feat(tools): get_version_range — NVD CPE + OSV.dev affected version range resolver + CLI subcommand (+99 tests) - #54

Summary

Implements the get_version_range tool and manus-agent version-range CLI subcommand — a README-documented feature that was completely unimplemented (no tool file, no CLI dispatch, no tests).

What it does

Computes affected version ranges for a CVE by walking two complementary sources:

1. NVD CPE configurations — parses versionStartIncluding, versionEndExcluding, versionEndIncluding bounds from CPE Match criteria to produce vendor/product-level version constraints
2. OSV.dev affected ranges — fetches per-package introduced/fixed/last_affected events from ecosystem databases (PyPI, npm, Maven, Go, RustSec, etc.)

Merges both sources, deduplicates, and optionally filters by ecosystem. Output includes:

• Affected version ranges (human-readable + structured)
• First patched version (from OSV fixed events or NVD end-excluding bounds)
• Affected package names and ecosystems
• CVSS context from NVD

CLI Usage

manus-agent version-range CVE-2021-44228
manus-agent version-range CVE-2021-44228 --ecosystem pypi
manus-agent version-range CVE-2021-44228 --output json | jq .first_patched_version

Design

• Zero new dependencies — uses only requests (already a project dep)
• Retry/back-off on all HTTP (configurable via env vars, same pattern as other tools)
• NVD_API_KEY support for higher rate limits
• Graceful degradation — NVD or OSV failure returns partial results, never crashes
• Strands TOOL_SPEC interface — compatible with the agent tool registry
• Ecosystem normalisation — accepts aliases (e.g., python→PyPI, node→npm)
• GHSA alias following — when CVE record lacks package data, follows GHSA aliases

Test Coverage

99 fully-mocked tests covering:

• TOOL_SPEC contract (5)
• Input validation (6)
• CPE URI parsing (6)
• Range string building (9)
• CPE range extraction (7)
• Ecosystem normalisation (8)
• Ecosystem filtering (6)
• NVD headers (3)
• HTTP retry behaviour (5)
• OSV range extraction (7)
• NVD fetch (4)
• Core fetch_version_range (7)
• Text formatting (5)
• Strands handler (5)
• CLI subcommand (6)
• Edge cases (7)
• JSON output (2)
• Integration: graceful degradation (2)

Full suite: 1257 passed (baseline 1158 + 99 new), 0 failures.

Files Changed

• src/manus_agent/tools/get_version_range.py (new — tool implementation)
• src/manus_agent/cli.py (dispatch + parser + _SUBCOMMANDS registration)
• tests/test_version_range.py (new — 99 tests)

Duplicate Check

Checked all 50 open PRs (#141–#190) and 30 merged PRs. No existing PR covers NVD CPE + OSV.dev version range resolution as a dedicated tool. Related but distinct:

• feat(tools): OSV.dev affected-package resolver — get_osv_data tool + manus-agent osv CLI #97 (merged) get_osv_data — raw OSV fetch, no NVD CPE cross-reference, no CLI subcommand named version-range
• feat: add cve-enrich tool and CLI subcommand for multi-source CVE enrichment #170 (open) cve-enrich — multi-source enrichment dump, not structured version ranges
• feat(tools): get_dependency_blast_radius + manus-use blast-radius CLI #63 (merged) blast-radius — downstream impact scoring, not upstream version bounds