deepbom 1.96.15 → 1.97.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +15 -8
- package/bin/deepbom.mjs +98 -72
- package/package.json +2 -1
- package/pkg/release-manifest.json +3 -3
- package/skills/deepbom/SKILL.md +83 -0
- package/skills/deepbom/agents/openai.yaml +7 -0
- package/skills/deepbom/references/capability-selection.md +16 -0
- package/skills/deepbom/references/evidence-semantics.md +20 -0
- package/skills/deepbom/references/failure-recovery.md +9 -0
- package/skills/deepbom/scripts/verify-deepbom.mjs +19 -0
package/README.md
CHANGED
|
@@ -7,10 +7,10 @@ For a local Codex or Claude Code project, preview and install the bundled Agent
|
|
|
7
7
|
Skill without operating an analysis server:
|
|
8
8
|
|
|
9
9
|
```console
|
|
10
|
-
npx -y deepbom@1.
|
|
11
|
-
npx -y deepbom@1.
|
|
12
|
-
npx -y deepbom@1.
|
|
13
|
-
npx -y deepbom@1.
|
|
10
|
+
npx -y deepbom@1.97.0 integrate codex
|
|
11
|
+
npx -y deepbom@1.97.0 integrate codex --apply
|
|
12
|
+
npx -y deepbom@1.97.0 integrate claude-code
|
|
13
|
+
npx -y deepbom@1.97.0 integrate claude-code --apply
|
|
14
14
|
```
|
|
15
15
|
|
|
16
16
|
```console
|
|
@@ -20,15 +20,18 @@ npx deepbom capabilities --compact
|
|
|
20
20
|
npx deepbom gguf model.gguf --context 8192 --memory-mib 8192
|
|
21
21
|
npx deepbom audit Model.mlpackage --compact
|
|
22
22
|
npx deepbom audit safetensors-repository/ --compact
|
|
23
|
+
npx deepbom verify model.onnx --bom supplied.cdx.json --render markdown
|
|
24
|
+
npx deepbom contract capture model.onnx -o baseline.interface-contract.json
|
|
23
25
|
npx deepbom verify model.tflite --contract production-interface.json
|
|
24
|
-
npx deepbom diff baseline.
|
|
26
|
+
npx deepbom diff baseline.gguf candidate.gguf --tensors --render markdown
|
|
25
27
|
npx deepbom explore model.tflite --target-profile target-profile.json
|
|
26
28
|
npx deepbom audit model.pte --executorch-build deepbom.executorch-build.json --compact
|
|
27
29
|
npx deepbom capabilities --format agent-json
|
|
28
|
-
npx
|
|
30
|
+
npx deepbom capabilities --format agent-text
|
|
31
|
+
npx -y deepbom@1.97.0 mcp
|
|
29
32
|
```
|
|
30
33
|
|
|
31
|
-
Claude Desktop can install the version-matched `deepbom-1.
|
|
34
|
+
Claude Desktop can install the version-matched `deepbom-1.97.0.mcpb` asset
|
|
32
35
|
from the corresponding GitHub Release as a local desktop extension.
|
|
33
36
|
|
|
34
37
|
The default output is a bounded human-readable summary. Use `--json` or
|
|
@@ -37,7 +40,11 @@ canonical cross-format contract, `--format cyclonedx` for CycloneDX 1.7, or
|
|
|
37
40
|
`--format sarif` for OASIS SARIF 2.1.0. `--policy-output` records a deterministic
|
|
38
41
|
finding gate when `--fail-on` is selected.
|
|
39
42
|
|
|
40
|
-
`verify`
|
|
43
|
+
`verify --bom` reconciles an exactly selected CycloneDX 1.7 component with
|
|
44
|
+
artifact-observable facts; publisher declarations remain not assessable from
|
|
45
|
+
the file. `contract capture` creates an artifact-derived interface baseline,
|
|
46
|
+
not an approved production contract. `verify --contract` fails closed on
|
|
47
|
+
interface contradictions, `diff` preserves the
|
|
41
48
|
canonical multi-target TFLite delta ledger, and `explore` exposes deterministic
|
|
42
49
|
WASM Pareto candidates. These commands do not add a second analysis engine.
|
|
43
50
|
|