@4da/mcp-server 6.2.0 → 6.2.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 6.2.1 — 2026-10-11
+
+### Feed tools leave out sources you turned off in the 4DA app
+
+Since app schema 126, social and editorial sources (Hacker News, Reddit, RSS
+and the rest) are opt-in "interests", off until turned on in Settings →
+Sources, and every app reader skips their items. The server still returned
+them. `get_relevant_content`, `get_actionable_signals`, `knowledge_gaps` and
+`what_should_i_know` now apply the app's own rule
+(`source_type NOT IN (SELECT source_type FROM sources WHERE enabled = 0)`), and
+say so in a `sources_note` when any source is off. A source with no `sources`
+row counts as on, as in the app; a database without `sources.enabled` is read
+unfiltered, as before. `developer_dna` is unchanged: like the app's own, it
+reports reading history. The vendored app-schema contract moves to schema 127.
+
 ## 6.2.0 — 2026-10-11
 
 ### `dependency_check`: the release-age hold no longer leaves only vulnerable choices

package/dist/db.d.ts

@@ -257,6 +257,21 @@ export declare class FourDADatabase {
     /** `MAX(sources.last_fetch)`, tolerant of a missing `sources` table (returns null). */
     private safeMaxLastFetch;
     hasTable(table: string): boolean;
+    /** Whether `sources.enabled` exists; probed once per connection (see enabledSourceClause). */
+    private sourcesEnabledColumn;
+    private hasSourcesEnabled;
+    /**
+     * ` AND <col> is a source the user has not turned off`, or `` when the
+     * database cannot say. The desktop app's rule, verbatim
+     * (`source_class::enabled_source_sql`, schema 126): every reader of source
+     * items skips a `source_type` whose `sources` row has `enabled = 0`. A type
+     * with no `sources` row counts as on, as in the app. A database without a
+     * `sources.enabled` column (or without `sources`) is read unfiltered, exactly
+     * as before this guard existed.
+     */
+    enabledSourceClause(col: string): string;
+    /** Source types the user turned off in the app (`sources.enabled = 0`), sorted; [] when unknown. */
+    disabledSources(): string[];
     hasColumn(table: string, column: string): boolean;
     /**
      * Idempotently add a column to a table if it does not already exist.

package/dist/db.js

@@ -1033,6 +1033,41 @@ export class FourDADatabase {
             return false;
         }
     }
+    /** Whether `sources.enabled` exists; probed once per connection (see enabledSourceClause). */
+    sourcesEnabledColumn;
+    hasSourcesEnabled() {
+        if (this.sourcesEnabledColumn === undefined) {
+            this.sourcesEnabledColumn = this.hasColumn("sources", "enabled");
+        }
+        return this.sourcesEnabledColumn;
+    }
+    /**
+     * ` AND <col> is a source the user has not turned off`, or `` when the
+     * database cannot say. The desktop app's rule, verbatim
+     * (`source_class::enabled_source_sql`, schema 126): every reader of source
+     * items skips a `source_type` whose `sources` row has `enabled = 0`. A type
+     * with no `sources` row counts as on, as in the app. A database without a
+     * `sources.enabled` column (or without `sources`) is read unfiltered, exactly
+     * as before this guard existed.
+     */
+    enabledSourceClause(col) {
+        return this.hasSourcesEnabled()
+            ? ` AND ${col} NOT IN (SELECT source_type FROM sources WHERE enabled = 0)`
+            : ``;
+    }
+    /** Source types the user turned off in the app (`sources.enabled = 0`), sorted; [] when unknown. */
+    disabledSources() {
+        if (!this.hasSourcesEnabled())
+            return [];
+        try {
+            return this.db
+                .prepare("SELECT source_type FROM sources WHERE enabled = 0 ORDER BY source_type")
+                .all().map((r) => r.source_type);
+        }
+        catch {
+            return [];
+        }
+    }
     hasColumn(table, column) {
         try {
             const cols = this.db.pragma(`table_info(${table})`);
@@ -1129,7 +1164,7 @@ export class FourDADatabase {
              ${depCount} AS dep_match_count
       FROM source_items
       WHERE relevance_score >= ?
-        AND datetime(created_at) >= datetime(?)${versionGuard}${curationGuard}${advisoryFreshnessGuard}
+        AND datetime(created_at) >= datetime(?)${versionGuard}${curationGuard}${advisoryFreshnessGuard}${this.enabledSourceClause("source_type")}
     `;
         const params = [minScore, sinceDate];
         if (sourceType) {
@@ -1213,7 +1248,7 @@ export class FourDADatabase {
         let query = `
       SELECT id, source_type, source_id, url, title, content, content_hash, created_at, last_seen
       FROM source_items
-      WHERE datetime(created_at) >= datetime(?)${advisoryFreshnessGuard}
+      WHERE datetime(created_at) >= datetime(?)${advisoryFreshnessGuard}${this.enabledSourceClause("source_type")}
     `;
         const params = [sinceDate];
         if (sourceType) {

