torusguard 0.9.5 → 1.3.0

package/skills/torusguard/payload/skills/torusguard/bootstrap.py

@@ -10,9 +10,33 @@ import sys
 import shutil
 import json
 import argparse
-import subprocess
 from pathlib import Path
 
+# Ensure UTF-8 stdout/stderr on Windows consoles
+if sys.stdout and hasattr(sys.stdout, "reconfigure"):
+    try:
+        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+if sys.stderr and hasattr(sys.stderr, "reconfigure"):
+    try:
+        getattr(sys.stderr, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+# ─── ANSI Color Helpers ───────────────────────────────────────────────────────
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+CYAN = "\033[36m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+WHITE = "\033[97m"
+GRAY = "\033[90m"
+RED = "\033[31m"
+BG_GREEN = "\033[42m"
+BG_CYAN = "\033[46m"
+
 
 def find_project_root(start_dir=None):
     """Detect project root directory by searching for standard repo root markers."""
@@ -33,36 +57,141 @@ def find_project_root(start_dir=None):
     return current
 
 
-def scaffold_workspace(target_root=None, force=False):
+def print_header():
+    """Print the branded TorusGuard header card."""
+    print(f"""
+  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
+  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v0.9.5{RESET}   {CYAN}│{RESET}
+  {CYAN}│{RESET}   {DIM}Autonomous Security Engine for AI-Built Applications{RESET}               {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
+  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
+""")
+
+
+def print_step_1_assets(file_count):
+    """Print the enhanced Step 1 asset unpacking card."""
+    print(f"""  {CYAN}┌─ {BOLD}Step 1/3{RESET} {CYAN}──────────────────────── {WHITE}Unpacking Governance Assets{RESET} {CYAN}──────┐{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Canonical security rules            {DIM}71 rules across 11 families{RESET}  {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} JSON validation schemas             {DIM}8 formal schemas{RESET}             {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Specialist agent specifications     {DIM}5 isolated agents{RESET}            {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Workflow templates                   {DIM}11 slash commands{RESET}            {CYAN}│{RESET}
+  {CYAN}│{RESET}   {GREEN}✔{RESET} Framework reference guides           {DIM}10 security guides{RESET}           {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}                                               {BOLD}{WHITE}{file_count} files unpacked{RESET}   {CYAN}│{RESET}
+  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+
+def print_step_2_profile(detected_stack=None):
+    """Print the security profile & coverage card (in-process stack alignment)."""
+    if detected_stack and detected_stack.get("framework") and detected_stack.get("framework") != "None":
+        fw = str(detected_stack.get("framework"))
+        lang = str(detected_stack.get("language", ""))
+        label = f"Auto-aligned stack: {fw} ({lang})"
+        pad = " " * max(0, 66 - len(label))
+        status_line = f"  {CYAN}│{RESET}   {GREEN}✔{RESET} {BOLD}Auto-aligned stack:{RESET} {WHITE}{fw}{RESET} {DIM}({lang}){RESET}{pad}{CYAN}│{RESET}"
+    else:
+        status_line = f"  {CYAN}│{RESET}   {DIM}ℹ Stack auto-detected on first /torusguard-audit run{RESET}              {CYAN}│{RESET}"
+
+    print(f"""  {CYAN}┌─ {BOLD}Step 2/3{RESET} {CYAN}──────────────────── {WHITE}Security Profile & Coverage{RESET} {CYAN}────────┐{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}Rule Families:{RESET}                                                      {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-SEC{RESET}     Secrets & Credentials    {YELLOW}TG-DB{RESET}      Database Safety    {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-INPUT{RESET}   Input Validation         {YELLOW}TG-AUTH{RESET}    Authentication     {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-CLIENT{RESET}  Client Bundle Leaks      {YELLOW}TG-DIFF{RESET}    Diff Inspection    {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-AGENT{RESET}   AI Agent Security        {YELLOW}TG-EDGE{RESET}    Serverless         {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-SUPPLY{RESET}  Supply Chain & CI/CD     {YELLOW}TG-SSRF{RESET}    Outbound Net       {CYAN}│{RESET}
+  {CYAN}│{RESET}     {YELLOW}TG-BIZ{RESET}     Business Logic                                      {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}Supported Stacks:{RESET}                                                  {CYAN}│{RESET}
