torusguard 1.3.3 → 1.3.4

package/.torusguard/runs/run-20260910-130519-audit/findings.md

@@ -0,0 +1,246 @@
+# TorusGuard Security Audit Findings: run-20260910-130519-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `17`
+- Identified Clusters: `5`
+- Generated At: `2026-09-10 13:05:19 IST`
+
+---
+## Summary of Findings
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-bb5e4b77`
+- **Location:** `examples/vulnerable-react-express/server/index.js:9`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded JWT signing secret
+```
+
+// TG-SEC-001: Hardcoded JWT secret
+const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [Critical] TG-SEC-001 - Hardcoded Secret or API Key in Tracked Source
+- **Finding ID:** `TG-SEC-001-c393d596`
+- **Location:** `examples/vulnerable-react-express/server/index.js:18`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Hardcoded credential or API secret string
+```
+
+const users = [
+  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },
+  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },
+];
+```
+
+### [Critical] TG-DB-002 - Privileged Database Secret or Master Role Key in Client Code
+- **Finding ID:** `TG-DB-002-d9bd69df`
+- **Location:** `demo/playground/vulnerable_nextjs/actions.ts:9`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-client-leak`
+- **Description:** Service role key or raw database connection string reference in frontend code
+```
+
+// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code
+export const SUPABASE_SERVICE_ROLE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890";
+
+interface UserRecord {
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-671d3513`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:246`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+    # Strategy 8: TLS Verification Bypass (TG-DIFF-001)
+    elif rule_id == "TG-DIFF-001":
+        if "verify=False" in target_line:
+            fixed_line = target_line.replace("verify=False", "verify=True")
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-b6549484`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:256`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+            applied_rule = True
+            fix_explanation = "Restored TLS certificate authority validation (rejectUnauthorized: true)"
+        elif "InsecureSkipVerify: true" in target_line:
+            fixed_line = target_line.replace("InsecureSkipVerify: true", "InsecureSkipVerify: false")
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-c4cfaa8a`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:251`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+            applied_rule = True
+            fix_explanation = "Restored mandatory TLS certificate verification (verify=True)"
+        elif "rejectUnauthorized: false" in target_line:
+            fixed_line = target_line.replace("rejectUnauthorized: false", "rejectUnauthorized: true")
+            new_lines[line_number - 1] = fixed_line
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-7db54483`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:180`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled TLS certificate verification (verify=False)
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-77bc2f9b`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:157`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Go TLS certificate verification (InsecureSkipVerify: true)
+```
+    if "go" in stack_lower:
+        sql_guards.append("`db.Query(..., args)` / GORM")
+        bypass_guards.append("`InsecureSkipVerify: true`")
+    if "rust" in stack_lower:
+        sql_guards.append("`sqlx::query!` / Diesel")
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-cb5ae7e9`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:172`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled Node.js TLS rejectUnauthorized
+```
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+        bypass_guards.append("`rejectUnauthorized: false`")
+
+    if not sql_guards:
+```
+
+### [Critical] TG-DIFF-001 - Disabled TLS / SSL Certificate Validation
+- **Finding ID:** `TG-DIFF-001-0e4204af`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:169`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-transport-security`
+- **Description:** Disabled PHP curl SSL verification
+```
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+        bypass_guards.append("`CURLOPT_SSL_VERIFYPEER => false`")
+    if "typescript" in stack_lower or "javascript" in stack_lower or "next" in stack_lower or "express" in stack_lower:
+        sql_guards.append("Prisma / Drizzle binders")
+```
+
+### [High] TG-INPUT-003 - Unsafe Dynamic Code or HTML Execution
+- **Finding ID:** `TG-INPUT-003-fea9421e`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:53`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-injection`
+- **Description:** React dangerouslySetInnerHTML rendering raw unescaped HTML
+```
+
+      {/* TG-INPUT-003: Unsafe HTML rendering */}
+      <div dangerouslySetInnerHTML={{ __html: bio }} />
+
+      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [High] TG-PLATFORM-001 - Wildcard Permissive CORS Configuration with Credentials
+- **Finding ID:** `TG-PLATFORM-001-7dd35cb4`
+- **Location:** `examples/vulnerable-react-express/server/index.js:12`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin configured in Express middleware
+```
+
+// TG-PLATFORM-001: Wildcard CORS with credentials
+app.use(cors({ origin: '*', credentials: true }));
+
+// TG-PLATFORM-004: No explicit JSON body size limit
+```
+
+### [High] TG-PLATFORM-001 - Wildcard Permissive CORS Configuration with Credentials
+- **Finding ID:** `TG-PLATFORM-001-1a813dde`
+- **Location:** `skills/torusguard/payload/scripts/harden_runner.py:202`
+- **Confidence Score:** `80/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Wildcard CORS origin enabled across entire application
+```
+    # Strategy 5: Permissive CORS with Credentials (TG-PLATFORM-001)
+    elif rule_id == "TG-PLATFORM-001":
+        if "CORS_ALLOW_ALL_ORIGINS = True" in target_line:
+            replacement = f'{indent}CORS_ALLOWED_ORIGINS = [os.environ.get("ALLOWED_ORIGIN", "https://app.example.com")]'
+            new_lines[line_number - 1] = replacement
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie or Disabled CSRF Protection
+- **Finding ID:** `TG-AUTH-004-f60870ef`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:180`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Decorator disabling route-level authentication or CSRF protection
+```
+
+    if not bypass_guards:
+        bypass_rule = "4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, `@csrf_exempt`, or `bypass_auth=True`."
+    else:
+        bypass_rule = f"4. **No Security Bypasses:** Never insert `# nosec`, `verify=False`, or {', '.join(bypass_guards[:2])}."
+```
+
+### [High] TG-AUTH-004 - Insecure Session Cookie or Disabled CSRF Protection
+- **Finding ID:** `TG-AUTH-004-6b0c7ebf`
+- **Location:** `skills/torusguard/payload/scripts/rules_sync.py:166`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-auth-bypass`
+- **Description:** Attribute disabling ASP.NET authentication
+```
+    if "c#" in stack_lower or "dotnet" in stack_lower:
+        sql_guards.append("EF Core LINQ / `FromSqlInterpolated`")
+        bypass_guards.append("`[AllowAnonymous]`")
+    if "php" in stack_lower:
+        sql_guards.append("PDO prepared statements / Eloquent")
+```
+
+### [Medium] TG-SEC-004 - Sensitive Credential or Token Logging
+- **Finding ID:** `TG-SEC-004-dbbc17f7`
+- **Location:** `examples/vulnerable-react-express/client/src/App.jsx:30`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to standard output
+```
+    const data = await res.json();
+    // TG-CLIENT-002: Sensitive console logging
+    console.log('Login token:', data.token, 'config:', clientConfig);
+    setMessage(JSON.stringify(data));
+  }
+```
+
+### [Medium] TG-SEC-004 - Sensitive Credential or Token Logging
+- **Finding ID:** `TG-SEC-004-08753da5`
+- **Location:** `examples/vulnerable-react-express/server/index.js:28`
+- **Confidence Score:** `70/100` (High Confidence)
+- **Cluster:** `cluster-credentials-exposure`
+- **Description:** Plaintext credential or token logged to standard output
+```
+app.post('/api/login', (req, res) => {
+  const { email, password } = req.body;
+  console.log('Login attempt:', { email, password }); // TG-SEC-004
+  const user = users.find((u) => u.email === email && u.password === password);
+  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration
+```

