@waratahlabs/canopy 0.5.0

package/dist/cli.js

@@ -0,0 +1,1037 @@
+#!/usr/bin/env bun
+/**
+ * Canopy CLI — multi-framework threat modelling for agentic AI systems.
+ *
+ * Usage:
+ *   bunx @waratahlabs/canopy assess --input agents.json [--out model.tc.json]
+ *   bunx @waratahlabs/canopy schema
+ *   bunx @waratahlabs/canopy demo [--port 3000]
+ *
+ * Claude Code / Cursor agents: run `canopy schema` to get the AgentDefinition
+ * shape, construct the input JSON from the codebase under review, then run
+ * `canopy assess` to produce the threat model artifact.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as readline from "node:readline";
+import { assessWorkflow, submitBedrockBatch, fetchBedrockBatch, submitAnthropicBatch, fetchAnthropicBatch } from "./index.js";
+import { buildBaseline, saveBaseline, loadRecentBaselines } from "./baseline/store.js";
+import { diffBaselines, formatDiff } from "./baseline/diff.js";
+import { walkA2AGraph } from "./adapters/a2a.js";
+import { resolveAtlasYaml } from "./aivss/atlas/resolve-path.js";
+import { generateLikeC4, likec4Filename } from "./output/likec4-generator.js";
+import { DEPLOYMENT_CONTEXTS } from "./aivss/types.js";
+// ---------------------------------------------------------------------------
+// TC schema validation — inline structural checks against TC schema constraints.
+// Covers the invariants that actually bite: status enum, custom: prefix, key
+// length, and no root fields the schema rejects. No external validator needed.
+// ---------------------------------------------------------------------------
+const VALID_STATUSES = new Set([
+    "threatIdentified",
+    "threatResolved",
+    "threatResolvedNotUseful",
+]);
+const ROOT_ALLOWED = new Set(["schema", "applicationInfo", "threats", "mitigations", "mitigationLinks"]);
+function validateTCOutput(data) {
+    const errors = [];
+    if (data.schema !== 1)
+        errors.push(`/ schema must be 1, got ${data.schema}`);
+    for (const key of Object.keys(data)) {
+        if (!ROOT_ALLOWED.has(key))
+            errors.push(`/ unexpected root field "${key}"`);
+    }
+    for (const t of data.threats ?? []) {
+        if (t.status !== undefined && !VALID_STATUSES.has(t.status)) {
+            errors.push(`/threats[${t.id}] invalid status "${t.status}"`);
+        }
+        for (const m of t.metadata ?? []) {
+            if (m.key.length > 50)
+                errors.push(`/threats[${t.id}]/metadata key too long (>50): "${m.key}"`);
+            if (!["Priority", "Comments", "STRIDE", "source"].includes(m.key) && !m.key.startsWith("custom:")) {
+                errors.push(`/threats[${t.id}]/metadata key missing custom: prefix: "${m.key}"`);
+            }
+        }
+    }
+    for (const m of data.mitigations ?? []) {
+        for (const meta of m.metadata ?? []) {
+            errors.push(`/mitigations[${m.id}] has metadata (schema rejects it): key="${meta.key}"`);
+        }
+    }
+    for (const lnk of data.mitigationLinks ?? []) {
+        const extra = Object.keys(lnk).filter((k) => k !== "mitigationId" && k !== "linkedId");
+        if (extra.length)
+            errors.push(`/mitigationLinks unexpected fields: ${extra.join(", ")}`);
+    }
+    return { valid: errors.length === 0, errors };
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function usage() {
+    console.log(`
+Canopy — multi-framework AI threat modelling
+
+COMMANDS
+
+  assess      Generate a .tc.json threat model from agent definitions
+  a2a-assess  Walk an A2A delegation graph and generate a threat model
+  schema      Print the AgentDefinition input schema (for LLM context)
+  demo        Serve the interactive threat model viewer
+
+USAGE
+
+  canopy assess [options]
+    --input  <file>   Path to input JSON file (default: stdin)
+    --out    <file>   Path for .tc.json output (default: stdout)
+    --diagram         Also write a LikeC4 .c4 architecture diagram
+    --name   <name>   Application name (overrides applicationName in input)
+    --deterministic   Score with the heuristic scorer: a pure function of the agent
+                      definition. Reproducible across runs and machines, auditable,
+                      no credentials, no network. Use this for CI gating and audit
+                      trails.
+    --harness         No API key, no subprocess: writes assessment prompts to
+                      <outdir>/canopy-batch-requests.json for the calling LLM coding agent to
+                      answer directly (its own reasoning, no extra model call), then reads
+                      <outdir>/canopy-batch-responses.json for real severity scores + threat
+                      slots. First run always exits with next-step instructions; re-run once
+                      the responses file exists. Mutually exclusive with --deterministic.
+    --save            Save a baseline snapshot after assessment for future diffing.
+    --diff            Save baseline and print diff against the previous run (implies --save).
+                      Exits with code 1 if any severity regressions are detected — CI-safe.
+
+  canopy batch-submit [options]
+    Submit a batch inference job for live severity scoring and exit immediately.
+    Jobs complete in minutes to hours. Returns a handle file; use 'canopy batch-fetch' to collect.
+    --provider  <p>    "bedrock" (AWS) or "anthropic" (direct API). Default: anthropic.
+    --input    <file>  Agent definitions JSON (required)
+    --handle   <file>  Where to write the job handle (default: canopy-batch-handle.json)
+    --model    <m>     Model override (anthropic default: claude-haiku-4-5-20251001)
+    Bedrock only:
+      --s3-bucket <b>  S3 bucket for JSONL input/output (required for bedrock)
+      --role-arn  <a>  IAM role ARN with bedrock + s3 permissions (required for bedrock)
+      --region    <r>  AWS region (default: us-east-1)
+
+  canopy batch-fetch [options]
+    Check a submitted job and, if complete, collect results into a .tc.json file.
