@4da/mcp-server 5.0.2 → 5.0.4

package/dist/live/index.d.ts

@@ -93,4 +93,3 @@ export declare class LiveIntelligence {
     fetchRegistryHealth(deps: ResolvedDependency[]): Promise<RegistryPackageInfo[]>;
     getStatus(): LiveIntelligenceStatus;
 }
-//# sourceMappingURL=index.d.ts.map

package/dist/live/index.js

@@ -295,4 +295,3 @@ function emptyVulnResult(projectPath, offline) {
         offline,
     };
 }
-//# sourceMappingURL=index.js.map

package/dist/live/npm-registry.d.ts

@@ -16,4 +16,3 @@ export declare class NpmRegistry {
     getPackageInfo(name: string, currentVersion: string | null, isDev: boolean): Promise<RegistryPackageInfo>;
     getBulkDownloads(names: string[]): Promise<Map<string, number>>;
 }
-//# sourceMappingURL=npm-registry.d.ts.map

package/dist/live/npm-registry.js

@@ -8,7 +8,7 @@
  * Privacy: sends only package names — public manifest data.
  */
 import { fetchJson, fetchWithTimeout } from "./http-utils.js";
-import { computeSemverDistance, isPreRelease } from "./semver-utils.js";
+import { computeSemverDistance, maxStableSemver } from "./semver-utils.js";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
 const NPM_DOWNLOADS_URL = "https://api.npmjs.org/downloads/point/last-week";
 const NPM_TIMEOUT_MS = 8_000;
@@ -127,13 +127,10 @@ export class NpmRegistry {
         return result;
     }
 }
+// Semver-max, not last-published: maintenance releases of older lines are
+// published after newer lines (see maxStableSemver).
 function findLatestStable(versions) {
-    for (let i = versions.length - 1; i >= 0; i--) {
-        if (!isPreRelease(versions[i])) {
-            return versions[i];
-        }
-    }
-    return null;
+    return maxStableSemver(versions);
 }
 function errorResult(name, currentVersion, isDev, fetchError) {
     return {
@@ -152,4 +149,3 @@ function errorResult(name, currentVersion, isDev, fetchError) {
         fetchError,
     };
 }
-//# sourceMappingURL=npm-registry.js.map

package/dist/live/osv-scanner.d.ts

@@ -8,7 +8,7 @@
  */
 import type { LiveCache } from "./cache.js";
 import type { RateLimiter } from "./rate-limiter.js";
-import type { ResolvedDependency, VulnerabilityScanResult } from "./types.js";
+import type { ResolvedDependency, OsvVulnerability, VulnerabilityScanResult } from "./types.js";
 export declare class OsvScanner {
     private cache;
     private rateLimiter;
@@ -28,4 +28,22 @@ export declare function extractCvssScore(severity: Array<{
     type: string;
     score: string;
 }> | undefined): number | null;
-//# sourceMappingURL=osv-scanner.d.ts.map
+/**
+ * Pick the fix version for the OSV range that actually CONTAINS the installed
+ * version — never another release line's fix. The old code returned the first
+ * range's first `fixed` event, so a multi-range advisory (e.g. undici fixed at
+ * 6.x on the 6 line and 7.x on the 7 line) recommended a DOWNGRADE to 6.x for
+ * an installed 7.x.
+ *
+ * Selection order:
+ * 1. The `fixed` of the interval containing installed (introduced <= installed
+ *    < fixed).
+ * 2. If that interval has no fix (or none contains installed), the smallest
+ *    published fix strictly ABOVE installed across all ranges.
+ * 3. If the installed version is unparseable, the highest published fix (it
+ *    resolves the advisory regardless of release line).
+ * 4. Otherwise null — omitting the recommendation beats emitting a downgrade.
+ *
+ * Hard guard: the returned version is never below the installed version.
+ */
+export declare function extractFixedVersion(affected: OsvVulnerability["affected"] | undefined, packageName: string, ecosystem: string, installedVersion: string | null): string | null;

