feat(tools): get_version_range — CVE affected version range resolver + CLI subcommand (+85 tests)

[manus-use]

Summary

Implements the get_version_range tool and manus-agent version-range CLI subcommand — a README-documented feature that had zero implementation (no tool file, no CLI dispatch, no tests).

What it does

Resolves a CVE to its affected version ranges per ecosystem and package by:

1. NVD CPE configurations — walks configurations[].nodes[].cpeMatch[] to extract versionStartIncluding, versionEndExcluding, etc. into structured range tuples
2. OSV.dev package ranges — fetches per-package affected[].ranges[].events with introduced/fixed/last_affected and concrete version lists; follows GHSA aliases when the CVE record lacks package-level data
3. Merges and deduplicates — presents a unified view grouped by ecosystem+package with human-readable range descriptions

CLI usage (matches README docs)

manus-agent version-range CVE-2021-44228
manus-agent version-range CVE-2021-44228 --ecosystem pypi
manus-agent version-range CVE-2021-44228 --output json | jq .first_patched_version

Ecosystem support

Supports filtering by: auto (all), pypi, npm, maven, go, cargo, nuget, rubygems, composer. Normalises aliases (e.g., "python" → PyPI, "node" → npm, "rust" → crates.io).

Design

• Zero new dependencies — uses only requests (already in deps)
• Retry/back-off on all HTTP (configurable via VERSION_RANGE_MAX_RETRIES, VERSION_RANGE_RETRY_BASE_DELAY env vars)
• NVD_API_KEY support for higher rate limits
• Graceful degradation — returns partial results when one source fails
• Strands TOOL_SPEC interface — consistent with all other tools in the repo
• GHSA alias following — recovers package-level data when CVE record is sparse (capped at 8 aliases)

Test coverage

85 fully-mocked tests covering:

• TOOL_SPEC contract (4)
• Input validation (5)
• HTTP retry logic (5)
• NVD CPE range parsing (8)
• NVD range formatting (5)
• OSV affected parsing (7)
• Ecosystem normalisation (7)
• Ecosystem filtering (5)
• Range description builder (5)
• fetch_version_range integration (5)
• OSV fetch with alias following (3)
• NVD fetch (4)
• Text formatting (5)
• JSON output (1)
• Strands tool handler (4)
• CLI subcommand (5)
• Edge cases (6)

Full test suite: 1243 passed, 0 failures.

Files changed

• src/manus_agent/tools/get_version_range.py (new — tool implementation)
• src/manus_agent/cli.py (dispatch + parser + _SUBCOMMANDS)
• tests/test_version_range.py (new — 85 tests)

Duplicate check

Checked all 50 open PRs (#137–#186) and 30 most recent merged PRs. No existing open or merged PR implements version-range. Closest PRs reviewed:

• feat(tools): OSV.dev affected-package resolver — get_osv_data tool + manus-agent osv CLI #97 (merged) get_osv_data — single CVE OSV lookup, no NVD CPE integration or version-range resolution
• feat: add cve-enrich tool and CLI subcommand for multi-source CVE enrichment #170 (open) cve-enrich — multi-source enrichment dump, not structured version-range output
• feat(tools): sbom_scan — CycloneDX/SPDX SBOM vulnerability scanner + CLI subcommand (+98 tests) #64 (open) sbom-scan — SBOM file scanning, different scope (file → vulns vs CVE → versions)