aisbom-cli 0.7.8__tar.gz → 0.9.0__tar.gz

{aisbom_cli-0.7.8 → aisbom_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aisbom-cli
-Version: 0.7.8
+Version: 0.9.0
 Summary: An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models.
 License-File: LICENSE
 Author: Ajoy L
@@ -13,12 +13,12 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Requires-Dist: click (<8.4.0)
 Requires-Dist: cyclonedx-python-lib (>=8.5,<12.0)
-Requires-Dist: packaging (>=24,<26)
+Requires-Dist: packaging (>=24,<27)
 Requires-Dist: pip-requirements-parser (>=32.0.1,<33.0.0)
 Requires-Dist: requests (>=2.32.3,<3.0.0)
 Requires-Dist: rich (>=13.7.1,<15.0.0)
 Requires-Dist: spdx-tools (>=0.8.3,<0.9.0)
-Requires-Dist: typer[all] (>=0.12.5,<0.22.0)
+Requires-Dist: typer[all] (>=0.12.5,<0.25.0)
 Project-URL: Homepage, https://www.aisbom.io/
 Project-URL: Repository, https://github.com/Lab700xOrg/aisbom
 Description-Content-Type: text/markdown
@@ -53,7 +53,9 @@ pip install aisbom-cli
 *Note: The package name is `aisbom-cli`, but the command you run is `aisbom`.*
 
 ### 1a. Standalone Binary (Air-Gapped)
-For environments where installing Python is not possible, download the single-file executable from our [Releases page](https://github.com/Lab700xOrg/aisbom/releases/tag/v0.7.0).
+For environments where installing Python is not possible, download the single-file executable from our [Releases page](https://github.com/Lab700xOrg/aisbom/releases/latest).
+
+> **📚 Guide:** [How to Audit Air-Gapped / Offline Systems](docs/air-gapped-guide.md)
 
 **Available Binaries:**
 *   `aisbom-linux-amd64` (Linux x86_64)
@@ -103,6 +105,14 @@ You will see a combined Security & Legal risk assessment in your terminal:
 
 A compliant `sbom.json` (CycloneDX v1.6) including SHA256 hashes and license data will be generated in your current directory.
 
+### 4. Share Your SBOM (New!)
+You can instantly generate a secure, hosted, and shareable link for your SBOM by appending the `--share` flag to your scan.
+
+```bash
+aisbom scan ./my-project-folder --share
+```
+*Note: Your SBOM will be uploaded to aisbom.io and available publicly to anyone with the link for 30 days. You will be prompted for confirmation unless you also pass `--share-yes`.*
+
 ---
 
