@dependfix/engine 0.3.0 → 0.4.0

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { Octokit } from "@octokit/rest";
+import { a as fromPat, c as computeRetryDelayMs, l as createGitHubClient } from "./auth2.mjs";
 import { RequestError } from "@octokit/request-error";
-import { AppError, collectCodeScanningSuggestions, createEmptyRunSummary, createLogger, filterAlerts, generateJsonReport, generateMarkdownReport, isAlertFixedByActions, isValidRepoIdentifier, limitAlerts, mapCodeScanningSeverity, normalizeAuditSeverity, prioritizeAlerts, toErrorMessage, writeReport } from "@dependfix/core";
+import { AppError, collectCodeScanningSuggestions, createEmptyRunSummary, createLogger, filterAlerts, generateJsonReport, generateMarkdownReport, isAlertFixedByActions, isValidRepoIdentifier, limitAlerts, mapCodeScanningSeverity, normalizeAuditSeverity, normalizeUpstreamId, prioritizeAlerts, toErrorMessage, writeReport } from "@dependfix/core";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { execFileSync, execSync, spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -12,116 +12,6 @@ import { connect } from "node:net";
 import { z } from "zod";
 import { createInterface } from "node:readline";
 
-//#region src/github/client.ts
-/**
-* 创建已认证的 Octokit 实例。
-*
-* 调用方直接使用 `octokit.rest.*` 访问所有已类型化的 GitHub REST API。
-* 分页使用 `octokit.paginate()` 自动合并多页结果。
-*
-* 配置 `retry` 时通过 `hook.wrap('request')` 统一包装所有请求
-* （含 paginate 内部请求），对限流响应做指数退避重试。
-*
-* @example
-* ```typescript
-* const octokit = createGitHubClient({ token: 'ghp_xxxx' })
-*
-* // 仓库信息
-* const { data: repo } = await octokit.rest.repos.get({ owner: 'foo', repo: 'bar' })
-*
-* // Dependabot 告警（自动分页）
-* const alerts = await octokit.paginate(
-*     octokit.rest.dependabot.listAlertsForRepo,
-*     { owner: 'foo', repo: 'bar', state: 'open', per_page: 100 },
-* )
-* ```
-*/
-function createGitHubClient(options) {
-	const client = new Octokit({
-		auth: options.token,
-		baseUrl: options.baseUrl ?? "https://api.github.com"
-	});
-	const maxRetries = options.retry?.maxRetries ?? 3;
-	if (maxRetries > 0) applyRetryPolicy(client, {
-		maxRetries,
-		baseDelayMs: options.retry?.baseDelayMs ?? 1e3,
-		maxBackoffMs: options.retry?.maxBackoffMs ?? MAX_BACKOFF_MS_DEFAULT
-	});
-	return client;
-}
-const SECONDARY_RATE_LIMIT_RE = /secondary rate limit|abuse|retry later|retry-after/i;
-/** 指数退避单次等待默认上限（30s），防止长时间空转（可经 retry.maxBackoffMs 覆盖） */
-const MAX_BACKOFF_MS_DEFAULT = 3e4;
-function applyRetryPolicy(client, retry) {
-	const maxRetries = retry.maxRetries ?? 3;
-	const baseDelayMs = retry.baseDelayMs ?? 1e3;
-	const maxBackoffMs = retry.maxBackoffMs ?? MAX_BACKOFF_MS_DEFAULT;
-	client.hook.wrap("request", async (request, options) => {
-		const method = (options.method ?? "GET").toUpperCase();
-		if (method !== "GET" && method !== "HEAD") return request(options);
-		let attempt = 0;
-		for (;;) try {
-			return await request(options);
-		} catch (error) {
-			const delayMs = computeRetryDelayMs(error, attempt, baseDelayMs, maxBackoffMs);
-			if (delayMs === null || attempt >= maxRetries) throw error;
-			attempt += 1;
-			await sleep(delayMs);
-		}
-	});
-}
-/**
-* 计算限流重试等待时间（纯函数，可单测）。
-*
-* 可重试（返回等待毫秒）：
-* - 429（Too Many Requests / secondary rate limit）
-* - 403 + `x-ratelimit-remaining: 0`（primary rate limit）
-* - 403/429 + message 含 secondary rate limit / abuse / retry 特征
-*
-* 等待策略（Retry-After 优先）：
-* 1. `retry-after` 头（秒）→ 等待其秒数（受 maxBackoffMs 上限约束）
-* 2. `x-ratelimit-reset`（unix 秒）→ 等待到 reset + 1s 缓冲
-* 3. 否则 → 指数退避 `baseDelayMs * 2^attempt`
-* 所有等待均受 maxBackoffMs 上限约束（默认 30s）。
-*
-* 不重试（返回 null）：
-* - 非 RequestError（网络错误等由上层 AppError 语义处理）
-* - 权限类 403（无限流特征）
-* - 其他状态码
-*/
-function computeRetryDelayMs(error, attempt, baseDelayMs = 1e3, maxBackoffMs = MAX_BACKOFF_MS_DEFAULT) {
-	if (!(error instanceof RequestError)) return null;
-	const status = error.status;
-	const headers = error.response?.headers ?? {};
-	const remaining = headers["x-ratelimit-remaining"];
-	const message = error.message;
-	let retryable = false;
-	if (status === 429) retryable = true;
-	else if (status === 403) {
-		if (remaining !== void 0 && remaining === "0") retryable = true;
-		else if (SECONDARY_RATE_LIMIT_RE.test(message)) retryable = true;
-	}
-	if (!retryable) return null;
-	const retryAfter = headers["retry-after"];
-	if (retryAfter !== void 0) {
-		const seconds = Number(retryAfter);
-		if (Number.isFinite(seconds) && seconds > 0) return Math.min(seconds * 1e3, maxBackoffMs);
-	}
-	const reset = headers["x-ratelimit-reset"];
-	if (reset !== void 0) {
-		const resetMs = Number(reset) * 1e3;
-		if (Number.isFinite(resetMs) && resetMs > 0) {
-			const waitMs = resetMs - Date.now() + 1e3;
-			if (waitMs > 0) return Math.min(waitMs, maxBackoffMs);
-		}
-	}
-	return Math.min(baseDelayMs * 2 ** attempt, maxBackoffMs);
-}
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-//#endregion
 //#region src/github/errors.ts
 /**
 * 将 Octokit 请求错误映射为 `AppError`。
@@ -249,7 +139,8 @@ function normalizeFinding(finding, owner, repo) {
 		alertClass: "report-only",
 		startLine: finding.location?.start_line ?? void 0,
 		endLine: finding.location?.end_line ?? void 0,
-		suggestion: description || "人工审查该 Code Quality finding"
+		suggestion: description || "人工审查该 Code Quality finding",
+		upstreamId: normalizeUpstreamId("code-quality", { alertNumber: finding.number })
 	};
 }
 /**
@@ -553,7 +444,8 @@ function normalizeAlert$1(alert, owner, repo) {
 		alertClass: classifyRule(ruleId),
 		startLine: instance?.location?.start_line ?? void 0,
