dependfix 0.1.0 → 0.3.2

package/dist/cli.cjs

@@ -1,2812 +0,0 @@
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") {
-		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-			key = keys[i];
-			if (!__hasOwnProp.call(to, key) && key !== except) {
-				__defProp(to, key, {
-					get: ((k) => from[k]).bind(null, key),
-					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-				});
-			}
-		}
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-
-//#endregion
-let citty = require("citty");
-let _dependfix_core = require("@dependfix/core");
-let _octokit_rest = require("@octokit/rest");
-let node_child_process = require("node:child_process");
-let node_crypto = require("node:crypto");
-let node_fs = require("node:fs");
-let node_path = require("node:path");
-let node_readline = require("node:readline");
-let yaml = require("yaml");
-yaml = __toESM(yaml);
-
-//#region src/github/client.ts
-/**
-* 创建已认证的 Octokit 实例。
-*
-* 调用方直接使用 `octokit.rest.*` 访问所有已类型化的 GitHub REST API。
-* 分页使用 `octokit.paginate()` 自动合并多页结果。
-*
-* @example
-* ```typescript
-* const octokit = createGitHubClient({ token: 'ghp_xxxx' })
-*
-* // 仓库信息
-* const { data: repo } = await octokit.rest.repos.get({ owner: 'foo', repo: 'bar' })
-*
-* // Dependabot 告警（自动分页）
-* const alerts = await octokit.paginate(
-*     octokit.rest.dependabot.listAlertsForRepo,
-*     { owner: 'foo', repo: 'bar', state: 'open', per_page: 100 },
-* )
-* ```
-*/
-function createGitHubClient(options) {
-	return new _octokit_rest.Octokit({
-		auth: options.token,
-		baseUrl: options.baseUrl ?? "https://api.github.com"
-	});
-}
-
-//#endregion
-//#region ../../node_modules/.pnpm/deprecation@2.3.1/node_modules/deprecation/dist-node/index.js
-var require_dist_node$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
-	Object.defineProperty(exports, "__esModule", { value: true });
-	var Deprecation = class extends Error {
-		constructor(message) {
-			super(message);
-			/* istanbul ignore next */
-			if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
-			this.name = "Deprecation";
-		}
-	};
-	exports.Deprecation = Deprecation;
-}));
-
-//#endregion
-//#region ../../node_modules/.pnpm/wrappy@1.0.2/node_modules/wrappy/wrappy.js
-var require_wrappy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	module.exports = wrappy;
-	function wrappy(fn, cb) {
-		if (fn && cb) return wrappy(fn)(cb);
-		if (typeof fn !== "function") throw new TypeError("need wrapper function");
-		Object.keys(fn).forEach(function(k) {
-			wrapper[k] = fn[k];
-		});
-		return wrapper;
-		function wrapper() {
-			var args = new Array(arguments.length);
-			for (var i = 0; i < args.length; i++) args[i] = arguments[i];
-			var ret = fn.apply(this, args);
-			var cb = args[args.length - 1];
-			if (typeof ret === "function" && ret !== cb) Object.keys(cb).forEach(function(k) {
-				ret[k] = cb[k];
-			});
-			return ret;
-		}
-	}
-}));
-
-//#endregion
-//#region ../../node_modules/.pnpm/once@1.4.0/node_modules/once/once.js
-var require_once = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var wrappy = require_wrappy();
-	module.exports = wrappy(once);
-	module.exports.strict = wrappy(onceStrict);
-	once.proto = once(function() {
-		Object.defineProperty(Function.prototype, "once", {
-			value: function() {
-				return once(this);
-			},
-			configurable: true
-		});
-		Object.defineProperty(Function.prototype, "onceStrict", {
-			value: function() {
-				return onceStrict(this);
-			},
-			configurable: true
-		});
-	});
-	function once(fn) {
-		var f = function() {
-			if (f.called) return f.value;
-			f.called = true;
-			return f.value = fn.apply(this, arguments);
-		};
-		f.called = false;
-		return f;
-	}
-	function onceStrict(fn) {
-		var f = function() {
-			if (f.called) throw new Error(f.onceError);
-			f.called = true;
-			return f.value = fn.apply(this, arguments);
-		};
-		f.onceError = (fn.name || "Function wrapped with `once`") + " shouldn't be called more than once";
-		f.called = false;
-		return f;
-	}
-}));
-
-//#endregion
-//#region ../../node_modules/.pnpm/@octokit+request-error@5.1.1/node_modules/@octokit/request-error/dist-node/index.js
-var require_dist_node = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var __create = Object.create;
-	var __defProp = Object.defineProperty;
-	var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-	var __getOwnPropNames = Object.getOwnPropertyNames;
-	var __getProtoOf = Object.getPrototypeOf;
-	var __hasOwnProp = Object.prototype.hasOwnProperty;
-	var __export = (target, all) => {
-		for (var name in all) __defProp(target, name, {
-			get: all[name],
-			enumerable: true
-		});
-	};
-	var __copyProps = (to, from, except, desc) => {
-		if (from && typeof from === "object" || typeof from === "function") {
-			for (let key of __getOwnPropNames(from)) if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-				get: () => from[key],
-				enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-			});
-		}
-		return to;
-	};
-	var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-		value: mod,
-		enumerable: true
-	}) : target, mod));
-	var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-	var dist_src_exports = {};
-	__export(dist_src_exports, { RequestError: () => RequestError });
-	module.exports = __toCommonJS(dist_src_exports);
-	var import_deprecation = require_dist_node$1();
-	var import_once = __toESM(require_once());
-	var logOnceCode = (0, import_once.default)((deprecation) => console.warn(deprecation));
-	var logOnceHeaders = (0, import_once.default)((deprecation) => console.warn(deprecation));
-	var RequestError = class extends Error {
-		constructor(message, statusCode, options) {
-			super(message);
-			if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
-			this.name = "HttpError";
-			this.status = statusCode;
-			let headers;
-			if ("headers" in options && typeof options.headers !== "undefined") headers = options.headers;
-			if ("response" in options) {
-				this.response = options.response;
-				headers = options.response.headers;
-			}
-			const requestCopy = Object.assign({}, options.request);
-			if (options.request.headers.authorization) requestCopy.headers = Object.assign({}, options.request.headers, { authorization: options.request.headers.authorization.replace(/(?<! ) .*$/, " [REDACTED]") });
-			requestCopy.url = requestCopy.url.replace(/\bclient_secret=\w+/g, "client_secret=[REDACTED]").replace(/\baccess_token=\w+/g, "access_token=[REDACTED]");
-			this.request = requestCopy;
-			Object.defineProperty(this, "code", { get() {
-				logOnceCode(new import_deprecation.Deprecation("[@octokit/request-error] `error.code` is deprecated, use `error.status`."));
-				return statusCode;
-			} });
-			Object.defineProperty(this, "headers", { get() {
-				logOnceHeaders(new import_deprecation.Deprecation("[@octokit/request-error] `error.headers` is deprecated, use `error.response.headers`."));
-				return headers || {};
-			} });
-		}
-	};
-}));
-
-//#endregion
-//#region src/github/errors.ts
-var import_dist_node = require_dist_node();
-/**
-* 将 Octokit 请求错误映射为 `AppError`。
-*
-* @param error   - 原始错误（`RequestError` 或网络异常）
-* @param context - 调用上下文描述（如 `'fetch repo info for foo/bar'`），会附加到错误消息中
-*/
-function mapGitHubError(error, context) {
-	if (error instanceof import_dist_node.RequestError) {
-		const code = resolveErrorCode(error);
-		const details = collectErrorDetails(error);
-		return new _dependfix_core.AppError(code, `${context}: ${error.message}`, {
-			cause: error,
-			details
-		});
-	}
-	if (error instanceof Error) return new _dependfix_core.AppError("NETWORK_ERROR", `${context}: ${error.message}`, { cause: error });
-	return new _dependfix_core.AppError("NETWORK_ERROR", `${context}: unknown error`, { details: { raw: (0, _dependfix_core.toErrorMessage)(error) } });
-}
-function resolveErrorCode(error) {
-	switch (error.status) {
-		case 401: return "AUTHENTICATION_FAILED";
-		case 403: {
-			const remaining = error.response?.headers["x-ratelimit-remaining"];
-			if (remaining !== void 0 && remaining === "0") return "RATE_LIMITED";
-			return "PERMISSION_DENIED";
-		}
-		case 404: return "REPO_NOT_FOUND";
-		default: return "GITHUB_API_ERROR";
-	}
-}
-function collectErrorDetails(error) {
-	const details = {
-		status: error.status,
-		requestUrl: error.request?.url,
-		requestMethod: error.request?.method
-	};
-	const resetAt = error.response?.headers["x-ratelimit-reset"];
-	if (resetAt) details.rateLimitReset = resetAt;
-	return details;
-}
-
-//#endregion
-//#region src/github/dependabot-fetcher.ts
-/**
-* 拉取指定仓库的 Dependabot 告警并映射为标准化模型。
-*
-* - 自动分页（`octokit.paginate()`），返回所有匹配的告警
-* - 仅处理 `state=open` 的告警（可通过 `params.state` 覆盖）
-* - 异常通过 `mapGitHubError` 转为 `AppError`
-* - 空仓库返回 `[]`，不抛异常
-*
-* @param client - 已认证的 Octokit 实例（来自 `createGitHubClient`）
-* @param params - 仓库标识与过滤参数
-* @returns 标准化告警列表
-*
-* @example
-* ```typescript
-* const octokit = createGitHubClient({ token: 'ghp_xxxx' })
-* const alerts = await fetchDependabotAlerts(octokit, { owner: 'foo', repo: 'bar' })
-* ```
-*/
-async function fetchDependabotAlerts(client, params) {
-	const { owner, repo, state = "open", perPage = 100 } = params;
-	try {
-		return (await client.paginate(client.rest.dependabot.listAlertsForRepo, {
-			owner,
-			repo,
-			state,
-			per_page: perPage
-		})).map((alert) => normalizeAlert(alert, owner, repo));
-	} catch (error) {
-		throw mapGitHubError(error, `fetch dependabot alerts for ${owner}/${repo}`);
-	}
-}
-/**
-* 将单条 Dependabot API 原始告警转换为标准化模型。
-*
-* 映射逻辑：
-* - severity 直接透传（Dependabot 的 `low|medium|high|critical` 与 `AlertSeverity` 对齐）
-* - fixable 判定：`security_vulnerability.first_patched_version !== null`
-* - fixStrategy：有修复版本 → `'upgrade'`，否则 `null`
-* - recommendedVersion 取自 `first_patched_version.identifier`
-* - 可选字段兜底：`packageName`/`packageEcosystem` → `'unknown'`，`manifestPath` → `''`
-* - `defaultBranch` 不在此层填充（由上层调用方获取后注入）
-*/
-function normalizeAlert(alert, owner, repo) {
-	const firstPatched = alert.security_vulnerability.first_patched_version;
-	const fixable = firstPatched !== null;
-	return {
-		id: alert.number,
-		source: "dependabot",
-		repository: `${owner}/${repo}`,
-		defaultBranch: "",
-		severity: alert.security_advisory.severity,
-		packageEcosystem: alert.dependency.package?.ecosystem ?? "unknown",
-		packageName: alert.dependency.package?.name ?? "unknown",
-		manifestPath: alert.dependency.manifest_path ?? "",
-		ruleId: alert.security_advisory.ghsa_id,
-		summary: alert.security_advisory.summary,
-		htmlUrl: alert.html_url,
-		fixable,
-		fixStrategy: fixable ? "upgrade" : null,
-		recommendedVersion: firstPatched?.identifier ?? "",
-		dependencyType: normalizeDependencyRelationship(alert.dependency.relationship)
-	};
-}
-/**
-* 将 Dependabot API 的 `dependency.relationship` 映射为 `DependencyType`。
-*
-* GitHub API 返回的合法值:
-* - `'direct'`    → 直接依赖
-* - `'indirect'`  → 间接依赖（transitive）
-* - `null`/`undefined` → 未知
-*/
-function normalizeDependencyRelationship(relationship) {
-	if (relationship === "direct") return "direct";
-	if (relationship === "indirect") return "transitive";
-}
-
-//#endregion
-//#region src/github/pr-creator.ts
