torusguard 1.3.5 → 1.4.0

package/skills/torusguard/payload/.manifest.json

@@ -142,25 +142,26 @@
   "schemas/remediation.schema.json": "544904239f871dec9552973e01e09dc1f40dbb8330f20d98c319f3b24031d630",
   "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
   "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
-  "scripts/apply_runner.py": "3863c894d0a57f4a71206dca802b26755f361958f085b4636f112350bde221a2",
-  "scripts/audit_runner.py": "bdf4784ebec526a6f980879ce80aa7693ad2a8268fd4fa0334130ac3c1a7b22a",
+  "scripts/apply_runner.py": "b145a68a4bc10fcacb853f972aee81fa3607e32d282b2b850c5a63d8e72da890",
+  "scripts/audit_runner.py": "bc1e06ea5153ae326c4ad1de5d0cbb9503e618186623bea7cb8bb64d7b7b05ec",
   "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
   "scripts/finding_scorer.py": "a5315be6ee256c01c4539da3d1905ebc8d0840a356b83c55f9f6f2654a9f0c60",
-  "scripts/harden_runner.py": "c7a8074eaa9f6ebe61a17c553fd07bb543efcb1d5b4e01f24fd856367c048a70",
-  "scripts/html_reporter.py": "30982f279b501834009159d7142624c973f36f2517b884a0ce4868d7ca42d1f3",
-  "scripts/manifest_builder.py": "c0137927789a9e40a08243e630ac3c6990beb1b87807934e98906c8ad0b99a97",
+  "scripts/harden_runner.py": "5d5a40029c088ccb66790a9b0128bdefcd35883ef1dac78088ceb9531392a8f1",
+  "scripts/html_reporter.py": "655c57be39e13c177db8842ef471664e5853f3e43b9f2a63e590df40ff9c16cb",
+  "scripts/manifest_builder.py": "18db6979b341a87e9bf38fe06525365d12b07d532c0dbfd2ac3ef0f539dc1f6f",
   "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
   "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
-  "scripts/recheck_runner.py": "0c51d91b37bd3babf228b4b12b0e9d65953c8eae2e2e46596a1d42af8d057f71",
-  "scripts/recipes_runner.py": "cd9ffba5fed53057aac56241dcbfda1e68248f323e51bbde3fe711634b099600",
-  "scripts/report_sync.py": "278666954207a9eef1d479872546b99c16a8ded46bd3238ac9a09e2856b69813",
+  "scripts/recheck_runner.py": "89e93fcc6843493d7e5f0bf97065dbdb40106273a00e07f903250665ca25f6fb",
+  "scripts/recipes_runner.py": "090c06ef0de3c640a111c5646837233ceeaca494b161bd5edc630cc1371dca0e",
+  "scripts/report_sync.py": "5ebef684690200694a53af30db850d9808d03ec710ed21ef75c4de52b5e5217c",
   "scripts/rules_sync.py": "4101b2ca8036ff4f468800b32a8d08898e8640a74d14124af53d454706a62d3a",
   "scripts/run_manager.py": "b738ff70879e46547d32fac6befc61de9599f676411384280fb9819ea3ad7035",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
-  "scripts/sarif_exporter.py": "f060cfaf91dfb6b8e9c4036e354704204dfa8054720501f0ce2fadae0fb89540",
-  "scripts/stack_detect.py": "3f755d9353d5a8fd33a25486d6af0101a1d1b0c2f70f5a28bb2af2fe6050adc2",
