@4da/mcp-server 5.0.4 → 6.0.1

package/dist/tools/dependency-health.js

@@ -6,9 +6,13 @@
  * deprecation status, and known vulnerabilities across npm, crates.io,
  * PyPI, and Go ecosystems. Zero config — auto-detects from lock files.
  */
+import { isActionableVulnerability } from "../live/maintenance.js";
+import { driftFor } from "./install-drift-notes.js";
+/** How long a health check waits for its own OSV scan before answering without CVE data (the scan keeps running). */
+const HEALTH_SCAN_TIMEOUT_MS = 60_000;
 export const dependencyHealthTool = {
     name: "dependency_health",
-    description: "Assess health of project dependencies — version freshness, deprecation status, known CVEs. Auto-detects stack from lock files. Covers npm, Rust, Python, and Go.",
+    description: "Assess health of project dependencies — version freshness, deprecation status, known CVEs. Auto-detects stack from lock files. Covers npm, Rust, Python, and Go. For npm, `installedVersion` appears beside `currentVersion` when node_modules holds a different version than the lockfile.",
     inputSchema: {
         type: "object",
         properties: {
@@ -33,6 +37,19 @@ export const dependencyHealthTool = {
         },
     },
 };
+/** Stamp each npm row with the version node_modules holds, where it differs from the lockfile's. */
+function withInstalledVersions(rows, drift) {
+    if (drift.length === 0)
+        return rows;
+    return rows.map((row) => {
+        if (row.ecosystem !== "npm")
+            return row;
+        const records = driftFor(drift, row.name, row.currentVersion);
+        if (records.length === 0)
+            return row;
+        return { ...row, installedVersion: [...new Set(records.map((r) => r.installedVersion))].join(", ") };
+    });
+}
 export async function executeDependencyHealth(_db, params, liveIntel) {
     const start = Date.now();
     if (!liveIntel || !liveIntel.isInitialized()) {
@@ -44,6 +61,7 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
             outdatedCount: 0,
             deprecatedCount: 0,
             vulnerableCount: 0,
+            advisoryCount: 0,
             healthScore: 0,
             dependencies: [],
             vulnerabilitySummary: null,
@@ -52,6 +70,9 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
             cached: false,
         };
     }
+    // A long-lived server must not answer from the versions it read at startup:
+    // re-resolve if a lockfile (or node_modules) changed. Stat calls only.
+    liveIntel.refreshIfLockfilesChanged();
     // Get resolved deps
     const includeDev = params.include_dev ?? false;
     let deps = liveIntel.getResolvedDeps();
@@ -63,15 +84,29 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
     }
     const ecosystems = [...new Set(deps.map((d) => d.ecosystem))];
     // Fetch registry health for all deps
-    const registryData = await liveIntel.fetchRegistryHealth(deps);
-    // Merge vulnerability data
-    const vulnResult = liveIntel.getVulnerabilities();
+    const registryData = withInstalledVersions(await liveIntel.fetchRegistryHealth(deps), liveIntel.getInstallDrift());
+    // Merge vulnerability data. "Vulnerable" means the actionable set — built
+    // on this host and not a maintenance notice — which is exactly what
+    // vulnerability_scan reports as `total_vulnerable_packages`. Counting every
+    // row here made the two tools disagree over one scan (this one said 11
+    // vulnerable packages where the scan listed 5 and filed the rest under
+    // platform-inactive and maintenance notices). `advisoryCount` keeps the raw
+    // row count visible so the filter hides nothing.
+    // Loaded here (bounded) when no scan has run: telling the agent to "run
+    // vulnerability_scan first" left a session's first health check CVE-blind.
+    const root = liveIntel.getProjectRoot() ?? process.cwd();
+    const vulnResult = (await liveIntel.ensureVulnerabilities(root, HEALTH_SCAN_TIMEOUT_MS, { includeDev })) ?? liveIntel.getVulnerabilities();
+    const allVulns = vulnResult?.vulnerabilities ?? [];
+    const activeVulns = allVulns.filter(isActionableVulnerability);
+    // Keyed by (ecosystem, name): a bare name let an npm advisory mark a
+    // same-named crate as vulnerable, and counted the two as one package.
+    const vulnKey = (ecosystem, name) => `${ecosystem}\u0000${name}`;
     const vulnMap = new Map();
-    if (vulnResult) {
-        for (const v of vulnResult.vulnerabilities) {
-            vulnMap.set(v.package, (vulnMap.get(v.package) || 0) + 1);
-        }
+    for (const v of activeVulns) {
+        const key = vulnKey(v.ecosystem, v.package);
+        vulnMap.set(key, (vulnMap.get(key) || 0) + 1);
