@4da/mcp-server 5.0.2 → 5.0.4

package/dist/tools/decision-enforcement.js

@@ -210,4 +210,3 @@ export function executeCheckDecisionAlignment(db, params) {
     // Provider configured -> hybrid retrieval (returns a Promise; dispatch awaits).
     return hybridDecisionRecall(db, query, candidates, 50, config).then(({ ranked, semanticById, recall_mode }) => assembleAlignment(params, ranked, semanticById, recall_mode));
 }
-//# sourceMappingURL=decision-enforcement.js.map

package/dist/tools/decision-memory.d.ts

@@ -127,4 +127,3 @@ export declare const decisionMemoryTool: {
     };
 };
 export declare function executeDecisionMemory(db: FourDADatabase, params: DecisionMemoryParams): object | Promise<object>;
-//# sourceMappingURL=decision-memory.d.ts.map

package/dist/tools/decision-memory.js

@@ -293,4 +293,3 @@ export function executeDecisionMemory(db, params) {
             return { error: `Unknown action: ${params.action}` };
     }
 }
-//# sourceMappingURL=decision-memory.js.map

package/dist/tools/decision-recall.d.ts

@@ -56,4 +56,3 @@ export declare function decisionEmbedText(row: DecisionLike): string;
  * be embedded.
  */
 export declare function hybridDecisionRecall<T extends DecisionLike>(db: FourDADatabase, query: string, rows: T[], limit: number, config: EmbeddingConfig): Promise<DecisionRecallResult<T>>;
-//# sourceMappingURL=decision-recall.d.ts.map

package/dist/tools/decision-recall.js

@@ -84,4 +84,3 @@ export async function hybridDecisionRecall(db, query, rows, limit, config) {
         .map((x) => x.row);
     return { ranked, semanticById: sem.semanticById, recall_mode: "hybrid" };
 }
-//# sourceMappingURL=decision-recall.js.map

package/dist/tools/dependency-health.d.ts

@@ -42,4 +42,3 @@ export declare const dependencyHealthTool: {
     };
 };
 export declare function executeDependencyHealth(_db: FourDADatabase, params: DependencyHealthParams, liveIntel: LiveIntelligence | null): Promise<DependencyHealthResult>;
-//# sourceMappingURL=dependency-health.d.ts.map

package/dist/tools/dependency-health.js

@@ -112,11 +112,38 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
     });
     const limit = params.limit ?? 50;
     const limited = sorted.slice(0, limit);
-    // Health score: 100 = perfect, 0 = everything is on fire
+    // Health score: 100 = perfect. Proportional and severity-weighted — the old
+    // absolute-count formula (15 points per vulnerable package, 2 per outdated,
+    // regardless of severity, degree, or project size) pinned any real-sized
+    // project at 0/100: a patch-behind dep cost the same as a critical CVE and
+    // the number informed nothing.
     const total = registryData.length || 1;
-    const vulnPenalty = Math.min(vulnerable * 15, 50);
-    const deprecatedPenalty = Math.min(deprecated * 10, 30);
-    const outdatedPenalty = Math.min(outdated * 2, 40);
+    // Vulnerabilities: severity-weighted; transitive findings at one-third
+    // weight (their fix arrives via a parent bump — the direct surface is what
+    // the user controls directly).
+    const sevWeight = { critical: 20, high: 10, medium: 4, low: 1 };
+    let vulnPenaltyRaw = 0;
+    if (vulnResult) {
+        for (const v of vulnResult.vulnerabilities) {
+            const w = sevWeight[v.severity] ?? 2; // "unknown" (mostly unmaintained-notices) counts low
+            vulnPenaltyRaw += v.isDirect ? w : w / 3;
+        }
+    }
+    const vulnPenalty = Math.min(Math.round(vulnPenaltyRaw), 55);
+    // Staleness: degree-weighted and proportional to the tracked set — a major
+    // behind is a real liability, a patch behind is routine drift.
+    let stalenessWeight = 0;
+    for (const dep of registryData) {
+        const label = dep.versionsBehind?.label;
+        if (label === "major")
+            stalenessWeight += 1;
+        else if (label === "minor")
+            stalenessWeight += 0.35;
+        else if (label === "patch")
+            stalenessWeight += 0.1;
+    }
+    const outdatedPenalty = Math.min(30, Math.round((stalenessWeight / total) * 60));
+    const deprecatedPenalty = Math.min(deprecated * 8, 15);
     const healthScore = Math.max(0, 100 - vulnPenalty - deprecatedPenalty - outdatedPenalty);
     const vulnSummary = vulnResult ? {
         critical: vulnResult.bySeverity.critical,
@@ -151,4 +178,3 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
         cached: false,
     };
 }
-//# sourceMappingURL=dependency-health.js.map