-  "scripts/term_ui.py": "4870714add208f3da53c76a1250b1ceb8c104c0b708384e73427210dd0b50e6a",
-  "skills/torusguard/SKILL.md": "3e63aaa90f5453ba2b7ea79ed6afbd64985fb083d198a34d552857abb2f183f4",
+  "scripts/sarif_exporter.py": "86700765212adb3ab590ca72614bf3ad4ce7ce60e3193f7f3bd1a04d34d10f6e",
+  "scripts/stack_detect.py": "c05a1ade4c8692025476bf7ea080a8f07c92e5d8e9a04f94c1654386352ffbdc",
+  "scripts/status_runner.py": "4c358c91950c7874bcc6a5f23f2d3fda62b0752efcf6c6b658adf02ed77c7752",
+  "scripts/term_ui.py": "ca69398f85c86fe89526d6334b3ee866c890273997351113c3cc1765b7bd20c3",
+  "skills/torusguard/SKILL.md": "4d5b8e43fa3c09e5e1079cbc3e2184654219a2c47b2272db394da749969318f8",
   "skills/torusguard/bootstrap.py": "3d946f388cb4befa739c9d3b1404255d9a8ea5770ebbb79e5a1b9839589e9bc7",
   "skills/torusguard/references/auth-and-sessions.md": "c3e4b9600cb53fc28c993922dc880accbec5783ac90d5ee98d63b52762d19525",
   "skills/torusguard/references/business-logic-and-abuse.md": "58e87df2864d468af70c1ff39f5d540c687fa846b671457f85046ab2065fe99c",
@@ -190,32 +191,46 @@
   "skills/torusguard/references/ssrf-and-outbound-requests.md": "5ce59ebada2f227b3e0a27f612b59a47801c152d24d2d4d533bee435f32b1b05",
   "skills/torusguard/references/webhook-security.md": "8fd27cce1562a3dfda8d4fae29bef7cfd47a65c1e89c6868cdbcac161ccd2be8",
   "skills/torusguard/references/websocket-security.md": "b5315e49432184c006664436d689d426b7322fc6fbbba2899a9ea5e5bab74c92",
-  "skills/torusguard-apply/SKILL.md": "453e1099ce3ae2184ae7bba34156cdafc6437976283e3839bef1c014bbc4bd9a",
-  "skills/torusguard-audit/SKILL.md": "b8e2d0058bce604a00fee93055112b3872290373e8b90d95b3414ce2c33bf9d9",
-  "skills/torusguard-authorize/SKILL.md": "67051f2db03f1957a63c10e6d39c963561c9c93f2c0c2e3289e936fe85b70da5",
-  "skills/torusguard-exploit-check/SKILL.md": "7b040abfc10e6aedd56a432247b5c36c4872966b2bf363e56c5ae393db825e23",
-  "skills/torusguard-full/SKILL.md": "f225de0e29d46f96fc0735e310394313dfecc987be430af14504498fc90847de",
-  "skills/torusguard-harden/SKILL.md": "11039ce21f6990d7b15c176e0aefb5ee6d7631ab083391e3442c1020d5cae956",
-  "skills/torusguard-init/SKILL.md": "89518de3585f4016b1e2ff6400979dcd7362c4b4f93fbdabd72e3ff4a59ba4d5",
-  "skills/torusguard-recheck/SKILL.md": "d839251dbe5571769da0d4ae3ff2ef18533ee96f87bf460b44bb51279866be22",
-  "skills/torusguard-report/SKILL.md": "f361f2e61141a4d0cea891da827146c3fce42b8b55c81d60d0ac999312e4d6cd",
-  "skills/torusguard-status/SKILL.md": "e14ab6276207bf4921749ec38a4c4b0bf482e84010a4e1b7c2b6f8ce7804f047",
-  "skills/torusguard-verify/SKILL.md": "f9aff4ca514e72883ac630245b6f3b62e035a9e54bdbe69ae8edb59bd9153691",
-  "skills/torusguard-web-validate/SKILL.md": "006d638d9d6f7ee5f9eb880704955f01eff1c3b9bb3baa8ac900fd807f6f589a",
