torusguard 0.9.2

package/skills/torusguard/payload/scripts/monorepo_detector.py

@@ -0,0 +1,164 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Monorepo & Multi-Package Workspace Detector (v0.9.3)
+Discovers and profiles sub-projects across Turborepo, pnpm, npm, and Python workspaces.
+Pure Python 3.10+ standard library (zero external dependencies).
+"""
+
+import sys
+import os
+import json
+import re
+import argparse
+from pathlib import Path
+from typing import Dict, List, Any, Optional
+
+
+def detect_package_info(abs_pkg_dir: Path, root: Path) -> Dict[str, Any]:
+    """Inspects a single directory to detect language and framework."""
+    rel_path = str(abs_pkg_dir.relative_to(root)).replace('\\', '/')
+    name = abs_pkg_dir.name
+    language = "unknown"
+    framework = "generic"
+
+    pkg_dir = abs_pkg_dir
+
+    # Check typescript / javascript
+    package_json = pkg_dir / "package.json"
+    if package_json.is_file() or list(pkg_dir.glob("*.ts")) or list(pkg_dir.glob("*.js")):
+        language = "typescript"
+        if package_json.is_file():
+            try:
+                with open(package_json, "r", encoding="utf-8") as f:
+                    pj = json.load(f)
+                    name = pj.get("name", name)
+                    deps = {**pj.get("dependencies", {}), **pj.get("devDependencies", {})}
+                    if "next" in deps:
+                        framework = "nextjs"
+                    elif "express" in deps:
+                        framework = "express"
+                    elif "react" in deps:
+                        framework = "react"
+                    elif "vue" in deps or "nuxt" in deps:
+                        framework = "vue"
+            except Exception:
+                pass
+        elif list(pkg_dir.glob("*next*")) or "next" in pkg_dir.name:
+            framework = "nextjs"
+
+    # Check python
+    pyproject = pkg_dir / "pyproject.toml"
+    reqs = pkg_dir / "requirements.txt"
+    if pyproject.is_file() or reqs.is_file() or list(pkg_dir.glob("*.py")):
+        if language == "unknown":
+            language = "python"
+        content = ""
+        if pyproject.is_file():
+            content += pyproject.read_text(encoding="utf-8", errors="replace").lower()
+        if reqs.is_file():
+            content += reqs.read_text(encoding="utf-8", errors="replace").lower()
+        for pyf in pkg_dir.glob("*.py"):
+            content += pyf.read_text(encoding="utf-8", errors="replace").lower()
+        
+        if "fastapi" in content or "fastapi" in pkg_dir.name:
+            framework = "fastapi"
+        elif "django" in content or "django" in pkg_dir.name:
+            framework = "django"
+        elif "flask" in content or "flask" in pkg_dir.name:
+            framework = "flask"
+
+    return {
+        "name": name,
+        "path": rel_path,
+        "language": language,
+        "framework": framework
+    }
+
+
+def scan_workspace(root_dir: str = ".") -> Dict[str, Any]:
+    """Scans root directory for monorepo configuration and sub-packages."""
+    root = Path(root_dir).resolve()
+    monorepo_type = "single-project"
+    sub_packages: List[Dict[str, Any]] = []
+
+    # 1. Turborepo
+    if (root / "turbo.json").is_file():
+        monorepo_type = "turborepo"
+
+    # 2. pnpm workspace
+    pnpm_ws = root / "pnpm-workspace.yaml"
+    if pnpm_ws.is_file():
+        monorepo_type = "pnpm-workspace"
+
+    # 3. npm / yarn workspaces
+    root_pj = root / "package.json"
+    if root_pj.is_file():
+        try:
+            with open(root_pj, "r", encoding="utf-8") as f:
+                data = json.load(f)
+                if "workspaces" in data:
+                    monorepo_type = "npm/yarn-workspaces"
+        except Exception:
+            pass
+
+    # Scan common monorepo container directories and direct project subfolders
+    candidate_folders = ["apps", "packages", "services", "libs", "modules"]
+    found_dirs = []
+    
+    for cf in candidate_folders:
+        container = root / cf
+        if container.is_dir():
+            for child in container.iterdir():
+                if child.is_dir() and not child.name.startswith(('.', '_')):
+                    if any((child / m).exists() for m in ["package.json", "pyproject.toml", "requirements.txt", "setup.py", "Cargo.toml", "main.py"]):
+                        found_dirs.append(child)
+
+    # Also scan direct subdirectories if not already captured
+    for child in root.iterdir():
+        if child.is_dir() and not child.name.startswith(('.', '_')) and child.name not in candidate_folders:
+            if any((child / m).exists() for m in ["package.json", "pyproject.toml", "requirements.txt", "setup.py", "Cargo.toml", "main.py", "actions.ts"]):
+                if child not in found_dirs:
+                    found_dirs.append(child)
+
+    if found_dirs:
+        if monorepo_type == "single-project":
+            monorepo_type = "multi-package-directory"
+        for d in found_dirs:
+            sub_packages.append(detect_package_info(d, root))
+
+    # If no monorepo sub-packages found, treat root as primary
+    if not sub_packages:
+        sub_packages.append(detect_package_info(root, root))
+
+    return {
+        "root": str(root).replace('\\', '/'),
+        "monorepo_type": monorepo_type,
+        "is_monorepo": monorepo_type != "single-project",
+        "package_count": len(sub_packages),
+        "packages": sub_packages
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Monorepo & Multi-Package Detector")
+    parser.add_argument("--scan", default=".", help="Root directory to scan (default: .)")
+    parser.add_argument("--write", action="store_true", help="Write to .torusguard/config/workspaces.json")
+    parser.add_argument("--json", action="store_true", help="Output JSON to stdout")
+    args = parser.parse_args()
+
+    res = scan_workspace(args.scan)
+
+    if args.write:
+        config_dir = Path(args.scan) / ".torusguard" / "config"
+        config_dir.mkdir(parents=True, exist_ok=True)
+        out_file = config_dir / "workspaces.json"
+        with open(out_file, "w", encoding="utf-8") as f:
+            json.dump(res, f, indent=2)
+        print(f"[SUCCESS] Wrote workspace registry to {out_file}")
+
+    if args.json or not args.write:
+        print(json.dumps(res, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/scripts/run_manager.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Run Folder Lifecycle Manager
+Creates isolated run folders, tracks manifest.json state, and enumerates execution history.
+"""
+
+import sys
+import json
+import datetime
+import argparse
+from pathlib import Path
+from typing import Dict, Any, List
+
+def create_run(base_dir: Path, command: str, target_name: str = "project") -> Path:
+    timestamp = datetime.datetime.utcnow().strftime("%Y%m%d-%H%M%S")
+    run_id = f"run-{timestamp}-{command}"
+    run_folder = base_dir / run_id
+    run_folder.mkdir(parents=True, exist_ok=True)
+
+    manifest = {
+        "run_id": run_id,
+        "command": command,
+        "target_name": target_name,
+        "created_at": datetime.datetime.utcnow().isoformat() + "Z",
+        "status": "in_progress",
+        "torusguard_version": "0.8.0",
+        "findings_count": 0,
+        "confirmed_fixed_count": 0,
+        "regressed_count": 0
+    }
+
+    manifest_path = run_folder / "manifest.json"
+    with open(manifest_path, "w", encoding="utf-8") as f:
+        json.dump(manifest, f, indent=2)
+
+    return run_folder
+
+
+def list_runs(base_dir: Path) -> List[Dict[str, Any]]:
+    runs = []
+    if not base_dir.is_dir():
+        return runs
+
+    for d in sorted(base_dir.iterdir(), reverse=True):
+        if d.is_dir() and d.name.startswith("run-"):
+            manifest_file = d / "manifest.json"
+            if manifest_file.is_file():
+                try:
+                    with open(manifest_file, "r", encoding="utf-8") as f:
+                        data = json.load(f)
+                    runs.append(data)
+                except Exception:
+                    runs.append({"run_id": d.name, "status": "corrupted"})
+            else:
+                runs.append({"run_id": d.name, "status": "unmanifested"})
+    return runs
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Run Manager")
+    subparsers = parser.add_subparsers(dest="subcommand")
+
+    create_p = subparsers.add_parser("create")
+    create_p.add_argument("--command", "-c", default="audit", help="TorusGuard command (audit, web-validate, harden, etc.)")
+    create_p.add_argument("--target", "-t", default="project", help="Target project name")
+    create_p.add_argument("--dir", "-d", default=".torusguard/runs", help="Base runs directory")
+
+    list_p = subparsers.add_parser("list")
+    list_p.add_argument("--dir", "-d", default=".torusguard/runs", help="Base runs directory")
+    list_p.add_argument("--json", action="store_true", help="Output JSON")
+
+    args = parser.parse_args()
+
+    if args.subcommand == "create":
+        folder = create_run(Path(args.dir), args.command, args.target)
+        print(f"Created run folder: {folder}")
+    elif args.subcommand == "list":
+        runs = list_runs(Path(args.dir))
+        if args.json:
+            print(json.dumps(runs, indent=2))
+        else:
+            print(f"Total Runs Found: {len(runs)}")
+            for r in runs:
+                print(f"  - {r.get('run_id')}: command={r.get('command')}, status={r.get('status')}")
+    else:
+        parser.print_help()
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/scripts/safety_gate.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Runtime Safety Gate Evaluator
+Evaluates prospective HTTP/browser validation probes against non-destruction policies.
+"""
+
+import sys
+import json
+import argparse
+from typing import Dict, Any, Tuple
+
+def evaluate_safety_gate(method: str, path: str, body: str = "") -> Tuple[str, str]:
+    """
+    Returns (decision, rationale)
+    Decisions:
+    - Auto-Allowed
+    - Approval Required
+    - Manual Only (Blocked)
+    """
+    method_upper = method.upper()
+
+    # Block destructive verbs
+    if method_upper in ("DELETE", "DROP"):
+        return "Manual Only", f"Method '{method_upper}' is destructive and strictly blocked from automated runtime validation."
+
+    # Block sensitive administrative paths
+    destructive_keywords = ["/admin/delete", "/shutdown", "/drop-database", "/purge", "/reset-system"]
+    for kw in destructive_keywords:
+        if kw in path.lower():
+            return "Manual Only", f"Path '{path}' targets destructive administrative endpoint '{kw}'."
+
+    # Safe read methods
+    if method_upper in ("GET", "HEAD", "OPTIONS"):
+        return "Auto-Allowed", f"Read-only method '{method_upper}' with non-destructive path."
+
+    # State-changing methods (POST, PUT, PATCH)
+    if method_upper in ("POST", "PUT", "PATCH"):
+        # Check if safe canary marker exists
+        if "tg-canary" in body.lower() or "torusguard" in body.lower():
+            return "Approval Required", f"State-changing method '{method_upper}' contains benign TorusGuard test marker; requires user approval."
+        else:
+            return "Approval Required", f"State-changing method '{method_upper}' requires operator approval before execution."
+
+    return "Approval Required", f"Unknown probe profile for {method_upper} {path}."
