aienvmp 0.1.14 → 0.1.16

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.16
+
+- Added scoped strict checks with `doctor --strict security|policy|coordination|all`.
+- Kept `doctor --ci` compatible as strict `all`.
+- Updated the GitHub Action `strict` input to support scoped enforcement while keeping advisory mode by default.
+
+## 0.1.15
+
+- Added dashboard links for written AI plan artifacts.
+- Added `write-plan` support to the GitHub Action so CI can emit read-only plan outputs.
+- Updated the GitHub Action example to show the sync, plan, and doctor flow.
+
 ## 0.1.14
 
 - Added `aienvmp plan` for read-only AI environment action plans.

package/README.md

@@ -36,6 +36,8 @@ AIENV.md
 .aienvmp/manifest.json
 .aienvmp/intents.jsonl
 .aienvmp/timeline.jsonl
+.aienvmp/plan.json
+.aienvmp/plan.md
 .aienvmp/dashboard.html
 ```
 
@@ -61,7 +63,8 @@ aienvmp plan              # read-only AI action plan, no automatic fixes
 aienvmp handoff           # next-agent handoff summary + recommended actions
 aienvmp intent            # record a planned env change
 aienvmp record            # record what changed
-aienvmp doctor --ci       # strict CI check
+aienvmp doctor --ci       # strict CI check for all warnings
+aienvmp doctor --strict security  # fail only scoped warnings
 ```
 
 ## Principles
@@ -70,6 +73,7 @@ aienvmp doctor --ci       # strict CI check
 - AI-first
 - lightweight
 - one advisory engine, optional enforcement with `doctor --ci`
+- scoped enforcement with `doctor --strict security|policy|coordination|all`
 - non-blocking unless strict mode is explicitly requested
 - security checks are opt-in and read-only
 

package/action.yml

@@ -8,9 +8,13 @@ inputs:
     required: false
     default: "."
   strict:
-    description: Fail when doctor reports warnings
+    description: Fail when doctor reports scoped warnings
     required: false
-    default: "false"
+    default: "off"
+  write-plan:
+    description: Write read-only AI plan artifacts
+    required: false
+    default: "true"
 
 runs:
   using: composite
@@ -19,11 +23,20 @@ runs:
       shell: bash
       run: node "$GITHUB_ACTION_PATH/bin/aienvmp.js" sync --dir "${{ inputs.directory }}" --quiet
 
+    - name: Write AI plan
+      shell: bash
+      run: |
+        if [ "${{ inputs.write-plan }}" = "true" ]; then
+          node "$GITHUB_ACTION_PATH/bin/aienvmp.js" plan --dir "${{ inputs.directory }}" --write --json
+        fi
+
     - name: Doctor
       shell: bash
       run: |
         if [ "${{ inputs.strict }}" = "true" ]; then
           node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}" --ci
+        elif [ "${{ inputs.strict }}" != "false" ] && [ "${{ inputs.strict }}" != "off" ]; then
+          node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}" --strict "${{ inputs.strict }}"
         else
           node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}"
         fi

package/examples/github-action.yml

@@ -13,4 +13,5 @@ jobs:
       - uses: soovwv/aienvmp@main
         with:
           directory: "."
-          strict: "false"
+          write-plan: "true"
+          strict: "off" # security, policy, coordination, all, or off

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -98,7 +98,7 @@ Advanced:
   aienvmp snippet [agents|claude|gemini] [--write AGENTS.md]
   aienvmp compile [--dir .]
   aienvmp diff [--dir .]
-  aienvmp doctor [--dir .] [--json] [--ci]
+  aienvmp doctor [--dir .] [--json] [--ci] [--strict security|policy|coordination|all]
   aienvmp dash [--dir .] [--open]
 `);
 }

package/src/commands/dash.js

@@ -2,9 +2,9 @@ import fs from "node:fs/promises";
 import { execFile } from "node:child_process";
 import path from "node:path";
 import { diagnose } from "../doctor.js";
-import { readJson } from "../fsutil.js";
+import { exists, readJson } from "../fsutil.js";
 import { openIntents, readJsonl, readTimeline } from "../timeline.js";
-import { dashboardPath, intentsPath, manifestPath, timelinePath, workspaceDir } from "../paths.js";
+import { dashboardPath, intentsPath, manifestPath, planJsonPath, planMdPath, timelinePath, workspaceDir } from "../paths.js";
 import { renderDashboard } from "../render.js";
 import { loadPolicy, policyWarnings } from "../policy.js";
 import { recommendedActions } from "../actions.js";
@@ -17,7 +17,8 @@ export async function dashWorkspace(args) {
   const intents = openIntents(await readJsonl(intentsPath(dir)));
   const policy = await loadPolicy(dir);
   const warnings = [...diagnose(manifest, { timeline, intents }), ...policyWarnings(manifest, policy)];
-  const html = renderDashboard({ ...manifest, recommendedActions: recommendedActions(manifest, { warnings, intents }) }, timeline, warnings, intents, policy);
+  const planArtifacts = await detectedPlanArtifacts(dir);
+  const html = renderDashboard({ ...manifest, recommendedActions: recommendedActions(manifest, { warnings, intents }), planArtifacts }, timeline, warnings, intents, policy);
   const out = dashboardPath(dir);
   await fs.mkdir(path.dirname(out), { recursive: true });
   await fs.writeFile(out, html, "utf8");
@@ -26,6 +27,15 @@ export async function dashWorkspace(args) {
   return { dashboard: out };
 }
 
+async function detectedPlanArtifacts(dir) {
+  const json = planJsonPath(dir);
+  const markdown = planMdPath(dir);
+  return {
+    json: await exists(json) ? ".aienvmp/plan.json" : "",
+    markdown: await exists(markdown) ? ".aienvmp/plan.md" : ""
+  };
+}
+
 function openFile(file) {
   if (process.platform === "win32") {
     execFile("cmd", ["/c", "start", "", file], { windowsHide: true });

package/src/commands/doctor.js

@@ -14,16 +14,18 @@ export async function doctorWorkspace(args) {
   const intents = openIntents(await readJsonl(intentsPath(dir)));
   const warnings = [...diagnose(manifest, { timeline, intents }), ...policyWarnings(manifest, policy)];
   const actions = recommendedActions(manifest, { warnings, intents });
+  const strict = strictResult(warnings, args);
   if (args.json) {
     console.log(JSON.stringify({
-      status: warnings.length ? "warning" : "ok",
+      status: strict.fail ? "fail" : warnings.length ? "warning" : "ok",
       trust: manifest.trust || {},
       policy,
       openIntentCount: intents.length,
       warnings,
-      recommendedActions: actions
+      recommendedActions: actions,
+      strict
     }, null, 2));
-    if (args.ci && warnings.length) {
+    if (strict.fail) {
       process.exitCode = 1;
     }
     return;
@@ -39,8 +41,39 @@ export async function doctorWorkspace(args) {
   for (const item of actions) {
     console.log(`- [${item.priority}] ${item.summary}${item.command ? ` (${item.command})` : ""}`);
   }
-  console.log("doctor: warnings are non-blocking by default; pass --ci to fail automation.");
-  if (args.ci) {
+  console.log(`doctor: warnings are non-blocking by default; pass --ci or --strict ${strict.availableScopes.join("|")} to fail automation.`);
+  if (strict.fail) {
     process.exitCode = 1;
   }
 }
+
+export function strictResult(warnings = [], args = {}) {
+  const scope = normalizeStrictScope(args.strict || (args.ci ? "all" : ""));
+  const matchedWarnings = scope ? warnings.filter((warning) => warningMatchesScope(warning, scope)) : [];
+  return {
+    enabled: Boolean(scope),
+    scope: scope || "off",
+    fail: matchedWarnings.length > 0,
+    matchedWarningCodes: matchedWarnings.map((warning) => warning.code),
+    availableScopes: ["security", "policy", "coordination", "all"]
+  };
+}
+
+function normalizeStrictScope(value) {
+  if (value === true) return "all";
+  const scope = String(value || "").trim().toLowerCase();
+  if (!scope || scope === "false" || scope === "off") return "";
+  if (["security", "policy", "coordination", "all"].includes(scope)) return scope;
+  return "all";
+}
+
+function warningMatchesScope(warning, scope) {
+  if (scope === "all") return true;
+  return warningScope(warning.code) === scope;
+}
+
+function warningScope(code = "") {
+  if (code === "security-vulnerabilities") return "security";
+  if (["conflicting-open-intents", "stale-open-intent", "handoff-stale"].includes(code)) return "coordination";
+  return "policy";
+}