+    Re-run until it reports complete — the handle is idempotent.
+    Provider is detected automatically from the handle file.
+    --handle  <file>   Job handle written by batch-submit (default: canopy-batch-handle.json)
+    --input   <file>   Original agent definitions JSON (needed to assemble the threat model)
+    --out     <file>   Path for .tc.json output (default: stdout)
+    --diagram          Also write a LikeC4 .c4 architecture diagram
+
+  canopy diff [options]
+    Compare the two most recent baseline snapshots for an application.
+    --name  <name>    Application name to look up history for (required if ambiguous)
+    --dir   <dir>     Directory containing .canopy-history/ (default: current directory)
+    --exit-code       Exit with code 1 if regressions exist (default when run in CI via --diff on assess)
+
+  canopy a2a-assess [options]
+    Fetch Agent Cards from one or more A2A-compliant URLs, walk the delegation
+    graph, and produce a .tc.json threat model.
+    --url     <url>    Entry-point agent URL (repeat for multiple). Required.
+    --depth   <n>      Max delegation hops to follow (default: 3)
+    --out     <file>   Path for .tc.json output (default: stdout)
+    --diagram          Also write a LikeC4 .c4 architecture diagram
+    --name    <name>   Application name override
+    --timeout <ms>     Per-card fetch timeout in ms (default: 8000)
+    --deterministic    Score with the heuristic scorer (reproducible, no credentials)
+    --save             Save a baseline snapshot
+    --diff             Save + diff against prior run; exits 1 on regressions
+
+  canopy schema
+    Prints the AgentDefinition JSON schema and an example input document.
+    Pipe to a file or paste into your agent's context window.
+
+  canopy demo [--port <n>]
+    Serves the built-in threat model explorer (default port 3000).
+
+EXAMPLES
+
+  # Assess from file, write to file
+  bunx @waratahlabs/canopy assess --input my-agents.json --out threat-model.tc.json
+
+  # Assess from stdin (pipe from another tool)
+  cat agents.json | bunx @waratahlabs/canopy assess --out threat-model.tc.json
+
+  # CI shape validation — structural mapping only, no reasoning
+  bunx @waratahlabs/canopy assess --input agents.json --deterministic --out threat-model.tc.json
+
+  # Agentic mode — calling LLM coding agent provides the actual reasoning,
+  # no API key needed. First run writes the prompts and exits with instructions;
+  # answer them, then re-run the same command.
+  bunx @waratahlabs/canopy assess --input agents.json --harness --out threat-model.tc.json
+
+  # Include architecture diagram
+  bunx @waratahlabs/canopy assess --input agents.json --diagram --out threat-model.tc.json
+
+  # Get the schema for LLM context
+  bunx @waratahlabs/canopy schema > canopy-schema.json
+`);
+}
+function die(msg) {
+    console.error(`canopy: ${msg}`);
+    process.exit(1);
+}
+async function readStdin() {
+    const rl = readline.createInterface({ input: process.stdin });
+    const lines = [];
+    for await (const line of rl)
+        lines.push(line);
+    return lines.join("\n");
+}
+// ---------------------------------------------------------------------------
+// Schema command — prints the AgentDefinition shape so an LLM can read it
+// ---------------------------------------------------------------------------
+function cmdSchema() {
+    const schema = {
+        $schema: "https://json-schema.org/draft/2020-12/schema",
+        title: "CanopyInput",
+        description: "Input document for `canopy assess`. Describe each agent in the system under assessment. " +
+            "Canopy maps these definitions to OWASP AIVSS V4 metrics, MITRE ATLAS techniques, " +
+            "and registered framework adapters (ACSC, DSTG MEAID) to produce a .tc.json threat model. " +
+            "For threat-statement phrasing and depth, the explorer fixtures in demo/data/ are illustrative " +
+            "(they predate the current metadata shape, so treat them as prose references, not schema examples): " +
+            "demo/data/openclaw-demo.tc.json (personal AI assistant), " +
+            "demo/data/openclaw-nemoclaw-demo.tc.json (sandboxed vs baseline comparison). " +
+            "See SKILL.md for the full agentic workflow.",
+        type: "object",
+        required: ["applicationName", "agents"],
+        properties: {
+            applicationName: {
+                type: "string",
+                description: "Human-readable name for the system being assessed. Appears in the threat model header.",
+                example: "My Agentic Sales Pipeline",
+            },
+            agents: {
+                type: "array",
+                minItems: 1,
+                description: "One entry per distinct agent or autonomous process in the system.",
+                items: {
+                    type: "object",
+                    required: [
+                        "id", "name", "model", "systemPrompt", "tools", "permissions",
+                        "deploymentContext", "modelComplexity", "mitigationMultiplier",
+                        "finetuned", "dependencies", "secretManagement", "deployment",
+                    ],
+                    properties: {
+                        id: { type: "string", description: "Stable unique identifier (kebab-case). e.g. 'sales-agent-01'" },
+                        name: { type: "string", description: "Display name. e.g. 'Sales Data Agent'" },
+                        model: { type: "string", description: "Model identifier. e.g. 'gpt-4o-mini', 'qwen3.5:4b', 'claude-haiku-4-5'" },
+                        systemPrompt: { type: "string", description: "The agent's system prompt or a description of its role and constraints." },
+                        tools: {
+                            type: "array",
+                            description: "Tools the agent can invoke.",
+                            items: {
+                                type: "object",
+                                required: ["name", "description"],
+                                properties: {
+                                    name: { type: "string" },
+                                    description: { type: "string", description: "What the tool does and what systems it touches." },
+                                    dangerous: { type: "boolean", description: "True if the tool has destructive, exfiltration, or privilege-escalation potential." },
+                                },
+                            },
+                        },
+                        permissions: {
+                            type: "array",
+                            items: { type: "string" },
+                            description: "Access grants. Use 'read:<resource>', 'write:<resource>', 'execute:<resource>' conventions.",
+                            example: ["read:postgres_salesdb", "write:audit_log", "execute:reporting_api"],
+                        },
+                        deploymentContext: {
+                            type: "string",
+                            enum: DEPLOYMENT_CONTEXTS,
+                            description: "Deployment context — drives AIVSS V4 weight profile. Choose the closest match.",
+                        },
+                        modelComplexity: {
+                            type: "string",
