torusguard 1.3.3 → 1.3.4

package/.torusguard/scripts/harden_runner.py

@@ -1,9 +1,9 @@
 #!/usr/bin/env python3
 """
-TorusGuard Autonomous Remediation Engine (v1.3.0)
+TorusGuard Autonomous Remediation Engine (v1.3.3)
 Evaluates audit findings against canonical patch templates, enforces Ponytail bounds
 (<= 35 additions, <= 25 deletions), packages structured candidate remediation bundles,
-and renders unified patch diffs.
+and renders unified patch diffs with standardized 75-column terminal UI.
 
 Pure Python 3.10+ standard library (zero external dependencies).
 """
@@ -16,9 +16,18 @@ import difflib
 import hashlib
 import argparse
 import datetime
-import unicodedata
 from pathlib import Path
-from typing import Dict, List, Any, Optional, Tuple
+from typing import Dict, List, Any, Optional
+
+# Ensure scripts dir is in sys.path for term_ui import
+scripts_dir = Path(__file__).resolve().parent
+if str(scripts_dir) not in sys.path:
+    sys.path.insert(0, str(scripts_dir))
+
+try:
+    import term_ui
+except ImportError:
+    term_ui = None
 
 # Windows console UTF-8 support
 if sys.stdout and hasattr(sys.stdout, "reconfigure"):
@@ -33,7 +42,7 @@ IST = datetime.timezone(datetime.timedelta(hours=5, minutes=30), name="IST")
 def get_ist_now() -> datetime.datetime:
     return datetime.datetime.now(IST)
 
-# ─── ANSI Colors & Formatter ───────────────────────────────────────────────────
+# ─── Fallback Formatters (if term_ui missing) ──────────────────────────────────
 BOLD = "\033[1m"
 DIM = "\033[2m"
 RESET = "\033[0m"
@@ -44,25 +53,25 @@ WHITE = "\033[97m"
 GRAY = "\033[90m"
 RED = "\033[31m"
 
-ANSI_REGEX = re.compile(r'\033\[[0-9;]*m')
+def box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
+    return f"  {border_color}{border}{RESET}  {content}"
 
-def get_visual_width(text: str) -> int:
-    clean = ANSI_REGEX.sub('', text)
-    width = 0
-    for ch in clean:
-        ea = unicodedata.east_asian_width(ch)
-        if ea in ('W', 'F'):
-            width += 2
-        elif ord(ch) >= 0x1F300:
-            width += 2
-        else:
-            width += 1
-    return width
+def box_header(title: str, subtitle: str = "", version: str = "v1.3.3", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.card_header(title, subtitle, version, border_color)
+    return f"=== {title} ({version}) ==="
 
-def format_box_line(content: str, width: int = 71, border: str = "│", border_color: str = CYAN) -> str:
-    vis = get_visual_width(content)
-    pad = " " * max(0, width - vis)
-    return f"  {border_color}{border}{RESET}  {content}{pad}{border_color}{border}{RESET}"
+def border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_top(title, border_color=border_color, double=double)
+    return "┌" + "─" * 71 + "┐"
+
+def border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_bottom(border_color=border_color, double=double)
+    return "└" + "─" * 71 + "┘"
 
 
 def find_latest_audit_run(runs_dir: Path) -> Optional[Path]:
@@ -100,7 +109,7 @@ def generate_patch_for_finding(finding: Dict[str, Any], target_root: Path) -> Op
         return None
 
