aienvmp 0.1.37 → 0.1.39

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.39
+
+- Added a dependency read set to preflight, `AIENV.md`, and the dashboard so agents know which manifests and lockfiles to read before package or security changes.
+- Added an advisory dependency change protocol so agents follow the same intent, refresh, record, and handoff flow for package/security edits.
+- Surfaced the dependency change protocol in `plan.md` so human-readable plans match the AI preflight contract.
+- Pointed security remediation recommendations at the dependency intent workflow instead of a generic context read.
+- Treated dependency records and package/security intents as coordination signals for stale handoff and multi-agent conflict warnings.
+- Added CLI regression coverage for `context --dir <workspace> --json` so remote and CI agents can safely inspect another workspace.
+- Allowed `--dir <workspace>` before the command, so AI and CI agents can use either global-style or command-style workspace targeting.
+
+## 0.1.38
+
+- Added a 10-second AI quickstart flow to the shared preflight contract and status output.
+- Added preflight intent target recommendations so agents can record runtime, package manager, dependency, Docker, or coordination changes consistently.
+- Surfaced AI intent target recommendations in the dashboard so humans can review the same target guidance.
+- Added the same quickstart and intent target guidance to `AIENV.md` so Markdown-first agents receive the current preflight.
+- Aligned AGENTS/Claude/Gemini pointer snippets with the same status-first, target-aware AI flow.
+
 ## 0.1.37
 
 - Added `lightSbom` to the manifest as an AI-ready package and vulnerability summary.

package/README.md

@@ -22,6 +22,9 @@ npx aienvmp plan
 npx aienvmp handoff
 ```
 
+10-second AI flow: `aienvmp status --write` -> `aienvmp context --json` -> intent before environment changes.
+Use `--dir <workspace>` before or after the command when an AI or CI process runs outside the target project.
+
 Optional deeper read-only checks:
 
 ```bash
@@ -49,13 +52,20 @@ AIENV.md
 .aienvmp/intents.jsonl
 .aienvmp/timeline.jsonl
 .aienvmp/plan.json
-.aienvmp/plan.md
+.aienvmp/plan.md             # read-only plan with dependency protocol
 .aienvmp/dashboard.html     # includes dependencies, plan, remediation, and environment cards
 ```
 
+`AIENV.md` includes the 10-second AI flow and recommended intent targets for Markdown-first agents.
+
 Trust states are machine-readable: `observed`, `planned`, `changed`, `review`, `verified`, `stale`.
 `status.json` also lists AI read order, artifact paths, and safe commands.
 `status`, `context`, `plan`, and `handoff` share the same AI preflight contract.
+Preflight also recommends the intent target, so agents do not guess between runtime, package manager, dependency, Docker, or coordination changes.
+It also lists dependency manifests and lockfiles to read before package or security changes.
+Dependency and security changes stay advisory: record dependency intent, refresh with `sync`, then record what changed.
+Dependency records also trigger handoff/coordination warnings for the next agent.
+The dashboard shows the same intent target guidance for human review.
 
 AI agents can observe, plan, and record. Only a human or CI should mark environment facts as verified.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/actions.js

@@ -51,9 +51,9 @@ function securityActions(security = {}) {
     highRisk ? "high" : "medium",
     "security",
     packageHints.length
-      ? `Review vulnerable packages before dependency or deployment changes: ${packageHints.join("; ")}.`
-      : "Review vulnerability summary before dependency or deployment changes.",
-    "aienvmp context --json"
+      ? `Review dependency read set and protocol before remediation: ${packageHints.join("; ")}.`
+      : "Review dependency read set and protocol before vulnerability remediation.",
+    "aienvmp intent --actor agent:id --action planned-change --target dependency"
   )];
 }
 

package/src/cli.js

@@ -34,9 +34,10 @@ const commands = new Map([
 ]);
 
 const version = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+const globalValueOptions = new Set(["--dir"]);
 
 export async function main(argv) {
-  const [command, ...rest] = argv;
+  const { command, rest, globalArgs } = splitCommand(argv);
   if (command === "-v" || command === "--version" || command === "version") {
     console.log(version);
     return;
@@ -50,7 +51,30 @@ export async function main(argv) {
     printUsage();
     throw new Error(`unknown command "${command}"`);
   }
-  await run(parseArgs(rest));
+  await run({ ...globalArgs, ...parseArgs(rest) });
+}
+
+function splitCommand(argv) {
+  const leading = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith("--")) {
+      return {
+        command: arg,
+        rest: argv.slice(i + 1),
+        globalArgs: parseArgs(leading)
+      };
+    }
+    leading.push(arg);
+    if (!arg.includes("=") && globalValueOptions.has(arg) && argv[i + 1] && !argv[i + 1].startsWith("--")) {
+      leading.push(argv[++i]);
+    }
+  }
+  return {
+    command: argv[0],
+    rest: [],
+    globalArgs: parseArgs(leading)
+  };
 }
 
 export function parseArgs(argv) {

package/src/commands/compile.js

@@ -5,6 +5,7 @@ import { openIntents, readJsonl, readTimeline } from "../timeline.js";
 import { aiEnvPath, intentsPath, manifestPath, timelinePath, workspaceDir } from "../paths.js";
 import { renderAIEnv } from "../render.js";
 import { loadPolicy, policyWarnings } from "../policy.js";
+import { buildPreflight } from "../preflight.js";
 
 export async function compileWorkspace(args) {
   const dir = workspaceDir(args);
@@ -14,7 +15,10 @@ export async function compileWorkspace(args) {
   const intents = openIntents(await readJsonl(intentsPath(dir)));
   const policy = await loadPolicy(dir);
   const warnings = [...diagnose(manifest, { timeline, intents }), ...policyWarnings(manifest, policy)];
-  const rendered = renderAIEnv(manifest, timeline, warnings, intents, policy);
+  const rendered = renderAIEnv({
+    ...manifest,
+    preflight: buildPreflight(manifest, warnings, intents)
+  }, timeline, warnings, intents, policy);
   await fs.writeFile(aiEnvPath(dir), rendered, "utf8");
   if (!args.quiet) {
     console.log(`compiled ${aiEnvPath(dir)}`);

package/src/commands/status.js

@@ -23,6 +23,8 @@ export async function statusWorkspace(args) {
   } else if (!args.quiet) {
     console.log(`${output.state}: ${output.summary}`);
     console.log(`next: ${output.nextCommand}`);
+    console.log(`ai: ${output.quickstart.readFirst} -> ${output.quickstart.detailCommand}`);
+    console.log(`intent: ${output.intentTargets[0]?.command || output.commands.recordIntent}`);
     console.log(`strict: ${output.enforcement.recommendedCommand}`);
     if (artifact) console.log(`status: ${artifact}`);
   }

package/src/doctor.js

@@ -110,17 +110,23 @@ export function handoffWarnings(timeline = []) {
 
 function inferTarget(action = "") {
   const normalized = String(action).toLowerCase();
-  for (const target of ["node", "python", "docker", "npm", "pnpm", "yarn", "uv", "pip", "pipx"]) {
+  for (const target of ["dependency", "node", "python", "docker", "npm", "pnpm", "yarn", "uv", "pip", "pipx"]) {
     if (normalized.includes(target)) return target;
   }
+  if (normalized.includes("package") || normalized.includes("lockfile") || normalized.includes("vulnerab")) return "dependency";