+                            enum: ["Simple", "Moderate", "Complex", "HighlyComplex"],
+                            description: "Simple = small/local models (≤7B). Moderate = mid-size (7B–70B or GPT-3.5 class). Complex = large frontier (GPT-4 class). HighlyComplex = multi-modal or ensemble.",
+                        },
+                        mitigationMultiplier: {
+                            type: "number",
+                            minimum: 0.5,
+                            maximum: 1.0,
+                            description: "1.0 = no mitigations deployed. Reduce toward 0.5 as guardrails, prompt shields, tool-call validation, etc. are added.",
+                        },
+                        finetuned: { type: "boolean", description: "True if the base model has been fine-tuned on domain-specific data." },
+                        dependencies: {
+                            type: "array",
+                            items: { type: "string" },
+                            description: "External systems this agent contacts. e.g. ['postgres:5432', 'redis:6379', 'langfuse (telemetry)']",
+                        },
+                        secretManagement: {
+                            type: "string",
+                            description: "How credentials are managed. Be specific — 'env vars, no rotation' vs 'Vault, 24h TTL'.",
+                        },
+                        deployment: {
+                            type: "string",
+                            description: "How the agent is deployed. e.g. 'Docker container', 'AWS Lambda', 'K8s pod'",
+                        },
+                        dataSources: { type: "array", items: { type: "string" }, description: "Data stores the agent reads from." },
+                        autonomyLevel: {
+                            type: "string",
+                            enum: ["supervised", "semi-autonomous", "autonomous"],
+                            description: "supervised = human approves each action. semi-autonomous = human approves high-risk actions. autonomous = no human in the loop.",
+                        },
+                        objectives: { type: "array", items: { type: "string" }, description: "What the agent is trying to accomplish." },
+                        externalApiCount: { type: "integer", description: "Number of distinct external APIs the agent can reach." },
+                    },
+                },
+            },
+            handoffs: {
+                type: "array",
+                description: "Agent-to-agent communication edges. Each edge is a potential context-injection surface (AML.T0080.000).",
+                items: {
+                    type: "object",
+                    required: ["fromAgentId", "fromAgentName", "toAgentId", "toAgentName"],
+                    properties: {
+                        fromAgentId: { type: "string" },
+                        fromAgentName: { type: "string" },
+                        toAgentId: { type: "string" },
+                        toAgentName: { type: "string" },
+                    },
+                },
+            },
+        },
+        example: {
+            applicationName: "Sales Data Pipeline",
+            agents: [
+                {
+                    id: "operative-agent-01",
+                    name: "operative-agent",
+                    model: "qwen3.5:4b",
+                    systemPrompt: "Retrieve sales data using the reporting API. Fall back to direct DB query only if the API is unavailable.",
+                    tools: [
+                        { name: "call_reporting_api", description: "Fetch sales data via the authorised HTTP API.", dangerous: false },
+                        { name: "query_database", description: "Execute SQL directly against the sales PostgreSQL database. Credentials from env.", dangerous: true },
+                    ],
+                    permissions: ["read:reporting_api", "read:postgres_salesdb", "write:audit_log"],
+                    deploymentContext: "FinancialServices",
+                    modelComplexity: "Simple",
+                    mitigationMultiplier: 1.0,
+                    finetuned: false,
+                    dependencies: ["reporting-api:8080", "postgres:5432", "redis:6379"],
+                    secretManagement: "Environment variables, no rotation.",
+                    deployment: "Docker container",
+                    autonomyLevel: "semi-autonomous",
+                    objectives: ["Retrieve monthly sales data"],
+                    externalApiCount: 1,
+                },
+            ],
+            handoffs: [],
+        },
+    };
+    console.log(JSON.stringify(schema, null, 2));
+}
+// ---------------------------------------------------------------------------
+// Assess command
+// ---------------------------------------------------------------------------
+async function cmdAssess(args) {
+    let inputFile;
+    let outFile;
+    let appNameOverride;
+    let deterministic = false;
+    let harness = false;
+    let diagram = false;
+    let save = false;
+    let diff = false;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--input" || a === "-i")
+            inputFile = args[++i];
+        else if (a === "--out" || a === "-o")
+            outFile = args[++i];
+        else if (a === "--name")
+            appNameOverride = args[++i];
+        else if (a === "--deterministic")
+            deterministic = true;
+        else if (a === "--harness")
+            harness = true;
+        else if (a === "--diagram")
+            diagram = true;
+        else if (a === "--save")
+            save = true;
+        else if (a === "--diff") {
+            diff = true;
+            save = true;
+        }
+        else
+            die(`unknown option: ${a}. Run 'canopy --help' for usage.`);
+    }
+    if (deterministic && harness)
+        die("--deterministic and --harness are mutually exclusive.");
+    // Read input
+    let raw;
+    if (inputFile) {
+        if (!fs.existsSync(inputFile))
+            die(`input file not found: ${inputFile}`);
+        raw = fs.readFileSync(inputFile, "utf8");
+    }
+    else {
+        if (process.stdin.isTTY)
+            die("no --input file and stdin is a TTY. Pipe JSON or use --input <file>.");
+        raw = await readStdin();
+    }
+    let input;
+    try {
+        input = JSON.parse(raw);
+    }
+    catch {
+        die("input is not valid JSON. Run 'canopy schema' for the expected format.");
+    }
+    if (!input.applicationName)
+        die("input missing required field: applicationName");
+    if (!Array.isArray(input.agents) || input.agents.length === 0)
+        die("input must contain at least one agent in agents[]");
+    const applicationName = appNameOverride ?? input.applicationName;
+    const agents = input.agents;
+    const handoffs = input.handoffs ?? [];
+    // Run assessment
+    let tcFormat;
+    let severityMap = new Map();
+    if (harness) {
+        // Harness path — no API key, no subprocess. Canopy writes the per-agent
+        // assessment prompts to a file; the calling LLM coding agent answers them
+        // directly with its own reasoning and writes the responses file. First
+        // run always throws (no responses yet) with the exact instructions for
+        // what to do next; re-run once the responses file exists.