package/dist/live/osv-scanner.js

@@ -9,6 +9,7 @@
  */
 import { fetchWithTimeout, fetchJson } from "./http-utils.js";
 import { cvssBaseScore } from "./cvss.js";
+import { compareSemver, maxSemver, parseSemver } from "./semver-utils.js";
 const OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
 const OSV_VULN_URL = "https://api.osv.dev/v1/vulns/";
 const OSV_TIMEOUT_MS = 15_000;
@@ -174,7 +175,7 @@ export class OsvScanner {
 }
 function mapVulnerability(vuln, dep) {
     const { severity, cvssScore } = deriveSeverity(vuln);
-    const fixedVersion = extractFixedVersion(vuln.affected, dep.name, dep.ecosystem);
+    const fixedVersion = extractFixedVersion(vuln.affected, dep.name, dep.ecosystem, dep.version);
     return {
         package: dep.name,
         currentVersion: dep.version || "unknown",
@@ -260,19 +261,91 @@ function cvssToSeverity(score) {
         return "low";
     return "unknown";
 }
-function extractFixedVersion(affected, packageName, ecosystem) {
+/**
+ * Pick the fix version for the OSV range that actually CONTAINS the installed
+ * version — never another release line's fix. The old code returned the first
+ * range's first `fixed` event, so a multi-range advisory (e.g. undici fixed at
+ * 6.x on the 6 line and 7.x on the 7 line) recommended a DOWNGRADE to 6.x for
+ * an installed 7.x.
+ *
+ * Selection order:
+ * 1. The `fixed` of the interval containing installed (introduced <= installed
+ *    < fixed).
+ * 2. If that interval has no fix (or none contains installed), the smallest
+ *    published fix strictly ABOVE installed across all ranges.
+ * 3. If the installed version is unparseable, the highest published fix (it
+ *    resolves the advisory regardless of release line).
+ * 4. Otherwise null — omitting the recommendation beats emitting a downgrade.
+ *
+ * Hard guard: the returned version is never below the installed version.
+ */
+export function extractFixedVersion(affected, packageName, ecosystem, installedVersion) {
     if (!affected)
         return null;
+    const intervals = collectVulnerableIntervals(affected, packageName, ecosystem);
+    const fixes = intervals
+        .map((i) => i.fixed)
+        .filter((f) => f !== null);
+    if (fixes.length === 0)
+        return null;
+    if (installedVersion === null || parseSemver(installedVersion) === null) {
+        // Can't place the installed version on a release line — recommend the
+        // highest published fix so the upgrade resolves the advisory either way.
+        return maxSemver(fixes);
+    }
+    // The interval whose release line the installed version sits on. `compareSemver`
+    // returns 0 for unparseable bounds (e.g. introduced "0" = since inception),
+    // which keeps those intervals eligible on the introduced side only.
+    const containing = intervals.find((i) => compareSemver(installedVersion, i.introduced) >= 0 &&
+        (i.fixed === null || compareSemver(installedVersion, i.fixed) < 0));
+    if (containing?.fixed &&
+        compareSemver(containing.fixed, installedVersion) > 0) {
+        return containing.fixed;
+    }
+    // No fix on the installed line (open interval, or installed already past
+    // every containing range): smallest fix strictly above installed, or nothing.
+    const above = fixes.filter((f) => compareSemver(f, installedVersion) > 0);
+    if (above.length === 0)
+        return null;
+    return above.reduce((min, v) => (compareSemver(v, min) < 0 ? v : min), above[0]);
+}
+/**
+ * Flatten the matching package's version ranges into [introduced, fixed)
+ * intervals. OSV sorts events within a range; each `introduced` opens an
+ * interval and the next `fixed` closes it. GIT ranges hold commit hashes,
+ * not versions, and are skipped.
+ */
+function collectVulnerableIntervals(affected, packageName, ecosystem) {
+    const intervals = [];
     for (const a of affected) {
-        if (a.package.name === packageName && a.package.ecosystem === ecosystem) {
-            for (const range of a.ranges || []) {
-                for (const event of range.events || []) {
-                    if (event.fixed)
-                        return event.fixed;
+        if (a.package.name !== packageName || a.package.ecosystem !== ecosystem)
+            continue;
+        for (const range of a.ranges || []) {
+            if (range.type === "GIT")
+                continue;
+            let open = null;
+            for (const event of range.events || []) {
+                if (event.introduced !== undefined) {
+                    if (open)
+                        intervals.push(open);
+                    open = { introduced: event.introduced, fixed: null };
+                }
+                else if (event.fixed !== undefined) {
+                    if (open) {
+                        open.fixed = event.fixed;
+                        intervals.push(open);
+                        open = null;
+                    }
+                    else {
+                        // `fixed` with no preceding `introduced` — treat as vulnerable
+                        // since inception ("0" = OSV's since-the-beginning sentinel).
+                        intervals.push({ introduced: "0", fixed: event.fixed });
+                    }
                 }
             }
+            if (open)
+                intervals.push(open);
         }
     }
-    return null;
+    return intervals;
 }
-//# sourceMappingURL=osv-scanner.js.map

