torusguard 1.3.6 → 1.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "1.3.6",
+  "version": "1.4.0",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {
@@ -17,8 +17,12 @@
   "scripts": {
     "test": "python harness/runner.py",
     "init": "node bin/torusguard.js init",
+    "status": "node bin/torusguard.js status",
     "audit": "node bin/torusguard.js audit",
-    "status": "node bin/torusguard.js status"
+    "harden": "node bin/torusguard.js harden",
+    "apply": "node bin/torusguard.js apply",
+    "recipes": "node bin/torusguard.js recipes",
+    "update": "node bin/torusguard.js update"
   },
   "keywords": [
     "security",

package/skills/torusguard/bootstrap.py

@@ -135,7 +135,7 @@ def print_header():
     print(f"""
   {CYAN}╭─────────────────────────────────────────────────────────────────────────╮{RESET}
   {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
-  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v1.3.0{RESET}   {CYAN}│{RESET}
+  {CYAN}│{RESET}   {BOLD}{WHITE}🛡️  T O R U S G U A R D{RESET}                                  {GRAY}v1.4.0{RESET}   {CYAN}│{RESET}
   {CYAN}│{RESET}   {DIM}Autonomous Security Engine for AI-Built Applications{RESET}               {CYAN}│{RESET}
   {CYAN}│{RESET}                                                                         {CYAN}│{RESET}
   {CYAN}╰─────────────────────────────────────────────────────────────────────────╯{RESET}
@@ -220,7 +220,7 @@ def print_already_initialized(target_root, cfg):
 
   {BOLD}▸ Project Root:{RESET}       {GREEN}{target_root}{RESET}
   {BOLD}▸ Workspace:{RESET}          {GREEN}.torusguard/{RESET} {DIM}(Already Initialized){RESET}
-  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.3.0')}{RESET}
+  {BOLD}▸ Version:{RESET}            {CYAN}{cfg.get('version', '1.4.0')}{RESET}
   {BOLD}▸ Severity Floor:{RESET}     {YELLOW}{cfg.get('severity_threshold', 'medium')}{RESET}
 
   {DIM}To refresh templates or re-scaffold, run:{RESET}
@@ -228,7 +228,7 @@ def print_already_initialized(target_root, cfg):
 """)
 
 
-def scaffold_workspace(target_root=None, force=False, full_commands=False):
+def scaffold_workspace(target_root=None, force=False, full_commands=False, template=None, run_audit=False):
     """Scaffold the .torusguard workspace into the target project root."""
     target_root = Path(target_root or find_project_root()).resolve()
     torusguard_target = target_root / ".torusguard"
@@ -379,12 +379,26 @@ def scaffold_workspace(target_root=None, force=False, full_commands=False):
         except Exception:
             detected_stack = None
 
+    TEMPLATE_MAP = {
+        "golang": {"language": "Go", "framework": "Gin/Fiber", "data_layer": "database/sql"},
+        "go": {"language": "Go", "framework": "Gin/Fiber", "data_layer": "database/sql"},
+        "nextjs": {"language": "TypeScript", "framework": "Next.js", "data_layer": "Prisma ORM"},
+        "fastapi": {"language": "Python", "framework": "FastAPI", "data_layer": "SQLAlchemy"},
+        "express": {"language": "JavaScript", "framework": "Express", "data_layer": "Mongoose"},
+        "django": {"language": "Python", "framework": "Django", "data_layer": "Django ORM"},
+        "react": {"language": "JavaScript/TypeScript", "framework": "React / Vite", "data_layer": "Supabase"}
+    }
+    if template and template.lower() in TEMPLATE_MAP:
+        detected_stack = TEMPLATE_MAP[template.lower()]
+
     config_file = torusguard_target / "config" / "torusguard.json"
     if config_file.exists():
         try:
             with open(config_file, "r", encoding="utf-8") as f:
                 cfg = json.load(f)
-            if detected_stack and detected_stack.get("framework") != "None":
+            if template and template.lower() in TEMPLATE_MAP:
+                cfg["detected_stack"] = TEMPLATE_MAP[template.lower()]
+            elif detected_stack and detected_stack.get("framework") != "None":
                 cfg["detected_stack"] = {
                     "language": detected_stack.get("language"),
                     "framework": detected_stack.get("framework"),
@@ -516,15 +530,40 @@ Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-valid
 
     # ── Success Card ────────────────────────────────────────────────────────
     print_success_card()
+
+    # ── Optional Immediate Audit ────────────────────────────────────────────
+    if run_audit:
+        audit_script = torusguard_target / "scripts" / "audit_runner.py"
+        if audit_script.is_file():
+            print(f"\n  {CYAN}▸ Running immediate baseline security audit (--audit)...{RESET}\n")
+            try:
+                import importlib.util
+                spec = importlib.util.spec_from_file_location("audit_runner", str(audit_script))
+                if spec and spec.loader:
+                    ar_mod = importlib.util.module_from_spec(spec)
+                    spec.loader.exec_module(ar_mod)
+                    if hasattr(ar_mod, "execute_audit"):
+                        ar_mod.execute_audit(target_root)
+            except Exception as e:
+                print(f"  {YELLOW}⚠ Immediate audit notice: {e}{RESET}")
+
     return True
 