 ## Advanced Usage
@@ -253,6 +263,52 @@ AI models are not just text files; they are executable programs and IP assets.
 
 ---
 
+## Telemetry & Privacy
+
+AIsbom collects a small amount of anonymous usage telemetry — what model formats people scan, how often critical findings appear, whether scans run in CI — to help us prioritize what to build. We treat this with the same care we expect from any security tool. Read what we collect, then opt out if you'd rather not participate.
+
+### What's collected
+
+Per `aisbom scan`: `target_type` (the **bucket**: `local` / `huggingface` / `http` / `https` — never the actual path or URL), `model_format` (the file-type bucket), `risk_level_max`, `scan_duration_ms`, `file_count`, `parse_error_count`, `strict_mode`. A `cli_scan_critical_found` event with a count is added when at least one CRITICAL is found.
+
+If you explicitly use `--share`: the generated `sbom.json` document is uploaded to our servers and retained for 30 days to generate the shareable viewer link. A `cli_share_created` event is fired tracking whether `has_share_yes=true|false`.
+
+Per `aisbom diff`: a `cli_diff` event with `has_drift=true|false`.
+
+On unhandled exceptions: a `cli_error` event records the exception class name only (e.g. `JSONDecodeError`) — never the message, traceback, or any file content.
+
+Each event carries an anonymous `user_id` — a SHA-256 of your machine's MAC address plus an app salt, truncated to 16 hex chars. Stored in `~/.aisbom/config.json`. Lets us see returning users without identifying anyone.
+
+### What's never collected
+
+File paths, directory contents, model names, target URLs, file hashes from your SBOMs, exception messages, tracebacks, or anything that could identify you, your project, or your organization.
+
+### Opt out
+
+Set `AISBOM_NO_TELEMETRY=1`. This wins over every other setting — telemetry will not fire and `~/.aisbom/config.json` will not be written.
+
+```bash
+# Permanent
+export AISBOM_NO_TELEMETRY=1
+
+# Single invocation
+AISBOM_NO_TELEMETRY=1 aisbom scan ./my-project
+```
+
+### Where the data goes
+
+Events POST to `https://api.aisbom.io/v1/telemetry` (a Cloudflare Worker we operate), which sanitizes the payload and forwards to Google Analytics 4 on the dedicated `cli.aisbom.io` data stream. We don't share, sell, or use this data for ad targeting.
+
+### CI environments
+
+When `CI=true` or `GITHUB_ACTIONS=true`, the `cli_install_first_seen` event is suppressed (containers are ephemeral and would otherwise spam the metric). Other events still fire, tagged `is_ci=true`.
+
+### Preview status
+
+In the current release, telemetry is **off by default** and only fires when `AISBOM_TELEMETRY_V2=1` is set. The next release will flip to default-on; `AISBOM_NO_TELEMETRY=1` is the opt-out and works in both states.
+
+---
+
 ## How to Verify (The "Trust Factor")
 
 Security tools require trust. **We do not distribute malicious binaries.**

{aisbom_cli-0.7.8 → aisbom_cli-0.9.0}/README.md

@@ -28,7 +28,9 @@ pip install aisbom-cli
 *Note: The package name is `aisbom-cli`, but the command you run is `aisbom`.*
 
 ### 1a. Standalone Binary (Air-Gapped)
-For environments where installing Python is not possible, download the single-file executable from our [Releases page](https://github.com/Lab700xOrg/aisbom/releases/tag/v0.7.0).
+For environments where installing Python is not possible, download the single-file executable from our [Releases page](https://github.com/Lab700xOrg/aisbom/releases/latest).
+
+> **📚 Guide:** [How to Audit Air-Gapped / Offline Systems](docs/air-gapped-guide.md)
 
 **Available Binaries:**
 *   `aisbom-linux-amd64` (Linux x86_64)
@@ -78,6 +80,14 @@ You will see a combined Security & Legal risk assessment in your terminal:
 
 A compliant `sbom.json` (CycloneDX v1.6) including SHA256 hashes and license data will be generated in your current directory.
 
+### 4. Share Your SBOM (New!)
+You can instantly generate a secure, hosted, and shareable link for your SBOM by appending the `--share` flag to your scan.
+
+```bash
+aisbom scan ./my-project-folder --share
+```
+*Note: Your SBOM will be uploaded to aisbom.io and available publicly to anyone with the link for 30 days. You will be prompted for confirmation unless you also pass `--share-yes`.*
+
 ---
 
 ## Advanced Usage
@@ -228,6 +238,52 @@ AI models are not just text files; they are executable programs and IP assets.
 
 ---
 
+## Telemetry & Privacy
+
+AIsbom collects a small amount of anonymous usage telemetry — what model formats people scan, how often critical findings appear, whether scans run in CI — to help us prioritize what to build. We treat this with the same care we expect from any security tool. Read what we collect, then opt out if you'd rather not participate.
+
+### What's collected
+
+Per `aisbom scan`: `target_type` (the **bucket**: `local` / `huggingface` / `http` / `https` — never the actual path or URL), `model_format` (the file-type bucket), `risk_level_max`, `scan_duration_ms`, `file_count`, `parse_error_count`, `strict_mode`. A `cli_scan_critical_found` event with a count is added when at least one CRITICAL is found.
+
+If you explicitly use `--share`: the generated `sbom.json` document is uploaded to our servers and retained for 30 days to generate the shareable viewer link. A `cli_share_created` event is fired tracking whether `has_share_yes=true|false`.
+
+Per `aisbom diff`: a `cli_diff` event with `has_drift=true|false`.
+
+On unhandled exceptions: a `cli_error` event records the exception class name only (e.g. `JSONDecodeError`) — never the message, traceback, or any file content.
+
+Each event carries an anonymous `user_id` — a SHA-256 of your machine's MAC address plus an app salt, truncated to 16 hex chars. Stored in `~/.aisbom/config.json`. Lets us see returning users without identifying anyone.
+
+### What's never collected
+
+File paths, directory contents, model names, target URLs, file hashes from your SBOMs, exception messages, tracebacks, or anything that could identify you, your project, or your organization.
+
+### Opt out
+
+Set `AISBOM_NO_TELEMETRY=1`. This wins over every other setting — telemetry will not fire and `~/.aisbom/config.json` will not be written.
+
+```bash
+# Permanent
+export AISBOM_NO_TELEMETRY=1
+
+# Single invocation
+AISBOM_NO_TELEMETRY=1 aisbom scan ./my-project
+```
+
+### Where the data goes
+
+Events POST to `https://api.aisbom.io/v1/telemetry` (a Cloudflare Worker we operate), which sanitizes the payload and forwards to Google Analytics 4 on the dedicated `cli.aisbom.io` data stream. We don't share, sell, or use this data for ad targeting.
+
+### CI environments
+
+When `CI=true` or `GITHUB_ACTIONS=true`, the `cli_install_first_seen` event is suppressed (containers are ephemeral and would otherwise spam the metric). Other events still fire, tagged `is_ci=true`.
+
+### Preview status
+
+In the current release, telemetry is **off by default** and only fires when `AISBOM_TELEMETRY_V2=1` is set. The next release will flip to default-on; `AISBOM_NO_TELEMETRY=1` is the opt-out and works in both states.
+
+---
+
 ## How to Verify (The "Trust Factor")
 
 Security tools require trust. **We do not distribute malicious binaries.**

{aisbom_cli-0.7.8 → aisbom_cli-0.9.0}/aisbom/cli.py

@@ -18,7 +18,11 @@ from .scanner import DeepScanner
 from .diff import SBOMDiff
 
 import threading
+import time
+import uuid
 from .version_check import check_latest_version
+from . import telemetry
+import requests
 
 app = typer.Typer()
 console = Console()
@@ -51,6 +55,56 @@ def _check_update_status():
             expand=False
         ))
 