 		endLine: instance?.location?.end_line ?? void 0,
-		suggestion: suggestionFor(ruleId)
+		suggestion: suggestionFor(ruleId),
+		upstreamId: normalizeUpstreamId("code-scanning", { alertNumber: alert.number })
 	};
 }
 /**
@@ -585,8 +477,13 @@ function mapSeverity(alert) {
 *
 * @example
 * ```typescript
-* const octokit = createGitHubClient({ token: 'ghp_xxxx' })
+* // 推荐：使用 auth 抽象层（M18.1 实施后）
+* import { fromPat } from '@dependfix/engine/auth'
+* const octokit = createGitHubClient({ auth: fromPat('ghp_xxxx') })
 * const alerts = await fetchDependabotAlerts(octokit, { owner: 'foo', repo: 'bar' })
+*
+* // 向后兼容：使用 token 字段（deprecated）
+* const octokit = createGitHubClient({ token: 'ghp_xxxx' })
 * ```
 */
 async function fetchDependabotAlerts(client, params) {
@@ -632,10 +529,22 @@ function normalizeAlert(alert, owner, repo) {
 		fixable,
 		fixStrategy: fixable ? "upgrade" : null,
 		recommendedVersion: firstPatched?.identifier ?? "",
-		dependencyType: normalizeDependencyRelationship(alert.dependency.relationship)
+		dependencyType: normalizeDependencyRelationship(alert.dependency.relationship),
+		upstreamId: normalizeUpstreamId("dependabot", { alertNumber: alert.number }),
+		ghsaId: alert.security_advisory.ghsa_id,
+		cveIds: extractCveIds(alert.security_advisory.identifiers)
 	};
 }
 /**
+** 从 dependabot alert.security_advisory.identifiers[] 提取 CVE 列表（type === 'CVE'）。
+** 兼容 identifiers 缺省为 undefined / 空数组场景。
+*/
+function extractCveIds(identifiers) {
+	if (!Array.isArray(identifiers) || identifiers.length === 0) return;
+	const cves = identifiers.filter((id) => id?.type === "CVE" && typeof id.value === "string" && Boolean(id.value)).map((id) => id.value);
+	return cves.length > 0 ? cves : void 0;
+}
+/**
 * 将 Dependabot API 的 `dependency.relationship` 映射为 `DependencyType`。
 *
 * GitHub API 返回的合法值:
@@ -650,8 +559,19 @@ function normalizeDependencyRelationship(relationship) {
 
 //#endregion
 //#region src/github/pr-creator.ts
-const BOT_NAME = "dependfix[bot]";
-const BOT_EMAIL = "dependfix[bot]@users.noreply.github.com";
+/**
+* PAT 路径默认 commit author（保持现有 PAT 路径用户行为零变化）。
+*
+* 注：此常量仅作为 PAT 路径的默认值；GitHub App 路径（M18.2 之后接入）走动态 commit author。
+* 现有 PAT 路径仍硬编码 `dependfix[bot]@users.noreply.github.com`，虽非真实 bot 身份（字符串约定），
+* 但保持行为不变以确保 PAT 用户无感升级。已知缺陷由 C22 范围之外的后续阶段修复。
+*
+* @see [C22 PAT 无感升级评估 §5.1 兼容性](../../../../docs/design/governance/c22-pat-backward-compat.md)
+*/
+const PAT_DEFAULT_COMMIT_AUTHOR = {
+	name: "dependfix[bot]",
+	email: "dependfix[bot]@users.noreply.github.com"
+};
 /** 自动修复分支统一前缀（分支名 = 前缀 + 内容指纹 8 位） */
 const BRANCH_PREFIX = "dependfix/auto-fix-";
 /**
@@ -747,14 +667,28 @@ function createFixBranch(branchName, workDir) {
 * 自动设置 git user.name / user.email（如未设置）。
 * 使用 `execFileSync` 参数数组形式（不经 shell），保证多行 commit message
 * 与 UTF-8 字符（如 →）在 Windows/Linux 双平台传递一致。
+*
+* W3 修复（M18.4 audit round 2）：显式传 `-c user.name=X -c user.email=Y` 强制 commit author
+* 使用传入值，不受 host 全局 `user.name`（如 CaoMeiYouRen）污染——`git commit` 走 lookup order
+* (env → `-c` config → local → global → system)，显式 `-c` 在 lookup order 中最高优先。
+*
+* @param author - 可选 commit author 信息；不传时使用 PAT 默认值（保持现有 PAT 路径行为零变化）。
+*   M18.2 之后 GitHub App 路径会传入动态生成的 `{app_id}+{bot_login}[bot]` author。
+*
+* @see [C22 PAT 无感升级评估 §5.1 兼容性](../../../../docs/design/governance/c22-pat-backward-compat.md)
 */
-function stageAndCommit(message, workDir) {
-	ensureGitConfig(workDir);
-	execSync("git add .", {
+function stageAndCommit(message, workDir, author) {
+	ensureGitConfig(workDir, author);
+	const effectiveAuthor = author ?? PAT_DEFAULT_COMMIT_AUTHOR;
+	execFileSync("git", ["add", "."], {
 		cwd: workDir,
 		stdio: "pipe"
 	});
 	execFileSync("git", [
+		"-c",
+		`user.name=${effectiveAuthor.name}`,
+		"-c",
+		`user.email=${effectiveAuthor.email}`,
 		"commit",
 		"-m",
 		message
@@ -763,9 +697,6 @@ function stageAndCommit(message, workDir) {
 		stdio: "pipe"
 	});
 }
-/**
-* 推送分支到远程 origin。
-*/
 function pushBranch(branchName, workDir) {
 	execFileSync("git", [
 		"push",
@@ -808,6 +739,38 @@ async function closePullRequest(octokit, owner, repo, pullNumber) {
 	});
 }
 /**
+* 在 Pull Request 上添加评论。
+*
+* 使用 `issues.createComment` 端点（GitHub PR 评论复用 issue comment API），
+* 需要 token 具备 `issues: write` 权限（比 `pull-requests: write` 宽）。
+*
+* 用于在新 PR 上评论指向被取代的旧 PR，避免用户手动排查重复 PR。
+*/
+async function commentOnPullRequest(octokit, owner, repo, pullNumber, body) {
+	await octokit.rest.issues.createComment({
+		owner,
+		repo,
+		issue_number: pullNumber,
+		body
+	});
+}
+/**
+* 在 Pull Request 上添加 label。
+*
+* 使用 `issues.addLabels` 端点（GitHub PR label 复用 issue label API），
+* 需要 token 具备 `issues: write` 权限。
+*
+* 用于标记重复 PR（如 `duplicate` label），便于用户过滤和管理。
+*/
+async function addLabelToPullRequest(octokit, owner, repo, pullNumber, labels) {
+	await octokit.rest.issues.addLabels({
+		owner,
+		repo,
+		issue_number: pullNumber,
+		labels
+	});
+}
+/**
 * 通过 GitHub API 创建 Pull Request。
 */
 async function createPullRequest(params) {
@@ -1161,21 +1124,35 @@ function branchExists(branchName, workDir) {
 		return false;
 	}
 }
-function ensureGitConfig(workDir) {
+function ensureGitConfig(workDir, author) {
+	const effectiveAuthor = author ?? PAT_DEFAULT_COMMIT_AUTHOR;
 	const hasName = gitConfigExists("user.name", workDir);
 	const hasEmail = gitConfigExists("user.email", workDir);
-	if (!hasName) execSync(`git config user.name "${BOT_NAME}"`, {
+	if (!hasName) execFileSync("git", [
+		"config",
+		"user.name",
+		effectiveAuthor.name
+	], {
 		cwd: workDir,
