@gamaze/hicortex 0.15.1 → 0.15.3

package/dist/retrieval.js

@@ -3,8 +3,11 @@
  * Retrieval layer with composite scoring, RRF fusion, and graph traversal.
  * Ported from hicortex/retrieval.py — same scoring model and weights.
  *
- * Scoring model:
- *   score = similarity * 0.4 + effective_strength * 0.3 + connection_score * 0.2 + recency * 0.1
+ * Scoring model (weights are config-driven since 0.15.2 — see configureScoring):
+ *   score = similarity * 0.50 + effective_strength * 0.20
+ *         + connection_score * 0.15 + recency * 0.15
+ *         + fresh-memory bonus (≤ 0.15, linear over the first 7 days)
+ *         then × 0.50 if the memory was superseded by a later decision
  *
  * Decay model (B+E+D):
  *   base_decay = derived from decayHalfLifeDays (config; default 365 → ~1-year
@@ -49,16 +52,23 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_DECAY_HALF_LIFE_DAYS = void 0;
+exports.SESSION_INTENT_ALPHA = exports.DEFAULT_DECAY_HALF_LIFE_DAYS = void 0;
 exports.decayConstantForHalfLife = decayConstantForHalfLife;
 exports.configureDecay = configureDecay;
 exports.configureRecall = configureRecall;
+exports.configureScoring = configureScoring;
+exports.getScoringWeights = getScoringWeights;
+exports.configureSessionIntent = configureSessionIntent;
+exports.getSessionIntent = getSessionIntent;
+exports.blendQueryVector = blendQueryVector;
+exports.findSupersededIds = findSupersededIds;
 exports.l2ToCosine = l2ToCosine;
 exports.effectiveStrength = effectiveStrength;
 exports.computeScore = computeScore;
 exports.retrieve = retrieve;
 exports.searchRecent = searchRecent;
 const storage = __importStar(require("./storage.js"));
+const schema_prototypes_js_1 = require("./schema-prototypes.js");
 /** Default decay half-life (days) at importance 0.5. #192: was 0.0005/h
  *  (~115-day half-life at base 0.5) — aggressive enough to bury the long tail
  *  in ranking. Long-term remembering is the product; time preference stays,
@@ -110,6 +120,110 @@ function configureRecall(config) {
     };
     return { ...recallDefaults };
 }
+const SCORING_DEFAULTS = {
+    similarity: 0.5,
+    strength: 0.2,
+    connections: 0.15,
+    recency: 0.15,
+    freshnessBoostDays: 7,
+    freshnessBoostWeight: 0.15,
+    supersededDemotion: 0.5,
+};
+let scoringWeights = { ...SCORING_DEFAULTS };
+/**
+ * Configure scoring weights + ranking knobs from config. Called at boot by the
+ * server and the nightly (alongside configureDecay/configureRecall) so
+ * retrieval and consolidation rank identically. Invalid/absent values keep the
+ * shipped default per key. Returns the resolved set for logging/tests.
+ */
+function configureScoring(config) {
+    const num = (key, dflt, min, max) => {
+        const v = Number(config?.[key]);
+        return Number.isFinite(v) && v >= min && v <= max ? v : dflt;
+    };
+    scoringWeights = {
+        similarity: num("scoreSimilarityWeight", SCORING_DEFAULTS.similarity, 0, 1),
+        strength: num("scoreStrengthWeight", SCORING_DEFAULTS.strength, 0, 1),
+        connections: num("scoreConnectionsWeight", SCORING_DEFAULTS.connections, 0, 1),
+        recency: num("scoreRecencyWeight", SCORING_DEFAULTS.recency, 0, 1),
+        freshnessBoostDays: num("freshnessBoostDays", SCORING_DEFAULTS.freshnessBoostDays, 0, 365),
+        freshnessBoostWeight: num("freshnessBoostWeight", SCORING_DEFAULTS.freshnessBoostWeight, 0, 1),
+        supersededDemotion: num("supersededDemotion", SCORING_DEFAULTS.supersededDemotion, 0, 1),
+    };
+    return { ...scoringWeights };
+}
+/** Current resolved weights (tests + status output). */
+function getScoringWeights() {
+    return { ...scoringWeights };
+}
+// ---------------------------------------------------------------------------
+// Session-intent keying (#192, 0.15.3). ONE config knob:
+//   sessionIntentWeight  0.33  blend weight of the rolling centroid in the
+//                              search vector: query = (1-w)·prompt + w·centroid.
+//                              0 = DISABLED (pure prompt, the kill-switch —
+//                              current behavior). Range [0, 1].
+//
+// The EMA rate α is a shipped constant (SESSION_INTENT_ALPHA, 0.4), not a
+// second knob — owner directive 0.15.3: one knob is enough to tune/disable;
