecosystem news from Hacker News, filtered by your detected tech stack. |
-| `get_context` | Your tech stack, resolved dependency versions, interests, affinities. |
+| `get_context` | Your tech stack, resolved dependency versions, interests, detected topics. |
 | `get_relevant_content`* | Scored content feed — articles, advisories, releases ranked by relevance. |
 | `get_actionable_signals`* | Classified alerts: security advisories, breaking changes, trending repos. |
 | `knowledge_gaps`* | Dependencies you use daily but never read about. Surfaces missed CVEs and updates. |
-| `record_feedback`* | Save or dismiss items to teach 4DA what matters. Sharpens future scoring. |
+| `record_feedback`* | Save or dismiss items so 4DA can record explicit interaction history. |
 
 ### Decisions & Memory
 
@@ -152,7 +152,7 @@ Results are cached (24h for registry data, 1h for vulnerabilities, 30min for new
 
 | Tool | What it does |
 |------|-------------|
-| `developer_dna`* | Your tech identity: primary stack, engagement patterns, blind spots. |
+| `developer_dna`* | Your tech identity: primary stack, top dependencies, blind spots. |
 
 *\* Requires the [4DA desktop app](https://4da.ai) for full data.*
 

package/dist/auth-context.d.ts

@@ -46,4 +46,3 @@ export declare function requiredOperation(toolName: string): "read" | "write";
  * Throws `AuthorizationError` when the role is insufficient.
  */
 export declare function assertToolPermission(toolName: string): void;
-//# sourceMappingURL=auth-context.d.ts.map

package/dist/auth-context.js

@@ -69,4 +69,3 @@ export function assertToolPermission(toolName) {
         throw new AuthorizationError(`Role '${ctx.claims.role}' is not permitted to perform '${operation}' operations (tool: ${toolName})`);
     }
 }
-//# sourceMappingURL=auth-context.js.map

package/dist/auth.d.ts

@@ -60,4 +60,3 @@ export declare function extractAuthClaims(req: IncomingMessage): TeamClaims | nu
  * `readOnlyHint` annotation.
  */
 export declare function hasPermission(role: string, operation: "read" | "write" | "admin"): boolean;
-//# sourceMappingURL=auth.d.ts.map

package/dist/auth.js

@@ -190,4 +190,3 @@ export function hasPermission(role, operation) {
             return false;
     }
 }
-//# sourceMappingURL=auth.js.map

package/dist/db.d.ts

@@ -40,6 +40,22 @@ export interface DataFreshness {
     /** Human-readable summary with the remedy when stale. */
     note: string;
 }
+/**
+ * Collapse near-duplicate stories (same news via reddit + rss + mastodon…) by
+ * token-set Jaccard similarity over normalized titles. Input is score-ordered,
+ * so the highest-scored copy of a story survives. Exported for tests.
+ */
+export declare function dedupeByTitle<T extends {
+    title: string | null;
+}>(items: T[], threshold?: number): T[];
+/**
+ * The dependency-group query the server runs at init against a pre-existing
+ * database (index.ts full-DB branch). Exported as a single source of truth so
+ * the schema-compatibility regression test exercises the EXACT production SQL —
+ * the `is_direct` standalone-schema gap slipped through precisely because the
+ * two modes were only ever tested separately.
+ */
+export declare const DEPENDENCY_GROUP_QUERY = "SELECT DISTINCT package_name, language, project_path, is_dev, is_direct FROM project_dependencies";
 /**
  * 4DA Database accessor
  */
@@ -116,7 +132,7 @@ export declare class FourDADatabase {
     getFreshness(): DataFreshness;
     /** `MAX(sources.last_fetch)`, tolerant of a missing `sources` table (returns null). */
     private safeMaxLastFetch;
-    private hasColumn;
+    hasColumn(table: string, column: string): boolean;
     /**
      * Idempotently add a column to a table if it does not already exist.
      * Used to add the optional `embedding` / `embedding_model` columns to
@@ -223,4 +239,3 @@ export declare class FourDADatabase {
  * Create a database instance
  */
 export declare function createDatabase(dbPath?: string): FourDADatabase;
-//# sourceMappingURL=db.d.ts.map

