torusguard 1.3.0 → 1.3.2

package/bin/torusguard.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 
 /**
  * TorusGuard CLI Runner (NPM Distribution)
@@ -49,7 +49,7 @@ function printHelp() {
   console.log(`
   ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  T O R U S G U A R D   C L I${RESET}                          ${GRAY}v1.3.0${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  T O R U S G U A R D   C L I${RESET}                          ${GRAY}v1.3.2${RESET}   ${CYAN}│${RESET}
   ${CYAN}│${RESET}   ${DIM}Autonomous Security Engine for AI-Built Applications${RESET}               ${CYAN}│${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
   ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
@@ -64,6 +64,11 @@ function printHelp() {
   ${CYAN}│${RESET}  ${GREEN}rules${RESET}     Auto-sync memory to AI IDE rules (.cursorrules, CLAUDE.md)  ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}memory${RESET}    Manage persistent security memory (export, hook, learn)     ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}audit${RESET}     Run static AST security scan on the target project          ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}harden${RESET}    Formulate minimal candidate patches (Ponytail bounded)      ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}apply${RESET}     Apply candidate patches with automatic .bak snapshots       ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}recheck${RESET}   Targeted differential verification of applied fixes         ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}recipes${RESET}   List & inspect distilled Golden Fix Recipes in memory       ${CYAN}│${RESET}
+  ${CYAN}│${RESET}  ${GREEN}rollback${RESET}  Instantly revert files from latest pre-apply snapshot       ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}report${RESET}    Export OASIS SARIF v2.1.0 or single-file visual HTML report ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}diff-guard${RESET} Scan diffs or wire pre-commit hook (--install-hook)        ${CYAN}│${RESET}
   ${CYAN}│${RESET}  ${GREEN}help${RESET}      Show this interactive command guide                         ${CYAN}│${RESET}
@@ -137,7 +142,7 @@ if (command === 'status') {
       console.log(`
   ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  TORUSGUARD SECURITY POSTURE${RESET}                        ${GRAY}v1.3.0${RESET}   ${CYAN}│${RESET}
+  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  TORUSGUARD SECURITY POSTURE${RESET}                        ${GRAY}v1.3.2${RESET}   ${CYAN}│${RESET}
   ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
   ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
 
@@ -287,7 +292,7 @@ if (command === 'memory') {
 if (command === 'diff-guard') {
   const diffScript = path.join(cwd, '.torusguard', 'scripts', 'diff_guard.py');
   const fallbackDiffScript = path.join(rootDir, '.torusguard', 'scripts', 'diff_guard.py');
-  const actualDiffScript = fs.existsSync(diffScript) ? diffScript : fallbackDiffScript;
+  const actualDiffScript = fs.existsSync(fallbackDiffScript) ? fallbackDiffScript : diffScript;
 
   const proc = spawnSync(pythonCmd, [actualDiffScript, ...args.slice(1)], { stdio: 'inherit', cwd });
   process.exit(proc.status !== null ? proc.status : 0);
@@ -298,7 +303,7 @@ if (command === 'rules') {
   const sub = args[1] || 'sync';
   const rulesScript = path.join(cwd, '.torusguard', 'scripts', 'rules_sync.py');
   const fallbackRulesScript = path.join(rootDir, '.torusguard', 'scripts', 'rules_sync.py');
-  const actualRulesScript = fs.existsSync(rulesScript) ? rulesScript : fallbackRulesScript;
+  const actualRulesScript = fs.existsSync(fallbackRulesScript) ? fallbackRulesScript : rulesScript;
 