package/dist/live/platform.d.ts

@@ -29,4 +29,3 @@ export declare function hostTarget(): HostTarget;
 export declare function targetActiveOnHost(target: string | null | undefined, host?: HostTarget): boolean;
 /** Evaluate a cfg predicate body (already unwrapped from `cfg( ... )`). */
 export declare function evalCfg(expr: string, host?: HostTarget): boolean;
-//# sourceMappingURL=platform.d.ts.map

package/dist/live/platform.js

@@ -153,4 +153,3 @@ function tripleActiveOnHost(triple, host) {
         return false;
     return true;
 }
-//# sourceMappingURL=platform.js.map

package/dist/live/pypi-registry.d.ts

@@ -15,4 +15,3 @@ export declare class PyPIRegistry {
     constructor(cache: LiveCache, rateLimiter: RateLimiter);
     getPackageInfo(name: string, currentVersion: string | null, isDev: boolean): Promise<RegistryPackageInfo>;
 }
-//# sourceMappingURL=pypi-registry.d.ts.map

package/dist/live/pypi-registry.js

@@ -8,7 +8,7 @@
  * Privacy: sends only package names -- public manifest data.
  */
 import { fetchJson } from "./http-utils.js";
-import { computeSemverDistance, isPreRelease } from "./semver-utils.js";
+import { computeSemverDistance, isPreRelease, maxStableSemver } from "./semver-utils.js";
 const PYPI_BASE_URL = "https://pypi.org/pypi";
 const PYPI_TIMEOUT_MS = 8_000;
 const PYPI_CACHE_TTL = 86_400; // 24 hours
@@ -83,17 +83,15 @@ export class PyPIRegistry {
     }
 }
 function findLatestStable(versions, releases) {
-    for (let i = versions.length - 1; i >= 0; i--) {
-        const v = versions[i];
+    // Semver-max among eligible versions, not last-listed (see maxStableSemver).
+    const eligible = versions.filter((v) => {
         if (isPreRelease(v))
-            continue;
+            return false;
         // Skip if all files for this version are yanked
         const files = releases[v];
-        if (files && files.length > 0 && files.every((f) => f.yanked))
-            continue;
-        return v;
-    }
-    return null;
+        return !(files && files.length > 0 && files.every((f) => f.yanked));
+    });
+    return maxStableSemver(eligible);
 }
 function getLastPublished(files) {
     if (!files || files.length === 0)
@@ -139,4 +137,3 @@ function errorResult(name, currentVersion, isDev, fetchError) {
         fetchError,
     };
 }
-//# sourceMappingURL=pypi-registry.js.map

package/dist/live/rate-limiter.d.ts

@@ -28,4 +28,3 @@ export declare const DEFAULT_RATE_LIMITS: {
         maxPerMinute: number;
     };
 };
-//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/live/rate-limiter.js

@@ -53,4 +53,3 @@ export const DEFAULT_RATE_LIMITS = {
     pypi: { maxPerMinute: 60 },
     go: { maxPerMinute: 60 },
 };
-//# sourceMappingURL=rate-limiter.js.map

package/dist/live/semver-utils.d.ts

@@ -10,4 +10,14 @@ export declare function isPreRelease(version: string): boolean;
 export declare function compareSemver(a: string, b: string): number;
 /** Highest version (by MAJOR.MINOR.PATCH) from a list, or null if empty. */
 export declare function maxSemver(versions: string[]): string | null;
-//# sourceMappingURL=semver-utils.d.ts.map
+/**
+ * Highest NON-prerelease version by semver from a list.
+ *
+ * Registries list versions in publish order, and maintenance releases for an
+ * older line land AFTER newer lines (React published 19.0.8 after 19.2.x; rsa
+ * published 0.9.10 after 0.10.0-rc.*). Taking the "last stable entry" therefore
+ * reported an older line as the latest stable — which surfaced as a bogus
+ * stable version in dependency_health and a literal DOWNGRADE recommendation
+ * in upgrade_planner. Order-independent max fixes the class.
+ */
+export declare function maxStableSemver(versions: string[]): string | null;

package/dist/live/semver-utils.js

@@ -49,4 +49,17 @@ export function maxSemver(versions) {
         return null;
     return versions.reduce((max, v) => (compareSemver(v, max) > 0 ? v : max), versions[0]);
 }
-//# sourceMappingURL=semver-utils.js.map
+/**
+ * Highest NON-prerelease version by semver from a list.
+ *
+ * Registries list versions in publish order, and maintenance releases for an
+ * older line land AFTER newer lines (React published 19.0.8 after 19.2.x; rsa
+ * published 0.9.10 after 0.10.0-rc.*). Taking the "last stable entry" therefore
+ * reported an older line as the latest stable — which surfaced as a bogus
+ * stable version in dependency_health and a literal DOWNGRADE recommendation
+ * in upgrade_planner. Order-independent max fixes the class.
+ */
+export function maxStableSemver(versions) {
+    const stable = versions.filter((v) => parseSemver(v) !== null && !isPreRelease(v));
+    return maxSemver(stable);
+}

package/dist/live/types.d.ts

@@ -153,4 +153,3 @@ export interface DependencyHealthResult {
     scanDurationMs: number;
     cached: boolean;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/live/types.js

@@ -1,3 +1,2 @@
 // SPDX-License-Identifier: Apache-2.0
 export {};
-//# sourceMappingURL=types.js.map

package/dist/live/version-resolver.d.ts

@@ -23,4 +23,3 @@ export declare function resolveVersions(cwd: string, deps: string[], devDeps: st
  * Direct dependency health and upgrade planning continue to use resolveVersions.
  */
 export declare function resolveAuditVersions(cwd: string, deps: string[], devDeps: string[], language: string, targets?: Record<string, string>): ResolvedDependency[];
-//# sourceMappingURL=version-resolver.d.ts.map

package/dist/live/version-resolver.js

@@ -411,4 +411,3 @@ function extractVersionFromSpec(spec) {
     const match = spec.match(/(\d+\.\d+\.\d+(?:-[\w.]+)?)/);
     return match ? match[1] : null;
 }
-//# sourceMappingURL=version-resolver.js.map

package/dist/live-singleton.d.ts

@@ -6,4 +6,3 @@
 import type { LiveIntelligence } from "./live/index.js";
 export declare function setLiveIntelligence(li: LiveIntelligence): void;
 export declare function getLiveIntelligence(): LiveIntelligence | null;
-//# sourceMappingURL=live-singleton.d.ts.map

package/dist/live-singleton.js

@@ -11,4 +11,3 @@ export function setLiveIntelligence(li) {
 export function getLiveIntelligence() {
     return instance;
 }
-//# sourceMappingURL=live-singleton.js.map

package/dist/project-scanner.d.ts

@@ -31,4 +31,3 @@ export interface ProjectScanResult {
  * Only reads manifest files at the root level — no recursion.
  */
 export declare function scanCurrentProject(cwd: string): ProjectScanResult;
-//# sourceMappingURL=project-scanner.d.ts.map

package/dist/project-scanner.js

@@ -453,4 +453,3 @@ function isNotableTopic(name) {
     ]);
     return notable.has(name);
 }
-//# sourceMappingURL=project-scanner.js.map