package/dist/tool-dispatch.d.ts

@@ -27,6 +27,8 @@ export declare const DATABASE_FREE_TOOLS: ReadonlySet<string>;
  * context; the host already owns the process).
  */
 export declare function dispatchTool(name: string, db: FourDADatabase | null, args: Record<string, unknown> | undefined): Promise<CallToolResult>;
+/** The sentence `sources_note` carries, or null when no source is turned off. */
+export declare function sourcesNote(disabled: string[]): string | null;
 /** What a desktop-only tool says when no desktop app database was found. */
 export declare function desktopAppNote(name: string): string;
 /** Check if a tool exists in the dispatch map */

package/dist/tool-dispatch.js

@@ -106,7 +106,8 @@ export async function dispatchTool(name, db, args) {
     // hides these in standalone mode, but a host can call one by name) used to
     // answer `[]`, which reads as "nothing relevant" rather than "no app".
     const desktopOnly = db !== null && db.isStandalone && TOOL_REGISTRY[name]?.standalone === false;
-    const payload = cleanStrings(withFreshness ? attachFreshness(db, result) : desktopOnly ? attachDesktopAppNote(name, result) : result);
+    const annotated = withFreshness ? attachFreshness(db, result) : desktopOnly ? attachDesktopAppNote(name, result) : result;
+    const payload = cleanStrings(db !== null && !db.isStandalone && SOURCE_FILTERED_TOOLS.has(name) ? attachSourcesNote(db, annotated) : annotated);
     // An executor that returns `{ error: "<message>" }` failed: say so in the
     // protocol, not only in the body, so the host and model treat it as an error.
     const failed = payload !== null && typeof payload === "object" && typeof payload.error === "string";
@@ -160,6 +161,45 @@ function attachFreshness(db, result) {
     }
     return { data_freshness, ...extras, result };
 }
+/**
+ * Tools that read the app's feed items and therefore skip items from sources
+ * the user turned off in the app (`FourDADatabase.enabledSourceClause`).
+ * developer_dna is not here: like the app's own developer_dna.rs it reports
+ * reading history, unfiltered, and returns no items.
+ */
+const SOURCE_FILTERED_TOOLS = new Set([
+    "get_relevant_content",
+    "get_actionable_signals",
+    "knowledge_gaps",
+    "what_should_i_know",
+]);
+/** The desktop app's always-on source types (`source_class::STACK_SOURCES`); every other type is an opt-in interest. */
+const STACK_SOURCES = new Set(["crates_io", "npm_registry", "pypi", "go_modules", "osv", "cve"]);
+/** The sentence `sources_note` carries, or null when no source is turned off. */
+export function sourcesNote(disabled) {
+    if (disabled.length === 0)
+        return null;
+    const kind = disabled.every((s) => !STACK_SOURCES.has(s)) ? "interest " : "";
+    const subject = disabled.length === 1 ? `1 ${kind}source is` : `${disabled.length} ${kind}sources are`;
+    return `${subject} turned off in the 4DA app; their items are not included. Turn them on in Settings → Sources.`;
+}
+/** Say, on the payload, that items from turned-off sources were left out. Best-effort, like attachFreshness. */
+function attachSourcesNote(db, result) {
+    let sources_note;
+    try {
+        sources_note = sourcesNote(db.disabledSources());
+    }
+    catch {
+        return result;
+    }
+    if (!sources_note)
+        return result;
+    if (Array.isArray(result))
+        return { sources_note, item_count: result.length, items: result };
+    if (result && typeof result === "object")
+        return { sources_note, ...result };
+    return { sources_note, result };
+}
 /** What a desktop-only tool says when no desktop app database was found. */
 export function desktopAppNote(name) {
     return (`${name} reads the 4DA desktop app's database, and none was found (standalone mode), so this result is empty or partial. ` +