+
+def _classify_target(target: str) -> str:
+    """Bucket the scan target into a category label for telemetry."""
+    if target.startswith("hf://"):
+        return "huggingface"
+    if target.startswith("https://"):
+        return "https"
+    if target.startswith("http://"):
+        return "http"
+    return "local"
+
+
+def _summarize_model_format(artifacts: list[dict]) -> str:
+    """Reduce per-artifact `framework` values to a single label.
+
+    Returns 'none' if no artifacts, the framework name if all match,
+    or 'mixed' if multiple distinct frameworks were found."""
+    if not artifacts:
+        return "none"
+    formats = {(a.get("framework") or "unknown").lower() for a in artifacts}
+    if len(formats) == 1:
+        return formats.pop()
+    return "mixed"
+
+
+def _maybe_emit_install_event() -> threading.Thread | None:
+    """Fire cli_install_first_seen on the very first invocation per machine.
+
+    Suppressed in CI (config dirs are ephemeral there) and when the home
+    config dir isn't writable. Self-gates via the existence of
+    ~/.aisbom/config.json — once that file is created, this is a no-op."""
+    if telemetry.is_ci():
+        return None
+    home = telemetry.get_config_dir()
+    if home is None:
+        return None
+    if (home / "config.json").exists():
+        return None
+    # post_event() will internally call get_or_init_config() which writes
+    # config.json, so the next invocation sees it and skips this branch.
+    return telemetry.post_event("cli_install_first_seen", {})
+
+
+def _flush_telemetry_threads(threads: list[threading.Thread | None]) -> None:
+    """Wait briefly for in-flight telemetry POSTs to flush before exit."""
+    for t in threads:
+        if t is not None:
+            t.join(timeout=2.0)
+
+
 class OutputFormat(str, Enum):
     JSON = "json"
     MARKDOWN = "markdown"
@@ -98,7 +152,9 @@ def scan(
     fail_on_risk: bool = typer.Option(True, help="Return exit code 2 if Critical risks are found"),
     strict: bool = typer.Option(False, help="Enable strict allowlisting mode (flags any unknown imports)"),
     lint: bool = typer.Option(False, help="Enable Migration Linter (checks for weights_only=True compatibility)"),
-    format: OutputFormat = typer.Option(OutputFormat.JSON, help="Output format (JSON for SBOM, MARKDOWN for Human Report, SPDX for Compliance)")
+    format: OutputFormat = typer.Option(OutputFormat.JSON, help="Output format (JSON for SBOM, MARKDOWN for Human Report, SPDX for Compliance)"),
+    share: bool = typer.Option(False, help="Upload the SBOM to aisbom.io and generate a shareable viewer link"),
+    share_yes: bool = typer.Option(False, "--share-yes", help="Skip confirmation prompt when using --share")
 ):
     """
     Deep Introspection Scan: Analyzes binary headers and dependency manifests.
@@ -109,14 +165,30 @@ def scan(
 
     console.print(Panel.fit(f"🚀 [bold cyan]AIsbom[/bold cyan] Scanning: [underline]{target}[/underline]"))
 
-    
+    # Telemetry: per-invocation scan_id groups all events from this scan into
+    # one GA4 session. Started here so an early failure still has an id.
+    scan_id = uuid.uuid4().hex
+    t_start = time.monotonic()
+    telemetry_threads: list[threading.Thread | None] = [
+        _maybe_emit_install_event(),
+    ]
+
     # 1. Run the Logic
-    scanner = DeepScanner(target, strict_mode=strict, lint=lint)
-    if isinstance(target, str) and (target.startswith("http://") or target.startswith("https://") or target.startswith("hf://")):
-        with console.status("[cyan]Resolving remote repository...[/cyan]"):
+    try:
+        scanner = DeepScanner(target, strict_mode=strict, lint=lint)
+        if isinstance(target, str) and (target.startswith("http://") or target.startswith("https://") or target.startswith("hf://")):
+            with console.status("[cyan]Resolving remote repository...[/cyan]"):
+                results = scanner.scan()
+        else:
             results = scanner.scan()
-    else:
-        results = scanner.scan()
+    except Exception as e:
+        err_thread = telemetry.post_event(
+            "cli_error",
+            {"command": "scan", "error_type": type(e).__name__},
+            scan_id=scan_id,
+        )
+        _flush_telemetry_threads(telemetry_threads + [err_thread])
+        raise
     # Track highest risk for exit code purposes (CI friendly)
     def _risk_score(label: str) -> int:
         text = (label or "").upper()
@@ -134,7 +206,40 @@ def scan(
         exit_code = max(exit_code, 1)
     if fail_on_risk and highest_risk >= 3:
         exit_code = 2
-    
+
+    # Telemetry: fire cli_scan plus any conditional follow-ups now that the
+    # scan completed and risk is known. Non-blocking; flushed before exit.
+    _risk_label = {3: "critical", 2: "medium", 1: "low", 0: "none"}.get(highest_risk, "unknown")
+    scan_duration_ms = int((time.monotonic() - t_start) * 1000)
+    scan_params = {
+        "target_type": _classify_target(target),
+        "model_format": _summarize_model_format(results.get("artifacts", [])),
+        "risk_level_max": _risk_label,
+        "scan_duration_ms": str(scan_duration_ms),
+        "file_count": str(len(results.get("artifacts", []))),
+        "parse_error_count": str(len(results.get("errors", []))),
+        "strict_mode": "true" if strict else "false",
+    }
+    telemetry_threads.append(
+        telemetry.post_event("cli_scan", scan_params, scan_id=scan_id)
+    )
+    if highest_risk >= 3:
+        critical_count = sum(
+            1 for a in results.get("artifacts", [])
+            if "CRITICAL" in (a.get("risk_level") or "").upper()
+        )
+        telemetry_threads.append(
+            telemetry.post_event(
+                "cli_scan_critical_found",
+                {"critical_count": str(critical_count)},
+                scan_id=scan_id,
+            )
+        )
+    if strict:
+        telemetry_threads.append(
+            telemetry.post_event("cli_strict_mode", {}, scan_id=scan_id)
+        )
+
     # 2. Render Results (UI)
     if results['artifacts']:
         table = Table(title="🧠 AI Model Artifacts Found")
@@ -243,6 +348,45 @@ def scan(
         
