@rse/ase 0.9.34 → 0.9.36

package/dst/ase-service.js

@@ -295,6 +295,10 @@ export default class ServiceCommand {
             const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
             const mcp = buildMcpServer();
             request.raw.res.on("close", () => {
+                /*  "h.abandon" (see below) bypasses "onPreResponse",
+                    so undo the "onRequest" accounting here instead  */
+                inFlight = Math.max(0, inFlight - 1);
+                lastActivity = Date.now();
                 transport.close().catch(() => { });
                 mcp.close().catch(() => { });
             });

package/dst/ase-setup.js

@@ -163,7 +163,7 @@ export default class SetupCommand {
             `installing ASE ${spec.label} plugin (origin: ${dev ? "local" : "remote/bundled"})`);
         const pkgdir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
         const source = dev ? path.resolve(pkgdir, "..") : pkgdir;
-        const scopeArgs = tool === "claude" ? ["--scope", scope] : [];
+        const scopeArgs = tool === "claude" && scope !== "user" ? ["--scope", scope] : [];
         await this.run(spec.cli, ["plugin", "marketplace", "add", source, ...scopeArgs]);
         await this.run(spec.cli, ["plugin", spec.pInstall, "ase@ase", ...scopeArgs], { retries: 3 });
         return 0;
@@ -174,7 +174,7 @@ export default class SetupCommand {
         const spec = toolSpecs[tool];
         await this.ensureTool("npm");
         await this.ensureTool(spec.cli);
-        const scopeArgs = tool === "claude" ? ["--scope", scope] : [];
+        const scopeArgs = tool === "claude" && scope !== "user" ? ["--scope", scope] : [];
         /*  best-effort stop of background service  */
         this.log.write("info", `setup: update${dev ? "[dev]" : ""}: ` +
             "stopping potentially running ASE service");
@@ -230,8 +230,9 @@ export default class SetupCommand {
         this.log.write("info", `setup: enable: enabling ASE ${spec.label} plugin`);
         /*  the GitHub Copilot CLI and OpenAI Codex CLI have no "plugin
             enable" subcommand, so (re-)install the plugin instead  */
+        const scopeArgs = scope !== "user" ? ["--scope", scope] : [];
         const args = tool === "claude" ?
-            ["plugin", "enable", "ase@ase", "--scope", scope] :
+            ["plugin", "enable", "ase@ase", ...scopeArgs] :
             ["plugin", spec.pInstall, "ase@ase"];
         await this.run(spec.cli, args, { retries: tool === "claude" ? 1 : 3 });
         return 0;
@@ -244,8 +245,9 @@ export default class SetupCommand {
         this.log.write("info", `setup: disable: disabling ASE ${spec.label} plugin`);
         /*  the GitHub Copilot CLI and OpenAI Codex CLI have no "plugin
             disable" subcommand, so uninstall the plugin instead  */
+        const scopeArgs = scope !== "user" ? ["--scope", scope] : [];
         const args = tool === "claude" ?
-            ["plugin", "disable", "ase@ase", "--scope", scope] :
+            ["plugin", "disable", "ase@ase", ...scopeArgs] :
             ["plugin", spec.pRemove, "ase@ase"];
         await this.run(spec.cli, args, { retries: tool === "claude" ? 1 : 3 });
         return 0;
@@ -256,7 +258,7 @@ export default class SetupCommand {
         const spec = toolSpecs[tool];
         await this.ensureTool("npm");
         await this.ensureTool(spec.cli);
-        const scopeArgs = tool === "claude" ? ["--scope", scope] : [];
+        const scopeArgs = tool === "claude" && scope !== "user" ? ["--scope", scope] : [];
         /*  best-effort stop of background service  */
         this.log.write("info", `setup: uninstall${dev ? "[dev]" : ""}: ` +
             "stopping potentially running ASE service");
@@ -376,7 +378,8 @@ export default class SetupCommand {
     async mcpAdd(tool, name, env, transport, scope) {
         const args = ["mcp", "add"];
         if (tool === "claude") {
-            args.push("--scope", scope);
+            if (scope !== "user")
+                args.push("--scope", scope);
             args.push("--transport", transport.type);
             if (transport.type === "stdio") {
                 for (const [key, val] of Object.entries(env))
@@ -429,9 +432,8 @@ export default class SetupCommand {
     /*  unregister an MCP server from the tool; the per-tool command line
         differs between Anthropic Claude Code CLI, GitHub Copilot CLI, and OpenAI Codex CLI  */
     async mcpRemove(tool, name, scope) {
-        const args = tool === "claude" ?
-            ["mcp", "remove", "--scope", scope, name] :
-            ["mcp", "remove", name];
+        const scopeArgs = tool === "claude" && scope !== "user" ? ["--scope", scope] : [];
+        const args = ["mcp", "remove", ...scopeArgs, name];
         await this.run(toolSpecs[tool].cli, args, { ignoreError: `MCP server "${name}" not registered` });
     }
     /*  build a chat-model MCP handler from the per-model direct and

package/dst/ase-skills.js

@@ -37,17 +37,19 @@ export class Skills {
             const time = pkg.time ?? {};
             const verEntry = version !== "" ? pkg.versions?.[version] : undefined;
             let repository = "";
+            let deps = "N.A.";
             if (verEntry !== undefined) {
                 const r = verEntry.repository;
                 if (typeof r === "string")
                     repository = r;
                 else if (r !== undefined && typeof r.url === "string")
                     repository = r.url;
+                deps = Object.keys(verEntry.dependencies ?? {}).length;
             }
-            return { version, time, repository };
+            return { version, time, repository, deps };
         }
         catch {
-            return { version: "", time: {}, repository: "" };
+            return { version: "", time: {}, repository: "", deps: "N.A." };
         }
     }
     /*  fetch GitHub stars given a repository URL (or empty string)  */
@@ -83,7 +85,7 @@ export class Skills {
     static async fetchMavenInfo(coord) {
         const [groupId, artifactId] = coord.split(":", 2);
         if (groupId === undefined || artifactId === undefined || groupId === "" || artifactId === "")
-            return { version: "", created: "", updated: "", repository: "" };
+            return { version: "", created: "", updated: "", repository: "", deps: "N.A." };
         try {
             const latest = await Skills.httpLimit(() => ofetch("https://search.maven.org/solrsearch/select" +
                 `?q=g:%22${encodeURIComponent(groupId)}%22+AND+a:%22${encodeURIComponent(artifactId)}%22` +
@@ -113,6 +115,7 @@ export class Skills {
             }
             const created = typeof firstTs === "number" ? new Date(firstTs).toISOString() : updated;
             let repository = "";
+            let deps = "N.A.";
             if (version !== "") {
                 try {
                     const pom = await Skills.httpLimit(() => ofetch(`https://repo1.maven.org/maven2/${groupId.replace(/\./g, "/")}` +
@@ -126,16 +129,31 @@ export class Skills {
                             if (url !== null)
                                 repository = url[1];
                         }
+                        /*  count the `<dependency>` entries of the direct
+                            `<dependencies>` block, skipping `test`/`provided`
+                            scopes; a `<dependencyManagement>` block is ignored
+                            as it only declares versions, not real dependencies  */
+                        const managed = /<dependencyManagement>[\s\S]*?<\/dependencyManagement>/gi;
+                        const stripped = pom.replace(managed, "");
+                        const depRe = /<dependency>([\s\S]*?)<\/dependency>/gi;
+                        let count = 0;
+                        let dep;
+                        while ((dep = depRe.exec(stripped)) !== null) {
+                            const scope = /<scope>\s*([^<\s]+)\s*<\/scope>/i.exec(dep[1]);
+                            if (scope === null || (scope[1] !== "test" && scope[1] !== "provided"))
+                                count++;
+                        }
+                        deps = count;
                     }
                 }
                 catch {
                     repository = "";
                 }
             }
-            return { version, created, updated, repository };
+            return { version, created, updated, repository, deps };
         }
         catch {
-            return { version: "", created: "", updated: "", repository: "" };
+            return { version: "", created: "", updated: "", repository: "", deps: "N.A." };
         }
     }
     /*  fetch the "Used By" count from `mvnrepository.com` as a downloads proxy
@@ -180,7 +198,7 @@ export class Skills {
         -   "JavaScript"/"TypeScript": NPM registry (pacote) + GitHub stars + npm-downloads
         -   "Java"/"Kotlin":           Maven Central + GitHub stars + mvnrepository.com "Used By"
         -   "Unknown":                 not supported -- return empty result  */
-    static async info(stack, components) {
+    static async info(stack, components, staleMonths = 18, smallScope = false) {
         if (stack === "JavaScript" || stack === "TypeScript") {
             /*  per package: kick off packument and downloads in parallel,
                 then stars as soon as the packument resolves; across packages
@@ -194,7 +212,7 @@ export class Skills {
                 ]);
                 const created = p.time.created ?? "";
                 const updated = p.version !== "" ? (p.time[p.version] ?? "") : "";
-                const rank = Skills.computeRank(downloads, stars, created, updated);
+                const rank = Skills.computeRank(downloads, stars, created, updated, p.deps, staleMonths, smallScope);
                 return {
                     name,
                     version: p.version,
@@ -203,6 +221,7 @@ export class Skills {
                     repository: p.repository,
                     stars,
                     downloads,
+                    deps: p.deps,
                     rank
                 };
             }));
@@ -222,7 +241,7 @@ export class Skills {
                 const [i, downloads, stars] = await Promise.all([
                     infoPromise, downloadsPromise, starsPromise
                 ]);
-                const rank = Skills.computeRank(downloads, stars, i.created, i.updated);
+                const rank = Skills.computeRank(downloads, stars, i.created, i.updated, i.deps, staleMonths, smallScope);
                 return {
                     name,
