aienvmp 0.1.45 → 0.1.47

package/BUGFIXES.md

@@ -58,6 +58,18 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: `aienvmp checkpoint` now performs the post-change loop and records an explicit sync ledger entry so follow-ups can be closed.
 - Verification: checkpoint tests cover text/JSON output, status artifact refresh, timeline entries, handoff recording, and cleared follow-ups.
 
+### Light SBOM risk required too much parsing
+
+- Issue: AI consumers could see package and vulnerability details, but had to infer risk level and next commands from several nested fields.
+- Fix: `lightSbom.riskSummary` and preflight `sbomRisk` now provide a compact risk score, signals, review targets, and advisory next steps.
+- Verification: tests cover risk scoring, top-risk severity fallback, scanner-off guidance, status/context exposure, dashboard rendering, and recommended actions.
+
+### Light SBOM was only nested inside larger artifacts
+
+- Issue: CI tools and AI agents that only need dependency/SBOM context had to read the full manifest or context payload.
+- Fix: `aienvmp sbom --json` and `.aienvmp/sbom.json` now expose a standalone light SBOM artifact.
+- Verification: tests cover standalone SBOM construction, writing, sync output, schema metadata, and dashboard linking.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.1.47
+
+- Added `aienvmp sbom` for standalone AI-readable light SBOM output without deep manifest parsing.
+- Added `.aienvmp/sbom.json` writing through `aienvmp sbom --write` and the default `sync` flow.
+- Added the SBOM artifact path to the shared preflight artifacts map.
+- Added SBOM output metadata to `aienvmp schema --json`.
+- Added a dashboard Light SBOM Artifact card linking to `sbom.json`.
+- Updated README outputs and commands with the standalone SBOM artifact.
+- Added regression tests for SBOM artifact building, writing, sync output, schema contract, and dashboard rendering.
+
+## 0.1.46
+
+- Added `lightSbom.riskSummary` with compact risk level, score, scanner state, signals, review targets, and next commands.
+- Added `sbomRisk` to the shared AI preflight contract so status/context consumers can read SBOM risk without deep parsing.
+- Surfaced SBOM risk in `context --json`, `AIENV.md`, and the dashboard Light SBOM card.
+- Added recommended actions for read-only security scans and high light-SBOM risk review.
+- Used top-risk package severity as a fallback when scanner summary severity counts are incomplete.
+- Updated dependency change hints to point agents to `aienvmp checkpoint` after accepted dependency changes.
+- Added regression tests for risk scoring, scanner-off guidance, status/context outputs, dashboard rendering, and recommended actions.
+
 ## 0.1.45
 
 - Added `aienvmp checkpoint` as a one-command post-environment-change flow for record, sync, status, and handoff.

package/README.md

@@ -35,6 +35,7 @@ Warnings are advisory by default. Use `doctor --strict <scope>` only when you wa
 AIENV.md                 # Markdown env map for AI agents
 .aienvmp/status.json     # first AI read: clear/review, next command, nextAgent hint
 .aienvmp/manifest.json   # runtime map + light SBOM
+.aienvmp/sbom.json       # standalone AI-readable light SBOM
 .aienvmp/intents.jsonl   # planned env changes
 .aienvmp/timeline.jsonl  # append-only change ledger
 .aienvmp/plan.md         # read-only action plan
@@ -47,6 +48,7 @@ AIENV.md                 # Markdown env map for AI agents
 - `schema --json` prints the stable AI-readable output contract without scanning.
 - `status.json.nextAgent` tells the next AI what to read and whether to review first.
 - `dependencyReadSet` lists manifests and lockfiles before package or security changes.
+- `sbomRisk` gives AI a compact light-SBOM risk level, signals, and next command.
 - `coordination.conflictTargets` shows where multiple agents are planning changes.
 - `agentActivity.multiActorTargets` shows where multiple agents actually recorded env changes.
 - `followUps` shows records that still need `sync`, `status`, or `handoff`.
@@ -71,6 +73,7 @@ npx aienvmp snippet gemini
 aienvmp sync                    # update env map, status, ledger, dashboard
 aienvmp status --write          # refresh compact AI status
 aienvmp context --json          # AI decision contract
+aienvmp sbom --json             # standalone light SBOM
 aienvmp schema --json           # stable output contract for AI/CI consumers
 aienvmp plan --write            # read-only action plan
 aienvmp handoff --record        # next-agent summary

