ccppccpp home

Profiles

Transformers.js 4

Guardrails for Transformers.js dependency management and migration to the 4.3.2 baseline.

Set this profile

ccpp cpo profile set transformers-js-v4

Inside Claude Code, prefix the command with ! to run it in the session. Downloading a profile needs a Builder or Team plan; listing them does not.

Policies

28 policies, grouped by what they guard.

Secrets & private data 2

Credentials, keys and personal data stay out of files, logs, commands and the conversation.

  • fetch-credentials

    SEC-02 · Restrict custom fetch authorization headers to approved origins

  • secret-literal

    SEC-01 · Do not commit Hugging Face token literals in integration source

Authentication & authorization 1

Who may do what, from roles, privileges and permissions to CSRF, CORS and verified tokens.

  • execute-generated

    GEN-05 · Do not execute generated text as a shell command

Untrusted input 2

Requests, downloads and tool output are validated before they reach SQL, a shell, eval or a deserializer.

  • untrusted-html

    SEC-04 · Do not inject generated output directly into HTML

  • user-model

    SEC-03 · Validate user-selected model IDs and asset sources

Error handling 1

Failures are propagated or handled, never swallowed or turned into fake success.

  • top-level-load

    RUN-03 · RUN-07 · Handle model and WebGPU initialization failures

Performance & resource bounds 3

Timeouts, bounded retries and fan-out, reused clients, closed resources, no N+1 queries.

  • device-detection

    RUN-02 · A reported device does not guarantee model and dtype initialization

  • generation-cap

    GEN-01 · Bound max_new_tokens on direct text-generation calls

  • initialize-per-request

    RUN-05 · Reuse pipeline initialization across repeated requests

HTTP & APIs 6

Request and response contracts, schemas, status codes, error bodies and published API surfaces.

  • inference-await

    API-05 · Await inference before reading its output

  • model-default

    API-03 · Pin a model explicitly where reproducibility matters

  • model-revision

    API-04 · Pin an immutable revision for remote production models

  • pipeline-await

    API-01 · Await pipeline construction before invoking the pipeline

  • structured-sequences

    GEN-03 · Use one generated sequence with experimental structured output

  • structured-wiring

    GEN-02 · Wire the experimental structured processor through logits_processor

Caching 1

Cache scopes, lifetimes and invalidation stated explicitly.

  • cache-per-request

    MODEL-05 · Keep cache clearing out of ordinary request handlers

Versions & deprecated APIs 7

Code matches the installed version, without removed, renamed or deprecated APIs.

  • legacy-cdn

    MIG-05 · Avoid copying older pinned CDN imports into a 4.3.2 integration

  • legacy-package

    MIG-01 · MIG-03 · Distinguish old package imports from Hub model IDs; migrate legacy @xenova/transformers imports when upgrading to Transformers.js 4

  • new-embeddinggemma

    NEW-02 · Verify EmbeddingGemma 2 modality-specific preprocessing

  • new-lfm3

    NEW-01 · Verify LFM3 ONNX assets, modality and runtime when evaluating 4.3.2 support

  • quantized-option

    MIG-02 · Replace the old pipeline quantized option with a supported dtype

  • version-unknown

    BASE-01 · Resolve the installed version before assuming the 4.3.2 device-enumeration API

  • webgpu-history

    MIG-04 · WebGPU was already supported in Transformers.js v3

Configuration 1

Settings read once at a boundary, validated, with units and without unsafe defaults.

  • dtype-verification

    MODEL-02 · Verify a chosen dtype against available model assets

Dependencies & toolchain 4

Packages change through the package manager, lockfiles stay consistent and the project's tools are used.

  • addon-dependency

    CLI-04 · Install structured output as a separate dependency and verify compatibility

  • manifest-edit

    CLI-01 · CLI-02 · Change Transformers.js dependency entries using the workspace package manager

  • onnx-override

    CLI-05 · Verify ONNX runtime overrides against the Transformers.js dependency graph

  • unqualified-install

    CLI-03 · An unqualified Transformers.js install does not pin the 4.3.2 baseline