@4da/mcp-server 5.0.3 → 6.0.0

package/dist/project-manifests.js

@@ -0,0 +1,193 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Direct-dependency names from Python, Go and Cargo-workspace manifests, for
+ * the project scanner (project-scanner.ts keeps npm and single-crate Cargo).
+ *
+ * Measured 2026-10-02, each gap below hid a whole project from the scan:
+ * - Poetry projects declare dependencies under `[tool.poetry.dependencies]`;
+ *   the scanner only looked for `dependencies = [`, found nothing, and never
+ *   created a Python group — poetry 1.0's own lockfile (131 advisories per
+ *   osv-scanner) scanned as zero dependencies.
+ * - A Cargo virtual workspace root (`[workspace]`, no `[package]`) declares
+ *   its dependencies in `[workspace.dependencies]` and in member manifests;
+ *   victauri's whole Cargo.lock (10 advisories per cargo audit) was ignored.
+ * - go.mod `// indirect` requirements are transitive, not direct.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { normalizePythonName, parseGoMod } from "./live/lockfile-parsers-pygo.js";
+/** The body of a TOML table (`[name]`) up to the next table header, or null. */
+export function tomlTable(content, name) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const header = new RegExp(`^\\[${escaped}\\]\\s*$`, "m").exec(content);
+    if (!header)
+        return null;
+    const rest = content.slice(header.index + header[0].length);
+    const next = rest.search(/^\[/m);
+    return next === -1 ? rest : rest.slice(0, next);
+}
+/** Keys of a TOML table body: `name = ...` lines, skipping comments. */
+function tomlKeys(body) {
+    if (!body)
+        return [];
+    const keys = [];
+    for (const line of body.split(/\r?\n/)) {
+        const m = /^\s*"?([A-Za-z0-9_.-]+)"?\s*=/.exec(line);
+        if (m && !line.trim().startsWith("#"))
+            keys.push(m[1]);
+    }
+    return keys;
+}
+/**
+ * PEP 508 requirement strings inside a TOML array literal:
+ * `"requests[socks]>=2; python_version>'3'"` -> requests. String literals are
+ * read whole, so a quote INSIDE one (an environment marker) is not a new entry.
+ */
+function requirementNames(arrayBody) {
+    const names = [];
+    for (const m of arrayBody.matchAll(/"((?:[^"\\]|\\.)*)"|'([^']*)'/g)) {
+        const name = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(m[1] ?? m[2] ?? "");
+        if (name)
+            names.push(name[1]);
+    }
+    return names;
+}
+/**
+ * The array literal assigned to `key` inside `body` (multi-line), or "".
+ * Brackets inside quoted strings do not close it: `"requests[socks]>=2"` is
+ * an ordinary PEP 508 entry, and a non-greedy `\[...\]` stopped at its `]`
+ * and dropped every dependency after it.
+ */
+function tomlArray(body, key) {
+    if (!body)
+        return "";
+    const start = new RegExp(`^\\s*${key}\\s*=\\s*\\[`, "m").exec(body);
+    if (!start)
+        return "";
+    let depth = 1;
+    let quote = null;
+    const from = start.index + start[0].length;
+    for (let i = from; i < body.length; i++) {
+        const ch = body[i];
+        if (quote) {
+            if (ch === "\\")
+                i++;
+            else if (ch === quote)
+                quote = null;
+        }
+        else if (ch === '"' || ch === "'")
+            quote = ch;
+        else if (ch === "[")
+            depth++;
+        else if (ch === "]" && --depth === 0)
+            return body.slice(from, i);
+    }
+    return body.slice(from);
+}
+/**
+ * Direct Python dependencies from pyproject.toml: PEP 621 `[project]`
+ * `dependencies`, `[project.optional-dependencies]` and PEP 735
+ * `[dependency-groups]` (dev), Poetry's `[tool.poetry.dependencies]` and its
+ * dev groups, and uv's `[tool.uv] dev-dependencies`. Names are PEP 503 normalised.
+ */
+export function parsePyprojectDependencies(content) {
+    const deps = new Set();
+    const devDeps = new Set();
+    const add = (set, names) => {
+        for (const name of names) {
+            const normalized = normalizePythonName(name);
+            if (normalized !== "python")
+                set.add(normalized);
+        }
+    };
+    add(deps, requirementNames(tomlArray(tomlTable(content, "project"), "dependencies")));
+    const optional = tomlTable(content, "project.optional-dependencies");
+    if (optional)
+        add(deps, requirementNames(optional.replace(/^\s*[A-Za-z0-9_.-]+\s*=/gm, "")));
+    add(deps, tomlKeys(tomlTable(content, "tool.poetry.dependencies")));
+    add(devDeps, tomlKeys(tomlTable(content, "tool.poetry.dev-dependencies")));
+    for (const m of content.matchAll(/^\[tool\.poetry\.group\.([A-Za-z0-9_-]+)\.dependencies\]\s*$/gm)) {
+        add(devDeps, tomlKeys(tomlTable(content, `tool.poetry.group.${m[1]}.dependencies`)));
+    }
+    add(devDeps, requirementNames(tomlArray(tomlTable(content, "tool.uv"), "dev-dependencies")));
+    const groups = tomlTable(content, "dependency-groups");
+    if (groups)
+        add(devDeps, requirementNames(groups.replace(/^\s*[A-Za-z0-9_.-]+\s*=/gm, "")));
+    for (const name of deps)
+        devDeps.delete(name);
+    return { deps: [...deps], devDeps: [...devDeps] };
+}
+/** Requirement names (pins and ranges alike) from a requirements file, PEP 503 normalised. */
+export function parseRequirementNames(content) {
+    const names = [];
+    for (const raw of content.replace(/\\\r?\n/g, " ").split(/\r?\n/)) {
+        const line = raw.replace(/(^|\s)#.*$/, "").trim();
+        if (!line || line.startsWith("-"))
+            continue;
+        const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(line);
+        if (m)
+            names.push(normalizePythonName(m[1]));
+    }
+    return [...new Set(names)];
+}
+/** Direct Go dependencies: go.mod requirements not marked `// indirect`. */
+export function parseGoModDirectDeps(content) {
+    return parseGoMod(content)
+        .requires.filter((r) => !r.indirect)
+        .map((r) => r.module);
+}
+/**
+ * Dependencies of a Cargo workspace root: `[workspace.dependencies]` plus the
+ * `[dependencies]`/`[dev-dependencies]`/`[build-dependencies]` of every member
+ * (`members = ["crates/*", "app"]`, one-level `*` globs). Member crates
+ * themselves are excluded: they are this project's own code.
+ */
+export function cargoWorkspaceDeps(root, content) {
+    const workspace = tomlTable(content, "workspace");
+    if (workspace === null)
+        return { deps: [], devDeps: [] };
+    const deps = new Set(tomlKeys(tomlTable(content, "workspace.dependencies")));
+    const devDeps = new Set();
+    const memberNames = new Set();
+    const members = [...tomlArray(workspace, "members").matchAll(/["']([^"']+)["']/g)].map((m) => m[1]);
+    for (const pattern of members) {
+        for (const dir of expandMemberGlob(root, pattern)) {
+            let manifest;
+            try {
+                manifest = fs.readFileSync(path.join(dir, "Cargo.toml"), "utf-8");
+            }
+            catch {
+                continue;
+            }
+            const name = /^name\s*=\s*"([^"]+)"/m.exec(tomlTable(manifest, "package") ?? "")?.[1];
+            if (name)
+                memberNames.add(name);
+            for (const dep of tomlKeys(tomlTable(manifest, "dependencies")))
+                deps.add(dep);
+            for (const section of ["dev-dependencies", "build-dependencies"]) {
+                for (const dep of tomlKeys(tomlTable(manifest, section)))
+                    devDeps.add(dep);
+            }
+        }
+    }
+    const strip = (set) => [...set].filter((d) => !memberNames.has(d));
+    const runtime = strip(deps);
+    return { deps: runtime, devDeps: strip(devDeps).filter((d) => !runtime.includes(d)) };
+}
+/** Member directories for one `members` entry: a path, or a path whose last segment is `*`. */
+function expandMemberGlob(root, pattern) {
+    if (!pattern.includes("*"))
+        return [path.join(root, pattern)];
+    const star = pattern.indexOf("*");
+    const parent = path.join(root, pattern.slice(0, star));
+    try {
+        return fs
+            .readdirSync(parent, { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => path.join(parent, e.name))
+            .filter((dir) => fs.existsSync(path.join(dir, "Cargo.toml")));
+    }
+    catch {
+        return [];
+    }
+}