   return "";
 }
 
 function isEnvironmentChange(item = {}) {
-  if (["runtime", "package-manager", "container"].includes(item.change?.scope)) return true;
+  if (["runtime", "package-manager", "container", "dependency"].includes(item.change?.scope)) return true;
   if (item.type === "detected-change") return false;
   const text = `${item.type || ""} ${item.target || ""} ${item.summary || ""} ${item.action || ""} ${item.change?.scope || ""} ${item.change?.key || ""}`.toLowerCase();
   return [
+    "dependency",
+    "dependencies",
+    "package",
+    "lockfile",
+    "vulnerability",
     "runtime",
     "node",
     "python",

package/src/preflight.js

@@ -8,6 +8,9 @@ export function buildPreflight(manifest = {}, warnings = [], intents = []) {
   const actions = recommendedActions(manifest, { warnings, intents });
   const state = decision.reviewRequired ? "review-required" : "clear";
   const topAction = actions[0] || null;
+  const intentTargets = recommendedIntentTargets(manifest, warnings, intents);
+  const dependencyReadSet = dependencyPreflightReadSet(manifest);
+  const dependencyChangeProtocol = dependencyProtocol(manifest, dependencyReadSet);
   return {
     schemaVersion: 1,
     state,
@@ -43,6 +46,10 @@ export function buildPreflight(manifest = {}, warnings = [], intents = []) {
       projectLocalWork: decision.canContinueProjectLocalWork ? "allowed" : "review-first",
       environmentChanges: decision.canChangeEnvironmentWithoutReview ? "allowed" : "intent-and-review-first"
     },
+    quickstart: agentQuickstart(decision.reviewRequired),
+    intentTargets,
+    dependencyReadSet,
+    dependencyChangeProtocol,
     artifacts: preflightArtifacts(),
     readOrder: [
       ".aienvmp/status.json",
@@ -58,13 +65,152 @@ export function buildPreflight(manifest = {}, warnings = [], intents = []) {
       context: "aienvmp context --json",
       plan: "aienvmp plan --write",
       handoff: "aienvmp handoff --record --actor agent:id",
-      recordIntent: "aienvmp intent --actor agent:id --action planned-change"
+      recordIntent: intentTargets[0]?.command || "aienvmp intent --actor agent:id --action planned-change"
     },
     topAction,
     nextCommand: topAction?.command || decision.nextCommand
   };
 }
 
+function dependencyProtocol(manifest = {}, dependencyReadSet = []) {
+  const pmPolicy = manifest.lightSbom?.packageManagerPolicy || {};
+  return {
+    mode: "advisory",
+    appliesWhen: "Before package, lockfile, or vulnerability remediation changes.",
+    packageManagerPolicy: pmPolicy.status || "not-detected",
+    beforeChange: [
+      "Read dependencyReadSet manifests and lockfiles.",
+      "Check lightSbom.packageManagerPolicy before choosing npm, pnpm, yarn, pip, uv, or another manager.",
+      "Record dependency intent before edits."
+    ],
+    commands: {
+      readContext: "aienvmp context --json",
+      recordIntent: "aienvmp intent --actor agent:id --action planned-change --target dependency",
+      refreshAfterChange: "aienvmp sync",
+      recordAfterChange: "aienvmp record --actor agent:id --summary dependency-change --target dependency",
+      handoff: "aienvmp handoff --record --actor agent:id"
+    },
+    mustNotDo: [
+      "Do not switch package managers because another lockfile exists without user approval.",
+      "Do not delete lockfiles or rewrite dependency manifests only to satisfy a tool preference.",
+      "Do not run automatic fix commands without reviewing the dependency read set first."
+    ],
+    readSetCount: dependencyReadSet.length
+  };
+}
+
+function dependencyPreflightReadSet(manifest = {}) {
+  const hints = manifest.lightSbom?.dependencyChangeHints || [];
+  const readSet = hints.map((hint) => ({
+    manifest: hint.manifest,
+    ecosystem: hint.ecosystem || "unknown",
+    manager: hint.manager || "unknown",
+    groups: hint.groups || [],
+    lockfiles: (hint.lockfiles || []).map((item) => item.file).filter(Boolean),
+    riskPackages: (hint.riskPackages || []).map((item) => item.name).filter(Boolean).slice(0, 5),
+    reason: hint.riskPackages?.length
+      ? "Read before dependency or security remediation; vulnerable packages are linked to this manifest."
+      : "Read before dependency changes; this manifest defines project packages."
+  }));
+  if (readSet.length) return readSet.slice(0, 8);
+
+  const manifests = manifest.lightSbom?.summary?.manifests || manifest.dependencySnapshot?.manifests || [];
+  const lockfiles = (manifest.lightSbom?.summary?.lockfiles || manifest.dependencySnapshot?.lockfiles || [])
+    .map((item) => item.file || item)
+    .filter(Boolean);
+  if (!manifests.length && !lockfiles.length) return [];
+  return [{
+    manifest: manifests[0] || "",
+    ecosystem: "unknown",
+    manager: "unknown",
+    groups: [],
+    lockfiles,
+    riskPackages: [],
+    reason: "Read detected dependency files before package changes."
+  }];
+}
+
+function recommendedIntentTargets(manifest = {}, warnings = [], intents = []) {
+  const targets = [];
+  for (const warning of warnings) {
+    addTarget(targets, targetFromWarning(warning), warning.message || warning.code, warning.code);
+  }
+  for (const intent of intents) {
+    addTarget(targets, intent.target || targetFromText(intent.action), `Open intent from ${intent.actor || "unknown"}.`, "open-intent");
+  }
+  const pmPolicy = manifest.lightSbom?.packageManagerPolicy;
+  if (pmPolicy?.status === "review-required") {
+    addTarget(targets, "package-manager", pmPolicy.guidance, "package-manager-policy");
+  }
+  if (Number(manifest.security?.summary?.total || 0) > 0) {
+    addTarget(targets, "dependency", "Security findings are dependency-related; record dependency intent before remediation.", "security");
+  }
+  if (Number(manifest.dependencySnapshot?.summary?.packages || 0) > 0) {
+    addTarget(targets, "dependency", "Dependency manifests detected; use this target before package changes.", "dependency-snapshot");
+  }
+  if (!targets.length) {
+    addTarget(targets, "environment", "Default target when the change affects runtime, dependency, container, or global tool state.", "default");
+  }
+  return targets.slice(0, 5).map((item) => ({
+    ...item,
+    command: `aienvmp intent --actor agent:id --action planned-change --target ${item.target}`
+  }));
+}
+
+function addTarget(targets, target, reason, source) {
+  const normalized = normalizeTarget(target);
+  if (!normalized) return;
+  const existing = targets.find((item) => item.target === normalized);
+  if (existing) {
+    if (source && !existing.sources.includes(source)) existing.sources.push(source);
+    return;
+  }
+  targets.push({ target: normalized, reason: reason || "Environment change target.", sources: source ? [source] : [] });
+}
+
+function targetFromWarning(warning = {}) {
+  if (warning.target) return warning.target;
+  const code = warning.code || "";
+  if (code.includes("node")) return "node";
+  if (code.includes("python")) return "python";
+  if (code.includes("docker")) return "docker";
+  if (code.includes("lockfile") || code.includes("package-manager")) return "package-manager";
+  if (code.includes("security")) return "dependency";
+  if (code.includes("intent") || code.includes("handoff")) return "coordination";
+  return targetFromText(`${warning.message || ""} ${code}`);
+}
+
+function targetFromText(text = "") {
+  const normalized = String(text).toLowerCase();
+  for (const target of ["node", "python", "docker", "package-manager", "dependency", "npm", "pnpm", "yarn", "uv", "pip", "pipx"]) {
+    if (normalized.includes(target)) return target;
+  }
+  if (normalized.includes("package manager") || normalized.includes("lockfile")) return "package-manager";
+  if (normalized.includes("vulnerab") || normalized.includes("package")) return "dependency";
+  return "";
+}
+
+function normalizeTarget(target = "") {
+  const normalized = String(target).trim().toLowerCase();
+  if (["npm", "pnpm", "yarn"].includes(normalized)) return "package-manager";
+  if (["pip", "pipx", "uv"].includes(normalized)) return "python";
+  return normalized;
+}
+
+function agentQuickstart(reviewRequired) {
+  return {
+    label: "10-second AI flow",
+    readFirst: "aienvmp status --write",
+    detailCommand: "aienvmp context --json",
+    beforeEnvironmentChange: "aienvmp intent --actor agent:id --action planned-change --target <runtime|package-manager|docker|dependency>",
+    afterEnvironmentChange: "aienvmp sync && aienvmp record --actor agent:id --summary what-changed",
+    handoff: "aienvmp handoff --record --actor agent:id",
+    rule: reviewRequired
+      ? "Review warnings or open intents before environment changes; project-local work may continue."