-const BOT_NAME = "dependfix[bot]";
-const BOT_EMAIL = "dependfix[bot]@users.noreply.github.com";
-/** 自动修复分支统一前缀（T210 起分支名 = 前缀 + 内容指纹 8 位） */
-const BRANCH_PREFIX = "dependfix/auto-fix-";
-/**
-* 计算修复内容指纹（sha256 前 8 位）。
-*
-* 指纹基于**结构化修复结果**而非 git diff：
-* - 成功升级集：`pkg@toVersion`（排序拼接）
-* - 修复失败集：失败包名（排序拼接）
-* - lockfile 修复状态（成功/失败）
-*
-* 同告警集 → 同修复结果 → 同指纹 → 幂等跳过；
-* 内容变化（升级集/失败集/锁文件修复变化）→ 指纹变化 → 关旧开新。
-* 不用 diff hash 是因为 pnpm 版本等非确定性因素会使锁文件内容漂移，
-* 导致"告警没变但指纹变"。
-*/
-function computeFixFingerprint(actions) {
-	const isUpgrade = (a) => a.type === "dependency-upgrade" && !!a.target && !a.target.startsWith("PR #");
-	const upgrades = actions.filter((a) => isUpgrade(a) && a.success && a.toVersion).map((a) => `${a.target}@${a.toVersion}`).sort();
-	const failures = actions.filter((a) => isUpgrade(a) && !a.success).map((a) => a.target).sort();
-	const repairs = actions.filter((a) => a.type === "lockfile-repair").map((a) => `${a.target}:${a.success}`).sort();
-	const payload = JSON.stringify([
-		upgrades,
-		failures,
-		repairs
-	]);
-	return (0, node_crypto.createHash)("sha256").update(payload).digest("hex").slice(0, 8);
-}
-/**
-* 从分支名提取内容指纹（`dependfix/auto-fix-{fp8}` → `{fp8}`）。
-* 指纹格式为 8 位 hex；分支名不含 `-` 后的内容、前缀不匹配或格式不合法时返回 null
-* （如旧版 runId 分支，会被 supersede）。
-*/
-function extractFingerprintFromBranch(branchName) {
-	if (!branchName.startsWith(BRANCH_PREFIX)) return null;
-	const fingerprint = branchName.slice(19);
-	return /^[0-9a-f]{8}$/.test(fingerprint) ? fingerprint : null;
-}
-/**
-* 计算 fix-and-pr 去重决策：
-* - 存在同指纹 open PR → skip（仅需关闭其余异指纹 PR）
-* - 否则 → create（关闭全部旧 PR，先建新后关旧由调用方保证）
-*/
-function computeFixAndPrPlan(existingPRs, fingerprint) {
-	const sameContentPR = existingPRs.find((pr) => extractFingerprintFromBranch(pr.headRef) === fingerprint);
-	if (sameContentPR) return {
-		action: "skip",
-		sameContentPR,
-		supersedePRs: existingPRs.filter((pr) => pr !== sameContentPR)
-	};
-	return {
-		action: "create",
-		supersedePRs: existingPRs
-	};
-}
-/**
-* 在工作目录创建修复分支。
-*
-* - 分支名由调用方传入（T210 起为 `dependfix/auto-fix-{内容指纹}`，不再依赖 runId）
-* - 如果分支已存在（如重跑），切换到该分支
-*
-* @returns 分支名和是否为新创建
-*/
-function createFixBranch(branchName, workDir) {
-	if (branchExists(branchName, workDir)) {
-		(0, node_child_process.execSync)(`git checkout ${branchName}`, {
-			cwd: workDir,
-			stdio: "pipe"
-		});
-		return {
-			branchName,
-			created: false
-		};
-	}
-	(0, node_child_process.execSync)(`git checkout -b ${branchName}`, {
-		cwd: workDir,
-		stdio: "pipe"
-	});
-	return {
-		branchName,
-		created: true
-	};
-}
-/**
-* 暂存所有变更并提交。
-* 自动设置 git user.name / user.email（如未设置）。
-*/
-function stageAndCommit(message, workDir) {
-	ensureGitConfig(workDir);
-	(0, node_child_process.execSync)("git add .", {
-		cwd: workDir,
-		stdio: "pipe"
-	});
-	(0, node_child_process.execSync)(`git commit -m "${escapeShell(message)}"`, {
-		cwd: workDir,
-		stdio: "pipe"
-	});
-}
-/**
-* 推送分支到远程 origin。
-*/
-function pushBranch(branchName, workDir) {
-	(0, node_child_process.execSync)(`git push origin ${branchName}`, {
-		cwd: workDir,
-		stdio: "pipe"
-	});
-}
-/**
-* 查找目标仓库中所有 open 状态的 dependfix 自动修复 PR。
-*
-* GitHub 的 `pulls.list` 的 `head` 参数不支持通配符，因此拉取 open PR 列表后
-* 按 head 分支前缀 `dependfix/auto-fix-` 过滤。假设 PR 数量不多（单页 100 足够），
-* 未来 PR 数量增大时可引入 label 索引（见 backlog B1）。
-*/
-async function findDependfixOpenPR(octokit, owner, repo) {
-	const { data } = await octokit.rest.pulls.list({
-		owner,
-		repo,
-		state: "open",
-		per_page: 100
-	});
-	return data.filter((pr) => pr.head.ref.startsWith(BRANCH_PREFIX)).map((pr) => ({
-		number: pr.number,
-		htmlUrl: pr.html_url,
-		headRef: pr.head.ref
-	}));
-}
-/**
-* 关闭 Pull Request（用于 supersede 旧 PR）。
-*/
-async function closePullRequest(octokit, owner, repo, pullNumber) {
-	await octokit.rest.pulls.update({
-		owner,
-		repo,
-		pull_number: pullNumber,
-		state: "closed"
-	});
-}
-/**
-* 通过 GitHub API 创建 Pull Request。
-*/
-async function createPullRequest(params) {
-	const { octokit, owner, repo, headBranch, baseBranch, title, body } = params;
-	const { data } = await octokit.rest.pulls.create({
-		owner,
-		repo,
-		title,
-		body,
-		head: headBranch,
-		base: baseBranch
-	});
-	return {
-		number: data.number,
-		htmlUrl: data.html_url
-	};
-}
-/**
-* 列出远端所有 `dependfix/` 前缀分支（git.listMatchingRefs 精确前缀匹配）。
-*/
-async function listDependfixBranches(octokit, owner, repo) {
-	const { data } = await octokit.rest.git.listMatchingRefs({
-		owner,
-		repo,
-		ref: "heads/dependfix",
-		per_page: 100
-	});
-	return data.map((ref) => ref.ref.replace(/^refs\/heads\//, "")).filter((name) => name.startsWith("dependfix/"));
-}
-/**
-* 查询分支对应的最近 PR 状态（pulls.list head 精确匹配，按最近更新取 1 条）。
-*/
-async function getBranchPrStatus(octokit, owner, repo, branch) {
-	const { data } = await octokit.rest.pulls.list({
-		owner,
-		repo,
-		head: `${owner}:${branch}`,
-		state: "all",
-		sort: "updated",
-		direction: "desc",
-		per_page: 1
-	});
-	const pr = data[0];
-	if (!pr) return {
-		branch,
-		prNumber: null,
-		merged: false,
-		closed: false
-	};
-	return {
-		branch,
-		prNumber: pr.number,
-		merged: pr.state === "closed" && pr.merged_at !== null,
-		closed: pr.state === "closed"
-	};
-}
-/**
-* 删除远端分支（git ref delete）。失败（分支保护、不存在）由调用方捕获处理。
-*/
-async function deleteRemoteBranch(octokit, owner, repo, branch) {
-	await octokit.rest.git.deleteRef({
-		owner,
-		repo,
-		ref: `heads/${branch}`
-	});
-}
-/**
-* 判定交互确认回答是否为"是"（y/yes，大小写不敏感；空输入默认拒绝）。
-*/
-function isConfirmAnswer(answer) {
-	return /^y(es)?$/i.test(answer.trim());
-}
-/**
-* 从 RunResult 生成 PR body（Markdown）。
-*
-* @param supersededNumbers 被本 PR 取代并已关闭的旧 PR 编号列表（用于 Supersedes 声明）
-*/
-function generatePRBody(result, supersededNumbers) {
-	const { summary, actions, errors } = result;
-	const lines = [
-		"## 🔒 Dependfix Auto Fix",
-		"",
-		`**Run ID**: \`${result.runId}\``,
-		`**Mode**: ${result.config.mode}`,
-		`**Time**: ${result.startedAt}`,
-		"",
-		"### 📊 Summary",
-		"",
-		"| Metric | Value |",
-		"|--------|-------|",
-		`| Repositories scanned | ${summary.repositoriesScanned} |`,
-		`| Alerts found | ${summary.alertsFound} |`,
-		`| Alerts fixable | ${summary.alertsFixable} |`,
-		`| Dependencies upgraded | ${summary.alertsFixed} |`,
-		`| Upgrades failed | ${summary.alertsFailed} |`,
-		`| Lockfile repairs | ${summary.lockfileRepairs} |`,
-		`| Verifications passed | ${summary.verificationsPassed} |`,
-		`| Verifications failed | ${summary.verificationsFailed} |`,
-		""
-	];
-	const upgrades = actions.filter((a) => a.type === "dependency-upgrade" && a.success);
-	if (upgrades.length > 0) {
-		lines.push("### 📦 Upgraded Dependencies", "");
-		lines.push("| Package | From | To | Major |");
-		lines.push("|---------|------|----|-------|");
-		for (const a of upgrades) {
-			const major = a.isMajor ? "⚠️ Yes" : "No";
-			lines.push(`| \`${a.target}\` | ${a.fromVersion ?? "-"} | ${a.toVersion ?? "-"} | ${major} |`);
-		}
-		lines.push("");
-	}
-	const failures = actions.filter((a) => a.type === "dependency-upgrade" && !a.success);
-	if (failures.length > 0) {
-		lines.push("### ⚠️ Failed Upgrades", "");
-		for (const a of failures) lines.push(`- **\`${a.target}\`**: ${a.error ?? "unknown error"}`);
-		lines.push("");
-	}
-	const verifications = actions.filter((a) => a.type === "verification");
-	if (verifications.length > 0) {
-		lines.push("### ✅ Verification", "");
-		for (const v of verifications) {
-			const icon = v.success ? "✅" : "❌";
-			lines.push(`- ${icon} \`${v.target}\` ${v.error ? `(${v.error})` : ""}`);
-		}
-		lines.push("");
-	}
-	if (errors.length > 0) {
-		lines.push("### 🚨 Errors", "");
-		for (const e of errors) lines.push(`- **${e.stage}**: ${e.message}`);
-		lines.push("");
-	}
-	lines.push("---", "", "*This PR was automatically created by [dependfix](https://github.com/dependfix/dependfix).*");
-	if (supersededNumbers && supersededNumbers.length > 0) lines.push("", `> **Supersedes**: ${supersededNumbers.map((n) => `#${n}`).join(", ")}（内容已更新，将取代旧 PR）`);
-	return lines.join("\n");
-}
-function branchExists(branchName, workDir) {
-	try {
-		(0, node_child_process.execSync)(`git rev-parse --verify ${branchName}`, {
-			cwd: workDir,
-			stdio: "pipe"
-		});
-		return true;
-	} catch {
-		return false;
-	}
-}
-function ensureGitConfig(workDir) {
-	const hasName = gitConfigExists("user.name", workDir);
-	const hasEmail = gitConfigExists("user.email", workDir);
-	if (!hasName) (0, node_child_process.execSync)(`git config user.name "${BOT_NAME}"`, {
-		cwd: workDir,
-		stdio: "pipe"
-	});
-	if (!hasEmail) (0, node_child_process.execSync)(`git config user.email "${BOT_EMAIL}"`, {
-		cwd: workDir,
-		stdio: "pipe"
-	});
-}
-function gitConfigExists(key, workDir) {
-	try {
-		(0, node_child_process.execSync)(`git config ${key}`, {
-			cwd: workDir,
-			stdio: "pipe"
-		});
-		return true;
-	} catch {
-		return false;
-	}
-}
-function escapeShell(str) {
-	return str.replace(/"/g, "\\\"");
-}
-
-//#endregion
-//#region src/fixers/dependency/index.ts
-/**
-* 升级单个依赖到指定版本。
-*
-* - 在 `workDir` 中查找 `package.json` 并修改目标包的版本声明（保留原始前缀）
-* - 执行 `pnpm install --no-frozen-lockfile` 更新 lockfile
-* - 失败时自动回滚 `package.json` 和 `pnpm-lock.yaml`
-* - 不执行验证（由 T107 负责）
-*
-* @param params - 包名、目标版本、工作目录
-* @returns 修复结果
-*/
-async function upgradeDependency(params) {
-	const { packageName, targetVersion, workDir } = params;
-	const pkgPath = (0, node_path.join)(workDir, "package.json");
-	const lockfilePath = (0, node_path.join)(workDir, "pnpm-lock.yaml");
-	if (!(0, node_fs.existsSync)(pkgPath)) return failResult(packageName, targetVersion, "", `${pkgPath}: file not found`);
-	let pkg;
-	try {
-		pkg = JSON.parse((0, node_fs.readFileSync)(pkgPath, "utf-8"));
-	} catch {
-		return failResult(packageName, targetVersion, "", `${pkgPath}: invalid JSON`);
-	}
-	const dep = findDependencyVersion(pkg, packageName);
-	if (!dep) return failResult(packageName, targetVersion, "", `package "${packageName}" not found in dependencies / devDependencies / optionalDependencies`);
-	const fromVersion = dep.version;
-	const toVersion = `${extractPrefix(fromVersion)}${targetVersion}`;
-	const isMajor = parseMajorVersion(fromVersion) !== parseMajorVersion(toVersion) && parseMajorVersion(fromVersion) !== -1 && parseMajorVersion(toVersion) !== -1;
-	const pkgBackup = `${pkgPath}.bak`;
-	const lockBackup = `${lockfilePath}.bak`;
-	try {
-		(0, node_fs.copyFileSync)(pkgPath, pkgBackup);
-		if ((0, node_fs.existsSync)(lockfilePath)) (0, node_fs.copyFileSync)(lockfilePath, lockBackup);
-	} catch {
-		return failResult(packageName, targetVersion, fromVersion, "failed to create backup files");
-	}
-	const deps = pkg[dep.group];
-	if (!deps) return failResult(packageName, targetVersion, fromVersion, `dependency group "${dep.group}" is missing`);
-	deps[packageName] = toVersion;
-	(0, node_fs.writeFileSync)(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`, "utf-8");
-	try {
-		await execPnpmInstall(workDir);
-	} catch (installErr) {
-		rollback$1(pkgPath, pkgBackup, lockfilePath, lockBackup);
-		cleanupBackups({
-			pkgBackup,
-			lockBackup
-		});
-		return {
-			packageName,
-			fromVersion,
-			toVersion,
-			isMajor,
-			success: false,
