autoremediator 0.16.0 → 0.18.0

package/dist/cli/program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmIpC,wBAAgB,aAAa,IAAI,OAAO,CAsMvC"}
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+IpC,wBAAgB,aAAa,IAAI,OAAO,CA+TvC"}

package/dist/cli/runners.d.ts

@@ -1,3 +1,5 @@
+import { runInteractiveTriage } from "./triage.js";
+export { runInteractiveTriage };
 import type { CommandOptions } from "./types.js";
 export declare function runSingleCve(cveId: string, opts: CommandOptions): Promise<void>;
 export declare function runScanInput(inputPath: string, opts: CommandOptions): Promise<void>;
@@ -6,4 +8,24 @@ export declare function runInspectPatch(patchPath: string, opts: Pick<CommandOpt
 export declare function runValidatePatch(patchPath: string, opts: Pick<CommandOptions, "cwd" | "patchesDir" | "packageManager" | "outputFormat">): Promise<void>;
 export declare function runUpdateOutdated(opts: CommandOptions): Promise<void>;
 export declare function runPortfolio(targetsFilePath: string, opts: CommandOptions): Promise<void>;
+export declare function runReachability(opts: {
+    cwd?: string;
+    package: string;
+    symbol?: string;
+    outputFormat?: string;
+}): Promise<void>;
+export declare function runEvaluate(packageName: string, opts: {
+    cwd?: string;
+    version?: string;
+    outputFormat?: string;
+}): Promise<void>;
+export declare function runDiffAudit(opts: {
+    cwd?: string;
+    base?: string;
+    outputFormat?: string;
+    ci?: boolean;
+}): Promise<void>;
+export declare function runReconcilePatches(opts: Pick<CommandOptions, "cwd" | "patchesDir" | "packageManager" | "runTests" | "outputFormat"> & {
+    autoApply?: boolean;
+}): Promise<void>;
 //# sourceMappingURL=runners.d.ts.map

package/dist/cli/runners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/cli/runners.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkFjD,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IrF;AAED,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqKzF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,gBAAgB,GAAG,cAAc,CAAC,GACnF,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C3E;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6F/F"}
+{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/cli/runners.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAGhC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkFjD,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA8IrF;AAED,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2KzF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,gBAAgB,GAAG,cAAc,CAAC,GACnF,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C3E;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6F/F;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,CAAC,EAAE,OAAO,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAiChB;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,gBAAgB,GAAG,UAAU,GAAG,cAAc,CAAC,GAAG;IAClG,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/cli/triage.d.ts

@@ -0,0 +1,7 @@
+import type { CommandOptions } from "./types.js";
+/**
+ * Interactive developer CLI triage workflow.
+ * Prompts developer through security findings with actions to apply, skip, suppress, or quit.
+ */
+export declare function runInteractiveTriage(inputPathOrOpts: string | Partial<CommandOptions>, maybeOpts?: Partial<CommandOptions>): Promise<void>;
+//# sourceMappingURL=triage.d.ts.map

package/dist/cli/triage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage.d.ts","sourceRoot":"","sources":["../../src/cli/triage.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,EACjD,SAAS,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAClC,OAAO,CAAC,IAAI,CAAC,CAyIf"}

package/dist/cli/types.d.ts

@@ -9,6 +9,8 @@ export interface CommandOptions {
     preview: boolean;
     simulationMode: boolean;
     runTests: boolean;
+    typecheck?: boolean;
+    interactive?: boolean;
     outputFormat: OutputFormat;
     llmProvider?: "remote" | "local";
     model?: string;