                     version: i.version,
@@ -231,6 +250,7 @@ export class Skills {
                     repository: i.repository,
                     stars,
                     downloads,
+                    deps: i.deps,
                     rank
                 };
             }));
@@ -253,7 +273,7 @@ export class Skills {
         is structurally unavailable, e.g. Maven Central exposes no
         per-artifact download counts) is likewise treated as neutral `1`, so
         such stacks can still be ranked by the remaining metrics.  */
-    static computeRank(downloads, stars, created, updated) {
+    static computeRank(downloads, stars, created, updated, deps, staleMonths, smallScope) {
         const d = typeof downloads === "number" ? downloads + 1 : 1;
         const s = typeof stars === "number" ? stars + 1 : 1;
         const cMs = created !== "" ? Date.parse(created) : NaN;
@@ -277,7 +297,31 @@ export class Skills {
             entry rankable without rewarding the missing date.  */
         const lifespan = (!Number.isNaN(cMs) && !Number.isNaN(uMs)) ? Math.max(0, uMs - cMs) : 1;
         const recentness = !Number.isNaN(uMs) ? Math.exp(-Math.max(0, (now - uMs) / msPerDay) / halfLife) : 0.5;
-        return d * s * lifespan * recentness;
+        let rank = d * s * lifespan * recentness;
+        /*  hard, caller-tunable staleness penalty on top of the soft
+            `recentness` decay: unlike the smooth exp-decay above, this is a
+            two-tier *cliff* keyed off the `staleMonths` threshold. Past the
+            first tier (`staleMonths`) the rank is cut to `0.3x`, past the
+            second tier (`2 x staleMonths`, i.e. long abandoned) to `0.1x`.
+            A component below the first tier -- or one whose `updated` date
+            is unknown -- is left unpenalized.  */
+        if (!Number.isNaN(uMs)) {
+            const ageMonths = (now - uMs) / msPerDay / 30;
+            if (ageMonths > 2 * staleMonths)
+                rank *= 0.1;
+            else if (ageMonths > staleMonths)
+                rank *= 0.3;
+        }
+        /*  small-scope dependency-weight penalty: for a narrow, self-
+            contained need, dragging in a heavy dependency tree is usually
+            the wrong call, so each real component is demoted in proportion
+            to its own number of *direct* dependencies (`1 / (1 + deps)`).
+            A zero-dep component is left unpenalized; an unknown `deps` count
+            (`"N.A."`) is treated neutrally. This only applies when the
+            caller flags the need as small-scope.  */
+        if (smallScope && typeof deps === "number")
+            rank *= 1 / (1 + deps);
+        return rank;
     }
     /*  compute the per-alternative product-sum (rating) row from a
         weighted decision matrix. Each input row has the shape
@@ -318,20 +362,28 @@ export class SkillsMCP {
                 "version + earliest/latest release timestamps from the Maven Central Solr " +
                 "search endpoint, the SCM/project URL from the latest POM at `repo1.maven.org`, " +
                 "GitHub stars (if applicable), and the \"Used By\" count from `mvnrepository.com` " +
-                "as the `downloads` proxy. Returns a JSON `text` array of " +
-                "`{ name, version, created, updated, repository, stars, downloads, rank }` " +
-                "objects, sorted in descending order by `rank`. Failures of individual side " +
-                "calls are isolated and reported as `\"N.A.\"` or empty string so every entry " +
-                "has the full shape.",
+                "as the `downloads` proxy. The number of *direct* dependencies is read as `deps` " +
+                "(from the packument version entry for NPM, or the latest POM's `<dependencies>` " +
+                "block for Maven). Returns a JSON `text` array of " +
+                "`{ name, version, created, updated, repository, stars, downloads, deps, rank }` " +
+                "objects, sorted in descending order by `rank`. The `rank` applies a two-tier hard " +
+                "staleness penalty keyed off `staleMonths` (0.3x past the threshold, 0.1x past twice " +
+                "it) and, when `smallScope` is set, a dependency-weight penalty of `1/(1+deps)` so " +
+                "dependency-heavy components sink. Failures of individual side calls are isolated " +
+                "and reported as `\"N.A.\"` or empty string so every entry has the full shape.",
             inputSchema: {
                 stack: z.string()
                     .describe("Technology stack: \"JavaScript\", \"TypeScript\", \"Java\", \"Kotlin\", or \"Unknown\""),
                 components: z.array(z.string())
-                    .describe("List of package names (NPM) or Maven coordinates `groupId:artifactId` (Java/Kotlin)")
+                    .describe("List of package names (NPM) or Maven coordinates `groupId:artifactId` (Java/Kotlin)"),
+                staleMonths: z.number().optional()
+                    .describe("Staleness threshold in months (default 18); a release older than this is rank-penalized"),
+                smallScope: z.boolean().optional()
+                    .describe("If true, penalize each component by its direct-dependency count (small-scope need)")
             }
         }, async (args) => {
             try {
-                const result = await Skills.info(args.stack, args.components);
+                const result = await Skills.info(args.stack, args.components, args.staleMonths, args.smallScope);
                 return {
                     content: [{ type: "text", text: JSON.stringify(result) }]
                 };

package/package.json

@@ -6,7 +6,7 @@
     "homepage":                             "http://github.com/rse/ase",
     "repository":                           { "url": "git+https://github.com/rse/ase.git", "type": "git" },
     "bugs":                                 { "url": "http://github.com/rse/ase/issues" },
-    "version":                              "0.9.34",
+    "version":                              "0.9.36",
     "license":                              "Apache-2.0",
     "author": {
         "name":                             "Dr. Ralf S. Engelschall",
@@ -18,8 +18,8 @@
     "devDependencies": {
         "eslint":                           "9.39.4",
         "@eslint/js":                       "9.39.4",
-        "@typescript-eslint/parser":        "8.62.0",
-        "@typescript-eslint/eslint-plugin": "8.62.0",
+        "@typescript-eslint/parser":        "8.62.1",
+        "@typescript-eslint/eslint-plugin": "8.62.1",
         "eslint-plugin-promise":            "7.3.0",
         "eslint-plugin-import":             "2.32.0",
         "neostandard":                      "0.13.0",
@@ -30,7 +30,7 @@
         "nodemon":                          "3.1.14",
         "shx":                              "0.4.0",
 
-        "@types/node":                      "26.0.1",
+        "@types/node":                      "26.1.0",
         "@types/luxon":                     "3.7.2",
         "@types/which":                     "3.0.4",
         "@types/update-notifier":           "6.0.8",
@@ -42,9 +42,9 @@
     },
     "dependencies": {
         "commander":                        "15.0.0",
-        "@dotenvx/dotenvx":                 "1.75.1",
+        "@dotenvx/dotenvx":                 "2.1.4",
         "yaml":                             "2.9.0",
-        "valibot":                          "1.4.1",
+        "valibot":                          "1.4.2",
         "execa":                            "9.6.1",
         "mkdirp":                           "3.0.1",
         "@hapi/hapi":                       "21.4.9",
@@ -63,7 +63,7 @@
         "write-file-atomic":                "8.0.0",
         "pacote":                           "22.0.0",
         "ofetch":                           "1.5.1",
-        "picomatch":                        "4.0.4"
+        "picomatch":                        "4.0.5"
     },
     "engines": {
         "npm":                              ">=10.0.0",

package/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name":        "ase",
-    "version":     "0.9.34",
+    "version":     "0.9.36",
     "description": "Agentic Software Engineering (ASE)",
     "keywords":    [ "agentic", "software", "engineering" ],
     "homepage":    "https://ase.tools",

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name":        "ase",
-    "version":     "0.9.34",
+    "version":     "0.9.36",
     "description": "Agentic Software Engineering (ASE)",
     "keywords":    [ "agentic", "software", "engineering" ],
     "homepage":    "https://ase.tools",

package/plugin/.github/plugin/plugin.json

@@ -1,6 +1,6 @@
 {
     "name":        "ase",
-    "version":     "0.9.34",
+    "version":     "0.9.36",
     "description": "Agentic Software Engineering (ASE)",
     "keywords":    [ "agentic", "software", "engineering" ],
     "homepage":    "https://ase.tools",

package/plugin/agents/ase-code-analyze.md

@@ -0,0 +1,262 @@
+---
+name: ase-code-analyze
+description: "Analysis Investigation"
+effort: high
+---
+
+Your role is an experienced, *expert-level software developer*.
+
+Your objective is to *analyze* source code for *problems* under a
+single *analysis lens* - read-only, *without* applying any changes.
+
+Workflow
+--------
+
+1.  Set the requested context: <context>$ARGUMENTS</context>.
+    The *first* whitespace-separated token of <context/> is the
+    *analysis lens* <lens/> (one of `logic`, `performance`, or
+    `security`). The *remaining* tokens are the source code files
+    to analyze.
+
+2.  Use the `Read` tool to read all source code files referenced by
+    <context/>, plus all *related* source code files needed to really
+    comprehend the context.
+
+3.  *Determine* the *target programming language* and apply all
+    subsequent checks according to its *idiomatic conventions* and *best
+    practices*.
+
+4.  Set <problems/> to empty.
+    Then check the read source code for problems under the analysis
+    lens <lens/>:
+
+    -   If <lens/> is `logic`:
+
+        Focus on problems in the *logic* and *semantics* and the related
+        *control flow* only - and do *not* investigate performance,
+        efficiency, or security problems.
+
+        Analysis Hints (not exhaustive, just indicators):
+        -   incorrect conditionals and boolean logic
+        -   off-by-one and boundary errors
+        -   operator misuse
+        -   mishandled edge cases
+        -   broken or missing error handling
+        -   incorrect async/await/promise handling
+        -   control-flow defects (unreachable code, missing breaks, wrong early returns)
+        -   state-mutation bugs
+        -   incorrect default values
+        -   null/undefined mishandling
+        -   type-coercion bugs
+        -   faulty parsing or merge/override semantics
+        -   race conditions and unsynchronized shared state
+        -   resource leaks (unclosed files, handles, connections)
+        -   inverted or swapped function arguments
+        -   incorrect loop termination or accumulator initialization
+        -   shadowed or reassigned variables changing intent
+        -   incomplete switch/case or enum coverage
+        -   silent exception swallowing
+        -   floating-point comparison and rounding errors
+        -   integer overflow/underflow or truncating division
+        -   sign and modulo errors with negative operands
+        -   reference vs. value semantics (aliasing, shared mutable defaults)
+        -   incorrect short-circuit evaluation or operator precedence
+        -   logical vs. bitwise operator confusion
+        -   negation mistakes in compound predicates
+        -   wrong comparison operator (`==` instead of `===`, `<` vs. `<=`, etc)
+        -   inverted condition or swapped if/else branches
+        -   dead or duplicated conditional branches
+        -   fall-through where a break or return was intended
+        -   missing or misplaced base case in recursion (non-termination)
+        -   mutation of a collection while iterating over it
+        -   incorrect index, key, or bounds when accessing collections
+        -   empty-collection or single-element edge cases unhandled
+        -   wrong order of operations in initialization or teardown
+        -   missing cleanup on early return, break, or exception path
+        -   double-free, use-after-free, or double-close of resources
+        -   incorrect time-zone, date arithmetic, or unit conversions
+        -   stale cache or memoization not invalidated on change
+        -   incorrect deep vs. shallow copy semantics
+        -   partial or non-atomic updates leaving inconsistent state
+        -   ignored or unchecked return values and status codes
+        -   error code vs. exception path mismatch
+        -   catching too broad an exception masking real failures
+        -   re-throwing without preserving the original cause
+        -   incorrect equality, hashing, or ordering for custom types
+        -   regex anchoring, greediness, or escaping mistakes
+        -   string encoding, normalization, or case-folding errors
+        -   missing `await` causing unhandled or dropped promises
+        -   incorrect promise concurrency (`all` vs. `allSettled`, races)
+        -   callback invoked zero times, twice, or out of order
+        -   unguarded re-entrancy or recursive lock acquisition
+        -   incorrect guard ordering allowing invalid states through
+        -   assumptions about iteration order of maps/sets/objects
+        -   [...]
+
+    -   If <lens/> is `performance`:
+
+        Focus on *performance* and *efficiency* only - and do *not*
+        investigate logic, semantics, control flow, or security
+        problems.
+
+        Analysis Hints (not exhaustive, just indicators):
+        -   high algorithmic complexity
+        -   needless resource allocations/copies
+        -   redundant recomputation
+        -   many I/O and query round-trips
+        -   concurrency bottlenecks
+        -   mismatched data structures
+        -   N+1 query patterns (1 parent query, N child queries)
+        -   missing caching/memoization of stable results
+        -   blocking/synchronous calls on hot paths
+        -   unbounded growth (memory leaks, ever-growing collections)
+        -   inefficient string building/concatenation in loops
+        -   premature or repeated serialization/parsing
+        -   lack of batching/pagination for bulk operations
+        -   excessive logging or instrumentation overhead
+        -   chatty network protocols (no connection pooling/keep-alive)
+        -   lock contention and overly coarse-grained locking
+        -   eager/over-fetching of data that is never used
+        -   missing database indexes
+        -   repeated regex (re)compilation in hot paths
+        -   busy-waiting/polling instead of event-driven waits
+        -   transferring uncompressed or overly verbose payloads
+        -   missing short-circuit evaluation in expensive conditions
+        -   recomputing invariants inside loops (loop-invariant code)
+        -   suboptimal batch sizes (too small = overhead, too large = latency)
+        -   inefficient algorithms for sorting/searching already-ordered data
+        -   redundant validation/sanitization of trusted internal data
+        -   missing connection/resource reuse (open-close per operation)
+        -   [...]
+
+    -   If <lens/> is `security`:
+
+        Focus on *security* only - and do *not* investigate logic,
+        semantics, performance, or efficiency problems.
+
+        Analysis Hints (not exhaustive, just indicators):
+        -   unsafe data deserialization
+        -   missing input data validation/sanitization
+        -   broken authentication/authorization
+        -   sensitive-data exposure
+        -   path traversal
+        -   unsafe cryptography
+        -   hard-coded secrets
+        -   vulnerable dependencies
+        -   injection flaws
+        -   cross-site scripting (XSS) and output-encoding gaps
+        -   cross-site request forgery (CSRF) and missing anti-forgery tokens
+        -   insecure direct object references (IDOR)
+        -   server-side request forgery (SSRF)
+        -   insecure or missing transport encryption (TLS)
+        -   weak session management (fixation, predictable tokens)
+        -   missing rate limiting/anti-automation controls
+        -   overly permissive CORS or file permissions
+        -   verbose error messages leaking internals
+        -   unsafe randomness for security-sensitive values
+        -   mass assignment / over-binding of request parameters
+        -   security misconfiguration (default credentials, debug modes, exposed admin endpoints)
+        -   missing or misconfigured security headers (CSP, HSTS, X-Frame-Options)
+        -   improper certificate/hostname validation (TLS verification disabled)
+        -   insufficient logging and monitoring of security events
+        -   race conditions / TOCTOU (time-of-check to time-of-use) flaws
+        -   integer overflow/underflow and buffer overflows
+        -   use-after-free and memory-safety violations
+        -   privilege escalation through improper privilege dropping
+        -   insecure file upload handling (unrestricted type/size, executable storage)
+        -   unsafe handling of untrusted regular expressions (ReDoS)
+        -   caching of sensitive data in shared or client-side caches
+        -   secrets or sensitive data leaking into logs, traces, or telemetry
+        -   insecure default-deny failures (fail-open instead of fail-closed)
+        -   missing integrity verification (unsigned updates, no subresource integrity)
+        -   excessive data exposure in API responses (returning more fields than needed)
+        -   improper resource cleanup leading to exhaustion (connection/file-descriptor leaks)
+        -   business-logic flaws (bypassable workflows, negative quantities, replay)
+        -   [...]
+
+    Be practically relevant - focus on *practically relevant* cases
+    only and especially do *not* investigate theoretical or fictive
+    cases.
+
+    Be problem-focused - report the *problem only* and do *not*
+    already investigate any possible *solution* or apply any *change*.
+
+    Be conservative - only report clear, well-grounded problems.
+    Think twice to avoid *false positives*.
+
+    Be focused - only report problems which were found in the source
+    files referenced by <context/>. Ignore problems which are located
+    in related source files which were just read to better comprehend
+    the <context/>.
+
+    For *each* found problem:
+
+    1.  Set <file/> to the *relative* filename path of the source file
+        in which the problem is located.
+
+    2.  Set <line/> to the numeric 1-based line number in <file/> which
+        is most relevant to the problem.
+
+    3.  Set <severity/> to the string `LOW`, `MEDIUM`, `HIGH`, or
+        `ACCEPTED`, ranked by the estimated *impact* of the problem.
+        Use `ACCEPTED` when the problem is a deliberate, justified
+        trade-off that should remain on record.
+
+    4.  Set <description/> to an *ultra brief* but still as *precise*
+        as possible Markdown-formatted problem description. In it,
+        highlight *code* as <template>`<code/>`</template> and *key
+        aspects* as <template>*<aspect/>*</template>, and add inline
+        *references* to the related code positions in the form of either
+        <template>(`<filename/>:<line-number/>`)</template>,
+        <template>(`<filename/>:<line-number/>-<line-number/>`)</template> or
+        <template>(`<filename/>#<function-or-method/>`)</template>.
+
+    5.  Set <title/> to an ultra-compressed <description/>: a concise,
+        short, single sentence. Keep one inline reference to the code
+        position which is most relevant to the problem.
+
+    6.  If <lens/> is `performance`:
+
+        Set <evidence/> to ground the finding by citing either the
+        inferred *Big-O* time/space complexity (e.g. `O(n²)` reducible
+        to `O(n)`) with the exact driving loop or recursion, or the
+        matched performance *anti-pattern* (e.g. N+1 query,
+        sync-in-loop, repeated recompute, string concat in loop), with
+        an inline code reference.
+
+        Set <trade-off/> to state the *cost* of the optimization (e.g.
+        readability, additional memory for speed, added complexity), so
+        the user can make an informed decision; use *none* if there is
+        no meaningful trade-off.
+
+        Otherwise (for the other lenses), set both <evidence/> and
+        <trade-off/> to empty strings.
+
+    7.  If <problems/> is not empty, set
+        <problems><problems/>,</problems> (append a comma).
+        Then append the following <template/> to <problems/>:
+
+        <template>
+            {
+                "file":        <file/>,
+                "line":        <line/>,
+                "severity":    <severity/>,
+                "title":       <title/>,
+                "description": <description/>,
+                "evidence":    <evidence/>,
+                "trade-off":   <trade-off/>
+            }
+        </template>
+
+5.  Return *exclusively* a single fenced JSON block (no prose,
+    no preamble, no summary) of the following shape:
+
+    ```json
+    [
+        <problems/>
+    ]
+    ```
+
+6.  You *MUST* *NOT* propose, apply, or render any code
+    changes yourself.
+