torusguard 1.3.3 → 1.3.5

package/bin/torusguard.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 
 /**
  * TorusGuard CLI Runner (NPM Distribution)
@@ -45,61 +45,171 @@ try {
   } catch (err) {}
 }
 
+const ANSI_REGEX = /\x1b\[[0-9;]*m/g;
+
+function getVisualWidth(text) {
+  const clean = text.replace(ANSI_REGEX, '');
+  let width = 0;
+  for (let i = 0; i < clean.length; i++) {
+    const cp = clean.codePointAt(i);
+    if (cp > 0xffff) i++;
+    if ((cp >= 0xfe00 && cp <= 0xfe0f) || (cp >= 0xe0100 && cp <= 0xe01ef)) continue;
+    if (cp === 0x200b || cp === 0x200c || cp === 0x200d || cp === 0x00ad) continue;
+    if (cp >= 0x1f300 || (cp >= 0x1100 && (
+      cp <= 0x115f || cp === 0x2329 || cp === 0x232a ||
+      (cp >= 0x2e80 && cp <= 0xa4cf && cp !== 0x303f) ||
+      (cp >= 0xac00 && cp <= 0xd7a3) ||
+      (cp >= 0xf900 && cp <= 0xfaff) ||
+      (cp >= 0xfe10 && cp <= 0xfe19) ||
+      (cp >= 0xfe30 && cp <= 0xfe6f) ||
+      (cp >= 0xff00 && cp <= 0xff60) ||
+      (cp >= 0xffe0 && cp <= 0xffe6)
+    ))) {
+      width += 2;
+    } else {
+      width += 1;
+    }
+  }
+  return width;
+}
+
+function truncateVisual(text, maxW = 67) {
+  if (getVisualWidth(text) <= maxW) return text;
+  let currW = 0;
+  let out = '';
+  let inAnsi = false;
+  let ansiBuf = '';
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === '\x1b') {
+      inAnsi = true;
+      ansiBuf = ch;
+      continue;
+    }
+    if (inAnsi) {
+      ansiBuf += ch;
+      if (ch === 'm') {
+        inAnsi = false;
+        out += ansiBuf;
+      }
+      continue;
+    }
+    const cp = text.codePointAt(i);
+    if (cp > 0xffff) i++;
+    if ((cp >= 0xfe00 && cp <= 0xfe0f) || (cp >= 0xe0100 && cp <= 0xe01ef) || cp === 0x200b || cp === 0x200c || cp === 0x200d || cp === 0x00ad) {
+      out += String.fromCodePoint(cp);
+      continue;
+    }
+    const cw = cp >= 0x1f300 ? 2 : 1;
+    if (currW + cw > maxW - 3) {
+      out += '\x1b[0m...';
+      currW += 3;
+      break;
+    }
+    out += String.fromCodePoint(cp);
+    currW += cw;
+  }
+  out += '\x1b[0m';
+  return out;
+}
+
+function formatBoxLine(content, width = 67, border = '│', borderColor = CYAN) {
+  const trunc = truncateVisual(content, width);
+  const vis = getVisualWidth(trunc);
+  const pad = ' '.repeat(Math.max(0, width - vis));
+  return `  ${borderColor}${border}${RESET}  ${trunc}${pad}  ${borderColor}${border}${RESET}`;
+}
+
+function cardBorderTop(title = '', borderColor = CYAN, double = false) {
+  const left = double ? '╔' : '┌';
+  const right = double ? '╗' : '┐';
+  const h = double ? '═' : '─';
+  if (title) {
+    const vis = getVisualWidth(title);
+    const rem = Math.max(0, 68 - vis);
+    return `  ${borderColor}${left}${h} ${BOLD}${WHITE}${title}${RESET}${borderColor} ${h.repeat(rem)}${right}${RESET}`;
+  }
+  return `  ${borderColor}${left}${h.repeat(71)}${right}${RESET}`;
+}
+
+function cardBorderBottom(borderColor = CYAN, double = false) {
+  const left = double ? '╚' : '└';
+  const right = double ? '╝' : '┘';
+  const h = double ? '═' : '─';
+  return `  ${borderColor}${left}${h.repeat(71)}${right}${RESET}`;
+}
+
+function cardDivider(title = '', borderColor = CYAN, double = false) {
+  const left = double ? '╠' : '├';
+  const right = double ? '╣' : '┤';
+  const h = double ? '═' : '─';
+  if (title) {
+    const vis = getVisualWidth(title);
+    const rem = Math.max(0, 68 - vis);
+    return `  ${borderColor}${left}${h} ${BOLD}${WHITE}${title}${RESET}${borderColor} ${h.repeat(rem)}${right}${RESET}`;
+  }
+  return `  ${borderColor}${left}${h.repeat(71)}${right}${RESET}`;
+}
+