     target_line = lines[line_number - 1]
-    indent = re.match(r'^\s*', target_line).group(0) # type: ignore
+    indent = re.match(r'^\s*', target_line).group(0)  # type: ignore
     new_lines = list(lines)
     applied_rule = False
     fix_explanation = ""
@@ -108,12 +117,13 @@ def generate_patch_for_finding(finding: Dict[str, Any], target_root: Path) -> Op
     # Strategy 1: Hardcoded Secrets (TG-SEC-001 / TG-SEC-002)
     if rule_id in ("TG-SEC-001", "TG-SEC-002"):
         if file_path.endswith((".js", ".jsx", ".ts", ".tsx", ".mjs")):
-            # const secret = "..." -> const secret = process.env.JWT_SECRET || "...";
             if re.search(r'(jwt_secret|jwtSecret|JWT_SECRET)', target_line, re.IGNORECASE):
-                replacement = f'{indent}const secret = process.env.JWT_SECRET || "";'
+                var_match = re.search(r'(const|let|var)\s+([A-Za-z0-9_]+)\s*=', target_line)
+                var_name = var_match.group(2) if var_match else "JWT_SECRET"
+                replacement = f'{indent}const {var_name} = process.env.JWT_SECRET || "";'
                 new_lines[line_number - 1] = replacement
                 applied_rule = True
-                fix_explanation = "Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET"
+                fix_explanation = f"Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET"
             elif re.search(r'(:=|=)\s*["\'][A-Za-z0-9_\-]{8,}["\']', target_line):
                 var_match = re.search(r'(const|let|var)?\s*([A-Za-z0-9_]+)\s*[:=]', target_line)
                 var_name = var_match.group(2) if var_match else "API_KEY"
@@ -135,22 +145,19 @@ def generate_patch_for_finding(finding: Dict[str, Any], target_root: Path) -> Op
     # Strategy 2: Dangerous React HTML rendering & DOM innerHTML (TG-INPUT-003)
     elif rule_id == "TG-INPUT-003":
         if "dangerouslySetInnerHTML" in target_line:
-            # <div dangerouslySetInnerHTML={{ __html: bio }} /> -> <div>{bio}</div>
-            var_match = re.search(r'__html\s*:\s*([A-Za-z0-9_]+)', target_line)
+            var_match = re.search(r'__html\s*:\s*([A-Za-z0-9_$.]+)', target_line)
             var_name = var_match.group(1) if var_match else "content"
             replacement = f'{indent}<div>{{{var_name}}}</div>'
             new_lines[line_number - 1] = replacement
             applied_rule = True
             fix_explanation = "Replaced raw dangerouslySetInnerHTML injection with safe React text interpolation"
         elif ".innerHTML" in target_line:
-            # Pattern A: el.innerHTML = '' or "" -> el.textContent = ""
             if re.search(r'\.innerHTML\s*=\s*["\']["\']', target_line):
                 fixed_line = re.sub(r'([a-zA-Z0-9_$]+)\.innerHTML\s*=\s*["\']["\']', r'\1.textContent = ""', target_line)
                 if fixed_line != target_line:
                     new_lines[line_number - 1] = fixed_line
                     applied_rule = True
                     fix_explanation = "Replaced unsafe innerHTML DOM reset with safe textContent assignment"
-            # Pattern B: el.innerHTML = someVar -> el.textContent = someVar
             elif re.search(r'([a-zA-Z0-9_$]+)\.innerHTML\s*=\s*([a-zA-Z0-9_$.]+)\s*;?$', target_line):
                 fixed_line = re.sub(r'([a-zA-Z0-9_$]+)\.innerHTML\s*=\s*([a-zA-Z0-9_$.]+)', r'\1.textContent = \2', target_line)
                 if fixed_line != target_line:
@@ -161,22 +168,34 @@ def generate_patch_for_finding(finding: Dict[str, Any], target_root: Path) -> Op
     # Strategy 3: Raw SQL Concatenation (TG-INPUT-002)
     elif rule_id == "TG-INPUT-002":
         if file_path.endswith(".py") and ("f\"SELECT" in target_line or "f'SELECT" in target_line):
-            # Replace f-string injection with parameterized query
             fixed_line = re.sub(r'f(["\']SELECT.*?WHERE.*?)(\{[^}]+\})', r'\1%s', target_line)
             if fixed_line != target_line:
                 new_lines[line_number - 1] = fixed_line
                 applied_rule = True
                 fix_explanation = "Replaced unsafe Python SQL f-string interpolation with parameterized SQL query placeholder"
+        elif file_path.endswith((".js", ".jsx", ".ts", ".tsx", ".mjs")):
+            # Template string SQL injection: `SELECT ... ${var}` -> parameterized placeholder
+            if "`SELECT" in target_line or "`select" in target_line:
+                fixed_line = re.sub(r'\$\{[^}]+\}', '?', target_line)
+                if fixed_line != target_line:
+                    new_lines[line_number - 1] = fixed_line
+                    applied_rule = True
+                    fix_explanation = "Replaced template literal SQL string interpolation with parameterized SQL placeholder (?)"
 
