aienvmp 0.1.46 → 0.1.48

package/BUGFIXES.md

@@ -64,6 +64,18 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: `lightSbom.riskSummary` and preflight `sbomRisk` now provide a compact risk score, signals, review targets, and advisory next steps.
 - Verification: tests cover risk scoring, top-risk severity fallback, scanner-off guidance, status/context exposure, dashboard rendering, and recommended actions.
 
+### Light SBOM was only nested inside larger artifacts
+
+- Issue: CI tools and AI agents that only need dependency/SBOM context had to read the full manifest or context payload.
+- Fix: `aienvmp sbom --json` and `.aienvmp/sbom.json` now expose a standalone light SBOM artifact.
+- Verification: tests cover standalone SBOM construction, writing, sync output, schema metadata, and dashboard linking.
+
+### Light SBOM needed a lightweight standard export
+
+- Issue: the standalone SBOM was AI-friendly, but less convenient for tools expecting CycloneDX-shaped data.
+- Fix: `aienvmp sbom --format cyclonedx-lite` and `.aienvmp/sbom.cdx.json` now export project-manifest packages in a CycloneDX-compatible shape with explicit limitations.
+- Verification: tests cover component mapping, vulnerability hints, sync output, schema metadata, and dashboard links.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.1.48
+
+- Added `aienvmp sbom --format cyclonedx-lite` for a lightweight CycloneDX-compatible export.
+- Added `.aienvmp/sbom.cdx.json` writing through the default `sync` flow.
+- Added CycloneDX-lite artifact paths to status/preflight outputs and schema metadata.
+- Added dashboard links for `sbom.cdx.json` beside the native light SBOM artifact.
+- Added README guidance for the CycloneDX-lite command and output.
+- Included explicit metadata limitations so consumers know no install or dependency resolver was run.
+- Added regression tests for CycloneDX-lite component mapping, vulnerability hints, sync output, schema contract, and dashboard rendering.
+
+## 0.1.47
+
+- Added `aienvmp sbom` for standalone AI-readable light SBOM output without deep manifest parsing.
+- Added `.aienvmp/sbom.json` writing through `aienvmp sbom --write` and the default `sync` flow.
+- Added the SBOM artifact path to the shared preflight artifacts map.
+- Added SBOM output metadata to `aienvmp schema --json`.
+- Added a dashboard Light SBOM Artifact card linking to `sbom.json`.
+- Updated README outputs and commands with the standalone SBOM artifact.
+- Added regression tests for SBOM artifact building, writing, sync output, schema contract, and dashboard rendering.
+
 ## 0.1.46
 
 - Added `lightSbom.riskSummary` with compact risk level, score, scanner state, signals, review targets, and next commands.

package/README.md

@@ -35,6 +35,8 @@ Warnings are advisory by default. Use `doctor --strict <scope>` only when you wa
 AIENV.md                 # Markdown env map for AI agents
 .aienvmp/status.json     # first AI read: clear/review, next command, nextAgent hint
 .aienvmp/manifest.json   # runtime map + light SBOM
+.aienvmp/sbom.json       # standalone AI-readable light SBOM
+.aienvmp/sbom.cdx.json   # CycloneDX-lite export from project manifests
 .aienvmp/intents.jsonl   # planned env changes
 .aienvmp/timeline.jsonl  # append-only change ledger
 .aienvmp/plan.md         # read-only action plan
@@ -72,6 +74,8 @@ npx aienvmp snippet gemini
 aienvmp sync                    # update env map, status, ledger, dashboard
 aienvmp status --write          # refresh compact AI status
 aienvmp context --json          # AI decision contract
+aienvmp sbom --json             # standalone light SBOM
+aienvmp sbom --format cyclonedx-lite --json
 aienvmp schema --json           # stable output contract for AI/CI consumers
 aienvmp plan --write            # read-only action plan
 aienvmp handoff --record        # next-agent summary

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -15,6 +15,7 @@ import { planWorkspace } from "./commands/plan.js";
 import { statusWorkspace } from "./commands/status.js";
 import { schemaWorkspace } from "./commands/schema.js";
 import { checkpointWorkspace } from "./commands/checkpoint.js";
+import { sbomWorkspace } from "./commands/sbom.js";
 import { readFileSync } from "node:fs";
 
 const commands = new Map([
@@ -34,7 +35,8 @@ const commands = new Map([
   ["plan", planWorkspace],
   ["status", statusWorkspace],
   ["schema", schemaWorkspace],
-  ["checkpoint", checkpointWorkspace]
+  ["checkpoint", checkpointWorkspace],
+  ["sbom", sbomWorkspace]
 ]);
 
 const version = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
@@ -112,6 +114,7 @@ Usage:
   aienvmp handoff [--dir .] [--json] [--record --actor agent:id]
   aienvmp checkpoint [--dir .] --actor agent:id --summary "what changed" [--target dependency] [--json]
   aienvmp plan [--dir .] [--json] [--write]
+  aienvmp sbom [--dir .] [--json] [--write]
   aienvmp schema [--json]
 