 
 if __name__ == "__main__":
     parser = argparse.ArgumentParser(description="TorusGuard Autonomous Workspace Bootstrapper")
-    parser.add_argument("--target", type=str, help="Target project root directory")
+    parser.add_argument("--target", "-t", type=str, help="Target project root directory")
     parser.add_argument("--force", action="store_true", help="Force overwrite existing workspace")
     parser.add_argument("--full-commands", action="store_true", help="Unlock and register all 11 individual slash commands")
+    parser.add_argument("--template", choices=["golang", "go", "nextjs", "fastapi", "express", "django", "react"], help="Pre-configure target framework stack template")
+    parser.add_argument("--audit", action="store_true", help="Execute immediate baseline audit post-initialization")
     args = parser.parse_args()
 
-    success = scaffold_workspace(target_root=args.target, force=args.force, full_commands=args.full_commands)
+    success = scaffold_workspace(
+        target_root=args.target,
+        force=args.force,
+        full_commands=args.full_commands,
+        template=args.template,
+        run_audit=args.audit
+    )
     sys.exit(0 if success else 1)

package/skills/torusguard/payload/.manifest.json

@@ -142,23 +142,24 @@
   "schemas/remediation.schema.json": "544904239f871dec9552973e01e09dc1f40dbb8330f20d98c319f3b24031d630",
   "schemas/retest.schema.json": "97c0407ca4365a524020c430912f686f698cc0de90043194621071e9fc681cc7",
   "schemas/runtime-evidence.schema.json": "929d2b094c1cd1f7f9db07be1eba5994e8002477eab3fd24140e1e973fd18cc1",
-  "scripts/apply_runner.py": "f9c5374ea213b77069293e45ed3d878d7f3f0e31497c55bc97885efc14bfa57c",
-  "scripts/audit_runner.py": "98a3975ff79f8ffb0343d5606dd84a603fd35d741e2def6d70f83bc1ee8f01ff",
+  "scripts/apply_runner.py": "b145a68a4bc10fcacb853f972aee81fa3607e32d282b2b850c5a63d8e72da890",
+  "scripts/audit_runner.py": "bc1e06ea5153ae326c4ad1de5d0cbb9503e618186623bea7cb8bb64d7b7b05ec",
   "scripts/diff_guard.py": "0dc178cdde1ac0ae1a1ea4b2eb2ce1756b2126f6156909cf55d85249f115fcbd",
   "scripts/finding_scorer.py": "a5315be6ee256c01c4539da3d1905ebc8d0840a356b83c55f9f6f2654a9f0c60",
-  "scripts/harden_runner.py": "f6f6922f2ade98b40f3de3e211459c62483e8aa274cbe4515dbd0d308956e6b4",
-  "scripts/html_reporter.py": "e9901a1dbeddd7b1dccd04afc9005d64954ccc1f14ba6ec4bdb4aa0ea8c2c66c",
-  "scripts/manifest_builder.py": "c0137927789a9e40a08243e630ac3c6990beb1b87807934e98906c8ad0b99a97",
+  "scripts/harden_runner.py": "5d5a40029c088ccb66790a9b0128bdefcd35883ef1dac78088ceb9531392a8f1",
+  "scripts/html_reporter.py": "655c57be39e13c177db8842ef471664e5853f3e43b9f2a63e590df40ff9c16cb",
+  "scripts/manifest_builder.py": "18db6979b341a87e9bf38fe06525365d12b07d532c0dbfd2ac3ef0f539dc1f6f",
   "scripts/memory_engine.py": "b715d0ca030e95eb06ad6eda99027535df8a7e37d64897c023be6a291cf13dc6",
   "scripts/monorepo_detector.py": "5603674136a5294ebfff89efeca0a546dd4a7deb1d184a2592ff21aff2131f73",
-  "scripts/recheck_runner.py": "dd6f35c98f6fd3d41d641bca419bb90739551c4900724a65447882b6d7dd4f54",
-  "scripts/recipes_runner.py": "6e057860e7d0e3b612a5b444b577255c9b7009b5dce0352098ab7d6c8c6659e7",
-  "scripts/report_sync.py": "c5f37c69e2e074c8ffd5953811907cf7c95e4c56f406ea16f3b5b9d878cfb774",
+  "scripts/recheck_runner.py": "89e93fcc6843493d7e5f0bf97065dbdb40106273a00e07f903250665ca25f6fb",
+  "scripts/recipes_runner.py": "090c06ef0de3c640a111c5646837233ceeaca494b161bd5edc630cc1371dca0e",
+  "scripts/report_sync.py": "5ebef684690200694a53af30db850d9808d03ec710ed21ef75c4de52b5e5217c",
   "scripts/rules_sync.py": "4101b2ca8036ff4f468800b32a8d08898e8640a74d14124af53d454706a62d3a",
   "scripts/run_manager.py": "b738ff70879e46547d32fac6befc61de9599f676411384280fb9819ea3ad7035",
   "scripts/safety_gate.py": "3379b7534b2590cf563717a448983ad8ed7e8f174f0ad65683d33e8a10f51558",
   "scripts/sarif_exporter.py": "86700765212adb3ab590ca72614bf3ad4ce7ce60e3193f7f3bd1a04d34d10f6e",