package/dist/project-scanner.js

@@ -13,6 +13,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { cargoWorkspaceDeps, parseGoModDirectDeps, parsePyprojectDependencies, parseRequirementNames, } from "./project-manifests.js";
 // =============================================================================
 // Framework Detection Maps
 // =============================================================================
@@ -193,6 +194,19 @@ export function scanCurrentProject(cwd) {
             // Platform-gated deps: [target.'cfg(...)'.dependencies] / [target.<triple>.dependencies].
             // Previously skipped entirely (e.g. windows-sys, winreg, libc were invisible).
             parseTargetDependencies(content, rustDeps, rustDevDeps, result.depTargets, fwSet, RUST_FRAMEWORK_MAP);
+            // A workspace root declares dependencies for its members; a virtual one
+            // (no [package]) declares nothing else, and was scanned as empty.
+            const workspace = cargoWorkspaceDeps(cwd, content);
+            for (const dep of workspace.deps) {
+                if (!rustDeps.includes(dep))
+                    rustDeps.push(dep);
+                if (dep in RUST_FRAMEWORK_MAP)
+                    fwSet.add(RUST_FRAMEWORK_MAP[dep]);
+            }
+            for (const dep of workspace.devDeps) {
+                if (!rustDeps.includes(dep) && !rustDevDeps.includes(dep))
+                    rustDevDeps.push(dep);
+            }
             // Add to flat arrays for backward compat
             result.dependencies.push(...rustDeps);
             result.devDependencies.push(...rustDevDeps);
@@ -211,59 +225,42 @@ export function scanCurrentProject(cwd) {
     const pyprojectPath = path.join(cwd, "pyproject.toml");
     const requirementsPath = path.join(cwd, "requirements.txt");
     const setupPyPath = path.join(cwd, "setup.py");
+    // pyproject.toml (PEP 621, Poetry, uv) and requirements.txt are read
+    // together: a project often has both, and the old else-if dropped the second.
+    const pyDeps = new Set();
+    const pyDevDeps = new Set();
     if (fs.existsSync(pyprojectPath)) {
         langSet.add("python");
-        const pyDeps = [];
         try {
-            const content = fs.readFileSync(pyprojectPath, "utf-8");
-            // Extract dependencies from pyproject.toml
-            const depsMatch = content.match(/dependencies\s*=\s*\[([\s\S]*?)\]/);
-            if (depsMatch) {
-                const deps = depsMatch[1].match(/"([^">=<!\s]+)/g);
-                if (deps) {
-                    for (const dep of deps) {
-                        const name = dep.replace(/^"/, "");
-                        result.dependencies.push(name);
-                        pyDeps.push(name);
-                        detectPythonFramework(name, fwSet);
-                    }
-                }
-            }
+            const parsed = parsePyprojectDependencies(fs.readFileSync(pyprojectPath, "utf-8"));
+            parsed.deps.forEach((d) => pyDeps.add(d));
+            parsed.devDeps.forEach((d) => pyDevDeps.add(d));
         }
         catch {
             // Skip
         }
-        if (pyDeps.length > 0) {
-            result.depsByEcosystem["python"] = { deps: pyDeps, devDeps: [] };
-        }
     }
-    else if (fs.existsSync(requirementsPath)) {
+    if (fs.existsSync(requirementsPath)) {
         langSet.add("python");
-        const pyDeps = [];
         try {
-            const content = fs.readFileSync(requirementsPath, "utf-8");
-            for (const line of content.split("\n")) {
-                const trimmed = line.trim();
-                if (trimmed && !trimmed.startsWith("#") && !trimmed.startsWith("-")) {
-                    const name = trimmed.split(/[>=<!\[]/)[0].trim();
-                    if (name) {
-                        result.dependencies.push(name);
-                        pyDeps.push(name);
-                        detectPythonFramework(name, fwSet);
-                    }
-                }
-            }
+            parseRequirementNames(fs.readFileSync(requirementsPath, "utf-8")).forEach((d) => pyDeps.add(d));
         }
         catch {
             // Skip
         }
-        if (pyDeps.length > 0) {
-            result.depsByEcosystem["python"] = { deps: pyDeps, devDeps: [] };
-        }
     }
-    else if (fs.existsSync(setupPyPath)) {
+    if (fs.existsSync(setupPyPath)) {
         langSet.add("python");
     }
+    for (const name of pyDeps) {
+        pyDevDeps.delete(name);
+        result.dependencies.push(name);
+        detectPythonFramework(name, fwSet);
+    }
+    result.devDependencies.push(...pyDevDeps);
+    if (pyDeps.size > 0 || pyDevDeps.size > 0) {
+        result.depsByEcosystem["python"] = { deps: [...pyDeps], devDeps: [...pyDevDeps] };
+    }
     // -------------------------------------------------------------------------
     // 4. go.mod (Go ecosystem)
     // -------------------------------------------------------------------------
@@ -279,18 +276,11 @@ export function scanCurrentProject(cwd) {
                 const parts = moduleMatch[1].split("/");
                 result.projectName = parts[parts.length - 1];
             }
-            // Extract require block dependencies
-            const requireMatch = content.match(/require\s*\(([\s\S]*?)\)/);
-            if (requireMatch) {
-                for (const line of requireMatch[1].split("\n")) {
-                    const depMatch = line.trim().match(/^(\S+)\s+/);
-                    if (depMatch && !depMatch[1].startsWith("//")) {
-                        const dep = depMatch[1];
-                        result.dependencies.push(dep);
-                        goDeps.push(dep);
-                        detectGoFramework(dep, fwSet);
-                    }
-                }
+            // Direct requirements only: `// indirect` lines are transitive.
+            for (const dep of parseGoModDirectDeps(content)) {
+                result.dependencies.push(dep);
+                goDeps.push(dep);
+                detectGoFramework(dep, fwSet);
             }
         }
         catch {

