aienvmp 0.1.9 → 0.1.11

package/BUGFIXES.md

@@ -28,6 +28,12 @@ Short record of bugs, fixes, and follow-up checks.
 - Fix: test command used `/bin/zsh -lc` to load login shell PATH.
 - Verification: remote test detected Node `v25.3.0`, npm `11.11.0`, and completed `aienvmp sync`.
 
+### Security summaries lacked remediation hints
+
+- Issue: AI agents could see vulnerable package names but not enough bounded detail to plan the next dependency update.
+- Fix: npm and Python security summaries now include fix versions and advisory references when scanners provide them.
+- Verification: parser tests cover npm remediation objects and pip-audit advisory ids; Windows and macOS tarball tests completed `sync --security`.
+
 ## Template
 
 ### Title

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.11
+
+- Added bounded remediation details to security summaries, including fix versions and advisory references.
+- Surfaced remediation hints in `AIENV.md` and the dashboard so AI agents can plan safer dependency updates.
+- Kept security scanning read-only and opt-in.
+
+## 0.1.10
+
+- Added optional `pip-audit` JSON parsing for Python security summaries.
+- Combined npm and Python vulnerable package summaries into the same AI-facing security context.
+- Kept missing Python scanners non-blocking with explicit scanner availability metadata.
+
 ## 0.1.9
 
 - Added top vulnerable package summaries for AI context, handoff, `AIENV.md`, and the dashboard.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aienvmp",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "AI-first environment maps and lightweight runtime SBOMs for shared development machines.",
   "type": "module",
   "bin": {

package/src/render.js

@@ -220,7 +220,9 @@ const inventoryHtml=manifest.inventory?.enabled?('<table>'+Object.entries(invent
 const sec=manifest.security||{};
 const secSummary=sec.summary||{total:0,critical:0,high:0,moderate:0,low:0,info:0};
 const secPackages=sec.topPackages||[];
-const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${p.fixAvailable?'fix available':'review required'}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
+const securityFix=p=>p.fixVersions?.length?\`fix \${p.fixVersions.slice(0,3).join(', ')}\`:(p.fixAvailable?'fix available':'review required');
+const securityRefs=p=>p.advisories?.length?\` · \${p.advisories.map(a=>a.id||a.title).filter(Boolean).slice(0,2).join(', ')}\`:'';
+const securityHtml=sec.enabled?\`<table><tr><th>Total</th><td><code>\${esc(secSummary.total||0)}</code></td></tr><tr><th>Critical</th><td><code>\${esc(secSummary.critical||0)}</code></td></tr><tr><th>High</th><td><code>\${esc(secSummary.high||0)}</code></td></tr><tr><th>Moderate</th><td><code>\${esc(secSummary.moderate||0)}</code></td></tr><tr><th>Low</th><td><code>\${esc(secSummary.low||0)}</code></td></tr></table>\${secPackages.length?'<div class="timeline">'+secPackages.slice(0,5).map(p=>\`<div class="event"><time>\${esc(p.severity)}</time><div><b>\${esc(p.name)}</b> \${esc(securityFix(p))}\${esc(securityRefs(p))}</div></div>\`).join('')+'</div>':'<div class="okline" style="margin-top:10px">No vulnerable packages reported.</div>'}\`:'<div class="okline">Security scan is off. Run <code>aienvmp sync --security</code> for read-only vulnerability summary.</div>';
 const change=c=>c.type==='changed'?\`\${c.scope} \${c.key}: \${c.before} -> \${c.after}\`:\`\${c.scope} \${c.key}: \${c.type} \${c.after||c.before}\`;
 const timelineLabel=t=>t.change?change(t.change):(t.summary||t.action||t.type||'recorded change');
 const agentNames={agents:'Codex',claude:'Claude',gemini:'Gemini'};
@@ -350,12 +352,21 @@ function securityLines(security = {}) {
   if (packages.length) {
     lines.push("- Top vulnerable packages:");
     for (const pkg of packages.slice(0, 8)) {
-      lines.push(`  - ${pkg.name}: ${pkg.severity}; ${pkg.fixAvailable ? "fix available" : "review required"}`);
+      lines.push(`  - ${pkg.name}: ${pkg.severity}; ${securityPackageNote(pkg)}`);
     }
   }
   return lines;
 }
 
+function securityPackageNote(pkg) {
+  const fix = pkg.fixVersions?.length ? `fix ${pkg.fixVersions.slice(0, 3).join(", ")}` : pkg.fixAvailable ? "fix available" : "review required";
+  const advisories = (pkg.advisories || [])
+    .map((item) => item.id || item.title)
+    .filter(Boolean)
+    .slice(0, 2);
+  return advisories.length ? `${fix}; advisories ${advisories.join(", ")}` : fix;
+}
+
 function policyLines(policy) {
   const lines = [];
   if (policy.node) lines.push(`- Node version policy: ${policy.node}`);

package/src/security.js

@@ -14,15 +14,15 @@ export async function scanSecurity(dir, options = {}) {
   }
 
   const npmAudit = await scanNpmAudit(dir);
+  const pipAudit = await scanPipAudit(dir);
+  const scanners = { npmAudit, pipAudit };
   return {
     mode: "security",
     enabled: true,
     note: "Read-only vulnerability summary. Use for review and CI policy, not automatic fixes.",
-    scanners: {
-      npmAudit
-    },
-    summary: summarizeScanners({ npmAudit }),
-    topPackages: topVulnerablePackages({ npmAudit })
+    scanners,
+    summary: summarizeScanners(scanners),
+    topPackages: topVulnerablePackages(scanners)
   };
 }
 
@@ -50,6 +50,29 @@ export async function scanNpmAudit(dir) {
   };
 }
 
+export async function scanPipAudit(dir) {
+  const hasPythonHints = await exists(path.join(dir, "pyproject.toml")) || await exists(path.join(dir, "requirements.txt"));
+  if (!hasPythonHints) return unavailable("pip-audit", "Python project hints not found");
+
+  const result = await commandResult("pip-audit", ["-f", "json"], {
+    cwd: dir,
+    timeout: 15000,
+    maxBuffer: 4 * 1024 * 1024
+  });
+  const parsed = parsePipAudit(result.stdout);
+  if (!parsed.available) {
+    return unavailable("pip-audit", result.stderr || "pip-audit did not return parseable JSON");
+  }
+  return {
+    scanner: "pip-audit",
+    available: true,
+    ok: result.ok,
+    exitCode: result.code,
+    summary: parsed.summary,
+    vulnerablePackages: parsed.vulnerablePackages
+  };
+}
+
 export function parseNpmAudit(raw) {
   try {
     const parsed = JSON.parse(raw || "{}");
@@ -57,12 +80,18 @@ export function parseNpmAudit(raw) {
     const vulnerabilities = parsed.vulnerabilities || {};
     const severityCounts = Object.fromEntries(SEVERITIES.map((severity) => [severity, Number(metadata.vulnerabilities?.[severity] || 0)]));
     const total = Number(metadata.vulnerabilities?.total || Object.values(severityCounts).reduce((sum, value) => sum + value, 0));
-    const vulnerablePackages = Object.entries(vulnerabilities).slice(0, 20).map(([name, value]) => ({
-      name,
-      severity: value.severity || "unknown",
-      viaCount: Array.isArray(value.via) ? value.via.length : 0,
-      fixAvailable: Boolean(value.fixAvailable)
-    }));
+    const vulnerablePackages = Object.entries(vulnerabilities).slice(0, 20).map(([name, value]) => {
+      const fixVersions = npmFixVersions(value.fixAvailable);
+      const advisories = npmAdvisories(value.via);
+      return {
+        name,
+        severity: value.severity || "unknown",
+        viaCount: Array.isArray(value.via) ? value.via.length : 0,
+        fixAvailable: hasFixAvailable(value.fixAvailable),
+        fixVersions,
+        advisories
+      };
+    });
     return {
       available: true,
       summary: { total, ...severityCounts },
@@ -73,6 +102,33 @@ export function parseNpmAudit(raw) {
   }
 }
 
+export function parsePipAudit(raw) {
+  try {
+    const parsed = JSON.parse(raw || "{}");
+    const dependencies = Array.isArray(parsed.dependencies) ? parsed.dependencies : [];
+    const vulnerablePackages = dependencies
+      .filter((dependency) => Array.isArray(dependency.vulns) && dependency.vulns.length)
+      .slice(0, 20)
+      .map((dependency) => ({
+        name: dependency.name || "unknown",
+        version: dependency.version || "unknown",
+        severity: "unknown",
+        viaCount: dependency.vulns.length,
+        fixAvailable: dependency.vulns.some((vuln) => Array.isArray(vuln.fix_versions) && vuln.fix_versions.length),
+        fixVersions: unique(dependency.vulns.flatMap((vuln) => vuln.fix_versions || [])).slice(0, 5),
+        advisories: pipAdvisories(dependency.vulns)
+      }));
+    const total = vulnerablePackages.reduce((sum, pkg) => sum + pkg.viaCount, 0);
+    return {
+      available: true,
+      summary: { total, critical: 0, high: 0, moderate: 0, low: 0, info: 0 },
+      vulnerablePackages
+    };
+  } catch {
+    return { available: false };
+  }
+}
+
 export function summarizeScanners(scanners = {}) {
   const summary = { total: 0, critical: 0, high: 0, moderate: 0, low: 0, info: 0 };
   for (const scanner of Object.values(scanners)) {
@@ -98,3 +154,42 @@ function unavailable(scanner, reason) {
     reason
   };
 }
+
+function unique(items) {
+  return [...new Set(items.filter(Boolean))];
+}
+
+function hasFixAvailable(value) {
+  if (typeof value === "boolean") return value;
+  return Boolean(value && typeof value === "object");
+}
+
+function npmFixVersions(value) {
+  if (!value || typeof value !== "object") return [];
+  return unique([value.version]).slice(0, 5);
+}
+
+function npmAdvisories(via = []) {
+  if (!Array.isArray(via)) return [];
+  return via
+    .filter((item) => item && typeof item === "object")
+    .map((item) => ({
+      id: String(item.source || item.id || item.cve || item.name || "").trim(),
+      title: String(item.title || "").trim(),
+      url: String(item.url || "").trim(),
+      severity: item.severity || "unknown"
+    }))
+    .filter((item) => item.id || item.title || item.url)
+    .slice(0, 5);
+}
+
+function pipAdvisories(vulns = []) {
+  return vulns
+    .map((vuln) => ({
+      id: String(vuln.id || vuln.aliases?.[0] || "").trim(),
+      aliases: Array.isArray(vuln.aliases) ? vuln.aliases.slice(0, 5) : [],
+      fixVersions: Array.isArray(vuln.fix_versions) ? vuln.fix_versions.slice(0, 5) : []
+    }))
+    .filter((item) => item.id || item.aliases.length || item.fixVersions.length)
+    .slice(0, 5);
+}