aisbom-cli 0.9.0__tar.gz → 0.9.2__tar.gz

{aisbom_cli-0.9.0 → aisbom_cli-0.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aisbom-cli
-Version: 0.9.0
+Version: 0.9.2
 Summary: An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models.
 License-File: LICENSE
 Author: Ajoy L
@@ -52,7 +52,21 @@ pip install aisbom-cli
 ```
 *Note: The package name is `aisbom-cli`, but the command you run is `aisbom`.*
 
-### 1a. Standalone Binary (Air-Gapped)
+### 1a. Zero-Install (`pipx run`)
+Want to try AIsbom without committing to an install? Run it ephemerally with [pipx](https://pipx.pypa.io/):
+
+```bash
+# Single throwaway invocation — pipx fetches the latest, runs it, then cleans up.
+pipx run --spec aisbom-cli aisbom scan hf://google-bert/bert-base-uncased
+
+# Or install into pipx's isolated venv (still no system-Python pollution):
+pipx install aisbom-cli
+aisbom scan hf://google-bert/bert-base-uncased
+```
+
+`pipx run` is the fastest path from "I read about this on HN" to seeing a real scan. The `--spec aisbom-cli` is required because our PyPI package name (`aisbom-cli`) differs from the command name (`aisbom`).
+
+### 1b. Standalone Binary (Air-Gapped)
 For environments where installing Python is not possible, download the single-file executable from our [Releases page](https://github.com/Lab700xOrg/aisbom/releases/latest).
 
 > **📚 Guide:** [How to Audit Air-Gapped / Offline Systems](docs/air-gapped-guide.md)
@@ -303,9 +317,9 @@ Events POST to `https://api.aisbom.io/v1/telemetry` (a Cloudflare Worker we oper
 
 When `CI=true` or `GITHUB_ACTIONS=true`, the `cli_install_first_seen` event is suppressed (containers are ephemeral and would otherwise spam the metric). Other events still fire, tagged `is_ci=true`.
 
-### Preview status
+### Status
 
-In the current release, telemetry is **off by default** and only fires when `AISBOM_TELEMETRY_V2=1` is set. The next release will flip to default-on; `AISBOM_NO_TELEMETRY=1` is the opt-out and works in both states.
+As of **0.9.1**, telemetry is **on by default**. `AISBOM_NO_TELEMETRY=1` is the single opt-out lever and is honored on every code path. The previous `AISBOM_TELEMETRY_V2=1` opt-in flag was retired once the rollout soak completed — setting it today is a harmless no-op.
 
 ---
 

{aisbom_cli-0.9.0 → aisbom_cli-0.9.2}/README.md

@@ -27,7 +27,21 @@ pip install aisbom-cli
 ```
 *Note: The package name is `aisbom-cli`, but the command you run is `aisbom`.*
 
-### 1a. Standalone Binary (Air-Gapped)
+### 1a. Zero-Install (`pipx run`)
+Want to try AIsbom without committing to an install? Run it ephemerally with [pipx](https://pipx.pypa.io/):
+
+```bash
+# Single throwaway invocation — pipx fetches the latest, runs it, then cleans up.
+pipx run --spec aisbom-cli aisbom scan hf://google-bert/bert-base-uncased
+
+# Or install into pipx's isolated venv (still no system-Python pollution):
+pipx install aisbom-cli
+aisbom scan hf://google-bert/bert-base-uncased
+```
+
+`pipx run` is the fastest path from "I read about this on HN" to seeing a real scan. The `--spec aisbom-cli` is required because our PyPI package name (`aisbom-cli`) differs from the command name (`aisbom`).
+
+### 1b. Standalone Binary (Air-Gapped)
 For environments where installing Python is not possible, download the single-file executable from our [Releases page](https://github.com/Lab700xOrg/aisbom/releases/latest).
 
 > **📚 Guide:** [How to Audit Air-Gapped / Offline Systems](docs/air-gapped-guide.md)
@@ -278,9 +292,9 @@ Events POST to `https://api.aisbom.io/v1/telemetry` (a Cloudflare Worker we oper
 
 When `CI=true` or `GITHUB_ACTIONS=true`, the `cli_install_first_seen` event is suppressed (containers are ephemeral and would otherwise spam the metric). Other events still fire, tagged `is_ci=true`.
 
