mindforge-cc 11.8.2 → 11.9.0

package/.mindforge/dynamic-workflows/scripts/security-hardening.js

@@ -11,144 +11,142 @@ export const meta = {
   ],
 };
 
-export default async function run({ agent, parallel, pipeline, phase, log, args, budget }) {
-  const FINDING_SCHEMA = {
-    type: 'object',
-    properties: {
-      dimension: { type: 'string' },
-      findings: {
-        type: 'array',
-        items: {
-          type: 'object',
-          properties: {
-            cwe: { type: 'string' },
-            owasp: { type: 'string' },
-            severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'] },
-            title: { type: 'string' },
-            location: { type: 'string' },
-            description: { type: 'string' },
-            remediation: { type: 'string' },
-          },
-          required: ['severity', 'title', 'description', 'remediation'],
+const FINDING_SCHEMA = {
+  type: 'object',
+  properties: {
+    dimension: { type: 'string' },
+    findings: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          cwe: { type: 'string' },
+          owasp: { type: 'string' },
+          severity: { type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'] },
+          title: { type: 'string' },
+          location: { type: 'string' },
+          description: { type: 'string' },
+          remediation: { type: 'string' },
         },
+        required: ['severity', 'title', 'description', 'remediation'],
       },
     },
-    required: ['dimension', 'findings'],
-  };
+  },
+  required: ['dimension', 'findings'],
+};
 
-  const VERDICT_SCHEMA = {
-    type: 'object',
-    properties: { isReal: { type: 'boolean' }, cvssEstimate: { type: 'number' }, reason: { type: 'string' } },
-    required: ['isReal', 'reason'],
-  };
+const VERDICT_SCHEMA = {
+  type: 'object',
+  properties: { isReal: { type: 'boolean' }, cvssEstimate: { type: 'number' }, reason: { type: 'string' } },
+  required: ['isReal', 'reason'],
+};
 
-  const THREAT_SCHEMA = {
-    type: 'object',
-    properties: {
-      strideThreats: {
-        type: 'array',
-        items: {
-          type: 'object',
-          properties: {
-            stride: { type: 'string', enum: ['Spoofing', 'Tampering', 'Repudiation', 'InfoDisclosure', 'DoS', 'ElevationOfPrivilege'] },
-            threat: { type: 'string' },
-            likelihood: { type: 'string', enum: ['high', 'medium', 'low'] },
-            impact: { type: 'string', enum: ['high', 'medium', 'low'] },
-            mitigation: { type: 'string' },
-          },
-          required: ['stride', 'threat', 'likelihood', 'impact', 'mitigation'],
+const THREAT_SCHEMA = {
+  type: 'object',
+  properties: {
+    strideThreats: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          stride: { type: 'string', enum: ['Spoofing', 'Tampering', 'Repudiation', 'InfoDisclosure', 'DoS', 'ElevationOfPrivilege'] },
+          threat: { type: 'string' },
+          likelihood: { type: 'string', enum: ['high', 'medium', 'low'] },
+          impact: { type: 'string', enum: ['high', 'medium', 'low'] },
+          mitigation: { type: 'string' },
         },
+        required: ['stride', 'threat', 'likelihood', 'impact', 'mitigation'],
       },
     },
-    required: ['strideThreats'],
-  };
+  },
+  required: ['strideThreats'],
+};
 
-  const ROADMAP_SCHEMA = {
-    type: 'object',
-    properties: {
-      summary: { type: 'string' },
-      overallRisk: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
-      immediateActions: { type: 'array', items: { type: 'string' } },
-      roadmap: {
-        type: 'array',
-        items: {
-          type: 'object',
-          properties: {
-            sprint: { type: 'number' },
-            items: { type: 'array', items: { type: 'string' } },
-            riskReduction: { type: 'string' },
-          },
-          required: ['sprint', 'items', 'riskReduction'],
+const ROADMAP_SCHEMA = {
+  type: 'object',
+  properties: {
+    summary: { type: 'string' },
+    overallRisk: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
+    immediateActions: { type: 'array', items: { type: 'string' } },
+    roadmap: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          sprint: { type: 'number' },
+          items: { type: 'array', items: { type: 'string' } },
+          riskReduction: { type: 'string' },
         },
+        required: ['sprint', 'items', 'riskReduction'],
       },
     },
-    required: ['summary', 'overallRisk', 'immediateActions', 'roadmap'],
-  };
+  },
+  required: ['summary', 'overallRisk', 'immediateActions', 'roadmap'],
+};
 
-  const target = args || 'current codebase (run from repo root)';
+const target = args || 'current codebase (run from repo root)';
 
-  phase('Scope');
-  log(`Security hardening target: ${target}`);
+phase('Scope');
+log(`Security hardening target: ${target}`);
 
-  const SCOUTS = [
-    { label: 'injection', prompt: `Scout for injection vulnerabilities in: "${target}". Cover: SQL injection, command injection, LDAP injection, XSS (stored/reflected/DOM), SSTI, XXE, path traversal (CWE-89, CWE-78, CWE-79, CWE-611, CWE-22). For each finding provide CWE ID, OWASP category, exact file/line if possible, and remediation.` },
-    { label: 'auth-access', prompt: `Scout for authentication and access control issues in: "${target}". Cover: broken authentication, missing auth checks, JWT flaws, session fixation, privilege escalation, IDOR, missing rate limits (OWASP A01, A07). Include CWE IDs and remediation.` },
-    { label: 'crypto-secrets', prompt: `Scout for cryptographic failures and secret exposure in: "${target}". Cover: hardcoded secrets, weak hashing (MD5/SHA1 for passwords), insecure random, unencrypted PII in transit/at-rest, certificate validation bypass (CWE-327, CWE-798, CWE-330). Include CWE IDs and remediation.` },
-    { label: 'config-supply', prompt: `Scout for security misconfiguration and supply chain risks in: "${target}". Cover: debug endpoints exposed, CORS misconfig, CSP missing, dependency vulns, unpinned deps, outdated packages with CVEs (OWASP A05, A06). Include CWE IDs and remediation.` },
-    { label: 'logging-monitoring', prompt: `Scout for logging, monitoring, and error handling security gaps in: "${target}". Cover: sensitive data in logs, missing audit trails, verbose error messages leaking internals, missing security event logging, SSRF via fetch/request (OWASP A09, A10, CWE-209). Include CWE IDs and remediation.` },
-  ];
+const SCOUTS = [
+  { label: 'injection', prompt: `Scout for injection vulnerabilities in: "${target}". Cover: SQL injection, command injection, LDAP injection, XSS (stored/reflected/DOM), SSTI, XXE, path traversal (CWE-89, CWE-78, CWE-79, CWE-611, CWE-22). For each finding provide CWE ID, OWASP category, exact file/line if possible, and remediation.` },
+  { label: 'auth-access', prompt: `Scout for authentication and access control issues in: "${target}". Cover: broken authentication, missing auth checks, JWT flaws, session fixation, privilege escalation, IDOR, missing rate limits (OWASP A01, A07). Include CWE IDs and remediation.` },
+  { label: 'crypto-secrets', prompt: `Scout for cryptographic failures and secret exposure in: "${target}". Cover: hardcoded secrets, weak hashing (MD5/SHA1 for passwords), insecure random, unencrypted PII in transit/at-rest, certificate validation bypass (CWE-327, CWE-798, CWE-330). Include CWE IDs and remediation.` },
+  { label: 'config-supply', prompt: `Scout for security misconfiguration and supply chain risks in: "${target}". Cover: debug endpoints exposed, CORS misconfig, CSP missing, dependency vulns, unpinned deps, outdated packages with CVEs (OWASP A05, A06). Include CWE IDs and remediation.` },
+  { label: 'logging-monitoring', prompt: `Scout for logging, monitoring, and error handling security gaps in: "${target}". Cover: sensitive data in logs, missing audit trails, verbose error messages leaking internals, missing security event logging, SSRF via fetch/request (OWASP A09, A10, CWE-209). Include CWE IDs and remediation.` },
+];
 
-  phase('Scout');
-  const scouts = await parallel(
-    SCOUTS.map(s => () => agent(s.prompt, { schema: FINDING_SCHEMA, label: `scout:${s.label}`, phase: 'Scout' }))
-  );
+phase('Scout');
+const scouts = await parallel(
+  SCOUTS.map(s => () => agent(s.prompt, { schema: FINDING_SCHEMA, label: `scout:${s.label}`, phase: 'Scout' }))
+);
 