-			error: `pnpm install failed: ${getStderr(installErr)}`
-		};
-	}
-	cleanupBackups({
-		pkgBackup,
-		lockBackup
-	});
-	return {
-		packageName,
-		fromVersion,
-		toVersion,
-		isMajor,
-		success: true
-	};
-}
-/**
-* 通过 pnpm `overrides` 升级间接（transitive）依赖。
-*
-* 间接依赖不在 `package.json` 的 `dependencies` / `devDependencies` 中列出，
-* 因此无法通过常规 `upgradeDependency` 处理。本函数根据项目类型选择覆盖写入位置：
-*
-* - **有 `pnpm-workspace.yaml`**（monorepo / workspace）→ 写入其中的 `overrides` 字段（pnpm v10+ 推荐）
-* - **无 `pnpm-workspace.yaml`**（单包项目）→ 写入 `package.json` 的 `pnpm.overrides`
-*
-* 失败时自动回滚被修改的文件和 `pnpm-lock.yaml`。不执行验证（由 T107 负责）。
-*
-* @param params - 包名、目标版本、工作目录
-* @returns 修复结果
-*/
-async function overrideTransitiveDependency(params) {
-	const { packageName, targetVersion, workDir } = params;
-	const pkgPath = (0, node_path.join)(workDir, "package.json");
-	const workspaceYamlPath = (0, node_path.join)(workDir, "pnpm-workspace.yaml");
-	const lockfilePath = (0, node_path.join)(workDir, "pnpm-lock.yaml");
-	const usesWorkspaceYaml = (0, node_fs.existsSync)(workspaceYamlPath);
-	if (!(0, node_fs.existsSync)(pkgPath)) return failResult(packageName, targetVersion, "", `${pkgPath}: file not found`);
-	let pkg;
-	try {
-		pkg = JSON.parse((0, node_fs.readFileSync)(pkgPath, "utf-8"));
-	} catch {
-		return failResult(packageName, targetVersion, "", `${pkgPath}: invalid JSON`);
-	}
-	const directDep = findDependencyVersion(pkg, packageName);
-	if (directDep) return failResult(packageName, targetVersion, directDep.version, `package "${packageName}" is a direct dependency (${directDep.group}), use upgradeDependency instead`);
-	const fromVersion = readLockfileVersion(lockfilePath, packageName) ?? "unknown";
-	const toVersion = `${extractPrefix(fromVersion)}${targetVersion}`;
-	const isMajor = parseMajorVersion(fromVersion) !== parseMajorVersion(toVersion) && parseMajorVersion(fromVersion) !== -1 && parseMajorVersion(toVersion) !== -1;
-	const pkgBackup = `${pkgPath}.bak`;
-	const workspaceBackup = usesWorkspaceYaml ? `${workspaceYamlPath}.bak` : null;
-	const lockBackup = `${lockfilePath}.bak`;
-	try {
-		(0, node_fs.copyFileSync)(pkgPath, pkgBackup);
-		if (usesWorkspaceYaml) (0, node_fs.copyFileSync)(workspaceYamlPath, workspaceBackup);
-		if ((0, node_fs.existsSync)(lockfilePath)) (0, node_fs.copyFileSync)(lockfilePath, lockBackup);
-	} catch {
-		return failResult(packageName, targetVersion, fromVersion, "failed to create backup files");
-	}
-	let oldOverride;
-	if (usesWorkspaceYaml) oldOverride = writeWorkspaceOverride(workspaceYamlPath, packageName, toVersion);
-	else {
-		const overrides = ensurePnpmOverrides(pkg);
-		oldOverride = overrides[packageName];
-		overrides[packageName] = toVersion;
-		(0, node_fs.writeFileSync)(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`, "utf-8");
-	}
-	try {
-		await execPnpmInstall(workDir);
-	} catch (installErr) {
-		rollbackOverrides({
-			usesWorkspaceYaml,
-			workspaceYamlPath,
-			packageName,
-			oldOverride,
-			pkg,
-			pkgPath
-		});
-		rollback$1(pkgPath, pkgBackup, lockfilePath, lockBackup);
-		if (usesWorkspaceYaml) rollback$1(workspaceYamlPath, workspaceBackup, lockfilePath, null);
-		cleanupBackups({
-			pkgBackup,
-			lockBackup,
-			workspaceBackup
-		});
-		return {
-			packageName,
-			fromVersion,
-			toVersion,
-			isMajor,
-			success: false,
-			error: `pnpm install failed: ${getStderr(installErr)}`
-		};
-	}
-	cleanupBackups({
-		pkgBackup,
-		lockBackup,
-		workspaceBackup
-	});
-	return {
-		packageName,
-		fromVersion,
-		toVersion,
-		isMajor,
-		success: true
-	};
-}
-/**
-* 从版本声明中提取前缀（^ / ~ / 空）。
-*
-* @example
-* extractPrefix('^4.17.20')  // '^'
-* extractPrefix('~4.17.0')   // '~'
-* extractPrefix('4.17.20')   // ''
-* extractPrefix('*')         // '^'  (默认)
-*/
-function extractPrefix(version) {
-	const trimmed = version.trim();
-	if (/^\d/.test(trimmed)) return "";
-	if (trimmed.startsWith("^")) return "^";
-	if (trimmed.startsWith("~")) return "~";
-	return "^";
-}
-/**
-* 从版本声明中提取主版本号（major）。
-* 去除前缀后匹配第一个 semver 段。
-*
-* @example
-* parseMajorVersion('^4.17.20')   // 4
-* parseMajorVersion('~2.0.0')     // 2
-* parseMajorVersion('1.2.3')      // 1
-* parseMajorVersion('*')          // -1
-*/
-function parseMajorVersion(version) {
-	const cleaned = version.replace(/^\s*[\^~>=<]*\s*/, "");
-	const match = /^(\d+)\.\d+\.\d+/.exec(cleaned);
-	return match ? Number.parseInt(match[1], 10) : -1;
-}
-/**
-* 在 `package.json` 的 `dependencies` / `devDependencies` / `optionalDependencies` 中按顺序查找包。
-*/
-function findDependencyVersion(pkg, packageName) {
-	for (const group of [
-		"dependencies",
-		"devDependencies",
-		"optionalDependencies"
-	]) {
-		const deps = pkg[group];
-		if (deps && typeof deps === "object" && packageName in deps) return {
-			group,
-			version: deps[packageName]
-		};
-	}
-	return null;
-}
-/**
-* 确保 `package.json` 中存在 `pnpm.overrides` 对象，若不存在则创建。
-* 返回 `overrides` 对象的引用，调用方可直接写入。
-*/
-function ensurePnpmOverrides(pkg) {
-	if (!pkg.pnpm) pkg.pnpm = {};
-	if (!pkg.pnpm.overrides) pkg.pnpm.overrides = {};
-	return pkg.pnpm.overrides;
-}
-/**
-* 从 `pnpm-lock.yaml` 中读取指定包的当前锁定版本。
-* 通过简单的正则匹配查找，不解析完整 YAML（性能优先）。
-*
-* pnpm v9+ lockfile 格式（v9.0 起）:
-*   /package-name/version:
-*   /@scope/package-name/version:
-*
-* @returns 锁定版本字符串（如 `'5.0.0'`），未找到返回 `null`
-*/
-function readLockfileVersion(lockfilePath, packageName) {
-	if (!(0, node_fs.existsSync)(lockfilePath)) return null;
-	try {
-		const content = (0, node_fs.readFileSync)(lockfilePath, "utf-8");
-		const escapedName = escapeRegExp(packageName);
-		const match = new RegExp(`^/${escapedName}/(\\d+(?:\\.\\d+(?:\\.\\d+)?(?:-[a-zA-Z0-9.]+)?)):`, "m").exec(content);
-		return match ? match[1] : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* 转义正则表达式特殊字符。
-*/
-function escapeRegExp(str) {
-	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-/**
-* 执行 `pnpm install --no-frozen-lockfile`。
-* 将同步 `execSync` 包装为 Promise，使上层 `upgradeDependency` 保持 async 语义。
-*/
-function execPnpmInstall(workDir) {
-	return new Promise((resolve, reject) => {
-		try {
-			(0, node_child_process.execSync)("pnpm install --no-frozen-lockfile", {
-				cwd: workDir,
-				encoding: "utf-8",
-				stdio: "pipe",
-				timeout: 12e4
-			});
-			resolve();
-		} catch (err) {
-			reject(err instanceof Error ? err : new Error(String(err)));
-		}
-	});
-}
-function failResult(packageName, targetVersion, fromVersion, error) {
-	return {
-		packageName,
-		fromVersion,
-		toVersion: targetVersion,
-		isMajor: false,
-		success: false,
-		error
-	};
-}
-function rollback$1(pkgPath, pkgBackup, lockfilePath, lockBackup) {
-	try {
-		if ((0, node_fs.existsSync)(pkgBackup)) (0, node_fs.copyFileSync)(pkgBackup, pkgPath);
-		if (lockBackup !== null && (0, node_fs.existsSync)(lockBackup)) (0, node_fs.copyFileSync)(lockBackup, lockfilePath);
-	} catch {}
-}
-/**
-* 安全删除备份文件，失败静默忽略。
-*/
-function safeUnlink(filePath) {
-	try {
-		if ((0, node_fs.existsSync)(filePath)) (0, node_fs.unlinkSync)(filePath);
-	} catch {}
-}
-/**
-* 清理所有备份文件。
-*/
-function cleanupBackups(paths) {
-	safeUnlink(paths.pkgBackup);
-	if (paths.lockBackup !== null) safeUnlink(paths.lockBackup);
-	if (paths.workspaceBackup) safeUnlink(paths.workspaceBackup);
-}
-/**
-* 在 `pnpm-workspace.yaml` 中写入一条 override。
-*
-* 读取现有 YAML → 设置 `overrides[packageName] = version` → 原样写回。
-*
-* @returns 写入前该包的旧值（`undefined` 表示原先不存在该 override）
-*/
-function writeWorkspaceOverride(workspaceYamlPath, packageName, version) {
-	let doc;
-	try {
-		const raw = (0, node_fs.readFileSync)(workspaceYamlPath, "utf-8");
-		doc = yaml.default.parse(raw) ?? {};
-	} catch {
-		doc = {};
-	}
-	const overrides = doc.overrides ?? {};
-	const old = overrides[packageName];
-	overrides[packageName] = version;
-	doc.overrides = overrides;
-	(0, node_fs.writeFileSync)(workspaceYamlPath, yaml.default.stringify(doc), "utf-8");
-	return old;
-}
-/**
-* 回滚 override 写入操作。
-*
-* - `pnpm-workspace.yaml` 模式：删除刚写入的条目，或恢复旧值
-* - `package.json` 模式：同理操作 `pkg.pnpm.overrides`
-*/
-function rollbackOverrides(params) {
-	const { usesWorkspaceYaml, workspaceYamlPath, packageName, oldOverride, pkg, pkgPath } = params;
-	if (usesWorkspaceYaml) try {
-		const raw = (0, node_fs.readFileSync)(workspaceYamlPath, "utf-8");
-		const doc = yaml.default.parse(raw) ?? {};
-		const overrides = doc.overrides ?? {};
-		if (oldOverride === void 0) {
-			const next = Object.fromEntries(Object.entries(overrides).filter(([key]) => key !== packageName));
-			if (Object.keys(next).length === 0) delete doc.overrides;
-			else doc.overrides = next;
-		} else overrides[packageName] = oldOverride;
-		(0, node_fs.writeFileSync)(workspaceYamlPath, yaml.default.stringify(doc), "utf-8");
-	} catch {}
-	else {
-		if (pkg.pnpm?.overrides) {
-			const overrides = pkg.pnpm.overrides;
-			if (oldOverride === void 0) {
-				const next = Object.fromEntries(Object.entries(overrides).filter(([key]) => key !== packageName));
-				if (Object.keys(next).length === 0) {
-					delete pkg.pnpm.overrides;
-					if (Object.keys(pkg.pnpm).length === 0) delete pkg.pnpm;
-				} else pkg.pnpm.overrides = next;
-			} else overrides[packageName] = oldOverride;
-		}
-		(0, node_fs.writeFileSync)(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`, "utf-8");
-	}
-}
-function getStderr(err) {
-	if (err instanceof Error && "stderr" in err) {
-		const stderr = err.stderr;
-		if (typeof stderr === "string") return stderr.trim();
-		if (Buffer.isBuffer(stderr)) return stderr.toString("utf-8").trim();
-		return typeof stderr === "object" && stderr !== null ? JSON.stringify(stderr) : String(stderr);
-	}
-	if (err instanceof Error) return err.message;
-	return typeof err === "object" && err !== null ? JSON.stringify(err) : String(err);
-}
-
-//#endregion
-//#region src/fixers/pnpm/index.ts
-/**
-* 执行 `pnpm i --frozen-lockfile` 并解析失败分类。
-* 成功时返回 { ok: true }。
-*/
-function classifyLockfileFailure(workDir) {
-	try {
-		(0, node_child_process.execSync)("pnpm install --frozen-lockfile", {
-			cwd: workDir,
-			stdio: "pipe",
-			timeout: 12e4
-		});
-		return { ok: true };
-	} catch (err) {
-		const stderr = getStderrText(err);
-		if (!stderr) return {
-			ok: false,
-			category: "UNKNOWN",
-			stderr: ""
-		};
-		return {
-			ok: false,
-			category: parseFailureCategory(stderr),
-			stderr
-		};
-	}
-}
-const FAILURE_PATTERNS = [
-	["LOCKFILE_NOT_FOUND", /no lockfile|Cannot find.*pnpm-lock\.yaml|ENOENT.*lockfile/i],
-	["MANIFEST_MISMATCH", /ERR_PNPM_OUTDATED_LOCKFILE|out of sync|needs update/i],
-	["CREDENTIAL_ERROR", /E401|ERR_PNPM_FETCH_401|ERR_PNPM_FETCH_403|authentication failed|Authorization/i],
-	["CORRUPTED_LOCKFILE", /\b(broken|corrupted|Cannot read).*lockfile|ERR_PNPM_BROKEN_LOCKFILE/i],
-	["LOCKFILE_VERSION_MISMATCH", /lockfileVersion.*incompatible|unsupported lockfile version|lockfile had been generated with/i],
-	["RESOLVE_ERROR", /ERR_PNPM_NO_MATCHING_VERSION|resolution|resolve.*failed|ERR_PNPM_PEER_DEP_ISSUES/i]
-];
-/**
-* 按优先级匹配 stderr，返回首个命中的 FailureCategory。
-* 不匹配任何特征时返回 'UNKNOWN'。
-*/
-function parseFailureCategory(stderr) {
-	for (const [category, pattern] of FAILURE_PATTERNS) if (pattern.test(stderr)) return category;