     # Strategy 4: Multi-Tenant Query Scoping (TG-DB-004)
     elif rule_id == "TG-DB-004":
         if ".objects.get(" in target_line and "tenant" not in target_line.lower() and "org" not in target_line.lower():
-            # .objects.get(id=...) -> .objects.get(id=..., organization_id=request.user.organization_id)
             fixed_line = target_line.replace(".objects.get(", ".objects.get(organization_id=request.user.organization_id, ")
             if fixed_line != target_line:
                 new_lines[line_number - 1] = fixed_line
                 applied_rule = True
                 fix_explanation = "Added explicit organization_id tenant boundary filter to ORM query"
+        elif "findUnique(" in target_line and "tenant" not in target_line.lower():
+            fixed_line = target_line.replace("findUnique({ where: {", "findFirst({ where: { tenantId: req.tenantId,")
+            if fixed_line != target_line:
+                new_lines[line_number - 1] = fixed_line
+                applied_rule = True
+                fix_explanation = "Enforced tenantId multi-tenant isolation in Prisma lookup"
 
     # Strategy 5: Permissive CORS with Credentials (TG-PLATFORM-001)
     elif rule_id == "TG-PLATFORM-001":
@@ -185,6 +204,60 @@ def generate_patch_for_finding(finding: Dict[str, Any], target_root: Path) -> Op
             new_lines[line_number - 1] = replacement
             applied_rule = True
             fix_explanation = "Replaced wildcard CORS configuration with strict origin whitelist environment variable"
+        elif "cors(" in target_line and ("origin: '*'" in target_line or 'origin: "*"' in target_line):
+            fixed_line = target_line.replace("origin: '*'", "origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173'")
+            fixed_line = fixed_line.replace('origin: "*"', "origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173'")
+            if fixed_line != target_line:
+                new_lines[line_number - 1] = fixed_line
+                applied_rule = True
+                fix_explanation = "Constrained wildcard CORS origin to process.env.ALLOWED_ORIGIN with secure fallback"
+
+    # Strategy 6: Cookie Missing Security Flags (TG-AUTH-004)
+    elif rule_id == "TG-AUTH-004":
+        if "res.cookie(" in target_line and "httpOnly" not in target_line:
+            # res.cookie('token', token) -> res.cookie('token', token, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' })
+            fixed_line = re.sub(
+                r'res\.cookie\(\s*([a-zA-Z0-9_\'\"]+)\s*,\s*([a-zA-Z0-9_]+)\s*\)',
+                r"res.cookie(\1, \2, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' })",
+                target_line
+            )
+            if fixed_line != target_line:
+                new_lines[line_number - 1] = fixed_line
+                applied_rule = True
+                fix_explanation = "Injected mandatory security flags (httpOnly, secure, sameSite) to cookie definition"
+
+    # Strategy 7: Path Traversal (TG-INPUT-006)
+    elif rule_id == "TG-INPUT-006":
+        if "path.join(" in target_line and "path.basename" not in target_line:
+            fixed_line = re.sub(r'path\.join\((.*?),\s*([a-zA-Z0-9_$.]+)\)', r'path.join(\1, path.basename(\2))', target_line)
+            if fixed_line != target_line:
+                new_lines[line_number - 1] = fixed_line
+                applied_rule = True
+                fix_explanation = "Wrapped dynamic path segment in path.basename to neutralize path traversal sequences"
+        elif "os.path.join(" in target_line and "os.path.basename" not in target_line:
+            fixed_line = re.sub(r'os\.path\.join\((.*?),\s*([a-zA-Z0-9_$.]+)\)', r'os.path.join(\1, os.path.basename(\2))', target_line)
+            if fixed_line != target_line:
+                new_lines[line_number - 1] = fixed_line
+                applied_rule = True
+                fix_explanation = "Wrapped dynamic path segment in os.path.basename to neutralize path traversal sequences"
+
+    # Strategy 8: TLS Verification Bypass (TG-DIFF-001)
+    elif rule_id == "TG-DIFF-001":
+        if "verify=False" in target_line:
+            fixed_line = target_line.replace("verify=False", "verify=True")
+            new_lines[line_number - 1] = fixed_line
+            applied_rule = True
+            fix_explanation = "Restored mandatory TLS certificate verification (verify=True)"
+        elif "rejectUnauthorized: false" in target_line:
+            fixed_line = target_line.replace("rejectUnauthorized: false", "rejectUnauthorized: true")
+            new_lines[line_number - 1] = fixed_line
+            applied_rule = True
+            fix_explanation = "Restored TLS certificate authority validation (rejectUnauthorized: true)"
+        elif "InsecureSkipVerify: true" in target_line:
+            fixed_line = target_line.replace("InsecureSkipVerify: true", "InsecureSkipVerify: false")
+            new_lines[line_number - 1] = fixed_line
+            applied_rule = True
+            fix_explanation = "Restored mandatory TLS certificate validation (InsecureSkipVerify: false)"
 
     if not applied_rule:
         return None
@@ -201,7 +274,7 @@ def generate_patch_for_finding(finding: Dict[str, Any], target_root: Path) -> Op
     additions = sum(1 for l in diff.splitlines() if l.startswith("+") and not l.startswith("+++"))
     deletions = sum(1 for l in diff.splitlines() if l.startswith("-") and not l.startswith("---"))
 
-    # Ponytail bounds validation
+    # Ponytail bounds validation: <= 35 additions, <= 25 deletions
     if additions > 35 or deletions > 25:
         return None
 
@@ -214,6 +287,8 @@ def generate_patch_for_finding(finding: Dict[str, Any], target_root: Path) -> Op
         "title": finding.get("title", rule_id),
         "target_file": file_path,
         "line_number": line_number,
+        "target_line": target_line,
+        "replacement_line": new_lines[line_number - 1],
         "what_is_wrong": description,
         "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
         "what_should_change": fix_explanation,
@@ -252,9 +327,14 @@ def execute_harden(target_root: Path, run_id_arg: Optional[str] = None) -> Dict[
     bundles_dir.mkdir(parents=True, exist_ok=True)
 
     bundles = []
+    seen_file_lines = set()
     for f in findings:
+        target_key = (f.get("file_path"), f.get("line_number"))
+        if target_key in seen_file_lines:
+            continue
         candidate = generate_patch_for_finding(f, target_root)
         if candidate:
+            seen_file_lines.add(target_key)
             bundles.append(candidate)
             b_dir = bundles_dir / candidate["bundle_id"]
             b_dir.mkdir(parents=True, exist_ok=True)
@@ -310,44 +390,44 @@ def execute_harden(target_root: Path, run_id_arg: Optional[str] = None) -> Dict[
         except Exception:
             pass
 