-  phase('Verify');
-  const allFindings = scouts.filter(Boolean).flatMap(s => (s.findings || []).map(f => ({ ...f, dimension: s.dimension })));
-  const criticalAndHigh = allFindings.filter(f => f.severity === 'critical' || f.severity === 'high');
-  log(`${allFindings.length} total findings, ${criticalAndHigh.length} critical/high → 3-vote adversarial verify`);
+phase('Verify');
+const allFindings = scouts.filter(Boolean).flatMap(s => (s.findings || []).map(f => ({ ...f, dimension: s.dimension })));
+const criticalAndHigh = allFindings.filter(f => f.severity === 'critical' || f.severity === 'high');
+log(`${allFindings.length} total findings, ${criticalAndHigh.length} critical/high → 3-vote adversarial verify`);
 
-  const verified = await parallel(
-    criticalAndHigh.map(f => () =>
-      parallel([
-        () => agent(`Try to REFUTE this security finding — is it a false positive? Finding: [${f.severity.toUpperCase()}] ${f.title} — ${f.description}. Default refuted=false only if clearly real.`, { schema: VERDICT_SCHEMA, label: `v1:${f.title.slice(0, 25)}`, phase: 'Verify' }),
-        () => agent(`Challenge this finding from an attacker's perspective — is it actually exploitable? Finding: [${f.severity.toUpperCase()}] ${f.title} — ${f.description}. Rate exploitability.`, { schema: VERDICT_SCHEMA, label: `v2:${f.title.slice(0, 25)}`, phase: 'Verify' }),
-        () => agent(`Assess business impact of this finding being exploited. Is the severity rating accurate? Finding: [${f.severity.toUpperCase()}] ${f.title} — ${f.description}.`, { schema: VERDICT_SCHEMA, label: `v3:${f.title.slice(0, 25)}`, phase: 'Verify' }),
-      ]).then(votes => {
-        if (!votes) return { ...f, confirmed: false };
-        const realVotes = votes.filter(Boolean).filter(v => v.isReal).length;
-        return { ...f, confirmed: realVotes >= 2 };
-      })
-    )
-  );
+const verified = await parallel(
+  criticalAndHigh.map(f => () =>
+    parallel([
+      () => agent(`Try to REFUTE this security finding — is it a false positive? Finding: [${f.severity.toUpperCase()}] ${f.title} — ${f.description}. Default refuted=false only if clearly real.`, { schema: VERDICT_SCHEMA, label: `v1:${f.title.slice(0, 25)}`, phase: 'Verify' }),
+      () => agent(`Challenge this finding from an attacker's perspective — is it actually exploitable? Finding: [${f.severity.toUpperCase()}] ${f.title} — ${f.description}. Rate exploitability.`, { schema: VERDICT_SCHEMA, label: `v2:${f.title.slice(0, 25)}`, phase: 'Verify' }),
+      () => agent(`Assess business impact of this finding being exploited. Is the severity rating accurate? Finding: [${f.severity.toUpperCase()}] ${f.title} — ${f.description}.`, { schema: VERDICT_SCHEMA, label: `v3:${f.title.slice(0, 25)}`, phase: 'Verify' }),
+    ]).then(votes => {
+      if (!votes) return { ...f, confirmed: false };
+      const realVotes = votes.filter(Boolean).filter(v => v.isReal).length;
+      return { ...f, confirmed: realVotes >= 2 };
+    })
+  )
+);
 
-  const confirmedHigh = verified.filter(Boolean).filter(f => f.confirmed);
-  const lowerSeverity = allFindings.filter(f => f.severity !== 'critical' && f.severity !== 'high');
-  const allConfirmed = [...confirmedHigh, ...lowerSeverity];
-  log(`${confirmedHigh.length}/${criticalAndHigh.length} critical/high confirmed after 3-vote verification`);
+const confirmedHigh = verified.filter(Boolean).filter(f => f.confirmed);
+const lowerSeverity = allFindings.filter(f => f.severity !== 'critical' && f.severity !== 'high');
+const allConfirmed = [...confirmedHigh, ...lowerSeverity];
+log(`${confirmedHigh.length}/${criticalAndHigh.length} critical/high confirmed after 3-vote verification`);
 
