feat(ai): migrate AI features from BYOK to XTM One agents

The extension previously embedded its own LLM integration: users had to
bring their own API keys (OpenAI, Anthropic, Gemini, or a custom endpoint),
and the extension handled prompt engineering, JSON parsing of raw LLM
output, and model selection directly in the browser.

This was fragile, hard to iterate on (prompt changes required extension
releases), and put the burden of LLM configuration on end users.

With XTM One now hosting dedicated agents for each AI feature, the
extension becomes a thin client: it sends structured task payloads and
receives structured JSON responses. Prompt management, model routing,
and output parsing all move server-side.

All 7 AI features (description generation, scenario generation, full
scenario, atomic testing, email generation, entity discovery, relationship
resolution) now call `POST /api/v1/extension/execute-task` with an agent
slug. The `AIClient` class is reduced to a single `executeTask()` method
that serializes the request into a `content` field and identifies the
target agent via `XTM_ONE_AGENT_SLUGS`. Connection testing uses
`GET /api/v1/auth/me`.

- Deleted `AIProvider` type, `apiKey`, `model`, `customBaseUrl`,
  `availableModels` from `AISettings` — replaced with `xtmOneUrl` and
  `apiToken`
- Settings UI (`AITab.tsx`) replaced provider/model dropdowns with
  XTM One URL + token fields; removed "Coming Soon" placeholder
- Background handlers (`ai-handlers.ts`, `ai-utils.ts`) simplified to
  thin wrappers — removed prompt construction, JSON parsing, retry logic
- Removed unused `getMaxContentLength()` export from `ai-utils.ts`
- Removed dead `AIGenerationRequest`/`AIGenerationResponse` types

- `ai/prompts.ts` — hardcoded prompt templates now managed as XTM One
  agent personas
- `ai/json-parser.ts` — JSON extraction from raw LLM output no longer
  needed (XTM One returns structured data)
- Corresponding test files: `prompts.test.ts`, `json-parser.test.ts`

- Added `credentials: 'omit'` to OpenCTI client fetch calls
- Fixed `credentials: 'omit'` ordering in OpenAEV client — moved after
  `...options` spread to prevent callers from overriding it
- Added user-friendly 401/404 error messages to OpenCTI and OpenAEV clients
- Fixed misleading JSDoc on `testConnection()` (claimed "execute-task"
  but actually calls `/auth/me`)

All AI-gated UI surfaces now show "AI is not configured. Configure
XTM One in extension settings." when XTM One is not set up. Previously,
`ScenarioTypeSelector` and `ScenarioFormView` only showed a generic
"AI not available" with no guidance. Enterprise-gate message standardized
to "AI features require Enterprise Edition." across all views.

Author: m719

docs/README.md

@@ -46,7 +46,7 @@ This extension integrates with [OpenCTI](https://filigran.io/solutions/open-cti/
 - **Atomic testing** - Generate command lines for security testing
 - **Entity discovery** - Find entities pattern matching might miss
 - **Relationship resolution** - Identify connections between entities
-- **Multiple LLM providers** - OpenAI, Anthropic, Google Gemini
+- **XTM One AI backend** - All AI features powered by XTM One
 
 ### 🎭 Scenario Themes (Table-Top Exercises)
 

docs/architecture.md

@@ -194,7 +194,7 @@ src/options/
     ├── OpenCTITab.tsx    # OpenCTI platform configuration
     ├── OpenAEVTab.tsx    # OpenAEV platform configuration
     ├── DetectionTab.tsx  # Detection settings
-    ├── AITab.tsx         # AI provider configuration
+    ├── AITab.tsx         # XTM One AI configuration
     ├── AppearanceTab.tsx # Theme settings
     └── AboutTab.tsx      # About and version info
 ```
@@ -211,13 +211,11 @@ Common code shared across all components.
 ```
 src/shared/
 ├── api/                  # API clients
-│   ├── ai-client.ts      # AI provider client (unified interface)
+│   ├── ai-client.ts      # XTM One agent invocation client
 │   ├── opencti-client.ts # OpenCTI GraphQL client
 │   ├── openaev-client.ts # OpenAEV REST client
-│   ├── ai/               # AI provider modules
-│   │   ├── types.ts      # AI request/response types
-│   │   ├── prompts.ts    # AI prompt templates (system prompts, theme configs, builders)
-│   │   └── json-parser.ts # AI response parsing utilities
+│   ├── ai/               # AI type definitions
+│   │   └── types.ts      # AI request/response types
 │   ├── opencti/          # OpenCTI GraphQL modules
 │   │   ├── types.ts      # OpenCTI-specific types (query responses)
 │   │   ├── fragments.ts  # Reusable GraphQL fragments
@@ -237,7 +235,7 @@ src/shared/
 ├── platform/             # Platform abstractions
 │   └── registry.ts       # Platform type registry
 ├── types/                # TypeScript definitions
-│   ├── ai.ts             # AI provider types, model selection, affinities
+│   ├── ai.ts             # AI settings types (XTM One URL, token)
 │   ├── common.ts         # Common response types and utilities
 │   ├── messages.ts       # Extension message types and payloads
 │   ├── observables.ts    # Observable types (IoCs) and detection interfaces
@@ -829,9 +827,9 @@ User clicks "Generate with AI" for scenario
 │    - Inject count & duration        │
 │    - Additional context             │
 │                                     │
-│ 3. Call AI provider                 │
+│ 3. Call XTM One agent               │
 │                                     │
-│ 4. Parse JSON response              │
+│ 4. Receive structured JSON          │
 └────────┬────────────────────────────┘
          │
          ▼
@@ -873,8 +871,8 @@ User clicks "Discover more with AI"
 │   - Page URL                   │
 │   - Page content               │
 │   - Existing entities          │
-│ - Call AI provider             │
-│ - Parse JSON response          │
+│ - Call XTM One agent           │
+│ - Receive structured JSON      │
 └────────┬────────────────────────┘
          │
          ▼
@@ -915,105 +913,34 @@ User clicks "Discover more with AI"
 
 ## AI Integration
 
-### Module Architecture
+### Architecture
 
-The AI client is modularized for maintainability:
+All AI features are routed through **XTM One** — the extension is a thin client that ships raw context to XTM One agents and receives structured JSON back. There is no BYOK (Bring Your Own Key) mode and no direct LLM provider integration. See `docs/features/xtm-one-integration-architecture.md` for the full design rationale.
 
 ```
-src/shared/api/ai/
-├── types.ts       # AI request/response type definitions
-├── prompts.ts     # All prompt templates and builders (system prompts, themes, JSON schemas)
-└── json-parser.ts # Robust AI response parsing (code blocks, malformed JSON)
+src/shared/api/
+├── ai-client.ts   # XTM One execute-task client (AIClient class)
+└── ai/
+    └── types.ts   # AI request/response type definitions
 ```
 
 **Key design decisions:**
-- **Prompt separation**: All prompts extracted to `prompts.ts` (~560 lines) for easy maintenance
-- **Unified interface**: Single `AIClient` class handles OpenAI, Anthropic, and Gemini
-- **Type-safe builders**: Functions like `buildScenarioPrompt()` ensure consistent prompt structure
-
-### Supported Providers
-
-| Provider | Client Class | Models |
-|----------|--------------|--------|
-| OpenAI | `AIClient` | GPT-4o, GPT-4 Turbo, GPT-4 |
-| Anthropic | `AIClient` | Claude 3.5 Sonnet, Claude 3 Opus |
-| Google | `AIClient` | Gemini 1.5 Pro, Gemini 1.5 Flash |
+- **Thin client, thick platform**: The extension owns no prompt logic — XTM One owns prompts, model selection, RBAC, quotas, and structured output.
+- **Single endpoint**: All tasks go through `POST {xtmOneUrl}/api/v1/extension/execute-task` with a `Bearer fcp-…` token.
+- **Agent-per-feature**: Each AI feature maps 1:1 to a dedicated XTM One agent identified by slug.
 
 ### AI Features
 
-| Feature | Message Type | Description |
-|---------|--------------|-------------|
-| Container Description | `AI_GENERATE_DESCRIPTION` | Generate intelligent descriptions from page context |
-| Full Scenario Generation | `AI_GENERATE_FULL_SCENARIO` | Generate complete scenarios with injects |
-| Atomic Test Generation | `AI_GENERATE_ATOMIC_TEST` | Generate test commands for attack patterns |
-| Email Generation | `AI_GENERATE_EMAILS` | Generate email content for table-top exercises |
-| Entity Discovery | `AI_DISCOVER_ENTITIES` | Discover entities pattern matching missed |
-| Relationship Resolution | `AI_RESOLVE_RELATIONSHIPS` | Identify relationships between entities |
-
-### Prompt Templates (in `ai/prompts.ts`)
-
-All prompt templates are centralized for maintainability:
-
-```typescript
-// System prompts for different operations
-export const SYSTEM_PROMPTS = {
-  CONTAINER_DESCRIPTION: '...',
-  SCENARIO_GENERATION: '...',
-  ATOMIC_TEST: '...',
-  EMAIL_GENERATION: '...',
-  ENTITY_DISCOVERY: '...',
-  RELATIONSHIP_RESOLUTION: '...',
-};
-
-// Theme-specific configurations for table-top scenarios
-export const TABLE_TOP_THEMES = {
-  'cybersecurity': { /* ... */ },
-  'physical-security': { /* ... */ },
-  // ... other themes
-};
-
-// Prompt builder functions
-export function buildContainerDescriptionPrompt(request: ContainerDescriptionRequest): string;
-export function buildScenarioPrompt(request: ScenarioGenerationRequest): string;
-export function buildFullScenarioPrompt(request: FullScenarioGenerationRequest): string;
-export function buildAtomicTestPrompt(request: AtomicTestRequest): string;
-export function buildEmailGenerationPrompt(request: EmailGenerationRequest): string;
-export function buildEntityDiscoveryPrompt(request: EntityDiscoveryRequest): string;
-export function buildRelationshipResolutionPrompt(request: RelationshipResolutionRequest): string;
-```
-
-### Scenario Themes
-
-For table-top scenario generation, themes customize the AI prompt. Defined in `ai/prompts.ts`:
-
-```typescript
-export const TABLE_TOP_THEMES = {
-  'cybersecurity': {
-    systemPromptSuffix: 'Focus on cyber attacks, data breaches, ransomware...',
-    exampleTopics: 'cyber attacks, malware outbreaks, data breaches...',
-  },
-  'physical-security': {
-    systemPromptSuffix: 'Focus on physical security threats...',
-    exampleTopics: 'facility intrusions, access control breaches...',
-  },
-  'business-continuity': {
-    systemPromptSuffix: 'Focus on business disruption scenarios...',
-    exampleTopics: 'natural disasters, power outages, supply chain...',
-  },
-  'crisis-communication': {
-    systemPromptSuffix: 'Focus on crisis communication scenarios...',
-    exampleTopics: 'media leaks, social media crises, PR incidents...',
-  },
-  'health-safety': {
-    systemPromptSuffix: 'Focus on health and safety incidents...',
-    exampleTopics: 'workplace injuries, pandemic outbreaks...',
-  },
-  'geopolitical': {
-    systemPromptSuffix: 'Focus on geopolitical and economic scenarios...',
-    exampleTopics: 'sanctions compliance, trade restrictions...',
-  },
-};
-```
+| Feature | Message Type | XTM One Agent Slug | Description |
+|---------|--------------|-------------------|-------------|
+| Container Description | `AI_GENERATE_DESCRIPTION` | `browser-container-description` | Generate descriptions from page context |
+| Scenario Generation | `AI_GENERATE_SCENARIO` | `browser-scenario-generation` | Generate attack scenarios |
+| Full Scenario Generation | `AI_GENERATE_FULL_SCENARIO` | `browser-full-scenario-generation` | Generate complete scenarios with injects |
+| Atomic Test Generation | `AI_GENERATE_ATOMIC_TEST` | `browser-atomic-test-generation` | Generate test commands for attack patterns |
+| Email Generation | `AI_GENERATE_EMAILS` | `browser-email-generation` | Generate email content for table-top exercises |
+| Entity Discovery | `AI_DISCOVER_ENTITIES` | `browser-entity-discovery` | Discover entities pattern matching missed |
+| Relationship Resolution | `AI_RESOLVE_RELATIONSHIPS` | `browser-relationship-resolution` | Identify relationships between entities |
+| Combined Scan | `AI_SCAN_ALL` | `browser-scan-all` | Entity discovery + relationship resolution in one pass |
 
