dependfix 0.0.0 → 0.1.0

package/dist/cli.mjs

@@ -0,0 +1,2530 @@
+import { defineCommand, parseArgs } from "citty";
+import { AppError, createEmptyRunSummary, createLogger, filterAlerts, generateJsonReport, generateMarkdownReport, isValidRepoIdentifier, limitAlerts, prioritizeAlerts, toAppError, toErrorMessage, writeReport } from "@dependfix/core";
+import { Octokit } from "@octokit/rest";
+import { execSync, spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createInterface } from "node:readline";
+import YAML from "yaml";
+
+//#region \0rolldown/runtime.js
+var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+
+//#endregion
+//#region src/github/client.ts
+/**
+* 创建已认证的 Octokit 实例。
+*
+* 调用方直接使用 `octokit.rest.*` 访问所有已类型化的 GitHub REST API。
+* 分页使用 `octokit.paginate()` 自动合并多页结果。
+*
+* @example
+* ```typescript
+* const octokit = createGitHubClient({ token: 'ghp_xxxx' })
+*
+* // 仓库信息
+* const { data: repo } = await octokit.rest.repos.get({ owner: 'foo', repo: 'bar' })
+*
+* // Dependabot 告警（自动分页）
+* const alerts = await octokit.paginate(
+*     octokit.rest.dependabot.listAlertsForRepo,
+*     { owner: 'foo', repo: 'bar', state: 'open', per_page: 100 },
+* )
+* ```
+*/
+function createGitHubClient(options) {
+	return new Octokit({
+		auth: options.token,
+		baseUrl: options.baseUrl ?? "https://api.github.com"
+	});
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/deprecation@2.3.1/node_modules/deprecation/dist-node/index.js
+var require_dist_node$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	var Deprecation = class extends Error {
+		constructor(message) {
+			super(message);
+			/* istanbul ignore next */
+			if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
+			this.name = "Deprecation";
+		}
+	};
+	exports.Deprecation = Deprecation;
+}));
+
+//#endregion
+//#region ../../node_modules/.pnpm/wrappy@1.0.2/node_modules/wrappy/wrappy.js
+var require_wrappy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = wrappy;
+	function wrappy(fn, cb) {
+		if (fn && cb) return wrappy(fn)(cb);
+		if (typeof fn !== "function") throw new TypeError("need wrapper function");
+		Object.keys(fn).forEach(function(k) {
+			wrapper[k] = fn[k];
+		});
+		return wrapper;
+		function wrapper() {
+			var args = new Array(arguments.length);
+			for (var i = 0; i < args.length; i++) args[i] = arguments[i];
+			var ret = fn.apply(this, args);
+			var cb = args[args.length - 1];
+			if (typeof ret === "function" && ret !== cb) Object.keys(cb).forEach(function(k) {
+				ret[k] = cb[k];
+			});
+			return ret;
+		}
+	}
+}));
+
+//#endregion
+//#region ../../node_modules/.pnpm/once@1.4.0/node_modules/once/once.js
+var require_once = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var wrappy = require_wrappy();
+	module.exports = wrappy(once);
+	module.exports.strict = wrappy(onceStrict);
+	once.proto = once(function() {
+		Object.defineProperty(Function.prototype, "once", {
+			value: function() {
+				return once(this);
+			},
+			configurable: true
+		});
+		Object.defineProperty(Function.prototype, "onceStrict", {
+			value: function() {
+				return onceStrict(this);
+			},
+			configurable: true
+		});
+	});
+	function once(fn) {
+		var f = function() {
+			if (f.called) return f.value;
+			f.called = true;
+			return f.value = fn.apply(this, arguments);
+		};
+		f.called = false;
+		return f;
+	}
+	function onceStrict(fn) {
+		var f = function() {
+			if (f.called) throw new Error(f.onceError);
+			f.called = true;
+			return f.value = fn.apply(this, arguments);
+		};
+		f.onceError = (fn.name || "Function wrapped with `once`") + " shouldn't be called more than once";
+		f.called = false;
+		return f;
+	}
+}));
+
+//#endregion
+//#region ../../node_modules/.pnpm/@octokit+request-error@5.1.1/node_modules/@octokit/request-error/dist-node/index.js
+var require_dist_node = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var __create = Object.create;
+	var __defProp = Object.defineProperty;
+	var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+	var __getOwnPropNames = Object.getOwnPropertyNames;
+	var __getProtoOf = Object.getPrototypeOf;
+	var __hasOwnProp = Object.prototype.hasOwnProperty;
+	var __export = (target, all) => {
+		for (var name in all) __defProp(target, name, {
+			get: all[name],
+			enumerable: true
+		});
+	};
+	var __copyProps = (to, from, except, desc) => {
+		if (from && typeof from === "object" || typeof from === "function") {
+			for (let key of __getOwnPropNames(from)) if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+				get: () => from[key],
+				enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+			});
+		}
+		return to;
+	};
+	var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+		value: mod,
+		enumerable: true
+	}) : target, mod));
+	var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+	var dist_src_exports = {};
+	__export(dist_src_exports, { RequestError: () => RequestError });
+	module.exports = __toCommonJS(dist_src_exports);
+	var import_deprecation = require_dist_node$1();
+	var import_once = __toESM(require_once());
+	var logOnceCode = (0, import_once.default)((deprecation) => console.warn(deprecation));
+	var logOnceHeaders = (0, import_once.default)((deprecation) => console.warn(deprecation));
+	var RequestError = class extends Error {
+		constructor(message, statusCode, options) {
+			super(message);
+			if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
+			this.name = "HttpError";
+			this.status = statusCode;
+			let headers;
+			if ("headers" in options && typeof options.headers !== "undefined") headers = options.headers;
+			if ("response" in options) {
+				this.response = options.response;
+				headers = options.response.headers;
+			}
+			const requestCopy = Object.assign({}, options.request);
+			if (options.request.headers.authorization) requestCopy.headers = Object.assign({}, options.request.headers, { authorization: options.request.headers.authorization.replace(/(?<! ) .*$/, " [REDACTED]") });
+			requestCopy.url = requestCopy.url.replace(/\bclient_secret=\w+/g, "client_secret=[REDACTED]").replace(/\baccess_token=\w+/g, "access_token=[REDACTED]");
+			this.request = requestCopy;
+			Object.defineProperty(this, "code", { get() {
+				logOnceCode(new import_deprecation.Deprecation("[@octokit/request-error] `error.code` is deprecated, use `error.status`."));
+				return statusCode;
+			} });
+			Object.defineProperty(this, "headers", { get() {
+				logOnceHeaders(new import_deprecation.Deprecation("[@octokit/request-error] `error.headers` is deprecated, use `error.response.headers`."));
+				return headers || {};
+			} });
+		}
+	};
+}));
+
+//#endregion
+//#region src/github/errors.ts
+var import_dist_node = require_dist_node();
+/**
+* 将 Octokit 请求错误映射为 `AppError`。
+*
+* @param error   - 原始错误（`RequestError` 或网络异常）
+* @param context - 调用上下文描述（如 `'fetch repo info for foo/bar'`），会附加到错误消息中
+*/
+function mapGitHubError(error, context) {
+	if (error instanceof import_dist_node.RequestError) {
+		const code = resolveErrorCode(error);
+		const details = collectErrorDetails(error);
+		return new AppError(code, `${context}: ${error.message}`, {
+			cause: error,
+			details
+		});
+	}
+	if (error instanceof Error) return new AppError("NETWORK_ERROR", `${context}: ${error.message}`, { cause: error });
+	return new AppError("NETWORK_ERROR", `${context}: unknown error`, { details: { raw: toErrorMessage(error) } });
+}
+function resolveErrorCode(error) {
+	switch (error.status) {
+		case 401: return "AUTHENTICATION_FAILED";
+		case 403: {
+			const remaining = error.response?.headers["x-ratelimit-remaining"];
+			if (remaining !== void 0 && remaining === "0") return "RATE_LIMITED";
+			return "PERMISSION_DENIED";
+		}
+		case 404: return "REPO_NOT_FOUND";
+		default: return "GITHUB_API_ERROR";
+	}
+}
+function collectErrorDetails(error) {
+	const details = {
+		status: error.status,
+		requestUrl: error.request?.url,
+		requestMethod: error.request?.method
+	};
+	const resetAt = error.response?.headers["x-ratelimit-reset"];
+	if (resetAt) details.rateLimitReset = resetAt;
+	return details;
+}
+
+//#endregion
+//#region src/github/dependabot-fetcher.ts
+/**
+* 拉取指定仓库的 Dependabot 告警并映射为标准化模型。
+*
+* - 自动分页（`octokit.paginate()`），返回所有匹配的告警
+* - 仅处理 `state=open` 的告警（可通过 `params.state` 覆盖）
+* - 异常通过 `mapGitHubError` 转为 `AppError`
+* - 空仓库返回 `[]`，不抛异常
+*
+* @param client - 已认证的 Octokit 实例（来自 `createGitHubClient`）
+* @param params - 仓库标识与过滤参数
+* @returns 标准化告警列表
+*
+* @example
+* ```typescript
+* const octokit = createGitHubClient({ token: 'ghp_xxxx' })
+* const alerts = await fetchDependabotAlerts(octokit, { owner: 'foo', repo: 'bar' })
+* ```
+*/
+async function fetchDependabotAlerts(client, params) {
+	const { owner, repo, state = "open", perPage = 100 } = params;
+	try {
+		return (await client.paginate(client.rest.dependabot.listAlertsForRepo, {
+			owner,
+			repo,
+			state,
+			per_page: perPage
+		})).map((alert) => normalizeAlert(alert, owner, repo));
+	} catch (error) {
+		throw mapGitHubError(error, `fetch dependabot alerts for ${owner}/${repo}`);
+	}
+}
+/**
+* 将单条 Dependabot API 原始告警转换为标准化模型。
+*
+* 映射逻辑：
+* - severity 直接透传（Dependabot 的 `low|medium|high|critical` 与 `AlertSeverity` 对齐）
+* - fixable 判定：`security_vulnerability.first_patched_version !== null`
+* - fixStrategy：有修复版本 → `'upgrade'`，否则 `null`
+* - recommendedVersion 取自 `first_patched_version.identifier`
+* - 可选字段兜底：`packageName`/`packageEcosystem` → `'unknown'`，`manifestPath` → `''`
+* - `defaultBranch` 不在此层填充（由上层调用方获取后注入）
+*/
+function normalizeAlert(alert, owner, repo) {
+	const firstPatched = alert.security_vulnerability.first_patched_version;
+	const fixable = firstPatched !== null;
+	return {
+		id: alert.number,
+		source: "dependabot",
+		repository: `${owner}/${repo}`,
+		defaultBranch: "",
+		severity: alert.security_advisory.severity,
+		packageEcosystem: alert.dependency.package?.ecosystem ?? "unknown",
+		packageName: alert.dependency.package?.name ?? "unknown",
+		manifestPath: alert.dependency.manifest_path ?? "",
+		ruleId: alert.security_advisory.ghsa_id,
+		summary: alert.security_advisory.summary,
+		htmlUrl: alert.html_url,
+		fixable,
+		fixStrategy: fixable ? "upgrade" : null,