-  phase('ThreatModel');
-  const findingSummary = allConfirmed.slice(0, 15).map(f => `[${f.severity}] ${f.title}: ${f.description}`).join('\n');
-  const threatModel = await agent(
-    `Generate a STRIDE threat model for: "${target}"\n\nBased on these confirmed findings:\n${findingSummary}\n\nFor each STRIDE category (Spoofing, Tampering, Repudiation, InfoDisclosure, DoS, ElevationOfPrivilege) identify the top threat, likelihood, impact, and mitigation.`,
-    { schema: THREAT_SCHEMA, label: 'threat-model', phase: 'ThreatModel' }
-  );
-  if (!threatModel) { log('Warning: agent returned null for threatModel, skipping'); return { target, error: 'agent-null' }; }
+phase('ThreatModel');
+const findingSummary = allConfirmed.slice(0, 15).map(f => `[${f.severity}] ${f.title}: ${f.description}`).join('\n');
+const threatModel = await agent(
+  `Generate a STRIDE threat model for: "${target}"\n\nBased on these confirmed findings:\n${findingSummary}\n\nFor each STRIDE category (Spoofing, Tampering, Repudiation, InfoDisclosure, DoS, ElevationOfPrivilege) identify the top threat, likelihood, impact, and mitigation.`,
+  { schema: THREAT_SCHEMA, label: 'threat-model', phase: 'ThreatModel' }
+);
+if (!threatModel) { log('Warning: agent returned null for threatModel, skipping'); return { target, error: 'agent-null' }; }
 
-  phase('Roadmap');
-  const threatSummary = (threatModel.strideThreats || []).map(t => `[${t.stride}] ${t.threat} (${t.likelihood} likelihood, ${t.impact} impact) → ${t.mitigation}`).join('\n');
-  const roadmap = await agent(
-    `Create a prioritized security remediation roadmap for: "${target}"\n\nConfirmed findings (${allConfirmed.length} total):\n${findingSummary}\n\nSTRIDE threats:\n${threatSummary}\n\nGroup into 3 sprints by severity+effort. Sprint 1 = immediate (critical/high, low effort). Sprint 2 = short-term (high, higher effort + medium). Sprint 3 = long-term (medium/low). Include risk reduction estimate per sprint.`,
-    { schema: ROADMAP_SCHEMA, label: 'roadmap', phase: 'Roadmap' }
-  );
-  if (!roadmap) { return { target, threats: threatModel, error: 'roadmap-agent-null', stats: { total: allFindings.length, criticalHigh: criticalAndHigh.length, confirmed: confirmedHigh.length } }; }
+phase('Roadmap');
+const threatSummary = (threatModel.strideThreats || []).map(t => `[${t.stride}] ${t.threat} (${t.likelihood} likelihood, ${t.impact} impact) → ${t.mitigation}`).join('\n');
+const roadmap = await agent(
+  `Create a prioritized security remediation roadmap for: "${target}"\n\nConfirmed findings (${allConfirmed.length} total):\n${findingSummary}\n\nSTRIDE threats:\n${threatSummary}\n\nGroup into 3 sprints by severity+effort. Sprint 1 = immediate (critical/high, low effort). Sprint 2 = short-term (high, higher effort + medium). Sprint 3 = long-term (medium/low). Include risk reduction estimate per sprint.`,
+  { schema: ROADMAP_SCHEMA, label: 'roadmap', phase: 'Roadmap' }
+);
+if (!roadmap) { return { target, threats: threatModel, error: 'roadmap-agent-null', stats: { total: allFindings.length, criticalHigh: criticalAndHigh.length, confirmed: confirmedHigh.length } }; }
 
-  return {
-    target,
-    threats: threatModel,
-    report: {
-      ...roadmap,
-      stats: { total: allFindings.length, criticalHigh: criticalAndHigh.length, confirmed: confirmedHigh.length, lower: lowerSeverity.length },
-    },
-  };
-}
+return {
+  target,
+  threats: threatModel,
+  report: {
+    ...roadmap,
+    stats: { total: allFindings.length, criticalHigh: criticalAndHigh.length, confirmed: confirmedHigh.length, lower: lowerSeverity.length },
+  },
+};

package/.mindforge/dynamic-workflows/scripts/security-threat-model.js

@@ -10,150 +10,148 @@ export const meta = {
   ],
 };
 