-    # Print 75-column Terminal Card
-    print(f"\n  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}")
-    print(f"  {CYAN}│                                                                         │{RESET}")
-    print(format_box_line(f"{BOLD}🛡️  TORUSGUARD GOVERNED REMEDIATION ENGINE         v1.3.1{RESET}", border_color=CYAN))
-    print(format_box_line(f"{DIM}Autonomous Minimal Patch Formulation & Ponytail Packaging{RESET}", border_color=CYAN))
-    print(f"  {CYAN}│                                                                         │{RESET}")
-    print(f"  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}\n")
-
-    print(f"  {CYAN}┌─ Remediation Scope ─────────────────────────────────────────────────────┐{RESET}")
-    print(format_box_line(f"Active Run:     {WHITE}{run_folder.name}{RESET}"))
-    print(format_box_line(f"Target Scope:   {WHITE}{target_root}{RESET}"))
-    print(format_box_line(f"Total Findings: {len(findings)} evaluated | {GREEN}{len(bundles)} surgical patches formulated{RESET}"))
-    print(format_box_line(f"Ponytail Guard: {GREEN}All patches strictly <= 35 additions, <= 25 deletions{RESET}"))
-    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+    # Print 75-column Terminal Cards
+    print()
+    print(box_header("🛡️  TORUSGUARD GOVERNED REMEDIATION ENGINE", "Autonomous Minimal Patch Formulation & Ponytail Packaging", "v1.3.3"))
+    print()
+
+    print(border_top("Remediation Scope"))
+    print(box_line(f"Active Run:     {WHITE}{run_folder.name}{RESET}"))
+    print(box_line(f"Target Scope:   {WHITE}{target_root}{RESET}"))
+    print(box_line(f"Total Findings: {len(findings)} evaluated | {GREEN}{len(bundles)} surgical patches formulated{RESET}"))
+    print(box_line(f"Ponytail Guard: {GREEN}All patches strictly <= 35 additions, <= 25 deletions{RESET}"))
+    print(border_bottom())
+    print()
 
     if bundles:
-        print(f"  {CYAN}┌─ Formulated Candidate Patches ({len(bundles)}) ───────────────────────────────────┐{RESET}")
+        print(border_top(f"Formulated Candidate Patches ({len(bundles)})"))
         for b in bundles[:5]:
-            print(format_box_line(f"{YELLOW}[{b['rule_id']}]{RESET} {WHITE}{b['target_file']}:{b['line_number']}{RESET} (+{b['additions']}/-{b['deletions']})"))
-            print(format_box_line(f"  └─ {DIM}{b['what_should_change']}{RESET}"))
+            print(box_line(f"{YELLOW}[{b['rule_id']}]{RESET} {WHITE}{b['target_file']}:{b['line_number']}{RESET} (+{b['additions']}/-{b['deletions']})"))
+            print(box_line(f"  └─ {DIM}{b['what_should_change']}{RESET}"))
         if len(bundles) > 5:
-            print(format_box_line(f"  ... and {len(bundles) - 5} more patches cataloged in remediation.md"))
-        print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
-
-        print(f"  {GREEN}╔═ Next Governed Action ═════════════════════════════════════════════════════╗{RESET}")
-        print(format_box_line(f"Review & Apply:   {BOLD}{WHITE}npx torusguard apply{RESET}  (CLI Human Gate)", border="║", border_color=GREEN))
-        print(format_box_line(f"Auto-Apply Flag:  {CYAN}npx torusguard apply --yes{RESET} (Automated mode)", border="║", border_color=GREEN))
-        print(format_box_line(f"AI IDE Chat:      Run {CYAN}/torusguard-apply{RESET} in your AI chat", border="║", border_color=GREEN))
-        print(f"  {GREEN}╚═════════════════════════════════════════════════════════════════════════════╝{RESET}\n")
+            print(box_line(f"  ... and {len(bundles) - 5} more patches cataloged in remediation.md"))
+        print(border_bottom())
+        print()
+
+        print(border_top("Next Governed Action", border_color=GREEN, double=True))
+        print(box_line(f"Review & Apply:   {BOLD}{WHITE}npx torusguard apply{RESET}  (CLI Human Gate)", border="║", border_color=GREEN))
+        print(box_line(f"Auto-Apply Flag:  {CYAN}npx torusguard apply --yes{RESET} (Automated mode)", border="║", border_color=GREEN))
+        print(box_line(f"AI IDE Chat:      Run {CYAN}/torusguard-apply{RESET} in your AI chat", border="║", border_color=GREEN))
+        print(border_bottom(border_color=GREEN, double=True))
+        print()
     else:
         print(f"  {YELLOW}ℹ No automatic patch templates matched current findings.{RESET}")
         print(f"  {GRAY}Findings require architectural refactoring or AI-assisted guidance.{RESET}\n")
-        print(f"  {CYAN}┌─ Recommended Next Steps ────────────────────────────────────────────────┐{RESET}")
-        print(format_box_line("1. In AI Chat (Antigravity/Cursor/Claude): Run /torusguard-harden"))
-        print(format_box_line("   to synthesize custom architectural fixes with your AI agent."))
-        print(format_box_line("2. View visual posture report: npx torusguard report --html"))
-        print(format_box_line(f"3. Inspect finding details: .torusguard/runs/{run_folder.name}/findings.md"))
-        print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+        print(border_top("Recommended Next Steps"))
+        print(box_line("1. In AI Chat: Run /torusguard-harden to synthesize custom fixes"))
+        print(box_line("2. View visual posture report: npx torusguard report --html"))
+        print(box_line(f"3. Inspect findings: .torusguard/runs/{run_folder.name}/findings.md"))
+        print(border_bottom())
+        print()
 