package/dist/project-tree.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Every independently-locked project under a root, for standalone scanning.
+ *
+ * A repository root is often not where its lockfiles live: 4DA keeps
+ * `src-tauri/Cargo.lock`, `relay/Cargo.lock`, `site/pnpm-lock.yaml` beside a
+ * root `pnpm-lock.yaml`. Standalone mode used to read the root directory only,
+ * so `npx @4da/mcp-server` started at the repo root never scanned the Rust
+ * code at all (measured 2026-10-02: 0 of src-tauri's 791 crates). The desktop
+ * app does not have this problem — it records each dependency's own manifest
+ * directory — so this is the standalone counterpart of that inventory.
+ *
+ * A directory joins when it holds a lockfile (or go.mod / requirements.txt,
+ * which carry exact versions themselves). Workspace members that share their
+ * root's lockfile are covered by the root. Bounded: depth 2 below the root,
+ * at most 64 projects, and directories that hold installed code, build
+ * output, test fixtures or tool worktrees are skipped.
+ */
+import { type ProjectScanResult } from "./project-scanner.js";
+export interface ProjectTreeEntry {
+    dir: string;
+    scan: ProjectScanResult;
+}
+/**
+ * The root (always) and every locked project below it, each with its own
+ * scan. Directories and lockfiles the repository's .gitignore excludes are not
+ * part of the project and are skipped (gitignore.ts).
+ */
+export declare function scanProjectTree(root: string): ProjectTreeEntry[];
+/**
+ * Resolution groups for the live layer: one per (project directory, ecosystem).
+ * A lockfile whose manifest declared nothing the scanner could read still gets
+ * a group, so its installed packages are scanned (as transitives) rather than
+ * silently dropped.
+ */
+export declare function treeResolutionGroups(entries: ProjectTreeEntry[]): Array<{
+    dir: string;
+    language: string;
+    deps: string[];
+    devDeps: string[];
+    targets: Record<string, string>;
+}>;

