torusguard 1.3.5 → 1.4.0

package/bin/torusguard.js

@@ -15,6 +15,51 @@ const command = args[0] || 'init';
 const rootDir = path.resolve(__dirname, '..');
 const cwd = process.cwd();
 
+// Parse version flag immediately
+if (command === '--version' || command === '-v' || command === 'version') {
+  let ver = '1.4.0';
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(rootDir, 'package.json'), 'utf-8'));
+    ver = pkg.version || ver;
+  } catch (e) {}
+  console.log(`torusguard v${ver}`);
+  process.exit(0);
+}
+
+function parseTargetAndArgs(cliArgs) {
+  let target = '.';
+  const remaining = [];
+  for (let i = 1; i < cliArgs.length; i++) {
+    const a = cliArgs[i];
+    if (a === '--target' || a === '-t' || a === '--root') {
+      if (i + 1 < cliArgs.length) {
+        target = cliArgs[i + 1];
+        i++;
+      }
+    } else if (a.startsWith('--target=') || a.startsWith('--root=')) {
+      target = a.split('=')[1];
+    } else {
+      remaining.push(a);
+    }
+  }
+  if (target === '.' && remaining.length > 0 && !remaining[0].startsWith('-')) {
+    target = remaining.shift();
+  }
+  return { target, remaining };
+}
+
+function compareSemver(a, b) {
+  const pa = a.replace(/^v/, '').split('.').map(n => parseInt(n, 10) || 0);
+  const pb = b.replace(/^v/, '').split('.').map(n => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    const na = pa[i] || 0;
+    const nb = pb[i] || 0;
+    if (na > nb) return 1;
+    if (na < nb) return -1;
+  }
+  return 0;
+}
+
 // ─── ANSI Color Helpers ───────────────────────────────────────────────────────
 const BOLD = '\x1b[1m';
 const DIM = '\x1b[2m';
@@ -151,7 +196,7 @@ function cardDivider(title = '', borderColor = CYAN, double = false) {
   return `  ${borderColor}${left}${h.repeat(71)}${right}${RESET}`;
 }
 
-function cardHeader(title, subtitle = '', version = 'v1.3.5', borderColor = CYAN) {
+function cardHeader(title, subtitle = '', version = 'v1.3.6', borderColor = CYAN) {
   const top = `  ${borderColor}╭${'─'.repeat(71)}╮${RESET}`;
   const bottom = `  ${borderColor}╰${'─'.repeat(71)}╯${RESET}`;
   const empty = `  ${borderColor}│${' '.repeat(71)}│${RESET}`;
@@ -169,12 +214,13 @@ function cardHeader(title, subtitle = '', version = 'v1.3.5', borderColor = CYAN
 
 function printHelp() {
   console.log();
-  console.log(cardHeader('🛡️  T O R U S G U A R D   C L I', 'Autonomous Security Engine for AI-Built Applications', 'v1.3.5'));
+  console.log(cardHeader('🛡️  T O R U S G U A R D   C L I', 'Autonomous Security Engine for AI-Built Applications', 'v1.4.0'));
   console.log(`\n  ${BOLD}Usage:${RESET}  ${GREEN}npx torusguard${RESET} ${WHITE}[command]${RESET} ${GRAY}[options]${RESET}\n`);
 
