feat(tools): get_cve_timeline — CVE event timeline reconstructor + CLI subcommand (+88 tests)

[manus-use]

Summary

Implements the get_cve_timeline tool and manus-agent cve-timeline CLI subcommand — both documented in the README but previously unimplemented.

What it does

Reconstructs the full event timeline for a CVE by gathering chronological events from multiple sources:

1. NVD — publish date, last modified date, CVSS score assignment
2. EPSS — first appearance date, significant spike events (>10% jump)
3. CISA KEV — date added to Known Exploited Vulnerabilities catalog
4. GitHub Advisory — advisory publish/update dates
5. Patches — commit/release URLs from NVD references

All events are sorted chronologically and a summary computes key time deltas (e.g., days from CVE publication to KEV addition).

Usage

manus-agent cve-timeline CVE-2021-44228
manus-agent cve-timeline CVE-2021-44228 --output json

Design

• Zero new dependencies — uses only requests (already in deps)
• Retry/back-off on all HTTP calls (configurable via NVD_MAX_RETRIES, NVD_BACKOFF_BASE, CVE_TIMELINE_TIMEOUT env vars)
• NVD_API_KEY and GITHUB_TOKEN support for higher rate limits
• Graceful degradation — each source fails independently; partial timelines still returned
• Strands TOOL_SPEC interface — fully compatible with the agent framework
• KEV deduplication — NVD sometimes embeds KEV dates; avoids duplicate KEV fetch
• Rich CLI output — date-grouped timeline with box-drawing characters + summary section

Test coverage

88 fully mocked tests covering:

• TOOL_SPEC contract (4)
• Date parsing (8)
• Days-between helper (6)
• CVSS extraction (6)
• Patch reference extraction (6)
• HTTP retry logic (5)
• NVD event fetching (5)
• EPSS event fetching (6)
• KEV date fetching (4)
• GitHub advisory dates (4)
• Summary computation (5)
• Timeline assembly integration (8)
• Text formatting (5)
• JSON formatting (2)
• Handler entry point (3)
• CLI subcommand (5)
• Edge cases (6)

Files changed

• src/manus_agent/tools/get_cve_timeline.py (new)
• src/manus_agent/cli.py (dispatch + parser + _SUBCOMMANDS set)
• tests/test_cve_timeline.py (new, 88 tests)

No duplicate check

Checked all 50 open PRs (#136–#185) and 30 merged PRs — no existing open or merged PR implements cve-timeline. Closest related:

• feat: add cve-enrich tool and CLI subcommand for multi-source CVE enrichment #170 (cve-enrich — multi-source enrichment dump, not timeline reconstruction)
• feat(tools): EPSS trend tracker with spike detection + epss-trend CLI subcommand #45 (merged, epss-trend — EPSS-only history, not full multi-source timeline)
• feat(cli): add manus-agent vendor-response subcommand for vendor patch status tracking #149 (vendor-response — vendor patch tracking, not chronological event assembly)