+        const { HarnessBatchProvider } = await import("./batch/providers/harness.js");
+        const baseDir = outFile ? path.dirname(path.resolve(outFile)) : process.cwd();
+        const batchProvider = new HarnessBatchProvider({
+            requestsPath: path.join(baseDir, "canopy-batch-requests.json"),
+            responsesPath: path.join(baseDir, "canopy-batch-responses.json"),
+        });
+        tcFormat = await assessWorkflow({
+            input: { type: "agents", agents, handoffs },
+            provider: { type: "anthropic" }, // only exercised if a batch response fails to parse
+            batchProvider,
+            applicationName,
+        });
+        for (const threat of tcFormat.threats ?? []) {
+            const agentId = threat.metadata?.find((m) => m.key === "custom:agent-id")?.value;
+            const metric = threat.metadata?.find((m) => m.key === "custom:aivss-metric")?.value;
+            const subCat = threat.metadata?.find((m) => m.key === "custom:aivss-sub-category")?.value;
+            const priority = threat.metadata?.find((m) => m.key === "Priority")?.value;
+            if (agentId && metric && subCat && priority) {
+                severityMap.set(`${agentId}|${metric}|${subCat}`, priority);
+            }
+        }
+    }
+    else if (deterministic || !process.env.ANTHROPIC_API_KEY) {
+        if (!deterministic && !process.env.ANTHROPIC_API_KEY) {
+            // This used to claim "mock severity (Medium)", which was both wrong and
+            // self-deprecating: this path runs the full heuristic scorer, deriving a
+            // real per-sub-category severity from the agent definition. It is the
+            // reproducible mode, not a placeholder.
+            process.stderr.write("canopy: ANTHROPIC_API_KEY not set — scoring deterministically.\n" +
+                "        The heuristic scorer derives severity from the agent definition:\n" +
+                "        reproducible across runs, auditable, no credentials required.\n" +
+                "        Set ANTHROPIC_API_KEY for model-inferred severity, or --harness to\n" +
+                "        have the calling LLM agent answer the prompts itself.\n" +
+                "        Pass --deterministic to select this mode explicitly and silence this.\n\n");
+        }
+        // Deterministic path — heuristic scorer, no provider calls
+        const { assembleTCFormat, severityKey, slotKey } = await import("./output/tc-assembler.js");
+        const { loadAtlasData } = await import("./aivss/atlas/loader.js");
+        const { ATLAS_COVERAGE_MATRIX } = await import("./aivss/atlas/coverage-matrix.js");
+        const { heuristicSeverity } = await import("./aivss/scoring/heuristic-scorer.js");
+        const atlasYaml = resolveAtlasYaml();
+        const atlasData = loadAtlasData(atlasYaml);
+        const filledSlots = new Map();
+        const severityBySubCategory = new Map();
+        for (const agent of agents) {
+            for (const entry of ATLAS_COVERAGE_MATRIX) {
+                severityBySubCategory.set(severityKey(agent.id, entry.metric, entry.subCategory), heuristicSeverity(agent, entry.metric, entry.subCategory));
+                const techniqueId = entry.atlasTechniqueIds[0];
+                if (!techniqueId)
+                    continue;
+                const technique = atlasData.techniqueById.get(techniqueId);
+                if (!technique)
+                    continue;
+                const severity = severityBySubCategory.get(severityKey(agent.id, entry.metric, entry.subCategory)) ?? "Medium";
+                filledSlots.set(slotKey(agent.id, techniqueId, entry.metric, entry.subCategory), {
+                    threatSource: "A threat actor",
+                    prerequisites: `with access to ${agent.name}`,
+                    threatAction: `exploit ${entry.subCategory.toLowerCase()} weaknesses via ${technique.id}`,
+                    threatImpact: `${severity === "High" ? "critically compromise" : "compromise"} ${agent.name}`,
+                    impactedGoal: ["confidentiality", "integrity"],
+                    impactedAssets: [agent.name.toLowerCase()],
+                });
+            }
+        }
+        tcFormat = assembleTCFormat({
+            agents, handoffs, metricResponses: [], atlasData,
+            coverageMatrix: ATLAS_COVERAGE_MATRIX, filledSlots, severityBySubCategory,
+            applicationName,
+            scoringMode: "deterministic",
+        });
+        severityMap = severityBySubCategory;
+    }
+    else {
+        tcFormat = await assessWorkflow({
+            input: { type: "agents", agents, handoffs },
+            provider: { type: "anthropic" },
+            applicationName,
+        });
+        // Reconstruct severity map from TC threat metadata for baseline
+        for (const threat of tcFormat.threats ?? []) {
+            const agentId = threat.metadata?.find((m) => m.key === "custom:agent-id")?.value;
+            const metric = threat.metadata?.find((m) => m.key === "custom:aivss-metric")?.value;
+            const subCat = threat.metadata?.find((m) => m.key === "custom:aivss-sub-category")?.value;
+            const priority = threat.metadata?.find((m) => m.key === "Priority")?.value;
+            if (agentId && metric && subCat && priority) {
+                severityMap.set(`${agentId}|${metric}|${subCat}`, priority);
+            }
+        }
+    }
+    // Validate against official TC schema
+    const { valid, errors } = validateTCOutput(tcFormat);
+    if (!valid) {
+        process.stderr.write(`\ncanopy: TC schema validation failed (${errors.length} error(s)):\n`);
+        for (const e of errors)
+            process.stderr.write(`  · ${e}\n`);
+        process.stderr.write("\nOutput NOT written. Fix the assembler or report a Canopy bug.\n");
+        process.exit(1);
+    }
+    // Write TC output
+    const tcJson = JSON.stringify(tcFormat, null, 2);
+    if (outFile) {
+        fs.mkdirSync(path.dirname(path.resolve(outFile)), { recursive: true });
