torusguard 1.3.6 → 2.0.0-alpha

package/skills/torusguard/payload/scripts/manifest_builder.py

@@ -33,6 +33,8 @@ def scan_workspace_files(base_dir):
             dirs.remove("snapshots")
         if "memory" in dirs:
             dirs.remove("memory")
+        if "reports" in dirs:
+            dirs.remove("reports")
         if "__pycache__" in dirs:
             dirs.remove("__pycache__")
 

package/skills/torusguard/payload/scripts/recheck_runner.py

@@ -233,11 +233,12 @@ def execute_recheck(target_root: Path, run_id_arg: Optional[str] = None) -> Dict
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Differential Recheck Engine")
     parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--target", "-t", help="Target project root directory (alias for path)")
     parser.add_argument("--run", "-r", help="Explicit run ID to recheck")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
     args = parser.parse_args()
 
-    target = Path(args.path).resolve()
+    target = Path(args.target or args.path).resolve()
     result = execute_recheck(target, run_id_arg=args.run)
 
     if args.json:

package/skills/torusguard/payload/scripts/recipes_runner.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-TorusGuard Golden Fix Recipe Explorer (v1.3.6)
+TorusGuard Golden Fix Recipe Explorer (v1.4.0)
 Inspect, list, and export reusable, verified AST remediation code snippets
 distilled from passing security patches and persistent memory patterns.
 Standardized 75-column terminal UI formatting.
@@ -47,7 +47,7 @@ def box_line(content: str, width: int = 67, border: str = "│", border_color: s
         return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
     return f"  {border_color}{border}{RESET}  {content}"
 
-def box_header(title: str, subtitle: str = "", version: str = "v1.3.6", border_color: str = CYAN) -> str:
+def box_header(title: str, subtitle: str = "", version: str = "v1.4.0", border_color: str = CYAN) -> str:
     if term_ui:
         return term_ui.card_header(title, subtitle, version, border_color)
     return f"=== {title} ({version}) ==="
@@ -63,28 +63,100 @@ def border_bottom(border_color: str = CYAN, double: bool = False) -> str:
     return "└" + "─" * 71 + "┘"
 
 
-def list_recipes(target_root: Path, detail_id: Optional[str] = None, json_output: bool = False) -> None:
+def list_recipes(target_root: Path, detail_id: Optional[str] = None, search_query: Optional[str] = None, export_path: Optional[str] = None, apply_id: Optional[str] = None, json_output: bool = False) -> None:
     patterns_file = target_root / ".torusguard" / "memory" / "patterns.json"
     recipes: List[Dict[str, Any]] = []
 
     if patterns_file.is_file():
         try:
             patterns = json.loads(patterns_file.read_text(encoding="utf-8"))
-            recipes = [p for p in patterns if p.get("pattern_type") == "golden_fix_recipe"]
+            if isinstance(patterns, list):
+                recipes = [p for p in patterns if p.get("pattern_type") == "golden_fix_recipe"]
+            elif isinstance(patterns, dict) and "patterns" in patterns:
+                recipes = [p for p in patterns["patterns"] if p.get("pattern_type") == "golden_fix_recipe"]
         except Exception:
             recipes = []
 
