torusguard 0.9.5 → 1.3.0

package/skills/torusguard/payload/references/csharp-security.md

@@ -0,0 +1,41 @@
+# TorusGuard Skill Reference: C# & ASP.NET Core Security
+
+> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Authentication & Authorization
+* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
+* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
+
+### 2. Entity Framework Core & SQL Injection
+* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
+* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
+* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
+
+### 3. Anti-Forgery & TLS
+* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
+* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```csharp
+// Safe Entity Framework Parameterized Query
+var user = await context.Users
+    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
+    .FirstOrDefaultAsync();
+
+// Safe Global Query Filter in DbContext
+modelBuilder.Entity<Invoice>()
+    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
+
+// Safe Controller Security
+[Authorize]
+[ApiController]
+[Route("api/[controller]")]
+public class InvoicesController : ControllerBase { ... }
+```

package/skills/torusguard/payload/references/go-security.md

@@ -0,0 +1,41 @@
+# TorusGuard Skill Reference: Go Security
+
+> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Database & SQL Injection
+* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
+* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
+
+### 2. TLS & Network Security
+* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
+* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
+
+### 3. Concurrency & Goroutine Safety
+* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
+* Use mutexes or channels to prevent data races on shared state.
+
+### 4. Input Validation & Path Traversal
+* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```go
+// Safe Parameterized Query
+row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
+
+// Safe GORM Scoping
+var invoice Invoice
+result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
+
+// Safe TLS Client
+tlsConfig := &tls.Config{
+    MinVersion: tls.VersionTLS13,
+}
+client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
+```

package/skills/torusguard/payload/references/java-security.md

@@ -0,0 +1,40 @@
+# TorusGuard Skill Reference: Java & Spring Security
+
+> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Spring Security & CSRF
+* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
+* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
+
+### 2. JPA & Hibernate SQL Injection
+* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
+* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
+
+### 3. Insecure Deserialization & XML
+* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
+* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```java
+// Safe JPA Query
+@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
+Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
+
+// Safe Spring Security Configuration
+@Bean
+public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http
+        .authorizeHttpRequests(auth -> auth
+            .requestMatchers("/public/**").permitAll()
+            .anyRequest().authenticated()
+        );
+    return http.build();
+}
+```

package/skills/torusguard/payload/references/polyglot-security-matrix.md

@@ -0,0 +1,25 @@
+# TorusGuard Universal Polyglot Security Matrix
+
+> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
+
+---
+
+## 🛡️ Cross-Language Invariant Mappings
+
+| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
+|---|---|---|---|---|---|---|
+| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
+| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
+| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
+| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
+| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
+| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
+| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
+
+---
+
+## 🚀 Polyglot Hardening Rules of Thumb
+
+1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
+2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
+3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.

package/skills/torusguard/payload/references/rust-security.md

@@ -0,0 +1,40 @@
+# TorusGuard Skill Reference: Rust Security
+
+> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Memory Safety & Unsafe Blocks
+* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
+* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
+
+### 2. Database & SQL Queries
+* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
+* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
+
+### 3. Outbound Requests & TLS
+* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
+* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```rust
+// Safe sqlx Parameterized Query
+let user = sqlx::query_as!(
+    User,
+    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
+    user_id,
+    current_tenant_id
+)
+.fetch_one(&pool)
+.await?;
+
+// Safe reqwest Client (Strict TLS)
+let client = reqwest::Client::builder()
+    .timeout(std::time::Duration::from_secs(10))
+    .build()?;
+```

package/skills/torusguard/payload/rules/custom/.gitkeep

@@ -0,0 +1 @@
+# Retain custom rules directory

package/skills/torusguard/payload/rules/custom/README.md

@@ -0,0 +1,30 @@
+# TorusGuard Custom Rules Directory
+
+Place your custom organization-specific, framework-specific, or proprietary library rules here.
+Any markdown files (`*.md`) or JSON files (`*.json`) placed in this directory will be automatically indexed during `/torusguard-audit` and finding scoring.
+
+---
+
+## Example Custom Rule: `TG-CUSTOM-001.md`
+
+```markdown
+# TG-CUSTOM-001: Require Organization UUID on All Multi-Tenant Queries
+
+**Rule ID:** TG-CUSTOM-001
+**Severity:** High
+**Category:** database-safety
+**Confidence Base:** 85
+
+### Description
+Ensure all database operations on multi-tenant tables enforce explicit `org_id` or `tenant_id` boundaries.
+
+### Unsafe Pattern
+```python
+db.execute("SELECT * FROM invoices WHERE status = 'paid'")
+```
+
+### Safe Remediation
+```python
+db.execute("SELECT * FROM invoices WHERE status = 'paid' AND org_id = %s", [current_org_id])
+```
+```

package/skills/torusguard/payload/schemas/golden-recipe.schema.json

@@ -0,0 +1,75 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://torusguard.dev/schemas/golden-recipe.schema.json",
+  "title": "TorusGuard Golden Fix Recipe Schema",
+  "description": "Schema for reusable, verified AST remediation code snippets distilled from passing security patches.",
+  "type": "object",
+  "required": [
+    "recipe_id",
+    "rule_id",
+    "file_type",
+    "before_snippet",
+    "after_snippet",
+    "diff_snippet",
+    "ponytail_metrics",
+    "verified_count",
+    "last_verified"
+  ],
+  "properties": {
+    "recipe_id": {
+      "type": "string",
+      "pattern": "^recipe-[A-Za-z0-9_-]+$"
+    },
+    "rule_id": {
+      "type": "string",
+      "pattern": "^TG-[A-Z]+-[0-9]{3}$"
+    },
+    "file_type": {
+      "type": "string",
+      "description": "File extension or language identifier (e.g., .py, .ts, .js)"
+    },
+    "framework": {
+      "type": ["string", "null"],
+      "description": "Target web framework (e.g., Django, FastAPI, Next.js)"
+    },
+    "description": {
+      "type": "string",
+      "description": "Human-readable summary of the fix strategy"
+    },
+    "before_snippet": {
+      "type": "string",
+      "description": "Vulnerable code pattern before remediation"
+    },
+    "after_snippet": {
+      "type": "string",
+      "description": "Remediated code pattern adhering to Ponytail bounds"
+    },
+    "diff_snippet": {
+      "type": "string",
+      "description": "Unified diff snippet representing the surgical fix"
+    },
+    "ponytail_metrics": {
+      "type": "object",
+      "required": ["additions", "deletions"],
+      "properties": {
+        "additions": {
+          "type": "integer",
+          "maximum": 35
+        },
+        "deletions": {
+          "type": "integer",
+          "maximum": 25
+        }
+      }
+    },
+    "verified_count": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "last_verified": {
+      "type": "string",
+      "format": "date-time"
+    }
+  },
+  "additionalProperties": false
+}

package/skills/torusguard/payload/schemas/memory-context.schema.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-context.schema.json",
+  "title": "TorusGuard Memory Context Window",
+  "description": "Pre-computed, token-budgeted context window for AI agent consumption formatted as structured JSON cards.",
+  "type": "object",
+  "required": ["version", "generated_at", "token_estimate", "max_token_budget", "project_profile", "cards"],
+  "properties": {
+    "version": {
+      "type": "string",
+      "description": "TorusGuard engine version (e.g., 1.0.0)."
+    },
+    "generated_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 UTC timestamp when this context window was computed."
+    },
+    "token_estimate": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Estimated token count of this context document."
+    },
+    "max_token_budget": {
+      "type": "integer",
+      "default": 2000,
+      "description": "Maximum allowed tokens for agent context injection (default: 2000)."
+    },
+    "project_profile": {
+      "type": "object",
+      "required": ["stack", "total_events", "active_patterns_count"],
+      "properties": {
+        "stack": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Detected technology stack frameworks/languages."
+        },
+        "total_events": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "active_patterns_count": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "fix_rate_percentage": {
+          "type": ["number", "null"],
+          "minimum": 0,
+          "maximum": 100
+        },
+        "top_vulnerabilities": {
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      }
+    },
+    "cards": {
+      "type": "array",
+      "description": "Ordered list of high-priority intelligence cards for LLM grounding.",
+      "items": {
+        "type": "object",
+        "required": ["card_id", "card_type", "priority", "title", "summary", "card_data"],
+        "properties": {
+          "card_id": {
+            "type": "string",
+            "description": "Unique card identifier (e.g., CARD-001)."
+          },
+          "card_type": {
+            "type": "string",
+            "enum": ["pattern", "profile", "regression_watch", "false_positive", "fix_idiom"],
+            "description": "Semantic category of this context card."
+          },
+          "priority": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 100,
+            "description": "Rank order priority (higher = more relevant/critical)."
+          },
+          "title": {
+            "type": "string",
+            "description": "Short, human-readable and agent-scannable card title."
+          },
+          "summary": {
+            "type": "string",
+            "description": "One-line operational summary for rapid agent reasoning."
+          },
+          "card_data": {
+            "type": "object",
+            "description": "Structured card payload containing rule_id, fix_strategy, confidence, affected_files, etc.",
+            "additionalProperties": true
+          }
+        }
+      }
+    }
+  }
+}

package/skills/torusguard/payload/schemas/memory-event.schema.json

@@ -0,0 +1,70 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-event.schema.json",
+  "title": "TorusGuard Memory Event",
+  "description": "Schema for individual memory events recorded during audit/fix/recheck cycles.",
+  "type": "object",
+  "required": ["event_id", "event_type", "timestamp", "version"],
+  "properties": {
+    "event_id": {
+      "type": "string",
+      "description": "Unique event identifier (UUID v4 or timestamp-based)."
+    },
+    "event_type": {
+      "type": "string",
+      "enum": ["audit_finding", "fix_applied", "fix_verified", "false_positive", "pattern_learned", "stack_changed"],
+      "description": "Category of security event."
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 UTC timestamp."
+    },
+    "version": {
+      "type": "string",
+      "description": "TorusGuard version that recorded this event."
+    },
+    "rule_id": {
+      "type": ["string", "null"],
+      "description": "TorusGuard rule ID (e.g., TG-DB-004)."
+    },
+    "file_path": {
+      "type": ["string", "null"],
+      "description": "Relative file path within the project."
+    },
+    "line_number": {
+      "type": ["integer", "null"],
+      "description": "Line number of the finding."
+    },
+    "severity": {
+      "type": ["string", "null"],
+      "enum": ["critical", "high", "medium", "low", "info", null]
+    },
+    "confidence_score": {
+      "type": ["integer", "null"],
+      "minimum": 0,
+      "maximum": 100
+    },
+    "code_hash": {
+      "type": ["string", "null"],
+      "description": "SHA-256 hash of the relevant code snippet for pattern matching."
+    },
+    "fix_strategy": {
+      "type": ["string", "null"],
+      "description": "Human-readable description of the fix approach used."
+    },
+    "verification_result": {
+      "type": ["string", "null"],
+      "enum": ["fixed", "regressed", "partial", "not_tested", null]
+    },
+    "suppression_reason": {
+      "type": ["string", "null"],
+      "description": "Reason for false positive suppression."
+    },
+    "metadata": {
+      "type": "object",
+      "description": "Additional event-specific metadata.",
+      "additionalProperties": true
+    }
+  }
+}

package/skills/torusguard/payload/schemas/memory-pattern.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "torusguard-memory-pattern.schema.json",
+  "title": "TorusGuard Memory Pattern",
+  "description": "Schema for distilled security patterns extracted from raw events. Patterns represent recurring fix strategies, vulnerability classes, and project-specific security idioms.",
+  "type": "object",
+  "required": ["pattern_id", "rule_id", "pattern_type", "confidence", "occurrences", "first_seen", "last_seen"],
+  "properties": {
+    "pattern_id": {
+      "type": "string",
+      "description": "Unique pattern identifier (PAT-NNN)."
+    },
+    "rule_id": {
+      "type": "string",
+      "description": "TorusGuard rule ID this pattern relates to."
+    },
+    "pattern_type": {
+      "type": "string",
+      "enum": ["recurring_fix", "common_vulnerability", "false_positive_class", "regression_watch", "security_idiom"],
+      "description": "Category of the distilled pattern."
+    },
+    "description": {
+      "type": "string",
+      "description": "Human-readable summary of the pattern."
+    },
+    "fix_strategy": {
+      "type": ["string", "null"],
+      "description": "The preferred fix approach observed across multiple occurrences."
+    },
+    "confidence": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 100,
+      "description": "Pattern confidence (amplified by repeated confirmations, decayed by TTL)."
+    },
+    "occurrences": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Number of times this pattern has been observed."
+    },
+    "affected_files": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "List of relative file paths where this pattern has been observed."
+    },
+    "first_seen": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "last_seen": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "decay_checkpoint": {
+      "type": ["string", "null"],
+      "format": "date-time",
+      "description": "Last timestamp when this pattern's confidence was reconfirmed or decayed."
+    },
+    "source_events": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "List of event_ids that contributed to this pattern."
+    }
+  }
+}