torusguard 1.3.2 → 1.3.3

package/skills/torusguard-apply/SKILL.md

@@ -19,11 +19,12 @@ Safely apply approved remediation bundles to disk source files, capturing a byte
 ## Execution Steps
 
 1. **Load Bundle:** Read `patch.diff` and metadata from `.torusguard/runs/<run_id>/remediation/<finding_id>/`.
-2. **Pre-Apply Snapshot:** Save exact backup to `.torusguard/runs/<run_id>/pre_apply/<filename>.bak`.
-3. **Obtain Human Gate:** Confirm user approval for proposed diff.
-4. **Apply Patch:** Execute surgical modification using `replace_file_content` or `patch`.
-5. **Assert Integrity:** Verify modified file compiles cleanly without syntax errors.
-6. **Record Ledger:** Log timestamp, file path, and post-patch SHA-256 in `apply-log.json`.
+2. **Handle CLI Failures:** If the CLI `npx torusguard apply` throws an error or fails to apply the patch, YOU MUST step in and apply it manually.
+3. **Pre-Apply Snapshot:** Save exact backup to `.torusguard/runs/<run_id>/pre_apply/<filename>.bak`.
+4. **Obtain Human Gate:** Confirm user approval for proposed diff.
+5. **Apply Patch Manually:** Execute the surgical modification directly on the target file using `replace_file_content`. Ensure the lines match the `patch.diff` formulated during harden phase.
+6. **Assert Integrity:** Verify modified file compiles cleanly without syntax errors (e.g. running `npm run build` or `python -m py_compile`).
+7. **Record Ledger:** Log timestamp, file path, and post-patch SHA-256 in `apply-log.json`.
 
 ---
 
@@ -32,12 +33,13 @@ Safely apply approved remediation bundles to disk source files, capturing a byte
 - Always create a rollback snapshot before modifying disk code.
 - If compile or syntax error occurs, instantly restore from `.bak`.
 - Require explicit operator confirmation before writing changes.
+- **Do not give up** if the CLI automation fails; the AI Agent must manually complete the patching process.
 
 ---
 
 ## Output Format
 ```markdown
-🚀 [TorusGuard] Patch Applied Successfully
+🚀 [TorusGuard] Patch Applied Successfully (AI Assisted)
 - Finding Target: <Finding ID> | File: <Path>
 - Churn: +<Additions> / -<Deletions>
 - Rollback Backup: `.torusguard/runs/<run_id>/pre_apply/<file>.bak`

package/skills/torusguard-audit/SKILL.md

@@ -65,6 +65,11 @@ Execute static AST analysis, query memory context, compute 0–100 confidence sc
 ```markdown
 🛡️ [TorusGuard] Static Code Audit Completed
 - Run ID: run-YYYYMMDD-HHMMSS-audit | Files: <Count> | Findings: <Count>
+- Posture Score: <Score>/100 (100 = Perfect, 0 = Extremely Vulnerable)
 - Clusters: <Count> identified | Memory Patterns Applied: <Count>
+
+> [!IMPORTANT]
+> If the posture score is low (e.g. 10/100) and vulnerabilities exist, it is your responsibility as the AI Agent to proactively recommend and manually execute the patches if the automated CLI falls short.
+
 Next: Run `/torusguard harden` to formulate surgical fixes.
 ```

package/skills/torusguard-authorize/SKILL.md

@@ -24,8 +24,9 @@ Define and validate legal runtime authorization boundaries, verify target owners
    ```bash
    python .torusguard/scripts/safety_gate.py check --url <target_url>
    ```
-5. **Write Scope Record:** Persist authorized targets, rate limits, and expiration timestamp into `.torusguard/config/scope.json`.
-6. **Validate Schema:** Confirm `scope.json` adheres to `auth-boundary.schema.json`.
+5. **Handle CLI Failures:** If `safety_gate.py` fails or is unavailable, YOU must manually verify the safety invariants and generate the JSON structure below.
+6. **Write Scope Record:** Persist authorized targets, rate limits, and expiration timestamp into `.torusguard/config/scope.json`.
+7. **Validate Schema:** Confirm `scope.json` adheres to `auth-boundary.schema.json`.
 
 ---
 
@@ -38,7 +39,7 @@ Define and validate legal runtime authorization boundaries, verify target owners
 
 ## Output Format
 ```markdown
-🔒 [TorusGuard] Target Scope Authorized
+🔒 [TorusGuard] Target Scope Authorized (AI Assisted)
 - Target Host: <Host URL> | Environment: <Local / Staging>
 - Allowed Paths: <Prefixes> | Rate Limit: <Max Req/sec>
 - Expiration TTL: <Timestamp>

package/skills/torusguard-exploit-check/SKILL.md

@@ -36,14 +36,15 @@ Before dispatching any exploitability probe:
 