-	return "UNKNOWN";
-}
-function getStderrText(err) {
-	if (!err.stderr) return err.message ?? "";
-	if (typeof err.stderr === "string") return err.stderr;
-	return err.stderr.toString("utf-8");
-}
-function execRepair(command, workDir, timeoutMs = 18e4) {
-	(0, node_child_process.execSync)(command, {
-		cwd: workDir,
-		stdio: "pipe",
-		timeout: timeoutMs
-	});
-}
-/**
-* 确定某个分类下适用的修复策略链（从首到末）。
-* CREDENTIAL_ERROR 返回空链（不可修复）。
-*/
-function getStrategyChain(category) {
-	switch (category) {
-		case "LOCKFILE_NOT_FOUND":
-		case "MANIFEST_MISMATCH": return ["REGENERATE", "REINSTALL"];
-		case "CORRUPTED_LOCKFILE": return [
-			"FIX_ENTRIES",
-			"REGENERATE",
-			"REINSTALL"
-		];
-		case "LOCKFILE_VERSION_MISMATCH": return [
-			"PIN_TOOLCHAIN",
-			"REGENERATE",
-			"REINSTALL"
-		];
-		case "RESOLVE_ERROR": return [
-			"REGENERATE",
-			"FIX_ENTRIES",
-			"REINSTALL"
-		];
-		case "UNKNOWN": return ["REGENERATE", "REINSTALL"];
-		case "CREDENTIAL_ERROR": return [];
-	}
-}
-function getStrategyCommand(strategy) {
-	switch (strategy) {
-		case "REGENERATE": return "pnpm install --lockfile-only";
-		case "FIX_ENTRIES": return "pnpm install --fix-lockfile --lockfile-only";
-		case "REINSTALL": return "pnpm install --no-frozen-lockfile";
-		case "PIN_TOOLCHAIN": return "pnpm install --lockfile-only";
-		default: return "";
-	}
-}
-/**
-* 比较修复前后 lockfile，返回行数与包数量变化摘要。
-*/
-function computeLockfileDiff(beforePath, afterPath) {
-	const beforeLines = countLockfileLines(beforePath);
-	const afterLines = countLockfileLines(afterPath);
-	const beforePackages = countLockfilePackages(beforePath);
-	const afterPackages = countLockfilePackages(afterPath);
-	const linesChanged = afterLines - beforeLines;
-	const packagesChanged = afterPackages - beforePackages;
-	const parts = [];
-	if (linesChanged !== 0) parts.push(`${linesChanged > 0 ? "+" : ""}${linesChanged} lines`);
-	if (packagesChanged !== 0) parts.push(`${packagesChanged > 0 ? "+" : ""}${packagesChanged} packages`);
-	return {
-		linesChanged,
-		packagesChanged,
-		summary: parts.length > 0 ? `lockfile updated: ${parts.join(", ")}` : "lockfile unchanged"
-	};
-}
-function countLockfileLines(path) {
-	if (!(0, node_fs.existsSync)(path)) return 0;
-	return (0, node_fs.readFileSync)(path, "utf-8").split("\n").length;
-}
-/**
-* 统计 pnpm-lock.yaml 中 `packages:` 块下的条目数。
-* packages 条目以缩进 + `/` 开头（如 `  /lodash@4.17.21:`）。
-*/
-function countLockfilePackages(path) {
-	if (!(0, node_fs.existsSync)(path)) return 0;
-	const lines = (0, node_fs.readFileSync)(path, "utf-8").split("\n");
-	let inPackages = false;
-	let count = 0;
-	for (const line of lines) {
-		if (!inPackages) {
-			if (/^packages:\s*$/.test(line)) inPackages = true;
-			continue;
-		}
-		if (/^[a-zA-Z]/.test(line)) break;
-		if (/^\s+\//.test(line)) count++;
-	}
-	return count;
-}
-/**
-* 从 package.json 的 `packageManager` 字段解析 pnpm 版本。
-* 优先级: toolchain.pnpmVersion > packageManager > null
-*/
-function resolvePnpmVersion(workDir, toolchain) {
-	if (toolchain?.pnpmVersion) return toolchain.pnpmVersion;
-	const pkgPath = (0, node_path.join)(workDir, "package.json");
-	if (!(0, node_fs.existsSync)(pkgPath)) return null;
-	try {
-		const pm = JSON.parse((0, node_fs.readFileSync)(pkgPath, "utf-8")).packageManager;
-		if (typeof pm === "string") {
-			const match = /pnpm@(.+)$/.exec(pm);
-			if (match?.[1]) return match[1];
-		}
-	} catch {}
-	return null;
-}
-const LOCKFILE_NAME = "pnpm-lock.yaml";
-/**
-* 在 workDir 中使用 `pnpm install --frozen-lockfile` 验证 lockfile 合规性。
-* 验证通过 → 返回 ret:0；失败 → 返回 ret:1 + stderr。
-* 不抛异常——调用方通过 ret 判断结果。
-*/
-function verifyFrozenLockfile(workDir) {
-	try {
-		(0, node_child_process.execSync)("pnpm install --frozen-lockfile", {
-			cwd: workDir,
-			stdio: "pipe",
-			timeout: 12e4
-		});
-		return {
-			ret: 0,
-			stderr: ""
-		};
-	} catch (err) {
-		return {
-			ret: 1,
-			stderr: getStderrText(err)
-		};
-	}
-}
-/**
-* 备份 pnpm-lock.yaml → `<name>.bak`，返回备份路径。
-* lockfile 不存在时会创建空 .bak（回滚时删除即可）。
-*/
-function backupLockfilePath(workDir) {
-	const src = (0, node_path.join)(workDir, LOCKFILE_NAME);
-	const bak = `${src}.bak`;
-	if ((0, node_fs.existsSync)(src)) (0, node_fs.copyFileSync)(src, bak);
-	return bak;
-}
-/** 从 .bak 还原 lockfile，并删除 .bak。 */
-function rollback(bakPath, workDir) {
-	const target = (0, node_path.join)(workDir, LOCKFILE_NAME);
-	try {
-		if ((0, node_fs.existsSync)(bakPath)) (0, node_fs.copyFileSync)(bakPath, target);
-	} finally {
-		try {
-			(0, node_fs.rmSync)(bakPath);
-		} catch {}
-	}
-}
-/**
-* 检测并修复 pnpm frozen-lockfile 漂移。
-*
-* 流程：
-* 1. 先跑 `pnpm i --frozen-lockfile` 诊断
-* 2. 若已合规 → 直接返回 success
-* 3. 若为 CREDENTIAL_ERROR → SKIP
-* 4. 按分类选取策略链，逐级尝试修复：
-*    - 每个策略执行后立即用 `pnpm i --frozen-lockfile` 验证
-*    - 验证通过 → 记录 diff、返回 success
-*    - 验证失败 → 继续下一个策略
-* 5. 所有策略失败 → 回滚 lockfile、返回失败结果
-*/
-function repairLockfile(params) {
-	const { workDir } = params;
-	const workDir_ = workDir;
-	const attempts = [];
-	const bakPath = backupLockfilePath(workDir_);
-	const classification = classifyLockfileFailure(workDir_);
-	if (classification.ok) {
-		try {
-			(0, node_fs.rmSync)(bakPath);
-		} catch {}
-		return {
-			success: true,
-			diff: null,
-			attemptHistory: attempts
-		};
-	}
-	const category = classification.category ?? "UNKNOWN";
-	const stderr = classification.stderr ?? "";
-	if (category === "CREDENTIAL_ERROR") {
-		try {
-			(0, node_fs.rmSync)(bakPath);
-		} catch {}
-		return {
-			success: false,
-			failureCategory: "CREDENTIAL_ERROR",
-			failureDetail: `registry authentication error: ${truncate(stderr, 500)}`,
-			strategy: "SKIP",
-			attemptHistory: attempts
-		};
-	}
-	const strategyChain = getStrategyChain(category);
-	let lastError = stderr;
-	const startTimestamp = Date.now();
-	for (const strategy of strategyChain) {
-		const command = getStrategyCommand(strategy);
-		const t0 = Date.now();
-		let strategySuccess = false;
-		let strategyError;
-		try {
-			execRepair(command, workDir_);
-			strategySuccess = true;
-		} catch (err) {
-			strategyError = getStderrText(err) || err.message;
-		}
-		const durationMs = Date.now() - t0;
-		attempts.push({
-			strategy,
-			command,
-			success: strategySuccess,
-			error: strategyError,
-			durationMs
-		});
-		if (!strategySuccess) {
-			lastError = strategyError ?? lastError;
-			continue;
-		}
-		const verify = verifyFrozenLockfile(workDir_);
-		if (verify.ret === 0) {
-			const diff = computeLockfileDiff(bakPath, (0, node_path.join)(workDir_, LOCKFILE_NAME));
-			try {
-				(0, node_fs.rmSync)(bakPath);
-			} catch {}
-			return {
-				success: true,
-				strategy,
-				diff,
-				attemptHistory: attempts
-			};
-		}
-		lastError = verify.stderr;
-	}
-	rollback(bakPath, workDir_);
-	const durationMs = Date.now() - startTimestamp;
-	attempts.push({
-		strategy: "SKIP",
-		command: "rollback",
-		success: true,
-		durationMs
-	});
-	return {
-		success: false,
-		failureCategory: category,
-		failureDetail: truncate(lastError, 500),
-		attemptHistory: attempts
-	};
-}
-function truncate(text, maxLen) {
-	if (text.length <= maxLen) return text;
-	return `${text.slice(0, maxLen)}…`;
-}
-
-//#endregion
-//#region src/runners/verification-runner.ts
-const DEFAULT_COMMANDS = [
-	"pnpm install --frozen-lockfile",
-	"pnpm lint",
-	"pnpm build"
-];
-const MAX_OUTPUT_LINES = 200;
-/**
-* 按顺序在工作目录执行命令序列，任一命令失败则停止。
-*
-* @example
-* ```ts
-* const result = await runVerification({ workDir: '/repo' })
-* if (!result.success) {
-*     console.error(result.failure)
-* }
-* ```
-*/
-async function runVerification(params) {
-	const commands = params.commands ?? DEFAULT_COMMANDS;
-	const commandResults = [];
-	for (const command of commands) {
-		const result = await execCommand(command, params.workDir);
-		commandResults.push(result);
-		if (result.exitCode !== 0) return {
-			success: false,
-			commandResults,
-			failedCommand: command,
-			failure: `command "${command}" exited with code ${result.exitCode}`
-		};
-	}
-	return {
-		success: true,
-		commandResults
-	};
-}
-/**
-* 执行单条 shell 命令，捕获 stdout/stderr（截断到 200 行）并脱敏。
-*/
-function execCommand(command, workDir) {
-	return new Promise((resolve) => {
-		const startTime = Date.now();
-		const cp = (0, node_child_process.spawn)(command, {
-			cwd: workDir,
-			shell: true,
-			stdio: "pipe"
-		});
-		const stdoutChunks = [];
-		const stderrChunks = [];
-		cp.stdout.on("data", (data) => {
-			stdoutChunks.push(data.toString("utf-8"));
-		});
-		cp.stderr.on("data", (data) => {
-			stderrChunks.push(data.toString("utf-8"));
-		});
-		cp.on("error", (err) => {
-			resolve({
-				command,
-				exitCode: -1,
-				durationMs: Date.now() - startTime,
-				stdout: "",
-				stderr: sanitizeOutput(err.message)
-			});
-		});
-		cp.on("close", (code) => {
-			const stdout = truncateLines(stdoutChunks.join(""), MAX_OUTPUT_LINES);
-			const stderr = truncateLines(stderrChunks.join(""), MAX_OUTPUT_LINES);
-			resolve({
-				command,
-				exitCode: code ?? -1,
-				durationMs: Date.now() - startTime,
-				stdout: sanitizeOutput(stdout),
-				stderr: sanitizeOutput(stderr)
-			});
-		});
-	});
-}
-/** 截断文本到指定行数 */
-function truncateLines(text, maxLines) {
-	const lines = text.split("\n");
-	if (lines.length <= maxLines) return text;
-	return `${lines.slice(0, maxLines).join("\n")}\n... (truncated, ${lines.length - maxLines} more lines)`;
-}
-/**
-* 脱敏处理：移除命令输出中可能包含的敏感信息。
-*
-* 过滤规则：
-* - 包含 `token=` / `secret=` / `password=` 的行
-* - `npm_config_` / `GITHUB_TOKEN` / `NPM_TOKEN` 等环境变量暴露
-* - URL 中的 user:password@ 模式
-*/
-const SECRET_PATTERNS = [
-	[/^(GITHUB_TOKEN|NPM_TOKEN|NODE_AUTH_TOKEN|DOCKER_PASSWORD)=.+/gim, "$1=***"],
-	[/\b(token|secret|password|api[_-]?key)\s*[=:]\s*\S+/gi, "$1=***"],
-	[/\/\/[^@\n]+@/g, "//***@"],
-	[/npm_config_[a-z_]+=\S+/g, "npm_config_***=***"]
-];
-/**
-* 对外暴露以支持单独测试
-*/
-function sanitizeOutput(output) {
-	let result = output;
-	for (const [pattern, replacement] of SECRET_PATTERNS) result = result.replace(pattern, replacement);
-	return result;
-}
-
-//#endregion
-//#region src/app-helpers.ts
-const DEFAULT_VERIFY_COMMANDS = [
-	"pnpm install --frozen-lockfile",
-	"pnpm lint",
-	"pnpm build"
-];
-/** 匹配 `pnpm <singleWord>` 模式的命令（可能是 package.json script 引用） */
-const PNPM_SCRIPT_RE = /^pnpm\s+([a-zA-Z][a-zA-Z0-9:_-]*)$/;
-/** 自动修复提交的标准消息（本地 --commit 与 fix-and-pr 共用） */
-const FIX_COMMIT_MESSAGE = "fix(deps): automated dependfix security repair";
-/**
-* 升级单个告警对应的依赖（dry-run 仅记录）。
-* 优先直接升级，失败且为间接依赖时回退到 pnpm overrides。
-*/
-async function upgradeAlert(ctx, alert) {
-	const { config, logger, workDir } = ctx;
-	const startMs = Date.now();
-	if (config.dryRun) {
-		logger.info(`[dry-run] Would upgrade ${alert.packageName} to ${alert.recommendedVersion}`);
-		return {
-			type: "dependency-upgrade",
-			repository: alert.repository,
-			target: alert.packageName,
-			fromVersion: alert.recommendedVersion ? `< ${alert.recommendedVersion}` : void 0,
-			toVersion: alert.recommendedVersion,
-			isMajor: false,
-			success: true,
-			durationMs: 0
-		};
-	}
-	try {
-		let result = await upgradeDependency({
-			packageName: alert.packageName,
-			targetVersion: alert.recommendedVersion,
-			workDir
-		});
-		if (!result.success && result.error?.includes("not found in dependencies")) {
-			result = await overrideTransitiveDependency({
-				packageName: alert.packageName,
-				targetVersion: alert.recommendedVersion,
-				workDir
-			});
-			logger.info(result.success ? `Upgraded ${result.packageName}: ${result.fromVersion} → ${result.toVersion} (pnpm overrides)` : `Failed to upgrade ${result.packageName}: ${result.error}`);
-		} else logger.info(result.success ? `Upgraded ${result.packageName}: ${result.fromVersion} → ${result.toVersion}` : `Failed to upgrade ${result.packageName}: ${result.error}`);
-		return {
-			type: "dependency-upgrade",
-			repository: alert.repository,
-			target: alert.packageName,
-			fromVersion: result.fromVersion,
-			toVersion: result.toVersion,
-			isMajor: result.isMajor,
-			success: result.success,
-			error: result.error,
-			durationMs: Date.now() - startMs
-		};
-	} catch (error) {
-		const message = (0, _dependfix_core.toErrorMessage)(error);
-		logger.error(`Upgrade error for ${alert.packageName}: ${message}`);
-		return {
-			type: "dependency-upgrade",
-			repository: alert.repository,
-			target: alert.packageName,
-			toVersion: alert.recommendedVersion,
-			success: false,
-			error: message,
-			durationMs: Date.now() - startMs
-		};
-	}
-}
-/** 尝试修复 pnpm-lock.yaml（dry-run 仅记录）。 */
-function tryLockfileRepair(ctx, repo) {
-	const { config, logger, workDir } = ctx;
-	const startMs = Date.now();
-	if (config.dryRun) {
-		logger.info(`[dry-run] Would attempt lockfile repair for ${repo}`);
-		return {
-			type: "lockfile-repair",
-			repository: repo,
-			target: "pnpm-lock.yaml",
-			success: true,
-			durationMs: 0
-		};
-	}
-	try {
-		const result = repairLockfile({ workDir });
-		logger.info(result.success ? `Lockfile repaired for ${repo} (strategy: ${result.strategy ?? "N/A"})` : `Lockfile repair failed for ${repo}: ${result.failureDetail ?? "unknown"}`);
-		return {
-			type: "lockfile-repair",
-			repository: repo,
-			target: "pnpm-lock.yaml",
-			success: result.success,
-			error: result.success ? void 0 : result.failureDetail ?? "Lockfile repair failed",
-			strategy: result.strategy,
-			durationMs: Date.now() - startMs,
-			diff: result.diff?.summary
-		};
-	} catch (error) {
-		const message = (0, _dependfix_core.toErrorMessage)(error);
-		logger.error(`Lockfile repair error for ${repo}: ${message}`);
-		return {
-			type: "lockfile-repair",
-			repository: repo,
-			target: "pnpm-lock.yaml",
-			success: false,
-			error: message,
-			durationMs: Date.now() - startMs
-		};
-	}
-}
-/** 执行验证命令链，返回逐命令结果。 */
-async function verifyProject(ctx, repo) {
-	const { customCommands, logger, workDir, allErrors } = ctx;
-	const rawCommands = customCommands ?? DEFAULT_VERIFY_COMMANDS;
-	const { valid, skipped } = !customCommands ? validateVerifyCommands(rawCommands, workDir) : {
-		valid: rawCommands,
-		skipped: []
-	};
-	for (const cmd of skipped) {
-		logger.info(`Skipping command "${cmd}": script not found in package.json`);
-		allErrors.push({
-			repository: repo,
-			target: cmd,
-			stage: "verify",
-			category: "SCRIPT_NOT_FOUND",
-			message: `Skipped: no matching script in package.json for "${cmd}"`
-		});
-	}
-	if (valid.length === 0) {
-		logger.info(`No verification commands to run for ${repo}`);
-		return [];
-	}
-	try {
-		return (await runVerification({
-			workDir,
-			commands: valid
-		})).commandResults.map((cr) => ({
-			type: "verification",
-			repository: repo,
-			target: cr.command,
-			success: cr.exitCode === 0,
-			error: cr.exitCode !== 0 ? `exit code ${cr.exitCode}` : void 0,
-			durationMs: cr.durationMs
-		}));
-	} catch (error) {
-		const message = (0, _dependfix_core.toErrorMessage)(error);
-		logger.error(`Verification error for ${repo}: ${message}`);
-		return [{
-			type: "verification",
-			repository: repo,
-			target: "verification",
-			success: false,
-			error: message
-		}];
-	}
-}
-/**
-* 校验默认命令链中的脚本引用是否存在。
-*
-* - `pnpm install --frozen-lockfile` 等非脚本命令 → 直接保留
-* - `pnpm lint` 等脚本命令 → 检查 `package.json#scripts` 是否存在对应键
-* - 用户自定义命令（`--commands`）不经过此校验
-*/
-function validateVerifyCommands(commands, workDir) {
-	const pkgJsonPath = (0, node_path.join)(workDir, "package.json");
-	let pkgScripts = {};
-	if ((0, node_fs.existsSync)(pkgJsonPath)) try {
-		pkgScripts = JSON.parse((0, node_fs.readFileSync)(pkgJsonPath, "utf-8")).scripts ?? {};
-	} catch {
-		return {
-			valid: commands,
-			skipped: []
-		};
-	}
-	const valid = [];
-	const skipped = [];
-	for (const cmd of commands) {
-		const match = PNPM_SCRIPT_RE.exec(cmd);
-		if (match) {
-			const scriptName = match[1];
-			if (pkgScripts[scriptName]) valid.push(cmd);
-			else skipped.push(cmd);
-		} else valid.push(cmd);
-	}
-	return {
-		valid,
-		skipped
-	};
-}
-/**
-* 将修复产生的变更提交到本地当前分支。
-*
-* - 无任何变更（含已暂存变更）时跳过
-* - config 校验已保证 `commit` 与 `dryRun` / `createPullRequest` 互斥，
-*   因此这里不需要再检查这两个开关
-*/
-function commitLocalChanges(ctx) {
-	const { logger, workDir } = ctx;
-	if (!hasGitChanges(workDir)) {
-		logger.info("No changes to commit — skipping local commit");
-		return;
-	}
-	ensureGitignore(workDir);
-	stageAndCommit(FIX_COMMIT_MESSAGE, workDir);
-	logger.info(`Committed fix changes to current branch: ${FIX_COMMIT_MESSAGE}`);
-}
-/**
-* 检查工作目录是否有未提交的变更（含未暂存与已暂存）。
-*/
-function hasGitChanges(workDir) {
-	try {
-		(0, node_child_process.execSync)("git diff --quiet", {
-			cwd: workDir,
-			stdio: "pipe"
-		});
-		(0, node_child_process.execSync)("git diff --cached --quiet", {
-			cwd: workDir,
-			stdio: "pipe"
-		});
-		return false;
-	} catch {
-		return true;
-	}
-}
-/**
-* 确保目标仓库的 `.gitignore` 中包含 `dependfix-reports/`。
-*
-* - 仅在 workDir 是 git 仓库时执行
-* - 已存在该条目时幂等跳过
-* - 失败（权限、磁盘满等）静默降级
-*/
-function ensureGitignore(workDir) {
-	try {
-		if (!(0, node_fs.existsSync)((0, node_path.join)(workDir, ".git"))) return;
-		const gitignorePath = (0, node_path.join)(workDir, ".gitignore");
-		const entry = "dependfix-reports/";
-		let content = "";
-		if ((0, node_fs.existsSync)(gitignorePath)) content = (0, node_fs.readFileSync)(gitignorePath, "utf-8");
-		if (content.split("\n").some((l) => l.trim() === entry)) return;
-		const block = `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}# dependfix\n${entry}\n`;
-		(0, node_fs.writeFileSync)(gitignorePath, content + block, "utf-8");
-	} catch {}
-}
-/**
-* 关闭被取代的旧 PR。单条关闭失败不中断其余 PR 的关闭，
-* 失败记录为 `PR_CLOSE_FAILED`（与 PR 创建失败区分）。
-*/
-async function closeSupersededPRs(ctx, client, owner, repo, supersedePRs) {
-	const { logger, allErrors } = ctx;
-	for (const old of supersedePRs) try {
-		await closePullRequest(client, owner, repo, old.number);
-		logger.info(`Closed superseded PR #${old.number}`);
-	} catch (error) {
-		const message = (0, _dependfix_core.toErrorMessage)(error);
-		logger.error(`Failed to close superseded PR #${old.number}: ${message}`);
-		allErrors.push({
-			repository: `${owner}/${repo}`,
-			stage: "report",
-			category: "PR_CLOSE_FAILED",
-			message: `Failed to close PR #${old.number}: ${message}`
-		});
-	}
-}
-/**
-* （fix-and-pr + --cleanup-branches）将已合并的 dependfix 分支列为待清理清单，
-* 记录到报告与日志，不执行删除。
-*/
-async function reportCleanupCandidates(ctx, client) {
-	const { config, logger, allActions, allErrors } = ctx;
-	for (const repo of config.repositories) {
-		const [owner, name] = repo.split("/");
-		try {
-			const branches = await listDependfixBranches(client, owner, name);
-			for (const branch of branches) if ((await getBranchPrStatus(client, owner, name, branch)).merged) {
-				logger.info(`[cleanup] merged branch awaiting manual cleanup: ${branch}`);
-				allActions.push({
-					type: "branch-cleanup",
-					repository: repo,
-					target: branch,
-					success: true,
-					diff: "merged; run `dependfix cleanup-branches` to delete",
-					durationMs: 0
-				});
-			}
-		} catch (error) {
-			const message = (0, _dependfix_core.toErrorMessage)(error);
-			logger.error(`[cleanup] detection failed for ${repo}: ${message}`);
-			allErrors.push({
-				repository: repo,
-				stage: "report",
-				category: "CLEANUP_DETECT_FAILED",
-				message
-			});
-		}
-	}
-}
-/**
-* 交互式确认删除。非 TTY（CI/管道）时直接拒绝。
-*/
-function confirmCleanup(ctx, repo, candidates) {
-	const { logger } = ctx;
-	if (!process.stdin.isTTY) {
-		logger.warn("[cleanup] non-TTY environment — deletion requires interactive confirmation, aborting");
-		return Promise.resolve(false);
-	}
-	const rl = (0, node_readline.createInterface)({
-		input: process.stdin,
-		output: process.stdout
-	});
-	return new Promise((resolve) => {
-		rl.question(`Delete ${candidates.length} branch(es) from ${repo}? [y/N] `, (answer) => {
-			rl.close();
-			resolve(isConfirmAnswer(answer));
-		});
-	});
-}
-/** 汇总所有动作到 summary（alertsSkipped 已在 processRepoForFix 中累加）。 */
-function computeSummary(ctx) {
-	const { config, allActions, allAlerts, summary } = ctx;
-	let fixed = 0;
-	let failed = 0;
-	let lockfileRepairs = 0;
-	let verificationsPassed = 0;
-	let verificationsFailed = 0;
-	for (const action of allActions) {
-		if (action.type === "dependency-upgrade") if (action.success) fixed++;
-		else failed++;
-		if (action.type === "lockfile-repair" && action.success) lockfileRepairs++;
-		if (action.type === "verification") if (action.success) verificationsPassed++;
-		else verificationsFailed++;
-	}
-	const fixable = allAlerts.filter((a) => a.fixable).length;
-	summary.repositoriesScanned = config.repositories.length;
-	summary.alertsFound = allAlerts.length;
-	summary.alertsFixable = fixable;
-	summary.alertsFixed = fixed;
-	summary.alertsFailed = failed;
-	summary.lockfileRepairs = lockfileRepairs;
-	summary.verificationsPassed = verificationsPassed;
-	summary.verificationsFailed = verificationsFailed;
-}
-/** 组装最终运行结果。 */
-function buildRunResult(ctx) {
-	const reportConfig = {
-		mode: ctx.config.mode,
-		severityThreshold: ctx.config.severityThreshold,
-		repositories: ctx.config.repositories,
-		dryRun: ctx.config.dryRun,
-		createPullRequest: ctx.config.createPullRequest,
-		maxAlertsPerRepository: ctx.config.maxAlertsPerRepository
-	};
-	return {
-		runId: ctx.runId,
-		startedAt: ctx.startedAt,
-		finishedAt: ctx.finishedAt,
-		config: reportConfig,
-		summary: ctx.summary,
-		repositories: ctx.repoResults,
-		alerts: ctx.allAlerts,
-		actions: ctx.allActions,
-		errors: ctx.allErrors
-	};
-}
-/**
-* 计算退出码：
-* - 0: 全部仓库处理成功（无 failed actions、无 errors）
-* - 1: 部分仓库失败
-* - 2: 全部仓库失败（或无仓库被成功处理）
-*/
-function computeExitCode(ctx) {
-	const { config, allErrors, allActions, repoResults } = ctx;
-	const hasErrors = allErrors.length > 0;
-	const hasFailures = allActions.some((a) => !a.success);
-	const hasRepoSuccess = repoResults.length > 0 && repoResults.some((r) => r.alertsCount > 0 || r.fixed > 0 || r.verificationPassed === true);
-	const hasCleanupSuccess = config.mode === "cleanup-branches" && allActions.some((a) => a.success && a.type === "branch-cleanup");
-	const hasSuccess = hasRepoSuccess || hasCleanupSuccess;
-	if (config.mode === "fix-and-pr") return 0;
-	if (!hasErrors && !hasFailures) return 0;
-	if (hasSuccess) return 1;
-	return 2;
-}
-
-//#endregion
-//#region src/app.ts
-var DependfixApp = class {
