Improve 'CVE Audit' agent (#9164)

Author: GytisCepk

.github/agents/cve-audit.agent.md

@@ -35,7 +35,7 @@ rush install
 ```
 
 - **Do not create the security branch yet.** The branch name requires a CVE ID, which is only known after the audit in Step 1. Branch creation happens in Execution Flow Step 1b (after the audit).
-- For multiple CVEs, use the highest-severity CVE/GHSA ID for the branch name and include others in the commit/PR text. If severity is equal, use the first ID returned by `rush audit --json`.
+- For multiple CVEs, use the highest-severity CVE/GHSA ID for the branch name and include others in the commit/PR text. If severity is equal, use the first ID from the audit table output.
 
 ### Protected Branch Guard (Required)
 
@@ -79,14 +79,13 @@ rush change --bulk --message "" --bump-type none -b origin/<starting-branch>
 1. Audit — run on the starting branch before creating any branch or making any changes:
 
 ```bash
-rush audit --level high
-rush audit --json > /tmp/cve-audit-results.json
+rush audit
 ```
 
-Parse `/tmp/cve-audit-results.json` to extract CVE/GHSA IDs, severities, advisory URLs, and dependency paths. These values drive all subsequent steps (branch name, commit message, PR body, deferral issues).
+**Note:** `rush audit` internally invokes `rush-pnpm audit --audit-level high`. It does **not** accept `--level` or `--json` flags directly. Parse the table output to extract CVE/GHSA IDs, severities, advisory URLs, and dependency paths. Use `rush-pnpm why <package>` to investigate transitive dependency paths when the audit output shows truncated paths.
 
 **1b. Early exit if no High/Critical CVEs found:**
-If `rush audit --level high` reports zero High or Critical vulnerabilities — **stop here**. Do not create a branch. Do not run `rush update --full`. Report all-clear to the invoker.
+If `rush audit` reports zero High or Critical vulnerabilities — **stop here**. Do not create a branch. Do not run `rush update`. Report all-clear to the invoker.
 
 **1c. Create security branch (now that CVE ID is known):**
 ```bash
@@ -98,12 +97,21 @@ git rev-parse --verify security/<first-CVE-ID> >/dev/null 2>&1 \
 
 2. Fast-path auto updates — attempt before any manual changes:
 
+```bash
+rush update
+rush audit
+```
+
+   Start with `rush update` (without `--full`) — it is faster and less disruptive. Re-run the audit immediately. If High/Critical vulnerabilities are cleared, proceed to Step 4 (verify).
+
+   If High/Critical remain, escalate to a full re-resolve:
+
 ```bash
 rush update --full
-rush audit --level high
+rush audit
 ```
 
-   Re-run the audit immediately after `rush update --full`. If High/Critical vulnerabilities are cleared, proceed to Step 4 (verify) — no further manual changes are needed.
+   If still not cleared after `--full`, proceed to Step 3 for manual remediation.
 
 3. If High/Critical remain after step 2, remediate using the fix strategy defined in the `cve-remediation` skill:
 
@@ -117,7 +125,12 @@ rush audit --level high
 
 ```bash
 rush update
-rush audit --level high
+rush audit
+```
+
+   After audit confirms High/Critical are resolved, run build and test validation. If the invoker prefers to validate separately (e.g., in CI), commit after audit verification and note pending validation steps in the report.
+
+```bash
 rush build
 rush test
 ```
@@ -229,7 +242,7 @@ If not requested: stop after commit and final report (no push, no PR).
 ## Done Criteria
 
 - Critical/High vulnerabilities reduced or explicitly documented with rationale.
-- `rush audit --level high` rerun and reported.
+- `rush audit` rerun and reported.
 - `rush build` and `rush test` pass (or no new failures with clear disclosure).
 - `rush change` handled non-interactively (`--verify`; blank entry via `--bulk --message "" --bump-type none` only when required).
 - API impact checked with `rush extract-api` when relevant.

.github/skills/cve-remediation/SKILL.md

@@ -50,7 +50,7 @@ Illustrative example (always consult the current `common/config/rush/pnpm-config
 }
 ```
 
-**Important:** The last entry must NOT have a trailing comma (valid JSON). When adding entries, ensure the previously-last entry gets a comma added.
+**Important:** This file uses JSONC (JSON with comments). The last entry in any object/array must NOT have a trailing comma. When adding entries, ensure the previously-last entry gets a comma added and the new last entry does not have one.
 
 ### ignoreCves (Audit Exceptions)
 
@@ -82,13 +82,16 @@ Always attempt fixes in this order. Do not skip to overrides without trying the
 ### 2a. Direct Dependency Fix
 
 1. Update the version range in the affected `package.json`
-2. Run `rush update` and `rush audit --level high`
+2. Run `rush update` then `rush audit` to verify
 3. If no safe version range exists, fall through to globalOverride (document why)
 
 ### 2b. Transitive Dependency Fix
 
-1. **Semver range update (try first):** Update the direct parent's `package.json` range to a version that resolves the transitive dep to a patched release
-2. **globalOverride (last resort):** Only if no safe parent version exists. Document why in the override comment
+1. **Check existing overrides first:** Before adding a new override, check if the package already has an entry in `globalOverrides` in `pnpm-config.json` to avoid conflicts or duplicates.
+2. **Semver range update (try first):** Update the direct parent's `package.json` range to a version that resolves the transitive dep to a patched release
+3. **Scoped globalOverride (last resort):** Only if no safe parent version exists. Scope the override to only the vulnerable version range (e.g., `"lodash@>=4.0.0 <=4.17.23": "^4.18.0"`) rather than overriding all versions blanket. This avoids interfering with future already-patched versions. Document why in the override comment.
+
+Use `rush-pnpm why <package>` to trace transitive dependency paths when the audit output truncates them.
 
 ### 3. ignoreCves (Absolute Last Resort)
 
@@ -113,11 +116,13 @@ After any remediation change:
 
 ```bash
 rush update                # Regenerate lock file
-rush audit --level high    # Verify CVE is resolved
+rush audit                 # Verify CVE is resolved (internally runs rush-pnpm audit --audit-level high)
 rush build                 # Ensure no build breakage
 rush test                  # Ensure no test regressions
 ```
 
+**Note:** `rush audit` does not accept `--level` or `--json` flags directly. Use `rush-pnpm why <package>` to investigate specific dependency paths.
+
 When direct dependency version ranges were changed in a `package.json`:
 
 ```bash