torusguard 1.0.0 → 1.3.1

package/bin/torusguard.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 
 /**
  * TorusGuard CLI Runner (NPM Distribution)
@@ -49,7 +49,7 @@ function printHelp() {
   console.log(`
   ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  T O R U S G U A R D   C L I${RESET}                          ${GRAY}v1.0.0${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  T O R U S G U A R D   C L I${RESET}                          ${GRAY}v1.3.1${RESET}   ${CYAN}│${RESET}
   ${CYAN}│${RESET}   ${DIM}Autonomous Security Engine for AI-Built Applications${RESET}               ${CYAN}│${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
   ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
@@ -61,11 +61,27 @@ function printHelp() {
   ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
   ${CYAN}│${RESET}  ${GREEN}init${RESET}      Scaffold ${BOLD}.torusguard/${RESET} workspace + unlock 12 slash commands   ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}status${RESET}    Display active security posture, memory, rules, and stack   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}memory${RESET}    Manage persistent security memory (export, import, decay)   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}rules${RESET}     Auto-sync memory to AI IDE rules (.cursorrules, CLAUDE.md)  ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}memory${RESET}    Manage persistent security memory (export, hook, learn)     ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}audit${RESET}     Run static AST security scan on the target project          ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}report${RESET}    Export OASIS SARIF v2.1.0 structured telemetry              ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}harden${RESET}    Formulate minimal candidate patches (Ponytail bounded)      ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}apply${RESET}     Apply candidate patches with automatic .bak snapshots       ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}recheck${RESET}   Targeted differential verification of applied fixes         ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}recipes${RESET}   List & inspect distilled Golden Fix Recipes in memory       ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}rollback${RESET}  Instantly revert files from latest pre-apply snapshot       ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}report${RESET}    Export OASIS SARIF v2.1.0 or single-file visual HTML report ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}diff-guard${RESET} Scan diffs or wire pre-commit hook (--install-hook)        ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}help${RESET}      Show this interactive command guide                         ${CYAN}│${RESET}
   ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
+  ${CYAN}│${RESET}  ${BOLD}AI & Memory Subcommands${RESET}                                               ${CYAN}│${RESET}
+  ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
+  ${CYAN}│${RESET}  ${WHITE}rules sync${RESET}       ${DIM}[--format all|cursor|claude|agent|windsurf]${RESET}        ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}report --html${RESET}    ${DIM}[--out <path>] Self-contained visual HTML dashboard${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}memory context${RESET}   ${DIM}[--role auditor|remediator|reviewer] [--file <f>]${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}memory hook${RESET}      ${DIM}[install|uninstall] Git pre-commit regression hook${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}memory learn${RESET}     ${DIM}[--commits <range>] Ingest security commit fixes${RESET}     ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${WHITE}memory export${RESET}    ${DIM}[--path <file>] [--sanitized] Safe team sharing${RESET}      ${CYAN}│${RESET}
+  ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
   ${CYAN}│${RESET}  ${BOLD}Options${RESET}                                                               ${CYAN}│${RESET}
   ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
   ${CYAN}│${RESET}  ${GRAY}--target <dir>${RESET}   Target directory to analyze or scaffold ${DIM}(default: .)${RESET}  ${CYAN}│${RESET}
@@ -126,7 +142,7 @@ if (command === 'status') {
       console.log(`
   ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  TORUSGUARD SECURITY POSTURE${RESET}                        ${GRAY}v1.0.0${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  TORUSGUARD SECURITY POSTURE${RESET}                        ${GRAY}v1.3.1${RESET}   ${CYAN}│${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
   ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
 