+function cardHeader(title, subtitle = '', version = 'v1.3.5', borderColor = CYAN) {
+  const top = `  ${borderColor}╭${'─'.repeat(71)}╮${RESET}`;
+  const bottom = `  ${borderColor}╰${'─'.repeat(71)}╯${RESET}`;
+  const empty = `  ${borderColor}│${' '.repeat(71)}│${RESET}`;
+  const titleVis = getVisualWidth(title);
+  const verVis = getVisualWidth(version);
+  const spaceCount = Math.max(1, 67 - titleVis - verVis);
+  const titleStr = `${BOLD}${WHITE}${title}${RESET}${' '.repeat(spaceCount)}${GRAY}${version}${RESET}`;
+  const lines = [top, empty, formatBoxLine(titleStr, 67, '│', borderColor)];
+  if (subtitle) {
+    lines.push(formatBoxLine(`${DIM}${subtitle}${RESET}`, 67, '│', borderColor));
+  }
+  lines.push(empty, bottom);
+  return lines.join('\n');
+}
+
 function printHelp() {
-  console.log(`
-  ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
-  ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  T O R U S G U A R D   C L I${RESET}                          ${GRAY}v1.3.2${RESET}   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${DIM}Autonomous Security Engine for AI-Built Applications${RESET}               ${CYAN}│${RESET}
-  ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
-
-  ${BOLD}Usage:${RESET}  ${GREEN}npx torusguard${RESET} ${WHITE}[command]${RESET} ${GRAY}[options]${RESET}
-
-  ${CYAN}┌─────────────────────────────────────────────────────────────────────────┐${RESET}
-  ${CYAN}│${RESET}  ${BOLD}Commands${RESET}                                                              ${CYAN}│${RESET}
-  ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
-  ${CYAN}│${RESET}  ${GREEN}init${RESET}      Scaffold ${BOLD}.torusguard/${RESET} workspace + unlock 12 slash commands   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}status${RESET}    Display active security posture, memory, rules, and stack   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}rules${RESET}     Auto-sync memory to AI IDE rules (.cursorrules, CLAUDE.md)  ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}memory${RESET}    Manage persistent security memory (export, hook, learn)     ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}audit${RESET}     Run static AST security scan on the target project          ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}harden${RESET}    Formulate minimal candidate patches (Ponytail bounded)      ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}apply${RESET}     Apply candidate patches with automatic .bak snapshots       ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}recheck${RESET}   Targeted differential verification of applied fixes         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}recipes${RESET}   List & inspect distilled Golden Fix Recipes in memory       ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}rollback${RESET}  Instantly revert files from latest pre-apply snapshot       ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}report${RESET}    Export OASIS SARIF v2.1.0 or single-file visual HTML report ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}diff-guard${RESET} Scan diffs or wire pre-commit hook (--install-hook)        ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GREEN}help${RESET}      Show this interactive command guide                         ${CYAN}│${RESET}
-  ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
-  ${CYAN}│${RESET}  ${BOLD}AI & Memory Subcommands${RESET}                                               ${CYAN}│${RESET}
-  ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