   "scripts/stack_detect.py": "c05a1ade4c8692025476bf7ea080a8f07c92e5d8e9a04f94c1654386352ffbdc",
+  "scripts/status_runner.py": "4c358c91950c7874bcc6a5f23f2d3fda62b0752efcf6c6b658adf02ed77c7752",
   "scripts/term_ui.py": "ca69398f85c86fe89526d6334b3ee866c890273997351113c3cc1765b7bd20c3",
   "skills/torusguard/SKILL.md": "4d5b8e43fa3c09e5e1079cbc3e2184654219a2c47b2272db394da749969318f8",
   "skills/torusguard/bootstrap.py": "3d946f388cb4befa739c9d3b1404255d9a8ea5770ebbb79e5a1b9839589e9bc7",
@@ -206,16 +207,30 @@
   "templates/authorization.template.md": "81ef843d42a19412c369f383b787465ac24173c0b14c1f5f211786eab3d10e8b",
   "templates/finding-card.template.md": "8f756edbd3e4139d3da2fb96f35bd2d2b267b33b754f187b590a89584265c1e6",
   "templates/remediation-bundle.template.md": "4d85a540e3a2e74f9b21fc8a2a1072e27ca03e97cd67ca482f529cfe722acc4d",
-  "workflows/apply.md": "8dd37fecc44e2820e82c29e2c6b2970936734ed5102d36950889a9eb8b19dbab",
-  "workflows/audit.md": "7e78ebb885176d65e86ed45a90a4326b942d484c2b5c8bff1d7bda141790de2f",
+  "workflows/apply.md": "67e1002fc6e9d68e0c7d871c40b6f3c3b9c3919c8e02106a579882729c0f6b9f",
+  "workflows/audit.md": "eac9102ca88d53f71da474cd55717d431fd9c3b08c66d0760da9b53a659cf89a",
   "workflows/authorize.md": "28ca58cfc656e956f7cec8160f2aadc152abcde3eb5ad5588df149007afb0df8",
   "workflows/exploit-check.md": "41e77afe912be9266c5bc1e00fd796baff22a67973eb6e86d196d34f4d7bdfa4",
-  "workflows/harden.md": "24c62ea0233bf5cb21308497869790fa6f24b6cbb563fd2ebf858ff02b09bba9",
-  "workflows/init.md": "9a9aeaff6bd2217323ad72fb4043f46057deaa45eb3380f679d9aef3d36bfc8b",
+  "workflows/harden.md": "7d92132973ff867b99e0425e3aee3c4e91868cb5193ec601069af2e857b6697f",
+  "workflows/init.md": "611418577ff9d5719df459f56b3fa53b91eb3717b02c4b4e5e86ed483bed3bfa",
   "workflows/memory.md": "8ad2ec154176e2540c2859a28eff9f7c2dbca0217aa29d0f4aa88b87c43f8bef",
   "workflows/recheck.md": "42eecc3ba194564d48a6a88d8003e86cafe003503e887dc565314d4aa558e8fd",
-  "workflows/report.md": "b98652ee0552b7bb73eeb78dc80d2b0a108cc505523cbd1b3ada6064409e4629",
-  "workflows/status.md": "dfbc2b75ba45ff70b60522addca4032a667241364b0907cd77a43bf9271dfa56",
+  "workflows/recipes.md": "300c1fed0167e1a299fcd33c07db05630116b18a71ec2513c385862bba0f179b",
+  "workflows/report.md": "ecbd67bfa95bde3c0f51e06aac6fad70d5989b0be82245116cd7ba367f378a4c",
+  "workflows/status.md": "7f07e726bbb0488e48b718c2f36971634b1422bc2ddfbb381eb3e1ea67c1cfbf",
+  "workflows/torusguard-apply.md": "67e1002fc6e9d68e0c7d871c40b6f3c3b9c3919c8e02106a579882729c0f6b9f",
+  "workflows/torusguard-audit.md": "eac9102ca88d53f71da474cd55717d431fd9c3b08c66d0760da9b53a659cf89a",
+  "workflows/torusguard-authorize.md": "28ca58cfc656e956f7cec8160f2aadc152abcde3eb5ad5588df149007afb0df8",
+  "workflows/torusguard-exploit-check.md": "41e77afe912be9266c5bc1e00fd796baff22a67973eb6e86d196d34f4d7bdfa4",
+  "workflows/torusguard-harden.md": "7d92132973ff867b99e0425e3aee3c4e91868cb5193ec601069af2e857b6697f",
+  "workflows/torusguard-init.md": "611418577ff9d5719df459f56b3fa53b91eb3717b02c4b4e5e86ed483bed3bfa",
+  "workflows/torusguard-recheck.md": "42eecc3ba194564d48a6a88d8003e86cafe003503e887dc565314d4aa558e8fd",
+  "workflows/torusguard-recipes.md": "300c1fed0167e1a299fcd33c07db05630116b18a71ec2513c385862bba0f179b",
+  "workflows/torusguard-report.md": "ecbd67bfa95bde3c0f51e06aac6fad70d5989b0be82245116cd7ba367f378a4c",
+  "workflows/torusguard-status.md": "7f07e726bbb0488e48b718c2f36971634b1422bc2ddfbb381eb3e1ea67c1cfbf",
+  "workflows/torusguard-verify.md": "6412e123a9346240e5ba898a0da73d3409d9a215d6e8f202ab2eb5719b663731",
+  "workflows/torusguard-web-validate.md": "3b2a3d02b69469539b4a48ed3bd355362927cc21470dbcdeccba564a9e68a371",
+  "workflows/torusguard.md": "4b5da6d38dae6be277bd52782121cdb181a75f1400068041310ca69deae89589",
   "workflows/verify.md": "6412e123a9346240e5ba898a0da73d3409d9a215d6e8f202ab2eb5719b663731",
   "workflows/web-validate.md": "3b2a3d02b69469539b4a48ed3bd355362927cc21470dbcdeccba564a9e68a371"
 }