@@ -190,6 +206,18 @@ if (command === 'memory') {
     pyArgs.push('--action', 'status');
   } else if (sub === 'context') {
     pyArgs.push('--action', 'context');
+    const roleIdx = args.indexOf('--role');
+    if (roleIdx !== -1 && args[roleIdx + 1]) {
+      pyArgs.push('--role', args[roleIdx + 1]);
+    }
+    const fileIdx = args.indexOf('--file') !== -1 ? args.indexOf('--file') : args.indexOf('-f');
+    if (fileIdx !== -1 && args[fileIdx + 1]) {
+      pyArgs.push('--file', args[fileIdx + 1]);
+    }
+    const ruleIdx = args.indexOf('--rule') !== -1 ? args.indexOf('--rule') : args.indexOf('-r');
+    if (ruleIdx !== -1 && args[ruleIdx + 1]) {
+      pyArgs.push('--rule-id', args[ruleIdx + 1]);
+    }
   } else if (sub === 'distill') {
     pyArgs.push('--action', 'distill');
   } else if (sub === 'decay') {
@@ -212,6 +240,9 @@ if (command === 'memory') {
     } else {
       pyArgs.push('--target', 'torusguard-memory-export.json');
     }
+    if (args.includes('--sanitized')) {
+      pyArgs.push('--sanitized');
+    }
   } else if (sub === 'import') {
     pyArgs.push('--action', 'import');
     const pathIdx = args.indexOf('--path') !== -1 ? args.indexOf('--path') : args.indexOf('-p');
@@ -221,6 +252,21 @@ if (command === 'memory') {
       console.error(`${RED}Error: --path <file> is required for memory import${RESET}`);
       process.exit(1);
     }
+  } else if (sub === 'hook') {
+    const hookAction = args[2] === 'uninstall' ? 'hook-uninstall' : 'hook-install';
+    pyArgs.push('--action', hookAction);
+  } else if (sub === 'learn') {
+    pyArgs.push('--action', 'learn');
+    const commitsIdx = args.indexOf('--commits');
+    if (commitsIdx !== -1 && args[commitsIdx + 1]) {
+      pyArgs.push('--commits', args[commitsIdx + 1]);
+    }
+    const daysIdx = args.indexOf('--days');
+    if (daysIdx !== -1 && args[daysIdx + 1]) {
+      pyArgs.push('--days', args[daysIdx + 1]);
+    }
+  } else if (sub === 'recipe') {
+    pyArgs.push('--action', 'recipe', ...args.slice(2));
   } else if (sub === 'fp') {
     pyArgs.push('--action', 'fp');
     const ruleIdx = args.indexOf('--rule') !== -1 ? args.indexOf('--rule') : args.indexOf('-r');
@@ -242,23 +288,151 @@ if (command === 'memory') {
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
-// Locate bootstrap / runner scripts
-const localBootstrap = path.join(rootDir, 'skills', 'torusguard', 'bootstrap.py');
-const localInstall = path.join(rootDir, 'install.py');
-const scriptToRun = fs.existsSync(localBootstrap) ? localBootstrap : localInstall;
+// Subcommand: diff-guard
+if (command === 'diff-guard') {
+  const diffScript = path.join(cwd, '.torusguard', 'scripts', 'diff_guard.py');
+  const fallbackDiffScript = path.join(rootDir, '.torusguard', 'scripts', 'diff_guard.py');
+  const actualDiffScript = fs.existsSync(diffScript) ? diffScript : fallbackDiffScript;
 
-// Pass flags: when init is executed, include --full-commands to unlock all slash commands
-let scriptArgs = [scriptToRun];
-if (command === 'init') {
-  scriptArgs.push('--full-commands');
-  scriptArgs.push(...args.slice(1));
-} else {
-  scriptArgs.push(...args);
+  const proc = spawnSync(pythonCmd, [actualDiffScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: rules
+if (command === 'rules') {
+  const sub = args[1] || 'sync';
+  const rulesScript = path.join(cwd, '.torusguard', 'scripts', 'rules_sync.py');
+  const fallbackRulesScript = path.join(rootDir, '.torusguard', 'scripts', 'rules_sync.py');
+  const actualRulesScript = fs.existsSync(rulesScript) ? rulesScript : fallbackRulesScript;
+
+  let pyArgs = [actualRulesScript];
+  if (sub === 'sync') {
+    const fmtIdx = args.indexOf('--format');
+    if (fmtIdx !== -1 && args[fmtIdx + 1]) {
+      pyArgs.push('--format', args[fmtIdx + 1]);
+    }
+    const rootIdx = args.indexOf('--root') !== -1 ? args.indexOf('--root') : args.indexOf('--target');
+    if (rootIdx !== -1 && args[rootIdx + 1]) {
+      pyArgs.push('--root', args[rootIdx + 1]);
+    }
+    if (args.includes('--json')) {
+      pyArgs.push('--json');
+    }
+  } else {
+    pyArgs.push(...args.slice(1));
+  }
+
+  const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: audit
+if (command === 'audit') {
+  const auditScript = path.join(cwd, '.torusguard', 'scripts', 'audit_runner.py');
+  const fallbackAuditScript = path.join(rootDir, '.torusguard', 'scripts', 'audit_runner.py');
+  const actualAuditScript = fs.existsSync(auditScript) ? auditScript : fallbackAuditScript;
+
+  const proc = spawnSync(pythonCmd, [actualAuditScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: report
+if (command === 'report') {
+  if (args.includes('--html') || args[1] === 'html') {
+    const htmlScript = path.join(cwd, '.torusguard', 'scripts', 'html_reporter.py');
+    const fallbackHtmlScript = path.join(rootDir, '.torusguard', 'scripts', 'html_reporter.py');
+    const actualHtmlScript = fs.existsSync(htmlScript) ? htmlScript : fallbackHtmlScript;
+
+    let pyArgs = [actualHtmlScript];
+    const outIdx = args.indexOf('--out');
+    if (outIdx !== -1 && args[outIdx + 1]) {
+      pyArgs.push('--out', args[outIdx + 1]);
+    }
+    const rootIdx = args.indexOf('--root') !== -1 ? args.indexOf('--root') : args.indexOf('--target');
+    if (rootIdx !== -1 && args[rootIdx + 1]) {
+      pyArgs.push('--root', args[rootIdx + 1]);
+    }
+    if (args.includes('--json')) {
+      pyArgs.push('--json');
+    }
+
+    const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd });
+    process.exit(proc.status !== null ? proc.status : 0);
+  } else {
+    const sarifScript = path.join(cwd, '.torusguard', 'scripts', 'sarif_exporter.py');
+    const fallbackSarifScript = path.join(rootDir, '.torusguard', 'scripts', 'sarif_exporter.py');
+    const actualSarifScript = fs.existsSync(sarifScript) ? sarifScript : fallbackSarifScript;
+
+    const proc = spawnSync(pythonCmd, [actualSarifScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+    process.exit(proc.status !== null ? proc.status : 0);
+  }
+}
+
+// Subcommand: harden
+if (command === 'harden') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'harden_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'harden_runner.py');
+  const actualScript = fs.existsSync(scriptPath) ? scriptPath : fallbackScript;
+
+  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: apply
+if (command === 'apply') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'apply_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'apply_runner.py');
+  const actualScript = fs.existsSync(scriptPath) ? scriptPath : fallbackScript;
+
+  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
 }
 