 		stdio: "pipe"
 	});
-	if (!hasEmail) execSync(`git config user.email "${BOT_EMAIL}"`, {
+	if (!hasEmail) execFileSync("git", [
+		"config",
+		"user.email",
+		effectiveAuthor.email
+	], {
 		cwd: workDir,
 		stdio: "pipe"
 	});
 }
 function gitConfigExists(key, workDir) {
 	try {
-		execSync(`git config ${key}`, {
+		execFileSync("git", [
+			"config",
+			"--local",
+			"--get",
+			key
+		], {
 			cwd: workDir,
 			stdio: "pipe"
 		});
@@ -1280,6 +1257,7 @@ const DEPENDABOT_CONFIG_PATH = ".github/dependabot.yml";
 * 2. topic 过滤（`--repo-topics`，AND 语义）
 * 3. 名单策略过滤（include / exclude / topicsExclude，探测前应用）
 * 4. dependabot.yml 探测（仅候选仓库触达 contents API；404 视为不支持，不剔除）
+* 5. 规模上限截断（`maxRepos`，按 fullName 字典序排序后截断）
 *
 * 结果按 `fullName` 字典序排序，保证同输入多次运行结果一致
 * （runId / 指纹稳定性前提）。
@@ -1287,7 +1265,7 @@ const DEPENDABOT_CONFIG_PATH = ".github/dependabot.yml";
 * @throws AppError（mapGitHubError 转换；token 权限、网络等全局性问题 fail-fast）
 */
 async function discoverRepositories(options) {
-	const { client, owners, topics = [], policy, probeDependabot = true, probeConcurrency = 5 } = options;
+	const { client, owners, topics = [], policy, probeDependabot = true, probeConcurrency = 5, maxRepos } = options;
 	const discovered = [];
 	for (const owner of owners) {
 		const repos = await fetchOwnerRepositories(client, owner);
@@ -1318,6 +1296,8 @@ async function discoverRepositories(options) {
 	}
 	if (probeDependabot) await probeDependabotConfigs(client, discovered, probeConcurrency);
 	discovered.sort((a, b) => a.fullName.localeCompare(b.fullName));
+	const effectiveMaxRepos = maxRepos ?? 100;
+	if (effectiveMaxRepos > 0 && discovered.length > effectiveMaxRepos) return discovered.slice(0, effectiveMaxRepos);
 	return discovered;
 }
 /**
@@ -2225,7 +2205,7 @@ function isCrossMajorFixRequired(lockfilePath, alert) {
 */
 function classifyLockfileFailure(workDir) {
 	try {
-		execSync("pnpm install --frozen-lockfile", {
+		execFileSync("pnpm", ["install", "--frozen-lockfile"], {
 			cwd: workDir,
 			stdio: "pipe",
 			timeout: 12e4
@@ -2267,8 +2247,8 @@ function getStderrText(err) {
 	if (typeof err.stderr === "string") return err.stderr;
 	return err.stderr.toString("utf-8");
 }
-function execRepair(command, workDir, timeoutMs = 18e4) {
-	execSync(command, {
+function execRepair(binary, args, workDir, timeoutMs = 18e4) {
+	execFileSync(binary, args, {
 		cwd: workDir,
 		stdio: "pipe",
 		timeout: timeoutMs
@@ -2308,14 +2288,43 @@ function getStrategyChain(category) {
 *   （corepack 不可用/下载失败时命令本身失败 → 策略链 REGENERATE/REINSTALL 兜底，
 *   行为不劣于现状）
 * - `pnpmVersion` 缺省：回退裸 `pnpm install --lockfile-only`（保持旧 stub 语义）
+*
+* 返回 `{ binary, args }` 而非完整 shell 命令字符串，便于 `execFileSync` 参数化调用
+* 避免 shell 解释（`execSync` 模板拼接是 Code Scanning 命令注入告警源头）。所有
+* 参数均受 `isValidPnpmVersion` 白名单约束，无 shell metacharacter。
 */
 function getStrategyCommand(strategy, pnpmVersion) {
 	switch (strategy) {
-		case "REGENERATE": return "pnpm install --lockfile-only";
-		case "FIX_ENTRIES": return "pnpm install --fix-lockfile --lockfile-only";
-		case "REINSTALL": return "pnpm install --no-frozen-lockfile";
-		case "PIN_TOOLCHAIN": return pnpmVersion ? `corepack pnpm@${pnpmVersion} install --lockfile-only` : "pnpm install --lockfile-only";
-		default: return "";
+		case "REGENERATE": return {
+			binary: "pnpm",
+			args: ["install", "--lockfile-only"]
+		};
+		case "FIX_ENTRIES": return {
+			binary: "pnpm",
+			args: [
+				"install",
+				"--fix-lockfile",
+				"--lockfile-only"
+			]
+		};
+		case "REINSTALL": return {
+			binary: "pnpm",
+			args: ["install", "--no-frozen-lockfile"]
+		};
+		case "PIN_TOOLCHAIN":
+			if (!pnpmVersion) return {
+				binary: "pnpm",
+				args: ["install", "--lockfile-only"]
+			};
+			return {
+				binary: "corepack",
+				args: [
+					`pnpm@${pnpmVersion}`,
+					"install",
+					"--lockfile-only"
+				]
+			};
+		default: return null;
 	}
 }
 /** 从 lockfile 内容提取 `lockfileVersion` 字段值（如 `9.0`）；缺失返回 null。 */
@@ -2366,7 +2375,7 @@ function countLockfilePackages(path) {
 }
 /**
 * pnpm 版本白名单格式（安全加固：拒绝不可信 packageManager/config 的任意字符串，
-* 防命令注入——corepack 命令是唯一动态拼接的 execSync 命令）。
+* 防命令注入——corepack 命令参数 `pnpm@<version>` 受 PNPM_VERSION_RE 白名单约束）。
 * 兼容标准 semver 与 corepack 哈希后缀（pnpm@10.5.2+sha512.xxx）。
 */
 const PNPM_VERSION_RE = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
@@ -2400,7 +2409,7 @@ const LOCKFILE_NAME = "pnpm-lock.yaml";
 */
 function verifyFrozenLockfile(workDir) {
 	try {
-		execSync("pnpm install --frozen-lockfile", {
+		execFileSync("pnpm", ["install", "--frozen-lockfile"], {
 			cwd: workDir,
 			stdio: "pipe",
 			timeout: 12e4
@@ -2486,12 +2495,14 @@ function repairLockfile(params) {
 	let lastError = stderr;
 	const startTimestamp = Date.now();
 	for (const strategy of strategyChain) {
-		const command = getStrategyCommand(strategy, pnpmVersion);
+		const cmd = getStrategyCommand(strategy, pnpmVersion);
+		if (!cmd) continue;
+		const command = [cmd.binary, ...cmd.args].join(" ");
 		const t0 = Date.now();
 		let strategySuccess = false;
 		let strategyError;
 		try {
-			execRepair(command, workDir_);
+			execRepair(cmd.binary, cmd.args, workDir_);
 			strategySuccess = true;
 		} catch (err) {
 			strategyError = getStderrText(err) || err.message;
@@ -2790,6 +2801,7 @@ const DEFAULT_RUNTIME_CONFIG = {
 	maxConcurrency: 1,
 	maxRetries: 3,
 	maxBackoffMs: 3e4,
+	maxRepos: 100,
 	ai: {
 		enabled: false,
 		provider: "openai-compatible",
@@ -2915,6 +2927,7 @@ function readEnvConfig(env = process.env) {
