aienvmp 0.1.15 → 0.1.17

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.17
+
+- Added bounded security remediation steps to `aienvmp plan`.
+- Included package fix versions and advisory references in plan JSON and markdown output.
+- Kept remediation output read-only and review-oriented.
+
+## 0.1.16
+
+- Added scoped strict checks with `doctor --strict security|policy|coordination|all`.
+- Kept `doctor --ci` compatible as strict `all`.
+- Updated the GitHub Action `strict` input to support scoped enforcement while keeping advisory mode by default.
+
 ## 0.1.15
 
 - Added dashboard links for written AI plan artifacts.

package/README.md

@@ -59,11 +59,12 @@ npx aienvmp snippet agents
 aienvmp sync              # update env map, light SBOM, ledger, dashboard
 aienvmp context           # AI preflight brief
 aienvmp context --json    # machine-readable AI decision context + recommended actions
-aienvmp plan              # read-only AI action plan, no automatic fixes
+aienvmp plan              # read-only AI action plan with remediation steps
 aienvmp handoff           # next-agent handoff summary + recommended actions
 aienvmp intent            # record a planned env change
 aienvmp record            # record what changed
-aienvmp doctor --ci       # strict CI check
+aienvmp doctor --ci       # strict CI check for all warnings
+aienvmp doctor --strict security  # fail only scoped warnings
 ```
 
 ## Principles
@@ -72,6 +73,7 @@ aienvmp doctor --ci       # strict CI check
 - AI-first
 - lightweight
 - one advisory engine, optional enforcement with `doctor --ci`
+- scoped enforcement with `doctor --strict security|policy|coordination|all`
 - non-blocking unless strict mode is explicitly requested
 - security checks are opt-in and read-only
 

package/action.yml

@@ -8,9 +8,9 @@ inputs:
     required: false
     default: "."
   strict:
-    description: Fail when doctor reports warnings
+    description: Fail when doctor reports scoped warnings
     required: false
-    default: "false"
+    default: "off"
   write-plan:
     description: Write read-only AI plan artifacts
     required: false
@@ -35,6 +35,8 @@ runs:
       run: |
         if [ "${{ inputs.strict }}" = "true" ]; then
           node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}" --ci
+        elif [ "${{ inputs.strict }}" != "false" ] && [ "${{ inputs.strict }}" != "off" ]; then
+          node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}" --strict "${{ inputs.strict }}"
         else
           node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}"
         fi

package/examples/github-action.yml

@@ -14,4 +14,4 @@ jobs:
         with:
           directory: "."
           write-plan: "true"
-          strict: "false"
+          strict: "off" # security, policy, coordination, all, or off

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -98,7 +98,7 @@ Advanced:
   aienvmp snippet [agents|claude|gemini] [--write AGENTS.md]
   aienvmp compile [--dir .]
   aienvmp diff [--dir .]
-  aienvmp doctor [--dir .] [--json] [--ci]
+  aienvmp doctor [--dir .] [--json] [--ci] [--strict security|policy|coordination|all]
   aienvmp dash [--dir .] [--open]
 `);
 }

package/src/commands/doctor.js

@@ -14,16 +14,18 @@ export async function doctorWorkspace(args) {
   const intents = openIntents(await readJsonl(intentsPath(dir)));
   const warnings = [...diagnose(manifest, { timeline, intents }), ...policyWarnings(manifest, policy)];
   const actions = recommendedActions(manifest, { warnings, intents });
+  const strict = strictResult(warnings, args);
   if (args.json) {
     console.log(JSON.stringify({
-      status: warnings.length ? "warning" : "ok",
+      status: strict.fail ? "fail" : warnings.length ? "warning" : "ok",
       trust: manifest.trust || {},
       policy,
       openIntentCount: intents.length,
       warnings,
-      recommendedActions: actions
+      recommendedActions: actions,
+      strict
     }, null, 2));
-    if (args.ci && warnings.length) {
+    if (strict.fail) {
       process.exitCode = 1;
     }
     return;
@@ -39,8 +41,39 @@ export async function doctorWorkspace(args) {
   for (const item of actions) {
     console.log(`- [${item.priority}] ${item.summary}${item.command ? ` (${item.command})` : ""}`);
   }
-  console.log("doctor: warnings are non-blocking by default; pass --ci to fail automation.");
-  if (args.ci) {
+  console.log(`doctor: warnings are non-blocking by default; pass --ci or --strict ${strict.availableScopes.join("|")} to fail automation.`);
+  if (strict.fail) {
     process.exitCode = 1;
   }
 }
+
+export function strictResult(warnings = [], args = {}) {
+  const scope = normalizeStrictScope(args.strict || (args.ci ? "all" : ""));
+  const matchedWarnings = scope ? warnings.filter((warning) => warningMatchesScope(warning, scope)) : [];
+  return {
+    enabled: Boolean(scope),
+    scope: scope || "off",
+    fail: matchedWarnings.length > 0,
+    matchedWarningCodes: matchedWarnings.map((warning) => warning.code),
+    availableScopes: ["security", "policy", "coordination", "all"]
+  };
+}
+
+function normalizeStrictScope(value) {
+  if (value === true) return "all";
+  const scope = String(value || "").trim().toLowerCase();
+  if (!scope || scope === "false" || scope === "off") return "";
+  if (["security", "policy", "coordination", "all"].includes(scope)) return scope;
+  return "all";
+}
+
+function warningMatchesScope(warning, scope) {
+  if (scope === "all") return true;
+  return warningScope(warning.code) === scope;
+}
+
+function warningScope(code = "") {
+  if (code === "security-vulnerabilities") return "security";
+  if (["conflicting-open-intents", "stale-open-intent", "handoff-stale"].includes(code)) return "coordination";
+  return "policy";
+}

package/src/commands/plan.js

@@ -56,6 +56,7 @@ export function buildPlan(manifest, warnings = [], intents = [], policy = {}) {
       summary: manifest.security?.summary || { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 },
       topPackages: manifest.security?.topPackages || []
     },
+    remediationSteps: remediationSteps(manifest.security),
     notes: [
       "This plan is read-only.",
       "Ask the user before global runtime, package manager, Docker, or global package changes.",
@@ -64,6 +65,35 @@ export function buildPlan(manifest, warnings = [], intents = [], policy = {}) {
   };
 }
 
+function remediationSteps(security = {}) {
+  if (!security.enabled) return [];
+  return (security.topPackages || []).slice(0, 8).map((pkg) => {
+    const fixVersions = Array.isArray(pkg.fixVersions) ? pkg.fixVersions.slice(0, 5) : [];
+    const advisories = Array.isArray(pkg.advisories)
+      ? pkg.advisories.map((item) => ({
+        id: item.id || "",
+        title: item.title || "",
+        url: item.url || "",
+        severity: item.severity || pkg.severity || "unknown"
+      })).slice(0, 5)
+      : [];
+    return {
+      package: pkg.name,
+      scanner: pkg.scanner || "unknown",
+      severity: pkg.severity || "unknown",
+      fixAvailable: pkg.fixAvailable === true,
+      fixVersions,
+      advisories,
+      steps: [
+        "Review the package changelog and advisory details.",
+        fixVersions.length ? `Prefer an upgrade path to ${fixVersions.join(", ")} if compatible.` : "Identify a compatible patched version before changing dependencies.",
+        "Run project tests after dependency changes.",
+        "Record the environment or dependency change with aienvmp record."
+      ]
+    };
+  });
+}
+
 function reviewGates(warnings, intents, security = {}) {
   const gates = [];
   if (warnings.length) gates.push("Review warnings before changing the environment.");

package/src/render.js

@@ -182,6 +182,9 @@ export function renderPlan(plan) {
     "Review gates:",
     ...plan.reviewGates.map((item) => `- ${item}`),
     "",
+    "Remediation steps:",
+    ...(plan.remediationSteps?.length ? plan.remediationSteps.slice(0, 5).flatMap(remediationLines) : ["- none"]),
+    "",
     "Warnings:",
     ...(plan.warnings.length ? plan.warnings.map((warning) => `- [${warning.code}] ${warning.message}`) : ["- none"]),
     ""
@@ -189,6 +192,15 @@ export function renderPlan(plan) {
   return lines.join("\n");
 }
 
+function remediationLines(item) {
+  const fix = item.fixVersions?.length ? `fix ${item.fixVersions.join(", ")}` : item.fixAvailable ? "fix available" : "review required";
+  const advisories = (item.advisories || []).map((advisory) => advisory.id || advisory.title).filter(Boolean).slice(0, 2);
+  return [
+    `- ${item.package}: ${item.severity}; ${fix}${advisories.length ? `; advisories ${advisories.join(", ")}` : ""}`,
+    ...item.steps.slice(0, 4).map((step) => `  - ${step}`)
+  ];
+}
+
 export function renderDashboard(manifest, timeline = [], warnings = [], intents = [], policy = {}) {
   const data = JSON.stringify({ manifest, timeline, warnings, intents, policy });
   return `<!doctype html>