Documentation
¶
Overview ¶
Package aibom discovers evidence of AI coding agents and AI-SDK usage in a codebase and maps it to a CycloneDX AI Bill of Materials.
All detection is driven by a declarative catalog (internal/aibom/catalog/*.json) so the rules — env-var names, tool directories/files, SDK import patterns and the SDK parameters that carry model names — can be maintained over time without code changes. The catalog is embedded in the binary and can be extended or overridden at runtime with --catalog.
Index ¶
- func Detect(opts Options) (cdx.AIDetections, error)
- type Catalog
- type CompiledCatalog
- type CompiledExtractor
- type CompiledFamily
- type CompiledLibrary
- type CompiledModelExtractor
- type CompiledPathRule
- type CompiledTool
- type ConfigExtractor
- type FamilyDef
- type LibraryDef
- type ModelExtractor
- type Options
- type ToolDef
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Catalog ¶
type Catalog struct {
Version string `json:"version"`
Tools []ToolDef `json:"tools"`
Libraries []LibraryDef `json:"libraries"`
Families []FamilyDef `json:"model_families"`
}
Catalog is the raw (uncompiled) detection catalog.
func DefaultCatalog ¶
DefaultCatalog parses and merges the embedded catalog files.
func LoadCatalog ¶
LoadCatalog returns the catalog to use for a scan. When noBuiltin is false the embedded catalog is loaded first; when overridePath is non-empty that file is merged on top (entries with a matching id replace the builtin; new ids are appended).
func (*Catalog) Compile ¶
func (c *Catalog) Compile() (*CompiledCatalog, error)
Compile compiles and validates every regex/glob in the catalog. It is the single validation gate used by both the runtime detector and the docs generator, so a malformed pattern fails fast and identically in both.
type CompiledCatalog ¶
type CompiledCatalog struct {
Version string
Tools []CompiledTool
Libraries []CompiledLibrary
Families []CompiledFamily
}
CompiledCatalog is the catalog with all regexes compiled and validated.
type CompiledExtractor ¶
type CompiledFamily ¶
type CompiledLibrary ¶
type CompiledLibrary struct {
Def LibraryDef
Langs map[string]bool
Imports []*regexp.Regexp
Models []CompiledModelExtractor
}
type CompiledModelExtractor ¶
type CompiledPathRule ¶
type CompiledTool ¶
type CompiledTool struct {
Def ToolDef
EnvExact map[string]bool
EnvGlobs []*regexp.Regexp
Paths []CompiledPathRule
Extractors []CompiledExtractor
Commits []*regexp.Regexp
}
type ConfigExtractor ¶
type ConfigExtractor struct {
FileGlob string `json:"file_glob"`
JSONKey string `json:"json_key,omitempty"`
Pattern string `json:"pattern,omitempty"`
}
ConfigExtractor extracts a model name from a tool config file, either by a JSON/YAML key or a regex with a single capture group.
type FamilyDef ¶
type FamilyDef struct {
PrefixRegex string `json:"prefix_regex"`
Provider string `json:"provider"`
Family string `json:"family"`
}
FamilyDef maps a model-name prefix pattern to a provider/family. It only enriches confidence — it never suppresses an unknown literal.
type LibraryDef ¶
type LibraryDef struct {
ID string `json:"id"`
Name string `json:"name"`
Provider string `json:"provider"`
Languages []string `json:"languages"`
PurlNames map[string]string `json:"purl_names,omitempty"` // ecosystem -> package name
// ImportPatterns confirm the library is in use (import/require/use lines).
ImportPatterns []string `json:"import_patterns"`
// ModelExtractors capture the model-name literal bound to a known SDK
// parameter. Anchoring on the parameter (not the value) is what makes
// unknown/future model names detectable.
ModelExtractors []ModelExtractor `json:"model_extractors,omitempty"`
}
LibraryDef describes one AI SDK / framework and how to detect its use and extract the model names passed to it.
type ModelExtractor ¶
type ModelExtractor struct {
Param string `json:"param"`
Pattern string `json:"pattern"`
Task string `json:"task,omitempty"` // chat | embedding | image | completion | ...
}
ModelExtractor is a regex with exactly one capture group = the model literal.
type Options ¶
type Options struct {
Root string
MaxDepth int
Ignore []string
ScanEnv bool
IncludeHome bool
ScanSource bool
ScanCommits bool
// CommitMax bounds how many commits the commit-history pass inspects (<=0
// uses defaultCommitScanMax).
CommitMax int
Catalog *CompiledCatalog
// Environ is injectable for tests; defaults to os.Environ() when nil.
Environ []string
// RespectGitignore prunes .gitignored paths (default off; the aibom command
// sets it true unless --aibom-include-ignored is passed).
RespectGitignore bool
}
Options controls a detection run.
type ToolDef ¶
type ToolDef struct {
ID string `json:"id"`
Name string `json:"name"`
Vendor string `json:"vendor"`
Type string `json:"type"` // cli-agent | ide-extension | ide | service
Homepage string `json:"homepage,omitempty"`
// Env are environment variable names (exact, or globs with '*') that this
// tool sets. Only the NAME and presence are ever recorded — never the value.
Env []string `json:"env,omitempty"`
// Paths maps an evidence category (config, instructions, ignore, skills,
// hooks, plugins, steering, memory, prompts, agents, commands, marketplace)
// to a list of repo-relative path globs ('*', '**', '?' supported).
Paths map[string][]string `json:"paths,omitempty"`
// ModelConfigExtractors pull model-name literals out of this tool's own
// config files.
ModelConfigExtractors []ConfigExtractor `json:"model_config_extractors,omitempty"`
// CommitPatterns are regexes matched against each commit's author/committer
// identity and message (e.g. a "Co-Authored-By: Claude <noreply@anthropic.com>"
// trailer, a "Claude-Session:" line, an agent bot author, or a "Generated
// with <tool>" marker). They identify commits authored by this agent in git
// history. No capture group required — these are presence signals.
CommitPatterns []string `json:"commit_patterns,omitempty"`
}
ToolDef describes one AI coding agent / assistant and the on-disk + environment evidence that identifies it.
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Command aibomgen renders the AIBOM detection documentation from the single source of truth: the embedded catalog (internal/aibom/catalog/*.json).
|
Command aibomgen renders the AIBOM detection documentation from the single source of truth: the embedded catalog (internal/aibom/catalog/*.json). |