aienvmp 0.1.35 → 0.1.37

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.37
+
+- Added `lightSbom` to the manifest as an AI-ready package and vulnerability summary.
+- Linked dependency manifests, ecosystem/group counts, vulnerable direct dependencies, and top risk packages into one compact SBOM view.
+- Surfaced dependency change hints in AI-facing outputs and the dashboard so agents and humans can identify relevant manifests before edits.
+- Added read-only lockfile awareness to dependency snapshots and light SBOM hints.
+- Added package manager policy hints from lockfiles to reduce accidental npm/pnpm/yarn drift.
+
+## 0.1.36
+
+- Added an explicit enforcement profile to the shared AI preflight contract.
+- Surfaced advisory-by-default vs optional strict mode in the dashboard.
+- Clarified that strict checks are intended for CI or explicit human-requested gates, not default local blocking.
+
 ## 0.1.35
 
 - Added a shared AI preflight contract across status, context, plan, and handoff outputs.

package/README.md

@@ -10,7 +10,7 @@
 
 It helps Codex, Claude, Gemini, and humans avoid silent Node, Python, package manager, dependency, Docker, and security drift.
 
-Core loop: scan once, link runtime/dependency/security context, give AI a shared decision contract with advisory priorities, and hand off safe next steps.
+Core loop: scan once, link runtime/dependency/security context, give AI a shared decision contract with a light SBOM summary, and hand off safe next steps.
 
 ## Quick Start
 
@@ -105,8 +105,14 @@ aienvmp doctor --strict security  # fail only scoped warnings
 - one advisory engine, optional enforcement with `doctor --ci`
 - scoped enforcement with `doctor --strict security|policy|coordination|all`
 - context and plan expose suggested strict scopes for CI
+- dashboard and preflight explain advisory default vs optional strict mode
 - non-blocking unless strict mode is explicitly requested
 - security checks are opt-in and read-only
+- light SBOM is generated from project files and optional scanner summaries
+- dependency change hints point AI agents to the relevant manifest before edits
+- lockfiles are detected read-only and shown before dependency edits
+- package manager policy is inferred from lockfiles to avoid accidental npm/pnpm/yarn drift
+- dashboard mirrors AI-facing SBOM hints so humans can review the same dependency context
 
 ## Development
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/context.js

@@ -38,6 +38,7 @@ export async function contextWorkspace(args) {
       containers: manifest.containers,
       inventory: inventorySummary(manifest.inventory),
       dependencySnapshot: dependencySummary(manifest.dependencySnapshot),
+      lightSbom: lightSbomSummary(manifest.lightSbom),
       security: securitySummary(manifest.security),
       projectHints: manifest.projectHints,
       warnings,
@@ -51,6 +52,31 @@ export async function contextWorkspace(args) {
   console.log(renderContext(manifest, timeline, warnings, intents, policy, actions));
 }
 
+function lightSbomSummary(lightSbom = {}) {
+  return {
+    mode: lightSbom.mode || "light-sbom",
+    summary: lightSbom.summary || {
+      ecosystems: {},
+      managers: {},
+      groups: {},
+      manifests: [],
+      lockfiles: [],
+      packages: 0,
+      vulnerabilities: 0,
+      directVulnerablePackages: 0,
+      transitiveOrUnmatchedVulnerablePackages: 0
+    },
+    topRisk: (lightSbom.topRisk || []).slice(0, 8),
+    packageManagerPolicy: lightSbom.packageManagerPolicy || {
+      status: "no-lockfile",
+      ecosystems: {},
+      guidance: "No lockfile policy detected."
+    },
+    dependencyChangeHints: (lightSbom.dependencyChangeHints || []).slice(0, 8),
+    aiUse: lightSbom.aiUse || {}
+  };
+}
+
 function dependencySummary(snapshot = {}) {
   return {
     mode: snapshot.mode || "snapshot",

package/src/commands/dash.js

@@ -9,6 +9,7 @@ import { renderDashboard } from "../render.js";
 import { loadPolicy, policyWarnings } from "../policy.js";
 import { recommendedActions } from "../actions.js";
 import { strictResult } from "../enforcement.js";
+import { buildPreflight } from "../preflight.js";
 
