crprotocol 5.1.1__tar.gz → 5.1.2__tar.gz

{crprotocol-5.1.1 → crprotocol-5.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crprotocol
-Version: 5.1.1
+Version: 5.1.2
 Summary: Context Relay Protocol — unbounded context, unbounded generation, amplified reasoning for LLMs
 Project-URL: Homepage, https://crprotocol.io
 Project-URL: Documentation, https://crprotocol.io

{crprotocol-5.1.1 → crprotocol-5.1.2}/crp/_version.py

@@ -2,4 +2,4 @@
 # Licensed under Elastic License 2.0 — see LICENSE.md for details.
 """CRP — Context Relay Protocol SDK."""
 
-__version__ = "5.1.1"
+__version__ = "5.1.2"

{crprotocol-5.1.1 → crprotocol-5.1.2}/crp/cli/main.py

@@ -1,6 +1,6 @@
 # Copyright © 2025 Constantinos Vidiniotis. All rights reserved.
 # Licensed under Elastic License 2.0 — see LICENSE.md for details.
-"""CRP CLI entry point — ``crp init | dispatch | ingest | status | preview | serve``.
+"""CRP CLI entry point — ``crp init | dispatch | ingest | status | preview | serve | scan | scan-remediate``.
 
 UNIX-friendly: reads stdin, writes JSON to stdout, pipe-compatible.
 Requires the ``click`` package (``pip install crprotocol[cli]``).
@@ -38,6 +38,225 @@ def _get_session(session_id: str) -> dict:
     return _sessions[session_id]
 
 
+# ── Scan helpers (used by ``crp scan`` and ``crp scan-remediate``) ───────
+
+def _scan_findings(paths: str, fail_on: str, min_version: str, min_grounding: float) -> list[dict]:
+    """Run the CRP regex scanner and return normalized finding dicts.
+
+    This mirrors the logic originally embedded in ``crp scan`` so both
+    ``crp scan`` and ``crp scan-remediate`` stay consistent.  ``fail_on`` and
+    ``min_grounding`` are accepted for interface parity but do not affect the
+    returned list.
+    """
+    import os
+    import re
+    from pathlib import Path
+
+    target_paths = [p.strip() for p in paths.split(",") if p.strip()]
+    findings: list[dict] = []
+
+    def _already_governed(line: str) -> bool:
+        lowered = line.lower()
+        return "crp." in lowered or "crprotocol" in lowered or "crp-" in lowered
+
+    # Patterns for ungoverned LLM calls and missing safety controls.
+    # Each tuple: (regex, rule_id, message, severity)
+    raw_patterns = [
+        # Python / JS / TS class instantiations
+        (r"(?<!crp\.)\bOpenAI\s*\(", "CRP001", "Direct OpenAI client instantiation without CRP governance", "HIGH"),
+        (r"(?<!crp\.)\bAnthropic\s*\(", "CRP001", "Direct Anthropic client instantiation without CRP governance", "HIGH"),
+        # Python / JS / TS SDK method calls
+        (r"\.chat\.completions\.create\(", "CRP001", "Direct OpenAI chat completions call without CRP governance", "HIGH"),
+        (r"\.messages\.create\(", "CRP001", "Direct Anthropic messages call without CRP governance", "HIGH"),
+        (r"(?<!crp\.)openai\.Completion\.create\(", "CRP001", "Direct OpenAI Completion call without CRP governance", "HIGH"),
+        (r"(?<!crp\.)anthropic\.(Client|Anthropic)\(", "CRP001", "Direct Anthropic client creation without CRP governance", "HIGH"),
+        (r"(?<!crp\.)google\.generativeai\.GenerativeModel\(", "CRP001", "Direct Gemini call without CRP governance", "HIGH"),
+        (r"(?<!crp\.)\bgenai\.GenerativeModel\(", "CRP001", "Direct Gemini call without CRP governance", "HIGH"),
+        # Raw HTTP / fetch / axios to LLM APIs
+        (r"requests\.(post|get|put|patch)\([^)]*https://api\.(openai|anthropic|gemini)", "CRP003", "Raw HTTP call to LLM API without governance", "HIGH"),
+        (r"fetch\s*\(\s*[\"\']https://api\.(openai|anthropic|gemini)", "CRP003", "Raw HTTP call to LLM API without governance", "HIGH"),
+        (r"axios\.(post|get|put|patch)\s*\(\s*[\"\']https://api\.(openai|anthropic|gemini)", "CRP003", "Raw HTTP call to LLM API without governance", "HIGH"),
+        (r"curl\s+.*https://api\.(openai|anthropic|gemini)", "CRP003", "Raw shell call to LLM API without governance", "HIGH"),
+        # Missing safety headers
+        (r"headers\s*=\s*\{[^}]*[\"\'][Xx]-[Aa][Ii]-[^\"\']*[\"\']", "CRP002", "AI request without CRP safety headers", "MEDIUM"),
+        # API key access
+        (r"os\.(?:environ|getenv)\([\"\']OPENAI_API_KEY[\"\']", "CRP004", "API key accessed directly — consider CRP Gateway for key management", "LOW"),
+        (r"os\.environ\.get\([\"\']OPENAI_API_KEY[\"\']", "CRP004", "API key accessed directly — consider CRP Gateway for key management", "LOW"),
+        (r"process\.env\.OPENAI_API_KEY", "CRP004", "API key accessed directly — consider CRP Gateway for key management", "LOW"),
+        # Hard-coded API key-like strings
+        (r"[\"\']sk-[a-zA-Z0-9]{20,}", "CRP006", "Hard-coded API key detected", "HIGH"),
+    ]
+    patterns = [(re.compile(p), rule, msg, sev) for p, rule, msg, sev in raw_patterns]
+
+    file_extensions = {
+        ".py", ".ts", ".js", ".mjs", ".cjs", ".jsx", ".tsx",
+        ".java", ".go", ".rs", ".cs", ".rb", ".php", ".swift", ".kt",
+    }
+
+    for target in target_paths:
+        if not os.path.exists(target):
+            continue
+        if os.path.isfile(target):
+            files = [target]
+        else:
+            files = []
+            for root, _dirs, filenames in os.walk(target):
+                # Skip common non-source directories
+                if any(part.startswith(".") for part in Path(root).parts):
+                    continue
+                for name in filenames:
+                    ext = os.path.splitext(name)[1]
+                    if ext in file_extensions:
+                        files.append(os.path.join(root, name))
+
+        for file_path in files:
+            try:
+                with open(file_path, encoding="utf-8", errors="replace") as f:
+                    lines = f.readlines()
+            except Exception:
+                continue
+
+            for line_num, line in enumerate(lines, start=1):
+                for compiled, rule_id, message, severity in patterns:
+                    match = compiled.search(line)
+                    if not match:
+                        continue
+                    if _already_governed(line):
+                        continue
+                    column = match.start() + 1
+                    suggestion = "Wrap in CRP Client: from crp import Client; client = Client()"
