torusguard 0.9.4 → 1.0.0

package/.torusguard/.manifest.json

@@ -8,7 +8,7 @@
   "agents/validator.md": "79fc4431de5c5507f8730aee6c5c3e61fd238cbf8cf8c7c6aac462eee9761ed6",
   "config/scope.json": "b198a86186b4c6d5e1af516bf4e3a6afa8878e622ca1d57a5bf72d294f8c6f25",
   "config/slash-commands.json": "5390f0d26f8117a62e56c58147d3a0d2deab1a20956302b212703281d13fa84e",
-  "config/torusguard.json": "218eeae10b538aca9b548d1b756d7d4f91a5b624e0bce07533f0c187860586e6",
+  "config/torusguard.json": "b979d6ead31e64a63729e050d820f3e3228d3c825972a60ccae2087e6b27f574",
   "references/django-security.md": "a15b7eb11b51dd1970d3d65544cf79ebea91fb99dc0e085e58a56532a718dce7",
   "references/drf-security.md": "c7a7af3acaef895bf4798590acc88b3a2e9831a49eb2d23b4d8f31540ab264cc",
   "references/express-security.md": "dff1db15e614d29d8c272f9da345b418077e62dc883fe210c7a50c552c76493f",
@@ -28,20 +28,24 @@
   "schemas/confidence.schema.json": "08b3a564d7370e123dd5bfadde9fb077d2954e36b523685b9e1d7bdd2aa4b8cb",
   "schemas/evidence.schema.json": "d3dcaa10fd2420a4046ea68836fb836a55d003ada4cdc6682229f232881182bf",
   "schemas/finding.schema.json": "e0a7c28fa4a5f84bdedb5cf5223da26348250d633479d2dbf7ce3ebd6790a852",
+  "schemas/memory-context.schema.json": "6b9e032c55ba87b2517dd1e7ca0043b8e2439e85fa4a6eac6fc6041f3091e571",
+  "schemas/memory-event.schema.json": "4f653610e04fd480325d0ec77a4339bea4690f85e1d2fa0bd4f6b654c813c905",
+  "schemas/memory-pattern.schema.json": "df4aae2a3034a7c64ec50b3ae27b6ee9296aac7371c2a1938508834e5f778afe",
   "schemas/provenance.schema.json": "781215801249532414643638b6608dc8f52febc9bca43ae03827b90aecc03256",
   "schemas/remediation.schema.json": "217cb2743ae1a912dc074382e9f05634da93f2e30a880c03f6020600ef7e43d3",
   "schemas/retest.schema.json": "773b764082f6d2e8c3656ea105e0ce09febd1020520bf262bbcd17f5924da11e",
   "schemas/runtime-evidence.schema.json": "dbe13741a7fb68cca2a044d47a644ee0bdaacb83a28621dc2a98bffdd59989a6",
-  "scripts/diff_guard.py": "227bf56d2e6c9aef293a51ad1a3209782e6d9204dc1775956d372c3a6851a736",
-  "scripts/finding_scorer.py": "b78c6315f22000fb64f5d4e6ff1f3467439769d3d5507aaa99380453df4eb464",
-  "scripts/manifest_builder.py": "b759131592966053db17ef710dc5f313127a9583295cb867a39ab22a7c996580",
+  "scripts/diff_guard.py": "5937b657c1047c78b7b9f0a36f3438cb699457cdb5ee56136d68b97edf56af42",
+  "scripts/finding_scorer.py": "c9f34c9153f5322c92bba824ce199ea281c450cd8edc637e61442c5f556d6183",
+  "scripts/manifest_builder.py": "136d5650a97dbb52fdf42c6d55b330a4f9593816e344b07913b0b2ba6b5cc409",
+  "scripts/memory_engine.py": "e99d34951b953bf3d96b6fca2413192de76778e6519278d4213fa3a72bc9b05f",
   "scripts/monorepo_detector.py": "38f1eb948ee2856f175e1212956bce211effdd1327d3a31f7303d32ba9478ebe",
-  "scripts/run_manager.py": "e853874e4fb0cb697596ea338f71ba7e955f2b41a6fc649733b45fa755e94768",
+  "scripts/run_manager.py": "b576fc3be9929ee6a52e67662e67f801e4e9317c158243582911e10c94a07619",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
   "scripts/sarif_exporter.py": "35c66637413afc4b72d5bd426638447c77231d2a8594dce5addceffd4803a20d",
   "scripts/stack_detect.py": "99b7bdf9829d58ff5b8c59afd6e8b6429bbb11d830ac73dec491101cbbc41574",
-  "skills/torusguard/SKILL.md": "5282a9e73c2faad97f079ff527def34b96709615c0dd297fe9b1bb2894f03e20",
-  "skills/torusguard/bootstrap.py": "7e348065a622089ab1d51e9bf4864e5b0022aaee1ccb2ecbf7057c14e792e2c7",
+  "skills/torusguard/SKILL.md": "e772e348716aee26e424ec96be5bd6750dbebcefc248bc4dab0df1e6c0e24fcf",
+  "skills/torusguard/bootstrap.py": "7c5a13687578a8736aef25cf767d1ef3c8b82dcae0eb7efce41bf131d27a120f",
   "skills/torusguard/references/auth-and-sessions.md": "34c2843f8c0dbe3574e54f00a39a92a1f431527ec5f69b2d64c84240d424a39e",
   "skills/torusguard/references/business-logic-and-abuse.md": "0d6088936bc1a01023070332fccef0f2e0734358a5119379055f3d2895c22567",
   "skills/torusguard/references/cache-and-sensitive-responses.md": "8f920cacde29c50b1f5f98de341a60db0bc607fe8c212a7e618ef7af08c86511",
@@ -66,13 +70,13 @@
   "skills/torusguard/references/webhook-security.md": "a0c7efb663c664dd840ba99b689cb67d4688643106f8b6e80d18a424c6add386",
   "skills/torusguard/references/websocket-security.md": "5624a84abd75bbb4eed029cd217e0c794ee452cbecc0730a8ab4d0f371537cd7",
   "skills/torusguard-apply/SKILL.md": "9436fa5cdefa661677ada22936a3949de06aca276e4f4bb27e0ef5b7ea34edc3",
-  "skills/torusguard-audit/SKILL.md": "d0e0c21d6c36d9d128ccce6ad628b978ff771d27552ba80e0a4981e18b9f5a51",
+  "skills/torusguard-audit/SKILL.md": "f879e280d357ea7f124c647ce39af2b24b79db608c9edd018f26e5312625a8b5",
   "skills/torusguard-authorize/SKILL.md": "da849585f2e46c08ef528b89737be14647f1109fd365fd27f3f6da57a396724b",
   "skills/torusguard-exploit-check/SKILL.md": "e9a173e154a88cc9cb929c59d79a65ab13d5cf9567b4112bd7f272746cf9c3f9",
   "skills/torusguard-full/SKILL.md": "cc97684d37de378e51fefd12f6f9a7cd15cc469ce46079a0599440aa7b073f7b",
-  "skills/torusguard-harden/SKILL.md": "86a8dee6c614477e2122287752f5c16e3688c0451d0e7ae9bfd2a23802bcdde3",
+  "skills/torusguard-harden/SKILL.md": "326fa84bda4832f96b19d73824c3472dfe185247ed3e3db9715dd943d46d9874",
   "skills/torusguard-init/SKILL.md": "1f7844d66219955581fdb266029eefdc355dbebb5741b848daf0062e606202a2",
-  "skills/torusguard-recheck/SKILL.md": "4725a9be6a6ddedb3d389d1957c7ce3e0f9ce288107816fce85b5953951e13e5",
+  "skills/torusguard-recheck/SKILL.md": "457b2a1cce064a738fbe43f0dba6b4393f1630a82f60698ea5ebe655ec017e50",
   "skills/torusguard-report/SKILL.md": "bde44d114bdc85c04472644a644a7796ed2f182a23e0c057838a3251e4910a09",
   "skills/torusguard-status/SKILL.md": "4e71d03c71b240afd7f6108569530b7da3702634c512a74ca8dc3174f3c6b0fb",
   "skills/torusguard-verify/SKILL.md": "10c19e0926255686351e3b75ae774880cf35562d42bd30b87a877bb8f284fc1f",
@@ -87,6 +91,7 @@
   "workflows/exploit-check.md": "9684009b835a61d5aca8827a971ee686a24c800425d86ef96f963dd27de845b8",
   "workflows/harden.md": "509484f844c9dcd10dd14c8bb6e3456021928e6cf6abd374faaf34be8fc34ce2",
   "workflows/init.md": "3d1668a9f6b87417c31f47c887c495f863595ed4a29074e0c5a8ee1ece1d4a35",
+  "workflows/memory.md": "c034f9266380db3c05e9ffed943c2bb4ba73c060507e3508e47b543a035a5873",
   "workflows/recheck.md": "7d374c29a5585c31b81f84fb32d6a466f2e9cb339726dc0523dba25e57bc5d13",
   "workflows/report.md": "56b3449cff362172c63093ee6150446d11bf05e3c8143661966dad9d42df1470",
   "workflows/status.md": "921129646518c592cb47ad8e8ccf3d703e8d11ea6eb89bd21a206f545e022dba",

package/.torusguard/config/torusguard.json

@@ -1,6 +1,6 @@
 {
   "$schema": "../schemas/torusguard-config.schema.json",
-  "version": "0.9.4",
+  "version": "1.0.0",
   "product": "TorusGuard Security Skill Kit",
   "severity_threshold": "medium",
   "auto_detect_stack": true,

package/.torusguard/schemas/memory-context.schema.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-context.schema.json",
+  "title": "TorusGuard Memory Context Window",
+  "description": "Pre-computed, token-budgeted context window for AI agent consumption formatted as structured JSON cards.",
+  "type": "object",
+  "required": ["version", "generated_at", "token_estimate", "max_token_budget", "project_profile", "cards"],
+  "properties": {
+    "version": {
+      "type": "string",
+      "description": "TorusGuard engine version (e.g., 1.0.0)."
+    },
+    "generated_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 UTC timestamp when this context window was computed."
+    },
+    "token_estimate": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Estimated token count of this context document."
+    },
+    "max_token_budget": {
+      "type": "integer",
+      "default": 2000,
+      "description": "Maximum allowed tokens for agent context injection (default: 2000)."
+    },
+    "project_profile": {
+      "type": "object",
+      "required": ["stack", "total_events", "active_patterns_count"],
+      "properties": {
+        "stack": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Detected technology stack frameworks/languages."
+        },
+        "total_events": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "active_patterns_count": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "fix_rate_percentage": {
+          "type": ["number", "null"],
+          "minimum": 0,
+          "maximum": 100
+        },
+        "top_vulnerabilities": {
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      }
+    },
+    "cards": {
+      "type": "array",
+      "description": "Ordered list of high-priority intelligence cards for LLM grounding.",
+      "items": {
+        "type": "object",
+        "required": ["card_id", "card_type", "priority", "title", "summary", "card_data"],
+        "properties": {
+          "card_id": {
+            "type": "string",
+            "description": "Unique card identifier (e.g., CARD-001)."
+          },
+          "card_type": {
+            "type": "string",
+            "enum": ["pattern", "profile", "regression_watch", "false_positive", "fix_idiom"],
+            "description": "Semantic category of this context card."
+          },
+          "priority": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 100,
+            "description": "Rank order priority (higher = more relevant/critical)."
+          },
+          "title": {
+            "type": "string",
+            "description": "Short, human-readable and agent-scannable card title."
+          },
+          "summary": {
+            "type": "string",
+            "description": "One-line operational summary for rapid agent reasoning."
+          },
+          "card_data": {
+            "type": "object",
+            "description": "Structured card payload containing rule_id, fix_strategy, confidence, affected_files, etc.",
+            "additionalProperties": true
+          }
+        }
+      }
+    }
+  }
+}