package/dist/tools/developer-dna.d.ts

@@ -2,7 +2,7 @@
  * developer_dna tool
  *
  * Export a comprehensive Developer DNA profile built from project scans,
- * engagement data, and learned preferences.
+ * explicit interests, and local interaction history.
  */
 import type { FourDADatabase } from "../db.js";
 export interface DeveloperDnaParams {
@@ -46,7 +46,8 @@ interface EngagedTopic {
 interface BlindSpotEntry {
     dependency: string;
     severity: string;
-    days_stale: number;
+    /** Days since last engagement with content about this dep; null = never engaged. */
+    days_stale: number | null;
 }
 interface SourceEngagement {
     source_type: string;
@@ -76,4 +77,3 @@ interface DeveloperDna {
 }
 export declare function executeDeveloperDna(db: FourDADatabase, params: DeveloperDnaParams): DeveloperDna;
 export {};
-//# sourceMappingURL=developer-dna.d.ts.map

package/dist/tools/developer-dna.js

@@ -3,14 +3,14 @@
  * developer_dna tool
  *
  * Export a comprehensive Developer DNA profile built from project scans,
- * engagement data, and learned preferences.
+ * explicit interests, and local interaction history.
  */
 // =============================================================================
 // Tool Definition
 // =============================================================================
 export const developerDnaTool = {
     name: "developer_dna",
-    description: `Export your Developer DNA — a comprehensive profile of your tech identity built from project scans, engagement data, and learned preferences. Includes primary stack, adjacent tech, top dependencies, engaged topics, blind spots, source engagement rates, and aggregate stats.`,
+    description: `Export your Developer DNA — a comprehensive profile of your tech identity built from project scans, explicit interests, and local interaction history. Includes primary stack, adjacent tech, top dependencies, engaged topics, blind spots, source engagement rates, and aggregate stats.`,
     inputSchema: {
         type: "object",
         properties: {
@@ -135,24 +135,40 @@ export function executeDeveloperDna(db, params) {
         // table may not exist
     }
     // -------------------------------------------------------------------------
-    // 5. Top Engaged Topics — from topic_affinities
+    // 5. Top Engaged Topics — from explicit interactions (topic_affinities was
+    // dropped with the implicit-capture system in desktop schema 105; querying
+    // it returned empty forever).
     // -------------------------------------------------------------------------
     let topEngagedTopics = [];
     try {
-        const affinityRows = rawDb
-            .prepare(`SELECT topic, positive_signals, negative_signals, total_exposures
-         FROM topic_affinities
-         WHERE positive_signals > 0
-         ORDER BY positive_signals DESC
-         LIMIT ?`)
-            .all(maxTopics);
-        const totalPositive = affinityRows.reduce((sum, r) => sum + r.positive_signals, 0);
-        topEngagedTopics = affinityRows.map((r) => ({
-            topic: r.topic,
-            interactions: r.positive_signals,
-            percent_of_total: totalPositive > 0
-                ? Math.round((r.positive_signals / totalPositive) * 10000) / 100
-                : 0,
+        const interactionRows = rawDb
+            .prepare(`SELECT item_topics FROM interactions
+         WHERE action_type IN ('click', 'save') AND item_topics IS NOT NULL`)
+            .all();
+        const topicCounts = new Map();
+        for (const row of interactionRows) {
+            try {
+                const topics = JSON.parse(row.item_topics);
+                if (!Array.isArray(topics))
+                    continue;
+                for (const t of topics) {
+                    if (typeof t === "string" && t.length > 0) {
+                        topicCounts.set(t, (topicCounts.get(t) || 0) + 1);
+                    }
+                }
+            }
+            catch {
+                // Malformed topic JSON on one row — skip it
+            }
+        }
+        const totalPositive = [...topicCounts.values()].reduce((a, b) => a + b, 0);
+        topEngagedTopics = [...topicCounts.entries()]
+            .sort((a, b) => b[1] - a[1])
+            .slice(0, maxTopics)
+            .map(([topic, count]) => ({
+            topic,
+            interactions: count,
+            percent_of_total: totalPositive > 0 ? Math.round((count / totalPositive) * 10000) / 100 : 0,
         }));
     }
     catch {