package/dist/project-tree.js

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Every independently-locked project under a root, for standalone scanning.
+ *
+ * A repository root is often not where its lockfiles live: 4DA keeps
+ * `src-tauri/Cargo.lock`, `relay/Cargo.lock`, `site/pnpm-lock.yaml` beside a
+ * root `pnpm-lock.yaml`. Standalone mode used to read the root directory only,
+ * so `npx @4da/mcp-server` started at the repo root never scanned the Rust
+ * code at all (measured 2026-10-02: 0 of src-tauri's 791 crates). The desktop
+ * app does not have this problem — it records each dependency's own manifest
+ * directory — so this is the standalone counterpart of that inventory.
+ *
+ * A directory joins when it holds a lockfile (or go.mod / requirements.txt,
+ * which carry exact versions themselves). Workspace members that share their
+ * root's lockfile are covered by the root. Bounded: depth 2 below the root,
+ * at most 64 projects, and directories that hold installed code, build
+ * output, test fixtures or tool worktrees are skipped.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { IgnoreRules } from "./gitignore.js";
+import { scanCurrentProject } from "./project-scanner.js";
+const LOCK_MARKERS = [
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "bun.lock",
+    "Cargo.lock",
+    "poetry.lock",
+    "uv.lock",
+    "Pipfile.lock",
+    "go.mod",
+    "requirements.txt",
+];
+const SKIP_DIRS = new Set([
+    "node_modules", "target", ".git", "dist", "build", "out", "vendor", ".venv", "venv",
+    "__pycache__", ".next", ".nuxt", "coverage", ".claude", ".codex", ".cursor", "fixtures",
+    "__fixtures__", "testdata", "test-fixtures", "__tests__", ".turbo", ".cache", ".pnpm-store",
+]);
+const MAX_DEPTH = 2;
+const MAX_PROJECTS = 64;
+/**
+ * The root (always) and every locked project below it, each with its own
+ * scan. Directories and lockfiles the repository's .gitignore excludes are not
+ * part of the project and are skipped (gitignore.ts).
+ */
+export function scanProjectTree(root) {
+    const entries = [{ dir: root, scan: scanCurrentProject(root) }];
+    const ignore = new IgnoreRules(root);
+    const walk = (dir, rel, depth) => {
+        if (depth > MAX_DEPTH || entries.length >= MAX_PROJECTS)
+            return;
+        ignore.load(rel);
+        let children;
+        try {
+            children = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const child of children) {
+            if (entries.length >= MAX_PROJECTS)
+                return;
+            if (!child.isDirectory() || SKIP_DIRS.has(child.name) || child.name.startsWith("."))
+                continue;
+            const childRel = rel ? `${rel}/${child.name}` : child.name;
+            if (ignore.ignores(childRel, true))
+                continue;
+            const sub = path.join(dir, child.name);
+            ignore.load(childRel);
+            const locked = LOCK_MARKERS.some((marker) => fs.existsSync(path.join(sub, marker)) && !ignore.ignores(`${childRel}/${marker}`, false));
+            if (locked)
+                entries.push({ dir: sub, scan: scanCurrentProject(sub) });
+            walk(sub, childRel, depth + 1);
+        }
+    };
+    walk(root, "", 1);
+    return entries;
+}
+/** Lockfiles that make an ecosystem scannable in a directory even when no direct dependency was parsed. */
+const LOCKS_BY_LANGUAGE = {
+    npm: ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"],
+    rust: ["Cargo.lock"],
+    python: ["poetry.lock", "uv.lock", "Pipfile.lock", "requirements.txt"],
+    go: ["go.mod"],
+};
+/**
+ * Resolution groups for the live layer: one per (project directory, ecosystem).
+ * A lockfile whose manifest declared nothing the scanner could read still gets
+ * a group, so its installed packages are scanned (as transitives) rather than
+ * silently dropped.
+ */
+export function treeResolutionGroups(entries) {
+    return entries.flatMap(({ dir, scan }) => {
+        const byLanguage = { ...scan.depsByEcosystem };
+        for (const [language, locks] of Object.entries(LOCKS_BY_LANGUAGE)) {
+            if (!byLanguage[language] && locks.some((lock) => fs.existsSync(path.join(dir, lock)))) {
+                byLanguage[language] = { deps: [], devDeps: [] };
+            }
+        }
+        return Object.entries(byLanguage).map(([language, { deps, devDeps }]) => ({
+            dir,
+            language,
+            deps,
+            devDeps,
+            targets: scan.depTargets,
+        }));
+    });
+}

package/dist/prompts.d.ts

@@ -0,0 +1,28 @@
+/**
+ * MCP prompts — user-invoked workflows (e.g. `/deps` in hosts that surface
+ * prompts as slash commands). A prompt is text handed to the agent; it does
+ * nothing on its own and never runs without the user choosing it.
+ */
+export interface PromptDefinition {
+    name: string;
+    title: string;
+    description: string;
+    arguments: Array<{
+        name: string;
+        description: string;
+        required: boolean;
+    }>;
+}
+export declare const PROMPTS: PromptDefinition[];
+export declare function listPrompts(): PromptDefinition[];
+/** The prompt's messages, or null for an unknown prompt name. */
+export declare function getPrompt(name: string, args: Record<string, string> | undefined): {
+    description: string;
+    messages: Array<{
+        role: "user";
+        content: {
+            type: "text";
+            text: string;
+        };
+    }>;
+} | null;