package/dist/cli/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/cli/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;AACvE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,eAAe,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,YAAY,GAAG,WAAW,GAAG,UAAU,CAAC;IAC3D,qBAAqB,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7C,2BAA2B,EAAE,OAAO,CAAC;IACrC,iBAAiB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,sBAAsB,EAAE,OAAO,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,UAAU,GAAG,gBAAgB,GAAG,eAAe,CAAC;IAC9D,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,qBAAqB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5C,qBAAqB,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,aAAa,CAAC;IAC1D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/cli/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;AACvE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,eAAe,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,YAAY,CAAC;IAE3B,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,YAAY,GAAG,WAAW,GAAG,UAAU,CAAC;IAC3D,qBAAqB,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7C,2BAA2B,EAAE,OAAO,CAAC;IACrC,iBAAiB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,sBAAsB,EAAE,OAAO,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,UAAU,GAAG,gBAAgB,GAAG,eAAe,CAAC;IAC9D,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,qBAAqB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5C,qBAAqB,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,aAAa,CAAC;IAC1D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9C"}

package/dist/cli.js

@@ -5,18 +5,25 @@ import {
   buildDependencyScopeCounts,
   buildSlaBreachSummary,
   buildStrategyCounts,
+  checkReachability,
   ciExitCode,
+  evaluatePackage,
   inspectPatchArtifact,
   listPatchArtifacts,
+  parseScanInput,
+  parseScanInputFromAudit,
+  reconcilePatchArtifacts,
   remediate,
   remediateFromScan,
   remediatePortfolio,
+  scanDelta,
   toCiSummary,
   toCycloneDxVex,
   toSarifOutput,
+  uniqueCveIds,
   updateOutdated,
   validatePatchArtifact
-} from "./chunk-CQXNIRHT.js";
+} from "./chunk-FXOUJDQ3.js";
 
 // src/cli/index.ts
 import { fileURLToPath } from "url";
@@ -25,6 +32,150 @@ import { fileURLToPath } from "url";
 import { Command } from "commander";
 import { existsSync } from "fs";
 