 ## Panel Utilities
 

docs/configuration.md

@@ -118,54 +118,31 @@ AI features require at least one connected Enterprise Edition (EE) platform. The
 
 1. Connect to at least one Enterprise Edition platform (OpenCTI EE or OpenAEV EE)
 2. Go to **Settings → AI Assistant**
-3. Select your LLM provider
-4. Enter your API key
-5. Click **Save Settings**
+3. Enter your **XTM One URL** (e.g. `https://xtm.company.com`)
+4. Enter your **XTM One API Token** (starts with `fcp-`)
+5. Click **Test Connection** to validate
+6. Click **Save Settings**
 
-### Supported LLM Providers
+### XTM One Setup
 
-| Provider | API Key | Model Selection |
-|----------|---------|-----------------|
-| **OpenAI** | Required | Dynamic list from API |
-| **Anthropic** | Required | Dynamic list from API |
-| **Google Gemini** | Required | Dynamic list from API |
-| **XTM One** | Coming Soon | Filigran Agentic AI Platform |
+| Field | Description |
+|-------|-------------|
+| **XTM One URL** | Base URL of your XTM One instance |
+| **API Token** | Personal Access Token (generate from your XTM One profile page) |
 
-### Model Selection
+### Connection Test
 
-After entering your API key:
+After entering your credentials:
 
-1. Click **Test Connection** to validate the key
-2. If successful, available models are fetched automatically
-3. Select your preferred model from the dropdown
-4. Click **Save Settings** to persist your selection
+1. Click **Test Connection** to validate the token against XTM One
+2. If successful, AI features become available throughout the extension
+3. Click **Save Settings** to persist your configuration
 
-Popular models by provider:
-
-| Provider | Recommended Models |
-|----------|-------------------|
-| OpenAI | `gpt-4o`, `gpt-4-turbo`, `gpt-4` |
-| Anthropic | `claude-3-5-sonnet-latest`, `claude-3-opus-latest` |
-| Google | `gemini-1.5-pro`, `gemini-1.5-flash` |
-
-### Getting API Keys
-
-#### OpenAI
-1. Go to [platform.openai.com](https://platform.openai.com)
-2. Navigate to **API Keys**
-3. Create a new secret key
-4. Copy and paste into the extension settings
-
-#### Anthropic
-1. Go to [console.anthropic.com](https://console.anthropic.com)
-2. Navigate to **API Keys**
-3. Create a new key
-4. Copy and paste into the extension settings
+### Getting Your API Token
 
-#### Google Gemini
-1. Go to [aistudio.google.com](https://aistudio.google.com)
-2. Navigate to **Get API Key**
-3. Create a new key
+1. Go to your XTM One instance
+2. Navigate to your **Profile → API Keys**
+3. Create a new Personal Access Token
 4. Copy and paste into the extension settings
 
 ### No Enterprise Edition?

docs/development.md

@@ -70,13 +70,11 @@ src/
 │   └── main.tsx         # Options entry point
 ├── shared/              # Shared code
 │   ├── api/             # API clients (modular architecture)
-│   │   ├── ai-client.ts         # AI/LLM provider client
+│   │   ├── ai-client.ts         # XTM One agent invocation client
 │   │   ├── opencti-client.ts    # OpenCTI GraphQL client
 │   │   ├── openaev-client.ts    # OpenAEV REST client
 │   │   ├── ai/                  # AI modules
-│   │   │   ├── prompts.ts       # Prompt templates & builders
-│   │   │   ├── types.ts         # AI types
-│   │   │   └── json-parser.ts   # Response parsing
+│   │   │   └── types.ts         # AI types
 │   │   ├── opencti/             # OpenCTI modules
 │   │   │   ├── queries.ts       # GraphQL queries & filters
 │   │   │   ├── fragments.ts     # GraphQL fragments
@@ -103,7 +101,7 @@ src/
 │   ├── theme/           # Theme configuration
 │   ├── types/           # TypeScript type definitions
 │   │   ├── settings.ts      # Platform config, detection settings
-│   │   ├── ai.ts            # AI provider types, model selection
+│   │   ├── ai.ts            # AI settings types (XTM One URL, token)
 │   │   ├── observables.ts   # Observable types (IoCs) and detection
 │   │   ├── platform.ts      # Cross-platform matching types
 │   │   ├── opencti.ts       # OpenCTI types (GraphQL, STIX, entities)
@@ -238,13 +236,11 @@ API clients are organized into modular structures for maintainability:
 
 ```
 src/shared/api/
-├── ai-client.ts          # Main AI client (imports from ai/)
+├── ai-client.ts          # XTM One execute-task client
 ├── opencti-client.ts     # Main OpenCTI client (imports from opencti/)
 ├── openaev-client.ts     # Main OpenAEV client (imports from openaev/)
 ├── ai/
-│   ├── prompts.ts        # All prompt templates (~560 lines)
-│   ├── types.ts          # AI type definitions
-│   └── json-parser.ts    # Response parsing utilities
+│   └── types.ts          # AI type definitions
 ├── opencti/
 │   ├── queries.ts        # GraphQL queries/mutations & filter builders (~350 lines)
 │   ├── fragments.ts      # Reusable GraphQL fragments
@@ -398,21 +394,27 @@ chrome.runtime.sendMessage({
 
 ### Using AI Features
 
+All AI features are routed through XTM One. The extension is a thin client:
+
 ```typescript
 import { AIClient } from './shared/api/ai-client';
 