package/dist/prompts.js

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * MCP prompts — user-invoked workflows (e.g. `/deps` in hosts that surface
+ * prompts as slash commands). A prompt is text handed to the agent; it does
+ * nothing on its own and never runs without the user choosing it.
+ */
+const DEPS_PROMPT = {
+    name: "deps",
+    title: "Safe dependency updates",
+    description: "Plan dependency upgrades, vet every bump with dependency_check, apply only the safe ones in small tested batches, and report the rest with evidence.",
+    arguments: [
+        {
+            name: "scope",
+            description: "Optional focus, e.g. a package name, \"security only\", or \"patch and minor only\".",
+            required: false,
+        },
+    ],
+};
+export const PROMPTS = [DEPS_PROMPT];
+export function listPrompts() {
+    return PROMPTS;
+}
+/** The prompt's messages, or null for an unknown prompt name. */
+export function getPrompt(name, args) {
+    if (name !== DEPS_PROMPT.name)
+        return null;
+    const scope = args?.scope?.trim();
+    return {
+        description: DEPS_PROMPT.description,
+        messages: [{ role: "user", content: { type: "text", text: depsWorkflow(scope) } }],
+    };
+}
+function depsWorkflow(scope) {
+    return [
+        "Update this project's dependencies safely, using the 4DA tools in this order.",
+        scope ? `Scope for this run: ${scope}. Leave everything outside it alone.` : "",
+        "",
+        "1. Call `upgrade_planner` to get the proposed upgrades (it runs the vulnerability scan itself; if it says it is CVE-blind, call it again once the scan completes). When its provenance is `app_plan`, each step is a work order: for every installed line it gives `installed`, `target`, `upgrade_type` and the project sites, plus a `mechanism`. Only touch steps whose sites include this project.",
+        "2. Call `dependency_check` on every proposed bump, passing `from` (the installed version) and `to` (the proposed version). Batch up to 25 items per call.",
+        "3. For each `proceed` item that is a major upgrade (a 0.x minor counts), call `upgrade_impact` with the package and target version first: it lists the breaking changes and the files here that import the package. Make the code changes it calls for in the same batch, and give each major its own batch.",
+        "4. Apply ONLY items whose verdict is `proceed`. Apply them in small batches (a few packages at a time, never majors mixed with patches), using the project's own package manager so the lockfile is updated. A `target` is a minimum: ask the package manager for at least that version and let it resolve the exact one. Follow the step's `mechanism`:",
+        "   - `manifest_bump`: raise the declared version range in this project's manifest, then install.",
+        "   - `lockfile_or_parent_update`: the package is not declared here. Update it within the existing ranges with the package manager's update command for that one package; if the ranges do not allow the target, update the direct dependency that pulls it in instead. Never add the transitive package as a new direct dependency.",
+        "   - `mixed`: handle each site by whether it is direct or transitive, as above.",
+        "   - `no_fix`: no fixed version exists yet. Do not change anything; report it.",
+        "5. After each batch, run the project's own tests (and its build or type-check if it has one). If anything fails, revert that batch, note which package caused it, and continue with the next batch.",
+        "6. Do NOT apply `review`, `avoid`, `wait` or `unknown` items. Stop on them and report each one to me with its verdict, reason, and the evidence from its signals, so I can decide. For `wait`, say when the release becomes old enough. If the package manager refuses a version because of its own policy (for example a minimum release age or a trust check), report that too; do not change the policy.",
+        "7. When done, call `vulnerability_scan` again and report: what was applied, what was skipped and why, test results per batch, and any advisories still open. If the app plan was used, say that a 4DA rescan will drop the finished steps.",
+        "",
+        "Never bypass a failing test, never edit a lockfile by hand, and never apply an item whose verdict you did not get from dependency_check.",
+    ]
+        .filter((line, i, all) => line !== "" || all[i - 1] !== "")
+        .join("\n");
+}