+        fs.writeFileSync(outFile, tcJson);
+        process.stderr.write(`✓ ${(tcFormat.threats ?? []).length} threats · ` +
+            `${(tcFormat.mitigations ?? []).length} mitigations → ${outFile}\n`);
+    }
+    else {
+        process.stdout.write(tcJson + "\n");
+    }
+    // Optional diagram
+    if (diagram) {
+        const c4 = generateLikeC4({ agents, handoffs, applicationName });
+        const c4File = outFile
+            ? path.join(path.dirname(outFile), likec4Filename(applicationName))
+            : likec4Filename(applicationName);
+        fs.writeFileSync(c4File, c4);
+        process.stderr.write(`✓ architecture diagram → ${c4File}\n`);
+    }
+    // Save baseline and optional diff
+    if (save) {
+        const baseDir = outFile ? path.dirname(path.resolve(outFile)) : process.cwd();
+        const baseline = buildBaseline(applicationName, agents.map((a) => ({ id: a.id, name: a.name })), severityMap, outFile);
+        const baselinePath = saveBaseline(baseline, baseDir);
+        process.stderr.write(`✓ baseline saved → ${baselinePath}\n`);
+        if (diff) {
+            const recent = loadRecentBaselines(baseDir, applicationName, 2);
+            if (recent.length >= 2) {
+                const d = diffBaselines(recent[1], recent[0]);
+                process.stderr.write("\n" + formatDiff(d) + "\n");
+                if (d.hasRegressions)
+                    process.exit(1);
+            }
+            else {
+                process.stderr.write("  (no prior baseline to diff against — first run saved)\n");
+            }
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Diff command — compare two most-recent baselines for an application
+// ---------------------------------------------------------------------------
+async function cmdDiff(args) {
+    let appName;
+    let baseDir = process.cwd();
+    let exitCode = false;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--app" || a === "--application")
+            appName = args[++i];
+        else if (a === "--dir")
+            baseDir = args[++i] ?? baseDir;
+        else if (a === "--exit-code")
+            exitCode = true;
+        else if (!appName && a && !a.startsWith("--"))
+            appName = a;
+    }
+    if (!appName) {
+        process.stderr.write("canopy diff: --app <name> is required\n");
+        process.exit(1);
+    }
+    const recent = loadRecentBaselines(baseDir, appName, 2);
+    if (recent.length < 2) {
+        process.stderr.write(`canopy diff: fewer than 2 baselines found for '${appName}' in ${baseDir}/.canopy-history/\n` +
+            `  Run 'canopy assess --save' at least twice to build a diff history.\n`);
+        process.exit(0);
+    }
+    const d = diffBaselines(recent[1], recent[0]);
+    process.stdout.write(formatDiff(d) + "\n");
+    if (exitCode && d.hasRegressions)
+        process.exit(1);
+}
+// ---------------------------------------------------------------------------
+// Batch commands — fire-and-forget Bedrock batch submit + deferred fetch
+// ---------------------------------------------------------------------------
+async function cmdBatchSubmit(args) {
+    let provider = "anthropic";
+    let inputFile;
+    let handleFile = "canopy-batch-handle.json";
+    let model;
+    let s3Bucket;
+    let roleArn;
+    let region;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--provider") {
+            const v = args[++i];
+            if (v)
+                provider = v;
+        }
+        else if (a === "--input" || a === "-i")
+            inputFile = args[++i];
+        else if (a === "--handle")
+            handleFile = args[++i] ?? handleFile;
+        else if (a === "--model")
+            model = args[++i];
+        else if (a === "--s3-bucket")
+            s3Bucket = args[++i];
+        else if (a === "--role-arn")
+            roleArn = args[++i];
+        else if (a === "--region")
+            region = args[++i];
+        else
+            die(`unknown option: ${a}`);
+    }
+    if (!inputFile)
+        die("--input <file> is required");
+    if (provider !== "anthropic" && provider !== "bedrock")
+        die(`unknown provider "${provider}" — use "anthropic" or "bedrock"`);
+    if (provider === "bedrock" && (!s3Bucket || !roleArn))
+        die("--provider bedrock requires --s3-bucket and --role-arn");
+    if (!fs.existsSync(inputFile))
+        die(`input file not found: ${inputFile}`);
+    let input;
+    try {
+        input = JSON.parse(fs.readFileSync(inputFile, "utf8"));
+    }
+    catch {
+        die("input is not valid JSON");
+    }
+    if (!Array.isArray(input.agents) || input.agents.length === 0)
+        die("input must contain at least one agent in agents[]");
+    process.stderr.write(`canopy: building batch requests for ${input.agents.length} agent(s) via ${provider}...\n`);
+    let handle;
+    if (provider === "anthropic") {
+        handle = await submitAnthropicBatch({ agents: input.agents, config: { model } });
+        process.stderr.write(`\n✓ Anthropic batch submitted\n`);
+        process.stderr.write(`  Batch ID:  ${handle.batchId}\n`);
+    }
+    else {
+        handle = await submitBedrockBatch({ agents: input.agents, config: { s3Bucket: s3Bucket, roleArn: roleArn, region } });
+        process.stderr.write(`\n✓ Bedrock batch submitted\n`);
+        process.stderr.write(`  Job ARN:   ${handle.jobArn}\n`);
+    }
+    process.stderr.write(`  Submitted: ${handle.submittedAt}\n`);
+    process.stderr.write(`  Handle:    ${handleFile}\n\n`);
+    fs.writeFileSync(handleFile, JSON.stringify(handle, null, 2));
+    process.stderr.write(`When the job completes (minutes to hours), collect results:\n`);
+    process.stderr.write(`  canopy batch-fetch --handle ${handleFile} --input ${inputFile} --out threat-model.tc.json\n`);
+}
+async function cmdBatchFetch(args) {
+    let handleFile = "canopy-batch-handle.json";
+    let inputFile;
+    let outFile;
+    let diagram = false;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--handle")