     }
+    const advisoryCount = allVulns.length;
     // Compute stats
     let outdated = 0;
     let deprecated = 0;
@@ -86,6 +121,7 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
     // breakdown shown beside it. registryData is direct deps only — counting there
     // undercounts CVEs that live in transitive dependencies.
     const vulnerable = vulnMap.size;
+    const drifted = registryData.filter((d) => d.installedVersion).length;
     // Sort
     const sortBy = params.sort_by ?? "risk";
     const sorted = [...registryData].sort((a, b) => {
@@ -99,7 +135,7 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
         // risk: vulnerable > deprecated > major outdated > minor > patch > current
         const riskScore = (dep) => {
             let score = 0;
-            if (vulnMap.has(dep.name))
+            if (vulnMap.has(vulnKey(dep.ecosystem, dep.name)))
                 score += 1000;
             if (dep.deprecated)
                 score += 500;
@@ -121,13 +157,13 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
     // Vulnerabilities: severity-weighted; transitive findings at one-third
     // weight (their fix arrives via a parent bump — the direct surface is what
     // the user controls directly).
+    // Penalised over the same actionable set the count reports, so a score
+    // below 100 always has a vulnerable package beside it.
     const sevWeight = { critical: 20, high: 10, medium: 4, low: 1 };
     let vulnPenaltyRaw = 0;
-    if (vulnResult) {
-        for (const v of vulnResult.vulnerabilities) {
-            const w = sevWeight[v.severity] ?? 2; // "unknown" (mostly unmaintained-notices) counts low
-            vulnPenaltyRaw += v.isDirect ? w : w / 3;
-        }
+    for (const v of activeVulns) {
+        const w = sevWeight[v.severity] ?? 2; // "unknown" severity with a real (non-maintenance) advisory
+        vulnPenaltyRaw += v.isDirect ? w : w / 3;
     }
     const vulnPenalty = Math.min(Math.round(vulnPenaltyRaw), 55);
     // Staleness: degree-weighted and proportional to the tracked set — a major
@@ -145,12 +181,14 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
     const outdatedPenalty = Math.min(30, Math.round((stalenessWeight / total) * 60));
     const deprecatedPenalty = Math.min(deprecated * 8, 15);
     const healthScore = Math.max(0, 100 - vulnPenalty - deprecatedPenalty - outdatedPenalty);
-    const vulnSummary = vulnResult ? {
-        critical: vulnResult.bySeverity.critical,
-        high: vulnResult.bySeverity.high,
-        medium: vulnResult.bySeverity.medium,
-        low: vulnResult.bySeverity.low,
-    } : null;
+    // Severity breakdown over the actionable set, matching the count above.
+    const vulnSummary = vulnResult ? { critical: 0, high: 0, medium: 0, low: 0 } : null;
+    if (vulnSummary) {
+        for (const v of activeVulns) {
+            if (v.severity in vulnSummary)
+                vulnSummary[v.severity]++;
+        }
+    }
     // Summary
     const parts = [];
     parts.push(`${total} dependenc${total !== 1 ? "ies" : "y"} scanned`);
@@ -160,8 +198,22 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
         parts.push(`${deprecated} deprecated`);
     if (outdated > 0)
         parts.push(`${outdated} outdated`);
-    if (vulnerable === 0 && deprecated === 0 && outdated === 0)
+    if (drifted > 0) {
+        parts.push(`${drifted} installed at a different version than the lockfile pins (see installedVersion; vulnerability_scan lists install_drift)`);
+    }
+    // "All healthy" is a claim about CVEs too; it needs a scan behind it.
+    if (vulnResult && vulnerable === 0 && deprecated === 0 && outdated === 0 && drifted === 0) {
         parts.push("all healthy");
+    }
+    const hidden = advisoryCount - activeVulns.length;
+    if (hidden > 0) {
+        parts.push(`${hidden} advisor${hidden !== 1 ? "ies" : "y"} not counted (platform-inactive or maintenance notices)`);
+    }
+    if (!vulnResult) {
+        parts.push(liveIntel.isEnabled()
+            ? `CVE data not loaded: the OSV scan did not finish within ${HEALTH_SCAN_TIMEOUT_MS / 1000}s or OSV was unreachable. Call again to use it once it completes`
+            : "CVE data not loaded: offline mode (FOURDA_OFFLINE)");
+    }
     return {
         scannedAt: new Date().toISOString(),
         projectPath: liveIntel.getProjectRoot() ?? process.cwd(),
@@ -170,6 +222,7 @@ export async function executeDependencyHealth(_db, params, liveIntel) {
         outdatedCount: outdated,
         deprecatedCount: deprecated,
         vulnerableCount: vulnerable,
+        advisoryCount,
         healthScore,
         dependencies: limited,
         vulnerabilitySummary: vulnSummary,

package/dist/tools/developer-dna.d.ts

@@ -36,7 +36,10 @@ export declare const developerDnaTool: {
 };
 interface DependencyEntry {
     name: string;
+    /** One project that declares it. */
     project_path: string;
+    /** How many of the user's projects declare it. */
+    projects: number;
 }
 interface EngagedTopic {
     topic: string;

package/dist/tools/developer-dna.js

@@ -77,13 +77,20 @@ export function executeDeveloperDna(db, params) {
     // 3. Top Dependencies — from project_dependencies table
     // -------------------------------------------------------------------------
     let topDependencies = [];
+    /** How many of the user's projects declare each dependency (lowercased name). */
+    const projectCounts = new Map();
     try {
+        // "Top" means most used: declared by the most projects. It meant the
+        // first N alphabetically ("@11ty/eleventy..." led the live profile).
         const depRows = rawDb
-            .prepare(`SELECT package_name, project_path
+            .prepare(`SELECT package_name, MIN(project_path) AS project_path, COUNT(DISTINCT project_path) AS projects
          FROM project_dependencies
-         ORDER BY package_name
+         GROUP BY LOWER(package_name)
+         ORDER BY projects DESC, package_name
          LIMIT ?`)
-            .all(maxDependencies);
+            .all(maxDependencies * 3);
+        for (const row of depRows)
+            projectCounts.set(row.package_name.toLowerCase(), row.projects);
         // Filter out invalid package names (template literals, path aliases, non-packages)
         const isValidPackageName = (name) => {
             if (!name)
@@ -104,19 +111,12 @@ export function executeDeveloperDna(db, params) {
         };
         topDependencies = depRows
             .filter((r) => isValidPackageName(r.package_name))
+            .slice(0, maxDependencies)
             .map((r) => ({
             name: r.package_name,
             project_path: r.project_path,
+            projects: r.projects,
         }));
-        // Deduplicate (case-insensitive)
-        const seen = new Set();
-        topDependencies = topDependencies.filter(d => {
-            const key = d.name.toLowerCase();
-            if (seen.has(key))
-                return false;
-            seen.add(key);
-            return true;
-        });
     }
     catch {
         // table may not exist
@@ -217,9 +217,10 @@ export function executeDeveloperDna(db, params) {
                             });
                         }
                     }
-                    else {
-                        // Never interacted with content about this dependency — null, not
-                        // a -1 sentinel leaking into user-facing output.
+                    else if ((projectCounts.get(depLower) ?? 0) >= 3) {
+                        // Never read about a dependency three or more projects rely on.
+                        // Every never-read dependency used to be listed, so the section
+                        // was the whole dependency list and said nothing.
                         blindSpots.push({
                             dependency: dep.name,
                             severity: "low",

package/dist/tools/ecosystem-pulse.d.ts

@@ -44,8 +44,12 @@ export declare const ecosystemPulseTool: {
     };
 };
 /**
- * Derive the tech stack used to filter HN headlines from the database:
- * explicit tech_stack entries plus the languages of tracked dependencies.
+ * The terms HN headlines are searched and matched on: the frameworks the
+ * project uses and its most-used direct dependencies — names specific enough
+ * that a headline naming one is about something this project runs. Language
+ * names are the fallback only: matched on "rust", the pulse was "What Zig felt
+ * like, coming from Rust" and an Emacs fork (live 2026-10-01). Package names
+ * that are everyday words are left out (they match unrelated titles).
  * Works on both the desktop DB and the standalone minimal schema.
  */
 export declare function deriveTechStackForHeadlines(db: FourDADatabase): string[];

package/dist/tools/ecosystem-pulse.js

@@ -6,6 +6,7 @@
  * Data is already fetched on server startup from Hacker News via Algolia API.
  * This tool makes it queryable.
  */
+import { COMMON_WORDS } from "./briefing-task-scope.js";
 export const ecosystemPulseTool = {
     name: "ecosystem_pulse",
     description: "Live ecosystem news relevant to your tech stack. Surfaces trending Hacker News discussions filtered by your detected technologies. Updated on server startup.",
@@ -23,34 +24,72 @@ export const ecosystemPulseTool = {
         },
     },
 };
+/** Languages: matching a headline on one is matching the whole language's news. */
+const LANGUAGES = new Set(["rust", "javascript", "typescript", "python", "go", "golang", "java", "kotlin", "ruby", "php", "c", "c++", "c#", "swift", "dart", "npm"]);
+const MAX_TERMS = 8;
 /**
- * Derive the tech stack used to filter HN headlines from the database:
- * explicit tech_stack entries plus the languages of tracked dependencies.
+ * The terms HN headlines are searched and matched on: the frameworks the
+ * project uses and its most-used direct dependencies — names specific enough
+ * that a headline naming one is about something this project runs. Language
+ * names are the fallback only: matched on "rust", the pulse was "What Zig felt
+ * like, coming from Rust" and an Emacs fork (live 2026-10-01). Package names
+ * that are everyday words are left out (they match unrelated titles).
  * Works on both the desktop DB and the standalone minimal schema.
  */
 export function deriveTechStackForHeadlines(db) {
-    const stack = new Set();
+    const terms = [];
+    const add = (term) => {
+        const t = (term ?? "").toLowerCase().trim();
+        if (t.length >= 3 && !LANGUAGES.has(t) && !COMMON_WORDS.has(t) && !terms.includes(t) && !t.includes("/"))
+            terms.push(t);
+    };
     const rawDb = db.getRawDb();
     try {
-        for (const row of rawDb.prepare("SELECT technology FROM tech_stack").all()) {
-            if (row.technology)
-                stack.add(row.technology.toLowerCase());
+        for (const row of rawDb
+            .prepare("SELECT name FROM detected_tech WHERE category IN ('framework', 'library') ORDER BY confidence DESC LIMIT 20")
+            .all()) {
+            add(row.name);
+        }
+    }
+    catch {
+        // detected_tech may not exist on exotic DBs.
+    }
+    try {
+        const direct = db.hasColumn("project_dependencies", "is_direct") ? "WHERE is_direct = 1" : "";
+        for (const row of rawDb
+            .prepare(`SELECT package_name FROM project_dependencies ${direct}
+         GROUP BY LOWER(package_name) ORDER BY COUNT(DISTINCT project_path) DESC, package_name LIMIT 40`)
+            .all()) {
+            if (terms.length >= MAX_TERMS)
+                break;
+            add(row.package_name);
         }
     }
     catch {
-        // tech_stack may not exist on exotic DBs — languages below still apply.
+        // project_dependencies may not exist.
     }
+    // Then the project's languages, as language-level news (labelled so by the
+    // fetcher): HN titles rarely name a library in a two-week window, and an
+    // asked-for ecosystem pulse should still say what moved in the language.
+    const specific = terms.slice(0, MAX_TERMS - 2);
+    const languages = [];
     try {
         for (const row of rawDb.prepare("SELECT DISTINCT language FROM project_dependencies").all()) {
-            if (row.language)
-                stack.add(row.language.toLowerCase());
+            const term = (row.language ?? "").toLowerCase();
+            if (term && PULSE_LANGUAGES.has(term) && !languages.includes(term))
+                languages.push(term);
         }
     }
     catch {
-        // project_dependencies may not exist — an empty stack yields an honest empty result.
+        // An empty stack yields an honest empty result.
     }
-    return [...stack];
+    return [...specific, ...languages.slice(0, MAX_TERMS - specific.length)];
 }
+/**
+ * Languages with distinctive enough names to search HN for: not
+ * "javascript"/"typescript" (they flood), not "go" (an everyday word in titles).
+ */
+const PULSE_LANGUAGES = new Set(["rust", "python", "zig", "kotlin", "swift", "ruby", "elixir"]);
 export async function executeEcosystemPulse(db, params, liveIntel) {
     if (!liveIntel) {
         return {
@@ -60,9 +99,9 @@ export async function executeEcosystemPulse(db, params, liveIntel) {
             note: "Live intelligence not available. Set FOURDA_OFFLINE=false and restart.",
         };
     }
-    // The startup prefetch only ever ran in standalone mode, so full-DB servers
-    // returned an empty cache forever. Fetch on demand when the cache is empty —
-    // the cache still serves warm repeat calls.
+    // Fetched when asked for, never at startup: the search terms are names from
+    // the user's projects, and HN should see them only when the user asks for
+    // the pulse. The cache serves warm repeat calls.
     let headlines = liveIntel.getHeadlines();
     if (headlines.length === 0 && liveIntel.isEnabled()) {
         const techStack = deriveTechStackForHeadlines(db);

