torusguard 1.3.4 → 1.3.5

package/skills/torusguard/payload/scripts/recheck_runner.py

@@ -1,238 +1,248 @@
-#!/usr/bin/env python3
-"""
-TorusGuard Targeted Differential Recheck Engine (v1.3.3)
-Executes scoped differential re-audits verifying only impacted files and adjacent boundaries.
-Evaluates formal status transitions (Confirmed Fixed vs Regressed vs Unresolved), updates run manifest,
-and records verification telemetry in the persistent security memory subsystem.
-Standardized 75-column terminal UI formatting.
-
-Pure Python 3.10+ standard library (zero external dependencies).
-"""
-
-import sys
-import os
-import re
-import json
-import argparse
-import datetime
-from pathlib import Path
-from typing import Dict, List, Any, Optional
-
-# Ensure scripts dir is in sys.path for term_ui import
-scripts_dir = Path(__file__).resolve().parent
-if str(scripts_dir) not in sys.path:
-    sys.path.insert(0, str(scripts_dir))
-
-try:
-    import term_ui
-except ImportError:
-    term_ui = None
-
-# Windows console UTF-8 support
-if sys.stdout and hasattr(sys.stdout, "reconfigure"):
-    try:
-        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
-    except Exception:
-        pass
-
-# ─── Timezone Configuration: Indian Standard Time (IST, UTC+05:30) ───────────
-IST = datetime.timezone(datetime.timedelta(hours=5, minutes=30), name="IST")
-
-def get_ist_now() -> datetime.datetime:
-    return datetime.datetime.now(IST)
-
-# ─── Formatting Helpers ────────────────────────────────────────────────────────
-BOLD = "\033[1m"
-DIM = "\033[2m"
-RESET = "\033[0m"
-CYAN = "\033[36m"
-GREEN = "\033[32m"
-YELLOW = "\033[33m"
-WHITE = "\033[97m"
-GRAY = "\033[90m"
-RED = "\033[31m"
-
-def box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
-    if term_ui:
-        return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
-    return f"  {border_color}{border}{RESET}  {content}"
-
-def box_header(title: str, subtitle: str = "", version: str = "v1.3.3", border_color: str = CYAN) -> str:
-    if term_ui:
-        return term_ui.card_header(title, subtitle, version, border_color)
-    return f"=== {title} ({version}) ==="
-
-def border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
-    if term_ui:
-        return term_ui.card_border_top(title, border_color=border_color, double=double)
-    return "┌" + "─" * 71 + "┐"
-
-def border_bottom(border_color: str = CYAN, double: bool = False) -> str:
-    if term_ui:
-        return term_ui.card_border_bottom(border_color=border_color, double=double)
-    return "└" + "─" * 71 + "┘"
-
-
-def find_latest_audit_run(runs_dir: Path) -> Optional[Path]:
-    if not runs_dir.is_dir():
-        return None
-    runs = sorted(runs_dir.glob("run-*-audit"), key=lambda p: p.stat().st_mtime, reverse=True)
-    return runs[0] if runs else None
-
-
-def execute_recheck(target_root: Path, run_id_arg: Optional[str] = None) -> Dict[str, Any]:
-    runs_dir = target_root / ".torusguard" / "runs"
-    if run_id_arg:
-        run_folder = runs_dir / run_id_arg
-    else:
-        run_folder = find_latest_audit_run(runs_dir)
-
-    if not run_folder or not run_folder.is_dir():
-        print(f"\n  {RED}✖ No audit run found to recheck.{RESET}\n")
-        sys.exit(1)
-
-    # Import audit scanner and memory engine
-    try:
-        import audit_runner
-    except ImportError:
-        audit_runner = None
-    try:
-        import memory_engine
-    except ImportError:
-        memory_engine = None
-
-    bundles_dir = run_folder / "bundles"
-    bundle_meta_files = list(bundles_dir.glob("*/metadata.json")) if bundles_dir.is_dir() else []
-
-    # Header Card
-    print()
-    print(box_header("🛡️  TORUSGUARD DIFFERENTIAL RECHECK ENGINE", "Targeted Differential AST Scan & Regression Verification", "v1.3.3"))
-    print()
-
-    print(border_top("Recheck Verification Scope"))
-    print(box_line(f"Active Run:     {WHITE}{run_folder.name}{RESET}"))
-    print(box_line(f"Target Root:    {WHITE}{target_root}{RESET}"))
-    print(border_bottom())
-    print()
-
-    recheck_results = []
-    confirmed_count = 0
-    regressed_count = 0
-    unresolved_count = 0
-
-    recheck_md_lines = [
-        f"# TorusGuard Differential Recheck Report",
-        f"**Run ID:** `{run_folder.name}`  ",
-        f"**Timestamp:** `{get_ist_now().strftime('%Y-%m-%d %H:%M:%S IST')}`  \n",
-        "---",
-        "## Recheck Transition Catalog\n"
-    ]
-
-    for mf in bundle_meta_files:
-        try:
-            bdata = json.loads(mf.read_text(encoding="utf-8"))
-        except Exception:
-            continue
-
-        rule_id = bdata.get("rule_id", "")
-        rel_path = bdata.get("target_file", "")
-        target_path = target_root / rel_path
-
-        if not target_path.is_file():
-            continue
-
-        # Differential scan on this single modified file
-        if audit_runner:
-            file_findings = audit_runner.scan_file(target_path, target_root)
-            matching_rule_findings = [f for f in file_findings if f.get("rule_id") == rule_id]
-        else:
-            matching_rule_findings = []
-
-        if not matching_rule_findings:
-            outcome = "Confirmed Fixed"
-            confirmed_count += 1
-            status_icon = f"{GREEN}✔ [Confirmed Fixed]{RESET}"
-            # Record in memory
-            if memory_engine:
-                try:
-                    memory_engine.record_event("fix_verified", {
-                        "rule_id": rule_id,
-                        "file_path": rel_path,
-                        "verification_result": "fixed"
-                    }, root_dir=target_root)
-                except Exception:
-                    pass
-        else:
-            outcome = "Unresolved"
-            unresolved_count += 1
-            status_icon = f"{YELLOW}⚠ [Unresolved]{RESET}"
-
-        recheck_results.append({
-            "rule_id": rule_id,
-            "target_file": rel_path,
-            "outcome": outcome,
-            "title": bdata.get("title", rule_id)
-        })
-
-        recheck_md_lines.append(f"### [{rule_id}] {bdata.get('title')}")
-        recheck_md_lines.append(f"- **File:** `{rel_path}`")
-        recheck_md_lines.append(f"- **Outcome:** `{outcome}`")
-        recheck_md_lines.append(f"- **Verification Timestamp:** {get_ist_now().strftime('%Y-%m-%d %H:%M:%S IST')}\n")
-
-        print(f"  {status_icon} {WHITE}{rule_id}{RESET} on {rel_path}")
-
-    # Write recheck.md
-    (run_folder / "recheck.md").write_text("\n".join(recheck_md_lines), encoding="utf-8")
-
-    # Update manifest
-    manifest_file = run_folder / "manifest.json"
-    if manifest_file.is_file():
-        try:
-            mdata = json.loads(manifest_file.read_text(encoding="utf-8"))
-            mdata["status"] = "verified_fixed" if regressed_count == 0 and unresolved_count == 0 else "recheck_completed"
-            mdata["confirmed_fixed_count"] = confirmed_count
-            mdata["regressed_count"] = regressed_count
-            manifest_file.write_text(json.dumps(mdata, indent=2), encoding="utf-8")
-        except Exception:
-            pass
-
-    print()
-    print(border_top("Recheck Summary"))
-    print(box_line(f"Confirmed Fixed:{GREEN}{confirmed_count} vulnerabilities verified closed{RESET}"))
