aienvmp 0.1.7 → 0.1.9

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.9
+
+- Added top vulnerable package summaries for AI context, handoff, `AIENV.md`, and the dashboard.
+- Ranked vulnerable packages by severity so agents can prioritize review without reading full audit output.
+- Kept security package details bounded to preserve lightweight output.
+
+## 0.1.8
+
+- Added optional `sync --security` / `scan --security` vulnerability summary collection.
+- Added read-only npm audit parsing for light SBOM security awareness.
+- Exposed security summaries to AI-facing context, handoff, `AIENV.md`, and the dashboard.
+
 ## 0.1.7
 
 - Added stale open intent warnings for long-running environment change plans.

package/README.md

@@ -21,10 +21,11 @@ npx aienvmp handoff
 npx aienvmp handoff --record --actor agent:codex
 ```
 
-Optional deeper read-only inventory:
+Optional read-only checks:
 
 ```bash
 npx aienvmp sync --deep
+npx aienvmp sync --security
 ```
 
 ## Output
@@ -68,6 +69,7 @@ aienvmp doctor --ci       # strict CI check
 - lightweight
 - one advisory engine, optional enforcement with `doctor --ci`
 - non-blocking unless strict mode is explicitly requested
+- security checks are opt-in and read-only
 
 ## Development
 

package/ROADMAP.md

@@ -7,6 +7,7 @@
 - Strengthen trust states: observed, planned, changed, review, verified, stale
 - Detect multi-agent environment intent conflicts
 - Keep one advisory decision engine with optional strict enforcement
+- Keep vulnerability checks opt-in and read-only
 - Stabilize `.aienvmp/manifest.json` and JSON command schemas
 - Keep `sync`, `context`, and `handoff` as the simple core flow
 - Improve the dashboard for 10-second human review
@@ -20,6 +21,9 @@
 - Global tool inventory:
   - richer summaries for `npm -g`, `pipx list`, `uv tool list`, and Homebrew
   - optional `--deep` scanners for more toolchains
+- Security summaries:
+  - Python vulnerability summary via optional scanner detection
+  - OS/container vulnerability summaries through optional external tools
 - Conflict detection:
   - package manager policy vs lockfile mismatch
   - monorepo/project boundary aware intent targets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -74,7 +74,7 @@ function printUsage() {
   console.log(`aienvmp - AI-first env map + lightweight runtime SBOM
 
 Usage:
-  aienvmp sync [--dir .] [--json] [--quiet] [--deep]
+  aienvmp sync [--dir .] [--json] [--quiet] [--deep] [--security]
   aienvmp context [--dir .] [--json]
   aienvmp handoff [--dir .] [--json] [--record --actor agent:id]
 
@@ -87,7 +87,7 @@ Common:
 
 Advanced:
   aienvmp init [--dir .]
-  aienvmp scan [--dir .] [--deep]
+  aienvmp scan [--dir .] [--deep] [--security]
   aienvmp intent [--dir .] --actor agent:codex --action "install pnpm"
   aienvmp resolve [--dir .] --actor human:you --id <intent-id> [--status resolved|cancelled]
   aienvmp record [--dir .] --actor agent:codex --summary "updated .nvmrc" [--target node] [--before 20] [--after 24]

package/src/commands/context.js

@@ -25,6 +25,7 @@ export async function contextWorkspace(args) {
       packageManagers: manifest.packageManagers,
       containers: manifest.containers,
       inventory: inventorySummary(manifest.inventory),
+      security: securitySummary(manifest.security),
       projectHints: manifest.projectHints,
       warnings,
       policy,
@@ -37,6 +38,15 @@ export async function contextWorkspace(args) {
   console.log(renderContext(manifest, timeline, warnings, intents, policy));
 }
 
+function securitySummary(security = {}) {
+  return {
+    mode: security.mode || "basic",
+    enabled: security.enabled === true,
+    summary: security.summary || { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 },
+    topPackages: security.topPackages || []
+  };
+}
+
 function inventorySummary(inventory = {}) {
   const tools = inventory.tools || {};
   return {

package/src/commands/handoff.js

@@ -53,6 +53,7 @@ export function buildHandoff(manifest, timeline = [], warnings = [], intents = [
       docker: manifest.containers?.docker ? "available" : "not detected"
     },
     inventory: inventorySummary(manifest.inventory),
+    security: securitySummary(manifest.security),
     policy: {
       node: policy.node || "not set",
       python: policy.python || "not set",
@@ -74,6 +75,15 @@ export function buildHandoff(manifest, timeline = [], warnings = [], intents = [
   };
 }
 
+function securitySummary(security = {}) {
+  return {
+    mode: security.mode || "basic",
+    enabled: security.enabled === true,
+    summary: security.summary || { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 },
+    topPackages: security.topPackages || []
+  };
+}
+
 function inventorySummary(inventory = {}) {
   const tools = inventory.tools || {};
   return {

package/src/commands/scan.js

@@ -11,7 +11,7 @@ export async function scanWorkspace(args) {
   if (previous && await exists(currentPath)) {
     await fs.copyFile(currentPath, previousManifestPath(dir));
   }
-  const manifest = await buildManifest(dir, { deep: args.deep });
+  const manifest = await buildManifest(dir, { deep: args.deep, security: args.security });
   await writeJson(currentPath, manifest);
   const changes = diffManifests(previous, manifest);
   for (const change of changes) {

package/src/doctor.js

@@ -42,12 +42,25 @@ export function diagnose(manifest, context = {}) {
       message: "Environment snapshot is older than 24 hours. Run `aienvmp sync` before changing the environment."