-	config;
-	workDir;
-	logger;
-	verbose;
-	customCommands;
-	runId;
-	allAlerts = [];
-	allActions = [];
-	allErrors = [];
-	repoResults = [];
-	summary = (0, _dependfix_core.createEmptyRunSummary)();
-	startedAt = "";
-	finishedAt = "";
-	constructor(options) {
-		this.config = options.config;
-		this.workDir = options.workDir ?? process.cwd();
-		this.verbose = options.verbose ?? false;
-		this.customCommands = options.commands;
-		this.runId = `dependfix-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-		this.logger = (0, _dependfix_core.createLogger)({
-			name: "dependfix",
-			minLevel: this.verbose ? "debug" : "info"
-		});
-	}
-	/** 供辅助方法使用的状态切片。 */
-	get ctx() {
-		return {
-			config: this.config,
-			workDir: this.workDir,
-			logger: this.logger,
-			customCommands: this.customCommands,
-			runId: this.runId,
-			allAlerts: this.allAlerts,
-			allActions: this.allActions,
-			allErrors: this.allErrors,
-			repoResults: this.repoResults,
-			summary: this.summary,
-			startedAt: this.startedAt,
-			finishedAt: this.finishedAt
-		};
-	}
-	/** 执行完整的编排流程，返回结构化结果和退出码。 */
-	async run() {
-		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
-		this.logger.info(`Starting dependfix run ${this.runId}`, {
-			mode: this.config.mode,
-			repositories: this.config.repositories
-		});
-		try {
-			await this.executeMode();
-		} catch (error) {
-			const message = (0, _dependfix_core.toErrorMessage)(error);
-			this.logger.error(`Unexpected error: ${message}`);
-			this.allErrors.push({
-				repository: "*",
-				stage: "report",
-				category: "FATAL",
-				message
-			});
-		}
-		this.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-		computeSummary(this.ctx);
-		const runResult = buildRunResult(this.ctx);
-		const exitCode = computeExitCode(this.ctx);
-		try {
-			(0, _dependfix_core.writeReport)((0, _dependfix_core.generateMarkdownReport)(runResult), (0, _dependfix_core.generateJsonReport)(runResult), this.startedAt, this.runId);
-			this.logger.info(`Reports written to ./dependfix-reports/`);
-		} catch (reportError) {
-			const message = (0, _dependfix_core.toErrorMessage)(reportError);
-			this.logger.error(`Failed to write reports: ${message}`);
-		}
-		ensureGitignore(this.workDir);
-		this.logger.info(`Run ${this.runId} completed`, { exitCode });
-		return {
-			result: runResult,
-			exitCode
-		};
-	}
-	async executeMode() {
-		switch (this.config.mode) {
-			case "report-only":
-				await this.executeReportMode();
-				break;
-			case "fix":
-				await this.executeFixMode();
-				break;
-			case "fix-and-pr":
-				await this.executeFixAndPrMode();
-				break;
-			case "cleanup-branches":
-				await this.executeCleanupBranchesMode();
-				break;
-		}
-	}
-	async executeReportMode() {
-		const client = this.createClient();
-		for (const repo of this.config.repositories) await this.processRepoForReport(client, repo);
-	}
-	async processRepoForReport(client, repo) {
-		const startTime = Date.now();
-		const [owner, name] = repo.split("/");
-		try {
-			const { filtered } = (0, _dependfix_core.filterAlerts)(await fetchDependabotAlerts(client, {
-				owner,
-				repo: name
-			}), { severityThreshold: this.config.severityThreshold });
-			const { limited } = (0, _dependfix_core.limitAlerts)((0, _dependfix_core.prioritizeAlerts)(filtered), this.config.maxAlertsPerRepository);
-			const defaultBranch = await this.fetchDefaultBranch(client, owner, name);
-			this.allAlerts.push(...limited);
-			this.repoResults.push({
-				repository: repo,
-				defaultBranch,
-				alertsCount: limited.length,
-				fixable: limited.filter((a) => a.fixable).length,
-				fixed: 0,
-				failed: 0,
-				lockfileRepaired: false,
-				durationMs: Date.now() - startTime
-			});
-			this.logger.info(`Fetched ${limited.length} alerts for ${repo}`);
-		} catch (error) {
-			const message = (0, _dependfix_core.toErrorMessage)(error);
-			this.logger.error(`Failed to fetch alerts for ${repo}: ${message}`);
-			this.allErrors.push({
-				repository: repo,
-				stage: "fetch",
-				category: "FETCH_FAILED",
-				message
-			});
-			this.repoResults.push({
-				repository: repo,
-				defaultBranch: "",
-				alertsCount: 0,
-				fixable: 0,
-				fixed: 0,
-				failed: 0,
-				lockfileRepaired: false,
-				durationMs: Date.now() - startTime
-			});
-		}
-	}
-	async executeFixMode() {
-		const client = this.createClient();
-		for (const repo of this.config.repositories) await this.processRepoForFix(client, repo);
-		if (this.config.commit) try {
-			commitLocalChanges(this.ctx);
-		} catch (error) {
-			const message = (0, _dependfix_core.toErrorMessage)(error);
-			this.logger.error(`Local commit failed: ${message}`);
-			this.allErrors.push({
-				repository: "*",
-				stage: "fix",
-				category: "COMMIT_FAILED",
-				message
-			});
-		}
-	}
-	async processRepoForFix(client, repo) {
-		const startTime = Date.now();
-		const [owner, name] = repo.split("/");
-		let alertsCount = 0;
-		let fixable = 0;
-		let fixed = 0;
-		let failed = 0;
-		let lockfileRepaired = false;
-		let verificationPassed;
-		let defaultBranch = "";
-		try {
-			const { filtered } = (0, _dependfix_core.filterAlerts)(await fetchDependabotAlerts(client, {
-				owner,
-				repo: name
-			}), { severityThreshold: this.config.severityThreshold });
-			const { limited } = (0, _dependfix_core.limitAlerts)((0, _dependfix_core.prioritizeAlerts)(filtered), this.config.maxAlertsPerRepository);
-			alertsCount = limited.length;
-			fixable = limited.filter((a) => a.fixable).length;
-			defaultBranch = await this.fetchDefaultBranch(client, owner, name);
-			this.allAlerts.push(...limited);
-			const fixableAlerts = limited.filter((a) => a.fixable && a.recommendedVersion);
-			for (const alert of fixableAlerts) {
-				const action = await upgradeAlert(this.ctx, alert);
-				this.allActions.push(action);
-				if (action.success) fixed++;
-				else failed++;
-			}
-			const skippedCount = limited.length - fixableAlerts.length;
-			this.summary.alertsSkipped += skippedCount;
-			const repairAction = tryLockfileRepair(this.ctx, repo);
-			this.allActions.push(repairAction);
-			if (repairAction.success) lockfileRepaired = true;
-			if (!this.config.dryRun) {
-				const verifyActions = await verifyProject(this.ctx, repo);
-				this.allActions.push(...verifyActions);
-				verificationPassed = verifyActions.every((a) => a.success);
-			} else {
-				this.logger.info(`[dry-run] Skipping verification for ${repo}`);
-				verificationPassed = void 0;
-			}
-		} catch (error) {
-			const message = (0, _dependfix_core.toErrorMessage)(error);
-			this.logger.error(`Failed to process ${repo}: ${message}`);
-			this.allErrors.push({
-				repository: repo,
-				stage: "fix",
-				category: "PROCESS_FAILED",
-				message
-			});
-		}
-		this.repoResults.push({
-			repository: repo,
-			defaultBranch,
-			alertsCount,
-			fixable,
-			fixed,
-			failed,
-			lockfileRepaired,
-			verificationPassed,
-			durationMs: Date.now() - startTime
-		});
-	}
-	/**
-	* 修复 → 计算内容指纹 → 查重 →（同指纹跳过 / 异指纹关旧开新）。
-	*
-	* 去重语义（T210）：
-	* - 同告警集 → 同修复结果 → 同指纹 → 跳过，不重复提交相同 PR
-	* - 内容变化 → 先创建新 PR（body 注明 Supersedes），成功后关闭旧 PR；
-	*   新 PR 创建失败时保留旧 PR，避免出现"无 PR 窗口"
-	*/
-	async executeFixAndPrMode() {
-		const client = this.createClient();
-		for (const repo of this.config.repositories) await this.processRepoForFix(client, repo);
-		if (this.config.cleanupBranches) await reportCleanupCandidates(this.ctx, client);
-		if (this.config.dryRun) {
-			this.logger.info("[dry-run] Would create branch, commit, push, and PR");
-			return;
-		}
-		if (!hasGitChanges(this.workDir)) {
-			this.logger.info("No changes to commit — skipping PR creation");
-			return;
-		}
-		if (this.config.repositories.length === 0) return;
-		const firstRepo = this.config.repositories[0];
-		const [owner, repo] = firstRepo.split("/");
-		try {
-			const fingerprint = computeFixFingerprint(this.allActions);
-			this.logger.info(`Fix fingerprint: ${fingerprint}`);
-			const plan = computeFixAndPrPlan(await findDependfixOpenPR(client, owner, repo), fingerprint);
-			if (plan.action === "skip" && plan.sameContentPR) {
-				this.logger.info(`Open PR #${plan.sameContentPR.number} already contains identical fixes — skipping PR creation`);
-				this.allActions.push({
-					type: "dependency-upgrade",
-					repository: firstRepo,
-					target: `PR #${plan.sameContentPR.number} (existing)`,
-					fromVersion: void 0,
-					toVersion: plan.sameContentPR.htmlUrl,
-					isMajor: false,
-					success: true,
-					durationMs: 0
-				});
-				await closeSupersededPRs(this.ctx, client, owner, repo, plan.supersedePRs);
-				return;
-			}
-			if (plan.supersedePRs.length > 0) this.logger.info(`Existing PR(s) with different content will be superseded: ${plan.supersedePRs.map((pr) => `#${pr.number}`).join(", ")}`);
-			const branchName = `dependfix/auto-fix-${fingerprint}`;
-			createFixBranch(branchName, this.workDir);
-			this.logger.info(`Creating fix branch: ${branchName}`);
-			this.logger.info("Staging and committing changes");
-			stageAndCommit(FIX_COMMIT_MESSAGE, this.workDir);
-			this.logger.info(`Pushing branch: ${branchName}`);
-			pushBranch(branchName, this.workDir);
-			const defaultBranch = await this.fetchDefaultBranch(client, owner, repo);
-			computeSummary(this.ctx);
-			const prBody = generatePRBody(buildRunResult(this.ctx), plan.supersedePRs.map((pr) => pr.number));
-			const pr = await createPullRequest({
-				octokit: client,
-				owner,
-				repo,
-				headBranch: branchName,
-				baseBranch: defaultBranch,
-				title: `fix(deps): automated security fix — ${this.summary.alertsFixed} upgrades`,
-				body: prBody
-			});
-			this.logger.info(`PR created: ${pr.htmlUrl}`);
-			this.allActions.push({
-				type: "dependency-upgrade",
-				repository: firstRepo,
-				target: `PR #${pr.number}`,
-				fromVersion: void 0,
-				toVersion: pr.htmlUrl,
-				isMajor: false,
-				success: true,
-				durationMs: 0
-			});
-			await closeSupersededPRs(this.ctx, client, owner, repo, plan.supersedePRs);
-		} catch (error) {
-			const message = (0, _dependfix_core.toErrorMessage)(error);
-			this.logger.error(`PR creation failed: ${message}`);
-			this.allErrors.push({
-				repository: this.config.repositories[0] ?? "*",
-				stage: "report",
-				category: "PR_CREATION_FAILED",
-				message
-			});
-		}
-	}
-	/**
-	* 清理已合并（或已关闭）的 dependfix 分支。
-	*
-	* - 分类：已合并（安全清理）/ 已关闭未合并（supersede 孤儿）/ open（跳过）
-	* - 删除前必须交互式确认（y/N）；非 TTY 环境（CI）默认拒绝
-	* - 只删 `dependfix/` 前缀分支，绝不触碰 open PR 对应分支
-	* - dry-run 模式仅列清单并打印 "would delete"，不执行删除
-	*/
-	async executeCleanupBranchesMode() {
-		const client = this.createClient();
-		for (const repo of this.config.repositories) {
-			const [owner, name] = repo.split("/");
-			try {
-				const branches = await listDependfixBranches(client, owner, name);
-				if (branches.length === 0) {
-					this.logger.info(`[cleanup] ${repo}: no dependfix branches found`);
-					continue;
-				}
-				const statuses = [];
-				for (const branch of branches) statuses.push(await getBranchPrStatus(client, owner, name, branch));
-				const merged = statuses.filter((s) => s.merged);
-				const orphaned = statuses.filter((s) => s.closed && !s.merged);
