aibom

package
v3.56.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 10, 2026 License: AGPL-3.0 Imports: 14 Imported by: 0

Documentation

Overview

Package aibom discovers evidence of AI coding agents and AI-SDK usage in a codebase and maps it to a CycloneDX AI Bill of Materials.

All detection is driven by a declarative catalog (internal/aibom/catalog/*.json) so the rules — env-var names, tool directories/files, SDK import patterns and the SDK parameters that carry model names — can be maintained over time without code changes. The catalog is embedded in the binary and can be extended or overridden at runtime with --catalog.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Detect

func Detect(opts Options) (cdx.AIDetections, error)

Detect runs the enabled passes and returns CycloneDX-ready detections.

Types

type Catalog

type Catalog struct {
	Version   string       `json:"version"`
	Tools     []ToolDef    `json:"tools"`
	Libraries []LibraryDef `json:"libraries"`
	Families  []FamilyDef  `json:"model_families"`
}

Catalog is the raw (uncompiled) detection catalog.

func DefaultCatalog

func DefaultCatalog() (*Catalog, error)

DefaultCatalog parses and merges the embedded catalog files.

func LoadCatalog

func LoadCatalog(overridePath string, noBuiltin bool) (*Catalog, error)

LoadCatalog returns the catalog to use for a scan. When noBuiltin is false the embedded catalog is loaded first; when overridePath is non-empty that file is merged on top (entries with a matching id replace the builtin; new ids are appended).

func (*Catalog) Compile

func (c *Catalog) Compile() (*CompiledCatalog, error)

Compile compiles and validates every regex/glob in the catalog. It is the single validation gate used by both the runtime detector and the docs generator, so a malformed pattern fails fast and identically in both.

type CompiledCatalog

type CompiledCatalog struct {
	Version   string
	Tools     []CompiledTool
	Libraries []CompiledLibrary
	Families  []CompiledFamily
}

CompiledCatalog is the catalog with all regexes compiled and validated.

type CompiledExtractor

type CompiledExtractor struct {
	FileGlob *regexp.Regexp
	JSONKey  string
	Re       *regexp.Regexp // nil when JSONKey is used
}

type CompiledFamily

type CompiledFamily struct {
	Def FamilyDef
	Re  *regexp.Regexp
}

type CompiledLibrary

type CompiledLibrary struct {
	Def     LibraryDef
	Langs   map[string]bool
	Imports []*regexp.Regexp
	Models  []CompiledModelExtractor
}

type CompiledModelExtractor

type CompiledModelExtractor struct {
	Param string
	Task  string
	Re    *regexp.Regexp
}

type CompiledPathRule

type CompiledPathRule struct {
	Category string
	Raw      string
	Re       *regexp.Regexp // nil when Exact
	Exact    bool
}

type CompiledTool

type CompiledTool struct {
	Def        ToolDef
	EnvExact   map[string]bool
	EnvGlobs   []*regexp.Regexp
	Paths      []CompiledPathRule
	Extractors []CompiledExtractor
	Commits    []*regexp.Regexp
}

type ConfigExtractor

type ConfigExtractor struct {
	FileGlob string `json:"file_glob"`
	JSONKey  string `json:"json_key,omitempty"`
	Pattern  string `json:"pattern,omitempty"`
}

ConfigExtractor extracts a model name from a tool config file, either by a JSON/YAML key or a regex with a single capture group.

type FamilyDef

type FamilyDef struct {
	PrefixRegex string `json:"prefix_regex"`
	Provider    string `json:"provider"`
	Family      string `json:"family"`
}

FamilyDef maps a model-name prefix pattern to a provider/family. It only enriches confidence — it never suppresses an unknown literal.

type LibraryDef

type LibraryDef struct {
	ID        string            `json:"id"`
	Name      string            `json:"name"`
	Provider  string            `json:"provider"`
	Languages []string          `json:"languages"`
	PurlNames map[string]string `json:"purl_names,omitempty"` // ecosystem -> package name
	// ImportPatterns confirm the library is in use (import/require/use lines).
	ImportPatterns []string `json:"import_patterns"`
	// ModelExtractors capture the model-name literal bound to a known SDK
	// parameter. Anchoring on the parameter (not the value) is what makes
	// unknown/future model names detectable.
	ModelExtractors []ModelExtractor `json:"model_extractors,omitempty"`
}

LibraryDef describes one AI SDK / framework and how to detect its use and extract the model names passed to it.

type ModelExtractor

type ModelExtractor struct {
	Param   string `json:"param"`
	Pattern string `json:"pattern"`
	Task    string `json:"task,omitempty"` // chat | embedding | image | completion | ...
}

ModelExtractor is a regex with exactly one capture group = the model literal.

type Options

type Options struct {
	Root        string
	MaxDepth    int
	Ignore      []string
	ScanEnv     bool
	IncludeHome bool
	ScanSource  bool
	ScanCommits bool
	// CommitMax bounds how many commits the commit-history pass inspects (<=0
	// uses defaultCommitScanMax).
	CommitMax int
	Catalog   *CompiledCatalog
	// Environ is injectable for tests; defaults to os.Environ() when nil.
	Environ []string
	// RespectGitignore prunes .gitignored paths (default off; the aibom command
	// sets it true unless --aibom-include-ignored is passed).
	RespectGitignore bool
}

Options controls a detection run.

type ToolDef

type ToolDef struct {
	ID       string `json:"id"`
	Name     string `json:"name"`
	Vendor   string `json:"vendor"`
	Type     string `json:"type"` // cli-agent | ide-extension | ide | service
	Homepage string `json:"homepage,omitempty"`
	// Env are environment variable names (exact, or globs with '*') that this
	// tool sets. Only the NAME and presence are ever recorded — never the value.
	Env []string `json:"env,omitempty"`
	// Paths maps an evidence category (config, instructions, ignore, skills,
	// hooks, plugins, steering, memory, prompts, agents, commands, marketplace)
	// to a list of repo-relative path globs ('*', '**', '?' supported).
	Paths map[string][]string `json:"paths,omitempty"`
	// ModelConfigExtractors pull model-name literals out of this tool's own
	// config files.
	ModelConfigExtractors []ConfigExtractor `json:"model_config_extractors,omitempty"`
	// CommitPatterns are regexes matched against each commit's author/committer
	// identity and message (e.g. a "Co-Authored-By: Claude <noreply@anthropic.com>"
	// trailer, a "Claude-Session:" line, an agent bot author, or a "Generated
	// with <tool>" marker). They identify commits authored by this agent in git
	// history. No capture group required — these are presence signals.
	CommitPatterns []string `json:"commit_patterns,omitempty"`
}

ToolDef describes one AI coding agent / assistant and the on-disk + environment evidence that identifies it.

Directories

Path Synopsis
Command aibomgen renders the AIBOM detection documentation from the single source of truth: the embedded catalog (internal/aibom/catalog/*.json).
Command aibomgen renders the AIBOM detection documentation from the single source of truth: the embedded catalog (internal/aibom/catalog/*.json).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL