torusguard 1.3.0 → 1.3.2

package/.torusguard/scripts/recheck_runner.py

@@ -0,0 +1,221 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Targeted Differential Recheck Engine (v1.3.0)
+Executes scoped differential re-audits verifying only impacted files and adjacent boundaries.
+Evaluates formal status transitions (Confirmed Fixed vs Regressed), updates run manifest,
+and records verification telemetry in the persistent security memory subsystem.
+
+Pure Python 3.10+ standard library (zero external dependencies).
+"""
+
+import sys
+import os
+import re
+import json
+import argparse
+import datetime
+import unicodedata
+from pathlib import Path
+from typing import Dict, List, Any, Optional, Tuple
+
+# Windows console UTF-8 support
+if sys.stdout and hasattr(sys.stdout, "reconfigure"):
+    try:
+        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+# ─── Timezone Configuration: Indian Standard Time (IST, UTC+05:30) ───────────
+IST = datetime.timezone(datetime.timedelta(hours=5, minutes=30), name="IST")
+
+def get_ist_now() -> datetime.datetime:
+    return datetime.datetime.now(IST)
+
+# ─── ANSI Colors & Formatter ───────────────────────────────────────────────────
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+CYAN = "\033[36m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+WHITE = "\033[97m"
+GRAY = "\033[90m"
+RED = "\033[31m"
+
+ANSI_REGEX = re.compile(r'\033\[[0-9;]*m')
+
+def get_visual_width(text: str) -> int:
+    clean = ANSI_REGEX.sub('', text)
+    width = 0
+    for ch in clean:
+        ea = unicodedata.east_asian_width(ch)
+        if ea in ('W', 'F'):
+            width += 2
+        elif ord(ch) >= 0x1F300:
+            width += 2
+        else:
+            width += 1
+    return width
+
+def format_box_line(content: str, width: int = 71, border: str = "│", border_color: str = CYAN) -> str:
+    vis = get_visual_width(content)
+    pad = " " * max(0, width - vis)
+    return f"  {border_color}{border}{RESET}  {content}{pad}{border_color}{border}{RESET}"
+
+
+def find_latest_audit_run(runs_dir: Path) -> Optional[Path]:
+    if not runs_dir.is_dir():
+        return None
+    runs = sorted(runs_dir.glob("run-*-audit"), key=lambda p: p.stat().st_mtime, reverse=True)
+    return runs[0] if runs else None
+
+
+def execute_recheck(target_root: Path, run_id_arg: Optional[str] = None) -> Dict[str, Any]:
+    runs_dir = target_root / ".torusguard" / "runs"
+    if run_id_arg:
+        run_folder = runs_dir / run_id_arg
+    else:
+        run_folder = find_latest_audit_run(runs_dir)
+
+    if not run_folder or not run_folder.is_dir():
+        print(f"\n  {RED}✖ No audit run found to recheck.{RESET}\n")
+        sys.exit(1)
+
+    # Import audit scanner and memory engine
+    scripts_dir = Path(__file__).resolve().parent
+    if str(scripts_dir) not in sys.path:
+        sys.path.insert(0, str(scripts_dir))
+    import audit_runner
+    import memory_engine
+
+    bundles_dir = run_folder / "bundles"
+    bundle_meta_files = list(bundles_dir.glob("*/metadata.json")) if bundles_dir.is_dir() else []
+
+    # Header Card
+    print(f"\n  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}")
+    print(f"  {CYAN}│                                                                         │{RESET}")
+    print(format_box_line(f"{BOLD}🛡️  TORUSGUARD DIFFERENTIAL RECHECK ENGINE          v1.3.0{RESET}", border_color=CYAN))
+    print(format_box_line(f"{DIM}Targeted Differential AST Scan & Regression Verification{RESET}", border_color=CYAN))
+    print(f"  {CYAN}│                                                                         │{RESET}")
+    print(f"  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}\n")
+
+    print(f"  {CYAN}┌─ Recheck Verification Scope ────────────────────────────────────────────┐{RESET}")
+    print(format_box_line(f"Active Run:     {WHITE}{run_folder.name}{RESET}"))
+    print(format_box_line(f"Target Root:    {WHITE}{target_root}{RESET}"))
+    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+
+    recheck_results = []
+    confirmed_count = 0
+    regressed_count = 0
+    unresolved_count = 0
+
+    recheck_md_lines = [
+        f"# TorusGuard Differential Recheck Report",
+        f"**Run ID:** `{run_folder.name}`  ",
+        f"**Timestamp:** `{get_ist_now().strftime('%Y-%m-%d %H:%M:%S IST')}`  \n",
+        "---",
+        "## Recheck Transition Catalog\n"
+    ]
+
+    for mf in bundle_meta_files:
+        try:
+            bdata = json.loads(mf.read_text(encoding="utf-8"))
+        except Exception:
+            continue
+
+        rule_id = bdata.get("rule_id", "")
+        rel_path = bdata.get("target_file", "")
+        target_path = target_root / rel_path
+
+        if not target_path.is_file():
+            continue
+
+        # Differential scan on this single modified file
+        file_findings = audit_runner.scan_file(target_path, target_root)
+        matching_rule_findings = [f for f in file_findings if f.get("rule_id") == rule_id]
+
+        if not matching_rule_findings:
+            outcome = "Confirmed Fixed"
+            confirmed_count += 1
+            status_color = GREEN
+            # Record in memory
+            try:
+                memory_engine.record_event("fix_verified", {
+                    "rule_id": rule_id,
+                    "file_path": rel_path,
+                    "verification_result": "fixed"
+                }, root_dir=target_root)
+            except Exception:
+                pass
+        else:
+            outcome = "Unresolved"
+            unresolved_count += 1
+            status_color = YELLOW
+
+        recheck_results.append({
+            "rule_id": rule_id,
+            "target_file": rel_path,
+            "outcome": outcome,
+            "title": bdata.get("title", rule_id)
+        })
+
+        recheck_md_lines.append(f"### [{rule_id}] {bdata.get('title')}")
+        recheck_md_lines.append(f"- **File:** `{rel_path}`")
+        recheck_md_lines.append(f"- **Outcome:** `{outcome}`")
+        recheck_md_lines.append(f"- **Verification Timestamp:** {get_ist_now().strftime('%Y-%m-%d %H:%M:%S IST')}\n")
+
+        print(f"  {status_color}✔ [{outcome}]{RESET} {WHITE}{rule_id}{RESET} on {rel_path}")
+
+    # Write recheck.md
+    (run_folder / "recheck.md").write_text("\n".join(recheck_md_lines), encoding="utf-8")
+
+    # Update manifest
+    manifest_file = run_folder / "manifest.json"
+    if manifest_file.is_file():
+        try:
+            mdata = json.loads(manifest_file.read_text(encoding="utf-8"))
+            mdata["status"] = "verified_fixed" if regressed_count == 0 and unresolved_count == 0 else "recheck_completed"
+            mdata["confirmed_fixed_count"] = confirmed_count
+            mdata["regressed_count"] = regressed_count
+            manifest_file.write_text(json.dumps(mdata, indent=2), encoding="utf-8")
+        except Exception:
+            pass
+
+    print()
+    print(f"  {CYAN}┌─ Recheck Summary ───────────────────────────────────────────────────────┐{RESET}")
+    print(format_box_line(f"Confirmed Fixed:{GREEN}{confirmed_count} vulnerabilities verified closed{RESET}"))
+    print(format_box_line(f"Regressed:      {RED if regressed_count > 0 else GREEN}{regressed_count} regressions detected{RESET}"))
+    print(format_box_line(f"Unresolved:     {YELLOW if unresolved_count > 0 else GREEN}{unresolved_count} unresolved{RESET}"))
+    print(format_box_line(f"Memory Sync:    {GREEN}Verification events synced to persistent memory engine{RESET}"))
+    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+
+    print(f"  {GREEN}╔═ Next Governed Action ═════════════════════════════════════════════════════╗{RESET}")
+    print(format_box_line(f"Visual Dashboard: {BOLD}{WHITE}npx torusguard report --html{RESET} (Updated posture score)", border="║", border_color=GREEN))
+    print(format_box_line(f"View Recipes:     {CYAN}npx torusguard recipes{RESET} (Active golden fix recipes)", border="║", border_color=GREEN))
+    print(f"  {GREEN}╚═════════════════════════════════════════════════════════════════════════════╝{RESET}\n")
+
+    return {
+        "run_folder": str(run_folder),
+        "confirmed_fixed_count": confirmed_count,
+        "regressed_count": regressed_count,
+        "unresolved_count": unresolved_count,
+        "results": recheck_results
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Differential Recheck Engine")
+    parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--run", "-r", help="Explicit run ID to recheck")
+    parser.add_argument("--json", action="store_true", help="Output raw JSON")
+    args = parser.parse_args()
+
+    target = Path(args.path).resolve()
+    result = execute_recheck(target, run_id_arg=args.run)
+
+    if args.json:
+        print(json.dumps(result, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/.torusguard/scripts/recipes_runner.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""
+TorusGuard Golden Fix Recipe Explorer (v1.3.0)
+Inspect, list, and export reusable, verified AST remediation code snippets
+distilled from passing security patches and persistent memory patterns.
+
+Pure Python 3.10+ standard library (zero external dependencies).
+"""
+
+import sys
+import json
+import argparse
+import unicodedata
+import re
