autoremediator 0.17.0 → 0.18.0

package/dist/cli/program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsIpC,wBAAgB,aAAa,IAAI,OAAO,CAyQvC"}
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+IpC,wBAAgB,aAAa,IAAI,OAAO,CA+TvC"}

package/dist/cli/runners.d.ts

@@ -1,3 +1,5 @@
+import { runInteractiveTriage } from "./triage.js";
+export { runInteractiveTriage };
 import type { CommandOptions } from "./types.js";
 export declare function runSingleCve(cveId: string, opts: CommandOptions): Promise<void>;
 export declare function runScanInput(inputPath: string, opts: CommandOptions): Promise<void>;
@@ -23,4 +25,7 @@ export declare function runDiffAudit(opts: {
     outputFormat?: string;
     ci?: boolean;
 }): Promise<void>;
+export declare function runReconcilePatches(opts: Pick<CommandOptions, "cwd" | "patchesDir" | "packageManager" | "runTests" | "outputFormat"> & {
+    autoApply?: boolean;
+}): Promise<void>;
 //# sourceMappingURL=runners.d.ts.map

package/dist/cli/runners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/cli/runners.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkFjD,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IrF;AAED,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqKzF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,gBAAgB,GAAG,cAAc,CAAC,GACnF,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C3E;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6F/F;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,CAAC,EAAE,OAAO,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAiChB"}
+{"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/cli/runners.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAGhC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkFjD,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA8IrF;AAED,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2KzF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,gBAAgB,GAAG,cAAc,CAAC,GACnF,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C3E;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6F/F;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,CAAC,EAAE,OAAO,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAiChB;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,gBAAgB,GAAG,UAAU,GAAG,cAAc,CAAC,GAAG;IAClG,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/cli/triage.d.ts

@@ -0,0 +1,7 @@
+import type { CommandOptions } from "./types.js";
+/**
+ * Interactive developer CLI triage workflow.
+ * Prompts developer through security findings with actions to apply, skip, suppress, or quit.
+ */
+export declare function runInteractiveTriage(inputPathOrOpts: string | Partial<CommandOptions>, maybeOpts?: Partial<CommandOptions>): Promise<void>;
+//# sourceMappingURL=triage.d.ts.map

package/dist/cli/triage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage.d.ts","sourceRoot":"","sources":["../../src/cli/triage.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,EACjD,SAAS,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAClC,OAAO,CAAC,IAAI,CAAC,CAyIf"}

package/dist/cli/types.d.ts

@@ -9,6 +9,8 @@ export interface CommandOptions {
     preview: boolean;
     simulationMode: boolean;
     runTests: boolean;
+    typecheck?: boolean;
+    interactive?: boolean;
     outputFormat: OutputFormat;
     llmProvider?: "remote" | "local";
     model?: string;

package/dist/cli/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/cli/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;AACvE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,eAAe,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,YAAY,GAAG,WAAW,GAAG,UAAU,CAAC;IAC3D,qBAAqB,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7C,2BAA2B,EAAE,OAAO,CAAC;IACrC,iBAAiB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,sBAAsB,EAAE,OAAO,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,UAAU,GAAG,gBAAgB,GAAG,eAAe,CAAC;IAC9D,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,qBAAqB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5C,qBAAqB,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,aAAa,CAAC;IAC1D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/cli/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,YAAY,GAAG,OAAO,CAAC;AACvE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,eAAe,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,YAAY,CAAC;IAE3B,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,YAAY,GAAG,WAAW,GAAG,UAAU,CAAC;IAC3D,qBAAqB,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7C,2BAA2B,EAAE,OAAO,CAAC;IACrC,iBAAiB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,sBAAsB,EAAE,OAAO,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,UAAU,GAAG,gBAAgB,GAAG,eAAe,CAAC;IAC9D,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,qBAAqB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5C,qBAAqB,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,aAAa,CAAC;IAC1D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9C"}

package/dist/cli.js

@@ -10,6 +10,9 @@ import {
   evaluatePackage,
   inspectPatchArtifact,
   listPatchArtifacts,
+  parseScanInput,
+  parseScanInputFromAudit,
+  reconcilePatchArtifacts,
   remediate,
   remediateFromScan,
   remediatePortfolio,
@@ -17,9 +20,10 @@ import {
   toCiSummary,
   toCycloneDxVex,
   toSarifOutput,
+  uniqueCveIds,
   updateOutdated,
   validatePatchArtifact
-} from "./chunk-U4LIJIGD.js";
+} from "./chunk-FXOUJDQ3.js";
 