+                    if rule_id == "CRP002":
+                        suggestion = 'Add CRP safety headers: {"CRP-Safety-Policy": "...", "CRP-Governance": "..."}'
+                    elif rule_id == "CRP003":
+                        suggestion = "Route through CRP Gateway or wrap the HTTP call with crp.Client()"
+                    elif rule_id == "CRP004":
+                        suggestion = "Use CRP Gateway key vault or CRP Client secrets binding"
+                    elif rule_id == "CRP006":
+                        suggestion = "Move API key to environment variables or a secrets manager"
+                    findings.append({
+                        "rule_id": rule_id,
+                        "message": message,
+                        "severity": severity,
+                        "file": file_path,
+                        "line": line_num,
+                        "column": column,
+                        "suggestion": suggestion,
+                    })
+
+    # Version check
+    if min_version:
+        try:
+            from packaging import version as pkg_version
+
+            from crp._version import __version__ as current_version
+            if pkg_version.parse(current_version) < pkg_version.parse(min_version):
+                findings.insert(0, {
+                    "rule_id": "CRP005",
+                    "message": f"crprotocol version {current_version} < required {min_version}",
+                    "severity": "CRITICAL",
+                    "file": "crp",
+                    "line": 0,
+                    "column": 0,
+                    "suggestion": f"pip install --upgrade crprotocol>={min_version}",
+                })
+        except ImportError:
+            pass
+
+    # Deduplicate
+    seen = set()
+    unique: list[dict] = []
+    for f in findings:
+        key = (f["file"], f["line"], f["rule_id"])
+        if key not in seen:
+            seen.add(key)
+            unique.append(f)
+    findings = unique
+
+    # Sort by severity
+    severity_rank = {"LOW": 1, "MEDIUM": 2, "HIGH": 3, "CRITICAL": 4}
+    findings.sort(key=lambda x: severity_rank.get(x["severity"], 0), reverse=True)
+    return findings
+
+
+def _findings_to_scan_findings(findings: list[dict]) -> list[Any]:
+    """Convert raw scanner dicts into RemediationEngine ``ScanFinding`` objects."""
+    from pathlib import Path
+
+    from crp.scan.remediation import ScanFinding
+
+    severity_map = {"LOW": "note", "MEDIUM": "warning", "HIGH": "error", "CRITICAL": "error"}
+
+    def _infer_provider(finding: dict) -> str:
+        msg = finding.get("message", "")
+        if "OpenAI" in msg or "openai" in msg:
+            return "openai"
+        if "Anthropic" in msg or "Claude" in msg:
+            return "anthropic"
+        if "Gemini" in msg or "GenerativeModel" in msg or "genai" in msg:
+            return "google"
+        if "HTTP" in msg:
+            return "http"
+        return "unknown"
+
+    def _code_context(file_path: str, line: int) -> list[str]:
+        try:
+            lines = Path(file_path).read_text(encoding="utf-8").splitlines()
+            start = max(0, line - 3)
+            end = min(len(lines), line + 2)
+            return lines[start:end]
+        except Exception:
+            return []
+
+    def _has_crp_import(file_path: str) -> bool:
+        try:
+            text = Path(file_path).read_text(encoding="utf-8").lower()
+            return "import crp" in text or "from crp" in text
+        except Exception:
+            return False
+
+    result: list[Any] = []
+    for f in findings:
+        file_path = Path(f.get("file", "")).as_posix()
+        line = f.get("line", 0)
+        result.append(ScanFinding(
+            rule_id=f.get("rule_id", ""),
+            file_path=file_path,
+            line=line,
+            message=f.get("message", ""),
+            severity=severity_map.get(f.get("severity", "LOW"), "note"),
+            provider=_infer_provider(f),
+            call_expression="",
+            code_context=_code_context(file_path, line),
+            has_crp_import=_has_crp_import(file_path),
+        ))
+    return result
+
+
+def _build_remediation_pr_body(proposals: list[Any]) -> str:
+    """Build a markdown PR body for an aggregated remediation PR."""
+    lines = [
+        "## CRP Scan — Automated Remediation",
+        "",
+        f"This PR remediates **{len(proposals)}** finding(s) detected by CRP Scan.",
+        "",
+        "### Findings",
+    ]
+    for proposal in proposals:
+        finding = proposal.finding
+        lines.append(
+            f"- **{finding.rule_id}** at `{finding.file_path}:{finding.line}` — {finding.message}"
+        )
+    lines.extend([
+        "",
+        "### Changes",
+        "- Code fixes route ungoverned AI calls through the CRP Gateway.",
+        "- Configuration fixes add governance policy to `crp.config.yaml`.",
+        "",
+        "Please review before merging.",
+    ])
+    return "\n".join(lines)
+
+
 # ── Click application ───────────────────────────────────────────────────
 