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/actions.js

@@ -20,6 +20,7 @@ export function recommendedActions(manifest = {}, context = {}) {
   }
 
   actions.push(...securityActions(manifest.security));
+  actions.push(...sbomRiskActions(manifest.lightSbom?.riskSummary));
 
   if (hasRuntimePolicyWarning(warnings)) {
     actions.push(action("review-version-policy", "medium", "runtime", "Detected runtime or package manager policy drift. Prefer project-local version files and ask before global changes."));
@@ -36,6 +37,18 @@ export function recommendedActions(manifest = {}, context = {}) {
   return dedupeActions(actions).slice(0, 8);
 }
 
+function sbomRiskActions(risk = {}) {
+  const actions = [];
+  if (!risk.level) return actions;
+  if (risk.scanner === "off" && risk.vulnerabilityCount === 0) {
+    actions.push(action("scan-sbom-risk", "medium", "security", "Run a read-only security scan before dependency or release decisions.", "aienvmp sync --security"));
+  }
+  if (["urgent", "high"].includes(risk.level)) {
+    actions.push(action("review-sbom-risk", "high", "security", `Review light SBOM risk summary before dependency changes: ${(risk.signals || []).slice(0, 2).join("; ") || risk.level}.`, "aienvmp plan --write"));
+  }
+  return actions;
+}
+
 function securityActions(security = {}) {
   if (!security.enabled) return [];
 

package/src/cli.js

@@ -15,6 +15,7 @@ import { planWorkspace } from "./commands/plan.js";
 import { statusWorkspace } from "./commands/status.js";
 import { schemaWorkspace } from "./commands/schema.js";
 import { checkpointWorkspace } from "./commands/checkpoint.js";
+import { sbomWorkspace } from "./commands/sbom.js";
 import { readFileSync } from "node:fs";
 
 const commands = new Map([
@@ -34,7 +35,8 @@ const commands = new Map([
   ["plan", planWorkspace],
   ["status", statusWorkspace],
   ["schema", schemaWorkspace],
-  ["checkpoint", checkpointWorkspace]
+  ["checkpoint", checkpointWorkspace],
+  ["sbom", sbomWorkspace]
 ]);
 
 const version = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
@@ -112,6 +114,7 @@ Usage:
   aienvmp handoff [--dir .] [--json] [--record --actor agent:id]
   aienvmp checkpoint [--dir .] --actor agent:id --summary "what changed" [--target dependency] [--json]
   aienvmp plan [--dir .] [--json] [--write]
+  aienvmp sbom [--dir .] [--json] [--write]
   aienvmp schema [--json]
 
 Common:
@@ -121,6 +124,7 @@ Common:
   aienvmp handoff   print the next-agent handoff summary
   aienvmp checkpoint record, sync, status, and handoff after an env change
   aienvmp plan      print a read-only AI environment action plan
+  aienvmp sbom      print/write standalone light SBOM artifact
   aienvmp schema    print the stable AI-readable output contract
   aienvmp snippet   print an AGENTS.md pointer snippet
   aienvmp dash      regenerate/open the lightweight dashboard
@@ -136,6 +140,7 @@ Advanced:
   aienvmp compile [--dir .]
   aienvmp diff [--dir .]
   aienvmp doctor [--dir .] [--json] [--ci] [--strict security|policy|coordination|all]
+  aienvmp sbom [--dir .] [--json] [--write]
   aienvmp dash [--dir .] [--open]
 `);
 }

