torusguard 0.9.5 → 1.3.0

package/.torusguard/scripts/diff_guard.py

@@ -1,7 +1,8 @@
 #!/usr/bin/env python3
 """
-TorusGuard Content-Aware Diff Line Scanner (v0.9.3)
-Evaluates unified diff patches against security invariants before harden or apply.
+TorusGuard Content-Aware Diff Line Scanner (v1.0.0)
+Evaluates unified diff patches against security invariants before harden or apply,
+including regression watch checks against persistent memory patterns.
 Pure Python 3.10+ standard library (zero external dependencies).
 """
 
@@ -14,12 +15,39 @@ from pathlib import Path
 from typing import Dict, List, Any, Optional
 
 BYPASS_PATTERNS = [
-    (re.compile(r'(?:#|//)\s*(?:TODO\s*:?\s*)?(?:bypass|skip|disable)[_\s]*(?:auth|security|check|guard|filter|csrf|tenant)', re.IGNORECASE), "Suspicious authentication or security check bypass comment"),
+    (re.compile(r'(?:#|//|/\*)\s*(?:TODO\s*:?\s*)?(?:bypass|skip|disable)[_\s]*(?:auth|security|check|guard|filter|csrf|tenant)', re.IGNORECASE), "Suspicious authentication or security check bypass comment"),
+    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust
     (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+    (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+    (re.compile(r'\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\b'), "Disabled Java / C# TLS certificate validation"),
+    (re.compile(r'\bServerCertificateCustomValidationCallback\s*=\s*(?:\([^)]*\)\s*=>\s*true|HttpClientHandler\.DangerousAcceptAnyServerCertificateValidator)'), "Disabled C# TLS certificate callback"),
+    (re.compile(r'\bCURLOPT_SSL_VERIFYPEER\s*(?:=>|,)\s*(?:false|0)\b', re.IGNORECASE), "Disabled PHP curl SSL verification (CURLOPT_SSL_VERIFYPEER => false)"),
+    (re.compile(r'\bdanger_accept_invalid_certs\s*\(\s*true\s*\)'), "Disabled Rust reqwest TLS certificate validation"),
+    # Auth & CSRF bypasses
     (re.compile(r'\b(?:skip_auth|bypass_auth|disable_auth|allow_all|permit_all)\s*=\s*True\b', re.IGNORECASE), "Explicit security bypass flag enabled"),
     (re.compile(r'@(?:csrf_exempt|allow_anonymous|disable_token_check)\b'), "Decorator disabling route-level security or CSRF protection"),
+    (re.compile(r'\[(?:AllowAnonymous|Authorize\s*\(\s*Roles\s*=\s*"\*"\s*\))\]'), "Attribute disabling ASP.NET authentication or authorization"),
+    (re.compile(r'\.csrf\(\)\.disable\(\)|\.csrf\([^)]*AbstractHttpConfigurer::disable\)'), "Spring Security CSRF protection explicitly disabled"),
+    # CORS wildcard with credentials
     (re.compile(r'\bCORS_ALLOW_ALL_ORIGINS\s*=\s*True\b'), "Wildcard CORS origin enabled in patch"),
-    (re.compile(r'(?:#|//)\s*nosec\b', re.IGNORECASE), "Suppression comment (nosec) hiding potential vulnerability")
+    (re.compile(r'@CrossOrigin\s*\(\s*(?:origins\s*=\s*)?["\']\*["\']'), "Wildcard CORS origin annotation in Java/Spring"),
+    # Native dangerous constructs
+    (re.compile(r'\bextract\s*\(\s*\$_(?:POST|GET|REQUEST)\s*\)'), "Dangerous PHP extract() on untrusted user input"),
+    (re.compile(r'\bunsafe\s*\{'), "Unvetted Rust unsafe block introduced in patch"),
+    # Polyglot additional security bypasses (Python, Ruby, Java, Kotlin, Elixir, Dart, C++)
+    (re.compile(r'\bSESSION_COOKIE_SECURE\s*=\s*False\b'), "Session cookie secure flag disabled"),
+    (re.compile(r'\bparams\.permit!'), "Rails strong parameters mass assignment bypass (params.permit!)"),
+    (re.compile(r'\b(?:csrf(?:\(\))?\.disable\(\)|\.csrf\(\)\.disable\(\)|\.csrf\([^)]*AbstractHttpConfigurer::disable\))'), "CSRF protection explicitly disabled"),
+    (re.compile(r'\b(?:verify_peer\s*:\s*false|verify\s*:\s*:verify_none)\b'), "Disabled Elixir TLS certificate verification"),
+    (re.compile(r'\bbadCertificateCallback\s*='), "Disabled Dart/Flutter badCertificateCallback validation"),
+    (re.compile(r'\bSSL_VERIFY_NONE\b'), "Disabled C/C++ OpenSSL certificate verification (SSL_VERIFY_NONE)"),
+    (re.compile(r'\bpermitAll\(\)'), "Unrestricted access granted via permitAll()"),
+    (re.compile(r'\bverify\s*(?:=>|=)\s*false\b', re.IGNORECASE), "Disabled TLS/HTTP client verification (verify => false)"),
+    # Linters and scanners suppressions
+    (re.compile(r'(?:#|//|/\*)\s*nosec\b', re.IGNORECASE), "Suppression comment (nosec) hiding potential vulnerability"),
+    (re.compile(r'@SuppressWarnings\s*\(\s*["\'](?:security|all)["\']\s*\)'), "Java security suppression annotation")
 ]
 
