aienvmp 0.1.42 → 0.1.43

package/BUGFIXES.md

@@ -40,6 +40,12 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: `doctor --json` now exposes `exitBehavior`, and enforcement gate metadata explains when strict mode sets a failure exit code.
 - Verification: Windows and macOS candidate smoke checks confirmed default `doctor --json` exits successfully while `doctor --strict policy --json` fails on matching policy warnings.
 
+### Record follow-up loop needed platform verification
+
+- Issue: dependency/security records need to guide the next AI back through sync, status, and handoff without forcing operations.
+- Fix: `record` timeline entries now include follow-up metadata, and status/context/dashboard surface unresolved follow-ups.
+- Verification: Windows and macOS candidate smoke checks confirmed `record --target dependency` appears in `status --json` followUps and the dashboard Follow-ups card.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.43
+
+- Added follow-up metadata to `record` timeline entries so dependency/security changes point agents back to sync, status, and handoff.
+- Added timeline follow-up summarization so unresolved dependency/security records can be surfaced consistently.
+- Surfaced pending follow-ups in status/preflight and context outputs.
+- Added a dashboard Follow-ups card for unresolved env/SBOM record refresh work.
+- Updated the README change loop to show record, sync, status, and handoff as one simple continuation flow.
+- Documented Windows/macOS candidate verification for the record follow-up loop.
+
 ## 0.1.42
 
 - Added explicit enforcement gate metadata so AI and CI consumers know local checks are warn-only unless `--strict` or `--ci` is requested.

package/README.md

@@ -24,6 +24,8 @@ Before environment changes:
 ```bash
 npx aienvmp intent --actor agent:codex --action "change dependency" --target dependency
 npx aienvmp record --actor agent:codex --summary "dependency-change" --target dependency
+npx aienvmp sync
+npx aienvmp status --write
 npx aienvmp handoff --record --actor agent:codex
 ```
 
@@ -49,6 +51,7 @@ AIENV.md                 # Markdown env map for AI agents
 - `status.json.nextAgent` tells the next AI what to read and whether to review first.
 - `dependencyReadSet` lists manifests and lockfiles before package or security changes.
 - `coordination.conflictTargets` shows where multiple agents are planning changes.
+- `followUps` shows records that still need `sync`, `status`, or `handoff`.
 - `handoff` carries dependency read-set and protocol guidance for the next AI.
 - Light SBOM includes source/confidence hints; verify security claims with dedicated scanners.
 - `enforcementProfile.gate` explains when checks warn, fail, and set exit codes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.42",
+  "version": "0.1.43",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/context.js

@@ -21,12 +21,13 @@ export async function contextWorkspace(args) {
   const decision = aiDecision(warnings, intents);
   const actions = recommendedActions(manifest, { warnings, intents });
   const stepSummary = compactStepSummary(buildPlan(manifest, warnings, intents, policy));
-  const preflight = buildPreflight(manifest, warnings, intents);
+  const preflight = buildPreflight(manifest, warnings, intents, timeline);
   if (args.json) {
     console.log(JSON.stringify({
       status: warnings.length ? "review-required" : "clear",
       preflight,
       coordination: preflight.coordination,
+      followUps: preflight.followUps,
       decision,
       enforcement: enforcementAdvice(warnings),
       recommendedActions: actions,

package/src/commands/dash.js

@@ -24,7 +24,7 @@ export async function dashWorkspace(args) {
   const planEnvironment = await detectedPlanEnvironment(dir);
   const html = renderDashboard({
     ...manifest,
-    preflight: buildPreflight(manifest, warnings, intents),
+    preflight: buildPreflight(manifest, warnings, intents, timeline),
     recommendedActions: recommendedActions(manifest, { warnings, intents }),
     planArtifacts,
     planRemediation,

package/src/commands/handoff.js

@@ -46,7 +46,7 @@ async function recordHandoff(file, handoff, actor) {
 export function buildHandoff(manifest, timeline = [], warnings = [], intents = [], policy = {}) {
   const reviewRequired = warnings.length > 0 || intents.length > 0;
   const actions = recommendedActions(manifest, { warnings, intents });
-  const preflight = buildPreflight(manifest, warnings, intents);
+  const preflight = buildPreflight(manifest, warnings, intents, timeline);
   return {
     status: reviewRequired ? "review-required" : "clear",
     trust: manifest.trust || {},

package/src/commands/plan.js

@@ -18,7 +18,7 @@ export async function planWorkspace(args) {
   const intents = openIntents(await readJsonl(intentsPath(dir)));
   const policy = await loadPolicy(dir);
   const warnings = [...diagnose(manifest, { timeline, intents }), ...policyWarnings(manifest, policy)];
-  const plan = buildPlan(manifest, warnings, intents, policy);
+  const plan = buildPlan(manifest, warnings, intents, policy, timeline);
 
   if (args.write) {
     await writeJson(planJsonPath(dir), plan);
@@ -33,14 +33,14 @@ export async function planWorkspace(args) {
   return plan;
 }
 
-export function buildPlan(manifest, warnings = [], intents = [], policy = {}) {
+export function buildPlan(manifest, warnings = [], intents = [], policy = {}, timeline = []) {
   const actions = recommendedActions(manifest, { warnings, intents });
   const status = warnings.length || intents.length ? "review-required" : "clear";
   return {
     schemaVersion: 1,
     generatedAt: new Date().toISOString(),
     status,
-    preflight: buildPreflight(manifest, warnings, intents),
+    preflight: buildPreflight(manifest, warnings, intents, timeline),
     workspace: manifest.workspace || {},
     trust: manifest.trust || {},
     decision: aiDecision(warnings, intents),

package/src/commands/record.js

@@ -18,12 +18,37 @@ export async function recordWorkspace(args) {
     after: args.after || "",
     evidence: args.evidence || "",
     requiresReview,
+    followUp: followUpForRecord({ target: args.target, summary }),
     trust: changedTrust(now, requiresReview)
   };
   await appendJsonLine(timelinePath(dir), entry);
   console.log(`recorded ${entry.type} by ${actor}`);
 }
 
+export function followUpForRecord(record = {}) {
+  const target = String(record.target || "").toLowerCase();
+  const text = `${record.summary || ""} ${target}`.toLowerCase();
+  const isDependency = ["dependency", "package", "lockfile", "vulnerab", "security", "npm", "pnpm", "yarn", "pip", "uv"].some((item) => text.includes(item));
+  const isEnvironment = isDependency || ["node", "python", "docker", "runtime", "package-manager", "global"].some((item) => text.includes(item));
+  if (!isEnvironment) return {
+    required: false,
+    reason: "No environment follow-up detected.",
+    commands: []
+  };
+  return {
+    required: true,
+    target: isDependency ? "dependency" : target || "environment",
+    reason: isDependency
+      ? "Dependency or security records should refresh the env map and handoff context."
+      : "Environment records should refresh the env map and handoff context.",
+    commands: [
+      "aienvmp sync",
+      "aienvmp status --write",
+      "aienvmp handoff --record --actor agent:id"
+    ]
+  };
+}
+
 function required(value, name) {
   if (!value) throw new Error(`record: --${name} is required`);
   return String(value);

package/src/commands/status.js

@@ -15,7 +15,7 @@ export async function statusWorkspace(args) {
   const timeline = await readTimeline(timelinePath(dir));
   const intents = openIntents(await readJsonl(intentsPath(dir)));
   const warnings = [...diagnose(manifest, { timeline, intents }), ...policyWarnings(manifest, policy)];
-  const status = buildStatus(manifest, warnings, intents);
+  const status = buildStatus(manifest, warnings, intents, timeline);
   const artifact = args.write ? await writeStatusArtifact(dir, status) : "";
   const output = artifact ? { ...status, artifact } : status;
   if (args.json) {
@@ -39,6 +39,6 @@ export async function writeStatusArtifact(dir, status) {
   return out;
 }
 