 		maxConcurrency: normalizeInteger(readEnv(env, "MAX_CONCURRENCY"), `${ENV_PREFIX}MAX_CONCURRENCY`),
 		maxRetries: normalizeNonNegativeInteger(readEnv(env, "MAX_RETRIES"), `${ENV_PREFIX}MAX_RETRIES`),
 		maxBackoffMs: normalizeInteger(readEnv(env, "MAX_BACKOFF_MS"), `${ENV_PREFIX}MAX_BACKOFF_MS`),
+		maxRepos: normalizeNonNegativeInteger(readEnv(env, "MAX_REPOS"), `${ENV_PREFIX}MAX_REPOS`),
 		upgradeGroups: normalizeUpgradeGroups(readEnv(env, "UPGRADE_GROUPS")),
 		toolchainPnpmVersion: readEnv(env, "TOOLCHAIN_PNPM_VERSION")?.trim() || void 0,
 		aiEnabled: normalizeBoolean(readEnv(env, "AI"), `${ENV_PREFIX}AI`),
@@ -2969,7 +2982,9 @@ function validateRuntimeConfig(config) {
 	if (isAuditSource && config.owner && config.owner.length > 0) throw new AppError("CONFIG_VALIDATION_ERROR", "--owner / DEPENDFIX_OWNER requires the github-dependabot alert source (owner discovery uses the GitHub API).");
 	if (config.mode === "cleanup-branches" && config.owner && config.owner.length > 0) throw new AppError("CONFIG_VALIDATION_ERROR", "--owner / DEPENDFIX_OWNER is not supported in cleanup-branches mode (branch cleanup requires explicit target repositories).");
 	if (config.mode === "cleanup-branches" && config.maxConcurrency > 1) throw new AppError("CONFIG_VALIDATION_ERROR", "maxConcurrency > 1 is not supported in cleanup-branches mode (branch cleanup runs sequentially).");
-	if (config.repositories.length === 0 && !(config.owner && config.owner.length > 0)) if (isAuditSource) {} else throw new AppError("CONFIG_VALIDATION_ERROR", "Missing target repositories. Provide --repo, --repository, --repos-file, --owner or DEPENDFIX_REPOSITORIES / DEPENDFIX_OWNER.");
+	if (config.repositories.length === 0 && !(config.owner && config.owner.length > 0)) {
+		if (isAuditSource) {} else throw new AppError("CONFIG_VALIDATION_ERROR", "Missing target repositories. Provide --repo, --repository, --repos-file, --owner or DEPENDFIX_REPOSITORIES / DEPENDFIX_OWNER.");
+	}
 	for (const repo of config.repositories) if (!isValidRepoIdentifier(repo)) throw new AppError("CONFIG_VALIDATION_ERROR", `Invalid repository identifier: "${repo}". Expected format: owner/repo`);
 	if (isAuditSource && config.repositories.length > 1) throw new AppError("CONFIG_VALIDATION_ERROR", "pnpm-audit alert source supports at most one repository (it scans the current workspace lockfile).");
 	if (isAuditSource && config.codeScanningEnabled) throw new AppError("CONFIG_VALIDATION_ERROR", "code-scanning requires the github-dependabot alert source (Code Scanning alerts are fetched from the GitHub API).");
@@ -3022,6 +3037,7 @@ function resolveRuntimeConfig(options = {}) {
 		maxConcurrency: cliOverrides.maxConcurrency ?? envConfig.maxConcurrency ?? DEFAULT_RUNTIME_CONFIG.maxConcurrency,
 		maxRetries: cliOverrides.maxRetries ?? envConfig.maxRetries ?? DEFAULT_RUNTIME_CONFIG.maxRetries,
 		maxBackoffMs: cliOverrides.maxBackoffMs ?? envConfig.maxBackoffMs ?? DEFAULT_RUNTIME_CONFIG.maxBackoffMs,
+		maxRepos: cliOverrides.maxRepos ?? envConfig.maxRepos ?? DEFAULT_RUNTIME_CONFIG.maxRepos,
 		upgradeGroups: cliOverrides.upgradeGroups ?? envConfig.upgradeGroups,
 		toolchainPnpmVersion: cliOverrides.toolchainPnpmVersion ?? envConfig.toolchainPnpmVersion,
 		ai: resolveAiOptions(cliOverrides, envConfig)
@@ -3810,15 +3826,19 @@ function restoreTrackedFiles(workDir, snapshot) {
 	}
 }
 /**
-* 快速验证（逐包）：仅运行 `pnpm lint`（脚本存在时）。
+* 快速验证（逐包）：运行验证命令序列。
 *
-* 完整验证（install + lint + build）成本高，逐包执行不现实；
-* lint 是依赖兼容性的快速信号（本次坏 PR 即因 lint 失败）。
-* 无 lint 脚本时视为通过（与 verifyProject 的跳过语义一致）。
+* 有自定义命令时执行完整序列（含 install + setup + lint + build），
+* 否则仅运行 `pnpm lint`（脚本存在时）。
+*
+* 设计决策（run 33946113272 复盘）：旧版仅跑 `pnpm lint`，但 Nuxt 等框架
+* 项目 lint 依赖 `nuxt prepare` 生成的 `.nuxt/tsconfig.json`——无 prepare
+* 步骤会导致 ESLint OOM。自定义命令已含 prepare，走完整序列可避免此问题；
+* `pnpm install` 在 node_modules 已就绪时近乎空操作，性能影响可忽略。
 */
 async function quickVerifyProject(ctx, repo) {
-	const { logger, workDir } = ctx;
-	const { valid, skipped } = validateVerifyCommands(["pnpm lint"], workDir);
+	const { logger, workDir, customCommands } = ctx;
+	const { valid, skipped } = validateVerifyCommands(customCommands ?? ["pnpm lint"], workDir);
 	if (valid.length === 0) {
 		if (skipped.length > 0) logger.info(`[quick-verify] ${repo}: no lint script, skipping per-package verification`);
 		return true;
@@ -4359,6 +4379,12 @@ function parseLegacyAuditReport(report) {
 	const advisories = report.advisories;
 	if (!advisories || typeof advisories !== "object") return [];
 	const actionMap = /* @__PURE__ */ new Map();
+	const advisoryExtrasMap = /* @__PURE__ */ new Map();
+	for (const [id, rawAdvisory] of Object.entries(advisories)) {
+		if (!rawAdvisory || typeof rawAdvisory !== "object") continue;
+		const extras = extractIdentifiers(rawAdvisory);
+		if (extras.ghsaId || extras.cveIds && extras.cveIds.length > 0) advisoryExtrasMap.set(id, extras);
+	}
 	for (const action of toArray(report.actions)) {
 		if (!action || typeof action !== "object") continue;
 		const record = action;
@@ -4370,13 +4396,15 @@ function parseLegacyAuditReport(report) {
 		if (!rawAdvisory || typeof rawAdvisory !== "object") continue;
 		const advisory = rawAdvisory;
 		const patched = normalizePatchedVersionValue(actionMap.get(id) ?? (typeof advisory.patched_versions === "string" ? advisory.patched_versions : void 0));
+		const extras = advisoryExtrasMap.get(id);
 		risks.push({
 			advisoryId: resolveAdvisoryId(advisory),
 			packageName: typeof advisory.module_name === "string" ? advisory.module_name : "unknown-package",