 1. **Verify Scope:** Read `scope.json`; assert authorized endpoint.
 2. **Select Canary:** Choose matching non-destructive probe strategy.
-3. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`.
-4. **Classify Status:** Transition finding into one of 5 canonical outcomes:
+3. **Handle Automation Failure:** If automated exploit check scripts fail, YOU must manually construct the safe HTTP request (using `curl` or `fetch`) and inspect the response.
+4. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`.
+5. **Classify Status:** Transition finding into one of 5 canonical outcomes:
    - `Confirmed`: Canary reflected or secondary tenant data leaked.
    - `Not Reproducible`: Endpoint responded with 401/403 or sanitized input.
    - `Needs Review`: Ambiguous status code or incomplete response.
    - `Blocked by Controls`: WAF or rate limiter stopped probe.
    - `Out of Scope`: Target endpoint is not authorized.
-5. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.
+6. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.
 
 ---
 
@@ -56,7 +57,7 @@ Before dispatching any exploitability probe:
 
 ## Output Format
 ```markdown
-🎯 [TorusGuard] Exploitability Confirmation
+🎯 [TorusGuard] Exploitability Confirmation (AI Assisted)
 - Finding ID: <Finding ID> | Target: <Route>
 - Status: <Confirmed / Not Reproducible / Blocked>
 - Evidence: <Response snippet or status code>

package/skills/torusguard-harden/SKILL.md

@@ -36,17 +36,17 @@ Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$
 
 ## Execution Steps
 
-1. **Select Finding:** Choose prioritized verified flaw from active run's `findings.md`.
-2. **Read AST Context:** View target file surrounding lines (±15) using `view_file`.
-3. **Formulate Minimal Fix:** Consult `.torusguard/memory/context.json` for verified idioms; parameterize SQL, add tenant filters.
-4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$ via `diff_guard.py`.
-5. **Package Bundle:** Write 4 artifacts (`patch.diff`, `plan.md`, `verification.md`, `rollback.md`).
+1. **Evaluate Findings:** First, review the active run's `findings.md`. If the user has already run the CLI `npx torusguard harden` and it formulated `0` patches (or skipped complex findings), it is **YOUR RESPONSIBILITY** as the AI Agent to manually remediate the remaining findings.
+2. **Read AST Context:** View target file surrounding lines (±15) using `view_file` to deeply understand the vulnerability.
+3. **Formulate Minimal Fix:** Actively rewrite the code to fix the vulnerability (e.g. parameterize SQL, add tenant filters, use safe DOM APIs). Do NOT wait for the CLI to do it. You must generate the fix. Consult `.torusguard/memory/context.json` for verified idioms.
+4. **Validate Line Churn:** Assert additions $\le 35$ and deletions $\le 25$ via `diff_guard.py`. If it's too complex, partition into sequential sub-bundles.
+5. **Package Bundle Manually:** Write 4 artifacts (`patch.diff`, `plan.md`, `verification.md`, `rollback.md`) into `.torusguard/runs/<run_id>/remediation/<finding_id>/`.
 6. **Flag Sensitive Paths:** Mark changes touching auth or billing with `Requires Sensitive-Path Sign-Off`.
 
 ---
 
 ## Safety Constraints
-- Dry-run only; do NOT apply modifications to source code during harden.
+- Dry-run only; do NOT apply modifications directly to source code during harden. Only write to the `patch.diff` artifact.
 - Keep surrounding formatting and comments intact.
 - Never touch files outside the targeted vulnerable sink.
 
@@ -54,10 +54,14 @@ Formulate minimal, surgical code fixes bound by the Ponytail Protocol ($\le 35$
 
 ## Output Format
 ```markdown
-🛠️ [TorusGuard] Remediation Bundle Packaged
+🛠️ [TorusGuard] Remediation Bundle Packaged (AI Assisted)
 - Finding Target: <Finding ID> | File: <Path>
 - Line Churn: +<Additions> / -<Deletions> (Ponytail: PASS)
 - Sensitive Path: <Yes/No>
 - Bundle Path: `.torusguard/runs/<run_id>/remediation/<finding_id>/`
+
+> [!NOTE]
+> This patch was formulated manually by the TorusGuard AI Agent because it required architectural changes beyond the CLI's automated templates.
+
 Next: Run `/torusguard apply` to review diff and apply with rollback backup.
 ```

package/skills/torusguard-init/SKILL.md

@@ -28,10 +28,11 @@ Auto-detect repository technology stack via indicators or `stack_detect.py`, act
    - Python: Django (`manage.py`), FastAPI (`fastapi`), Flask (`flask`), SQLAlchemy.
    - Node: Next.js (`"next"`), Express (`"express"`), React/Vite (`"vite"`).
    - BaaS: Supabase (`@supabase/supabase-js`), Firebase (`firebase-admin`).
-2. **Emit Stack Record:** Log detected language, framework, ORM, and client SDKs.
-3. **Activate Tailored Rules:** Copy matching `TG-*` rules from `.torusguard/rules/` into `.torusguard/rules/active/`.
-4. **Provision Policy:** Create `SECURITY.md` if absent, configuring responsible disclosure contacts.
-5. **Write Configuration:** Persist detected stack and active rules count to `.torusguard/config/torusguard.json`.
+2. **Handle CLI Failures:** If `stack_detect.py` crashes or is unable to determine the stack, YOU must manually analyze the directory structure and determine the stack.
+3. **Emit Stack Record:** Log detected language, framework, ORM, and client SDKs.
+4. **Activate Tailored Rules:** Copy matching `TG-*` rules from `.torusguard/rules/` into `.torusguard/rules/active/`.
+5. **Provision Policy:** Create `SECURITY.md` if absent, configuring responsible disclosure contacts.
+6. **Write Configuration:** Persist detected stack and active rules count to `.torusguard/config/torusguard.json`.
 
 ---
 
@@ -44,7 +45,7 @@ Auto-detect repository technology stack via indicators or `stack_detect.py`, act
 
 ## Output Format
 ```markdown
-🛡️ [TorusGuard] Workspace Initialized
+🛡️ [TorusGuard] Workspace Initialized (AI Assisted)
 - Primary Stack: <Detected Stack> | Components: <Backend/Frontend/DB>
 - Active Rules: <Count> rules enabled in `.torusguard/rules/active/`
 - Configuration: `.torusguard/config/torusguard.json` written

package/skills/torusguard-recheck/SKILL.md

@@ -19,11 +19,12 @@ Re-scan only files modified by remediation patches, confirming that targeted vul
 ## Execution Steps
 
 1. **Identify Modified Files:** Read `apply-log.json` from active run directory.
-2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against modified files.
-3. **Evaluate Finding Status:** Transition finding state according to transition rules below.
-4. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
-5. **Update State & Memory:** Record status in `findings.json` and sync verified results to memory engine.
-6. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
+2. **Handle CLI Failures:** If `npx torusguard recheck` crashes or reports a false negative, YOU must act as the manual arbiter.
+3. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against modified files. If doing this manually, use `view_file` to read the patched file and cross-reference with the active rules.
+4. **Evaluate Finding Status:** Transition finding state according to transition rules below.
+5. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
+6. **Update State & Memory:** Record status in `findings.json` and sync verified results to memory engine.
+7. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
 
 ---
 
@@ -37,14 +38,14 @@ Re-scan only files modified by remediation patches, confirming that targeted vul
 
 ## Safety Constraints
 - Restrict AST scan strictly to modified files and direct callers.
-- If regression is detected, halt and recommend immediate rollback via `.bak` snapshot.
+- If regression is detected, halt and recommend immediate rollback via `.bak` snapshot. If CLI rollback fails, you MUST manually revert the file using your write tools.
 - Read-only differential analysis.
 
 ---
 
 ## Output Format
 ```markdown
-✅ [TorusGuard] Differential Recheck Completed
+✅ [TorusGuard] Differential Recheck Completed (AI Assisted)
 - Modified Files Scanned: <Count>
 - Target Finding: <Finding ID> ──► FIXED
 - Regressions Detected: 0

package/skills/torusguard-report/SKILL.md

@@ -19,13 +19,14 @@ Aggregate findings, verification traces, and recheck results into a signed execu
 ## Execution Steps
 
 1. **Aggregate Run Data:** Read findings, verified evidence, and recheck records from active run.
-2. **Export OASIS SARIF v2.1.0:**
+2. **Handle CLI Failures:** If `npx torusguard report --html` or SARIF export crashes, YOU must manually gather the metrics and format the report.
+3. **Export OASIS SARIF v2.1.0:**
    ```bash
    python .torusguard/scripts/sarif_exporter.py --run <run_dir> --output <run_dir>/results.sarif
    ```
-3. **Compile Executive Markdown Report:** Generate `report.md` with posture score, open/closed finding tables, and risk breakdown.
-4. **Update Run Manifest:** Finalize `manifest.json` status counts.
-5. **Archive Release Artifacts:** Ensure `report.md` and `results.sarif` are serialized to disk.
+4. **Compile Executive Markdown/HTML Report:** Generate `report.md` or `.html` with posture score, open/closed finding tables, and risk breakdown. Make sure the polyglot stack detected during audit is explicitly summarized.
+5. **Update Run Manifest:** Finalize `manifest.json` status counts.
+6. **Archive Release Artifacts:** Ensure `report.md` and `results.sarif` are serialized to disk.
 
 ---
 
@@ -46,7 +47,7 @@ Aggregate findings, verification traces, and recheck results into a signed execu
 
 ## Output Format
 ```markdown
-📊 [TorusGuard] Security Posture Report Emitted
+📊 [TorusGuard] Security Posture Report Emitted (AI Assisted)
 - Run ID: <Run ID> | Posture Score: <Score>/100
 - Findings: <Total> (<Fixed> Fixed · <Open> Open)
 - SARIF Export: `.torusguard/runs/<run_id>/results.sarif`

package/skills/torusguard-status/SKILL.md

@@ -18,22 +18,23 @@ Provide an instant diagnostic summary of the repository's security state, active
 ## Execution Steps
 
 1. **Read Configuration:** Parse `.torusguard/config/torusguard.json` to verify initialization state and detected framework stack.
-2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
-3. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
-4. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
-5. **Render Diagnostic Overview:** Output formatted status card.
+2. **Handle CLI Failures:** If `npx torusguard status` throws an error, YOU must manually parse the local files (e.g. `torusguard.json`, `scope.json`) to deduce the status instead of just returning the CLI error.
+3. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
+4. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
+5. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
+6. **Render Diagnostic Overview:** Output formatted status card.
 
 ---
 
 ## Safety Constraints
 - Read-only execution; zero file modifications.
-- Handle uninitialized workspaces gracefully with advice to run `/torusguard init`.
+- Handle uninitialized workspaces gracefully with advice to run `/torusguard init` (or manual AI initialization).
 
 ---
 
 ## Output Format
 ```markdown
-🛡️ [TorusGuard] Workspace Status Overview
+🛡️ [TorusGuard] Workspace Status Overview (AI Assisted)
 - Version: v0.9.2 | Stack: <Detected Framework>
 - Active Rules: <Count> rules active in `.torusguard/rules/active/`
 - Historical Runs: <Count> runs recorded

package/skills/torusguard-verify/SKILL.md

@@ -18,14 +18,15 @@ Audit the evidence sufficiency of candidate findings by reading current disk lin
 ## Execution Steps
 
 1. **Locate Target Findings:** Load active findings from `.torusguard/runs/<latest-run>/findings.md`.
-2. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
-3. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
-4. **Calibrate Confidence Score:**
+2. **Handle CLI Failures:** If `python .torusguard/scripts/finding_scorer.py` or the verify workflow fails, YOU must manually read the code and calibrate the score based on the evidence parameters.
+3. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
+4. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
+5. **Calibrate Confidence Score:**
    ```bash
    python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
    ```
-5. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
-6. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
+6. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
+7. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
 
 ---
 
@@ -47,7 +48,7 @@ A finding is verified as sufficient when:
 
 ## Output Format
 ```markdown
-🧪 [TorusGuard] Finding Verification Complete
+🧪 [TorusGuard] Finding Verification Complete (AI Assisted)
 - Findings Audited: <Count> | Confirmed Real: <Count>
 - False Positives Filtered: <Count> | Refined Mean Score: <Score>/100
 - Artifact: `.torusguard/runs/<run_id>/verified-evidence.md`

package/skills/torusguard-web-validate/SKILL.md

@@ -34,11 +34,12 @@ All requests pass through `.torusguard/scripts/safety_gate.py`:
 ## Execution Steps
 
 1. **Gate Check:** Validate scope in `scope.json` and query `safety_gate.py`.
-2. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
-3. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
-4. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
-5. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
-6. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
+2. **Handle Automation Failure:** If automated web validation scripts fail, YOU must manually construct the HTTP requests (using `curl` or `fetch`) and inspect the responses.
+3. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
+4. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
+5. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
+6. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
+7. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
 
 ---
 
@@ -56,7 +57,7 @@ All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk s
 
 ## Output Format
 ```markdown
-🌐 [TorusGuard] Web Validation Completed
+🌐 [TorusGuard] Web Validation Completed (AI Assisted)
 - Target: <Host URL> | Endpoints Tested: <Count>
 - Header Posture: <CSP/HSTS Status> | Cookies: <Flags Status>
 - Replay Trace: `.torusguard/runs/<run_id>/requests.json`