package/dist/db.js

@@ -80,6 +80,60 @@ function minutesSince(ts) {
         return null;
     return Math.max(0, Math.round((Date.now() - ms) / 60000));
 }
+/** Filler words ignored when comparing titles for near-duplicate collapsing. */
+const TITLE_STOPWORDS = new Set([
+    "the", "a", "an", "is", "are", "was", "out", "in", "on", "of", "for", "to",
+    "and", "announcing", "announced", "new", "blog", "via", "with",
+]);
+function titleTokens(title) {
+    const tokens = title
+        .toLowerCase()
+        .replace(/[^a-z0-9.]+/g, " ")
+        .split(/\s+/)
+        .map((t) => t.replace(/^\.+|\.+$/g, ""))
+        .filter((t) => t.length > 0 && !TITLE_STOPWORDS.has(t));
+    return new Set(tokens);
+}
+/**
+ * Collapse near-duplicate stories (same news via reddit + rss + mastodon…) by
+ * token-set Jaccard similarity over normalized titles. Input is score-ordered,
+ * so the highest-scored copy of a story survives. Exported for tests.
+ */
+export function dedupeByTitle(items, threshold = 0.6) {
+    const kept = [];
+    for (const item of items) {
+        const tokens = titleTokens(item.title ?? "");
+        if (tokens.size === 0) {
+            kept.push({ item, tokens });
+            continue;
+        }
+        let isDup = false;
+        for (const prev of kept) {
+            if (prev.tokens.size === 0)
+                continue;
+            let overlap = 0;
+            for (const t of tokens)
+                if (prev.tokens.has(t))
+                    overlap++;
+            const union = tokens.size + prev.tokens.size - overlap;
+            if (union > 0 && overlap / union >= threshold) {
+                isDup = true;
+                break;
+            }
+        }
+        if (!isDup)
+            kept.push({ item, tokens });
+    }
+    return kept.map((k) => k.item);
+}
+/**
+ * The dependency-group query the server runs at init against a pre-existing
+ * database (index.ts full-DB branch). Exported as a single source of truth so
+ * the schema-compatibility regression test exercises the EXACT production SQL —
+ * the `is_direct` standalone-schema gap slipped through precisely because the
+ * two modes were only ever tested separately.
+ */
+export const DEPENDENCY_GROUP_QUERY = "SELECT DISTINCT package_name, language, project_path, is_dev, is_direct FROM project_dependencies";
 /**
  * 4DA Database accessor
  */
@@ -112,6 +166,24 @@ export class FourDADatabase {
             this.createMinimalSchema();
             this._isStandalone = true;
         }
+        // Schema upgrade for standalone databases created before `is_direct` was
+        // added to the minimal schema: the full-DB init branch queries that column
+        // (DEPENDENCY_GROUP_QUERY), and without it session 2+ of a standalone
+        // install throws, gets caught, and silently disables vulnerability_scan /
+        // dependency_health / upgrade_planner. Scanner-inserted manifest deps are
+        // direct by definition, so DEFAULT 1 backfills correctly. The desktop
+        // app's database already has the column — no-op there.
+        try {
+            const hasDepsTable = this.db
+                .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='project_dependencies'")
+                .get();
+            if (hasDepsTable) {
+                this.ensureColumn("project_dependencies", "is_direct", "INTEGER DEFAULT 1");
+            }
+        }
+        catch (err) {
+            console.error(`[4da] project_dependencies is_direct upgrade failed (dependency tools may be degraded): ${err instanceof Error ? err.message : String(err)}`);
+        }
     }
     /**
      * Whether this database was freshly created in standalone mode
@@ -307,35 +379,10 @@ export class FourDADatabase {
       );
       CREATE INDEX IF NOT EXISTS idx_active_topics_topic ON active_topics(topic);
 
-      -- Topic affinities (learned) — queried by get_context, developer_dna, attention_report
-      CREATE TABLE IF NOT EXISTS topic_affinities (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        topic TEXT NOT NULL UNIQUE,
-        embedding BLOB,
-        positive_signals INTEGER DEFAULT 0,
-        negative_signals INTEGER DEFAULT 0,
-        total_exposures INTEGER DEFAULT 0,
-        affinity_score REAL DEFAULT 0.0,
-        confidence REAL DEFAULT 0.0,
-        last_interaction TEXT DEFAULT (datetime('now')),
-        decay_applied INTEGER DEFAULT 0,
-        created_at TEXT DEFAULT (datetime('now')),
-        updated_at TEXT DEFAULT (datetime('now'))
-      );
-
-      -- Anti-topics (learned exclusions) — queried by get_context
-      CREATE TABLE IF NOT EXISTS anti_topics (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        topic TEXT NOT NULL UNIQUE,
-        rejection_count INTEGER DEFAULT 0,
-        confidence REAL DEFAULT 0.0,
-        auto_detected INTEGER DEFAULT 1,
-        user_confirmed INTEGER DEFAULT 0,
-        first_rejection TEXT DEFAULT (datetime('now')),
-        last_rejection TEXT DEFAULT (datetime('now')),
-        created_at TEXT DEFAULT (datetime('now')),
-        updated_at TEXT DEFAULT (datetime('now'))
-      );
+      -- topic_affinities / anti_topics are deliberately NOT created: the
+      -- implicit-capture learning system was removed product-wide (AD-029 →
+      -- v20b) and desktop schema 105 dropped both tables. Baking them into
+      -- fresh standalone installs would recreate dead tables no code reads.
 
       -- Interactions — queried by record_feedback, developer_dna, knowledge_gaps
       CREATE TABLE IF NOT EXISTS interactions (
@@ -361,6 +408,7 @@ export class FourDADatabase {
         package_name TEXT NOT NULL,
         version TEXT,
         is_dev INTEGER DEFAULT 0,
+        is_direct INTEGER DEFAULT 1,
         language TEXT NOT NULL,
         last_scanned TEXT NOT NULL DEFAULT (datetime('now')),
         UNIQUE(project_path, package_name)
@@ -788,10 +836,24 @@ export class FourDADatabase {
             query += ` AND source_type = ?`;
             params.push(sourceType);
         }
-        query += ` ORDER BY relevance_score DESC LIMIT ?`;
-        params.push(limit);
+        // Ranked read (desktop audit items 12+26, schema 110): order by the
+        // batch-relative rank when the analysis cycle has ranked the item, falling
+        // back to the evidence score. This mirrors the Rust source of truth —
+        // `RANKED_ORDER_EXPR` in `src-tauri/src/db/scoring_queries.rs` — and must
+        // stay textually in sync with it. The `relevance_score >= ?` membership
+        // filter above deliberately stays on evidence: evidence decides membership,
+        // rank decides order. Guarded on column existence for pre-110 DBs.
+        const rankedOrder = this.hasColumn("source_items", "rank_score")
+            ? `COALESCE(rank_score, relevance_score) DESC`
+            : `relevance_score DESC`;
+        query += ` ORDER BY ${rankedOrder} LIMIT ?`;
+        // Over-fetch so near-duplicate collapsing below can still fill `limit`
+        // (the same story arrives via reddit + rss + mastodon: live feeds showed
+        // three copies of "Rust 1.98.0" in one 20-item response).
+        params.push(limit * 2);
         const stmt = this.db.prepare(query);
-        const items = stmt.all(...params);
+        const fetched = stmt.all(...params);
+        const items = dedupeByTitle(fetched).slice(0, limit);
         const now = Date.now();
         return items.map((item) => {
             const createdAt = new Date(item.created_at.replace(" ", "T") + "Z");
@@ -980,41 +1042,17 @@ export class FourDADatabase {
                 };
             }
         }
-        // Learned preferences
+        // Learned preferences: permanently empty by design. The implicit-capture
+        // learning system was removed product-wide (AD-029 quarantine, then v20b
+        // #488 deleted it) and desktop schema 105 DROPPED topic_affinities /
+        // anti_topics. Even a pre-105 database's rows are quarantined data the
+        // product no longer honors, so they are not read — the fields remain in
+        // the shape for API stability.
         if (includeLearned) {
-            try {
-                const affinitiesStmt = this.db.prepare(`
-          SELECT topic, affinity_score, confidence, positive_signals, negative_signals, total_exposures
-          FROM topic_affinities
-          WHERE confidence > 0.1
-          ORDER BY affinity_score DESC
-          LIMIT 50
-        `);
-                const affinities = affinitiesStmt.all();
-                const antiTopicsStmt = this.db.prepare(`
-          SELECT topic, rejection_count, confidence, auto_detected, user_confirmed
-          FROM anti_topics
-          WHERE confidence > 0.3
-          ORDER BY confidence DESC
-          LIMIT 50
-        `);
-                const antiTopics = antiTopicsStmt.all();
-                context.learned = {
-                    topic_affinities: affinities,
-                    anti_topics: antiTopics.map((at) => ({
-                        ...at,
-                        auto_detected: Boolean(at.auto_detected),
-                        user_confirmed: Boolean(at.user_confirmed),
-                    })),
-                };
-            }
-            catch {
-                // Learned tables might not exist
-                context.learned = {
-                    topic_affinities: [],
-                    anti_topics: [],
-                };
-            }
+            context.learned = {
+                topic_affinities: [],
+                anti_topics: [],
+            };
         }
         return context;
     }
@@ -1486,4 +1524,3 @@ export class FourDADatabase {
 export function createDatabase(dbPath) {
     return new FourDADatabase(dbPath);
 }
-//# sourceMappingURL=db.js.map

