torusguard 0.9.2

package/.torusguard/scripts/manifest_builder.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Cryptographic Manifest Builder & Verifier
+Generates or validates SHA-256 integrity digests for all .torusguard files.
+"""
+
+import os
+import sys
+import json
+import hashlib
+import argparse
+from pathlib import Path
+
+
+def compute_file_sha256(filepath):
+    """Compute SHA-256 digest of a file in binary mode."""
+    hasher = hashlib.sha256()
+    with open(filepath, "rb") as fh:
+        while chunk := fh.read(65536):
+            hasher.update(chunk)
+    return hasher.hexdigest()
+
+
+def scan_workspace_files(base_dir):
+    """Scan all files inside .torusguard, ignoring runs, pyc, and gitkeep."""
+    base_dir = Path(base_dir).resolve()
+    file_map = {}
+
+    for root, dirs, files in os.walk(base_dir):
+        if "runs" in dirs:
+            dirs.remove("runs")
+        if "__pycache__" in dirs:
+            dirs.remove("__pycache__")
+
+        for f in sorted(files):
+            if f in [".manifest.json", ".gitkeep"] or f.endswith(".pyc"):
+                continue
+            full_path = Path(root) / f
+            rel_path = full_path.relative_to(base_dir).as_posix()
+            file_map[rel_path] = compute_file_sha256(full_path)
+
+    return file_map
+
+
+def check_manifest(base_dir):
+    """Check disk files against existing .manifest.json."""
+    base_dir = Path(base_dir).resolve()
+    manifest_file = base_dir / ".manifest.json"
+
+    if not manifest_file.exists():
+        print(f"[ERROR] Missing manifest file: {manifest_file}")
+        return False
+
+    with open(manifest_file, "r", encoding="utf-8") as fh:
+        expected = json.load(fh)
+
+    current = scan_workspace_files(base_dir)
+
+    # Files expected to change during user initialization/configuration
+    USER_CONFIGS = {"config/torusguard.json", "config/scope.json"}
+
+    missing = set(expected.keys()) - set(current.keys())
+    added = set(current.keys()) - set(expected.keys())
+    altered_core = [k for k in expected if k in current and expected[k] != current[k] and k not in USER_CONFIGS]
+    altered_configs = [k for k in expected if k in current and expected[k] != current[k] and k in USER_CONFIGS]
+
+    print("================================================================================")
+    print("TORUSGUARD INTEGRITY MANIFEST VERIFICATION")
+    print("================================================================================")
+    print(f"Directory: {base_dir}")
+    print(f"Indexed Files: {len(expected)}")
+
+    if missing:
+        print(f"\n[FAIL] Missing files ({len(missing)}):")
+        for m in sorted(missing):
+            print(f"  - {m}")
+
+    if altered_core:
+        print(f"\n[FAIL] Altered / Tampered core files ({len(altered_core)}):")
+        for a in sorted(altered_core):
+            print(f"  - {a}")
+
+    if altered_configs:
+        print(f"\n[INFO] Tailored user project configs ({len(altered_configs)}):")
+        for ac in sorted(altered_configs):
+            print(f"  * {ac}")
+
+    if added:
+        print(f"\n[INFO] Untracked new files ({len(added)}):")
+        for ad in sorted(added):
+            print(f"  + {ad}")
+
+    if not missing and not altered_core:
+        print("\n[PASS] 100% of workspace files match cryptographic SHA-256 signatures cleanly.")
+        print("================================================================================")
+        return True
+
+    print("\n================================================================================")
+    print("INTEGRITY VERIFICATION FAILED")
+    print("================================================================================")
+    return False
+
+
+def write_manifest(base_dir):
+    """Write freshly computed manifest to .torusguard/.manifest.json."""