 const client = new AIClient({
-  provider: 'openai',
-  apiKey: 'sk-...',
-  model: 'gpt-4o',
+  xtmOneUrl: 'https://xtm.company.com',
+  apiToken: 'fcp-...',
 });
 
-// Generate description
-const description = await client.generateDescription(pageContent);
+// Generate description (delegates to XTM One browser-container-description agent)
+const result = await client.generateContainerDescription({
+  pageTitle: 'Threat Report',
+  pageUrl: 'https://example.com/report',
+  pageContent: '...',
+  containerType: 'Report',
+  containerName: 'My Report',
+});
 
-// Fetch available models
-const models = await client.fetchModels();
-// Returns: [{ id: 'gpt-4o', name: 'GPT-4o' }, ...]
+// Test connection
+const status = await client.testConnection();
 ```
 
 ## Message Passing
@@ -457,7 +459,7 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
 | `AI_GENERATE_EMAILS` | Panel → Background | Generate email content for table-top scenarios |
 | `AI_GENERATE_ATOMIC_TEST` | Panel → Background | Generate atomic test payload |
 | `AI_DISCOVER_ENTITIES` | Panel → Background | Discover entities using AI |
-| `AI_TEST_AND_FETCH_MODELS` | Options → Background | Test AI key & fetch models |
+| `AI_TEST_CONNECTION` | Options → Background | Test XTM One connection |
 
 ## Contributing
 

docs/features.md

@@ -280,22 +280,19 @@ AI-powered features require at least one Enterprise Edition platform. If not con
 - Configure AI in Settings (if you have EE)
 - Start a free 30-day trial (if you don't have EE)
 
-### Supported LLM Providers
-
-| Provider | Description | Model Selection |
-|----------|-------------|-----------------|
-| **OpenAI** | GPT-4, GPT-4 Turbo, GPT-4o models | ✅ Dynamic model list |
-| **Anthropic** | Claude 3.5 Sonnet, Claude 3 Opus | ✅ Dynamic model list |
-| **Google Gemini** | Gemini 1.5 Pro and Flash | ✅ Dynamic model list |
-| **XTM One** | Filigran Agentic AI Platform (coming soon) | - |
-
-### Model Selection
-
-After configuring your API key, you can:
-1. Click **Test Connection** to validate the API key
-2. The extension fetches available models from the provider
-3. Select your preferred model from the dropdown
-4. Models are cached for future sessions
+### XTM One (AI Backend)
+
+All AI features are powered by XTM One — no direct LLM provider configuration needed.
+
+| Setting | Description |
+|---------|-------------|
+| **XTM One URL** | Base URL of your XTM One instance |
+| **API Token** | Personal Access Token (starts with `fcp-`) |
+
+### Connection Test
+
+1. Click **Test Connection** to validate your XTM One credentials
+2. AI features become available once connected
 
 ### AI Container Description (OpenCTI)
 When creating containers in OpenCTI, you can use AI to generate intelligent descriptions: