feat(tools): Go module enrichment in get_dependency_blast_radius

[manus-use]

Summary

Adds _enrich_go() to get_dependency_blast_radius.py, giving the blast-radius tool first-class support for the Go ecosystem alongside the existing npm, PyPI, and Maven enrichers.

What changed

src/manus_agent/tools/get_dependency_blast_radius.py

Addition	Purpose
_parse_go_timestamp(ts)	Robust ISO-8601 parser shared by both API calls; handles Z suffix, +00:00 offset, naive TZ, sub-second fractions up to 7-digit .NET-style ticks
_enrich_go(name)	Two-call enrichment — Go module proxy + deps.dev
_enrich_package() dispatch	"go" / "golang" ecosystem strings route to _enrich_go()
Go output block	Renders: Latest version, Total versions, First released (+ age), Latest release date
Updated module docstring	Documents the two new data sources

Data sources (both free, unauthenticated)

1. Go module proxy https://proxy.golang.org/{module}/@latest

   • Latest semver tag + release timestamp

2. deps.dev API https://api.deps.dev/v3alpha/systems/GO/packages/{module}

   • Full version list with per-version publishedAt timestamps
   • Derived: first_release_date, age_years, total_versions

Design decisions

• Module paths are URL-encoded with urllib.parse.quote(name, safe="") so golang.org/x/net → golang.org%2Fx%2Fnet in both API URLs (required by Go proxy spec)
• Two independent try/except blocks: proxy failure still yields deps.dev data; deps.dev failure still yields latest-version from proxy
• _parse_go_timestamp truncates fractional seconds to 6 digits before calling datetime.fromisoformat to handle .NET-style 7-digit ticks
• weekly_downloads is not set for Go packages (no equivalent public metric); blast score falls through to UNKNOWN for packages with no download/dependent signal — honest and correct

tests/test_dependency_blast_radius.py

17 new tests, 100% mocked — no real HTTP calls:

Class	Count	Coverage
TestParseGoTimestamp	7	Z suffix, +00:00 offset, naive TZ, microseconds, 7-digit ticks, empty string, invalid string
TestEnrichGo	7	Happy path, URL encoding, proxy-only fallback, deps.dev-only fallback, both-fail minimal record, empty version list, missing publishedAt skipped
TestEnrichPackageDispatch	2	"Go" and "golang" ecosystem aliases
TestGetDependencyBlastRadius	1	Go output block rendered in full integration test

Suite results: 1175 passed, 0 failures (baseline was 1158; +17 new tests).

Example output

manus-agent blast-radius CVE-2023-44487   # HTTP/2 Rapid Reset (Go net/http)

[1] golang.org/x/net  (Go modules)
    Blast radius:     UNKNOWN
    Vulnerable range: < 0.17.0
    Latest version:   v0.20.0
    Total versions:   42
    First released:   2022-10-19  (1.4 yrs old)
    Latest release:   2024-03-05
    Data sources:     osv

No-duplicate confirmation

Checked all open and merged PRs before building. No existing PR covers Go module enrichment in get_dependency_blast_radius.

Open PRs checked (no overlap): #51, #53, #54, #58, #60, #64, #65, #67, #74, #75, #76, #77, #78, #79, #80, #82, #83, #85, #86, #87, #88, #89, #90, #96, #97, #98, #100, #103, #104, #105