+    base_dir = Path(base_dir).resolve()
+    manifest_file = base_dir / ".manifest.json"
+
+    current = scan_workspace_files(base_dir)
+    with open(manifest_file, "w", encoding="utf-8") as fh:
+        json.dump(current, fh, indent=2)
+
+    print(f"[SUCCESS] Wrote {len(current)} entries to {manifest_file}")
+    return True
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="TorusGuard Manifest Builder & Verifier")
+    parser.add_argument("--dir", default=".torusguard", help="Target .torusguard directory")
+    parser.add_argument("--write", action="store_true", help="Generate and write manifest")
+    parser.add_argument("--check", action="store_true", help="Check workspace against manifest")
+    args = parser.parse_args()
+
+    if args.write:
+        success = write_manifest(args.dir)
+    else:
+        # Default to --check
+        success = check_manifest(args.dir)
+
+    sys.exit(0 if success else 1)

package/.torusguard/scripts/monorepo_detector.py

@@ -0,0 +1,164 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Monorepo & Multi-Package Workspace Detector (v0.9.3)
+Discovers and profiles sub-projects across Turborepo, pnpm, npm, and Python workspaces.
+Pure Python 3.10+ standard library (zero external dependencies).
+"""
+
+import sys
+import os
+import json
+import re
+import argparse
+from pathlib import Path
+from typing import Dict, List, Any, Optional
+
+
+def detect_package_info(abs_pkg_dir: Path, root: Path) -> Dict[str, Any]:
+    """Inspects a single directory to detect language and framework."""
+    rel_path = str(abs_pkg_dir.relative_to(root)).replace('\\', '/')
+    name = abs_pkg_dir.name
+    language = "unknown"
+    framework = "generic"
+
+    pkg_dir = abs_pkg_dir
+
+    # Check typescript / javascript
+    package_json = pkg_dir / "package.json"
+    if package_json.is_file() or list(pkg_dir.glob("*.ts")) or list(pkg_dir.glob("*.js")):
+        language = "typescript"
+        if package_json.is_file():
+            try:
+                with open(package_json, "r", encoding="utf-8") as f:
+                    pj = json.load(f)
+                    name = pj.get("name", name)
+                    deps = {**pj.get("dependencies", {}), **pj.get("devDependencies", {})}
+                    if "next" in deps:
+                        framework = "nextjs"
+                    elif "express" in deps:
+                        framework = "express"
+                    elif "react" in deps:
+                        framework = "react"
+                    elif "vue" in deps or "nuxt" in deps:
+                        framework = "vue"
+            except Exception:
+                pass
+        elif list(pkg_dir.glob("*next*")) or "next" in pkg_dir.name:
+            framework = "nextjs"
+
+    # Check python
+    pyproject = pkg_dir / "pyproject.toml"
+    reqs = pkg_dir / "requirements.txt"
+    if pyproject.is_file() or reqs.is_file() or list(pkg_dir.glob("*.py")):
+        if language == "unknown":
+            language = "python"
+        content = ""
+        if pyproject.is_file():
+            content += pyproject.read_text(encoding="utf-8", errors="replace").lower()
+        if reqs.is_file():
+            content += reqs.read_text(encoding="utf-8", errors="replace").lower()
+        for pyf in pkg_dir.glob("*.py"):
+            content += pyf.read_text(encoding="utf-8", errors="replace").lower()
+        
+        if "fastapi" in content or "fastapi" in pkg_dir.name:
+            framework = "fastapi"
+        elif "django" in content or "django" in pkg_dir.name:
+            framework = "django"
+        elif "flask" in content or "flask" in pkg_dir.name:
+            framework = "flask"
+
+    return {
+        "name": name,
+        "path": rel_path,
+        "language": language,
+        "framework": framework
+    }
+
+
+def scan_workspace(root_dir: str = ".") -> Dict[str, Any]:
+    """Scans root directory for monorepo configuration and sub-packages."""