+  "skills/torusguard-apply/SKILL.md": "4cdd01d8159fc5f7519a806526a119e6d67e41b8af195de018b05d6af09acb12",
+  "skills/torusguard-audit/SKILL.md": "0065336b125cfa8ec766dcec585bce4bbac66b3b063c174b7183dffef18e090d",
+  "skills/torusguard-authorize/SKILL.md": "8694e6cef71cbeb6605fed33dd1f24b74352541069e54de7c3f48c9676e9aa3a",
+  "skills/torusguard-exploit-check/SKILL.md": "87e0e01f28f3efea8dbe81790abaceb845a1290c75a6a16bbd256251cd0539a9",
+  "skills/torusguard-full/SKILL.md": "35f8b38b08fef5a09504312ef3e54921b1f8f31f197bbe2af1474bcce2e83e1c",
+  "skills/torusguard-harden/SKILL.md": "4332761e5454a504176eebbba2d4c585bcf066c8046c014cebc0f5771379c089",
+  "skills/torusguard-init/SKILL.md": "03e599a5dad4262396e6b1a75859f76739b0b1480d8cc64544296106da903dfc",
+  "skills/torusguard-recheck/SKILL.md": "72a0a79b29dcc7f7ae054f00c53e005bc92778f2c6bf3ad828f6391e859d9c1c",
+  "skills/torusguard-report/SKILL.md": "6dc62fb2c9e2986827a802b7cabf41ce41d00a47573524a4bf1642a8d8e2249e",
+  "skills/torusguard-status/SKILL.md": "2ad72e5d317e1d6fe0606f6926b1721dc01ba98b5daa2bfaa90bdd953a67bdf7",
+  "skills/torusguard-verify/SKILL.md": "810c31ba9adc1b410b22eb8503f266be2d51e260a9c6828fd2938e2774e5baa7",
+  "skills/torusguard-web-validate/SKILL.md": "3e02d9734402e8fbc86a0b5c2fdac945ef4fc9d60ba1b992197b1373427ad16e",
   "templates/audit-report.template.md": "71149dd05b01a74287a47781fdc71fd2d1b4b70337da303bf78767d0410a6c90",
   "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
   "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
-  "workflows/apply.md": "fde7e879db5879bc6c8e67b5bd40473065688bba91149a01f66ad4739f4c8443",
-  "workflows/audit.md": "b02a7d2536c81b35ab4519b7f9eda3396d08f09da581ef299dc8fed83b4c082d",
-  "workflows/authorize.md": "71b14c2ffa24b1ad511d019a7da86854bf1bf94c282f563e05e9ad3b8493e8ca",
-  "workflows/exploit-check.md": "01c0a51e4b12a9dbb1d4f2b28d0bb495d92f95b786f5f1df59467b8fc6c61855",
-  "workflows/harden.md": "e68a78c47a2c4ec1d65adb08104d2fa16eb0c4530cf9b78400fd147f2076fb95",
-  "workflows/init.md": "f71438745a7e8d59dcf2e1089f7c5ccf2340e7909e56e1257b24c8ca79353162",
-  "workflows/memory.md": "faf93f39917fb6d0da23f9794e8337e643fd0a240cc46ca702fef84e02f5b867",
-  "workflows/recheck.md": "426a719a9c4233a653daa8fe0265370492f3a17a422517f7930549c991d25c93",
-  "workflows/report.md": "2aad2cbf2ffc781355e1186bb28a29b3da5efbacc57c8f44c9976aa635f0b120",
-  "workflows/status.md": "f3445bbf90402df819472180d5ae251a17b4f491ea3402d74f134bf55c2bf570",
-  "workflows/verify.md": "48f37892d329287059492ffaebf7022253fd5515a0a1a3253799e5cea765a21a",
