aienvmp 0.1.46 → 0.1.47

package/BUGFIXES.md

@@ -64,6 +64,12 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: `lightSbom.riskSummary` and preflight `sbomRisk` now provide a compact risk score, signals, review targets, and advisory next steps.
 - Verification: tests cover risk scoring, top-risk severity fallback, scanner-off guidance, status/context exposure, dashboard rendering, and recommended actions.
 
+### Light SBOM was only nested inside larger artifacts
+
+- Issue: CI tools and AI agents that only need dependency/SBOM context had to read the full manifest or context payload.
+- Fix: `aienvmp sbom --json` and `.aienvmp/sbom.json` now expose a standalone light SBOM artifact.
+- Verification: tests cover standalone SBOM construction, writing, sync output, schema metadata, and dashboard linking.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.47
+
+- Added `aienvmp sbom` for standalone AI-readable light SBOM output without deep manifest parsing.
+- Added `.aienvmp/sbom.json` writing through `aienvmp sbom --write` and the default `sync` flow.
+- Added the SBOM artifact path to the shared preflight artifacts map.
+- Added SBOM output metadata to `aienvmp schema --json`.
+- Added a dashboard Light SBOM Artifact card linking to `sbom.json`.
+- Updated README outputs and commands with the standalone SBOM artifact.
+- Added regression tests for SBOM artifact building, writing, sync output, schema contract, and dashboard rendering.
+
 ## 0.1.46
 
 - Added `lightSbom.riskSummary` with compact risk level, score, scanner state, signals, review targets, and next commands.

package/README.md

@@ -35,6 +35,7 @@ Warnings are advisory by default. Use `doctor --strict <scope>` only when you wa
 AIENV.md                 # Markdown env map for AI agents
 .aienvmp/status.json     # first AI read: clear/review, next command, nextAgent hint
 .aienvmp/manifest.json   # runtime map + light SBOM
+.aienvmp/sbom.json       # standalone AI-readable light SBOM
 .aienvmp/intents.jsonl   # planned env changes
 .aienvmp/timeline.jsonl  # append-only change ledger
 .aienvmp/plan.md         # read-only action plan
@@ -72,6 +73,7 @@ npx aienvmp snippet gemini
 aienvmp sync                    # update env map, status, ledger, dashboard
 aienvmp status --write          # refresh compact AI status
 aienvmp context --json          # AI decision contract
+aienvmp sbom --json             # standalone light SBOM
 aienvmp schema --json           # stable output contract for AI/CI consumers
 aienvmp plan --write            # read-only action plan
 aienvmp handoff --record        # next-agent summary

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.46",
+  "version": "0.1.47",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -15,6 +15,7 @@ import { planWorkspace } from "./commands/plan.js";
 import { statusWorkspace } from "./commands/status.js";
 import { schemaWorkspace } from "./commands/schema.js";
 import { checkpointWorkspace } from "./commands/checkpoint.js";
+import { sbomWorkspace } from "./commands/sbom.js";
 import { readFileSync } from "node:fs";
 
 const commands = new Map([
@@ -34,7 +35,8 @@ const commands = new Map([
   ["plan", planWorkspace],
   ["status", statusWorkspace],
   ["schema", schemaWorkspace],
-  ["checkpoint", checkpointWorkspace]
+  ["checkpoint", checkpointWorkspace],
+  ["sbom", sbomWorkspace]
 ]);
 
 const version = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
@@ -112,6 +114,7 @@ Usage:
   aienvmp handoff [--dir .] [--json] [--record --actor agent:id]
   aienvmp checkpoint [--dir .] --actor agent:id --summary "what changed" [--target dependency] [--json]
   aienvmp plan [--dir .] [--json] [--write]
+  aienvmp sbom [--dir .] [--json] [--write]
   aienvmp schema [--json]
 
 Common:
@@ -121,6 +124,7 @@ Common:
   aienvmp handoff   print the next-agent handoff summary
   aienvmp checkpoint record, sync, status, and handoff after an env change
   aienvmp plan      print a read-only AI environment action plan
+  aienvmp sbom      print/write standalone light SBOM artifact
   aienvmp schema    print the stable AI-readable output contract
   aienvmp snippet   print an AGENTS.md pointer snippet
   aienvmp dash      regenerate/open the lightweight dashboard
@@ -136,6 +140,7 @@ Advanced:
   aienvmp compile [--dir .]
   aienvmp diff [--dir .]
   aienvmp doctor [--dir .] [--json] [--ci] [--strict security|policy|coordination|all]
+  aienvmp sbom [--dir .] [--json] [--write]
   aienvmp dash [--dir .] [--open]
 `);
 }

package/src/commands/sbom.js

@@ -0,0 +1,51 @@
+import { readJson, writeJson } from "../fsutil.js";
+import { manifestPath, sbomJsonPath, workspaceDir } from "../paths.js";
+
+export async function sbomWorkspace(args = {}) {
+  const dir = workspaceDir(args);
+  const manifest = await readJson(manifestPath(dir));
+  if (!manifest) throw new Error("missing manifest; run `aienvmp sync` first");
+  const sbom = buildSbomArtifact(manifest);
+  const artifact = args.write ? await writeSbomArtifact(dir, sbom) : "";
+  const output = artifact ? { ...sbom, artifact } : sbom;
+  if (args.json || args.write || args.quiet) {
+    if (args.json) console.log(JSON.stringify(output, null, 2));
+  } else {
+    console.log(`sbom: ${sbom.riskSummary.level}/${sbom.riskSummary.score}`);
+    console.log(`packages: ${sbom.summary.packages || 0}`);
+    console.log(`vulnerabilities: ${sbom.summary.vulnerabilities || 0}`);
+    console.log(`next: ${sbom.riskSummary.next}`);
+  }
+  return output;
+}
+
+export function buildSbomArtifact(manifest = {}) {
+  const lightSbom = manifest.lightSbom || {};
+  return {
+    schemaVersion: 1,
+    schemaName: "aienvmp.light-sbom",
+    generatedAt: manifest.generatedAt || "",
+    workspace: manifest.workspace || {},
+    mode: lightSbom.mode || "light-sbom",
+    source: lightSbom.source || {},
+    confidence: lightSbom.confidence || {},
+    limitations: lightSbom.limitations || [],
+    summary: lightSbom.summary || { packages: 0, vulnerabilities: 0 },
+    riskSummary: lightSbom.riskSummary || { level: "clear", score: 0, signals: [], commands: [] },
+    topRisk: (lightSbom.topRisk || []).slice(0, 20),
+    packageManagerPolicy: lightSbom.packageManagerPolicy || {},
+    dependencyChangeHints: (lightSbom.dependencyChangeHints || []).slice(0, 20),
+    aiUse: {
+      purpose: "Standalone AI-readable light SBOM artifact.",
+      readBefore: "Dependency changes, vulnerability remediation, release review, or shared AI handoff.",
+      nextCommand: lightSbom.riskSummary?.commands?.[0] || "aienvmp context --json",
+      rule: "Use as a lightweight planning map; verify security claims with dedicated scanners."
+    }
+  };
+}
+
+export async function writeSbomArtifact(dir, sbom) {
+  const out = sbomJsonPath(dir);
+  await writeJson(out, sbom);
+  return out;
+}

package/src/commands/sync.js

@@ -3,6 +3,7 @@ import { scanWorkspace } from "./scan.js";
 import { compileWorkspace } from "./compile.js";
 import { dashWorkspace } from "./dash.js";
 import { statusWorkspace } from "./status.js";
+import { sbomWorkspace } from "./sbom.js";
 
 export async function syncWorkspace(args) {
   const quiet = args.quiet || args.json;
@@ -13,6 +14,7 @@ export async function syncWorkspace(args) {
   const compiled = await compileWorkspace(next);
   const dashboard = await dashWorkspace(next);
   const status = await statusWorkspace({ ...next, json: false, write: true, quiet: true });
+  const sbom = await sbomWorkspace({ ...next, json: false, write: true, quiet: true });
 