+    root = Path(root_dir).resolve()
+    monorepo_type = "single-project"
+    sub_packages: List[Dict[str, Any]] = []
+
+    # 1. Turborepo
+    if (root / "turbo.json").is_file():
+        monorepo_type = "turborepo"
+
+    # 2. pnpm workspace
+    pnpm_ws = root / "pnpm-workspace.yaml"
+    if pnpm_ws.is_file():
+        monorepo_type = "pnpm-workspace"
+
+    # 3. npm / yarn workspaces
+    root_pj = root / "package.json"
+    if root_pj.is_file():
+        try:
+            with open(root_pj, "r", encoding="utf-8") as f:
+                data = json.load(f)
+                if "workspaces" in data:
+                    monorepo_type = "npm/yarn-workspaces"
+        except Exception:
+            pass
+
+    # Scan common monorepo container directories and direct project subfolders
+    candidate_folders = ["apps", "packages", "services", "libs", "modules"]
+    found_dirs = []
+    
+    for cf in candidate_folders:
+        container = root / cf
+        if container.is_dir():
+            for child in container.iterdir():
+                if child.is_dir() and not child.name.startswith(('.', '_')):
+                    if any((child / m).exists() for m in ["package.json", "pyproject.toml", "requirements.txt", "setup.py", "Cargo.toml", "main.py"]):
+                        found_dirs.append(child)
+
+    # Also scan direct subdirectories if not already captured
+    for child in root.iterdir():
+        if child.is_dir() and not child.name.startswith(('.', '_')) and child.name not in candidate_folders:
+            if any((child / m).exists() for m in ["package.json", "pyproject.toml", "requirements.txt", "setup.py", "Cargo.toml", "main.py", "actions.ts"]):
+                if child not in found_dirs:
+                    found_dirs.append(child)
+
+    if found_dirs:
+        if monorepo_type == "single-project":
+            monorepo_type = "multi-package-directory"
+        for d in found_dirs:
+            sub_packages.append(detect_package_info(d, root))
+
+    # If no monorepo sub-packages found, treat root as primary
+    if not sub_packages:
+        sub_packages.append(detect_package_info(root, root))
+
+    return {
+        "root": str(root).replace('\\', '/'),
+        "monorepo_type": monorepo_type,
+        "is_monorepo": monorepo_type != "single-project",
+        "package_count": len(sub_packages),
+        "packages": sub_packages
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Monorepo & Multi-Package Detector")
+    parser.add_argument("--scan", default=".", help="Root directory to scan (default: .)")
+    parser.add_argument("--write", action="store_true", help="Write to .torusguard/config/workspaces.json")
+    parser.add_argument("--json", action="store_true", help="Output JSON to stdout")
+    args = parser.parse_args()
+
+    res = scan_workspace(args.scan)
+
+    if args.write:
+        config_dir = Path(args.scan) / ".torusguard" / "config"
+        config_dir.mkdir(parents=True, exist_ok=True)
+        out_file = config_dir / "workspaces.json"
+        with open(out_file, "w", encoding="utf-8") as f:
+            json.dump(res, f, indent=2)
+        print(f"[SUCCESS] Wrote workspace registry to {out_file}")
+
+    if args.json or not args.write:
+        print(json.dumps(res, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/.torusguard/scripts/run_manager.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Run Folder Lifecycle Manager
+Creates isolated run folders, tracks manifest.json state, and enumerates execution history.
+"""
+
+import sys
+import json
+import datetime
+import argparse
+from pathlib import Path
+from typing import Dict, Any, List
+
+def create_run(base_dir: Path, command: str, target_name: str = "project") -> Path:
+    timestamp = datetime.datetime.utcnow().strftime("%Y%m%d-%H%M%S")
+    run_id = f"run-{timestamp}-{command}"
+    run_folder = base_dir / run_id
+    run_folder.mkdir(parents=True, exist_ok=True)
+
+    manifest = {
+        "run_id": run_id,
+        "command": command,
+        "target_name": target_name,
+        "created_at": datetime.datetime.utcnow().isoformat() + "Z",
+        "status": "in_progress",
+        "torusguard_version": "0.8.0",
+        "findings_count": 0,
+        "confirmed_fixed_count": 0,
+        "regressed_count": 0
+    }
+
+    manifest_path = run_folder / "manifest.json"
+    with open(manifest_path, "w", encoding="utf-8") as f:
+        json.dump(manifest, f, indent=2)
+
+    return run_folder
+
+
+def list_runs(base_dir: Path) -> List[Dict[str, Any]]:
+    runs = []
+    if not base_dir.is_dir():
+        return runs
+
+    for d in sorted(base_dir.iterdir(), reverse=True):
+        if d.is_dir() and d.name.startswith("run-"):
+            manifest_file = d / "manifest.json"
+            if manifest_file.is_file():
+                try:
+                    with open(manifest_file, "r", encoding="utf-8") as f:
+                        data = json.load(f)
+                    runs.append(data)
+                except Exception:
+                    runs.append({"run_id": d.name, "status": "corrupted"})
+            else:
+                runs.append({"run_id": d.name, "status": "unmanifested"})
+    return runs
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Run Manager")
+    subparsers = parser.add_subparsers(dest="subcommand")
+
+    create_p = subparsers.add_parser("create")
+    create_p.add_argument("--command", "-c", default="audit", help="TorusGuard command (audit, web-validate, harden, etc.)")