package/.torusguard/schemas/memory-event.schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-event.schema.json",
+  "title": "TorusGuard Memory Event",
+  "description": "Schema for individual memory events recorded during audit/fix/recheck cycles.",
+  "type": "object",
+  "required": ["event_id", "event_type", "timestamp", "version"],
+  "properties": {
+    "event_id": {
+      "type": "string",
+      "description": "Unique event identifier (UUID v4 or timestamp-based)."
+    },
+    "event_type": {
+      "type": "string",
+      "enum": ["audit_finding", "fix_applied", "fix_verified", "false_positive", "pattern_learned", "stack_changed"],
+      "description": "Category of security event."
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 UTC timestamp."
+    },
+    "version": {
+      "type": "string",
+      "description": "TorusGuard version that recorded this event."
+    },
+    "rule_id": {
+      "type": ["string", "null"],
+      "description": "TorusGuard rule ID (e.g., TG-DB-004)."
+    },
+    "file_path": {
+      "type": ["string", "null"],
+      "description": "Relative file path within the project."
+    },
+    "line_number": {
+      "type": ["integer", "null"],
+      "description": "Line number of the finding."
+    },
+    "severity": {
+      "type": ["string", "null"],
+      "enum": ["critical", "high", "medium", "low", "info", null]
+    },
+    "confidence_score": {
+      "type": ["integer", "null"],
+      "minimum": 0,
+      "maximum": 100
+    },
+    "code_hash": {
+      "type": ["string", "null"],
+      "description": "SHA-256 hash of the relevant code snippet for pattern matching."
+    },
+    "fix_strategy": {
+      "type": ["string", "null"],
+      "description": "Human-readable description of the fix approach used."
+    },
+    "verification_result": {
+      "type": ["string", "null"],
+      "enum": ["fixed", "regressed", "partial", "not_tested", null]
+    },
+    "suppression_reason": {
+      "type": ["string", "null"],
+      "description": "Reason for false positive suppression."
+    },
+    "metadata": {
+      "type": "object",
+      "description": "Additional event-specific metadata.",
+      "additionalProperties": true
+    }
+  }
+}

package/.torusguard/schemas/memory-pattern.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-pattern.schema.json",
+  "title": "TorusGuard Memory Pattern",
+  "description": "Schema for distilled security patterns extracted from raw events. Patterns represent recurring fix strategies, vulnerability classes, and project-specific security idioms.",
+  "type": "object",
+  "required": ["pattern_id", "rule_id", "pattern_type", "confidence", "occurrences", "first_seen", "last_seen"],
+  "properties": {
+    "pattern_id": {
+      "type": "string",
+      "description": "Unique pattern identifier (PAT-NNN)."
+    },
+    "rule_id": {
+      "type": "string",
+      "description": "TorusGuard rule ID this pattern relates to."
+    },
+    "pattern_type": {
+      "type": "string",
+      "enum": ["recurring_fix", "common_vulnerability", "false_positive_class", "regression_watch", "security_idiom"],
+      "description": "Category of the distilled pattern."
+    },
+    "description": {
+      "type": "string",
+      "description": "Human-readable summary of the pattern."
+    },
+    "fix_strategy": {
+      "type": ["string", "null"],
+      "description": "The preferred fix approach observed across multiple occurrences."
+    },
+    "confidence": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 100,
+      "description": "Pattern confidence (amplified by repeated confirmations, decayed by TTL)."
+    },
+    "occurrences": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Number of times this pattern has been observed."
+    },
+    "affected_files": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "List of relative file paths where this pattern has been observed."
+    },
+    "first_seen": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "last_seen": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "decay_checkpoint": {
+      "type": ["string", "null"],
+      "format": "date-time",
+      "description": "Last timestamp when this pattern's confidence was reconfirmed or decayed."
+    },
+    "source_events": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "List of event_ids that contributed to this pattern."
+    }
+  }
+}

package/.torusguard/scripts/diff_guard.py

@@ -1,7 +1,8 @@
 #!/usr/bin/env python3
 """
-TorusGuard Content-Aware Diff Line Scanner (v0.9.3)
-Evaluates unified diff patches against security invariants before harden or apply.
+TorusGuard Content-Aware Diff Line Scanner (v1.0.0)
+Evaluates unified diff patches against security invariants before harden or apply,
+including regression watch checks against persistent memory patterns.
 Pure Python 3.10+ standard library (zero external dependencies).
 """
 
@@ -38,16 +39,69 @@ TENANT_FILTER_PATTERNS = [
 ]
 
