torusguard 0.9.5 → 1.0.0

package/skills/torusguard/payload/schemas/memory-pattern.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-pattern.schema.json",
+  "title": "TorusGuard Memory Pattern",
+  "description": "Schema for distilled security patterns extracted from raw events. Patterns represent recurring fix strategies, vulnerability classes, and project-specific security idioms.",
+  "type": "object",
+  "required": ["pattern_id", "rule_id", "pattern_type", "confidence", "occurrences", "first_seen", "last_seen"],
+  "properties": {
+    "pattern_id": {
+      "type": "string",
+      "description": "Unique pattern identifier (PAT-NNN)."
+    },
+    "rule_id": {
+      "type": "string",
+      "description": "TorusGuard rule ID this pattern relates to."
+    },
+    "pattern_type": {
+      "type": "string",
+      "enum": ["recurring_fix", "common_vulnerability", "false_positive_class", "regression_watch", "security_idiom"],
+      "description": "Category of the distilled pattern."
+    },
+    "description": {
+      "type": "string",
+      "description": "Human-readable summary of the pattern."
+    },
+    "fix_strategy": {
+      "type": ["string", "null"],
+      "description": "The preferred fix approach observed across multiple occurrences."
+    },
+    "confidence": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 100,
+      "description": "Pattern confidence (amplified by repeated confirmations, decayed by TTL)."
+    },
+    "occurrences": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Number of times this pattern has been observed."
+    },
+    "affected_files": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "List of relative file paths where this pattern has been observed."
+    },
+    "first_seen": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "last_seen": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "decay_checkpoint": {
+      "type": ["string", "null"],
+      "format": "date-time",
+      "description": "Last timestamp when this pattern's confidence was reconfirmed or decayed."
+    },
+    "source_events": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "List of event_ids that contributed to this pattern."
+    }
+  }
+}

package/skills/torusguard/payload/scripts/diff_guard.py

@@ -1,7 +1,8 @@
 #!/usr/bin/env python3
 """
-TorusGuard Content-Aware Diff Line Scanner (v0.9.3)
-Evaluates unified diff patches against security invariants before harden or apply.
+TorusGuard Content-Aware Diff Line Scanner (v1.0.0)
+Evaluates unified diff patches against security invariants before harden or apply,
+including regression watch checks against persistent memory patterns.
 Pure Python 3.10+ standard library (zero external dependencies).
 """
 
@@ -38,16 +39,69 @@ TENANT_FILTER_PATTERNS = [
 ]
 
 
-def audit_diff(diff_content: str) -> Dict[str, Any]:
+def check_memory_regressions(
+    current_file: str,
+    current_line: int,
+    added_content: str,
+    root_dir: Optional[Path] = None
+) -> List[Dict[str, Any]]:
+    """
+    Check if the added line re-introduces a vulnerability in a file
+    that is tracked under active Regression Watch in .torusguard/memory/patterns.json.
+    """
+    violations = []
+    base = Path(root_dir or Path.cwd()).resolve()
+    torusguard_dir = base / ".torusguard"
+    if not torusguard_dir.exists():
+        for parent in base.parents:
+            if (parent / ".torusguard").exists():
+                torusguard_dir = parent / ".torusguard"
+                break
+
+    patterns_file = torusguard_dir / "memory" / "patterns.json"
+    if not patterns_file.exists():
+        return violations
+
+    try:
+        with open(patterns_file, "r", encoding="utf-8") as f:
+            patterns = json.load(f)
+    except Exception:
+        return violations
+
+    clean_file = current_file.replace("\\", "/")
+    for pat in patterns:
+        if pat.get("pattern_type") == "regression_watch":
+            affected = [f.replace("\\", "/") for f in pat.get("affected_files", [])]
+            if clean_file in affected or any(clean_file.endswith(a) for a in affected):
+                rule_id = pat.get("rule_id", "TG-REG")
+                desc = pat.get("description", "Regression watch violation")
+                violations.append({
+                    "rule_id": "TG-DIFF-004",
+                    "category": "Regression Watch",
+                    "severity": "HIGH",
+                    "file": current_file,
+                    "line": current_line,
+                    "content": added_content.strip(),
+                    "description": f"File {current_file} matches active Regression Watch for {rule_id}: {desc}"
+                })
+    return violations
+
+
+def audit_diff(
+    diff_content: str,
+    check_memory: bool = False,
+    root_dir: Optional[Path] = None
+) -> Dict[str, Any]:
     """
     Parses a unified diff and returns detected violations.
+    Optionally checks against active regression watch patterns in memory.
     """
     lines = diff_content.splitlines()
     violations: List[Dict[str, Any]] = []
-    
+
     current_file = "unknown"
     current_line = 0
-    
+
     additions: List[tuple[int, str]] = []
     deletions: List[tuple[int, str]] = []
 
