@4da/mcp-server 5.0.2 → 5.0.4

package/dist/tools/record-feedback.js

@@ -2,22 +2,22 @@
 /**
  * record_feedback tool
  *
- * Record user feedback on an item for learning.
+ * Record explicit user interaction history for an item.
  */
 /**
  * Tool definition for MCP registration
  */
 export const recordFeedbackTool = {
     name: "record_feedback",
-    description: `Record user feedback on a content item.
+    description: `Record explicit user interaction history for a content item.
 
 Feedback actions:
-- "click": User clicked/opened the item (moderate positive signal)
-- "save": User saved/bookmarked the item (strong positive signal)
-- "dismiss": User dismissed the item (weak negative signal)
-- "mark_irrelevant": User marked item as not relevant (strong negative signal)
+- "click": User clicked/opened the item
+- "save": User saved/bookmarked the item
+- "dismiss": User dismissed the item
+- "mark_irrelevant": User marked item as not relevant
 
-This feedback helps 4DA learn user preferences over time.`,
+This records what happened; it does not train content preferences (interaction counts only graduate scoring's bootstrap gate).`,
     inputSchema: {
         type: "object",
         properties: {
@@ -58,4 +58,3 @@ export function executeRecordFeedback(db, params) {
     }
     return db.recordFeedback(params.item_id, params.source_type, params.action);
 }
-//# sourceMappingURL=record-feedback.js.map

package/dist/tools/upgrade-planner.d.ts

@@ -80,4 +80,3 @@ export declare const upgradePlannerTool: {
 };
 export declare function executeUpgradePlanner(_db: FourDADatabase, params: UpgradePlannerParams, liveIntel: LiveIntelligence | null): Promise<UpgradePlanResult>;
 export {};
-//# sourceMappingURL=upgrade-planner.d.ts.map

package/dist/tools/upgrade-planner.js

@@ -17,7 +17,7 @@
  * - When no vulnerability scan has run, the plan says so instead of silently
  *   producing a CVE-blind ranking.
  */
-import { maxSemver } from "../live/semver-utils.js";
+import { compareSemver, maxSemver } from "../live/semver-utils.js";
 const PROVENANCE_NOTE = "Point-in-time heuristic from local lockfiles plus live registry/OSV lookups. " +
     "Not the 4DA desktop app's cross-project, version-confirmed plan.";
 export const upgradePlannerTool = {
@@ -136,8 +136,21 @@ export async function executeUpgradePlanner(_db, params, liveIntel) {
         // Skip if no upgrade needed (no vuln, not deprecated, not behind => no reasons)
         if (reasons.length === 0)
             continue;
+        // Never recommend a downgrade: when the current version is a prerelease
+        // AHEAD of the latest stable (rsa 0.10.0-rc.18 vs stable 0.9.10), the
+        // stable line is not an upgrade target. Fall back to the highest vuln
+        // fix version that IS ahead of current, else no target ("review").
+        if (targetVersion &&
+            dep.currentVersion &&
+            compareSemver(dep.currentVersion, targetVersion) >= 0) {
+            const vulnFixesAhead = (vulns ?? [])
+                .map((v) => v.fixedVersion)
+                .filter((f) => Boolean(f))
+                .filter((f) => compareSemver(f, dep.currentVersion) > 0);
+            targetVersion = vulnFixesAhead.length > 0 ? maxSemver(vulnFixesAhead) : null;
+        }
         const label = dep.versionsBehind?.label;
-        const upgradeType = !label || label === "up-to-date" ? "patch" : label;
+        const upgradeType = !label || label === "up-to-date" ? "unknown" : label;
         recommendations.push({
             package: dep.name,
             ecosystem: dep.ecosystem,
@@ -245,4 +258,3 @@ export async function executeUpgradePlanner(_db, params, liveIntel) {
         provenance: { mode: "standalone_heuristic", note: PROVENANCE_NOTE },
     };
 }
-//# sourceMappingURL=upgrade-planner.js.map

package/dist/tools/vulnerability-scan.d.ts

@@ -177,4 +177,3 @@ export declare function executeVulnerabilityScan(db: FourDADatabase, params: Vul
     message?: undefined;
     hint?: undefined;
 }>;
-//# sourceMappingURL=vulnerability-scan.d.ts.map

package/dist/tools/vulnerability-scan.js

@@ -213,4 +213,3 @@ function formatVuln(v) {
         references: v.references,
     };
 }
-//# sourceMappingURL=vulnerability-scan.js.map

package/dist/tools/what-should-i-know.d.ts

@@ -76,4 +76,3 @@ export declare const whatShouldIKnowTool: {
 };
 export declare function executeWhatShouldIKnow(db: FourDADatabase, params: WhatShouldIKnowParams): WhatShouldIKnowResult | Promise<WhatShouldIKnowResult>;
 export {};
-//# sourceMappingURL=what-should-i-know.d.ts.map

