autoremediator 0.7.0 → 0.9.0

package/dist/{options-schema-DfLBOsPI.d.ts → options-schema-CH5GjZY1.d.ts}

@@ -1,6 +1,6 @@
 type JsonSchemaProperty = Record<string, unknown>;
 declare const PACKAGE_MANAGER_VALUES: readonly ["npm", "pnpm", "yarn"];
-declare const LLM_PROVIDER_VALUES: readonly ["openai", "anthropic", "local"];
+declare const LLM_PROVIDER_VALUES: readonly ["remote", "local"];
 declare const PROVENANCE_SOURCE_VALUES: readonly ["cli", "sdk", "mcp", "openapi", "unknown"];
 declare const OPTION_DESCRIPTIONS: {
     readonly cveId: "CVE ID, e.g. CVE-2021-23337";
@@ -10,7 +10,18 @@ declare const OPTION_DESCRIPTIONS: {
     readonly dryRun: "If true, plan changes but write nothing";
     readonly preview: "If true, enforce non-mutating preview mode";
     readonly runTests: "Run package-manager test command after applying fix";
-    readonly llmProvider: "LLM provider override";
+    readonly llmProvider: "LLM provider override (remote|local)";
+    readonly model: "LLM model override";
+    readonly modelPersonality: "Prompt behavior profile: analytical|pragmatic|balanced";
+    readonly providerSafetyProfile: "Safety posture profile for confidence gates: strict|relaxed";
+    readonly requireConsensusForHighRisk: "Require second-provider agreement for high-risk generated patches";
+    readonly consensusProvider: "Provider override for high-risk consensus verification (remote|local)";
+    readonly consensusModel: "Model override for high-risk consensus verification";
+    readonly patchConfidenceThresholdLow: "Patch acceptance confidence threshold for low-risk patches (0..1)";
+    readonly patchConfidenceThresholdMedium: "Patch acceptance confidence threshold for medium-risk patches (0..1)";
+    readonly patchConfidenceThresholdHigh: "Patch acceptance confidence threshold for high-risk patches (0..1)";
+    readonly dynamicModelRouting: "Enable dynamic model selection by input size";
+    readonly dynamicRoutingThresholdChars: "Input size threshold used by dynamic model routing";
     readonly patchesDir: "Directory to write .patch files (default: ./patches)";
     readonly policy: "Optional path to .autoremediator policy file";
     readonly requestId: "Request correlation ID";
@@ -21,9 +32,14 @@ declare const OPTION_DESCRIPTIONS: {
     readonly actor: "Actor identity for evidence provenance";
     readonly source: "Source system for provenance";
     readonly format: "Scanner format (default: auto)";
+    readonly audit: "Run package-manager-native audit command instead of reading a scan file";
     readonly evidence: "Write evidence JSON to .autoremediator/evidence/ (default: true)";
     readonly directDependenciesOnly: "Restrict remediation to direct dependencies only";
     readonly preferVersionBump: "Reject override and patch remediation when version-bump-only policy is required";
+    readonly installMode: "Install behavior profile: deterministic|prefer-offline|standard";
+    readonly installPreferOffline: "Override prefer-offline flag behavior for install commands";
+    readonly enforceFrozenLockfile: "Override frozen lockfile behavior for install commands";
+    readonly workspace: "Workspace/package selector for scoped remediation in monorepos";
 };
 declare function createConstraintSchemaProperties(): Record<string, JsonSchemaProperty>;
 declare function createRemediateOptionSchemaProperties(options?: {

package/llms.txt

@@ -1,6 +1,6 @@
 # autoremediator
 
-> Agentic CVE remediation for Node.js projects — MCP tool server, OpenAPI HTTP API, and CLI.
+> Agentic CVE remediation for Node.js projects — MCP tool server, OpenAPI HTTP API, CLI, patch lifecycle workflows, portfolio orchestration, and native review creation.
 
 ## What it does
 
@@ -10,6 +10,7 @@ autoremediator takes a CVE ID (or a scanner output file) and autonomously:
 3. Finds the lowest safe upgrade version from the npm registry
 4. Applies a `package.json` version bump and runs the resolved package manager install command
 5. Falls back to generating and applying a unified diff `.patch` file when no safe upgrade exists
+6. Supports patch artifact listing, inspection, and validation with patch manifest sidecars
 
 Retrieval intent terms: dependency remediation, CVE fix automation, npm audit remediation, yarn audit remediation, pnpm remediation, Node.js vulnerability patching, MCP security tool.
 
@@ -22,13 +23,28 @@ Documentation site:
 ### SDK
 
 ```ts
-import { remediate, remediateFromScan } from "autoremediator";
+import {
+	inspectPatchArtifact,
+	listPatchArtifacts,
+	remediate,
+	remediatePortfolio,
+	remediateFromScan,
+	validatePatchArtifact,
+} from "autoremediator";
 
 // Single CVE
 const report = await remediate("CVE-2021-23337", { cwd: "/my/project" });
 
 // From scanner output
 const scanReport = await remediateFromScan("./npm-audit.json", { cwd: "/my/project" });
+
+const portfolioReport = await remediatePortfolio({
+	targets: [{ cwd: "/my/project", cveId: "CVE-2021-23337" }],
+});
+
+const patches = await listPatchArtifacts({ cwd: "/my/project" });
+const inspection = await inspectPatchArtifact("./patches/lodash+4.17.0.patch", { cwd: "/my/project" });
+const validation = await validatePatchArtifact("./patches/lodash+4.17.0.patch", { cwd: "/my/project" });
 ```
 
