npm - @waratahlabs/canopy - Versions diffs - 0.5.0 → 0.6.0 - Mend

@waratahlabs/canopy 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (54) hide show

package/README.md +244 -195
package/SKILL.md +13 -2
package/demo/data/insaider-threat-model.tc.json +7800 -0
package/demo/data/openclaw-demo.tc.json +80 -303
package/demo/data/openclaw-nemoclaw-demo.tc.json +114 -389
package/dist/aivss/scoring/heuristic-scorer.d.ts +1 -1
package/dist/aivss/scoring/heuristic-scorer.js +1 -1
package/dist/cli.js +24 -37
package/dist/cli.js.map +1 -1
package/dist/examples/insaider-assessment.d.ts +28 -0
package/dist/examples/insaider-assessment.d.ts.map +1 -0
package/dist/examples/insaider-assessment.js +301 -0
package/dist/examples/insaider-assessment.js.map +1 -0
package/dist/index.d.ts.map +1 -1
package/dist/index.js +0 -9
package/dist/index.js.map +1 -1
package/dist/output/tc-assembler.d.ts +0 -10
package/dist/output/tc-assembler.d.ts.map +1 -1
package/dist/output/tc-assembler.js +4 -42
package/dist/output/tc-assembler.js.map +1 -1
package/dist/references/container-taxonomy.d.ts +41 -0
package/dist/references/container-taxonomy.d.ts.map +1 -0
package/dist/references/container-taxonomy.js +207 -0
package/dist/references/container-taxonomy.js.map +1 -0
package/dist/references/index.d.ts +0 -7
package/dist/references/index.d.ts.map +1 -1
package/dist/references/index.js +0 -13
package/dist/references/index.js.map +1 -1
package/dist/references/nist-ai-rmf.d.ts +1 -6
package/dist/references/nist-ai-rmf.d.ts.map +1 -1
package/dist/references/nist-ai-rmf.js +1 -10
package/dist/references/nist-ai-rmf.js.map +1 -1
package/dist/references/owasp-agentic-top10.d.ts +1 -6
package/dist/references/owasp-agentic-top10.d.ts.map +1 -1
package/dist/references/owasp-agentic-top10.js +0 -9
package/dist/references/owasp-agentic-top10.js.map +1 -1
package/package.json +4 -18
package/demo/index.html +0 -556
package/dist/aivss/scoring/a2a-corpus.test.d.ts +0 -28
package/dist/aivss/scoring/a2a-corpus.test.d.ts.map +0 -1
package/dist/aivss/scoring/a2a-corpus.test.js +0 -109
package/dist/aivss/scoring/a2a-corpus.test.js.map +0 -1
package/dist/aivss/scoring/determinism.test.d.ts +0 -16
package/dist/aivss/scoring/determinism.test.d.ts.map +0 -1
package/dist/aivss/scoring/determinism.test.js +0 -169
package/dist/aivss/scoring/determinism.test.js.map +0 -1
package/dist/aivss/scoring/scoring-mode.d.ts +0 -48
package/dist/aivss/scoring/scoring-mode.d.ts.map +0 -1
package/dist/aivss/scoring/scoring-mode.js +0 -64
package/dist/aivss/scoring/scoring-mode.js.map +0 -1
package/dist/references/registry-parity.test.d.ts +0 -17
package/dist/references/registry-parity.test.d.ts.map +0 -1
package/dist/references/registry-parity.test.js +0 -87
package/dist/references/registry-parity.test.js.map +0 -1

package/demo/index.html DELETED Viewed

@@ -1,556 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Canopy — AI Threat Model Explorer</title>
-  <meta name="description" content="Interactive threat model for OpenClaw personal AI assistant. Generated by Canopy using OWASP AIVSS V4, MITRE ATLAS, and ASD/ACSC frameworks.">
-  <style>
-    :root {
-      --bg: #0f0f0f;
-      --surface: #1a1a1a;
-      --border: #2a2a2a;
-      --text: #e0e0e0;
-      --muted: #888;
-      --accent: #3b82f6;
-      --critical: #ef4444;
-      --high: #f97316;
-      --medium: #eab308;
-      --low: #22c55e;
-      --none: #6b7280;
-      --font-mono: "SF Mono", "Fira Code", "Cascadia Code", monospace;
-      --font-sans: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
-    }
-    * { box-sizing: border-box; margin: 0; padding: 0; }
-    body { background: var(--bg); color: var(--text); font-family: var(--font-sans); font-size: 14px; line-height: 1.6; }
-    header { border-bottom: 1px solid var(--border); padding: 20px 32px; display: flex; align-items: center; gap: 16px; }
-    .logo { font-size: 20px; font-weight: 700; letter-spacing: -0.5px; color: #fff; }
-    .logo span { color: var(--accent); }
-    .tagline { color: var(--muted); font-size: 13px; }