package/dist/schema-registry.d.ts

@@ -1,8 +1,14 @@
 /**
  * Schema Registry for Dynamic Context Discovery
  *
- * Reduces tool listing from ~4500 tokens to ~500 tokens by:
- * - Returning only one-liner summaries in list_tools
+ * Reduces tool listing from ~4500 tokens to ~1300 tokens by:
+ * - Returning one-liner summaries in list_tools
+ * - Serving the REAL inputSchema only for tools with REQUIRED parameters
+ *   (AD-032): a client cannot construct a valid call to those without the
+ *   schema, and most clients never read MCP Resources — so a slim
+ *   `{type:"object"}` made required-param tools effectively uncallable.
+ *   All-optional tools stay slim (`{}` is a valid call) with the full
+ *   schema still available as a Resource.
  * - Storing full schemas as MCP Resources (lazy-loaded)
  *
  * Also provides category/tag metadata for tool discovery and filtering.
@@ -39,16 +45,20 @@ export interface ToolRegistryEntry {
  * 14 tools total: 9 standalone + 5 full-mode.
  */
 export declare const TOOL_REGISTRY: Record<string, ToolRegistryEntry>;
+/** An inputSchema as tools/list serves it — the MCP Tool contract requires
+ * the literal `type: "object"` at the root. */
+export type ToolInputSchema = {
+    type: "object";
+} & Record<string, unknown>;
 /**
- * Get slim tool list for list_tools response
- * Returns minimal schema (just type: object) — full schema via resources
+ * Get the tool list for the tools/list response: slim summaries throughout,
+ * real inputSchema for required-param tools, `{type:"object"}` otherwise
+ * (full schema via resources).
  */
 export declare function getSlimToolList(standaloneOnly?: boolean): Array<{
     name: string;
     description: string;
-    inputSchema: {
-        type: "object";
-    };
+    inputSchema: ToolInputSchema;
     annotations: ToolAnnotations;
 }>;
 /**
@@ -77,4 +87,3 @@ export declare function getCategoryManifest(): {
 };
 /** Find tools matching any of the given tags */
 export declare function getToolsByTags(tags: string[]): string[];
-//# sourceMappingURL=schema-registry.d.ts.map