package/.torusguard/runs/run-20260910-130519-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260910-130519-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-10 13:05:19 IST",
+  "created_at_iso": "2026-09-10T13:05:19.697735+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 17,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260910-130519-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260910-130519-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 17
+- Root-Cause Clusters: 5
+- Generated: 2026-09-10 13:05:19 IST

package/.torusguard/scripts/apply_runner.py

@@ -1,8 +1,9 @@
 #!/usr/bin/env python3
 """
-TorusGuard Governed Patch Application & Snapshot Engine (v1.3.0)
+TorusGuard Governed Patch Application & Snapshot Engine (v1.3.3)
 Interactive Human Gate authorization, pre-apply .bak rollback snapshots,
 atomic patch application, and Golden Fix Recipe distillation into persistent memory.
+Strict 75-column terminal UI formatting.
 
 Pure Python 3.10+ standard library (zero external dependencies).
 """
@@ -15,9 +16,18 @@ import shutil
 import hashlib
 import argparse
 import datetime
-import unicodedata
 from pathlib import Path
-from typing import Dict, List, Any, Optional, Tuple
+from typing import Dict, List, Any, Optional
+
+# Ensure scripts dir is in sys.path for term_ui import
+scripts_dir = Path(__file__).resolve().parent
+if str(scripts_dir) not in sys.path:
+    sys.path.insert(0, str(scripts_dir))
+
+try:
+    import term_ui
+except ImportError:
+    term_ui = None
 
 # Windows console UTF-8 support
 if sys.stdout and hasattr(sys.stdout, "reconfigure"):
@@ -32,7 +42,7 @@ IST = datetime.timezone(datetime.timedelta(hours=5, minutes=30), name="IST")
 def get_ist_now() -> datetime.datetime:
     return datetime.datetime.now(IST)
 
-# ─── ANSI Colors & Formatter ───────────────────────────────────────────────────
+# ─── Formatting Helpers ────────────────────────────────────────────────────────
 BOLD = "\033[1m"
 DIM = "\033[2m"
 RESET = "\033[0m"
@@ -43,25 +53,25 @@ WHITE = "\033[97m"
 GRAY = "\033[90m"
 RED = "\033[31m"
 
-ANSI_REGEX = re.compile(r'\033\[[0-9;]*m')
-
-def get_visual_width(text: str) -> int:
-    clean = ANSI_REGEX.sub('', text)
-    width = 0
-    for ch in clean:
-        ea = unicodedata.east_asian_width(ch)
-        if ea in ('W', 'F'):
-            width += 2
-        elif ord(ch) >= 0x1F300:
-            width += 2
-        else:
-            width += 1
-    return width
+def box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
+    return f"  {border_color}{border}{RESET}  {content}"
+
+def box_header(title: str, subtitle: str = "", version: str = "v1.3.3", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.card_header(title, subtitle, version, border_color)
+    return f"=== {title} ({version}) ==="
+
+def border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_top(title, border_color=border_color, double=double)
+    return "┌" + "─" * 71 + "┐"
 
-def format_box_line(content: str, width: int = 71, border: str = "│", border_color: str = CYAN) -> str:
-    vis = get_visual_width(content)
-    pad = " " * max(0, width - vis)
-    return f"  {border_color}{border}{RESET}  {content}{pad}{border_color}{border}{RESET}"
+def border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_bottom(border_color=border_color, double=double)
+    return "└" + "─" * 71 + "┘"
 
 
 def find_latest_audit_run(runs_dir: Path) -> Optional[Path]:
@@ -98,17 +108,17 @@ def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> Non
         shutil.copy2(bak_file, dest_file)
         restored_files.append(orig_rel)
 
-    print(f"\n  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}")
-    print(format_box_line(f"{BOLD}🛡️  TORUSGUARD ROLLBACK RESTORATION                   v1.3.1{RESET}", border_color=CYAN))
-    print(format_box_line(f"{DIM}Restored original files from pre-apply snapshot{RESET}", border_color=CYAN))
-    print(f"  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}\n")
+    print()
+    print(box_header("🛡️  TORUSGUARD ROLLBACK RESTORATION", "Restored original files from pre-apply snapshot", "v1.3.3"))
+    print()
 