+		recommendedVersion: firstPatched?.identifier ?? "",
+		dependencyType: normalizeDependencyRelationship(alert.dependency.relationship)
+	};
+}
+/**
+* 将 Dependabot API 的 `dependency.relationship` 映射为 `DependencyType`。
+*
+* GitHub API 返回的合法值:
+* - `'direct'`    → 直接依赖
+* - `'indirect'`  → 间接依赖（transitive）
+* - `null`/`undefined` → 未知
+*/
+function normalizeDependencyRelationship(relationship) {
+	if (relationship === "direct") return "direct";
+	if (relationship === "indirect") return "transitive";
+}
+
+//#endregion
+//#region src/github/pr-creator.ts
+const BOT_NAME = "dependfix[bot]";
+const BOT_EMAIL = "dependfix[bot]@users.noreply.github.com";
+/** 自动修复分支统一前缀（T210 起分支名 = 前缀 + 内容指纹 8 位） */
+const BRANCH_PREFIX = "dependfix/auto-fix-";
+/**
+* 计算修复内容指纹（sha256 前 8 位）。
+*
+* 指纹基于**结构化修复结果**而非 git diff：
+* - 成功升级集：`pkg@toVersion`（排序拼接）
+* - 修复失败集：失败包名（排序拼接）
+* - lockfile 修复状态（成功/失败）
+*
+* 同告警集 → 同修复结果 → 同指纹 → 幂等跳过；
+* 内容变化（升级集/失败集/锁文件修复变化）→ 指纹变化 → 关旧开新。
+* 不用 diff hash 是因为 pnpm 版本等非确定性因素会使锁文件内容漂移，
+* 导致"告警没变但指纹变"。
+*/
+function computeFixFingerprint(actions) {
+	const isUpgrade = (a) => a.type === "dependency-upgrade" && !!a.target && !a.target.startsWith("PR #");
+	const upgrades = actions.filter((a) => isUpgrade(a) && a.success && a.toVersion).map((a) => `${a.target}@${a.toVersion}`).sort();
+	const failures = actions.filter((a) => isUpgrade(a) && !a.success).map((a) => a.target).sort();
+	const repairs = actions.filter((a) => a.type === "lockfile-repair").map((a) => `${a.target}:${a.success}`).sort();
+	const payload = JSON.stringify([
+		upgrades,
+		failures,
+		repairs
+	]);
+	return createHash("sha256").update(payload).digest("hex").slice(0, 8);
+}
+/**
+* 从分支名提取内容指纹（`dependfix/auto-fix-{fp8}` → `{fp8}`）。
+* 指纹格式为 8 位 hex；分支名不含 `-` 后的内容、前缀不匹配或格式不合法时返回 null
+* （如旧版 runId 分支，会被 supersede）。
+*/
+function extractFingerprintFromBranch(branchName) {
+	if (!branchName.startsWith(BRANCH_PREFIX)) return null;
+	const fingerprint = branchName.slice(19);
+	return /^[0-9a-f]{8}$/.test(fingerprint) ? fingerprint : null;
+}
+/**
+* 计算 fix-and-pr 去重决策：
+* - 存在同指纹 open PR → skip（仅需关闭其余异指纹 PR）
+* - 否则 → create（关闭全部旧 PR，先建新后关旧由调用方保证）
+*/
+function computeFixAndPrPlan(existingPRs, fingerprint) {
+	const sameContentPR = existingPRs.find((pr) => extractFingerprintFromBranch(pr.headRef) === fingerprint);
+	if (sameContentPR) return {
+		action: "skip",
+		sameContentPR,
+		supersedePRs: existingPRs.filter((pr) => pr !== sameContentPR)
+	};
+	return {
+		action: "create",
+		supersedePRs: existingPRs
+	};
+}
+/**
+* 在工作目录创建修复分支。
+*
+* - 分支名由调用方传入（T210 起为 `dependfix/auto-fix-{内容指纹}`，不再依赖 runId）
+* - 如果分支已存在（如重跑），切换到该分支
+*
+* @returns 分支名和是否为新创建
+*/
+function createFixBranch(branchName, workDir) {
+	if (branchExists(branchName, workDir)) {
+		execSync(`git checkout ${branchName}`, {
+			cwd: workDir,
+			stdio: "pipe"
+		});
+		return {
+			branchName,
+			created: false
+		};
+	}
+	execSync(`git checkout -b ${branchName}`, {
+		cwd: workDir,
+		stdio: "pipe"
+	});
+	return {
+		branchName,
+		created: true
+	};
+}
+/**
+* 暂存所有变更并提交。
+* 自动设置 git user.name / user.email（如未设置）。
+*/
+function stageAndCommit(message, workDir) {
+	ensureGitConfig(workDir);
+	execSync("git add .", {
+		cwd: workDir,
+		stdio: "pipe"
+	});
+	execSync(`git commit -m "${escapeShell(message)}"`, {
+		cwd: workDir,
+		stdio: "pipe"
+	});
+}
+/**
+* 推送分支到远程 origin。
+*/
+function pushBranch(branchName, workDir) {
+	execSync(`git push origin ${branchName}`, {
+		cwd: workDir,
+		stdio: "pipe"
+	});
+}
+/**
+* 查找目标仓库中所有 open 状态的 dependfix 自动修复 PR。
+*
+* GitHub 的 `pulls.list` 的 `head` 参数不支持通配符，因此拉取 open PR 列表后
+* 按 head 分支前缀 `dependfix/auto-fix-` 过滤。假设 PR 数量不多（单页 100 足够），
+* 未来 PR 数量增大时可引入 label 索引（见 backlog B1）。
+*/
+async function findDependfixOpenPR(octokit, owner, repo) {
+	const { data } = await octokit.rest.pulls.list({
+		owner,
+		repo,
+		state: "open",
+		per_page: 100
+	});
+	return data.filter((pr) => pr.head.ref.startsWith(BRANCH_PREFIX)).map((pr) => ({
+		number: pr.number,
+		htmlUrl: pr.html_url,
+		headRef: pr.head.ref
+	}));
+}
+/**
+* 关闭 Pull Request（用于 supersede 旧 PR）。
+*/
+async function closePullRequest(octokit, owner, repo, pullNumber) {
+	await octokit.rest.pulls.update({
+		owner,
+		repo,
+		pull_number: pullNumber,
+		state: "closed"
+	});
+}
+/**
+* 通过 GitHub API 创建 Pull Request。
+*/
+async function createPullRequest(params) {
+	const { octokit, owner, repo, headBranch, baseBranch, title, body } = params;
+	const { data } = await octokit.rest.pulls.create({
+		owner,
+		repo,
+		title,
+		body,
+		head: headBranch,
+		base: baseBranch
+	});
+	return {
+		number: data.number,
+		htmlUrl: data.html_url
+	};
+}
+/**
+* 列出远端所有 `dependfix/` 前缀分支（git.listMatchingRefs 精确前缀匹配）。
+*/
+async function listDependfixBranches(octokit, owner, repo) {
+	const { data } = await octokit.rest.git.listMatchingRefs({
+		owner,
+		repo,
+		ref: "heads/dependfix",
+		per_page: 100
+	});
+	return data.map((ref) => ref.ref.replace(/^refs\/heads\//, "")).filter((name) => name.startsWith("dependfix/"));
+}
+/**
+* 查询分支对应的最近 PR 状态（pulls.list head 精确匹配，按最近更新取 1 条）。
+*/
+async function getBranchPrStatus(octokit, owner, repo, branch) {
+	const { data } = await octokit.rest.pulls.list({
+		owner,
+		repo,
+		head: `${owner}:${branch}`,
+		state: "all",
+		sort: "updated",
+		direction: "desc",
+		per_page: 1
+	});
+	const pr = data[0];
+	if (!pr) return {
+		branch,
+		prNumber: null,
+		merged: false,
+		closed: false
+	};
+	return {
+		branch,
+		prNumber: pr.number,
+		merged: pr.state === "closed" && pr.merged_at !== null,
+		closed: pr.state === "closed"
+	};
+}
+/**
+* 删除远端分支（git ref delete）。失败（分支保护、不存在）由调用方捕获处理。
+*/
+async function deleteRemoteBranch(octokit, owner, repo, branch) {
+	await octokit.rest.git.deleteRef({
+		owner,
+		repo,
+		ref: `heads/${branch}`
+	});
+}
+/**
+* 判定交互确认回答是否为"是"（y/yes，大小写不敏感；空输入默认拒绝）。
+*/
+function isConfirmAnswer(answer) {
+	return /^y(es)?$/i.test(answer.trim());
+}
+/**
+* 从 RunResult 生成 PR body（Markdown）。
+*
+* @param supersededNumbers 被本 PR 取代并已关闭的旧 PR 编号列表（用于 Supersedes 声明）
+*/
+function generatePRBody(result, supersededNumbers) {
+	const { summary, actions, errors } = result;
+	const lines = [
+		"## 🔒 Dependfix Auto Fix",
+		"",
+		`**Run ID**: \`${result.runId}\``,
+		`**Mode**: ${result.config.mode}`,
+		`**Time**: ${result.startedAt}`,
+		"",
+		"### 📊 Summary",
+		"",
+		"| Metric | Value |",
+		"|--------|-------|",
+		`| Repositories scanned | ${summary.repositoriesScanned} |`,
+		`| Alerts found | ${summary.alertsFound} |`,
+		`| Alerts fixable | ${summary.alertsFixable} |`,
+		`| Dependencies upgraded | ${summary.alertsFixed} |`,
+		`| Upgrades failed | ${summary.alertsFailed} |`,
+		`| Lockfile repairs | ${summary.lockfileRepairs} |`,
+		`| Verifications passed | ${summary.verificationsPassed} |`,
+		`| Verifications failed | ${summary.verificationsFailed} |`,
+		""
+	];
+	const upgrades = actions.filter((a) => a.type === "dependency-upgrade" && a.success);
+	if (upgrades.length > 0) {
+		lines.push("### 📦 Upgraded Dependencies", "");
+		lines.push("| Package | From | To | Major |");
+		lines.push("|---------|------|----|-------|");
+		for (const a of upgrades) {
+			const major = a.isMajor ? "⚠️ Yes" : "No";
+			lines.push(`| \`${a.target}\` | ${a.fromVersion ?? "-"} | ${a.toVersion ?? "-"} | ${major} |`);
+		}
+		lines.push("");
+	}
+	const failures = actions.filter((a) => a.type === "dependency-upgrade" && !a.success);
+	if (failures.length > 0) {
+		lines.push("### ⚠️ Failed Upgrades", "");
+		for (const a of failures) lines.push(`- **\`${a.target}\`**: ${a.error ?? "unknown error"}`);
+		lines.push("");
+	}
+	const verifications = actions.filter((a) => a.type === "verification");
+	if (verifications.length > 0) {
+		lines.push("### ✅ Verification", "");
+		for (const v of verifications) {
+			const icon = v.success ? "✅" : "❌";
+			lines.push(`- ${icon} \`${v.target}\` ${v.error ? `(${v.error})` : ""}`);
+		}
+		lines.push("");
+	}
+	if (errors.length > 0) {
+		lines.push("### 🚨 Errors", "");
+		for (const e of errors) lines.push(`- **${e.stage}**: ${e.message}`);
+		lines.push("");
+	}
+	lines.push("---", "", "*This PR was automatically created by [dependfix](https://github.com/dependfix/dependfix).*");
+	if (supersededNumbers && supersededNumbers.length > 0) lines.push("", `> **Supersedes**: ${supersededNumbers.map((n) => `#${n}`).join(", ")}（内容已更新，将取代旧 PR）`);
+	return lines.join("\n");
+}
+function branchExists(branchName, workDir) {
+	try {
+		execSync(`git rev-parse --verify ${branchName}`, {
+			cwd: workDir,
+			stdio: "pipe"
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+function ensureGitConfig(workDir) {
+	const hasName = gitConfigExists("user.name", workDir);
+	const hasEmail = gitConfigExists("user.email", workDir);
+	if (!hasName) execSync(`git config user.name "${BOT_NAME}"`, {
+		cwd: workDir,
+		stdio: "pipe"
+	});
+	if (!hasEmail) execSync(`git config user.email "${BOT_EMAIL}"`, {
+		cwd: workDir,
+		stdio: "pipe"
+	});
+}
+function gitConfigExists(key, workDir) {
+	try {
+		execSync(`git config ${key}`, {
+			cwd: workDir,
+			stdio: "pipe"
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+function escapeShell(str) {
+	return str.replace(/"/g, "\\\"");
+}
+
+//#endregion
+//#region src/fixers/dependency/index.ts
+/**
+* 升级单个依赖到指定版本。
+*
+* - 在 `workDir` 中查找 `package.json` 并修改目标包的版本声明（保留原始前缀）
+* - 执行 `pnpm install --no-frozen-lockfile` 更新 lockfile
+* - 失败时自动回滚 `package.json` 和 `pnpm-lock.yaml`
+* - 不执行验证（由 T107 负责）
+*
+* @param params - 包名、目标版本、工作目录
+* @returns 修复结果
+*/
+async function upgradeDependency(params) {
+	const { packageName, targetVersion, workDir } = params;
+	const pkgPath = join(workDir, "package.json");
+	const lockfilePath = join(workDir, "pnpm-lock.yaml");
+	if (!existsSync(pkgPath)) return failResult(packageName, targetVersion, "", `${pkgPath}: file not found`);
+	let pkg;
+	try {
+		pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+	} catch {
+		return failResult(packageName, targetVersion, "", `${pkgPath}: invalid JSON`);
+	}
+	const dep = findDependencyVersion(pkg, packageName);
+	if (!dep) return failResult(packageName, targetVersion, "", `package "${packageName}" not found in dependencies / devDependencies / optionalDependencies`);
