tachi: Command for Claude Code

User Input

$ARGUMENTS

Consider user input before proceeding (if not empty).

Step 0: Parse Flags

1. If $ARGUMENTS contains --output-dir <path>:

   • Set output_dir to the specified path
   • Strip --output-dir <path> from $ARGUMENTS (trim extra whitespace)

2. Default: output_dir = null (outputs written to same directory as input)

3. Remaining $ARGUMENTS is treated as the input directory path.

4. If no input directory was provided in $ARGUMENTS:

   • If ./docs/security/ exists in cwd: glob docs/security/*/, sort directory names descending (ISO-like YYYY-MM-DDTHH-MM-SS timestamps sort correctly as strings), and select the newest directory that contains threats.md or threats.sarif. Set input_dir to that path and display: Auto-detected input: {input_dir}.
   • Otherwise, default to current working directory (.).

Overview

Single-command entry point for tachi quantitative risk scoring. Validates prerequisites, locates threat model output, invokes the risk-scorer agent, and writes scored output files.

Flow: Validate → Locate Input → Score → Report

Output suite:

• risk-scores.md — scored threat table, executive summary, dimensional breakdowns, governance fields, methodology
• risk-scores.sarif — SARIF 2.1.0 with per-finding composite scores in security-severity and scoring properties in result property bags

Step 1: Validate Prerequisites

1. Check tachi agents are installed:

   • Verify .claude/agents/tachi/risk-scorer.md exists
   • If missing, display:

     TACHI RISK SCORER NOT INSTALLED
     Run: cp -r <tachi-repo>/adapters/claude-code/agents/risk-scorer.md .claude/agents/tachi/
     See: https://github.com/davidmatousek/tachi
     

   • Halt if missing.

2. Check input files exist:

   • Look for threats.md in the input directory
   • If not found, look for threats.sarif in the input directory
   • If neither exists, display:

     NO THREAT MODEL OUTPUT FOUND
     Neither threats.md nor threats.sarif found in: {input_dir}
     Run /threat-model first to generate threat model output.
     

   • Halt if neither exists.