package/dist/tools/get-actionable-signals.d.ts

@@ -6,8 +6,10 @@
  * Cross-references against the user's ACE-detected tech stack.
  */
 import type { FourDADatabase } from "../db.js";
-type SignalType = "security_alert" | "breaking_change" | "tool_discovery" | "tech_trend" | "learning" | "competitive_intel";
-type SignalPriority = "critical" | "high" | "medium" | "low";
+import type { LiveIntelligence } from "../live/index.js";
+import type { VulnerabilityEntry } from "../live/types.js";
+import { type SignalPriority, type SignalType } from "./signal-classifier.js";
+export { normalizeStoredPriority, type SignalPriority, type SignalType } from "./signal-classifier.js";
 interface ClassifiedSignal {
     id: number;
     title: string;
@@ -56,9 +58,29 @@ export interface GetActionableSignalsParams {
     limit?: number;
     since_hours?: number;
 }
-export declare function executeGetActionableSignals(db: FourDADatabase, params: GetActionableSignalsParams): {
+/** The slice of the live layer this tool reads; a stub suffices in tests. */
+export type SignalsLiveIntel = Pick<LiveIntelligence, "getVulnerabilities">;
+/** One signal's worth of live findings: the entry to report and every id it is known by. */
+export interface VulnerabilityCluster {
+    representative: VulnerabilityEntry;
+    ids: string[];
+}
+/**
+ * Group scan entries that are the same vulnerability under different ids.
+ *
+ * OSV returns a GHSA record and a RUSTSEC (or CVE) record for one bug, each
+ * naming the other in `aliases`; injected one-per-record they read as two
+ * problems and doubled the advisory count in every briefing. Union-find over
+ * `[vulnId, ...aliases]` connects the records transitively (A knows B, B knows
+ * C), scoped to the affected (ecosystem, package, version) so one advisory
+ * against two packages — or two pinned versions of one package — stays two
+ * things to fix. The representative is the GHSA record when the cluster has
+ * one (the richest and most stable id), else the first seen; `ids` lists
+ * every identifier in first-seen order.
+ */
+export declare function clusterVulnerabilities(vulns: VulnerabilityEntry[]): VulnerabilityCluster[];
+export declare function executeGetActionableSignals(db: FourDADatabase, params: GetActionableSignalsParams, liveIntel?: SignalsLiveIntel | null): {
     signals: ClassifiedSignal[];
     total: number;
     summary: Record<string, number>;
 };
-export {};