+// src/cli/triage.ts
+import * as readline from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+async function runInteractiveTriage(inputPathOrOpts, maybeOpts) {
+  const inputPath = typeof inputPathOrOpts === "string" ? inputPathOrOpts : inputPathOrOpts.input;
+  const opts = (typeof inputPathOrOpts === "object" ? inputPathOrOpts : maybeOpts) ?? {};
+  const cwd = opts.cwd ?? process.cwd();
+  output.write("\n\u{1F50D} Scanning for security findings to triage...\n");
+  let findings = [];
+  try {
+    if (inputPath) {
+      findings = parseScanInput(inputPath, opts.format ?? "auto");
+    } else {
+      findings = await parseScanInputFromAudit({
+        cwd,
+        packageManager: opts.packageManager,
+        format: opts.format ?? "auto",
+        workspace: opts.workspace
+      });
+    }
+  } catch (err) {
+    output.write(
+      `Failed to load scan findings: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return;
+  }
+  const cveIds = uniqueCveIds(findings);
+  if (cveIds.length === 0) {
+    output.write("\u2728 No vulnerabilities found to triage!\n\n");
+    return;
+  }
+  output.write(`Found ${cveIds.length} unique vulnerability(ies) to triage.
+`);
+  const rl = readline.createInterface({ input, output });
+  let remediatedCount = 0;
+  let skippedCount = 0;
+  let suppressedCount = 0;
+  try {
+    for (let i = 0; i < cveIds.length; i++) {
+      const cveId = cveIds[i];
+      const matchingFindings = findings.filter(
+        (f) => f.cveId.toUpperCase() === cveId.toUpperCase()
+      );
+      const firstFinding = matchingFindings[0];
+      const pkgName = firstFinding?.packageName ?? "unknown package";
+      const severity = firstFinding?.severity ?? "UNKNOWN";
+      let safeVersion;
+      if (pkgName !== "unknown package") {
+        try {
+          const evalRes = await evaluatePackage(pkgName, { enrichIntelligence: true });
+          const matchingVuln = evalRes.vulnerabilities.find(
+            (v) => v.cveId.toUpperCase() === cveId.toUpperCase()
+          );
+          safeVersion = matchingVuln?.safeUpgradeVersion ?? evalRes.vulnerabilities.find((v) => v.safeUpgradeVersion)?.safeUpgradeVersion;
+        } catch {
+        }
+      }
+      output.write("\n" + "=".repeat(60) + "\n");
+      output.write(`[${i + 1}/${cveIds.length}] Vulnerability: ${cveId}
+`);
+      output.write(`  Package:  ${pkgName}
+`);
+      output.write(`  Severity: ${severity}
+`);
+      if (safeVersion) {
+        output.write(`  Safe Upstream Version: ${safeVersion}
+`);
+      }
+      output.write("=".repeat(60) + "\n");
+      let answered = false;
+      while (!answered) {
+        const answer = await rl.question(
+          "Action: [a]pply fix, [s]kip, [x] suppress/vex, [q]uit triage? [a/s/x/q]: "
+        );
+        const choice = answer.trim().toLowerCase();
+        if (choice === "a" || choice === "apply") {
+          output.write(`Applying remediation for ${cveId}...
+`);
+          try {
+            const report = await remediate(cveId, {
+              cwd,
+              packageManager: opts.packageManager,
+              patchesDir: opts.patchesDir,
+              policy: opts.policy,
+              runTests: opts.runTests,
+              constraints: {
+                directDependenciesOnly: opts.directDependenciesOnly,
+                preferVersionBump: opts.preferVersionBump,
+                workspace: opts.workspace
+              }
+            });
+            const applied = report.results.some((r) => r.applied);
+            if (applied) {
+              output.write(`\u2705 Successfully applied remediation for ${cveId}!
+`);
+              remediatedCount++;
+            } else {
+              const reason = report.results[0]?.unresolvedReason ?? "unresolved";
+              output.write(`\u26A0\uFE0F Remediation could not be applied automatically (${reason}).
+`);
+              skippedCount++;
+            }
+          } catch (err) {
+            output.write(
+              `\u274C Error remediating ${cveId}: ${err instanceof Error ? err.message : String(err)}
+`
+            );
+            skippedCount++;
+          }
+          answered = true;
+        } else if (choice === "s" || choice === "skip" || choice === "") {
+          output.write(`Skipped ${cveId}.
+`);
+          skippedCount++;
+          answered = true;
+        } else if (choice === "x" || choice === "suppress") {
+          output.write(`Marked ${cveId} as suppressed / VEX excluded.
+`);
+          suppressedCount++;
+          answered = true;
+        } else if (choice === "q" || choice === "quit") {
+          output.write("Exiting triage session.\n");
+          return;
+        } else {
+          output.write("Invalid option. Please choose 'a', 's', 'x', or 'q'.\n");
+        }
+      }
+    }
+  } finally {
+    rl.close();
+    output.write("\n=== Triage Summary ===\n");
+    output.write(`Total evaluated: ${cveIds.length}
+`);
+    output.write(`Remediated:     ${remediatedCount}
+`);
+    output.write(`Suppressed:     ${suppressedCount}
+`);
+    output.write(`Skipped:        ${skippedCount}
+
+`);
+  }
+}
+
 // src/cli/runners.ts
 import { readFileSync, writeFileSync } from "fs";
 
