torusguard 1.3.2 → 1.3.4

package/skills/torusguard-status/SKILL.md

@@ -1,42 +1,58 @@
----
-name: torusguard-status
-description: Display current TorusGuard security posture, active configuration, rules catalog, and run history.
-version: 0.9.2
-workflow: .torusguard/workflows/status.md
-tools: Read, Grep, Glob
-scripts-binding:
-  - .torusguard/scripts/run_manager.py
----
-
-# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
-
-## Objective
-Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
-
----
-
-## Execution Steps
-
-1. **Read Configuration:** Parse `.torusguard/config/torusguard.json` to verify initialization state and detected framework stack.
-2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
-3. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
-4. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
-5. **Render Diagnostic Overview:** Output formatted status card.
-
----
-
-## Safety Constraints
-- Read-only execution; zero file modifications.
-- Handle uninitialized workspaces gracefully with advice to run `/torusguard init`.
-
----
-
-## Output Format
-```markdown
-🛡️ [TorusGuard] Workspace Status Overview
-- Version: v0.9.2 | Stack: <Detected Framework>
-- Active Rules: <Count> rules active in `.torusguard/rules/active/`
-- Historical Runs: <Count> runs recorded
-- Scope: <Authorized (TTL Active) / Expired / Unconfigured>
-- Posture: <SECURE / ACTION REQUIRED>
-```
+---
+name: torusguard-status
+description: Display current TorusGuard security posture, active configuration, rules catalog, and run history via CLI or AI Agent.
+version: 1.3.4
+workflow: .torusguard/workflows/status.md
+tools: Read, Grep, Glob, run_command
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
+---
+
+# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
+
+## Objective
+Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution
+Run the diagnostic overview from your terminal:
+```bash
+# Display 75-column status cards
+npx torusguard status
+
+# Check status of specific project directory
+npx torusguard status ./examples/vulnerable-react-express
+
+# Output machine-readable JSON
+npx torusguard status --json
+```
+**Under the Hood:**
+- Evaluates `.torusguard/config/torusguard.json` for initialized status and detected stack.
+- Enumerates active rules in `.torusguard/rules/active/` (or canonical 71 rules).
+- Scans `.torusguard/runs/` for run history, finding counts, and verified fixes.
+- Inspects `.torusguard/config/scope.json` for authorized runtime validation targets.
+- Displays mathematically aligned 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Status Check
+When checking workspace status in AI chat:
+1. **Verify Workspace Setup:** Check if `.torusguard/` exists on disk.
+2. **Inspect Active Config:** Read `.torusguard/config/torusguard.json` for detected stack, framework, and rules.
+3. **Inspect Latest Run:** Find the latest run directory under `.torusguard/runs/` and read `manifest.json`.
+4. **Inspect Memory Engine:** Check `.torusguard/memory/patterns.json` for captured Golden Fix Recipes.
+5. **Render Diagnostic Card:** Present an overview of posture, stack, and recommended next steps.
+
+---
+
+## Output Card Format
+```markdown
+### 🛡️ TorusGuard Workspace Status Overview
+- **Version:** v1.3.3 | **Stack:** Node.js / React / Express
+- **Active Rules:** 71 canonical security rules enabled
+- **Historical Runs:** 3 runs recorded
+- **Golden Recipes:** 4 distilled into persistent memory
+- **Overall Posture:** SECURE (All targeted vulnerabilities verified closed)
+```

package/skills/torusguard-verify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-verify
 description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
-version: 0.9.2
+version: 1.3.4
 workflow: .torusguard/workflows/verify.md
 tools: Read, Grep, Glob, Write
 scripts-binding:
@@ -18,14 +18,15 @@ Audit the evidence sufficiency of candidate findings by reading current disk lin
 ## Execution Steps
 
 1. **Locate Target Findings:** Load active findings from `.torusguard/runs/<latest-run>/findings.md`.
-2. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
-3. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
-4. **Calibrate Confidence Score:**
+2. **Handle CLI Failures:** If `python .torusguard/scripts/finding_scorer.py` or the verify workflow fails, YOU must manually read the code and calibrate the score based on the evidence parameters.
+3. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
+4. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
+5. **Calibrate Confidence Score:**
    ```bash
    python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
    ```
-5. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
-6. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
+6. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
+7. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
 
 ---
 
@@ -47,7 +48,7 @@ A finding is verified as sufficient when:
 
 ## Output Format
 ```markdown
-🧪 [TorusGuard] Finding Verification Complete
+🧪 [TorusGuard] Finding Verification Complete (AI Assisted)
 - Findings Audited: <Count> | Confirmed Real: <Count>
 - False Positives Filtered: <Count> | Refined Mean Score: <Score>/100
 - Artifact: `.torusguard/runs/<run_id>/verified-evidence.md`

package/skills/torusguard-web-validate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-web-validate
 description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
-version: 0.9.2
+version: 1.3.4
 workflow: .torusguard/workflows/web-validate.md
 tools: Read, Grep, Glob, Bash, Write
 scripts-binding:
@@ -34,11 +34,12 @@ All requests pass through `.torusguard/scripts/safety_gate.py`:
 ## Execution Steps
 
 1. **Gate Check:** Validate scope in `scope.json` and query `safety_gate.py`.
-2. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
-3. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
-4. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
-5. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
-6. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
+2. **Handle Automation Failure:** If automated web validation scripts fail, YOU must manually construct the HTTP requests (using `curl` or `fetch`) and inspect the responses.
+3. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
+4. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
+5. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
+6. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
+7. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
 
 ---
 
@@ -56,7 +57,7 @@ All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk s
 
 ## Output Format
 ```markdown
-🌐 [TorusGuard] Web Validation Completed
+🌐 [TorusGuard] Web Validation Completed (AI Assisted)
 - Target: <Host URL> | Endpoints Tested: <Count>
 - Header Posture: <CSP/HSTS Status> | Cookies: <Flags Status>
 - Replay Trace: `.torusguard/runs/<run_id>/requests.json`