+      : "Continue project-local work; record intent before environment changes."
+  };
+}
+
 export function preflightArtifacts() {
   return {
     status: ".aienvmp/status.json",

package/src/render.js

@@ -16,6 +16,7 @@ export function renderAIEnv(manifest, timeline = [], warnings = [], intents = []
   lines.push("5. After environment changes, run `aienvmp sync`.");
   lines.push("6. Record what changed with `aienvmp record --actor agent:id --summary what-changed`.");
   lines.push("7. At handoff, run `aienvmp handoff --record --actor agent:id`.", "");
+  lines.push(...preflightLines(manifest.preflight), "");
   lines.push("## Current Policy", "");
   lines.push(...policyLines(policy));
   lines.push("- Enforcement: non-blocking by default; warnings require review but do not lock the machine.");
@@ -69,6 +70,50 @@ export function renderAIEnv(manifest, timeline = [], warnings = [], intents = []
   return lines.join("\n");
 }
 
+function preflightLines(preflight = {}) {
+  const quickstart = preflight.quickstart;
+  const targets = preflight.intentTargets || [];
+  const lines = ["## 10-Second AI Flow", ""];
+  if (quickstart) {
+    lines.push(`- Read first: \`${quickstart.readFirst}\``);
+    lines.push(`- Detail: \`${quickstart.detailCommand}\``);
+    lines.push(`- Before env change: \`${quickstart.beforeEnvironmentChange}\``);
+    lines.push(`- After env change: \`${quickstart.afterEnvironmentChange}\``);
+    lines.push(`- Handoff: \`${quickstart.handoff}\``);
+    lines.push(`- Rule: ${quickstart.rule}`);
+  } else {
+    lines.push("- Run `aienvmp status --write`, then `aienvmp context --json` before environment changes.");
+  }
+  lines.push("", "## Recommended Intent Targets", "");
+  if (targets.length) {
+    for (const target of targets.slice(0, 5)) {
+      lines.push(`- ${target.target}: \`${target.command}\` - ${target.reason}`);
+    }
+  } else {
+    lines.push("- environment: `aienvmp intent --actor agent:id --action planned-change --target environment`");
+  }
+  const dependencyReadSet = preflight.dependencyReadSet || [];
+  if (dependencyReadSet.length) {
+    lines.push("", "## Dependency Read Set", "");
+    for (const item of dependencyReadSet.slice(0, 5)) {
+      const files = [item.manifest, ...(item.lockfiles || [])].filter(Boolean).join(", ");
+      const risk = item.riskPackages?.length ? `; risk: ${item.riskPackages.join(", ")}` : "";
+      lines.push(`- ${files}: ${item.ecosystem}/${item.manager}${risk} - ${item.reason}`);
+    }
+  }
+  const dependencyProtocol = preflight.dependencyChangeProtocol;
+  if (dependencyProtocol) {
+    lines.push("", "## Dependency Change Protocol", "");
+    lines.push(`- Mode: ${dependencyProtocol.mode}`);
+    lines.push(`- Package manager policy: ${dependencyProtocol.packageManagerPolicy}`);
+    lines.push(`- Intent: \`${dependencyProtocol.commands.recordIntent}\``);
+    lines.push(`- After change: \`${dependencyProtocol.commands.refreshAfterChange}\` then \`${dependencyProtocol.commands.recordAfterChange}\``);
+    lines.push(`- Handoff: \`${dependencyProtocol.commands.handoff}\``);
+    for (const item of dependencyProtocol.mustNotDo.slice(0, 3)) lines.push(`- Must not: ${item}`);
+  }
+  return lines;
+}
+
 export function renderAgentPointer(target = "agents") {
   const label = target === "claude" ? "Claude" : target === "gemini" ? "Gemini" : "AI agents";
   return `## aienvmp Environment Map
@@ -77,12 +122,12 @@ ${label} should use \`aienvmp\` as the workspace environment source of truth.