-    .header-meta { margin-left: auto; display: flex; gap: 12px; align-items: center; }
-    .badge { background: var(--surface); border: 1px solid var(--border); border-radius: 4px; padding: 3px 8px; font-size: 11px; color: var(--muted); font-family: var(--font-mono); }
-    /* View toggle */
-    .view-toggle { display: flex; border: 1px solid var(--border); border-radius: 6px; overflow: hidden; margin-bottom: 20px; }
-    .view-tab { flex: 1; padding: 8px 16px; border: none; background: var(--surface); color: var(--muted); cursor: pointer; font-size: 12px; font-weight: 500; transition: background 0.15s, color 0.15s; text-align: center; }
-    .view-tab:not(:last-child) { border-right: 1px solid var(--border); }
-    .view-tab.active { background: #1e3a5f; color: #93c5fd; }
-    .view-tab .tab-badge { display: inline-block; margin-left: 6px; background: #052040; border: 1px solid #1e3a5f; border-radius: 3px; padding: 0 5px; font-size: 10px; font-family: var(--font-mono); color: var(--muted); vertical-align: middle; }
-    .view-tab.active .tab-badge { background: #0f2a4a; color: #60a5fa; }
-    .layout { display: grid; grid-template-columns: 280px 1fr; min-height: calc(100vh - 61px); }
-    aside { border-right: 1px solid var(--border); padding: 20px 0; }
-    .sidebar-section { padding: 0 20px 16px; border-bottom: 1px solid var(--border); margin-bottom: 16px; }
-    .sidebar-section:last-child { border-bottom: none; }
-    .sidebar-label { font-size: 10px; font-weight: 600; letter-spacing: 0.08em; text-transform: uppercase; color: var(--muted); margin-bottom: 8px; }
-    .filter-btn { display: flex; align-items: center; gap: 8px; width: 100%; padding: 6px 8px; border-radius: 4px; border: none; background: transparent; color: var(--text); cursor: pointer; font-size: 13px; text-align: left; transition: background 0.1s; }
-    .filter-btn:hover, .filter-btn.active { background: var(--surface); }
-    .filter-btn .dot { width: 8px; height: 8px; border-radius: 50%; flex-shrink: 0; }
-    .filter-btn .count { margin-left: auto; color: var(--muted); font-size: 11px; font-family: var(--font-mono); }
-    main { padding: 24px 32px; }
-    .system-info { background: var(--surface); border: 1px solid var(--border); border-radius: 6px; padding: 16px 20px; margin-bottom: 24px; display: flex; gap: 32px; flex-wrap: wrap; }
-    .info-item { }
-    .info-label { font-size: 11px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.06em; margin-bottom: 2px; }
-    .info-value { font-size: 13px; font-family: var(--font-mono); }
-    .threat-list { display: flex; flex-direction: column; gap: 12px; }
-    .threat-card { background: var(--surface); border: 1px solid var(--border); border-radius: 6px; overflow: hidden; cursor: pointer; transition: border-color 0.15s; }
-    .threat-card:hover { border-color: #444; }
-    .threat-card.expanded { border-color: var(--accent); }
-    .threat-header { padding: 14px 16px; display: flex; align-items: flex-start; gap: 12px; }
-    .sev-pill { flex-shrink: 0; padding: 2px 8px; border-radius: 3px; font-size: 10px; font-weight: 700; letter-spacing: 0.06em; text-transform: uppercase; margin-top: 2px; }
-    .sev-Critical { background: #7f1d1d; color: var(--critical); }
-    .sev-High { background: #431407; color: var(--high); }
-    .sev-Medium { background: #422006; color: var(--medium); }
-    .sev-Low { background: #052e16; color: var(--low); }
-    .threat-title { flex: 1; font-size: 14px; font-weight: 500; line-height: 1.4; }
-    .threat-tags { display: flex; gap: 6px; flex-wrap: wrap; margin-top: 4px; }
-    .tag { background: #252525; border: 1px solid var(--border); border-radius: 3px; padding: 1px 6px; font-size: 10px; color: var(--muted); font-family: var(--font-mono); }
-    .tag.atlas { color: #60a5fa; border-color: #1e3a5f; background: #0f2040; }
-    .tag.metric { color: #a78bfa; border-color: #2e1f5e; background: #1a1030; }
-    .tag.acsc { color: #34d399; border-color: #064e3b; background: #042f23; }