+    create_p.add_argument("--target", "-t", default="project", help="Target project name")
+    create_p.add_argument("--dir", "-d", default=".torusguard/runs", help="Base runs directory")
+
+    list_p = subparsers.add_parser("list")
+    list_p.add_argument("--dir", "-d", default=".torusguard/runs", help="Base runs directory")
+    list_p.add_argument("--json", action="store_true", help="Output JSON")
+
+    args = parser.parse_args()
+
+    if args.subcommand == "create":
+        folder = create_run(Path(args.dir), args.command, args.target)
+        print(f"Created run folder: {folder}")
+    elif args.subcommand == "list":
+        runs = list_runs(Path(args.dir))
+        if args.json:
+            print(json.dumps(runs, indent=2))
+        else:
+            print(f"Total Runs Found: {len(runs)}")
+            for r in runs:
+                print(f"  - {r.get('run_id')}: command={r.get('command')}, status={r.get('status')}")
+    else:
+        parser.print_help()
+
+if __name__ == "__main__":
+    main()

package/.torusguard/scripts/safety_gate.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Runtime Safety Gate Evaluator
+Evaluates prospective HTTP/browser validation probes against non-destruction policies.
+"""
+
+import sys
+import json
+import argparse
+from typing import Dict, Any, Tuple
+
+def evaluate_safety_gate(method: str, path: str, body: str = "") -> Tuple[str, str]:
+    """
+    Returns (decision, rationale)
+    Decisions:
+    - Auto-Allowed
+    - Approval Required
+    - Manual Only (Blocked)
+    """
+    method_upper = method.upper()
+
+    # Block destructive verbs
+    if method_upper in ("DELETE", "DROP"):
+        return "Manual Only", f"Method '{method_upper}' is destructive and strictly blocked from automated runtime validation."
+
+    # Block sensitive administrative paths
+    destructive_keywords = ["/admin/delete", "/shutdown", "/drop-database", "/purge", "/reset-system"]
+    for kw in destructive_keywords:
+        if kw in path.lower():
+            return "Manual Only", f"Path '{path}' targets destructive administrative endpoint '{kw}'."
+
+    # Safe read methods
+    if method_upper in ("GET", "HEAD", "OPTIONS"):
+        return "Auto-Allowed", f"Read-only method '{method_upper}' with non-destructive path."
+
+    # State-changing methods (POST, PUT, PATCH)
+    if method_upper in ("POST", "PUT", "PATCH"):
+        # Check if safe canary marker exists
+        if "tg-canary" in body.lower() or "torusguard" in body.lower():
+            return "Approval Required", f"State-changing method '{method_upper}' contains benign TorusGuard test marker; requires user approval."
+        else:
+            return "Approval Required", f"State-changing method '{method_upper}' requires operator approval before execution."
+
+    return "Approval Required", f"Unknown probe profile for {method_upper} {path}."