-  "workflows/web-validate.md": "4d81294432e4d06e6c21db9a517b7cf1052744df3d821ed947a7751acb4fe39f"
+  "workflows/apply.md": "67e1002fc6e9d68e0c7d871c40b6f3c3b9c3919c8e02106a579882729c0f6b9f",
+  "workflows/audit.md": "eac9102ca88d53f71da474cd55717d431fd9c3b08c66d0760da9b53a659cf89a",
+  "workflows/authorize.md": "28ca58cfc656e956f7cec8160f2aadc152abcde3eb5ad5588df149007afb0df8",
+  "workflows/exploit-check.md": "41e77afe912be9266c5bc1e00fd796baff22a67973eb6e86d196d34f4d7bdfa4",
+  "workflows/harden.md": "7d92132973ff867b99e0425e3aee3c4e91868cb5193ec601069af2e857b6697f",
+  "workflows/init.md": "611418577ff9d5719df459f56b3fa53b91eb3717b02c4b4e5e86ed483bed3bfa",
+  "workflows/memory.md": "8ad2ec154176e2540c2859a28eff9f7c2dbca0217aa29d0f4aa88b87c43f8bef",
+  "workflows/recheck.md": "42eecc3ba194564d48a6a88d8003e86cafe003503e887dc565314d4aa558e8fd",
+  "workflows/recipes.md": "300c1fed0167e1a299fcd33c07db05630116b18a71ec2513c385862bba0f179b",
+  "workflows/report.md": "ecbd67bfa95bde3c0f51e06aac6fad70d5989b0be82245116cd7ba367f378a4c",
+  "workflows/status.md": "7f07e726bbb0488e48b718c2f36971634b1422bc2ddfbb381eb3e1ea67c1cfbf",
+  "workflows/torusguard-apply.md": "67e1002fc6e9d68e0c7d871c40b6f3c3b9c3919c8e02106a579882729c0f6b9f",
+  "workflows/torusguard-audit.md": "eac9102ca88d53f71da474cd55717d431fd9c3b08c66d0760da9b53a659cf89a",
+  "workflows/torusguard-authorize.md": "28ca58cfc656e956f7cec8160f2aadc152abcde3eb5ad5588df149007afb0df8",
+  "workflows/torusguard-exploit-check.md": "41e77afe912be9266c5bc1e00fd796baff22a67973eb6e86d196d34f4d7bdfa4",
+  "workflows/torusguard-harden.md": "7d92132973ff867b99e0425e3aee3c4e91868cb5193ec601069af2e857b6697f",
+  "workflows/torusguard-init.md": "611418577ff9d5719df459f56b3fa53b91eb3717b02c4b4e5e86ed483bed3bfa",
+  "workflows/torusguard-recheck.md": "42eecc3ba194564d48a6a88d8003e86cafe003503e887dc565314d4aa558e8fd",
+  "workflows/torusguard-recipes.md": "300c1fed0167e1a299fcd33c07db05630116b18a71ec2513c385862bba0f179b",
+  "workflows/torusguard-report.md": "ecbd67bfa95bde3c0f51e06aac6fad70d5989b0be82245116cd7ba367f378a4c",
+  "workflows/torusguard-status.md": "7f07e726bbb0488e48b718c2f36971634b1422bc2ddfbb381eb3e1ea67c1cfbf",
+  "workflows/torusguard-verify.md": "6412e123a9346240e5ba898a0da73d3409d9a215d6e8f202ab2eb5719b663731",
+  "workflows/torusguard-web-validate.md": "3b2a3d02b69469539b4a48ed3bd355362927cc21470dbcdeccba564a9e68a371",
+  "workflows/torusguard.md": "4b5da6d38dae6be277bd52782121cdb181a75f1400068041310ca69deae89589",
+  "workflows/verify.md": "6412e123a9346240e5ba898a0da73d3409d9a215d6e8f202ab2eb5719b663731",
+  "workflows/web-validate.md": "3b2a3d02b69469539b4a48ed3bd355362927cc21470dbcdeccba564a9e68a371"
 }

package/skills/torusguard/payload/scripts/apply_runner.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-TorusGuard Governed Patch Application & Snapshot Engine (v1.3.5)
+TorusGuard Governed Patch Application & Snapshot Engine (v1.3.6)
 Interactive Human Gate authorization, pre-apply .bak rollback snapshots,
 atomic patch application, and Golden Fix Recipe distillation into persistent memory.
 Strict 75-column terminal UI formatting.
@@ -58,7 +58,7 @@ def box_line(content: str, width: int = 67, border: str = "│", border_color: s
         return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
     return f"  {border_color}{border}{RESET}  {content}"
 
-def box_header(title: str, subtitle: str = "", version: str = "v1.3.5", border_color: str = CYAN) -> str:
+def box_header(title: str, subtitle: str = "", version: str = "v1.4.0", border_color: str = CYAN) -> str:
     if term_ui:
         return term_ui.card_header(title, subtitle, version, border_color)
     return f"=== {title} ({version}) ==="
@@ -81,6 +81,35 @@ def find_latest_audit_run(runs_dir: Path) -> Optional[Path]:
     return runs[0] if runs else None
 
 
+def list_snapshots(target_root: Path) -> None:
+    """Display historical pre-apply backup snapshots."""
+    snapshots_base = target_root / ".torusguard" / "snapshots"
+    print()
+    print(box_header("🛡️  TORUSGUARD SNAPSHOT LEDGER", "Pre-Apply Safety Snapshots (.bak)", "v1.4.0"))
+    print()
+    if not snapshots_base.is_dir():
+        print(f"  {YELLOW}ℹ No snapshots directory found at:{RESET} {snapshots_base}\n")
+        return
+    snapshots = sorted([d for d in snapshots_base.iterdir() if d.is_dir()], key=lambda p: p.stat().st_mtime, reverse=True)
+    if not snapshots:
+        print(f"  {YELLOW}ℹ No rollback snapshots captured yet.{RESET}\n")
+        return
+    print(border_top(f"Available Snapshots ({len(snapshots)})"))
+    for s in snapshots:
+        bak_files = list(s.rglob("*.bak"))
+        total_bytes = sum(f.stat().st_size for f in bak_files)
+        kb_str = f"{total_bytes / 1024:.1f} KB"
+        try:
+            mtime_dt = datetime.datetime.fromtimestamp(s.stat().st_mtime, tz=IST)
+            time_str = mtime_dt.strftime("%Y-%m-%d %H:%M:%S IST")
+        except Exception:
+            time_str = "Captured"
+        print(box_line(f"{GREEN}{s.name}{RESET} ({len(bak_files)} files · {kb_str})"))
+        print(box_line(f"  └─ {DIM}Timestamp: {time_str}{RESET}"))
+    print(border_bottom())
+    print(f"\n  {DIM}To restore any snapshot, run: {CYAN}npx torusguard rollback --run <snapshot-name>{RESET}\n")
+
+
 def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> None:
     """Restore all target files from the pre-apply backup snapshots."""
     snapshots_base = target_root / ".torusguard" / "snapshots"
@@ -108,8 +137,14 @@ def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> Non
         shutil.copy2(bak_file, dest_file)
         restored_files.append(orig_rel)
 
+    try:
+        import report_sync
+        report_sync.record_rollback_results(target_root, restored_files, snapshot_dir.name)
+    except Exception:
+        pass
+
     print()
-    print(box_header("🛡️  TORUSGUARD ROLLBACK RESTORATION", "Restored original files from pre-apply snapshot", "v1.3.5"))
+    print(box_header("🛡️  TORUSGUARD ROLLBACK RESTORATION", "Restored original files from pre-apply snapshot", "v1.4.0"))
     print()
 
     print(border_top("Rollback Snapshot Restored"))
@@ -122,7 +157,7 @@ def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> Non
     sys.exit(0)
 
 
-def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_approve: bool = False) -> Dict[str, Any]:
+def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_approve: bool = False, diff_only: bool = False, selective: bool = False, verify_post_apply: bool = False) -> Dict[str, Any]:
     runs_dir = target_root / ".torusguard" / "runs"
     if run_id_arg:
         run_folder = runs_dir / run_id_arg
@@ -138,7 +173,7 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     bundle_meta_files = list(bundles_dir.glob("*/metadata.json")) if bundles_dir.is_dir() else []
     if not bundle_meta_files:
         print()
-        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.5"))
+        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.4.0"))
         print()
         print(f"  {YELLOW}ℹ Zero candidate remediation bundles found in run: {run_folder.name}{RESET}")
         print(f"  {GRAY}The findings in this run require manual review or AI-assisted remediation.{RESET}\n")
@@ -157,13 +192,46 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
         except Exception:
             pass
 
+    # Diff Preview Mode
+    if diff_only:
+        print()
+        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH DIFF PREVIEW", "Dry-Run Unified Diff Inspection (No Files Modified)", "v1.4.0"))
+        print()
+        print(border_top(f"Candidate Patches ({len(bundles)})"))
+        for idx, b in enumerate(bundles, 1):
+            rule_id = b.get("rule_id", "TG-SEC")
+            rel_path = b.get("target_file", "")
+            line_no = b.get("line_number", 1)
+            diff = b.get("proposed_diff", "")
+            desc = b.get("what_should_change", "")
+            print(f"  {YELLOW}─── [{idx}/{len(bundles)}] Candidate Patch: [{rule_id}] on {rel_path}:{line_no} ───{RESET}")
+            print(f"  Strategy: {WHITE}{desc}{RESET}")
+            print(f"  Ponytail: {GREEN}+{b.get('additions', 0)} / -{b.get('deletions', 0)}{RESET}\n")
+            for dline in diff.splitlines()[:16]:
+                if dline.startswith("+") and not dline.startswith("+++"):
+                    print(f"    {GREEN}{dline}{RESET}")
+                elif dline.startswith("-") and not dline.startswith("---"):
+                    print(f"    {RED}{dline}{RESET}")
+                elif dline.startswith("@"):
+                    print(f"    {CYAN}{dline}{RESET}")
+                else:
+                    print(f"    {DIM}{dline}{RESET}")
+            print()
+        print(border_bottom())
+        print(f"\n  {DIM}To apply these patches to disk, run: {CYAN}npx torusguard apply{RESET} or {CYAN}npx torusguard apply --yes{RESET}\n")
+        return {
+            "status": "diff_preview",
+            "bundles_count": len(bundles),
+            "bundles": bundles
+        }
+
     # Snapshot directory
     snapshot_dir = target_root / ".torusguard" / "snapshots" / run_folder.name
     snapshot_dir.mkdir(parents=True, exist_ok=True)
 
     # Header Card
     print()
-    print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.5"))
+    print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.4.0"))
     print()
 
     print(border_top("Candidate Bundles Ready for Application"))
@@ -175,7 +243,7 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
 
     applied_count = 0
     skipped_count = 0
-    all_approved = auto_approve
+    all_approved = False if selective else auto_approve
     diff_summary_lines = [f"# TorusGuard Applied Patch Summary: {run_folder.name}\n"]
     applied_bundles = []
 
@@ -351,6 +419,21 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     print(border_bottom(border_color=GREEN, double=True))
     print()
 
+    if verify_post_apply and applied_count > 0:
+        recheck_script = scripts_dir / "recheck_runner.py"
+        if recheck_script.is_file():
+            print(f"\n  {CYAN}▸ Triggering differential recheck post-apply (--verify)...{RESET}\n")
+            try:
+                import importlib.util
+                spec = importlib.util.spec_from_file_location("recheck_runner", str(recheck_script))
+                if spec and spec.loader:
+                    rc_mod = importlib.util.module_from_spec(spec)
+                    spec.loader.exec_module(rc_mod)
+                    if hasattr(rc_mod, "execute_recheck"):
+                        rc_mod.execute_recheck(target_root, run_folder.name)
+            except Exception as e:
+                print(f"  {YELLOW}⚠ Post-apply recheck notice: {e}{RESET}")
+
     return {
         "applied_count": applied_count,
         "skipped_count": skipped_count,
@@ -362,19 +445,35 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Governed Patch Application Engine")
     parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--target", "-t", help="Target project root directory (alias for path)")
     parser.add_argument("--run", "-r", help="Explicit run ID to apply")
     parser.add_argument("--yes", "-y", action="store_true", help="Auto-approve all patches (non-interactive)")
+    parser.add_argument("--diff", action="store_true", help="Preview unified diffs without modifying files on disk")
+    parser.add_argument("--selective", action="store_true", help="Interactively review and select patches one by one")
+    parser.add_argument("--verify", action="store_true", help="Trigger differential AST recheck immediately post-apply")
+    parser.add_argument("--list-snapshots", action="store_true", help="List historical pre-apply backup snapshots")
     parser.add_argument("--rollback", action="store_true", help="Rollback all applied patches using snapshots")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
     args = parser.parse_args()
 
-    target = Path(args.path).resolve()
+    target = Path(args.target or args.path).resolve()
+
+    if args.list_snapshots:
+        list_snapshots(target)
+        return
 
     if args.rollback:
         execute_rollback(target, run_id_arg=args.run)
         return
 
-    result = execute_apply(target, run_id_arg=args.run, auto_approve=args.yes)
+    result = execute_apply(
+        target,
+        run_id_arg=args.run,
+        auto_approve=args.yes,
+        diff_only=args.diff,
+        selective=args.selective,
+        verify_post_apply=args.verify
+    )
     if args.json:
         print(json.dumps(result, indent=2))