 SECRET_PATTERNS = [
@@ -34,20 +62,76 @@ TENANT_FILTER_PATTERNS = [
     re.compile(r'\.filter\([^)]*\btenant\s*='),
     re.compile(r'\.filter_by\([^)]*\btenant\s*='),
     re.compile(r'\bwhere\s+tenant_id\s*='),
-    re.compile(r'\btenant_id\s*==?')
+    re.compile(r'\btenant_id\s*==?'),
+    re.compile(r'\btenantId\s*:'),
+    re.compile(r'\.Where\([^)]*(?:tenant_id|TenantId)'),
+    re.compile(r'\bwhere\s*:\s*\{[^}]*tenant')
 ]
 
 
-def audit_diff(diff_content: str) -> Dict[str, Any]:
+def check_memory_regressions(
+    current_file: str,
+    current_line: int,
+    added_content: str,
+    root_dir: Optional[Path] = None
+) -> List[Dict[str, Any]]:
+    """
+    Check if the added line re-introduces a vulnerability in a file
+    that is tracked under active Regression Watch in .torusguard/memory/patterns.json.
+    """
+    violations = []
+    base = Path(root_dir or Path.cwd()).resolve()
+    torusguard_dir = base / ".torusguard"
+    if not torusguard_dir.exists():
+        for parent in base.parents:
+            if (parent / ".torusguard").exists():
+                torusguard_dir = parent / ".torusguard"
+                break
+
+    patterns_file = torusguard_dir / "memory" / "patterns.json"
+    if not patterns_file.exists():
+        return violations
+
+    try:
+        with open(patterns_file, "r", encoding="utf-8") as f:
+            patterns = json.load(f)
+    except Exception:
+        return violations
+
+    clean_file = current_file.replace("\\", "/")
+    for pat in patterns:
+        if pat.get("pattern_type") == "regression_watch":
+            affected = [f.replace("\\", "/") for f in pat.get("affected_files", [])]
+            if clean_file in affected or any(clean_file.endswith(a) for a in affected):
+                rule_id = pat.get("rule_id", "TG-REG")
+                desc = pat.get("description", "Regression watch violation")
+                violations.append({
+                    "rule_id": "TG-DIFF-004",
+                    "category": "Regression Watch",
+                    "severity": "HIGH",
+                    "file": current_file,
+                    "line": current_line,
+                    "content": added_content.strip(),
+                    "description": f"File {current_file} matches active Regression Watch for {rule_id}: {desc}"
+                })
+    return violations
+
+
+def audit_diff(
+    diff_content: str,
+    check_memory: bool = False,
+    root_dir: Optional[Path] = None
+) -> Dict[str, Any]:
     """
     Parses a unified diff and returns detected violations.
+    Optionally checks against active regression watch patterns in memory.
     """
     lines = diff_content.splitlines()
     violations: List[Dict[str, Any]] = []
-    
+
     current_file = "unknown"
     current_line = 0
-    
+
     additions: List[tuple[int, str]] = []
     deletions: List[tuple[int, str]] = []
 