package/src/render.js

@@ -252,7 +252,7 @@ const sec=manifest.security||{};
 const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0};
 const secPackages=sec.topPackages||[];
 const securityFix=p=>p.fixVersions?.length?\`fix \${p.fixVersions.slice(0,3).join(', ')}\`:(p.fixAvailable?'fix available':'review required');
-const securityRefs=p=>p.advisories?.length?\` · \${p.advisories.map(a=>a.id||a.title).filter(Boolean).slice(0,2).join(', ')}\`:'';
+const securityRefs=p=>p.advisories?.length?\` - \${p.advisories.map(a=>a.id||a.title).filter(Boolean).slice(0,2).join(', ')}\`:'';
 const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${esc(securityFix(p))}\${esc(securityRefs(p))}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
 const change=c=>c.type==='changed'?\`\${c.scope} \${c.key}: \${c.before} -> \${c.after}\`:\`\${c.scope} \${c.key}: \${c.type} \${c.after||c.before}\`;
 const timelineLabel=t=>t.change?change(t.change):(t.summary||t.action||t.type||'recorded change');
@@ -264,6 +264,8 @@ const intentsHtml=intents.length?'<div class="timeline">'+intents.slice(-6).reve
 const policyHtml=entries(policy).length?\`<table>\${rows(policy)}</table>\`:'<div class="okline">No explicit version policy set.</div>';
 const actions=manifest.recommendedActions||[];
 const actionsHtml=actions.length?'<div class="timeline">'+actions.slice(0,6).map(a=>\`<div class="event"><time>\${esc(a.priority)}</time><div><b>\${esc(a.category)}</b> \${esc(a.summary)}\${a.command?\`<div class="path">\${esc(a.command)}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No recommended actions. Continue project-local work.</div>';
+const plan=manifest.planArtifacts||{};
+const planHtml=plan.markdown||plan.json?\`<table><tr><th>Markdown</th><td>\${plan.markdown?'<a href="plan.md">plan.md</a>':'not written'}</td></tr><tr><th>JSON</th><td>\${plan.json?'<a href="plan.json">plan.json</a>':'not written'}</td></tr></table>\`:'<div class="okline">No plan artifacts yet. Run <code>aienvmp plan --write</code>.</div>';
 const card=(title,badge,body)=>\`<section class="card"><div class="card-head"><h2>\${title}</h2>\${badge||''}</div>\${body}</section>\`;
 const reviewRequired=warnings.length>0||intents.length>0;
 const recentChanges=timeline.slice(-8).length;
@@ -305,6 +307,8 @@ document.getElementById('app').innerHTML=\`
   <aside>
     \${card('Recommended Actions','<span class="pill">'+actions.length+' actions</span>',actionsHtml)}
     <div style="height:14px"></div>
+    \${card('AI Plan Artifacts',plan.markdown||plan.json?'<span class="pill">written</span>':'<span class="pill off">not written</span>',planHtml)}
+    <div style="height:14px"></div>
     \${card('Environment Health',warnings.length?'<span class="pill warn">attention</span>':'<span class="pill">clear</span>',warnHtml)}
     <div style="height:14px"></div>
     \${card('Version Policy','<span class="pill">'+entries(policy).length+' rules</span>',policyHtml)}