torusguard 0.9.4 → 1.0.0

package/.torusguard/skills/torusguard/bootstrap.py

@@ -10,9 +10,33 @@ import sys
 import shutil
 import json
 import argparse
-import subprocess
 from pathlib import Path
 
+# Ensure UTF-8 stdout/stderr on Windows consoles
+if sys.stdout and hasattr(sys.stdout, "reconfigure"):
+    try:
+        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+if sys.stderr and hasattr(sys.stderr, "reconfigure"):
+    try:
+        sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+# ─── ANSI Color Helpers ───────────────────────────────────────────────────────
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+CYAN = "\033[36m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+WHITE = "\033[97m"
+GRAY = "\033[90m"
+RED = "\033[31m"
+BG_GREEN = "\033[42m"
+BG_CYAN = "\033[46m"
+
 
 def find_project_root(start_dir=None):
     """Detect project root directory by searching for standard repo root markers."""
@@ -33,36 +57,141 @@ def find_project_root(start_dir=None):
     return current
 
 
-def scaffold_workspace(target_root=None, force=False):
+def print_header():
+    """Print the branded TorusGuard header card."""
+    print(f"""
+  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
+  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v0.9.5{RESET}   {CYAN}│{RESET}
+  {CYAN}│{RESET}   {DIM}Autonomous Security Engine for AI-Built Applications{RESET}               {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
+  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
+""")
+
+
+def print_step_1_assets(file_count):
+    """Print the enhanced Step 1 asset unpacking card."""
+    print(f"""  {CYAN}┌─ {BOLD}Step 1/3{RESET} {CYAN}──────────────────────── {WHITE}Unpacking Governance Assets{RESET} {CYAN}──────┐{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Canonical security rules            {DIM}71 rules across 11 families{RESET}  {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} JSON validation schemas             {DIM}8 formal schemas{RESET}             {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Specialist agent specifications     {DIM}5 isolated agents{RESET}            {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Workflow templates                   {DIM}11 slash commands{RESET}            {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Framework reference guides           {DIM}10 security guides{RESET}           {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}                                               {BOLD}{WHITE}{file_count} files unpacked{RESET}   {CYAN}│{RESET}
+  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+
+def print_step_2_profile(detected_stack=None):
+    """Print the security profile & coverage card (in-process stack alignment)."""
+    if detected_stack and detected_stack.get("framework") and detected_stack.get("framework") != "None":
+        fw = str(detected_stack.get("framework"))
+        lang = str(detected_stack.get("language", ""))
+        label = f"Auto-aligned stack: {fw} ({lang})"
+        pad = " " * max(0, 66 - len(label))
+        status_line = f"  {CYAN}│{RESET}   {GREEN}✔{RESET} {BOLD}Auto-aligned stack:{RESET} {WHITE}{fw}{RESET} {DIM}({lang}){RESET}{pad}{CYAN}│{RESET}"
+    else:
+        status_line = f"  {CYAN}│{RESET}   {DIM}ℹ Stack auto-detected on first /torusguard-audit run{RESET}              {CYAN}│{RESET}"
+
+    print(f"""  {CYAN}┌─ {BOLD}Step 2/3{RESET} {CYAN}──────────────────── {WHITE}Security Profile & Coverage{RESET} {CYAN}────────┐{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}Rule Families:{RESET}                                                      {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-SEC{RESET}     Secrets & Credentials    {YELLOW}TG-DB{RESET}      Database Safety    {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-INPUT{RESET}   Input Validation         {YELLOW}TG-AUTH{RESET}    Authentication     {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-CLIENT{RESET}  Client Bundle Leaks      {YELLOW}TG-DIFF{RESET}    Diff Inspection    {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-AGENT{RESET}   AI Agent Security        {YELLOW}TG-EDGE{RESET}    Serverless         {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-SUPPLY{RESET}  Supply Chain & CI/CD     {YELLOW}TG-SSRF{RESET}    Outbound Net       {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-BIZ{RESET}     Business Logic                                      {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}Supported Stacks:{RESET}                                                  {CYAN}│{RESET}
+  {CYAN}│{RESET}     {GREEN}Python{RESET}    Django {DIM}·{RESET} FastAPI {DIM}·{RESET} Flask {DIM}·{RESET} DRF {DIM}·{RESET} SQLAlchemy              {CYAN}│{RESET}
+  {CYAN}│{RESET}     {GREEN}Node.js{RESET}   Next.js {DIM}·{RESET} Express {DIM}·{RESET} React {DIM}·{RESET} Supabase {DIM}·{RESET} Firebase       {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+{status_line}
+  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+
+def print_step_3_bridges(registered_ides):
+    """Print the IDE command registration card."""
+    lines = ""
+    for r in registered_ides:
+        lines += f"  {CYAN}│{RESET}   {GREEN}✔{RESET} {r:<67} {CYAN}│{RESET}\n"
+
+    print(f"""  {CYAN}┌─ {BOLD}Step 3/3{RESET} {CYAN}─────────────────── {WHITE}AI IDE Command Registration{RESET} {CYAN}─────────┐{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+{lines}  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+
+def print_success_card():
+    """Print the final success card with next steps."""
+    print(f"""  {GREEN}╔═══════════════════════════════════════════════════════════════════════╗{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}   {GREEN}{BOLD}✅  WORKSPACE INITIALIZED SUCCESSFULLY{RESET}                               {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}╠═══════════════════════════════════════════════════════════════════════╣{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}   {BOLD}Next Steps:{RESET}                                                         {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}    {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard-audit{RESET}  or  {WHITE}/torusguard{RESET}              {GREEN}║{RESET}
+  {GREEN}║{RESET}    {CYAN}2.{RESET} In Terminal      {WHITE}npx torusguard status{RESET}                       {GREEN}║{RESET}
+  {GREEN}║{RESET}    {CYAN}3.{RESET} In CI/CD         {WHITE}npx torusguard audit{RESET}                        {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}   {DIM}Docs{RESET}   {CYAN}https://github.com/githubmofo/TorusGuard{RESET}                   {GREEN}║{RESET}
+  {GREEN}║{RESET}   {DIM}NPM{RESET}    {CYAN}https://npmjs.com/package/torusguard{RESET}                       {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}╚═══════════════════════════════════════════════════════════════════════╝{RESET}
+""")
+
+
+def print_already_initialized(target_root, cfg):
+    """Print the already-initialized status card."""
+    print(f"""
+  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
+  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}                           {GREEN}[Active]{RESET}         {CYAN}│{RESET}
+  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
+
+  {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
+  {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.0.0')}{RESET}
+  {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
+
+  {DIM}To refresh templates or re-scaffold, run:{RESET}
+     {CYAN}npx torusguard init --force{RESET}
+""")
+
+
+def scaffold_workspace(target_root=None, force=False, full_commands=False):
     """Scaffold the .torusguard workspace into the target project root."""
     target_root = Path(target_root or find_project_root()).resolve()
     torusguard_target = target_root / ".torusguard"
     script_dir = Path(__file__).resolve().parent
     payload_dir = script_dir / "payload"
 
-    print("================================================================================")
-    print("TORUSGUARD WORKSPACE BOOTSTRAPPER")
-    print("================================================================================")
-    print(f"Target Directory: {target_root}")
-    print(f"Destination:      {torusguard_target}")
-
     if torusguard_target.exists() and not force:
-        print(f"\n[INFO] Workspace already exists at {torusguard_target}")
         config_file = torusguard_target / "config" / "torusguard.json"
+        cfg = {}
         if config_file.exists():
             try:
                 with open(config_file, "r", encoding="utf-8") as f:
                     cfg = json.load(f)
-                print(f"Current Version:   {cfg.get('version', 'unknown')}")
-                print(f"Severity Minimum:  {cfg.get('severity_threshold', 'medium')}")
             except Exception:
                 pass
-        print("\nUse --force to re-scaffold or refresh templates.")
+        print_already_initialized(target_root, cfg)
         return True
 
-    # 1. Unpack Payload Template
+    # ── Header ──────────────────────────────────────────────────────────────
+    print_header()
+    print(f"  {BOLD}▸ Target Project:{RESET}     {WHITE}{target_root}{RESET}")
+    print(f"  {BOLD}▸ Destination:{RESET}        {WHITE}{torusguard_target}{RESET}")
+
+    # ── Step 1: Unpack Payload ──────────────────────────────────────────────
+    file_count = 93
     if payload_dir.is_dir():
-        print("\n1. Unpacking bundled offline workspace payload...")
         try:
             if torusguard_target.exists() and force:
                 shutil.rmtree(torusguard_target)
@@ -71,22 +200,25 @@ def scaffold_workspace(target_root=None, force=False):
                 torusguard_target,
                 ignore=shutil.ignore_patterns("runs", "*.pyc", "__pycache__", ".git*")
             )
-            print("  [SUCCESS] Copied template tree from local skill payload.")
+            # Count actual files
+            file_count = sum(1 for _ in torusguard_target.rglob("*") if _.is_file())
         except Exception as e:
-            print(f"  [ERROR] Failed to unpack payload: {e}")
+            print(f"\n  {RED}✖ Failed to unpack payload: {e}{RESET}")
             return False
     else:
         # Fallback: create base structure
-        print("\n1. Bundled payload not found. Creating core skeleton...")
         subdirs = [
             "config", "agents", "workflows", "scripts", "templates",
             "schemas", "references", "rules/active", "runs"
         ]
         for s in subdirs:
             (torusguard_target / s).mkdir(parents=True, exist_ok=True)
-        print("  [WARN] Bare skeleton created; full assets should be pulled from repository.")
+        file_count = 0
+
+    print()
+    print_step_1_assets(file_count)
 
-    # 2. Ensure runs and rules/active directories exist
+    # ── Ensure runs and rules/active directories exist ──────────────────────
     runs_dir = torusguard_target / "runs"
     runs_dir.mkdir(parents=True, exist_ok=True)
     gitkeep_runs = runs_dir / ".gitkeep"
@@ -99,52 +231,207 @@ def scaffold_workspace(target_root=None, force=False):
     if not gitkeep_rules.exists():
         gitkeep_rules.write_text("", encoding="utf-8")
 
-    # 3. Stack Detection & Tailoring
-    print("\n2. Executing stack detection on target project...")
+    # ── Ensure memory subsystem is initialized (v1.0.0) ────────────────────
+    memory_dir = torusguard_target / "memory"
+    memory_dir.mkdir(parents=True, exist_ok=True)
+    events_dir = memory_dir / "events"
+    events_dir.mkdir(parents=True, exist_ok=True)
+
+    gitkeep_events = events_dir / ".gitkeep"
+    if not gitkeep_events.exists():
+        gitkeep_events.write_text("", encoding="utf-8")
+
+    mem_gitignore = memory_dir / ".gitignore"
+    if not mem_gitignore.exists():
+        mem_gitignore.write_text("*\n", encoding="utf-8")
+
+    decay_file = memory_dir / "decay.json"
+    if not decay_file.exists():
+        decay_file.write_text(json.dumps({
+            "default_ttl_days": 90,
+            "decay_rate": 0.15,
+            "last_decay_run": None
+        }, indent=2), encoding="utf-8")
+
+    patterns_file = memory_dir / "patterns.json"
+    if not patterns_file.exists():
+        patterns_file.write_text("[]", encoding="utf-8")
+
+    profile_file = memory_dir / "profile.json"
+    if not profile_file.exists():
+        profile_file.write_text(json.dumps({
+            "stack": [],
+            "total_events": 0,
+            "active_patterns_count": 0,
+            "fix_rate_percentage": None,
+            "top_vulnerabilities": [],
+            "last_updated": None
+        }, indent=2), encoding="utf-8")
+
+    context_file = memory_dir / "context.json"
+    if not context_file.exists():
+        context_file.write_text(json.dumps({
+            "version": "1.0.0",
+            "generated_at": None,
+            "token_estimate": 0,
+            "max_token_budget": 2000,
+            "project_profile": {
+                "stack": [],
+                "total_events": 0,
+                "active_patterns_count": 0,
+                "fix_rate_percentage": None,
+                "top_vulnerabilities": []
+            },
+            "cards": []
+        }, indent=2), encoding="utf-8")
+
+    # Ensure target project root .gitignore excludes .torusguard/memory/
+    root_gitignore = target_root / ".gitignore"
+    if root_gitignore.exists():
+        try:
+            gi_content = root_gitignore.read_text(encoding="utf-8")
+            if ".torusguard/memory" not in gi_content:
+                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard security memory (local only)\n.torusguard/memory/\n", encoding="utf-8")
+        except Exception:
+            pass
+
+    # ── Step 2: Security Profile & Coverage (In-Process, Zero Subprocess) ──
+    # Execute stack detection in-process without spawning child processes (Socket.dev safe)
+    detected_stack = None
     stack_detect_script = torusguard_target / "scripts" / "stack_detect.py"
-    detected_stack = {"language": "Unknown", "framework": "None", "data_layer": "None", "confidence": "Uncertain"}
-    
-    if stack_detect_script.exists():
+    if stack_detect_script.is_file():
         try:
-            res = subprocess.run(
-                [sys.executable, str(stack_detect_script), str(target_root), "--json"],
-                capture_output=True,
-                text=True,
-                timeout=10
-            )
-            if res.returncode == 0 and res.stdout.strip():
-                detected_stack = json.loads(res.stdout)
-                print(f"  [DETECTED] Language:   {detected_stack.get('language')}")
-                print(f"  [DETECTED] Framework:  {detected_stack.get('framework')}")
-                print(f"  [DETECTED] Data Layer: {detected_stack.get('data_layer')}")
-        except Exception as e:
-            print(f"  [WARN] Stack detection encountered error: {e}")
+            import importlib.util
+            spec = importlib.util.spec_from_file_location("stack_detect", str(stack_detect_script))
+            if spec and spec.loader:
+                sd_mod = importlib.util.module_from_spec(spec)
+                spec.loader.exec_module(sd_mod)
+                if hasattr(sd_mod, "detect_stack"):
+                    detected_stack = sd_mod.detect_stack(target_root)
+        except Exception:
+            detected_stack = None
 
-    # 4. Update torusguard.json configuration
     config_file = torusguard_target / "config" / "torusguard.json"
     if config_file.exists():
         try:
             with open(config_file, "r", encoding="utf-8") as f:
                 cfg = json.load(f)
-            cfg["detected_stack"] = {
-                "language": detected_stack.get("language"),
-                "framework": detected_stack.get("framework"),
-                "data_layer": detected_stack.get("data_layer")
-            }
+            if detected_stack and detected_stack.get("framework") != "None":
+                cfg["detected_stack"] = {
+                    "language": detected_stack.get("language"),
+                    "framework": detected_stack.get("framework"),
+                    "data_layer": detected_stack.get("data_layer")
+                }
+            else:
+                cfg["detected_stack"] = {
+                    "language": "Unknown",
+                    "framework": "None",
+                    "data_layer": "None"
+                }
             with open(config_file, "w", encoding="utf-8") as f:
                 json.dump(cfg, f, indent=2)
-            print("  [SUCCESS] Configured .torusguard/config/torusguard.json")
-        except Exception as e:
-            print(f"  [WARN] Failed to write stack details to config: {e}")
-
-    print("\n================================================================================")
-    print("[SUCCESS] TORUSGUARD WORKSPACE SCAFFOLDED SUCCESSFULLY!")
-    print("================================================================================")
-    print(f"Workspace Path: {torusguard_target}")
-    print("\nNext Steps:")
-    print("  1. Run `/torusguard audit` in your AI IDE to scan the project.")
-    print("  2. Run `/torusguard status` to verify active security posture.")
-    print("================================================================================")
+        except Exception:
+            pass
+
+    print_step_2_profile(detected_stack)
+
+    # ── Step 3: Register Slash Commands for AI IDEs ─────────────────────────
+    registered_ides = []
+    tg_workflow_content = """---
+description: TorusGuard Autonomous Security Command Engine — run static security audits, authorized runtime web validation, governed remediation, and SARIF exports.
+version: 1.0.0
+tools: Read, Grep, Glob, Bash, Edit, Write
+agent: auditor
+---
+
+# /torusguard — Autonomous Application Security Guardrails
+
+$ARGUMENTS
+
+## Objective
+Execute TorusGuard security workflows across Python and TypeScript codebases.
+
+## Execution
+Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-validate`, `exploit-check`, `harden`, `apply`, `recheck`, `report`, `status`, `init`):
+1. **If action is omitted or 'status':** View `.torusguard/workflows/status.md` and report posture.
+2. **If action is specified:** Load the dedicated workflow from `.torusguard/workflows/<action>.md` and matching skill from `.torusguard/skills/torusguard-<action>/SKILL.md`.
+3. Follow the phase execution steps defined in the workflow.
+"""
+
+    # Ensure .agent/workflows and .agents/workflows are created
+    dest_workflow_dirs = []
+    if (target_root / ".agents").exists():
+        agents_wf = target_root / ".agents" / "workflows"
+        agents_wf.mkdir(parents=True, exist_ok=True)
+        (agents_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
+        dest_workflow_dirs.append(agents_wf)
+        registered_ides.append("Antigravity / Gemini     .agents/workflows/torusguard.md")
+
+    agent_wf = target_root / ".agent" / "workflows"
+    agent_wf.mkdir(parents=True, exist_ok=True)
+    (agent_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
+    dest_workflow_dirs.append(agent_wf)
+    registered_ides.append("Tribunal Agent Kit       .agent/workflows/torusguard.md")
+
+    # When full_commands is requested (e.g. via NPM package npx torusguard init),
+    # unlock and register all 11 individual slash commands
+    if full_commands:
+        src_wf = torusguard_target / "workflows"
+        if src_wf.is_dir():
+            count = 0
+            for wf_file in src_wf.glob("*.md"):
+                if wf_file.name == "torusguard.md":
+                    continue
+                cmd_filename = f"torusguard-{wf_file.name}"
+                for d in dest_workflow_dirs:
+                    shutil.copy2(wf_file, d / cmd_filename)
+                count += 1
+            registered_ides.append(f"{count} Slash Commands          /torusguard-audit, -harden, -apply, ...")
+
+    # Claude Code (.claude/commands)
+    claude_dir = target_root / ".claude"
+    if claude_dir.exists():
+        claude_commands = claude_dir / "commands"
+        claude_commands.mkdir(parents=True, exist_ok=True)
+        (claude_commands / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
+        registered_ides.append("Claude Code              .claude/commands/torusguard.md")
+
+    # Cursor (.cursor/rules)
+    cursor_dir = target_root / ".cursor"
+    if cursor_dir.exists():
+        cursor_rules = cursor_dir / "rules"
+        cursor_rules.mkdir(parents=True, exist_ok=True)
+        (cursor_rules / "torusguard.mdc").write_text(tg_workflow_content, encoding="utf-8")
+        registered_ides.append("Cursor                   .cursor/rules/torusguard.mdc")
+
+    # Windsurf (.windsurfrules)
+    if (target_root / ".windsurfrules").exists() or (target_root / ".windsurf").exists():
+        windsurf_rules = target_root / ".windsurfrules"
+        current_content = windsurf_rules.read_text(encoding="utf-8") if windsurf_rules.exists() else ""
+        if "TorusGuard" not in current_content:
+            windsurf_rules.write_text(current_content + "\n\n" + tg_workflow_content, encoding="utf-8")
+        registered_ides.append("Windsurf                 .windsurfrules")
+
+    # VS Code / GitHub Copilot (.github/copilot-instructions.md)
+    github_dir = target_root / ".github"
+    if github_dir.exists():
+        copilot_file = github_dir / "copilot-instructions.md"
+        current_content = copilot_file.read_text(encoding="utf-8") if copilot_file.exists() else ""
+        if "TorusGuard" not in current_content:
+            copilot_file.write_text(current_content + "\n\n# TorusGuard Security Instructions\n" + tg_workflow_content, encoding="utf-8")
+        registered_ides.append("VS Code / Copilot        .github/copilot-instructions.md")
+
+    # Universal AGENTS.md (Kimi, Codex, Open Agent Standard)
+    agents_md = target_root / "AGENTS.md"
+    current_agents = agents_md.read_text(encoding="utf-8") if agents_md.exists() else ""
+    if "TorusGuard" not in current_agents:
+        agents_md.write_text(current_agents + ("\n\n" if current_agents else "") + "# TorusGuard Security Guardrails\n\nRun `/torusguard audit` to scan the codebase or refer to `.torusguard/` for security guidelines.\n", encoding="utf-8")
+        registered_ides.append("Universal AGENTS.md      Kimi / Open Agent Standard")
+
+    print_step_3_bridges(registered_ides)
+
+    # ── Success Card ────────────────────────────────────────────────────────
+    print_success_card()
     return True
 