+// exposing α was speculative generality.
+//
+// The centroid itself lives on SessionRecallRegistry; retrieval only needs to
+// ACCEPT a pre-blended query vector (options.queryEmbedding) so the recall
+// closure can do the one-embed-per-recall + blend without retrieve()
+// re-embedding. /search and other unblended callers omit queryEmbedding and
+// get pure-prompt behavior unchanged.
+// ---------------------------------------------------------------------------
+/** EMA rate for the session-intent centroid: centroid_new = (1-α)·old + α·prompt. */
+exports.SESSION_INTENT_ALPHA = 0.4;
+const SESSION_INTENT_DEFAULT_WEIGHT = 0.33;
+let sessionIntentWeight = SESSION_INTENT_DEFAULT_WEIGHT;
+/**
+ * Configure session-intent keying from config. Called at server boot next to
+ * configureScoring (the nightly does no recall, so it does not need this).
+ * Reads only `sessionIntentWeight` ([0,1]; 0 = disabled). Invalid/out-of-range
+ * values keep the shipped default. Returns `{ weight, alpha }` — alpha is the
+ * fixed constant, surfaced so the recall closure passes it to the registry in
+ * one call.
+ */
+function configureSessionIntent(config) {
+    const v = Number(config?.sessionIntentWeight);
+    sessionIntentWeight =
+        Number.isFinite(v) && v >= 0 && v <= 1 ? v : SESSION_INTENT_DEFAULT_WEIGHT;
+    return { weight: sessionIntentWeight, alpha: exports.SESSION_INTENT_ALPHA };
+}
+/** Current resolved session-intent weight + the shipped alpha (closure + tests). */
+function getSessionIntent() {
+    return { weight: sessionIntentWeight, alpha: exports.SESSION_INTENT_ALPHA };
+}
+/**
+ * Blend the prompt embedding with the session-intent centroid for the vector
+ * search: `query = l2Normalize((1-w)·prompt + w·centroid)`. Returns the prompt
+ * UNCHANGED when `centroid` is undefined (first turn — no behavior change) or
+ * `weight` is 0 (the kill-switch — pure prompt). Extracted from the
+ * /recall-index closure (mcp-server.ts) so the exact blend decision is
+ * unit-testable directly, locking the ternary against a refactor without a
+ * closure-integration harness.
+ */
+function blendQueryVector(promptEmb, centroid, weight) {
+    return centroid && weight > 0
+        ? (0, schema_prototypes_js_1.l2Normalize)((0, schema_prototypes_js_1.weightedAdd)(promptEmb, 1 - weight, centroid, weight))
+        : promptEmb;
+}
+/**
+ * Ids among `candidateIds` that have been superseded by a later memory — i.e.
+ * they are the SOURCE of a `superseded_by` link (stageSupersession links
+ * old → new). One query, not per-candidate.
+ */
+function findSupersededIds(db, candidateIds) {
+    if (candidateIds.length === 0)
+        return new Set();
+    const placeholders = candidateIds.map(() => "?").join(",");
+    const rows = db
+        .prepare(`SELECT DISTINCT source_id FROM memory_links
+        WHERE relationship = 'superseded_by' AND source_id IN (${placeholders})`)
+        .all(...candidateIds);
+    return new Set(rows.map((r) => r.source_id));
+}
 /**
  * Placeholder L2 distance for candidates that have no measured vector
  * distance (FTS-only hits and graph-discovered neighbors). Chosen so that
@@ -175,7 +289,7 @@ function effectiveStrength(baseStrength, lastAccessed, now, options) {
  * Return a composite relevance score in [0, 1] for a candidate memory.
  * Exported for exact-value tests of the similarity component (#145).
  */
-function computeScore(memory, distance, connectionCount, maxConnections, now) {
+function computeScore(memory, distance, connectionCount, maxConnections, now, options) {
     // TRUE cosine similarity (#145). The old `1 − distance` compressed real
     // cosines (cos 0.8 scored 0.37) and the 0-clamp at that scale flattened
     // everything below cos 0.5 to exactly 0, killing mid-relevance
@@ -193,7 +307,34 @@ function computeScore(memory, distance, connectionCount, maxConnections, now) {
     const connScore = maxConnections > 0 ? connectionCount / maxConnections : 0;
     const hoursSinceCreated = Math.max((now.getTime() - parseTimestamp(memory.created_at).getTime()) / 3_600_000, 0);
     const recency = Math.pow(0.9995, hoursSinceCreated);
-    return similarity * 0.4 + effStrength * 0.3 + connScore * 0.2 + recency * 0.1;
+    const w = scoringWeights;