@@ -68,7 +152,7 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
             current_line += 1
             added_content = line[1:]
             additions.append((current_line, added_content))
-            
+
             # Check bypass patterns
             for pat, desc in BYPASS_PATTERNS:
                 if pat.search(added_content):
@@ -81,7 +165,7 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
                         "content": added_content.strip(),
                         "description": desc
                     })
-                    
+
             # Check secret ingestion
             for pat, desc in SECRET_PATTERNS:
                 if pat.search(added_content):
@@ -95,6 +179,11 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
                         "description": desc
                     })
 
+            # Check memory regression watch if requested
+            if check_memory:
+                reg_violations = check_memory_regressions(current_file, current_line, added_content, root_dir=root_dir)
+                violations.extend(reg_violations)
+
         elif line.startswith('-') and not line.startswith('---'):
             deleted_content = line[1:]
             deletions.append((line_idx, deleted_content))
@@ -127,7 +216,7 @@ def audit_diff(diff_content: str) -> Dict[str, Any]:
     }
 
 
-def audit_diff_file(file_path: str) -> Dict[str, Any]:
+def audit_diff_file(file_path: str, check_memory: bool = False, root_dir: Optional[Path] = None) -> Dict[str, Any]:
     path = Path(file_path)
     if not path.is_file():
         return {
@@ -136,23 +225,120 @@ def audit_diff_file(file_path: str) -> Dict[str, Any]:
             "violations": []
         }
     content = path.read_text(encoding="utf-8", errors="replace")
-    return audit_diff(content)
+    return audit_diff(content, check_memory=check_memory, root_dir=root_dir)
+
+
+def check_diff_content(diff_content: str, file_path: str = "") -> List[Dict[str, Any]]:
+    """Convenience helper to audit diff string directly and return list of violations."""
+    res = audit_diff(diff_content)
+    return res.get("violations", [])
+
+
+def install_pre_commit_hook(root_dir: Optional[Path] = None) -> bool:
+    """Install TorusGuard pre-commit security hook into .git/hooks/pre-commit."""
+    base = Path(root_dir or Path.cwd()).resolve()
+    git_dir = base / ".git"
+    if not git_dir.exists():
+        for parent in base.parents:
+            if (parent / ".git").exists():
+                git_dir = parent / ".git"
+                break
+    if not git_dir.exists():
+        print("[ERROR] Diff Guard: Not a git repository (no .git directory found).", file=sys.stderr)
+        return False
+
+    hooks_dir = git_dir / "hooks"
+    hooks_dir.mkdir(parents=True, exist_ok=True)
+    hook_file = hooks_dir / "pre-commit"
+
+    hook_script = """#!/usr/bin/env sh
+# TorusGuard Pre-Commit Security Diff Guard
+# Automatically blocks commits containing security bypasses, secret leaks, or tenant stripping.
+python .torusguard/scripts/diff_guard.py --pre-commit
+"""
+    try:
+        hook_file.write_text(hook_script, encoding="utf-8")
+        if os.name != "nt":
+            import stat
+            os.chmod(hook_file, hook_file.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+        print(f"[SUCCESS] Installed TorusGuard pre-commit hook at: {hook_file}")
+        return True
+    except Exception as e:
+        print(f"[ERROR] Diff Guard: Failed to install pre-commit hook: {e}", file=sys.stderr)
+        return False
+
+
+def uninstall_pre_commit_hook(root_dir: Optional[Path] = None) -> bool:
+    """Uninstall TorusGuard pre-commit hook from .git/hooks/pre-commit."""
+    base = Path(root_dir or Path.cwd()).resolve()
+    git_dir = base / ".git"
+    if not git_dir.exists():
+        for parent in base.parents:
+            if (parent / ".git").exists():
+                git_dir = parent / ".git"
+                break
+    if not git_dir.exists():
+        print("[WARN] Diff Guard: No .git directory found.", file=sys.stderr)
+        return False
+
+    hook_file = git_dir / "hooks" / "pre-commit"
+    if hook_file.exists():
+        try:
+            hook_file.unlink()
+            print("[SUCCESS] Uninstalled TorusGuard pre-commit hook.")
+            return True
+        except Exception as e:
+            print(f"[ERROR] Diff Guard: Failed to delete hook file: {e}", file=sys.stderr)
+            return False
+    else:
+        print("[INFO] Diff Guard: No pre-commit hook currently installed.")
+        return True
 