+  {CYAN}│{RESET}     {GREEN}Python{RESET}    Django {DIM}·{RESET} FastAPI {DIM}·{RESET} Flask {DIM}·{RESET} DRF {DIM}·{RESET} SQLAlchemy              {CYAN}│{RESET}
+  {CYAN}│{RESET}     {GREEN}Node.js{RESET}   Next.js {DIM}·{RESET} Express {DIM}·{RESET} React {DIM}·{RESET} Supabase {DIM}·{RESET} Firebase       {CYAN}│{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+{status_line}
+  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+
+def print_step_3_bridges(registered_ides):
+    """Print the IDE command registration card."""
+    lines = ""
+    for r in registered_ides:
+        lines += f"  {CYAN}│{RESET}   {GREEN}✔{RESET} {r:<67} {CYAN}│{RESET}\n"
+
+    print(f"""  {CYAN}┌─ {BOLD}Step 3/3{RESET} {CYAN}─────────────────── {WHITE}AI IDE Command Registration{RESET} {CYAN}─────────┐{RESET}
+  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+{lines}  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
+  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
+""")
+
+
+def print_success_card():
+    """Print the final success card with next steps."""
+    print(f"""  {GREEN}╔═══════════════════════════════════════════════════════════════════════╗{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}   {GREEN}{BOLD}✅  WORKSPACE INITIALIZED SUCCESSFULLY{RESET}                               {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}╠═══════════════════════════════════════════════════════════════════════╣{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}   {BOLD}Next Steps:{RESET}                                                         {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}    {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard-audit{RESET}  or  {WHITE}/torusguard{RESET}              {GREEN}║{RESET}
+  {GREEN}║{RESET}    {CYAN}2.{RESET} In Terminal      {WHITE}npx torusguard status{RESET}                       {GREEN}║{RESET}
+  {GREEN}║{RESET}    {CYAN}3.{RESET} In CI/CD         {WHITE}npx torusguard audit{RESET}                        {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}║{RESET}   {DIM}Docs{RESET}   {CYAN}https://github.com/githubmofo/TorusGuard{RESET}                   {GREEN}║{RESET}
+  {GREEN}║{RESET}   {DIM}NPM{RESET}    {CYAN}https://npmjs.com/package/torusguard{RESET}                       {GREEN}║{RESET}
+  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
+  {GREEN}╚═══════════════════════════════════════════════════════════════════════╝{RESET}
+""")
+
+
+def print_already_initialized(target_root, cfg):
+    """Print the already-initialized status card."""
+    print(f"""
+  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
+  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  TORUSGUARD WORKSPACE{RESET}                           {GREEN}[Active]{RESET}         {CYAN}│{RESET}
+  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
+
+  {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
+  {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.0.0')}{RESET}
+  {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
+
+  {DIM}To refresh templates or re-scaffold, run:{RESET}
+     {CYAN}npx torusguard init --force{RESET}
+""")
+
+
+def scaffold_workspace(target_root=None, force=False, full_commands=False):
     """Scaffold the .torusguard workspace into the target project root."""
     target_root = Path(target_root or find_project_root()).resolve()
     torusguard_target = target_root / ".torusguard"
     script_dir = Path(__file__).resolve().parent
     payload_dir = script_dir / "payload"
 
-    print("================================================================================")
-    print("TORUSGUARD WORKSPACE BOOTSTRAPPER")
-    print("================================================================================")
-    print(f"Target Directory: {target_root}")
-    print(f"Destination:      {torusguard_target}")
-
     if torusguard_target.exists() and not force:
-        print(f"\n[INFO] Workspace already exists at {torusguard_target}")
         config_file = torusguard_target / "config" / "torusguard.json"
+        cfg = {}
         if config_file.exists():
             try:
                 with open(config_file, "r", encoding="utf-8") as f:
                     cfg = json.load(f)
-                print(f"Current Version:   {cfg.get('version', 'unknown')}")
-                print(f"Severity Minimum:  {cfg.get('severity_threshold', 'medium')}")
             except Exception:
                 pass
-        print("\nUse --force to re-scaffold or refresh templates.")
+        print_already_initialized(target_root, cfg)
         return True
 
-    # 1. Unpack Payload Template
+    # ── Header ──────────────────────────────────────────────────────────────
+    print_header()
+    print(f"  {BOLD}▸ Target Project:{RESET}     {WHITE}{target_root}{RESET}")
+    print(f"  {BOLD}▸ Destination:{RESET}        {WHITE}{torusguard_target}{RESET}")
+
+    # ── Step 1: Unpack Payload ──────────────────────────────────────────────
+    file_count = 93
     if payload_dir.is_dir():
-        print("\n1. Unpacking bundled offline workspace payload...")
         try:
             if torusguard_target.exists() and force:
                 shutil.rmtree(torusguard_target)
@@ -71,22 +200,25 @@ def scaffold_workspace(target_root=None, force=False):
                 torusguard_target,
                 ignore=shutil.ignore_patterns("runs", "*.pyc", "__pycache__", ".git*")
             )
-            print("  [SUCCESS] Copied template tree from local skill payload.")
+            # Count actual files
+            file_count = sum(1 for _ in torusguard_target.rglob("*") if _.is_file())
         except Exception as e:
-            print(f"  [ERROR] Failed to unpack payload: {e}")
+            print(f"\n  {RED}✖ Failed to unpack payload: {e}{RESET}")
             return False
     else:
         # Fallback: create base structure
-        print("\n1. Bundled payload not found. Creating core skeleton...")
         subdirs = [
             "config", "agents", "workflows", "scripts", "templates",
             "schemas", "references", "rules/active", "runs"
         ]
         for s in subdirs:
             (torusguard_target / s).mkdir(parents=True, exist_ok=True)
-        print("  [WARN] Bare skeleton created; full assets should be pulled from repository.")
+        file_count = 0
+
+    print()
+    print_step_1_assets(file_count)
 
-    # 2. Ensure runs and rules/active directories exist
+    # ── Ensure runs and rules/active directories exist ──────────────────────
     runs_dir = torusguard_target / "runs"
     runs_dir.mkdir(parents=True, exist_ok=True)
     gitkeep_runs = runs_dir / ".gitkeep"
@@ -99,52 +231,207 @@ def scaffold_workspace(target_root=None, force=False):
     if not gitkeep_rules.exists():
         gitkeep_rules.write_text("", encoding="utf-8")
 