+    let score = similarity * w.similarity +
+        effStrength * w.strength +
+        connScore * w.connections +
+        recency * w.recency;
+    // Fresh-memory window (#191 Phase B): a memory is born highly available and
+    // settles into the normal ranking over `freshnessBoostDays`. Age is measured
+    // from created_at, which the nightly sets from the session's own date — so a
+    // session captured last night ranks as ~1 day old (not 0), and backfilled
+    // older content correctly gets no boost. The slow
+    // `recency` term above (≈58-day half-life at weight 0.15) could never lift a
+    // day-old memory past a hardened old one — measured case: an exact-match
+    // 1-day-old memory (strength 0.50) lost to an unrelated memory at strength
+    // 0.80. This is an ADDITIVE bonus that decays linearly to zero at the window
+    // edge, so it cannot distort ranking among memories that are all old.
+    const ageDays = hoursSinceCreated / 24;
+    if (memory.created_at && ageDays < scoringWeights.freshnessBoostDays) {
+        const freshness = 1 - ageDays / scoringWeights.freshnessBoostDays;
+        score += freshness * scoringWeights.freshnessBoostWeight;
+    }
+    // Superseded demotion (#191 Phase B): a memory whose decision was reversed by
+    // a later one keeps its content and strength but must not outrank the
+    // decision that replaced it. Applied as an explicit multiplier here rather
+    // than by penalizing base_strength, so ranking weights stay independently
+    // tunable and supersession never nudges a memory toward prune eligibility.
+    if (options?.superseded)
+        score *= scoringWeights.supersededDemotion;
+    return Math.max(0, Math.min(1, score));
 }
 // ---------------------------------------------------------------------------
 // Graph traversal
@@ -286,8 +427,8 @@ async function retrieve(db, embedFn, query, options) {
     const privacy = options?.privacy;
     const sourceAgent = options?.sourceAgent;
     const now = new Date();
-    // 1. Embed
-    const queryEmbedding = await embedFn(query);
+    // 1. Embed — or reuse the caller-provided vector (session-intent blend).
+    const queryEmbedding = options?.queryEmbedding ?? (await embedFn(query));
     // 2. Dual retrieval — vector + BM25.
     // #192: sqlite-vec can't push filters into the KNN, so filtered queries must
     // over-fetch — the old flat limit*3 intersected a global top-15 with (for the
@@ -357,9 +498,14 @@ async function retrieve(db, embedFn, query, options) {
         : [0]));
     const scored = [];
     const maxRrf = Math.max(...([...rrfScores.values()].length > 0 ? [...rrfScores.values()] : [1]));
+    // One query for the whole candidate set (#191 Phase B): superseded memories
+    // are demoted in computeScore rather than strength-penalized.
+    const supersededIds = findSupersededIds(db, [...candidateMap.keys()]);
     for (const [mid, { mem, distance, source }] of candidateMap) {
         const connCount = connectionCounts.get(mid) ?? 0;
-        const composite = computeScore(mem, distance, connCount, maxConnections, now);
+        const composite = computeScore(mem, distance, connCount, maxConnections, now, {
+            superseded: supersededIds.has(mid),
+        });
         const effStr = effectiveStrength(mem.base_strength ?? 0.5, mem.last_accessed, now, {
             accessCount: mem.access_count ?? 0,
             linkCount: connectionCounts.get(mem.id) ?? 0,
@@ -435,9 +581,12 @@ function searchRecent(db, options) {
         ? [...connectionCounts.values()]
         : [0]));
     const scored = [];
+    const supersededRecent = findSupersededIds(db, candidates.map((c) => c.id));
     for (const mem of candidates) {
         const connCount = connectionCounts.get(mem.id) ?? 0;
-        const score = computeScore(mem, DEFAULT_GRAPH_DISTANCE, connCount, maxConnections, now);
+        const score = computeScore(mem, DEFAULT_GRAPH_DISTANCE, connCount, maxConnections, now, {
+            superseded: supersededRecent.has(mem.id),
+        });
         const effStr = effectiveStrength(mem.base_strength ?? 0.5, mem.last_accessed, now, {
             accessCount: mem.access_count ?? 0,
             linkCount: connectionCounts.get(mem.id) ?? 0,