 
 Before changing runtimes, package managers, Docker settings, global packages, or environment policy:
 
-1. Run \`aienvmp context\`.
-2. Read \`AIENV.md\`.
-3. If the context says \`review-required\`, ask the user before changing the environment.
-4. Record planned environment changes with \`aienvmp intent\`.
-5. After environment changes, run \`aienvmp sync\`.
-6. Record what changed with \`aienvmp record\`.
+1. Run \`aienvmp status --write\`.
+2. Run \`aienvmp context --json\` for details.
+3. Read \`AIENV.md\`.
+4. If status or context says \`review-required\`, ask the user before changing the environment.
+5. Record planned environment changes with the recommended target, for example \`aienvmp intent --actor agent:id --action planned-change --target dependency\`.
+6. After environment changes, run \`aienvmp sync\` and \`aienvmp record --actor agent:id --summary what-changed\`.
 7. At handoff, run \`aienvmp handoff --record --actor agent:id\`.
 
 \`aienvmp\` does not replace this instruction file. It provides the live env map, lightweight runtime SBOM, intent log, timeline, and dashboard.`;
@@ -192,6 +237,9 @@ export function renderPlan(plan) {
     "Review gates:",
     ...plan.reviewGates.map((item) => `- ${item}`),
     "",
+    "Dependency protocol:",
+    ...dependencyProtocolPlanLines(plan.preflight?.dependencyChangeProtocol),
+    "",
     "Remediation steps:",
     ...(plan.remediationSteps?.length ? plan.remediationSteps.slice(0, 5).flatMap(remediationLines) : ["- none"]),
     "",
@@ -205,6 +253,17 @@ export function renderPlan(plan) {
   return lines.join("\n");
 }
 
+function dependencyProtocolPlanLines(protocol = {}) {
+  if (!protocol.commands) return ["- none"];
+  return [
+    `- Mode: ${protocol.mode || "advisory"}`,
+    `- Package manager policy: ${protocol.packageManagerPolicy || "not-detected"}`,
+    `- Intent: ${protocol.commands.recordIntent}`,
+    `- After change: ${protocol.commands.refreshAfterChange}; ${protocol.commands.recordAfterChange}`,
+    ...(protocol.mustNotDo || []).slice(0, 3).map((item) => `- Must not: ${item}`)
+  ];
+}
+
 function environmentLines(item) {
   return [
     `- ${item.category}: ${item.summary}`,
@@ -326,6 +385,12 @@ const ciReadinessHtml=ciReadiness.length?'<table>'+ciReadiness.map(s=>\`<tr><th>
 const enforcementProfile=manifest.preflight?.enforcementProfile||{};
 const strictCommands=enforcementProfile.strictCommands||[];
 const enforcementHtml=\`<table><tr><th>Default</th><td><code>\${esc(enforcementProfile.defaultMode||'advisory')}</code></td></tr><tr><th>Local</th><td>\${esc(enforcementProfile.localOperation||'non-blocking')}</td></tr><tr><th>Strict</th><td>\${esc(enforcementProfile.strictUse||'CI or explicit checks only')}</td></tr><tr><th>Recommended</th><td><code>\${esc(enforcementProfile.recommendedStrictCommand||'aienvmp doctor --strict all')}</code></td></tr></table><div class="timeline">\${strictCommands.slice(0,4).map(cmd=>\`<div class="event"><time>CI</time><div><code>\${esc(cmd)}</code></div></div>\`).join('')}</div><div class="path">\${esc(enforcementProfile.reason||'Warnings stay advisory unless strict mode is requested.')}</div>\`;
+const intentTargets=manifest.preflight?.intentTargets||[];
+const intentTargetsHtml=intentTargets.length?'<div class="timeline">'+intentTargets.slice(0,5).map(t=>\`<div class="event"><time>\${esc(t.target)}</time><div><b>\${esc(t.target)}</b> \${esc(t.reason||'Record this target before environment changes.')}\${t.command?\`<div class="path">\${esc(t.command)}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No specific target recommendation. Use <code>aienvmp intent --actor agent:id --action planned-change</code>.</div>';
+const dependencyReadSet=manifest.preflight?.dependencyReadSet||[];
+const dependencyReadSetHtml=dependencyReadSet.length?'<div class="timeline">'+dependencyReadSet.slice(0,5).map(d=>\`<div class="event"><time>\${esc(d.ecosystem||'deps')}</time><div><b>\${esc(d.manifest||'dependency files')}</b> <code>\${esc(d.manager||'unknown')}</code><div class="path">\${esc([d.manifest,...(d.lockfiles||[])].filter(Boolean).join(', '))}</div>\${d.riskPackages?.length?\`<div class="path">risk: \${esc(d.riskPackages.join(', '))}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No dependency files detected.</div>';
+const dependencyProtocol=manifest.preflight?.dependencyChangeProtocol||{};
+const dependencyProtocolHtml=dependencyProtocol.commands?'<table><tr><th>Mode</th><td><code>'+esc(dependencyProtocol.mode||'advisory')+'</code></td></tr><tr><th>Policy</th><td><code>'+esc(dependencyProtocol.packageManagerPolicy||'not-detected')+'</code></td></tr><tr><th>Intent</th><td><code>'+esc(dependencyProtocol.commands.recordIntent)+'</code></td></tr><tr><th>After</th><td><code>'+esc(dependencyProtocol.commands.refreshAfterChange)+'</code> then <code>'+esc(dependencyProtocol.commands.recordAfterChange)+'</code></td></tr></table><div class="timeline">'+(dependencyProtocol.mustNotDo||[]).slice(0,3).map(item=>\`<div class="event"><time>avoid</time><div>\${esc(item)}</div></div>\`).join('')+'</div>':'<div class="okline">No dependency change protocol available.</div>';
 const card=(title,badge,body)=>\`<section class="card"><div class="card-head"><h2>\${title}</h2>\${badge||''}</div>\${body}</section>\`;
 const reviewRequired=warnings.length>0||intents.length>0;
 const recentChanges=timeline.slice(-8).length;
@@ -369,6 +434,12 @@ document.getElementById('app').innerHTML=\`
   <aside>
     \${card('Recommended Actions','<span class="pill">'+actions.length+' actions</span>',actionsHtml)}
     <div style="height:14px"></div>
+    \${card('AI Intent Targets','<span class="pill">'+intentTargets.length+' targets</span>',intentTargetsHtml)}
+    <div style="height:14px"></div>
+    \${card('Dependency Read Set','<span class="pill">'+dependencyReadSet.length+' files</span>',dependencyReadSetHtml)}
+    <div style="height:14px"></div>
+    \${card('Dependency Protocol','<span class="pill">'+(dependencyProtocol.mode||'advisory')+'</span>',dependencyProtocolHtml)}
+    <div style="height:14px"></div>
     \${card('AI Plan Artifacts',plan.markdown||plan.json?'<span class="pill">written</span>':'<span class="pill off">not written</span>',planHtml)}
     <div style="height:14px"></div>
     \${card('Remediation Steps',remediation.length?'<span class="pill warn">'+remediation.length+' items</span>':'<span class="pill off">none</span>',remediationHtml)}