package/dist/doctor.d.ts

@@ -12,4 +12,3 @@
  *   4da-mcp --doctor
  */
 export declare function runDoctor(): void;
-//# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.js

@@ -20,12 +20,13 @@ export function runDoctor() {
     // 1. Node.js version
     const nodeVersion = process.version;
     const major = parseInt(nodeVersion.slice(1).split(".")[0], 10);
+    const nodeRequired = 20;
     checks.push({
         name: "Node.js version",
-        status: major >= 18 ? "pass" : "fail",
-        detail: major >= 18
-            ? `${nodeVersion} (>= 18 required)`
-            : `${nodeVersion} — Node.js 18+ required`,
+        status: major >= nodeRequired ? "pass" : "fail",
+        detail: major >= nodeRequired
+            ? `${nodeVersion} (>= ${nodeRequired} required)`
+            : `${nodeVersion} — Node.js ${nodeRequired}+ required`,
     });
     // 2. Native bindings — if we reached here, the dynamic import in db.ts succeeded
     // (it calls process.exit(1) with a diagnostic message on failure)
@@ -69,24 +70,26 @@ export function runDoctor() {
             detail: envExists ? envDb : `Set to ${envDb} but file does not exist`,
         });
     }
-    // 5. LLM providers (optional)
-    const llmProvider = process.env.LLM_PROVIDER;
-    const hasAnthropic = !!process.env.ANTHROPIC_API_KEY;
+    // 5. Semantic recall provider (optional)
+    const embedProvider = process.env.FOURDA_EMBED_PROVIDER;
     const hasOpenAI = !!process.env.OPENAI_API_KEY;
-    if (llmProvider || hasAnthropic || hasOpenAI) {
+    const hasOllama = process.env.FOURDA_EMBED_PROVIDER === "ollama" ||
+        process.env.OLLAMA_HOST ||
+        process.env.OLLAMA_BASE_URL;
+    if (embedProvider || hasOpenAI || hasOllama) {
         checks.push({
-            name: "LLM provider",
+            name: "Semantic recall provider",
             status: "pass",
-            detail: llmProvider
-                ? `${llmProvider} configured`
-                : hasAnthropic ? "Anthropic API key set" : "OpenAI API key set",
+            detail: embedProvider
+                ? `${embedProvider} configured`
+                : hasOllama ? "Ollama endpoint configured" : "OpenAI API key set",
         });
     }
     else {
         checks.push({
-            name: "LLM provider",
+            name: "Semantic recall provider",
             status: "warn",
-            detail: "No API keys set — AI synthesis tools will be unavailable",
+            detail: "Not configured — keyword recall remains available",
         });
     }
     // Print results
@@ -123,4 +126,3 @@ export function runDoctor() {
         console.log("  All checks passed.\n");
     }
 }
-//# sourceMappingURL=doctor.js.map

package/dist/embeddings.d.ts

@@ -85,4 +85,3 @@ export declare function semanticScores(db: FourDADatabase, table: string, query:
 }>, config: EmbeddingConfig, opts?: {
     maxNewEmbeds?: number;
 }): Promise<SemanticScoreResult>;
-//# sourceMappingURL=embeddings.d.ts.map

package/dist/embeddings.js

@@ -289,4 +289,3 @@ function loadStoredEmbeddings(rawDb, table, ids, modelTagValue) {
     }
     return out;
 }
-//# sourceMappingURL=embeddings.js.map

package/dist/http-transport.d.ts

@@ -84,4 +84,3 @@ export declare function enforceBindPolicy(host: string, policy: HttpSecurityPoli
  * Resolves once the server is accepting connections.
  */
 export declare function startHttpServer(factory: () => Server, options?: HttpServerOptions): Promise<HttpServerHandle>;
-//# sourceMappingURL=http-transport.d.ts.map

package/dist/http-transport.js

@@ -220,4 +220,3 @@ export async function startHttpServer(factory, options = { port: DEFAULT_PORT, h
     process.once("SIGTERM", shutdown);
     return { server: httpServer, close };
 }
-//# sourceMappingURL=http-transport.js.map

package/dist/index.d.ts

@@ -9,4 +9,3 @@ import { Server } from "@modelcontextprotocol/server";
  * shares the same lazily-initialized database and live-intelligence layer.
  */
 export declare function buildServer(): Server;
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -42,6 +42,7 @@ import { runSetup } from "./setup.js";
 import { runDoctor } from "./doctor.js";
 import { scanCurrentProject } from "./project-scanner.js";
 import { LiveIntelligence } from "./live/index.js";
+import { deriveTechStackForHeadlines } from "./tools/ecosystem-pulse.js";
 import { setLiveIntelligence } from "./live-singleton.js";
 // Schema registry for slim tool listing + category metadata
 import { getSlimToolList, getSchemaResources, hasToolSchema, getSchemaFilename, getCategoryManifest } from "./schema-registry.js";
@@ -61,7 +62,7 @@ const SERVER_VERSION = (() => {
         return "0.0.0";
     }
 })();
-import { createDatabase, FourDADatabase } from "./db.js";
+import { createDatabase, DEPENDENCY_GROUP_QUERY, FourDADatabase } from "./db.js";
 // =============================================================================
 // Server Setup
 // =============================================================================
@@ -137,7 +138,7 @@ function getDatabase() {
             // npm deps living in sub-packages.
             try {
                 const rawDb = db.getRawDb();
-                const rows = rawDb.prepare("SELECT DISTINCT package_name, language, project_path, is_dev, is_direct FROM project_dependencies").all();
+                const rows = rawDb.prepare(DEPENDENCY_GROUP_QUERY).all();
                 // Scope to the active project root. Sibling projects tracked in the same
                 // database (the ACE engine indexes every local project) must not bleed
                 // into this project's vulnerability scan.
@@ -165,6 +166,17 @@ function getDatabase() {
                 if (groups.size > 0) {
                     liveIntel.initFromDependencyGroups([...groups.values()]);
                 }
+                // Warm the headline cache for ecosystem_pulse — previously only the
+                // standalone branch prefetched, so full-DB servers served an empty
+                // cache forever. Non-blocking; the tool also fetches on demand now.
+                if (liveIntel.isEnabled()) {
+                    const techStack = deriveTechStackForHeadlines(db);
+                    if (techStack.length > 0) {
+                        liveIntel.fetchHeadlines(techStack).catch((err) => {
+                            console.error(`[4DA]   Headline prefetch failed: ${err instanceof Error ? err.message : String(err)}.`);
+                        });
+                    }
+                }
             }
             catch (err) {
                 // Non-fatal — live intel just won't have version data — but log to stderr
@@ -451,12 +463,12 @@ async function main() {
             db.close();
         process.exit(0);
     });
-    const toolCount = getSlimToolList().length;
-    console.error(`4DA MCP Server v${SERVER_VERSION} started — ${toolCount} tools, stdio transport`);
+    const toolCount = getSlimToolList(validation.standalone ? true : undefined).length;
+    const toolLabel = validation.standalone ? "standalone tools" : "tools";
+    console.error(`4DA MCP Server v${SERVER_VERSION} started — ${toolCount} ${toolLabel}, stdio transport`);
     console.error("  Use --http for Streamable HTTP, --setup to configure editors, --doctor to check health");
 }
 main().catch((error) => {
     console.error("Fatal error:", error);
     process.exit(1);
 });
-//# sourceMappingURL=index.js.map

package/dist/live/cache.d.ts

@@ -13,4 +13,3 @@ export declare class LiveCache {
     invalidateSource(source: string): void;
     invalidateAll(): void;
 }
-//# sourceMappingURL=cache.d.ts.map

package/dist/live/cache.js

@@ -58,4 +58,3 @@ export class LiveCache {
         this.db.prepare("DELETE FROM live_cache").run();
     }
 }
-//# sourceMappingURL=cache.js.map