-  ${CYAN}│${RESET}  ${WHITE}rules sync${RESET}       ${DIM}[--format all|cursor|claude|agent|windsurf]${RESET}        ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${WHITE}report --html${RESET}    ${DIM}[--out <path>] Self-contained visual HTML dashboard${RESET}   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${WHITE}memory context${RESET}   ${DIM}[--role auditor|remediator|reviewer] [--file <f>]${RESET}   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${WHITE}memory hook${RESET}      ${DIM}[install|uninstall] Git pre-commit regression hook${RESET}   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${WHITE}memory learn${RESET}     ${DIM}[--commits <range>] Ingest security commit fixes${RESET}     ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${WHITE}memory export${RESET}    ${DIM}[--path <file>] [--sanitized] Safe team sharing${RESET}      ${CYAN}│${RESET}
-  ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
-  ${CYAN}│${RESET}  ${BOLD}Options${RESET}                                                               ${CYAN}│${RESET}
-  ${CYAN}├─────────────────────────────────────────────────────────────────────────┤${RESET}
-  ${CYAN}│${RESET}  ${GRAY}--target <dir>${RESET}   Target directory to analyze or scaffold ${DIM}(default: .)${RESET}  ${CYAN}│${RESET}
-  ${CYAN}│${RESET}  ${GRAY}--force${RESET}          Overwrite existing workspace and re-scaffold          ${CYAN}│${RESET}
-  ${CYAN}└─────────────────────────────────────────────────────────────────────────┘${RESET}
-
-  ${BOLD}AI Chat Commands:${RESET}
-    ${DIM}In your AI IDE chat, use any of these slash commands:${RESET}
-    ${CYAN}/torusguard${RESET}          Main orchestrator (status, audit, harden, memory)
-    ${CYAN}/torusguard-audit${RESET}    Static AST security scan
-    ${CYAN}/torusguard-harden${RESET}   Generate governed fix patches
-    ${CYAN}/torusguard-apply${RESET}    Apply patches with rollback snapshots
-    ${CYAN}/torusguard-report${RESET}   Executive security posture report
-    ${CYAN}/torusguard-status${RESET}   Read-only workspace diagnostic
-
-  ${DIM}Documentation:${RESET}  ${CYAN}https://github.com/githubmofo/TorusGuard${RESET}
-  ${DIM}NPM Package:${RESET}   ${CYAN}https://npmjs.com/package/torusguard${RESET}
-`);
+  console.log();
+  console.log(cardHeader('🛡️  T O R U S G U A R D   C L I', 'Autonomous Security Engine for AI-Built Applications', 'v1.3.5'));
+  console.log(`\n  ${BOLD}Usage:${RESET}  ${GREEN}npx torusguard${RESET} ${WHITE}[command]${RESET} ${GRAY}[options]${RESET}\n`);
+
+  console.log(cardBorderTop('Commands'));
+  console.log(formatBoxLine(`${GREEN}init${RESET}        Scaffold ${BOLD}.torusguard/${RESET} workspace + unlock slash commands`));
+  console.log(formatBoxLine(`${GREEN}status${RESET}      Display active security posture, memory, rules, & stack`));
+  console.log(formatBoxLine(`${GREEN}rules${RESET}       Auto-sync memory to AI IDE rules (.cursorrules, CLAUDE.md)`));
+  console.log(formatBoxLine(`${GREEN}memory${RESET}      Manage persistent security memory (export, hook, learn)`));
+  console.log(formatBoxLine(`${GREEN}audit${RESET}       Run static AST security scan on target project`));
+  console.log(formatBoxLine(`${GREEN}harden${RESET}      Formulate minimal candidate patches (Ponytail bounded)`));
+  console.log(formatBoxLine(`${GREEN}apply${RESET}       Apply candidate patches with automatic .bak snapshots`));
+  console.log(formatBoxLine(`${GREEN}recheck${RESET}     Targeted differential verification of applied fixes`));
+  console.log(formatBoxLine(`${GREEN}recipes${RESET}     List & inspect distilled Golden Fix Recipes in memory`));
+  console.log(formatBoxLine(`${GREEN}rollback${RESET}    Instantly revert files from latest pre-apply snapshot`));
