aienvmp 0.1.25 → 0.1.27

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.27
+
+- Added a read-only dependency snapshot to the manifest, context, AIENV.md, and dashboard.
+- Captured npm and Python project dependencies from `package.json`, `requirements.txt`, and `pyproject.toml` without installing or resolving packages.
+- Linked the env map and light SBOM story so AI agents can see runtime, dependency, and vulnerability context together.
+
+## 0.1.26
+
+- Shared one AI decision contract across `context --json`, `plan`, and `handoff`.
+- Added decision mode and required command guidance to plan and handoff outputs.
+- Reduced duplicated guidance so multiple AI agents receive the same environment-change rules.
+
 ## 0.1.25
 
 - Added a more explicit AI decision contract to `context --json`.

package/README.md

@@ -8,9 +8,9 @@
 
 `aienvmp` is an AI-first environment map for shared coding machines.
 
-It helps Codex, Claude, Gemini, and humans avoid silent Node, Python, package manager, Docker, and security drift.
+It helps Codex, Claude, Gemini, and humans avoid silent Node, Python, package manager, dependency, Docker, and security drift.
 
-Core loop: scan once, give AI a preflight context, write a read-only action plan, and hand off safe next steps.
+Core loop: scan once, give AI a shared decision contract, write a read-only action plan, and hand off safe next steps.
 