 def cli() -> None:
@@ -324,136 +543,11 @@ def cli() -> None:
     @click.option('--min-grounding', default=0.0, type=float, help='Minimum grounding score (advisory)')
     def scan(fmt, fail_on, paths, min_version, sarif, summary, report_only, min_grounding):
         """Scan source code for ungoverned LLM calls and missing safety policies."""
-        import os
-        import re
         from pathlib import Path
 
-        target_paths = [p.strip() for p in paths.split(',') if p.strip()]
-        findings = []
         severity_rank = {'LOW': 1, 'MEDIUM': 2, 'HIGH': 3, 'CRITICAL': 4}
         min_rank = severity_rank.get(fail_on, 3)
-
-        def _already_governed(line: str) -> bool:
-            """Return True if the line already references CRP governance."""
-            lowered = line.lower()
-            return 'crp.' in lowered or 'crprotocol' in lowered or 'crp-' in lowered
-
-        # Patterns for ungoverned LLM calls and missing safety controls.
-        # Each tuple: (regex, rule_id, message, severity)
-        raw_patterns = [
-            # Python / JS / TS class instantiations
-            (r'(?<!crp\.)\bOpenAI\s*\(', 'CRP001', 'Direct OpenAI client instantiation without CRP governance', 'HIGH'),
-            (r'(?<!crp\.)\bAnthropic\s*\(', 'CRP001', 'Direct Anthropic client instantiation without CRP governance', 'HIGH'),
-            # Python / JS / TS SDK method calls (client.chat.completions.create,
-            # client.messages.create, openai.Completion.create, etc.)
-            (r'\.chat\.completions\.create\(', 'CRP001', 'Direct OpenAI chat completions call without CRP governance', 'HIGH'),
-            (r'\.messages\.create\(', 'CRP001', 'Direct Anthropic messages call without CRP governance', 'HIGH'),
-            (r'(?<!crp\.)openai\.Completion\.create\(', 'CRP001', 'Direct OpenAI Completion call without CRP governance', 'HIGH'),
-            (r'(?<!crp\.)anthropic\.(Client|Anthropic)\(', 'CRP001', 'Direct Anthropic client creation without CRP governance', 'HIGH'),
-            (r'(?<!crp\.)google\.generativeai\.GenerativeModel\(', 'CRP001', 'Direct Gemini call without CRP governance', 'HIGH'),
-            (r'(?<!crp\.)\bgenai\.GenerativeModel\(', 'CRP001', 'Direct Gemini call without CRP governance', 'HIGH'),
-            # Raw HTTP / fetch / axios to LLM APIs
-            (r'requests\.(post|get|put|patch)\([^)]*https://api\.(openai|anthropic|gemini)', 'CRP003', 'Raw HTTP call to LLM API without governance', 'HIGH'),
-            (r'fetch\s*\(\s*["\']https://api\.(openai|anthropic|gemini)', 'CRP003', 'Raw HTTP call to LLM API without governance', 'HIGH'),
-            (r'axios\.(post|get|put|patch)\s*\(\s*["\']https://api\.(openai|anthropic|gemini)', 'CRP003', 'Raw HTTP call to LLM API without governance', 'HIGH'),
-            (r'curl\s+.*https://api\.(openai|anthropic|gemini)', 'CRP003', 'Raw shell call to LLM API without governance', 'HIGH'),
-            # Missing safety headers
-            (r'headers\s*=\s*\{[^}]*["\'][Xx]-[Aa][Ii]-[^"\']*["\']', 'CRP002', 'AI request without CRP safety headers', 'MEDIUM'),
-            # API key access
-            (r'os\.(?:environ|getenv)\(["\']OPENAI_API_KEY["\']', 'CRP004', 'API key accessed directly — consider CRP Gateway for key management', 'LOW'),
-            (r'os\.environ\.get\(["\']OPENAI_API_KEY["\']', 'CRP004', 'API key accessed directly — consider CRP Gateway for key management', 'LOW'),
-            (r'process\.env\.OPENAI_API_KEY', 'CRP004', 'API key accessed directly — consider CRP Gateway for key management', 'LOW'),
-            # Hard-coded API key-like strings
-            (r'["\']sk-[a-zA-Z0-9]{20,}', 'CRP006', 'Hard-coded API key detected', 'HIGH'),
-        ]
-        patterns = [(re.compile(p), rule, msg, sev) for p, rule, msg, sev in raw_patterns]
-
-        file_extensions = {
-            '.py', '.ts', '.js', '.mjs', '.cjs', '.jsx', '.tsx',