         console.print(f"\n[bold green]✔ Compliance Artifact Generated:[/bold green] {output} (CycloneDX v{schema_version})")
 
+        has_content = bool(results.get('artifacts') or results.get('dependencies'))
+        if share and has_content:
+            do_share = True
+            if not share_yes:
+                do_share = typer.confirm(
+                    "Upload this SBOM to aisbom.io to generate a shareable link?\n"
+                    "Data will be public to anyone with the link and expires in 30 days.", 
+                    default=False
+                )
+                if not do_share:
+                    console.print("[dim]Share cancelled.[/dim]")
+
+            if do_share:
+                with console.status("[cyan]Uploading SBOM to aisbom.io...[/cyan]"):
+                    try:
+                        json_str = outputter.output_as_string()
+                        res = requests.post(
+                            "https://aisbom.io/api/sbom-share",
+                            data=json_str,
+                            headers={
+                                "Content-Type": "application/json",
+                                "User-Agent": telemetry._build_user_agent()
+                            },
+                            timeout=15.0
+                        )
+                        res.raise_for_status()
+                        share_url = res.json().get("url")
+                        
+                        console.print(f"\n[bold green]✔ Share Link Created:[/bold green] [underline cyan]{share_url}[/underline cyan]")
+                        console.print("[dim]Anyone with this link can view this SBOM. Expires in 30 days.[/dim]")
+                        
+                        telemetry_threads.append(telemetry.post_event(
+                            "cli_share_created",
+                            {"has_share_yes": "true" if share_yes else "false"},
+                            scan_id=scan_id
+                        ))
+                    except Exception as e:
+                        console.print(f"\n[bold red]✖ Failed to create share link:[/bold red] {e}")
+
     elif format == OutputFormat.SPDX:
         from .spdx_gen import generate_spdx_sbom
         spdx_json = generate_spdx_sbom(results)
@@ -262,12 +406,10 @@ def scan(
         except importlib.metadata.PackageNotFoundError:
             ver = "unknown"
 
-        viewer_url = f"https://www.aisbom.io/viewer.html?utm_source=cli&utm_medium=terminal&utm_campaign=scan_output&utm_version={ver}"
-
         console.print(Panel(
             f"[bold white]📊 Visualize this report:[/bold white]\n"
             f"Drag and drop [cyan]{output}[/cyan] into our secure offline viewer:\n"
-            f"👉 [link={viewer_url}]Open Secure Viewer (aisbom.io)[/link]",
+            f"> View detailed artifact visualizer: https://aisbom.io/viewer",
             border_style="blue",
             expand=False
         ))
@@ -281,6 +423,9 @@ def scan(
     # Check update status before exiting
     _check_update_status()
 