-const proc = spawnSync(pythonCmd, scriptArgs, {
-  stdio: 'inherit',
-  cwd: cwd,
-});
+// Subcommand: rollback
+if (command === 'rollback') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'apply_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'apply_runner.py');
+  const actualScript = fs.existsSync(scriptPath) ? scriptPath : fallbackScript;
+
+  const proc = spawnSync(pythonCmd, [actualScript, '--rollback', ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: recheck / verify
+if (command === 'recheck' || command === 'verify') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'recheck_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'recheck_runner.py');
+  const actualScript = fs.existsSync(scriptPath) ? scriptPath : fallbackScript;
+
+  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: recipes
+if (command === 'recipes') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'recipes_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'recipes_runner.py');
+  const actualScript = fs.existsSync(scriptPath) ? scriptPath : fallbackScript;
+
+  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: init (scaffold workspace)
+if (command === 'init') {
+  const localBootstrap = path.join(rootDir, 'skills', 'torusguard', 'bootstrap.py');
+  const localInstall = path.join(rootDir, 'install.py');
+  const scriptToRun = fs.existsSync(localBootstrap) ? localBootstrap : localInstall;
+
+  const scriptArgs = [scriptToRun, '--full-commands', ...args.slice(1)];
+  const proc = spawnSync(pythonCmd, scriptArgs, {
+    stdio: 'inherit',
+    cwd: cwd,
+  });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
 
-process.exit(proc.status !== null ? proc.status : 0);
+// Unknown command fallback
+console.error(`\n  ${RED}✖ Unknown command:${RESET} ${WHITE}${command}${RESET}`);
+console.error(`  Run ${GREEN}npx torusguard help${RESET} for available commands.\n`);
+process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "1.0.0",
+  "version": "1.3.1",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {

package/skills/torusguard/SKILL.md

@@ -1,42 +1,42 @@
----
-name: torusguard
-description: "Autonomous security engine: 71 rules across 11 families, governed remediation (Ponytail Protocol), SARIF v2.1.0 exports, and persistent security memory context for Python & TypeScript web applications."
-version: 1.0.0
----
-
-# TorusGuard Master Security Router
-
-**Principle:** If the browser receives it, users can inspect it. Keep secrets, database queries, and authorization strictly on trusted server-side code.
-
----
-
-## ⚡ Workspace Bootstrap Check
-1. **If `.torusguard/` exists on disk:** Full governance active. Load `.torusguard/memory/context.json` into prompt context for local-first intelligence. Route commands to specialist workflows below.
-2. **If `.torusguard/` is absent (Autonomous AI Mode):** Operates standalone in any AI agent (Kimi, Antigravity, VS Code, Cursor). Apply in-memory security invariants:
-   - Server-side auth & tenant scoping (`.filter(tenant=...)`).
-   - Zero client-side secrets (`SUPABASE_SERVICE_ROLE_KEY`, live API keys).
-   - Ponytail Protocol patch limits ($\le 35$ additions, $\le 25$ deletions).
-   - *Upgrade:* Run `npx torusguard init` to unlock local `.torusguard/` run tracking & individual commands.
-
----
-
-## Specialist Skill Routing (Lazy Loading)
-Load **only** the designated sub-skill on demand to preserve the 1,000–1,500 token budget:
-
-| Command | Specialist Skill | Agent |
-| :--- | :--- | :--- |
-| `/torusguard init` | `skills/torusguard-init/SKILL.md` | `profiler` |
-| `/torusguard authorize` | `skills/torusguard-authorize/SKILL.md` | `reviewer` |
-| `/torusguard audit` | `skills/torusguard-audit/SKILL.md` | `auditor` |
-| `/torusguard verify` | `skills/torusguard-verify/SKILL.md` | `validator` |
-| `/torusguard web-validate` | `skills/torusguard-web-validate/SKILL.md` | `validator` |
-| `/torusguard exploit-check` | `skills/torusguard-exploit-check/SKILL.md` | `validator` |
-| `/torusguard harden` | `skills/torusguard-harden/SKILL.md` | `remediator` |
-| `/torusguard apply` | `skills/torusguard-apply/SKILL.md` | `remediator` |
-| `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` |
-| `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` |
-| `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` |
-| `/torusguard memory` | `skills/torusguard/SKILL.md` | `reviewer` |
-| `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* |
-
-*Note: Never load all skills simultaneously. Lazy-load strictly on demand.*
+---
+name: torusguard
+description: "Universal autonomous security engine: 71 rules across 11 families, polyglot stack detection across 16+ languages, governed remediation (Ponytail Protocol <=35 add, <=25 del), SARIF v2.1.0 exports, single-file HTML dashboards, and persistent security memory context for modern web applications."
+version: 1.3.1
+---
+
+# TorusGuard Master Security Router
+
+**Principle:** If the browser or client receives it, users can inspect it. Keep secrets, database queries, and authorization strictly on trusted server-side code.
+
+---
+
+## ⚡ Workspace Bootstrap Check
+1. **If `.torusguard/` exists on disk:** Full autonomous governance active. Load `.torusguard/memory/context.json` into prompt context for local-first intelligence. Route commands to specialist workflows below.
+2. **If `.torusguard/` is absent (Autonomous AI Mode):** Operates standalone in any AI agent (Kimi, Antigravity, VS Code, Cursor, Claude Code, Windsurf). Apply universal security invariants:
+   - Server-side auth & tenant scoping (`.filter(tenant=...)`, `.Where("tenant_id = ?")`, `where: { tenantId: ... }`).
+   - Zero client-side secrets (`SUPABASE_SERVICE_ROLE_KEY`, live API keys, Stripe secret keys).
+   - Ponytail Protocol patch limits ($\le 35$ additions, $\le 25$ deletions, zero full-file rewrites).
+   - *Upgrade:* Run `npx torusguard init` to unlock local `.torusguard/` workspace tracking, persistent memory, and individual slash commands.
+
+---
+
+## Specialist Skill Routing (Lazy Loading)
+Load **only** the designated sub-skill on demand to preserve the 1,000–1,500 token budget:
+
+| Command | Specialist Skill | Agent | Purpose |
+| :--- | :--- | :--- | :--- |
+| `/torusguard init` | `skills/torusguard-init/SKILL.md` | `profiler` | Workspace discovery, stack detection & scaffolding |
+| `/torusguard authorize` | `skills/torusguard-authorize/SKILL.md` | `reviewer` | Legal scope definition & safety boundaries |
+| `/torusguard audit` | `skills/torusguard-audit/SKILL.md` | `auditor` | Static AST security audit & root-cause clustering |
+| `/torusguard verify` | `skills/torusguard-verify/SKILL.md` | `validator` | Evidence sufficiency & line match audit |
+| `/torusguard web-validate` | `skills/torusguard-web-validate/SKILL.md` | `validator` | Authorized non-destructive HTTP probing |
+| `/torusguard exploit-check`| `skills/torusguard-exploit-check/SKILL.md`| `validator` | Bounded single-step exploitability confirmation |
+| `/torusguard harden` | `skills/torusguard-harden/SKILL.md` | `remediator`| Governed remediation under Ponytail Protocol |
+| `/torusguard apply` | `skills/torusguard-apply/SKILL.md` | `remediator`| Governed patch application with rollback snapshots |
+| `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` | Differential AST re-scan & closure verification |
+| `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` | Executive posture reporting, SARIF & visual HTML export |
+| `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` | Diagnostic overview of posture, stack & rules |
+| `/torusguard memory` | `skills/torusguard/SKILL.md` | `reviewer` | Persistent memory inspection, decay & context cards |
+| `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* | End-to-end 7-stage closed-loop execution |
+
+*Note: Never load all skills simultaneously. Lazy-load strictly on demand.*