   console.log(cardBorderTop('Commands'));
   console.log(formatBoxLine(`${GREEN}init${RESET}        Scaffold ${BOLD}.torusguard/${RESET} workspace + unlock slash commands`));
   console.log(formatBoxLine(`${GREEN}status${RESET}      Display active security posture, memory, rules, & stack`));
+  console.log(formatBoxLine(`${GREEN}update${RESET}      Check npm registry for updates (--install to auto-upgrade)`));
   console.log(formatBoxLine(`${GREEN}rules${RESET}       Auto-sync memory to AI IDE rules (.cursorrules, CLAUDE.md)`));
   console.log(formatBoxLine(`${GREEN}memory${RESET}      Manage persistent security memory (export, hook, learn)`));
   console.log(formatBoxLine(`${GREEN}audit${RESET}       Run static AST security scan on target project`));
@@ -189,6 +235,7 @@ function printHelp() {
   console.log(cardDivider('AI & Memory Subcommands'));
   console.log(formatBoxLine(`${WHITE}rules sync${RESET}       ${DIM}[--format all|cursor|claude|agent|windsurf]${RESET}`));
   console.log(formatBoxLine(`${WHITE}report --html${RESET}    ${DIM}[--out <path>] Self-contained visual HTML dashboard${RESET}`));
+  console.log(formatBoxLine(`${WHITE}report --sarif${RESET}   ${DIM}[--out <path>] OASIS SARIF v2.1.0 GitHub Scanning log${RESET}`));
   console.log(formatBoxLine(`${WHITE}memory context${RESET}   ${DIM}[--role auditor|remediator|reviewer] [--file <f>]${RESET}`));
   console.log(formatBoxLine(`${WHITE}memory hook${RESET}      ${DIM}[install|uninstall] Git pre-commit regression hook${RESET}`));
   console.log(formatBoxLine(`${WHITE}memory learn${RESET}     ${DIM}[--commits <range>] Ingest security commit fixes${RESET}`));
@@ -197,6 +244,7 @@ function printHelp() {
   console.log(formatBoxLine(`${GRAY}--target <dir>${RESET}   Target directory to analyze or scaffold ${DIM}(default: .)${RESET}`));
   console.log(formatBoxLine(`${GRAY}--force${RESET}          Overwrite existing workspace and re-scaffold`));
   console.log(formatBoxLine(`${GRAY}--yes, -y${RESET}        Non-interactive auto-approval for patch application`));
+  console.log(formatBoxLine(`${GRAY}--version, -v${RESET}    Display TorusGuard package version`));
   console.log(cardBorderBottom());
 
   console.log(`\n  ${BOLD}AI Chat Commands:${RESET}`);
@@ -218,7 +266,18 @@ if (command === 'help' || command === '--help' || command === '-h') {
 }
 
 if (command === 'status') {
-  const cfgPath = path.join(cwd, '.torusguard', 'config', 'torusguard.json');
+  const { target, remaining } = parseTargetAndArgs(args);
+  const targetDir = path.resolve(cwd, target);
+  const statusScript = path.join(targetDir, '.torusguard', 'scripts', 'status_runner.py');
+  const fallbackStatusScript = path.join(rootDir, '.torusguard', 'scripts', 'status_runner.py');
+  const actualStatusScript = fs.existsSync(statusScript) ? statusScript : fallbackStatusScript;
+
+  if (fs.existsSync(actualStatusScript)) {
+    const proc = spawnSync(pythonCmd, [actualStatusScript, targetDir, ...remaining], { stdio: 'inherit', cwd: targetDir });
+    process.exit(proc.status !== null ? proc.status : 0);
+  }
+
+  const cfgPath = path.join(targetDir, '.torusguard', 'config', 'torusguard.json');
   if (fs.existsSync(cfgPath)) {
     try {
       const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
@@ -250,7 +309,7 @@ if (command === 'status') {
       }
 
       console.log();
-      console.log(cardHeader('🛡️  TORUSGUARD SECURITY POSTURE', '', 'v1.3.5'));
+      console.log(cardHeader('🛡️  TORUSGUARD SECURITY POSTURE', '', 'v1.3.6'));
       console.log(`\n  ${BOLD}▸ Workspace:${RESET}        ${GREEN}${cwd}${RESET}`);
       console.log(`  ${BOLD}▸ Governance:${RESET}       ${GREEN}Full Local Governance (.torusguard/)${RESET}`);
       console.log(`  ${BOLD}▸ Living Report:${RESET}    ${CYAN}security_report.md${RESET}\n`);
@@ -440,111 +499,258 @@ if (command === 'rules') {
 
 // Subcommand: audit
 if (command === 'audit') {
-  const auditScript = path.join(cwd, '.torusguard', 'scripts', 'audit_runner.py');
+  const { target, remaining } = parseTargetAndArgs(args);
+  const targetDir = path.resolve(cwd, target);
+  const auditScript = path.join(targetDir, '.torusguard', 'scripts', 'audit_runner.py');
   const fallbackAuditScript = path.join(rootDir, '.torusguard', 'scripts', 'audit_runner.py');
   const actualAuditScript = fs.existsSync(fallbackAuditScript) ? fallbackAuditScript : auditScript;
 