+    # Flush in-flight telemetry POSTs so events aren't lost on exit.
+    _flush_telemetry_threads(telemetry_threads)
+
     # Non-zero exit codes for CI/CD when high risk or errors are present
     raise typer.Exit(code=exit_code)
 
@@ -362,11 +507,18 @@ def diff(
     t = threading.Thread(target=run_version_check_wrapper, daemon=True)
     t.start()
 
+    # Telemetry: per-invocation scan_id groups events into one GA4 session.
+    scan_id = uuid.uuid4().hex
+    telemetry_threads: list[threading.Thread | None] = [
+        _maybe_emit_install_event(),
+    ]
+
     path_old = Path(old_file)
     path_new = Path(new_file)
 
     if not path_old.exists() or not path_new.exists():
         console.print("[bold red]Error:[/bold red] One or both files do not exist.")
+        _flush_telemetry_threads(telemetry_threads)
         raise typer.Exit(code=1)
 
     try:
@@ -374,8 +526,22 @@ def diff(
         result = differ.compare()
     except Exception as e:
         console.print(f"[bold red]Error parsing SBOMs:[/bold red] {e}")
+        telemetry_threads.append(telemetry.post_event(
+            "cli_error",
+            {"command": "diff", "error_type": type(e).__name__},
+            scan_id=scan_id,
+        ))
+        _flush_telemetry_threads(telemetry_threads)
         raise typer.Exit(code=1)
 
+    # Telemetry: comparison succeeded; fire cli_diff with drift signal.
+    has_drift = bool(result.added or result.removed or result.changed)
+    telemetry_threads.append(telemetry.post_event(
+        "cli_diff",
+        {"has_drift": "true" if has_drift else "false"},
+        scan_id=scan_id,
+    ))
+
     console.print(Panel.fit(f"[bold cyan]Comparing[/bold cyan] {path_old.name} -> {path_new.name}"))
 
     table = Table(title="Drift Analysis")
@@ -454,11 +620,13 @@ def diff(
 
     if fail_on_risk_increase and (result.risk_increased or result.hash_drifted):
         console.print("\n[bold red]FAILURE: Critical risk increase or hash drift detected![/bold red]")
+        _flush_telemetry_threads(telemetry_threads)
         raise typer.Exit(code=1)
-    
+
     console.print("\n[bold green]Success: No critical regression detected.[/bold green]")
-    
+
     _check_update_status()
+    _flush_telemetry_threads(telemetry_threads)
 
 if __name__ == "__main__":
     app()

