aienvmp 0.1.47 → 0.1.49

package/BUGFIXES.md

@@ -70,6 +70,18 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: `aienvmp sbom --json` and `.aienvmp/sbom.json` now expose a standalone light SBOM artifact.
 - Verification: tests cover standalone SBOM construction, writing, sync output, schema metadata, and dashboard linking.
 
+### Light SBOM needed a lightweight standard export
+
+- Issue: the standalone SBOM was AI-friendly, but less convenient for tools expecting CycloneDX-shaped data.
+- Fix: `aienvmp sbom --format cyclonedx-lite` and `.aienvmp/sbom.cdx.json` now export project-manifest packages in a CycloneDX-compatible shape with explicit limitations.
+- Verification: tests cover component mapping, vulnerability hints, sync output, schema metadata, and dashboard links.
+
+### CI example did not surface SBOM artifacts clearly
+
+- Issue: sync could generate SBOM artifacts, but the GitHub Action and example upload list did not make them explicit.
+- Fix: the Action now has `write-sbom` and the example uploads both native and CycloneDX-lite SBOM artifacts.
+- Verification: Action tests cover input metadata, SBOM write commands, and example artifact paths.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.1.49
+
+- Added a `write-sbom` GitHub Action input for explicit SBOM artifact generation.
+- Added Action steps for writing `.aienvmp/sbom.json` and `.aienvmp/sbom.cdx.json`.
+- Updated the GitHub Action example to enable SBOM writing.
+- Added native light SBOM artifact upload paths to the example workflow.
+- Added CycloneDX-lite artifact upload paths to the example workflow.
+- Updated README CI usage to mention SBOM artifacts.
+- Added regression coverage for Action SBOM inputs, commands, and example upload paths.
+
+## 0.1.48
+
+- Added `aienvmp sbom --format cyclonedx-lite` for a lightweight CycloneDX-compatible export.
+- Added `.aienvmp/sbom.cdx.json` writing through the default `sync` flow.
+- Added CycloneDX-lite artifact paths to status/preflight outputs and schema metadata.
+- Added dashboard links for `sbom.cdx.json` beside the native light SBOM artifact.
+- Added README guidance for the CycloneDX-lite command and output.
+- Included explicit metadata limitations so consumers know no install or dependency resolver was run.
+- Added regression tests for CycloneDX-lite component mapping, vulnerability hints, sync output, schema contract, and dashboard rendering.
+
 ## 0.1.47
 
 - Added `aienvmp sbom` for standalone AI-readable light SBOM output without deep manifest parsing.

package/README.md

@@ -36,6 +36,7 @@ AIENV.md                 # Markdown env map for AI agents
 .aienvmp/status.json     # first AI read: clear/review, next command, nextAgent hint
 .aienvmp/manifest.json   # runtime map + light SBOM
 .aienvmp/sbom.json       # standalone AI-readable light SBOM
+.aienvmp/sbom.cdx.json   # CycloneDX-lite export from project manifests
 .aienvmp/intents.jsonl   # planned env changes
 .aienvmp/timeline.jsonl  # append-only change ledger
 .aienvmp/plan.md         # read-only action plan
@@ -74,6 +75,7 @@ aienvmp sync                    # update env map, status, ledger, dashboard
 aienvmp status --write          # refresh compact AI status
 aienvmp context --json          # AI decision contract
 aienvmp sbom --json             # standalone light SBOM
+aienvmp sbom --format cyclonedx-lite --json
 aienvmp schema --json           # stable output contract for AI/CI consumers
 aienvmp plan --write            # read-only action plan
 aienvmp handoff --record        # next-agent summary
@@ -85,13 +87,14 @@ aienvmp doctor --strict security|policy|coordination|all
 