 // src/cli/index.ts
 import { fileURLToPath } from "url";
@@ -28,6 +32,150 @@ import { fileURLToPath } from "url";
 import { Command } from "commander";
 import { existsSync } from "fs";
 
+// src/cli/triage.ts
+import * as readline from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+async function runInteractiveTriage(inputPathOrOpts, maybeOpts) {
+  const inputPath = typeof inputPathOrOpts === "string" ? inputPathOrOpts : inputPathOrOpts.input;
+  const opts = (typeof inputPathOrOpts === "object" ? inputPathOrOpts : maybeOpts) ?? {};
+  const cwd = opts.cwd ?? process.cwd();
+  output.write("\n\u{1F50D} Scanning for security findings to triage...\n");
+  let findings = [];
+  try {
+    if (inputPath) {
+      findings = parseScanInput(inputPath, opts.format ?? "auto");
+    } else {
+      findings = await parseScanInputFromAudit({
+        cwd,
+        packageManager: opts.packageManager,
+        format: opts.format ?? "auto",
+        workspace: opts.workspace
+      });
+    }
+  } catch (err) {
+    output.write(
+      `Failed to load scan findings: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return;
+  }
+  const cveIds = uniqueCveIds(findings);
+  if (cveIds.length === 0) {
+    output.write("\u2728 No vulnerabilities found to triage!\n\n");
+    return;
+  }
+  output.write(`Found ${cveIds.length} unique vulnerability(ies) to triage.
+`);
+  const rl = readline.createInterface({ input, output });
+  let remediatedCount = 0;
+  let skippedCount = 0;
+  let suppressedCount = 0;
+  try {
+    for (let i = 0; i < cveIds.length; i++) {
+      const cveId = cveIds[i];
+      const matchingFindings = findings.filter(
+        (f) => f.cveId.toUpperCase() === cveId.toUpperCase()
+      );
+      const firstFinding = matchingFindings[0];
+      const pkgName = firstFinding?.packageName ?? "unknown package";
+      const severity = firstFinding?.severity ?? "UNKNOWN";
+      let safeVersion;
+      if (pkgName !== "unknown package") {
+        try {
+          const evalRes = await evaluatePackage(pkgName, { enrichIntelligence: true });
+          const matchingVuln = evalRes.vulnerabilities.find(
+            (v) => v.cveId.toUpperCase() === cveId.toUpperCase()
+          );
+          safeVersion = matchingVuln?.safeUpgradeVersion ?? evalRes.vulnerabilities.find((v) => v.safeUpgradeVersion)?.safeUpgradeVersion;
+        } catch {
+        }
+      }
+      output.write("\n" + "=".repeat(60) + "\n");
+      output.write(`[${i + 1}/${cveIds.length}] Vulnerability: ${cveId}
+`);
+      output.write(`  Package:  ${pkgName}
+`);
+      output.write(`  Severity: ${severity}
+`);
+      if (safeVersion) {
+        output.write(`  Safe Upstream Version: ${safeVersion}
+`);
+      }
+      output.write("=".repeat(60) + "\n");
+      let answered = false;
+      while (!answered) {
+        const answer = await rl.question(
+          "Action: [a]pply fix, [s]kip, [x] suppress/vex, [q]uit triage? [a/s/x/q]: "
+        );
+        const choice = answer.trim().toLowerCase();
+        if (choice === "a" || choice === "apply") {
+          output.write(`Applying remediation for ${cveId}...
+`);
+          try {
+            const report = await remediate(cveId, {
+              cwd,
+              packageManager: opts.packageManager,
+              patchesDir: opts.patchesDir,
+              policy: opts.policy,
+              runTests: opts.runTests,
+              constraints: {
+                directDependenciesOnly: opts.directDependenciesOnly,
+                preferVersionBump: opts.preferVersionBump,
+                workspace: opts.workspace
+              }
+            });
+            const applied = report.results.some((r) => r.applied);
+            if (applied) {
+              output.write(`\u2705 Successfully applied remediation for ${cveId}!
+`);
+              remediatedCount++;
+            } else {
+              const reason = report.results[0]?.unresolvedReason ?? "unresolved";
+              output.write(`\u26A0\uFE0F Remediation could not be applied automatically (${reason}).
+`);
+              skippedCount++;
+            }
+          } catch (err) {
+            output.write(
+              `\u274C Error remediating ${cveId}: ${err instanceof Error ? err.message : String(err)}
+`
+            );
+            skippedCount++;
+          }
+          answered = true;
+        } else if (choice === "s" || choice === "skip" || choice === "") {
+          output.write(`Skipped ${cveId}.
+`);
+          skippedCount++;
+          answered = true;
+        } else if (choice === "x" || choice === "suppress") {
+          output.write(`Marked ${cveId} as suppressed / VEX excluded.
+`);
+          suppressedCount++;
+          answered = true;
+        } else if (choice === "q" || choice === "quit") {
+          output.write("Exiting triage session.\n");
+          return;
+        } else {
+          output.write("Invalid option. Please choose 'a', 's', 'x', or 'q'.\n");
+        }
+      }
+    }
+  } finally {
+    rl.close();
+    output.write("\n=== Triage Summary ===\n");
+    output.write(`Total evaluated: ${cveIds.length}
+`);
+    output.write(`Remediated:     ${remediatedCount}
+`);
+    output.write(`Suppressed:     ${suppressedCount}
+`);
+    output.write(`Skipped:        ${skippedCount}
+
+`);
+  }
+}
+
 // src/cli/runners.ts
 import { readFileSync, writeFileSync } from "fs";
 