+	const fromVersion = dep.version;
+	const toVersion = `${extractPrefix(fromVersion)}${targetVersion}`;
+	const isMajor = parseMajorVersion(fromVersion) !== parseMajorVersion(toVersion) && parseMajorVersion(fromVersion) !== -1 && parseMajorVersion(toVersion) !== -1;
+	const pkgBackup = `${pkgPath}.bak`;
+	const lockBackup = `${lockfilePath}.bak`;
+	try {
+		copyFileSync(pkgPath, pkgBackup);
+		if (existsSync(lockfilePath)) copyFileSync(lockfilePath, lockBackup);
+	} catch {
+		return failResult(packageName, targetVersion, fromVersion, "failed to create backup files");
+	}
+	const deps = pkg[dep.group];
+	if (!deps) return failResult(packageName, targetVersion, fromVersion, `dependency group "${dep.group}" is missing`);
+	deps[packageName] = toVersion;
+	writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`, "utf-8");
+	try {
+		await execPnpmInstall(workDir);
+	} catch (installErr) {
+		rollback$1(pkgPath, pkgBackup, lockfilePath, lockBackup);
+		cleanupBackups({
+			pkgBackup,
+			lockBackup
+		});
+		return {
+			packageName,
+			fromVersion,
+			toVersion,
+			isMajor,
+			success: false,
+			error: `pnpm install failed: ${getStderr(installErr)}`
+		};
+	}
+	cleanupBackups({
+		pkgBackup,
+		lockBackup
+	});
+	return {
+		packageName,
+		fromVersion,
+		toVersion,
+		isMajor,
+		success: true
+	};
+}
+/**
+* 通过 pnpm `overrides` 升级间接（transitive）依赖。
+*
+* 间接依赖不在 `package.json` 的 `dependencies` / `devDependencies` 中列出，
+* 因此无法通过常规 `upgradeDependency` 处理。本函数根据项目类型选择覆盖写入位置：
+*
+* - **有 `pnpm-workspace.yaml`**（monorepo / workspace）→ 写入其中的 `overrides` 字段（pnpm v10+ 推荐）
+* - **无 `pnpm-workspace.yaml`**（单包项目）→ 写入 `package.json` 的 `pnpm.overrides`
+*
+* 失败时自动回滚被修改的文件和 `pnpm-lock.yaml`。不执行验证（由 T107 负责）。
+*
+* @param params - 包名、目标版本、工作目录
+* @returns 修复结果
+*/
+async function overrideTransitiveDependency(params) {
+	const { packageName, targetVersion, workDir } = params;
+	const pkgPath = join(workDir, "package.json");
+	const workspaceYamlPath = join(workDir, "pnpm-workspace.yaml");
+	const lockfilePath = join(workDir, "pnpm-lock.yaml");
+	const usesWorkspaceYaml = existsSync(workspaceYamlPath);
+	if (!existsSync(pkgPath)) return failResult(packageName, targetVersion, "", `${pkgPath}: file not found`);
+	let pkg;
+	try {
+		pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+	} catch {
+		return failResult(packageName, targetVersion, "", `${pkgPath}: invalid JSON`);
+	}
+	const directDep = findDependencyVersion(pkg, packageName);
+	if (directDep) return failResult(packageName, targetVersion, directDep.version, `package "${packageName}" is a direct dependency (${directDep.group}), use upgradeDependency instead`);
+	const fromVersion = readLockfileVersion(lockfilePath, packageName) ?? "unknown";
+	const toVersion = `${extractPrefix(fromVersion)}${targetVersion}`;
+	const isMajor = parseMajorVersion(fromVersion) !== parseMajorVersion(toVersion) && parseMajorVersion(fromVersion) !== -1 && parseMajorVersion(toVersion) !== -1;
+	const pkgBackup = `${pkgPath}.bak`;
+	const workspaceBackup = usesWorkspaceYaml ? `${workspaceYamlPath}.bak` : null;
+	const lockBackup = `${lockfilePath}.bak`;
+	try {
+		copyFileSync(pkgPath, pkgBackup);
+		if (usesWorkspaceYaml) copyFileSync(workspaceYamlPath, workspaceBackup);
+		if (existsSync(lockfilePath)) copyFileSync(lockfilePath, lockBackup);
+	} catch {
+		return failResult(packageName, targetVersion, fromVersion, "failed to create backup files");
+	}
+	let oldOverride;
+	if (usesWorkspaceYaml) oldOverride = writeWorkspaceOverride(workspaceYamlPath, packageName, toVersion);
+	else {
+		const overrides = ensurePnpmOverrides(pkg);
+		oldOverride = overrides[packageName];
+		overrides[packageName] = toVersion;
+		writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`, "utf-8");
+	}
+	try {
+		await execPnpmInstall(workDir);
+	} catch (installErr) {
+		rollbackOverrides({
+			usesWorkspaceYaml,
+			workspaceYamlPath,
+			packageName,
+			oldOverride,
+			pkg,
+			pkgPath
+		});
+		rollback$1(pkgPath, pkgBackup, lockfilePath, lockBackup);
+		if (usesWorkspaceYaml) rollback$1(workspaceYamlPath, workspaceBackup, lockfilePath, null);
+		cleanupBackups({
+			pkgBackup,
+			lockBackup,
+			workspaceBackup
+		});
+		return {
+			packageName,
+			fromVersion,
+			toVersion,
+			isMajor,
+			success: false,
+			error: `pnpm install failed: ${getStderr(installErr)}`
+		};
+	}
+	cleanupBackups({
+		pkgBackup,
+		lockBackup,
+		workspaceBackup
+	});
+	return {
+		packageName,
+		fromVersion,
+		toVersion,
+		isMajor,
+		success: true
+	};
+}
+/**
+* 从版本声明中提取前缀（^ / ~ / 空）。
+*
+* @example
+* extractPrefix('^4.17.20')  // '^'
+* extractPrefix('~4.17.0')   // '~'
+* extractPrefix('4.17.20')   // ''
+* extractPrefix('*')         // '^'  (默认)
+*/
+function extractPrefix(version) {
+	const trimmed = version.trim();
+	if (/^\d/.test(trimmed)) return "";
+	if (trimmed.startsWith("^")) return "^";
+	if (trimmed.startsWith("~")) return "~";
+	return "^";
+}
+/**
+* 从版本声明中提取主版本号（major）。
+* 去除前缀后匹配第一个 semver 段。
+*
+* @example
+* parseMajorVersion('^4.17.20')   // 4
+* parseMajorVersion('~2.0.0')     // 2
+* parseMajorVersion('1.2.3')      // 1
+* parseMajorVersion('*')          // -1
+*/
+function parseMajorVersion(version) {
+	const cleaned = version.replace(/^\s*[\^~>=<]*\s*/, "");
+	const match = /^(\d+)\.\d+\.\d+/.exec(cleaned);
+	return match ? Number.parseInt(match[1], 10) : -1;
+}
+/**
+* 在 `package.json` 的 `dependencies` / `devDependencies` / `optionalDependencies` 中按顺序查找包。
+*/
+function findDependencyVersion(pkg, packageName) {
+	for (const group of [
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies"
+	]) {
+		const deps = pkg[group];
+		if (deps && typeof deps === "object" && packageName in deps) return {
+			group,
+			version: deps[packageName]
+		};
+	}
+	return null;
+}
+/**
+* 确保 `package.json` 中存在 `pnpm.overrides` 对象，若不存在则创建。
+* 返回 `overrides` 对象的引用，调用方可直接写入。
+*/
+function ensurePnpmOverrides(pkg) {
+	if (!pkg.pnpm) pkg.pnpm = {};
+	if (!pkg.pnpm.overrides) pkg.pnpm.overrides = {};
+	return pkg.pnpm.overrides;
+}
+/**
+* 从 `pnpm-lock.yaml` 中读取指定包的当前锁定版本。
+* 通过简单的正则匹配查找，不解析完整 YAML（性能优先）。
+*
+* pnpm v9+ lockfile 格式（v9.0 起）:
+*   /package-name/version:
+*   /@scope/package-name/version:
+*
+* @returns 锁定版本字符串（如 `'5.0.0'`），未找到返回 `null`
+*/
+function readLockfileVersion(lockfilePath, packageName) {
+	if (!existsSync(lockfilePath)) return null;
+	try {
+		const content = readFileSync(lockfilePath, "utf-8");
+		const escapedName = escapeRegExp(packageName);
+		const match = new RegExp(`^/${escapedName}/(\\d+(?:\\.\\d+(?:\\.\\d+)?(?:-[a-zA-Z0-9.]+)?)):`, "m").exec(content);
+		return match ? match[1] : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* 转义正则表达式特殊字符。
+*/
+function escapeRegExp(str) {
+	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* 执行 `pnpm install --no-frozen-lockfile`。
+* 将同步 `execSync` 包装为 Promise，使上层 `upgradeDependency` 保持 async 语义。
+*/
+function execPnpmInstall(workDir) {
+	return new Promise((resolve, reject) => {
+		try {
+			execSync("pnpm install --no-frozen-lockfile", {
+				cwd: workDir,
+				encoding: "utf-8",
+				stdio: "pipe",
+				timeout: 12e4
+			});
+			resolve();
+		} catch (err) {
+			reject(err instanceof Error ? err : new Error(String(err)));
+		}
+	});
+}
+function failResult(packageName, targetVersion, fromVersion, error) {
+	return {
+		packageName,
+		fromVersion,
+		toVersion: targetVersion,
+		isMajor: false,
+		success: false,
+		error
+	};
+}
+function rollback$1(pkgPath, pkgBackup, lockfilePath, lockBackup) {
+	try {
+		if (existsSync(pkgBackup)) copyFileSync(pkgBackup, pkgPath);
+		if (lockBackup !== null && existsSync(lockBackup)) copyFileSync(lockBackup, lockfilePath);
+	} catch {}
+}
+/**
+* 安全删除备份文件，失败静默忽略。
+*/
+function safeUnlink(filePath) {
+	try {
+		if (existsSync(filePath)) unlinkSync(filePath);
+	} catch {}
+}
+/**
+* 清理所有备份文件。
+*/
+function cleanupBackups(paths) {
+	safeUnlink(paths.pkgBackup);
+	if (paths.lockBackup !== null) safeUnlink(paths.lockBackup);
+	if (paths.workspaceBackup) safeUnlink(paths.workspaceBackup);
+}
+/**
+* 在 `pnpm-workspace.yaml` 中写入一条 override。
+*
+* 读取现有 YAML → 设置 `overrides[packageName] = version` → 原样写回。
+*
+* @returns 写入前该包的旧值（`undefined` 表示原先不存在该 override）
+*/
+function writeWorkspaceOverride(workspaceYamlPath, packageName, version) {
+	let doc;
+	try {
+		const raw = readFileSync(workspaceYamlPath, "utf-8");
+		doc = YAML.parse(raw) ?? {};
+	} catch {
+		doc = {};
+	}
+	const overrides = doc.overrides ?? {};
+	const old = overrides[packageName];
+	overrides[packageName] = version;
+	doc.overrides = overrides;
+	writeFileSync(workspaceYamlPath, YAML.stringify(doc), "utf-8");
+	return old;
+}
+/**
+* 回滚 override 写入操作。
+*
+* - `pnpm-workspace.yaml` 模式：删除刚写入的条目，或恢复旧值
+* - `package.json` 模式：同理操作 `pkg.pnpm.overrides`
+*/
+function rollbackOverrides(params) {
+	const { usesWorkspaceYaml, workspaceYamlPath, packageName, oldOverride, pkg, pkgPath } = params;
+	if (usesWorkspaceYaml) try {
+		const raw = readFileSync(workspaceYamlPath, "utf-8");
+		const doc = YAML.parse(raw) ?? {};
+		const overrides = doc.overrides ?? {};
+		if (oldOverride === void 0) {
+			const next = Object.fromEntries(Object.entries(overrides).filter(([key]) => key !== packageName));
+			if (Object.keys(next).length === 0) delete doc.overrides;
+			else doc.overrides = next;
+		} else overrides[packageName] = oldOverride;
+		writeFileSync(workspaceYamlPath, YAML.stringify(doc), "utf-8");
+	} catch {}
+	else {
+		if (pkg.pnpm?.overrides) {
+			const overrides = pkg.pnpm.overrides;
+			if (oldOverride === void 0) {
+				const next = Object.fromEntries(Object.entries(overrides).filter(([key]) => key !== packageName));
+				if (Object.keys(next).length === 0) {
+					delete pkg.pnpm.overrides;
+					if (Object.keys(pkg.pnpm).length === 0) delete pkg.pnpm;
+				} else pkg.pnpm.overrides = next;
+			} else overrides[packageName] = oldOverride;
+		}
+		writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`, "utf-8");
+	}
+}
+function getStderr(err) {
+	if (err instanceof Error && "stderr" in err) {
+		const stderr = err.stderr;
+		if (typeof stderr === "string") return stderr.trim();
+		if (Buffer.isBuffer(stderr)) return stderr.toString("utf-8").trim();