package/dist/schema-registry.js

@@ -2,8 +2,14 @@
 /**
  * Schema Registry for Dynamic Context Discovery
  *
- * Reduces tool listing from ~4500 tokens to ~500 tokens by:
- * - Returning only one-liner summaries in list_tools
+ * Reduces tool listing from ~4500 tokens to ~1300 tokens by:
+ * - Returning one-liner summaries in list_tools
+ * - Serving the REAL inputSchema only for tools with REQUIRED parameters
+ *   (AD-032): a client cannot construct a valid call to those without the
+ *   schema, and most clients never read MCP Resources — so a slim
+ *   `{type:"object"}` made required-param tools effectively uncallable.
+ *   All-optional tools stay slim (`{}` is a valid call) with the full
+ *   schema still available as a Resource.
  * - Storing full schemas as MCP Resources (lazy-loaded)
  *
  * Also provides category/tag metadata for tool discovery and filtering.
@@ -11,6 +17,9 @@
  * Full schemas available at: 4da://schema/{tool_name}
  * Category manifest at: 4da://categories
  */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
 /**
  * Slim tool registry — one-liner descriptions + category/tag metadata.
  * Full schemas are stored in schemas/*.json and exposed as MCP Resources.
@@ -61,7 +70,7 @@ export const TOOL_REGISTRY = {
         annotations: { readOnlyHint: true, openWorldHint: true },
     },
     get_context: {
-        summary: "What 4DA knows about the user: role, tech stack, interests, and learned affinities. Call FIRST when you need to know what the user works on before answering or recommending.",
+        summary: "What 4DA knows about the user: role, tech stack, interests, exclusions, and ACE-detected context. Call FIRST when you need to know what the user works on before answering or recommending.",
         schemaFile: "get-context.json",
         category: "intelligence",
         tags: ["context", "interests", "tech-stack", "profile"],
@@ -93,10 +102,10 @@ export const TOOL_REGISTRY = {
         annotations: { readOnlyHint: true, openWorldHint: false },
     },
     record_feedback: {
-        summary: "Record click/save/dismiss on a content item to sharpen future scoring. Call AFTER the user reacts to a surfaced item (opens, saves, or dismisses it).",
+        summary: "Record click/save/dismiss on a content item as explicit interaction history. Call AFTER the user reacts to a surfaced item (opens, saves, or dismisses it).",
         schemaFile: "record-feedback.json",
         category: "intelligence",
-        tags: ["feedback", "learning", "save", "dismiss"],
+        tags: ["feedback", "history", "save", "dismiss"],
         standalone: false,
         annotations: { readOnlyHint: false, openWorldHint: false, destructiveHint: false, idempotentHint: false },
     },
@@ -136,9 +145,46 @@ export const TOOL_REGISTRY = {
         annotations: { readOnlyHint: true, openWorldHint: false },
     },
 };
+/** Schemas live beside this module in both layouts: src/schemas (vitest) and
+ * dist/schemas (compiled — populated by the copy-schemas build step). */
+const SCHEMAS_DIR = join(dirname(fileURLToPath(import.meta.url)), "schemas");
+/** Lazy cache: tool name → its real inputSchema when the schema declares
+ * required parameters, else null (tool stays slim). */
+const requiredParamSchemas = new Map();
 /**
- * Get slim tool list for list_tools response
- * Returns minimal schema (just type: object) — full schema via resources
+ * The tools/list discoverability line (AD-032): a tool whose schema declares
+ * REQUIRED parameters serves its real inputSchema — `{type:"object"}` hid the
+ * required params from every client that never reads MCP Resources, making
+ * those tools fail on first call (GPT adversarial audit, finding 7). Tools
+ * whose parameters are all optional keep the slim schema: `{}` is a valid
+ * call, and the full schema stays one Resource read away. Fail-open: an
+ * unreadable or malformed schema file falls back to slim rather than
+ * breaking tools/list.
+ */
+function inputSchemaIfRequired(name, schemaFile) {
+    if (!requiredParamSchemas.has(name)) {
+        let loaded = null;
+        try {
+            const parsed = JSON.parse(readFileSync(join(SCHEMAS_DIR, schemaFile), "utf-8"));
+            const schema = parsed.inputSchema;
+            if (schema &&
+                schema.type === "object" &&
+                Array.isArray(schema.required) &&
+                schema.required.length > 0) {
+                loaded = schema;
+            }
+        }
+        catch {
+            loaded = null;
+        }
+        requiredParamSchemas.set(name, loaded);
+    }
+    return requiredParamSchemas.get(name) ?? null;
+}
+/**
+ * Get the tool list for the tools/list response: slim summaries throughout,
+ * real inputSchema for required-param tools, `{type:"object"}` otherwise
+ * (full schema via resources).
  */
 export function getSlimToolList(standaloneOnly) {
     return Object.entries(TOOL_REGISTRY)
@@ -146,7 +192,7 @@ export function getSlimToolList(standaloneOnly) {
         .map(([name, info]) => ({
         name,
         description: info.summary,
-        inputSchema: { type: "object" },
+        inputSchema: inputSchemaIfRequired(name, info.schemaFile) ?? { type: "object" },
         annotations: info.annotations,
     }));
 }
@@ -200,4 +246,3 @@ export function getToolsByTags(tags) {
         .filter(([, entry]) => entry.tags.some((t) => tagSet.has(t.toLowerCase())))
         .map(([name]) => name);
 }
-//# sourceMappingURL=schema-registry.js.map

package/dist/schemas/developer-dna.json

@@ -1,6 +1,6 @@
 {
   "name": "developer_dna",
-  "description": "Export your Developer DNA — a comprehensive profile of your tech identity built from project scans, engagement data, and learned preferences. Includes primary stack, adjacent tech, top dependencies, engaged topics, blind spots, source engagement rates, and aggregate stats. Call when the user asks for a summary of their developer profile, identity, or tech fingerprint.",
+  "description": "Export your Developer DNA — a comprehensive profile of your tech identity built from project scans, explicit interests, and local interaction history. Includes primary stack, adjacent tech, top dependencies, engaged topics, blind spots, source engagement rates, and aggregate stats. Call when the user asks for a summary of their developer profile, identity, or tech fingerprint.",
   "inputSchema": {
     "type": "object",
     "properties": {