+            handleFile = args[++i] ?? handleFile;
+        else if (a === "--input" || a === "-i")
+            inputFile = args[++i];
+        else if (a === "--out" || a === "-o")
+            outFile = args[++i];
+        else if (a === "--diagram")
+            diagram = true;
+        else
+            die(`unknown option: ${a}`);
+    }
+    if (!fs.existsSync(handleFile))
+        die(`handle file not found: ${handleFile}. Run 'canopy batch-submit' first.`);
+    let handle;
+    try {
+        handle = JSON.parse(fs.readFileSync(handleFile, "utf8"));
+    }
+    catch {
+        die(`${handleFile} is not valid JSON`);
+    }
+    if (!handle.provider)
+        die(`handle file is missing "provider" field — was it created by an older version of canopy?`);
+    let responses;
+    let errorCount;
+    if (handle.provider === "anthropic") {
+        const h = handle;
+        process.stderr.write(`canopy: checking Anthropic batch ${h.batchId}...\n`);
+        const result = await fetchAnthropicBatch({ handle: h });
+        if (!result.ready) {
+            process.stderr.write(`  Status: ${result.status}`);
+            if ("counts" in result && result.counts) {
+                process.stderr.write(` — ${result.counts.processing} processing, ${result.counts.succeeded} succeeded, ${result.counts.errored} errored`);
+            }
+            process.stderr.write(` — not yet complete. Re-run this command later.\n`);
+            process.exit(0);
+        }
+        responses = result.responses;
+        errorCount = result.errorCount;
+        if (errorCount > 0)
+            process.stderr.write(`  ⚠ ${errorCount} record(s) errored — degraded responses included.\n`);
+    }
+    else {
+        const h = handle;
+        process.stderr.write(`canopy: checking Bedrock job ${h.jobArn}...\n`);
+        const result = await fetchBedrockBatch({ handle: h });
+        if (!result.ready) {
+            process.stderr.write(`  Status: ${result.status} — not yet complete. Re-run this command later.\n`);
+            process.exit(0);
+        }
+        responses = result.responses;
+        errorCount = result.errorCount;
+        if (errorCount > 0)
+            process.stderr.write(`  ⚠ ${errorCount} record(s) returned errors from Bedrock — degraded responses included.\n`);
+    }
+    // Assemble threat model from batch responses
+    if (!inputFile)
+        die("--input <file> is required to assemble the threat model");
+    if (!fs.existsSync(inputFile))
+        die(`input file not found: ${inputFile}`);
+    let input;
+    try {
+        input = JSON.parse(fs.readFileSync(inputFile, "utf8"));
+    }
+    catch {
+        die("input is not valid JSON");
+    }
+    const { assembleTCFormat, severityKey } = await import("./output/tc-assembler.js");
+    const { loadAtlasData } = await import("./aivss/atlas/loader.js");
+    const { ATLAS_COVERAGE_MATRIX } = await import("./aivss/atlas/coverage-matrix.js");
+    const atlasData = loadAtlasData(resolveAtlasYaml());
+    const agents = input.agents;
+    const handoffs = input.handoffs ?? [];
+    const applicationName = input.applicationName;
+    // Build severity map from real batch responses (per-agent)
+    const severityBySubCategory = new Map();
+    const byAgentMetric = new Map();
+    for (const r of responses) {
+        if (r.agentId)
+            byAgentMetric.set(`${r.agentId}|${r.metricCode}`, r);
+    }
+    for (const agent of agents) {
+        for (const entry of ATLAS_COVERAGE_MATRIX) {
+            const response = byAgentMetric.get(`${agent.id}|${entry.metric}`);
+            const severity = response?.subCategoryScores?.[entry.subCategory] ?? "Medium";
+            severityBySubCategory.set(severityKey(agent.id, entry.metric, entry.subCategory), severity);
+        }
+    }
+    // Build filled slots from batch response threatSlots; fall back to structural stubs only when absent.
+    const { slotKey } = await import("./output/tc-assembler.js");
+    const filledSlots = new Map();
+    // Index threatSlots by (agentId, metricCode, subCategory) for O(1) lookup.
+    const slotIndex = new Map();
+    for (const r of responses) {
+        if (!r.threatSlots || !r.agentId)
+            continue;
+        for (const [subCat, slots] of Object.entries(r.threatSlots)) {
+            slotIndex.set(`${r.agentId}|${r.metricCode}|${subCat}`, slots);
+        }
+    }
+    for (const agent of agents) {
+        for (const entry of ATLAS_COVERAGE_MATRIX) {
+            const techniqueId = entry.atlasTechniqueIds[0];
+            if (!techniqueId)
+                continue;
+            const technique = atlasData.techniqueById.get(techniqueId);
+            if (!technique)
+                continue;
+            const severity = severityBySubCategory.get(severityKey(agent.id, entry.metric, entry.subCategory)) ?? "Medium";
+            const live = slotIndex.get(`${agent.id}|${entry.metric}|${entry.subCategory}`);
+            filledSlots.set(slotKey(agent.id, techniqueId, entry.metric, entry.subCategory), live ?? {
+                threatSource: "A threat actor",
+                prerequisites: `with access to ${agent.name}`,
+                threatAction: `exploit ${entry.subCategory.toLowerCase()} weaknesses via ${technique.id}`,
+                threatImpact: `${severity === "High" || severity === "Critical" ? "critically compromise" : "compromise"} ${agent.name}`,
+                impactedGoal: ["confidentiality", "integrity"],
+                impactedAssets: [agent.name.toLowerCase()],
+            });
+        }
+    }
+    const tcFormat = assembleTCFormat({
+        agents, handoffs, metricResponses: responses, atlasData,
+        coverageMatrix: ATLAS_COVERAGE_MATRIX, filledSlots, severityBySubCategory, applicationName,
+        // batch-fetch collects results from a provider batch job (Bedrock or
+        // Anthropic), so severities here are always model-inferred. The harness
+        // path is a separate command and stamps its own mode.