@@ -175,25 +191,9 @@ export function executeDeveloperDna(db, params) {
             const now = Date.now();
             for (const dep of topDependencies) {
                 const depLower = dep.name.toLowerCase();
-                // Check if any interaction item's source mentions this dependency
-                // Use a simpler heuristic: check if the dependency name appears in
-                // topic_affinities with positive signals
-                let lastEngagement = null;
-                try {
-                    const affinityRow = rawDb
-                        .prepare(`SELECT topic, positive_signals
-               FROM topic_affinities
-               WHERE LOWER(topic) = ?
-               AND positive_signals > 0`)
-                        .get(depLower);
-                    if (affinityRow) {
-                        continue; // Has engagement, not a blind spot
-                    }
-                }
-                catch {
-                    // Ignore
-                }
                 // Check for any source_items mentioning this dep that have interactions
+                // (the old topic_affinities shortcut queried a table dropped in schema
+                // 105 — it never fired).
                 try {
                     // Escape LIKE wildcards so a name containing % or _ matches literally.
                     const likeDep = `%${depLower.replace(/[\\%_]/g, (c) => "\\" + c)}%`;
@@ -218,11 +218,12 @@ export function executeDeveloperDna(db, params) {
                         }
                     }
                     else {
-                        // Never interacted with content about this dependency
+                        // Never interacted with content about this dependency — null, not
+                        // a -1 sentinel leaking into user-facing output.
                         blindSpots.push({
                             dependency: dep.name,
                             severity: "low",
-                            days_stale: -1, // indicates "never engaged"
+                            days_stale: null,
                         });
                     }
                 }
@@ -294,14 +295,28 @@ export function executeDeveloperDna(db, params) {
     catch {
         // table may not exist
     }
+    // total_relevant / rejection_rate describe the PIPELINE's judgment, so they
+    // must come from its persisted verdicts — the old interaction-based count
+    // reported total_relevant: 0 / rejection_rate: 1.0 for any passive user,
+    // contradicting a corpus with hundreds of feed-relevant items.
+    let judgedCount = 0;
     try {
-        // Items with at least one positive interaction = "relevant"
-        const relevantRow = rawDb
-            .prepare(`SELECT COUNT(DISTINCT item_id) as cnt
-         FROM interactions
-         WHERE action_type IN ('click', 'save')`)
-            .get();
-        totalRelevant = relevantRow.cnt;
+        if (db.hasColumn("source_items", "feed_relevant")) {
+            const row = rawDb
+                .prepare(`SELECT COUNT(*) as judged, SUM(CASE WHEN feed_relevant = 1 THEN 1 ELSE 0 END) as relevant
+           FROM source_items WHERE feed_relevant IS NOT NULL`)
+                .get();
+            judgedCount = row.judged;
+            totalRelevant = row.relevant ?? 0;
+        }
+        else if (db.hasColumn("source_items", "relevance_score")) {
+            const row = rawDb
+                .prepare(`SELECT COUNT(*) as judged, SUM(CASE WHEN relevance_score >= 0.4 THEN 1 ELSE 0 END) as relevant
+           FROM source_items WHERE relevance_score IS NOT NULL`)
+                .get();
+            judgedCount = row.judged;
+            totalRelevant = row.relevant ?? 0;
+        }
     }
     catch {
         // table may not exist
@@ -336,8 +351,10 @@ export function executeDeveloperDna(db, params) {
     catch {
         // table may not exist
     }
-    const rejectionRate = totalItemsProcessed > 0
-        ? Math.round(((totalItemsProcessed - totalRelevant) / totalItemsProcessed) * 10000) / 10000
+    // Rejection rate over the JUDGED set — unjudged items are "not yet curated",
+    // not rejected.
+    const rejectionRate = judgedCount > 0
+        ? Math.round(((judgedCount - totalRelevant) / judgedCount) * 10000) / 10000
         : 0;
     const stats = {
         total_items_processed: totalItemsProcessed,
@@ -406,4 +423,3 @@ function buildIdentitySummary(primaryStack, adjacentTech, interests, engagedTopi
     }
     return parts.join(". ") + ".";
 }
-//# sourceMappingURL=developer-dna.js.map