-export default async function run({ agent, parallel, pipeline, phase, log, args, budget }) {
-  const ASSETS_SCHEMA = {
-    type: 'object',
-    properties: {
-      assets: {
-        type: 'array',
-        items: {
-          type: 'object',
-          properties: {
-            name: { type: 'string' },
-            type: { type: 'string', enum: ['data', 'service', 'credential', 'infrastructure', 'user'] },
-            sensitivity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
-            description: { type: 'string' },
-          },
-          required: ['name', 'type', 'sensitivity'],
+const ASSETS_SCHEMA = {
+  type: 'object',
+  properties: {
+    assets: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          name: { type: 'string' },
+          type: { type: 'string', enum: ['data', 'service', 'credential', 'infrastructure', 'user'] },
+          sensitivity: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
+          description: { type: 'string' },
         },
+        required: ['name', 'type', 'sensitivity'],
       },
-      dataFlows: { type: 'array', items: { type: 'string' } },
-      trustBoundaries: { type: 'array', items: { type: 'string' } },
-      entryPoints: { type: 'array', items: { type: 'string' } },
     },
-    required: ['assets', 'dataFlows', 'trustBoundaries', 'entryPoints'],
-  };
+    dataFlows: { type: 'array', items: { type: 'string' } },
+    trustBoundaries: { type: 'array', items: { type: 'string' } },
+    entryPoints: { type: 'array', items: { type: 'string' } },
+  },
+  required: ['assets', 'dataFlows', 'trustBoundaries', 'entryPoints'],
+};
 
-  const STRIDE_SCHEMA = {
-    type: 'object',
-    properties: {
-      category: { type: 'string', enum: ['Spoofing', 'Tampering', 'Repudiation', 'InformationDisclosure', 'DenialOfService', 'ElevationOfPrivilege'] },
-      threats: {
-        type: 'array',
-        items: {
-          type: 'object',
-          properties: {
-            threatId: { type: 'string' },
-            title: { type: 'string' },
-            affectedAsset: { type: 'string' },
-            attackVector: { type: 'string' },
-            likelihood: { type: 'string', enum: ['high', 'medium', 'low'] },
-            impact: { type: 'string', enum: ['high', 'medium', 'low'] },
-            description: { type: 'string' },
-          },
-          required: ['threatId', 'title', 'affectedAsset', 'likelihood', 'impact', 'description'],
+const STRIDE_SCHEMA = {
+  type: 'object',
+  properties: {
+    category: { type: 'string', enum: ['Spoofing', 'Tampering', 'Repudiation', 'InformationDisclosure', 'DenialOfService', 'ElevationOfPrivilege'] },
+    threats: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          threatId: { type: 'string' },
+          title: { type: 'string' },
+          affectedAsset: { type: 'string' },
+          attackVector: { type: 'string' },
+          likelihood: { type: 'string', enum: ['high', 'medium', 'low'] },
+          impact: { type: 'string', enum: ['high', 'medium', 'low'] },
+          description: { type: 'string' },
         },
+        required: ['threatId', 'title', 'affectedAsset', 'likelihood', 'impact', 'description'],
       },
     },
-    required: ['category', 'threats'],
-  };
+  },
+  required: ['category', 'threats'],
+};
 
-  const MITIGATION_SCHEMA = {
-    type: 'object',
-    properties: {
-      threatId: { type: 'string' },
-      controls: {
-        type: 'array',
-        items: {
-          type: 'object',
-          properties: {
-            control: { type: 'string' },
-            type: { type: 'string', enum: ['preventive', 'detective', 'corrective'] },
-            implementation: { type: 'string' },
-            effort: { type: 'string', enum: ['low', 'medium', 'high'] },
-          },
-          required: ['control', 'type', 'implementation', 'effort'],
+const MITIGATION_SCHEMA = {
+  type: 'object',
+  properties: {
+    threatId: { type: 'string' },
+    controls: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          control: { type: 'string' },
+          type: { type: 'string', enum: ['preventive', 'detective', 'corrective'] },
+          implementation: { type: 'string' },
+          effort: { type: 'string', enum: ['low', 'medium', 'high'] },
         },
+        required: ['control', 'type', 'implementation', 'effort'],
       },
-      residualRisk: { type: 'string', enum: ['high', 'medium', 'low', 'accepted'] },
     },
-    required: ['threatId', 'controls', 'residualRisk'],
-  };
+    residualRisk: { type: 'string', enum: ['high', 'medium', 'low', 'accepted'] },
+  },
+  required: ['threatId', 'controls', 'residualRisk'],
+};
 