 
@@ -152,7 +439,8 @@ if __name__ == "__main__":
     parser = argparse.ArgumentParser(description="TorusGuard Autonomous Workspace Bootstrapper")
     parser.add_argument("--target", type=str, help="Target project root directory")
     parser.add_argument("--force", action="store_true", help="Force overwrite existing workspace")
+    parser.add_argument("--full-commands", action="store_true", help="Unlock and register all 11 individual slash commands")
     args = parser.parse_args()
 
-    success = scaffold_workspace(target_root=args.target, force=args.force)
+    success = scaffold_workspace(target_root=args.target, force=args.force, full_commands=args.full_commands)
     sys.exit(0 if success else 1)

package/.torusguard/skills/torusguard-audit/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-audit
-description: Static security AST scanning, stable fingerprinting, root-cause clustering, and 0–100 confidence scoring.
-version: 0.9.2
+description: Static AST scanning, memory pattern boosting, and 0–100 confidence scoring.
+version: 1.0.0
 workflow: .torusguard/workflows/audit.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -9,36 +9,37 @@ scripts-binding:
   - .torusguard/scripts/run_manager.py
 ---
 
-# TorusGuard Audit — Static Code Analysis & Finding Clustering
+# TorusGuard Audit — Static Code Analysis & Memory Scanning
 
 ## Objective
-Execute static analysis across ASTs, generate line-shift invariant fingerprints, group findings into root causes, compute 0–100 confidence scores, and persist findings to `.torusguard/runs/`.
+Execute static AST analysis, query memory context, compute 0–100 confidence scores with memory boosts, and record findings to runs and memory.
 
 ---
 
 ## Execution Steps
 
-1. **Setup Run Directory:** Initialize `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/` via `run_manager.py`.
-2. **Load Active Rules:** Load rules from `.torusguard/rules/active/` and thresholds from `torusguard.json`.
+1. **Run Setup:** Initialize `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/` via `run_manager.py`.
+2. **Context & Rules:** Load `.torusguard/memory/context.json` for patterns and false positives. Load rules from `.torusguard/rules/active/`.
 3. **AST Scan Sinks:** Match files against active rules:
-   - `TG-SEC-*`: Leaked API keys, secrets.
-   - `TG-INPUT-*`: Unescaped SQL or unvalidated payloads.
-   - `TG-DB-*`: Unscoped queries omitting tenant filters (`Model.get(id=id)`).
-   - `TG-AUTH-*`: Missing `HttpOnly`/`Secure` flags; open CORS.
-   - `TG-CLIENT-*`: Admin credentials in client bundles.
-4. **Stable Fingerprinting:** Compute SHA-256 hash of normalized 3 surrounding AST lines.
-5. **Root-Cause Clustering:** Group findings by root cause (`cluster-tenant-isolation`, `cluster-raw-sql-sink`).
-6. **Confidence Scoring:** Calculate 0–100 score across 5-factor rubric via `finding_scorer.py`.
-7. **Write Run Artifacts:** Persist `findings.md`, `findings.json`, and `summary.md`.
+   - `TG-SEC-*`: Secrets and API keys.
+   - `TG-INPUT-*`: SQL injection, unvalidated input.
+   - `TG-DB-*`: Unscoped tenant queries (`Model.get(id=id)`).
+   - `TG-AUTH-*`: Insecure cookies, open CORS.
+   - `TG-CLIENT-*`: Client bundle secret leaks.
+4. **Stable Fingerprinting:** Compute SHA-256 hash of surrounding AST context.
+5. **Root-Cause Clustering:** Group findings by causal sink (`cluster-tenant-isolation`).
+6. **Scoring:** Calculate 0–100 score via `finding_scorer.py` (applies memory boost/suppression).
+7. **Write Artifacts:** Save `findings.json` and sync findings to memory engine.
 
