aienvmp 0.1.17 → 0.1.19

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.19
+
+- Added runtime, package manager, Docker, and coordination environment steps to `aienvmp plan`.
+- Kept environment plans read-only and ask-first for global changes.
+- Improved AI guidance for resolving version drift and multi-agent coordination warnings.
+
+## 0.1.18
+
+- Added a dashboard remediation steps card backed by `.aienvmp/plan.json`.
+- Kept dashboard remediation details bounded to package, severity, fix version, and advisory references.
+- Improved human visibility for AI-generated read-only security plans.
+
 ## 0.1.17
 
 - Added bounded security remediation steps to `aienvmp plan`.

package/README.md

@@ -38,7 +38,7 @@ AIENV.md
 .aienvmp/timeline.jsonl
 .aienvmp/plan.json
 .aienvmp/plan.md
-.aienvmp/dashboard.html
+.aienvmp/dashboard.html     # includes plan and remediation cards
 ```
 
 Trust states are machine-readable: `observed`, `planned`, `changed`, `review`, `verified`, `stale`.
@@ -59,7 +59,7 @@ npx aienvmp snippet agents
 aienvmp sync              # update env map, light SBOM, ledger, dashboard
 aienvmp context           # AI preflight brief
 aienvmp context --json    # machine-readable AI decision context + recommended actions
-aienvmp plan              # read-only AI action plan with remediation steps
+aienvmp plan              # read-only AI action plan for drift and remediation
 aienvmp handoff           # next-agent handoff summary + recommended actions
 aienvmp intent            # record a planned env change
 aienvmp record            # record what changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/dash.js

@@ -18,7 +18,8 @@ export async function dashWorkspace(args) {
   const policy = await loadPolicy(dir);
   const warnings = [...diagnose(manifest, { timeline, intents }), ...policyWarnings(manifest, policy)];
   const planArtifacts = await detectedPlanArtifacts(dir);
-  const html = renderDashboard({ ...manifest, recommendedActions: recommendedActions(manifest, { warnings, intents }), planArtifacts }, timeline, warnings, intents, policy);
+  const planRemediation = await detectedPlanRemediation(dir);
+  const html = renderDashboard({ ...manifest, recommendedActions: recommendedActions(manifest, { warnings, intents }), planArtifacts, planRemediation }, timeline, warnings, intents, policy);
   const out = dashboardPath(dir);
   await fs.mkdir(path.dirname(out), { recursive: true });
   await fs.writeFile(out, html, "utf8");
@@ -36,6 +37,17 @@ async function detectedPlanArtifacts(dir) {
   };
 }
 
+async function detectedPlanRemediation(dir) {
+  const plan = await readJson(planJsonPath(dir), {});
+  return (plan.remediationSteps || []).slice(0, 5).map((item) => ({
+    package: item.package || "unknown",
+    severity: item.severity || "unknown",
+    fixVersions: Array.isArray(item.fixVersions) ? item.fixVersions.slice(0, 3) : [],
+    fixAvailable: item.fixAvailable === true,
+    advisories: Array.isArray(item.advisories) ? item.advisories.map((advisory) => advisory.id || advisory.title).filter(Boolean).slice(0, 2) : []
+  }));
+}
+
 function openFile(file) {
   if (process.platform === "win32") {
     execFile("cmd", ["/c", "start", "", file], { windowsHide: true });

package/src/commands/plan.js

@@ -57,6 +57,7 @@ export function buildPlan(manifest, warnings = [], intents = [], policy = {}) {
       topPackages: manifest.security?.topPackages || []
     },
     remediationSteps: remediationSteps(manifest.security),
+    environmentSteps: environmentSteps(warnings),
     notes: [
       "This plan is read-only.",
       "Ask the user before global runtime, package manager, Docker, or global package changes.",
@@ -65,6 +66,81 @@ export function buildPlan(manifest, warnings = [], intents = [], policy = {}) {
   };
 }
 
+function environmentSteps(warnings = []) {
+  return warnings
+    .filter((warning) => warning.code !== "security-vulnerabilities")
+    .slice(0, 8)
+    .map((warning) => ({
+      code: warning.code,
+      category: environmentCategory(warning.code),
+      summary: warning.message,
+      steps: environmentStepLines(warning.code)
+    }));
+}
+
+function environmentCategory(code = "") {
+  if (["conflicting-open-intents", "stale-open-intent", "handoff-stale"].includes(code)) return "coordination";
+  if (code.includes("docker")) return "container";
+  if (code.includes("lockfile") || code.includes("package-manager")) return "package-manager";
+  if (code.includes("node") || code.includes("python") || code.includes("version") || code.includes("runtime")) return "runtime";
+  return "environment";
+}
+
+function environmentStepLines(code = "") {
+  if (code === "node-version-mismatch") return [
+    "Read .nvmrc and the detected Node version before changing tools.",
+    "Prefer project-local version managers such as nvm, mise, or asdf.",
+    "Ask before changing global Node or npm installations.",
+    "Run aienvmp sync and record the change after alignment."
+  ];
+  if (code === "python-version-mismatch") return [
+    "Read .python-version and the detected Python version before changing tools.",
+    "Prefer project-local virtual environments or version managers.",
+    "Ask before changing global Python installations.",
+    "Run aienvmp sync and record the change after alignment."
+  ];
+  if (code === "mixed-node-lockfiles" || code === "package-manager-policy-mismatch") return [