-  const SCORE_SCHEMA = {
-    type: 'object',
-    properties: {
-      summary: { type: 'string' },
-      overallRiskLevel: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
-      scoreMatrix: {
-        type: 'array',
-        items: {
-          type: 'object',
-          properties: {
-            threatId: { type: 'string' },
-            title: { type: 'string' },
-            category: { type: 'string' },
-            cvssEstimate: { type: 'number' },
-            priority: { type: 'string', enum: ['p0', 'p1', 'p2', 'p3'] },
-            mitigationStatus: { type: 'string', enum: ['mitigated', 'partial', 'unmitigated'] },
-          },
-          required: ['threatId', 'title', 'category', 'cvssEstimate', 'priority'],
+const SCORE_SCHEMA = {
+  type: 'object',
+  properties: {
+    summary: { type: 'string' },
+    overallRiskLevel: { type: 'string', enum: ['critical', 'high', 'medium', 'low'] },
+    scoreMatrix: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          threatId: { type: 'string' },
+          title: { type: 'string' },
+          category: { type: 'string' },
+          cvssEstimate: { type: 'number' },
+          priority: { type: 'string', enum: ['p0', 'p1', 'p2', 'p3'] },
+          mitigationStatus: { type: 'string', enum: ['mitigated', 'partial', 'unmitigated'] },
         },
+        required: ['threatId', 'title', 'category', 'cvssEstimate', 'priority'],
       },
-      topRisks: { type: 'array', items: { type: 'string' } },
     },
-    required: ['summary', 'overallRiskLevel', 'scoreMatrix', 'topRisks'],
-  };
+    topRisks: { type: 'array', items: { type: 'string' } },
+  },
+  required: ['summary', 'overallRiskLevel', 'scoreMatrix', 'topRisks'],
+};
 
-  const target = args || 'current system (run from repo root or describe the system in args)';
+const target = args || 'current system (run from repo root or describe the system in args)';
 
-  phase('Assets');
-  log(`Threat modeling target: ${target}`);
-  const assetModel = await agent(
-    `Inventory the security-relevant assets, data flows, and trust boundaries for: "${target}". Identify: (1) assets (data stores, services, credentials, infrastructure) with sensitivity level, (2) data flows between components, (3) trust boundaries (where data crosses privilege levels), (4) entry points (public APIs, user inputs, external integrations).`,
-    { schema: ASSETS_SCHEMA, label: 'assets' }
-  );
-  if (!assetModel) { return { target, error: 'assetModel-agent-null' }; }
-  log(`${assetModel.assets.length} assets, ${assetModel.trustBoundaries.length} trust boundaries, ${assetModel.entryPoints.length} entry points`);
+phase('Assets');
+log(`Threat modeling target: ${target}`);
+const assetModel = await agent(
+  `Inventory the security-relevant assets, data flows, and trust boundaries for: "${target}". Identify: (1) assets (data stores, services, credentials, infrastructure) with sensitivity level, (2) data flows between components, (3) trust boundaries (where data crosses privilege levels), (4) entry points (public APIs, user inputs, external integrations).`,
+  { schema: ASSETS_SCHEMA, label: 'assets' }
+);
+if (!assetModel) { return { target, error: 'assetModel-agent-null' }; }
+log(`${assetModel.assets.length} assets, ${assetModel.trustBoundaries.length} trust boundaries, ${assetModel.entryPoints.length} entry points`);
 
-  const assetContext = `Assets: ${assetModel.assets.slice(0, 5).map(a => `${a.name}(${a.sensitivity})`).join(', ')}\nData flows: ${assetModel.dataFlows.slice(0, 3).join(', ')}\nTrust boundaries: ${assetModel.trustBoundaries.slice(0, 3).join(', ')}\nEntry points: ${assetModel.entryPoints.slice(0, 3).join(', ')}`;
+const assetContext = `Assets: ${assetModel.assets.slice(0, 5).map(a => `${a.name}(${a.sensitivity})`).join(', ')}\nData flows: ${assetModel.dataFlows.slice(0, 3).join(', ')}\nTrust boundaries: ${assetModel.trustBoundaries.slice(0, 3).join(', ')}\nEntry points: ${assetModel.entryPoints.slice(0, 3).join(', ')}`;
 
