aienvmp 0.1.28 → 0.1.30

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.30
+
+- Added shared enforcement advice for AI and CI surfaces.
+- Exposed advisory-by-default behavior, suggested strict scopes, and scoped CI commands in context and plan outputs.
+- Moved strict scope logic into a reusable enforcement module while keeping existing `doctor --strict` behavior compatible.
+
+## 0.1.29
+
+- Added lightweight remediation priority scoring for vulnerable packages.
+- Exposed priority level, score, and reasons in security summaries, plans, compact context, and dashboard rows.
+- Kept scoring advisory-only so AI agents can choose safer next steps without blocking local operation.
+
 ## 0.1.28
 
 - Linked vulnerable package summaries to the dependency snapshot when the package is directly declared.

package/README.md

@@ -10,7 +10,7 @@
 
 It helps Codex, Claude, Gemini, and humans avoid silent Node, Python, package manager, dependency, Docker, and security drift.
 
-Core loop: scan once, link runtime/dependency/security context, give AI a shared decision contract, and hand off safe next steps.
+Core loop: scan once, link runtime/dependency/security context, give AI a shared decision contract with advisory priorities, and hand off safe next steps.
 
 ## Quick Start
 
@@ -97,6 +97,7 @@ aienvmp doctor --strict security  # fail only scoped warnings
 - read-only planning, no automatic fixes
 - one advisory engine, optional enforcement with `doctor --ci`
 - scoped enforcement with `doctor --strict security|policy|coordination|all`
+- context and plan expose suggested strict scopes for CI
 - non-blocking unless strict mode is explicitly requested
 - security checks are opt-in and read-only
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/actions.js

@@ -42,7 +42,8 @@ function securityActions(security = {}) {
 
   const packageHints = packages.map((pkg) => {
     const fix = pkg.fixVersions?.length ? `fix ${pkg.fixVersions.slice(0, 2).join(", ")}` : pkg.fixAvailable ? "fix available" : "review required";
-    return `${pkg.name} (${pkg.severity}, ${fix})`;
+    const priority = pkg.remediationPriority ? `${pkg.remediationPriority.level}/${pkg.remediationPriority.score}, ` : "";
+    return `${pkg.name} (${priority}${pkg.severity}, ${fix})`;
   });
 
   return [action(

package/src/commands/context.js

@@ -7,6 +7,7 @@ import { loadPolicy, policyWarnings } from "../policy.js";
 import { recommendedActions } from "../actions.js";
 import { buildPlan, compactStepSummary } from "./plan.js";
 import { aiDecision } from "../decision.js";
+import { enforcementAdvice } from "../enforcement.js";
 
 export async function contextWorkspace(args) {
   const dir = workspaceDir(args);
@@ -23,6 +24,7 @@ export async function contextWorkspace(args) {
     console.log(JSON.stringify({
       status: warnings.length ? "review-required" : "clear",
       decision,
+      enforcement: enforcementAdvice(warnings),
       recommendedActions: actions,
       stepSummary,
       trust: manifest.trust || {},

package/src/commands/dash.js

@@ -8,7 +8,7 @@ import { dashboardPath, intentsPath, manifestPath, planJsonPath, planMdPath, tim
 import { renderDashboard } from "../render.js";
 import { loadPolicy, policyWarnings } from "../policy.js";
 import { recommendedActions } from "../actions.js";
-import { strictResult } from "./doctor.js";
+import { strictResult } from "../enforcement.js";
 
 export async function dashWorkspace(args) {
   const dir = workspaceDir(args);

package/src/commands/doctor.js

@@ -4,6 +4,9 @@ import { openIntents, readJsonl, readTimeline } from "../timeline.js";
 import { intentsPath, manifestPath, timelinePath, workspaceDir } from "../paths.js";
 import { loadPolicy, policyWarnings } from "../policy.js";
 import { recommendedActions } from "../actions.js";
+import { enforcementAdvice, strictResult } from "../enforcement.js";
+
+export { strictResult } from "../enforcement.js";
 
 export async function doctorWorkspace(args) {
   const dir = workspaceDir(args);
@@ -23,6 +26,7 @@ export async function doctorWorkspace(args) {
       openIntentCount: intents.length,
       warnings,
       recommendedActions: actions,
+      enforcement: enforcementAdvice(warnings),
       strict
     }, null, 2));
     if (strict.fail) {
@@ -46,34 +50,3 @@ export async function doctorWorkspace(args) {
     process.exitCode = 1;
   }
 }
-
-export function strictResult(warnings = [], args = {}) {
-  const scope = normalizeStrictScope(args.strict || (args.ci ? "all" : ""));
-  const matchedWarnings = scope ? warnings.filter((warning) => warningMatchesScope(warning, scope)) : [];
-  return {
-    enabled: Boolean(scope),
-    scope: scope || "off",
-    fail: matchedWarnings.length > 0,
-    matchedWarningCodes: matchedWarnings.map((warning) => warning.code),
-    availableScopes: ["security", "policy", "coordination", "all"]
-  };
-}
-
-function normalizeStrictScope(value) {
-  if (value === true) return "all";
-  const scope = String(value || "").trim().toLowerCase();
-  if (!scope || scope === "false" || scope === "off") return "";
-  if (["security", "policy", "coordination", "all"].includes(scope)) return scope;
-  return "all";
-}
-
-function warningMatchesScope(warning, scope) {
-  if (scope === "all") return true;
-  return warningScope(warning.code) === scope;
-}
-
-function warningScope(code = "") {
-  if (code === "security-vulnerabilities") return "security";
-  if (["conflicting-open-intents", "stale-open-intent", "handoff-stale"].includes(code)) return "coordination";
-  return "policy";
-}

package/src/commands/plan.js

@@ -7,6 +7,7 @@ import { renderPlan } from "../render.js";
 import { recommendedActions } from "../actions.js";
 import { openIntents, readJsonl, readTimeline } from "../timeline.js";
 import { aiDecision } from "../decision.js";
+import { enforcementAdvice } from "../enforcement.js";
 
 export async function planWorkspace(args) {
   const dir = workspaceDir(args);
@@ -41,6 +42,7 @@ export function buildPlan(manifest, warnings = [], intents = [], policy = {}) {
     workspace: manifest.workspace || {},
     trust: manifest.trust || {},
     decision: aiDecision(warnings, intents),
+    enforcement: enforcementAdvice(warnings),
     policy: {
       node: policy.node || "not set",
       python: policy.python || "not set",
@@ -73,6 +75,8 @@ export function compactStepSummary(plan = {}) {
     remediation: (plan.remediationSteps || []).slice(0, 3).map((item) => ({
       package: item.package,
       severity: item.severity,
+      priority: item.remediationPriority?.level || "low",
+      score: item.remediationPriority?.score || 0,
       fixVersions: (item.fixVersions || []).slice(0, 3),
       advisoryIds: (item.advisories || []).map((advisory) => advisory.id || advisory.title).filter(Boolean).slice(0, 3)
     })),
@@ -175,6 +179,7 @@ function remediationSteps(security = {}) {
       package: pkg.name,
       scanner: pkg.scanner || "unknown",
       severity: pkg.severity || "unknown",
+      remediationPriority: pkg.remediationPriority || { level: "low", score: 0, reasons: [] },
       directDependency: pkg.directDependency === true,
       dependency: pkg.dependency || null,
       fixAvailable: pkg.fixAvailable === true,

package/src/dependencies.js

@@ -29,20 +29,43 @@ export function linkVulnerableDependencies(security = {}, snapshot = {}) {
     ...security,
     topPackages: (security.topPackages || []).map((pkg) => {
       const dependency = dependencyIndex.get(dependencyKey(scannerEcosystem(pkg.scanner), pkg.name));
+      const directDependency = Boolean(dependency);
       return {
         ...pkg,
-        directDependency: Boolean(dependency),
+        directDependency,
         dependency: dependency ? {
           ecosystem: dependency.ecosystem,
           manifest: dependency.manifest,
           group: dependency.group,
           version: dependency.version
-        } : null
+        } : null,
+        remediationPriority: remediationPriority(pkg, { directDependency })
       };
     })
   };
 }
 
+export function remediationPriority(pkg = {}, context = {}) {
+  const severityScore = { critical: 90, high: 70, moderate: 45, low: 20, info: 5, unknown: 30 };
+  const severity = String(pkg.severity || "unknown").toLowerCase();
+  const reasons = [`severity:${severity}`];
+  let score = severityScore[severity] ?? severityScore.unknown;
+  if (context.directDependency) {
+    score += 15;
+    reasons.push("direct-dependency");
+  } else {
+    reasons.push("not-direct-in-snapshot");
+  }
+  if (pkg.fixAvailable === true || (Array.isArray(pkg.fixVersions) && pkg.fixVersions.length)) {
+    score += 5;
+    reasons.push("fix-available");
+  } else {
+    reasons.push("fix-review-needed");
+  }
+  const level = score >= 95 ? "urgent" : score >= 75 ? "high" : score >= 50 ? "medium" : "low";
+  return { level, score, reasons };
+}
+
 async function scanNodeDependencies(dir) {
   const file = path.join(dir, "package.json");
   if (!(await exists(file))) return { manifests: [], packages: [] };

package/src/enforcement.js

@@ -0,0 +1,57 @@
+const STRICT_SCOPES = ["security", "policy", "coordination", "all"];
+
+export function strictResult(warnings = [], args = {}) {
+  const scope = normalizeStrictScope(args.strict || (args.ci ? "all" : ""));
+  const matchedWarnings = scope ? warnings.filter((warning) => warningMatchesScope(warning, scope)) : [];
+  return {
+    enabled: Boolean(scope),
+    scope: scope || "off",
+    fail: matchedWarnings.length > 0,
+    matchedWarningCodes: matchedWarnings.map((warning) => warning.code),
+    availableScopes: STRICT_SCOPES
+  };
+}
+
+export function enforcementAdvice(warnings = []) {
+  const scopeResults = STRICT_SCOPES.map((scope) => {
+    const result = strictResult(warnings, { strict: scope });
+    return {
+      scope,
+      status: result.fail ? "fail" : "pass",
+      matchedWarningCodes: result.matchedWarningCodes
+    };
+  });
+  const suggestedStrictScopes = scopeResults
+    .filter((item) => item.scope !== "all" && item.status === "fail")
+    .map((item) => item.scope);
+  return {
+    mode: "advisory-by-default",
+    localBehavior: "non-blocking",
+    ciBehavior: "strict-only-when-requested",
+    suggestedStrictScopes,
+    scopes: scopeResults,
+    recommendedCommand: suggestedStrictScopes.length
+      ? `aienvmp doctor --strict ${suggestedStrictScopes[0]}`
+      : "aienvmp doctor --strict all",
+    note: "Use strict mode in CI or explicit checks; do not block local operation unless the user requests it."
+  };
+}
+
+function normalizeStrictScope(value) {
+  if (value === true) return "all";
+  const scope = String(value || "").trim().toLowerCase();
+  if (!scope || scope === "false" || scope === "off") return "";
+  if (STRICT_SCOPES.includes(scope)) return scope;
+  return "all";
+}
+
+function warningMatchesScope(warning, scope) {
+  if (scope === "all") return true;
+  return warningScope(warning.code) === scope;
+}
+
+function warningScope(code = "") {
+  if (code === "security-vulnerabilities") return "security";
+  if (["conflicting-open-intents", "stale-open-intent", "handoff-stale"].includes(code)) return "coordination";
+  return "policy";
+}

package/src/render.js

@@ -95,6 +95,7 @@ export function renderContext(manifest, timeline = [], warnings = [], intents =
     `Status: ${status}`,
     `Next: ${next}`,
     "Project-local work: allowed; environment changes require intent and review when warnings or open intents exist.",
+    "Enforcement: advisory by default; use `aienvmp doctor --strict <scope>` only when explicit CI failure is wanted.",
     `Trust: ${manifest.trust?.state || "observed"} (verified requires human or CI)`,
     `Workspace: ${manifest.workspace.path}`,
     `Node: ${manifest.runtimes.node || "not detected"}`,
@@ -175,6 +176,7 @@ export function renderPlan(plan) {
     "",
     `Status: ${plan.status}`,
     `Decision: ${plan.decision?.mode || plan.status}`,
+    `Enforcement: ${plan.enforcement?.mode || "advisory-by-default"} (${plan.enforcement?.localBehavior || "non-blocking"})`,
     `Generated: ${plan.generatedAt}`,
     `Workspace: ${plan.workspace?.path || "unknown"}`,
     "",
@@ -212,8 +214,9 @@ function remediationLines(item) {
   const fix = item.fixVersions?.length ? `fix ${item.fixVersions.join(", ")}` : item.fixAvailable ? "fix available" : "review required";
   const advisories = (item.advisories || []).map((advisory) => advisory.id || advisory.title).filter(Boolean).slice(0, 2);
   const dependency = item.directDependency && item.dependency ? `; declared in ${item.dependency.manifest} ${item.dependency.version}` : "; not found in dependency snapshot";
+  const priority = item.remediationPriority ? `priority ${item.remediationPriority.level}/${item.remediationPriority.score}` : "priority unscored";
   return [
-    `- ${item.package}: ${item.severity}; ${fix}${dependency}${advisories.length ? `; advisories ${advisories.join(", ")}` : ""}`,
+    `- ${item.package}: ${item.severity}; ${priority}; ${fix}${dependency}${advisories.length ? `; advisories ${advisories.join(", ")}` : ""}`,
     ...item.steps.slice(0, 4).map((step) => `  - ${step}`)
   ];
 }
@@ -287,7 +290,8 @@ const secPackages=sec.topPackages||[];
 const securityFix=p=>p.fixVersions?.length?\`fix \${p.fixVersions.slice(0,3).join(', ')}\`:(p.fixAvailable?'fix available':'review required');
 const securityRefs=p=>p.advisories?.length?\` - \${p.advisories.map(a=>a.id||a.title).filter(Boolean).slice(0,2).join(', ')}\`:'';
 const securityDep=p=>p.directDependency&&p.dependency?\`<div class="path">\${esc(p.dependency.manifest)} / \${esc(p.dependency.group)} / \${esc(p.dependency.version)}</div>\`:'<div class="path">not found in dependency snapshot</div>';
-const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${esc(securityFix(p))}\${esc(securityRefs(p))}\${securityDep(p)}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
+const securityPriority=p=>p.remediationPriority?\`<code>\${esc(p.remediationPriority.level)} \${esc(p.remediationPriority.score)}</code> \`:'';
+const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${securityPriority(p)}\${esc(securityFix(p))}\${esc(securityRefs(p))}\${securityDep(p)}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
 const change=c=>c.type==='changed'?\`\${c.scope} \${c.key}: \${c.before} -> \${c.after}\`:\`\${c.scope} \${c.key}: \${c.type} \${c.after||c.before}\`;
 const timelineLabel=t=>t.change?change(t.change):(t.summary||t.action||t.type||'recorded change');
 const agentNames={agents:'Codex',claude:'Claude',gemini:'Gemini'};
@@ -465,12 +469,13 @@ function securityLines(security = {}) {
 
 function securityPackageNote(pkg) {
   const fix = pkg.fixVersions?.length ? `fix ${pkg.fixVersions.slice(0, 3).join(", ")}` : pkg.fixAvailable ? "fix available" : "review required";
+  const priority = pkg.remediationPriority ? `priority ${pkg.remediationPriority.level}/${pkg.remediationPriority.score}; ` : "";
   const dependency = pkg.directDependency && pkg.dependency ? `; declared in ${pkg.dependency.manifest} ${pkg.dependency.version}` : "; not found in dependency snapshot";
   const advisories = (pkg.advisories || [])
     .map((item) => item.id || item.title)
     .filter(Boolean)
     .slice(0, 2);
-  return advisories.length ? `${fix}${dependency}; advisories ${advisories.join(", ")}` : `${fix}${dependency}`;
+  return advisories.length ? `${priority}${fix}${dependency}; advisories ${advisories.join(", ")}` : `${priority}${fix}${dependency}`;
 }
 
 function policyLines(policy) {