package/dist/schemas/get-context.json

@@ -1,6 +1,6 @@
 {
   "name": "get_context",
-  "description": "Get the user's context - what 4DA knows about them.\n\nReturns information about:\n- Static Identity: User-declared role, tech stack, domains, interests, and exclusions\n- ACE Context (optional): Auto-detected technologies and active topics from recent activity\n- Learned Preferences (optional): Topic affinities learned from user behavior\n\nCall FIRST when you need to understand what the user works on or cares about before answering or recommending.",
+  "description": "Get the user's context - what 4DA knows about them.\n\nReturns information about:\n- Static Identity: User-declared role, tech stack, domains, interests, and exclusions\n- ACE Context (optional): Auto-detected technologies and active topics from recent activity\n- Learned Preferences (optional): retained compatibility field; implicit preference learning no longer contributes to scoring\n\nCall FIRST when you need to understand what the user works on or cares about before answering or recommending.",
   "inputSchema": {
     "type": "object",
     "properties": {
@@ -10,7 +10,7 @@
       },
       "include_learned": {
         "type": "boolean",
-        "description": "Include learned preferences (topic affinities, anti-topics). Default: true"
+        "description": "Include the retained learned-preferences compatibility field. Default: true"
       }
     }
   }

package/dist/schemas/get-relevant-content.json

@@ -1,6 +1,6 @@
 {
   "name": "get_relevant_content",
-  "description": "Get filtered relevant content from 4DA's personalized feed.\n\nReturns content items that match the user's interests, tech stack, and learned preferences.\nItems are scored based on:\n- Explicit interests declared by the user\n- Tech stack and domains\n- ACE-detected context (recent files, projects, git activity)\n- Learned preferences from past interactions\n\nIMPORTANT for autonomous use: each item carries an `evidence_class` describing how it is grounded. The relevance_score float is NOT comparable across classes — gate actions on evidence_class, not the number:\n- \"osv_verified\": a security advisory matching one of the user's INSTALLED dependencies — safe to act on\n- \"dependency_grounded\": matched one of the user's declared dependencies — trustworthy\n- \"semantic_only\": topical/embedding relevance with NO dependency edge — surface to the human, verify before acting\n- \"keyword_heuristic\": standalone-mode keyword score (no Rust pipeline) — weakest signal\n\nCall when the user asks what to read, what is relevant to them, or for content on a topic.",
+  "description": "Get filtered relevant content from 4DA's personalized feed.\n\nReturns content items that match the user's explicit interests, tech stack, and ACE-detected context.\nItems are scored based on:\n- Explicit interests declared by the user\n- Tech stack and domains\n- ACE-detected context (recent files, projects, git activity)\n\nIMPORTANT for autonomous use: each item carries an `evidence_class` describing how it is grounded. The relevance_score float is NOT comparable across classes — gate actions on evidence_class, not the number:\n- \"osv_verified\": a security advisory matching one of the user's INSTALLED dependencies — safe to act on\n- \"dependency_grounded\": matched one of the user's declared dependencies — trustworthy\n- \"semantic_only\": topical/embedding relevance with NO dependency edge — surface to the human, verify before acting\n- \"keyword_heuristic\": standalone-mode keyword score (no Rust pipeline) — weakest signal\n\nCall when the user asks what to read, what is relevant to them, or for content on a topic.",
   "inputSchema": {
     "type": "object",
     "properties": {

