feat(cli): add manus-agent sbom-scan subcommand for SBOM vulnerability scanning (+66 tests)

[manus-use]

Summary

Implements the manus-agent sbom-scan CLI subcommand — documented in the README but previously unimplemented. This adds a complete SBOM vulnerability scanner that parses CycloneDX or SPDX JSON files, queries OSV.dev in batch for known vulnerabilities, enriches each finding with EPSS scores and CISA KEV membership, and ranks results by severity.

What's included

New tool: src/manus_agent/tools/scan_sbom.py

• SBOM parsing: CycloneDX JSON and SPDX JSON format detection and component extraction
• PURL parsing: Full Package URL support with 17 ecosystem mappings (npm, PyPI, Maven, Go, crates.io, NuGet, RubyGems, Packagist, etc.)
• OSV.dev batch query: Efficient batch vulnerability lookup (up to 1000 packages per request)
• EPSS enrichment: Fetches exploit prediction scores for all discovered CVEs
• CISA KEV enrichment: Checks all findings against the Known Exploited Vulnerabilities catalog
• Ranking: Results sorted by KEV membership first, then EPSS score descending
• Retry/back-off: Exponential back-off on all HTTP requests (429, 5xx), configurable via env vars
• Graceful degradation: EPSS and KEV enrichment failures don't break the scan
• Strands TOOL_SPEC: Full tool interface for agent use

CLI subcommand: manus-agent sbom-scan <bom-file>

• --output text (default): Rich table with color-coded findings
• --output json: Machine-readable JSON with critical_count, all findings, and metadata
• Proper error handling for missing files, invalid JSON, unrecognised formats

Test suite: tests/test_scan_sbom.py (+66 tests)

• TOOL_SPEC contract verification (4 tests)
• PURL parsing (14 tests) — all ecosystem types, qualifiers, edge cases
• SBOM parsing (10 tests) — CycloneDX, SPDX, fallbacks, error cases
• OSV batch query (4 tests) — payload construction, empty input, ecosystem handling
• EPSS enrichment (4 tests) — success, empty, graceful failure
• KEV enrichment (2 tests) — success, graceful failure
• Retry logic (3 tests) — 429 retry, network error, no-retry on 4xx
• Full scan integration (7 tests) — ranking, deduplication, critical count
• Strands tool entry point (4 tests) — success, missing input, errors
• CLI subcommand (7 tests) — JSON output, text output, argparse, error paths
• Edge cases (5 tests) — GHSA alias resolution, no-CVE vulns, CVSS extraction, truncation, SPDX end-to-end

All tests are 100% mocked — no real HTTP calls.

Usage

# Text output with severity-ranked table
manus-agent sbom-scan bom.json

# JSON output for piping
manus-agent sbom-scan sbom.spdx.json --output json | jq .critical_count

Open PRs checked (no overlap)

Reviewed all 50 open PRs (#135–#184). No existing open or merged PR implements sbom-scan:

• feat(tools): export_sarif — SARIF v2.1.0 vulnerability report exporter + CLI subcommand #183 (export_sarif) — SARIF export, not SBOM scanning
• feat: add cve-enrich tool and CLI subcommand for multi-source CVE enrichment #170 (cve-enrich) — single-CVE enrichment, not SBOM batch scanning
• feat(tools): OSV.dev affected-package resolver — get_osv_data tool + manus-agent osv CLI #97 (merged, osv CLI) — single-CVE OSV lookup, not batch SBOM scanning
• feat(cli): add manus-agent watchlist subcommand for persistent CVE tracking with bulk EPSS + KEV status #179 (watchlist) — CVE tracking, not SBOM scanning

Test results

1224 passed, 3 deselected, 3 warnings in 25.66s

Zero new dependencies — uses only requests (already in project deps).