+  console.log(formatBoxLine(`${GREEN}report${RESET}      Export OASIS SARIF v2.1.0 or single-file visual HTML report`));
+  console.log(formatBoxLine(`${GREEN}diff-guard${RESET}  Scan diffs or wire pre-commit hook (--install-hook)`));
+  console.log(formatBoxLine(`${GREEN}help${RESET}        Show this interactive command guide`));
+  console.log(cardDivider('AI & Memory Subcommands'));
+  console.log(formatBoxLine(`${WHITE}rules sync${RESET}       ${DIM}[--format all|cursor|claude|agent|windsurf]${RESET}`));
+  console.log(formatBoxLine(`${WHITE}report --html${RESET}    ${DIM}[--out <path>] Self-contained visual HTML dashboard${RESET}`));
+  console.log(formatBoxLine(`${WHITE}memory context${RESET}   ${DIM}[--role auditor|remediator|reviewer] [--file <f>]${RESET}`));
+  console.log(formatBoxLine(`${WHITE}memory hook${RESET}      ${DIM}[install|uninstall] Git pre-commit regression hook${RESET}`));
+  console.log(formatBoxLine(`${WHITE}memory learn${RESET}     ${DIM}[--commits <range>] Ingest security commit fixes${RESET}`));
+  console.log(formatBoxLine(`${WHITE}memory export${RESET}    ${DIM}[--path <file>] [--sanitized] Safe team sharing${RESET}`));
+  console.log(cardDivider('Options'));
+  console.log(formatBoxLine(`${GRAY}--target <dir>${RESET}   Target directory to analyze or scaffold ${DIM}(default: .)${RESET}`));
+  console.log(formatBoxLine(`${GRAY}--force${RESET}          Overwrite existing workspace and re-scaffold`));
+  console.log(formatBoxLine(`${GRAY}--yes, -y${RESET}        Non-interactive auto-approval for patch application`));
+  console.log(cardBorderBottom());
+
+  console.log(`\n  ${BOLD}AI Chat Commands:${RESET}`);
+  console.log(`    ${DIM}In your AI IDE chat, use any of these slash commands:${RESET}`);
+  console.log(`    ${CYAN}/torusguard${RESET}          Main orchestrator (status, audit, harden, memory)`);
+  console.log(`    ${CYAN}/torusguard-audit${RESET}    Static AST security scan`);
+  console.log(`    ${CYAN}/torusguard-harden${RESET}   Generate governed fix patches`);
+  console.log(`    ${CYAN}/torusguard-apply${RESET}    Apply patches with rollback snapshots`);
+  console.log(`    ${CYAN}/torusguard-recheck${RESET}  Differential AST fix closure verification`);
+  console.log(`    ${CYAN}/torusguard-report${RESET}   Executive security posture report`);
+  console.log(`    ${CYAN}/torusguard-status${RESET}   Read-only workspace diagnostic`);
+  console.log(`\n  ${DIM}Documentation:${RESET}  ${CYAN}https://github.com/githubmofo/TorusGuard${RESET}`);
+  console.log(`  ${DIM}NPM Package:${RESET}   ${CYAN}https://npmjs.com/package/torusguard${RESET}\n`);
 }
 
 if (command === 'help' || command === '--help' || command === '-h') {
@@ -139,48 +249,50 @@ if (command === 'status') {
         } catch (e) {}
       }
 
-      console.log(`
-  ${CYAN}╭─────────────────────────────────────────────────────────────────────────╮${RESET}
-  ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}│${RESET}   ${BOLD}${WHITE}🛡️  TORUSGUARD SECURITY POSTURE${RESET}                        ${GRAY}v1.3.2${RESET}   ${CYAN}│${RESET}
-  ${CYAN}│${RESET}                                                                         ${CYAN}│${RESET}
-  ${CYAN}╰─────────────────────────────────────────────────────────────────────────╯${RESET}
-
-  ${BOLD}▸ Workspace:${RESET}        ${GREEN}${cwd}${RESET}
-  ${BOLD}▸ Governance:${RESET}       ${GREEN}Full Local Governance (.torusguard/)${RESET}
-
-  ${CYAN}┌── Environment & Stack ──────────────────────────────────────────────────┐${RESET}
-  ${CYAN}│${RESET}  Language:          ${BOLD}${stackLang}${RESET}