-				const open = statuses.filter((s) => !s.closed);
-				this.logger.info(`[cleanup] ${repo}: ${merged.length} merged, ${orphaned.length} closed, ${open.length} kept`);
-				for (const s of merged) this.logger.info(`  [merged] ${s.branch}${s.prNumber ? ` (PR #${s.prNumber})` : ""}`);
-				for (const s of orphaned) this.logger.info(`  [closed] ${s.branch}${s.prNumber ? ` (PR #${s.prNumber})` : ""}`);
-				for (const s of open) {
-					const label = s.prNumber ? `[open — kept]` : `[no PR — kept]`;
-					this.logger.info(`  ${label} ${s.branch}${s.prNumber ? ` (PR #${s.prNumber})` : ""}`);
-				}
-				const candidates = [...merged, ...orphaned];
-				if (candidates.length === 0) {
-					this.logger.info("[cleanup] nothing to delete");
-					continue;
-				}
-				if (this.config.dryRun) {
-					this.logger.info(`[dry-run] Would delete ${candidates.length} branch(es): ${candidates.map((s) => s.branch).join(", ")}`);
-					continue;
-				}
-				if (!await confirmCleanup(this.ctx, repo, candidates)) {
-					this.logger.info("[cleanup] cancelled by user");
-					continue;
-				}
-				for (const s of candidates) try {
-					await deleteRemoteBranch(client, owner, name, s.branch);
-					this.logger.info(`Deleted branch: ${s.branch}`);
-					this.allActions.push({
-						type: "branch-cleanup",
-						repository: repo,
-						target: s.branch,
-						success: true,
-						diff: s.merged ? "merged" : "closed",
-						durationMs: 0
-					});
-				} catch (error) {
-					const message = (0, _dependfix_core.toErrorMessage)(error);
-					this.logger.error(`Failed to delete branch ${s.branch}: ${message}`);
-					this.allErrors.push({
-						repository: repo,
-						stage: "report",
-						category: "BRANCH_DELETE_FAILED",
-						message: `Failed to delete ${s.branch}: ${message}`
-					});
-				}
-			} catch (error) {
-				const message = (0, _dependfix_core.toErrorMessage)(error);
-				this.logger.error(`[cleanup] failed for ${repo}: ${message}`);
-				this.allErrors.push({
-					repository: repo,
-					stage: "report",
-					category: "CLEANUP_FAILED",
-					message
-				});
-			}
-		}
-	}
-	createClient() {
-		return createGitHubClient({ token: this.config.githubToken });
-	}
-	/**
-	* 获取仓库的默认分支。
-	* 失败时返回 `'unknown'`（不阻塞主流程）。
-	*/
-	async fetchDefaultBranch(client, owner, repo) {
-		try {
-			const { data } = await client.rest.repos.get({
-				owner,
-				repo
-			});
-			return data.default_branch;
-		} catch {
-			return "unknown";
-		}
-	}
-};
-
-//#endregion
-//#region src/github/repo-selector.ts
-/**
-* 从文件读取仓库列表（每行一个 `owner/repo`）。
-* 空行和 `#` 开头的注释行会被跳过。
-*/
-function readReposFile(filePath) {
-	if (!(0, node_fs.existsSync)(filePath)) throw new _dependfix_core.AppError("REPO_FILE_NOT_FOUND", `Repositories file not found: ${filePath}`);
-	const lines = (0, node_fs.readFileSync)(filePath, "utf-8").split("\n");
-	const repos = [];
-	for (let i = 0; i < lines.length; i += 1) {
-		const line = lines[i].trim();
-		if (!line || line.startsWith("#")) continue;
-		if (!(0, _dependfix_core.isValidRepoIdentifier)(line)) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", `Invalid repository identifier at ${filePath}:${i + 1}: "${line}". Expected format: owner/repo`);
-		repos.push(line);
-	}
-	if (repos.length === 0) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", `No valid repository identifiers found in ${filePath}`);
-	return repos;
-}
-/**
-* 合并 CLI 传入仓库列表与文件中的仓库列表，去重并校验。
-*/
-function resolveRepoList(cliRepos, reposFilePath) {
-	const repos = [...cliRepos];
-	if (reposFilePath) {
-		const fileRepos = readReposFile(reposFilePath);
-		repos.push(...fileRepos);
-	}
-	const deduped = [...new Set(repos)];
-	for (const repo of deduped) if (!(0, _dependfix_core.isValidRepoIdentifier)(repo)) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", `Invalid repository identifier: "${repo}". Expected format: owner/repo`);
-	return deduped;
-}
-
-//#endregion
-//#region src/config/index.ts
-const RUNTIME_MODES = [
-	"report-only",
-	"fix",
-	"fix-and-pr",
-	"cleanup-branches"
-];
-const SEVERITY_THRESHOLDS = [
-	"critical",
-	"high",
-	"medium",
-	"all"
-];
-const DEFAULT_RUNTIME_CONFIG = {
-	mode: "report-only",
-	severityThreshold: "high",
-	maxAlertsPerRepository: 10
-};
-function isRuntimeMode$1(value) {
-	return RUNTIME_MODES.includes(value);
-}
-function isSeverityThreshold$1(value) {
-	return SEVERITY_THRESHOLDS.includes(value);
-}
-function normalizeBoolean(value, fieldName) {
-	if (value === void 0 || value.trim() === "") return;
-	const normalized = value.trim().toLowerCase();
-	if ([
-		"true",
-		"1",
-		"yes",
-		"on"
-	].includes(normalized)) return true;
-	if ([
-		"false",
-		"0",
-		"no",
-		"off"
-	].includes(normalized)) return false;
-	throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", `Invalid boolean value for ${fieldName}: ${value}`);
-}
-function normalizeInteger(value, fieldName) {
-	if (value === void 0 || value.trim() === "") return;
-	const parsed = Number.parseInt(value, 10);
-	if (!Number.isInteger(parsed) || parsed <= 0) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", `${fieldName} must be a positive integer`);
-	return parsed;
-}
-function normalizeList(value) {
-	if (value === void 0 || value.trim() === "") return;
-	const items = value.split(",").map((item) => item.trim()).filter(Boolean);
-	return items.length > 0 ? items : void 0;
-}
-function readRuntimeMode(value, fieldName) {
-	if (value === void 0 || value.trim() === "") return;
-	if (!isRuntimeMode$1(value)) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", `${fieldName} must be one of: ${RUNTIME_MODES.join(", ")}`);
-	return value;
-}
-function readSeverityThreshold(value, fieldName) {
-	if (value === void 0 || value.trim() === "") return;
-	if (!isSeverityThreshold$1(value)) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", `${fieldName} must be one of: ${SEVERITY_THRESHOLDS.join(", ")}`);
-	return value;
-}
-function readEnvConfig(env = process.env) {
-	return {
-		mode: readRuntimeMode(env.AUTO_FIX_GITHUB_SECURITY_MODE, "AUTO_FIX_GITHUB_SECURITY_MODE"),
-		severityThreshold: readSeverityThreshold(env.AUTO_FIX_GITHUB_SECURITY_SEVERITY_THRESHOLD, "AUTO_FIX_GITHUB_SECURITY_SEVERITY_THRESHOLD"),
-		repositories: normalizeList(env.AUTO_FIX_GITHUB_SECURITY_REPOSITORIES),
-		dryRun: normalizeBoolean(env.AUTO_FIX_GITHUB_SECURITY_DRY_RUN, "AUTO_FIX_GITHUB_SECURITY_DRY_RUN"),
-		createPullRequest: normalizeBoolean(env.AUTO_FIX_GITHUB_SECURITY_CREATE_PR, "AUTO_FIX_GITHUB_SECURITY_CREATE_PR"),
-		commit: normalizeBoolean(env.AUTO_FIX_GITHUB_SECURITY_COMMIT, "AUTO_FIX_GITHUB_SECURITY_COMMIT"),
-		cleanupBranches: normalizeBoolean(env.AUTO_FIX_GITHUB_SECURITY_CLEANUP_BRANCHES, "AUTO_FIX_GITHUB_SECURITY_CLEANUP_BRANCHES"),
-		githubToken: env.AUTO_FIX_GITHUB_SECURITY_GITHUB_TOKEN?.trim() || env.GITHUB_TOKEN?.trim() || void 0,
-		maxAlertsPerRepository: normalizeInteger(env.AUTO_FIX_GITHUB_SECURITY_MAX_ALERTS_PER_REPOSITORY, "AUTO_FIX_GITHUB_SECURITY_MAX_ALERTS_PER_REPOSITORY")
-	};
-}
-function resolveDryRun(mode, cliOverrides, envConfig) {
-	if (cliOverrides.dryRun !== void 0) return cliOverrides.dryRun;
-	if (envConfig.dryRun !== void 0) return envConfig.dryRun;
-	return mode === "report-only";
-}
-function resolveCreatePullRequest(mode, cliOverrides, envConfig) {
-	if (cliOverrides.createPullRequest !== void 0) return cliOverrides.createPullRequest;
-	if (envConfig.createPullRequest !== void 0) return envConfig.createPullRequest;
-	return mode === "fix-and-pr";
-}
-function resolveCommit(cliOverrides, envConfig) {
-	if (cliOverrides.commit !== void 0) return cliOverrides.commit;
-	if (envConfig.commit !== void 0) return envConfig.commit;
-	return false;
-}
-function resolveCleanupBranches(cliOverrides, envConfig) {
-	if (cliOverrides.cleanupBranches !== void 0) return cliOverrides.cleanupBranches;
-	if (envConfig.cleanupBranches !== void 0) return envConfig.cleanupBranches;
-	return false;
-}
-function validateRuntimeConfig(config) {
-	if (!config.githubToken) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", "Missing GitHub token. Provide GITHUB_TOKEN or AUTO_FIX_GITHUB_SECURITY_GITHUB_TOKEN.");
-	if (config.repositories.length === 0) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", "Missing target repositories. Provide --repo, --repository, --repos-file or AUTO_FIX_GITHUB_SECURITY_REPOSITORIES.");
-	for (const repo of config.repositories) if (!(0, _dependfix_core.isValidRepoIdentifier)(repo)) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", `Invalid repository identifier: "${repo}". Expected format: owner/repo`);
-	if (config.mode === "report-only" && config.createPullRequest) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", "createPullRequest cannot be enabled when mode is report-only.");
-	if (config.dryRun && config.createPullRequest) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", "createPullRequest cannot be enabled while dryRun is true.");
-	if (config.commit && config.mode !== "fix") throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", "commit is only supported in fix mode.");
-	if (config.commit && config.dryRun) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", "commit cannot be enabled while dryRun is true.");
-	if (config.commit && config.createPullRequest) throw new _dependfix_core.AppError("CONFIG_VALIDATION_ERROR", "commit cannot be enabled together with createPullRequest. Use fix-and-pr mode instead.");
-	return config;
-}
-function resolveRuntimeConfig(options = {}) {
-	const envConfig = readEnvConfig(options.env);
-	const cliOverrides = options.cliOverrides ?? {};
-	const mode = cliOverrides.mode ?? envConfig.mode ?? DEFAULT_RUNTIME_CONFIG.mode;
-	let repositories = resolveRepoList([...envConfig.repositories ?? [], ...cliOverrides.repositories ?? []], cliOverrides.reposFilePath);
-	if (repositories.length === 0) {
-		const inferred = inferRepoFromGitRemote(options.workDir ?? process.cwd());
-		if (inferred) repositories = [inferred];
-	}
-	return validateRuntimeConfig({
-		mode,
-		severityThreshold: cliOverrides.severityThreshold ?? envConfig.severityThreshold ?? DEFAULT_RUNTIME_CONFIG.severityThreshold,
-		repositories,
-		dryRun: resolveDryRun(mode, cliOverrides, envConfig),
-		createPullRequest: resolveCreatePullRequest(mode, cliOverrides, envConfig),
-		commit: resolveCommit(cliOverrides, envConfig),
-		cleanupBranches: resolveCleanupBranches(cliOverrides, envConfig),
-		githubToken: cliOverrides.githubToken ?? envConfig.githubToken ?? "",
-		maxAlertsPerRepository: cliOverrides.maxAlertsPerRepository ?? envConfig.maxAlertsPerRepository ?? DEFAULT_RUNTIME_CONFIG.maxAlertsPerRepository
-	});
-}
-/** 匹配 GitHub remote URL 的正则（HTTPS / SSH / git@ 格式） */
-const GITHUB_REMOTE_RE = /github\.com[/:]([^/]+)\/([^/\s.]+?)(?:\.git)?\s*$/i;
-/**
-* 从 git remote origin 推断 owner/repo。
-*
-* 支持格式：
-* - `https://github.com/owner/repo.git`
-* - `git@github.com:owner/repo.git`
-* - `ssh://git@github.com/owner/repo.git`
-*
-* @returns `owner/repo` 或 `null`（非 GitHub / 无 origin）
-*/
-function inferRepoFromGitRemote(workDir) {
-	try {
-		const url = (0, node_child_process.execSync)("git remote get-url origin", {