+		return typeof stderr === "object" && stderr !== null ? JSON.stringify(stderr) : String(stderr);
+	}
+	if (err instanceof Error) return err.message;
+	return typeof err === "object" && err !== null ? JSON.stringify(err) : String(err);
+}
+
+//#endregion
+//#region src/fixers/pnpm/index.ts
+/**
+* 执行 `pnpm i --frozen-lockfile` 并解析失败分类。
+* 成功时返回 { ok: true }。
+*/
+function classifyLockfileFailure(workDir) {
+	try {
+		execSync("pnpm install --frozen-lockfile", {
+			cwd: workDir,
+			stdio: "pipe",
+			timeout: 12e4
+		});
+		return { ok: true };
+	} catch (err) {
+		const stderr = getStderrText(err);
+		if (!stderr) return {
+			ok: false,
+			category: "UNKNOWN",
+			stderr: ""
+		};
+		return {
+			ok: false,
+			category: parseFailureCategory(stderr),
+			stderr
+		};
+	}
+}
+const FAILURE_PATTERNS = [
+	["LOCKFILE_NOT_FOUND", /no lockfile|Cannot find.*pnpm-lock\.yaml|ENOENT.*lockfile/i],
+	["MANIFEST_MISMATCH", /ERR_PNPM_OUTDATED_LOCKFILE|out of sync|needs update/i],
+	["CREDENTIAL_ERROR", /E401|ERR_PNPM_FETCH_401|ERR_PNPM_FETCH_403|authentication failed|Authorization/i],
+	["CORRUPTED_LOCKFILE", /\b(broken|corrupted|Cannot read).*lockfile|ERR_PNPM_BROKEN_LOCKFILE/i],
+	["LOCKFILE_VERSION_MISMATCH", /lockfileVersion.*incompatible|unsupported lockfile version|lockfile had been generated with/i],
+	["RESOLVE_ERROR", /ERR_PNPM_NO_MATCHING_VERSION|resolution|resolve.*failed|ERR_PNPM_PEER_DEP_ISSUES/i]
+];
+/**
+* 按优先级匹配 stderr，返回首个命中的 FailureCategory。
+* 不匹配任何特征时返回 'UNKNOWN'。
+*/
+function parseFailureCategory(stderr) {
+	for (const [category, pattern] of FAILURE_PATTERNS) if (pattern.test(stderr)) return category;
+	return "UNKNOWN";
+}
+function getStderrText(err) {
+	if (!err.stderr) return err.message ?? "";
+	if (typeof err.stderr === "string") return err.stderr;
+	return err.stderr.toString("utf-8");
+}
+function execRepair(command, workDir, timeoutMs = 18e4) {
+	execSync(command, {
+		cwd: workDir,
+		stdio: "pipe",
+		timeout: timeoutMs
+	});
+}
+/**
+* 确定某个分类下适用的修复策略链（从首到末）。
+* CREDENTIAL_ERROR 返回空链（不可修复）。
+*/
+function getStrategyChain(category) {
+	switch (category) {
+		case "LOCKFILE_NOT_FOUND":
+		case "MANIFEST_MISMATCH": return ["REGENERATE", "REINSTALL"];
+		case "CORRUPTED_LOCKFILE": return [
+			"FIX_ENTRIES",
+			"REGENERATE",
+			"REINSTALL"
+		];
+		case "LOCKFILE_VERSION_MISMATCH": return [
+			"PIN_TOOLCHAIN",
+			"REGENERATE",
+			"REINSTALL"
+		];
+		case "RESOLVE_ERROR": return [
+			"REGENERATE",
+			"FIX_ENTRIES",
+			"REINSTALL"
+		];
+		case "UNKNOWN": return ["REGENERATE", "REINSTALL"];
+		case "CREDENTIAL_ERROR": return [];
+	}
+}
+function getStrategyCommand(strategy) {
+	switch (strategy) {
+		case "REGENERATE": return "pnpm install --lockfile-only";
+		case "FIX_ENTRIES": return "pnpm install --fix-lockfile --lockfile-only";
+		case "REINSTALL": return "pnpm install --no-frozen-lockfile";
+		case "PIN_TOOLCHAIN": return "pnpm install --lockfile-only";
+		default: return "";
+	}
+}
+/**
+* 比较修复前后 lockfile，返回行数与包数量变化摘要。
+*/
+function computeLockfileDiff(beforePath, afterPath) {
+	const beforeLines = countLockfileLines(beforePath);
+	const afterLines = countLockfileLines(afterPath);
+	const beforePackages = countLockfilePackages(beforePath);
+	const afterPackages = countLockfilePackages(afterPath);
+	const linesChanged = afterLines - beforeLines;
+	const packagesChanged = afterPackages - beforePackages;
+	const parts = [];
+	if (linesChanged !== 0) parts.push(`${linesChanged > 0 ? "+" : ""}${linesChanged} lines`);
+	if (packagesChanged !== 0) parts.push(`${packagesChanged > 0 ? "+" : ""}${packagesChanged} packages`);
+	return {
+		linesChanged,
+		packagesChanged,
+		summary: parts.length > 0 ? `lockfile updated: ${parts.join(", ")}` : "lockfile unchanged"
+	};
+}
+function countLockfileLines(path) {
+	if (!existsSync(path)) return 0;
+	return readFileSync(path, "utf-8").split("\n").length;
+}
+/**
+* 统计 pnpm-lock.yaml 中 `packages:` 块下的条目数。
+* packages 条目以缩进 + `/` 开头（如 `  /lodash@4.17.21:`）。
+*/
+function countLockfilePackages(path) {
+	if (!existsSync(path)) return 0;
+	const lines = readFileSync(path, "utf-8").split("\n");
+	let inPackages = false;
+	let count = 0;
+	for (const line of lines) {
+		if (!inPackages) {
+			if (/^packages:\s*$/.test(line)) inPackages = true;
+			continue;
+		}
+		if (/^[a-zA-Z]/.test(line)) break;
+		if (/^\s+\//.test(line)) count++;
+	}
+	return count;
+}
+/**
+* 从 package.json 的 `packageManager` 字段解析 pnpm 版本。
+* 优先级: toolchain.pnpmVersion > packageManager > null
+*/
+function resolvePnpmVersion(workDir, toolchain) {
+	if (toolchain?.pnpmVersion) return toolchain.pnpmVersion;
+	const pkgPath = join(workDir, "package.json");
+	if (!existsSync(pkgPath)) return null;
+	try {
+		const pm = JSON.parse(readFileSync(pkgPath, "utf-8")).packageManager;
+		if (typeof pm === "string") {
+			const match = /pnpm@(.+)$/.exec(pm);
+			if (match?.[1]) return match[1];
+		}
+	} catch {}
+	return null;
+}
+const LOCKFILE_NAME = "pnpm-lock.yaml";
+/**
+* 在 workDir 中使用 `pnpm install --frozen-lockfile` 验证 lockfile 合规性。
+* 验证通过 → 返回 ret:0；失败 → 返回 ret:1 + stderr。
+* 不抛异常——调用方通过 ret 判断结果。
+*/
+function verifyFrozenLockfile(workDir) {
+	try {
+		execSync("pnpm install --frozen-lockfile", {
+			cwd: workDir,
+			stdio: "pipe",
+			timeout: 12e4
+		});
+		return {
+			ret: 0,
+			stderr: ""
+		};
+	} catch (err) {
+		return {
+			ret: 1,
+			stderr: getStderrText(err)
+		};
+	}
+}
+/**
+* 备份 pnpm-lock.yaml → `<name>.bak`，返回备份路径。
+* lockfile 不存在时会创建空 .bak（回滚时删除即可）。
+*/
+function backupLockfilePath(workDir) {
+	const src = join(workDir, LOCKFILE_NAME);
+	const bak = `${src}.bak`;
+	if (existsSync(src)) copyFileSync(src, bak);
+	return bak;
+}
+/** 从 .bak 还原 lockfile，并删除 .bak。 */
+function rollback(bakPath, workDir) {
+	const target = join(workDir, LOCKFILE_NAME);
+	try {
+		if (existsSync(bakPath)) copyFileSync(bakPath, target);
+	} finally {
+		try {
+			rmSync(bakPath);
+		} catch {}
+	}
+}
+/**
+* 检测并修复 pnpm frozen-lockfile 漂移。
+*
+* 流程：
+* 1. 先跑 `pnpm i --frozen-lockfile` 诊断
+* 2. 若已合规 → 直接返回 success
+* 3. 若为 CREDENTIAL_ERROR → SKIP
+* 4. 按分类选取策略链，逐级尝试修复：
+*    - 每个策略执行后立即用 `pnpm i --frozen-lockfile` 验证
+*    - 验证通过 → 记录 diff、返回 success
+*    - 验证失败 → 继续下一个策略
+* 5. 所有策略失败 → 回滚 lockfile、返回失败结果
+*/
+function repairLockfile(params) {
+	const { workDir } = params;
+	const workDir_ = workDir;
+	const attempts = [];
+	const bakPath = backupLockfilePath(workDir_);
+	const classification = classifyLockfileFailure(workDir_);
+	if (classification.ok) {
+		try {
+			rmSync(bakPath);
+		} catch {}
+		return {
+			success: true,
+			diff: null,
+			attemptHistory: attempts
+		};
+	}
+	const category = classification.category ?? "UNKNOWN";
+	const stderr = classification.stderr ?? "";
+	if (category === "CREDENTIAL_ERROR") {
+		try {
+			rmSync(bakPath);
+		} catch {}
+		return {
+			success: false,
+			failureCategory: "CREDENTIAL_ERROR",
+			failureDetail: `registry authentication error: ${truncate(stderr, 500)}`,
+			strategy: "SKIP",
+			attemptHistory: attempts
+		};
+	}
+	const strategyChain = getStrategyChain(category);
+	let lastError = stderr;
+	const startTimestamp = Date.now();
+	for (const strategy of strategyChain) {
+		const command = getStrategyCommand(strategy);
+		const t0 = Date.now();
+		let strategySuccess = false;
+		let strategyError;
+		try {
+			execRepair(command, workDir_);
+			strategySuccess = true;
+		} catch (err) {
+			strategyError = getStderrText(err) || err.message;
+		}
+		const durationMs = Date.now() - t0;
+		attempts.push({
+			strategy,
+			command,
+			success: strategySuccess,
+			error: strategyError,
+			durationMs
+		});
+		if (!strategySuccess) {
+			lastError = strategyError ?? lastError;
+			continue;
+		}
+		const verify = verifyFrozenLockfile(workDir_);
+		if (verify.ret === 0) {
+			const diff = computeLockfileDiff(bakPath, join(workDir_, LOCKFILE_NAME));
+			try {
+				rmSync(bakPath);
+			} catch {}
+			return {
+				success: true,
+				strategy,
+				diff,
+				attemptHistory: attempts
+			};
+		}
+		lastError = verify.stderr;
+	}
+	rollback(bakPath, workDir_);
+	const durationMs = Date.now() - startTimestamp;
+	attempts.push({
+		strategy: "SKIP",
+		command: "rollback",
+		success: true,
+		durationMs
+	});
+	return {
+		success: false,
+		failureCategory: category,
+		failureDetail: truncate(lastError, 500),
+		attemptHistory: attempts
+	};
+}
+function truncate(text, maxLen) {
+	if (text.length <= maxLen) return text;
+	return `${text.slice(0, maxLen)}…`;
+}
+
+//#endregion
+//#region src/runners/verification-runner.ts
+const DEFAULT_COMMANDS = [
+	"pnpm install --frozen-lockfile",
+	"pnpm lint",
+	"pnpm build"
+];
+const MAX_OUTPUT_LINES = 200;
+/**
+* 按顺序在工作目录执行命令序列，任一命令失败则停止。
+*
+* @example
+* ```ts
+* const result = await runVerification({ workDir: '/repo' })
+* if (!result.success) {
+*     console.error(result.failure)
+* }
+* ```
+*/
+async function runVerification(params) {
+	const commands = params.commands ?? DEFAULT_COMMANDS;
+	const commandResults = [];
+	for (const command of commands) {
+		const result = await execCommand(command, params.workDir);
+		commandResults.push(result);
+		if (result.exitCode !== 0) return {
+			success: false,
+			commandResults,
+			failedCommand: command,
+			failure: `command "${command}" exited with code ${result.exitCode}`
+		};
+	}
+	return {
+		success: true,
+		commandResults
+	};
+}
+/**
+* 执行单条 shell 命令，捕获 stdout/stderr（截断到 200 行）并脱敏。
+*/
+function execCommand(command, workDir) {
+	return new Promise((resolve) => {
+		const startTime = Date.now();
+		const cp = spawn(command, {
+			cwd: workDir,
+			shell: true,
+			stdio: "pipe"
+		});
+		const stdoutChunks = [];
+		const stderrChunks = [];
+		cp.stdout.on("data", (data) => {
+			stdoutChunks.push(data.toString("utf-8"));
+		});
+		cp.stderr.on("data", (data) => {
+			stderrChunks.push(data.toString("utf-8"));
+		});
+		cp.on("error", (err) => {
+			resolve({
+				command,
+				exitCode: -1,
+				durationMs: Date.now() - startTime,
+				stdout: "",
+				stderr: sanitizeOutput(err.message)
+			});
+		});
+		cp.on("close", (code) => {
+			const stdout = truncateLines(stdoutChunks.join(""), MAX_OUTPUT_LINES);
+			const stderr = truncateLines(stderrChunks.join(""), MAX_OUTPUT_LINES);