   const result = {
     status: "ok",
@@ -21,6 +23,7 @@ export async function syncWorkspace(args) {
       manifest: scanned.manifest,
       timeline: scanned.timeline,
       status: status.artifact,
+      sbom: sbom.artifact,
       dashboard: dashboard.dashboard
     },
     changes: scanned.changes,

package/src/contract.js

@@ -31,6 +31,11 @@ export function schemaContract() {
       manifest: {
         file: ".aienvmp/manifest.json",
         rootFields: ["schemaVersion", "workspace", "runtimes", "packageManagers", "dependencySnapshot", "lightSbom", "security", "trust"]
+      },
+      sbom: {
+        file: ".aienvmp/sbom.json",
+        command: "aienvmp sbom --json",
+        rootFields: ["schemaVersion", "schemaName", "workspace", "summary", "riskSummary", "topRisk", "packageManagerPolicy", "dependencyChangeHints"]
       }
     },
     compatibility: {

package/src/paths.js

@@ -16,6 +16,10 @@ export function statusJsonPath(dir) {
   return path.join(stateDir(dir), "status.json");
 }
 
+export function sbomJsonPath(dir) {
+  return path.join(stateDir(dir), "sbom.json");
+}
+
 export function previousManifestPath(dir) {
   return path.join(stateDir(dir), "manifest.previous.json");
 }

package/src/preflight.js

@@ -353,6 +353,7 @@ export function preflightArtifacts() {
     status: ".aienvmp/status.json",
     envMap: "AIENV.md",
     manifest: ".aienvmp/manifest.json",
+    sbom: ".aienvmp/sbom.json",
     dashboard: ".aienvmp/dashboard.html",
     planJson: ".aienvmp/plan.json",
     planMarkdown: ".aienvmp/plan.md",

package/src/render.js

@@ -442,6 +442,7 @@ const actions=manifest.recommendedActions||[];
 const actionsHtml=actions.length?'<div class="timeline">'+actions.slice(0,6).map(a=>\`<div class="event"><time>\${esc(a.priority)}</time><div><b>\${esc(a.category)}</b> \${esc(a.summary)}\${a.command?\`<div class="path">\${esc(a.command)}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No recommended actions. Continue project-local work.</div>';
 const plan=manifest.planArtifacts||{};
 const planHtml=plan.markdown||plan.json?\`<table><tr><th>Markdown</th><td>\${plan.markdown?'<a href="plan.md">plan.md</a>':'not written'}</td></tr><tr><th>JSON</th><td>\${plan.json?'<a href="plan.json">plan.json</a>':'not written'}</td></tr></table>\`:'<div class="okline">No plan artifacts yet. Run <code>aienvmp plan --write</code>.</div>';
+const sbomArtifactHtml='<table><tr><th>JSON</th><td><a href="sbom.json">sbom.json</a></td></tr><tr><th>Command</th><td><code>aienvmp sbom --write</code></td></tr></table>';
 const remediation=manifest.planRemediation||[];
 const remediationFix=r=>r.fixVersions?.length?\`fix \${r.fixVersions.join(', ')}\`:(r.fixAvailable?'fix available':'review required');
 const remediationRefs=r=>r.advisories?.length?\` - \${r.advisories.join(', ')}\`:'';
@@ -530,6 +531,8 @@ document.getElementById('app').innerHTML=\`
     <div style="height:14px"></div>
     \${card('AI Plan Artifacts',plan.markdown||plan.json?'<span class="pill">written</span>':'<span class="pill off">not written</span>',planHtml)}
     <div style="height:14px"></div>
+    \${card('Light SBOM Artifact','<span class="pill">json</span>',sbomArtifactHtml)}
+    <div style="height:14px"></div>
     \${card('Remediation Steps',remediation.length?'<span class="pill warn">'+remediation.length+' items</span>':'<span class="pill off">none</span>',remediationHtml)}
     <div style="height:14px"></div>
     \${card('Environment Steps',envSteps.length?'<span class="pill warn">'+envSteps.length+' items</span>':'<span class="pill off">none</span>',envStepsHtml)}