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Safety Gate Evaluator")
+    parser.add_argument("--method", "-m", default="GET", help="HTTP Method")
+    parser.add_argument("--path", "-p", default="/api/test", help="Endpoint path")
+    parser.add_argument("--body", "-b", default="", help="Request payload body")
+    parser.add_argument("--json", action="store_true", help="Output JSON")
+    args = parser.parse_args()
+
+    decision, rationale = evaluate_safety_gate(args.method, args.path, args.body)
+
+    if args.json:
+        print(json.dumps({"decision": decision, "rationale": rationale}, indent=2))
+    else:
+        print(f"Safety Decision: {decision}")
+        print(f"Rationale: {rationale}")
+
+if __name__ == "__main__":
+    main()

package/.torusguard/scripts/sarif_exporter.py

@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+"""
+TorusGuard OASIS SARIF v2.1.0 Exporter
+Converts normalized TorusGuard findings into standard SARIF v2.1.0 format with
+GitHub Code Scanning multi-analysis category separation and partialFingerprints deduplication.
+"""
+
+import sys
+import json
+import hashlib
+import argparse
+from typing import List, Dict, Any
+
+def generate_sarif(findings: List[Dict[str, Any]], run_id: str = "default", category: str = "torusguard/static") -> Dict[str, Any]:
+    rules_map: Dict[str, Dict[str, Any]] = {}
+    results: List[Dict[str, Any]] = []
+
+    for f in findings:
+        rule_id = f.get("rule_id", "TG-GEN-001")
+        if rule_id not in rules_map:
+            rules_map[rule_id] = {
+                "id": rule_id,
+                "name": f.get("title", rule_id),
+                "shortDescription": {"text": f.get("title", rule_id)},
+                "fullDescription": {"text": f.get("description", f.get("title", rule_id))},
+                "defaultConfiguration": {
+                    "level": "error" if f.get("severity") in ("Critical", "High") else "warning"
+                },
+                "properties": {
+                    "tags": ["security", "torusguard", f.get("category", "general")]
+                }
+            }
+
+        target = f.get("target", {})
+        file_path = target.get("file_path", "unknown")
+        line = target.get("start_line", 1)
+
+        # Generate deduplication fingerprint
+        seed = f"{rule_id}:{file_path}:{line}"
+        line_hash = hashlib.sha256(seed.encode("utf-8")).hexdigest()[:16]
+
+        result: Dict[str, Any] = {
+            "ruleId": rule_id,
+            "message": {"text": f.get("title", "TorusGuard Security Finding")},
+            "level": "error" if f.get("severity") in ("Critical", "High") else "warning",
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {
+                            "uri": file_path,
+                            "uriBaseId": "%SRCROOT%"
+                        },
+                        "region": {
+                            "startLine": line,
+                            "startColumn": 1
+                        }
+                    }
+                }
+            ],
+            "partialFingerprints": {
+                "primaryLocationLineHash": line_hash
+            },
+            "properties": {
+                "confidence": f.get("confidence", 70),
+                "status": f.get("status", "Confirmed"),
+                "finding_id": f.get("finding_id", "TG-FIND-UNKNOWN")
+            }
+        }
+        results.append(result)
+
+    sarif = {
+        "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "TorusGuard",
+                        "semanticVersion": "0.8.0",
+                        "informationUri": "https://github.com/githubmofo/TorusGuard",
+                        "rules": list(rules_map.values())
+                    }
+                },
+                "automationDetails": {
+                    "id": f"{category}/{run_id}"
+                },
+                "results": results
+            }
+        ]
+    }
+    return sarif
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard SARIF v2.1.0 Exporter")
+    parser.add_argument("--input", "-i", help="Path to findings JSON file")
+    parser.add_argument("--output", "-o", help="Output path for sarif.json")
+    parser.add_argument("--run-id", default="run-default", help="Unique execution Run ID")
+    args = parser.parse_args()
+
+    findings = []
+    if args.input:
+        with open(args.input, "r", encoding="utf-8") as f:
+            findings = json.load(f)
+
+    sarif = generate_sarif(findings, run_id=args.run_id)
+
+    if args.output:
+        with open(args.output, "w", encoding="utf-8") as f:
+            json.dump(sarif, f, indent=2)
+        print(f"SARIF log written to: {args.output}")
+    else:
+        print(json.dumps(sarif, indent=2))
+
+if __name__ == "__main__":
+    main()