-    .tag.mitigated { color: #4ade80; border-color: #14532d; background: #052e16; }
-    .tag.residual { color: #f97316; border-color: #431407; background: #1f0d03; }
-    .tag.partial { color: #eab308; border-color: #422006; background: #1a0f02; }
-    /* Severity delta arrow */
-    .sev-delta { display: flex; align-items: center; gap: 6px; flex-shrink: 0; margin-top: 2px; }
-    .sev-delta .arrow { color: var(--muted); font-size: 12px; }
-    .delta-reduced .arrow { color: #4ade80; }
-    .delta-unchanged .arrow { color: var(--muted); }
-    .threat-body { padding: 0 16px 16px; border-top: 1px solid var(--border); display: none; }
-    .threat-card.expanded .threat-body { display: block; }
-    .threat-section { margin-top: 14px; }
-    .threat-section-label { font-size: 10px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.08em; color: var(--muted); margin-bottom: 6px; }
-    .threat-section-content { font-size: 13px; color: #ccc; line-height: 1.6; }
-    /* NeMo Claw control box */
-    .nemo-control-box { margin-top: 14px; background: #0a1a0a; border: 1px solid #1a3a1a; border-radius: 4px; padding: 10px 14px; }
-    .nemo-control-label { font-size: 10px; font-weight: 600; text-transform: uppercase; color: #4ade80; letter-spacing: 0.08em; margin-bottom: 4px; }
-    .nemo-control-text { font-size: 12px; color: #a0c8a0; font-family: var(--font-mono); line-height: 1.5; }
-    .nemo-control-residual { background: #1a0a00; border-color: #3a1800; }
-    .nemo-control-residual .nemo-control-label { color: #f97316; }
-    .nemo-control-residual .nemo-control-text { color: #c8a080; }
-    .mitigation-list { margin-top: 24px; }
-    .mitigation-card { background: #0f1f10; border: 1px solid #1a3a1a; border-radius: 6px; padding: 12px 16px; margin-bottom: 8px; }
-    .mitigation-label { font-size: 10px; font-weight: 600; text-transform: uppercase; color: #4ade80; letter-spacing: 0.08em; margin-bottom: 6px; }
-    .mitigation-text { font-size: 13px; color: #ccc; }
-    /* Comparison summary banner */
-    .comparison-banner { background: #0a1a0a; border: 1px solid #1a3a1a; border-radius: 6px; padding: 14px 20px; margin-bottom: 20px; display: flex; gap: 32px; flex-wrap: wrap; align-items: center; }
-    .comparison-stat { text-align: center; }
-    .comparison-stat .stat-num { font-size: 24px; font-weight: 700; font-family: var(--font-mono); }
-    .comparison-stat .stat-label { font-size: 11px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.06em; margin-top: 2px; }
-    .stat-reduced { color: #4ade80; }
-    .stat-unchanged { color: var(--muted); }
-    .stat-mitigated { color: #60a5fa; }
-    .comparison-note { font-size: 12px; color: var(--muted); line-height: 1.6; max-width: 400px; }
-    .empty { color: var(--muted); text-align: center; padding: 48px; }
-    .framework-strip { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 20px; }
-    .fw-chip { display: flex; align-items: center; gap: 6px; background: var(--surface); border: 1px solid var(--border); border-radius: 4px; padding: 4px 10px; font-size: 11px; color: var(--muted); }
-    .fw-dot { width: 6px; height: 6px; border-radius: 50%; }
-    footer { border-top: 1px solid var(--border); padding: 16px 32px; display: flex; gap: 16px; align-items: center; }
-    footer a { color: var(--muted); text-decoration: none; font-size: 12px; }
-    footer a:hover { color: var(--text); }
-    .footer-sep { color: var(--border); }
-  </style>
-</head>
-<body>
-<header>
-  <div>
-    <div class="logo">🌿 <span>Canopy</span></div>
-    <div class="tagline">Multi-framework AI threat modelling</div>
-  </div>
-  <div class="header-meta">
-    <span class="badge">AIVSS V4</span>
-    <span class="badge">ATLAS 5.6.0</span>
-    <span class="badge">ASD/ACSC</span>
-  </div>
-</header>
-<div class="layout">
-  <aside>
-    <div class="sidebar-section">
-      <div class="sidebar-label">System</div>
-      <button class="filter-btn active" data-filter="all">
-        All threats
-        <span class="count" id="count-all">—</span>