package/src/commands/context.js

@@ -27,6 +27,7 @@ export async function contextWorkspace(args) {
       status: warnings.length ? "review-required" : "clear",
       preflight,
       coordination: preflight.coordination,
+      sbomRisk: preflight.sbomRisk,
       followUps: preflight.followUps,
       decision,
       enforcement: enforcementAdvice(warnings),
@@ -75,6 +76,7 @@ function lightSbomSummary(lightSbom = {}) {
       guidance: "No lockfile policy detected."
     },
     dependencyChangeHints: (lightSbom.dependencyChangeHints || []).slice(0, 8),
+    riskSummary: lightSbom.riskSummary || {},
     source: lightSbom.source || {},
     confidence: lightSbom.confidence || {},
     limitations: lightSbom.limitations || [],

package/src/commands/sbom.js

@@ -0,0 +1,51 @@
+import { readJson, writeJson } from "../fsutil.js";
+import { manifestPath, sbomJsonPath, workspaceDir } from "../paths.js";
+
+export async function sbomWorkspace(args = {}) {
+  const dir = workspaceDir(args);
+  const manifest = await readJson(manifestPath(dir));
+  if (!manifest) throw new Error("missing manifest; run `aienvmp sync` first");
+  const sbom = buildSbomArtifact(manifest);
+  const artifact = args.write ? await writeSbomArtifact(dir, sbom) : "";
+  const output = artifact ? { ...sbom, artifact } : sbom;
+  if (args.json || args.write || args.quiet) {
+    if (args.json) console.log(JSON.stringify(output, null, 2));
+  } else {
+    console.log(`sbom: ${sbom.riskSummary.level}/${sbom.riskSummary.score}`);
+    console.log(`packages: ${sbom.summary.packages || 0}`);
+    console.log(`vulnerabilities: ${sbom.summary.vulnerabilities || 0}`);
+    console.log(`next: ${sbom.riskSummary.next}`);
+  }
+  return output;
+}
+
+export function buildSbomArtifact(manifest = {}) {
+  const lightSbom = manifest.lightSbom || {};
+  return {
+    schemaVersion: 1,
+    schemaName: "aienvmp.light-sbom",
+    generatedAt: manifest.generatedAt || "",
+    workspace: manifest.workspace || {},
+    mode: lightSbom.mode || "light-sbom",
+    source: lightSbom.source || {},
+    confidence: lightSbom.confidence || {},
+    limitations: lightSbom.limitations || [],
+    summary: lightSbom.summary || { packages: 0, vulnerabilities: 0 },
+    riskSummary: lightSbom.riskSummary || { level: "clear", score: 0, signals: [], commands: [] },
+    topRisk: (lightSbom.topRisk || []).slice(0, 20),
+    packageManagerPolicy: lightSbom.packageManagerPolicy || {},
+    dependencyChangeHints: (lightSbom.dependencyChangeHints || []).slice(0, 20),
+    aiUse: {
+      purpose: "Standalone AI-readable light SBOM artifact.",
+      readBefore: "Dependency changes, vulnerability remediation, release review, or shared AI handoff.",
+      nextCommand: lightSbom.riskSummary?.commands?.[0] || "aienvmp context --json",
+      rule: "Use as a lightweight planning map; verify security claims with dedicated scanners."
+    }
+  };
+}
+
+export async function writeSbomArtifact(dir, sbom) {
+  const out = sbomJsonPath(dir);
+  await writeJson(out, sbom);
+  return out;
+}

package/src/commands/sync.js

@@ -3,6 +3,7 @@ import { scanWorkspace } from "./scan.js";
 import { compileWorkspace } from "./compile.js";
 import { dashWorkspace } from "./dash.js";
 import { statusWorkspace } from "./status.js";
+import { sbomWorkspace } from "./sbom.js";
 
 export async function syncWorkspace(args) {
   const quiet = args.quiet || args.json;
@@ -13,6 +14,7 @@ export async function syncWorkspace(args) {
   const compiled = await compileWorkspace(next);
   const dashboard = await dashWorkspace(next);
   const status = await statusWorkspace({ ...next, json: false, write: true, quiet: true });
+  const sbom = await sbomWorkspace({ ...next, json: false, write: true, quiet: true });
 