package/dist/live/crates-registry.d.ts

@@ -15,4 +15,3 @@ export declare class CratesRegistry {
     constructor(cache: LiveCache, rateLimiter: RateLimiter);
     getPackageInfo(name: string, currentVersion: string | null, isDev: boolean): Promise<RegistryPackageInfo>;
 }
-//# sourceMappingURL=crates-registry.d.ts.map

package/dist/live/crates-registry.js

@@ -8,7 +8,7 @@
  * Privacy: sends only crate names — public manifest data.
  */
 import { fetchWithTimeout } from "./http-utils.js";
-import { computeSemverDistance, isPreRelease } from "./semver-utils.js";
+import { computeSemverDistance, maxStableSemver } from "./semver-utils.js";
 const CRATES_TIMEOUT_MS = 8_000;
 const CRATES_CACHE_TTL = 86_400; // 24 hours
 export class CratesRegistry {
@@ -105,13 +105,11 @@ function parseIndexLines(text) {
     }
     return entries;
 }
+// Semver-max among non-yanked entries, not last-published: rsa published
+// 0.9.10 after 0.10.0-rc.*, so last-entry scanning reported the older line
+// as latest stable (see maxStableSemver).
 function findLatestStable(entries) {
-    for (let i = entries.length - 1; i >= 0; i--) {
-        if (!entries[i].yanked && !isPreRelease(entries[i].vers)) {
-            return entries[i].vers;
-        }
-    }
-    return null;
+    return maxStableSemver(entries.filter((e) => !e.yanked).map((e) => e.vers));
 }
 function errorResult(name, currentVersion, isDev, fetchError) {
     return {
@@ -130,4 +128,3 @@ function errorResult(name, currentVersion, isDev, fetchError) {
         fetchError,
     };
 }
-//# sourceMappingURL=crates-registry.js.map

package/dist/live/cvss.d.ts

@@ -13,4 +13,3 @@
  * v2/v4, or malformed).
  */
 export declare function cvssBaseScore(vector: string): number | null;
-//# sourceMappingURL=cvss.d.ts.map

package/dist/live/cvss.js

@@ -59,4 +59,3 @@ export function cvssBaseScore(vector) {
     const raw = scope === "C" ? 1.08 * (impact + exploitability) : impact + exploitability;
     return roundUp(Math.min(raw, 10));
 }
-//# sourceMappingURL=cvss.js.map

package/dist/live/go-registry.d.ts

@@ -16,4 +16,3 @@ export declare class GoRegistry {
     constructor(cache: LiveCache, rateLimiter: RateLimiter);
     getPackageInfo(name: string, currentVersion: string | null, isDev: boolean): Promise<RegistryPackageInfo>;
 }
-//# sourceMappingURL=go-registry.d.ts.map

package/dist/live/go-registry.js

@@ -9,7 +9,7 @@
  * Privacy: sends only module paths -- public manifest data.
  */
 import { fetchJson, fetchWithTimeout } from "./http-utils.js";
-import { computeSemverDistance, isPreRelease } from "./semver-utils.js";
+import { computeSemverDistance, isPreRelease, maxStableSemver } from "./semver-utils.js";
 const GO_PROXY_URL = "https://proxy.golang.org";
 const GO_TIMEOUT_MS = 8_000;
 const GO_CACHE_TTL = 86_400; // 24 hours
@@ -99,13 +99,9 @@ function escapeModulePath(mod) {
  * Versions use "v" prefix (v1.2.3) -- strip for prerelease check.
  */
 function findLatestStable(versions) {
-    for (let i = versions.length - 1; i >= 0; i--) {
-        const v = versions[i];
-        if (!isPreRelease(v.replace(/^v/, ""))) {
-            return v;
-        }
-    }
-    return null;
+    // Semver-max, not last-listed (see maxStableSemver). parseSemver strips the
+    // "v" prefix; isPreRelease needs it stripped here.
+    return maxStableSemver(versions.filter((v) => !isPreRelease(v.replace(/^v/, ""))));
 }
 function errorResult(name, currentVersion, isDev, fetchError) {
     return {
@@ -124,4 +120,3 @@ function errorResult(name, currentVersion, isDev, fetchError) {
         fetchError,
     };
 }
-//# sourceMappingURL=go-registry.js.map

package/dist/live/hn-fetcher.d.ts

@@ -16,4 +16,3 @@ export declare class HNFetcher {
     fetch(techStack: string[]): Promise<LiveHeadline[]>;
     private searchHN;
 }
-//# sourceMappingURL=hn-fetcher.d.ts.map