-      </button>
-    </div>
-    <div class="sidebar-section">
-      <div class="sidebar-label">Severity</div>
-      <button class="filter-btn" data-filter="sev-Critical">
-        <span class="dot" style="background:var(--critical)"></span> Critical
-        <span class="count" id="count-Critical">0</span>
-      </button>
-      <button class="filter-btn" data-filter="sev-High">
-        <span class="dot" style="background:var(--high)"></span> High
-        <span class="count" id="count-High">0</span>
-      </button>
-      <button class="filter-btn" data-filter="sev-Medium">
-        <span class="dot" style="background:var(--medium)"></span> Medium
-        <span class="count" id="count-Medium">0</span>
-      </button>
-      <button class="filter-btn" data-filter="sev-Low">
-        <span class="dot" style="background:var(--low)"></span> Low
-        <span class="count" id="count-Low">0</span>
-      </button>
-    </div>
-    <div class="sidebar-section">
-      <div class="sidebar-label">AIVSS Metric</div>
-      <div id="metric-filters"></div>
-    </div>
-    <!-- NeMo Claw filter panel (only shown in comparison view) -->
-    <div class="sidebar-section" id="nemo-filter-section" style="display:none">
-      <div class="sidebar-label">NeMo Claw</div>
-      <button class="filter-btn" data-filter="nemo-mitigated">
-        <span class="dot" style="background:var(--low)"></span> Mitigated
-        <span class="count" id="count-mitigated">0</span>
-      </button>
-      <button class="filter-btn" data-filter="nemo-partial">
-        <span class="dot" style="background:var(--medium)"></span> Partial
-        <span class="count" id="count-partial">0</span>
-      </button>
-      <button class="filter-btn" data-filter="nemo-unchanged">
-        <span class="dot" style="background:var(--muted)"></span> Unchanged
-        <span class="count" id="count-unchanged">0</span>
-      </button>
-    </div>
-  </aside>
-  <main>
-    <div class="view-toggle">
-      <button class="view-tab active" id="tab-baseline" onclick="switchView('baseline')">
-        OpenClaw — Baseline
-        <span class="tab-badge" id="tab-baseline-count">—</span>
-      </button>
-      <button class="view-tab" id="tab-nemoclaw" onclick="switchView('nemoclaw')">
-        OpenClaw + NeMo Claw
-        <span class="tab-badge" id="tab-nemoclaw-count">—</span>
-      </button>
-    </div>
-    <div class="framework-strip">
-      <div class="fw-chip"><span class="fw-dot" style="background:#3b82f6"></span> OWASP AIVSS V4 — 9 metrics, 39 sub-categories</div>
-      <div class="fw-chip"><span class="fw-dot" style="background:#a78bfa"></span> MITRE ATLAS 5.6.0 — adversary TTPs</div>
-      <div class="fw-chip"><span class="fw-dot" style="background:#34d399"></span> ASD/ACSC Five Eyes</div>
-      <div class="fw-chip" id="nemo-chip" style="display:none"><span class="fw-dot" style="background:#4ade80"></span> NeMo Claw — kernel-level sandbox (alpha)</div>
-    </div>
-    <!-- Comparison stats banner (only in NeMo view) -->
-    <div class="comparison-banner" id="comparison-banner" style="display:none"></div>
-    <div class="system-info" id="system-info"></div>
-    <div class="threat-list" id="threat-list"></div>
-    <div class="mitigation-list" id="mitigation-list"></div>
-  </main>
-</div>
-<footer>
-  <a href="https://github.com/waratahlabs/canopy">@waratahlabs/canopy</a>
-  <span class="footer-sep">·</span>
-  <a href="https://aivss.owasp.org">OWASP AIVSS</a>
-  <span class="footer-sep">·</span>
-  <a href="https://atlas.mitre.org">MITRE ATLAS</a>
-  <span class="footer-sep">·</span>
-  <a href="https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services">ASD/ACSC</a>
-  <span class="footer-sep">·</span>
-  <a href="https://www.secondtalent.com/resources/nemoclaw-vs-openclaw/">NeMo Claw vs OpenClaw</a>
-  <span class="footer-sep">·</span>
-  <a href="https://github.com/awslabs/threat-composer">AWS Threat Composer</a>
-</footer>
-<script>
-  const METRIC_NAMES = {
