feat(cli): add manus-agent otx subcommand for AlienVault OTX threat intelligence

[manus-use]

Summary

Adds manus-agent otx <CVE-ID> CLI subcommand that wires the existing get_otx_cve_details Strands tool to the terminal. Users can now look up AlienVault OTX threat intelligence for any CVE without invoking the full agent.

What's included

CLI (src/manus_agent/cli.py)

• _build_otx_parser() — positional CVE-ID, --output {text,json} (default: text)
• _run_otx(argv) — CVE ID validation (uppercased), synthetic ToolUse invocation, text/JSON output routing
• _print_otx_text(cve_id, data) — human-readable pulse display including:
  • Pulse name, author, dates
  • Adversary / threat actor
  • TLP level
  • Indicator count
  • Tags, targeted countries, malware families, MITRE ATT&CK IDs
  • Truncation message when >10 pulses
• Registered in _SUBCOMMANDS set and main() dispatch

README

• TOC entry + full CLI reference section with usage examples and flag table

Tests (tests/test_cli_otx.py) — 29 tests

• TestBuildOtxParser (8): prog name, args, output choices, help text
• TestRunOtxInvalidInputs (4): invalid format, empty, partial, lowercase normalisation
• TestRunOtxTextOutput (2): no-pulses message, JSON→text rendering with full pulse details
• TestRunOtxJsonOutput (2): structured JSON pass-through, text message JSON wrapping
• TestRunOtxErrors (3): API key missing, HTTP error, import failure
• TestPrintOtxText (7): basic output, truncation, adversary, countries, malware, ATT&CK
• TestSubcommandsRegistry (1): "otx" in _SUBCOMMANDS
• TestMainDispatchOtx (3): basic dispatch, output flag forwarding, non-zero exit propagation

All tests are 100% mocked — no real HTTP calls.

Test results

1187 passed, 3 deselected, 3 warnings in 25.48s

(Baseline 1158 + 29 new = 1187 total, 0 failures)

Duplicate check

Confirmed no overlap with existing open or merged PRs:

• PR test(core-tools): comprehensive test suite for check_cisa_kev, get_nvd_data, get_cwe_details, get_otx_cve_details #89 adds tool-level tests for get_otx_cve_details but no CLI subcommand
• No other open PR (feat(tools): silent patch detector — detect_silent_patches tool + manus-agent silent-patches CLI #51-feat(cli): add manus-agent cwe subcommand for CWE weakness lookup #124) or merged PR adds an otx CLI subcommand
• Checked all 50 open PRs and 30 merged PRs by title and branch name

Usage

# Text output (requires OTX_API_KEY env var or config.toml)
manus-agent otx CVE-2024-3094

# JSON output for piping
manus-agent otx CVE-2021-44228 --output json | jq '.pulse_info.count'