package/dist/tools/briefing-stored-advisories.js

@@ -33,7 +33,7 @@ export function storedAdvisoriesFor(db, packages, limit = 5) {
            WHERE source_type IN (${ADVISORY_SOURCES.map(() => "?").join(", ")})
              AND created_at > datetime('now', '-90 days')
              AND LOWER(title) LIKE ?
-             ${hasFeedRelevant ? "AND (feed_relevant IS NULL OR feed_relevant = 1)" : ""}
+             ${hasFeedRelevant ? "AND (feed_relevant IS NULL OR feed_relevant = 1)" : ""}${db.enabledSourceClause("source_type")}
            ORDER BY created_at DESC LIMIT 20`)
                 .all(...ADVISORY_SOURCES, `%${pkg.name.toLowerCase()}%`);
         }

package/dist/tools/briefing-task-scope.js

@@ -226,7 +226,7 @@ export function releasesFor(db, pkg) {
         rows = db
             .getRawDb()
             .prepare(`SELECT title, url, created_at FROM source_items
-         WHERE source_type = ? AND title LIKE ? ORDER BY created_at DESC LIMIT 50`)
+         WHERE source_type = ? AND title LIKE ?${db.enabledSourceClause("source_type")} ORDER BY created_at DESC LIMIT 50`)
             .all(spec.source, `${spec.prefix}${pkg.name} v%`);
     }
     catch {
@@ -266,7 +266,7 @@ export function judgedReadingFor(db, packages, limit = 5) {
          SELECT s.id, s.title, s.url, s.source_type, l.relevance_score AS verdict, s.created_at
          FROM source_items s JOIN latest l ON l.source_item_id = s.id AND l.rn = 1
          WHERE s.feed_relevant = 1 AND l.relevance_score >= 0.5
-           AND s.created_at > datetime('now', '-30 days')
+           AND s.created_at > datetime('now', '-30 days')${db.enabledSourceClause("s.source_type")}
          ORDER BY l.relevance_score DESC, s.created_at DESC LIMIT 2000`)
             .all();
     }

package/dist/tools/knowledge-gap-citations.js

@@ -56,7 +56,7 @@ export function loadCandidates(db) {
               ${has("source_id") ? "si.source_id" : "NULL AS source_id"},
               substr(COALESCE(si.content, ''), 1, 2000) AS content_head
          FROM source_items si
-        WHERE si.created_at >= datetime('now', '-30 days')
+        WHERE si.created_at >= datetime('now', '-30 days')${db.enabledSourceClause("si.source_type")}
           ${hasRelevance ? "AND si.relevance_score IS NOT NULL AND si.relevance_score >= 0.2" : ""}
           ${hasContentType ? `AND (si.content_type IS NULL OR si.content_type NOT IN (${excludedTypes}))` : ""}
           ${engaged}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4da/mcp-server",
-  "version": "6.2.0",
+  "version": "6.2.1",
   "mcpName": "io.github.4DA-Systems/4da-mcp-server",
   "description": "Upgrade intelligence for AI coding agents: what changes between your installed and target version (changelog, breaking changes, the files you import it from), a pre-install verdict on each bump, vulnerability scanning at osv-scanner parity across npm/pnpm/yarn, Cargo, Python and Go lockfiles, ranked upgrade plans, task-scoped briefings, decision memory. Local, no account; works standalone, and adds the 4DA desktop app's signals, knowledge gaps and stack-judged news when it is installed.",
   "type": "module",