     return {
         "status": "success",

package/.torusguard/scripts/recheck_runner.py

@@ -1,9 +1,10 @@
 #!/usr/bin/env python3
 """
-TorusGuard Targeted Differential Recheck Engine (v1.3.0)
+TorusGuard Targeted Differential Recheck Engine (v1.3.3)
 Executes scoped differential re-audits verifying only impacted files and adjacent boundaries.
-Evaluates formal status transitions (Confirmed Fixed vs Regressed), updates run manifest,
+Evaluates formal status transitions (Confirmed Fixed vs Regressed vs Unresolved), updates run manifest,
 and records verification telemetry in the persistent security memory subsystem.
+Standardized 75-column terminal UI formatting.
 
 Pure Python 3.10+ standard library (zero external dependencies).
 """
@@ -14,9 +15,18 @@ import re
 import json
 import argparse
 import datetime
-import unicodedata
 from pathlib import Path
-from typing import Dict, List, Any, Optional, Tuple
+from typing import Dict, List, Any, Optional
+
+# Ensure scripts dir is in sys.path for term_ui import
+scripts_dir = Path(__file__).resolve().parent
+if str(scripts_dir) not in sys.path:
+    sys.path.insert(0, str(scripts_dir))
+
+try:
+    import term_ui
+except ImportError:
+    term_ui = None
 
 # Windows console UTF-8 support
 if sys.stdout and hasattr(sys.stdout, "reconfigure"):
@@ -31,7 +41,7 @@ IST = datetime.timezone(datetime.timedelta(hours=5, minutes=30), name="IST")
 def get_ist_now() -> datetime.datetime:
     return datetime.datetime.now(IST)
 
-# ─── ANSI Colors & Formatter ───────────────────────────────────────────────────
+# ─── Formatting Helpers ────────────────────────────────────────────────────────
 BOLD = "\033[1m"
 DIM = "\033[2m"
 RESET = "\033[0m"
@@ -42,25 +52,25 @@ WHITE = "\033[97m"
 GRAY = "\033[90m"
 RED = "\033[31m"
 
-ANSI_REGEX = re.compile(r'\033\[[0-9;]*m')
-
-def get_visual_width(text: str) -> int:
-    clean = ANSI_REGEX.sub('', text)
-    width = 0
-    for ch in clean:
-        ea = unicodedata.east_asian_width(ch)
-        if ea in ('W', 'F'):
-            width += 2
-        elif ord(ch) >= 0x1F300:
-            width += 2
-        else:
-            width += 1
-    return width
+def box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
+    return f"  {border_color}{border}{RESET}  {content}"
+
+def box_header(title: str, subtitle: str = "", version: str = "v1.3.3", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.card_header(title, subtitle, version, border_color)
+    return f"=== {title} ({version}) ==="
 