-            '.java', '.go', '.rs', '.cs', '.rb', '.php', '.swift', '.kt'
-        }
-
-        for target in target_paths:
-            if not os.path.exists(target):
-                continue
-            if os.path.isfile(target):
-                files = [target]
-            else:
-                files = []
-                for root, _dirs, filenames in os.walk(target):
-                    # Skip common non-source directories
-                    if any(part.startswith('.') for part in Path(root).parts):
-                        continue
-                    for name in filenames:
-                        ext = os.path.splitext(name)[1]
-                        if ext in file_extensions:
-                            files.append(os.path.join(root, name))
-
-            for file_path in files:
-                try:
-                    with open(file_path, encoding='utf-8', errors='replace') as f:
-                        lines = f.readlines()
-                except Exception:
-                    continue
-
-                for line_num, line in enumerate(lines, start=1):
-                    for compiled, rule_id, message, severity in patterns:
-                        match = compiled.search(line)
-                        if not match:
-                            continue
-                        if _already_governed(line):
-                            continue
-                        column = match.start() + 1
-                        suggestion = 'Wrap in CRP Client: from crp import Client; client = Client()'
-                        if rule_id == 'CRP002':
-                            suggestion = 'Add CRP safety headers: {"CRP-Safety-Policy": "...", "CRP-Governance": "..."}'
-                        elif rule_id == 'CRP003':
-                            suggestion = 'Route through CRP Gateway or wrap the HTTP call with crp.Client()'
-                        elif rule_id == 'CRP004':
-                            suggestion = 'Use CRP Gateway key vault or CRP Client secrets binding'
-                        elif rule_id == 'CRP006':
-                            suggestion = 'Move API key to environment variables or a secrets manager'
-                        findings.append({
-                            'rule_id': rule_id,
-                            'message': message,
-                            'severity': severity,
-                            'file': file_path,
-                            'line': line_num,
-                            'column': column,
-                            'suggestion': suggestion,
-                        })
-
-        # Version check
-        if min_version:
-            try:
-                from packaging import version as pkg_version
-
-                from crp._version import __version__ as current_version
-                if pkg_version.parse(current_version) < pkg_version.parse(min_version):
-                    findings.insert(0, {
-                        'rule_id': 'CRP005',
-                        'message': f'crprotocol version {current_version} < required {min_version}',
-                        'severity': 'CRITICAL',
-                        'file': 'crp',
-                        'line': 0,
-                        'column': 0,
-                        'suggestion': f'pip install --upgrade crprotocol>={min_version}',
-                    })
-            except ImportError:
-                pass
-
-        # Deduplicate
-        seen = set()
-        unique = []
-        for f in findings:
-            key = (f['file'], f['line'], f['rule_id'])
-            if key not in seen:
-                seen.add(key)
-                unique.append(f)
-        findings = unique
-
-        # Sort by severity
-        findings.sort(key=lambda x: severity_rank.get(x['severity'], 0), reverse=True)
+        findings = _scan_findings(paths, fail_on, min_version, min_grounding)
 
         # Build SARIF document once for optional file + stdout
         def _build_sarif():
@@ -488,18 +582,18 @@ def cli() -> None:
             Path(sarif).write_text(json.dumps(_build_sarif(), indent=2), encoding='utf-8')
 
         if summary:
-            lines = ['# CRP Scan Summary\n', '| Severity | Count |', '|----------|-------|']
+            summary_lines = ['# CRP Scan Summary\n', '| Severity | Count |', '|----------|-------|']
             counts = {sev: 0 for sev in severity_rank}
             for f in findings:
                 counts[f['severity']] = counts.get(f['severity'], 0) + 1
             for sev in ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']:
-                lines.append(f'| {sev} | {counts.get(sev, 0)} |')
-            lines.append(f'\n**Total findings:** {len(findings)}\n')
+                summary_lines.append(f'| {sev} | {counts.get(sev, 0)} |')
+            summary_lines.append(f'\n**Total findings:** {len(findings)}\n')
             if findings:
-                lines.append('## Findings\n')
+                summary_lines.append('## Findings\n')
                 for f in findings:
-                    lines.append(f"- **{f['rule_id']}** ({f['severity']}) — {f['message']} at `{f['file']}:{f['line']}`")
-            Path(summary).write_text('\n'.join(lines), encoding='utf-8')
+                    summary_lines.append(f"- **{f['rule_id']}** ({f['severity']}) — {f['message']} at `{f['file']}:{f['line']}`")
+            Path(summary).write_text('\n'.join(summary_lines), encoding='utf-8')
 
         # Advisory: min-grounding is accepted but not enforced by the regex scanner.
         if min_grounding:
@@ -510,6 +604,170 @@ def cli() -> None:
         if not report_only and max_rank >= min_rank:
             raise SystemExit(1)
 