 ## Quick Start
 
@@ -48,7 +48,7 @@ AIENV.md
 .aienvmp/timeline.jsonl
 .aienvmp/plan.json
 .aienvmp/plan.md
-.aienvmp/dashboard.html     # includes plan, remediation, and environment cards
+.aienvmp/dashboard.html     # includes dependencies, plan, remediation, and environment cards
 ```
 
 Trust states are machine-readable: `observed`, `planned`, `changed`, `review`, `verified`, `stale`.
@@ -81,8 +81,8 @@ The dashboard shows which strict scopes are CI-ready before you enforce them.
 aienvmp sync              # update env map, light SBOM, ledger, dashboard
 aienvmp context           # AI preflight brief
 aienvmp context --json    # AI decision contract + actions + compact step summary
-aienvmp plan              # read-only AI action plan for drift and remediation
-aienvmp handoff           # next-agent handoff summary + recommended actions
+aienvmp plan              # read-only AI action plan using the same decision contract
+aienvmp handoff           # next-agent handoff summary using the same decision contract
 aienvmp intent            # record a planned env change
 aienvmp record            # record what changed
 aienvmp doctor --ci       # strict CI check for all warnings

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/context.js

@@ -6,6 +6,7 @@ import { renderContext } from "../render.js";
 import { loadPolicy, policyWarnings } from "../policy.js";
 import { recommendedActions } from "../actions.js";
 import { buildPlan, compactStepSummary } from "./plan.js";
+import { aiDecision } from "../decision.js";
 
 export async function contextWorkspace(args) {
   const dir = workspaceDir(args);
@@ -15,7 +16,7 @@ export async function contextWorkspace(args) {
   const intents = openIntents(await readJsonl(intentsPath(dir)));
   const policy = await loadPolicy(dir);
   const warnings = [...diagnose(manifest, { timeline, intents }), ...policyWarnings(manifest, policy)];
-  const decision = contextDecision(warnings, intents);
+  const decision = aiDecision(warnings, intents);
   const actions = recommendedActions(manifest, { warnings, intents });
   const stepSummary = compactStepSummary(buildPlan(manifest, warnings, intents, policy));
   if (args.json) {
@@ -31,6 +32,7 @@ export async function contextWorkspace(args) {
       packageManagers: manifest.packageManagers,
       containers: manifest.containers,
       inventory: inventorySummary(manifest.inventory),
+      dependencySnapshot: dependencySummary(manifest.dependencySnapshot),
       security: securitySummary(manifest.security),
       projectHints: manifest.projectHints,
       warnings,
@@ -44,6 +46,15 @@ export async function contextWorkspace(args) {
   console.log(renderContext(manifest, timeline, warnings, intents, policy, actions));
 }
 
+function dependencySummary(snapshot = {}) {
+  return {
+    mode: snapshot.mode || "snapshot",
+    enabled: snapshot.enabled === true,
+    summary: snapshot.summary || { ecosystems: [], manifests: 0, packages: 0 },
+    packages: (snapshot.packages || []).slice(0, 12)
+  };
+}
+
 function securitySummary(security = {}) {
   return {
     mode: security.mode || "basic",
@@ -61,40 +72,3 @@ function inventorySummary(inventory = {}) {
     groups: Object.fromEntries(Object.entries(tools).map(([name, items]) => [name, items.length]))
   };
 }
-
-function contextDecision(warnings, intents) {
-  const warningCodes = warnings.map((warning) => warning.code);
-  const reviewRequired = warnings.length > 0 || intents.length > 0;
-  const canChangeEnvironmentWithoutReview = !reviewRequired;
-  const mode = reviewRequired ? "review-first" : "project-local-work";
-  return {
-    schemaVersion: 1,
-    mode,
-    canProceed: !reviewRequired,
-    canContinueProjectLocalWork: true,
-    canChangeEnvironmentWithoutReview,
-    safeForProjectLocalWork: warnings.length === 0,
-    reviewRequired,
-    warningCodes,
-    environmentChangeRequiresIntent: true,
-    globalEnvironmentChangesRequireUserApproval: true,
-    pendingIntentCount: intents.length,
-    mustNotDo: [
-      "do not change global runtimes without user approval",
-      "do not install or remove global package managers without user approval",
-      "do not change Docker daemon/context assumptions without user approval",
-      "do not ignore open intents or review-required warnings"
-    ],
-    recommendedNextActions: warnings.length
-      ? ["review warnings", "ask the user before environment changes", "record intent before changes"]
-      : ["continue with project-local work", "run aienvmp intent before environment changes"],
-    requiredCommands: {
-      beforeEnvironmentChange: "aienvmp intent --actor agent:id --action planned-change --target <runtime|package-manager|docker>",
-      refreshAfterChange: "aienvmp sync",
-      recordAfterChange: "aienvmp record --actor agent:id --summary what-changed",
-      handoff: "aienvmp handoff --record --actor agent:id",
-      reviewPlan: "aienvmp plan"
-    },
-    nextCommand: reviewRequired ? "aienvmp plan" : "continue project-local work; use aienvmp intent before environment changes"
-  };
-}

package/src/commands/handoff.js

@@ -6,6 +6,7 @@ import { renderHandoff } from "../render.js";
 import { openIntents, readJsonl, readTimeline } from "../timeline.js";
 import { changedTrust } from "../trust.js";
 import { recommendedActions } from "../actions.js";
+import { aiDecision } from "../decision.js";
 
 export async function handoffWorkspace(args) {
   const dir = workspaceDir(args);
@@ -48,6 +49,7 @@ export function buildHandoff(manifest, timeline = [], warnings = [], intents = [
     status: reviewRequired ? "review-required" : "clear",
     trust: manifest.trust || {},
     schemaVersion: manifest.schemaVersion || 1,
+    decision: aiDecision(warnings, intents),
     workspace: manifest.workspace,
     safeRuntime: {
       node: manifest.runtimes?.node || "not detected",

package/src/commands/plan.js

@@ -6,6 +6,7 @@ import { intentsPath, manifestPath, planJsonPath, planMdPath, timelinePath, work
 import { renderPlan } from "../render.js";
 import { recommendedActions } from "../actions.js";
 import { openIntents, readJsonl, readTimeline } from "../timeline.js";
+import { aiDecision } from "../decision.js";
 
 export async function planWorkspace(args) {
   const dir = workspaceDir(args);
@@ -39,6 +40,7 @@ export function buildPlan(manifest, warnings = [], intents = [], policy = {}) {
     status,
     workspace: manifest.workspace || {},
     trust: manifest.trust || {},
+    decision: aiDecision(warnings, intents),
     policy: {
       node: policy.node || "not set",
       python: policy.python || "not set",

package/src/decision.js

@@ -0,0 +1,35 @@
+export function aiDecision(warnings = [], intents = []) {
+  const warningCodes = warnings.map((warning) => warning.code).filter(Boolean);
+  const reviewRequired = warnings.length > 0 || intents.length > 0;
+  const mode = reviewRequired ? "review-first" : "project-local-work";
+  return {
+    schemaVersion: 1,
+    mode,
+    canProceed: !reviewRequired,
+    canContinueProjectLocalWork: true,
+    canChangeEnvironmentWithoutReview: !reviewRequired,
+    safeForProjectLocalWork: warnings.length === 0,
+    reviewRequired,
+    warningCodes,
+    environmentChangeRequiresIntent: true,
+    globalEnvironmentChangesRequireUserApproval: true,
+    pendingIntentCount: intents.length,
+    mustNotDo: [
+      "do not change global runtimes without user approval",
+      "do not install or remove global package managers without user approval",
+      "do not change Docker daemon/context assumptions without user approval",
+      "do not ignore open intents or review-required warnings"
+    ],
+    recommendedNextActions: reviewRequired
+      ? ["review warnings and open intents", "ask the user before environment changes", "record intent before changes"]
+      : ["continue with project-local work", "run aienvmp intent before environment changes"],
+    requiredCommands: {
+      beforeEnvironmentChange: "aienvmp intent --actor agent:id --action planned-change --target <runtime|package-manager|docker>",
+      refreshAfterChange: "aienvmp sync",
+      recordAfterChange: "aienvmp record --actor agent:id --summary what-changed",
+      handoff: "aienvmp handoff --record --actor agent:id",
+      reviewPlan: "aienvmp plan"
+    },
+    nextCommand: reviewRequired ? "aienvmp plan" : "continue project-local work; use aienvmp intent before environment changes"
+  };
+}

package/src/dependencies.js

@@ -0,0 +1,114 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { exists, readJson } from "./fsutil.js";
+
+const NODE_GROUPS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+
+export async function scanDependencySnapshot(dir) {
+  const node = await scanNodeDependencies(dir);
+  const python = await scanPythonDependencies(dir);
+  const packages = [...node.packages, ...python.packages];
+  const manifests = [...node.manifests, ...python.manifests];
+  return {
+    mode: "snapshot",
+    enabled: true,
+    note: "Read-only dependency snapshot from project files. It does not install, update, or resolve packages.",
+    manifests,
+    summary: {
+      ecosystems: [...new Set(packages.map((pkg) => pkg.ecosystem))],
+      manifests: manifests.length,
+      packages: packages.length
+    },
+    packages: packages.slice(0, 80)
+  };
+}
+
+async function scanNodeDependencies(dir) {
+  const file = path.join(dir, "package.json");