-    MR: "Model Robustness",
-    DS: "Data Security",
-    EI: "Ethical Implications",
-    DC: "Deployment Config",
-    AD: "Agent Delegation",
-    AA: "Agentic Autonomy",
-    LL: "Lifecycle & Lineage",
-    GV: "Governance",
-    CS: "Supply Chain"
-  };
-  const SEV_ORDER = { Critical: 4, High: 3, Medium: 2, Low: 1, None: 0 };
-  let currentView = "baseline";
-  let baselineData = null;
-  let nemoclawData = null;
-  let activeFilter = "all";
-  function getMeta(threat, key) {
-    return threat.metadata?.find(m => m.key === key)?.value ?? "";
-  }
-  function activeData() {
-    return currentView === "baseline" ? baselineData : nemoclawData;
-  }
-  function renderSystemInfo(data) {
-    const el = document.getElementById("system-info");
-    const appName = data.applicationInfo?.name ?? "Unknown";
-    const threatCount = data.threats?.length ?? 0;
-    const mitigationCount = data.mitigations?.length ?? 0;
-    const version = data.metadata?.find(m => m.key === "canopy-version")?.value ?? "—";
-    const aivss = data.metadata?.find(m => m.key === "aivss-version")?.value ?? "—";
-    const generatedAt = data.metadata?.find(m => m.key === "generated-at")?.value ?? "";
-    const date = generatedAt ? new Date(generatedAt).toLocaleDateString("en-AU", { dateStyle: "medium" }) : "—";
-    const isolationLayers = data.metadata?.find(m => m.key === "isolation-layers")?.value ?? null;
-    el.innerHTML = `
-      <div class="info-item"><div class="info-label">System</div><div class="info-value">${appName}</div></div>
-      <div class="info-item"><div class="info-label">Threats</div><div class="info-value">${threatCount}</div></div>
-      <div class="info-item"><div class="info-label">Mitigations</div><div class="info-value">${mitigationCount}</div></div>
-      <div class="info-item"><div class="info-label">Canopy</div><div class="info-value">v${version}</div></div>
-      <div class="info-item"><div class="info-label">AIVSS</div><div class="info-value">v${aivss}</div></div>
-      <div class="info-item"><div class="info-label">Generated</div><div class="info-value">${date}</div></div>
-      ${isolationLayers ? `<div class="info-item"><div class="info-label">Isolation</div><div class="info-value" style="color:#4ade80">${isolationLayers}</div></div>` : ""}
-    `;
-  }
-  function buildSevPill(sev) {
-    return `<span class="sev-pill sev-${sev}">${sev}</span>`;
-  }
-  function buildSevDelta(baseline, current) {
-    const bOrd = SEV_ORDER[baseline] ?? 2;
-    const cOrd = SEV_ORDER[current] ?? 2;
-    const deltaClass = cOrd < bOrd ? "delta-reduced" : "delta-unchanged";
-    const arrow = cOrd < bOrd ? "↓" : "→";
-    return `
-      <div class="sev-delta ${deltaClass}">
-        ${buildSevPill(baseline)}
-        <span class="arrow">${arrow}</span>
-        ${buildSevPill(current)}
-      </div>
-    `;
-  }
-  function renderThreat(t) {
-    const sev = getMeta(t, "aivss-severity") || "Medium";
-    const metric = getMeta(t, "aivss-metric");
-    const atlasId = getMeta(t, "atlas-techniqueId");
-    const atlasName = getMeta(t, "atlas-techniqueName");
-    const tactic = getMeta(t, "atlas-tactic");
-    const acscFamily = getMeta(t, "acsc-riskFamily");
-    // NeMo Claw fields
-    const nemoMitigated = getMeta(t, "nemoclaw-mitigated");
-    const nemoControl = getMeta(t, "nemoclaw-control");
-    const baselineSev = getMeta(t, "baseline-severity");
-    const severityDelta = getMeta(t, "severity-delta");
-    const isNemoView = currentView === "nemoclaw";
-    // NeMo Claw status tag
-    let nemoTag = "";
-    if (isNemoView && nemoMitigated) {
-      if (nemoMitigated === "true") nemoTag = `<span class="tag mitigated">NeMo: mitigated</span>`;
-      else if (nemoMitigated === "partial") nemoTag = `<span class="tag partial">NeMo: partial</span>`;
-      else if (nemoMitigated === "false") nemoTag = `<span class="tag residual">NeMo: residual risk</span>`;
-    }
-    const tags = [
-      metric ? `<span class="tag metric">${metric} — ${METRIC_NAMES[metric] ?? metric}</span>` : "",