-    print(box_line(f"Regressed:      {RED if regressed_count > 0 else GREEN}{regressed_count} regressions detected{RESET}"))
-    print(box_line(f"Unresolved:     {YELLOW if unresolved_count > 0 else GREEN}{unresolved_count} unresolved{RESET}"))
-    print(box_line(f"Memory Sync:    {GREEN}Verification events synced to persistent memory engine{RESET}"))
-    print(border_bottom())
-    print()
-
-    print(border_top("Next Governed Action", border_color=GREEN, double=True))
-    print(box_line(f"Visual Dashboard: {BOLD}{WHITE}npx torusguard report --html{RESET} (Updated posture score)", border="║", border_color=GREEN))
-    print(box_line(f"View Recipes:     {CYAN}npx torusguard recipes{RESET} (Active golden fix recipes)", border="║", border_color=GREEN))
-    print(border_bottom(border_color=GREEN, double=True))
-    print()
-
-    return {
-        "run_folder": str(run_folder),
-        "confirmed_fixed_count": confirmed_count,
-        "regressed_count": regressed_count,
-        "unresolved_count": unresolved_count,
-        "results": recheck_results
-    }
-
-
-def main():
-    parser = argparse.ArgumentParser(description="TorusGuard Differential Recheck Engine")
-    parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
-    parser.add_argument("--run", "-r", help="Explicit run ID to recheck")
-    parser.add_argument("--json", action="store_true", help="Output raw JSON")
-    args = parser.parse_args()
-
-    target = Path(args.path).resolve()
-    result = execute_recheck(target, run_id_arg=args.run)
-
-    if args.json:
-        print(json.dumps(result, indent=2))
-
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""
+TorusGuard Targeted Differential Recheck Engine (v1.3.5)
+Executes scoped differential re-audits verifying only impacted files and adjacent boundaries.
+Evaluates formal status transitions (Confirmed Fixed vs Regressed vs Unresolved), updates run manifest,
+and records verification telemetry in the persistent security memory subsystem.
+Standardized 75-column terminal UI formatting.
+
+Pure Python 3.10+ standard library (zero external dependencies).
+"""
+
+import sys
+import os
+import re
+import json
+import argparse
+import datetime
+from pathlib import Path
+from typing import Dict, List, Any, Optional
+
+# Ensure scripts dir is in sys.path for term_ui import
+scripts_dir = Path(__file__).resolve().parent
+if str(scripts_dir) not in sys.path:
+    sys.path.insert(0, str(scripts_dir))
+
+try:
+    import term_ui
+except ImportError:
+    term_ui = None
+
+# Windows console UTF-8 support
+if sys.stdout and hasattr(sys.stdout, "reconfigure"):
+    try:
+        getattr(sys.stdout, "reconfigure")(encoding="utf-8", errors="replace")
+    except Exception:
+        pass
+
+# ─── Timezone Configuration: Indian Standard Time (IST, UTC+05:30) ───────────
+IST = datetime.timezone(datetime.timedelta(hours=5, minutes=30), name="IST")
+
+def get_ist_now() -> datetime.datetime:
+    return datetime.datetime.now(IST)
+
+# ─── Formatting Helpers ────────────────────────────────────────────────────────
+BOLD = "\033[1m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+CYAN = "\033[36m"
+GREEN = "\033[32m"
+YELLOW = "\033[33m"
+WHITE = "\033[97m"
+GRAY = "\033[90m"
+RED = "\033[31m"
+
+def box_line(content: str, width: int = 67, border: str = "│", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
+    return f"  {border_color}{border}{RESET}  {content}"
+
+def box_header(title: str, subtitle: str = "", version: str = "v1.3.5", border_color: str = CYAN) -> str:
+    if term_ui:
+        return term_ui.card_header(title, subtitle, version, border_color)
+    return f"=== {title} ({version}) ==="
+
+def border_top(title: str = "", border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_top(title, border_color=border_color, double=double)
+    return "┌" + "─" * 71 + "┐"
+
+def border_bottom(border_color: str = CYAN, double: bool = False) -> str:
+    if term_ui:
+        return term_ui.card_border_bottom(border_color=border_color, double=double)
+    return "└" + "─" * 71 + "┘"
+
+
+def find_latest_audit_run(runs_dir: Path) -> Optional[Path]:
+    if not runs_dir.is_dir():
+        return None
+    runs = sorted(runs_dir.glob("run-*-audit"), key=lambda p: p.stat().st_mtime, reverse=True)
+    return runs[0] if runs else None
+
+
+def execute_recheck(target_root: Path, run_id_arg: Optional[str] = None) -> Dict[str, Any]:
+    runs_dir = target_root / ".torusguard" / "runs"
+    if run_id_arg:
+        run_folder = runs_dir / run_id_arg
+    else:
+        run_folder = find_latest_audit_run(runs_dir)
+
+    if not run_folder or not run_folder.is_dir():
+        print(f"\n  {RED}✖ No audit run found to recheck.{RESET}\n")
+        sys.exit(1)
+
+    # Import audit scanner and memory engine
+    try:
+        import audit_runner
+    except ImportError:
+        audit_runner = None
+    try:
+        import memory_engine
+    except ImportError:
+        memory_engine = None
+
+    bundles_dir = run_folder / "bundles"
+    bundle_meta_files = list(bundles_dir.glob("*/metadata.json")) if bundles_dir.is_dir() else []
+
+    # Header Card
+    print()
+    print(box_header("🛡️  TORUSGUARD DIFFERENTIAL RECHECK ENGINE", "Targeted Differential AST Scan & Regression Verification", "v1.3.5"))
+    print()
+
+    print(border_top("Recheck Verification Scope"))
+    print(box_line(f"Active Run:     {WHITE}{run_folder.name}{RESET}"))
+    print(box_line(f"Target Root:    {WHITE}{target_root}{RESET}"))
+    print(border_bottom())
+    print()
+
+    recheck_results = []
+    confirmed_count = 0
+    regressed_count = 0
+    unresolved_count = 0
+
+    recheck_md_lines = [
+        f"# TorusGuard Differential Recheck Report",
+        f"**Run ID:** `{run_folder.name}`  ",
+        f"**Timestamp:** `{get_ist_now().strftime('%Y-%m-%d %H:%M:%S IST')}`  \n",
+        "---",
+        "## Recheck Transition Catalog\n"
+    ]
+
+    for mf in bundle_meta_files:
+        try:
+            bdata = json.loads(mf.read_text(encoding="utf-8"))
+        except Exception:
+            continue
+
+        rule_id = bdata.get("rule_id", "")
+        rel_path = bdata.get("target_file", "")
+        target_path = target_root / rel_path
+
+        if not target_path.is_file():
+            continue
+
+        # Differential scan on this single modified file
+        if audit_runner:
+            file_findings = audit_runner.scan_file(target_path, target_root)
+            matching_rule_findings = [f for f in file_findings if f.get("rule_id") == rule_id]
+        else:
+            matching_rule_findings = []
+
+        if not matching_rule_findings:
+            outcome = "Confirmed Fixed"
+            confirmed_count += 1
+            status_icon = f"{GREEN}✔ [Confirmed Fixed]{RESET}"
+            # Record in memory
+            if memory_engine:
+                try:
+                    memory_engine.record_event("fix_verified", {
+                        "rule_id": rule_id,
+                        "file_path": rel_path,
+                        "verification_result": "fixed"
+                    }, root_dir=target_root)
+                except Exception:
+                    pass
+        else:
+            outcome = "Unresolved"
+            unresolved_count += 1