   const result = {
     status: "ok",
@@ -21,6 +23,7 @@ export async function syncWorkspace(args) {
       manifest: scanned.manifest,
       timeline: scanned.timeline,
       status: status.artifact,
+      sbom: sbom.artifact,
       dashboard: dashboard.dashboard
     },
     changes: scanned.changes,

package/src/contract.js

@@ -4,7 +4,7 @@ export function preflightContract() {
     version: 1,
     stability: "additive",
     requiredFields: ["schemaVersion", "state", "decision", "quickstart", "commands", "artifacts"],
-    aiEntryFields: ["state", "summary", "nextAgent", "coordination", "agentActivity", "followUps", "dependencyReadSet", "dependencyChangeProtocol"],
+    aiEntryFields: ["state", "summary", "nextAgent", "coordination", "agentActivity", "sbomRisk", "followUps", "dependencyReadSet", "dependencyChangeProtocol"],
     rule: "Consumers should ignore unknown fields and treat missing optional fields as unavailable."
   };
 }
@@ -31,6 +31,11 @@ export function schemaContract() {
       manifest: {
         file: ".aienvmp/manifest.json",
         rootFields: ["schemaVersion", "workspace", "runtimes", "packageManagers", "dependencySnapshot", "lightSbom", "security", "trust"]
+      },
+      sbom: {
+        file: ".aienvmp/sbom.json",
+        command: "aienvmp sbom --json",
+        rootFields: ["schemaVersion", "schemaName", "workspace", "summary", "riskSummary", "topRisk", "packageManagerPolicy", "dependencyChangeHints"]
       }
     },
     compatibility: {

package/src/dependencies.js

@@ -108,6 +108,7 @@ export function buildLightSbom(snapshot = {}, security = {}) {
       transitiveOrUnmatchedVulnerablePackages: transitiveOrUnmatched.length
     },
     topRisk,
+    riskSummary: lightSbomRiskSummary({ packages, security, directVulnerable, transitiveOrUnmatched, topRisk, lockfiles: snapshot.lockfiles || [] }),
     packageManagerPolicy: packageManagerPolicy(snapshot.lockfiles || []),
     dependencyChangeHints: dependencyChangeHints(packages, topRisk, snapshot.lockfiles || []),
     aiUse: {
@@ -119,6 +120,74 @@ export function buildLightSbom(snapshot = {}, security = {}) {
   };
 }
 