@@ -99,6 +250,7 @@ async function runSingleCve(cveId, opts) {
     preview: opts.preview,
     simulationMode: opts.simulationMode,
     runTests: opts.runTests,
+    typecheck: opts.typecheck,
     patchesDir: opts.patchesDir,
     policy: opts.policy,
     evidence: opts.evidence,
@@ -217,6 +369,10 @@ async function runSingleCve(cveId, opts) {
   }
 }
 async function runScanInput(inputPath, opts) {
+  if (opts.interactive) {
+    await runInteractiveTriage(inputPath, opts);
+    return;
+  }
   const changeRequest = resolveChangeRequestOptions(opts);
   const report = await remediateFromScan(inputPath, {
     cwd: opts.cwd,
@@ -229,6 +385,7 @@ async function runScanInput(inputPath, opts) {
     preview: opts.preview,
     simulationMode: opts.simulationMode,
     runTests: opts.runTests,
+    typecheck: opts.typecheck,
     llmProvider: opts.llmProvider,
     model: opts.model,
     modelPersonality: opts.modelPersonality,
@@ -600,10 +757,143 @@ async function runPortfolio(targetsFilePath, opts) {
     process.exitCode = report.failedCount > 0 ? 1 : 0;
   }
 }
+async function runReachability(opts) {
+  const result = await checkReachability({
+    cwd: opts.cwd,
+    packageName: opts.package,
+    symbol: opts.symbol
+  });
+  if (opts.outputFormat === "json") {
+    logJson(result);
+    return;
+  }
+  process.stdout.write(`Package: ${result.packageName}
+`);
+  process.stdout.write(`Status: ${result.status}
+`);
+  process.stdout.write(`Reason: ${result.reason}
+`);
+  if (result.evidence && result.evidence.length > 0) {
+    process.stdout.write(`Evidence files (${result.evidence.length}):
+`);
+    for (const ev of result.evidence) {
+      process.stdout.write(
+        `  - ${ev.filePath} [${ev.matchType}] (invoked: ${ev.invoked ?? false})
+`
+      );
+    }
+  }
+}
+async function runEvaluate(packageName, opts) {
+  const report = await evaluatePackage(packageName, {
+    version: opts.version,
+    cwd: opts.cwd,
+    enrichIntelligence: true
+  });
+  if (opts.outputFormat === "json") {
+    logJson(report);
+    return;
+  }
+  process.stdout.write(
+    `Package: ${report.packageName}${report.evaluatedVersion ? `@${report.evaluatedVersion}` : ""}
+`
+  );
+  process.stdout.write(`Verdict: ${report.verdict.toUpperCase()}
+`);
+  process.stdout.write(`Summary: ${report.summary}
+`);
+  if (report.recommendedVersion) {
+    process.stdout.write(`Recommended Version: ${report.recommendedVersion}
+`);
+  }
+  if (report.vulnerabilities.length > 0) {
+    process.stdout.write(`Known Vulnerabilities (${report.vulnerabilities.length}):
+`);
+    for (const vuln of report.vulnerabilities) {
+      process.stdout.write(`  - [${vuln.cveId}] (${vuln.severity}) ${vuln.summary}
+`);
+      if (vuln.safeUpgradeVersion) {
+        process.stdout.write(`    Safe upgrade: ${vuln.safeUpgradeVersion}
+`);
+      }
+    }
+  }
+}
+async function runDiffAudit(opts) {
+  const report = await scanDelta({
+    cwd: opts.cwd,
+    baseRef: opts.base
+  });
+  if (opts.outputFormat === "json") {
+    logJson(report);
+    if (opts.ci) {
+      process.exitCode = report.netRiskVerdict === "degraded" ? 1 : 0;
+    }
+    return;
+  }
+  process.stdout.write(`Delta scan against base: ${report.baseRef}
+`);
+  process.stdout.write(`Net Risk Verdict: ${report.netRiskVerdict.toUpperCase()}
+`);
+  process.stdout.write(`Dependency Changes: ${report.dependencyChanges.length}
+`);
+  process.stdout.write(`Newly Introduced CVEs: ${report.introducedFindings.length}
+`);
+  process.stdout.write(`Resolved CVEs: ${report.resolvedFindings.length}
+`);
+  process.stdout.write(`Summary: ${report.summary}
+`);
+  if (report.introducedFindings.length > 0) {
+    process.stdout.write(`
+Introduced Findings:
+`);
+    for (const f of report.introducedFindings) {
+      process.stdout.write(
+        `  - [${f.cveId}] ${f.packageName}@${f.installedVersion ?? "unknown"} (${f.severity}): ${f.summary}
+`
+      );
+    }
+  }
+  if (opts.ci) {
+    process.exitCode = report.netRiskVerdict === "degraded" ? 1 : 0;
+  }
+}
+async function runReconcilePatches(opts) {
+  const report = await reconcilePatchArtifacts({
+    cwd: opts.cwd,
+    patchesDir: opts.patchesDir,
+    packageManager: opts.packageManager,
+    autoApply: opts.autoApply,
+    runTests: opts.runTests
+  });
+  if (opts.outputFormat === "json") {
+    logJson(report);
+    return;
+  }
+  process.stdout.write(`=== Patch Artifact Reconciliation ===
+`);
+  process.stdout.write(`Reconciled (upgraded): ${report.reconciledCount}
+`);
+  process.stdout.write(`Retained: ${report.retainedCount}
+
+`);
+  for (const item of report.reconciled) {
+    process.stdout.write(`- [${item.status}] ${item.packageName} (${item.patchFilePath})
+`);
+    if (item.safeUpstreamVersion) {
+      process.stdout.write(`  Safe Upstream Version: ${item.safeUpstreamVersion}
+`);
+    }
+    if (item.reason) {
+      process.stdout.write(`  Reason: ${item.reason}
+`);
+    }
+  }
+}
 
 // src/cli/types.ts
 function isCveId(value) {
-  return /^CVE-\d{4}-\d{1,7}$/i.test(value);
+  return /^CVE-\d{4}-\d{1,7}$/i.test(value) || /^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/i.test(value);
 }
 
 // src/cli/validators.ts
@@ -645,7 +935,11 @@ function validateOutputFormat(outputFormat, supported, commandName) {
 // src/cli/program.ts
 function addSharedOptions(program, includeInput = false, includeSimulationMode = true) {
   const parseBooleanFlag = (value) => value === "true";
-  program.option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager).option("--patches-dir <path>", OPTION_DESCRIPTIONS.patchesDir).option("--dry-run", OPTION_DESCRIPTIONS.dryRun, false).option("--preview", OPTION_DESCRIPTIONS.preview, false).option("--run-tests", OPTION_DESCRIPTIONS.runTests, false).option("--llm-provider <provider>", OPTION_DESCRIPTIONS.llmProvider).option("--model <name>", OPTION_DESCRIPTIONS.model).option("--model-personality <profile>", OPTION_DESCRIPTIONS.modelPersonality).option("--provider-safety-profile <profile>", OPTION_DESCRIPTIONS.providerSafetyProfile).option(
+  program.option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager).option("--patches-dir <path>", OPTION_DESCRIPTIONS.patchesDir).option("--dry-run", OPTION_DESCRIPTIONS.dryRun, false).option("--preview", OPTION_DESCRIPTIONS.preview, false).option("--run-tests", OPTION_DESCRIPTIONS.runTests, false).option(
+    "--typecheck",
+    "Enable typecheck validation (e.g. tsc --noEmit or npm run typecheck) after patching",
+    false
+  ).option("-i, --interactive", "Launch interactive developer CLI triage workflow", false).option("--llm-provider <provider>", OPTION_DESCRIPTIONS.llmProvider).option("--model <name>", OPTION_DESCRIPTIONS.model).option("--model-personality <profile>", OPTION_DESCRIPTIONS.modelPersonality).option("--provider-safety-profile <profile>", OPTION_DESCRIPTIONS.providerSafetyProfile).option(
     "--require-consensus-for-high-risk",
     OPTION_DESCRIPTIONS.requireConsensusForHighRisk,
     false
@@ -786,12 +1080,80 @@ function createProgram() {
       await runValidatePatch(patchPath, merged);
     }
   );
+  patches.command("reconcile").description(
+    "Reconcile active patch artifacts against upstream registries to retire obsolete patches"
+  ).option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--patches-dir <path>", OPTION_DESCRIPTIONS.patchesDir).option(
+    "--auto-apply",
+    "Automatically upgrade packages and remove retired patch artifacts",
+    false
+  ).option("--run-tests", OPTION_DESCRIPTIONS.runTests, false).option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager).option("--output-format <format>", "Output format: text|json", "text").action(
+    async (opts, command) => {
+      const merged = {
+        ...command.optsWithGlobals(),
+        ...opts
+      };
+      validateOutputFormat(
+        merged.outputFormat ?? "text",
+        ["text", "json"],
+        "patches reconcile"
+      );
+      await runReconcilePatches(merged);
+    }
+  );