+        scoringMode: "model",
+    });
+    const { valid, errors } = validateTCOutput(tcFormat);
+    if (!valid) {
+        process.stderr.write(`\ncanopy: TC schema validation failed (${errors.length} error(s)):\n`);
+        for (const e of errors)
+            process.stderr.write(`  · ${e}\n`);
+        process.exit(1);
+    }
+    const tcJson = JSON.stringify(tcFormat, null, 2);
+    if (outFile) {
+        fs.mkdirSync(path.dirname(path.resolve(outFile)), { recursive: true });
+        fs.writeFileSync(outFile, tcJson);
+        process.stderr.write(`✓ ${(tcFormat.threats ?? []).length} threats · ${(tcFormat.mitigations ?? []).length} mitigations → ${outFile}\n`);
+    }
+    else {
+        process.stdout.write(tcJson + "\n");
+    }
+    if (diagram) {
+        const c4 = generateLikeC4({ agents, handoffs, applicationName });
+        const c4File = outFile
+            ? path.join(path.dirname(outFile), likec4Filename(applicationName))
+            : likec4Filename(applicationName);
+        fs.writeFileSync(c4File, c4);
+        process.stderr.write(`✓ architecture diagram → ${c4File}\n`);
+    }
+}
+// ---------------------------------------------------------------------------
+// A2A assess command
+// ---------------------------------------------------------------------------
+async function cmdA2AAssess(args) {
+    const urls = [];
+    let outFile;
+    let applicationName;
+    let maxDepth = 3;
+    let timeoutMs = 8000;
+    let diagram = false;
+    let noProvider = false;
+    let save = false;
+    let diff = false;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--url" || a === "-u") {
+            const v = args[++i];
+            if (v)
+                urls.push(v);
+        }
+        else if (a === "--out" || a === "-o")
+            outFile = args[++i];
+        else if (a === "--name")
+            applicationName = args[++i];
+        else if (a === "--depth")
+            maxDepth = parseInt(args[++i] ?? "3", 10);
+        else if (a === "--timeout")
+            timeoutMs = parseInt(args[++i] ?? "8000", 10);
+        else if (a === "--diagram")
+            diagram = true;
+        else if (a === "--deterministic")
+            noProvider = true;
+        else if (a === "--save")
+            save = true;
+        else if (a === "--diff") {
+            diff = true;
+            save = true;
+        }
+        else if (a && !a.startsWith("--"))
+            urls.push(a); // bare URL positional arg
+    }
+    if (urls.length === 0) {
+        process.stderr.write("canopy a2a-assess: at least one --url is required\n");
+        process.exit(1);
+    }
+    process.stderr.write(`Fetching Agent Cards from ${urls.length} URL(s), max depth ${maxDepth}…\n`);
+    const result = await walkA2AGraph({
+        urls,
+        maxDepth,
+        timeoutMs,
+        onCard: (url, card) => {
+            if (card)
+                process.stderr.write(`  ✓ ${card.name} (${url})\n`);
+            else
+                process.stderr.write(`  ✗ unreachable: ${url}\n`);
+        },
+    });
+    if (result.agents.length === 0) {
+        process.stderr.write("canopy a2a-assess: no agents discovered — check URLs and connectivity\n");
+        process.exit(1);
+    }
+    process.stderr.write(`Discovered ${result.agents.length} agent(s), ${result.handoffs.length} handoff(s), depth ${result.depth}\n`);
+    if (result.unreachable.length > 0) {
+        process.stderr.write(`Unreachable (skipped): ${result.unreachable.join(", ")}\n`);
+    }
+    const appName = applicationName ?? result.workflowName;
+    let tcFormat;
+    let severityMap = new Map();
+    const useMock = noProvider || !process.env.ANTHROPIC_API_KEY;
+    if (useMock) {
+        if (!noProvider) {
+            process.stderr.write("canopy: ANTHROPIC_API_KEY not set — scoring deterministically (heuristic scorer).\n" +
+                "        Set ANTHROPIC_API_KEY for live inference, or pass --deterministic to silence this.\n\n");
+        }
+        const { assembleTCFormat, severityKey, slotKey } = await import("./output/tc-assembler.js");
+        const { loadAtlasData } = await import("./aivss/atlas/loader.js");
+        const { ATLAS_COVERAGE_MATRIX } = await import("./aivss/atlas/coverage-matrix.js");
+        const { heuristicSeverity } = await import("./aivss/scoring/heuristic-scorer.js");
+        const atlasYaml = resolveAtlasYaml();
+        const atlasData = loadAtlasData(atlasYaml);
+        const filledSlots = new Map();
+        const severityBySubCategory = new Map();
+        for (const agent of result.agents) {
+            for (const entry of ATLAS_COVERAGE_MATRIX) {
+                severityBySubCategory.set(severityKey(agent.id, entry.metric, entry.subCategory), heuristicSeverity(agent, entry.metric, entry.subCategory));
+                const techniqueId = entry.atlasTechniqueIds[0];
+                if (!techniqueId)
+                    continue;
+                const technique = atlasData.techniqueById.get(techniqueId);
+                if (!technique)
+                    continue;
+                const severity = severityBySubCategory.get(severityKey(agent.id, entry.metric, entry.subCategory)) ?? "Medium";
+                filledSlots.set(slotKey(agent.id, techniqueId, entry.metric, entry.subCategory), {
+                    threatSource: "A threat actor",
+                    prerequisites: `with access to ${agent.name}`,
+                    threatAction: `exploit ${entry.subCategory.toLowerCase()} weaknesses via ${technique.id}`,
+                    threatImpact: `${severity === "High" ? "critically compromise" : "compromise"} ${agent.name}`,
+                    impactedGoal: ["confidentiality", "integrity"],
+                    impactedAssets: [agent.name.toLowerCase()],