@@ -68,7 +122,7 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
             current_line += 1
             added_content = line[1:]
             additions.append((current_line, added_content))
-            
+
             # Check bypass patterns
             for pat, desc in BYPASS_PATTERNS:
                 if pat.search(added_content):
@@ -81,7 +135,7 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
                         "content": added_content.strip(),
                         "description": desc
                     })
-                    
+
             # Check secret ingestion
             for pat, desc in SECRET_PATTERNS:
                 if pat.search(added_content):
@@ -95,6 +149,11 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
                         "description": desc
                     })
 
+            # Check memory regression watch if requested
+            if check_memory:
+                reg_violations = check_memory_regressions(current_file, current_line, added_content, root_dir=root_dir)
+                violations.extend(reg_violations)
+
         elif line.startswith('-') and not line.startswith('---'):
             deleted_content = line[1:]
             deletions.append((line_idx, deleted_content))
@@ -127,7 +186,7 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
     }
 
 
-def audit_diff_file(file_path: str) -> Dict[str, Any]:
+def audit_diff_file(file_path: str, check_memory: bool = False, root_dir: Optional[Path] = None) -> Dict[str, Any]:
     path = Path(file_path)
     if not path.is_file():
         return {
@@ -136,23 +195,24 @@ def audit_diff_file(file_path: str) -> Dict[str, Any]:
             "violations": []
         }
     content = path.read_text(encoding="utf-8", errors="replace")
-    return audit_diff(content)
+    return audit_diff(content, check_memory=check_memory, root_dir=root_dir)
 
 
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Unified Diff Security Scanner")
     parser.add_argument("diff_path", nargs="?", help="Path to unified diff file (or read stdin if omitted)")
+    parser.add_argument("--check-memory", action="store_true", help="Check additions against persistent memory regression watch patterns")
     parser.add_argument("--json", action="store_true", help="Output results as JSON")
     args = parser.parse_args()
 
     if args.diff_path:
-        res = audit_diff_file(args.diff_path)
+        res = audit_diff_file(args.diff_path, check_memory=args.check_memory)
     else:
         if sys.stdin.isatty():
             parser.print_help()
             sys.exit(1)
         diff_text = sys.stdin.read()
-        res = audit_diff(diff_text)
+        res = audit_diff(diff_text, check_memory=args.check_memory)
 
     if args.json:
         print(json.dumps(res, indent=2))