-    print(f"  {CYAN}┌─ Rollback Snapshot Restored ────────────────────────────────────────────┐{RESET}")
-    print(format_box_line(f"Snapshot Run:   {WHITE}{snapshot_dir.name}{RESET}"))
-    print(format_box_line(f"Files Restored: {GREEN}{len(restored_files)} file(s) cleanly reverted{RESET}"))
+    print(border_top("Rollback Snapshot Restored"))
+    print(box_line(f"Snapshot Run:   {WHITE}{snapshot_dir.name}{RESET}"))
+    print(box_line(f"Files Restored: {GREEN}{len(restored_files)} file(s) cleanly reverted{RESET}"))
     for rf in restored_files:
-        print(format_box_line(f"  ✔ {rf}"))
-    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+        print(box_line(f"  ✔ {rf}"))
+    print(border_bottom())
+    print()
     sys.exit(0)
 
 
@@ -127,21 +137,17 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     bundles_dir = run_folder / "bundles"
     bundle_meta_files = list(bundles_dir.glob("*/metadata.json")) if bundles_dir.is_dir() else []
     if not bundle_meta_files:
-        print(f"\n  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}")
-        print(f"  {CYAN}│                                                                         │{RESET}")
-        print(format_box_line(f"{BOLD}🛡️  TORUSGUARD GOVERNED PATCH APPLIER               v1.3.1{RESET}", border_color=CYAN))
-        print(format_box_line(f"{DIM}Human-Gate Authorization, Snapshots & Golden Recipe Distillation{RESET}", border_color=CYAN))
-        print(f"  {CYAN}│                                                                         │{RESET}")
-        print(f"  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}\n")
-
+        print()
+        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.3"))
+        print()
         print(f"  {YELLOW}ℹ Zero candidate remediation bundles found in run: {run_folder.name}{RESET}")
         print(f"  {GRAY}The findings in this run require manual review or AI-assisted remediation.{RESET}\n")
-        print(f"  {CYAN}┌─ Recommended Next Steps ────────────────────────────────────────────────┐{RESET}")
-        print(format_box_line("1. In AI Chat (Antigravity/Cursor/Claude): Run /torusguard-harden"))
-        print(format_box_line("   to formulate custom architectural patches with your AI agent."))
-        print(format_box_line(f"2. Inspect findings: .torusguard/runs/{run_folder.name}/findings.md"))
-        print(format_box_line("3. View visual posture report: npx torusguard report --html"))
-        print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+        print(border_top("Recommended Next Steps"))
+        print(box_line("1. In AI Chat: Run /torusguard-harden to synthesize custom fixes"))
+        print(box_line(f"2. Inspect findings: .torusguard/runs/{run_folder.name}/findings.md"))
+        print(box_line("3. View visual posture report: npx torusguard report --html"))
+        print(border_bottom())
+        print()
         sys.exit(0)
 
     bundles = []
@@ -156,18 +162,16 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     snapshot_dir.mkdir(parents=True, exist_ok=True)
 
     # Header Card
-    print(f"\n  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}")
-    print(f"  {CYAN}│                                                                         │{RESET}")
-    print(format_box_line(f"{BOLD}🛡️  TORUSGUARD GOVERNED PATCH APPLIER               v1.3.0{RESET}", border_color=CYAN))
-    print(format_box_line(f"{DIM}Human-Gate Authorization, Snapshots & Golden Recipe Distillation{RESET}", border_color=CYAN))
-    print(f"  {CYAN}│                                                                         │{RESET}")
-    print(f"  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}\n")
-
-    print(f"  {CYAN}┌─ Candidate Bundles Ready for Application ───────────────────────────────┐{RESET}")
-    print(format_box_line(f"Active Run:     {WHITE}{run_folder.name}{RESET}"))
-    print(format_box_line(f"Total Bundles:  {GREEN}{len(bundles)} candidate surgical patches formulated{RESET}"))
-    print(format_box_line(f"Rollback Safety:Automatic pre-apply snapshot to .torusguard/snapshots/{run_folder.name}"))
-    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+    print()
+    print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.3"))
+    print()
+
+    print(border_top("Candidate Bundles Ready for Application"))
+    print(box_line(f"Active Run:     {WHITE}{run_folder.name}{RESET}"))
+    print(box_line(f"Total Bundles:  {GREEN}{len(bundles)} candidate surgical patches formulated{RESET}"))
+    print(box_line(f"Rollback Safety:Automatic pre-apply snapshot to .torusguard/snapshots/"))
+    print(border_bottom())
+    print()
 
     applied_count = 0
     skipped_count = 0
@@ -176,10 +180,10 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     applied_bundles = []
 