+    # ── crp scan-remediate ──────────────────────────────────────────
+
+    @_cli.command("scan-remediate")
+    @click.option("--paths", default=".", help="Comma-separated paths to scan")
+    @click.option("--fail-on", default="HIGH", type=click.Choice(["LOW", "MEDIUM", "HIGH", "CRITICAL"]))
+    @click.option("--repo", default=None, help="Repository slug (owner/repo) for PR mode")
+    @click.option("--branch", default=None, help="Remediation branch to create")
+    @click.option("--base-branch", default="main", help="Base branch to branch from")
+    @click.option("--gh-token", default=None, envvar="GH_TOKEN", help="GitHub token for push/PR")
+    def scan_remediate(paths, fail_on, repo, branch, base_branch, gh_token):
+        """Scan for CRP findings and produce a remediation plan or open a PR.
+
+        Without --repo and --branch, prints a JSON remediation plan and exits 0.
+        With --repo and --branch, creates a dedicated branch, applies code/config
+        fixes, pushes, and opens a pull request.  NEVER commits to the base branch.
+        """
+        import os
+        import subprocess
+        import tempfile
+        from pathlib import Path
+
+        from crp.scan.remediation import RemediationEngine
+
+        raw_findings = _scan_findings(paths, fail_on, "", 0.0)
+        scan_findings = _findings_to_scan_findings(raw_findings)
+        engine = RemediationEngine()
+        proposals = engine.proposals_for_repo(scan_findings)
+
+        plan = {
+            "proposals": [
+                {
+                    "proposal_id": p.proposal_id,
+                    "rule_id": p.finding.rule_id,
+                    "file_path": p.finding.file_path,
+                    "line": p.finding.line,
+                    "remediation_class": p.remediation_class,
+                    "title": p.title,
+                    "description": p.description,
+                    "diff": p.diff,
+                    "config_snippet": p.config_snippet,
+                    "pr_branch": p.pr_branch,
+                }
+                for p in proposals
+            ],
+        }
+
+        if not proposals:
+            click.echo(json.dumps(plan, indent=2))
+            return
+
+        if not repo or not branch:
+            click.echo(json.dumps(plan, indent=2))
+            return
+
+        if not gh_token:
+            click.echo("ERROR: --gh-token (or GH_TOKEN env) is required for PR mode.", err=True)
+            raise SystemExit(1)
+
+        repo_root = Path(".")
+
+        def _run_git(args, check=True):
+            result = subprocess.run(
+                ["git", *args],
+                cwd=repo_root,
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            if check and result.returncode != 0:
+                click.echo(f"ERROR: git {' '.join(args)} failed: {result.stderr.strip()}", err=True)
+                raise SystemExit(1)
+            return result
+
+        # Configure git identity
+        _run_git(["config", "user.name", "CRP Scan Bot"])
+        _run_git(["config", "user.email", "crp-scan@crprotocol.io"])
+
+        # Create dedicated remediation branch from base branch
+        _run_git(["checkout", "-b", branch, base_branch])
+
+        # Apply proposals: code fixes via git apply, config fixes via crp.config.yaml
+        config_snippets = []
+        for proposal in proposals:
+            if proposal.remediation_class == "code_fix" and proposal.diff:
+                with tempfile.NamedTemporaryFile(
+                    mode="w", suffix=".diff", delete=False, encoding="utf-8"
+                ) as diff_file:
+                    diff_file.write(proposal.diff)
+                    diff_path = diff_file.name
+                try:
+                    check = _run_git(["apply", "--check", diff_path], check=False)
+                    if check.returncode == 0:
+                        _run_git(["apply", diff_path])
+                        _run_git(["add", proposal.finding.file_path])
+                    else:
+                        click.echo(
+                            f"WARNING: git apply failed for {proposal.finding.file_path}: "
+                            f"{check.stderr.strip()}",
+                            err=True,
+                        )
+                finally:
+                    os.unlink(diff_path)
+            elif proposal.remediation_class == "config_fix" and proposal.config_snippet:
+                config_snippets.append(proposal.config_snippet)
+
+        if config_snippets:
+            config_path = repo_root / "crp.config.yaml"
+            existing = config_path.read_text(encoding="utf-8") if config_path.exists() else ""
+            with open(config_path, "a", encoding="utf-8") as f:
+                if existing and not existing.endswith("\n"):
+                    f.write("\n")
+                for snippet in config_snippets:
+                    f.write(snippet)
+                    if not snippet.endswith("\n"):
+                        f.write("\n")
+            _run_git(["add", "crp.config.yaml"])
+
+        # Verify something was staged
+        status = _run_git(["diff", "--cached", "--quiet"], check=False)
+        if status.returncode == 0:
+            click.echo("No changes to commit — remediation already applied or diffs failed.")
+            click.echo(json.dumps(plan, indent=2))
+            return
+
+        # Commit and push to dedicated branch
+        commit_message = (
+            f"fix(crp-scan): automated remediation for {len(proposals)} finding(s)\n\n"
+            "Generated by CRP Scan auto-remediation."
+        )
+        _run_git(["commit", "-m", commit_message])
+
+        remote_url = f"https://x-access-token:{gh_token}@github.com/{repo}.git"
+        _run_git(["remote", "set-url", "origin", remote_url])
+        _run_git(["push", "origin", branch])
+
+        # Open PR via GitHub CLI
+        pr_title = f"fix(crp-scan): automated remediation ({len(proposals)} finding(s))"
+        pr_body = _build_remediation_pr_body(proposals)
+        env = os.environ.copy()
+        env["GH_TOKEN"] = gh_token
+        pr_result = subprocess.run(
+            [
+                "gh", "pr", "create",
+                "--repo", repo,
+                "--base", base_branch,
+                "--head", branch,
+                "--title", pr_title,
+                "--body", pr_body,
+            ],
+            cwd=repo_root,
+            capture_output=True,
+            text=True,
+            env=env,
+            check=False,
+        )
+        if pr_result.returncode != 0:
+            click.echo(f"ERROR: gh pr create failed: {pr_result.stderr.strip()}", err=True)
+            raise SystemExit(1)
+
+        pr_url = pr_result.stdout.strip()
+        click.echo(pr_url)
+        Path("/tmp/crp_remediation_pr_url").write_text(pr_url, encoding="utf-8")
+        plan["pr_url"] = pr_url
+
     _cli(standalone_mode=True)