-### Preview status
+### Status
 
-In the current release, telemetry is **off by default** and only fires when `AISBOM_TELEMETRY_V2=1` is set. The next release will flip to default-on; `AISBOM_NO_TELEMETRY=1` is the opt-out and works in both states.
+As of **0.9.1**, telemetry is **on by default**. `AISBOM_NO_TELEMETRY=1` is the single opt-out lever and is honored on every code path. The previous `AISBOM_TELEMETRY_V2=1` opt-in flag was retired once the rollout soak completed — setting it today is a harmless no-op.
 
 ---
 

{aisbom_cli-0.9.0 → aisbom_cli-0.9.2}/aisbom/cli.py

@@ -27,6 +27,32 @@ import requests
 app = typer.Typer()
 console = Console()
 
+
+@app.callback(invoke_without_command=True)
+def main(ctx: typer.Context):
+    """AIsbom — AI Supply Chain Security Scanner."""
+    # Owns the no-args codepath. When the user runs `aisbom` with no
+    # subcommand, show a one-screen quickstart instead of Typer's auto-help
+    # block. `--help` still short-circuits to Typer's full reference, and
+    # subcommand invocations fall through (this callback is a no-op when
+    # `ctx.invoked_subcommand` is set).
+    if ctx.invoked_subcommand is None:
+        console.print(
+            Panel(
+                "[bold cyan]Deep introspection of ML model artifacts[/bold cyan]\n"
+                "[dim](.pt, .safetensors, .gguf) for malware, license risk, and silent drift.[/dim]\n\n"
+                "[bold]Try it now:[/bold]\n\n"
+                "    [white]$ aisbom scan hf://google-bert/bert-base-uncased[/white]\n\n"
+                "[dim]Run [white]aisbom --help[/white] for the full command reference.[/dim]",
+                title=" AIsbom ",
+                border_style="cyan",
+                padding=(1, 2),
+                expand=False,
+            )
+        )
+        raise typer.Exit(code=0)
+
+
 # Thread-safe storage for update checks
 update_result = {"version": None}
 

{aisbom_cli-0.9.0 → aisbom_cli-0.9.2}/aisbom/telemetry.py

@@ -8,9 +8,12 @@ cloudcowork/PHASE_1_2_DESIGN.md for the full design.
 Gates (all must be passed before any network call):
   AISBOM_NO_TELEMETRY  — opt-out, always wins. If set, no events fire and no
                          config files are written.
-  AISBOM_TELEMETRY_V2  — opt-in for the v2 rollout. Until set to "1",
-                         post_event() is a no-op even with no opt-out.
-                         Default-flipped to on in a future release.
+
+History: an earlier `AISBOM_TELEMETRY_V2=1` opt-in gate was used during the
+v2 schema rollout (Phase 1.2). It was retired in 0.9.1 once the soak period
+passed cleanly; telemetry is now default-on, with AISBOM_NO_TELEMETRY as the
+single opt-out lever. Setting AISBOM_TELEMETRY_V2 today is a no-op (kept
+documented purely so old shell rc files don't trip on an unknown var).
 
 PyInstaller constraint: this module imports only stdlib + `requests`. Do not
 add new third-party dependencies without updating scripts/build_binaries.sh.
@@ -48,11 +51,9 @@ def is_ci() -> bool:
 
 
 def _telemetry_disabled() -> bool:
-    """All-paths short-circuit. Both env vars consulted; opt-out always wins."""
+    """All-paths short-circuit. Opt-out always wins; default state is enabled."""
     if os.getenv("AISBOM_NO_TELEMETRY"):
         return True
-    if os.getenv("AISBOM_TELEMETRY_V2") != "1":
-        return True
     return False
 
 

{aisbom_cli-0.9.0 → aisbom_cli-0.9.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "aisbom-cli"
-version = "0.9.0"
+version = "0.9.2"
 description = "An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models."
 authors = ["Ajoy L <lab700xdev@gmail.com>"]
 readme = "README.md"