+    "Identify the intended package manager from project policy and lockfiles.",
+    "Do not delete lockfiles without user approval.",
+    "Use one package manager for dependency changes.",
+    "Record the chosen package manager policy if it changes."
+  ];
+  if (code === "python-missing") return [
+    "Confirm whether the Python project is active.",
+    "Prefer project-local Python setup before global installation.",
+    "Ask before installing a global Python runtime.",
+    "Run aienvmp sync after setup."
+  ];
+  if (code === "docker-missing") return [
+    "Confirm whether Docker is required for the current task.",
+    "Do not change Docker daemon or context without user approval.",
+    "Document fallback commands if Docker is unavailable.",
+    "Run aienvmp sync after Docker availability changes."
+  ];
+  if (code === "manifest-stale") return [
+    "Run aienvmp sync before environment changes.",
+    "Review context again after refresh."
+  ];
+  if (code === "conflicting-open-intents") return [
+    "Review open intents before changing the environment.",
+    "Coordinate with the user or other agent.",
+    "Resolve stale or superseded intents before proceeding."
+  ];
+  if (code === "stale-open-intent") return [
+    "Confirm whether the old intent is still valid.",
+    "Resolve or renew the intent before changing the environment."
+  ];
+  if (code === "handoff-stale") return [
+    "Run aienvmp handoff --record --actor agent:id before the next AI continues.",
+    "Review recent changes before new environment work."
+  ];
+  return [
+    "Review the warning before changing environment state.",
+    "Ask before global environment changes.",
+    "Run aienvmp sync after any accepted change."
+  ];
+}
+
 function remediationSteps(security = {}) {
   if (!security.enabled) return [];
   return (security.topPackages || []).slice(0, 8).map((pkg) => {

package/src/render.js

@@ -185,6 +185,9 @@ export function renderPlan(plan) {
     "Remediation steps:",
     ...(plan.remediationSteps?.length ? plan.remediationSteps.slice(0, 5).flatMap(remediationLines) : ["- none"]),
     "",
+    "Environment steps:",
+    ...(plan.environmentSteps?.length ? plan.environmentSteps.slice(0, 5).flatMap(environmentLines) : ["- none"]),
+    "",
     "Warnings:",
     ...(plan.warnings.length ? plan.warnings.map((warning) => `- [${warning.code}] ${warning.message}`) : ["- none"]),
     ""
@@ -192,6 +195,13 @@ export function renderPlan(plan) {
   return lines.join("\n");
 }
 
+function environmentLines(item) {
+  return [
+    `- ${item.category}: ${item.summary}`,
+    ...item.steps.slice(0, 4).map((step) => `  - ${step}`)
+  ];
+}
+
 function remediationLines(item) {
   const fix = item.fixVersions?.length ? `fix ${item.fixVersions.join(", ")}` : item.fixAvailable ? "fix available" : "review required";
   const advisories = (item.advisories || []).map((advisory) => advisory.id || advisory.title).filter(Boolean).slice(0, 2);
@@ -278,6 +288,10 @@ const actions=manifest.recommendedActions||[];
 const actionsHtml=actions.length?'<div class="timeline">'+actions.slice(0,6).map(a=>\`<div class="event"><time>\${esc(a.priority)}</time><div><b>\${esc(a.category)}</b> \${esc(a.summary)}\${a.command?\`<div class="path">\${esc(a.command)}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No recommended actions. Continue project-local work.</div>';
 const plan=manifest.planArtifacts||{};
 const planHtml=plan.markdown||plan.json?\`<table><tr><th>Markdown</th><td>\${plan.markdown?'<a href="plan.md">plan.md</a>':'not written'}</td></tr><tr><th>JSON</th><td>\${plan.json?'<a href="plan.json">plan.json</a>':'not written'}</td></tr></table>\`:'<div class="okline">No plan artifacts yet. Run <code>aienvmp plan --write</code>.</div>';
+const remediation=manifest.planRemediation||[];
+const remediationFix=r=>r.fixVersions?.length?\`fix \${r.fixVersions.join(', ')}\`:(r.fixAvailable?'fix available':'review required');
+const remediationRefs=r=>r.advisories?.length?\` - \${r.advisories.join(', ')}\`:'';
+const remediationHtml=remediation.length?'<div class="timeline">'+remediation.map(r=>\`<div class="event"><time>\${esc(r.severity)}</time><div><b>\${esc(r.package)}</b> \${esc(remediationFix(r))}\${esc(remediationRefs(r))}</div></div>\`).join('')+'</div>':'<div class="okline">No remediation steps in the current plan.</div>';
 const card=(title,badge,body)=>\`<section class="card"><div class="card-head"><h2>\${title}</h2>\${badge||''}</div>\${body}</section>\`;
 const reviewRequired=warnings.length>0||intents.length>0;
 const recentChanges=timeline.slice(-8).length;
@@ -321,6 +335,8 @@ document.getElementById('app').innerHTML=\`
     <div style="height:14px"></div>
     \${card('AI Plan Artifacts',plan.markdown||plan.json?'<span class="pill">written</span>':'<span class="pill off">not written</span>',planHtml)}
     <div style="height:14px"></div>
+    \${card('Remediation Steps',remediation.length?'<span class="pill warn">'+remediation.length+' items</span>':'<span class="pill off">none</span>',remediationHtml)}
+    <div style="height:14px"></div>
     \${card('Environment Health',warnings.length?'<span class="pill warn">attention</span>':'<span class="pill">clear</span>',warnHtml)}
     <div style="height:14px"></div>
     \${card('Version Policy','<span class="pill">'+entries(policy).length+' rules</span>',policyHtml)}