   let pyArgs = [actualRulesScript];
   if (sub === 'sync') {
@@ -321,12 +326,22 @@ if (command === 'rules') {
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
+// Subcommand: audit
+if (command === 'audit') {
+  const auditScript = path.join(cwd, '.torusguard', 'scripts', 'audit_runner.py');
+  const fallbackAuditScript = path.join(rootDir, '.torusguard', 'scripts', 'audit_runner.py');
+  const actualAuditScript = fs.existsSync(fallbackAuditScript) ? fallbackAuditScript : auditScript;
+
+  const proc = spawnSync(pythonCmd, [actualAuditScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
 // Subcommand: report
 if (command === 'report') {
   if (args.includes('--html') || args[1] === 'html') {
     const htmlScript = path.join(cwd, '.torusguard', 'scripts', 'html_reporter.py');
     const fallbackHtmlScript = path.join(rootDir, '.torusguard', 'scripts', 'html_reporter.py');
-    const actualHtmlScript = fs.existsSync(htmlScript) ? htmlScript : fallbackHtmlScript;
+    const actualHtmlScript = fs.existsSync(fallbackHtmlScript) ? fallbackHtmlScript : htmlScript;
 
     let pyArgs = [actualHtmlScript];
     const outIdx = args.indexOf('--out');
@@ -343,26 +358,81 @@ if (command === 'report') {
 
     const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd });
     process.exit(proc.status !== null ? proc.status : 0);
+  } else {
+    const sarifScript = path.join(cwd, '.torusguard', 'scripts', 'sarif_exporter.py');
+    const fallbackSarifScript = path.join(rootDir, '.torusguard', 'scripts', 'sarif_exporter.py');
+    const actualSarifScript = fs.existsSync(fallbackSarifScript) ? fallbackSarifScript : sarifScript;
+
+    const proc = spawnSync(pythonCmd, [actualSarifScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+    process.exit(proc.status !== null ? proc.status : 0);
   }
 }
 
-// Locate bootstrap / runner scripts
-const localBootstrap = path.join(rootDir, 'skills', 'torusguard', 'bootstrap.py');
-const localInstall = path.join(rootDir, 'install.py');
-const scriptToRun = fs.existsSync(localBootstrap) ? localBootstrap : localInstall;
+// Subcommand: harden
+if (command === 'harden') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'harden_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'harden_runner.py');
+  const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
 
-// Pass flags: when init is executed, include --full-commands to unlock all slash commands
-let scriptArgs = [scriptToRun];
-if (command === 'init') {
-  scriptArgs.push('--full-commands');
-  scriptArgs.push(...args.slice(1));
-} else {
-  scriptArgs.push(...args);
+  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: apply
+if (command === 'apply') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'apply_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'apply_runner.py');
+  const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
+
+  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: rollback
+if (command === 'rollback') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'apply_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'apply_runner.py');
+  const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
+
+  const proc = spawnSync(pythonCmd, [actualScript, '--rollback', ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: recheck / verify
+if (command === 'recheck' || command === 'verify') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'recheck_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'recheck_runner.py');
+  const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
+
+  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
 }
 
-const proc = spawnSync(pythonCmd, scriptArgs, {
-  stdio: 'inherit',
-  cwd: cwd,
-});
+// Subcommand: recipes
+if (command === 'recipes') {
+  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'recipes_runner.py');
+  const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'recipes_runner.py');
+  const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
+
+  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
+
+// Subcommand: init (scaffold workspace)
+if (command === 'init') {
+  const localBootstrap = path.join(rootDir, 'skills', 'torusguard', 'bootstrap.py');
+  const localInstall = path.join(rootDir, 'install.py');
+  const scriptToRun = fs.existsSync(localBootstrap) ? localBootstrap : localInstall;
+
+  const scriptArgs = [scriptToRun, '--full-commands', ...args.slice(1)];
+  const proc = spawnSync(pythonCmd, scriptArgs, {
+    stdio: 'inherit',
+    cwd: cwd,
+  });
+  process.exit(proc.status !== null ? proc.status : 0);
+}
 
