aienvmp 0.1.45 → 0.1.46

package/BUGFIXES.md

@@ -58,6 +58,12 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: `aienvmp checkpoint` now performs the post-change loop and records an explicit sync ledger entry so follow-ups can be closed.
 - Verification: checkpoint tests cover text/JSON output, status artifact refresh, timeline entries, handoff recording, and cleared follow-ups.
 
+### Light SBOM risk required too much parsing
+
+- Issue: AI consumers could see package and vulnerability details, but had to infer risk level and next commands from several nested fields.
+- Fix: `lightSbom.riskSummary` and preflight `sbomRisk` now provide a compact risk score, signals, review targets, and advisory next steps.
+- Verification: tests cover risk scoring, top-risk severity fallback, scanner-off guidance, status/context exposure, dashboard rendering, and recommended actions.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.46
+
+- Added `lightSbom.riskSummary` with compact risk level, score, scanner state, signals, review targets, and next commands.
+- Added `sbomRisk` to the shared AI preflight contract so status/context consumers can read SBOM risk without deep parsing.
+- Surfaced SBOM risk in `context --json`, `AIENV.md`, and the dashboard Light SBOM card.
+- Added recommended actions for read-only security scans and high light-SBOM risk review.
+- Used top-risk package severity as a fallback when scanner summary severity counts are incomplete.
+- Updated dependency change hints to point agents to `aienvmp checkpoint` after accepted dependency changes.
+- Added regression tests for risk scoring, scanner-off guidance, status/context outputs, dashboard rendering, and recommended actions.
+
 ## 0.1.45
 
 - Added `aienvmp checkpoint` as a one-command post-environment-change flow for record, sync, status, and handoff.

package/README.md

@@ -47,6 +47,7 @@ AIENV.md                 # Markdown env map for AI agents
 - `schema --json` prints the stable AI-readable output contract without scanning.
 - `status.json.nextAgent` tells the next AI what to read and whether to review first.
 - `dependencyReadSet` lists manifests and lockfiles before package or security changes.
+- `sbomRisk` gives AI a compact light-SBOM risk level, signals, and next command.
 - `coordination.conflictTargets` shows where multiple agents are planning changes.
 - `agentActivity.multiActorTargets` shows where multiple agents actually recorded env changes.
 - `followUps` shows records that still need `sync`, `status`, or `handoff`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.45",
+  "version": "0.1.46",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/actions.js

@@ -20,6 +20,7 @@ export function recommendedActions(manifest = {}, context = {}) {
   }
 
   actions.push(...securityActions(manifest.security));
+  actions.push(...sbomRiskActions(manifest.lightSbom?.riskSummary));
 
   if (hasRuntimePolicyWarning(warnings)) {
     actions.push(action("review-version-policy", "medium", "runtime", "Detected runtime or package manager policy drift. Prefer project-local version files and ask before global changes."));
@@ -36,6 +37,18 @@ export function recommendedActions(manifest = {}, context = {}) {
   return dedupeActions(actions).slice(0, 8);
 }
 
+function sbomRiskActions(risk = {}) {
+  const actions = [];
+  if (!risk.level) return actions;
+  if (risk.scanner === "off" && risk.vulnerabilityCount === 0) {
+    actions.push(action("scan-sbom-risk", "medium", "security", "Run a read-only security scan before dependency or release decisions.", "aienvmp sync --security"));
+  }
+  if (["urgent", "high"].includes(risk.level)) {
+    actions.push(action("review-sbom-risk", "high", "security", `Review light SBOM risk summary before dependency changes: ${(risk.signals || []).slice(0, 2).join("; ") || risk.level}.`, "aienvmp plan --write"));
+  }
+  return actions;
+}
+
 function securityActions(security = {}) {
   if (!security.enabled) return [];
 

package/src/commands/context.js

@@ -27,6 +27,7 @@ export async function contextWorkspace(args) {
       status: warnings.length ? "review-required" : "clear",
       preflight,
       coordination: preflight.coordination,
+      sbomRisk: preflight.sbomRisk,
       followUps: preflight.followUps,
       decision,
       enforcement: enforcementAdvice(warnings),
@@ -75,6 +76,7 @@ function lightSbomSummary(lightSbom = {}) {
       guidance: "No lockfile policy detected."
     },
     dependencyChangeHints: (lightSbom.dependencyChangeHints || []).slice(0, 8),
+    riskSummary: lightSbom.riskSummary || {},
     source: lightSbom.source || {},
     confidence: lightSbom.confidence || {},
     limitations: lightSbom.limitations || [],