-  const proc = spawnSync(pythonCmd, [actualAuditScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  const proc = spawnSync(pythonCmd, [actualAuditScript, targetDir, ...remaining], { stdio: 'inherit', cwd: targetDir });
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
 // Subcommand: report
 if (command === 'report') {
-  if (args.includes('--html') || args[1] === 'html') {
-    const htmlScript = path.join(cwd, '.torusguard', 'scripts', 'html_reporter.py');
+  const wantHtml = args.includes('--html') || args[1] === 'html' || args.includes('--out');
+  const wantSarif = args.includes('--sarif') || (!wantHtml && args[1] !== 'html');
+
+  // Resolve target directory (supports --target and --root)
+  const rootIdx = args.indexOf('--root') !== -1 ? args.indexOf('--root') : (args.indexOf('--target') !== -1 ? args.indexOf('--target') : args.indexOf('-t'));
+  let targetRoot = cwd;
+  if (rootIdx !== -1 && args[rootIdx + 1]) {
+    targetRoot = path.resolve(cwd, args[rootIdx + 1]);
+  }
+
+  let exitCode = 0;
+
+  // 1. If SARIF export is requested
+  if (wantSarif) {
+    const sarifScript = path.join(targetRoot, '.torusguard', 'scripts', 'sarif_exporter.py');
+    const fallbackSarifScript = path.join(rootDir, '.torusguard', 'scripts', 'sarif_exporter.py');
+    const actualSarifScript = fs.existsSync(fallbackSarifScript) ? fallbackSarifScript : sarifScript;
+
+    const sarifArgs = [actualSarifScript, '--root', targetRoot];
+    const sarifOutIdx = args.indexOf('--sarif-out');
+    if (sarifOutIdx !== -1 && args[sarifOutIdx + 1]) {
+      sarifArgs.push('--output', args[sarifOutIdx + 1]);
+    } else if (!wantHtml) {
+      const outIdx = args.indexOf('--out');
+      if (outIdx !== -1 && args[outIdx + 1]) {
+        sarifArgs.push('--output', args[outIdx + 1]);
+      }
+    }
+    const runIdIdx = args.indexOf('--run');
+    if (runIdIdx !== -1 && args[runIdIdx + 1]) {
+      sarifArgs.push('--run-id', args[runIdIdx + 1]);
+    }
+
+    const proc = spawnSync(pythonCmd, sarifArgs, { stdio: 'inherit', cwd: targetRoot });
+    if (proc.status !== 0 && proc.status !== null) {
+      exitCode = proc.status;
+    }
+  }
+
+  // 2. If Visual HTML dashboard is requested
+  if (wantHtml) {
+    const htmlScript = path.join(targetRoot, '.torusguard', 'scripts', 'html_reporter.py');
     const fallbackHtmlScript = path.join(rootDir, '.torusguard', 'scripts', 'html_reporter.py');
     const actualHtmlScript = fs.existsSync(fallbackHtmlScript) ? fallbackHtmlScript : htmlScript;
 
-    let pyArgs = [actualHtmlScript];
+    let pyArgs = [actualHtmlScript, '--root', targetRoot];
     const outIdx = args.indexOf('--out');
     if (outIdx !== -1 && args[outIdx + 1]) {
-      pyArgs.push('--out', args[outIdx + 1]);
-    }
-    const rootIdx = args.indexOf('--root') !== -1 ? args.indexOf('--root') : args.indexOf('--target');
-    if (rootIdx !== -1 && args[rootIdx + 1]) {
-      pyArgs.push('--root', args[rootIdx + 1]);
+      pyArgs.push('--out', path.resolve(cwd, args[outIdx + 1]));
+    } else {
+      pyArgs.push('--out', path.join(targetRoot, 'report.html'));
     }
     if (args.includes('--json')) {
       pyArgs.push('--json');
     }
 