package/dist/schemas/record-feedback.json

@@ -1,6 +1,6 @@
 {
   "name": "record_feedback",
-  "description": "Record user feedback on a content item.\n\nFeedback actions:\n- \"click\": User clicked/opened the item (moderate positive signal)\n- \"save\": User saved/bookmarked the item (strong positive signal)\n- \"dismiss\": User dismissed the item (weak negative signal)\n- \"mark_irrelevant\": User marked item as not relevant (strong negative signal)\n\nThis feedback helps 4DA learn user preferences over time. Call after the user reacts to a surfaced item (opens, saves, or dismisses it).",
+  "description": "Record explicit user interaction history for a content item.\n\nFeedback actions:\n- \"click\": User clicked/opened the item\n- \"save\": User saved/bookmarked the item\n- \"dismiss\": User dismissed the item\n- \"mark_irrelevant\": User marked item as not relevant\n\nThis records what happened; it does not train content preferences (interaction counts only graduate scoring's bootstrap gate). Call after the user reacts to a surfaced item (opens, saves, or dismisses it).",
   "inputSchema": {
     "type": "object",
     "properties": {

package/dist/setup.d.ts

@@ -15,4 +15,3 @@
  * @param dryRun If true, only report what would be written without modifying files.
  */
 export declare function runSetup(dryRun?: boolean): void;
-//# sourceMappingURL=setup.d.ts.map

package/dist/setup.js

@@ -168,4 +168,3 @@ if (isDirectRun) {
     const dryRun = process.argv.includes("--dry-run");
     runSetup(dryRun);
 }
-//# sourceMappingURL=setup.js.map

package/dist/tool-dispatch.d.ts

@@ -24,4 +24,3 @@ export declare function dispatchTool(name: string, db: FourDADatabase, args: Rec
 export declare function hasDispatchTool(name: string): boolean;
 /** Get count of registered tool executors */
 export declare function getDispatchToolCount(): number;
-//# sourceMappingURL=tool-dispatch.d.ts.map

package/dist/tool-dispatch.js

@@ -58,7 +58,27 @@ export async function dispatchTool(name, db, args) {
         throw new Error(`Unknown tool: ${name}`);
     }
     assertToolPermission(name);
-    const result = await executor(db, (args || {}));
+    // BUSY/LOCKED retry at the single choke point every tool passes through.
+    // The desktop engine writes to the same database every 30 minutes; a read
+    // that collides with its transaction deserves one backoff retry rather than
+    // an immediate error JSON. (db.queryWithRetry existed for this but had no
+    // production caller — it is sync and the executors are async, so the retry
+    // lives here.)
+    const toolArgs = (args || {});
+    let result;
+    try {
+        result = await executor(db, toolArgs);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "SQLITE_BUSY" || code === "SQLITE_LOCKED") {
+            await new Promise((resolve) => setTimeout(resolve, 150));
+            result = await executor(db, toolArgs);
+        }
+        else {
+            throw error;
+        }
+    }
     const payload = FRESHNESS_TOOLS.has(name) ? attachFreshness(db, result) : result;
     return {
         content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
@@ -94,4 +114,3 @@ export function hasDispatchTool(name) {
 export function getDispatchToolCount() {
     return Object.keys(DISPATCH_MAP).length;
 }
-//# sourceMappingURL=tool-dispatch.js.map

package/dist/tools/agent-memory.d.ts

@@ -101,4 +101,3 @@ export declare function memoryEmbedText(row: {
     content: string;
 }): string;
 export declare function executeAgentMemory(db: FourDADatabase, params: AgentMemoryParams): object | Promise<object>;
-//# sourceMappingURL=agent-memory.d.ts.map

package/dist/tools/agent-memory.js

@@ -365,4 +365,3 @@ async function enhanceRecallWithSemantics(db, query, rows, limit, config) {
         recall_mode: sem.embeddedCount > 0 ? "hybrid" : "ranked_lexical",
     };
 }
-//# sourceMappingURL=agent-memory.js.map

package/dist/tools/decision-enforcement.d.ts

@@ -72,4 +72,3 @@ export declare const checkDecisionAlignmentTool: {
 };
 export declare function executeCheckDecisionAlignment(db: FourDADatabase, params: CheckDecisionAlignmentParams): AlignmentResult | Promise<AlignmentResult>;
 export {};
-//# sourceMappingURL=decision-enforcement.d.ts.map