+export function lightSbomRiskSummary({ packages = [], security = {}, directVulnerable = [], transitiveOrUnmatched = [], topRisk = [], lockfiles = [] } = {}) {
+  const signals = [];
+  let score = 0;
+  const critical = Math.max(Number(security.summary?.critical || 0), topRisk.filter((pkg) => pkg.severity === "critical").length);
+  const high = Math.max(Number(security.summary?.high || 0), topRisk.filter((pkg) => pkg.severity === "high").length);
+  const total = Number(security.summary?.total || 0);
+  if (critical > 0) {
+    score += 45;
+    signals.push(`${critical} critical vulnerability finding(s)`);
+  }
+  if (high > 0) {
+    score += 30;
+    signals.push(`${high} high vulnerability finding(s)`);
+  }
+  if (directVulnerable.length) {
+    score += 15;
+    signals.push(`${directVulnerable.length} vulnerable direct dependency package(s)`);
+  }
+  if (transitiveOrUnmatched.length) {
+    score += 8;
+    signals.push(`${transitiveOrUnmatched.length} vulnerable transitive or unmatched package(s)`);
+  }
+  if (packageManagerPolicy(lockfiles).status === "review-required") {
+    score += 10;
+    signals.push("mixed package manager lockfiles");
+  }
+  if (packages.length && security.enabled !== true) {
+    score += 5;
+    signals.push("security scanner summary is off");
+  }
+  const level = score >= 90 ? "urgent" : score >= 60 ? "high" : score >= 30 ? "medium" : score > 0 ? "low" : "clear";
+  const reviewTargets = [
+    ...new Set([
+      ...topRisk.map((pkg) => pkg.manifest).filter(Boolean),
+      ...topRisk.map((pkg) => pkg.name).filter(Boolean).slice(0, 5)
+    ])
+  ].slice(0, 8);
+  return {
+    level,
+    score,
+    signals,
+    scanner: security.enabled ? "enabled" : "off",
+    vulnerabilityCount: total,
+    directVulnerablePackages: directVulnerable.length,
+    reviewTargets,
+    next: riskNext(level, security.enabled, topRisk),
+    commands: riskCommands(level, security.enabled)
+  };
+}
+
+function riskNext(level, securityEnabled, topRisk = []) {
+  if (!securityEnabled) return "Run read-only security scan before dependency or release decisions.";
+  if (level === "urgent" || level === "high") return "Review dependency read set and topRisk before remediation; do not auto-fix without user approval.";
+  if (topRisk.length) return "Review topRisk packages before dependency changes.";
+  return "No SBOM risk signal requires action in the lightweight snapshot.";
+}
+
+function riskCommands(level, securityEnabled) {
+  const commands = [];
+  if (!securityEnabled) commands.push("aienvmp sync --security");
+  if (["urgent", "high", "medium"].includes(level)) {
+    commands.push("aienvmp intent --actor agent:id --action dependency-review --target dependency");
+    commands.push("aienvmp plan --write");
+  }
+  commands.push("aienvmp checkpoint --actor agent:id --summary dependency-review --target dependency");
+  return commands;
+}
+
 function packageManagerPolicy(lockfiles = []) {
   const byEcosystem = {};
   for (const lockfile of lockfiles) {
@@ -196,8 +265,7 @@ function dependencyChangeHints(packages = [], topRisk = [], lockfiles = []) {
     ],
     afterChange: [
       "Run project tests or the narrowest relevant validation.",
-      "Run aienvmp sync.",
-      "Record the dependency change with aienvmp record."
+      "Run aienvmp checkpoint --actor agent:id --summary dependency-change --target dependency."
     ]
   }));
 }

package/src/paths.js

@@ -16,6 +16,10 @@ export function statusJsonPath(dir) {
   return path.join(stateDir(dir), "status.json");
 }
 
+export function sbomJsonPath(dir) {
+  return path.join(stateDir(dir), "sbom.json");
+}
+
 export function previousManifestPath(dir) {
   return path.join(stateDir(dir), "manifest.previous.json");
 }

package/src/preflight.js

@@ -16,6 +16,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
   const coordination = coordinationSummary(intents);
   const followUps = pendingFollowUps(timeline);
   const agentActivity = agentActivitySummary(timeline);
+  const sbomRisk = manifest.lightSbom?.riskSummary || {};
   return {
     schemaVersion: 1,
     contract: preflightContract(),
@@ -57,6 +58,7 @@ export function buildPreflight(manifest = {}, warnings = [], intents = [], timel
     nextAgent: nextAgentHint(state, dependencyReadSet, dependencyChangeProtocol),
     coordination,
     agentActivity,
+    sbomRisk,
     followUps,
     intentTargets,
     dependencyReadSet,
@@ -351,6 +353,7 @@ export function preflightArtifacts() {
     status: ".aienvmp/status.json",
     envMap: "AIENV.md",
     manifest: ".aienvmp/manifest.json",
+    sbom: ".aienvmp/sbom.json",
     dashboard: ".aienvmp/dashboard.html",
     planJson: ".aienvmp/plan.json",
     planMarkdown: ".aienvmp/plan.md",

package/src/render.js

@@ -416,10 +416,12 @@ const lightSbom=manifest.lightSbom||{};
 const lightSbomSummary=lightSbom.summary||{};
 const pmPolicy=lightSbom.packageManagerPolicy||{};
 const topRisk=lightSbom.topRisk||[];
+const riskSummary=lightSbom.riskSummary||{};
 const dependencyHints=lightSbom.dependencyChangeHints||[];
 const dependencyHintsHtml=dependencyHints.length?'<div class="timeline">'+dependencyHints.slice(0,5).map(h=>\`<div class="event"><time>\${esc(h.ecosystem||'deps')}</time><div><b>\${esc(h.manifest)}</b> <code>\${esc(h.manager||'unknown')}</code> \${esc(h.packages||0)} packages\${h.riskPackages?.length?\`<div class="path">risk: \${esc(h.riskPackages.map(p=>p.name).join(', '))}</div>\`:''}<div class="path">\${esc((h.groups||[]).join(', ')||'no groups')}\${h.lockfiles?.length?\` / lockfiles: \${esc(h.lockfiles.map(l=>l.file).join(', '))}\`:''}</div></div></div>\`).join('')+'</div>':'<div class="okline">No dependency change hints available.</div>';
 const pmPolicyHtml='<table><tr><th>Status</th><td><code>'+esc(pmPolicy.status||'no-lockfile')+'</code></td></tr><tr><th>Guidance</th><td>'+esc(pmPolicy.guidance||'No lockfile policy detected.')+'</td></tr></table>';
-const lightSbomHtml=\`<table><tr><th>Packages</th><td><code>\${esc(lightSbomSummary.packages||0)}</code></td></tr><tr><th>Vulnerabilities</th><td><code>\${esc(lightSbomSummary.vulnerabilities||0)}</code></td></tr><tr><th>Direct vulnerable</th><td><code>\${esc(lightSbomSummary.directVulnerablePackages||0)}</code></td></tr><tr><th>Manifests</th><td><code>\${esc((lightSbomSummary.manifests||[]).join(', ')||'none')}</code></td></tr><tr><th>Lockfiles</th><td><code>\${esc((lightSbomSummary.lockfiles||[]).map(l=>l.file).join(', ')||'none')}</code></td></tr></table><h3 style="margin-top:12px">Package manager policy</h3>\${pmPolicyHtml}\${topRisk.length?'<div class="timeline">'+topRisk.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.priority)}</time><div><b>\${esc(p.name)}</b> \${esc(p.severity)} \${p.directDependency?'<code>direct</code>':'<code>transitive</code>'}<div class="path">\${esc(p.manifest||p.ecosystem)} \${esc(p.version||'')}</div></div></div>\`).join('')+'</div>':'<div class="okline">No high-risk package summary in the current light SBOM.</div>'}<h3 style="margin-top:12px">Dependency change hints</h3>\${dependencyHintsHtml}\`;
+const riskSummaryHtml=riskSummary.level?\`<table><tr><th>Level</th><td><code>\${esc(riskSummary.level)}</code> \${esc(riskSummary.score||0)}</td></tr><tr><th>Scanner</th><td><code>\${esc(riskSummary.scanner||'unknown')}</code></td></tr><tr><th>Next</th><td>\${esc(riskSummary.next||'No SBOM action required.')}</td></tr><tr><th>Targets</th><td>\${esc((riskSummary.reviewTargets||[]).join(', ')||'none')}</td></tr></table>\${riskSummary.signals?.length?'<div class="timeline">'+riskSummary.signals.slice(0,5).map(s=>\`<div class="event"><time>risk</time><div>\${esc(s)}</div></div>\`).join('')+'</div>':''}\`:'<div class="okline">No risk summary available.</div>';
+const lightSbomHtml=\`<table><tr><th>Packages</th><td><code>\${esc(lightSbomSummary.packages||0)}</code></td></tr><tr><th>Vulnerabilities</th><td><code>\${esc(lightSbomSummary.vulnerabilities||0)}</code></td></tr><tr><th>Direct vulnerable</th><td><code>\${esc(lightSbomSummary.directVulnerablePackages||0)}</code></td></tr><tr><th>Manifests</th><td><code>\${esc((lightSbomSummary.manifests||[]).join(', ')||'none')}</code></td></tr><tr><th>Lockfiles</th><td><code>\${esc((lightSbomSummary.lockfiles||[]).map(l=>l.file).join(', ')||'none')}</code></td></tr></table><h3 style="margin-top:12px">Risk summary</h3>\${riskSummaryHtml}<h3 style="margin-top:12px">Package manager policy</h3>\${pmPolicyHtml}\${topRisk.length?'