package/skills/torusguard/payload/scripts/apply_runner.py

@@ -58,7 +58,7 @@ def box_line(content: str, width: int = 67, border: str = "│", border_color: s
         return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
     return f"  {border_color}{border}{RESET}  {content}"
 
-def box_header(title: str, subtitle: str = "", version: str = "v1.3.6", border_color: str = CYAN) -> str:
+def box_header(title: str, subtitle: str = "", version: str = "v1.4.0", border_color: str = CYAN) -> str:
     if term_ui:
         return term_ui.card_header(title, subtitle, version, border_color)
     return f"=== {title} ({version}) ==="
@@ -81,6 +81,35 @@ def find_latest_audit_run(runs_dir: Path) -> Optional[Path]:
     return runs[0] if runs else None
 
 
+def list_snapshots(target_root: Path) -> None:
+    """Display historical pre-apply backup snapshots."""
+    snapshots_base = target_root / ".torusguard" / "snapshots"
+    print()
+    print(box_header("🛡️  TORUSGUARD SNAPSHOT LEDGER", "Pre-Apply Safety Snapshots (.bak)", "v1.4.0"))
+    print()
+    if not snapshots_base.is_dir():
+        print(f"  {YELLOW}ℹ No snapshots directory found at:{RESET} {snapshots_base}\n")
+        return
+    snapshots = sorted([d for d in snapshots_base.iterdir() if d.is_dir()], key=lambda p: p.stat().st_mtime, reverse=True)
+    if not snapshots:
+        print(f"  {YELLOW}ℹ No rollback snapshots captured yet.{RESET}\n")
+        return
+    print(border_top(f"Available Snapshots ({len(snapshots)})"))
+    for s in snapshots:
+        bak_files = list(s.rglob("*.bak"))
+        total_bytes = sum(f.stat().st_size for f in bak_files)
+        kb_str = f"{total_bytes / 1024:.1f} KB"
+        try:
+            mtime_dt = datetime.datetime.fromtimestamp(s.stat().st_mtime, tz=IST)
+            time_str = mtime_dt.strftime("%Y-%m-%d %H:%M:%S IST")
+        except Exception:
+            time_str = "Captured"
+        print(box_line(f"{GREEN}{s.name}{RESET} ({len(bak_files)} files · {kb_str})"))
+        print(box_line(f"  └─ {DIM}Timestamp: {time_str}{RESET}"))
+    print(border_bottom())
+    print(f"\n  {DIM}To restore any snapshot, run: {CYAN}npx torusguard rollback --run <snapshot-name>{RESET}\n")
+
+
 def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> None:
     """Restore all target files from the pre-apply backup snapshots."""
     snapshots_base = target_root / ".torusguard" / "snapshots"
@@ -115,7 +144,7 @@ def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> Non
         pass
 
     print()
-    print(box_header("🛡️  TORUSGUARD ROLLBACK RESTORATION", "Restored original files from pre-apply snapshot", "v1.3.6"))
+    print(box_header("🛡️  TORUSGUARD ROLLBACK RESTORATION", "Restored original files from pre-apply snapshot", "v1.4.0"))
     print()
 
     print(border_top("Rollback Snapshot Restored"))
@@ -128,7 +157,7 @@ def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> Non
     sys.exit(0)
 
 
-def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_approve: bool = False) -> Dict[str, Any]:
+def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_approve: bool = False, diff_only: bool = False, selective: bool = False, verify_post_apply: bool = False) -> Dict[str, Any]:
     runs_dir = target_root / ".torusguard" / "runs"
     if run_id_arg:
         run_folder = runs_dir / run_id_arg
@@ -144,7 +173,7 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     bundle_meta_files = list(bundles_dir.glob("*/metadata.json")) if bundles_dir.is_dir() else []
     if not bundle_meta_files:
         print()
-        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.6"))
+        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.4.0"))
         print()
         print(f"  {YELLOW}ℹ Zero candidate remediation bundles found in run: {run_folder.name}{RESET}")
         print(f"  {GRAY}The findings in this run require manual review or AI-assisted remediation.{RESET}\n")
@@ -163,13 +192,46 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
         except Exception:
             pass
 
+    # Diff Preview Mode
+    if diff_only:
+        print()
+        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH DIFF PREVIEW", "Dry-Run Unified Diff Inspection (No Files Modified)", "v1.4.0"))
+        print()
+        print(border_top(f"Candidate Patches ({len(bundles)})"))
+        for idx, b in enumerate(bundles, 1):
+            rule_id = b.get("rule_id", "TG-SEC")
+            rel_path = b.get("target_file", "")
+            line_no = b.get("line_number", 1)
+            diff = b.get("proposed_diff", "")
+            desc = b.get("what_should_change", "")
+            print(f"  {YELLOW}─── [{idx}/{len(bundles)}] Candidate Patch: [{rule_id}] on {rel_path}:{line_no} ───{RESET}")
+            print(f"  Strategy: {WHITE}{desc}{RESET}")
+            print(f"  Ponytail: {GREEN}+{b.get('additions', 0)} / -{b.get('deletions', 0)}{RESET}\n")
+            for dline in diff.splitlines()[:16]:
+                if dline.startswith("+") and not dline.startswith("+++"):
+                    print(f"    {GREEN}{dline}{RESET}")
+                elif dline.startswith("-") and not dline.startswith("---"):
+                    print(f"    {RED}{dline}{RESET}")
+                elif dline.startswith("@"):
+                    print(f"    {CYAN}{dline}{RESET}")
+                else:
+                    print(f"    {DIM}{dline}{RESET}")
+            print()
+        print(border_bottom())
+        print(f"\n  {DIM}To apply these patches to disk, run: {CYAN}npx torusguard apply{RESET} or {CYAN}npx torusguard apply --yes{RESET}\n")
+        return {
+            "status": "diff_preview",
+            "bundles_count": len(bundles),
+            "bundles": bundles
+        }
+
     # Snapshot directory
     snapshot_dir = target_root / ".torusguard" / "snapshots" / run_folder.name
     snapshot_dir.mkdir(parents=True, exist_ok=True)
 
     # Header Card
     print()
-    print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.6"))
+    print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.4.0"))
     print()
 
     print(border_top("Candidate Bundles Ready for Application"))
@@ -181,7 +243,7 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
 
     applied_count = 0
     skipped_count = 0
-    all_approved = auto_approve
+    all_approved = False if selective else auto_approve
     diff_summary_lines = [f"# TorusGuard Applied Patch Summary: {run_folder.name}\n"]
     applied_bundles = []
 
@@ -357,6 +419,21 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     print(border_bottom(border_color=GREEN, double=True))
     print()
 
+    if verify_post_apply and applied_count > 0:
+        recheck_script = scripts_dir / "recheck_runner.py"
+        if recheck_script.is_file():
+            print(f"\n  {CYAN}▸ Triggering differential recheck post-apply (--verify)...{RESET}\n")
+            try:
+                import importlib.util
+                spec = importlib.util.spec_from_file_location("recheck_runner", str(recheck_script))
+                if spec and spec.loader:
+                    rc_mod = importlib.util.module_from_spec(spec)
+                    spec.loader.exec_module(rc_mod)
+                    if hasattr(rc_mod, "execute_recheck"):
+                        rc_mod.execute_recheck(target_root, run_folder.name)
+            except Exception as e:
+                print(f"  {YELLOW}⚠ Post-apply recheck notice: {e}{RESET}")
+
     return {
         "applied_count": applied_count,
         "skipped_count": skipped_count,
@@ -368,19 +445,35 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Governed Patch Application Engine")
     parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--target", "-t", help="Target project root directory (alias for path)")
     parser.add_argument("--run", "-r", help="Explicit run ID to apply")
     parser.add_argument("--yes", "-y", action="store_true", help="Auto-approve all patches (non-interactive)")
+    parser.add_argument("--diff", action="store_true", help="Preview unified diffs without modifying files on disk")
+    parser.add_argument("--selective", action="store_true", help="Interactively review and select patches one by one")
+    parser.add_argument("--verify", action="store_true", help="Trigger differential AST recheck immediately post-apply")
+    parser.add_argument("--list-snapshots", action="store_true", help="List historical pre-apply backup snapshots")
     parser.add_argument("--rollback", action="store_true", help="Rollback all applied patches using snapshots")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
     args = parser.parse_args()
 
-    target = Path(args.path).resolve()
+    target = Path(args.target or args.path).resolve()
+
+    if args.list_snapshots:
+        list_snapshots(target)
+        return
 
     if args.rollback:
         execute_rollback(target, run_id_arg=args.run)
         return
 