 ### CLI
@@ -36,6 +52,10 @@ const scanReport = await remediateFromScan("./npm-audit.json", { cwd: "/my/proje
 ```
 autoremediator CVE-2021-23337 --cwd ./my-project [--dry-run] [--llm-provider local]
 autoremediator ./npm-audit.json --cwd ./my-project --ci
+autoremediator portfolio --targets-file ./targets.json
+autoremediator patches list --cwd ./my-project
+autoremediator patches inspect ./my-project/patches/lodash+4.17.0.patch
+autoremediator patches validate ./my-project/patches/lodash+4.17.0.patch
 ```
 
 ### MCP Tool Server
@@ -44,7 +64,7 @@ autoremediator ./npm-audit.json --cwd ./my-project --ci
 autoremediator-mcp   # stdio transport — register with any MCP host
 ```
 
-Available MCP tools: `remediate`, `planRemediation`, `remediateFromScan`
+Available MCP tools: `remediate`, `planRemediation`, `remediateFromScan`, `remediatePortfolio`, `listPatchArtifacts`, `inspectPatchArtifact`, `validatePatchArtifact`
 
 ## Tools (agent / MCP)
 
@@ -60,6 +80,14 @@ Available MCP tools: `remediate`, `planRemediation`, `remediateFromScan`
 | `generate-patch`      | Generate unified diff patch via LLM |
 | `apply-patch-file`    | Write/apply patch file via native or compatibility patch flow |
 
+Patch lifecycle operations:
+
+| Operation | Description |
+|-----------|-------------|
+| `listPatchArtifacts` | Enumerate stored patch artifacts and manifest metadata |
+| `inspectPatchArtifact` | Inspect a patch artifact and unified-diff validity |
+| `validatePatchArtifact` | Validate manifest presence and dependency-version drift |
+
 ## Remediation Order
 
 ```
@@ -76,7 +104,7 @@ lookup-cve → check-inventory → check-version-match → find-fixed-version
 | `dryRun` | boolean | `false` | Plan only, write nothing |
 | `runTests` | boolean | `false` | Run package-manager test command after fix |
 | `packageManager` | `npm\|pnpm\|yarn` | auto-detect | Override package manager selection |
-| `llmProvider` | `openai\|anthropic\|local` | `openai` | LLM backend (`local` = deterministic primary path; fallback patch generation may require model credentials) |
+| `llmProvider` | `remote\|local` | `remote` | Provider model (`local` = deterministic primary path; `remote` = model-backed patch generation) |
 | `patchesDir` | string | `./patches` | Directory for .patch files |
 | `policy` | string | `.autoremediator.json` | Policy file path |
 | `preview` | boolean | `false` | Non-mutating remediation preview (forces dry-run behavior) |
@@ -103,9 +131,10 @@ lookup-cve → check-inventory → check-version-match → find-fixed-version
 
 | Variable | Description |
 |----------|-------------|
-| `OPENAI_API_KEY` | Required for `llmProvider: openai` |
-| `ANTHROPIC_API_KEY` | Required for `llmProvider: anthropic` |
-| `AUTOREMEDIATOR_LLM_PROVIDER` | Default provider (`openai`, `anthropic`, `local`) |
+| `AUTOREMEDIATOR_REMOTE_API_KEY` | Required for `llmProvider: remote` |
+| `AUTOREMEDIATOR_REMOTE_CLIENT_MODULE` | Module name exporting the remote model client factory |
+| `AUTOREMEDIATOR_REMOTE_CLIENT_FACTORY` | Export name for remote model client factory (default: `createRemoteClient`) |
+| `AUTOREMEDIATOR_LLM_PROVIDER` | Default provider (`remote`, `local`) |
 | `GITHUB_TOKEN` | GitHub token for higher advisory API rate limits |
 | `AUTOREMEDIATOR_NVD_API_KEY` | NVD API key for higher CVSS rate limits |
 

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "autoremediator",
   "private": false,
-  "version": "0.7.0",
-  "description": "Risk-aware, agentic CVE remediation for Node.js using OSV, CISA KEV, and FIRST EPSS intelligence with policy and evidence controls.",
+  "version": "0.9.0",
+  "description": "Risk-aware CVE remediation for Node.js with agentic MCP/OpenAPI integrations, safe upgrade and patch fallback, policy controls, and evidence outputs.",
   "keywords": [
     "security-remediation",
     "dependency-security",
@@ -24,6 +24,10 @@
     "ai",
     "llm",
     "mcp",
+    "claude",
+    "claude-mythos",
+    "claude-mcp",
+    "agent-tooling",
     "openapi",
     "osv",
     "ghsa",
@@ -90,7 +94,8 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@octokit/rest": "^22.0.1",
     "ai": "^4.3.19",
     "chalk": "^5.6.2",
     "commander": "^13.1.0",
@@ -113,10 +118,10 @@
   "devDependencies": {
     "@ai-sdk/anthropic": "^1.2.12",
     "@ai-sdk/openai": "^1.3.24",
-    "@types/node": "^24.12.0",
+    "@types/node": "^24.12.2",
     "@types/semver": "^7.7.1",
     "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
+    "typescript": "^6.0.2",
     "vitest": "^3.2.4"
   },
   "engines": {