 
-def audit_diff(diff_content: str) -> Dict[str, Any]:
+def check_memory_regressions(
+    current_file: str,
+    current_line: int,
+    added_content: str,
+    root_dir: Optional[Path] = None
+) -> List[Dict[str, Any]]:
+    """
+    Check if the added line re-introduces a vulnerability in a file
+    that is tracked under active Regression Watch in .torusguard/memory/patterns.json.
+    """
+    violations = []
+    base = Path(root_dir or Path.cwd()).resolve()
+    torusguard_dir = base / ".torusguard"
+    if not torusguard_dir.exists():
+        for parent in base.parents:
+            if (parent / ".torusguard").exists():
+                torusguard_dir = parent / ".torusguard"
+                break
+
+    patterns_file = torusguard_dir / "memory" / "patterns.json"
+    if not patterns_file.exists():
+        return violations
+
+    try:
+        with open(patterns_file, "r", encoding="utf-8") as f:
+            patterns = json.load(f)
+    except Exception:
+        return violations
+
+    clean_file = current_file.replace("\\", "/")
+    for pat in patterns:
+        if pat.get("pattern_type") == "regression_watch":
+            affected = [f.replace("\\", "/") for f in pat.get("affected_files", [])]
+            if clean_file in affected or any(clean_file.endswith(a) for a in affected):
+                rule_id = pat.get("rule_id", "TG-REG")
+                desc = pat.get("description", "Regression watch violation")
+                violations.append({
+                    "rule_id": "TG-DIFF-004",
+                    "category": "Regression Watch",
+                    "severity": "HIGH",
+                    "file": current_file,
+                    "line": current_line,
+                    "content": added_content.strip(),
+                    "description": f"File {current_file} matches active Regression Watch for {rule_id}: {desc}"
+                })
+    return violations
+
+
+def audit_diff(
+    diff_content: str,
+    check_memory: bool = False,
+    root_dir: Optional[Path] = None
+) -> Dict[str, Any]:
     """
     Parses a unified diff and returns detected violations.
+    Optionally checks against active regression watch patterns in memory.
     """
     lines = diff_content.splitlines()
     violations: List[Dict[str, Any]] = []
-    
+
     current_file = "unknown"
     current_line = 0
-    
+
     additions: List[tuple[int, str]] = []
     deletions: List[tuple[int, str]] = []
 
@@ -68,7 +122,7 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
             current_line += 1
             added_content = line[1:]
             additions.append((current_line, added_content))
-            
+
             # Check bypass patterns
             for pat, desc in BYPASS_PATTERNS:
                 if pat.search(added_content):
@@ -81,7 +135,7 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
                         "content": added_content.strip(),
                         "description": desc
                     })
-                    
+
             # Check secret ingestion
             for pat, desc in SECRET_PATTERNS:
                 if pat.search(added_content):
@@ -95,6 +149,11 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
                         "description": desc
                     })
 
+            # Check memory regression watch if requested
+            if check_memory:
+                reg_violations = check_memory_regressions(current_file, current_line, added_content, root_dir=root_dir)
+                violations.extend(reg_violations)
+
         elif line.startswith('-') and not line.startswith('---'):
             deleted_content = line[1:]
             deletions.append((line_idx, deleted_content))
@@ -127,7 +186,7 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
     }
 
 
-def audit_diff_file(file_path: str) -> Dict[str, Any]:
+def audit_diff_file(file_path: str, check_memory: bool = False, root_dir: Optional[Path] = None) -> Dict[str, Any]:
     path = Path(file_path)
     if not path.is_file():
         return {
@@ -136,23 +195,24 @@ def audit_diff_file(file_path: str) -> Dict[str, Any]:
             "violations": []
         }
     content = path.read_text(encoding="utf-8", errors="replace")
-    return audit_diff(content)
+    return audit_diff(content, check_memory=check_memory, root_dir=root_dir)
 
 
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Unified Diff Security Scanner")
     parser.add_argument("diff_path", nargs="?", help="Path to unified diff file (or read stdin if omitted)")
+    parser.add_argument("--check-memory", action="store_true", help="Check additions against persistent memory regression watch patterns")
     parser.add_argument("--json", action="store_true", help="Output results as JSON")
     args = parser.parse_args()
 
     if args.diff_path:
-        res = audit_diff_file(args.diff_path)
+        res = audit_diff_file(args.diff_path, check_memory=args.check_memory)
     else:
         if sys.stdin.isatty():
             parser.print_help()
             sys.exit(1)
         diff_text = sys.stdin.read()
-        res = audit_diff(diff_text)
+        res = audit_diff(diff_text, check_memory=args.check_memory)
 
     if args.json:
         print(json.dumps(res, indent=2))