aienvmp 0.1.27 → 0.1.28

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.28
+
+- Linked vulnerable package summaries to the dependency snapshot when the package is directly declared.
+- Added direct dependency metadata to remediation steps and dashboard security rows.
+- Kept the linkage read-only and file-based so security context stays lightweight and non-disruptive.
+
 ## 0.1.27
 
 - Added a read-only dependency snapshot to the manifest, context, AIENV.md, and dashboard.

package/README.md

@@ -10,7 +10,7 @@
 
 It helps Codex, Claude, Gemini, and humans avoid silent Node, Python, package manager, dependency, Docker, and security drift.
 
-Core loop: scan once, give AI a shared decision contract, write a read-only action plan, and hand off safe next steps.
+Core loop: scan once, link runtime/dependency/security context, give AI a shared decision contract, and hand off safe next steps.
 
 ## Quick Start
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/plan.js

@@ -175,6 +175,8 @@ function remediationSteps(security = {}) {
       package: pkg.name,
       scanner: pkg.scanner || "unknown",
       severity: pkg.severity || "unknown",
+      directDependency: pkg.directDependency === true,
+      dependency: pkg.dependency || null,
       fixAvailable: pkg.fixAvailable === true,
       fixVersions,
       advisories,

package/src/dependencies.js

@@ -23,6 +23,26 @@ export async function scanDependencySnapshot(dir) {
   };
 }
 
+export function linkVulnerableDependencies(security = {}, snapshot = {}) {
+  const dependencyIndex = new Map((snapshot.packages || []).map((pkg) => [dependencyKey(pkg.ecosystem, pkg.name), pkg]));
+  return {
+    ...security,
+    topPackages: (security.topPackages || []).map((pkg) => {
+      const dependency = dependencyIndex.get(dependencyKey(scannerEcosystem(pkg.scanner), pkg.name));
+      return {
+        ...pkg,
+        directDependency: Boolean(dependency),
+        dependency: dependency ? {
+          ecosystem: dependency.ecosystem,
+          manifest: dependency.manifest,
+          group: dependency.group,
+          version: dependency.version
+        } : null
+      };
+    })
+  };
+}
+
 async function scanNodeDependencies(dir) {
   const file = path.join(dir, "package.json");
   if (!(await exists(file))) return { manifests: [], packages: [] };
@@ -102,6 +122,15 @@ export function parseRequirementLine(line) {
   };
 }
 
+function scannerEcosystem(scanner = "") {
+  if (String(scanner).includes("pip")) return "python";
+  return "npm";
+}
+
+function dependencyKey(ecosystem = "", name = "") {
+  return `${String(ecosystem).toLowerCase()}:${String(name).toLowerCase()}`;
+}
+
 export function parsePyprojectDependencies(raw) {
   const lines = [];
   const match = String(raw).match(/dependencies\s*=\s*\[([\s\S]*?)\]/m);

package/src/manifest.js

@@ -6,10 +6,12 @@ import { exists } from "./fsutil.js";
 import { observedTrust } from "./trust.js";
 import { scanGlobalInventory } from "./inventory.js";
 import { scanSecurity } from "./security.js";
-import { scanDependencySnapshot } from "./dependencies.js";
+import { linkVulnerableDependencies, scanDependencySnapshot } from "./dependencies.js";
 
 export async function buildManifest(dir, options = {}) {
   const now = new Date().toISOString();
+  const dependencySnapshot = await scanDependencySnapshot(dir);
+  const security = linkVulnerableDependencies(await scanSecurity(dir, { security: options.security }), dependencySnapshot);
   const manifest = {
     schemaName: "aienvmp.runtime-sbom",
     schemaVersion: 1,
@@ -28,9 +30,9 @@ export async function buildManifest(dir, options = {}) {
     packageManagers: await scanPackageManagers(),
     containers: await scanContainers(),
     projectHints: await scanProjectHints(dir),
-    dependencySnapshot: await scanDependencySnapshot(dir),
+    dependencySnapshot,
     inventory: await scanGlobalInventory({ deep: options.deep }),
-    security: await scanSecurity(dir, { security: options.security }),
+    security,
     agentFiles: await scanAgentFiles(dir),
     agentProtocol: {
       sourceOfTruth: "AIENV.md",

package/src/render.js

@@ -211,8 +211,9 @@ function environmentLines(item) {
 function remediationLines(item) {
   const fix = item.fixVersions?.length ? `fix ${item.fixVersions.join(", ")}` : item.fixAvailable ? "fix available" : "review required";
   const advisories = (item.advisories || []).map((advisory) => advisory.id || advisory.title).filter(Boolean).slice(0, 2);
+  const dependency = item.directDependency && item.dependency ? `; declared in ${item.dependency.manifest} ${item.dependency.version}` : "; not found in dependency snapshot";
   return [
-    `- ${item.package}: ${item.severity}; ${fix}${advisories.length ? `; advisories ${advisories.join(", ")}` : ""}`,
+    `- ${item.package}: ${item.severity}; ${fix}${dependency}${advisories.length ? `; advisories ${advisories.join(", ")}` : ""}`,
     ...item.steps.slice(0, 4).map((step) => `  - ${step}`)
   ];
 }
@@ -285,7 +286,8 @@ const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0
 const secPackages=sec.topPackages||[];
 const securityFix=p=>p.fixVersions?.length?\`fix \${p.fixVersions.slice(0,3).join(', ')}\`:(p.fixAvailable?'fix available':'review required');
 const securityRefs=p=>p.advisories?.length?\` - \${p.advisories.map(a=>a.id||a.title).filter(Boolean).slice(0,2).join(', ')}\`:'';
-const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${esc(securityFix(p))}\${esc(securityRefs(p))}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
+const securityDep=p=>p.directDependency&&p.dependency?\`<div class="path">\${esc(p.dependency.manifest)} / \${esc(p.dependency.group)} / \${esc(p.dependency.version)}</div>\`:'<div class="path">not found in dependency snapshot</div>';
+const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${esc(securityFix(p))}\${esc(securityRefs(p))}\${securityDep(p)}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
 const change=c=>c.type==='changed'?\`\${c.scope} \${c.key}: \${c.before} -> \${c.after}\`:\`\${c.scope} \${c.key}: \${c.type} \${c.after||c.before}\`;
 const timelineLabel=t=>t.change?change(t.change):(t.summary||t.action||t.type||'recorded change');
 const agentNames={agents:'Codex',claude:'Claude',gemini:'Gemini'};
@@ -463,11 +465,12 @@ function securityLines(security = {}) {
 
 function securityPackageNote(pkg) {
   const fix = pkg.fixVersions?.length ? `fix ${pkg.fixVersions.slice(0, 3).join(", ")}` : pkg.fixAvailable ? "fix available" : "review required";
+  const dependency = pkg.directDependency && pkg.dependency ? `; declared in ${pkg.dependency.manifest} ${pkg.dependency.version}` : "; not found in dependency snapshot";
   const advisories = (pkg.advisories || [])
     .map((item) => item.id || item.title)
     .filter(Boolean)
     .slice(0, 2);
-  return advisories.length ? `${fix}; advisories ${advisories.join(", ")}` : fix;
+  return advisories.length ? `${fix}${dependency}; advisories ${advisories.join(", ")}` : `${fix}${dependency}`;
 }
 
 function policyLines(policy) {