 			severity: typeof advisory.severity === "string" ? advisory.severity : "medium",
 			title: typeof advisory.title === "string" ? advisory.title : "Untitled advisory",
 			htmlUrl: typeof advisory.url === "string" ? advisory.url : "",
-			patchedVersion: patched
+			patchedVersion: patched,
+			...extras ?? {}
 		});
 	}
 	return risks;
@@ -4401,26 +4429,30 @@ function parseModernAuditReport(report) {
 		})();
 		const viaItems = toArray(vulnerability.via).filter((item) => item !== null && typeof item === "object");
 		if (viaItems.length === 0) {
+			const extras = extractIdentifiers(vulnerability);
 			risks.push({
 				advisoryId: resolveAdvisoryId(vulnerability),
 				packageName,
 				severity: typeof vulnerability.severity === "string" ? vulnerability.severity : "medium",
 				title: typeof vulnerability.title === "string" ? vulnerability.title : `${packageName} vulnerability`,
 				htmlUrl: typeof vulnerability.url === "string" ? vulnerability.url : "",
-				patchedVersion: patchedFromFixAvailable
+				patchedVersion: patchedFromFixAvailable,
+				...extras ?? {}
 			});
 			continue;
 		}
 		for (const advisory of viaItems) {
 			let severity = typeof vulnerability.severity === "string" ? vulnerability.severity : "medium";
 			if (typeof advisory.severity === "string" && advisory.severity) severity = advisory.severity;
+			const extras = extractIdentifiers(advisory);
 			risks.push({
 				advisoryId: resolveAdvisoryId(advisory),
 				packageName: typeof advisory.name === "string" && advisory.name ? advisory.name : packageName,
 				severity,
 				title: typeof advisory.title === "string" ? advisory.title : `${packageName} vulnerability`,
 				htmlUrl: typeof advisory.url === "string" ? advisory.url : "",
-				patchedVersion: patchedFromFixAvailable
+				patchedVersion: patchedFromFixAvailable,
+				...extras ?? {}
 			});
 		}
 	}
@@ -4454,13 +4486,34 @@ function parseAuditReport(report) {
 	return [...deduped.values()];
 }
 /**
-* advisoryId 的稳定数字哈希（`NormalizedSecurityAlert.id` 为 number）。
+* advisoryId 的稳定数字哈希（M20 之前使用，M20 后保留以维持向后兼容 `NormalizedSecurityAlert.id: number`）。
+*
 * 取 sha256 前 4 字节完整 uint32（非设计稿的 `% 2^31`：uint32 语义更自然，
 * 碰撞概率 ~2^-32/对，12 条告警场景生日界 ~1.6e-8，可忽略）。
+*
+* M20 弃用：唯一去重键改为 `upstreamId`，详见 [`normalizeUpstreamId`](../../../core/src/alerts/upstream-id.ts)。
+* 本函数保留仅为兼容现有 `NormalizedSecurityAlert.id: number` 字段，**不是**平台去重键。
 */
 function hashAdvisoryId(packageName, advisoryId) {
 	return createHash("sha256").update(`${packageName}:${advisoryId}`).digest().readUInt32BE(0);
 }
+/**
+** M23.3 C66-A2：从 pnpm audit advisory 提取 GHSA ID + CVE 列表。
+** 兼容 legacy `github_advisory_id` + modern `advisory.github_advisory_id` 与 `cves[]`。
+*/
+function extractIdentifiers(candidate) {
+	const ghsaId = typeof candidate.github_advisory_id === "string" && candidate.github_advisory_id ? candidate.github_advisory_id : void 0;
+	const cves = candidate.cves;
+	let cveIds;
+	if (Array.isArray(cves)) {
+		const valid = cves.filter((c) => typeof c === "string" && Boolean(c));
+		if (valid.length > 0) cveIds = valid;
+	}
+	const result = {};
+	if (ghsaId) result.ghsaId = ghsaId;
+	if (cveIds) result.cveIds = cveIds;
+	return result;
+}
 /** audit 风险 → 标准化告警（source='pnpm-audit'，repository 由调用方注入） */
 function mapAuditRiskToAlert(risk, repository) {
 	const fixable = risk.patchedVersion !== null;
@@ -4479,7 +4532,13 @@ function mapAuditRiskToAlert(risk, repository) {
 		fixable,
 		fixStrategy: fixable ? "upgrade" : null,
 		recommendedVersion: risk.patchedVersion ?? "",
-		dependencyType: void 0
+		dependencyType: void 0,
+		upstreamId: normalizeUpstreamId("pnpm-audit", {
+			packageName: risk.packageName,
+			advisoryId: risk.advisoryId
+		}),
+		ghsaId: risk.ghsaId,
+		cveIds: risk.cveIds
 	};
 }
 
@@ -5407,11 +5466,15 @@ function computeSummary(ctx) {
 	for (const action of allActions) {
 		if (action.noOp) continue;
 		if (action.strategy === "ai-patch" || action.strategy === "ai-suggestion") continue;
-		if (action.type === "dependency-upgrade" || action.type === "code-scanning-fix") if (action.success) fixed++;
-		else failed++;
+		if (action.type === "dependency-upgrade" || action.type === "code-scanning-fix") {
+			if (action.success) fixed++;
+			else failed++;
+		}
 		if (action.type === "lockfile-repair" && action.success) lockfileRepairs++;
-		if (action.type === "verification") if (action.success) verificationsPassed++;
-		else verificationsFailed++;
+		if (action.type === "verification") {
+			if (action.success) verificationsPassed++;
+			else verificationsFailed++;
+		}
 	}
 	const fixable = allAlerts.filter((a) => a.fixable).length;
 	summary.repositoriesScanned = repoResults.length;
@@ -5514,7 +5577,7 @@ function resolveAlertRepositories(ctx) {
 	return ["local"];
 }
 /** 自动修复提交的兜底标题（无成功升级 / 包名超长无法生成动态标题时） */
-const FIX_COMMIT_MESSAGE = "fix(deps): automated dependfix security repair";
+const FIX_COMMIT_MESSAGE = "chore(deps): automated dependfix security repair";
 /** commitlint header-max-length 上限（commitlint-config-cmyr 覆盖为 140） */
 const COMMIT_HEADER_MAX_LENGTH = 140;
 /**
@@ -5540,15 +5603,15 @@ function buildCommitTitle(upgrades) {
 		const a = upgrades[0];
 		const from = a.fromVersion && a.fromVersion !== "unknown" ? ` from ${a.fromVersion}` : "";
 		const to = a.toVersion ? ` to ${a.toVersion}` : "";
-		const title = `fix(deps): bump ${a.target}${from}${to}`;
+		const title = `chore(deps): bump ${a.target}${from}${to}`;
 		return title.length <= COMMIT_HEADER_MAX_LENGTH ? title : FIX_COMMIT_MESSAGE;
 	}