+			resolve({
+				command,
+				exitCode: code ?? -1,
+				durationMs: Date.now() - startTime,
+				stdout: sanitizeOutput(stdout),
+				stderr: sanitizeOutput(stderr)
+			});
+		});
+	});
+}
+/** 截断文本到指定行数 */
+function truncateLines(text, maxLines) {
+	const lines = text.split("\n");
+	if (lines.length <= maxLines) return text;
+	return `${lines.slice(0, maxLines).join("\n")}\n... (truncated, ${lines.length - maxLines} more lines)`;
+}
+/**
+* 脱敏处理：移除命令输出中可能包含的敏感信息。
+*
+* 过滤规则：
+* - 包含 `token=` / `secret=` / `password=` 的行
+* - `npm_config_` / `GITHUB_TOKEN` / `NPM_TOKEN` 等环境变量暴露
+* - URL 中的 user:password@ 模式
+*/
+const SECRET_PATTERNS = [
+	[/^(GITHUB_TOKEN|NPM_TOKEN|NODE_AUTH_TOKEN|DOCKER_PASSWORD)=.+/gim, "$1=***"],
+	[/\b(token|secret|password|api[_-]?key)\s*[=:]\s*\S+/gi, "$1=***"],
+	[/\/\/[^@\n]+@/g, "//***@"],
+	[/npm_config_[a-z_]+=\S+/g, "npm_config_***=***"]
+];
+/**
+* 对外暴露以支持单独测试
+*/
+function sanitizeOutput(output) {
+	let result = output;
+	for (const [pattern, replacement] of SECRET_PATTERNS) result = result.replace(pattern, replacement);
+	return result;
+}
+
+//#endregion
+//#region src/app-helpers.ts
+const DEFAULT_VERIFY_COMMANDS = [
+	"pnpm install --frozen-lockfile",
+	"pnpm lint",
+	"pnpm build"
+];
+/** 匹配 `pnpm <singleWord>` 模式的命令（可能是 package.json script 引用） */
+const PNPM_SCRIPT_RE = /^pnpm\s+([a-zA-Z][a-zA-Z0-9:_-]*)$/;
+/** 自动修复提交的标准消息（本地 --commit 与 fix-and-pr 共用） */
+const FIX_COMMIT_MESSAGE = "fix(deps): automated dependfix security repair";
+/**
+* 升级单个告警对应的依赖（dry-run 仅记录）。
+* 优先直接升级，失败且为间接依赖时回退到 pnpm overrides。
+*/
+async function upgradeAlert(ctx, alert) {
+	const { config, logger, workDir } = ctx;
+	const startMs = Date.now();
+	if (config.dryRun) {
+		logger.info(`[dry-run] Would upgrade ${alert.packageName} to ${alert.recommendedVersion}`);
+		return {
+			type: "dependency-upgrade",
+			repository: alert.repository,
+			target: alert.packageName,
+			fromVersion: alert.recommendedVersion ? `< ${alert.recommendedVersion}` : void 0,
+			toVersion: alert.recommendedVersion,
+			isMajor: false,
+			success: true,
+			durationMs: 0
+		};
+	}
+	try {
+		let result = await upgradeDependency({
+			packageName: alert.packageName,
+			targetVersion: alert.recommendedVersion,
+			workDir
+		});
+		if (!result.success && result.error?.includes("not found in dependencies")) {
+			result = await overrideTransitiveDependency({
+				packageName: alert.packageName,
+				targetVersion: alert.recommendedVersion,
+				workDir
+			});
+			logger.info(result.success ? `Upgraded ${result.packageName}: ${result.fromVersion} → ${result.toVersion} (pnpm overrides)` : `Failed to upgrade ${result.packageName}: ${result.error}`);
+		} else logger.info(result.success ? `Upgraded ${result.packageName}: ${result.fromVersion} → ${result.toVersion}` : `Failed to upgrade ${result.packageName}: ${result.error}`);
+		return {
+			type: "dependency-upgrade",
+			repository: alert.repository,
+			target: alert.packageName,
+			fromVersion: result.fromVersion,
+			toVersion: result.toVersion,
+			isMajor: result.isMajor,
+			success: result.success,
+			error: result.error,
+			durationMs: Date.now() - startMs
+		};
+	} catch (error) {
+		const message = toErrorMessage(error);
+		logger.error(`Upgrade error for ${alert.packageName}: ${message}`);
+		return {
+			type: "dependency-upgrade",
+			repository: alert.repository,
+			target: alert.packageName,
+			toVersion: alert.recommendedVersion,
+			success: false,
+			error: message,
+			durationMs: Date.now() - startMs
+		};
+	}
+}
+/** 尝试修复 pnpm-lock.yaml（dry-run 仅记录）。 */
+function tryLockfileRepair(ctx, repo) {
+	const { config, logger, workDir } = ctx;
+	const startMs = Date.now();
+	if (config.dryRun) {
+		logger.info(`[dry-run] Would attempt lockfile repair for ${repo}`);
+		return {
+			type: "lockfile-repair",
+			repository: repo,
+			target: "pnpm-lock.yaml",
+			success: true,
+			durationMs: 0
+		};
+	}
+	try {
+		const result = repairLockfile({ workDir });
+		logger.info(result.success ? `Lockfile repaired for ${repo} (strategy: ${result.strategy ?? "N/A"})` : `Lockfile repair failed for ${repo}: ${result.failureDetail ?? "unknown"}`);
+		return {
+			type: "lockfile-repair",
+			repository: repo,
+			target: "pnpm-lock.yaml",
+			success: result.success,
+			error: result.success ? void 0 : result.failureDetail ?? "Lockfile repair failed",
+			strategy: result.strategy,
+			durationMs: Date.now() - startMs,
+			diff: result.diff?.summary
+		};
+	} catch (error) {
+		const message = toErrorMessage(error);
+		logger.error(`Lockfile repair error for ${repo}: ${message}`);
+		return {
+			type: "lockfile-repair",
+			repository: repo,
+			target: "pnpm-lock.yaml",
+			success: false,
+			error: message,
+			durationMs: Date.now() - startMs
+		};
+	}
+}
+/** 执行验证命令链，返回逐命令结果。 */
+async function verifyProject(ctx, repo) {
+	const { customCommands, logger, workDir, allErrors } = ctx;
+	const rawCommands = customCommands ?? DEFAULT_VERIFY_COMMANDS;
+	const { valid, skipped } = !customCommands ? validateVerifyCommands(rawCommands, workDir) : {
+		valid: rawCommands,
+		skipped: []
+	};
+	for (const cmd of skipped) {
+		logger.info(`Skipping command "${cmd}": script not found in package.json`);
+		allErrors.push({
+			repository: repo,
+			target: cmd,
+			stage: "verify",
+			category: "SCRIPT_NOT_FOUND",
+			message: `Skipped: no matching script in package.json for "${cmd}"`
+		});
+	}
+	if (valid.length === 0) {
+		logger.info(`No verification commands to run for ${repo}`);
+		return [];
+	}
+	try {
+		return (await runVerification({
+			workDir,
+			commands: valid
+		})).commandResults.map((cr) => ({
+			type: "verification",
+			repository: repo,
+			target: cr.command,
+			success: cr.exitCode === 0,
+			error: cr.exitCode !== 0 ? `exit code ${cr.exitCode}` : void 0,
+			durationMs: cr.durationMs
+		}));
+	} catch (error) {
+		const message = toErrorMessage(error);
+		logger.error(`Verification error for ${repo}: ${message}`);
+		return [{
+			type: "verification",
+			repository: repo,
+			target: "verification",
+			success: false,
+			error: message
+		}];
+	}
+}
+/**
+* 校验默认命令链中的脚本引用是否存在。
+*
+* - `pnpm install --frozen-lockfile` 等非脚本命令 → 直接保留
+* - `pnpm lint` 等脚本命令 → 检查 `package.json#scripts` 是否存在对应键
+* - 用户自定义命令（`--commands`）不经过此校验
+*/
+function validateVerifyCommands(commands, workDir) {
+	const pkgJsonPath = join(workDir, "package.json");
+	let pkgScripts = {};
+	if (existsSync(pkgJsonPath)) try {
+		pkgScripts = JSON.parse(readFileSync(pkgJsonPath, "utf-8")).scripts ?? {};
+	} catch {
+		return {
+			valid: commands,
+			skipped: []
+		};
+	}
+	const valid = [];
+	const skipped = [];
+	for (const cmd of commands) {
+		const match = PNPM_SCRIPT_RE.exec(cmd);
+		if (match) {
+			const scriptName = match[1];
+			if (pkgScripts[scriptName]) valid.push(cmd);
+			else skipped.push(cmd);
+		} else valid.push(cmd);
+	}
+	return {
+		valid,
+		skipped
+	};
+}
+/**
+* 将修复产生的变更提交到本地当前分支。
+*
+* - 无任何变更（含已暂存变更）时跳过
+* - config 校验已保证 `commit` 与 `dryRun` / `createPullRequest` 互斥，
+*   因此这里不需要再检查这两个开关
+*/
+function commitLocalChanges(ctx) {
+	const { logger, workDir } = ctx;
+	if (!hasGitChanges(workDir)) {
+		logger.info("No changes to commit — skipping local commit");
+		return;
+	}
+	ensureGitignore(workDir);
+	stageAndCommit(FIX_COMMIT_MESSAGE, workDir);
+	logger.info(`Committed fix changes to current branch: ${FIX_COMMIT_MESSAGE}`);
+}
+/**
+* 检查工作目录是否有未提交的变更（含未暂存与已暂存）。
+*/
+function hasGitChanges(workDir) {
+	try {
+		execSync("git diff --quiet", {
+			cwd: workDir,
+			stdio: "pipe"
+		});
+		execSync("git diff --cached --quiet", {
+			cwd: workDir,
+			stdio: "pipe"
+		});
+		return false;
+	} catch {
+		return true;
+	}
+}
+/**
+* 确保目标仓库的 `.gitignore` 中包含 `dependfix-reports/`。
+*
+* - 仅在 workDir 是 git 仓库时执行
+* - 已存在该条目时幂等跳过
+* - 失败（权限、磁盘满等）静默降级
+*/
+function ensureGitignore(workDir) {
+	try {
+		if (!existsSync(join(workDir, ".git"))) return;
+		const gitignorePath = join(workDir, ".gitignore");
+		const entry = "dependfix-reports/";
+		let content = "";
+		if (existsSync(gitignorePath)) content = readFileSync(gitignorePath, "utf-8");
+		if (content.split("\n").some((l) => l.trim() === entry)) return;
+		const block = `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}# dependfix\n${entry}\n`;
+		writeFileSync(gitignorePath, content + block, "utf-8");
+	} catch {}
+}
+/**
+* 关闭被取代的旧 PR。单条关闭失败不中断其余 PR 的关闭，
+* 失败记录为 `PR_CLOSE_FAILED`（与 PR 创建失败区分）。
+*/
+async function closeSupersededPRs(ctx, client, owner, repo, supersedePRs) {
+	const { logger, allErrors } = ctx;
+	for (const old of supersedePRs) try {
+		await closePullRequest(client, owner, repo, old.number);
+		logger.info(`Closed superseded PR #${old.number}`);
+	} catch (error) {
+		const message = toErrorMessage(error);
+		logger.error(`Failed to close superseded PR #${old.number}: ${message}`);
+		allErrors.push({
+			repository: `${owner}/${repo}`,
+			stage: "report",
+			category: "PR_CLOSE_FAILED",
+			message: `Failed to close PR #${old.number}: ${message}`
+		});
+	}
+}
+/**
+* （fix-and-pr + --cleanup-branches）将已合并的 dependfix 分支列为待清理清单，
+* 记录到报告与日志，不执行删除。
+*/
+async function reportCleanupCandidates(ctx, client) {
+	const { config, logger, allActions, allErrors } = ctx;
+	for (const repo of config.repositories) {
+		const [owner, name] = repo.split("/");
+		try {
+			const branches = await listDependfixBranches(client, owner, name);
+			for (const branch of branches) if ((await getBranchPrStatus(client, owner, name, branch)).merged) {
+				logger.info(`[cleanup] merged branch awaiting manual cleanup: ${branch}`);
+				allActions.push({
+					type: "branch-cleanup",
+					repository: repo,
+					target: branch,
+					success: true,
+					diff: "merged; run `dependfix cleanup-branches` to delete",
+					durationMs: 0
+				});
+			}
+		} catch (error) {
+			const message = toErrorMessage(error);
+			logger.error(`[cleanup] detection failed for ${repo}: ${message}`);
+			allErrors.push({
+				repository: repo,
+				stage: "report",
+				category: "CLEANUP_DETECT_FAILED",
+				message
+			});
+		}
+	}
+}
+/**
+* 交互式确认删除。非 TTY（CI/管道）时直接拒绝。
+*/
+function confirmCleanup(ctx, repo, candidates) {
+	const { logger } = ctx;