-			cwd: workDir,
-			encoding: "utf-8",
-			stdio: "pipe"
-		}).trim();
-		const match = GITHUB_REMOTE_RE.exec(url);
-		return match ? `${match[1]}/${match[2]}` : null;
-	} catch {
-		return null;
-	}
-}
-
-//#endregion
-//#region src/cli/index.ts
-const argsDef = {
-	mode: {
-		type: "positional",
-		description: "运行模式：report-only, fix, fix-and-pr, cleanup-branches",
-		required: false,
-		default: "report-only"
-	},
-	repo: {
-		type: "string",
-		description: "目标仓库 (owner/repo)，逗号分隔多个",
-		alias: [
-			"r",
-			"repository",
-			"repositories"
-		]
-	},
-	"repos-file": {
-		type: "string",
-		description: "从文件读取仓库列表（每行一个 owner/repo）"
-	},
-	"severity-threshold": {
-		type: "string",
-		description: "严重级别阈值：critical, high, medium, all",
-		default: "high"
-	},
-	"dry-run": {
-		type: "boolean",
-		description: "试运行模式，不实际写入文件",
-		negativeDescription: "关闭试运行模式"
-	},
-	"create-pr": {
-		type: "boolean",
-		description: "创建 Pull Request",
-		negativeDescription: "不创建 Pull Request"
-	},
-	commit: {
-		type: "boolean",
-		description: "修复完成后在本地当前分支直接提交（不推送、不创建 PR）",
-		negativeDescription: "不自动提交（默认）"
-	},
-	"cleanup-branches": {
-		type: "boolean",
-		description: "（fix-and-pr 模式）结束后列出已合并的 dependfix 分支到报告，不自动删除",
-		negativeDescription: "不执行分支清理检查"
-	},
-	"github-token": {
-		type: "string",
-		description: "GitHub Personal Access Token"
-	},
-	"max-alerts-per-repository": {
-		type: "string",
-		description: "每个仓库最多处理的告警数",
-		default: "10"
-	},
-	commands: {
-		type: "string",
-		description: "自定义验证命令（逗号分隔），覆盖默认的 install/lint/build"
-	},
-	verbose: {
-		type: "boolean",
-		description: "输出详细日志"
-	}
-};
-function isRuntimeMode(value) {
-	return RUNTIME_MODES.includes(value);
-}
-function isSeverityThreshold(value) {
-	return SEVERITY_THRESHOLDS.includes(value);
-}
-function appendRepositories(target, value) {
-	for (const repository of value.split(",")) {
-		const trimmed = repository.trim();
-		if (!trimmed) continue;
-		if (!(0, _dependfix_core.isValidRepoIdentifier)(trimmed)) throw new _dependfix_core.AppError("ARGUMENT_PARSE_ERROR", `Invalid repository identifier: "${trimmed}". Expected format: owner/repo`);
-		target.push(trimmed);
-	}
-}
-function parseCommandsFlag(value) {
-	return value.split(",").map((cmd) => cmd.trim()).filter(Boolean);
-}
-function parsedArgsToCliOverrides(parsed) {
-	const overrides = {};
-	const rawMode = parsed.mode;
-	if (isRuntimeMode(rawMode)) overrides.mode = rawMode;
-	const repoValue = parsed.repo;
-	if (repoValue) {
-		const repos = [];
-		appendRepositories(repos, repoValue);
-		if (repos.length > 0) overrides.repositories = repos;
-	}
-	const reposFile = parsed["repos-file"];
-	if (reposFile) overrides.reposFilePath = reposFile;
-	const severityThreshold = parsed["severity-threshold"];
-	if (isSeverityThreshold(severityThreshold)) overrides.severityThreshold = severityThreshold;
-	if (parsed["dry-run"] !== void 0) overrides.dryRun = parsed["dry-run"];
-	if (parsed["create-pr"] !== void 0) overrides.createPullRequest = parsed["create-pr"];
-	if (parsed.commit !== void 0) overrides.commit = parsed.commit;
-	if (parsed["cleanup-branches"] !== void 0) overrides.cleanupBranches = parsed["cleanup-branches"];
-	const githubToken = parsed["github-token"];
-	if (githubToken) overrides.githubToken = githubToken;
-	const maxAlerts = parsed["max-alerts-per-repository"];
-	if (maxAlerts) {
-		const num = Number.parseInt(maxAlerts, 10);
-		if (Number.isNaN(num)) throw new _dependfix_core.AppError("ARGUMENT_PARSE_ERROR", `Invalid --max-alerts-per-repository value: "${maxAlerts}". Expected a positive integer.`);
-		overrides.maxAlertsPerRepository = num;
-	}
-	if (parsed.verbose !== void 0) overrides.verbose = parsed.verbose;
-	const commandsValue = parsed.commands;
-	if (commandsValue) overrides.commands = parseCommandsFlag(commandsValue);
-	return overrides;
-}
-function parseCliArgs(rawArgs) {
-	const configOverrides = parsedArgsToCliOverrides((0, citty.parseArgs)(rawArgs, argsDef));
-	return {
-		mode: configOverrides.mode,
-		configOverrides,
-		rawArgs: [...rawArgs]
-	};
-}
-function runCli(rawArgs) {
-	const invocation = parseCliArgs(rawArgs);
-	return {
-		ok: true,
-		invocation,
-		config: resolveRuntimeConfig({
-			env: process.env,
-			cliOverrides: invocation.configOverrides
-		})
-	};
-}
-async function runApp(rawArgs) {
-	const invocation = parseCliArgs(rawArgs);
-	const { exitCode } = await new DependfixApp({
-		config: resolveRuntimeConfig({
-			env: process.env,
-			cliOverrides: invocation.configOverrides
-		}),
-		verbose: invocation.configOverrides.verbose,
-		commands: invocation.configOverrides.commands
-	}).run();
-	return exitCode;
-}
-const dependfixCommand = (0, citty.defineCommand)({
-	meta: {
-		name: "dependfix",
-		version: "0.1.0",
-		description: "自动化处理 Dependabot / Code Scanning 安全告警的修复工具"
-	},
-	args: argsDef,
-	async run({ rawArgs }) {
-		let exitCode = 1;
-		try {
-			exitCode = await runApp(rawArgs);
-		} catch (error) {
-			const appError = (0, _dependfix_core.toAppError)(error, "CLI_EXECUTION_FAILED");
-			console.error(`Error: ${appError.message}`);
-			exitCode = 1;
-		}
-		process.exitCode = exitCode;
-	}
-});
-
-//#endregion
-Object.defineProperty(exports, 'DEFAULT_RUNTIME_CONFIG', {
-  enumerable: true,
-  get: function () {
-    return DEFAULT_RUNTIME_CONFIG;
-  }
-});
-Object.defineProperty(exports, 'DependfixApp', {
-  enumerable: true,
-  get: function () {
-    return DependfixApp;
-  }
-});
-Object.defineProperty(exports, 'RUNTIME_MODES', {
-  enumerable: true,
-  get: function () {
-    return RUNTIME_MODES;
-  }
-});
-Object.defineProperty(exports, 'SEVERITY_THRESHOLDS', {
-  enumerable: true,
-  get: function () {
-    return SEVERITY_THRESHOLDS;
-  }
-});
-Object.defineProperty(exports, '__toESM', {
-  enumerable: true,
-  get: function () {
-    return __toESM;
-  }
-});
-Object.defineProperty(exports, 'classifyLockfileFailure', {
-  enumerable: true,
-  get: function () {
-    return classifyLockfileFailure;
-  }
-});
-Object.defineProperty(exports, 'closePullRequest', {
-  enumerable: true,
-  get: function () {
-    return closePullRequest;
-  }
-});
-Object.defineProperty(exports, 'computeFixAndPrPlan', {
-  enumerable: true,
-  get: function () {
-    return computeFixAndPrPlan;
-  }
-});
-Object.defineProperty(exports, 'computeFixFingerprint', {
-  enumerable: true,
-  get: function () {
-    return computeFixFingerprint;
-  }
-});
-Object.defineProperty(exports, 'computeLockfileDiff', {
-  enumerable: true,
-  get: function () {
-    return computeLockfileDiff;
-  }
-});
-Object.defineProperty(exports, 'createFixBranch', {
-  enumerable: true,
-  get: function () {
-    return createFixBranch;
-  }
-});
-Object.defineProperty(exports, 'createGitHubClient', {
-  enumerable: true,
-  get: function () {
-    return createGitHubClient;
-  }
-});
-Object.defineProperty(exports, 'createPullRequest', {
-  enumerable: true,
-  get: function () {
-    return createPullRequest;
-  }
-});
-Object.defineProperty(exports, 'deleteRemoteBranch', {
-  enumerable: true,
-  get: function () {
-    return deleteRemoteBranch;
-  }
-});
-Object.defineProperty(exports, 'dependfixCommand', {
-  enumerable: true,
-  get: function () {
-    return dependfixCommand;
-  }
-});
-Object.defineProperty(exports, 'ensurePnpmOverrides', {
-  enumerable: true,
-  get: function () {
-    return ensurePnpmOverrides;
-  }
-});
-Object.defineProperty(exports, 'extractFingerprintFromBranch', {
-  enumerable: true,
-  get: function () {
-    return extractFingerprintFromBranch;
-  }
-});
-Object.defineProperty(exports, 'extractPrefix', {
-  enumerable: true,
-  get: function () {
-    return extractPrefix;
-  }
-});
-Object.defineProperty(exports, 'fetchDependabotAlerts', {
-  enumerable: true,
-  get: function () {
-    return fetchDependabotAlerts;
-  }
-});
-Object.defineProperty(exports, 'findDependencyVersion', {
-  enumerable: true,
-  get: function () {
-    return findDependencyVersion;
-  }
-});
-Object.defineProperty(exports, 'findDependfixOpenPR', {
-  enumerable: true,
-  get: function () {
-    return findDependfixOpenPR;
-  }
-});
-Object.defineProperty(exports, 'generatePRBody', {
-  enumerable: true,
-  get: function () {
-    return generatePRBody;
-  }
-});
-Object.defineProperty(exports, 'getBranchPrStatus', {
-  enumerable: true,
-  get: function () {
-    return getBranchPrStatus;
-  }
-});
-Object.defineProperty(exports, 'inferRepoFromGitRemote', {
-  enumerable: true,
-  get: function () {
-    return inferRepoFromGitRemote;
-  }
-});
-Object.defineProperty(exports, 'isConfirmAnswer', {
-  enumerable: true,
-  get: function () {
-    return isConfirmAnswer;
-  }
-});
-Object.defineProperty(exports, 'listDependfixBranches', {
-  enumerable: true,
-  get: function () {
-    return listDependfixBranches;
-  }
-});
-Object.defineProperty(exports, 'mapGitHubError', {
-  enumerable: true,
-  get: function () {
-    return mapGitHubError;
-  }
-});
-Object.defineProperty(exports, 'overrideTransitiveDependency', {
-  enumerable: true,
-  get: function () {
-    return overrideTransitiveDependency;
-  }
-});
-Object.defineProperty(exports, 'parseCliArgs', {
-  enumerable: true,
-  get: function () {
-    return parseCliArgs;
-  }
-});
-Object.defineProperty(exports, 'parseMajorVersion', {
-  enumerable: true,
-  get: function () {
-    return parseMajorVersion;
-  }
-});
-Object.defineProperty(exports, 'pushBranch', {
-  enumerable: true,
-  get: function () {
-    return pushBranch;
-  }
-});
-Object.defineProperty(exports, 'readEnvConfig', {
-  enumerable: true,
-  get: function () {
-    return readEnvConfig;
-  }
-});
-Object.defineProperty(exports, 'readLockfileVersion', {
-  enumerable: true,
-  get: function () {
-    return readLockfileVersion;
-  }
-});
-Object.defineProperty(exports, 'readReposFile', {
-  enumerable: true,
-  get: function () {
-    return readReposFile;
-  }
-});
-Object.defineProperty(exports, 'repairLockfile', {
-  enumerable: true,
-  get: function () {
-    return repairLockfile;
-  }
-});
-Object.defineProperty(exports, 'resolvePnpmVersion', {
-  enumerable: true,
-  get: function () {
-    return resolvePnpmVersion;
-  }
-});
-Object.defineProperty(exports, 'resolveRepoList', {
-  enumerable: true,
-  get: function () {
-    return resolveRepoList;
-  }
-});
-Object.defineProperty(exports, 'resolveRuntimeConfig', {
-  enumerable: true,
-  get: function () {
-    return resolveRuntimeConfig;
-  }
-});
-Object.defineProperty(exports, 'runCli', {
-  enumerable: true,
-  get: function () {
-    return runCli;
-  }
-});
-Object.defineProperty(exports, 'runVerification', {
-  enumerable: true,
-  get: function () {
-    return runVerification;
-  }
-});
-Object.defineProperty(exports, 'sanitizeOutput', {
-  enumerable: true,
-  get: function () {
-    return sanitizeOutput;
-  }
-});
-Object.defineProperty(exports, 'stageAndCommit', {
-  enumerable: true,
-  get: function () {
-    return stageAndCommit;
-  }
-});
-Object.defineProperty(exports, 'upgradeDependency', {
-  enumerable: true,
-  get: function () {
-    return upgradeDependency;
-  }
-});
-//# sourceMappingURL=cli.cjs.map