+from pathlib import Path
+from typing import Dict, List, Any, Optional
+
+# Windows console UTF-8 support
+if sys.stdout and hasattr(sys.stdout, "reconfigure"):
+    try:
+        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+# ─── ANSI Colors & Formatter ───────────────────────────────────────────────────
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+CYAN = "\033[36m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+WHITE = "\033[97m"
+GRAY = "\033[90m"
+RED = "\033[31m"
+
+ANSI_REGEX = re.compile(r'\033\[[0-9;]*m')
+
+def get_visual_width(text: str) -> int:
+    clean = ANSI_REGEX.sub('', text)
+    width = 0
+    for ch in clean:
+        ea = unicodedata.east_asian_width(ch)
+        if ea in ('W', 'F'):
+            width += 2
+        elif ord(ch) >= 0x1F300:
+            width += 2
+        else:
+            width += 1
+    return width
+
+def format_box_line(content: str, width: int = 71, border: str = "│", border_color: str = CYAN) -> str:
+    vis = get_visual_width(content)
+    pad = " " * max(0, width - vis)
+    return f"  {border_color}{border}{RESET}  {content}{pad}{border_color}{border}{RESET}"
+
+
+def list_recipes(target_root: Path, detail_id: Optional[str] = None, json_output: bool = False) -> None:
+    patterns_file = target_root / ".torusguard" / "memory" / "patterns.json"
+    recipes: List[Dict[str, Any]] = []
+
+    if patterns_file.is_file():
+        try:
+            patterns = json.loads(patterns_file.read_text(encoding="utf-8"))
+            recipes = [p for p in patterns if p.get("pattern_type") == "golden_fix_recipe"]
+        except Exception:
+            recipes = []
+
+    if json_output:
+        print(json.dumps(recipes, indent=2))
+        return
+
+    # Header Card
+    print(f"\n  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}")
+    print(f"  {CYAN}│                                                                         │{RESET}")
+    print(format_box_line(f"{BOLD}🛡️  TORUSGUARD GOLDEN FIX RECIPES                   v1.3.0{RESET}", border_color=CYAN))
+    print(format_box_line(f"{DIM}Distilled Ponytail Fixes (<= 35 add, <= 25 del) in Persistent Memory{RESET}", border_color=CYAN))
+    print(f"  {CYAN}│                                                                         │{RESET}")
+    print(f"  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}\n")
+
+    if not recipes:
+        print(f"  {YELLOW}ℹ No golden fix recipes captured yet.{RESET}")
+        print(f"  Run {CYAN}npx torusguard harden{RESET} followed by {CYAN}npx torusguard apply{RESET} to distill verified recipes.\n")
+        return
+
+    print(f"  {CYAN}┌─ Active Distilled Recipes ({len(recipes)}) ─────────────────────────────────────┐{RESET}")
+    for idx, r in enumerate(recipes, 1):
+        rule_id = r.get("rule_id", "TG-SEC")
+        rec_id = r.get("recipe_id", f"recipe-{idx}")
+        desc = r.get("description", "Verified fix")
+        rdata = r.get("recipe_data", {})
+        metrics = rdata.get("ponytail_metrics", {})
+        verified = rdata.get("verified_count", 1)
+        adds = metrics.get("additions", 0)
+        dels = metrics.get("deletions", 0)
+
+        print(format_box_line(f"{GREEN}[{rule_id}]{RESET} {WHITE}{rec_id}{RESET} (Verified {verified}x · +{adds}/-{dels} Ponytail)"))
+        print(format_box_line(f"  └─ {DIM}{desc}{RESET}"))
+    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+
+    if detail_id:
+        target_rec = next((r for r in recipes if r.get("recipe_id") == detail_id), None)
+        if target_rec:
+            rdata = target_rec.get("recipe_data", {})
+            print(f"  {BOLD}Recipe Details: {detail_id}{RESET}")
+            print(f"  {DIM}Rule ID:{RESET} {target_rec.get('rule_id')}")
+            print(f"  {DIM}Diff Snippet:{RESET}")
+            print("  ```diff")
+            for line in rdata.get("diff_snippet", "").splitlines():
+                if line.startswith("+"):
+                    print(f"    {GREEN}{line}{RESET}")
+                elif line.startswith("-"):
+                    print(f"    {RED}{line}{RESET}")
+                else:
+                    print(f"    {DIM}{line}{RESET}")
+            print("  ```\n")
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Golden Fix Recipe Explorer")
+    parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--detail", "-d", help="Inspect specific recipe ID")
+    parser.add_argument("--json", action="store_true", help="Output raw JSON")
+    args = parser.parse_args()
+
+    target = Path(args.path).resolve()
+    list_recipes(target, detail_id=args.detail, json_output=args.json)
+
+
+if __name__ == "__main__":
+    main()

package/.torusguard/scripts/run_manager.py

@@ -13,8 +13,17 @@ from pathlib import Path
 from typing import Dict, Any, List, Optional
 
 
+# ─── Timezone Configuration: Indian Standard Time (IST, UTC+05:30) ───────────
+IST = datetime.timezone(datetime.timedelta(hours=5, minutes=30), name="IST")
+
+def get_ist_now() -> datetime.datetime:
+    """Return timezone-aware datetime strictly in Indian Standard Time (IST)."""
+    return datetime.datetime.now(IST)
+
+
 def create_run(base_dir: Path, command: str, target_name: str = "project") -> Path:
-    timestamp = datetime.datetime.utcnow().strftime("%Y%m%d-%H%M%S")
+    now_ist = get_ist_now()
+    timestamp = now_ist.strftime("%Y%m%d-%H%M%S")
     run_id = f"run-{timestamp}-{command}"
     run_folder = base_dir / run_id
     run_folder.mkdir(parents=True, exist_ok=True)
@@ -23,9 +32,10 @@ def create_run(base_dir: Path, command: str, target_name: str = "project") -> Pa
         "run_id": run_id,
         "command": command,
         "target_name": target_name,
-        "created_at": datetime.datetime.utcnow().isoformat() + "Z",
+        "created_at": now_ist.strftime("%Y-%m-%d %H:%M:%S IST"),
+        "created_at_iso": now_ist.isoformat(),
         "status": "in_progress",
-        "torusguard_version": "1.0.0",
+        "torusguard_version": "1.3.0",
         "findings_count": 0,
         "confirmed_fixed_count": 0,
         "regressed_count": 0
@@ -136,7 +146,8 @@ def main():
     subparsers = parser.add_subparsers(dest="subcommand")
 
     create_p = subparsers.add_parser("create")
-    create_p.add_argument("--command", "-c", default="audit", help="TorusGuard command (audit, web-validate, harden, etc.)")
+    create_p.add_argument("cmd_pos", nargs="?", default=None, help="TorusGuard command (positional)")
+    create_p.add_argument("--command", "-c", default=None, help="TorusGuard command (audit, web-validate, harden, etc.)")
     create_p.add_argument("--target", "-t", default="project", help="Target project name")
     create_p.add_argument("--dir", "-d", default=".torusguard/runs", help="Base runs directory")
 
@@ -150,7 +161,8 @@ def main():
     args = parser.parse_args()
 
     if args.subcommand == "create":
-        folder = create_run(Path(args.dir), args.command, args.target)
+        eff_command = args.cmd_pos or args.command or "audit"
+        folder = create_run(Path(args.dir), eff_command, args.target)
         print(f"Created run folder: {folder}")
     elif args.subcommand == "list":
         runs = list_runs(Path(args.dir))