package/src/contract.js

@@ -4,7 +4,7 @@ export function preflightContract() {
     version: 1,
     stability: "additive",
     requiredFields: ["schemaVersion", "state", "decision", "quickstart", "commands", "artifacts"],
-    aiEntryFields: ["state", "summary", "nextAgent", "coordination", "agentActivity", "followUps", "dependencyReadSet", "dependencyChangeProtocol"],
+    aiEntryFields: ["state", "summary", "nextAgent", "coordination", "agentActivity", "sbomRisk", "followUps", "dependencyReadSet", "dependencyChangeProtocol"],
     rule: "Consumers should ignore unknown fields and treat missing optional fields as unavailable."
   };
 }

package/src/dependencies.js

@@ -108,6 +108,7 @@ export function buildLightSbom(snapshot = {}, security = {}) {
       transitiveOrUnmatchedVulnerablePackages: transitiveOrUnmatched.length
     },
     topRisk,
+    riskSummary: lightSbomRiskSummary({ packages, security, directVulnerable, transitiveOrUnmatched, topRisk, lockfiles: snapshot.lockfiles || [] }),
     packageManagerPolicy: packageManagerPolicy(snapshot.lockfiles || []),
     dependencyChangeHints: dependencyChangeHints(packages, topRisk, snapshot.lockfiles || []),
     aiUse: {
@@ -119,6 +120,74 @@ export function buildLightSbom(snapshot = {}, security = {}) {
   };
 }
 
+export function lightSbomRiskSummary({ packages = [], security = {}, directVulnerable = [], transitiveOrUnmatched = [], topRisk = [], lockfiles = [] } = {}) {
+  const signals = [];
+  let score = 0;
+  const critical = Math.max(Number(security.summary?.critical || 0), topRisk.filter((pkg) => pkg.severity === "critical").length);
+  const high = Math.max(Number(security.summary?.high || 0), topRisk.filter((pkg) => pkg.severity === "high").length);
+  const total = Number(security.summary?.total || 0);
+  if (critical > 0) {
+    score += 45;
+    signals.push(`${critical} critical vulnerability finding(s)`);
+  }
+  if (high > 0) {
+    score += 30;
+    signals.push(`${high} high vulnerability finding(s)`);
+  }
+  if (directVulnerable.length) {
+    score += 15;
+    signals.push(`${directVulnerable.length} vulnerable direct dependency package(s)`);
+  }
+  if (transitiveOrUnmatched.length) {
+    score += 8;
+    signals.push(`${transitiveOrUnmatched.length} vulnerable transitive or unmatched package(s)`);
+  }
+  if (packageManagerPolicy(lockfiles).status === "review-required") {
+    score += 10;
+    signals.push("mixed package manager lockfiles");
+  }
+  if (packages.length && security.enabled !== true) {
+    score += 5;
+    signals.push("security scanner summary is off");
+  }
+  const level = score >= 90 ? "urgent" : score >= 60 ? "high" : score >= 30 ? "medium" : score > 0 ? "low" : "clear";
+  const reviewTargets = [
+    ...new Set([
+      ...topRisk.map((pkg) => pkg.manifest).filter(Boolean),
+      ...topRisk.map((pkg) => pkg.name).filter(Boolean).slice(0, 5)
+    ])
+  ].slice(0, 8);
+  return {
+    level,
+    score,
+    signals,
+    scanner: security.enabled ? "enabled" : "off",
+    vulnerabilityCount: total,
+    directVulnerablePackages: directVulnerable.length,
+    reviewTargets,
+    next: riskNext(level, security.enabled, topRisk),
+    commands: riskCommands(level, security.enabled)
+  };
+}
+
+function riskNext(level, securityEnabled, topRisk = []) {
+  if (!securityEnabled) return "Run read-only security scan before dependency or release decisions.";
+  if (level === "urgent" || level === "high") return "Review dependency read set and topRisk before remediation; do not auto-fix without user approval.";
+  if (topRisk.length) return "Review topRisk packages before dependency changes.";
+  return "No SBOM risk signal requires action in the lightweight snapshot.";
+}
+
+function riskCommands(level, securityEnabled) {
+  const commands = [];
+  if (!securityEnabled) commands.push("aienvmp sync --security");
+  if (["urgent", "high", "medium"].includes(level)) {
+    commands.push("aienvmp intent --actor agent:id --action dependency-review --target dependency");
+    commands.push("aienvmp plan --write");
+  }
+  commands.push("aienvmp checkpoint --actor agent:id --summary dependency-review --target dependency");
+  return commands;
+}
+
 function packageManagerPolicy(lockfiles = []) {
   const byEcosystem = {};
   for (const lockfile of lockfiles) {
@@ -196,8 +265,7 @@ function dependencyChangeHints(packages = [], topRisk = [], lockfiles = []) {
     ],
     afterChange: [
       "Run project tests or the narrowest relevant validation.",
-      "Run aienvmp sync.",
-      "Record the dependency change with aienvmp record."
+      "Run aienvmp checkpoint --actor agent:id --summary dependency-change --target dependency."
     ]
   }));
 }