-  phase('STRIDE');
-  const STRIDE_CATEGORIES = [
-    { cat: 'Spoofing', prompt: `Identify SPOOFING threats for: "${target}". ${assetContext}. Spoofing = an attacker pretends to be someone/something they're not. Look for: weak authentication, missing identity verification, forged tokens/sessions, impersonation attacks. Assign each threat a unique ID (S-01, S-02...), affected asset, likelihood, and impact.` },
-    { cat: 'Tampering', prompt: `Identify TAMPERING threats for: "${target}". ${assetContext}. Tampering = malicious modification of data. Look for: insufficient authorization on write operations, missing integrity checks, SQL/command injection, insecure deserialization, CSRF. Assign IDs (T-01...), affected asset, likelihood, impact.` },
-    { cat: 'Repudiation', prompt: `Identify REPUDIATION threats for: "${target}". ${assetContext}. Repudiation = ability to deny performing an action. Look for: missing audit logs, insufficient logging of sensitive operations, lack of digital signatures, no non-repudiation controls. Assign IDs (R-01...).` },
-    { cat: 'InformationDisclosure', prompt: `Identify INFORMATION DISCLOSURE threats for: "${target}". ${assetContext}. Info disclosure = exposure of data to unauthorized parties. Look for: verbose error messages, debug endpoints, insecure data storage, missing encryption at rest/transit, over-permissive APIs, PII exposure. Assign IDs (I-01...).` },
-    { cat: 'DenialOfService', prompt: `Identify DENIAL OF SERVICE threats for: "${target}". ${assetContext}. DoS = making resources unavailable. Look for: missing rate limits, resource exhaustion endpoints, expensive unbounded queries, large payload acceptance without limits, connection pool exhaustion. Assign IDs (D-01...).` },
-    { cat: 'ElevationOfPrivilege', prompt: `Identify ELEVATION OF PRIVILEGE threats for: "${target}". ${assetContext}. EoP = gaining unauthorized capabilities. Look for: broken access control, IDOR, privilege escalation paths, JWT/token manipulation, missing authorization checks on admin functions. Assign IDs (E-01...).` },
-  ];
+phase('STRIDE');
+const STRIDE_CATEGORIES = [
+  { cat: 'Spoofing', prompt: `Identify SPOOFING threats for: "${target}". ${assetContext}. Spoofing = an attacker pretends to be someone/something they're not. Look for: weak authentication, missing identity verification, forged tokens/sessions, impersonation attacks. Assign each threat a unique ID (S-01, S-02...), affected asset, likelihood, and impact.` },
+  { cat: 'Tampering', prompt: `Identify TAMPERING threats for: "${target}". ${assetContext}. Tampering = malicious modification of data. Look for: insufficient authorization on write operations, missing integrity checks, SQL/command injection, insecure deserialization, CSRF. Assign IDs (T-01...), affected asset, likelihood, impact.` },
+  { cat: 'Repudiation', prompt: `Identify REPUDIATION threats for: "${target}". ${assetContext}. Repudiation = ability to deny performing an action. Look for: missing audit logs, insufficient logging of sensitive operations, lack of digital signatures, no non-repudiation controls. Assign IDs (R-01...).` },
+  { cat: 'InformationDisclosure', prompt: `Identify INFORMATION DISCLOSURE threats for: "${target}". ${assetContext}. Info disclosure = exposure of data to unauthorized parties. Look for: verbose error messages, debug endpoints, insecure data storage, missing encryption at rest/transit, over-permissive APIs, PII exposure. Assign IDs (I-01...).` },
+  { cat: 'DenialOfService', prompt: `Identify DENIAL OF SERVICE threats for: "${target}". ${assetContext}. DoS = making resources unavailable. Look for: missing rate limits, resource exhaustion endpoints, expensive unbounded queries, large payload acceptance without limits, connection pool exhaustion. Assign IDs (D-01...).` },
+  { cat: 'ElevationOfPrivilege', prompt: `Identify ELEVATION OF PRIVILEGE threats for: "${target}". ${assetContext}. EoP = gaining unauthorized capabilities. Look for: broken access control, IDOR, privilege escalation paths, JWT/token manipulation, missing authorization checks on admin functions. Assign IDs (E-01...).` },
+];
 
-  const strideResults = await parallel(
-    STRIDE_CATEGORIES.map(s => () => agent(s.prompt, { schema: STRIDE_SCHEMA, label: `stride:${s.cat.toLowerCase()}`, phase: 'STRIDE' }))
-  );
+const strideResults = await parallel(
+  STRIDE_CATEGORIES.map(s => () => agent(s.prompt, { schema: STRIDE_SCHEMA, label: `stride:${s.cat.toLowerCase()}`, phase: 'STRIDE' }))
+);
 