aisbom_cli-0.9.0/aisbom/telemetry.py

@@ -0,0 +1,214 @@
+"""
+Privacy-respecting CLI telemetry for aisbom-cli.
+
+Events are POSTed to api.aisbom.io/v1/telemetry, which forwards to GA4
+Measurement Protocol on the AIsbom CLI stream. See
+cloudcowork/PHASE_1_2_DESIGN.md for the full design.
+
+Gates (all must be passed before any network call):
+  AISBOM_NO_TELEMETRY  — opt-out, always wins. If set, no events fire and no
+                         config files are written.
+  AISBOM_TELEMETRY_V2  — opt-in for the v2 rollout. Until set to "1",
+                         post_event() is a no-op even with no opt-out.
+                         Default-flipped to on in a future release.
+
+PyInstaller constraint: this module imports only stdlib + `requests`. Do not
+add new third-party dependencies without updating scripts/build_binaries.sh.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import importlib.metadata
+import json
+import os
+import platform
+import threading
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+
+import requests
+
+TELEMETRY_ENDPOINT = "https://api.aisbom.io/v1/telemetry"
+POST_TIMEOUT_SEC = 3.0
+CONFIG_SCHEMA_VERSION = 1
+
+# Hardcoded app salt. Purpose: make user_id non-reversible to a MAC address
+# even if a user_id is ever exposed (e.g., GA4 export). The threat model is
+# "outside attacker reverses user_id → MAC", not "attacker compromises this
+# source code". Constant value is fine; rotate by bumping the suffix if the
+# hash space ever needs to be reset.
+_USER_ID_SALT = "aisbom-cli-1.0"
+
+
+def is_ci() -> bool:
+    """True when running inside a CI environment (GITHUB_ACTIONS or CI set)."""
+    return bool(os.getenv("GITHUB_ACTIONS") or os.getenv("CI"))
+
+
+def _telemetry_disabled() -> bool:
+    """All-paths short-circuit. Both env vars consulted; opt-out always wins."""
+    if os.getenv("AISBOM_NO_TELEMETRY"):
+        return True
+    if os.getenv("AISBOM_TELEMETRY_V2") != "1":
+        return True
+    return False
+
+
+def get_config_dir() -> Path | None:
+    """
+    Return the writable ~/.aisbom directory, creating it if needed.
+
+    Returns None if the dir cannot be created or written to (sandboxed
+    environments, read-only FS, restrictive Docker, etc.). Callers should
+    treat None as "skip all stateful telemetry" — never raise from telemetry.
+    """
+    try:
+        home = Path.home() / ".aisbom"
+        home.mkdir(exist_ok=True, parents=True)
+        probe = home / ".write_probe"
+        probe.write_text("")
+        probe.unlink()
+        return home
+    except (OSError, PermissionError):
+        return None
+
+
+def save_config(cfg: dict) -> None:
+    """
+    Atomically persist config.json to ~/.aisbom/. Silent no-op if the dir is
+    unwritable. Uses write-temp-then-rename so concurrent CLI invocations
+    cannot corrupt the file.
+    """
+    home = get_config_dir()
+    if home is None:
+        return
+    tmp = home / "config.json.tmp"
+    try:
+        tmp.write_text(json.dumps(cfg, separators=(",", ":")))
+        tmp.replace(home / "config.json")
+    except (OSError, PermissionError):
+        # Never raise from telemetry. Best-effort cleanup of orphaned tmp.
+        try:
+            tmp.unlink(missing_ok=True)
+        except OSError:
+            pass
+
+
+def _generate_user_id() -> str:
+    """
+    Anonymous, stable per-machine user_id. Hash of MAC address + app salt,
+    truncated to 16 hex chars. uuid.getnode() returns a random number with
+    the multicast bit set if it can't read the MAC, which means a small
+    fraction of users (<1%) will get a fresh user_id per process. Documented
+    risk; affects returning-user metrics for those users only.
+    """
+    raw = f"{uuid.getnode()}:{_USER_ID_SALT}"
+    return hashlib.sha256(raw.encode()).hexdigest()[:16]
+
+
+def get_or_init_config() -> dict:
+    """
+    Load or initialize config.json.
+
+    Returns:
+        Config dict with keys schema_version, user_id, installed_at.
+        Returns empty dict if telemetry is disabled or config dir unwritable.
+
+    On first call (and when config is missing/corrupt), generates a stable
+    anonymous user_id and records install timestamp.
+    """
+    if _telemetry_disabled():
+        return {}
+    home = get_config_dir()
+    if home is None:
+        return {}
+    config_path = home / "config.json"
+    if config_path.exists():
+        try:
+            return json.loads(config_path.read_text())
+        except (json.JSONDecodeError, OSError):
+            # corrupt or unreadable — fall through to reinit
+            pass
+    cfg = {
+        "schema_version": CONFIG_SCHEMA_VERSION,
+        "user_id": _generate_user_id(),
+        "installed_at": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+    }
+    save_config(cfg)
+    return cfg
+
+
+def _build_user_agent() -> str:
+    """
+    Match the format from version_check.py:26 verbatim so the Worker's UA
+    parser at aisbom-edge/src/index.js works for both endpoints:
+
+        aisbom-cli/{version} ({system}; python {py_ver}; ci={true|false})
+    """
+    try:
+        version = importlib.metadata.version("aisbom-cli")
+    except importlib.metadata.PackageNotFoundError:
+        version = "unknown"
+    system = platform.system()
+    py_ver = platform.python_version()
+    is_ci_str = "true" if is_ci() else "false"
+    return f"aisbom-cli/{version} ({system}; python {py_ver}; ci={is_ci_str})"
+
+
+def _do_post(event: str, params: dict, scan_id: str | None) -> None:
+    """
+    Send one event to the Worker. Silent on any failure — the contract is
+    that telemetry never raises and never blocks a user-facing flow.
+    """
+    try:
+        body: dict = {"event": event, "params": params}
+        if scan_id:
+            body["scan_id"] = scan_id
+        requests.post(
+            TELEMETRY_ENDPOINT,
+            json=body,
+            headers={"User-Agent": _build_user_agent()},
+            timeout=POST_TIMEOUT_SEC,
+        )
+    except Exception:
+        # Catch-all is intentional. Telemetry must not surface errors.
+        pass
+
+
+def post_event(
+    event: str,
+    params: dict | None = None,
+    scan_id: str | None = None,
+) -> threading.Thread | None:
+    """
+    Fire one telemetry event in a non-daemon background thread.
+
+    Args:
+        event: The event name (validated against allowlist by the Worker).
+        params: Custom event params. user_id is auto-injected from config.
+        scan_id: Optional UUID grouping multiple events from one CLI invocation
+            into a single GA4 session.
+
+    Returns:
+        threading.Thread when the POST has been dispatched; the caller may
+        join() with a timeout before exiting to give it a chance to flush.
+        None if telemetry is disabled (opt-out or v2 not enabled), in which
+        case nothing was queued and nothing will be sent.
+
+    Never raises. Never blocks on the network.
+    """
+    if _telemetry_disabled():
+        return None
+    cfg = get_or_init_config()
+    full_params = dict(params or {})
+    if cfg.get("user_id"):
+        full_params["user_id"] = cfg["user_id"]
+    thread = threading.Thread(
+        target=_do_post,
+        args=(event, full_params, scan_id),
+        daemon=False,  # non-daemon so process waits for in-flight POSTs at exit
+    )
+    thread.start()
+    return thread