 ## CI
 
-The GitHub Action writes status, schema, doctor, plan, and dashboard artifacts. `strict: "off"` reports warnings without failing the job.
+The GitHub Action writes status, schema, doctor, plan, SBOM, and dashboard artifacts. `strict: "off"` reports warnings without failing the job.
 
 ```yaml
 - uses: soovwv/aienvmp@main
   with:
     write-status: "true"
     write-plan: "true"
+    write-sbom: "true"
     strict: "off"
 ```
 

package/action.yml

@@ -27,6 +27,10 @@ inputs:
     description: Write doctor JSON with advisory/strict exit behavior
     required: false
     default: "true"
+  write-sbom:
+    description: Write standalone light SBOM and CycloneDX-lite artifacts
+    required: false
+    default: "true"
 
 runs:
   using: composite
@@ -65,6 +69,14 @@ runs:
           node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}" --json > "${{ inputs.directory }}/.aienvmp/doctor.json"
         fi
 
+    - name: Write SBOM artifacts
+      shell: bash
+      run: |
+        if [ "${{ inputs.write-sbom }}" = "true" ]; then
+          node "$GITHUB_ACTION_PATH/bin/aienvmp.js" sbom --dir "${{ inputs.directory }}" --write --quiet
+          node "$GITHUB_ACTION_PATH/bin/aienvmp.js" sbom --dir "${{ inputs.directory }}" --format cyclonedx-lite --write --quiet
+        fi
+
     - name: Doctor
       shell: bash
       run: |

package/examples/github-action.yml

@@ -16,6 +16,7 @@ jobs:
           write-plan: "true"
           write-schema: "true"
           write-doctor-json: "true"
+          write-sbom: "true"
           strict: "off" # security, policy, coordination, all, or off
 
       - uses: actions/upload-artifact@v4
@@ -26,6 +27,8 @@ jobs:
             AIENV.md
             .aienvmp/manifest.json
             .aienvmp/status.json
+            .aienvmp/sbom.json
+            .aienvmp/sbom.cdx.json
             .aienvmp/schema.json
             .aienvmp/doctor.json
             .aienvmp/plan.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/sbom.js

@@ -1,12 +1,13 @@
 import { readJson, writeJson } from "../fsutil.js";
-import { manifestPath, sbomJsonPath, workspaceDir } from "../paths.js";
+import { cyclonedxSbomPath, manifestPath, sbomJsonPath, workspaceDir } from "../paths.js";
 
 export async function sbomWorkspace(args = {}) {
   const dir = workspaceDir(args);
   const manifest = await readJson(manifestPath(dir));
   if (!manifest) throw new Error("missing manifest; run `aienvmp sync` first");
-  const sbom = buildSbomArtifact(manifest);
-  const artifact = args.write ? await writeSbomArtifact(dir, sbom) : "";
+  const format = normalizeFormat(args.format);
+  const sbom = format === "cyclonedx-lite" ? buildCycloneDxLite(manifest) : buildSbomArtifact(manifest);
+  const artifact = args.write ? await writeSbomArtifact(dir, sbom, format) : "";
   const output = artifact ? { ...sbom, artifact } : sbom;
   if (args.json || args.write || args.quiet) {
     if (args.json) console.log(JSON.stringify(output, null, 2));
@@ -45,7 +46,98 @@ export function buildSbomArtifact(manifest = {}) {
 }
 
 export async function writeSbomArtifact(dir, sbom) {
-  const out = sbomJsonPath(dir);
+  const out = sbom.bomFormat === "CycloneDX" ? cyclonedxSbomPath(dir) : sbomJsonPath(dir);
   await writeJson(out, sbom);
   return out;
 }
+
+export function buildCycloneDxLite(manifest = {}) {
+  const snapshot = manifest.dependencySnapshot || {};
+  const packages = snapshot.packages || [];
+  const lightSbom = manifest.lightSbom || {};
+  return {
+    bomFormat: "CycloneDX",
+    specVersion: "1.6",
+    serialNumber: `urn:uuid:aienvmp-${hashText(`${manifest.workspace?.path || ""}:${manifest.generatedAt || ""}`)}`,
+    version: 1,
+    metadata: {
+      timestamp: manifest.generatedAt || "",
+      tools: {
+        components: [{
+          type: "application",
+          name: "aienvmp",
+          version: manifest.generatedBy?.version || "unknown"
+        }]
+      },
+      component: {
+        type: "application",
+        name: manifest.workspace?.name || "workspace",
+        bomRef: "workspace"
+      },
+      properties: [
+        { name: "aienvmp:format", value: "cyclonedx-lite" },
+        { name: "aienvmp:source", value: lightSbom.source?.dependencies || "project manifests" },
+        { name: "aienvmp:confidence:transitiveDependencies", value: lightSbom.confidence?.transitiveDependencies || "not-resolved" },
+        { name: "aienvmp:risk:level", value: lightSbom.riskSummary?.level || "clear" },
+        { name: "aienvmp:risk:score", value: String(lightSbom.riskSummary?.score || 0) }
+      ]
+    },
+    components: packages.slice(0, 200).map(cycloneComponent),
+    vulnerabilities: (lightSbom.topRisk || []).slice(0, 50).map(cycloneVulnerability),
+    properties: [
+      { name: "aienvmp:limitation", value: "Light SBOM from project manifests only; no install or dependency resolver was run." },
+      { name: "aienvmp:verifyWith", value: "CycloneDX, Syft, Trivy, npm audit, pip-audit, or another dedicated scanner before security claims." }
+    ]
+  };
+}
+
+function cycloneComponent(pkg = {}) {
+  const version = String(pkg.version || "unspecified");
+  return {
+    type: "library",
+    name: pkg.name || "unknown",
+    version,
+    purl: packageUrl(pkg, version),
+    bomRef: `${pkg.ecosystem || "pkg"}:${pkg.name || "unknown"}@${version}`,
+    properties: [
+      { name: "aienvmp:ecosystem", value: pkg.ecosystem || "unknown" },
+      { name: "aienvmp:manager", value: pkg.manager || "unknown" },
+      { name: "aienvmp:manifest", value: pkg.manifest || "" },
+      { name: "aienvmp:group", value: pkg.group || "" }
+    ]
+  };
+}
+
+function cycloneVulnerability(pkg = {}) {
+  return {
+    id: pkg.name || "unknown",
+    source: { name: "aienvmp-light-sbom" },
+    ratings: [{ severity: pkg.severity || "unknown" }],
+    affects: [{
+      ref: `${pkg.ecosystem || "pkg"}:${pkg.name || "unknown"}@${pkg.version || "unspecified"}`
+    }],
+    properties: [
+      { name: "aienvmp:priority", value: pkg.priority || "low" },
+      { name: "aienvmp:score", value: String(pkg.score || 0) },
+      { name: "aienvmp:directDependency", value: String(pkg.directDependency === true) },
+      { name: "aienvmp:manifest", value: pkg.manifest || "" }
+    ]
+  };
+}
+
+function packageUrl(pkg = {}, version = "") {
+  const type = pkg.ecosystem === "python" ? "pypi" : "npm";
+  return `pkg:${type}/${encodeURIComponent(pkg.name || "unknown")}@${encodeURIComponent(version)}`;
+}
+
+function normalizeFormat(format = "") {
+  const value = String(format || "aienvmp").toLowerCase();
+  if (["cyclonedx", "cyclonedx-lite", "cdx"].includes(value)) return "cyclonedx-lite";
+  return "aienvmp";
+}
+
+function hashText(text = "") {
+  let hash = 0;
+  for (const ch of String(text)) hash = ((hash << 5) - hash + ch.charCodeAt(0)) >>> 0;
+  return `${hash.toString(16).padStart(8, "0")}-0000-4000-8000-000000000000`;
+}

package/src/commands/sync.js

@@ -15,6 +15,7 @@ export async function syncWorkspace(args) {
   const dashboard = await dashWorkspace(next);
   const status = await statusWorkspace({ ...next, json: false, write: true, quiet: true });
   const sbom = await sbomWorkspace({ ...next, json: false, write: true, quiet: true });
+  const cyclonedx = await sbomWorkspace({ ...next, json: false, write: true, quiet: true, format: "cyclonedx-lite" });
 
   const result = {
     status: "ok",
@@ -24,6 +25,7 @@ export async function syncWorkspace(args) {
       timeline: scanned.timeline,
       status: status.artifact,
       sbom: sbom.artifact,
+      cyclonedx: cyclonedx.artifact,
       dashboard: dashboard.dashboard
     },
     changes: scanned.changes,

package/src/contract.js

@@ -36,6 +36,11 @@ export function schemaContract() {
         file: ".aienvmp/sbom.json",
         command: "aienvmp sbom --json",
         rootFields: ["schemaVersion", "schemaName", "workspace", "summary", "riskSummary", "topRisk", "packageManagerPolicy", "dependencyChangeHints"]
+      },
+      cyclonedxLite: {
+        file: ".aienvmp/sbom.cdx.json",
+        command: "aienvmp sbom --format cyclonedx-lite --json",
+        rootFields: ["bomFormat", "specVersion", "metadata", "components", "vulnerabilities", "properties"]
       }
     },
     compatibility: {

package/src/paths.js

@@ -20,6 +20,10 @@ export function sbomJsonPath(dir) {
   return path.join(stateDir(dir), "sbom.json");
 }
 
+export function cyclonedxSbomPath(dir) {
+  return path.join(stateDir(dir), "sbom.cdx.json");
+}
+
 export function previousManifestPath(dir) {
   return path.join(stateDir(dir), "manifest.previous.json");
 }

package/src/preflight.js

@@ -354,6 +354,7 @@ export function preflightArtifacts() {
     envMap: "AIENV.md",
     manifest: ".aienvmp/manifest.json",
     sbom: ".aienvmp/sbom.json",
+    cyclonedx: ".aienvmp/sbom.cdx.json",
     dashboard: ".aienvmp/dashboard.html",
     planJson: ".aienvmp/plan.json",
     planMarkdown: ".aienvmp/plan.md",

package/src/render.js

@@ -442,7 +442,7 @@ const actions=manifest.recommendedActions||[];
 const actionsHtml=actions.length?'<div class="timeline">'+actions.slice(0,6).map(a=>\`<div class="event"><time>\${esc(a.priority)}</time><div><b>\${esc(a.category)}</b> \${esc(a.summary)}\${a.command?\`<div class="path">\${esc(a.command)}</div>\`:''}</div></div>\`).join('')+'</div>':'<div class="okline">No recommended actions. Continue project-local work.</div>';
 const plan=manifest.planArtifacts||{};
 const planHtml=plan.markdown||plan.json?\`<table><tr><th>Markdown</th><td>\${plan.markdown?'<a href="plan.md">plan.md</a>':'not written'}</td></tr><tr><th>JSON</th><td>\${plan.json?'<a href="plan.json">plan.json</a>':'not written'}</td></tr></table>\`:'<div class="okline">No plan artifacts yet. Run <code>aienvmp plan --write</code>.</div>';
-const sbomArtifactHtml='<table><tr><th>JSON</th><td><a href="sbom.json">sbom.json</a></td></tr><tr><th>Command</th><td><code>aienvmp sbom --write</code></td></tr></table>';
+const sbomArtifactHtml='<table><tr><th>JSON</th><td><a href="sbom.json">sbom.json</a></td></tr><tr><th>CDX Lite</th><td><a href="sbom.cdx.json">sbom.cdx.json</a></td></tr><tr><th>Command</th><td><code>aienvmp sbom --write</code></td></tr></table>';
 const remediation=manifest.planRemediation||[];
 const remediationFix=r=>r.fixVersions?.length?\`fix \${r.fixVersions.join(', ')}\`:(r.fixAvailable?'fix available':'review required');
 const remediationRefs=r=>r.advisories?.length?\` - \${r.advisories.join(', ')}\`:'';