-      atlasId ? `<span class="tag atlas">${atlasId} ${atlasName}</span>` : "",
-      tactic ? `<span class="tag">${tactic}</span>` : "",
-      acscFamily ? `<span class="tag acsc">ACSC: ${acscFamily}</span>` : "",
-      nemoTag,
-    ].filter(Boolean).join("");
-    // Header: baseline view shows simple pill; NeMo view shows delta if severity changed
-    const headerSev = (isNemoView && baselineSev && baselineSev !== sev)
-      ? buildSevDelta(baselineSev, sev)
-      : buildSevPill(sev);
-    // NeMo control callout in body
-    let nemoControlHtml = "";
-    if (isNemoView && nemoControl && nemoControl !== "None — injection occurs inside sandboxed process") {
-      const isResidual = nemoMitigated === "false";
-      nemoControlHtml = `
-        <div class="nemo-control-box ${isResidual ? 'nemo-control-residual' : ''}">
-          <div class="nemo-control-label">${isResidual ? "Residual risk — NeMo Claw does not mitigate" : "NeMo Claw control"}</div>
-          <div class="nemo-control-text">${nemoControl}</div>
-        </div>
-      `;
-    } else if (isNemoView && nemoMitigated === "false") {
-      nemoControlHtml = `
-        <div class="nemo-control-box nemo-control-residual">
-          <div class="nemo-control-label">Residual risk — NeMo Claw does not mitigate</div>
-          <div class="nemo-control-text">${nemoControl || "This attack vector operates inside the sandbox boundary and is not addressed by kernel-level isolation."}</div>
-        </div>
-      `;
-    }
-    return `
-      <div class="threat-card" data-id="${t.id}" data-sev="${sev}" data-metric="${metric}" data-nemo="${nemoMitigated}" onclick="toggleCard(this)">
-        <div class="threat-header">
-          ${headerSev}
-          <div style="flex:1">
-            <div class="threat-title">${t.threatAction ?? t.statement ?? "Unnamed threat"}</div>
-            <div class="threat-tags">${tags}</div>
-          </div>
-        </div>
-        <div class="threat-body">
-          ${nemoControlHtml}
-          ${t.threatSource ? `<div class="threat-section"><div class="threat-section-label">Threat source</div><div class="threat-section-content">${t.threatSource}</div></div>` : ""}
-          ${t.prerequisites ? `<div class="threat-section"><div class="threat-section-label">Prerequisites</div><div class="threat-section-content">${t.prerequisites}</div></div>` : ""}
-          ${t.threatImpact ? `<div class="threat-section"><div class="threat-section-label">Impact</div><div class="threat-section-content">${t.threatImpact}</div></div>` : ""}
-          ${t.statement ? `<div class="threat-section"><div class="threat-section-label">Full statement</div><div class="threat-section-content">${t.statement}</div></div>` : ""}
-          ${t.impactedAssets?.length ? `<div class="threat-section"><div class="threat-section-label">Impacted assets</div><div class="threat-tags">${t.impactedAssets.map(a => `<span class="tag">${a}</span>`).join("")}</div></div>` : ""}
-        </div>
-      </div>
-    `;
-  }
-  function renderThreats(threats) {
-    const list = document.getElementById("threat-list");
-    if (!threats.length) {
-      list.innerHTML = '<div class="empty">No threats match the current filter.</div>';
-      return;
-    }
-    list.innerHTML = threats.map(renderThreat).join("");
-  }
-  function renderMitigations(mitigations) {
-    const list = document.getElementById("mitigation-list");
-    if (!mitigations.length) { list.innerHTML = ""; return; }
-    list.innerHTML = `
-      <div style="font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:0.08em;color:var(--muted);margin-bottom:12px;">Mitigations (${mitigations.length})</div>
-      ${mitigations.map(m => `
-        <div class="mitigation-card">
-          <div class="mitigation-label">Mitigation ${m.numericId}</div>
-          <div class="mitigation-text">${m.content}</div>
-        </div>
-      `).join("")}
-    `;
-  }
-  function renderComparisonBanner(threats) {
