fix: scope workspace fix commands to the declaring member

examples/pnpm-workspace-parent-upgrade/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "cve-lite-example-pnpm-workspace-parent-upgrade",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Intentionally vulnerable pnpm monorepo example. The packages/tooling member's dev dependency concurrently@9.2.1 transitively pulls the vulnerable shell-quote@1.8.3, fixable only by upgrading the parent (concurrently@9.2.4). Verifies CVE Lite CLI scopes the parent-upgrade fix command to the correct workspace member with --filter.",
+  "license": "MIT"
+}

examples/pnpm-workspace-parent-upgrade/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+packages:
+  - 'packages/*'

examples/yarn-workspace-parent-upgrade/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "cve-lite-example-yarn-workspace-parent-upgrade",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Intentionally vulnerable Yarn monorepo example. The packages/tooling member's dev dependency concurrently@9.2.1 transitively pulls the vulnerable shell-quote@1.8.3, fixable only by upgrading the parent (concurrently@9.2.4). Verifies CVE Lite CLI scopes the parent-upgrade fix command to the correct workspace member with `yarn workspace <name> add`.",
+  "license": "MIT",
+  "workspaces": [
+    "packages/*"
+  ]
+}

examples/yarn-workspace-parent-upgrade/packages/tooling/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "tooling",
+  "version": "1.0.0",
+  "private": true,
+  "devDependencies": {
+    "concurrently": "9.2.1"
+  }
+}

examples/yarn-workspace-parent-upgrade/yarn.lock

@@ -0,0 +1,15 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+concurrently@9.2.1:
+  version "9.2.1"
+  resolved "https://registry.yarnpkg.com/concurrently/-/concurrently-9.2.1.tgz#a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
+  integrity sha512-fsfrO0MxV64Znoy8/l1vVIjjHa29SZyyqPgQBwhiDcaW8wJc2W3XWVOGx4M3oJBnv/zdUZIIp1gDeS98GzP8Ng==
+  dependencies:
+    shell-quote "1.8.3"
+
+shell-quote@1.8.3:
+  version "1.8.3"
+  resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.3.tgz#b1c2d3e4f5a60718293a4b5c6d7e8f9012345678"
+  integrity sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==

src/remediation/fix-commands.ts

@@ -282,6 +282,7 @@ export function buildSuggestedFixCommandPlan(
       const chainForNpmRemediation = finding.chainResolution?.directDep === finding.recommendedNpmTransitiveRemediation.package
         ? finding.chainResolution
         : null;
+      const npmParentUpgradeWorkspaces = workspaceMap.get(finding.recommendedNpmTransitiveRemediation.package)?.filter(w => w !== ".") ?? [];
       upsertTarget(targetsByPackage, {
         package: finding.recommendedNpmTransitiveRemediation.package,
         currentVersion: finding.recommendedNpmTransitiveRemediation.currentVersion,
@@ -299,6 +300,7 @@ export function buildSuggestedFixCommandPlan(
         remainingPaths: coverage.remainingPaths,
         usage: finding.usage ?? null,
         isDev: devLookup.get(`${finding.recommendedNpmTransitiveRemediation.package}@${finding.recommendedNpmTransitiveRemediation.currentVersion}`) ?? false,
+        workspaces: npmParentUpgradeWorkspaces.length > 0 ? npmParentUpgradeWorkspaces : undefined,
         chainProof: chainForNpmRemediation?.chain,
         chainSafeVersion: chainForNpmRemediation?.safeVersion,
         chainVulnerablePackage: chainForNpmRemediation ? finding.pkg.name : undefined,
@@ -321,6 +323,7 @@ export function buildSuggestedFixCommandPlan(
       const chainForParentUpgrade = finding.chainResolution?.directDep === finding.recommendedParentUpgrade.package
         ? finding.chainResolution
         : null;
+      const parentUpgradeWorkspaces = workspaceMap.get(finding.recommendedParentUpgrade.package)?.filter(w => w !== ".") ?? [];
       upsertTarget(targetsByPackage, {
         package: finding.recommendedParentUpgrade.package,
         currentVersion: finding.recommendedParentUpgrade.currentVersion,
@@ -338,6 +341,7 @@ export function buildSuggestedFixCommandPlan(
         remainingPaths: coverage.remainingPaths,
         usage: finding.usage ?? null,
         isDev: devLookup.get(`${finding.recommendedParentUpgrade.package}@${finding.recommendedParentUpgrade.currentVersion}`) ?? false,
+        workspaces: parentUpgradeWorkspaces.length > 0 ? parentUpgradeWorkspaces : undefined,
         chainProof: chainForParentUpgrade?.chain,
         chainSafeVersion: chainForParentUpgrade?.safeVersion,
         chainVulnerablePackage: chainForParentUpgrade ? finding.pkg.name : undefined,
@@ -390,6 +394,7 @@ export function buildSuggestedFixCommandPlan(
       if (finding.chainResolution) {
         const isDev = devLookup.get(`${finding.chainResolution.directDep}@${finding.chainResolution.directDepCurrentVersion}`) ?? false;
         const coverage = calculatePathCoverage(finding.dependencyPaths, [finding.chainResolution.directDep]);
+        const chainWorkspaces = workspaceMap.get(finding.chainResolution.directDep)?.filter(w => w !== ".") ?? [];
         upsertTarget(targetsByPackage, {
           package: finding.chainResolution.directDep,
           currentVersion: finding.chainResolution.directDepCurrentVersion,
@@ -406,6 +411,7 @@ export function buildSuggestedFixCommandPlan(
           chainVulnerablePackage: finding.pkg.name,
           usage: finding.usage ?? null,
           isDev,
+          workspaces: chainWorkspaces.length > 0 ? chainWorkspaces : undefined,
         });
         continue;
       }
@@ -445,6 +451,17 @@ export function buildSuggestedFixCommandPlan(
     return a.package.localeCompare(b.package);
   });
 
+  // Some install targets carry an explicit `command` built without workspace
+  // context (e.g. a chain-resolution command). This raw field is exposed in JSON
+  // and embedded in the HTML report, so scope it to the declaring member too -
+  // parent-update commands are already workspace-aware and left untouched.
+  for (const target of targets) {
+    if (target.kind !== "parent-update" && target.command && target.workspaces?.length) {
+      const scoped = buildWorkspaceInstallCommands([target], packageManager);
+      if (scoped.length > 0) target.command = scoped.join(" && ");
+    }
+  }
+
   const nowMs = options?.nowMs ?? Date.now();
   if (scanInput.filePath && (packageManager === "npm" || packageManager === "pnpm" || packageManager === "yarn")) {
     const cooldown = readConfiguredCooldown(path.dirname(scanInput.filePath), packageManager);
@@ -524,7 +541,7 @@ function buildPnpmLockfileRefreshCommand(pkg: string, workspaces?: string[]): st
   if (workspace === ".") {
     return `pnpm update --no-save ${pkg}`;
   }
-  return `pnpm -C ${workspace} update --no-save ${pkg}`;
+  return `pnpm --filter ./${workspace} update --no-save ${pkg}`;
 }
 
 export function commandPrefix(packageManager: SuggestedFixPackageManager): string {
@@ -582,11 +599,17 @@ export function findSuggestedCommandForFinding(
 ): string | null {
   const target = findFixTargetForFinding(plan, finding);
   if (!target) return null;
-  if (target.command) return target.command;
+  // parent-update targets carry an explicit command that is already
+  // workspace-scoped (npm update --workspace / pnpm --filter ... update).
+  if (target.kind === "parent-update" && target.command) return target.command;
+  // For install targets (direct / parent-upgrade), a workspace membership must
+  // win over any flat explicit command (e.g. a chain-resolution command built
+  // without workspace context), mirroring the plan-level command builder.
   if (target.workspaces?.length) {
     const commands = buildWorkspaceInstallCommands([target], plan.packageManager);
     if (commands.length > 0) return commands.join(" && ");
   }
+  if (target.command) return target.command;
   const flag = target.isDev ? ` ${devFlag(plan.packageManager)}` : "";
   return `${commandPrefix(plan.packageManager)}${flag} ${target.package}@${target.targetVersion}`;
 }
@@ -842,8 +865,11 @@ function buildWorkspaceInstallCommands(
         const wsFlags = workspaces.map(ws => `-w ${ws}`).join(" ");
         commands.push(`npm install${flag}${wsFlags ? " " + wsFlags : ""} ${pkgArgs}`);
       } else if (packageManager === "pnpm") {
+        // pnpm's --filter selector is a CLI-level flag that precedes the command
+        // (`pnpm --filter ./client add pkg`), not a trailing argument.
         const wsFlags = workspaces.map(ws => `--filter ./${ws}`).join(" ");
-        commands.push(`pnpm add${flag}${wsFlags ? " " + wsFlags : ""} ${pkgArgs}`);
+        const prefix = wsFlags ? `pnpm ${wsFlags} add` : "pnpm add";
+        commands.push(`${prefix}${flag} ${pkgArgs}`);
       } else if (packageManager === "yarn") {
         if (workspaces.length === 0) {
           commands.push(`yarn add${flag} ${pkgArgs}`);