package/.torusguard/skills/torusguard/SKILL.md

@@ -1,42 +1,42 @@
----
-name: torusguard
-description: "Autonomous security engine: 71 rules across 11 families, governed remediation (Ponytail Protocol), SARIF v2.1.0 exports, and persistent security memory context for Python & TypeScript web applications."
-version: 1.0.0
----
-
-# TorusGuard Master Security Router
-
-**Principle:** If the browser receives it, users can inspect it. Keep secrets, database queries, and authorization strictly on trusted server-side code.
-
----
-
-## ⚡ Workspace Bootstrap Check
-1. **If `.torusguard/` exists on disk:** Full governance active. Load `.torusguard/memory/context.json` into prompt context for local-first intelligence. Route commands to specialist workflows below.
-2. **If `.torusguard/` is absent (Autonomous AI Mode):** Operates standalone in any AI agent (Kimi, Antigravity, VS Code, Cursor). Apply in-memory security invariants:
-   - Server-side auth & tenant scoping (`.filter(tenant=...)`).
-   - Zero client-side secrets (`SUPABASE_SERVICE_ROLE_KEY`, live API keys).
-   - Ponytail Protocol patch limits ($\le 35$ additions, $\le 25$ deletions).
-   - *Upgrade:* Run `npx torusguard init` to unlock local `.torusguard/` run tracking & individual commands.
-
----
-
-## Specialist Skill Routing (Lazy Loading)
-Load **only** the designated sub-skill on demand to preserve the 1,000–1,500 token budget:
-
-| Command | Specialist Skill | Agent |
-| :--- | :--- | :--- |
-| `/torusguard init` | `skills/torusguard-init/SKILL.md` | `profiler` |
-| `/torusguard authorize` | `skills/torusguard-authorize/SKILL.md` | `reviewer` |
-| `/torusguard audit` | `skills/torusguard-audit/SKILL.md` | `auditor` |
-| `/torusguard verify` | `skills/torusguard-verify/SKILL.md` | `validator` |
-| `/torusguard web-validate` | `skills/torusguard-web-validate/SKILL.md` | `validator` |
-| `/torusguard exploit-check` | `skills/torusguard-exploit-check/SKILL.md` | `validator` |
-| `/torusguard harden` | `skills/torusguard-harden/SKILL.md` | `remediator` |
-| `/torusguard apply` | `skills/torusguard-apply/SKILL.md` | `remediator` |
-| `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` |
-| `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` |
-| `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` |
-| `/torusguard memory` | `skills/torusguard/SKILL.md` | `reviewer` |
-| `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* |
-
-*Note: Never load all skills simultaneously. Lazy-load strictly on demand.*
+---
+name: torusguard
+description: "Universal autonomous security engine: 71 rules across 11 families, polyglot stack detection across 16+ languages, governed remediation (Ponytail Protocol <=35 add, <=25 del), SARIF v2.1.0 exports, single-file HTML dashboards, and persistent security memory context for modern web applications."
+version: 1.3.2
+---
+
+# TorusGuard Master Security Router
+
+**Principle:** If the browser or client receives it, users can inspect it. Keep secrets, database queries, and authorization strictly on trusted server-side code.
+
+---
+
+## ⚡ Workspace Bootstrap Check
+1. **If `.torusguard/` exists on disk:** Full autonomous governance active. Load `.torusguard/memory/context.json` into prompt context for local-first intelligence. Route commands to specialist workflows below.
+2. **If `.torusguard/` is absent (Autonomous AI Mode):** Operates standalone in any AI agent (Kimi, Antigravity, VS Code, Cursor, Claude Code, Windsurf). Apply universal security invariants:
+   - Server-side auth & tenant scoping (`.filter(tenant=...)`, `.Where("tenant_id = ?")`, `where: { tenantId: ... }`).
+   - Zero client-side secrets (`SUPABASE_SERVICE_ROLE_KEY`, live API keys, Stripe secret keys).
+   - Ponytail Protocol patch limits ($\le 35$ additions, $\le 25$ deletions, zero full-file rewrites).
+   - *Upgrade:* Run `npx torusguard init` to unlock local `.torusguard/` workspace tracking, persistent memory, and individual slash commands.
+
+---
+
+## Specialist Skill Routing (Lazy Loading)
+Load **only** the designated sub-skill on demand to preserve the 1,000–1,500 token budget:
+
+| Command | Specialist Skill | Agent | Purpose |
+| :--- | :--- | :--- | :--- |
+| `/torusguard init` | `skills/torusguard-init/SKILL.md` | `profiler` | Workspace discovery, stack detection & scaffolding |
+| `/torusguard authorize` | `skills/torusguard-authorize/SKILL.md` | `reviewer` | Legal scope definition & safety boundaries |
+| `/torusguard audit` | `skills/torusguard-audit/SKILL.md` | `auditor` | Static AST security audit & root-cause clustering |
+| `/torusguard verify` | `skills/torusguard-verify/SKILL.md` | `validator` | Evidence sufficiency & line match audit |
+| `/torusguard web-validate` | `skills/torusguard-web-validate/SKILL.md` | `validator` | Authorized non-destructive HTTP probing |
+| `/torusguard exploit-check`| `skills/torusguard-exploit-check/SKILL.md`| `validator` | Bounded single-step exploitability confirmation |
+| `/torusguard harden` | `skills/torusguard-harden/SKILL.md` | `remediator`| Governed remediation under Ponytail Protocol |
+| `/torusguard apply` | `skills/torusguard-apply/SKILL.md` | `remediator`| Governed patch application with rollback snapshots |
+| `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` | Differential AST re-scan & closure verification |
+| `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` | Executive posture reporting, SARIF & visual HTML export |
+| `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` | Diagnostic overview of posture, stack & rules |
+| `/torusguard memory` | `skills/torusguard/SKILL.md` | `reviewer` | Persistent memory inspection, decay & context cards |
+| `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* | End-to-end 7-stage closed-loop execution |
+
+*Note: Never load all skills simultaneously. Lazy-load strictly on demand.*