aienvmp 0.1.8 → 0.1.10

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.10
+
+- Added optional `pip-audit` JSON parsing for Python security summaries.
+- Combined npm and Python vulnerable package summaries into the same AI-facing security context.
+- Kept missing Python scanners non-blocking with explicit scanner availability metadata.
+
+## 0.1.9
+
+- Added top vulnerable package summaries for AI context, handoff, `AIENV.md`, and the dashboard.
+- Ranked vulnerable packages by severity so agents can prioritize review without reading full audit output.
+- Kept security package details bounded to preserve lightweight output.
+
 ## 0.1.8
 
 - Added optional `sync --security` / `scan --security` vulnerability summary collection.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/commands/context.js

@@ -42,7 +42,8 @@ function securitySummary(security = {}) {
   return {
     mode: security.mode || "basic",
     enabled: security.enabled === true,
-    summary: security.summary || { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 }
+    summary: security.summary || { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 },
+    topPackages: security.topPackages || []
   };
 }
 

package/src/commands/handoff.js

@@ -79,7 +79,8 @@ function securitySummary(security = {}) {
   return {
     mode: security.mode || "basic",
     enabled: security.enabled === true,
-    summary: security.summary || { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 }
+    summary: security.summary || { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 },
+    topPackages: security.topPackages || []
   };
 }
 

package/src/render.js

@@ -219,7 +219,8 @@ const inventoryCount=Object.values(inventoryGroups).reduce((sum,items)=>sum+(Arr
 const inventoryHtml=manifest.inventory?.enabled?('<table>'+Object.entries(inventoryGroups).map(([k,v])=>\`<tr><th>\${esc(k)}</th><td><code>\${Array.isArray(v)?v.length:0} tools</code></td></tr>\`).join('')+'</table>'):'<div class="okline">Deep global inventory is off. Run <code>aienvmp sync --deep</code> when an AI needs global tool awareness.</div>';
 const sec=manifest.security||{};
 const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0};
-const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
+const secPackages=sec.topPackages||[];
+const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${p.fixAvailable?'fix available':'review required'}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
 const change=c=>c.type==='changed'?\`\${c.scope} \${c.key}: \${c.before} -> \${c.after}\`:\`\${c.scope} \${c.key}: \${c.type} \${c.after||c.before}\`;
 const timelineLabel=t=>t.change?change(t.change):(t.summary||t.action||t.type||'recorded change');
 const agentNames={agents:'Codex',claude:'Claude',gemini:'Gemini'};
@@ -337,7 +338,7 @@ function inventoryLines(inventory = {}) {
 function securityLines(security = {}) {
   if (!security.enabled) return ["- Mode: basic", "- Security scan is disabled. Run `aienvmp sync --security` when vulnerability context is needed."];
   const summary = security.summary || {};
-  return [
+  const lines = [
     "- Mode: security",
     `- Total vulnerabilities: ${summary.total || 0}`,
     `- Critical: ${summary.critical || 0}`,
@@ -345,6 +346,14 @@ function securityLines(security = {}) {
     `- Moderate: ${summary.moderate || 0}`,
     `- Low: ${summary.low || 0}`
   ];
+  const packages = security.topPackages || [];
+  if (packages.length) {
+    lines.push("- Top vulnerable packages:");
+    for (const pkg of packages.slice(0, 8)) {
+      lines.push(`  - ${pkg.name}: ${pkg.severity}; ${pkg.fixAvailable ? "fix available" : "review required"}`);
+    }
+  }
+  return lines;
 }
 
 function policyLines(policy) {

package/src/security.js

@@ -14,14 +14,15 @@ export async function scanSecurity(dir, options = {}) {
   }
 
   const npmAudit = await scanNpmAudit(dir);
+  const pipAudit = await scanPipAudit(dir);
+  const scanners = { npmAudit, pipAudit };
   return {
     mode: "security",
     enabled: true,
     note: "Read-only vulnerability summary. Use for review and CI policy, not automatic fixes.",
-    scanners: {
-      npmAudit
-    },
-    summary: summarizeScanners({ npmAudit })
+    scanners,
+    summary: summarizeScanners(scanners),
+    topPackages: topVulnerablePackages(scanners)
   };
 }
 
@@ -49,6 +50,29 @@ export async function scanNpmAudit(dir) {
   };
 }
 
+export async function scanPipAudit(dir) {
+  const hasPythonHints = await exists(path.join(dir, "pyproject.toml")) || await exists(path.join(dir, "requirements.txt"));
+  if (!hasPythonHints) return unavailable("pip-audit", "Python project hints not found");
+
+  const result = await commandResult("pip-audit", ["-f", "json"], {
+    cwd: dir,
+    timeout: 15000,
+    maxBuffer: 4 * 1024 * 1024
+  });
+  const parsed = parsePipAudit(result.stdout);
+  if (!parsed.available) {
+    return unavailable("pip-audit", result.stderr || "pip-audit did not return parseable JSON");
+  }
+  return {
+    scanner: "pip-audit",
+    available: true,
+    ok: result.ok,
+    exitCode: result.code,
+    summary: parsed.summary,
+    vulnerablePackages: parsed.vulnerablePackages
+  };
+}
+
 export function parseNpmAudit(raw) {
   try {
     const parsed = JSON.parse(raw || "{}");
@@ -72,6 +96,32 @@ export function parseNpmAudit(raw) {
   }
 }
 
+export function parsePipAudit(raw) {
+  try {
+    const parsed = JSON.parse(raw || "{}");
+    const dependencies = Array.isArray(parsed.dependencies) ? parsed.dependencies : [];
+    const vulnerablePackages = dependencies
+      .filter((dependency) => Array.isArray(dependency.vulns) && dependency.vulns.length)
+      .slice(0, 20)
+      .map((dependency) => ({
+        name: dependency.name || "unknown",
+        version: dependency.version || "unknown",
+        severity: "unknown",
+        viaCount: dependency.vulns.length,
+        fixAvailable: dependency.vulns.some((vuln) => Array.isArray(vuln.fix_versions) && vuln.fix_versions.length),
+        fixVersions: unique(dependency.vulns.flatMap((vuln) => vuln.fix_versions || [])).slice(0, 5)
+      }));
+    const total = vulnerablePackages.reduce((sum, pkg) => sum + pkg.viaCount, 0);
+    return {
+      available: true,
+      summary: { total, critical: 0, high: 0, moderate: 0, low: 0, info: 0 },
+      vulnerablePackages
+    };
+  } catch {
+    return { available: false };
+  }
+}
+
 export function summarizeScanners(scanners = {}) {
   const summary = { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 };
   for (const scanner of Object.values(scanners)) {
@@ -81,6 +131,15 @@ export function summarizeScanners(scanners = {}) {
   return summary;
 }
 
+export function topVulnerablePackages(scanners = {}, limit = 8) {
+  const rank = { critical: 0, high: 1, moderate: 2, low: 3, info: 4, unknown: 5 };
+  return Object.values(scanners)
+    .filter((scanner) => scanner?.available)
+    .flatMap((scanner) => (scanner.vulnerablePackages || []).map((pkg) => ({ ...pkg, scanner: scanner.scanner })))
+    .sort((a, b) => (rank[a.severity] ?? rank.unknown) - (rank[b.severity] ?? rank.unknown) || a.name.localeCompare(b.name))
+    .slice(0, limit);
+}
+
 function unavailable(scanner, reason) {
   return {
     scanner,
@@ -88,3 +147,7 @@ function unavailable(scanner, reason) {
     reason
   };
 }
+
+function unique(items) {
+  return [...new Set(items.filter(Boolean))];
+}