package/dist/tools/ecosystem-pulse.d.ts

@@ -43,6 +43,11 @@ export declare const ecosystemPulseTool: {
         };
     };
 };
-export declare function executeEcosystemPulse(_db: FourDADatabase, params: EcosystemPulseParams, liveIntel: LiveIntelligence | null): EcosystemPulseResult;
+/**
+ * Derive the tech stack used to filter HN headlines from the database:
+ * explicit tech_stack entries plus the languages of tracked dependencies.
+ * Works on both the desktop DB and the standalone minimal schema.
+ */
+export declare function deriveTechStackForHeadlines(db: FourDADatabase): string[];
+export declare function executeEcosystemPulse(db: FourDADatabase, params: EcosystemPulseParams, liveIntel: LiveIntelligence | null): Promise<EcosystemPulseResult>;
 export {};
-//# sourceMappingURL=ecosystem-pulse.d.ts.map

package/dist/tools/ecosystem-pulse.js

@@ -23,7 +23,35 @@ export const ecosystemPulseTool = {
         },
     },
 };
-export function executeEcosystemPulse(_db, params, liveIntel) {
+/**
+ * Derive the tech stack used to filter HN headlines from the database:
+ * explicit tech_stack entries plus the languages of tracked dependencies.
+ * Works on both the desktop DB and the standalone minimal schema.
+ */
+export function deriveTechStackForHeadlines(db) {
+    const stack = new Set();
+    const rawDb = db.getRawDb();
+    try {
+        for (const row of rawDb.prepare("SELECT technology FROM tech_stack").all()) {
+            if (row.technology)
+                stack.add(row.technology.toLowerCase());
+        }
+    }
+    catch {
+        // tech_stack may not exist on exotic DBs — languages below still apply.
+    }
+    try {
+        for (const row of rawDb.prepare("SELECT DISTINCT language FROM project_dependencies").all()) {
+            if (row.language)
+                stack.add(row.language.toLowerCase());
+        }
+    }
+    catch {
+        // project_dependencies may not exist — an empty stack yields an honest empty result.
+    }
+    return [...stack];
+}
+export async function executeEcosystemPulse(db, params, liveIntel) {
     if (!liveIntel) {
         return {
             headlines: [],
@@ -32,7 +60,16 @@ export function executeEcosystemPulse(_db, params, liveIntel) {
             note: "Live intelligence not available. Set FOURDA_OFFLINE=false and restart.",
         };
     }
-    const headlines = liveIntel.getHeadlines();
+    // The startup prefetch only ever ran in standalone mode, so full-DB servers
+    // returned an empty cache forever. Fetch on demand when the cache is empty —
+    // the cache still serves warm repeat calls.
+    let headlines = liveIntel.getHeadlines();
+    if (headlines.length === 0 && liveIntel.isEnabled()) {
+        const techStack = deriveTechStackForHeadlines(db);
+        if (techStack.length > 0) {
+            headlines = await liveIntel.fetchHeadlines(techStack);
+        }
+    }
     const minPoints = params.min_points ?? 0;
     const limit = params.limit ?? 15;
     const filtered = headlines
@@ -57,4 +94,3 @@ export function executeEcosystemPulse(_db, params, liveIntel) {
             : `${filtered.length} headline${filtered.length !== 1 ? "s" : ""} relevant to your tech stack.`,
     };
 }
-//# sourceMappingURL=ecosystem-pulse.js.map

package/dist/tools/get-actionable-signals.d.ts

@@ -62,4 +62,3 @@ export declare function executeGetActionableSignals(db: FourDADatabase, params:
     summary: Record<string, number>;
 };
 export {};
-//# sourceMappingURL=get-actionable-signals.d.ts.map

package/dist/tools/get-actionable-signals.js

@@ -359,4 +359,3 @@ export function executeGetActionableSignals(db, params) {
         ...(signals.length === 0 && items.length === 0 ? { note: "No source items in the database. Run the 4DA desktop app to fetch content, or use vulnerability_scan to check dependencies directly." } : {}),
     };
 }
-//# sourceMappingURL=get-actionable-signals.js.map

package/dist/tools/get-context.d.ts

@@ -38,4 +38,3 @@ export declare function executeGetContext(db: FourDADatabase, params: GetContext
         isDev: boolean;
     }>;
 };
-//# sourceMappingURL=get-context.d.ts.map

package/dist/tools/get-context.js

@@ -15,7 +15,7 @@ export const getContextTool = {
 Returns information about:
 - Static Identity: User-declared role, tech stack, domains, interests, and exclusions
 - ACE Context (optional): Auto-detected technologies and active topics from recent activity
-- Learned Preferences (optional): Topic affinities learned from user behavior
+- Learned Preferences (optional): retained compatibility field; implicit preference learning no longer contributes to scoring
 
 Use this to understand what the user is working on and interested in.`,
     inputSchema: {
@@ -28,7 +28,7 @@ Use this to understand what the user is working on and interested in.`,
             },
             include_learned: {
                 type: "boolean",
-                description: "Include learned preferences (topic affinities, anti-topics). Default: true",
+                description: "Include the retained learned-preferences compatibility field. Default: true",
                 default: true,
             },
         },
@@ -58,4 +58,3 @@ export function executeGetContext(db, params) {
     }
     return context;
 }
-//# sourceMappingURL=get-context.js.map

package/dist/tools/get-relevant-content.d.ts

@@ -41,4 +41,3 @@ export declare const getRelevantContentTool: {
  * Execute the get_relevant_content tool
  */
 export declare function executeGetRelevantContent(db: FourDADatabase, params: GetRelevantContentParams): RelevantItem[];
-//# sourceMappingURL=get-relevant-content.d.ts.map

package/dist/tools/get-relevant-content.js

@@ -11,12 +11,11 @@ export const getRelevantContentTool = {
     name: "get_relevant_content",
     description: `Get filtered relevant content from 4DA's personalized feed.
 
-Returns content items that match the user's interests, tech stack, and learned preferences.
+Returns content items that match the user's explicit interests, tech stack, and ACE-detected context.
 Items are scored based on:
 - Explicit interests declared by the user
 - Tech stack and domains
 - ACE-detected context (recent files, projects, git activity)
-- Learned preferences from past interactions
 
 Each item includes necessity fields (necessity_score, necessity_reason, necessity_category, necessity_urgency) indicating how critical the item is — e.g., security vulnerabilities affecting your deps, breaking changes in your stack, or deprecation notices. These are populated from the full PASIFA analysis pipeline when available.
 
@@ -67,4 +66,3 @@ export function executeGetRelevantContent(db, params) {
     }
     return items;
 }
-//# sourceMappingURL=get-relevant-content.js.map

package/dist/tools/index.d.ts

@@ -21,4 +21,3 @@ export { decisionMemoryTool, executeDecisionMemory, } from "./decision-memory.js
 export { checkDecisionAlignmentTool, executeCheckDecisionAlignment, } from "./decision-enforcement.js";
 export { agentMemoryTool, executeAgentMemory, } from "./agent-memory.js";
 export { developerDnaTool, executeDeveloperDna, } from "./developer-dna.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.js

@@ -27,4 +27,3 @@ export { checkDecisionAlignmentTool, executeCheckDecisionAlignment, } from "./de
 export { agentMemoryTool, executeAgentMemory, } from "./agent-memory.js";
 // Identity
 export { developerDnaTool, executeDeveloperDna, } from "./developer-dna.js";
-//# sourceMappingURL=index.js.map

package/dist/tools/knowledge-gaps.d.ts

@@ -51,4 +51,3 @@ export declare function executeKnowledgeGaps(db: FourDADatabase, params: Knowled
     gaps_returned: number;
     summary: string;
 };
-//# sourceMappingURL=knowledge-gaps.d.ts.map

package/dist/tools/knowledge-gaps.js

@@ -6,7 +6,18 @@
  */
 // Word-boundary matching prevents "cve" matching inside "achieve", "receiver", etc.
 function hasWordBoundary(text, term) {
-    const regex = new RegExp(`\\b${term}\\b`, 'i');
+    const regex = new RegExp(`\\b${escapeRegExp(term)}\\b`, 'i');
+    return regex.test(text);
+}
+// Package names can contain regex metacharacters (@scope/name, c++, next.js).
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+}
+// True when `text` mentions the package name as a whole word. Word characters
+// for this purpose include - and _ (so dep "hono" does NOT match "hono-shim",
+// and never matches "in HONOr of"). @scope/name matches as the full literal.
+function mentionsPackage(text, pkg) {
+    const regex = new RegExp(`(^|[^A-Za-z0-9_-])${escapeRegExp(pkg)}($|[^A-Za-z0-9_-])`, "i");
     return regex.test(text);
 }
 // Escape SQL LIKE wildcards so a package name containing % or _ (npm names may
@@ -36,9 +47,16 @@ export const knowledgeGapsTool = {
 };
 export function executeKnowledgeGaps(db, params) {
     const rawDb = db.getRawDb();
-    // Get all tracked dependencies
+    // Feature-detect optional columns: a pure-standalone database has no scoring
+    // pipeline (no relevance_score) and may predate content_type — the tool must
+    // degrade to word-boundary + recency grounding there, never throw.
+    const hasRelevance = db.hasColumn("source_items", "relevance_score");
+    const hasContentType = db.hasColumn("source_items", "content_type");
+    const hasIsDirect = db.hasColumn("project_dependencies", "is_direct");
+    // Direct dependencies only — a transitive dep's news is not the user's
+    // reading backlog. Dev deps stay in: a vitest or eslint advisory is real.
     const deps = rawDb
-        .prepare("SELECT package_name, version, project_path, language FROM project_dependencies LIMIT 100")
+        .prepare(`SELECT package_name, version, project_path, language FROM project_dependencies ${hasIsDirect ? "WHERE is_direct = 1 " : ""}LIMIT 100`)
         .all();
     if (deps.length === 0) {
         return {
@@ -47,41 +65,86 @@ export function executeKnowledgeGaps(db, params) {
         };
     }
     const gaps = [];
+    const seenPackages = new Set();
     for (const dep of deps) {
         // Names shorter than 3 chars (e.g. "c", "go", "ws") match too many unrelated
         // items via substring LIKE to be a trustworthy "mention" signal — skip them.
         if (!dep.package_name || dep.package_name.length < 3)
             continue;
+        // One gap per package: the same dep declared by several projects would
+        // otherwise repeat identical missed_items once per project_path.
+        const pkgKey = dep.package_name.toLowerCase();
+        if (seenPackages.has(pkgKey))
+            continue;
+        seenPackages.add(pkgKey);
         // Find source items mentioning this dependency. Engagement is recorded by the
         // app in interactions.item_id / .action_type (the canonical columns; the older
         // source_item_id / action columns are unused), so the NOT-IN suppression must
         // read those or it silently never fires.
+        //
+        // Grounding (each guard killed an observed false-positive class):
+        // - relevance_score >= 0.2: the scoring pipeline's above-noise band — drops
+        //   off-topic chatter that merely contains the string (chocolate-bar class).
+        // - 30-day window: a "gap" is something you MISSED, not archaeology — a
+        //   2014 StackOverflow post is not missed intelligence.
+        // - LIKE is only a cheap candidate pre-filter; the real test is the
+        //   word-boundary check below ("invite" must never evidence a vite gap).
+        // - feed_relevant is deliberately NOT filtered here: an item the feed gate
+        //   rejected can still be a legitimate unread dep mention — surfacing those
+        //   is this tool's niche. The relevance floor already excludes noise.
         const pattern = `%${escapeLike(dep.package_name)}%`;
-        const mentionedItems = rawDb
-            .prepare(`SELECT si.id, si.title, si.url, si.source_type, si.created_at
+        const candidates = rawDb
+            .prepare(`SELECT si.id, si.title, si.url, si.source_type, ${hasContentType ? "si.content_type" : "NULL AS content_type"}, si.created_at,
+               ${hasRelevance ? "si.relevance_score" : "NULL AS relevance_score"}, substr(COALESCE(si.content, ''), 1, 2000) AS content_head
         FROM source_items si
         WHERE (si.title LIKE ? ESCAPE '\\' OR si.content LIKE ? ESCAPE '\\')
+        ${hasRelevance ? "AND si.relevance_score IS NOT NULL AND si.relevance_score >= 0.2" : ""}
+        AND si.created_at >= datetime('now', '-30 days')