 Common:
@@ -121,6 +124,7 @@ Common:
   aienvmp handoff   print the next-agent handoff summary
   aienvmp checkpoint record, sync, status, and handoff after an env change
   aienvmp plan      print a read-only AI environment action plan
+  aienvmp sbom      print/write standalone light SBOM artifact
   aienvmp schema    print the stable AI-readable output contract
   aienvmp snippet   print an AGENTS.md pointer snippet
   aienvmp dash      regenerate/open the lightweight dashboard
@@ -136,6 +140,7 @@ Advanced:
   aienvmp compile [--dir .]
   aienvmp diff [--dir .]
   aienvmp doctor [--dir .] [--json] [--ci] [--strict security|policy|coordination|all]
+  aienvmp sbom [--dir .] [--json] [--write]
   aienvmp dash [--dir .] [--open]
 `);
 }

package/src/commands/sbom.js

@@ -0,0 +1,143 @@
+import { readJson, writeJson } from "../fsutil.js";
+import { cyclonedxSbomPath, manifestPath, sbomJsonPath, workspaceDir } from "../paths.js";
+
+export async function sbomWorkspace(args = {}) {
+  const dir = workspaceDir(args);
+  const manifest = await readJson(manifestPath(dir));
+  if (!manifest) throw new Error("missing manifest; run `aienvmp sync` first");
+  const format = normalizeFormat(args.format);
+  const sbom = format === "cyclonedx-lite" ? buildCycloneDxLite(manifest) : buildSbomArtifact(manifest);
+  const artifact = args.write ? await writeSbomArtifact(dir, sbom, format) : "";
+  const output = artifact ? { ...sbom, artifact } : sbom;
+  if (args.json || args.write || args.quiet) {
+    if (args.json) console.log(JSON.stringify(output, null, 2));
+  } else {
+    console.log(`sbom: ${sbom.riskSummary.level}/${sbom.riskSummary.score}`);
+    console.log(`packages: ${sbom.summary.packages || 0}`);
+    console.log(`vulnerabilities: ${sbom.summary.vulnerabilities || 0}`);
+    console.log(`next: ${sbom.riskSummary.next}`);
+  }
+  return output;
+}
+
+export function buildSbomArtifact(manifest = {}) {
+  const lightSbom = manifest.lightSbom || {};
+  return {
+    schemaVersion: 1,
+    schemaName: "aienvmp.light-sbom",
+    generatedAt: manifest.generatedAt || "",
+    workspace: manifest.workspace || {},
+    mode: lightSbom.mode || "light-sbom",
+    source: lightSbom.source || {},
+    confidence: lightSbom.confidence || {},
+    limitations: lightSbom.limitations || [],
+    summary: lightSbom.summary || { packages: 0, vulnerabilities: 0 },
+    riskSummary: lightSbom.riskSummary || { level: "clear", score: 0, signals: [], commands: [] },
+    topRisk: (lightSbom.topRisk || []).slice(0, 20),
+    packageManagerPolicy: lightSbom.packageManagerPolicy || {},
+    dependencyChangeHints: (lightSbom.dependencyChangeHints || []).slice(0, 20),
+    aiUse: {
+      purpose: "Standalone AI-readable light SBOM artifact.",
+      readBefore: "Dependency changes, vulnerability remediation, release review, or shared AI handoff.",
+      nextCommand: lightSbom.riskSummary?.commands?.[0] || "aienvmp context --json",
+      rule: "Use as a lightweight planning map; verify security claims with dedicated scanners."
+    }
+  };
+}
+
+export async function writeSbomArtifact(dir, sbom) {
+  const out = sbom.bomFormat === "CycloneDX" ? cyclonedxSbomPath(dir) : sbomJsonPath(dir);
+  await writeJson(out, sbom);
+  return out;
+}
+
+export function buildCycloneDxLite(manifest = {}) {
+  const snapshot = manifest.dependencySnapshot || {};
+  const packages = snapshot.packages || [];
+  const lightSbom = manifest.lightSbom || {};
+  return {
+    bomFormat: "CycloneDX",
+    specVersion: "1.6",
+    serialNumber: `urn:uuid:aienvmp-${hashText(`${manifest.workspace?.path || ""}:${manifest.generatedAt || ""}`)}`,
+    version: 1,
+    metadata: {
+      timestamp: manifest.generatedAt || "",
+      tools: {
+        components: [{
+          type: "application",
+          name: "aienvmp",
+          version: manifest.generatedBy?.version || "unknown"
+        }]
+      },
+      component: {
+        type: "application",
+        name: manifest.workspace?.name || "workspace",
+        bomRef: "workspace"
+      },
+      properties: [
+        { name: "aienvmp:format", value: "cyclonedx-lite" },
+        { name: "aienvmp:source", value: lightSbom.source?.dependencies || "project manifests" },
+        { name: "aienvmp:confidence:transitiveDependencies", value: lightSbom.confidence?.transitiveDependencies || "not-resolved" },
+        { name: "aienvmp:risk:level", value: lightSbom.riskSummary?.level || "clear" },
+        { name: "aienvmp:risk:score", value: String(lightSbom.riskSummary?.score || 0) }
+      ]
+    },
+    components: packages.slice(0, 200).map(cycloneComponent),
+    vulnerabilities: (lightSbom.topRisk || []).slice(0, 50).map(cycloneVulnerability),
+    properties: [
+      { name: "aienvmp:limitation", value: "Light SBOM from project manifests only; no install or dependency resolver was run." },
+      { name: "aienvmp:verifyWith", value: "CycloneDX, Syft, Trivy, npm audit, pip-audit, or another dedicated scanner before security claims." }
+    ]
+  };
+}
+
+function cycloneComponent(pkg = {}) {
+  const version = String(pkg.version || "unspecified");
+  return {
+    type: "library",
+    name: pkg.name || "unknown",
+    version,
+    purl: packageUrl(pkg, version),
+    bomRef: `${pkg.ecosystem || "pkg"}:${pkg.name || "unknown"}@${version}`,
+    properties: [
+      { name: "aienvmp:ecosystem", value: pkg.ecosystem || "unknown" },
+      { name: "aienvmp:manager", value: pkg.manager || "unknown" },
+      { name: "aienvmp:manifest", value: pkg.manifest || "" },
+      { name: "aienvmp:group", value: pkg.group || "" }
+    ]
+  };
+}
+
+function cycloneVulnerability(pkg = {}) {
+  return {
+    id: pkg.name || "unknown",
+    source: { name: "aienvmp-light-sbom" },
+    ratings: [{ severity: pkg.severity || "unknown" }],
+    affects: [{
+      ref: `${pkg.ecosystem || "pkg"}:${pkg.name || "unknown"}@${pkg.version || "unspecified"}`
+    }],
+    properties: [
+      { name: "aienvmp:priority", value: pkg.priority || "low" },
+      { name: "aienvmp:score", value: String(pkg.score || 0) },
+      { name: "aienvmp:directDependency", value: String(pkg.directDependency === true) },
+      { name: "aienvmp:manifest", value: pkg.manifest || "" }
+    ]
+  };
+}
+
+function packageUrl(pkg = {}, version = "") {
+  const type = pkg.ecosystem === "python" ? "pypi" : "npm";
+  return `pkg:${type}/${encodeURIComponent(pkg.name || "unknown")}@${encodeURIComponent(version)}`;
+}
+
+function normalizeFormat(format = "") {
+  const value = String(format || "aienvmp").toLowerCase();
+  if (["cyclonedx", "cyclonedx-lite", "cdx"].includes(value)) return "cyclonedx-lite";
+  return "aienvmp";
+}
+
+function hashText(text = "") {
+  let hash = 0;
+  for (const ch of String(text)) hash = ((hash << 5) - hash + ch.charCodeAt(0)) >>> 0;
+  return `${hash.toString(16).padStart(8, "0")}-0000-4000-8000-000000000000`;
+}

package/src/commands/sync.js

@@ -3,6 +3,7 @@ import { scanWorkspace } from "./scan.js";
 import { compileWorkspace } from "./compile.js";
 import { dashWorkspace } from "./dash.js";
 import { statusWorkspace } from "./status.js";
+import { sbomWorkspace } from "./sbom.js";
 
 export async function syncWorkspace(args) {
   const quiet = args.quiet || args.json;
@@ -13,6 +14,8 @@ export async function syncWorkspace(args) {
   const compiled = await compileWorkspace(next);
   const dashboard = await dashWorkspace(next);
   const status = await statusWorkspace({ ...next, json: false, write: true, quiet: true });
+  const sbom = await sbomWorkspace({ ...next, json: false, write: true, quiet: true });
+  const cyclonedx = await sbomWorkspace({ ...next, json: false, write: true, quiet: true, format: "cyclonedx-lite" });
 