 export async function dashWorkspace(args) {
   const dir = workspaceDir(args);
@@ -23,6 +24,7 @@ export async function dashWorkspace(args) {
   const planEnvironment = await detectedPlanEnvironment(dir);
   const html = renderDashboard({
     ...manifest,
+    preflight: buildPreflight(manifest, warnings, intents),
     recommendedActions: recommendedActions(manifest, { warnings, intents }),
     planArtifacts,
     planRemediation,

package/src/dependencies.js

@@ -3,20 +3,33 @@ import path from "node:path";
 import { exists, readJson } from "./fsutil.js";
 
 const NODE_GROUPS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+const LOCKFILE_CANDIDATES = [
+  { file: "package-lock.json", ecosystem: "npm", manager: "npm" },
+  { file: "npm-shrinkwrap.json", ecosystem: "npm", manager: "npm" },
+  { file: "pnpm-lock.yaml", ecosystem: "npm", manager: "pnpm" },
+  { file: "yarn.lock", ecosystem: "npm", manager: "yarn" },
+  { file: "bun.lockb", ecosystem: "npm", manager: "bun" },
+  { file: "uv.lock", ecosystem: "python", manager: "uv" },
+  { file: "poetry.lock", ecosystem: "python", manager: "poetry" },
+  { file: "Pipfile.lock", ecosystem: "python", manager: "pipenv" }
+];
 
 export async function scanDependencySnapshot(dir) {
   const node = await scanNodeDependencies(dir);
   const python = await scanPythonDependencies(dir);
   const packages = [...node.packages, ...python.packages];
   const manifests = [...node.manifests, ...python.manifests];
+  const lockfiles = await scanDependencyLockfiles(dir);
   return {
     mode: "snapshot",
     enabled: true,
     note: "Read-only dependency snapshot from project files. It does not install, update, or resolve packages.",
     manifests,
+    lockfiles,
     summary: {
       ecosystems: [...new Set(packages.map((pkg) => pkg.ecosystem))],
       manifests: manifests.length,
+      lockfiles: lockfiles.length,
       packages: packages.length
     },
     packages: packages.slice(0, 80)
@@ -45,6 +58,144 @@ export function linkVulnerableDependencies(security = {}, snapshot = {}) {
   };
 }
 