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Safety Gate Evaluator")
+    parser.add_argument("--method", "-m", default="GET", help="HTTP Method")
+    parser.add_argument("--path", "-p", default="/api/test", help="Endpoint path")
+    parser.add_argument("--body", "-b", default="", help="Request payload body")
+    parser.add_argument("--json", action="store_true", help="Output JSON")
+    args = parser.parse_args()
+
+    decision, rationale = evaluate_safety_gate(args.method, args.path, args.body)
+
+    if args.json:
+        print(json.dumps({"decision": decision, "rationale": rationale}, indent=2))
+    else:
+        print(f"Safety Decision: {decision}")
+        print(f"Rationale: {rationale}")
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/scripts/sarif_exporter.py

@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+"""
+TorusGuard OASIS SARIF v2.1.0 Exporter
+Converts normalized TorusGuard findings into standard SARIF v2.1.0 format with
+GitHub Code Scanning multi-analysis category separation and partialFingerprints deduplication.
+"""
+
+import sys
+import json
+import hashlib
+import argparse
+from typing import List, Dict, Any
+
+def generate_sarif(findings: List[Dict[str, Any]], run_id: str = "default", category: str = "torusguard/static") -> Dict[str, Any]:
+    rules_map: Dict[str, Dict[str, Any]] = {}
+    results: List[Dict[str, Any]] = []
+
+    for f in findings:
+        rule_id = f.get("rule_id", "TG-GEN-001")
+        if rule_id not in rules_map:
+            rules_map[rule_id] = {
+                "id": rule_id,
+                "name": f.get("title", rule_id),
+                "shortDescription": {"text": f.get("title", rule_id)},
+                "fullDescription": {"text": f.get("description", f.get("title", rule_id))},
+                "defaultConfiguration": {
+                    "level": "error" if f.get("severity") in ("Critical", "High") else "warning"
+                },
+                "properties": {
+                    "tags": ["security", "torusguard", f.get("category", "general")]
+                }
+            }
+
+        target = f.get("target", {})
+        file_path = target.get("file_path", "unknown")
+        line = target.get("start_line", 1)
+
+        # Generate deduplication fingerprint
+        seed = f"{rule_id}:{file_path}:{line}"
+        line_hash = hashlib.sha256(seed.encode("utf-8")).hexdigest()[:16]
+
+        result: Dict[str, Any] = {
+            "ruleId": rule_id,
+            "message": {"text": f.get("title", "TorusGuard Security Finding")},
+            "level": "error" if f.get("severity") in ("Critical", "High") else "warning",
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {
+                            "uri": file_path,
+                            "uriBaseId": "%SRCROOT%"
+                        },
+                        "region": {
+                            "startLine": line,
+                            "startColumn": 1
+                        }
+                    }
+                }
+            ],
+            "partialFingerprints": {
+                "primaryLocationLineHash": line_hash
+            },
+            "properties": {
+                "confidence": f.get("confidence", 70),
+                "status": f.get("status", "Confirmed"),
+                "finding_id": f.get("finding_id", "TG-FIND-UNKNOWN")
+            }
+        }
+        results.append(result)
+
+    sarif = {
+        "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "TorusGuard",
+                        "semanticVersion": "0.8.0",
+                        "informationUri": "https://github.com/githubmofo/TorusGuard",
+                        "rules": list(rules_map.values())
+                    }
+                },
+                "automationDetails": {
+                    "id": f"{category}/{run_id}"
+                },
+                "results": results
+            }
+        ]
+    }
+    return sarif
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard SARIF v2.1.0 Exporter")
+    parser.add_argument("--input", "-i", help="Path to findings JSON file")
+    parser.add_argument("--output", "-o", help="Output path for sarif.json")
+    parser.add_argument("--run-id", default="run-default", help="Unique execution Run ID")
+    args = parser.parse_args()
+
+    findings = []
+    if args.input:
+        with open(args.input, "r", encoding="utf-8") as f:
+            findings = json.load(f)
+
+    sarif = generate_sarif(findings, run_id=args.run_id)
+
+    if args.output:
+        with open(args.output, "w", encoding="utf-8") as f:
+            json.dump(sarif, f, indent=2)
+        print(f"SARIF log written to: {args.output}")
+    else:
+        print(json.dumps(sarif, indent=2))
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/scripts/stack_detect.py

@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Stack Detector Utility
+Inspects project directory to detect programming language, frameworks, ORM/data layer,
+and dependency manifests. Outputs canonical stack block and structured JSON.
+"""
+
+import sys
+import json
+import argparse
+from pathlib import Path
+from typing import Dict, Any, List
+
+def detect_stack(project_root: Path) -> Dict[str, Any]:
+    profile = {
+        "language": "Unknown",
+        "framework": "None",
+        "data_layer": "None",
+        "dependency_files": [],
+        "detection_evidence": [],
+        "confidence": "Needs Review",
+        "recommended_rules": [
+            "TG-SEC-*",
+            "TG-INPUT-*",
+            "TG-AUTH-*"
+        ],
+        "recommended_references": []
+    }
+
+    # 1. Inspect dependency manifests
+    dep_candidates = ["pyproject.toml", "requirements.txt", "Pipfile", "package.json", "package-lock.json", "pnpm-lock.yaml"]
+    for dc in dep_candidates:
+        if (project_root / dc).is_file():
+            profile["dependency_files"].append(dc)
+
+    # 2. Check Python ecosystem
+    manage_py = project_root / "manage.py"
+    settings_py = list(project_root.glob("**/settings.py"))
+    
+    if manage_py.is_file() or settings_py:
+        profile["language"] = "Python"
+        profile["framework"] = "Django"
+        profile["data_layer"] = "Django ORM"
+        profile["confidence"] = "Confirmed"
+        profile["detection_evidence"].append({
+            "file": "manage.py" if manage_py.is_file() else str(settings_py[0].relative_to(project_root)),
+            "indicator": "Django management or settings configuration"
+        })
+        profile["recommended_rules"].extend(["TG-DB-004", "TG-RATE-001", "TG-PLATFORM-*"])
+        profile["recommended_references"].extend(["django-security.md", "python-security-overview.md"])
+        
+        # Check for DRF
+        for py_file in project_root.glob("**/*.py"):
+            try:
+                content = py_file.read_text(encoding="utf-8", errors="ignore")
+                if "rest_framework" in content:
+                    profile["framework"] = "Django / DRF"
+                    profile["recommended_references"].append("drf-security.md")
+                    break
+            except Exception:
+                continue
+
+    # Check for FastAPI / Flask if not Django
+    if profile["framework"] == "None":
+        for py_file in list(project_root.glob("*.py")) + list(project_root.glob("app/**/*.py")) + list(project_root.glob("src/**/*.py")):
+            try:
+                content = py_file.read_text(encoding="utf-8", errors="ignore")
+                if "FastAPI(" in content or "from fastapi" in content:
+                    profile["language"] = "Python"
+                    profile["framework"] = "FastAPI"
+                    profile["confidence"] = "Confirmed"
+                    profile["detection_evidence"].append({
+                        "file": str(py_file.relative_to(project_root)),
+                        "indicator": "FastAPI application instantiation"
+                    })
+                    profile["recommended_references"].append("fastapi-security.md")
+                elif "Flask(__name__)" in content or "from flask" in content:
+                    profile["language"] = "Python"
+                    profile["framework"] = "Flask"
+                    profile["confidence"] = "Confirmed"
+                    profile["detection_evidence"].append({
+                        "file": str(py_file.relative_to(project_root)),
+                        "indicator": "Flask application instantiation"
+                    })
+                    profile["recommended_references"].append("flask-security.md")
+
+                if "sqlalchemy" in content:
+                    profile["data_layer"] = "SQLAlchemy"
+                    profile["recommended_references"].append("sqlalchemy-security.md")
+            except Exception:
+                continue
+
+    # 3. Check JavaScript / TypeScript ecosystem
+    pkg_json_path = project_root / "package.json"
+    if pkg_json_path.is_file():
+        profile["language"] = "TypeScript" if list(project_root.glob("**/*.ts*")) else "JavaScript"
+        try:
+            with open(pkg_json_path, "r", encoding="utf-8") as f:
+                pkg = json.load(f)
+            deps = {**pkg.get("dependencies", {}), **pkg.get("devDependencies", {})}
+            
+            if "next" in deps:
+                profile["framework"] = "Next.js"
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "next dependency"})
+                profile["recommended_references"].append("nextjs-security.md")
+                profile["recommended_rules"].extend(["TG-CLIENT-*", "TG-PLATFORM-001"])
+            elif "express" in deps:
+                profile["framework"] = "Express"
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "express dependency"})
+                profile["recommended_references"].append("express-security.md")
+            elif "react" in deps:
+                profile["framework"] = "React / Vite"
+                profile["confidence"] = "Confirmed"
+                profile["detection_evidence"].append({"file": "package.json", "indicator": "react dependency"})
+                profile["recommended_references"].append("react-vite-security.md")
+
+            if "@supabase/supabase-js" in deps:
+                profile["data_layer"] = "Supabase"
+                profile["recommended_references"].append("supabase-security.md")
+            elif "firebase" in deps or "firebase-admin" in deps:
+                profile["data_layer"] = "Firebase"
+                profile["recommended_references"].append("firebase-security.md")
+        except Exception:
+            pass
+
+    return profile
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Stack Detector")
+    parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--json", action="store_true", help="Output raw JSON")
+    args = parser.parse_args()
+
+    project_root = Path(args.path).resolve()
+    profile = detect_stack(project_root)
+
+    if args.json:
+        print(json.dumps(profile, indent=2))
+    else:
+        evidence = profile["detection_evidence"][0]["file"] if profile["detection_evidence"] else "heuristic"
+        print(f"## Detected Stack")
+        print(f"- Language: {profile['language']}")
+        print(f"- Framework: {profile['framework']}")
+        print(f"- Data layer: {profile['data_layer']}")
+        print(f"- Dependency files: {', '.join(profile['dependency_files']) if profile['dependency_files'] else 'None'}")
+        print(f"- Detection confidence: {profile['confidence']} ({evidence})")
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/skills/torusguard/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: torusguard
+description: Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications across Python and TypeScript.
+version: 0.9.2
+---
+
+# TorusGuard Master Router
+
+**Principle:** If the browser receives it, users can inspect it. Keep secrets, direct database access, and authorization on trusted server-side code.
+
+---
+
+## ⚡ Workspace Bootstrap Check
+1. **If `.torusguard/` exists:** Load matching specialist skill on demand per command.
+2. **If `.torusguard/` is missing:** Run `python skills/torusguard/bootstrap.py --target .` or `/torusguard init`.
+
+---
+
+## Specialist Skill Routing (Lazy Loading)
+Load **only** the designated sub-skill when a slash command is executed to maintain strict 1,000–1,500 token budget:
+
+| Command | Specialist Skill | Agent |
+| :--- | :--- | :--- |
+| `/torusguard init` | `skills/torusguard-init/SKILL.md` | `profiler` |
+| `/torusguard authorize` | `skills/torusguard-authorize/SKILL.md` | `reviewer` |
+| `/torusguard audit` | `skills/torusguard-audit/SKILL.md` | `auditor` |
+| `/torusguard verify` | `skills/torusguard-verify/SKILL.md` | `validator` |
+| `/torusguard web-validate` | `skills/torusguard-web-validate/SKILL.md` | `validator` |
+| `/torusguard exploit-check` | `skills/torusguard-exploit-check/SKILL.md` | `validator` |
+| `/torusguard harden` | `skills/torusguard-harden/SKILL.md` | `remediator` |
+| `/torusguard apply` | `skills/torusguard-apply/SKILL.md` | `remediator` |
+| `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` |
+| `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` |
+| `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` |
+| `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* |
+
+*Note: Never load all skills simultaneously. Lazy-load strictly on demand.*