@@ -102,6 +250,7 @@ async function runSingleCve(cveId, opts) {
     preview: opts.preview,
     simulationMode: opts.simulationMode,
     runTests: opts.runTests,
+    typecheck: opts.typecheck,
     patchesDir: opts.patchesDir,
     policy: opts.policy,
     evidence: opts.evidence,
@@ -220,6 +369,10 @@ async function runSingleCve(cveId, opts) {
   }
 }
 async function runScanInput(inputPath, opts) {
+  if (opts.interactive) {
+    await runInteractiveTriage(inputPath, opts);
+    return;
+  }
   const changeRequest = resolveChangeRequestOptions(opts);
   const report = await remediateFromScan(inputPath, {
     cwd: opts.cwd,
@@ -232,6 +385,7 @@ async function runScanInput(inputPath, opts) {
     preview: opts.preview,
     simulationMode: opts.simulationMode,
     runTests: opts.runTests,
+    typecheck: opts.typecheck,
     llmProvider: opts.llmProvider,
     model: opts.model,
     modelPersonality: opts.modelPersonality,
@@ -704,10 +858,42 @@ Introduced Findings:
     process.exitCode = report.netRiskVerdict === "degraded" ? 1 : 0;
   }
 }
+async function runReconcilePatches(opts) {
+  const report = await reconcilePatchArtifacts({
+    cwd: opts.cwd,
+    patchesDir: opts.patchesDir,
+    packageManager: opts.packageManager,
+    autoApply: opts.autoApply,
+    runTests: opts.runTests
+  });
+  if (opts.outputFormat === "json") {
+    logJson(report);
+    return;
+  }
+  process.stdout.write(`=== Patch Artifact Reconciliation ===
+`);
+  process.stdout.write(`Reconciled (upgraded): ${report.reconciledCount}
+`);
+  process.stdout.write(`Retained: ${report.retainedCount}
+
+`);
+  for (const item of report.reconciled) {
+    process.stdout.write(`- [${item.status}] ${item.packageName} (${item.patchFilePath})
+`);
+    if (item.safeUpstreamVersion) {
+      process.stdout.write(`  Safe Upstream Version: ${item.safeUpstreamVersion}
+`);
+    }
+    if (item.reason) {
+      process.stdout.write(`  Reason: ${item.reason}
+`);
+    }
+  }
+}
 
 // src/cli/types.ts
 function isCveId(value) {
-  return /^CVE-\d{4}-\d{1,7}$/i.test(value);
+  return /^CVE-\d{4}-\d{1,7}$/i.test(value) || /^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/i.test(value);
 }
 
 // src/cli/validators.ts
@@ -749,7 +935,11 @@ function validateOutputFormat(outputFormat, supported, commandName) {
 // src/cli/program.ts
 function addSharedOptions(program, includeInput = false, includeSimulationMode = true) {
   const parseBooleanFlag = (value) => value === "true";
-  program.option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager).option("--patches-dir <path>", OPTION_DESCRIPTIONS.patchesDir).option("--dry-run", OPTION_DESCRIPTIONS.dryRun, false).option("--preview", OPTION_DESCRIPTIONS.preview, false).option("--run-tests", OPTION_DESCRIPTIONS.runTests, false).option("--llm-provider <provider>", OPTION_DESCRIPTIONS.llmProvider).option("--model <name>", OPTION_DESCRIPTIONS.model).option("--model-personality <profile>", OPTION_DESCRIPTIONS.modelPersonality).option("--provider-safety-profile <profile>", OPTION_DESCRIPTIONS.providerSafetyProfile).option(
+  program.option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager).option("--patches-dir <path>", OPTION_DESCRIPTIONS.patchesDir).option("--dry-run", OPTION_DESCRIPTIONS.dryRun, false).option("--preview", OPTION_DESCRIPTIONS.preview, false).option("--run-tests", OPTION_DESCRIPTIONS.runTests, false).option(
+    "--typecheck",
+    "Enable typecheck validation (e.g. tsc --noEmit or npm run typecheck) after patching",
+    false
+  ).option("-i, --interactive", "Launch interactive developer CLI triage workflow", false).option("--llm-provider <provider>", OPTION_DESCRIPTIONS.llmProvider).option("--model <name>", OPTION_DESCRIPTIONS.model).option("--model-personality <profile>", OPTION_DESCRIPTIONS.modelPersonality).option("--provider-safety-profile <profile>", OPTION_DESCRIPTIONS.providerSafetyProfile).option(
     "--require-consensus-for-high-risk",
     OPTION_DESCRIPTIONS.requireConsensusForHighRisk,
     false
@@ -890,6 +1080,26 @@ function createProgram() {
       await runValidatePatch(patchPath, merged);
     }
   );
+  patches.command("reconcile").description(
+    "Reconcile active patch artifacts against upstream registries to retire obsolete patches"
+  ).option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--patches-dir <path>", OPTION_DESCRIPTIONS.patchesDir).option(
+    "--auto-apply",
+    "Automatically upgrade packages and remove retired patch artifacts",
+    false
+  ).option("--run-tests", OPTION_DESCRIPTIONS.runTests, false).option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager).option("--output-format <format>", "Output format: text|json", "text").action(
+    async (opts, command) => {
+      const merged = {
+        ...command.optsWithGlobals(),
+        ...opts
+      };
+      validateOutputFormat(
+        merged.outputFormat ?? "text",
+        ["text", "json"],
+        "patches reconcile"
+      );
+      await runReconcilePatches(merged);
+    }
+  );
   program.command("reachability").description("Perform AST call-graph reachability analysis for a package or vulnerable symbol").requiredOption("--package <name>", "Target package name to search").option("--symbol <name>", "Optional specific vulnerable function or export symbol to check").option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--output-format <format>", "Output format: text|json", "text").action(
     async (opts) => {
       validateOutputFormat(
@@ -931,12 +1141,19 @@ function createProgram() {
     );
     await runDiffAudit(opts);
   });
+  program.command("triage [input]").description("Interactively triage discovered vulnerabilities step-by-step").option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager).option("--patches-dir <path>", OPTION_DESCRIPTIONS.patchesDir).option("--format <format>", OPTION_DESCRIPTIONS.format, "auto").option("--run-tests", OPTION_DESCRIPTIONS.runTests, false).option("--policy <path>", OPTION_DESCRIPTIONS.policy).action(async (inputArg, opts) => {
+    await runInteractiveTriage(inputArg ? inputArg : opts, opts);
+  });
   addSharedOptions(
     program.argument("[target]", "Scanner output file path (or CVE ID fallback)").option("--format <type>", OPTION_DESCRIPTIONS.format, "auto").option("--summary-file <path>", "Write machine-readable scan summary JSON to path"),
     true
   ).action(async (target, opts) => {
     validateSharedCommandOptions(opts);
     validateOutputFormat(opts.outputFormat, ["text", "json", "sarif"], "default");
+    if (opts.interactive) {
+      await runInteractiveTriage(opts.input ?? target ?? opts, opts);
+      return;
+    }
     if (opts.audit) {
       await runScanInput(opts.input ?? target ?? "", opts);
       return;