package/dist/live/hn-fetcher.js

@@ -53,10 +53,14 @@ export class HNFetcher {
         return headlines;
     }
     async searchHN(query) {
+        // "Pulse" means current: without a recency floor Algolia's point-sorted
+        // results are dominated by multi-year-old all-time hits (e.g. the Tauri
+        // 1.0 launch), which is archaeology, not ecosystem news.
+        const fourteenDaysAgo = Math.floor(Date.now() / 1000) - 14 * 24 * 60 * 60;
         const params = new URLSearchParams({
             query,
             tags: "story",
-            numericFilters: `points>${MIN_POINTS}`,
+            numericFilters: `points>${MIN_POINTS},created_at_i>${fourteenDaysAgo}`,
             hitsPerPage: String(RESULTS_PER_QUERY),
         });
         const url = `${HN_ALGOLIA_URL}?${params}`;
@@ -82,12 +86,16 @@ function buildQueries(techStack) {
     return prioritized;
 }
 function wordBoundaryMatch(text, term) {
-    const idx = text.indexOf(term);
-    if (idx === -1)
-        return false;
-    const before = idx === 0 || !/[a-zA-Z0-9]/.test(text[idx - 1]);
-    const after = idx + term.length >= text.length || !/[a-zA-Z0-9]/.test(text[idx + term.length]);
-    return before && after;
+    // Check EVERY occurrence — indexOf-only missed "react" in a title whose
+    // first hit was inside "reactor".
+    let idx = -1;
+    while ((idx = text.indexOf(term, idx + 1)) !== -1) {
+        const before = idx === 0 || !/[a-zA-Z0-9]/.test(text[idx - 1]);
+        const after = idx + term.length >= text.length || !/[a-zA-Z0-9]/.test(text[idx + term.length]);
+        if (before && after)
+            return true;
+    }
+    return false;
 }
 function scoreAndMap(hits, techStack) {
     const techLower = techStack.map((t) => t.toLowerCase());
@@ -95,6 +103,13 @@ function scoreAndMap(hits, techStack) {
         .map((hit) => {
         const titleLower = hit.title.toLowerCase();
         const matchedTech = techLower.filter((t) => wordBoundaryMatch(titleLower, t));
+        return { hit, matchedTech };
+    })
+        // The tool's contract is "filtered by detected technologies" — a hit whose
+        // title matches none of the user's stack is Algolia query noise (nuclear
+        // "reactors" and weather stories arrived this way), not ecosystem news.
+        .filter(({ matchedTech }) => matchedTech.length > 0)
+        .map(({ hit, matchedTech }) => {
         const techBoost = Math.min(matchedTech.length * 0.2, 0.4);
         const pointsBoost = Math.min(hit.points / 500, 0.3);
         const commentsBoost = Math.min(hit.num_comments / 200, 0.2);
@@ -108,9 +123,7 @@ function scoreAndMap(hits, techStack) {
             comments: hit.num_comments,
             published: hit.created_at,
             relevanceScore: Math.round(score * 100) / 100,
-            relevanceReason: matchedTech.length > 0
-                ? `Matches your stack: ${matchedTech.join(", ")}`
-                : `Trending (${hit.points} points)`,
+            relevanceReason: `Matches your stack: ${matchedTech.join(", ")}`,
         };
     })
         .sort((a, b) => b.relevanceScore - a.relevanceScore)
@@ -120,4 +133,3 @@ const SKIP_TERMS = new Set([
     "javascript", "typescript", // too generic, floods results
     "docker", // too broad
 ]);
-//# sourceMappingURL=hn-fetcher.js.map

package/dist/live/http-utils.d.ts

@@ -1,3 +1,2 @@
 export declare function fetchWithTimeout(url: string, options?: RequestInit, timeoutMs?: number): Promise<Response>;
 export declare function fetchJson<T>(url: string, options?: RequestInit, timeoutMs?: number): Promise<T>;
-//# sourceMappingURL=http-utils.d.ts.map

package/dist/live/http-utils.js

@@ -17,4 +17,3 @@ export async function fetchJson(url, options = {}, timeoutMs = DEFAULT_TIMEOUT_M
     }
     return (await response.json());
 }
-//# sourceMappingURL=http-utils.js.map