         AND si.id NOT IN (SELECT item_id FROM interactions WHERE action_type IN ('click', 'save'))
-        ORDER BY si.created_at DESC LIMIT 5`)
+        ORDER BY si.created_at DESC LIMIT 25`)
             .all(pattern, pattern);
+        // Word-boundary verification: the mention must be the package name as a
+        // whole word in the title or the content head, not a substring.
+        const mentionedItems = candidates
+            .filter((item) => mentionsPackage(item.title || "", dep.package_name) ||
+            mentionsPackage(item.content_head || "", dep.package_name))
+            .slice(0, 5);
         if (mentionedItems.length > 0) {
-            // Check if any are security-related
-            const hasSecurityMention = mentionedItems.some((item) => hasWordBoundary(item.title || "", "cve") ||
-                hasWordBoundary(item.title || "", "security") ||
-                hasWordBoundary(item.title || "", "vulnerability"));
-            const severity = hasSecurityMention
+            const isAdvisory = (item) => item.source_type === "cve" ||
+                item.source_type === "osv" ||
+                item.content_type === "security_advisory";
+            const securityKeywords = (title) => hasWordBoundary(title, "cve") ||
+                hasWordBoundary(title, "security") ||
+                hasWordBoundary(title, "vulnerability");
+            // Graded honestly:
+            // - critical: an actual advisory whose TITLE names this dependency — the
+            //   advisory is about the dep, not merely co-mentioning it in a body.
+            // - high: a security-keyword item whose title names the dep.
+            // - medium: 3+ recent unread mentions; low: 1-2.
+            const advisoryAboutDep = mentionedItems.some((item) => isAdvisory(item) && mentionsPackage(item.title || "", dep.package_name));
+            const securityTitleMention = mentionedItems.some((item) => securityKeywords(item.title || "") &&
+                mentionsPackage(item.title || "", dep.package_name));
+            const severity = advisoryAboutDep
                 ? "critical"
-                : mentionedItems.length >= 3
+                : securityTitleMention
                     ? "high"
-                    : "medium";
+                    : mentionedItems.length >= 3
+                        ? "medium"
+                        : "low";
             gaps.push({
                 dependency: dep.package_name,
                 version: dep.version,
                 project_path: dep.project_path,
                 language: dep.language,
-                missed_items: mentionedItems.map(item => ({
-                    ...item,
-                    title: item.title && item.title.length > 120 ? item.title.substring(0, 120) + "..." : item.title,
+                missed_items: mentionedItems.map((item) => ({
+                    id: item.id,
+                    title: item.title && item.title.length > 120
+                        ? item.title.substring(0, 120) + "..."
+                        : item.title,
+                    url: item.url,
+                    source_type: item.source_type,
+                    created_at: item.created_at,
+                    relevance_score: item.relevance_score,
                 })),
                 gap_severity: severity,
                 missed_count: mentionedItems.length,
@@ -101,4 +164,3 @@ export function executeKnowledgeGaps(db, params) {
         summary: `${filtered.length} knowledge gaps across ${deps.length} tracked dependencies (showing top ${Math.min(filtered.length, maxGaps)})`,
     };
 }
-//# sourceMappingURL=knowledge-gaps.js.map

package/dist/tools/recall.d.ts

@@ -30,4 +30,3 @@ export declare function rankRowsByRecall<T>(rows: T[], query: string, fields: Re
  * like auth -> jwt).
  */
 export declare function createRelevanceScorer(query: string): (text: unknown) => number;
-//# sourceMappingURL=recall.d.ts.map

package/dist/tools/recall.js

@@ -131,4 +131,3 @@ export function createRelevanceScorer(query) {
 function scoreRecallText(text, query) {
     return createRelevanceScorer(query)(text);
 }
-//# sourceMappingURL=recall.js.map

package/dist/tools/record-feedback.d.ts

@@ -1,7 +1,7 @@
 /**
  * record_feedback tool
  *
- * Record user feedback on an item for learning.
+ * Record explicit user interaction history for an item.
  */
 import type { FourDADatabase } from "../db.js";
 import type { RecordFeedbackParams, FeedbackResult } from "../types.js";
@@ -36,4 +36,3 @@ export declare const recordFeedbackTool: {
  * Execute the record_feedback tool
  */
 export declare function executeRecordFeedback(db: FourDADatabase, params: RecordFeedbackParams): FeedbackResult;
-//# sourceMappingURL=record-feedback.d.ts.map