-def format_box_line(content: str, width: int = 71, border: str = "│", border_color: str = CYAN) -> str:
-    vis = get_visual_width(content)
-    pad = " " * max(0, width - vis)
-    return f"  {border_color}{border}{RESET}  {content}{pad}{border_color}{border}{RESET}"
+def border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_top(title, border_color=border_color, double=double)
+    return "┌" + "─" * 71 + "┐"
+
+def border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_bottom(border_color=border_color, double=double)
+    return "└" + "─" * 71 + "┘"
 
 
 def find_latest_audit_run(runs_dir: Path) -> Optional[Path]:
@@ -82,27 +92,28 @@ def execute_recheck(target_root: Path, run_id_arg: Optional[str] = None) -> Dict
         sys.exit(1)
 
     # Import audit scanner and memory engine
-    scripts_dir = Path(__file__).resolve().parent
-    if str(scripts_dir) not in sys.path:
-        sys.path.insert(0, str(scripts_dir))
-    import audit_runner
-    import memory_engine
+    try:
+        import audit_runner
+    except ImportError:
+        audit_runner = None
+    try:
+        import memory_engine
+    except ImportError:
+        memory_engine = None
 
     bundles_dir = run_folder / "bundles"
     bundle_meta_files = list(bundles_dir.glob("*/metadata.json")) if bundles_dir.is_dir() else []
 
     # Header Card
-    print(f"\n  {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}")
-    print(f"  {CYAN}│                                                                         │{RESET}")
-    print(format_box_line(f"{BOLD}🛡️  TORUSGUARD DIFFERENTIAL RECHECK ENGINE          v1.3.0{RESET}", border_color=CYAN))
-    print(format_box_line(f"{DIM}Targeted Differential AST Scan & Regression Verification{RESET}", border_color=CYAN))
-    print(f"  {CYAN}│                                                                         │{RESET}")
-    print(f"  {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}\n")
-
-    print(f"  {CYAN}┌─ Recheck Verification Scope ────────────────────────────────────────────┐{RESET}")
-    print(format_box_line(f"Active Run:     {WHITE}{run_folder.name}{RESET}"))
-    print(format_box_line(f"Target Root:    {WHITE}{target_root}{RESET}"))
-    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
+    print()
+    print(box_header("🛡️  TORUSGUARD DIFFERENTIAL RECHECK ENGINE", "Targeted Differential AST Scan & Regression Verification", "v1.3.3"))
+    print()
+
+    print(border_top("Recheck Verification Scope"))
+    print(box_line(f"Active Run:     {WHITE}{run_folder.name}{RESET}"))
+    print(box_line(f"Target Root:    {WHITE}{target_root}{RESET}"))
+    print(border_bottom())
+    print()
 
     recheck_results = []
     confirmed_count = 0
@@ -131,26 +142,30 @@ def execute_recheck(target_root: Path, run_id_arg: Optional[str] = None) -> Dict
             continue
 
         # Differential scan on this single modified file
-        file_findings = audit_runner.scan_file(target_path, target_root)
-        matching_rule_findings = [f for f in file_findings if f.get("rule_id") == rule_id]
+        if audit_runner:
+            file_findings = audit_runner.scan_file(target_path, target_root)
+            matching_rule_findings = [f for f in file_findings if f.get("rule_id") == rule_id]
+        else:
+            matching_rule_findings = []
 
         if not matching_rule_findings:
             outcome = "Confirmed Fixed"
             confirmed_count += 1
-            status_color = GREEN
+            status_icon = f"{GREEN}✔ [Confirmed Fixed]{RESET}"
             # Record in memory
-            try:
-                memory_engine.record_event("fix_verified", {
-                    "rule_id": rule_id,
-                    "file_path": rel_path,
-                    "verification_result": "fixed"
-                }, root_dir=target_root)
-            except Exception:
-                pass
+            if memory_engine:
+                try:
+                    memory_engine.record_event("fix_verified", {
+                        "rule_id": rule_id,
+                        "file_path": rel_path,
+                        "verification_result": "fixed"
+                    }, root_dir=target_root)
+                except Exception:
+                    pass
         else:
             outcome = "Unresolved"
             unresolved_count += 1
-            status_color = YELLOW
+            status_icon = f"{YELLOW}⚠ [Unresolved]{RESET}"
 