-    result = execute_apply(target, run_id_arg=args.run, auto_approve=args.yes)
+    result = execute_apply(
+        target,
+        run_id_arg=args.run,
+        auto_approve=args.yes,
+        diff_only=args.diff,
+        selective=args.selective,
+        verify_post_apply=args.verify
+    )
     if args.json:
         print(json.dumps(result, indent=2))
 

package/skills/torusguard/payload/scripts/audit_runner.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-TorusGuard Autonomous Static Security Audit Engine (v1.3.6)
+TorusGuard Autonomous Static Security Audit Engine (v1.4.0)
 Multi-language static pattern & AST security scanner.
 Evaluates source trees against canonical TorusGuard rule families,
 augments confidence via the persistent security memory subsystem,
@@ -12,6 +12,7 @@ Pure Python 3.10+ standard library (zero external dependencies).
 import sys
 import os
 import re
+import time
 import json
 import hashlib
 import argparse
@@ -369,7 +370,9 @@ RULE_PATTERNS: List[RulePattern] = [
         "patterns": [
             (re.compile(r'(?:query|execute|raw)\s*\(\s*f["\'].*SELECT.*\{', re.IGNORECASE), "Python f-string interpolation in raw SQL query"),
             (re.compile(r'(?:query|execute|raw)\s*\(\s*[`"\'].*SELECT.*\$\{', re.IGNORECASE), "JavaScript template literal interpolation in SQL query"),
-            (re.compile(r'(?:query|execute|raw)\s*\(\s*["\'].*SELECT.*\+\s*(?:req|input|params)', re.IGNORECASE), "String concatenation in raw SQL query")
+            (re.compile(r'(?:query|execute|raw)\s*\(\s*["\'].*SELECT.*\+\s*(?:req|input|params)', re.IGNORECASE), "String concatenation in raw SQL query"),
+            (re.compile(r'(?:db|tx)\.(?:Query|Exec|QueryRow)\s*\(\s*fmt\.Sprintf\s*\(\s*["\'].*(?:SELECT|INSERT|UPDATE|DELETE).*%s', re.IGNORECASE), "Go database/sql query using fmt.Sprintf string interpolation instead of parameterized placeholders"),
+            (re.compile(r'(?:db|tx)\.(?:Query|Exec|QueryRow)\s*\(\s*["\'].*(?:SELECT|INSERT|UPDATE|DELETE).*\+\s*(?:r\.URL|c\.Query|input|param)', re.IGNORECASE), "Go database/sql query with string concatenation")
         ]
     },
     {
@@ -414,7 +417,8 @@ RULE_PATTERNS: List[RulePattern] = [
         "cluster": "cluster-injection",
         "patterns": [
             (re.compile(r'(?:open|readFile|readFileSync)\s*\([^)]*\+\s*(?:req|params|query)'), "File read operation using unsanitized user request path"),
-            (re.compile(r'path\.join\s*\([^)]*(?:req\.params|req\.query)\.[a-zA-Z0-9_]+\)'), "Path traversal sink in path.join without basename sanitization")
+            (re.compile(r'path\.join\s*\([^)]*(?:req\.params|req\.query)\.[a-zA-Z0-9_]+\)'), "Path traversal sink in path.join without basename sanitization"),
+            (re.compile(r'(?:os\.Open|os\.ReadFile|ioutil\.ReadFile)\s*\([^)]*(?:c\.Query|c\.Param|r\.URL\.Query|filepath\.Join\([^)]*(?:c\.Query|c\.Param|r\.URL\.Query))'), "Go file read operation using unsanitized user request parameter")
         ]
     },
 
@@ -502,7 +506,8 @@ RULE_PATTERNS: List[RulePattern] = [
         "category": "ssrf",
         "cluster": "cluster-ssrf",
         "patterns": [
-            (re.compile(r'(?:fetch|axios\.get|requests\.get|urllib\.request\.urlopen)\s*\(\s*(?:req\.query|req\.body|request\.GET)\.[a-zA-Z0-9_]+'), "Outbound HTTP request directly invoking user-supplied URL parameter")
+            (re.compile(r'(?:fetch|axios\.get|requests\.get|urllib\.request\.urlopen)\s*\(\s*(?:req\.query|req\.body|request\.GET)\.[a-zA-Z0-9_]+'), "Outbound HTTP request directly invoking user-supplied URL parameter"),
+            (re.compile(r'http\.(?:Get|Post|Head)\s*\(\s*(?:r\.URL\.Query|c\.Query|c\.Param|req\.)'), "Go http.Get/Post directly invoking user-supplied URL parameter")
         ]
     },
     {
@@ -533,7 +538,9 @@ RULE_PATTERNS: List[RulePattern] = [
         "category": "ssrf",
         "cluster": "cluster-ssrf",
         "patterns": [
-            (re.compile(r'requests\.(?:get|post|put)\s*\((?![^)]*\btimeout\s*=)[^)]*\)'), "Python requests call without explicit timeout parameter")
+            (re.compile(r'requests\.(?:get|post|put)\s*\((?![^)]*\btimeout\s*=)[^)]*\)'), "Python requests call without explicit timeout parameter"),
+            (re.compile(r'&http\.Client\s*\{\s*\}'), "Go http.Client initialized without explicit Timeout boundary (defaults to unbounded zero)"),
+            (re.compile(r'http\.DefaultClient\.(?:Get|Post|Do)\s*\('), "Go http.DefaultClient call with zero/unbounded request timeout")
         ]
     },
 
@@ -693,7 +700,8 @@ RULE_PATTERNS: List[RulePattern] = [
         "category": "supply",
         "cluster": "cluster-supply-chain",
         "patterns": [
-            (re.compile(r'^\s*package-lock\.json\s*$', re.MULTILINE), "Lockfile package-lock.json explicitly ignored in .gitignore")
+            (re.compile(r'^\s*package-lock\.json\s*$', re.MULTILINE), "Lockfile package-lock.json explicitly ignored in .gitignore"),
+            (re.compile(r'^\s*go\.sum\s*$', re.MULTILINE), "Go dependency checksum lockfile go.sum explicitly ignored in .gitignore")
         ]
     },
     {
@@ -1362,7 +1370,7 @@ def emit_run_artifacts(run_folder: Path, scored_findings: List[Dict[str, Any]],
             pass
 
 
-def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: List[Dict[str, Any]], clusters: Dict[str, List[Dict[str, Any]]], run_folder: Path, detected_stack: Optional[Dict[str, Any]] = None) -> None:
+def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: List[Dict[str, Any]], clusters: Dict[str, List[Dict[str, Any]]], run_folder: Path, detected_stack: Optional[Dict[str, Any]] = None, perf_metrics: Optional[Dict[str, Any]] = None) -> None:
     """Print the unified 75-column TorusGuard Static Audit results card."""
     crit_count = sum(1 for f in scored_findings if f["severity"] == "Critical")
     high_count = sum(1 for f in scored_findings if f["severity"] == "High")
@@ -1373,13 +1381,17 @@ def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: L
         stack_str = f"{detected_stack.get('framework')} ({detected_stack.get('language')})"
 
     print()
-    print(card_header("🛡️  TORUSGUARD STATIC SECURITY AUDIT", "Autonomous AST & Invariant Security Scanner", "v1.3.6"))
+    print(card_header("🛡️  TORUSGUARD STATIC SECURITY AUDIT", "Autonomous AST & Invariant Security Scanner", "v1.4.0"))
     print()
 
     print(card_border_top("Audit Execution Scope"))
     print(format_box_line(f"{BOLD}Target:{RESET}       {WHITE}{str(target_root)}{RESET}"))
     print(format_box_line(f"{BOLD}Stack:{RESET}        {GREEN}{stack_str}{RESET}"))
     print(format_box_line(f"{BOLD}Files:{RESET}        {WHITE}{file_count} files evaluated across 18 rule families (74 rules){RESET}"))
+    if perf_metrics:
+        ms = perf_metrics.get("elapsed_ms", 0)
+        fps = perf_metrics.get("throughput_fps", 0)
+        print(format_box_line(f"{BOLD}Metrics:{RESET}      {CYAN}{ms}ms{RESET} elapsed · {GREEN}{fps} files/sec{RESET} throughput"))
     print(card_border_bottom())
     print()
 
@@ -1389,6 +1401,17 @@ def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: L
     print(format_box_line(f"Status:      {status_icon}"))
     print(format_box_line(f"Findings:    {RED}{crit_count} Critical{RESET}  {YELLOW}{high_count} High{RESET}  {CYAN}{med_count} Medium/Low{RESET}  ({len(scored_findings)} total)"))
     print(format_box_line(f"Clusters:    {WHITE}{len(clusters)} architectural root causes identified{RESET}"))
+
+    # Rule Family Breakdown
+    if scored_findings:
+        fam_counts: Dict[str, int] = {}
+        for f in scored_findings:
+            rid = f.get("rule_id", "")
+            parts = rid.split("-")
+            fam = f"{parts[0]}-{parts[1]}" if len(parts) >= 2 else "OTHER"
+            fam_counts[fam] = fam_counts.get(fam, 0) + 1
+        fam_items = [f"{YELLOW}{k}{RESET}: {v}" for k, v in sorted(fam_counts.items(), key=lambda x: -x[1])[:4]]
+        print(format_box_line(f"Families:    {'  '.join(fam_items)}"))
     print(card_divider())
 
     if not scored_findings:
@@ -1418,8 +1441,69 @@ def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: L
     print()
 