package/dist/schema-prototypes.d.ts

@@ -38,6 +38,21 @@ export declare function blobToVec(buf: Buffer): Float32Array;
  * is returned as an all-zero copy rather than dividing by zero.
  */
 export declare function l2Normalize(vec: Float32Array): Float32Array;
+/**
+ * Weighted sum of two vectors into a NEW Float32Array (inputs untouched). The
+ * result is NOT renormalized — callers normalize explicitly via `l2Normalize`
+ * when they need a unit vector (both call sites below do, because embeddings
+ * are L2-normalized and the blend must stay on the unit sphere to keep cosine
+ * meaningful). Throws on a dimension mismatch rather than silently truncating:
+ * the embedding dim is fixed at 384 in practice, so a mismatch signals a
+ * mid-process model swap or a bug, which must surface (CLAUDE.md: fail
+ * explicitly), not get quietly papered over.
+ *
+ * Used by the session-intent centroid EMA and the recall query blend (#192
+ * session-intent keying): `weightedAdd(a, 1-α, b, α)` is the EMA step,
+ * `weightedAdd(prompt, 1-w, centroid, w)` is the blended search vector.
+ */
+export declare function weightedAdd(a: Float32Array, wA: number, b: Float32Array, wB: number): Float32Array;
 /**
  * Association weight of a memory for a tag = cosine(memory embedding, domain
  * prototype). Both inputs are L2-normalized (embedder.ts normalizes memory

package/dist/schema-prototypes.js

@@ -28,6 +28,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PROTOTYPE_MIN_MEMBERS = void 0;
 exports.blobToVec = blobToVec;
 exports.l2Normalize = l2Normalize;
+exports.weightedAdd = weightedAdd;
 exports.tagWeight = tagWeight;
 exports.compartmentSet = compartmentSet;
 exports.derivePrimary = derivePrimary;
@@ -70,6 +71,29 @@ function l2Normalize(vec) {
         out[i] = vec[i] / norm;
     return out;
 }
+/**
+ * Weighted sum of two vectors into a NEW Float32Array (inputs untouched). The
+ * result is NOT renormalized — callers normalize explicitly via `l2Normalize`
+ * when they need a unit vector (both call sites below do, because embeddings
+ * are L2-normalized and the blend must stay on the unit sphere to keep cosine
+ * meaningful). Throws on a dimension mismatch rather than silently truncating:
+ * the embedding dim is fixed at 384 in practice, so a mismatch signals a
+ * mid-process model swap or a bug, which must surface (CLAUDE.md: fail
+ * explicitly), not get quietly papered over.
+ *
+ * Used by the session-intent centroid EMA and the recall query blend (#192
+ * session-intent keying): `weightedAdd(a, 1-α, b, α)` is the EMA step,
+ * `weightedAdd(prompt, 1-w, centroid, w)` is the blended search vector.
+ */
+function weightedAdd(a, wA, b, wB) {
+    if (a.length !== b.length) {
+        throw new Error(`weightedAdd: dimension mismatch (${a.length} vs ${b.length}) — expected equal-length L2-normalized embeddings`);
+    }
+    const out = new Float32Array(a.length);
+    for (let i = 0; i < a.length; i++)
+        out[i] = a[i] * wA + b[i] * wB;
+    return out;
+}
 /**
  * Association weight of a memory for a tag = cosine(memory embedding, domain
  * prototype). Both inputs are L2-normalized (embedder.ts normalizes memory