+  if (!(await exists(file))) return { manifests: [], packages: [] };
+  const json = await readJson(file, {});
+  const packages = [];
+  for (const group of NODE_GROUPS) {
+    for (const [name, version] of Object.entries(json[group] || {})) {
+      packages.push({
+        ecosystem: "npm",
+        manager: "npm",
+        manifest: "package.json",
+        group,
+        name,
+        version: String(version)
+      });
+    }
+  }
+  return { manifests: ["package.json"], packages };
+}
+
+async function scanPythonDependencies(dir) {
+  const requirements = await scanRequirementsTxt(dir);
+  const pyproject = await scanPyproject(dir);
+  return {
+    manifests: [...requirements.manifests, ...pyproject.manifests],
+    packages: [...requirements.packages, ...pyproject.packages]
+  };
+}
+
+async function scanRequirementsTxt(dir) {
+  const file = path.join(dir, "requirements.txt");
+  if (!(await exists(file))) return { manifests: [], packages: [] };
+  const raw = await fs.readFile(file, "utf8");
+  const packages = raw
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line && !line.startsWith("#") && !line.startsWith("-"))
+    .slice(0, 80)
+    .map((line) => {
+      const parsed = parseRequirementLine(line);
+      return {
+        ecosystem: "python",
+        manager: "pip",
+        manifest: "requirements.txt",
+        group: "requirements",
+        name: parsed.name,
+        version: parsed.version
+      };
+    });
+  return { manifests: ["requirements.txt"], packages };
+}
+
+async function scanPyproject(dir) {
+  const file = path.join(dir, "pyproject.toml");
+  if (!(await exists(file))) return { manifests: [], packages: [] };
+  const raw = await fs.readFile(file, "utf8");
+  const packages = parsePyprojectDependencies(raw).slice(0, 80).map((line) => {
+    const parsed = parseRequirementLine(line);
+    return {
+      ecosystem: "python",
+      manager: "pyproject",
+      manifest: "pyproject.toml",
+      group: "project.dependencies",
+      name: parsed.name,
+      version: parsed.version
+    };
+  });
+  return { manifests: ["pyproject.toml"], packages };
+}
+
+export function parseRequirementLine(line) {
+  const cleaned = String(line).split("#")[0].trim();
+  const match = cleaned.match(/^([A-Za-z0-9_.-]+)\s*(.*)$/);
+  return {
+    name: match?.[1] || cleaned,
+    version: (match?.[2] || "unspecified").trim() || "unspecified"
+  };
+}
+
+export function parsePyprojectDependencies(raw) {
+  const lines = [];
+  const match = String(raw).match(/dependencies\s*=\s*\[([\s\S]*?)\]/m);
+  if (!match) return lines;
+  for (const item of match[1].split(/\r?\n/)) {
+    const cleaned = item.trim().replace(/,$/, "").replace(/^["']|["']$/g, "");
+    if (cleaned && !cleaned.startsWith("#")) lines.push(cleaned);
+  }
+  return lines;
+}

package/src/manifest.js

@@ -6,6 +6,7 @@ import { exists } from "./fsutil.js";
 import { observedTrust } from "./trust.js";
 import { scanGlobalInventory } from "./inventory.js";
 import { scanSecurity } from "./security.js";
+import { scanDependencySnapshot } from "./dependencies.js";
 
 export async function buildManifest(dir, options = {}) {
   const now = new Date().toISOString();
@@ -27,6 +28,7 @@ export async function buildManifest(dir, options = {}) {
     packageManagers: await scanPackageManagers(),
     containers: await scanContainers(),
     projectHints: await scanProjectHints(dir),
+    dependencySnapshot: await scanDependencySnapshot(dir),
     inventory: await scanGlobalInventory({ deep: options.deep }),
     security: await scanSecurity(dir, { security: options.security }),
     agentFiles: await scanAgentFiles(dir),
@@ -84,6 +86,11 @@ export async function buildManifest(dir, options = {}) {
         mode: "basic by default; vulnerability summaries only when requested",
         npmAudit: "npm audit --json"
       },
+      dependencySnapshot: {
+        mode: "read-only project file snapshot",
+        node: "package.json dependencies",
+        python: "requirements.txt and pyproject.toml dependencies"
+      },
       projectHints: [
         ".nvmrc",
         ".python-version",

package/src/render.js

@@ -31,6 +31,8 @@ export function renderAIEnv(manifest, timeline = [], warnings = [], intents = []
   pushMap(lines, "Containers", manifest.containers);
   lines.push("## Global Tool Inventory", "");
   lines.push(...inventoryLines(manifest.inventory), "");
+  lines.push("## Dependency Snapshot", "");
+  lines.push(...dependencyLines(manifest.dependencySnapshot), "");
   lines.push("## Security Summary", "");
   lines.push(...securityLines(manifest.security), "");
   lines.push("## Project Requirements And Hints", "");
@@ -99,6 +101,7 @@ export function renderContext(manifest, timeline = [], warnings = [], intents =
     `Python: ${manifest.runtimes.python || manifest.runtimes.python3 || "not detected"}`,
     `Docker: ${manifest.containers.docker ? "available" : "not detected"}`,
     `Inventory: ${manifest.inventory?.mode || "basic"}${manifest.inventory?.enabled ? " enabled" : " disabled"}`,
+    `Dependencies: ${manifest.dependencySnapshot?.summary?.packages || 0} packages across ${(manifest.dependencySnapshot?.summary?.ecosystems || []).join(", ") || "no ecosystems"}`,
     `Security: ${manifest.security?.mode || "basic"}${manifest.security?.enabled ? ` enabled (${manifest.security.summary?.total || 0} vulnerabilities)` : " disabled"}`,
     `Policy Node: ${policy.node || "not set"}`,
     `Policy Python: ${policy.python || "not set"}`,
@@ -133,6 +136,7 @@ export function renderHandoff(handoff) {
     "# AI Handoff",
     "",
     `Status: ${handoff.status}`,
+    `Decision: ${handoff.decision?.mode || handoff.status}`,
     `Trust: ${handoff.trust?.state || "observed"} (not AI-verified)`,
     `Schema: ${handoff.schemaVersion}`,
     `Workspace: ${handoff.workspace?.path || "unknown"}`,
@@ -170,6 +174,7 @@ export function renderPlan(plan) {
     "# AI Environment Plan",
     "",
     `Status: ${plan.status}`,
+    `Decision: ${plan.decision?.mode || plan.status}`,
     `Generated: ${plan.generatedAt}`,
     `Workspace: ${plan.workspace?.path || "unknown"}`,
     "",
@@ -271,6 +276,10 @@ const rows=o=>entries(o).map(([k,v])=>\`<tr><th>\${esc(k)}</th><td><code>\${esc(
 const inventoryGroups=manifest.inventory?.tools||{};
 const inventoryCount=Object.values(inventoryGroups).reduce((sum,items)=>sum+(Array.isArray(items)?items.length:0),0);
 const inventoryHtml=manifest.inventory?.enabled?('<table>'+Object.entries(inventoryGroups).map(([k,v])=>\`<tr><th>\${esc(k)}</th><td><code>\${Array.isArray(v)?v.length:0} tools</code></td></tr>\`).join('')+'</table>'):'<div class="okline">Deep global inventory is off. Run <code>aienvmp sync --deep</code> when an AI needs global tool awareness.</div>';
+const deps=manifest.dependencySnapshot||{};
+const depSummary=deps.summary||{ecosystems:[],manifests:0,packages:0};
+const depPackages=deps.packages||[];
+const depHtml=depPackages.length?'<table><tr><th>Packages</th><td><code>'+esc(depSummary.packages||0)+'</code></td></tr><tr><th>Ecosystems</th><td><code>'+esc((depSummary.ecosystems||[]).join(', ')||'none')+'</code></td></tr><tr><th>Manifests</th><td><code>'+esc((deps.manifests||[]).join(', ')||'none')+'</code></td></tr></table><div class="timeline">'+depPackages.slice(0,8).map(p=>\`<div class="event"><time>\${esc(p.ecosystem)}</time><div><b>\${esc(p.name)}</b> <code>\${esc(p.version)}</code><div class="path">\${esc(p.manifest)} / \${esc(p.group)}</div></div></div>\`).join('')+'</div>':'<div class="okline">No project dependency manifests detected.</div>';
 const sec=manifest.security||{};
 const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0};
 const secPackages=sec.topPackages||[];
@@ -334,6 +343,7 @@ document.getElementById('app').innerHTML=\`
     \${card('Containers',manifest.containers?.docker?'<span class="pill">available</span>':'<span class="pill off">not detected</span>',\`<table>\${rows(manifest.containers)}</table>\`)}
     \${card('Project Hints',\`<span class="pill">\${entries(manifest.projectHints).length} hints</span>\`,\`<table>\${rows(manifest.projectHints)}</table>\`)}
     \${card('Global Inventory',manifest.inventory?.enabled?'<span class="pill">deep</span>':'<span class="pill off">basic</span>',inventoryHtml)}
+    \${card('Dependency Snapshot','<span class="pill">'+(depSummary.packages||0)+' packages</span>',depHtml)}
     \${card('Security Summary',sec.enabled?'<span class="pill warn">security</span>':'<span class="pill off">basic</span>',securityHtml)}
   </div>
   <aside>
@@ -414,6 +424,22 @@ function inventoryLines(inventory = {}) {
   return lines;
 }
 
+function dependencyLines(snapshot = {}) {
+  const summary = snapshot.summary || {};
+  const packages = snapshot.packages || [];
+  const ecosystems = summary.ecosystems?.length ? summary.ecosystems.join(", ") : "none";
+  const lines = [
+    `- Mode: ${snapshot.mode || "snapshot"}`,
+    `- Manifests: ${(snapshot.manifests || []).join(", ") || "none"}`,
+    `- Ecosystems: ${ecosystems}`,
+    `- Packages: ${summary.packages || 0}`
+  ];
+  for (const pkg of packages.slice(0, 10)) {
+    lines.push(`- ${pkg.ecosystem}/${pkg.name}: ${pkg.version} (${pkg.manifest})`);
+  }
+  return lines;
+}
+
 function securityLines(security = {}) {
   if (!security.enabled) return ["- Mode: basic", "- Security scan is disabled. Run `aienvmp sync --security` when vulnerability context is needed."];
   const summary = security.summary || {};