+export function buildLightSbom(snapshot = {}, security = {}) {
+  const packages = snapshot.packages || [];
+  const vulnerable = security.topPackages || [];
+  const directVulnerable = vulnerable.filter((pkg) => pkg.directDependency === true);
+  const transitiveOrUnmatched = vulnerable.filter((pkg) => pkg.directDependency !== true);
+  const topRisk = vulnerable.slice(0, 8).map((pkg) => ({
+    name: pkg.name,
+    ecosystem: scannerEcosystem(pkg.scanner),
+    severity: pkg.severity || "unknown",
+    directDependency: pkg.directDependency === true,
+    manifest: pkg.dependency?.manifest || "",
+    version: pkg.dependency?.version || pkg.version || "",
+    priority: pkg.remediationPriority?.level || "low",
+    score: pkg.remediationPriority?.score || 0,
+    fixAvailable: pkg.fixAvailable === true || Boolean(pkg.fixVersions?.length),
+    fixVersions: (pkg.fixVersions || []).slice(0, 3)
+  }));
+  return {
+    schemaVersion: 1,
+    mode: "light-sbom",
+    note: "AI-ready package and vulnerability summary from read-only project files and optional scanners.",
+    summary: {
+      ecosystems: countBy(packages, "ecosystem"),
+      managers: countBy(packages, "manager"),
+      groups: countBy(packages, "group"),
+      manifests: snapshot.manifests || [],
+      lockfiles: snapshot.lockfiles || [],
+      packages: packages.length,
+      vulnerabilities: Number(security.summary?.total || 0),
+      directVulnerablePackages: directVulnerable.length,
+      transitiveOrUnmatchedVulnerablePackages: transitiveOrUnmatched.length
+    },
+    topRisk,
+    packageManagerPolicy: packageManagerPolicy(snapshot.lockfiles || []),
+    dependencyChangeHints: dependencyChangeHints(packages, topRisk, snapshot.lockfiles || []),
+    aiUse: {
+      beforeDependencyChanges: "Read lightSbom.summary and lightSbom.topRisk before changing dependencies.",
+      securityMode: security.enabled ? "scanner-summary" : "scanner-off",
+      dependencySource: "project manifests only; no install or resolver is run"
+    }
+  };
+}
+
+function packageManagerPolicy(lockfiles = []) {
+  const byEcosystem = {};
+  for (const lockfile of lockfiles) {
+    const ecosystem = lockfile.ecosystem || "unknown";
+    const managers = byEcosystem[ecosystem]?.managers || new Set();
+    managers.add(lockfile.manager || "unknown");
+    byEcosystem[ecosystem] = {
+      ecosystem,
+      managers,
+      lockfiles: [...(byEcosystem[ecosystem]?.lockfiles || []), lockfile.file]
+    };
+  }
+  const ecosystems = Object.fromEntries(Object.entries(byEcosystem).map(([name, value]) => {
+    const managers = [...value.managers].sort();
+    return [name, {
+      managers,
+      lockfiles: value.lockfiles.sort(),
+      status: managers.length > 1 ? "mixed-lockfiles" : "single-manager",
+      recommendedManager: managers[0] || "not-detected",
+      guidance: managers.length > 1
+        ? "Review with the user before dependency changes; multiple package manager lockfiles are present."
+        : "Use the detected package manager for dependency changes unless the user says otherwise."
+    }];
+  }));
+  return {
+    status: Object.keys(ecosystems).length === 0
+      ? "no-lockfile"
+      : Object.values(ecosystems).some((item) => item.status === "mixed-lockfiles") ? "review-required" : "clear",
+    ecosystems,
+    guidance: Object.keys(ecosystems).length === 0
+      ? "No lockfile detected; avoid creating one with an unexpected package manager without user approval."
+      : "Preserve existing lockfile and package manager choices during dependency changes."
+  };
+}
+
+function dependencyChangeHints(packages = [], topRisk = [], lockfiles = []) {
+  const byManifest = new Map();
+  for (const pkg of packages) {
+    const key = pkg.manifest || "unknown";
+    const entry = byManifest.get(key) || {
+      manifest: key,
+      ecosystem: pkg.ecosystem || "unknown",
+      manager: pkg.manager || "unknown",
+      groups: new Set(),
+      packages: 0,
+      riskPackages: []
+    };
+    entry.groups.add(pkg.group || "unknown");
+    entry.packages += 1;
+    byManifest.set(key, entry);
+  }
+  for (const risk of topRisk) {
+    if (!risk.manifest || !byManifest.has(risk.manifest)) continue;
+    byManifest.get(risk.manifest).riskPackages.push({
+      name: risk.name,
+      severity: risk.severity,
+      priority: risk.priority,
+      fixAvailable: risk.fixAvailable
+    });
+  }
+  return [...byManifest.values()].map((entry) => ({
+    manifest: entry.manifest,
+    ecosystem: entry.ecosystem,
+    manager: entry.manager,
+    groups: [...entry.groups].sort(),
+    packages: entry.packages,
+    riskPackages: entry.riskPackages.slice(0, 5),
+    lockfiles: lockfilesForEntry(entry, lockfiles),
+    beforeChange: [
+      `Read ${entry.manifest} and the active package manager policy before editing dependencies.`,
+      lockfilesForEntry(entry, lockfiles).length
+        ? `Preserve related lockfiles: ${lockfilesForEntry(entry, lockfiles).map((item) => item.file).join(", ")}.`
+        : "No related lockfile was detected; do not create one with a different package manager without approval.",
+      "Record an intent before dependency or lockfile changes when another AI may be working."
+    ],
+    afterChange: [
+      "Run project tests or the narrowest relevant validation.",
+      "Run aienvmp sync.",
+      "Record the dependency change with aienvmp record."
+    ]
+  }));
+}
+
+async function scanDependencyLockfiles(dir) {
+  const found = [];
+  for (const item of LOCKFILE_CANDIDATES) {
+    if (await exists(path.join(dir, item.file))) found.push(item);
+  }
+  return found;
+}
+
+function lockfilesForEntry(entry, lockfiles = []) {
+  return lockfiles.filter((lockfile) => lockfile.ecosystem === entry.ecosystem);
+}
+
 export function remediationPriority(pkg = {}, context = {}) {
   const severityScore = { critical: 90, high: 70, moderate: 45, low: 20, info: 5, unknown: 30 };
   const severity = String(pkg.severity || "unknown").toLowerCase();
@@ -66,6 +217,14 @@ export function remediationPriority(pkg = {}, context = {}) {
   return { level, score, reasons };
 }
 