package/dist/storage.js

@@ -335,6 +335,16 @@ function searchFts(db, query, limit = 10, privacy, sourceAgent, project) {
  * Create a link between two memories.
  */
 function addLink(db, sourceId, targetId, relationship, strength = 0.5) {
+    // Guard: superseded_by is the sole ranking-demotion signal, so never let a
+    // different relationship clobber an existing superseded_by link for the same
+    // pair — INSERT OR REPLACE would otherwise silently remove the demotion.
+    if (relationship !== "superseded_by") {
+        const protectedLink = db
+            .prepare("SELECT 1 FROM memory_links WHERE source_id = ? AND target_id = ? AND relationship = 'superseded_by' LIMIT 1")
+            .get(sourceId, targetId);
+        if (protectedLink)
+            return;
+    }
     db.prepare(`INSERT OR REPLACE INTO memory_links
      (source_id, target_id, relationship, strength, created_at)
      VALUES (?, ?, ?, ?, ?)`).run(sourceId, targetId, relationship, strength, nowIso());

package/dist/telemetry.d.ts

@@ -14,6 +14,7 @@
  *   shown    — sum of shown_count (server mode only)
  *   uses     — sum of access_count (server mode only)
  *   cold     — memories never shown and never used (server mode only)
+ *   event    — install | nightly | uninstall (which lifecycle moment this is)
  *
  * Every install sends the SAME fields — nothing marks an install as special
  * (a rare label would be a fingerprint, i.e. no longer anonymous). Excluding
@@ -47,6 +48,13 @@ export interface TelemetryPayload {
     ok: boolean;
     /** Payload schema version (2 = adoption fields, 0.15.1). Absent = v1. */
     pv?: number;
+    /**
+     * Lifecycle event this ping represents (0.15.2). Absent on pre-0.15.2
+     * payloads, which were always nightlies. Active-install counts are derived
+     * from `nightly` events only, so an install/uninstall ping can never look
+     * like activity.
+     */
+    event?: "install" | "nightly" | "uninstall";
     /**
      * Adoption aggregates (server mode only — a client install has no DB).
      * `shown`/`uses` are corpus-wide sums of shown_count/access_count; their
@@ -80,3 +88,12 @@ export declare function telemetryDisabledReason(config: Record<string, unknown>
  * Send anonymous telemetry. Fire-and-forget — failures are silently ignored.
  */
 export declare function sendTelemetry(payload: TelemetryPayload, serverUrl?: string): Promise<void>;
+/**
+ * Send an install/uninstall lifecycle ping (0.15.2). Same anonymous id and
+ * transport as the nightly ping, minus the corpus aggregates (there is nothing
+ * meaningful to count at install time, and at uninstall the numbers are about
+ * to be irrelevant). Fire-and-forget and opt-out-aware like every other ping;
+ * exists so the funnel install → first nightly → retained → uninstall is
+ * measurable instead of inferred.
+ */
+export declare function sendLifecycleEvent(event: "install" | "uninstall", stateDir: string, config: Record<string, unknown> | null, version: string, serverUrl?: string): Promise<void>;

package/dist/telemetry.js

@@ -15,6 +15,7 @@
  *   shown    — sum of shown_count (server mode only)
  *   uses     — sum of access_count (server mode only)
  *   cold     — memories never shown and never used (server mode only)
+ *   event    — install | nightly | uninstall (which lifecycle moment this is)
  *
  * Every install sends the SAME fields — nothing marks an install as special
  * (a rare label would be a fingerprint, i.e. no longer anonymous). Excluding
@@ -42,6 +43,7 @@ exports.isTelemetryEnabled = isTelemetryEnabled;
 exports.getTelemetryId = getTelemetryId;
 exports.telemetryDisabledReason = telemetryDisabledReason;
 exports.sendTelemetry = sendTelemetry;
+exports.sendLifecycleEvent = sendLifecycleEvent;
 const node_crypto_1 = require("node:crypto");
 const state_js_1 = require("./state.js");
 exports.TELEMETRY_URL = "https://hicortex.gamaze.com/api/telemetry";
@@ -105,3 +107,32 @@ async function sendTelemetry(payload, serverUrl = exports.TELEMETRY_URL) {
         // Silently ignore — telemetry must never affect the nightly result
     }
 }
+/**
+ * Send an install/uninstall lifecycle ping (0.15.2). Same anonymous id and
+ * transport as the nightly ping, minus the corpus aggregates (there is nothing
+ * meaningful to count at install time, and at uninstall the numbers are about
+ * to be irrelevant). Fire-and-forget and opt-out-aware like every other ping;
+ * exists so the funnel install → first nightly → retained → uninstall is
+ * measurable instead of inferred.
+ */
+async function sendLifecycleEvent(event, stateDir, config, version, serverUrl) {
+    if (!isTelemetryEnabled(config))
+        return;
+    try {
+        await sendTelemetry({
+            id: getTelemetryId(stateDir),
+            v: version,
+            pv: exports.TELEMETRY_PAYLOAD_VERSION,
+            event,
+            mode: config?.mode === "client" ? "client" : "server",
+            agent: "unknown",
+            mem: 0,
+            lessons: 0,
+            sessions: 0,
+            ok: true,
+        }, serverUrl);
+    }
+    catch {
+        // Never let a lifecycle ping affect install/uninstall success.
+    }
+}

package/dist/uninstall.js

@@ -7,6 +7,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runUninstall = runUninstall;
 const paths_js_1 = require("./paths.js");
 const node_fs_1 = require("node:fs");
+const telemetry_js_1 = require("./telemetry.js");
 const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_child_process_1 = require("node:child_process");
@@ -26,6 +27,15 @@ async function ask(question) {
     });
 }
 async function runUninstall() {
+    // Churn signal (0.15.2): ping BEFORE removing anything, while state.json
+    // still holds the anonymous id. Opt-out aware; failures are swallowed.
+    try {
+        const home = (0, paths_js_1.hicortexHome)();
+        const config = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(home, "config.json"), "utf-8"));
+        const version = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "..", "package.json"), "utf-8")).version;
+        await (0, telemetry_js_1.sendLifecycleEvent)("uninstall", home, config, version);
+    }
+    catch { /* no config/state or unreadable — nothing to report */ }
     console.log("Hicortex — Uninstall CC Integration\n");
     const answer = await ask("This will remove Hicortex from Claude Code. Your memory database is preserved. Continue? [y/N] ");
     if (answer.toLowerCase() !== "y") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gamaze/hicortex",
-  "version": "0.15.1",
+  "version": "0.15.3",
   "description": "Self-learning memory for AI agents — experience captured automatically, distilled into lessons overnight, shared across your whole fleet. Works with Hermes, OpenClaw, Claude Code, and Pi.",
   "main": "dist/index.js",
   "bin": {
@@ -38,6 +38,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "eval": "node dist/eval/run-eval.js",
+    "eval:recall-sweep": "node dist/eval/recall-sweep.js",
     "prepack": "npm run build && rm -rf ./hermes-plugin && mkdir -p ./hermes-plugin && cp -r ../../hermes-plugin/hicortex ./hermes-plugin/ && find ./hermes-plugin -name __pycache__ -type d -exec rm -rf {} + 2>/dev/null || true",
     "prepublishOnly": "npm run build && rm -rf ./hermes-plugin && mkdir -p ./hermes-plugin && cp -r ../../hermes-plugin/hicortex ./hermes-plugin/ && find ./hermes-plugin -name __pycache__ -type d -exec rm -rf {} + 2>/dev/null || true"
   },
@@ -49,7 +50,7 @@
     "vitest": "^3.0.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://hicortex.gamaze.com",
@@ -65,7 +66,7 @@
   "dependencies": {
     "@huggingface/transformers": "^3.0.0",
     "@modelcontextprotocol/sdk": "^1.28.0",
-    "better-sqlite3": "^11.0.0",
+    "better-sqlite3": "^12.11.1",
     "express": "^4.21.0",
     "sqlite-vec": "^0.1.7"
   }