 
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Unified Diff Security Scanner")
     parser.add_argument("diff_path", nargs="?", help="Path to unified diff file (or read stdin if omitted)")
+    parser.add_argument("--check-memory", action="store_true", help="Check additions against persistent memory regression watch patterns")
+    parser.add_argument("--pre-commit", action="store_true", help="Audit git staged diff (--cached) for pre-commit hook")
+    parser.add_argument("--install-hook", action="store_true", help="Install TorusGuard pre-commit hook into .git/hooks/pre-commit")
+    parser.add_argument("--uninstall-hook", action="store_true", help="Uninstall TorusGuard pre-commit hook")
     parser.add_argument("--json", action="store_true", help="Output results as JSON")
     args = parser.parse_args()
 
-    if args.diff_path:
-        res = audit_diff_file(args.diff_path)
+    if args.install_hook:
+        sys.exit(0 if install_pre_commit_hook() else 1)
+
+    if args.uninstall_hook:
+        sys.exit(0 if uninstall_pre_commit_hook() else 1)
+
+    if args.pre_commit:
+        import subprocess
+        try:
+            res_git = subprocess.run(
+                ["git", "diff", "--cached"],
+                capture_output=True,
+                text=True,
+                encoding="utf-8",
+                errors="replace"
+            )
+            diff_text = res_git.stdout
+        except Exception as e:
+            print(f"[ERROR] Diff Guard: Could not read git staged diff: {e}", file=sys.stderr)
+            sys.exit(1)
+
+        if not diff_text.strip():
+            print("[PASS] Diff Guard (pre-commit): No staged changes detected.")
+            sys.exit(0)
+
+        res = audit_diff(diff_text, check_memory=True)
+    elif args.diff_path:
+        res = audit_diff_file(args.diff_path, check_memory=args.check_memory)
     else:
         if sys.stdin.isatty():
             parser.print_help()
             sys.exit(1)
         diff_text = sys.stdin.read()
-        res = audit_diff(diff_text)
+        res = audit_diff(diff_text, check_memory=args.check_memory)
 
     if args.json:
         print(json.dumps(res, indent=2))
@@ -169,3 +355,4 @@ def main():
 