+  program.command("reachability").description("Perform AST call-graph reachability analysis for a package or vulnerable symbol").requiredOption("--package <name>", "Target package name to search").option("--symbol <name>", "Optional specific vulnerable function or export symbol to check").option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--output-format <format>", "Output format: text|json", "text").action(
+    async (opts) => {
+      validateOutputFormat(
+        opts.outputFormat ?? "text",
+        ["text", "json"],
+        "reachability"
+      );
+      await runReachability(opts);
+    }
+  );
+  program.command("evaluate <package>").description(
+    "Pre-flight security evaluator for npm packages before installation (e.g. evaluate express@4.18.2)"
+  ).option("--pkg-version <version>", "Package version to evaluate").option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--output-format <format>", "Output format: text|json", "text").action(
+    async (pkg, opts) => {
+      validateOutputFormat(
+        opts.outputFormat ?? "text",
+        ["text", "json"],
+        "evaluate"
+      );
+      let targetName = pkg;
+      let targetVersion = opts.pkgVersion;
+      const lastAt = pkg.lastIndexOf("@");
+      if (lastAt > 0 && !targetVersion) {
+        targetName = pkg.slice(0, lastAt);
+        targetVersion = pkg.slice(lastAt + 1);
+      }
+      await runEvaluate(targetName, {
+        cwd: opts.cwd,
+        version: targetVersion,
+        outputFormat: opts.outputFormat
+      });
+    }
+  );
+  program.command("diff").description("Git-aware delta vulnerability scan against base git reference or working tree").option("--base <ref>", "Git base reference (default: HEAD)", "HEAD").option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--ci", "Enable CI exit code behavior on degraded security posture", false).option("--output-format <format>", "Output format: text|json", "text").action(async (opts) => {
+    validateOutputFormat(
+      opts.outputFormat ?? "text",
+      ["text", "json"],
+      "diff"
+    );
+    await runDiffAudit(opts);
+  });
+  program.command("triage [input]").description("Interactively triage discovered vulnerabilities step-by-step").option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager).option("--patches-dir <path>", OPTION_DESCRIPTIONS.patchesDir).option("--format <format>", OPTION_DESCRIPTIONS.format, "auto").option("--run-tests", OPTION_DESCRIPTIONS.runTests, false).option("--policy <path>", OPTION_DESCRIPTIONS.policy).action(async (inputArg, opts) => {
+    await runInteractiveTriage(inputArg ? inputArg : opts, opts);
+  });
   addSharedOptions(
     program.argument("[target]", "Scanner output file path (or CVE ID fallback)").option("--format <type>", OPTION_DESCRIPTIONS.format, "auto").option("--summary-file <path>", "Write machine-readable scan summary JSON to path"),
     true
   ).action(async (target, opts) => {
     validateSharedCommandOptions(opts);
     validateOutputFormat(opts.outputFormat, ["text", "json", "sarif"], "default");
+    if (opts.interactive) {
+      await runInteractiveTriage(opts.input ?? target ?? opts, opts);
+      return;
+    }
     if (opts.audit) {
       await runScanInput(opts.input ?? target ?? "", opts);
       return;