+function countBy(items = [], key) {
+  return Object.fromEntries(Object.entries(items.reduce((acc, item) => {
+    const value = item[key] || "unknown";
+    acc[value] = (acc[value] || 0) + 1;
+    return acc;
+  }, {})).sort(([a], [b]) => a.localeCompare(b)));
+}
+
 async function scanNodeDependencies(dir) {
   const file = path.join(dir, "package.json");
   if (!(await exists(file))) return { manifests: [], packages: [] };

package/src/manifest.js

@@ -6,12 +6,13 @@ import { exists } from "./fsutil.js";
 import { observedTrust } from "./trust.js";
 import { scanGlobalInventory } from "./inventory.js";
 import { scanSecurity } from "./security.js";
-import { linkVulnerableDependencies, scanDependencySnapshot } from "./dependencies.js";
+import { buildLightSbom, linkVulnerableDependencies, scanDependencySnapshot } from "./dependencies.js";
 
 export async function buildManifest(dir, options = {}) {
   const now = new Date().toISOString();
   const dependencySnapshot = await scanDependencySnapshot(dir);
   const security = linkVulnerableDependencies(await scanSecurity(dir, { security: options.security }), dependencySnapshot);
+  const lightSbom = buildLightSbom(dependencySnapshot, security);
   const manifest = {
     schemaName: "aienvmp.runtime-sbom",
     schemaVersion: 1,
@@ -31,6 +32,7 @@ export async function buildManifest(dir, options = {}) {
     containers: await scanContainers(),
     projectHints: await scanProjectHints(dir),
     dependencySnapshot,
+    lightSbom,
     inventory: await scanGlobalInventory({ deep: options.deep }),
     security,
     agentFiles: await scanAgentFiles(dir),

package/src/preflight.js

@@ -16,6 +16,20 @@ export function buildPreflight(manifest = {}, warnings = [], intents = []) {
       : "Review warnings or open intents before environment changes.",
     decision,
     enforcement,
+    enforcementProfile: {
+      defaultMode: "advisory",
+      localOperation: "non-blocking",
+      strictMode: "optional",
+      strictUse: "CI or explicit human-requested checks only",
+      reason: "Avoid disrupting shared servers or developer machines while still making drift visible.",
+      recommendedStrictCommand: enforcement.recommendedCommand,
+      strictCommands: [
+        "aienvmp doctor --strict security",
+        "aienvmp doctor --strict policy",
+        "aienvmp doctor --strict coordination",
+        "aienvmp doctor --strict all"
+      ]
+    },
     counts: {
       warnings: warnings.length,
       openIntents: intents.length,

package/src/render.js

@@ -33,6 +33,8 @@ export function renderAIEnv(manifest, timeline = [], warnings = [], intents = []
   lines.push(...inventoryLines(manifest.inventory), "");
   lines.push("## Dependency Snapshot", "");
   lines.push(...dependencyLines(manifest.dependencySnapshot), "");
+  lines.push("## Light SBOM", "");
+  lines.push(...lightSbomLines(manifest.lightSbom), "");
   lines.push("## Security Summary", "");
   lines.push(...securityLines(manifest.security), "");
   lines.push("## Project Requirements And Hints", "");
@@ -284,6 +286,14 @@ const deps=manifest.dependencySnapshot||{};
 const depSummary=deps.summary||{ecosystems:[],manifests:0,packages:0};
 const depPackages=deps.packages||[];
 const depHtml=depPackages.length?'<table><tr><th>Packages</th><td><code>'+esc(depSummary.packages||0)+'</code></td></tr><tr><th>Ecosystems</th><td><code>'+esc((depSummary.ecosystems||[]).join(', ')||'none')+'</code></td></tr><tr><th>Manifests</th><td><code>'+esc((deps.manifests||[]).join(', ')||'none')+'</code></td></tr></table><div class="timeline">'+depPackages.slice(0,8).map(p=>\`<div class="event"><time>\${esc(p.ecosystem)}</time><div><b>\${esc(p.name)}</b> <code>\${esc(p.version)}</code><div class="path">\${esc(p.manifest)} / \${esc(p.group)}</div></div></div>\`).join('')+'</div>':'<div class="okline">No project dependency manifests detected.</div>';
+const lightSbom=manifest.lightSbom||{};
+const lightSbomSummary=lightSbom.summary||{};
+const pmPolicy=lightSbom.packageManagerPolicy||{};
+const topRisk=lightSbom.topRisk||[];
+const dependencyHints=lightSbom.dependencyChangeHints||[];
+const dependencyHintsHtml=dependencyHints.length?'<div class="timeline">'+dependencyHints.slice(0,5).map(h=>\`<div class="event"><time>\${esc(h.ecosystem||'deps')}</time><div><b>\${esc(h.manifest)}</b> <code>\${esc(h.manager||'unknown')}</code> \${esc(h.packages||0)} packages\${h.riskPackages?.length?\`<div class="path">risk: \${esc(h.riskPackages.map(p=>p.name).join(', '))}</div>\`:''}<div class="path">\${esc((h.groups||[]).join(', ')||'no groups')}\${h.lockfiles?.length?\` / lockfiles: \${esc(h.lockfiles.map(l=>l.file).join(', '))}\`:''}</div></div></div>\`).join('')+'</div>':'<div class="okline">No dependency change hints available.</div>';
+const pmPolicyHtml='<table><tr><th>Status</th><td><code>'+esc(pmPolicy.status||'no-lockfile')+'</code></td></tr><tr><th>Guidance</th><td>'+esc(pmPolicy.guidance||'No lockfile policy detected.')+'</td></tr></table>';
+const lightSbomHtml=\`<table><tr><th>Packages</th><td><code>\${esc(lightSbomSummary.packages||0)}</code></td></tr><tr><th>Vulnerabilities</th><td><code>\${esc(lightSbomSummary.vulnerabilities||0)}</code></td></tr><tr><th>Direct vulnerable</th><td><code>\${esc(lightSbomSummary.directVulnerablePackages||0)}</code></td></tr><tr><th>Manifests</th><td><code>\${esc((lightSbomSummary.manifests||[]).join(', ')||'none')}</code></td></tr><tr><th>Lockfiles</th><td><code>\${esc((lightSbomSummary.lockfiles||[]).map(l=>l.file).join(', ')||'none')}</code></td></tr></table><h3 style="margin-top:12px">Package manager policy</h3>\${pmPolicyHtml}\${topRisk.length?'<div class="timeline">'+topRisk.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.priority)}</time><div><b>\${esc(p.name)}</b> \${esc(p.severity)} \${p.directDependency?'<code>direct</code>':'<code>transitive</code>'}<div class="path">\${esc(p.manifest||p.ecosystem)} \${esc(p.version||'')}</div></div></div>\`).join('')+'</div>':'<div class="okline">No high-risk package summary in the current light SBOM.</div>'}<h3 style="margin-top:12px">Dependency change hints</h3>\${dependencyHintsHtml}\`;
 const sec=manifest.security||{};
 const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0};
 const secPackages=sec.topPackages||[];
@@ -313,6 +323,9 @@ const envStepsHtml=envSteps.length?'<div class="timeline">'+envSteps.map(s=>\`<d
 const ciReadiness=manifest.ciReadiness||[];
 const ciHasFailure=ciReadiness.some(s=>s.status==='fail');
 const ciReadinessHtml=ciReadiness.length?'<table>'+ciReadiness.map(s=>\`<tr><th>\${esc(s.scope)}</th><td><code>\${esc(s.status)}</code>\${s.matchedWarningCodes?.length?\` \${esc(s.matchedWarningCodes.join(', '))}\`:''}</td></tr>\`).join('')+'</table>':'<div class="okline">Run <code>aienvmp doctor --strict security|policy|coordination|all</code> to choose CI enforcement scope.</div>';
+const enforcementProfile=manifest.preflight?.enforcementProfile||{};
+const strictCommands=enforcementProfile.strictCommands||[];
+const enforcementHtml=\`<table><tr><th>Default</th><td><code>\${esc(enforcementProfile.defaultMode||'advisory')}</code></td></tr><tr><th>Local</th><td>\${esc(enforcementProfile.localOperation||'non-blocking')}</td></tr><tr><th>Strict</th><td>\${esc(enforcementProfile.strictUse||'CI or explicit checks only')}</td></tr><tr><th>Recommended</th><td><code>\${esc(enforcementProfile.recommendedStrictCommand||'aienvmp doctor --strict all')}</code></td></tr></table><div class="timeline">\${strictCommands.slice(0,4).map(cmd=>\`<div class="event"><time>CI</time><div><code>\${esc(cmd)}</code></div></div>\`).join('')}</div><div class="path">\${esc(enforcementProfile.reason||'Warnings stay advisory unless strict mode is requested.')}</div>\`;
 const card=(title,badge,body)=>\`<section class="card"><div class="card-head"><h2>\${title}</h2>\${badge||''}</div>\${body}</section>\`;
 const reviewRequired=warnings.length>0||intents.length>0;
 const recentChanges=timeline.slice(-8).length;
@@ -350,6 +363,7 @@ document.getElementById('app').innerHTML=\`
     \${card('Project Hints',\`<span class="pill">\${entries(manifest.projectHints).length} hints</span>\`,\`<table>\${rows(manifest.projectHints)}</table>\`)}
     \${card('Global Inventory',manifest.inventory?.enabled?'<span class="pill">deep</span>':'<span class="pill off">basic</span>',inventoryHtml)}
     \${card('Dependency Snapshot','<span class="pill">'+(depSummary.packages||0)+' packages</span>',depHtml)}
+    \${card('Light SBOM','<span class="pill">'+(lightSbomSummary.packages||0)+' packages</span>',lightSbomHtml)}
     \${card('Security Summary',sec.enabled?'<span class="pill warn">security</span>':'<span class="pill off">basic</span>',securityHtml)}
   </div>
   <aside>
@@ -361,6 +375,8 @@ document.getElementById('app').innerHTML=\`
     <div style="height:14px"></div>
     \${card('Environment Steps',envSteps.length?'<span class="pill warn">'+envSteps.length+' items</span>':'<span class="pill off">none</span>',envStepsHtml)}
     <div style="height:14px"></div>
+    \${card('Enforcement Mode','<span class="pill">advisory</span>',enforcementHtml)}
+    <div style="height:14px"></div>
     \${card('CI Readiness',ciHasFailure?'<span class="pill warn">review</span>':'<span class="pill">ready</span>',ciReadinessHtml)}
     <div style="height:14px"></div>
     \${card('Environment Health',warnings.length?'<span class="pill warn">attention</span>':'<span class="pill">clear</span>',warnHtml)}
@@ -446,6 +462,39 @@ function dependencyLines(snapshot = {}) {
   return lines;
 }
 
+function lightSbomLines(lightSbom = {}) {
+  const summary = lightSbom.summary || {};
+  const lines = [
+    `- Mode: ${lightSbom.mode || "light-sbom"}`,
+    `- Packages: ${summary.packages || 0}`,
+    `- Vulnerabilities: ${summary.vulnerabilities || 0}`,
+    `- Direct vulnerable packages: ${summary.directVulnerablePackages || 0}`,
+    `- Transitive or unmatched vulnerable packages: ${summary.transitiveOrUnmatchedVulnerablePackages || 0}`,
+    `- Lockfiles: ${(summary.lockfiles || []).map((item) => item.file).join(", ") || "none"}`
+  ];
+  if (lightSbom.packageManagerPolicy) {
+    lines.push(`- Package manager policy: ${lightSbom.packageManagerPolicy.status}`);
+    lines.push(`- Package manager guidance: ${lightSbom.packageManagerPolicy.guidance}`);
+  }
+  const risks = lightSbom.topRisk || [];
+  if (risks.length) {
+    lines.push("- Top risk:");
+    for (const item of risks.slice(0, 8)) {
+      lines.push(`  - ${item.name}: ${item.severity}; ${item.priority}/${item.score}; ${item.directDependency ? "direct" : "transitive-or-unmatched"}${item.version ? `; ${item.version}` : ""}`);
+    }
+  }
+  const hints = lightSbom.dependencyChangeHints || [];
+  if (hints.length) {
+    lines.push("- Dependency change hints:");
+    for (const hint of hints.slice(0, 6)) {
+      const risk = hint.riskPackages?.length ? `; risk: ${hint.riskPackages.map((pkg) => pkg.name).join(", ")}` : "";
+      const lockfiles = hint.lockfiles?.length ? `; lockfiles: ${hint.lockfiles.map((item) => item.file).join(", ")}` : "";
+      lines.push(`  - ${hint.manifest}: ${hint.ecosystem}/${hint.manager}; ${hint.packages} packages${risk}${lockfiles}`);
+    }
+  }
+  return lines;
+}
+
 function securityLines(security = {}) {
   if (!security.enabled) return ["- Mode: basic", "- Security scan is disabled. Run `aienvmp sync --security` when vulnerability context is needed."];
   const summary = security.summary || {};