 if __name__ == "__main__":
     main()
+

package/.torusguard/scripts/finding_scorer.py

@@ -1,86 +1,199 @@
-#!/usr/bin/env python3
-"""
-TorusGuard 5-Factor Finding Confidence Scorer
-Evaluates finding confidence against the objective 0–100 scoring model.
-"""
-
-import sys
-import json
-import argparse
-from typing import Dict, Any, Tuple
-
-def compute_confidence_score(
-    evidence_quality: int = 35,
-    reproduction_success: int = 0,
-    independent_confirmations: int = 5,
-    environmental_clarity: int = 15,
-    manual_review_status: int = 0
-) -> Tuple[int, str, Dict[str, int]]:
-    """
-    Computes total score and assigns confidence band.
-    Max points:
-    - evidence_quality: 35
-    - reproduction_success: 25
-    - independent_confirmations: 15
-    - environmental_clarity: 15
-    - manual_review_status: 10
-    """
-    eq = min(max(evidence_quality, 0), 35)
-    rs = min(max(reproduction_success, 0), 25)
-    ic = min(max(independent_confirmations, 0), 15)
-    ec = min(max(environmental_clarity, 0), 15)
-    mr = min(max(manual_review_status, 0), 10)
-
-    total = eq + rs + ic + ec + mr
-
-    if total >= 90:
-        band = "Confirmed"
-    elif total >= 70:
-        band = "High Confidence"
-    elif total >= 50:
-        band = "Medium Confidence"
-    else:
-        band = "Needs Review"
-
-    factors = {
-        "evidence_quality": eq,
-        "reproduction_success": rs,
-        "independent_confirmations": ic,
-        "environmental_clarity": ec,
-        "manual_review_status": mr,
-        "total_score": total,
-        "classification_band": band
-    }
-    return total, band, factors
-
-
-def main():
-    parser = argparse.ArgumentParser(description="TorusGuard Confidence Scorer")
-    parser.add_argument("--eq", type=int, default=35, help="Evidence quality score (0-35)")
-    parser.add_argument("--rs", type=int, default=0, help="Reproduction success score (0-25)")
-    parser.add_argument("--ic", type=int, default=5, help="Independent confirmations score (0-15)")
-    parser.add_argument("--ec", type=int, default=15, help="Environmental clarity score (0-15)")
-    parser.add_argument("--mr", type=int, default=0, help="Manual review status score (0-10)")
-    parser.add_argument("--json", action="store_true", help="Output JSON")
-    args = parser.parse_args()
-
-    total, band, factors = compute_confidence_score(
-        evidence_quality=args.eq,
-        reproduction_success=args.rs,
-        independent_confirmations=args.ic,
-        environmental_clarity=args.ec,
-        manual_review_status=args.mr
-    )
-
-    if args.json:
-        print(json.dumps(factors, indent=2))
-    else:
-        print(f"Total Confidence Score: {total}/100")
-        print(f"Classification Band: {band}")
-        print("Factor Breakdown:")
-        for k, v in factors.items():
-            if k not in ("total_score", "classification_band"):
-                print(f"  - {k}: {v}")
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""
+TorusGuard Finding Confidence Scorer (v1.0.0)
+Evaluates finding confidence against the objective 0–100 scoring model,
+augmented by persistent memory patterns and false-positive suppression.
+"""
+
+import sys
+import json
+import argparse
+from pathlib import Path
+from typing import Dict, Any, Tuple, Optional
+
+
+def compute_memory_boost(
+    rule_id: str,
+    file_path: Optional[str] = None,
+    root_dir: Optional[Path] = None
+) -> int:
+    """
+    Query .torusguard/memory/patterns.json to calculate memory confidence modifier:
+    - False positive class: -30 (heavily suppressed)
+    - Regression watch: +15 (high alert / known recurrence)
+    - Recurring fix / Common vulnerability: +10
+    - Security idiom: +5
+    - Multi-file pattern match bonus: +5
+    """
+    if not rule_id:
+        return 0
+
+    base = Path(root_dir or Path.cwd()).resolve()
+    # Search for .torusguard
+    torusguard_dir = base / ".torusguard"
+    if not torusguard_dir.exists():
+        for parent in base.parents:
+            if (parent / ".torusguard").exists():
+                torusguard_dir = parent / ".torusguard"
+                break
+
+    patterns_file = torusguard_dir / "memory" / "patterns.json"
+    if not patterns_file.exists():
+        return 0
+
+    try:
+        with open(patterns_file, "r", encoding="utf-8") as f:
+            patterns = json.load(f)
+    except (json.JSONDecodeError, OSError, UnicodeDecodeError):
+        return 0
+
+    boost = 0
+    matched_file = False
+    matched_dir = False
+    target_path = Path(file_path) if file_path else None
+
+    for pat in patterns:
+        if pat.get("rule_id") == rule_id:
+            ptype = pat.get("pattern_type")
+            if ptype == "false_positive_class":
+                boost -= 30
+            elif ptype == "regression_watch":
+                boost += 15
+            elif ptype in ("recurring_fix", "common_vulnerability"):
+                boost += 10
+            elif ptype == "security_idiom":
+                boost += 5
+
+            # File-specific and directory-level correlation bonus
+            affected = pat.get("affected_files", [])
+            if file_path and file_path in affected:
+                matched_file = True
+            elif target_path and any(target_path.parent == Path(af).parent for af in affected if af):
+                matched_dir = True
+
+    if matched_file and boost > 0:
+        boost += 5
+    elif matched_file and boost < 0:
+        boost -= 10
+    elif matched_dir and boost > 0:
+        boost += 2
+    elif matched_dir and boost < 0:
+        boost -= 4
+
+    return boost
+
+
+def is_test_path(file_path: Optional[str]) -> bool:
+    """Detects whether a file path belongs to a test suite, fixture, or mock."""
+    if not file_path:
+        return False
+    clean = file_path.replace("\\", "/").lower()
+    test_markers = [
+        "/test/", "/tests/", "/spec/", "/specs/", "/fixtures/", "/mock/", "/mocks/",
+        "/e2e/", "__tests__", "test_", "_test.", ".test.", ".spec.", "testcase"
+    ]
+    return any(marker in clean for marker in test_markers) or clean.endswith(("_test.go", "test.java", "test.py", ".spec.ts", ".test.ts", ".spec.js", ".test.js"))
+
+
+def compute_confidence_score(
+    evidence_quality: int = 35,
+    reproduction_success: int = 0,
+    independent_confirmations: int = 5,
+    environmental_clarity: int = 15,
+    manual_review_status: int = 0,
+    memory_boost: int = 0,
+    rule_id: Optional[str] = None,
+    file_path: Optional[str] = None,
+    root_dir: Optional[Path] = None
+) -> Tuple[int, str, Dict[str, Any]]:
+    """
+    Computes total score and assigns confidence band.
+    Max points:
+    - evidence_quality: 35
+    - reproduction_success: 25
+    - independent_confirmations: 15
+    - environmental_clarity: 15
+    - manual_review_status: 10
+    - memory_boost: -30 to +20 (modifier from persistent memory)
+    - test_deduction: -30 if file is located in a test/mock path
+    Total is clamped to [0, 100].
+    """
+    eq = min(max(evidence_quality, 0), 35)
+    rs = min(max(reproduction_success, 0), 25)
+    ic = min(max(independent_confirmations, 0), 15)
+    ec = min(max(environmental_clarity, 0), 15)
+    mr = min(max(manual_review_status, 0), 10)
+
+    # Auto-calculate memory boost if rule_id provided and memory_boost == 0
+    eff_mem_boost = memory_boost
+    if rule_id and eff_mem_boost == 0:
+        eff_mem_boost = compute_memory_boost(rule_id, file_path=file_path, root_dir=root_dir)
+
+    # Test path noise suppression: -30 deduction for test mocks/fixtures
+    is_test = is_test_path(file_path)
+    test_deduction = -30 if is_test else 0
+
+    raw_total = eq + rs + ic + ec + mr + eff_mem_boost + test_deduction
+    total = min(max(raw_total, 0), 100)
+
+    if total >= 90:
+        band = "Confirmed"
+    elif total >= 70:
+        band = "High Confidence"
+    elif total >= 50:
+        band = "Medium Confidence"
+    else:
+        band = "Needs Review"
+
+    factors = {
+        "evidence_quality": eq,
+        "reproduction_success": rs,
+        "independent_confirmations": ic,
+        "environmental_clarity": ec,
+        "manual_review_status": mr,
+        "memory_boost": eff_mem_boost,
+        "test_exemption": is_test,
+        "test_deduction": test_deduction,
+        "total_score": total,
+        "classification_band": band
+    }
+    return total, band, factors
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Confidence Scorer")
+    parser.add_argument("--eq", type=int, default=35, help="Evidence quality score (0-35)")
+    parser.add_argument("--rs", type=int, default=0, help="Reproduction success score (0-25)")
+    parser.add_argument("--ic", type=int, default=5, help="Independent confirmations score (0-15)")
+    parser.add_argument("--ec", type=int, default=15, help="Environmental clarity score (0-15)")
+    parser.add_argument("--mr", type=int, default=0, help="Manual review status score (0-10)")
+    parser.add_argument("--memory-boost", type=int, default=0, help="Memory boost score (-30 to +20)")
+    parser.add_argument("--rule-id", type=str, help="TorusGuard rule ID for memory pattern matching")
+    parser.add_argument("--file", type=str, help="File path for correlation matching")
+    parser.add_argument("--json", action="store_true", help="Output JSON")
+    args = parser.parse_args()
+
+    total, band, factors = compute_confidence_score(
+        evidence_quality=args.eq,
+        reproduction_success=args.rs,
+        independent_confirmations=args.ic,
+        environmental_clarity=args.ec,
+        manual_review_status=args.mr,
+        memory_boost=args.memory_boost,
+        rule_id=args.rule_id,
+        file_path=args.file
+    )
+
+    if args.json:
+        print(json.dumps(factors, indent=2))
+    else:
+        print(f"Total Confidence Score: {total}/100")
+        print(f"Classification Band: {band}")
+        print("Factor Breakdown:")
+        for k, v in factors.items():
+            if k not in ("total_score", "classification_band"):
+                print(f"  - {k}: {v}")
+
+
+if __name__ == "__main__":
+    main()