Enhance threat inference with business context

[melonattacker]

This pull request introduces first-class support for injecting business context documents into the threat modeling prompt, both in the CLI and API. It enables users to provide PDF, Markdown, or text files containing business context (such as scope, actors, assets, and assumptions), which are injected as full text into the prompt for more domain-specific threat analysis. The changes also add a --prompt-token-limit option to control prompt size and ensure the LLM input does not exceed token budgets. Documentation is updated to clarify the distinction between required business context (--context) and optional reference retrieval (--rag).

Business Context Injection Support:

• Added a new --context CLI flag and corresponding API support to inject business context documents (PDF, Markdown, or text) into the threat prompt, ensuring the LLM considers domain-specific information for threat analysis. (src/threat_thinker/main.py, src/threat_thinker/context_loader.py, docs/cli.md, docs/rag.md, docs/serve_config.md) [1] [2] [3] [4] [5] [6] [7] [8] [9]

• Introduced the ContextDocument dataclass and supporting functions to load, validate, and format business context documents, including PDF extraction and token counting. (src/threat_thinker/context_loader.py)

Prompt Token Limit Enforcement:

• Added a --prompt-token-limit CLI argument and corresponding validation logic to fail early if the assembled prompt (including graph, context, RAG, and instructions) exceeds the specified token budget. Default limits are set per LLM provider. (src/threat_thinker/main.py, src/threat_thinker/llm/inference.py) [1] [2] [3] [4] [5] [6] [7] [8]

Threat Analysis Improvements:

• Updated LLM instructions to explicitly require use of provided business context for identifying domain-specific threats, and to ensure a significant portion of threats are not generic. (src/threat_thinker/constants.py) [1] [2]

Documentation Updates:

• Clarified in documentation the difference between --context (for always-included business context) and --rag (for optional, retrieved references), with usage examples and API schema updates. (docs/cli.md, docs/rag.md, docs/serve_config.md) [1] [2] [3] [4]

User Experience and Progress Tracking:

• Improved CLI progress tracking to reflect the additional context loading step when business context documents are provided. (src/threat_thinker/main.py)

These changes ensure that business context is treated as a first-class input, improving the relevance and specificity of generated threat models, while providing robust controls over prompt size and clear user guidance.