-    const banner = document.getElementById("comparison-banner");
-    if (currentView !== "nemoclaw") { banner.style.display = "none"; return; }
-    let reduced = 0, unchanged = 0, partial = 0, fullyMitigated = 0;
-    for (const t of threats) {
-      const m = getMeta(t, "nemoclaw-mitigated");
-      const delta = getMeta(t, "severity-delta");
-      if (m === "true") fullyMitigated++;
-      else if (m === "partial") partial++;
-      else unchanged++;
-      if (delta === "reduced") reduced++;
-    }
-    banner.style.display = "flex";
-    banner.innerHTML = `
-      <div class="comparison-stat">
-        <div class="stat-num stat-reduced">${reduced}</div>
-        <div class="stat-label">Severity reduced</div>
-      </div>
-      <div class="comparison-stat">
-        <div class="stat-num stat-unchanged">${unchanged}</div>
-        <div class="stat-label">Unchanged</div>
-      </div>
-      <div class="comparison-stat">
-        <div class="stat-num stat-mitigated">${fullyMitigated}</div>
-        <div class="stat-label">Fully mitigated</div>
-      </div>
-      <div class="comparison-stat">
-        <div class="stat-num" style="color:var(--medium)">${partial}</div>
-        <div class="stat-label">Partially mitigated</div>
-      </div>
-      <div class="comparison-note">
-        NeMo Claw's kernel-level sandbox (Landlock + seccomp + network namespaces) addresses host and engine layers
-        directly. L1 Orchestration and L2 Application threats persist — the sandbox confines the blast radius but
-        does not prevent injection or cron persistence.
-      </div>
-    `;
-  }
-  function renderFilters(threats) {
-    const counts = { all: threats.length, Critical: 0, High: 0, Medium: 0, Low: 0, None: 0 };
-    const metricCounts = {};
-    const nemoCounts = { mitigated: 0, partial: 0, unchanged: 0 };
-    for (const t of threats) {
-      const sev = getMeta(t, "aivss-severity") || "Medium";
-      if (sev in counts) counts[sev]++;
-      const metric = getMeta(t, "aivss-metric");
-      if (metric) metricCounts[metric] = (metricCounts[metric] ?? 0) + 1;
-      const nemo = getMeta(t, "nemoclaw-mitigated");
-      if (nemo === "true") nemoCounts.mitigated++;
-      else if (nemo === "partial") nemoCounts.partial++;
-      else if (nemo === "false") nemoCounts.unchanged++;
-    }
-    document.getElementById("count-all").textContent = counts.all;
-    for (const sev of ["Critical", "High", "Medium", "Low"]) {
-      document.getElementById(`count-${sev}`).textContent = counts[sev];
-    }
-    document.getElementById("count-mitigated").textContent = nemoCounts.mitigated;
-    document.getElementById("count-partial").textContent = nemoCounts.partial;
-    document.getElementById("count-unchanged").textContent = nemoCounts.unchanged;
-    const mf = document.getElementById("metric-filters");
-    mf.innerHTML = Object.entries(metricCounts).sort().map(([m, c]) => `
-      <button class="filter-btn" data-filter="metric-${m}">
-        <span style="font-family:var(--font-mono);font-size:11px;color:var(--accent)">${m}</span>
-        ${METRIC_NAMES[m] ?? m}
-        <span class="count">${c}</span>
-      </button>
-    `).join("");
-    mf.querySelectorAll(".filter-btn").forEach(btn => btn.addEventListener("click", () => applyFilter(btn)));
-    // Show/hide NeMo filter panel
-    const nemoSection = document.getElementById("nemo-filter-section");
-    nemoSection.style.display = currentView === "nemoclaw" ? "block" : "none";
-    document.getElementById("nemo-chip").style.display = currentView === "nemoclaw" ? "flex" : "none";
-  }
-  function applyFilter(btn) {
-    document.querySelectorAll(".filter-btn").forEach(b => b.classList.remove("active"));
-    btn.classList.add("active");
-    activeFilter = btn.dataset.filter;
-    const data = activeData();
-    if (!data) return;
-    const filtered = filterThreats(data.threats ?? [], activeFilter);
-    renderThreats(filtered);
-  }
-  function filterThreats(threats, filter) {