+    # 1. Search filtering
+    if search_query:
+        sq = search_query.lower()
+        recipes = [
+            r for r in recipes
+            if sq in r.get("rule_id", "").lower()
+            or sq in r.get("recipe_id", "").lower()
+            or sq in r.get("description", "").lower()
+            or sq in r.get("recipe_data", {}).get("diff_snippet", "").lower()
+        ]
+
+    # 2. Export requested
+    if export_path:
+        out_p = Path(export_path)
+        if not out_p.is_absolute():
+            out_p = (target_root / out_p).resolve()
+        out_p.parent.mkdir(parents=True, exist_ok=True)
+        if out_p.suffix.lower() == ".json":
+            out_p.write_text(json.dumps(recipes, indent=2), encoding="utf-8")
+        else:
+            md_lines = [
+                "# TorusGuard Golden Fix Recipes Catalog",
+                f"- Total Recipes: {len(recipes)}",
+                f"- Exported From: {target_root}",
+                ""
+            ]
+            for r in recipes:
+                md_lines.append(f"## [{r.get('rule_id')}] {r.get('recipe_id')}")
+                md_lines.append(f"- **Description:** {r.get('description')}")
+                rdata = r.get("recipe_data", {})
+                md_lines.append(f"- **Verified Count:** {rdata.get('verified_count', 1)}x")
+                md_lines.append("```diff")
+                md_lines.append(rdata.get("diff_snippet", ""))
+                md_lines.append("```\n")
+            out_p.write_text("\n".join(md_lines), encoding="utf-8")
+        print(f"\n  {GREEN}✔ Exported {len(recipes)} golden recipe(s) to:{RESET} {CYAN}{out_p}{RESET}\n")
+        return
+
+    # 3. Apply inspection requested
+    if apply_id:
+        target_rec = next((r for r in recipes if r.get("recipe_id") == apply_id or apply_id in r.get("recipe_id", "")), None)
+        if not target_rec:
+            print(f"\n  {RED}✖ Recipe '{apply_id}' not found in golden recipe memory.{RESET}\n")
+            return
+        rdata = target_rec.get("recipe_data", {})
+        print()
+        print(box_header("🛡️  GOLDEN RECIPE APPLICATION PREVIEW", f"Recipe ID: {target_rec.get('recipe_id')}", "v1.4.0"))
+        print()
+        print(border_top("Recipe Metadata"))
+        print(box_line(f"Rule ID:     {YELLOW}{target_rec.get('rule_id')}{RESET}"))
+        print(box_line(f"Description: {WHITE}{target_rec.get('description')}{RESET}"))
+        metrics = rdata.get("ponytail_metrics", {})
+        print(box_line(f"Ponytail:    {GREEN}+{metrics.get('additions', 0)} / -{metrics.get('deletions', 0)} lines{RESET}"))
+        print(border_bottom())
+        print()
+        print(f"  {BOLD}Diff Projection:{RESET}")
+        print("  ```diff")
+        for line in rdata.get("diff_snippet", "").splitlines():
+            if line.startswith("+"):
+                print(f"    {GREEN}{line}{RESET}")
+            elif line.startswith("-"):
+                print(f"    {RED}{line}{RESET}")
+            else:
+                print(f"    {DIM}{line}{RESET}")
+        print("  ```")
+        print(f"\n  {DIM}To apply automatically across all matching findings, run: {CYAN}npx torusguard harden && npx torusguard apply{RESET}\n")
+        return
+
     if json_output:
         print(json.dumps(recipes, indent=2))
         return
 
     # Header Card
     print()
-    print(box_header("🛡️  TORUSGUARD GOLDEN FIX RECIPES", "Distilled Ponytail Fixes (<= 35 add, <= 25 del) in Persistent Memory", "v1.3.6"))
+    sub_title = f"Filtered by '{search_query}'" if search_query else "Distilled Ponytail Fixes (<= 35 add, <= 25 del) in Persistent Memory"
+    print(box_header("🛡️  TORUSGUARD GOLDEN FIX RECIPES", sub_title, "v1.4.0"))
     print()
 
     if not recipes:
-        print(f"  {YELLOW}ℹ No golden fix recipes captured yet.{RESET}")
+        print(f"  {YELLOW}ℹ No golden fix recipes found matching query.{RESET}")
         print(f"  Run {CYAN}npx torusguard harden{RESET} followed by {CYAN}npx torusguard apply{RESET} to distill verified recipes.\n")
         return
 
@@ -125,12 +197,23 @@ def list_recipes(target_root: Path, detail_id: Optional[str] = None, json_output
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Golden Fix Recipe Explorer")
     parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--target", "-t", help="Target project root directory (alias for path)")
     parser.add_argument("--detail", "-d", help="Inspect specific recipe ID")
+    parser.add_argument("--search", "-s", help="Filter recipes by rule, keyword, or language")
+    parser.add_argument("--export", "-e", help="Export recipes to JSON or Markdown file path")
+    parser.add_argument("--apply", "-a", help="Project and display application diff for specific recipe ID")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
     args = parser.parse_args()
 
-    target = Path(args.path).resolve()
-    list_recipes(target, detail_id=args.detail, json_output=args.json)
+    target = Path(args.target or args.path).resolve()
+    list_recipes(
+        target,
+        detail_id=args.detail,
+        search_query=args.search,
+        export_path=args.export,
+        apply_id=args.apply,
+        json_output=args.json
+    )
 
 
 if __name__ == "__main__":

package/skills/torusguard/payload/scripts/report_sync.py

@@ -184,9 +184,9 @@ def parse_existing_report(report_path: Path) -> Dict[str, Any]:
 
     # ── Format B (new v2): ### TG-RULE-001 · Title `status` `confidence` ──
     card_pattern_v2 = re.compile(
-        r'###\s+(TG-[A-Z]+-\d+)\s+·\s+(.*?)\s+`([^`]+)`\s+`([^`]+)`\n'
-        r'- \*\*Finding ID:\*\*\s+`([^`]+)`(?:[^\n]*\*\*Severity:\*\*\s+`([^`]+)`)?\n'
-        r'(?:📁|- \*\*Target:\*\*)\s*`([^`\n]+)`',
+        r'###\s+(TG-[A-Z]+-\d+)\s+·\s+(.*?)\s+`([^`]+)`\s+`([^`]+)`[\r\n]+'
+        r'-\s+\*\*Finding ID:\*\*\s+`([^`]+)`(?:[^\r\n]*\*\*Severity:\*\*\s+`([^`]+)`)?(?:[^\r\n]*\*\*Cluster:\*\*\s+`([^`]+)`)?[^\r\n]*[\r\n]+'
+        r'(?:📁|- \*\*Target:\*\*)\s*`?([^\r\n`]+)`?(?:[\r\n]+\*\*Problem:\*\*\s+([^\r\n]+))?',
         re.MULTILINE
     )
 
@@ -197,7 +197,9 @@ def parse_existing_report(report_path: Path) -> Dict[str, Any]:
         confidence = m.group(4).strip()
         finding_id = m.group(5).strip()
         sev_explicit = m.group(6).strip() if m.group(6) else None
-        target = m.group(7).strip()
+        cluster_explicit = m.group(7).strip() if m.group(7) else None
+        target = m.group(8).strip()
+        problem = m.group(9).strip() if m.group(9) else None
 
         if finding_id not in findings:  # Don't overwrite legacy matches
             if sev_explicit:
@@ -220,6 +222,8 @@ def parse_existing_report(report_path: Path) -> Dict[str, Any]:
                 "severity": severity,
                 "confidence": confidence,
                 "target": target,
+                "cluster": cluster_explicit or "cluster-general",
+                "description": problem or "Security violation detected.",
                 "history": []
             }
 
@@ -257,6 +261,37 @@ def parse_existing_report(report_path: Path) -> Dict[str, Any]:
                 "details": "Restored from inline history"
             })
 
+    # Enrich findings from run history if available
+    runs_dir = report_path.parent / ".torusguard" / "runs"
+    run_findings_map: Dict[str, Any] = {}
+    if runs_dir.is_dir():
+        for d in sorted(runs_dir.iterdir()):
+            if d.is_dir() and (d / "findings.json").is_file():
+                try:
+                    f_items = json.loads((d / "findings.json").read_text(encoding="utf-8"))
+                    for it in f_items:
+                        if isinstance(it, dict) and it.get("finding_id"):
+                            run_findings_map[it["finding_id"]] = it
+                except Exception:
+                    pass
+
+    for fid, f in findings.items():
+        if fid in run_findings_map:
+            rf = run_findings_map[fid]
+            if not f.get("cluster") or f.get("cluster") == "cluster-general":
+                f["cluster"] = rf.get("cluster") or "cluster-general"
+            if not f.get("category"):
+                f["category"] = rf.get("category") or "general"
+            if not f.get("target") or "\n" in f.get("target", "") or "**Problem:**" in f.get("target", "") or f.get("target") == "unknown":
+                f["target"] = f"{rf.get('file_path', 'unknown')}:{rf.get('line_number', 1)}"
+            if not f.get("description") or f.get("description") == "Security violation detected.":
+                f["description"] = rf.get("description") or "Security invariant check failed."
+            if not f.get("snippet"):
+                f["snippet"] = rf.get("snippet") or rf.get("matched_text", "")
+            if not f.get("file_path"):
+                f["file_path"] = rf.get("file_path", "")
+            if not f.get("line_number"):
+                f["line_number"] = rf.get("line_number", 1)
 
     return {"findings": findings, "raw_content": content}
 
@@ -384,6 +419,83 @@ def render_report(findings: List[Dict[str, Any]], target_root: Path) -> str:
         lines.append(f"> ⚠️ **Action Required:** {crit_open} critical finding{'s' if crit_open != 1 else ''} require immediate attention. Run `npx torusguard harden` to generate patches.")
         lines.append("")
 
+    # ── Governed Remediation & Problem-Solved Velocity Table ──
+    crit_resolved = max(0, crit_count - crit_open)
+    high_resolved = max(0, high_count - high_open)
+    med_resolved = max(0, med_count - med_open)
+    low_resolved = max(0, low_count)
+
+    crit_pct = int((crit_resolved / crit_count) * 100) if crit_count > 0 else 100
+    high_pct = int((high_resolved / high_count) * 100) if high_count > 0 else 100
+    med_pct = int((med_resolved / med_count) * 100) if med_count > 0 else 100
+    overall_pct = int((resolved_count / total) * 100) if total > 0 else 100
+
+    lines.extend([
+        "### ⚡ Governed Remediation & Problem-Solved Velocity",
+        "",
+        "| Severity Layer | Total Discovered | Remediated & Hardened | Active Exposure | Closure Rate | Status |",
+        "| :--- | :---: | :---: | :---: | :---: | :---: |",
+        f"| **Critical** | {crit_count} | {crit_resolved} | {crit_open} | {crit_pct}% | {'🟢 100% DEFENDED' if crit_open == 0 else '🔴 ACTION REQUIRED'} |",
+        f"| **High** | {high_count} | {high_resolved} | {high_open} | {high_pct}% | {'🟢 100% DEFENDED' if high_open == 0 else '🟠 NEEDS ATTENTION'} |",
+        f"| **Medium / Low** | {med_count + low_count} | {med_resolved + low_resolved} | {med_open} | {med_pct}% | {'🟢 100% DEFENDED' if med_open == 0 else '🟡 PENDING REVIEW'} |",
+        f"| **Total Flaws** | **{total}** | **{resolved_count}** | **{open_count}** | **{overall_pct}%** | **{'🟢 100% HARDENED' if open_count == 0 else '🟡 REMEDIATION IN PROGRESS'}** |",
+        "",
+    ])
+
+    # ── Directory Attack Surface Overview Table ──
+    dir_stats: Dict[str, Dict[str, int]] = {}
+    for f in findings:
+        t = f.get('target', '')
+        fp = t.split(':')[0] if ':' in t else t
+        fp = fp.replace('\\', '/')
+        d_name = f"{fp.split('/')[0]}/" if '/' in fp else "root"
+        if d_name not in dir_stats:
+            dir_stats[d_name] = {"total": 0, "resolved": 0, "open": 0}
+        dir_stats[d_name]["total"] += 1
+        if "RESOLVED" in f.get("status", ""):
+            dir_stats[d_name]["resolved"] += 1
+        else:
+            dir_stats[d_name]["open"] += 1
+
+    if dir_stats:
+        lines.extend([
+            "### 🗺️ Directory Attack Surface Defended",
+            "",
+            "| Directory / Module | Total Invariants Checked | Vulnerabilities Neutralized | Active Risk | Defense Posture |",
+            "| :--- | :---: | :---: | :---: | :--- |",
+        ])
+        for d_name, d_data in sorted(dir_stats.items(), key=lambda x: x[1]["total"], reverse=True):
+            posture_str = "🟢 Hardened Zone (100% Invariants Enforced)" if d_data["open"] == 0 else f"🔴 Active Exposure ({d_data['open']} Open Flaws)"
+            lines.append(f"| `{d_name}` | {d_data['total']} | {d_data['resolved']} | {d_data['open']} | {posture_str} |")
+        lines.append("")
+
+    # ── Root-Cause Architectural Clusters Overview Table ──
+    cluster_stats: Dict[str, Dict[str, Any]] = {}
+    for f in findings:
+        c_id = f.get('cluster') or f.get('category') or 'cluster-general'
+        if c_id not in cluster_stats:
+            cluster_stats[c_id] = {"total": 0, "resolved": 0, "open": 0, "rules": set()}
+        cluster_stats[c_id]["total"] += 1
+        cluster_stats[c_id]["rules"].add(f.get("rule_id", "TG-GEN"))
+        if "RESOLVED" in f.get("status", ""):
+            cluster_stats[c_id]["resolved"] += 1
+        else:
+            cluster_stats[c_id]["open"] += 1
+
+    if cluster_stats:
+        lines.extend([
+            "### 🏛️ Root-Cause Architectural Clusters",
+            "",
+            "| Cluster ID | Threat Architectural Domain | Neutralized Issues | Enforced Invariants | Posture State |",
+            "| :--- | :--- | :---: | :--- | :--- |",
+        ])
+        for c_id, c_data in sorted(cluster_stats.items(), key=lambda x: x[1]["total"], reverse=True):
+            c_domain = c_id.replace("cluster-", "").replace("-", " ").title()
+            rules_str = ", ".join(f"`{r}`" for r in sorted(c_data["rules"])[:3])
+            c_state = "🟢 Dismantled & Defended" if c_data["open"] == 0 else f"🔴 {c_data['open']} Active Flaws"
+            lines.append(f"| `{c_id}` | {c_domain} | {c_data['resolved']} | {rules_str} | {c_state} |")
+        lines.append("")
+
     lines.append("---")
     lines.append("")
 
@@ -445,11 +557,26 @@ def _render_finding_card(f: Dict[str, Any]) -> List[str]:
     status_full = f["status"]
     conf = f.get('confidence', '70% (High Confidence)')
     sev = f.get('severity', 'High')
+    target = f.get('target', 'unknown')
+    if "\n" in target:
+        target = target.splitlines()[0]
+    target = target.strip().strip("`")
+    if target.startswith("📁"):
+        target = target.replace("📁", "").strip()
+
+    desc = f.get('what_is_wrong') or f.get('description') or 'Security violation detected.'
+    if "\n" in desc:
+        desc = desc.splitlines()[0]
+    desc = desc.strip().strip("`")
+    if desc.startswith("**Problem:**"):
+        desc = desc.replace("**Problem:**", "").strip()
+
+    cluster_badge = f" · **Cluster:** `{f['cluster']}`" if f.get("cluster") else ""
     card = [
         f"### {f['rule_id']} · {f['title']} `{status_full}` `{conf}`",
-        f"- **Finding ID:** `{f['finding_id']}` · **Severity:** `{sev}`",
-        f"📁 `{f['target']}`",
-        f"**Problem:** {f.get('what_is_wrong', f.get('description', 'Security violation detected.'))}",
+        f"- **Finding ID:** `{f['finding_id']}` · **Severity:** `{sev}`{cluster_badge}",
+        f"📁 `{target}`",
+        f"**Problem:** {desc}",
     ]
     if f.get("what_should_change"):
         card.append(f"**Fix:** {f['what_should_change']}")