 	const names = upgrades.map((a) => a.target);
-	const full = `fix(deps): bump ${names.join(", ")}`;
+	const full = `chore(deps): bump ${names.join(", ")}`;
 	if (full.length <= COMMIT_HEADER_MAX_LENGTH) return full;
 	let count = names.length - 1;
 	while (count > 0) {
-		const candidate = `fix(deps): bump ${names.slice(0, count).join(", ")} and ${names.length - count} more`;
+		const candidate = `chore(deps): bump ${names.slice(0, count).join(", ")} and ${names.length - count} more`;
 		if (candidate.length <= COMMIT_HEADER_MAX_LENGTH) return candidate;
 		count--;
 	}
@@ -5711,17 +5774,47 @@ async function upgradeAlert(ctx, alert) {
 }
 /**
 * 执行 Code Scanning 模板修复（2.0 节；从 app/index.ts 提取以控制文件行数）。
-* 仅处理 A 类告警；逐告警：快照 → 应用模板 → quickVerify（lint）→ 失败回滚（不静默）。
+* 仅处理 A 类告警；按批处理（默认每 10 个告警跑一次 lint）：快照 → 应用模板 → 累积到批 → 批满跑 lint → 失败回滚整批（不静默）。
 * - 快照失败 / 无模板 / 模板不适用 / 缺文件 → noOp 动作（回退建议模式，展示；
 *   error 原因可审计，不计 failed 避免陈旧告警永久 exit 1/2）
-* - 写盘失败 / lint 验证失败 → failed（回滚并记录；回滚失败时注明 file may be modified）
+* - 写盘失败 → 立即失败（不计 lint）+ 整批回滚
+* - lint 验证失败 → 整批回滚（粒度 = batchSize；vs 旧版每个告警回滚，回滚粒度变粗但 lint 提速 ~10x）
+*
+* 性能权衡（M28.2 实证）：
+* - N 个 cs 告警（旧版）→ N 次 spawn `pnpm lint` 子进程：N=100 平均 2593 ms（基准 commit 395ee29）
+* - N 个 cs 告警（批处理）→ ceil(N/batchSize) 次 lint：N=100 平均 ~300 ms（提速 ~10x）
+* - 合并验证可提速 ~96x 但回滚粒度过粗（整次 fix 全失败）；批处理折中
+*
 * @returns 本批次实际修复数（fixed）与失败数（failed），调用方累加到仓库统计
 */
-async function runCodeScanningFixes(ctx, repo, alerts) {
+async function runCodeScanningFixes(ctx, repo, alerts, options = {}) {
 	const { config, workDir, logger } = ctx;
+	const batchSize = options.batchSize ?? DEFAULT_CS_BATCH_SIZE;
 	const codeScanningAutoFixable = alerts.filter((a) => a.source === "code-scanning" && a.alertClass === "auto-fixable");
 	let fixed = 0;
 	let failed = 0;
+	/** 待 lint 批：每条保留 sourceSnapshot + action 用于 lint 失败时整批回滚 */
+	const pendingBatch = [];
+	/**
+	* 处理当前批：跑 lint + 按结果分发 fixed/failed + 回滚（lint 失败时）。
+	*/
+	const flushBatch = async () => {
+		if (pendingBatch.length === 0) return;
+		if (await quickVerifyProject(ctx, repo)) for (const item of pendingBatch) {
+			ctx.allActions.push(item.action);
+			fixed++;
+			logger.info(`[code-scanning] ${item.csAlert.ruleId}: ${item.action.diff}`);
+		}
+		else for (const item of pendingBatch) {
+			const restored = restoreSourceFile(workDir, item.sourceSnapshot);
+			item.action.success = false;
+			item.action.error = restored ? "lint failed after code-scanning fix; changes rolled back" : "lint failed after code-scanning fix; rollback failed, file may be modified";
+			ctx.allActions.push(item.action);
+			failed++;
+			logger.warn(`[code-scanning] ${item.csAlert.ruleId} fix rolled back: lint failed`);
+		}
+		pendingBatch.length = 0;
+	};
 	for (const csAlert of codeScanningAutoFixable) {
 		const sourceSnapshot = snapshotSourceFile(workDir, csAlert.manifestPath);
 		if (!sourceSnapshot) {
@@ -5762,24 +5855,30 @@ async function runCodeScanningFixes(ctx, repo, alerts) {
 			ctx.allActions.push(action);
 			continue;
 		}
-		if (!await quickVerifyProject(ctx, repo)) {
-			const restored = restoreSourceFile(workDir, sourceSnapshot);
-			action.success = false;
-			action.error = restored ? "lint failed after code-scanning fix; changes rolled back" : "lint failed after code-scanning fix; rollback failed, file may be modified";
-			ctx.allActions.push(action);
-			failed++;
-			logger.warn(`[code-scanning] ${csAlert.ruleId} fix rolled back: lint failed`);
-			continue;
-		}
-		ctx.allActions.push(action);
-		fixed++;
-		logger.info(`[code-scanning] ${csAlert.ruleId}: ${action.diff}`);
+		pendingBatch.push({
+			csAlert,
+			sourceSnapshot,
+			action
+		});
+		if (pendingBatch.length >= batchSize) await flushBatch();
 	}
+	await flushBatch();
 	return {
 		fixed,
 		failed
 	};
 }
+/**
+* Code Scanning 修复批处理默认大小（M28.2 决策）。
+*
+* 决策依据（commit 395ee29 baseline）：
+* - 旧版（每个告警 1 次 lint）：N=10 平均 263 ms / N=50 平均 1294 ms / N=100 平均 2593 ms
+* - 批处理 batchSize=10：N=10 触发 1 次 lint（vs 旧版 10 次 → 提速 ~10x）
+* - 回滚粒度 = batchSize（vs 旧版每个告警独立回滚）
+*
+* 经验值：典型 cs 告警场景 5-50 个 / repo，batchSize=10 平衡 lint 提速 + 回滚粒度。
+*/
+const DEFAULT_CS_BATCH_SIZE = 10;
 /** 尝试修复 pnpm-lock.yaml（dry-run 仅记录）。 */
 function tryLockfileRepair(ctx, repo) {
 	const { config, logger, workDir } = ctx;
@@ -5958,7 +6057,7 @@ function buildPrTitle(summary, actions) {
 	const parts = [];
 	if (upgrades > 0) parts.push(`${upgrades} upgrade${upgrades > 1 ? "s" : ""}`);
 	if (codeFixes > 0) parts.push(`${codeFixes} code fix${codeFixes > 1 ? "es" : ""}`);
-	return parts.length > 0 ? `fix(deps): automated security fix — ${parts.join(", ")}` : "fix(deps): automated security fix";
+	return parts.length > 0 ? `chore(deps): automated security fix — ${parts.join(", ")}` : "chore(deps): automated security fix";
 }
 
 //#endregion
@@ -6004,19 +6103,23 @@ async function fetchRepoAlerts(deps, repo) {
 		failedSources.push("dependabot");
 		recordAlertSourceError(deps, repo, "dependabot", dependabotResult.reason);
 	}
-	if (config.codeScanningEnabled) if (codeScanningResult.status === "fulfilled") {
-		alerts.push(...codeScanningResult.value);
-		deps.logger.info(`Fetched ${codeScanningResult.value.length} code scanning alerts for ${repo}`);
-	} else {
-		failedSources.push("code-scanning");
-		recordAlertSourceError(deps, repo, "code-scanning", codeScanningResult.reason);
+	if (config.codeScanningEnabled) {
+		if (codeScanningResult.status === "fulfilled") {
+			alerts.push(...codeScanningResult.value);
+			deps.logger.info(`Fetched ${codeScanningResult.value.length} code scanning alerts for ${repo}`);
+		} else {
+			failedSources.push("code-scanning");
+			recordAlertSourceError(deps, repo, "code-scanning", codeScanningResult.reason);
+		}
 	}
-	if (config.codeQualityEnabled) if (codeQualityResult.status === "fulfilled") {
-		alerts.push(...codeQualityResult.value);
-		deps.logger.info(`Fetched ${codeQualityResult.value.length} code quality findings for ${repo}`);
-	} else {
-		failedSources.push("code-quality");
-		recordAlertSourceError(deps, repo, "code-quality", codeQualityResult.reason);
+	if (config.codeQualityEnabled) {
+		if (codeQualityResult.status === "fulfilled") {
+			alerts.push(...codeQualityResult.value);
+			deps.logger.info(`Fetched ${codeQualityResult.value.length} code quality findings for ${repo}`);
+		} else {
+			failedSources.push("code-quality");
+			recordAlertSourceError(deps, repo, "code-quality", codeQualityResult.reason);
+		}
 	}
 	let totalSources = 1;
 	if (config.codeScanningEnabled) totalSources++;
@@ -6038,13 +6141,10 @@ async function fetchRepoAlerts(deps, repo) {
 * 背景详见 docs/plan/todo.md「已知缺口 G2」。
 */
 function createAlertsClientFromConfig(config) {
-	return createGitHubClient({
-		token: config.alertsToken || config.githubToken,
-		retry: {
-			maxRetries: config.maxRetries,
-			maxBackoffMs: config.maxBackoffMs
-		}
-	});
+	return createGitHubClient({ auth: fromPat(config.alertsToken || config.githubToken, { retry: {
+		maxRetries: config.maxRetries,
+		maxBackoffMs: config.maxBackoffMs
+	} }) });
 }
 /** 记录单个告警源的拉取失败（不中断另一源的处理）。 */
 function recordAlertSourceError(deps, repo, source, error) {
@@ -6055,6 +6155,7 @@ function recordAlertSourceError(deps, repo, source, error) {
 		repository: repo,
 		stage: "fetch",
 		category: "FETCH_FAILED",
+		source,
 		message: hint ? `${message}（${hint}）` : message
 	});
 }
@@ -7154,6 +7255,35 @@ async function finalizeRepoFix(ctx, repo, progress) {
 
 //#endregion
 //#region src/app/index.ts
+/**
+* 输出"部分源拉取失败"汇总（todo.md §M19.5 C8 per-source 错误隔离）。
+*
+* 触发条件（必须全部满足，避免与"全部源失败"语义重叠）：
+* 1. allErrors 至少包含一个 `stage='fetch' + category='FETCH_FAILED'` 错误（per-source 失败）
+* 2. **至少一个仓库成功拉取了部分告警**（isAnyRepoSuccessful = true）——
+*    否则就是"全部源失败"语义，已由 processRepoForReport catch + logger.error 单独处理，
+*    本函数聚焦"warn + 保留成功源"场景的汇总输出，避免重复提示。
+*
+* 汇总按 source 分组（'dependabot' / 'code-scanning' / 'code-quality' / 'pnpm-audit'），
+* 列出每个源失败的仓库数 + 示例错误消息，便于用户快速定位是 token 权限还是网络问题。
+*/
+function logPartialSourceFailureSummary(allErrors, logger, isAnyRepoSuccessful) {
+	const fetchErrors = allErrors.filter((e) => e.stage === "fetch" && e.category === "FETCH_FAILED");
+	if (fetchErrors.length === 0) return;
+	if (!isAnyRepoSuccessful) return;
+	const bySource = /* @__PURE__ */ new Map();
+	for (const err of fetchErrors) {
+		const source = err.source ?? "unknown";
+		const existing = bySource.get(source);
+		if (existing) existing.repos.add(err.repository);
+		else bySource.set(source, {
+			repos: /* @__PURE__ */ new Set([err.repository]),
+			sampleMessage: err.message
+		});
+	}
+	const summary = [...bySource.entries()].map(([source, { repos, sampleMessage }]) => `${source}（${repos.size} 个仓库: ${[...repos].slice(0, 3).join(", ")}${repos.size > 3 ? "..." : ""}）: ${sampleMessage}`).join("\n  - ");
+	logger.warn(`[alerts] 部分源拉取失败（M19.5 per-source 错误隔离）— 成功源已保留继续处理，详细如下：\n  - ${summary}`);
+}
 var DependfixApp = class {
 	config;
 	workDir;
@@ -7182,7 +7312,7 @@ var DependfixApp = class {
 		this.customCommands = options.commands;
 		this.executionEnvironment = options.executionEnvironment ?? "local";
 		this.runId = `dependfix-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-		this.logger = createLogger({
+		this.logger = options.logger ?? createLogger({
 			name: "dependfix",
 			minLevel: this.verbose ? "debug" : "info"
 		});
@@ -7257,6 +7387,8 @@ var DependfixApp = class {
 			const costText = u.estimatedCostUsd !== void 0 ? `, 估算成本 $${u.estimatedCostUsd.toFixed(4)}` : "";
 			this.logger.info(`[ai] run 总计: ${u.calls} 次调用, ${u.inputTokens} in / ${u.outputTokens} out tokens${costText}`);
 		}
+		const isAnyRepoSuccessful = this.repoResults.some((r) => r.alertsCount > 0 || r.fixed > 0 || r.verificationPassed === true);
+		logPartialSourceFailureSummary(this.allErrors, this.logger, isAnyRepoSuccessful);
 		return {
 			result: runResult,
 			exitCode
@@ -7454,6 +7586,7 @@ var DependfixApp = class {
 				success: true,
 				durationMs: 0
 			});
+			await this.handleDuplicatePRs(client, owner, repo, pr.number, plan.supersedePRs);
 			await closeSupersededPRs(this.ctx, client, owner, repo, plan.supersedePRs);
 		} catch (error) {
 			const message = toErrorMessage(error);
@@ -7480,6 +7613,41 @@ var DependfixApp = class {
 		for (const repo of this.config.repositories) await runBranchCleanupForRepo(this.ctx, client, repo);
 	}
 	/**
+	* 重复 PR 处理：在新 PR 上添加评论指向被取代的旧 PR + 添加 `duplicate` label。
+	*
+	* 失败仅记录 warning（家务活 best-effort），不阻断主流程：
+	* - 新 PR 已创建成功，用户已可访问
+	* - 评论失败不影响 PR 本身的可用性
+	* - 但需要 `issues: write` token scope（比 `pull-requests: write` 宽）；
+	*   若 token 权限不足，error 会被记录但不阻塞
+	*/
+	async handleDuplicatePRs(client, owner, repo, newPRNumber, supersededPRs) {
+		if (supersededPRs.length === 0) return;
+		const commentBody = [
+			"## ⚠️ Duplicate PR Notice",
+			"",
+			"This PR supersedes the following dependfix PR(s) with different content:",
+			"",
+			supersededPRs.map((pr) => `- [#${pr.number}](${pr.htmlUrl})`).join("\n"),
+			"",
+			"The superseded PR(s) have been closed. Please review this PR as the new canonical fix."
+		].join("\n");
+		try {
+			await commentOnPullRequest(client, owner, repo, newPRNumber, commentBody);
+			this.logger.info(`Added duplicate notice comment to PR #${newPRNumber}`);
+		} catch (error) {
+			const message = toErrorMessage(error);
+			this.logger.warn(`Failed to add duplicate notice comment to PR #${newPRNumber}: ${message}（token may lack \`issues: write\` scope）`);
+		}
+		try {
+			await addLabelToPullRequest(client, owner, repo, newPRNumber, ["duplicate"]);
+			this.logger.info(`Added 'duplicate' label to PR #${newPRNumber}`);
+		} catch (error) {
+			const message = toErrorMessage(error);
+			this.logger.warn(`Failed to add 'duplicate' label to PR #${newPRNumber}: ${message}（token may lack \`issues: write\` scope）`);
+		}
+	}
+	/**
 	* 多仓库并发执行管线。
 	*
 	* - 并发窗口 = config.maxConcurrency（默认 1 保守串行，行为与现状一致）
@@ -7539,7 +7707,8 @@ var DependfixApp = class {
 				client,
 				owners: owner,
 				topics: this.config.repoTopics,
-				policy
+				policy,
+				maxRepos: this.config.maxRepos
 			});
 			const explicitFiltered = filterExplicitRepositories(policy, this.config.repositories);
 			const merged = mergeRepositories(explicitFiltered, discovered.map((r) => r.fullName));
@@ -7563,16 +7732,13 @@ var DependfixApp = class {
 		return this.createClient();
 	}
 	createClient(token = this.config.githubToken) {
-		return createGitHubClient({
-			token,
-			retry: {
-				maxRetries: this.config.maxRetries,
-				maxBackoffMs: this.config.maxBackoffMs
-			}
-		});
+		return createGitHubClient({ auth: fromPat(token, { retry: {
+			maxRetries: this.config.maxRetries,
+			maxBackoffMs: this.config.maxBackoffMs
+		} }) });
 	}
 };
 
 //#endregion
-export { ALERT_SOURCES, AUTO_FIXABLE_RULES, AiUsageTracker, DEFAULT_CONCURRENCY, DEFAULT_RULES_CONFIG, DEFAULT_RUNTIME_CONFIG, DependfixApp, ENV_PREFIX, MAX_CONCURRENCY_LIMIT, MAX_GLOB_PATTERN_LENGTH, RULE_CONFIG_ENV, RUNTIME_MODES, SEVERITY_THRESHOLDS, SUGGESTED_RULES, analyzeTokenScope, applyCodeScanningFix, applyVersionedOverrides, assessBreakingChange, buildPrTitle, buildUpgradeGroups, checkTokenPermissions, classifyLockfileFailure, classifyRule, closePullRequest, compareSemver, computeFixAndPrPlan, computeFixFingerprint, computeLockfileDiff, computeRetryDelayMs, createFixBranch, createGitHubClient, createPullRequest, dedupeFixableAlerts, deleteRemoteBranch, detectPnpmMajor, discoverRepositories, ensurePnpmOverrides, estimateCostUsd, extractFingerprintFromBranch, extractLockfileVersion, extractMainPackage, extractPrefix, fetchCodeQualityFindings, fetchCodeScanningAlerts, fetchDefaultBranch, fetchDependabotAlerts, fetchPnpmAuditAlerts, filterExplicitRepositories, findDependencyVersion, findDependfixOpenPR, formatHistory, formatVerificationError, generatePRBody, getActiveRulesConfig, getBranchPrStatus, getCodeScanningFixTemplate, hashAdvisoryId, inferRepoFromGitRemote, isConfirmAnswer, isCrossMajorFixRequired, isMainPackagePresent, isNonSemverDeclaration, isRootDirectDependency, isValidConcurrency, isValidPnpmVersion, listDependfixBranches, loadRulesConfigFromEnv, loadRulesConfigFromFile, mapCodeQualitySeverity, mapGitHubError, maskSecrets, matchesPattern, matchesRepoExclude, matchesRepoGlob, matchesRepoInclude, matchesTopicsExclude, mergeRepositories, overrideTransitiveDependency, parseAuditReport, parseDependabotGroups, parseMajorVersion, parseRulesConfig, partitionSubmanifestAlerts, pushBranch, queryRepoHistory, quickVerifyProject, readArchiveIndex, readEnv, readEnvConfig, readExistingOverrides, readLockfileVersion, readLockfileVersions, readReposFile, repairLockfile, repoGlobToRegExp, resetActiveRulesConfig, resolvePnpmVersion, resolveRepoList, resolveRuntimeConfig, resolveWithinWorkDir, restoreSourceFile, restoreTrackedFiles, runVerification, runWithConcurrency, sanitizeOutput, setActiveRulesConfig, snapshotSourceFile, snapshotTrackedFiles, stageAndCommit, suggestionFor, summarizeVerificationOutput, upgradeDependency, writeArchive };
+export { ALERT_SOURCES, AUTO_FIXABLE_RULES, AiUsageTracker, DEFAULT_CONCURRENCY, DEFAULT_RULES_CONFIG, DEFAULT_RUNTIME_CONFIG, DependfixApp, ENV_PREFIX, MAX_CONCURRENCY_LIMIT, MAX_GLOB_PATTERN_LENGTH, RULE_CONFIG_ENV, RUNTIME_MODES, SEVERITY_THRESHOLDS, SUGGESTED_RULES, addLabelToPullRequest, analyzeTokenScope, applyCodeScanningFix, applyVersionedOverrides, assessBreakingChange, buildPrTitle, buildUpgradeGroups, checkTokenPermissions, classifyLockfileFailure, classifyRule, closePullRequest, closeSupersededPRs, commentOnPullRequest, compareSemver, computeFixAndPrPlan, computeFixFingerprint, computeLockfileDiff, computeRetryDelayMs, createFixBranch, createGitHubClient, createPullRequest, dedupeFixableAlerts, deleteRemoteBranch, detectPnpmMajor, discoverRepositories, ensurePnpmOverrides, estimateCostUsd, extractFingerprintFromBranch, extractLockfileVersion, extractMainPackage, extractPrefix, fetchCodeQualityFindings, fetchCodeScanningAlerts, fetchDefaultBranch, fetchDependabotAlerts, fetchPnpmAuditAlerts, filterExplicitRepositories, findDependencyVersion, findDependfixOpenPR, formatHistory, formatVerificationError, generatePRBody, getActiveRulesConfig, getBranchPrStatus, getCodeScanningFixTemplate, hashAdvisoryId, inferRepoFromGitRemote, isConfirmAnswer, isCrossMajorFixRequired, isMainPackagePresent, isNonSemverDeclaration, isRootDirectDependency, isValidConcurrency, isValidPnpmVersion, listDependfixBranches, loadRulesConfigFromEnv, loadRulesConfigFromFile, logPartialSourceFailureSummary, mapCodeQualitySeverity, mapGitHubError, maskSecrets, matchesPattern, matchesRepoExclude, matchesRepoGlob, matchesRepoInclude, matchesTopicsExclude, mergeRepositories, overrideTransitiveDependency, parseAuditReport, parseDependabotGroups, parseMajorVersion, parseRulesConfig, partitionSubmanifestAlerts, pushBranch, queryRepoHistory, quickVerifyProject, readArchiveIndex, readEnv, readEnvConfig, readExistingOverrides, readLockfileVersion, readLockfileVersions, readReposFile, repairLockfile, repoGlobToRegExp, resetActiveRulesConfig, resolvePnpmVersion, resolveRepoList, resolveRuntimeConfig, resolveWithinWorkDir, restoreSourceFile, restoreTrackedFiles, runVerification, runWithConcurrency, sanitizeOutput, setActiveRulesConfig, snapshotSourceFile, snapshotTrackedFiles, stageAndCommit, suggestionFor, summarizeVerificationOutput, upgradeDependency, writeArchive };
 //# sourceMappingURL=index.mjs.map