aienvmp 0.1.10 → 0.1.11

package/BUGFIXES.md

@@ -28,6 +28,12 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: test command used `/bin/zsh -lc` to load login shell PATH.
 - Verification: remote test detected Node `v25.3.0`, npm `11.11.0`, and completed `aienvmp sync`.
 
+### Security summaries lacked remediation hints
+
+- Issue: AI agents could see vulnerable package names but not enough bounded detail to plan the next dependency update.
+- Fix: npm and Python security summaries now include fix versions and advisory references when scanners provide them.
+- Verification: parser tests cover npm remediation objects and pip-audit advisory ids; Windows and macOS tarball tests completed `sync --security`.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.11
+
+- Added bounded remediation details to security summaries, including fix versions and advisory references.
+- Surfaced remediation hints in `AIENV.md` and the dashboard so AI agents can plan safer dependency updates.
+- Kept security scanning read-only and opt-in.
+
 ## 0.1.10
 
 - Added optional `pip-audit` JSON parsing for Python security summaries.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/render.js

@@ -220,7 +220,9 @@ const inventoryHtml=manifest.inventory?.enabled?('<table>'+Object.entries(invent
 const sec=manifest.security||{};
 const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0};
 const secPackages=sec.topPackages||[];
-const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${p.fixAvailable?'fix available':'review required'}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
+const securityFix=p=>p.fixVersions?.length?\`fix \${p.fixVersions.slice(0,3).join(', ')}\`:(p.fixAvailable?'fix available':'review required');
+const securityRefs=p=>p.advisories?.length?\` · \${p.advisories.map(a=>a.id||a.title).filter(Boolean).slice(0,2).join(', ')}\`:'';
+const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${esc(securityFix(p))}\${esc(securityRefs(p))}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
 const change=c=>c.type==='changed'?\`\${c.scope} \${c.key}: \${c.before} -> \${c.after}\`:\`\${c.scope} \${c.key}: \${c.type} \${c.after||c.before}\`;
 const timelineLabel=t=>t.change?change(t.change):(t.summary||t.action||t.type||'recorded change');
 const agentNames={agents:'Codex',claude:'Claude',gemini:'Gemini'};
@@ -350,12 +352,21 @@ function securityLines(security = {}) {
   if (packages.length) {
     lines.push("- Top vulnerable packages:");
     for (const pkg of packages.slice(0, 8)) {
-      lines.push(`  - ${pkg.name}: ${pkg.severity}; ${pkg.fixAvailable ? "fix available" : "review required"}`);
+      lines.push(`  - ${pkg.name}: ${pkg.severity}; ${securityPackageNote(pkg)}`);
     }
   }
   return lines;
 }
 
+function securityPackageNote(pkg) {
+  const fix = pkg.fixVersions?.length ? `fix ${pkg.fixVersions.slice(0, 3).join(", ")}` : pkg.fixAvailable ? "fix available" : "review required";
+  const advisories = (pkg.advisories || [])
+    .map((item) => item.id || item.title)
+    .filter(Boolean)
+    .slice(0, 2);
+  return advisories.length ? `${fix}; advisories ${advisories.join(", ")}` : fix;
+}
+
 function policyLines(policy) {
   const lines = [];
   if (policy.node) lines.push(`- Node version policy: ${policy.node}`);

package/src/security.js

@@ -80,12 +80,18 @@ export function parseNpmAudit(raw) {
     const vulnerabilities = parsed.vulnerabilities || {};
     const severityCounts = Object.fromEntries(SEVERITIES.map((severity) => [severity, Number(metadata.vulnerabilities?.[severity] || 0)]));
     const total = Number(metadata.vulnerabilities?.total || Object.values(severityCounts).reduce((sum, value) => sum + value, 0));
-    const vulnerablePackages = Object.entries(vulnerabilities).slice(0, 20).map(([name, value]) => ({
-      name,
-      severity: value.severity || "unknown",
-      viaCount: Array.isArray(value.via) ? value.via.length : 0,
-      fixAvailable: Boolean(value.fixAvailable)
-    }));
+    const vulnerablePackages = Object.entries(vulnerabilities).slice(0, 20).map(([name, value]) => {
+      const fixVersions = npmFixVersions(value.fixAvailable);
+      const advisories = npmAdvisories(value.via);
+      return {
+        name,
+        severity: value.severity || "unknown",
+        viaCount: Array.isArray(value.via) ? value.via.length : 0,
+        fixAvailable: hasFixAvailable(value.fixAvailable),
+        fixVersions,
+        advisories
+      };
+    });
     return {
       available: true,
       summary: { total, ...severityCounts },
@@ -109,7 +115,8 @@ export function parsePipAudit(raw) {
         severity: "unknown",
         viaCount: dependency.vulns.length,
         fixAvailable: dependency.vulns.some((vuln) => Array.isArray(vuln.fix_versions) && vuln.fix_versions.length),
-        fixVersions: unique(dependency.vulns.flatMap((vuln) => vuln.fix_versions || [])).slice(0, 5)
+        fixVersions: unique(dependency.vulns.flatMap((vuln) => vuln.fix_versions || [])).slice(0, 5),
+        advisories: pipAdvisories(dependency.vulns)
       }));
     const total = vulnerablePackages.reduce((sum, pkg) => sum + pkg.viaCount, 0);
     return {
@@ -151,3 +158,38 @@ function unavailable(scanner, reason) {
 function unique(items) {
   return [...new Set(items.filter(Boolean))];
 }
+
+function hasFixAvailable(value) {
+  if (typeof value === "boolean") return value;
+  return Boolean(value && typeof value === "object");
+}
+
+function npmFixVersions(value) {
+  if (!value || typeof value !== "object") return [];
+  return unique([value.version]).slice(0, 5);
+}
+
+function npmAdvisories(via = []) {
+  if (!Array.isArray(via)) return [];
+  return via
+    .filter((item) => item && typeof item === "object")
+    .map((item) => ({
+      id: String(item.source || item.id || item.cve || item.name || "").trim(),
+      title: String(item.title || "").trim(),
+      url: String(item.url || "").trim(),
+      severity: item.severity || "unknown"
+    }))
+    .filter((item) => item.id || item.title || item.url)
+    .slice(0, 5);
+}
+
+function pipAdvisories(vulns = []) {
+  return vulns
+    .map((vuln) => ({
+      id: String(vuln.id || vuln.aliases?.[0] || "").trim(),
+      aliases: Array.isArray(vuln.aliases) ? vuln.aliases.slice(0, 5) : [],
+      fixVersions: Array.isArray(vuln.fix_versions) ? vuln.fix_versions.slice(0, 5) : []
+    }))
+    .filter((item) => item.id || item.aliases.length || item.fixVersions.length)
+    .slice(0, 5);
+}