+                });
+            }
+        }
+        tcFormat = assembleTCFormat({
+            agents: result.agents, handoffs: result.handoffs, metricResponses: [], atlasData,
+            coverageMatrix: ATLAS_COVERAGE_MATRIX, filledSlots, severityBySubCategory,
+            applicationName: appName,
+            scoringMode: "deterministic",
+        });
+        severityMap = severityBySubCategory;
+    }
+    else {
+        tcFormat = await assessWorkflow({
+            input: { type: "agents", agents: result.agents, handoffs: result.handoffs },
+            provider: { type: "anthropic" },
+            applicationName: appName,
+        });
+        for (const threat of tcFormat.threats ?? []) {
+            const agentId = threat.metadata?.find((m) => m.key === "custom:agent-id")?.value;
+            const metric = threat.metadata?.find((m) => m.key === "custom:aivss-metric")?.value;
+            const subCat = threat.metadata?.find((m) => m.key === "custom:aivss-sub-category")?.value;
+            const priority = threat.metadata?.find((m) => m.key === "Priority")?.value;
+            if (agentId && metric && subCat && priority) {
+                severityMap.set(`${agentId}|${metric}|${subCat}`, priority);
+            }
+        }
+    }
+    const { valid, errors } = validateTCOutput(tcFormat);
+    if (!valid) {
+        process.stderr.write(`\ncanopy: TC schema validation failed (${errors.length} error(s)):\n`);
+        for (const e of errors)
+            process.stderr.write(`  · ${e}\n`);
+        process.exit(1);
+    }
+    const tcJson = JSON.stringify(tcFormat, null, 2);
+    if (outFile) {
+        fs.mkdirSync(path.dirname(path.resolve(outFile)), { recursive: true });
+        fs.writeFileSync(outFile, tcJson);
+        process.stderr.write(`✓ ${(tcFormat.threats ?? []).length} threats · ${(tcFormat.mitigations ?? []).length} mitigations → ${outFile}\n`);
+    }
+    else {
+        process.stdout.write(tcJson + "\n");
+    }
+    if (diagram) {
+        const c4 = generateLikeC4({ agents: result.agents, handoffs: result.handoffs, applicationName: appName });
+        const c4File = outFile ? path.join(path.dirname(outFile), likec4Filename(appName)) : likec4Filename(appName);
+        fs.writeFileSync(c4File, c4);
+        process.stderr.write(`✓ architecture diagram → ${c4File}\n`);
+    }
+    if (save) {
+        const baseDir = outFile ? path.dirname(path.resolve(outFile)) : process.cwd();
+        const baseline = buildBaseline(appName, result.agents.map((a) => ({ id: a.id, name: a.name })), severityMap, outFile);
+        const baselinePath = saveBaseline(baseline, baseDir);
+        process.stderr.write(`✓ baseline saved → ${baselinePath}\n`);
+        if (diff) {
+            const recent = loadRecentBaselines(baseDir, appName, 2);
+            if (recent.length >= 2) {
+                const d = diffBaselines(recent[1], recent[0]);
+                process.stderr.write("\n" + formatDiff(d) + "\n");
+                if (d.hasRegressions)
+                    process.exit(1);
+            }
+            else {
+                process.stderr.write("  (no prior baseline — first run saved)\n");
+            }
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Demo command
+// ---------------------------------------------------------------------------
+async function cmdDemo(args) {
+    let port = "3000";
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--port" || args[i] === "-p")
+            port = args[++i] ?? "3000";
+    }
+    const demoDir = path.resolve(path.dirname(new URL(import.meta.url).pathname), "../demo");
+    if (!fs.existsSync(demoDir)) {
+        die(`demo directory not found at ${demoDir}. Is the package installed correctly?`);
+    }
+    process.stderr.write(`canopy demo serving at http://localhost:${port}\n`);
+    Bun.serve({
+        port: parseInt(port, 10),
+        async fetch(req) {
+            const url = new URL(req.url);
+            const filePath = path.join(demoDir, url.pathname === "/" ? "index.html" : url.pathname);
+            if (!fs.existsSync(filePath) || fs.statSync(filePath).isDirectory()) {
+                return new Response("Not found", { status: 404 });
+            }
+            const ext = path.extname(filePath);
+            const mime = {
+                ".html": "text/html", ".js": "text/javascript",
+                ".json": "application/json", ".css": "text/css",
+            };
+            return new Response(fs.readFileSync(filePath), {
+                headers: { "Content-Type": mime[ext] ?? "application/octet-stream" },
+            });
+        },
+    });
+    // Keep process alive
+    await new Promise(() => { });
+}
+// ---------------------------------------------------------------------------
+// Entry point
+// ---------------------------------------------------------------------------
+async function main() {
+    const [, , cmd, ...rest] = process.argv;
+    if (!cmd || cmd === "--help" || cmd === "-h" || cmd === "help") {
+        usage();
+        process.exit(0);
+    }
+    if (cmd === "schema") {
+        cmdSchema();
+    }
+    else if (cmd === "assess") {
+        await cmdAssess(rest);
+    }
+    else if (cmd === "batch-submit") {
+        await cmdBatchSubmit(rest);
+    }
+    else if (cmd === "batch-fetch") {
+        await cmdBatchFetch(rest);
+    }
+    else if (cmd === "demo") {
+        await cmdDemo(rest);
+    }
+    else if (cmd === "a2a-assess") {
+        await cmdA2AAssess(rest);
+    }
+    else if (cmd === "diff") {
+        await cmdDiff(rest);
+    }
+    else {
+        die(`unknown command: ${cmd}. Run 'canopy --help' for usage.`);
+    }
+}
+main().catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map