+	if (!process.stdin.isTTY) {
+		logger.warn("[cleanup] non-TTY environment — deletion requires interactive confirmation, aborting");
+		return Promise.resolve(false);
+	}
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	return new Promise((resolve) => {
+		rl.question(`Delete ${candidates.length} branch(es) from ${repo}? [y/N] `, (answer) => {
+			rl.close();
+			resolve(isConfirmAnswer(answer));
+		});
+	});
+}
+/** 汇总所有动作到 summary（alertsSkipped 已在 processRepoForFix 中累加）。 */
+function computeSummary(ctx) {
+	const { config, allActions, allAlerts, summary } = ctx;
+	let fixed = 0;
+	let failed = 0;
+	let lockfileRepairs = 0;
+	let verificationsPassed = 0;
+	let verificationsFailed = 0;
+	for (const action of allActions) {
+		if (action.type === "dependency-upgrade") if (action.success) fixed++;
+		else failed++;
+		if (action.type === "lockfile-repair" && action.success) lockfileRepairs++;
+		if (action.type === "verification") if (action.success) verificationsPassed++;
+		else verificationsFailed++;
+	}
+	const fixable = allAlerts.filter((a) => a.fixable).length;
+	summary.repositoriesScanned = config.repositories.length;
+	summary.alertsFound = allAlerts.length;
+	summary.alertsFixable = fixable;
+	summary.alertsFixed = fixed;
+	summary.alertsFailed = failed;
+	summary.lockfileRepairs = lockfileRepairs;
+	summary.verificationsPassed = verificationsPassed;
+	summary.verificationsFailed = verificationsFailed;
+}
+/** 组装最终运行结果。 */
+function buildRunResult(ctx) {
+	const reportConfig = {
+		mode: ctx.config.mode,
+		severityThreshold: ctx.config.severityThreshold,
+		repositories: ctx.config.repositories,
+		dryRun: ctx.config.dryRun,
+		createPullRequest: ctx.config.createPullRequest,
+		maxAlertsPerRepository: ctx.config.maxAlertsPerRepository
+	};
+	return {
+		runId: ctx.runId,
+		startedAt: ctx.startedAt,
+		finishedAt: ctx.finishedAt,
+		config: reportConfig,
+		summary: ctx.summary,
+		repositories: ctx.repoResults,
+		alerts: ctx.allAlerts,
+		actions: ctx.allActions,
+		errors: ctx.allErrors
+	};
+}
+/**
+* 计算退出码：
+* - 0: 全部仓库处理成功（无 failed actions、无 errors）
+* - 1: 部分仓库失败
+* - 2: 全部仓库失败（或无仓库被成功处理）
+*/
+function computeExitCode(ctx) {
+	const { config, allErrors, allActions, repoResults } = ctx;
+	const hasErrors = allErrors.length > 0;
+	const hasFailures = allActions.some((a) => !a.success);
+	const hasRepoSuccess = repoResults.length > 0 && repoResults.some((r) => r.alertsCount > 0 || r.fixed > 0 || r.verificationPassed === true);
+	const hasCleanupSuccess = config.mode === "cleanup-branches" && allActions.some((a) => a.success && a.type === "branch-cleanup");
+	const hasSuccess = hasRepoSuccess || hasCleanupSuccess;
+	if (config.mode === "fix-and-pr") return 0;
+	if (!hasErrors && !hasFailures) return 0;
+	if (hasSuccess) return 1;
+	return 2;
+}
+
+//#endregion
+//#region src/app.ts
+var DependfixApp = class {
+	config;
+	workDir;
+	logger;
+	verbose;
+	customCommands;
+	runId;
+	allAlerts = [];
+	allActions = [];
+	allErrors = [];
+	repoResults = [];
+	summary = createEmptyRunSummary();
+	startedAt = "";
+	finishedAt = "";
+	constructor(options) {
+		this.config = options.config;
+		this.workDir = options.workDir ?? process.cwd();
+		this.verbose = options.verbose ?? false;
+		this.customCommands = options.commands;
+		this.runId = `dependfix-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+		this.logger = createLogger({
+			name: "dependfix",
+			minLevel: this.verbose ? "debug" : "info"
+		});
+	}
+	/** 供辅助方法使用的状态切片。 */
+	get ctx() {
+		return {
+			config: this.config,
+			workDir: this.workDir,
+			logger: this.logger,
+			customCommands: this.customCommands,
+			runId: this.runId,
+			allAlerts: this.allAlerts,
+			allActions: this.allActions,
+			allErrors: this.allErrors,
+			repoResults: this.repoResults,
+			summary: this.summary,
+			startedAt: this.startedAt,
+			finishedAt: this.finishedAt
+		};
+	}
+	/** 执行完整的编排流程，返回结构化结果和退出码。 */
+	async run() {
+		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+		this.logger.info(`Starting dependfix run ${this.runId}`, {
+			mode: this.config.mode,
+			repositories: this.config.repositories
+		});
+		try {
+			await this.executeMode();
+		} catch (error) {
+			const message = toErrorMessage(error);
+			this.logger.error(`Unexpected error: ${message}`);
+			this.allErrors.push({
+				repository: "*",
+				stage: "report",
+				category: "FATAL",
+				message
+			});
+		}
+		this.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+		computeSummary(this.ctx);
+		const runResult = buildRunResult(this.ctx);
+		const exitCode = computeExitCode(this.ctx);
+		try {
+			writeReport(generateMarkdownReport(runResult), generateJsonReport(runResult), this.startedAt, this.runId);
+			this.logger.info(`Reports written to ./dependfix-reports/`);
+		} catch (reportError) {
+			const message = toErrorMessage(reportError);
+			this.logger.error(`Failed to write reports: ${message}`);
+		}
+		ensureGitignore(this.workDir);
+		this.logger.info(`Run ${this.runId} completed`, { exitCode });
+		return {
+			result: runResult,
+			exitCode
+		};
+	}
+	async executeMode() {
+		switch (this.config.mode) {
+			case "report-only":
+				await this.executeReportMode();
+				break;
+			case "fix":
+				await this.executeFixMode();
+				break;
+			case "fix-and-pr":
+				await this.executeFixAndPrMode();
+				break;
+			case "cleanup-branches":
+				await this.executeCleanupBranchesMode();
+				break;
+		}
+	}
+	async executeReportMode() {
+		const client = this.createClient();
+		for (const repo of this.config.repositories) await this.processRepoForReport(client, repo);
+	}
+	async processRepoForReport(client, repo) {
+		const startTime = Date.now();
+		const [owner, name] = repo.split("/");
+		try {
+			const { filtered } = filterAlerts(await fetchDependabotAlerts(client, {
+				owner,
+				repo: name
+			}), { severityThreshold: this.config.severityThreshold });
+			const { limited } = limitAlerts(prioritizeAlerts(filtered), this.config.maxAlertsPerRepository);
+			const defaultBranch = await this.fetchDefaultBranch(client, owner, name);
+			this.allAlerts.push(...limited);
+			this.repoResults.push({
+				repository: repo,
+				defaultBranch,
+				alertsCount: limited.length,
+				fixable: limited.filter((a) => a.fixable).length,
+				fixed: 0,
+				failed: 0,
+				lockfileRepaired: false,
+				durationMs: Date.now() - startTime
+			});
+			this.logger.info(`Fetched ${limited.length} alerts for ${repo}`);
+		} catch (error) {
+			const message = toErrorMessage(error);
+			this.logger.error(`Failed to fetch alerts for ${repo}: ${message}`);
+			this.allErrors.push({
+				repository: repo,
+				stage: "fetch",
+				category: "FETCH_FAILED",
+				message
+			});
+			this.repoResults.push({
+				repository: repo,
+				defaultBranch: "",
+				alertsCount: 0,
+				fixable: 0,
+				fixed: 0,
+				failed: 0,
+				lockfileRepaired: false,
+				durationMs: Date.now() - startTime
+			});
+		}
+	}
+	async executeFixMode() {
+		const client = this.createClient();
+		for (const repo of this.config.repositories) await this.processRepoForFix(client, repo);
+		if (this.config.commit) try {
+			commitLocalChanges(this.ctx);
+		} catch (error) {
+			const message = toErrorMessage(error);
+			this.logger.error(`Local commit failed: ${message}`);
+			this.allErrors.push({
+				repository: "*",
+				stage: "fix",
+				category: "COMMIT_FAILED",
+				message
+			});
+		}
+	}
+	async processRepoForFix(client, repo) {
+		const startTime = Date.now();
+		const [owner, name] = repo.split("/");
+		let alertsCount = 0;
+		let fixable = 0;
+		let fixed = 0;
+		let failed = 0;
+		let lockfileRepaired = false;
+		let verificationPassed;
+		let defaultBranch = "";
+		try {
+			const { filtered } = filterAlerts(await fetchDependabotAlerts(client, {
+				owner,
+				repo: name
+			}), { severityThreshold: this.config.severityThreshold });
+			const { limited } = limitAlerts(prioritizeAlerts(filtered), this.config.maxAlertsPerRepository);
+			alertsCount = limited.length;
+			fixable = limited.filter((a) => a.fixable).length;
+			defaultBranch = await this.fetchDefaultBranch(client, owner, name);
+			this.allAlerts.push(...limited);
+			const fixableAlerts = limited.filter((a) => a.fixable && a.recommendedVersion);
+			for (const alert of fixableAlerts) {
+				const action = await upgradeAlert(this.ctx, alert);
+				this.allActions.push(action);
+				if (action.success) fixed++;
+				else failed++;
+			}
+			const skippedCount = limited.length - fixableAlerts.length;
+			this.summary.alertsSkipped += skippedCount;
+			const repairAction = tryLockfileRepair(this.ctx, repo);
+			this.allActions.push(repairAction);
+			if (repairAction.success) lockfileRepaired = true;
+			if (!this.config.dryRun) {
+				const verifyActions = await verifyProject(this.ctx, repo);
+				this.allActions.push(...verifyActions);
+				verificationPassed = verifyActions.every((a) => a.success);
+			} else {
+				this.logger.info(`[dry-run] Skipping verification for ${repo}`);
+				verificationPassed = void 0;
+			}
+		} catch (error) {
+			const message = toErrorMessage(error);
+			this.logger.error(`Failed to process ${repo}: ${message}`);
+			this.allErrors.push({
+				repository: repo,
+				stage: "fix",
+				category: "PROCESS_FAILED",
+				message
+			});
+		}
+		this.repoResults.push({
+			repository: repo,
+			defaultBranch,
+			alertsCount,
+			fixable,
+			fixed,
+			failed,
+			lockfileRepaired,
+			verificationPassed,
+			durationMs: Date.now() - startTime
+		});
+	}
+	/**
+	* 修复 → 计算内容指纹 → 查重 →（同指纹跳过 / 异指纹关旧开新）。
+	*
+	* 去重语义（T210）：
+	* - 同告警集 → 同修复结果 → 同指纹 → 跳过，不重复提交相同 PR
+	* - 内容变化 → 先创建新 PR（body 注明 Supersedes），成功后关闭旧 PR；
+	*   新 PR 创建失败时保留旧 PR，避免出现"无 PR 窗口"
+	*/
+	async executeFixAndPrMode() {
+		const client = this.createClient();
+		for (const repo of this.config.repositories) await this.processRepoForFix(client, repo);
+		if (this.config.cleanupBranches) await reportCleanupCandidates(this.ctx, client);
+		if (this.config.dryRun) {
+			this.logger.info("[dry-run] Would create branch, commit, push, and PR");
+			return;
+		}
+		if (!hasGitChanges(this.workDir)) {
+			this.logger.info("No changes to commit — skipping PR creation");
+			return;
+		}
+		if (this.config.repositories.length === 0) return;
+		const firstRepo = this.config.repositories[0];
+		const [owner, repo] = firstRepo.split("/");
+		try {
+			const fingerprint = computeFixFingerprint(this.allActions);
+			this.logger.info(`Fix fingerprint: ${fingerprint}`);
+			const plan = computeFixAndPrPlan(await findDependfixOpenPR(client, owner, repo), fingerprint);
+			if (plan.action === "skip" && plan.sameContentPR) {
+				this.logger.info(`Open PR #${plan.sameContentPR.number} already contains identical fixes — skipping PR creation`);
+				this.allActions.push({
+					type: "dependency-upgrade",
+					repository: firstRepo,
+					target: `PR #${plan.sameContentPR.number} (existing)`,
+					fromVersion: void 0,
+					toVersion: plan.sameContentPR.htmlUrl,
+					isMajor: false,
+					success: true,
+					durationMs: 0
+				});
+				await closeSupersededPRs(this.ctx, client, owner, repo, plan.supersedePRs);
+				return;
+			}
+			if (plan.supersedePRs.length > 0) this.logger.info(`Existing PR(s) with different content will be superseded: ${plan.supersedePRs.map((pr) => `#${pr.number}`).join(", ")}`);
+			const branchName = `dependfix/auto-fix-${fingerprint}`;
+			createFixBranch(branchName, this.workDir);
+			this.logger.info(`Creating fix branch: ${branchName}`);
+			this.logger.info("Staging and committing changes");
+			stageAndCommit(FIX_COMMIT_MESSAGE, this.workDir);
+			this.logger.info(`Pushing branch: ${branchName}`);
+			pushBranch(branchName, this.workDir);
+			const defaultBranch = await this.fetchDefaultBranch(client, owner, repo);
+			computeSummary(this.ctx);
+			const prBody = generatePRBody(buildRunResult(this.ctx), plan.supersedePRs.map((pr) => pr.number));
+			const pr = await createPullRequest({
+				octokit: client,
+				owner,
+				repo,
+				headBranch: branchName,
+				baseBranch: defaultBranch,
+				title: `fix(deps): automated security fix — ${this.summary.alertsFixed} upgrades`,
+				body: prBody
+			});
+			this.logger.info(`PR created: ${pr.htmlUrl}`);
+			this.allActions.push({
+				type: "dependency-upgrade",
+				repository: firstRepo,
+				target: `PR #${pr.number}`,
+				fromVersion: void 0,
+				toVersion: pr.htmlUrl,
+				isMajor: false,
+				success: true,
+				durationMs: 0
+			});
+			await closeSupersededPRs(this.ctx, client, owner, repo, plan.supersedePRs);
+		} catch (error) {
+			const message = toErrorMessage(error);
+			this.logger.error(`PR creation failed: ${message}`);
+			this.allErrors.push({
+				repository: this.config.repositories[0] ?? "*",
+				stage: "report",
+				category: "PR_CREATION_FAILED",
+				message
+			});
+		}
+	}
+	/**
+	* 清理已合并（或已关闭）的 dependfix 分支。
+	*
+	* - 分类：已合并（安全清理）/ 已关闭未合并（supersede 孤儿）/ open（跳过）
+	* - 删除前必须交互式确认（y/N）；非 TTY 环境（CI）默认拒绝
+	* - 只删 `dependfix/` 前缀分支，绝不触碰 open PR 对应分支
+	* - dry-run 模式仅列清单并打印 "would delete"，不执行删除
+	*/
+	async executeCleanupBranchesMode() {
+		const client = this.createClient();
+		for (const repo of this.config.repositories) {
+			const [owner, name] = repo.split("/");
+			try {
+				const branches = await listDependfixBranches(client, owner, name);
+				if (branches.length === 0) {
+					this.logger.info(`[cleanup] ${repo}: no dependfix branches found`);
+					continue;
+				}
+				const statuses = [];
+				for (const branch of branches) statuses.push(await getBranchPrStatus(client, owner, name, branch));
+				const merged = statuses.filter((s) => s.merged);
+				const orphaned = statuses.filter((s) => s.closed && !s.merged);
+				const open = statuses.filter((s) => !s.closed);
+				this.logger.info(`[cleanup] ${repo}: ${merged.length} merged, ${orphaned.length} closed, ${open.length} kept`);
+				for (const s of merged) this.logger.info(`  [merged] ${s.branch}${s.prNumber ? ` (PR #${s.prNumber})` : ""}`);
+				for (const s of orphaned) this.logger.info(`  [closed] ${s.branch}${s.prNumber ? ` (PR #${s.prNumber})` : ""}`);
+				for (const s of open) {
+					const label = s.prNumber ? `[open — kept]` : `[no PR — kept]`;
+					this.logger.info(`  ${label} ${s.branch}${s.prNumber ? ` (PR #${s.prNumber})` : ""}`);
+				}
+				const candidates = [...merged, ...orphaned];
+				if (candidates.length === 0) {
+					this.logger.info("[cleanup] nothing to delete");
+					continue;
+				}
+				if (this.config.dryRun) {
+					this.logger.info(`[dry-run] Would delete ${candidates.length} branch(es): ${candidates.map((s) => s.branch).join(", ")}`);
+					continue;
+				}
+				if (!await confirmCleanup(this.ctx, repo, candidates)) {
+					this.logger.info("[cleanup] cancelled by user");
+					continue;
+				}
+				for (const s of candidates) try {
+					await deleteRemoteBranch(client, owner, name, s.branch);
+					this.logger.info(`Deleted branch: ${s.branch}`);
+					this.allActions.push({
+						type: "branch-cleanup",
+						repository: repo,
+						target: s.branch,
+						success: true,
+						diff: s.merged ? "merged" : "closed",
+						durationMs: 0
+					});
+				} catch (error) {
+					const message = toErrorMessage(error);
+					this.logger.error(`Failed to delete branch ${s.branch}: ${message}`);
+					this.allErrors.push({
+						repository: repo,
+						stage: "report",
+						category: "BRANCH_DELETE_FAILED",
+						message: `Failed to delete ${s.branch}: ${message}`
+					});
+				}
+			} catch (error) {
+				const message = toErrorMessage(error);
+				this.logger.error(`[cleanup] failed for ${repo}: ${message}`);
+				this.allErrors.push({
+					repository: repo,
+					stage: "report",
+					category: "CLEANUP_FAILED",
+					message
+				});
+			}
+		}
+	}
+	createClient() {
+		return createGitHubClient({ token: this.config.githubToken });
+	}
+	/**
+	* 获取仓库的默认分支。
+	* 失败时返回 `'unknown'`（不阻塞主流程）。
+	*/
+	async fetchDefaultBranch(client, owner, repo) {
+		try {
+			const { data } = await client.rest.repos.get({
+				owner,
+				repo
+			});
+			return data.default_branch;
+		} catch {
+			return "unknown";
+		}
+	}
+};
+
+//#endregion
+//#region src/github/repo-selector.ts
+/**
+* 从文件读取仓库列表（每行一个 `owner/repo`）。
+* 空行和 `#` 开头的注释行会被跳过。
+*/
+function readReposFile(filePath) {
+	if (!existsSync(filePath)) throw new AppError("REPO_FILE_NOT_FOUND", `Repositories file not found: ${filePath}`);
+	const lines = readFileSync(filePath, "utf-8").split("\n");
+	const repos = [];
+	for (let i = 0; i < lines.length; i += 1) {
+		const line = lines[i].trim();
+		if (!line || line.startsWith("#")) continue;
+		if (!isValidRepoIdentifier(line)) throw new AppError("CONFIG_VALIDATION_ERROR", `Invalid repository identifier at ${filePath}:${i + 1}: "${line}". Expected format: owner/repo`);
+		repos.push(line);
+	}
+	if (repos.length === 0) throw new AppError("CONFIG_VALIDATION_ERROR", `No valid repository identifiers found in ${filePath}`);
+	return repos;
+}
+/**
+* 合并 CLI 传入仓库列表与文件中的仓库列表，去重并校验。
+*/
+function resolveRepoList(cliRepos, reposFilePath) {
+	const repos = [...cliRepos];
+	if (reposFilePath) {
+		const fileRepos = readReposFile(reposFilePath);
+		repos.push(...fileRepos);
+	}
+	const deduped = [...new Set(repos)];
+	for (const repo of deduped) if (!isValidRepoIdentifier(repo)) throw new AppError("CONFIG_VALIDATION_ERROR", `Invalid repository identifier: "${repo}". Expected format: owner/repo`);
+	return deduped;
+}
+
+//#endregion
+//#region src/config/index.ts
+const RUNTIME_MODES = [
+	"report-only",
+	"fix",
+	"fix-and-pr",
+	"cleanup-branches"
+];
+const SEVERITY_THRESHOLDS = [
+	"critical",
+	"high",
+	"medium",
+	"all"
+];
+const DEFAULT_RUNTIME_CONFIG = {
+	mode: "report-only",
+	severityThreshold: "high",
+	maxAlertsPerRepository: 10
+};
+function isRuntimeMode$1(value) {
+	return RUNTIME_MODES.includes(value);
+}
+function isSeverityThreshold$1(value) {
+	return SEVERITY_THRESHOLDS.includes(value);
+}
+function normalizeBoolean(value, fieldName) {
+	if (value === void 0 || value.trim() === "") return;
+	const normalized = value.trim().toLowerCase();
+	if ([
+		"true",
+		"1",
+		"yes",
+		"on"
+	].includes(normalized)) return true;
+	if ([
+		"false",
+		"0",
+		"no",
+		"off"
+	].includes(normalized)) return false;
+	throw new AppError("CONFIG_VALIDATION_ERROR", `Invalid boolean value for ${fieldName}: ${value}`);
+}
+function normalizeInteger(value, fieldName) {
+	if (value === void 0 || value.trim() === "") return;
+	const parsed = Number.parseInt(value, 10);
+	if (!Number.isInteger(parsed) || parsed <= 0) throw new AppError("CONFIG_VALIDATION_ERROR", `${fieldName} must be a positive integer`);
+	return parsed;
+}
+function normalizeList(value) {
+	if (value === void 0 || value.trim() === "") return;
+	const items = value.split(",").map((item) => item.trim()).filter(Boolean);
+	return items.length > 0 ? items : void 0;
+}
+function readRuntimeMode(value, fieldName) {
+	if (value === void 0 || value.trim() === "") return;
+	if (!isRuntimeMode$1(value)) throw new AppError("CONFIG_VALIDATION_ERROR", `${fieldName} must be one of: ${RUNTIME_MODES.join(", ")}`);
+	return value;
+}
+function readSeverityThreshold(value, fieldName) {
+	if (value === void 0 || value.trim() === "") return;
+	if (!isSeverityThreshold$1(value)) throw new AppError("CONFIG_VALIDATION_ERROR", `${fieldName} must be one of: ${SEVERITY_THRESHOLDS.join(", ")}`);
+	return value;
+}
+function readEnvConfig(env = process.env) {
+	return {
+		mode: readRuntimeMode(env.AUTO_FIX_GITHUB_SECURITY_MODE, "AUTO_FIX_GITHUB_SECURITY_MODE"),
+		severityThreshold: readSeverityThreshold(env.AUTO_FIX_GITHUB_SECURITY_SEVERITY_THRESHOLD, "AUTO_FIX_GITHUB_SECURITY_SEVERITY_THRESHOLD"),
+		repositories: normalizeList(env.AUTO_FIX_GITHUB_SECURITY_REPOSITORIES),
+		dryRun: normalizeBoolean(env.AUTO_FIX_GITHUB_SECURITY_DRY_RUN, "AUTO_FIX_GITHUB_SECURITY_DRY_RUN"),
+		createPullRequest: normalizeBoolean(env.AUTO_FIX_GITHUB_SECURITY_CREATE_PR, "AUTO_FIX_GITHUB_SECURITY_CREATE_PR"),
+		commit: normalizeBoolean(env.AUTO_FIX_GITHUB_SECURITY_COMMIT, "AUTO_FIX_GITHUB_SECURITY_COMMIT"),
+		cleanupBranches: normalizeBoolean(env.AUTO_FIX_GITHUB_SECURITY_CLEANUP_BRANCHES, "AUTO_FIX_GITHUB_SECURITY_CLEANUP_BRANCHES"),
+		githubToken: env.AUTO_FIX_GITHUB_SECURITY_GITHUB_TOKEN?.trim() || env.GITHUB_TOKEN?.trim() || void 0,
+		maxAlertsPerRepository: normalizeInteger(env.AUTO_FIX_GITHUB_SECURITY_MAX_ALERTS_PER_REPOSITORY, "AUTO_FIX_GITHUB_SECURITY_MAX_ALERTS_PER_REPOSITORY")
+	};
+}
+function resolveDryRun(mode, cliOverrides, envConfig) {
+	if (cliOverrides.dryRun !== void 0) return cliOverrides.dryRun;
+	if (envConfig.dryRun !== void 0) return envConfig.dryRun;
+	return mode === "report-only";
+}
+function resolveCreatePullRequest(mode, cliOverrides, envConfig) {
+	if (cliOverrides.createPullRequest !== void 0) return cliOverrides.createPullRequest;
+	if (envConfig.createPullRequest !== void 0) return envConfig.createPullRequest;
+	return mode === "fix-and-pr";
+}
+function resolveCommit(cliOverrides, envConfig) {
+	if (cliOverrides.commit !== void 0) return cliOverrides.commit;
+	if (envConfig.commit !== void 0) return envConfig.commit;
+	return false;
+}
+function resolveCleanupBranches(cliOverrides, envConfig) {
+	if (cliOverrides.cleanupBranches !== void 0) return cliOverrides.cleanupBranches;
+	if (envConfig.cleanupBranches !== void 0) return envConfig.cleanupBranches;
+	return false;
+}
+function validateRuntimeConfig(config) {
+	if (!config.githubToken) throw new AppError("CONFIG_VALIDATION_ERROR", "Missing GitHub token. Provide GITHUB_TOKEN or AUTO_FIX_GITHUB_SECURITY_GITHUB_TOKEN.");
+	if (config.repositories.length === 0) throw new AppError("CONFIG_VALIDATION_ERROR", "Missing target repositories. Provide --repo, --repository, --repos-file or AUTO_FIX_GITHUB_SECURITY_REPOSITORIES.");
+	for (const repo of config.repositories) if (!isValidRepoIdentifier(repo)) throw new AppError("CONFIG_VALIDATION_ERROR", `Invalid repository identifier: "${repo}". Expected format: owner/repo`);
+	if (config.mode === "report-only" && config.createPullRequest) throw new AppError("CONFIG_VALIDATION_ERROR", "createPullRequest cannot be enabled when mode is report-only.");
+	if (config.dryRun && config.createPullRequest) throw new AppError("CONFIG_VALIDATION_ERROR", "createPullRequest cannot be enabled while dryRun is true.");
+	if (config.commit && config.mode !== "fix") throw new AppError("CONFIG_VALIDATION_ERROR", "commit is only supported in fix mode.");
+	if (config.commit && config.dryRun) throw new AppError("CONFIG_VALIDATION_ERROR", "commit cannot be enabled while dryRun is true.");
+	if (config.commit && config.createPullRequest) throw new AppError("CONFIG_VALIDATION_ERROR", "commit cannot be enabled together with createPullRequest. Use fix-and-pr mode instead.");
+	return config;
+}
+function resolveRuntimeConfig(options = {}) {
+	const envConfig = readEnvConfig(options.env);
+	const cliOverrides = options.cliOverrides ?? {};
+	const mode = cliOverrides.mode ?? envConfig.mode ?? DEFAULT_RUNTIME_CONFIG.mode;
+	let repositories = resolveRepoList([...envConfig.repositories ?? [], ...cliOverrides.repositories ?? []], cliOverrides.reposFilePath);
+	if (repositories.length === 0) {
+		const inferred = inferRepoFromGitRemote(options.workDir ?? process.cwd());
+		if (inferred) repositories = [inferred];
+	}
+	return validateRuntimeConfig({
+		mode,
+		severityThreshold: cliOverrides.severityThreshold ?? envConfig.severityThreshold ?? DEFAULT_RUNTIME_CONFIG.severityThreshold,
+		repositories,
+		dryRun: resolveDryRun(mode, cliOverrides, envConfig),
+		createPullRequest: resolveCreatePullRequest(mode, cliOverrides, envConfig),
+		commit: resolveCommit(cliOverrides, envConfig),
+		cleanupBranches: resolveCleanupBranches(cliOverrides, envConfig),
+		githubToken: cliOverrides.githubToken ?? envConfig.githubToken ?? "",
+		maxAlertsPerRepository: cliOverrides.maxAlertsPerRepository ?? envConfig.maxAlertsPerRepository ?? DEFAULT_RUNTIME_CONFIG.maxAlertsPerRepository
+	});
+}
+/** 匹配 GitHub remote URL 的正则（HTTPS / SSH / git@ 格式） */
+const GITHUB_REMOTE_RE = /github\.com[/:]([^/]+)\/([^/\s.]+?)(?:\.git)?\s*$/i;
+/**
+* 从 git remote origin 推断 owner/repo。
+*
+* 支持格式：
+* - `https://github.com/owner/repo.git`
+* - `git@github.com:owner/repo.git`
+* - `ssh://git@github.com/owner/repo.git`
+*
+* @returns `owner/repo` 或 `null`（非 GitHub / 无 origin）
+*/
+function inferRepoFromGitRemote(workDir) {
+	try {
+		const url = execSync("git remote get-url origin", {
+			cwd: workDir,
+			encoding: "utf-8",
+			stdio: "pipe"
+		}).trim();
+		const match = GITHUB_REMOTE_RE.exec(url);
+		return match ? `${match[1]}/${match[2]}` : null;
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+//#region src/cli/index.ts
+const argsDef = {
+	mode: {
+		type: "positional",
+		description: "运行模式：report-only, fix, fix-and-pr, cleanup-branches",
+		required: false,
+		default: "report-only"
+	},
+	repo: {
+		type: "string",
+		description: "目标仓库 (owner/repo)，逗号分隔多个",
+		alias: [
+			"r",
+			"repository",
+			"repositories"
+		]
+	},
+	"repos-file": {
+		type: "string",
+		description: "从文件读取仓库列表（每行一个 owner/repo）"
+	},
+	"severity-threshold": {
+		type: "string",
+		description: "严重级别阈值：critical, high, medium, all",
+		default: "high"
+	},
+	"dry-run": {
+		type: "boolean",
+		description: "试运行模式，不实际写入文件",
+		negativeDescription: "关闭试运行模式"
+	},
+	"create-pr": {
+		type: "boolean",
+		description: "创建 Pull Request",
+		negativeDescription: "不创建 Pull Request"
+	},
+	commit: {
+		type: "boolean",
+		description: "修复完成后在本地当前分支直接提交（不推送、不创建 PR）",
+		negativeDescription: "不自动提交（默认）"
+	},
+	"cleanup-branches": {
+		type: "boolean",
+		description: "（fix-and-pr 模式）结束后列出已合并的 dependfix 分支到报告，不自动删除",
+		negativeDescription: "不执行分支清理检查"
+	},
+	"github-token": {
+		type: "string",
+		description: "GitHub Personal Access Token"
+	},
+	"max-alerts-per-repository": {
+		type: "string",
+		description: "每个仓库最多处理的告警数",
+		default: "10"
+	},
+	commands: {
+		type: "string",
+		description: "自定义验证命令（逗号分隔），覆盖默认的 install/lint/build"
+	},
+	verbose: {
+		type: "boolean",
+		description: "输出详细日志"
+	}
+};
+function isRuntimeMode(value) {
+	return RUNTIME_MODES.includes(value);
+}
+function isSeverityThreshold(value) {
+	return SEVERITY_THRESHOLDS.includes(value);
+}
+function appendRepositories(target, value) {
+	for (const repository of value.split(",")) {
+		const trimmed = repository.trim();
+		if (!trimmed) continue;
+		if (!isValidRepoIdentifier(trimmed)) throw new AppError("ARGUMENT_PARSE_ERROR", `Invalid repository identifier: "${trimmed}". Expected format: owner/repo`);
+		target.push(trimmed);
+	}
+}
+function parseCommandsFlag(value) {
+	return value.split(",").map((cmd) => cmd.trim()).filter(Boolean);
+}
+function parsedArgsToCliOverrides(parsed) {
+	const overrides = {};
+	const rawMode = parsed.mode;
+	if (isRuntimeMode(rawMode)) overrides.mode = rawMode;
+	const repoValue = parsed.repo;
+	if (repoValue) {
+		const repos = [];
+		appendRepositories(repos, repoValue);
+		if (repos.length > 0) overrides.repositories = repos;
+	}
+	const reposFile = parsed["repos-file"];
+	if (reposFile) overrides.reposFilePath = reposFile;
+	const severityThreshold = parsed["severity-threshold"];
+	if (isSeverityThreshold(severityThreshold)) overrides.severityThreshold = severityThreshold;
+	if (parsed["dry-run"] !== void 0) overrides.dryRun = parsed["dry-run"];
+	if (parsed["create-pr"] !== void 0) overrides.createPullRequest = parsed["create-pr"];
+	if (parsed.commit !== void 0) overrides.commit = parsed.commit;
+	if (parsed["cleanup-branches"] !== void 0) overrides.cleanupBranches = parsed["cleanup-branches"];
+	const githubToken = parsed["github-token"];
+	if (githubToken) overrides.githubToken = githubToken;
+	const maxAlerts = parsed["max-alerts-per-repository"];
+	if (maxAlerts) {
+		const num = Number.parseInt(maxAlerts, 10);
+		if (Number.isNaN(num)) throw new AppError("ARGUMENT_PARSE_ERROR", `Invalid --max-alerts-per-repository value: "${maxAlerts}". Expected a positive integer.`);
+		overrides.maxAlertsPerRepository = num;
+	}
+	if (parsed.verbose !== void 0) overrides.verbose = parsed.verbose;
+	const commandsValue = parsed.commands;
+	if (commandsValue) overrides.commands = parseCommandsFlag(commandsValue);
+	return overrides;
+}
+function parseCliArgs(rawArgs) {
+	const configOverrides = parsedArgsToCliOverrides(parseArgs(rawArgs, argsDef));
+	return {
+		mode: configOverrides.mode,
+		configOverrides,
+		rawArgs: [...rawArgs]
+	};
+}
+function runCli(rawArgs) {
+	const invocation = parseCliArgs(rawArgs);
+	return {
+		ok: true,
+		invocation,
+		config: resolveRuntimeConfig({
+			env: process.env,
+			cliOverrides: invocation.configOverrides
+		})
+	};
+}
+async function runApp(rawArgs) {
+	const invocation = parseCliArgs(rawArgs);
+	const { exitCode } = await new DependfixApp({
+		config: resolveRuntimeConfig({
+			env: process.env,
+			cliOverrides: invocation.configOverrides
+		}),
+		verbose: invocation.configOverrides.verbose,
+		commands: invocation.configOverrides.commands
+	}).run();
+	return exitCode;
+}
+const dependfixCommand = defineCommand({
+	meta: {
+		name: "dependfix",
+		version: "0.1.0",
+		description: "自动化处理 Dependabot / Code Scanning 安全告警的修复工具"
+	},
+	args: argsDef,
+	async run({ rawArgs }) {
+		let exitCode = 1;
+		try {
+			exitCode = await runApp(rawArgs);
+		} catch (error) {
+			const appError = toAppError(error, "CLI_EXECUTION_FAILED");
+			console.error(`Error: ${appError.message}`);
+			exitCode = 1;
+		}
+		process.exitCode = exitCode;
+	}
+});
+
+//#endregion
+export { createPullRequest as A, fetchDependabotAlerts as B, parseMajorVersion as C, computeFixAndPrPlan as D, closePullRequest as E, getBranchPrStatus as F, createGitHubClient as H, isConfirmAnswer as I, listDependfixBranches as L, extractFingerprintFromBranch as M, findDependfixOpenPR as N, computeFixFingerprint as O, generatePRBody as P, pushBranch as R, overrideTransitiveDependency as S, upgradeDependency as T, mapGitHubError as V, repairLockfile as _, RUNTIME_MODES as a, extractPrefix as b, readEnvConfig as c, resolveRepoList as d, DependfixApp as f, computeLockfileDiff as g, classifyLockfileFailure as h, DEFAULT_RUNTIME_CONFIG as i, deleteRemoteBranch as j, createFixBranch as k, resolveRuntimeConfig as l, sanitizeOutput as m, parseCliArgs as n, SEVERITY_THRESHOLDS as o, runVerification as p, runCli as r, inferRepoFromGitRemote as s, dependfixCommand as t, readReposFile as u, resolvePnpmVersion as v, readLockfileVersion as w, findDependencyVersion as x, ensurePnpmOverrides as y, stageAndCommit as z };
+//# sourceMappingURL=cli.mjs.map