-    # 3. Stack Detection & Tailoring
-    print("\n2. Executing stack detection on target project...")
+    # ── Ensure memory subsystem is initialized (v1.0.0) ────────────────────
+    memory_dir = torusguard_target / "memory"
+    memory_dir.mkdir(parents=True, exist_ok=True)
+    events_dir = memory_dir / "events"
+    events_dir.mkdir(parents=True, exist_ok=True)
+
+    gitkeep_events = events_dir / ".gitkeep"
+    if not gitkeep_events.exists():
+        gitkeep_events.write_text("", encoding="utf-8")
+
+    mem_gitignore = memory_dir / ".gitignore"
+    if not mem_gitignore.exists():
+        mem_gitignore.write_text("*\n", encoding="utf-8")
+
+    decay_file = memory_dir / "decay.json"
+    if not decay_file.exists():
+        decay_file.write_text(json.dumps({
+            "default_ttl_days": 90,
+            "decay_rate": 0.15,
+            "last_decay_run": None
+        }, indent=2), encoding="utf-8")
+
+    patterns_file = memory_dir / "patterns.json"
+    if not patterns_file.exists():
+        patterns_file.write_text("[]", encoding="utf-8")
+
+    profile_file = memory_dir / "profile.json"
+    if not profile_file.exists():
+        profile_file.write_text(json.dumps({
+            "stack": [],
+            "total_events": 0,
+            "active_patterns_count": 0,
+            "fix_rate_percentage": None,
+            "top_vulnerabilities": [],
+            "last_updated": None
+        }, indent=2), encoding="utf-8")
+
+    context_file = memory_dir / "context.json"
+    if not context_file.exists():
+        context_file.write_text(json.dumps({
+            "version": "1.0.0",
+            "generated_at": None,
+            "token_estimate": 0,
+            "max_token_budget": 2000,
+            "project_profile": {
+                "stack": [],
+                "total_events": 0,
+                "active_patterns_count": 0,
+                "fix_rate_percentage": None,
+                "top_vulnerabilities": []
+            },
+            "cards": []
+        }, indent=2), encoding="utf-8")
+
+    # Ensure target project root .gitignore excludes .torusguard/memory/
+    root_gitignore = target_root / ".gitignore"
+    if root_gitignore.exists():
+        try:
+            gi_content = root_gitignore.read_text(encoding="utf-8")
+            if ".torusguard/memory" not in gi_content:
+                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard security memory (local only)\n.torusguard/memory/\n", encoding="utf-8")
+        except Exception:
+            pass
+
+    # ── Step 2: Security Profile & Coverage (In-Process, Zero Subprocess) ──
+    # Execute stack detection in-process without spawning child processes (Socket.dev safe)
+    detected_stack = None
     stack_detect_script = torusguard_target / "scripts" / "stack_detect.py"
-    detected_stack = {"language": "Unknown", "framework": "None", "data_layer": "None", "confidence": "Uncertain"}
-    
-    if stack_detect_script.exists():
+    if stack_detect_script.is_file():
         try:
-            res = subprocess.run(
-                [sys.executable, str(stack_detect_script), str(target_root), "--json"],
-                capture_output=True,
-                text=True,
-                timeout=10
-            )
-            if res.returncode == 0 and res.stdout.strip():
-                detected_stack = json.loads(res.stdout)
-                print(f"  [DETECTED] Language:   {detected_stack.get('language')}")
-                print(f"  [DETECTED] Framework:  {detected_stack.get('framework')}")
-                print(f"  [DETECTED] Data Layer: {detected_stack.get('data_layer')}")
-        except Exception as e:
-            print(f"  [WARN] Stack detection encountered error: {e}")
+            import importlib.util
+            spec = importlib.util.spec_from_file_location("stack_detect", str(stack_detect_script))
+            if spec and spec.loader:
+                sd_mod = importlib.util.module_from_spec(spec)
+                spec.loader.exec_module(sd_mod)
+                if hasattr(sd_mod, "detect_stack"):
+                    detected_stack = sd_mod.detect_stack(target_root)
+        except Exception:
+            detected_stack = None
 
-    # 4. Update torusguard.json configuration
     config_file = torusguard_target / "config" / "torusguard.json"
     if config_file.exists():
         try:
             with open(config_file, "r", encoding="utf-8") as f:
                 cfg = json.load(f)
-            cfg["detected_stack"] = {
-                "language": detected_stack.get("language"),
-                "framework": detected_stack.get("framework"),
-                "data_layer": detected_stack.get("data_layer")
-            }
+            if detected_stack and detected_stack.get("framework") != "None":
+                cfg["detected_stack"] = {
+                    "language": detected_stack.get("language"),
+                    "framework": detected_stack.get("framework"),
+                    "data_layer": detected_stack.get("data_layer")
+                }
+            else:
+                cfg["detected_stack"] = {
+                    "language": "Unknown",
+                    "framework": "None",
+                    "data_layer": "None"
+                }
             with open(config_file, "w", encoding="utf-8") as f:
                 json.dump(cfg, f, indent=2)
-            print("  [SUCCESS] Configured .torusguard/config/torusguard.json")
-        except Exception as e:
-            print(f"  [WARN] Failed to write stack details to config: {e}")
-
-    print("\n================================================================================")
-    print("[SUCCESS] TORUSGUARD WORKSPACE SCAFFOLDED SUCCESSFULLY!")
-    print("================================================================================")
-    print(f"Workspace Path: {torusguard_target}")
-    print("\nNext Steps:")
-    print("  1. Run `/torusguard audit` in your AI IDE to scan the project.")
-    print("  2. Run `/torusguard status` to verify active security posture.")
-    print("================================================================================")
+        except Exception:
+            pass
+
+    print_step_2_profile(detected_stack)
+
+    # ── Step 3: Register Slash Commands for AI IDEs ─────────────────────────
+    registered_ides = []
+    tg_workflow_content = """---
+description: TorusGuard Autonomous Security Command Engine — run static security audits, authorized runtime web validation, governed remediation, and SARIF exports.
+version: 1.0.0
+tools: Read, Grep, Glob, Bash, Edit, Write
+agent: auditor
+---
+
+# /torusguard — Autonomous Application Security Guardrails
+
+$ARGUMENTS
+
+## Objective
+Execute TorusGuard security workflows across Python and TypeScript codebases.
+
+## Execution
+Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-validate`, `exploit-check`, `harden`, `apply`, `recheck`, `report`, `status`, `init`):
+1. **If action is omitted or 'status':** View `.torusguard/workflows/status.md` and report posture.
+2. **If action is specified:** Load the dedicated workflow from `.torusguard/workflows/<action>.md` and matching skill from `.torusguard/skills/torusguard-<action>/SKILL.md`.
+3. Follow the phase execution steps defined in the workflow.
+"""
+
+    # Ensure .agent/workflows and .agents/workflows are created
+    dest_workflow_dirs = []
+    if (target_root / ".agents").exists():
+        agents_wf = target_root / ".agents" / "workflows"
+        agents_wf.mkdir(parents=True, exist_ok=True)
+        (agents_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
+        dest_workflow_dirs.append(agents_wf)
+        registered_ides.append("Antigravity / Gemini     .agents/workflows/torusguard.md")
+
+    agent_wf = target_root / ".agent" / "workflows"
+    agent_wf.mkdir(parents=True, exist_ok=True)
+    (agent_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
+    dest_workflow_dirs.append(agent_wf)
+    registered_ides.append("Tribunal Agent Kit       .agent/workflows/torusguard.md")
+
+    # When full_commands is requested (e.g. via NPM package npx torusguard init),
+    # unlock and register all 11 individual slash commands
+    if full_commands:
+        src_wf = torusguard_target / "workflows"
+        if src_wf.is_dir():
+            count = 0
+            for wf_file in src_wf.glob("*.md"):
+                if wf_file.name == "torusguard.md":
+                    continue
+                cmd_filename = f"torusguard-{wf_file.name}"
+                for d in dest_workflow_dirs:
+                    shutil.copy2(wf_file, d / cmd_filename)
+                count += 1
+            registered_ides.append(f"{count} Slash Commands          /torusguard-audit, -harden, -apply, ...")
+
+    # Claude Code (.claude/commands)
+    claude_dir = target_root / ".claude"
+    if claude_dir.exists():
+        claude_commands = claude_dir / "commands"
+        claude_commands.mkdir(parents=True, exist_ok=True)
+        (claude_commands / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
+        registered_ides.append("Claude Code              .claude/commands/torusguard.md")
+
+    # Cursor (.cursor/rules)
+    cursor_dir = target_root / ".cursor"
+    if cursor_dir.exists():
+        cursor_rules = cursor_dir / "rules"
+        cursor_rules.mkdir(parents=True, exist_ok=True)
+        (cursor_rules / "torusguard.mdc").write_text(tg_workflow_content, encoding="utf-8")
+        registered_ides.append("Cursor                   .cursor/rules/torusguard.mdc")
+
+    # Windsurf (.windsurfrules)
+    if (target_root / ".windsurfrules").exists() or (target_root / ".windsurf").exists():
+        windsurf_rules = target_root / ".windsurfrules"
+        current_content = windsurf_rules.read_text(encoding="utf-8") if windsurf_rules.exists() else ""
+        if "TorusGuard" not in current_content:
+            windsurf_rules.write_text(current_content + "\n\n" + tg_workflow_content, encoding="utf-8")
+        registered_ides.append("Windsurf                 .windsurfrules")
+
+    # VS Code / GitHub Copilot (.github/copilot-instructions.md)
+    github_dir = target_root / ".github"
+    if github_dir.exists():
+        copilot_file = github_dir / "copilot-instructions.md"
+        current_content = copilot_file.read_text(encoding="utf-8") if copilot_file.exists() else ""
+        if "TorusGuard" not in current_content:
+            copilot_file.write_text(current_content + "\n\n# TorusGuard Security Instructions\n" + tg_workflow_content, encoding="utf-8")
+        registered_ides.append("VS Code / Copilot        .github/copilot-instructions.md")
+
+    # Universal AGENTS.md (Kimi, Codex, Open Agent Standard)
+    agents_md = target_root / "AGENTS.md"
+    current_agents = agents_md.read_text(encoding="utf-8") if agents_md.exists() else ""
+    if "TorusGuard" not in current_agents:
+        agents_md.write_text(current_agents + ("\n\n" if current_agents else "") + "# TorusGuard Security Guardrails\n\nRun `/torusguard audit` to scan the codebase or refer to `.torusguard/` for security guidelines.\n", encoding="utf-8")
+        registered_ides.append("Universal AGENTS.md      Kimi / Open Agent Standard")
+
+    print_step_3_bridges(registered_ides)
+
+    # ── Success Card ────────────────────────────────────────────────────────
+    print_success_card()
     return True
 
 
@@ -152,7 +439,8 @@ if __name__ == "__main__":
     parser = argparse.ArgumentParser(description="TorusGuard Autonomous Workspace Bootstrapper")
     parser.add_argument("--target", type=str, help="Target project root directory")
     parser.add_argument("--force", action="store_true", help="Force overwrite existing workspace")
+    parser.add_argument("--full-commands", action="store_true", help="Unlock and register all 11 individual slash commands")
     args = parser.parse_args()
 
-    success = scaffold_workspace(target_root=args.target, force=args.force)
+    success = scaffold_workspace(target_root=args.target, force=args.force, full_commands=args.full_commands)
     sys.exit(0 if success else 1)

package/skills/torusguard/payload/skills/torusguard/references/csharp-security.md

@@ -0,0 +1,41 @@
+# TorusGuard Skill Reference: C# & ASP.NET Core Security
+
+> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Authentication & Authorization
+* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
+* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
+
+### 2. Entity Framework Core & SQL Injection
+* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
+* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
+* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
+
+### 3. Anti-Forgery & TLS
+* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
+* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```csharp
+// Safe Entity Framework Parameterized Query
+var user = await context.Users
+    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
+    .FirstOrDefaultAsync();
+
+// Safe Global Query Filter in DbContext
+modelBuilder.Entity<Invoice>()
+    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
+
+// Safe Controller Security
+[Authorize]
+[ApiController]
+[Route("api/[controller]")]
+public class InvoicesController : ControllerBase { ... }
+```

package/skills/torusguard/payload/skills/torusguard/references/go-security.md

@@ -0,0 +1,41 @@
+# TorusGuard Skill Reference: Go Security
+
+> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Database & SQL Injection
+* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
+* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
+
+### 2. TLS & Network Security
+* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
+* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
+
+### 3. Concurrency & Goroutine Safety
+* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
+* Use mutexes or channels to prevent data races on shared state.
+
+### 4. Input Validation & Path Traversal
+* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```go
+// Safe Parameterized Query
+row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
+
+// Safe GORM Scoping
+var invoice Invoice
+result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
+
+// Safe TLS Client
+tlsConfig := &tls.Config{
+    MinVersion: tls.VersionTLS13,
+}
+client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
+```

package/skills/torusguard/payload/skills/torusguard/references/java-security.md

@@ -0,0 +1,40 @@
+# TorusGuard Skill Reference: Java & Spring Security
+
+> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Spring Security & CSRF
+* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
+* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
+
+### 2. JPA & Hibernate SQL Injection
+* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
+* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
+
+### 3. Insecure Deserialization & XML
+* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
+* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```java
+// Safe JPA Query
+@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
+Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
+
+// Safe Spring Security Configuration
+@Bean
+public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http
+        .authorizeHttpRequests(auth -> auth
+            .requestMatchers("/public/**").permitAll()
+            .anyRequest().authenticated()
+        );
+    return http.build();
+}
+```

package/skills/torusguard/payload/skills/torusguard/references/polyglot-security-matrix.md

@@ -0,0 +1,25 @@
+# TorusGuard Universal Polyglot Security Matrix
+
+> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
+
+---
+
+## 🛡️ Cross-Language Invariant Mappings
+
+| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
+|---|---|---|---|---|---|---|
+| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
+| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
+| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
+| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
+| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
+| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
+| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
+
+---
+
+## 🚀 Polyglot Hardening Rules of Thumb
+
+1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
+2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
+3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.