 
+def export_sarif(target_root: Path, run_folder_str: Optional[str], sarif_out: Optional[str] = None) -> None:
+    """Export audit run findings to OASIS SARIF v2.1.0 format."""
+    s_dir = Path(__file__).resolve().parent
+    sarif_script = s_dir / "sarif_exporter.py"
+    if sarif_script.is_file():
+        try:
+            import importlib.util
+            spec = importlib.util.spec_from_file_location("sarif_exporter", str(sarif_script))
+            if spec and spec.loader:
+                mod = importlib.util.module_from_spec(spec)
+                spec.loader.exec_module(mod)
+                run_id = Path(run_folder_str).name if run_folder_str else "audit-run"
+                findings = []
+                if run_folder_str and (Path(run_folder_str) / "findings.json").is_file():
+                    with open(Path(run_folder_str) / "findings.json", "r", encoding="utf-8") as f:
+                        findings = json.load(f)
+                sarif_data = mod.generate_sarif(findings, run_id=run_id)
+                out_path = Path(sarif_out) if sarif_out else (target_root / ".torusguard" / "reports" / "torusguard-audit.sarif")
+                out_path.parent.mkdir(parents=True, exist_ok=True)
+                with open(out_path, "w", encoding="utf-8") as f:
+                    json.dump(sarif_data, f, indent=2)
+                print(f"  {GREEN}✔ OASIS SARIF v2.1.0 exported to:{RESET} {CYAN}{out_path}{RESET}\n")
+        except Exception as e:
+            print(f"  {YELLOW}⚠ SARIF export notice: {e}{RESET}")
+
+
+def run_watch_mode(target_root: Path, severity_floor: str = "medium", json_output: bool = False, include_tests: bool = False, sarif: bool = False, sarif_out: Optional[str] = None) -> None:
+    """Run audit continuously, re-scanning when files are modified."""
+    print(f"\n  {CYAN}👀 TorusGuard Watch Mode active.{RESET} Watching {WHITE}{target_root}{RESET} (Ctrl+C to stop)...\n")
+
+    def get_file_mtimes() -> Dict[str, float]:
+        mtimes = {}
+        for f in find_files_to_scan(target_root, include_tests=include_tests):
+            try:
+                mtimes[str(f)] = f.stat().st_mtime
+            except OSError:
+                pass
+        return mtimes
+
+    last_mtimes = get_file_mtimes()
+    res = execute_audit(target_root, severity_floor=severity_floor, json_output=json_output, include_tests=include_tests)
+    if sarif:
+        export_sarif(target_root, res.get("run_folder"), sarif_out)
+
+    try:
+        while True:
+            time.sleep(1.0)
+            curr_mtimes = get_file_mtimes()
+            if curr_mtimes != last_mtimes:
+                changed = [f for f in curr_mtimes if f not in last_mtimes or curr_mtimes[f] != last_mtimes.get(f)]
+                last_mtimes = curr_mtimes
+                now_str = get_ist_now().strftime("%H:%M:%S")
+                print(f"\n  {CYAN}↻ File changes detected ({len(changed)} file(s)) at {now_str}. Re-scanning...{RESET}\n")
+                res = execute_audit(target_root, severity_floor=severity_floor, json_output=json_output, include_tests=include_tests)
+                if sarif:
+                    export_sarif(target_root, res.get("run_folder"), sarif_out)
+    except KeyboardInterrupt:
+        print(f"\n  {YELLOW}🛑 Watch mode stopped.{RESET}\n")
+
+
 def execute_audit(target_root: Path, severity_floor: str = "medium", json_output: bool = False, include_tests: bool = False) -> Dict[str, Any]:
     """Execute the full TorusGuard static security audit."""
+    start_time = time.perf_counter()
     target_root = target_root.resolve()
     s_dir = Path(__file__).resolve().parent
 
@@ -1474,6 +1558,13 @@ def execute_audit(target_root: Path, severity_floor: str = "medium", json_output
     except Exception:
         pass
 
+    elapsed_ms = int((time.perf_counter() - start_time) * 1000)
+    throughput = round(len(files) / max(0.001, (elapsed_ms / 1000.0)), 1)
+    perf_metrics = {
+        "elapsed_ms": elapsed_ms,
+        "throughput_fps": throughput
+    }
+
     result = {
         "status": "completed",
         "target_root": str(target_root),
@@ -1484,13 +1575,15 @@ def execute_audit(target_root: Path, severity_floor: str = "medium", json_output
         "medium_count": sum(1 for f in scored_findings if f["severity"] in ("Medium", "Low")),
         "clusters_count": len(clusters),
         "run_folder": str(run_folder),
-        "findings": scored_findings
+        "findings": scored_findings,
+        "elapsed_ms": elapsed_ms,
+        "throughput_fps": throughput
     }
 
     if json_output:
         print(json.dumps(result, indent=2))
     else:
-        print_audit_dashboard(target_root, len(files), scored_findings, clusters, run_folder, detected_stack)
+        print_audit_dashboard(target_root, len(files), scored_findings, clusters, run_folder, detected_stack, perf_metrics=perf_metrics)
 
     return result
 
@@ -1498,14 +1591,26 @@ def execute_audit(target_root: Path, severity_floor: str = "medium", json_output
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Static Security Audit Engine")
     parser.add_argument("path", nargs="?", default=".", help="Target project root directory to audit")
+    parser.add_argument("--target", "-t", help="Target project root directory (alias for path)")
     parser.add_argument("--scope", "-s", help="Alternative path to target project")
     parser.add_argument("--severity", choices=["critical", "high", "medium", "low"], default="medium", help="Severity floor")
+    parser.add_argument("--watch", "-w", action="store_true", help="Continuous watch mode: re-scan on file save")
+    parser.add_argument("--sarif", action="store_true", help="Automatically export findings to OASIS SARIF v2.1.0")
+    parser.add_argument("--sarif-out", help="Output file path for SARIF export")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
     parser.add_argument("--include-tests", action="store_true", help="Include test files and harness fixtures in scan")
     args = parser.parse_args()
 
-    target = Path(args.scope or args.path).resolve()
+    target = Path(args.target or args.scope or args.path).resolve()
+
+    if args.watch:
+        run_watch_mode(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests, sarif=args.sarif, sarif_out=args.sarif_out)
+        sys.exit(0)
+
     res = execute_audit(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests)
+    if args.sarif:
+        export_sarif(target, res.get("run_folder"), args.sarif_out)
+
     sys.exit(0 if res["critical_count"] == 0 else 1)