Add explain and quiet CLI modes

README.md

@@ -92,6 +92,7 @@ The `scan` command is the default and can also be run explicitly as `npx depende
 | Flag | Description |
 |---|---|
 | `--project <path>` | Path to the project to scan (defaults to current directory) |
+| `--quiet` | Suppress progress/info logs, browser opening, and footer messaging while keeping the final summary and failures visible |
 | `--out <path>` | Output path for the report file |
 | `--offline` | Skip `npm audit` and `npm outdated` (useful for offline/air-gapped scans) |
 | `--json` | Output JSON instead of HTML (`dependency-radar.json`) |
@@ -101,6 +102,49 @@ The `scan` command is the default and can also be run explicitly as `npx depende
 | `--fail-on <rules>` | Fail with exit code 1 when selected policy rules are violated (see below) |
 | `--help` | Show all options |
 
+### Explain one dependency in the terminal
+
+Use `explain` when you want a fast terminal view for one package without generating HTML or JSON output:
+
+```bash
+npx dependency-radar explain lodash
+```
+
+This reuses the normal scan model and then filters it in memory. `explain` does not add its own extra lookup pipeline and does not write `dependency-radar.html`, but it can still trigger the same network-dependent `audit` and `outdated` steps as a normal scan unless you pass `--offline`.
+
+`explain` shows the signals already present in Dependency Radar's scan model, including:
+
+- direct vs transitive
+- scope and introduction classification
+- runtime impact heuristics
+- root packages and direct parents
+- static import evidence and top import locations
+- vulnerability summary when audit data is available
+- licence status
+- upgrade blockers
+- other detected versions of the same package
+
+Examples:
+
+```bash
+npx dependency-radar explain lodash
+```
+
+```bash
+npx dependency-radar explain lodash --project ./my-app
+```
+
+```bash
+npx dependency-radar explain lodash --project ./my-app --offline
+```
+
+Notes:
+
+- `explain` matches by package name only. If multiple installed versions exist, each version is shown in its own block.
+- Vulnerabilities are reported only when audit data is available. With `--offline`, the command prints `not available (--offline)` instead of implying `none`.
+- "Static import evidence" means Dependency Radar found local source imports for that package. It is a code-usage heuristic, not exploit reachability analysis.
+- "Introduced via root packages" and "Direct parents" are shown from the current scan model. The command does not currently print full ancestry chains.
+
 ### CI policy enforcement (`--fail-on`)
 
 ```
@@ -149,6 +193,20 @@ npx dependency-radar --offline
 npx dependency-radar --no-report --fail-on reachable-vuln,licence-mismatch
 ```
 
+### Example: quiet mode for CI or scripting
+
+```bash
+npx dependency-radar scan --quiet --no-report
+```
+
+`--quiet` is quiet, not silent:
+
+- the scan still runs fully
+- reports are still generated unless `--no-report` is set
+- the final summary block is still printed
+- policy failures are still printed
+- progress/info logs, automatic browser opening, and the promotional footer are suppressed
+
 __Note:__ When used with `--no-report`, the `--keep-temp` flag is ignored. 
 Temporary files are normally deleted automatically. 
 If you intentionally use `--keep-temp` (without `--no-report`) for debugging, 
@@ -227,6 +285,8 @@ When you run `npx dependency-radar` (or `dependency-radar scan`), the CLI execut
 
 The scan is local-first: package metadata is read from `node_modules`; only audit/outdated commands require registry access.
 
+The `explain` command reuses this same pipeline with report writing disabled, then filters the in-memory model down to a single package for terminal output.
+
 ### `node_modules` crawling details
 
 - Dependency metadata is read from installed package directories, not from registry documents.