feat(import): add TM7 file import from Microsoft TMT

[exitzerolabs-admin]

Summary

• Add TM7 (Microsoft Threat Modeling Tool) XML import, converting .tm7 files to ThreatForge's native .thf YAML format
• Preserves elements, data flows, trust boundaries, threats, canvas positions, and STRIDE categories
• Full import flow: native menu → command palette → file dialog → Rust parser → canvas

What's Included

Rust Backend

• TM7 XML parser (src-tauri/src/importers/tm7.rs) — ~1000 lines of parser + 14 unit tests
  • Handles all TM7 element types: StencilRectangle (external entity), StencilEllipse (process), StencilParallelLines (data store), BorderBoundary, LineBoundary, Connector
  • STRIDE category mapping from UserThreatCategory with TypeId prefix fallback
  • Containment detection using actual TM7 element dimensions
  • Out-of-scope element exclusion, duplicate name handling, orphaned reference resilience
• Import command (import_commands.rs) — extensible format dispatch ("tm7" → parser)

Frontend

• FileAdapter.importThreatModel() — interface + Tauri/Browser implementations
• useFileOperations.importModel — dirty-state guard, error handling, layout setup, store clearing
• Native menu "Import…" item + command palette file:import command
• File path set to null after import (forces Save As to create .thf)

Tests (14 Rust, 1 Frontend)

• Minimal TM7, empty TM7, unique IDs, STRIDE categories, severity, mitigation status
• Out-of-scope exclusion, orphaned flow GUIDs, duplicate names, line boundaries
• Malformed XML error handling, self-loop flows, NeedsInvestigation mapping, unknown TypeId fallback
• Command registry wiring test

Docs Updated

• README.md — new "Import from Microsoft TMT" feature section, updated Contributing
• CONTRIBUTING.md — TM7 import marked as done
• architecture.md, overview.md, product-design.md — importers module documented
• releasing-a-version.md — TM7 import in smoke test checklist

Test plan

• cargo clippy — clean
• cargo fmt — clean
• cargo test — 73 tests pass (14 new)
• npx biome check — clean
• npx vitest --run — 417 tests pass (1 new)
• npm run ci:local — all checks pass
• Manual test: import a real .tm7 file from Microsoft TMT

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
threat-forge	Ready	Preview, Comment	Mar 7, 2026 2:35pm