package/src/preflight.js

@@ -16,6 +16,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
   const coordination = coordinationSummary(intents);
   const followUps = pendingFollowUps(timeline);
   const agentActivity = agentActivitySummary(timeline);
+  const sbomRisk = manifest.lightSbom?.riskSummary || {};
   return {
     schemaVersion: 1,
     contract: preflightContract(),
@@ -57,6 +58,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
     nextAgent: nextAgentHint(state, dependencyReadSet, dependencyChangeProtocol),
     coordination,
     agentActivity,
+    sbomRisk,
     followUps,
     intentTargets,
     dependencyReadSet,

package/src/render.js

@@ -416,10 +416,12 @@ const lightSbom=manifest.lightSbom||{};
 const lightSbomSummary=lightSbom.summary||{};
 const pmPolicy=lightSbom.packageManagerPolicy||{};
 const topRisk=lightSbom.topRisk||[];
+const riskSummary=lightSbom.riskSummary||{};
 const dependencyHints=lightSbom.dependencyChangeHints||[];
 const dependencyHintsHtml=dependencyHints.length?'<div class="timeline">'+dependencyHints.slice(0,5).map(h=>\`<div class="event"><time>\${esc(h.ecosystem||'deps')}</time><div><b>\${esc(h.manifest)}</b> <code>\${esc(h.manager||'unknown')}</code> \${esc(h.packages||0)} packages\${h.riskPackages?.length?\`<div class="path">risk: \${esc(h.riskPackages.map(p=>p.name).join(', '))}</div>\`:''}<div class="path">\${esc((h.groups||[]).join(', ')||'no groups')}\${h.lockfiles?.length?\` / lockfiles: \${esc(h.lockfiles.map(l=>l.file).join(', '))}\`:''}</div></div></div>\`).join('')+'</div>':'<div class="okline">No dependency change hints available.</div>';
 const pmPolicyHtml='<table><tr><th>Status</th><td><code>'+esc(pmPolicy.status||'no-lockfile')+'</code></td></tr><tr><th>Guidance</th><td>'+esc(pmPolicy.guidance||'No lockfile policy detected.')+'</td></tr></table>';
-const lightSbomHtml=\`<table><tr><th>Packages</th><td><code>\${esc(lightSbomSummary.packages||0)}</code></td></tr><tr><th>Vulnerabilities</th><td><code>\${esc(lightSbomSummary.vulnerabilities||0)}</code></td></tr><tr><th>Direct vulnerable</th><td><code>\${esc(lightSbomSummary.directVulnerablePackages||0)}</code></td></tr><tr><th>Manifests</th><td><code>\${esc((lightSbomSummary.manifests||[]).join(', ')||'none')}</code></td></tr><tr><th>Lockfiles</th><td><code>\${esc((lightSbomSummary.lockfiles||[]).map(l=>l.file).join(', ')||'none')}</code></td></tr></table><h3 style="margin-top:12px">Package manager policy</h3>\${pmPolicyHtml}\${topRisk.length?'<div class="timeline">'+topRisk.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.priority)}</time><div><b>\${esc(p.name)}</b> \${esc(p.severity)} \${p.directDependency?'<code>direct</code>':'<code>transitive</code>'}<div class="path">\${esc(p.manifest||p.ecosystem)} \${esc(p.version||'')}</div></div></div>\`).join('')+'</div>':'<div class="okline">No high-risk package summary in the current light SBOM.</div>'}<h3 style="margin-top:12px">Dependency change hints</h3>\${dependencyHintsHtml}\`;
+const riskSummaryHtml=riskSummary.level?\`<table><tr><th>Level</th><td><code>\${esc(riskSummary.level)}</code> \${esc(riskSummary.score||0)}</td></tr><tr><th>Scanner</th><td><code>\${esc(riskSummary.scanner||'unknown')}</code></td></tr><tr><th>Next</th><td>\${esc(riskSummary.next||'No SBOM action required.')}</td></tr><tr><th>Targets</th><td>\${esc((riskSummary.reviewTargets||[]).join(', ')||'none')}</td></tr></table>\${riskSummary.signals?.length?'<div class="timeline">'+riskSummary.signals.slice(0,5).map(s=>\`<div class="event"><time>risk</time><div>\${esc(s)}</div></div>\`).join('')+'</div>':''}\`:'<div class="okline">No risk summary available.</div>';
+const lightSbomHtml=\`<table><tr><th>Packages</th><td><code>\${esc(lightSbomSummary.packages||0)}</code></td></tr><tr><th>Vulnerabilities</th><td><code>\${esc(lightSbomSummary.vulnerabilities||0)}</code></td></tr><tr><th>Direct vulnerable</th><td><code>\${esc(lightSbomSummary.directVulnerablePackages||0)}</code></td></tr><tr><th>Manifests</th><td><code>\${esc((lightSbomSummary.manifests||[]).join(', ')||'none')}</code></td></tr><tr><th>Lockfiles</th><td><code>\${esc((lightSbomSummary.lockfiles||[]).map(l=>l.file).join(', ')||'none')}</code></td></tr></table><h3 style="margin-top:12px">Risk summary</h3>\${riskSummaryHtml}<h3 style="margin-top:12px">Package manager policy</h3>\${pmPolicyHtml}\${topRisk.length?'<div class="timeline">'+topRisk.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.priority)}</time><div><b>\${esc(p.name)}</b> \${esc(p.severity)} \${p.directDependency?'<code>direct</code>':'<code>transitive</code>'}<div class="path">\${esc(p.manifest||p.ecosystem)} \${esc(p.version||'')}</div></div></div>\`).join('')+'</div>':'<div class="okline">No high-risk package summary in the current light SBOM.</div>'}<h3 style="margin-top:12px">Dependency change hints</h3>\${dependencyHintsHtml}\`;
 const sec=manifest.security||{};
 const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0};
 const secPackages=sec.topPackages||[];
@@ -633,6 +635,10 @@ function lightSbomLines(lightSbom = {}) {
     lines.push(`- Source: ${lightSbom.source?.dependencies || "project manifests"}; vulnerabilities: ${lightSbom.source?.vulnerabilities || "not scanned"}`);
     lines.push(`- Confidence: direct ${lightSbom.confidence?.directDependencies || "unknown"}; transitive ${lightSbom.confidence?.transitiveDependencies || "unknown"}`);
   }
+  if (lightSbom.riskSummary) {
+    lines.push(`- Risk summary: ${lightSbom.riskSummary.level || "clear"}/${lightSbom.riskSummary.score || 0}; ${lightSbom.riskSummary.next || "no action"}`);
+    if (lightSbom.riskSummary.signals?.length) lines.push(`- Risk signals: ${lightSbom.riskSummary.signals.join("; ")}`);
+  }
   if (lightSbom.packageManagerPolicy) {
     lines.push(`- Package manager policy: ${lightSbom.packageManagerPolicy.status}`);
     lines.push(`- Package manager guidance: ${lightSbom.packageManagerPolicy.guidance}`);