-process.exit(proc.status !== null ? proc.status : 0);
+// Unknown command fallback
+console.error(`\n  ${RED}✖ Unknown command:${RESET} ${WHITE}${command}${RESET}`);
+console.error(`  Run ${GREEN}npx torusguard help${RESET} for available commands.\n`);
+process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {

package/skills/torusguard/SKILL.md

@@ -1,42 +1,42 @@
----
-name: torusguard
-description: "Autonomous security engine: 71 rules across 11 families, governed remediation (Ponytail Protocol), SARIF v2.1.0 exports, and persistent security memory context for Python & TypeScript web applications."
-version: 1.0.0
----
-
-# TorusGuard Master Security Router
-
-**Principle:** If the browser receives it, users can inspect it. Keep secrets, database queries, and authorization strictly on trusted server-side code.
-
----
-
-## ⚡ Workspace Bootstrap Check
-1. **If `.torusguard/` exists on disk:** Full governance active. Load `.torusguard/memory/context.json` into prompt context for local-first intelligence. Route commands to specialist workflows below.
-2. **If `.torusguard/` is absent (Autonomous AI Mode):** Operates standalone in any AI agent (Kimi, Antigravity, VS Code, Cursor). Apply in-memory security invariants:
-   - Server-side auth & tenant scoping (`.filter(tenant=...)`).
-   - Zero client-side secrets (`SUPABASE_SERVICE_ROLE_KEY`, live API keys).
-   - Ponytail Protocol patch limits ($\le 35$ additions, $\le 25$ deletions).
-   - *Upgrade:* Run `npx torusguard init` to unlock local `.torusguard/` run tracking & individual commands.
-
----
-
-## Specialist Skill Routing (Lazy Loading)
-Load **only** the designated sub-skill on demand to preserve the 1,000–1,500 token budget:
-
-| Command | Specialist Skill | Agent |
-| :--- | :--- | :--- |
-| `/torusguard init` | `skills/torusguard-init/SKILL.md` | `profiler` |
-| `/torusguard authorize` | `skills/torusguard-authorize/SKILL.md` | `reviewer` |
-| `/torusguard audit` | `skills/torusguard-audit/SKILL.md` | `auditor` |
-| `/torusguard verify` | `skills/torusguard-verify/SKILL.md` | `validator` |
-| `/torusguard web-validate` | `skills/torusguard-web-validate/SKILL.md` | `validator` |
-| `/torusguard exploit-check` | `skills/torusguard-exploit-check/SKILL.md` | `validator` |
-| `/torusguard harden` | `skills/torusguard-harden/SKILL.md` | `remediator` |
-| `/torusguard apply` | `skills/torusguard-apply/SKILL.md` | `remediator` |
-| `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` |
-| `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` |
-| `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` |
-| `/torusguard memory` | `skills/torusguard/SKILL.md` | `reviewer` |
-| `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* |
-
-*Note: Never load all skills simultaneously. Lazy-load strictly on demand.*
+---
+name: torusguard
+description: "Universal autonomous security engine: 71 rules across 11 families, polyglot stack detection across 16+ languages, governed remediation (Ponytail Protocol <=35 add, <=25 del), SARIF v2.1.0 exports, single-file HTML dashboards, and persistent security memory context for modern web applications."
+version: 1.3.2
+---
+
+# TorusGuard Master Security Router
+
+**Principle:** If the browser or client receives it, users can inspect it. Keep secrets, database queries, and authorization strictly on trusted server-side code.
+
+---
+
+## ⚡ Workspace Bootstrap Check
+1. **If `.torusguard/` exists on disk:** Full autonomous governance active. Load `.torusguard/memory/context.json` into prompt context for local-first intelligence. Route commands to specialist workflows below.
+2. **If `.torusguard/` is absent (Autonomous AI Mode):** Operates standalone in any AI agent (Kimi, Antigravity, VS Code, Cursor, Claude Code, Windsurf). Apply universal security invariants:
+   - Server-side auth & tenant scoping (`.filter(tenant=...)`, `.Where("tenant_id = ?")`, `where: { tenantId: ... }`).
+   - Zero client-side secrets (`SUPABASE_SERVICE_ROLE_KEY`, live API keys, Stripe secret keys).
+   - Ponytail Protocol patch limits ($\le 35$ additions, $\le 25$ deletions, zero full-file rewrites).
+   - *Upgrade:* Run `npx torusguard init` to unlock local `.torusguard/` workspace tracking, persistent memory, and individual slash commands.
+
+---
+
+## Specialist Skill Routing (Lazy Loading)
+Load **only** the designated sub-skill on demand to preserve the 1,000–1,500 token budget:
+
+| Command | Specialist Skill | Agent | Purpose |
+| :--- | :--- | :--- | :--- |
+| `/torusguard init` | `skills/torusguard-init/SKILL.md` | `profiler` | Workspace discovery, stack detection & scaffolding |
+| `/torusguard authorize` | `skills/torusguard-authorize/SKILL.md` | `reviewer` | Legal scope definition & safety boundaries |
+| `/torusguard audit` | `skills/torusguard-audit/SKILL.md` | `auditor` | Static AST security audit & root-cause clustering |
+| `/torusguard verify` | `skills/torusguard-verify/SKILL.md` | `validator` | Evidence sufficiency & line match audit |
+| `/torusguard web-validate` | `skills/torusguard-web-validate/SKILL.md` | `validator` | Authorized non-destructive HTTP probing |
+| `/torusguard exploit-check`| `skills/torusguard-exploit-check/SKILL.md`| `validator` | Bounded single-step exploitability confirmation |
+| `/torusguard harden` | `skills/torusguard-harden/SKILL.md` | `remediator`| Governed remediation under Ponytail Protocol |
+| `/torusguard apply` | `skills/torusguard-apply/SKILL.md` | `remediator`| Governed patch application with rollback snapshots |
+| `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` | Differential AST re-scan & closure verification |
+| `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` | Executive posture reporting, SARIF & visual HTML export |
+| `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` | Diagnostic overview of posture, stack & rules |
+| `/torusguard memory` | `skills/torusguard/SKILL.md` | `reviewer` | Persistent memory inspection, decay & context cards |
+| `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* | End-to-end 7-stage closed-loop execution |
+
+*Note: Never load all skills simultaneously. Lazy-load strictly on demand.*

package/skills/torusguard/bootstrap.py

@@ -57,12 +57,85 @@ def find_project_root(start_dir=None):
     return current
 
 
+import re
+import unicodedata
+
+ANSI_REGEX = re.compile(r'\033\[[0-9;]*m')
+
+def get_visual_width(text: str) -> int:
+    """Calculate the printable display width of a string (ANSI and emoji aware)."""
+    clean = ANSI_REGEX.sub('', text)
+    width = 0
+    for ch in clean:
+        ea = unicodedata.east_asian_width(ch)
+        if ea in ('W', 'F'):
+            width += 2
+        elif ord(ch) >= 0x1F300:
+            width += 2
+        else:
+            width += 1
+    return width
+
+def truncate_visual(text: str, max_w: int = 67) -> str:
+    """Truncate text visually without breaking ANSI escape codes."""
+    if get_visual_width(text) <= max_w:
+        return text
+    out, curr_w, in_ansi, ansi_buf = [], 0, False, ''
+    for ch in text:
+        if ch == '\033':
+            in_ansi = True
+            ansi_buf = ch
+            continue
+        if in_ansi:
+            ansi_buf += ch
+            if ch == 'm':
+                in_ansi = False
+                out.append(ansi_buf)
+            continue
+        ea = unicodedata.east_asian_width(ch)
+        cw = 2 if ea in ('W', 'F') or ord(ch) >= 0x1F300 else 1
+        if curr_w + cw > max_w - 3:
+            out.append('...')
+            break
+        out.append(ch)
+        curr_w += cw
+    return ''.join(out)
+
+def card_line(content: str, max_w: int = 67, border: str = "│", border_color: str = CYAN) -> str:
+    """Pad content so the card is exactly 75 visual columns total width."""
+    trunc = truncate_visual(content, max_w)
+    vis = get_visual_width(trunc)
+    pad = " " * max(0, max_w - vis)
+    return f"  {border_color}{border}{RESET}  {trunc}{pad}  {border_color}{border}{RESET}"
+
+def card_border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    left = "╔" if double else "┌"
+    right = "╗" if double else "┐"
+    h = "═" if double else "─"
+    if title:
+        vis = get_visual_width(title)
+        rem = max(0, 71 - 3 - vis - 1)
+        return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    left = "╚" if double else "└"
+    right = "╝" if double else "┘"
+    h = "═" if double else "─"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
+def card_divider(border_color: str = CYAN, double: bool = False) -> str:
+    left = "╠" if double else "├"
+    right = "╣" if double else "┤"
+    h = "═" if double else "─"
+    return f"  {border_color}{left}{h * 71}{right}{RESET}"
+
 def print_header():
     """Print the branded TorusGuard header card."""
     print(f"""
   {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
   {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
-  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v0.9.5{RESET}   {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v1.3.0{RESET}   {CYAN}│{RESET}
   {CYAN}│{RESET}   {DIM}Autonomous Security Engine for AI-Built Applications{RESET}               {CYAN}│{RESET}
   {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
   {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
@@ -71,81 +144,71 @@ def print_header():
 
 def print_step_1_assets(file_count):
     """Print the enhanced Step 1 asset unpacking card."""
-    print(f"""  {CYAN}┌─ {BOLD}Step 1/3{RESET} {CYAN}──────────────────────── {WHITE}Unpacking Governance Assets{RESET} {CYAN}──────┐{RESET}
-  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
-  {CYAN}│{RESET}   {GREEN}✔{RESET} Canonical security rules            {DIM}71 rules across 11 families{RESET}  {CYAN}│{RESET}
-  {CYAN}│{RESET}   {GREEN}✔{RESET} JSON validation schemas             {DIM}8 formal schemas{RESET}             {CYAN}│{RESET}
-  {CYAN}│{RESET}   {GREEN}✔{RESET} Specialist agent specifications     {DIM}5 isolated agents{RESET}            {CYAN}│{RESET}
-  {CYAN}│{RESET}   {GREEN}✔{RESET} Workflow templates                   {DIM}11 slash commands{RESET}            {CYAN}│{RESET}
-  {CYAN}│{RESET}   {GREEN}✔{RESET} Framework reference guides           {DIM}10 security guides{RESET}           {CYAN}│{RESET}
-  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
-  {CYAN}│{RESET}                                               {BOLD}{WHITE}{file_count} files unpacked{RESET}   {CYAN}│{RESET}
-  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
-""")
+    print(card_border_top("Step 1/3 ─── Unpacking Governance Assets"))
+    print(card_line(""))
+    print(card_line(f"{GREEN}✔{RESET} Canonical security rules            {DIM}71 rules across 11 families{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} JSON validation schemas             {DIM}8 formal schemas{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Specialist agent specifications     {DIM}5 isolated agents{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Workflow templates                   {DIM}11 slash commands{RESET}"))
+    print(card_line(f"{GREEN}✔{RESET} Framework reference guides           {DIM}10 security guides{RESET}"))
+    print(card_line(""))
+    print(card_line(f"{BOLD}{WHITE}{file_count} files unpacked{RESET}"))
+    print(card_border_bottom())
 
 
 def print_step_2_profile(detected_stack=None):
     """Print the security profile & coverage card (in-process stack alignment)."""
+    print(card_border_top("Step 2/3 ─── Security Profile & Coverage"))
+    print(card_line(""))
+    print(card_line(f"{BOLD}Rule Families:{RESET}"))
+    print(card_line(f"  {YELLOW}TG-SEC{RESET}     Secrets & Credentials    {YELLOW}TG-DB{RESET}      Database Safety"))
+    print(card_line(f"  {YELLOW}TG-INPUT{RESET}   Input Validation         {YELLOW}TG-AUTH{RESET}    Authentication"))
+    print(card_line(f"  {YELLOW}TG-CLIENT{RESET}  Client Bundle Leaks      {YELLOW}TG-DIFF{RESET}    Diff Inspection"))
+    print(card_line(f"  {YELLOW}TG-AGENT{RESET}   AI Agent Security        {YELLOW}TG-EDGE{RESET}    Serverless"))
+    print(card_line(f"  {YELLOW}TG-SUPPLY{RESET}  Supply Chain & CI/CD     {YELLOW}TG-SSRF{RESET}    Outbound Net"))
+    print(card_line(f"  {YELLOW}TG-BIZ{RESET}     Business Logic"))
+    print(card_line(""))
+    print(card_line(f"{BOLD}Supported Stacks:{RESET}"))
+    print(card_line(f"  {GREEN}Python{RESET}    Django · FastAPI · Flask · DRF · SQLAlchemy"))
+    print(card_line(f"  {GREEN}Node.js{RESET}   Next.js · Express · React · Supabase · Firebase"))
+    print(card_line(""))
     if detected_stack and detected_stack.get("framework") and detected_stack.get("framework") != "None":
         fw = str(detected_stack.get("framework"))
         lang = str(detected_stack.get("language", ""))
-        label = f"Auto-aligned stack: {fw} ({lang})"
-        pad = " " * max(0, 66 - len(label))
-        status_line = f"  {CYAN}│{RESET}   {GREEN}✔{RESET} {BOLD}Auto-aligned stack:{RESET} {WHITE}{fw}{RESET} {DIM}({lang}){RESET}{pad}{CYAN}│{RESET}"
+        print(card_line(f"{GREEN}✔{RESET} {BOLD}Auto-aligned stack:{RESET} {WHITE}{fw}{RESET} {DIM}({lang}){RESET}"))
     else:
-        status_line = f"  {CYAN}│{RESET}   {DIM}ℹ Stack auto-detected on first /torusguard-audit run{RESET}              {CYAN}│{RESET}"
-
-    print(f"""  {CYAN}┌─ {BOLD}Step 2/3{RESET} {CYAN}──────────────────── {WHITE}Security Profile & Coverage{RESET} {CYAN}────────┐{RESET}
-  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
-  {CYAN}│{RESET}   {BOLD}Rule Families:{RESET}                                                      {CYAN}│{RESET}
-  {CYAN}│{RESET}     {YELLOW}TG-SEC{RESET}     Secrets & Credentials    {YELLOW}TG-DB{RESET}      Database Safety    {CYAN}│{RESET}
-  {CYAN}│{RESET}     {YELLOW}TG-INPUT{RESET}   Input Validation         {YELLOW}TG-AUTH{RESET}    Authentication     {CYAN}│{RESET}
-  {CYAN}│{RESET}     {YELLOW}TG-CLIENT{RESET}  Client Bundle Leaks      {YELLOW}TG-DIFF{RESET}    Diff Inspection    {CYAN}│{RESET}
-  {CYAN}│{RESET}     {YELLOW}TG-AGENT{RESET}   AI Agent Security        {YELLOW}TG-EDGE{RESET}    Serverless         {CYAN}│{RESET}
-  {CYAN}│{RESET}     {YELLOW}TG-SUPPLY{RESET}  Supply Chain & CI/CD     {YELLOW}TG-SSRF{RESET}    Outbound Net       {CYAN}│{RESET}
-  {CYAN}│{RESET}     {YELLOW}TG-BIZ{RESET}     Business Logic                                      {CYAN}│{RESET}
-  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
-  {CYAN}│{RESET}   {BOLD}Supported Stacks:{RESET}                                                  {CYAN}│{RESET}
-  {CYAN}│{RESET}     {GREEN}Python{RESET}    Django {DIM}·{RESET} FastAPI {DIM}·{RESET} Flask {DIM}·{RESET} DRF {DIM}·{RESET} SQLAlchemy              {CYAN}│{RESET}
-  {CYAN}│{RESET}     {GREEN}Node.js{RESET}   Next.js {DIM}·{RESET} Express {DIM}·{RESET} React {DIM}·{RESET} Supabase {DIM}·{RESET} Firebase       {CYAN}│{RESET}
-  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
-{status_line}
-  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
-""")
+        print(card_line(f"{DIM}ℹ Stack auto-detected on first /torusguard-audit run{RESET}"))
+    print(card_border_bottom())
 
 
 def print_step_3_bridges(registered_ides):
     """Print the IDE command registration card."""
-    lines = ""
+    print(card_border_top("Step 3/3 ─── AI IDE Command Registration"))
+    print(card_line(""))
     for r in registered_ides:
-        lines += f"  {CYAN}│{RESET}   {GREEN}✔{RESET} {r:<67} {CYAN}│{RESET}\n"
-
-    print(f"""  {CYAN}┌─ {BOLD}Step 3/3{RESET} {CYAN}─────────────────── {WHITE}AI IDE Command Registration{RESET} {CYAN}─────────┐{RESET}
-  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
-{lines}  {CYAN}│{RESET}                                                                       {CYAN}│{RESET}
-  {CYAN}└───────────────────────────────────────────────────────────────────────┘{RESET}
-""")
+        print(card_line(f"{GREEN}✔{RESET} {r}"))
+    print(card_line(""))
+    print(card_border_bottom())
 
 
 def print_success_card():
     """Print the final success card with next steps."""
-    print(f"""  {GREEN}╔═══════════════════════════════════════════════════════════════════════╗{RESET}
-  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
-  {GREEN}║{RESET}   {GREEN}{BOLD}✅  WORKSPACE INITIALIZED SUCCESSFULLY{RESET}                               {GREEN}║{RESET}
-  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
-  {GREEN}╠═══════════════════════════════════════════════════════════════════════╣{RESET}
-  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
-  {GREEN}║{RESET}   {BOLD}Next Steps:{RESET}                                                         {GREEN}║{RESET}
-  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
-  {GREEN}║{RESET}    {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard-audit{RESET}  or  {WHITE}/torusguard{RESET}              {GREEN}║{RESET}
-  {GREEN}║{RESET}    {CYAN}2.{RESET} In Terminal      {WHITE}npx torusguard status{RESET}                       {GREEN}║{RESET}
-  {GREEN}║{RESET}    {CYAN}3.{RESET} In CI/CD         {WHITE}npx torusguard audit{RESET}                        {GREEN}║{RESET}
-  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
-  {GREEN}║{RESET}   {DIM}Docs{RESET}   {CYAN}https://github.com/githubmofo/TorusGuard{RESET}                   {GREEN}║{RESET}
-  {GREEN}║{RESET}   {DIM}NPM{RESET}    {CYAN}https://npmjs.com/package/torusguard{RESET}                       {GREEN}║{RESET}
-  {GREEN}║{RESET}                                                                       {GREEN}║{RESET}
-  {GREEN}╚═══════════════════════════════════════════════════════════════════════╝{RESET}
-""")
+    print(card_border_top("", border_color=GREEN, double=True))
+    print(card_line("", border="║", border_color=GREEN))
+    print(card_line(f"{GREEN}{BOLD}✅  WORKSPACE INITIALIZED SUCCESSFULLY{RESET}", border="║", border_color=GREEN))
+    print(card_line("", border="║", border_color=GREEN))
+    print(card_divider(border_color=GREEN, double=True))
+    print(card_line("", border="║", border_color=GREEN))
+    print(card_line(f"{BOLD}Next Steps:{RESET}", border="║", border_color=GREEN))
+    print(card_line("", border="║", border_color=GREEN))
+    print(card_line(f" {CYAN}1.{RESET} In AI Chat      {WHITE}/torusguard-audit{RESET}  or  {WHITE}/torusguard{RESET}", border="║", border_color=GREEN))
+    print(card_line(f" {CYAN}2.{RESET} In Terminal     {WHITE}npx torusguard status{RESET}", border="║", border_color=GREEN))
+    print(card_line(f" {CYAN}3.{RESET} In CI/CD        {WHITE}npx torusguard audit{RESET}", border="║", border_color=GREEN))
+    print(card_line("", border="║", border_color=GREEN))
+    print(card_line(f"{DIM}Docs{RESET}   {CYAN}https://github.com/githubmofo/TorusGuard{RESET}", border="║", border_color=GREEN))
+    print(card_line(f"{DIM}NPM{RESET}    {CYAN}https://npmjs.com/package/torusguard{RESET}", border="║", border_color=GREEN))
+    print(card_line("", border="║", border_color=GREEN))
+    print(card_border_bottom(border_color=GREEN, double=True))
 
 
 def print_already_initialized(target_root, cfg):
@@ -157,7 +220,7 @@ def print_already_initialized(target_root, cfg):
 
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.0.0')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.3.0')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}
@@ -358,23 +421,39 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
 3. Follow the phase execution steps defined in the workflow.
 """
 
-    # Ensure .agent/workflows and .agents/workflows are created
+    # Ensure .agents/workflows, .agents/skills, .agent/workflows, and .agent/skills are created
     dest_workflow_dirs = []
-    if (target_root / ".agents").exists():
-        agents_wf = target_root / ".agents" / "workflows"
-        agents_wf.mkdir(parents=True, exist_ok=True)
-        (agents_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
-        dest_workflow_dirs.append(agents_wf)
-        registered_ides.append("Antigravity / Gemini     .agents/workflows/torusguard.md")
 
+    # 1. Antigravity / Gemini (.agents/)
+    agents_wf = target_root / ".agents" / "workflows"
+    agents_wf.mkdir(parents=True, exist_ok=True)
+    (agents_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
+    dest_workflow_dirs.append(agents_wf)
+    registered_ides.append("Antigravity / Gemini     .agents/workflows/torusguard.md")
+
+    # 2. Tribunal Agent Kit (.agent/)
     agent_wf = target_root / ".agent" / "workflows"
     agent_wf.mkdir(parents=True, exist_ok=True)
     (agent_wf / "torusguard.md").write_text(tg_workflow_content, encoding="utf-8")
     dest_workflow_dirs.append(agent_wf)
     registered_ides.append("Tribunal Agent Kit       .agent/workflows/torusguard.md")
 
+    # Unpack Skills into .agents/skills and .agent/skills for full IDE resolution
+    src_skills = torusguard_target / "skills"
+    if src_skills.is_dir():
+        for dest_base in [target_root / ".agents" / "skills", target_root / ".agent" / "skills"]:
+            dest_base.mkdir(parents=True, exist_ok=True)
+            for skill_dir in src_skills.iterdir():
+                if skill_dir.is_dir():
+                    target_skill_dir = dest_base / skill_dir.name
+                    if not target_skill_dir.exists():
+                        try:
+                            shutil.copytree(skill_dir, target_skill_dir)
+                        except Exception:
+                            pass
+
     # When full_commands is requested (e.g. via NPM package npx torusguard init),
-    # unlock and register all 11 individual slash commands
+    # unlock and register all individual slash commands
     if full_commands:
         src_wf = torusguard_target / "workflows"
         if src_wf.is_dir():