     });
   }
+  warnings.push(...securityWarnings(manifest.security));
   warnings.push(...coordinationWarnings(context.intents || []));
   warnings.push(...staleIntentWarnings(context.intents || []));
   warnings.push(...handoffWarnings(context.timeline || []));
   return warnings;
 }
 
+export function securityWarnings(security = {}) {
+  if (!security.enabled || !security.summary) return [];
+  const summary = security.summary;
+  if (Number(summary.critical || 0) > 0 || Number(summary.high || 0) > 0) {
+    return [{
+      code: "security-vulnerabilities",
+      message: `Security scan found ${summary.critical || 0} critical and ${summary.high || 0} high vulnerabilities. Review before changing or deploying the environment.`
+    }];
+  }
+  return [];
+}
+
 export function coordinationWarnings(intents = []) {
   const warnings = [];
   const byTarget = new Map();

package/src/manifest.js

@@ -5,6 +5,7 @@ import { commandOutput, commandVersion } from "./shell.js";
 import { exists } from "./fsutil.js";
 import { observedTrust } from "./trust.js";
 import { scanGlobalInventory } from "./inventory.js";
+import { scanSecurity } from "./security.js";
 
 export async function buildManifest(dir, options = {}) {
   const now = new Date().toISOString();
@@ -14,7 +15,7 @@ export async function buildManifest(dir, options = {}) {
     generatedAt: now,
     generatedBy: {
       name: "aienvmp",
-      command: options.deep ? "aienvmp sync --deep" : "aienvmp sync"
+      command: generatedCommand(options)
     },
     trust: observedTrust(new Date(now)),
     workspace: {
@@ -27,6 +28,7 @@ export async function buildManifest(dir, options = {}) {
     containers: await scanContainers(),
     projectHints: await scanProjectHints(dir),
     inventory: await scanGlobalInventory({ deep: options.deep }),
+    security: await scanSecurity(dir, { security: options.security }),
     agentFiles: await scanAgentFiles(dir),
     agentProtocol: {
       sourceOfTruth: "AIENV.md",
@@ -78,6 +80,10 @@ export async function buildManifest(dir, options = {}) {
         uvTools: "uv tool list",
         brew: "brew list --versions"
       },
+      security: {
+        mode: "basic by default; vulnerability summaries only when requested",
+        npmAudit: "npm audit --json"
+      },
       projectHints: [
         ".nvmrc",
         ".python-version",
@@ -96,6 +102,10 @@ export async function buildManifest(dir, options = {}) {
   return manifest;
 }
 
+function generatedCommand(options = {}) {
+  return ["aienvmp", "sync", options.deep ? "--deep" : "", options.security ? "--security" : ""].filter(Boolean).join(" ");
+}
+
 async function scanOS() {
   return {
     platform: os.platform(),

package/src/render.js

@@ -31,6 +31,8 @@ export function renderAIEnv(manifest, timeline = [], warnings = [], intents = []
   pushMap(lines, "Containers", manifest.containers);
   lines.push("## Global Tool Inventory", "");
   lines.push(...inventoryLines(manifest.inventory), "");
+  lines.push("## Security Summary", "");
+  lines.push(...securityLines(manifest.security), "");
   lines.push("## Project Requirements And Hints", "");
   pushMap(lines, "Detected", manifest.projectHints);
   lines.push("## Drift And Warnings", "");
@@ -96,6 +98,7 @@ export function renderContext(manifest, timeline = [], warnings = [], intents =
     `Python: ${manifest.runtimes.python || manifest.runtimes.python3 || "not detected"}`,
     `Docker: ${manifest.containers.docker ? "available" : "not detected"}`,
     `Inventory: ${manifest.inventory?.mode || "basic"}${manifest.inventory?.enabled ? " enabled" : " disabled"}`,
+    `Security: ${manifest.security?.mode || "basic"}${manifest.security?.enabled ? ` enabled (${manifest.security.summary?.total || 0} vulnerabilities)` : " disabled"}`,
     `Policy Node: ${policy.node || "not set"}`,
     `Policy Python: ${policy.python || "not set"}`,
     `Policy Package Manager: ${policy.packageManager || "not set"}`,
@@ -135,6 +138,7 @@ export function renderHandoff(handoff) {
     `- Python: ${handoff.safeRuntime.python}`,