         recheck_results.append({
             "rule_id": rule_id,
@@ -164,7 +179,7 @@ def execute_recheck(target_root: Path, run_id_arg: Optional[str] = None) -> Dict
         recheck_md_lines.append(f"- **Outcome:** `{outcome}`")
         recheck_md_lines.append(f"- **Verification Timestamp:** {get_ist_now().strftime('%Y-%m-%d %H:%M:%S IST')}\n")
 
-        print(f"  {status_color}✔ [{outcome}]{RESET} {WHITE}{rule_id}{RESET} on {rel_path}")
+        print(f"  {status_icon} {WHITE}{rule_id}{RESET} on {rel_path}")
 
     # Write recheck.md
     (run_folder / "recheck.md").write_text("\n".join(recheck_md_lines), encoding="utf-8")
@@ -182,17 +197,19 @@ def execute_recheck(target_root: Path, run_id_arg: Optional[str] = None) -> Dict
             pass
 
     print()
-    print(f"  {CYAN}┌─ Recheck Summary ───────────────────────────────────────────────────────┐{RESET}")
-    print(format_box_line(f"Confirmed Fixed:{GREEN}{confirmed_count} vulnerabilities verified closed{RESET}"))
-    print(format_box_line(f"Regressed:      {RED if regressed_count > 0 else GREEN}{regressed_count} regressions detected{RESET}"))
-    print(format_box_line(f"Unresolved:     {YELLOW if unresolved_count > 0 else GREEN}{unresolved_count} unresolved{RESET}"))
-    print(format_box_line(f"Memory Sync:    {GREEN}Verification events synced to persistent memory engine{RESET}"))
-    print(f"  {CYAN}└─────────────────────────────────────────────────────────────────────────┘{RESET}\n")
-
-    print(f"  {GREEN}╔═ Next Governed Action ═════════════════════════════════════════════════════╗{RESET}")
-    print(format_box_line(f"Visual Dashboard: {BOLD}{WHITE}npx torusguard report --html{RESET} (Updated posture score)", border="║", border_color=GREEN))
-    print(format_box_line(f"View Recipes:     {CYAN}npx torusguard recipes{RESET} (Active golden fix recipes)", border="║", border_color=GREEN))
-    print(f"  {GREEN}╚═════════════════════════════════════════════════════════════════════════════╝{RESET}\n")
+    print(border_top("Recheck Summary"))
+    print(box_line(f"Confirmed Fixed:{GREEN}{confirmed_count} vulnerabilities verified closed{RESET}"))
+    print(box_line(f"Regressed:      {RED if regressed_count > 0 else GREEN}{regressed_count} regressions detected{RESET}"))
+    print(box_line(f"Unresolved:     {YELLOW if unresolved_count > 0 else GREEN}{unresolved_count} unresolved{RESET}"))
+    print(box_line(f"Memory Sync:    {GREEN}Verification events synced to persistent memory engine{RESET}"))
+    print(border_bottom())
+    print()
+
+    print(border_top("Next Governed Action", border_color=GREEN, double=True))
+    print(box_line(f"Visual Dashboard: {BOLD}{WHITE}npx torusguard report --html{RESET} (Updated posture score)", border="║", border_color=GREEN))
+    print(box_line(f"View Recipes:     {CYAN}npx torusguard recipes{RESET} (Active golden fix recipes)", border="║", border_color=GREEN))
+    print(border_bottom(border_color=GREEN, double=True))
+    print()
 
     return {
         "run_folder": str(run_folder),