-    const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd });
-    process.exit(proc.status !== null ? proc.status : 0);
-  } else {
-    const sarifScript = path.join(cwd, '.torusguard', 'scripts', 'sarif_exporter.py');
-    const fallbackSarifScript = path.join(rootDir, '.torusguard', 'scripts', 'sarif_exporter.py');
-    const actualSarifScript = fs.existsSync(fallbackSarifScript) ? fallbackSarifScript : sarifScript;
-
-    const proc = spawnSync(pythonCmd, [actualSarifScript, ...args.slice(1)], { stdio: 'inherit', cwd });
-    process.exit(proc.status !== null ? proc.status : 0);
+    const proc = spawnSync(pythonCmd, pyArgs, { stdio: 'inherit', cwd: targetRoot });
+    if (proc.status !== 0 && proc.status !== null) {
+      exitCode = proc.status;
+    }
   }
+
+  process.exit(exitCode);
 }
 
 // Subcommand: harden
 if (command === 'harden') {
-  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'harden_runner.py');
+  const { target, remaining } = parseTargetAndArgs(args);
+  const targetDir = path.resolve(cwd, target);
+  const scriptPath = path.join(targetDir, '.torusguard', 'scripts', 'harden_runner.py');
   const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'harden_runner.py');
   const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
 
-  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  const proc = spawnSync(pythonCmd, [actualScript, targetDir, ...remaining], { stdio: 'inherit', cwd: targetDir });
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
 // Subcommand: apply
 if (command === 'apply') {
-  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'apply_runner.py');
+  const { target, remaining } = parseTargetAndArgs(args);
+  const targetDir = path.resolve(cwd, target);
+  const scriptPath = path.join(targetDir, '.torusguard', 'scripts', 'apply_runner.py');
   const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'apply_runner.py');
   const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
 
-  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  const proc = spawnSync(pythonCmd, [actualScript, targetDir, ...remaining], { stdio: 'inherit', cwd: targetDir });
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
 // Subcommand: rollback
 if (command === 'rollback') {
-  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'apply_runner.py');
+  const { target, remaining } = parseTargetAndArgs(args);
+  const targetDir = path.resolve(cwd, target);
+  const scriptPath = path.join(targetDir, '.torusguard', 'scripts', 'apply_runner.py');
   const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'apply_runner.py');
   const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
 
-  const proc = spawnSync(pythonCmd, [actualScript, '--rollback', ...args.slice(1)], { stdio: 'inherit', cwd });
+  const proc = spawnSync(pythonCmd, [actualScript, targetDir, '--rollback', ...remaining], { stdio: 'inherit', cwd: targetDir });
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
 // Subcommand: recheck / verify
 if (command === 'recheck' || command === 'verify') {
-  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'recheck_runner.py');
+  const { target, remaining } = parseTargetAndArgs(args);
+  const targetDir = path.resolve(cwd, target);
+  const scriptPath = path.join(targetDir, '.torusguard', 'scripts', 'recheck_runner.py');
   const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'recheck_runner.py');
   const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
 
-  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  const proc = spawnSync(pythonCmd, [actualScript, targetDir, ...remaining], { stdio: 'inherit', cwd: targetDir });
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
 // Subcommand: recipes
 if (command === 'recipes') {
-  const scriptPath = path.join(cwd, '.torusguard', 'scripts', 'recipes_runner.py');
+  const { target, remaining } = parseTargetAndArgs(args);
+  const targetDir = path.resolve(cwd, target);
+  const scriptPath = path.join(targetDir, '.torusguard', 'scripts', 'recipes_runner.py');
   const fallbackScript = path.join(rootDir, '.torusguard', 'scripts', 'recipes_runner.py');
   const actualScript = fs.existsSync(fallbackScript) ? fallbackScript : scriptPath;
 
-  const proc = spawnSync(pythonCmd, [actualScript, ...args.slice(1)], { stdio: 'inherit', cwd });
+  const proc = spawnSync(pythonCmd, [actualScript, targetDir, ...remaining], { stdio: 'inherit', cwd: targetDir });
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
 // Subcommand: init (scaffold workspace)
 if (command === 'init') {
+  const { target, remaining } = parseTargetAndArgs(args);
+  const targetDir = path.resolve(cwd, target);
   const localBootstrap = path.join(rootDir, 'skills', 'torusguard', 'bootstrap.py');
   const localInstall = path.join(rootDir, 'install.py');
   const scriptToRun = fs.existsSync(localBootstrap) ? localBootstrap : localInstall;
 