   const result = {
     status: "ok",
@@ -21,6 +24,8 @@ export async function syncWorkspace(args) {
       manifest: scanned.manifest,
       timeline: scanned.timeline,
       status: status.artifact,
+      sbom: sbom.artifact,
+      cyclonedx: cyclonedx.artifact,
       dashboard: dashboard.dashboard
     },
     changes: scanned.changes,

package/src/contract.js

@@ -31,6 +31,16 @@ export function schemaContract() {
       manifest: {
         file: ".aienvmp/manifest.json",
         rootFields: ["schemaVersion", "workspace", "runtimes", "packageManagers", "dependencySnapshot", "lightSbom", "security", "trust"]
+      },
+      sbom: {
+        file: ".aienvmp/sbom.json",
+        command: "aienvmp sbom --json",
+        rootFields: ["schemaVersion", "schemaName", "workspace", "summary", "riskSummary", "topRisk", "packageManagerPolicy", "dependencyChangeHints"]
+      },
+      cyclonedxLite: {
+        file: ".aienvmp/sbom.cdx.json",
+        command: "aienvmp sbom --format cyclonedx-lite --json",
+        rootFields: ["bomFormat", "specVersion", "metadata", "components", "vulnerabilities", "properties"]
       }
     },
     compatibility: {

package/src/paths.js

@@ -16,6 +16,14 @@ export function statusJsonPath(dir) {
   return path.join(stateDir(dir), "status.json");
 }
 
+export function sbomJsonPath(dir) {
+  return path.join(stateDir(dir), "sbom.json");
+}
+
+export function cyclonedxSbomPath(dir) {
+  return path.join(stateDir(dir), "sbom.cdx.json");
+}
+
 export function previousManifestPath(dir) {
   return path.join(stateDir(dir), "manifest.previous.json");
 }

package/src/preflight.js

@@ -353,6 +353,8 @@ export function preflightArtifacts() {
     status: ".aienvmp/status.json",
     envMap: "AIENV.md",
     manifest: ".aienvmp/manifest.json",
+    sbom: ".aienvmp/sbom.json",
+    cyclonedx: ".aienvmp/sbom.cdx.json",
     dashboard: ".aienvmp/dashboard.html",
     planJson: ".aienvmp/plan.json",
     planMarkdown: ".aienvmp/plan.md",

package/src/render.js

@@ -442,6 +442,7 @@ const actions=manifest.recommendedActions||[];
 const actionsHtml=actions.length?'<div class="timeline">'+actions.slice(0,6).map(a=>\`<div class="event"><time>\${esc(a.priority)}</time><div><b>\${esc(a.category)}</b> \${esc(a.summary)}\${a.command?\`<div class="path">\${esc(a.command)}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No recommended actions. Continue project-local work.</div>';
 const plan=manifest.planArtifacts||{};
 const planHtml=plan.markdown||plan.json?\`<table><tr><th>Markdown</th><td>\${plan.markdown?'<a href="plan.md">plan.md</a>':'not written'}</td></tr><tr><th>JSON</th><td>\${plan.json?'<a href="plan.json">plan.json</a>':'not written'}</td></tr></table>\`:'<div class="okline">No plan artifacts yet. Run <code>aienvmp plan --write</code>.</div>';
+const sbomArtifactHtml='<table><tr><th>JSON</th><td><a href="sbom.json">sbom.json</a></td></tr><tr><th>CDX Lite</th><td><a href="sbom.cdx.json">sbom.cdx.json</a></td></tr><tr><th>Command</th><td><code>aienvmp sbom --write</code></td></tr></table>';
 const remediation=manifest.planRemediation||[];
 const remediationFix=r=>r.fixVersions?.length?\`fix \${r.fixVersions.join(', ')}\`:(r.fixAvailable?'fix available':'review required');
 const remediationRefs=r=>r.advisories?.length?\` - \${r.advisories.join(', ')}\`:'';
@@ -530,6 +531,8 @@ document.getElementById('app').innerHTML=\`
     <div style="height:14px"></div>
     \${card('AI Plan Artifacts',plan.markdown||plan.json?'<span class="pill">written</span>':'<span class="pill off">not written</span>',planHtml)}
     <div style="height:14px"></div>
+    \${card('Light SBOM Artifact','<span class="pill">json</span>',sbomArtifactHtml)}
+    <div style="height:14px"></div>
     \${card('Remediation Steps',remediation.length?'<span class="pill warn">'+remediation.length+' items</span>':'<span class="pill off">none</span>',remediationHtml)}
     <div style="height:14px"></div>
     \${card('Environment Steps',envSteps.length?'<span class="pill warn">'+envSteps.length+' items</span>':'<span class="pill off">none</span>',envStepsHtml)}