-  ${CYAN}│${RESET}  Framework:         ${BOLD}${stackFw}${RESET}
-  ${CYAN}│${RESET}  Data Layer:        ${BOLD}${stackDb}${RESET}
-  ${CYAN}│${RESET}  Stack Detection:   ${stackStatus}
-  ${CYAN}└─────────────────────────────────────────────────────────────────────────┘${RESET}
-
-  ${CYAN}┌── Security Memory Engine ───────────────────────────────────────────────┐${RESET}
-  ${CYAN}│${RESET}  Patterns Learned:  ${GREEN}${memPatterns} active patterns${RESET}
-  ${CYAN}│${RESET}  Events Recorded:   ${WHITE}${memEvents} events (local-first log)${RESET}
-  ${CYAN}│${RESET}  Context Window:    ${CYAN}${memTokens} / 2,000 tokens${RESET} (${Math.round((memTokens / 2000) * 100)}% utilized)
-  ${CYAN}│${RESET}  Fix Velocity Rate: ${YELLOW}${memFixRate}${RESET}
-  ${CYAN}└─────────────────────────────────────────────────────────────────────────┘${RESET}
-
-  ${CYAN}┌── Governance Telemetry ─────────────────────────────────────────────────┐${RESET}
-  ${CYAN}│${RESET}  Rules Catalog:     ${GREEN}71 Canonical Security Rules${RESET} (11 families)
-  ${CYAN}│${RESET}  Severity Floor:    ${YELLOW}${cfg.severity_threshold || 'medium'}${RESET}
-  ${CYAN}│${RESET}  Runs Directory:    ${DIM}${cfg.runs_dir || '.torusguard/runs'}${RESET}
-  ${CYAN}│${RESET}  Ponytail Bounds:   ${GREEN}<= 35 additions, <= 25 deletions${RESET}
-  ${CYAN}└─────────────────────────────────────────────────────────────────────────┘${RESET}
-
-  ${CYAN}┌── Rule Families ────────────────────────────────────────────────────────┐${RESET}
-  ${CYAN}│${RESET}  ${YELLOW}TG-SEC${RESET}     Secrets & Credentials    ${YELLOW}TG-DB${RESET}      Database Safety
-  ${CYAN}│${RESET}  ${YELLOW}TG-INPUT${RESET}   Input Validation         ${YELLOW}TG-AUTH${RESET}    Authentication
-  ${CYAN}│${RESET}  ${YELLOW}TG-CLIENT${RESET}  Client Bundle Leaks      ${YELLOW}TG-DIFF${RESET}    Diff Inspection
-  ${CYAN}│${RESET}  ${YELLOW}TG-AGENT${RESET}   AI Agent Security        ${YELLOW}TG-EDGE${RESET}    Serverless
-  ${CYAN}│${RESET}  ${YELLOW}TG-SUPPLY${RESET}  Supply Chain & CI/CD     ${YELLOW}TG-SSRF${RESET}    Outbound Net
-  ${CYAN}│${RESET}  ${YELLOW}TG-BIZ${RESET}     Business Logic
-  ${CYAN}└─────────────────────────────────────────────────────────────────────────┘${RESET}
-
-  ${DIM}Quick Action:${RESET} In your AI chat, run ${CYAN}/torusguard-audit${RESET} to scan.
-`);
+      console.log();
+      console.log(cardHeader('🛡️  TORUSGUARD SECURITY POSTURE', '', 'v1.3.5'));
+      console.log(`\n  ${BOLD}▸ Workspace:${RESET}        ${GREEN}${cwd}${RESET}`);
+      console.log(`  ${BOLD}▸ Governance:${RESET}       ${GREEN}Full Local Governance (.torusguard/)${RESET}`);
+      console.log(`  ${BOLD}▸ Living Report:${RESET}    ${CYAN}security_report.md${RESET}\n`);
+
+      console.log(cardBorderTop('Environment & Stack'));
+      console.log(formatBoxLine(`Language:          ${BOLD}${stackLang}${RESET}`));
+      console.log(formatBoxLine(`Framework:         ${BOLD}${stackFw}${RESET}`));
+      console.log(formatBoxLine(`Data Layer:        ${BOLD}${stackDb}${RESET}`));
+      console.log(formatBoxLine(`Stack Detection:   ${stackStatus}`));
+      console.log(cardBorderBottom());
+      console.log();
+
+      console.log(cardBorderTop('Security Memory Engine'));
+      console.log(formatBoxLine(`Patterns Learned:  ${GREEN}${memPatterns} active patterns${RESET}`));
+      console.log(formatBoxLine(`Events Recorded:   ${WHITE}${memEvents} events (local-first log)${RESET}`));
+      console.log(formatBoxLine(`Context Window:    ${CYAN}${memTokens} / 2,000 tokens${RESET} (${Math.round((memTokens / 2000) * 100)}% utilized)`));
+      console.log(formatBoxLine(`Fix Velocity Rate: ${YELLOW}${memFixRate}${RESET}`));
+      console.log(cardBorderBottom());
+      console.log();
+
+      console.log(cardBorderTop('Governance Telemetry'));
+      console.log(formatBoxLine(`Rules Catalog:     ${GREEN}74 Canonical Security Rules${RESET} (18 families)`));
+      console.log(formatBoxLine(`Severity Floor:    ${YELLOW}${cfg.severity_threshold || 'medium'}${RESET}`));
+      console.log(formatBoxLine(`Runs Directory:    ${DIM}${cfg.runs_dir || '.torusguard/runs'}${RESET}`));
+      console.log(formatBoxLine(`Ponytail Bounds:   ${GREEN}<= 35 additions, <= 25 deletions${RESET}`));
+      console.log(formatBoxLine(`Living Report:     ${CYAN}security_report.md (ground truth)${RESET}`));
+      console.log(cardBorderBottom());
+      console.log();
+
+      console.log(cardBorderTop('Rule Families (18 Families / 74 Rules)'));
+      console.log(formatBoxLine(`${YELLOW}TG-SEC${RESET}     Secrets (7)              ${YELLOW}TG-DB${RESET}      Database Safety (4)`));
+      console.log(formatBoxLine(`${YELLOW}TG-INPUT${RESET}   Input Validation (6)     ${YELLOW}TG-AUTH${RESET}    Authentication (8)`));
+      console.log(formatBoxLine(`${YELLOW}TG-RATE${RESET}    Rate Limiting (3)        ${YELLOW}TG-AGENT${RESET}   AI Agent Security (4)`));
+      console.log(formatBoxLine(`${YELLOW}TG-SSRF${RESET}    Server Request (4)       ${YELLOW}TG-WEBHOOK${RESET} Webhook Trust (4)`));
+      console.log(formatBoxLine(`${YELLOW}TG-WS${RESET}      WebSocket (4)            ${YELLOW}TG-CSRF${RESET}    Cross-Site Request (2)`));
+      console.log(formatBoxLine(`${YELLOW}TG-GQL${RESET}     GraphQL Security (4)     ${YELLOW}TG-SUPPLY${RESET}  Supply Chain (6)`));
+      console.log(formatBoxLine(`${YELLOW}TG-BIZ${RESET}     Business Logic (4)       ${YELLOW}TG-CACHE${RESET}   Cache Isolation (3)`));
+      console.log(formatBoxLine(`${YELLOW}TG-CLIENT${RESET}  Client Bundles (2)       ${YELLOW}TG-PLATFORM${RESET}Platform Config (4)`));
+      console.log(formatBoxLine(`${YELLOW}TG-DIFF${RESET}    Diff Inspection (3)      ${YELLOW}TG-EDGE${RESET}    Serverless / Edge (2)`));
+      console.log(cardBorderBottom());
+
+      console.log(`\n  ${DIM}Quick Action:${RESET} In your AI chat, run ${CYAN}/torusguard-audit${RESET} to scan.\n`);
       process.exit(0);
     } catch (e) {
       // Fallback to python runner

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {

package/skills/torusguard/SKILL.md

@@ -1,42 +1,73 @@
----
-name: torusguard
-description: "Universal autonomous security engine: 71 rules across 11 families, polyglot stack detection across 16+ languages, governed remediation (Ponytail Protocol <=35 add, <=25 del), SARIF v2.1.0 exports, single-file HTML dashboards, and persistent security memory context for modern web applications."
-version: 1.3.2
----
-
-# TorusGuard Master Security Router
-
-**Principle:** If the browser or client receives it, users can inspect it. Keep secrets, database queries, and authorization strictly on trusted server-side code.
-
----
-
-## ⚡ Workspace Bootstrap Check
-1. **If `.torusguard/` exists on disk:** Full autonomous governance active. Load `.torusguard/memory/context.json` into prompt context for local-first intelligence. Route commands to specialist workflows below.
-2. **If `.torusguard/` is absent (Autonomous AI Mode):** Operates standalone in any AI agent (Kimi, Antigravity, VS Code, Cursor, Claude Code, Windsurf). Apply universal security invariants:
-   - Server-side auth & tenant scoping (`.filter(tenant=...)`, `.Where("tenant_id = ?")`, `where: { tenantId: ... }`).
-   - Zero client-side secrets (`SUPABASE_SERVICE_ROLE_KEY`, live API keys, Stripe secret keys).
-   - Ponytail Protocol patch limits ($\le 35$ additions, $\le 25$ deletions, zero full-file rewrites).
-   - *Upgrade:* Run `npx torusguard init` to unlock local `.torusguard/` workspace tracking, persistent memory, and individual slash commands.
-
----
-
-## Specialist Skill Routing (Lazy Loading)
-Load **only** the designated sub-skill on demand to preserve the 1,000–1,500 token budget:
-
-| Command | Specialist Skill | Agent | Purpose |
-| :--- | :--- | :--- | :--- |
-| `/torusguard init` | `skills/torusguard-init/SKILL.md` | `profiler` | Workspace discovery, stack detection & scaffolding |
-| `/torusguard authorize` | `skills/torusguard-authorize/SKILL.md` | `reviewer` | Legal scope definition & safety boundaries |
-| `/torusguard audit` | `skills/torusguard-audit/SKILL.md` | `auditor` | Static AST security audit & root-cause clustering |
-| `/torusguard verify` | `skills/torusguard-verify/SKILL.md` | `validator` | Evidence sufficiency & line match audit |
-| `/torusguard web-validate` | `skills/torusguard-web-validate/SKILL.md` | `validator` | Authorized non-destructive HTTP probing |
-| `/torusguard exploit-check`| `skills/torusguard-exploit-check/SKILL.md`| `validator` | Bounded single-step exploitability confirmation |
-| `/torusguard harden` | `skills/torusguard-harden/SKILL.md` | `remediator`| Governed remediation under Ponytail Protocol |
-| `/torusguard apply` | `skills/torusguard-apply/SKILL.md` | `remediator`| Governed patch application with rollback snapshots |
-| `/torusguard recheck` | `skills/torusguard-recheck/SKILL.md` | `reviewer` | Differential AST re-scan & closure verification |
-| `/torusguard report` | `skills/torusguard-report/SKILL.md` | `reviewer` | Executive posture reporting, SARIF & visual HTML export |
-| `/torusguard status` | `skills/torusguard-status/SKILL.md` | `reviewer` | Diagnostic overview of posture, stack & rules |
-| `/torusguard memory` | `skills/torusguard/SKILL.md` | `reviewer` | Persistent memory inspection, decay & context cards |
-| `/torusguard full` | `skills/torusguard-full/SKILL.md` | *All* | End-to-end 7-stage closed-loop execution |
-
-*Note: Never load all skills simultaneously. Lazy-load strictly on demand.*
+---
+name: torusguard
+description: Universal autonomous security engine: 74 canonical rules across 18 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, living security_report.md ground-truth ledger, SARIF v2.1.0 exports, and persistent security memory context.
+version: 1.3.5
+---
+
+# TorusGuard Master Security Engine & Command Router
+
+**Core Invariant:** If the browser or client receives it, users can inspect it. Never expose database credentials, master keys, or private API secrets in client bundles. Always isolate multi-tenant database queries.
+
+---
+
+## Command Catalog: Terminal CLI & AI Chat Parity
+
+TorusGuard operates with 100% feature parity across both the terminal CLI and AI chat slash commands:
+
+| Capability | Terminal CLI Command | AI Chat Slash Command | Specialist Skill | Purpose |
+| :--- | :--- | :--- | :--- | :--- |
+| **Init** | `npx torusguard init` | `/torusguard init` | `skills/torusguard-init` | Stack discovery, rule activation, workspace scaffolding |
+| **Status** | `npx torusguard status` | `/torusguard status` | `skills/torusguard-status` | Posture score, active rules, run history, scope check |
+| **Audit** | `npx torusguard audit` | `/torusguard audit` | `skills/torusguard-audit` | Static AST scan, invariant fingerprinting, confidence scoring |
+| **Verify** | `npx torusguard verify` | `/torusguard verify` | `skills/torusguard-verify` | Evidence sufficiency audit & line match calibration |
+| **Harden** | `npx torusguard harden` | `/torusguard harden` | `skills/torusguard-harden` | Ponytail patch formulation ($\le 35$ add, $\le 25$ del) |
+| **Apply** | `npx torusguard apply [--yes]` | `/torusguard apply` | `skills/torusguard-apply` | Human Gate review, `.bak` snapshots, patch application |
+| **Rollback** | `npx torusguard rollback` | `/torusguard rollback` | `skills/torusguard-apply` | Instant 1-step rollback from pre-apply snapshots |
+| **Recheck** | `npx torusguard recheck` | `/torusguard recheck` | `skills/torusguard-recheck` | Targeted differential AST scan, fix closure verification |
+| **Recipes** | `npx torusguard recipes` | `/torusguard recipes` | `skills/torusguard-harden` | Explore verified Golden Fix Recipes from persistent memory |
+| **Report** | `npx torusguard report --html` | `/torusguard report` | `skills/torusguard-report` | Executive posture reporting, SARIF v2.1.0 & visual HTML |
+| **Authorize** | `npx torusguard authorize` | `/torusguard authorize` | `skills/torusguard-authorize`| Legal scope definition & safety boundaries |
+| **Validate** | `npx torusguard web-validate` | `/torusguard web-validate` | `skills/torusguard-web-validate`| Authorized non-destructive HTTP probing |
+| **Exploit** | `npx torusguard exploit-check` | `/torusguard exploit-check`| `skills/torusguard-exploit-check`| Bounded single-step exploitability confirmation |
+| **Full** | `npx torusguard full` | `/torusguard full` | `skills/torusguard-full` | End-to-end 7-stage closed-loop execution |
+| **Sync** | `npx torusguard rules sync` | `/torusguard rules sync` | `skills/torusguard-init` | Synchronize rules across AI editors (Cursor, Claude, Antigravity) |
+
+---
+
+## Non-Negotiable Invariants
+
+1. **Browser-Code Truth:** If the client receives it, it is public. Zero hardcoded secrets (`SUPABASE_SERVICE_ROLE_KEY`, private tokens, live API keys) in frontend code.
+2. **Multi-Tenant Isolation:** All database lookups must be scoped by organization or user ownership (`tenant_id`, `organization_id`, `where: { tenantId }`).
+3. **Ponytail Churn Bounds:** Patches must be minimal and surgical ($\le 35$ additions, $\le 25$ deletions). Never perform full-file rewrites.
+4. **Standardized 75-Column Terminal:** All CLI terminal output is strictly normalized to 75 visual columns with Unicode emoji width calculation, ANSI escape handling, and visual truncation with ellipsis (`...`).
+5. **Zero Security Bypasses:** Never insert `# nosec`, `verify=False`, `InsecureSkipVerify: true`, `[AllowAnonymous]`, or `csrf().disable()`.
+6. **Snapshots Before Edits:** Every code modification must capture a byte-for-byte pre-apply backup in `.torusguard/snapshots/<run_id>/` before touching disk code.
+7. **Living Security Report Ground Truth:** All finding discoveries, patch formulations, applications, and recheck verifications must synchronize with `security_report.md` at the workspace root to maintain verifiable finding state and eliminate hallucination.
+
+---
+
+## Workspace Layout Structure
+```
+.torusguard/
+├── config/
+│   ├── torusguard.json          # Detected stack, settings, and rule counts
+│   └── scope.json               # Authorized runtime validation targets & TTL
+├── memory/
+│   ├── context.json             # Aggregated security memory context
+│   ├── patterns.json            # Distilled Golden Fix Recipes
+│   └── events.json              # Historical audit, apply, and recheck events
+├── rules/
+│   └── active/                  # Active TG-* rule definitions
+├── runs/
+│   └── run-YYYYMMDD-HHMMSS-audit/
+│       ├── findings.json        # Machine-readable AST findings
+│       ├── findings.md          # Actionable markdown finding cards
+│       ├── remediation.md       # Formulated candidate patch catalog
+│       ├── diff_summary.md      # Summary of applied diffs
+│       ├── recheck.md           # Differential recheck status transitions
+│       ├── report.html          # Single-file visual dark-mode HTML report
+│       ├── results.sarif        # OASIS SARIF v2.1.0 log
+│       └── bundles/             # Formulated Ponytail remediation bundles
+└── snapshots/
+    └── run-YYYYMMDD-HHMMSS-audit/ # Pre-apply .bak files for instant rollback
+```