-  const scriptArgs = [scriptToRun, '--full-commands', ...args.slice(1)];
+  const scriptArgs = [scriptToRun, '--full-commands', '--target', targetDir, ...remaining];
   const proc = spawnSync(pythonCmd, scriptArgs, {
     stdio: 'inherit',
-    cwd: cwd,
+    cwd: targetDir,
   });
   process.exit(proc.status !== null ? proc.status : 0);
 }
 
+// Subcommand: update
+if (command === 'update') {
+  const https = require('https');
+  const pkgJsonPath = path.join(rootDir, 'package.json');
+  let currentVersion = '1.4.0';
+  try {
+    if (fs.existsSync(pkgJsonPath)) {
+      currentVersion = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8')).version || currentVersion;
+    }
+  } catch (e) {}
+
+  console.log();
+  console.log(cardHeader('🛡️  TORUSGUARD UPDATE CHECK', 'Package Distribution & Registry Verifier', `v${currentVersion}`));
+  console.log(`\n  ${DIM}Checking npm registry for updates...${RESET}`);
+
+  const autoInstall = args.includes('--install') || args.includes('-i') || args.includes('--yes') || args.includes('-y');
+
+  function printUpdateOffline(reason) {
+    console.log();
+    console.log(cardBorderTop('Offline / Registry Unreachable', YELLOW));
+    console.log(formatBoxLine(`Current:    ${WHITE}v${currentVersion}${RESET}`, 67, '│', YELLOW));
+    console.log(formatBoxLine(`Notice:     ${DIM}${reason}${RESET}`, 67, '│', YELLOW));
+    console.log(formatBoxLine(`Manual:     ${BOLD}${CYAN}npm update torusguard${RESET} or ${BOLD}${CYAN}npm i -g torusguard@latest${RESET}`, 67, '│', YELLOW));
+    console.log(cardBorderBottom(YELLOW));
+    console.log();
+    process.exit(0);
+  }
+
+  const req = https.get('https://registry.npmjs.org/torusguard/latest', {
+    headers: { 'User-Agent': `torusguard-cli/${currentVersion}` },
+    timeout: 6000
+  }, (res) => {
+    let raw = '';
+    res.on('data', chunk => raw += chunk);
+    res.on('end', () => {
+      try {
+        const data = JSON.parse(raw);
+        const latestVersion = data.version;
+        if (!latestVersion) {
+          printUpdateOffline('No version field returned in npm registry response');
+          return;
+        }
+
+        const isNewer = compareSemver(latestVersion, currentVersion) > 0;
+        console.log();
+        console.log(cardBorderTop('Version Telemetry', CYAN));
+        console.log(formatBoxLine(`Installed Version: ${WHITE}v${currentVersion}${RESET}`));
+        console.log(formatBoxLine(`Latest on NPM:     ${BOLD}${GREEN}v${latestVersion}${RESET}`));
+        console.log(cardBorderBottom(CYAN));
+        console.log();
+
+        if (isNewer) {
+          console.log(cardBorderTop('Update Available', YELLOW, true));
+          console.log(formatBoxLine(`${YELLOW}A new version of TorusGuard is available!${RESET}`, 67, '║', YELLOW));
+          console.log(formatBoxLine(`Global:  ${BOLD}${WHITE}npm install -g torusguard@latest${RESET}`, 67, '║', YELLOW));
+          console.log(formatBoxLine(`Local:   ${BOLD}${WHITE}npm install torusguard@latest${RESET}`, 67, '║', YELLOW));
+          console.log(cardBorderBottom(YELLOW, true));
+          console.log();
+
+          if (autoInstall) {
+            console.log(`  ${CYAN}Auto-installing latest version via npm...${RESET}`);
+            const npmProc = spawnSync('npm', ['install', '-g', 'torusguard@latest'], { stdio: 'inherit' });
+            if (npmProc.status === 0) {
+              console.log(`\n  ${GREEN}✔ Successfully upgraded TorusGuard to v${latestVersion}!${RESET}\n`);
+            } else {
+              console.error(`\n  ${RED}✖ Failed to auto-install update. Run: npm install -g torusguard@latest${RESET}\n`);
+            }
+          } else {
+            console.log(`  ${DIM}Tip: Run with ${CYAN}npx torusguard update --install${DIM} to auto-upgrade.${RESET}\n`);
+          }
+        } else {
+          console.log(cardBorderTop('Status: Up To Date', GREEN, true));
+          console.log(formatBoxLine(`${GREEN}✔ TorusGuard is up to date (v${currentVersion})${RESET}`, 67, '║', GREEN));
+          console.log(cardBorderBottom(GREEN, true));
+          console.log();
+        }
+        process.exit(0);
+      } catch (err) {
+        printUpdateOffline(err.message);
+      }
+    });
+  });
+
+  req.on('error', (err) => printUpdateOffline(err.message));
+  req.on('timeout', () => {
+    req.destroy();
+    printUpdateOffline('npm registry request timed out (6000ms)');
+  });
+}
+
 // Unknown command fallback
-console.error(`\n  ${RED}✖ Unknown command:${RESET} ${WHITE}${command}${RESET}`);
-console.error(`  Run ${GREEN}npx torusguard help${RESET} for available commands.\n`);
-process.exit(1);
+const KNOWN_COMMANDS = new Set([
+  'init', 'status', 'rules', 'memory', 'diff-guard', 'audit',
+  'report', 'harden', 'apply', 'rollback', 'recheck', 'verify',
+  'recipes', 'update', 'help', '--help', '-h', '--version', '-v', 'version'
+]);
+
+if (!KNOWN_COMMANDS.has(command)) {
+  console.error(`\n  ${RED}✖ Unknown command:${RESET} ${WHITE}${command}${RESET}`);
+  console.error(`  Run ${GREEN}npx torusguard help${RESET} for available commands.\n`);
+  process.exit(1);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "1.3.5",
+  "version": "1.4.0",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {
@@ -17,8 +17,12 @@
   "scripts": {
     "test": "python harness/runner.py",
     "init": "node bin/torusguard.js init",
+    "status": "node bin/torusguard.js status",
     "audit": "node bin/torusguard.js audit",
-    "status": "node bin/torusguard.js status"
+    "harden": "node bin/torusguard.js harden",
+    "apply": "node bin/torusguard.js apply",
+    "recipes": "node bin/torusguard.js recipes",
+    "update": "node bin/torusguard.js update"
   },
   "keywords": [
     "security",

package/skills/torusguard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: torusguard
 description: Universal autonomous security engine: 74 canonical rules across 18 families, polyglot stack detection across 16+ languages, Ponytail remediation bounds (<=35 add, <=25 del), standardized 75-column terminal UI, living security_report.md ground-truth ledger, SARIF v2.1.0 exports, and persistent security memory context.
-version: 1.3.5
+version: 1.3.6
 ---
 
 # TorusGuard Master Security Engine & Command Router

package/skills/torusguard/bootstrap.py

@@ -135,7 +135,7 @@ def print_header():
     print(f"""
   {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
   {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
-  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v1.3.0{RESET}   {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v1.4.0{RESET}   {CYAN}│{RESET}
   {CYAN}│{RESET}   {DIM}Autonomous Security Engine for AI-Built Applications{RESET}               {CYAN}│{RESET}
   {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
   {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
@@ -220,7 +220,7 @@ def print_already_initialized(target_root, cfg):
 
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.3.0')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.4.0')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}
@@ -228,7 +228,7 @@ def print_already_initialized(target_root, cfg):
 """)
 
 
-def scaffold_workspace(target_root=None, force=False, full_commands=False):
+def scaffold_workspace(target_root=None, force=False, full_commands=False, template=None, run_audit=False):
     """Scaffold the .torusguard workspace into the target project root."""
     target_root = Path(target_root or find_project_root()).resolve()
     torusguard_target = target_root / ".torusguard"
@@ -348,13 +348,18 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
             "cards": []
         }, indent=2), encoding="utf-8")
 
-    # Ensure target project root .gitignore excludes .torusguard/memory/
+    # Ensure target project root .gitignore excludes .torusguard/memory/ and report.html
     root_gitignore = target_root / ".gitignore"
     if root_gitignore.exists():
         try:
             gi_content = root_gitignore.read_text(encoding="utf-8")
+            to_add = []
             if ".torusguard/memory" not in gi_content:
-                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard security memory (local only)\n.torusguard/memory/\n", encoding="utf-8")
+                to_add.append(".torusguard/memory/")
+            if "report.html" not in gi_content:
+                to_add.append("report.html")
+            if to_add:
+                root_gitignore.write_text(gi_content.rstrip() + "\n\n# TorusGuard local artifacts\n" + "\n".join(to_add) + "\n", encoding="utf-8")
         except Exception:
             pass
 
@@ -374,12 +379,26 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
         except Exception:
             detected_stack = None
 
+    TEMPLATE_MAP = {
+        "golang": {"language": "Go", "framework": "Gin/Fiber", "data_layer": "database/sql"},
+        "go": {"language": "Go", "framework": "Gin/Fiber", "data_layer": "database/sql"},
+        "nextjs": {"language": "TypeScript", "framework": "Next.js", "data_layer": "Prisma ORM"},
+        "fastapi": {"language": "Python", "framework": "FastAPI", "data_layer": "SQLAlchemy"},
+        "express": {"language": "JavaScript", "framework": "Express", "data_layer": "Mongoose"},
+        "django": {"language": "Python", "framework": "Django", "data_layer": "Django ORM"},
+        "react": {"language": "JavaScript/TypeScript", "framework": "React / Vite", "data_layer": "Supabase"}
+    }
+    if template and template.lower() in TEMPLATE_MAP:
+        detected_stack = TEMPLATE_MAP[template.lower()]
+
     config_file = torusguard_target / "config" / "torusguard.json"
     if config_file.exists():
         try:
             with open(config_file, "r", encoding="utf-8") as f:
                 cfg = json.load(f)
-            if detected_stack and detected_stack.get("framework") != "None":
+            if template and template.lower() in TEMPLATE_MAP:
+                cfg["detected_stack"] = TEMPLATE_MAP[template.lower()]
+            elif detected_stack and detected_stack.get("framework") != "None":
                 cfg["detected_stack"] = {
                     "language": detected_stack.get("language"),
                     "framework": detected_stack.get("framework"),
@@ -511,15 +530,40 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
 
     # ── Success Card ────────────────────────────────────────────────────────
     print_success_card()
+
+    # ── Optional Immediate Audit ────────────────────────────────────────────
+    if run_audit:
+        audit_script = torusguard_target / "scripts" / "audit_runner.py"
+        if audit_script.is_file():
+            print(f"\n  {CYAN}▸ Running immediate baseline security audit (--audit)...{RESET}\n")
+            try:
+                import importlib.util
+                spec = importlib.util.spec_from_file_location("audit_runner", str(audit_script))
+                if spec and spec.loader:
+                    ar_mod = importlib.util.module_from_spec(spec)
+                    spec.loader.exec_module(ar_mod)
+                    if hasattr(ar_mod, "execute_audit"):
+                        ar_mod.execute_audit(target_root)
+            except Exception as e:
+                print(f"  {YELLOW}⚠ Immediate audit notice: {e}{RESET}")
+
     return True
 
 
 if __name__ == "__main__":
     parser = argparse.ArgumentParser(description="TorusGuard Autonomous Workspace Bootstrapper")
-    parser.add_argument("--target", type=str, help="Target project root directory")
+    parser.add_argument("--target", "-t", type=str, help="Target project root directory")
     parser.add_argument("--force", action="store_true", help="Force overwrite existing workspace")
     parser.add_argument("--full-commands", action="store_true", help="Unlock and register all 11 individual slash commands")
+    parser.add_argument("--template", choices=["golang", "go", "nextjs", "fastapi", "express", "django", "react"], help="Pre-configure target framework stack template")
+    parser.add_argument("--audit", action="store_true", help="Execute immediate baseline audit post-initialization")
     args = parser.parse_args()
 
-    success = scaffold_workspace(target_root=args.target, force=args.force, full_commands=args.full_commands)
+    success = scaffold_workspace(
+        target_root=args.target,
+        force=args.force,
+        full_commands=args.full_commands,
+        template=args.template,
+        run_audit=args.audit
+    )
     sys.exit(0 if success else 1)