<div class="timeline">'+topRisk.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.priority)}</time><div><b>\${esc(p.name)}</b> \${esc(p.severity)} \${p.directDependency?'<code>direct</code>':'<code>transitive</code>'}<div class="path">\${esc(p.manifest||p.ecosystem)} \${esc(p.version||'')}</div></div></div>\`).join('')+'</div>':'<div class="okline">No high-risk package summary in the current light SBOM.</div>'}<h3 style="margin-top:12px">Dependency change hints</h3>\${dependencyHintsHtml}\`;
 const sec=manifest.security||{};
 const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0};
 const secPackages=sec.topPackages||[];
@@ -440,6 +442,7 @@ const actions=manifest.recommendedActions||[];
 const actionsHtml=actions.length?'<div class="timeline">'+actions.slice(0,6).map(a=>\`<div class="event"><time>\${esc(a.priority)}</time><div><b>\${esc(a.category)}</b> \${esc(a.summary)}\${a.command?\`<div class="path">\${esc(a.command)}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No recommended actions. Continue project-local work.</div>';
 const plan=manifest.planArtifacts||{};
 const planHtml=plan.markdown||plan.json?\`<table><tr><th>Markdown</th><td>\${plan.markdown?'<a href="plan.md">plan.md</a>':'not written'}</td></tr><tr><th>JSON</th><td>\${plan.json?'<a href="plan.json">plan.json</a>':'not written'}</td></tr></table>\`:'<div class="okline">No plan artifacts yet. Run <code>aienvmp plan --write</code>.</div>';
+const sbomArtifactHtml='<table><tr><th>JSON</th><td><a href="sbom.json">sbom.json</a></td></tr><tr><th>Command</th><td><code>aienvmp sbom --write</code></td></tr></table>';
 const remediation=manifest.planRemediation||[];
 const remediationFix=r=>r.fixVersions?.length?\`fix \${r.fixVersions.join(', ')}\`:(r.fixAvailable?'fix available':'review required');
 const remediationRefs=r=>r.advisories?.length?\` - \${r.advisories.join(', ')}\`:'';
@@ -528,6 +531,8 @@ document.getElementById('app').innerHTML=\`
     <div style="height:14px"></div>
     \${card('AI Plan Artifacts',plan.markdown||plan.json?'<span class="pill">written</span>':'<span class="pill off">not written</span>',planHtml)}
     <div style="height:14px"></div>
+    \${card('Light SBOM Artifact','<span class="pill">json</span>',sbomArtifactHtml)}
+    <div style="height:14px"></div>
     \${card('Remediation Steps',remediation.length?'<span class="pill warn">'+remediation.length+' items</span>':'<span class="pill off">none</span>',remediationHtml)}
     <div style="height:14px"></div>
     \${card('Environment Steps',envSteps.length?'<span class="pill warn">'+envSteps.length+' items</span>':'<span class="pill off">none</span>',envStepsHtml)}
@@ -633,6 +638,10 @@ function lightSbomLines(lightSbom = {}) {
     lines.push(`- Source: ${lightSbom.source?.dependencies || "project manifests"}; vulnerabilities: ${lightSbom.source?.vulnerabilities || "not scanned"}`);
     lines.push(`- Confidence: direct ${lightSbom.confidence?.directDependencies || "unknown"}; transitive ${lightSbom.confidence?.transitiveDependencies || "unknown"}`);
   }
+  if (lightSbom.riskSummary) {
+    lines.push(`- Risk summary: ${lightSbom.riskSummary.level || "clear"}/${lightSbom.riskSummary.score || 0}; ${lightSbom.riskSummary.next || "no action"}`);
+    if (lightSbom.riskSummary.signals?.length) lines.push(`- Risk signals: ${lightSbom.riskSummary.signals.join("; ")}`);
+  }
   if (lightSbom.packageManagerPolicy) {
     lines.push(`- Package manager policy: ${lightSbom.packageManagerPolicy.status}`);
     lines.push(`- Package manager guidance: ${lightSbom.packageManagerPolicy.guidance}`);