package/dist/tools/what-should-i-know.js

@@ -40,9 +40,13 @@ export const whatShouldIKnowTool = {
 function getOpenDecisionWindows(db) {
     try {
         const rawDb = db.getRawDb();
-        return rawDb.prepare(`SELECT id, title, description, urgency
+        return rawDb.prepare(
+        // opened_at, not created_at — the wrong column name made this query
+        // throw (swallowed below) on EVERY schema in existence, so the
+        // decision-windows section had never returned a row for anyone.
+        `SELECT id, title, description, urgency
        FROM decision_windows WHERE status = 'open'
-       ORDER BY urgency DESC, created_at DESC
+       ORDER BY urgency DESC, opened_at DESC
        LIMIT 20`).all();
     }
     catch {
@@ -345,4 +349,3 @@ export function executeWhatShouldIKnow(db, params) {
     // Provider configured -> hybrid wisdom (returns a Promise; dispatch awaits).
     return getRelevantWisdomHybrid(db, task, files, embedConfig).then(({ wisdom, recall_mode }) => finalize(wisdom, recall_mode));
 }
-//# sourceMappingURL=what-should-i-know.js.map

package/dist/types.d.ts

@@ -81,7 +81,7 @@ export interface ActiveTopic {
     last_seen: string;
 }
 /**
- * Learned topic affinity
+ * Retained compatibility shape for historic topic affinity data.
  */
 export interface TopicAffinity {
     topic: string;
@@ -92,7 +92,7 @@ export interface TopicAffinity {
     total_exposures: number;
 }
 /**
- * Anti-topic (learned exclusion)
+ * Retained compatibility shape for historic anti-topic data.
  */
 export interface AntiTopic {
     topic: string;
@@ -394,4 +394,3 @@ export interface AgentFeedbackTopItemRow {
     used_count: number;
     rejected_count: number;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/types.js

@@ -5,4 +5,3 @@
  * These types mirror the 4DA database schema for read operations.
  */
 export {};
-//# sourceMappingURL=types.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4da/mcp-server",
-  "version": "5.0.2",
+  "version": "5.0.4",
   "mcpName": "io.github.4DA-Systems/4da-mcp-server",
   "description": "Dependency intelligence for AI coding agents. Live CVE scanning, dependency health, upgrade planning, ecosystem news, decision memory — zero config, privacy-first. 9 tools standalone, 14 total with desktop app.",
   "type": "module",
@@ -18,6 +18,18 @@
     "README.md",
     "LICENSE"
   ],
+  "scripts": {
+    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\"",
+    "build": "pnpm run clean && tsc && pnpm run copy-schemas",
+    "copy-schemas": "node -e \"const fs=require('fs');const path=require('path');const src='src/schemas';const dst='dist/schemas';if(!fs.existsSync(dst))fs.mkdirSync(dst,{recursive:true});fs.readdirSync(src).filter(f=>f.endsWith('.json')).forEach(f=>fs.copyFileSync(path.join(src,f),path.join(dst,f)))\"",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "inspect": "npx @modelcontextprotocol/inspector node dist/index.js",
+    "setup": "node dist/setup.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "pnpm run build"
+  },
   "keywords": [
     "mcp",
     "mcp-server",
@@ -84,14 +96,28 @@
   "engines": {
     "node": ">=20.0.0"
   },
-  "scripts": {
-    "build": "tsc && pnpm run copy-schemas",
-    "copy-schemas": "node -e \"const fs=require('fs');const path=require('path');const src='src/schemas';const dst='dist/schemas';if(!fs.existsSync(dst))fs.mkdirSync(dst,{recursive:true});fs.readdirSync(src).filter(f=>f.endsWith('.json')).forEach(f=>fs.copyFileSync(path.join(src,f),path.join(dst,f)))\"",
-    "dev": "tsc --watch",
-    "start": "node dist/index.js",
-    "inspect": "npx @modelcontextprotocol/inspector node dist/index.js",
-    "setup": "node dist/setup.js",
-    "test": "vitest run",
-    "test:watch": "vitest"
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3",
+      "esbuild"
+    ],
+    "overrides": {
+      "fast-uri": ">=3.1.5",
+      "ip-address": ">=10.3.1 <11",
+      "vite": ">=7.3.5 <8",
+      "esbuild": ">=0.28.1",
+      "hono": ">=4.12.34 <5",
+      "@hono/node-server": ">=2.0.5 <3",
+      "minimatch@>=9.0.0 <9.0.6": ">=9.0.7",
+      "picomatch@>=4.0.0 <4.0.4": ">=4.0.4",
+      "brace-expansion@<1.1.18": ">=1.1.18 <2",
+      "brace-expansion@>=2.0.0 <2.0.3": ">=2.0.3",
+      "brace-expansion@>=3.0.0 <5.0.9": ">=5.0.9 <6",
+      "js-yaml@>=4.0.0 <4.3.1": ">=4.3.1 <5",
+      "nanoid@<3.3.18": ">=3.3.18 <4",
+      "nanoid@>=4.0.0 <5.1.16": ">=5.1.16 <6",
+      "postcss@<8.5.23": ">=8.5.23 <9",
+      "undici@>=7.0.0 <7.29.0": ">=7.29.0 <8"
+    }
   }
-}
+}