-export function buildStatus(manifest = {}, warnings = [], intents = []) {
-  return buildPreflight(manifest, warnings, intents);
+export function buildStatus(manifest = {}, warnings = [], intents = [], timeline = []) {
+  return buildPreflight(manifest, warnings, intents, timeline);
 }

package/src/contract.js

@@ -4,7 +4,7 @@ export function preflightContract() {
     version: 1,
     stability: "additive",
     requiredFields: ["schemaVersion", "state", "decision", "quickstart", "commands", "artifacts"],
-    aiEntryFields: ["state", "summary", "nextAgent", "coordination", "dependencyReadSet", "dependencyChangeProtocol"],
+    aiEntryFields: ["state", "summary", "nextAgent", "coordination", "followUps", "dependencyReadSet", "dependencyChangeProtocol"],
     rule: "Consumers should ignore unknown fields and treat missing optional fields as unavailable."
   };
 }

package/src/preflight.js

@@ -2,8 +2,9 @@ import { recommendedActions } from "./actions.js";
 import { aiDecision } from "./decision.js";
 import { enforcementAdvice, enforcementGate } from "./enforcement.js";
 import { preflightContract } from "./contract.js";
+import { pendingFollowUps } from "./timeline.js";
 
-export function buildPreflight(manifest = {}, warnings = [], intents = []) {
+export function buildPreflight(manifest = {}, warnings = [], intents = [], timeline = []) {
   const decision = aiDecision(warnings, intents);
   const enforcement = enforcementAdvice(warnings);
   const actions = recommendedActions(manifest, { warnings, intents });
@@ -13,6 +14,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = []) {
   const dependencyReadSet = dependencyPreflightReadSet(manifest);
   const dependencyChangeProtocol = dependencyProtocol(manifest, dependencyReadSet);
   const coordination = coordinationSummary(intents);
+  const followUps = pendingFollowUps(timeline);
   return {
     schemaVersion: 1,
     contract: preflightContract(),
@@ -53,6 +55,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = []) {
     quickstart: agentQuickstart(decision.reviewRequired),
     nextAgent: nextAgentHint(state, dependencyReadSet, dependencyChangeProtocol),
     coordination,
+    followUps,
     intentTargets,
     dependencyReadSet,
     dependencyChangeProtocol,

package/src/render.js

@@ -173,6 +173,9 @@ export function renderContext(manifest, timeline = [], warnings = [], intents =
     "Enforcement gate:",
     ...enforcementGateLines(manifest.preflight?.enforcementProfile?.gate),
     "",
+    "Follow-ups:",
+    ...followUpLines(manifest.preflight?.followUps),
+    "",
     "Open intents:",
     ...(intents.length ? intents.slice(-5).reverse().map((i) => `- ${i.actor}: ${i.action}`) : ["- none"]),
     "",
@@ -309,6 +312,14 @@ function enforcementGateLines(gate = {}) {
   ];
 }
 