-  const allThreats = strideResults.filter(Boolean).flatMap(s => s.threats.map(t => ({ category: s.category, ...t })));
-  log(`${allThreats.length} threats identified across 6 STRIDE categories`);
+const allThreats = strideResults.filter(Boolean).flatMap(s => s.threats.map(t => ({ category: s.category, ...t })));
+log(`${allThreats.length} threats identified across 6 STRIDE categories`);
 
-  phase('Mitigate');
-  const highPriorityThreats = allThreats.filter(t => t.likelihood === 'high' || t.impact === 'high').slice(0, 12);
-  log(`Generating mitigations for ${highPriorityThreats.length} high-priority threats`);
+phase('Mitigate');
+const highPriorityThreats = allThreats.filter(t => t.likelihood === 'high' || t.impact === 'high').slice(0, 12);
+log(`Generating mitigations for ${highPriorityThreats.length} high-priority threats`);
 
-  const mitigations = await parallel(
-    highPriorityThreats.map(t => () => agent(
-      `Design mitigations for this threat in: "${target}"\n\nThreat ${t.threatId} [${t.category}]: ${t.title}\nDescription: ${t.description}\nAffected asset: ${t.affectedAsset}\nLikelihood: ${t.likelihood}, Impact: ${t.impact}\n\nProvide 2-3 security controls: preventive (stop it), detective (detect it), or corrective (respond to it). Include specific implementation steps and effort estimate. Rate residual risk after controls.`,
-      { schema: MITIGATION_SCHEMA, label: `mitigate:${t.threatId}`, phase: 'Mitigate' }
-    ))
-  );
+const mitigations = await parallel(
+  highPriorityThreats.map(t => () => agent(
+    `Design mitigations for this threat in: "${target}"\n\nThreat ${t.threatId} [${t.category}]: ${t.title}\nDescription: ${t.description}\nAffected asset: ${t.affectedAsset}\nLikelihood: ${t.likelihood}, Impact: ${t.impact}\n\nProvide 2-3 security controls: preventive (stop it), detective (detect it), or corrective (respond to it). Include specific implementation steps and effort estimate. Rate residual risk after controls.`,
+    { schema: MITIGATION_SCHEMA, label: `mitigate:${t.threatId}`, phase: 'Mitigate' }
+  ))
+);
 
-  phase('Score');
-  const threatContext = allThreats.slice(0, 15).map(t => `${t.threatId} [${t.category}/${t.likelihood}/${t.impact}]: ${t.title}`).join('\n');
-  const mitigationContext = mitigations.filter(Boolean).map(m => `${m.threatId}: ${m.controls.length} controls, residual=${m.residualRisk}`).join('\n');
+phase('Score');
+const threatContext = allThreats.slice(0, 15).map(t => `${t.threatId} [${t.category}/${t.likelihood}/${t.impact}]: ${t.title}`).join('\n');
+const mitigationContext = mitigations.filter(Boolean).map(m => `${m.threatId}: ${m.controls.length} controls, residual=${m.residualRisk}`).join('\n');
 
-  const scoreMatrix = await agent(
-    `Create a CVSS-style risk score matrix for: "${target}"\n\nThreats:\n${threatContext}\n\nMitigations:\n${mitigationContext}\n\nFor each threat estimate a CVSS base score (0.0-10.0) based on likelihood×impact. Assign priority (P0=CVSS≥9, P1=7-8.9, P2=4-6.9, P3=<4). Determine overall risk level and list top 5 risks to address immediately.`,
-    { schema: SCORE_SCHEMA, label: 'score-matrix' }
-  );
+const scoreMatrix = await agent(
+  `Create a CVSS-style risk score matrix for: "${target}"\n\nThreats:\n${threatContext}\n\nMitigations:\n${mitigationContext}\n\nFor each threat estimate a CVSS base score (0.0-10.0) based on likelihood×impact. Assign priority (P0=CVSS≥9, P1=7-8.9, P2=4-6.9, P3=<4). Determine overall risk level and list top 5 risks to address immediately.`,
+  { schema: SCORE_SCHEMA, label: 'score-matrix' }
+);
 
-  return { target, assetModel, threats: allThreats, mitigations: mitigations.filter(Boolean), scoreMatrix };
-}
+return { target, assetModel, threats: allThreats, mitigations: mitigations.filter(Boolean), scoreMatrix };