 ---
 
 ## Confidence Scoring Rubric
-- **1. Evidence (35):** AST flow (35), regex match (20), indirect (10).
-- **2. Reproduction (25):** Deterministic test (25), simulated (15), hypothesis (0).
+- **1. Evidence (35):** AST flow (35), regex sink (20), heuristic (10).
+- **2. Reproduction (25):** Automated test (25), simulated (15), hypothesis (0).
 - **3. Corroboration (15):** >=3 files (15), 2 files (10), single (5).
-- **4. Environment (15):** Explicit route (15), minor ambiguity (8), unknown (0).
-- **5. Review Status (10):** Human verified (10), agent consensus (5), auto (0).
+- **4. Environment (15):** Explicit route (15), ambiguous (8), unknown (0).
+- **5. Review Status (10):** Human confirmed (10), agent verified (5), auto (0).
+- **Memory Modifier:** False positive (-30), regression (+15), recurring (+10).
 - **Bands:** 90–100 (`Confirmed`), 70–89 (`High`), 50–69 (`Medium`), <50 (`Review`).
 
 ---
@@ -46,17 +47,16 @@ Execute static analysis across ASTs, generate line-shift invariant fingerprints,
 ## Finding Card Format
 ```markdown
 ### [TG-DB-004] Missing Tenant Scoping in /invoices/
-- **Severity**: High | **Confidence**: 90/100 (Confirmed)
+- **Severity**: High | **Confidence**: 90/100 (Confirmed) | **Memory Boost**: +10
 - **File**: `views.py:42` | **Cluster**: `cluster-tenant-isolation`
-- **Evidence**: Unscoped query leaks records.
-- **Remediation**: Scope by `tenant=request.user.tenant`.
+- **Remediation**: Apply `.filter(tenant=request.user.tenant)`.
 ```
 
 ---
 
 ## Safety Constraints
-- Read-only execution; zero code modifications.
-- Exclude build folders (`node_modules/`, `.venv/`, `dist/`).
+- Read-only analysis; zero code modifications during audit.
+- Exclude build directories (`node_modules/`, `.venv/`, `dist/`).
 - Redact secrets before saving to `findings.md`.
 
 ---
@@ -65,6 +65,6 @@ Execute static analysis across ASTs, generate line-shift invariant fingerprints,
 ```markdown
 🛡️ [TorusGuard] Static Code Audit Completed
 - Run ID: run-YYYYMMDD-HHMMSS-audit | Files: <Count> | Findings: <Count>
-- Clusters: <Count> identified | Posture: ACTION REQUIRED
+- Clusters: <Count> identified | Memory Patterns Applied: <Count>
 Next: Run `/torusguard harden` to formulate surgical fixes.
 ```

package/.torusguard/skills/torusguard-harden/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-harden
 description: Package surgical remediation bundles conforming to the Ponytail Protocol (<= 35 additions, <= 25 deletions).
-version: 0.9.2
+version: 1.0.0
 workflow: .torusguard/workflows/harden.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -38,8 +38,8 @@ Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$
 
 1. **Select Finding:** Choose prioritized verified flaw from active run's `findings.md`.
 2. **Read AST Context:** View target file surrounding lines (±15) using `view_file`.
-3. **Formulate Minimal Fix:** Parameterize SQL, add tenant filters, insert validation schemas.
-4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$.
+3. **Formulate Minimal Fix:** Consult `.torusguard/memory/context.json` for verified idioms; parameterize SQL, add tenant filters.
+4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$ via `diff_guard.py`.
 5. **Package Bundle:** Write 4 artifacts (`patch.diff`, `plan.md`, `verification.md`, `rollback.md`).
 6. **Flag Sensitive Paths:** Mark changes touching auth or billing with `Requires Sensitive-Path Sign-Off`.
 

package/.torusguard/skills/torusguard-recheck/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-recheck
 description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions.
-version: 0.9.2
+version: 1.0.0
 workflow: .torusguard/workflows/recheck.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -19,10 +19,10 @@ Re-scan only files modified by remediation patches, confirming that targeted vul
 ## Execution Steps
 
 1. **Identify Modified Files:** Read `apply-log.json` from active run directory.
-2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against the modified files.
+2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against modified files.
 3. **Evaluate Finding Status:** Transition finding state according to transition rules below.
 4. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
-5. **Update State:** Record verified status in `findings.json`.
+5. **Update State & Memory:** Record status in `findings.json` and sync verified results to memory engine.
 6. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
 
 ---