{aisbom_cli-0.7.8 → aisbom_cli-0.9.0}/aisbom/version_check.py

@@ -4,7 +4,7 @@ import importlib.metadata
 import requests
 from packaging.version import parse as parse_version
 
-API_URL = "https://api.aisbom.io/v1/version"
+API_URL = "https://api.aisbom.io/v1/version?utm_source=cli&utm_medium=terminal"
 
 def check_latest_version() -> str | None:
     """

{aisbom_cli-0.7.8 → aisbom_cli-0.9.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "aisbom-cli"
-version = "0.7.8"
+version = "0.9.0"
 description = "An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models."
 authors = ["Ajoy L <lab700xdev@gmail.com>"]
 readme = "README.md"
@@ -9,13 +9,13 @@ repository = "https://github.com/Lab700xOrg/aisbom"
 urls = { "Homepage" = "https://www.aisbom.io/" }
 [tool.poetry.dependencies]
 python = "^3.11"
-typer = {extras = ["all"], version = ">=0.12.5,<0.22.0"}
+typer = {extras = ["all"], version = ">=0.12.5,<0.25.0"}
 rich = ">=13.7.1,<15.0.0"
 cyclonedx-python-lib = ">=8.5,<12.0"
 pip-requirements-parser = "^32.0.1"
 click = "<8.4.0"
 spdx-tools = "^0.8.3"
-packaging = ">=24,<26"
+packaging = ">=24,<27"
 
 [tool.poetry.dependencies.requests]
 version = "^2.32.3"