package/skills/torusguard/payload/scripts/finding_scorer.py

@@ -1,86 +1,171 @@
-#!/usr/bin/env python3
-"""
-TorusGuard 5-Factor Finding Confidence Scorer
-Evaluates finding confidence against the objective 0–100 scoring model.
-"""
-
-import sys
-import json
-import argparse
-from typing import Dict, Any, Tuple
-
-def compute_confidence_score(
-    evidence_quality: int = 35,
-    reproduction_success: int = 0,
-    independent_confirmations: int = 5,
-    environmental_clarity: int = 15,
-    manual_review_status: int = 0
-) -> Tuple[int, str, Dict[str, int]]:
-    """
-    Computes total score and assigns confidence band.
-    Max points:
-    - evidence_quality: 35
-    - reproduction_success: 25
-    - independent_confirmations: 15
-    - environmental_clarity: 15
-    - manual_review_status: 10
-    """
-    eq = min(max(evidence_quality, 0), 35)
-    rs = min(max(reproduction_success, 0), 25)
-    ic = min(max(independent_confirmations, 0), 15)
-    ec = min(max(environmental_clarity, 0), 15)
-    mr = min(max(manual_review_status, 0), 10)
-
-    total = eq + rs + ic + ec + mr
-
-    if total >= 90:
-        band = "Confirmed"
-    elif total >= 70:
-        band = "High Confidence"
-    elif total >= 50:
-        band = "Medium Confidence"
-    else:
-        band = "Needs Review"
-
-    factors = {
-        "evidence_quality": eq,
-        "reproduction_success": rs,
-        "independent_confirmations": ic,
-        "environmental_clarity": ec,
-        "manual_review_status": mr,
-        "total_score": total,
-        "classification_band": band
-    }
-    return total, band, factors
-
-
-def main():
-    parser = argparse.ArgumentParser(description="TorusGuard Confidence Scorer")
-    parser.add_argument("--eq", type=int, default=35, help="Evidence quality score (0-35)")
-    parser.add_argument("--rs", type=int, default=0, help="Reproduction success score (0-25)")
-    parser.add_argument("--ic", type=int, default=5, help="Independent confirmations score (0-15)")
-    parser.add_argument("--ec", type=int, default=15, help="Environmental clarity score (0-15)")
-    parser.add_argument("--mr", type=int, default=0, help="Manual review status score (0-10)")
-    parser.add_argument("--json", action="store_true", help="Output JSON")
-    args = parser.parse_args()
-
-    total, band, factors = compute_confidence_score(
-        evidence_quality=args.eq,
-        reproduction_success=args.rs,
-        independent_confirmations=args.ic,
-        environmental_clarity=args.ec,
-        manual_review_status=args.mr
-    )
-
-    if args.json:
-        print(json.dumps(factors, indent=2))
-    else:
-        print(f"Total Confidence Score: {total}/100")
-        print(f"Classification Band: {band}")
-        print("Factor Breakdown:")
-        for k, v in factors.items():
-            if k not in ("total_score", "classification_band"):
-                print(f"  - {k}: {v}")
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""
+TorusGuard Finding Confidence Scorer (v1.0.0)
+Evaluates finding confidence against the objective 0–100 scoring model,
+augmented by persistent memory patterns and false-positive suppression.
+"""
+
+import sys
+import json
+import argparse
+from pathlib import Path
+from typing import Dict, Any, Tuple, Optional
+
+
+def compute_memory_boost(
+    rule_id: str,
+    file_path: Optional[str] = None,
+    root_dir: Optional[Path] = None
+) -> int:
+    """
+    Query .torusguard/memory/patterns.json to calculate memory confidence modifier:
+    - False positive class: -30 (heavily suppressed)
+    - Regression watch: +15 (high alert / known recurrence)
+    - Recurring fix / Common vulnerability: +10
+    - Security idiom: +5
+    - Multi-file pattern match bonus: +5
+    """
+    if not rule_id:
+        return 0
+
+    base = Path(root_dir or Path.cwd()).resolve()
+    # Search for .torusguard
+    torusguard_dir = base / ".torusguard"
+    if not torusguard_dir.exists():
+        for parent in base.parents:
+            if (parent / ".torusguard").exists():
+                torusguard_dir = parent / ".torusguard"
+                break
+
+    patterns_file = torusguard_dir / "memory" / "patterns.json"
+    if not patterns_file.exists():
+        return 0
+
+    try:
+        with open(patterns_file, "r", encoding="utf-8") as f:
+            patterns = json.load(f)
+    except Exception:
+        return 0
+
+    boost = 0
+    matched_file = False
+
+    for pat in patterns:
+        if pat.get("rule_id") == rule_id:
+            ptype = pat.get("pattern_type")
+            if ptype == "false_positive_class":
+                boost -= 30
+            elif ptype == "regression_watch":
+                boost += 15
+            elif ptype in ("recurring_fix", "common_vulnerability"):
+                boost += 10
+            elif ptype == "security_idiom":
+                boost += 5
+
+            # File-specific correlation bonus
+            if file_path and file_path in pat.get("affected_files", []):
+                matched_file = True
+
+    if matched_file and boost > 0:
+        boost += 5
+    elif matched_file and boost < 0:
+        boost -= 10
+
+    return boost
+
+
+def compute_confidence_score(
+    evidence_quality: int = 35,
+    reproduction_success: int = 0,
+    independent_confirmations: int = 5,
+    environmental_clarity: int = 15,
+    manual_review_status: int = 0,
+    memory_boost: int = 0,
+    rule_id: Optional[str] = None,
+    file_path: Optional[str] = None,
+    root_dir: Optional[Path] = None
+) -> Tuple[int, str, Dict[str, int]]:
+    """
+    Computes total score and assigns confidence band.
+    Max points:
+    - evidence_quality: 35
+    - reproduction_success: 25
+    - independent_confirmations: 15
+    - environmental_clarity: 15
+    - manual_review_status: 10
+    - memory_boost: -30 to +20 (modifier from persistent memory)
+    Total is clamped to [0, 100].
+    """
+    eq = min(max(evidence_quality, 0), 35)
+    rs = min(max(reproduction_success, 0), 25)
+    ic = min(max(independent_confirmations, 0), 15)
+    ec = min(max(environmental_clarity, 0), 15)
+    mr = min(max(manual_review_status, 0), 10)
+
+    # Auto-calculate memory boost if rule_id provided and memory_boost == 0
+    eff_mem_boost = memory_boost
+    if rule_id and eff_mem_boost == 0:
+        eff_mem_boost = compute_memory_boost(rule_id, file_path=file_path, root_dir=root_dir)
+
+    raw_total = eq + rs + ic + ec + mr + eff_mem_boost
+    total = min(max(raw_total, 0), 100)
+
+    if total >= 90:
+        band = "Confirmed"
+    elif total >= 70:
+        band = "High Confidence"
+    elif total >= 50:
+        band = "Medium Confidence"
+    else:
+        band = "Needs Review"
+
+    factors = {
+        "evidence_quality": eq,
+        "reproduction_success": rs,
+        "independent_confirmations": ic,
+        "environmental_clarity": ec,
+        "manual_review_status": mr,
+        "memory_boost": eff_mem_boost,
+        "total_score": total,
+        "classification_band": band
+    }
+    return total, band, factors
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Confidence Scorer")
+    parser.add_argument("--eq", type=int, default=35, help="Evidence quality score (0-35)")
+    parser.add_argument("--rs", type=int, default=0, help="Reproduction success score (0-25)")
+    parser.add_argument("--ic", type=int, default=5, help="Independent confirmations score (0-15)")
+    parser.add_argument("--ec", type=int, default=15, help="Environmental clarity score (0-15)")
+    parser.add_argument("--mr", type=int, default=0, help="Manual review status score (0-10)")
+    parser.add_argument("--memory-boost", type=int, default=0, help="Memory boost score (-30 to +20)")
+    parser.add_argument("--rule-id", type=str, help="TorusGuard rule ID for memory pattern matching")
+    parser.add_argument("--file", type=str, help="File path for correlation matching")
+    parser.add_argument("--json", action="store_true", help="Output JSON")
+    args = parser.parse_args()
+
+    total, band, factors = compute_confidence_score(
+        evidence_quality=args.eq,
+        reproduction_success=args.rs,
+        independent_confirmations=args.ic,
+        environmental_clarity=args.ec,
+        manual_review_status=args.mr,
+        memory_boost=args.memory_boost,
+        rule_id=args.rule_id,
+        file_path=args.file
+    )
+
+    if args.json:
+        print(json.dumps(factors, indent=2))
+    else:
+        print(f"Total Confidence Score: {total}/100")
+        print(f"Classification Band: {band}")
+        print("Factor Breakdown:")
+        for k, v in factors.items():
+            if k not in ("total_score", "classification_band"):
+                print(f"  - {k}: {v}")
+
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/scripts/manifest_builder.py

@@ -29,6 +29,8 @@ def scan_workspace_files(base_dir):
     for root, dirs, files in os.walk(base_dir):
         if "runs" in dirs:
             dirs.remove("runs")
+        if "memory" in dirs:
+            dirs.remove("memory")
         if "__pycache__" in dirs:
             dirs.remove("__pycache__")