     # Import memory_engine for Golden Recipe distillation
-    scripts_dir = Path(__file__).resolve().parent
-    if str(scripts_dir) not in sys.path:
-        sys.path.insert(0, str(scripts_dir))
-    import memory_engine
+    try:
+        import memory_engine
+    except ImportError:
+        memory_engine = None
 
     for idx, b in enumerate(bundles, 1):
         rule_id = b.get("rule_id", "TG-SEC")
@@ -228,39 +232,67 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
             print(f"  {RED}✖ Target file not found: {target_file}{RESET}\n")
             continue
 
-        # 1. Pre-apply Snapshot (.bak)
+        # 1. Pre-apply Snapshot (.bak) if not already created
         bak_dest = snapshot_dir / (rel_path + ".bak")
-        bak_dest.parent.mkdir(parents=True, exist_ok=True)
-        shutil.copy2(target_file, bak_dest)
-
-        # 2. Write Patched Content
-        if patched_content:
+        if not bak_dest.is_file():
+            bak_dest.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(target_file, bak_dest)
+
+        # 2. Write Patched Content (Sequential Line-Aware or Full Patch)
+        target_line = b.get("target_line")
+        replacement_line = b.get("replacement_line")
+        curr_text = target_file.read_text(encoding="utf-8", errors="replace")
+        curr_lines = curr_text.splitlines()
+
+        if target_line and replacement_line is not None:
+            applied_line = False
+            # Try expected line index
+            if 0 <= line_no - 1 < len(curr_lines) and curr_lines[line_no - 1] == target_line:
+                curr_lines[line_no - 1] = replacement_line
+                applied_line = True
+            else:
+                # Search across whole file for the target line
+                for i, cl in enumerate(curr_lines):
+                    if cl == target_line:
+                        curr_lines[i] = replacement_line
+                        applied_line = True
+                        break
+            if applied_line:
+                target_file.write_text("\n".join(curr_lines) + "\n", encoding="utf-8")
+            elif patched_content:
+                target_file.write_text(patched_content, encoding="utf-8")
+        elif patched_content:
             target_file.write_text(patched_content, encoding="utf-8")
         else:
             continue
 
         # 3. Distill into Golden Fix Recipe in Memory Engine
-        try:
-            fn = getattr(memory_engine, "record_golden_recipe", getattr(memory_engine, "store_golden_recipe", None))
-            if fn:
-                fn(
-                    rule_id=rule_id,
-                    before_snippet=target_file.read_text(encoding="utf-8").splitlines()[max(0, line_no-1)],
-                    after_snippet=desc,
-                    diff_snippet=diff,
-                    file_type=target_file.suffix,
-                    description=desc,
-                    root_dir=target_root
-                )
-            # Record event
-            memory_engine.record_event("fix_applied", {
-                "rule_id": rule_id,
-                "file_path": rel_path,
-                "line_number": line_no,
-                "bundle_id": b.get("bundle_id")
-            }, root_dir=target_root)
-        except Exception:
-            pass
+        if memory_engine:
+            try:
+                fn = getattr(memory_engine, "record_golden_recipe", getattr(memory_engine, "store_golden_recipe", None))
+                if fn:
+                    before_lines = target_file.read_text(encoding="utf-8").splitlines()
+                    before_snip = before_lines[max(0, line_no - 1)] if before_lines else ""
+                    fn(
+                        rule_id=rule_id,
+                        before_snippet=before_snip,
+                        after_snippet=desc,
+                        diff_snippet=diff,
+                        file_type=target_file.suffix,
+                        description=desc,
+                        root_dir=target_root
+                    )
+                # Record event
+                record_ev = getattr(memory_engine, "record_event", None)
+                if record_ev:
+                    record_ev("fix_applied", {
+                        "rule_id": rule_id,
+                        "file_path": rel_path,
+                        "line_number": line_no,
+                        "bundle_id": b.get("bundle_id")
+                    }, root_dir=target_root)
+            except Exception:
+                pass
 
         applied_count += 1
         applied_bundles.append(b)
@@ -268,7 +300,11 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
         diff_summary_lines.append("```diff")
         diff_summary_lines.append(diff.strip())
         diff_summary_lines.append("```\n")
-        print(f"  {GREEN}✔ Applied successfully.{RESET} (Snapshot saved: {bak_dest.relative_to(target_root)})\n")
+        try:
+            rel_snapshot = bak_dest.relative_to(target_root)
+        except Exception:
+            rel_snapshot = bak_dest.name
+        print(f"  {GREEN}✔ Applied successfully.{RESET} (Snapshot saved: {rel_snapshot})\n")
 
     # Write apply artifacts in run folder
     (run_folder / "diff_summary.md").write_text("\n".join(diff_summary_lines), encoding="utf-8")
@@ -294,18 +330,20 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
             pass
 
     # Summary Box
-    print(f"  {CYAN}┌─ Application Summary ───────────────────────────────────────────────────┐{RESET}")
-    print(format_box_line(f"Applied Patches:{GREEN}{applied_count} applied cleanly{RESET}"))
-    print(format_box_line(f"Skipped / Pass: {GRAY}{skipped_count} skipped{RESET}"))
-    print(format_box_line(f"Golden Recipes: {GREEN}{applied_count} distilled into persistent memory{RESET}"))
-    print(format_box_line(f"Snapshot Safety:.torusguard/snapshots/{run_folder.name}"))
-    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
-
-    print(f"  {GREEN}╔═ Next Governed Action ═════════════════════════════════════════════════════╗{RESET}")
-    print(format_box_line(f"Differential Recheck: {BOLD}{WHITE}npx torusguard recheck{RESET} (Verify fix closure)", border="║", border_color=GREEN))
-    print(format_box_line(f"View Golden Recipes:  {CYAN}npx torusguard recipes{RESET} (Inspect memory)", border="║", border_color=GREEN))
-    print(format_box_line(f"Emergency Rollback:   {YELLOW}npx torusguard rollback{RESET} (Instant revert)", border="║", border_color=GREEN))
-    print(f"  {GREEN}╚═════════════════════════════════════════════════════════════════════════════╝{RESET}\n")
+    print(border_top("Application Summary"))
+    print(box_line(f"Applied Patches:{GREEN}{applied_count} applied cleanly{RESET}"))
+    print(box_line(f"Skipped / Pass: {GRAY}{skipped_count} skipped{RESET}"))
+    print(box_line(f"Golden Recipes: {GREEN}{applied_count} distilled into persistent memory{RESET}"))
+    print(box_line(f"Snapshot Safety:.torusguard/snapshots/{run_folder.name}"))
+    print(border_bottom())
+    print()
+
+    print(border_top("Next Governed Action", border_color=GREEN, double=True))
+    print(box_line(f"Differential Recheck: {BOLD}{WHITE}npx torusguard recheck{RESET} (Verify fix closure)", border="║", border_color=GREEN))
+    print(box_line(f"View Golden Recipes:  {CYAN}npx torusguard recipes{RESET} (Inspect memory)", border="║", border_color=GREEN))
+    print(box_line(f"Emergency Rollback:   {YELLOW}npx torusguard rollback{RESET} (Instant revert)", border="║", border_color=GREEN))
+    print(border_bottom(border_color=GREEN, double=True))
+    print()
 
     return {
         "applied_count": applied_count,