-    if (filter === "all") return threats;
-    if (filter.startsWith("sev-")) {
-      const sev = filter.slice(4);
-      return threats.filter(t => (getMeta(t, "aivss-severity") || "Medium") === sev);
-    }
-    if (filter.startsWith("metric-")) {
-      const m = filter.slice(7);
-      return threats.filter(t => getMeta(t, "aivss-metric") === m);
-    }
-    if (filter === "nemo-mitigated") return threats.filter(t => getMeta(t, "nemoclaw-mitigated") === "true");
-    if (filter === "nemo-partial") return threats.filter(t => getMeta(t, "nemoclaw-mitigated") === "partial");
-    if (filter === "nemo-unchanged") return threats.filter(t => getMeta(t, "nemoclaw-mitigated") === "false");
-    return threats;
-  }
-  function toggleCard(el) {
-    el.classList.toggle("expanded");
-  }
-  function switchView(view) {
-    currentView = view;
-    activeFilter = "all";
-    document.getElementById("tab-baseline").classList.toggle("active", view === "baseline");
-    document.getElementById("tab-nemoclaw").classList.toggle("active", view === "nemoclaw");
-    const data = activeData();
-    if (!data) return;
-    const threats = data.threats ?? [];
-    renderSystemInfo(data);
-    renderFilters(threats);
-    renderComparisonBanner(threats);
-    renderThreats(threats);
-    renderMitigations(data.mitigations ?? []);
-    // Reset filter buttons to "all"
-    document.querySelectorAll(".filter-btn").forEach(b => b.classList.remove("active"));
-    document.querySelector(".filter-btn[data-filter='all']")?.classList.add("active");
-  }
-  document.querySelectorAll(".filter-btn[data-filter]").forEach(btn => {
-    btn.addEventListener("click", () => applyFilter(btn));
-  });
-  // Load both datasets in parallel
-  Promise.all([
-    fetch("data/openclaw-demo.tc.json").then(r => r.json()),
-    fetch("data/openclaw-nemoclaw-demo.tc.json").then(r => r.json()),
-  ]).then(([baseline, nemoclaw]) => {
-    baselineData = baseline;
-    nemoclawData = nemoclaw;
-    document.getElementById("tab-baseline-count").textContent = baseline.threats?.length ?? 0;
-    document.getElementById("tab-nemoclaw-count").textContent = nemoclaw.threats?.length ?? 0;
-    // Render baseline by default
-    switchView("baseline");
-  }).catch(err => {
-    document.getElementById("threat-list").innerHTML =
-      `<div class="empty">Failed to load demo data: ${err.message}</div>`;
-  });
-</script>
-</body>
-</html>

package/dist/aivss/scoring/a2a-corpus.test.d.ts DELETED Viewed

@@ -1,28 +0,0 @@
-/**
- * A2A corpus regression — deterministic scoring against real agent definitions.
- *
- * The unit tests prove the scorer is pure over a hand-written fixture. This
- * proves it stays stable over a corpus of ~25 real agent topologies harvested
- * from a2aproject/a2a-samples, which is where scoring changes actually show up:
- * a threshold tweak that looks harmless against one synthetic agent will move
- * severities across a real corpus.
- *
- * Regenerate the corpus with a checkout of a2a-samples:
- *
- *   bun scripts/harvest-a2a-samples.ts path/to/a2a-samples
- *
- * That writes tests/fixtures/a2a/input/<agent>.json (the synthesized
- * AgentDefinitions) and tests/fixtures/a2a/expected/<agent>.tc.json (the
- * assessed artifact). This test re-derives the expected output from the input
- * and diffs.
- *
- * A diff here is not automatically a bug. It means emitted scores moved, which
- * per CONTRIBUTING.md is a breaking change requiring a major version bump — so
- * the diff should be reviewed, then the corpus regenerated in the same commit
- * that changes the scoring.
- *
- * The suite skips cleanly when the corpus is absent, so a fresh clone without
- * fixtures is green rather than red.
- */
-export {};
-//# sourceMappingURL=a2a-corpus.test.d.ts.map

package/dist/aivss/scoring/a2a-corpus.test.d.ts.map DELETED Viewed

	@@ -1 +0,0 @@
1	- {"version":3,"file":"a2a-corpus.test.d.ts","sourceRoot":"","sources":["../../../src/aivss/scoring/a2a-corpus.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}