     `- Docker: ${handoff.safeRuntime.docker}`,
     `- Inventory: ${handoff.inventory?.mode || "basic"}${handoff.inventory?.enabled ? " enabled" : " disabled"}`,
+    `- Security: ${handoff.security?.mode || "basic"}${handoff.security?.enabled ? ` enabled (${handoff.security.summary?.total || 0} vulnerabilities)` : " disabled"}`,
     "",
     "Open intents:",
     ...(handoff.openIntents.length ? handoff.openIntents.map((i) => `- ${i.actor}: ${i.action}${i.target ? ` (${i.target})` : ""}`) : ["- none"]),
@@ -213,6 +217,10 @@ const rows=o=>entries(o).map(([k,v])=>\`<tr><th>\${esc(k)}</th><td><code>\${esc(
 const inventoryGroups=manifest.inventory?.tools||{};
 const inventoryCount=Object.values(inventoryGroups).reduce((sum,items)=>sum+(Array.isArray(items)?items.length:0),0);
 const inventoryHtml=manifest.inventory?.enabled?('<table>'+Object.entries(inventoryGroups).map(([k,v])=>\`<tr><th>\${esc(k)}</th><td><code>\${Array.isArray(v)?v.length:0} tools</code></td></tr>\`).join('')+'</table>'):'<div class="okline">Deep global inventory is off. Run <code>aienvmp sync --deep</code> when an AI needs global tool awareness.</div>';
+const sec=manifest.security||{};
+const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0};
+const secPackages=sec.topPackages||[];
+const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${p.fixAvailable?'fix available':'review required'}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
 const change=c=>c.type==='changed'?\`\${c.scope} \${c.key}: \${c.before} -> \${c.after}\`:\`\${c.scope} \${c.key}: \${c.type} \${c.after||c.before}\`;
 const timelineLabel=t=>t.change?change(t.change):(t.summary||t.action||t.type||'recorded change');
 const agentNames={agents:'Codex',claude:'Claude',gemini:'Gemini'};
@@ -257,6 +265,7 @@ document.getElementById('app').innerHTML=\`
     \${card('Containers',manifest.containers?.docker?'<span class="pill">available</span>':'<span class="pill off">not detected</span>',\`<table>\${rows(manifest.containers)}</table>\`)}
     \${card('Project Hints',\`<span class="pill">\${entries(manifest.projectHints).length} hints</span>\`,\`<table>\${rows(manifest.projectHints)}</table>\`)}
     \${card('Global Inventory',manifest.inventory?.enabled?'<span class="pill">deep</span>':'<span class="pill off">basic</span>',inventoryHtml)}
+    \${card('Security Summary',sec.enabled?'<span class="pill warn">security</span>':'<span class="pill off">basic</span>',securityHtml)}
   </div>
   <aside>
     \${card('Environment Health',warnings.length?'<span class="pill warn">attention</span>':'<span class="pill">clear</span>',warnHtml)}
@@ -326,6 +335,27 @@ function inventoryLines(inventory = {}) {
   return lines;
 }
 
+function securityLines(security = {}) {
+  if (!security.enabled) return ["- Mode: basic", "- Security scan is disabled. Run `aienvmp sync --security` when vulnerability context is needed."];
+  const summary = security.summary || {};
+  const lines = [
+    "- Mode: security",
+    `- Total vulnerabilities: ${summary.total || 0}`,
+    `- Critical: ${summary.critical || 0}`,
+    `- High: ${summary.high || 0}`,
+    `- Moderate: ${summary.moderate || 0}`,
+    `- Low: ${summary.low || 0}`
+  ];
+  const packages = security.topPackages || [];
+  if (packages.length) {
+    lines.push("- Top vulnerable packages:");
+    for (const pkg of packages.slice(0, 8)) {
+      lines.push(`  - ${pkg.name}: ${pkg.severity}; ${pkg.fixAvailable ? "fix available" : "review required"}`);
+    }
+  }
+  return lines;
+}
+
 function policyLines(policy) {
   const lines = [];
   if (policy.node) lines.push(`- Node version policy: ${policy.node}`);

package/src/security.js

@@ -0,0 +1,100 @@
+import { exists } from "./fsutil.js";
+import { commandResult } from "./shell.js";
+import path from "node:path";
+
+const SEVERITIES = ["critical", "high", "moderate", "low", "info"];
+
+export async function scanSecurity(dir, options = {}) {
+  if (!options.security) {
+    return {
+      mode: "basic",
+      enabled: false,
+      note: "Run `aienvmp sync --security` to collect read-only vulnerability summaries."
+    };
+  }
+
+  const npmAudit = await scanNpmAudit(dir);
+  return {
+    mode: "security",
+    enabled: true,
+    note: "Read-only vulnerability summary. Use for review and CI policy, not automatic fixes.",
+    scanners: {
+      npmAudit
+    },
+    summary: summarizeScanners({ npmAudit }),
+    topPackages: topVulnerablePackages({ npmAudit })
+  };
+}
+
+export async function scanNpmAudit(dir) {
+  const hasPackageJson = await exists(path.join(dir, "package.json"));
+  if (!hasPackageJson) return unavailable("npm-audit", "package.json not found");
+
+  const command = process.platform === "win32" ? "npm.cmd" : "npm";
+  const result = await commandResult(command, ["audit", "--json"], {
+    cwd: dir,
+    timeout: 15000,
+    maxBuffer: 4 * 1024 * 1024
+  });
+  const parsed = parseNpmAudit(result.stdout);
+  if (!parsed.available) {
+    return unavailable("npm-audit", result.stderr || "npm audit did not return parseable JSON");
+  }
+  return {
+    scanner: "npm-audit",
+    available: true,
+    ok: result.ok,
+    exitCode: result.code,
+    summary: parsed.summary,
+    vulnerablePackages: parsed.vulnerablePackages
+  };
+}
+
+export function parseNpmAudit(raw) {
+  try {
+    const parsed = JSON.parse(raw || "{}");
+    const metadata = parsed.metadata || {};
+    const vulnerabilities = parsed.vulnerabilities || {};
+    const severityCounts = Object.fromEntries(SEVERITIES.map((severity) => [severity, Number(metadata.vulnerabilities?.[severity] || 0)]));
+    const total = Number(metadata.vulnerabilities?.total || Object.values(severityCounts).reduce((sum, value) => sum + value, 0));
+    const vulnerablePackages = Object.entries(vulnerabilities).slice(0, 20).map(([name, value]) => ({
+      name,
+      severity: value.severity || "unknown",
+      viaCount: Array.isArray(value.via) ? value.via.length : 0,
+      fixAvailable: Boolean(value.fixAvailable)
+    }));
+    return {
+      available: true,
+      summary: { total, ...severityCounts },
+      vulnerablePackages
+    };
+  } catch {
+    return { available: false };
+  }
+}
+
+export function summarizeScanners(scanners = {}) {
+  const summary = { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 };
+  for (const scanner of Object.values(scanners)) {
+    if (!scanner?.available) continue;
+    for (const key of Object.keys(summary)) summary[key] += Number(scanner.summary?.[key] || 0);
+  }
+  return summary;
+}
+
+export function topVulnerablePackages(scanners = {}, limit = 8) {
+  const rank = { critical: 0, high: 1, moderate: 2, low: 3, info: 4, unknown: 5 };
+  return Object.values(scanners)
+    .filter((scanner) => scanner?.available)
+    .flatMap((scanner) => (scanner.vulnerablePackages || []).map((pkg) => ({ ...pkg, scanner: scanner.scanner })))
+    .sort((a, b) => (rank[a.severity] ?? rank.unknown) - (rank[b.severity] ?? rank.unknown) || a.name.localeCompare(b.name))
+    .slice(0, limit);
+}
+
+function unavailable(scanner, reason) {
+  return {
+    scanner,
+    available: false,
+    reason
+  };
+}

package/src/shell.js

@@ -20,6 +20,7 @@ export async function commandOutput(command, args = [], options = {}) {
     const { stdout } = await execFileAsync(command, args, {
       timeout: options.timeout || 2500,
       maxBuffer: options.maxBuffer || 1024 * 1024,
+      cwd: options.cwd,
       windowsHide: true
     });
     return stdout.trim();
@@ -28,6 +29,25 @@ export async function commandOutput(command, args = [], options = {}) {
   }
 }
 
+export async function commandResult(command, args = [], options = {}) {
+  try {
+    const { stdout, stderr } = await execFileAsync(command, args, {
+      timeout: options.timeout || 5000,
+      maxBuffer: options.maxBuffer || 2 * 1024 * 1024,
+      cwd: options.cwd,
+      windowsHide: true
+    });
+    return { ok: true, code: 0, stdout: stdout.trim(), stderr: stderr.trim() };
+  } catch (error) {
+    return {
+      ok: false,
+      code: typeof error.code === "number" ? error.code : 1,
+      stdout: String(error.stdout || "").trim(),
+      stderr: String(error.stderr || error.message || "").trim()
+    };
+  }
+}
+
 export function firstVersion(text) {
   const match = String(text).match(/(?:v)?(\d+\.\d+(?:\.\d+)?(?:[-+][\w.]+)?)/);
   return match ? match[1] : null;