+            status_icon = f"{YELLOW}⚠ [Unresolved]{RESET}"
+
+        recheck_results.append({
+            "rule_id": rule_id,
+            "target_file": rel_path,
+            "outcome": outcome,
+            "title": bdata.get("title", rule_id)
+        })
+
+        recheck_md_lines.append(f"### [{rule_id}] {bdata.get('title')}")
+        recheck_md_lines.append(f"- **File:** `{rel_path}`")
+        recheck_md_lines.append(f"- **Outcome:** `{outcome}`")
+        recheck_md_lines.append(f"- **Verification Timestamp:** {get_ist_now().strftime('%Y-%m-%d %H:%M:%S IST')}\n")
+
+        print(f"  {status_icon} {WHITE}{rule_id}{RESET} on {rel_path}")
+
+    # Write recheck.md
+    (run_folder / "recheck.md").write_text("\n".join(recheck_md_lines), encoding="utf-8")
+    try:
+        import report_sync
+        report_sync.record_recheck_results(target_root, {
+            "fixed": [r for r in recheck_results if r.get("outcome") == "Confirmed Fixed"],
+            "regressed": [r for r in recheck_results if r.get("outcome") == "Regressed"],
+            "remaining": [r for r in recheck_results if r.get("outcome") == "Unresolved"]
+        }, run_folder.name)
+    except Exception:
+        pass
+
+    # Update manifest
+    manifest_file = run_folder / "manifest.json"
+    if manifest_file.is_file():
+        try:
+            mdata = json.loads(manifest_file.read_text(encoding="utf-8"))
+            mdata["status"] = "verified_fixed" if regressed_count == 0 and unresolved_count == 0 else "recheck_completed"
+            mdata["confirmed_fixed_count"] = confirmed_count
+            mdata["regressed_count"] = regressed_count
+            manifest_file.write_text(json.dumps(mdata, indent=2), encoding="utf-8")
+        except Exception:
+            pass
+
+    print()
+    print(border_top("Recheck Summary"))
+    print(box_line(f"Confirmed Fixed:{GREEN}{confirmed_count} vulnerabilities verified closed{RESET}"))
+    print(box_line(f"Regressed:      {RED if regressed_count > 0 else GREEN}{regressed_count} regressions detected{RESET}"))
+    print(box_line(f"Unresolved:     {YELLOW if unresolved_count > 0 else GREEN}{unresolved_count} unresolved{RESET}"))
+    print(box_line(f"Memory Sync:    {GREEN}Verification events synced to persistent memory engine{RESET}"))
+    print(border_bottom())
+    print()
+
+    print(border_top("Next Governed Action", border_color=GREEN, double=True))
+    print(box_line(f"Living Report:    {CYAN}security_report.md (verified closures recorded){RESET}", border="║", border_color=GREEN))
+    print(box_line(f"Visual Dashboard: {BOLD}{WHITE}npx torusguard report --html{RESET} (Updated posture score)", border="║", border_color=GREEN))
+    print(box_line(f"View Recipes:     {CYAN}npx torusguard recipes{RESET} (Active golden fix recipes)", border="║", border_color=GREEN))
+    print(border_bottom(border_color=GREEN, double=True))
+    print()
+
+    return {
+        "run_folder": str(run_folder),
+        "confirmed_fixed_count": confirmed_count,
+        "regressed_count": regressed_count,
+        "unresolved_count": unresolved_count,
+        "results": recheck_results
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="TorusGuard Differential Recheck Engine")
+    parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--run", "-r", help="Explicit run ID to recheck")
+    parser.add_argument("--json", action="store_true", help="Output raw JSON")
+    args = parser.parse_args()
+
+    target = Path(args.path).resolve()
+    result = execute_recheck(target, run_id_arg=args.run)
+
+    if args.json:
+        print(json.dumps(result, indent=2))
+
+
+if __name__ == "__main__":
+    main()