+function followUpLines(followUps = []) {
+  if (!followUps.length) return ["- none"];
+  return followUps.slice(0, 5).map((item) => {
+    const command = item.commands?.[0] ? ` (${item.commands[0]})` : "";
+    return `- ${item.target || "environment"}: ${item.summary || item.reason || "follow-up required"}${command}`;
+  });
+}
+
 function environmentLines(item) {
   return [
     `- ${item.category}: ${item.summary}`,
@@ -435,6 +446,8 @@ const contract=manifest.preflight?.contract||{};
 const contractHtml=contract.name?\`<table><tr><th>Name</th><td><code>\${esc(contract.name)}</code></td></tr><tr><th>Version</th><td><code>\${esc(contract.version||1)}</code></td></tr><tr><th>Stability</th><td><code>\${esc(contract.stability||'additive')}</code></td></tr><tr><th>AI fields</th><td>\${esc((contract.aiEntryFields||[]).join(', ')||'none')}</td></tr></table><div class="path">\${esc(contract.rule||'Ignore unknown fields.')}</div>\`:'<div class="okline">Run <code>aienvmp status --write</code> to include AI contract metadata.</div>';
 const intentTargets=manifest.preflight?.intentTargets||[];
 const intentTargetsHtml=intentTargets.length?'<div class="timeline">'+intentTargets.slice(0,5).map(t=>\`<div class="event"><time>\${esc(t.target)}</time><div><b>\${esc(t.target)}</b> \${esc(t.reason||'Record this target before environment changes.')}\${t.command?\`<div class="path">\${esc(t.command)}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No specific target recommendation. Use <code>aienvmp intent --actor agent:id --action planned-change</code>.</div>';
+const followUps=manifest.preflight?.followUps||[];
+const followUpsHtml=followUps.length?'<div class="timeline">'+followUps.slice(0,5).map(f=>\`<div class="event"><time>\${esc(f.target||'env')}</time><div><b>\${esc(f.summary||'follow-up')}</b> \${esc(f.reason||'Refresh shared context.')}\${f.commands?.length?\`<div class="path">\${esc(f.commands.join(' -> '))}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No pending follow-ups after environment records.</div>';
 const dependencyReadSet=manifest.preflight?.dependencyReadSet||[];
 const dependencyReadSetHtml=dependencyReadSet.length?'<div class="timeline">'+dependencyReadSet.slice(0,5).map(d=>\`<div class="event"><time>\${esc(d.ecosystem||'deps')}</time><div><b>\${esc(d.manifest||'dependency files')}</b> <code>\${esc(d.manager||'unknown')}</code><div class="path">\${esc([d.manifest,...(d.lockfiles||[])].filter(Boolean).join(', '))}</div>\${d.riskPackages?.length?\`<div class="path">risk: \${esc(d.riskPackages.join(', '))}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No dependency files detected.</div>';
 const dependencyProtocol=manifest.preflight?.dependencyChangeProtocol||{};
@@ -489,6 +502,8 @@ document.getElementById('app').innerHTML=\`
     <div style="height:14px"></div>
     \${card('AI Intent Targets','<span class="pill">'+intentTargets.length+' targets</span>',intentTargetsHtml)}
     <div style="height:14px"></div>
+    \${card('Follow-ups',followUps.length?'<span class="pill warn">'+followUps.length+' pending</span>':'<span class="pill">clear</span>',followUpsHtml)}
+    <div style="height:14px"></div>
     \${card('AI Contract','<span class="pill">'+(contract.stability||'additive')+'</span>',contractHtml)}
     <div style="height:14px"></div>
     \${card('Dependency Read Set','<span class="pill">'+dependencyReadSet.length+' files</span>',dependencyReadSetHtml)}

package/src/timeline.js

@@ -44,3 +44,26 @@ export function newIntentID(now = new Date()) {
   const entropy = Math.random().toString(36).slice(2, 8);
   return `int_${time}_${entropy}`;
 }
+
+export function pendingFollowUps(timeline = []) {
+  const lastSync = [...timeline].reverse().find((item) => item.type === "sync" || item.type === "detected-change");
+  const lastHandoff = [...timeline].reverse().find((item) => item.type === "agent-handoff");
+  const lastSyncAt = lastSync ? new Date(lastSync.at).getTime() : 0;
+  const lastHandoffAt = lastHandoff ? new Date(lastHandoff.at).getTime() : 0;
+  return timeline
+    .filter((item) => item.followUp?.required)
+    .filter((item) => {
+      const at = new Date(item.at).getTime();
+      return at > lastSyncAt || at > lastHandoffAt;
+    })
+    .slice(-5)
+    .reverse()
+    .map((item) => ({
+      at: item.at,
+      actor: item.actor || "unknown",
+      target: item.followUp.target || item.target || "environment",
+      summary: item.summary || item.type || "environment record",
+      reason: item.followUp.reason || "Follow-up is required.",
+      commands: item.followUp.commands || []
+    }));
+}