torusguard 1.3.3 → 1.3.4

package/skills/torusguard-report/SKILL.md

@@ -1,55 +1,72 @@
----
-name: torusguard-report
-description: Generate unified security posture reports and export OASIS SARIF v2.1.0 logs for CI/CD integration.
-version: 0.9.2
-workflow: .torusguard/workflows/report.md
-tools: Read, Grep, Glob, Write
-scripts-binding:
-  - .torusguard/scripts/sarif_exporter.py
-  - .torusguard/scripts/run_manager.py
----
-
-# TorusGuard Report — Unified Security Posture Report & SARIF Export
-
-## Objective
-Aggregate findings, verification traces, and recheck results into a signed executive security summary and export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines.
-
----
-
-## Execution Steps
-
-1. **Aggregate Run Data:** Read findings, verified evidence, and recheck records from active run.
-2. **Handle CLI Failures:** If `npx torusguard report --html` or SARIF export crashes, YOU must manually gather the metrics and format the report.
-3. **Export OASIS SARIF v2.1.0:**
-   ```bash
-   python .torusguard/scripts/sarif_exporter.py --run <run_dir> --output <run_dir>/results.sarif
-   ```
-4. **Compile Executive Markdown/HTML Report:** Generate `report.md` or `.html` with posture score, open/closed finding tables, and risk breakdown. Make sure the polyglot stack detected during audit is explicitly summarized.
-5. **Update Run Manifest:** Finalize `manifest.json` status counts.
-6. **Archive Release Artifacts:** Ensure `report.md` and `results.sarif` are serialized to disk.
-
----
-
-## SARIF v2.1.0 Output Specification
-- **Version:** `$schema: https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`, `version: 2.1.0`.
-- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 0.9.2`, full rules catalog in `driver.rules`.
-- **Category Hygiene:** Set `automationDetails.id: "torusguard/static"` to avoid collisions in multi-analysis CI.
-- **Fingerprinting:** Populate `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
-
----
-
-## Safety Constraints
-- Redact all tokens, passwords, and API keys before saving report.
-- Strictly read-only reporting; no source code modifications.
-- Ensure SARIF passes JSON schema validation.
-
----
-
-## Output Format
-```markdown
-📊 [TorusGuard] Security Posture Report Emitted (AI Assisted)
-- Run ID: <Run ID> | Posture Score: <Score>/100
-- Findings: <Total> (<Fixed> Fixed · <Open> Open)
-- SARIF Export: `.torusguard/runs/<run_id>/results.sarif`
-- Executive Report: `.torusguard/runs/<run_id>/report.md`
-```
+---
+name: torusguard-report
+description: Generate executive posture reports, export OASIS SARIF v2.1.0 logs, and render dark-mode HTML dashboards via CLI or AI Agent.
+version: 1.3.4
+workflow: .torusguard/workflows/report.md
+tools: Read, Grep, Glob, Write, run_command
+scripts-binding:
+  - .torusguard/scripts/html_reporter.py
+  - .torusguard/scripts/sarif_exporter.py
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
+---
+
+# TorusGuard Report — Posture Reporting & SARIF / HTML Export
+
+## Objective
+Aggregate findings, verification traces, and recheck results into an auditable executive security report, export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines, and render zero-dependency single-file visual HTML posture reports.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution
+Run the report engine from your terminal:
+```bash
+# Generate visual dark-mode HTML dashboard
+npx torusguard report --html
+
+# Export OASIS SARIF v2.1.0 for GitHub Code Scanning / CI
+npx torusguard report --sarif
+
+# Generate both HTML and SARIF for latest run
+npx torusguard report --html --sarif
+
+# Generate report for a specific project directory
+npx torusguard report ./examples/vulnerable-react-express --html
+
+# Target a specific run ID
+npx torusguard report --run run-20260910-121618-audit --html
+```
+**Under the Hood:**
+- Invokes `python .torusguard/scripts/html_reporter.py` to compile self-contained, offline-ready HTML reports with dynamic filtering, posture gauge, and cluster summaries at `.torusguard/runs/<run_id>/report.html`.
+- Invokes `python .torusguard/scripts/sarif_exporter.py` to produce OASIS SARIF v2.1.0 logs at `.torusguard/runs/<run_id>/results.sarif`.
+- Finalizes `manifest.json` metrics and updates historical posture scoring.
+- Displays 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Reporting
+When generating security posture summaries in AI chat:
+1. **Aggregate Run Data:** Inspect `findings.json`, `remediation.md`, and `recheck.md` from the active run.
+2. **Calculate Posture Score:** Compute posture score ($0$–$100$) based on severity weighting (Critical: 25, High: 15, Medium: 5, Low: 2).
+3. **Format Executive Card:** Present finding counts, closed vulnerabilities, remaining risks, and compliance posture.
+4. **Export Artifacts:** Verify that `report.html` and `results.sarif` are serialized to disk.
+
+---
+
+## SARIF v2.1.0 Specification
+- **Schema:** `https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`
+- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 1.3.3`, full rules catalog in `driver.rules`.
+- **Automation Details:** `automationDetails.id: "torusguard/static"` to avoid collisions in multi-scanner CI/CD pipelines.
+- **Fingerprints:** `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
+
+---
+
+## Output Card Format
+```markdown
+### 📊 TorusGuard Security Posture Report Emitted
+- **Run ID:** `run-20260910-121618-audit`
+- **Posture Score:** 85 / 100 (HIGH SECURITY)
+- **Findings Summary:** 3 Evaluated · 2 Confirmed Fixed · 1 Unresolved
+- **HTML Dashboard:** `.torusguard/runs/<run_id>/report.html` (View in browser)
+- **SARIF v2.1.0 Export:** `.torusguard/runs/<run_id>/results.sarif` (Ready for CI)
+```

package/skills/torusguard-status/SKILL.md

@@ -1,43 +1,58 @@
----
-name: torusguard-status
-description: Display current TorusGuard security posture, active configuration, rules catalog, and run history.
-version: 0.9.2
-workflow: .torusguard/workflows/status.md
-tools: Read, Grep, Glob
-scripts-binding:
-  - .torusguard/scripts/run_manager.py
----
-
-# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
-
-## Objective
-Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
-
----
-
-## Execution Steps
-
-1. **Read Configuration:** Parse `.torusguard/config/torusguard.json` to verify initialization state and detected framework stack.
-2. **Handle CLI Failures:** If `npx torusguard status` throws an error, YOU must manually parse the local files (e.g. `torusguard.json`, `scope.json`) to deduce the status instead of just returning the CLI error.
-3. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
-4. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
-5. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
-6. **Render Diagnostic Overview:** Output formatted status card.
-
----
-
-## Safety Constraints
-- Read-only execution; zero file modifications.
-- Handle uninitialized workspaces gracefully with advice to run `/torusguard init` (or manual AI initialization).
-
----
-
-## Output Format
-```markdown
-🛡️ [TorusGuard] Workspace Status Overview (AI Assisted)
-- Version: v0.9.2 | Stack: <Detected Framework>
-- Active Rules: <Count> rules active in `.torusguard/rules/active/`
-- Historical Runs: <Count> runs recorded
-- Scope: <Authorized (TTL Active) / Expired / Unconfigured>
-- Posture: <SECURE / ACTION REQUIRED>
-```
+---
+name: torusguard-status
+description: Display current TorusGuard security posture, active configuration, rules catalog, and run history via CLI or AI Agent.
+version: 1.3.4
+workflow: .torusguard/workflows/status.md
+tools: Read, Grep, Glob, run_command
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/term_ui.py
+---
+
+# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
+
+## Objective
+Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
+
+---
+
+## Two Execution Modes
+
+### Mode A: Automated CLI Execution
+Run the diagnostic overview from your terminal:
+```bash
+# Display 75-column status cards
+npx torusguard status
+
+# Check status of specific project directory
+npx torusguard status ./examples/vulnerable-react-express
+
+# Output machine-readable JSON
+npx torusguard status --json
+```
+**Under the Hood:**
+- Evaluates `.torusguard/config/torusguard.json` for initialized status and detected stack.
+- Enumerates active rules in `.torusguard/rules/active/` (or canonical 71 rules).
+- Scans `.torusguard/runs/` for run history, finding counts, and verified fixes.
+- Inspects `.torusguard/config/scope.json` for authorized runtime validation targets.
+- Displays mathematically aligned 75-column terminal cards.
+
+### Mode B: In-Session AI Chat Agent Status Check
+When checking workspace status in AI chat:
+1. **Verify Workspace Setup:** Check if `.torusguard/` exists on disk.
+2. **Inspect Active Config:** Read `.torusguard/config/torusguard.json` for detected stack, framework, and rules.
+3. **Inspect Latest Run:** Find the latest run directory under `.torusguard/runs/` and read `manifest.json`.
+4. **Inspect Memory Engine:** Check `.torusguard/memory/patterns.json` for captured Golden Fix Recipes.
+5. **Render Diagnostic Card:** Present an overview of posture, stack, and recommended next steps.
+
+---
+
+## Output Card Format
+```markdown
+### 🛡️ TorusGuard Workspace Status Overview
+- **Version:** v1.3.3 | **Stack:** Node.js / React / Express
+- **Active Rules:** 71 canonical security rules enabled
+- **Historical Runs:** 3 runs recorded
+- **Golden Recipes:** 4 distilled into persistent memory
+- **Overall Posture:** SECURE (All targeted vulnerabilities verified closed)
+```

package/skills/torusguard-verify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-verify
 description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
-version: 0.9.2
+version: 1.3.4
 workflow: .torusguard/workflows/verify.md
 tools: Read, Grep, Glob, Write
 scripts-binding:

package/skills/torusguard-web-validate/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard-web-validate
 description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
-version: 0.9.2
+version: 1.3.4
 workflow: .torusguard/workflows/web-validate.md
 tools: Read, Grep, Glob, Bash, Write
 scripts-binding: