deepbom 1.97.0 → 1.97.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepbom",
-  "version": "1.97.0",
+  "version": "1.97.4",
   "mcpName": "io.github.JunHwan-Kwon/deepbom",
   "description": "Local multi-format deployment-artifact analysis for on-device AI models",
   "type": "module",
@@ -45,6 +45,8 @@
     "sarif",
     "static-analysis",
     "agent-skills",
-    "model-context-protocol"
+    "model-context-protocol",
+    "mcp",
+    "chatgpt"
   ]
 }

package/pkg/release-manifest.json

@@ -1,8 +1,8 @@
 {
   "schema": "deepbom.npm_release.v1",
-  "version": "1.97.0",
+  "version": "1.97.4",
   "source": {
-    "git_commit": "95b2218267ba6eeaf54945344aa3d7c945ef7fdd",
+    "git_commit": "859274046529f75f7af1f322075191e27330b119",
     "git_state": "clean",
     "distribution": "public_channel"
   },

package/skills/deepbom/SKILL.md

@@ -5,14 +5,26 @@ description: Statically audit serialized AI deployment artifacts with the local
 
 # Audit deployment artifacts with DEEPBOM
 
-Run DEEPBOM locally. Never upload artifact bytes or invent a hosted DEEPBOM endpoint.
+Run DEEPBOM locally for files in the workspace. Never upload artifact bytes or invent a hosted DEEPBOM endpoint. A separately connected ChatGPT integration may analyze one authorized attachment in its browser sandbox; that is a different execution boundary.
+
+## Resolve a verified runtime first
+
+Run `scripts/verify-deepbom.mjs` from this Skill directory before choosing an invocation. It checks, in order, `DEEPBOM_BIN`, the analyzer bundled with an npm installation, and an exact-version `deepbom` already on `PATH`. It does not access a package registry by default.
+
+If no exact local installation is available, ask before running:
+
+```bash
+node "<skill-root>/scripts/verify-deepbom.mjs" --allow-download
+```
+
+That explicit fallback may download `deepbom@1.97.4` through npm. Use the returned `invocation.command` and `invocation.prefix_args` for subsequent commands. Do not silently replace a version mismatch or network failure with an unverified executable.
 
 ## Start with discovery
 
-Use the release pinned by this skill:
+After resolving the exact release pinned by this Skill, discover its machine contract:
 
 ```bash
-npx -y deepbom@1.97.0 capabilities --format agent-json
+deepbom capabilities --format agent-json
 ```
 
 Treat that machine document as authoritative for commands, supported inputs, scan modes, targets, outputs, and exit codes. Read `references/capability-selection.md` when deciding whether the task belongs to DEEPBOM.
@@ -22,15 +34,15 @@ Treat that machine document as authoritative for commands, supported inputs, sca
 Start with the bounded human result:
 
 ```bash
-npx -y deepbom@1.97.0 audit "./model.onnx" --summary
+deepbom audit "./model.onnx" --summary
 ```
 
 Then request only the evidence needed by the question:
 
 ```bash
-npx -y deepbom@1.97.0 audit "./model.onnx" --section quantization --json
-npx -y deepbom@1.97.0 audit "./model.onnx" --pointer /mac_assessment --json
-npx -y deepbom@1.97.0 audit "./model.onnx" --output-format envelope
+deepbom audit "./model.onnx" --section quantization --json
+deepbom audit "./model.onnx" --pointer /mac_assessment --json
+deepbom audit "./model.onnx" --output-format envelope
 ```
 
 For a large GGUF or SafeTensors artifact, use `--scan structure` for inventory questions. Use `integrity` or `full` only when payload evidence is necessary.
@@ -38,15 +50,15 @@ For a large GGUF or SafeTensors artifact, use `--scan structure` for inventory q
 For a concise GGUF tensor table without nested numerical-integrity ledgers, use the bounded projection (it defaults to a structure scan):
 
 ```bash
-npx -y deepbom@1.97.0 gguf "./model.gguf" --tensors
-npx -y deepbom@1.97.0 gguf "./model.gguf" --tensors --compact
-npx -y deepbom@1.97.0 gguf "./model.gguf" --tensors --compact --tensor-offset 100 --tensor-limit 100
+deepbom gguf "./model.gguf" --tensors
+deepbom gguf "./model.gguf" --tensors --compact
+deepbom gguf "./model.gguf" --tensors --compact --tensor-offset 100 --tensor-limit 100
 ```
 
-Before relying on a newly fetched package, run:
+Before relying on any resolved installation, run:
 
 ```bash
-npx -y deepbom@1.97.0 self-test --compact
+deepbom self-test --compact
 ```
 
 ## Interpret the result
@@ -68,12 +80,12 @@ Never infer actual accelerator assignment, latency, energy, thermal behavior, ta
 ## Compare or explain
 
 ```bash
-npx -y deepbom@1.97.0 diff "./baseline.onnx" "./candidate.onnx" --summary
-npx -y deepbom@1.97.0 diff "./baseline.gguf" "./candidate.gguf" --tensors --render markdown
-npx -y deepbom@1.97.0 verify "./model.onnx" --bom "./supplied.cdx.json" --render markdown
-npx -y deepbom@1.97.0 contract capture "./model.onnx" -o "./baseline.interface-contract.json"
-npx -y deepbom@1.97.0 explain-rule <rule-id> --json
-npx -y deepbom@1.97.0 graph "./model.onnx" --view structure --format svg -o graph.svg
+deepbom diff "./baseline.onnx" "./candidate.onnx" --summary
+deepbom diff "./baseline.gguf" "./candidate.gguf" --tensors --render markdown
+deepbom verify "./model.onnx" --bom "./supplied.cdx.json" --render markdown
+deepbom contract capture "./model.onnx" -o "./baseline.interface-contract.json"
+deepbom explain-rule <rule-id> --json
+deepbom graph "./model.onnx" --view structure --format svg -o graph.svg
 ```
 
 Use matching serialized deployment formats for diff. Treat `verify --bom` as a reconciliation of the selected component with artifact-observable facts, not a complete BOM or compliance verdict. An automatically captured contract is an artifact-derived baseline until it is separately reviewed and approved. Do not deserialize `.pth`, `.pt`, or `.h5`; bind a conversion receipt to the deployed artifact instead.

package/skills/deepbom/references/failure-recovery.md

@@ -7,3 +7,4 @@
 5. For remote input, require an immutable identity: a full Hugging Face commit, GCS object generation, or HTTPS SHA-256 fragment.
 6. Do not raise download, response, or memory limits without explaining the cost and obtaining user approval.
 7. If no shell, local MCP, or local file access exists, explain that actual analysis cannot run in that client and provide the pinned `npx` command.
+8. Registry download is opt-in. Prefer a verified exact-version installation; use `npx -y deepbom@1.97.4` only after network and installation permission is clear.

package/skills/deepbom/scripts/verify-deepbom.mjs

@@ -1,19 +1,71 @@
 #!/usr/bin/env node
 
 import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
 
-const VERSION = "1.97.0";
-const executable = process.platform === "win32" ? process.env.ComSpec || "cmd.exe" : "npx";
-const args = process.platform === "win32"
-  ? ["/d", "/s", "/c", "npx.cmd", "-y", `deepbom@${VERSION}`, "self-test", "--compact"]
-  : ["-y", `deepbom@${VERSION}`, "self-test", "--compact"];
-const result = spawnSync(executable, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-if (result.status !== 0) {
-  process.stderr.write(result.stderr || result.stdout || `DEEPBOM self-test exited ${result.status}.\n`);
-  process.exit(result.status || 1);
+const VERSION = "1.97.4";
+const allowDownload = process.argv.slice(2).includes("--allow-download");
+const attempts = [];
+const candidates = localCandidates();
+if (allowDownload) candidates.push({ source: "npm_exact_version", command: process.platform === "win32" ? "npx.cmd" : "npx", prefix_args: ["-y", `deepbom@${VERSION}`], network: true });
+
+for (const candidate of candidates) {
+  const versionRun = invoke(candidate, ["--version"]);
+  if (versionRun.status !== 0 || versionRun.stdout.trim() !== VERSION) {
+    attempts.push({ source: candidate.source, status: versionRun.status, observed_version: versionRun.stdout.trim() || null, error: bounded(versionRun.stderr) });
+    continue;
+  }
+  const selfTest = invoke(candidate, ["self-test", "--compact"]);
+  try {
+    const document = JSON.parse(selfTest.stdout);
+    if (selfTest.status !== 0 || document.schema !== "deepbom.cli_self_test.v1" || document.status !== "pass" || document.version !== VERSION) throw new Error("self-test contract mismatch");
+    process.stdout.write(`${JSON.stringify({ schema: "deepbom.skill_runtime_resolution.v1", version: VERSION, status: "pass", source: candidate.source, network_used: candidate.network, invocation: { command: candidate.command, prefix_args: candidate.prefix_args }, self_test: document })}\n`);
+    process.exit(0);
+  } catch (error) {
+    attempts.push({ source: candidate.source, status: selfTest.status, error: bounded(selfTest.stderr || selfTest.stdout || error.message) });
+  }
+}
+
+process.stderr.write(`${JSON.stringify({ schema: "deepbom.skill_runtime_resolution.v1", version: VERSION, status: "unavailable", registry_download_attempted: allowDownload, attempts, suggested_action: allowDownload ? "Review the recorded installation or network error; do not claim an analysis ran." : "Install the exact release or rerun with --allow-download only after registry access is authorized." })}\n`);
+process.exit(3);
+
+function localCandidates() {
+  const rows = [];
+  if (process.env.DEEPBOM_BIN?.trim()) rows.push(candidateForPath(path.resolve(process.env.DEEPBOM_BIN.trim()), "DEEPBOM_BIN"));
+  const packaged = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../bin/deepbom.mjs");
+  if (existsSync(packaged)) rows.push(candidateForPath(packaged, "bundled_npm_package"));
+  const installed = findOnPath("deepbom");
+  if (installed && !rows.some((row) => path.resolve(row.identity) === path.resolve(installed))) rows.push(candidateForPath(installed, "installed_path"));
+  return rows;
+}
+
+function candidateForPath(file, source) {
+  return /\.(?:mjs|js|cjs)$/i.test(file)
+    ? { source, identity: file, command: process.execPath, prefix_args: [file], network: false }
+    : { source, identity: file, command: file, prefix_args: [], network: false };
 }
-const document = JSON.parse(result.stdout);
-if (document.schema !== "deepbom.cli_self_test.v1" || document.status !== "pass") {
-  throw new Error("DEEPBOM self-test did not return a passing deepbom.cli_self_test.v1 document.");
+
+function findOnPath(name) {
+  const extensions = process.platform === "win32" ? (process.env.PATHEXT || ".EXE;.CMD;.BAT").split(";") : [""];
+  for (const directory of (process.env.PATH || "").split(path.delimiter).filter(Boolean)) {
+    for (const extension of extensions) {
+      const file = path.join(directory.replace(/^"|"$/g, ""), process.platform === "win32" ? `${name}${extension.toLowerCase()}` : name);
+      if (existsSync(file)) return file;
+    }
+  }
+  return null;
+}
+
+function invoke(candidate, args) {
+  const shell = process.platform === "win32" && /\.(?:cmd|bat)$/i.test(candidate.command);
+  const result = spawnSync(candidate.command, [...candidate.prefix_args, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], shell, timeout: 120000, windowsHide: true });
+  return { status: Number.isInteger(result.status) ? result.status : 1, stdout: result.stdout || "", stderr: result.stderr || result.error?.message || "" };
+}
+
+function bounded(value) {
+  const text = String(value || "").trim();
+  return text ? text.slice(0, 1000) : null;
 }
-process.stdout.write(`${JSON.stringify(document)}\n`);