torusguard 1.3.6 → 2.0.0-alpha

package/.torusguard/runs/run-20260918-105940-audit/manifest.json

@@ -8,5 +8,6 @@
   "torusguard_version": "1.3.0",
   "findings_count": 0,
   "confirmed_fixed_count": 0,
-  "regressed_count": 0
+  "regressed_count": 0,
+  "remediation_bundles_count": 0
 }

package/.torusguard/runs/run-20260918-105940-audit/remediation.md

@@ -0,0 +1,7 @@
+# TorusGuard Governed Remediation Catalog
+**Run ID:** `run-20260918-105940-audit`  
+**Generated:** `2026-09-19 14:54:41 IST`  
+**Candidate Bundles Formulated:** `0`  
+
+---
+## Formulated Candidate Patches

package/.torusguard/runs/run-20260919-145701-audit/findings.json

@@ -0,0 +1 @@
+[]

package/.torusguard/runs/run-20260919-145701-audit/findings.md

@@ -0,0 +1,8 @@
+# TorusGuard Security Audit Findings: run-20260919-145701-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `0`
+- Identified Clusters: `0`
+- Generated At: `2026-09-19 14:57:01 IST`
+
+---
+## Summary of Findings

package/.torusguard/runs/run-20260919-145701-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260919-145701-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-19 14:57:01 IST",
+  "created_at_iso": "2026-09-19T14:57:01.568307+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 0,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260919-145701-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260919-145701-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 0
+- Root-Cause Clusters: 0
+- Generated: 2026-09-19 14:57:01 IST

package/.torusguard/runs/run-20260919-151729-audit/findings.json

@@ -0,0 +1 @@
+[]

package/.torusguard/runs/run-20260919-151729-audit/findings.md

@@ -0,0 +1,8 @@
+# TorusGuard Security Audit Findings: run-20260919-151729-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `0`
+- Identified Clusters: `0`
+- Generated At: `2026-09-19 15:17:29 IST`
+
+---
+## Summary of Findings

package/.torusguard/runs/run-20260919-151729-audit/manifest.json

@@ -0,0 +1,13 @@
+{
+  "run_id": "run-20260919-151729-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-19 15:17:29 IST",
+  "created_at_iso": "2026-09-19T15:17:29.783790+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 0,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0,
+  "remediation_bundles_count": 0
+}

package/.torusguard/runs/run-20260919-151729-audit/remediation.md

@@ -0,0 +1,7 @@
+# TorusGuard Governed Remediation Catalog
+**Run ID:** `run-20260919-151729-audit`  
+**Generated:** `2026-09-19 15:17:35 IST`  
+**Candidate Bundles Formulated:** `0`  
+
+---
+## Formulated Candidate Patches

package/.torusguard/runs/run-20260919-151729-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260919-151729-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 0
+- Root-Cause Clusters: 0
+- Generated: 2026-09-19 15:17:29 IST

package/.torusguard/runs/run-20260919-152340-audit/findings.json

@@ -0,0 +1 @@
+[]

package/.torusguard/runs/run-20260919-152340-audit/findings.md

@@ -0,0 +1,8 @@
+# TorusGuard Security Audit Findings: run-20260919-152340-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `0`
+- Identified Clusters: `0`
+- Generated At: `2026-09-19 15:23:40 IST`
+
+---
+## Summary of Findings

package/.torusguard/runs/run-20260919-152340-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260919-152340-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-19 15:23:40 IST",
+  "created_at_iso": "2026-09-19T15:23:40.802283+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 0,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260919-152340-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260919-152340-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 0
+- Root-Cause Clusters: 0
+- Generated: 2026-09-19 15:23:40 IST

package/.torusguard/runs/run-20260919-152345-audit/findings.json

@@ -0,0 +1 @@
+[]

package/.torusguard/runs/run-20260919-152345-audit/findings.md

@@ -0,0 +1,8 @@
+# TorusGuard Security Audit Findings: run-20260919-152345-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `0`
+- Identified Clusters: `0`
+- Generated At: `2026-09-19 15:23:45 IST`
+
+---
+## Summary of Findings

package/.torusguard/runs/run-20260919-152345-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260919-152345-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-19 15:23:45 IST",
+  "created_at_iso": "2026-09-19T15:23:45.599143+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 0,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260919-152345-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260919-152345-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 0
+- Root-Cause Clusters: 0
+- Generated: 2026-09-19 15:23:45 IST

package/.torusguard/runs/run-20260919-153500-audit/findings.json

@@ -0,0 +1 @@
+[]

package/.torusguard/runs/run-20260919-153500-audit/findings.md

@@ -0,0 +1,8 @@
+# TorusGuard Security Audit Findings: run-20260919-153500-audit
+- Target Root: `C:\Users\Admin\Desktop\TorusGuard`
+- Total Scored Findings: `0`
+- Identified Clusters: `0`
+- Generated At: `2026-09-19 15:35:00 IST`
+
+---
+## Summary of Findings

package/.torusguard/runs/run-20260919-153500-audit/manifest.json

@@ -0,0 +1,12 @@
+{
+  "run_id": "run-20260919-153500-audit",
+  "command": "audit",
+  "target_name": "TorusGuard",
+  "created_at": "2026-09-19 15:35:00 IST",
+  "created_at_iso": "2026-09-19T15:35:00.129289+05:30",
+  "status": "completed",
+  "torusguard_version": "1.3.0",
+  "findings_count": 0,
+  "confirmed_fixed_count": 0,
+  "regressed_count": 0
+}

package/.torusguard/runs/run-20260919-153500-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260919-153500-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 0
+- Root-Cause Clusters: 0
+- Generated: 2026-09-19 15:35:00 IST

package/.torusguard/scripts/apply_runner.py

@@ -58,7 +58,7 @@ def box_line(content: str, width: int = 67, border: str = "│", border_color: s
         return term_ui.format_box_line(content, width=width, border=border, border_color=border_color)
     return f"  {border_color}{border}{RESET}  {content}"
 
-def box_header(title: str, subtitle: str = "", version: str = "v1.3.6", border_color: str = CYAN) -> str:
+def box_header(title: str, subtitle: str = "", version: str = "v1.4.0", border_color: str = CYAN) -> str:
     if term_ui:
         return term_ui.card_header(title, subtitle, version, border_color)
     return f"=== {title} ({version}) ==="
@@ -81,6 +81,35 @@ def find_latest_audit_run(runs_dir: Path) -> Optional[Path]:
     return runs[0] if runs else None
 
 
+def list_snapshots(target_root: Path) -> None:
+    """Display historical pre-apply backup snapshots."""
+    snapshots_base = target_root / ".torusguard" / "snapshots"
+    print()
+    print(box_header("🛡️  TORUSGUARD SNAPSHOT LEDGER", "Pre-Apply Safety Snapshots (.bak)", "v1.4.0"))
+    print()
+    if not snapshots_base.is_dir():
+        print(f"  {YELLOW}ℹ No snapshots directory found at:{RESET} {snapshots_base}\n")
+        return
+    snapshots = sorted([d for d in snapshots_base.iterdir() if d.is_dir()], key=lambda p: p.stat().st_mtime, reverse=True)
+    if not snapshots:
+        print(f"  {YELLOW}ℹ No rollback snapshots captured yet.{RESET}\n")
+        return
+    print(border_top(f"Available Snapshots ({len(snapshots)})"))
+    for s in snapshots:
+        bak_files = list(s.rglob("*.bak"))
+        total_bytes = sum(f.stat().st_size for f in bak_files)
+        kb_str = f"{total_bytes / 1024:.1f} KB"
+        try:
+            mtime_dt = datetime.datetime.fromtimestamp(s.stat().st_mtime, tz=IST)
+            time_str = mtime_dt.strftime("%Y-%m-%d %H:%M:%S IST")
+        except Exception:
+            time_str = "Captured"
+        print(box_line(f"{GREEN}{s.name}{RESET} ({len(bak_files)} files · {kb_str})"))
+        print(box_line(f"  └─ {DIM}Timestamp: {time_str}{RESET}"))
+    print(border_bottom())
+    print(f"\n  {DIM}To restore any snapshot, run: {CYAN}npx torusguard rollback --run <snapshot-name>{RESET}\n")
+
+
 def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> None:
     """Restore all target files from the pre-apply backup snapshots."""
     snapshots_base = target_root / ".torusguard" / "snapshots"
@@ -115,7 +144,7 @@ def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> Non
         pass
 
     print()
-    print(box_header("🛡️  TORUSGUARD ROLLBACK RESTORATION", "Restored original files from pre-apply snapshot", "v1.3.6"))
+    print(box_header("🛡️  TORUSGUARD ROLLBACK RESTORATION", "Restored original files from pre-apply snapshot", "v1.4.0"))
     print()
 
     print(border_top("Rollback Snapshot Restored"))
@@ -128,7 +157,7 @@ def execute_rollback(target_root: Path, run_id_arg: Optional[str] = None) -> Non
     sys.exit(0)
 
 
-def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_approve: bool = False) -> Dict[str, Any]:
+def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_approve: bool = False, diff_only: bool = False, selective: bool = False, verify_post_apply: bool = False) -> Dict[str, Any]:
     runs_dir = target_root / ".torusguard" / "runs"
     if run_id_arg:
         run_folder = runs_dir / run_id_arg
@@ -144,7 +173,7 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     bundle_meta_files = list(bundles_dir.glob("*/metadata.json")) if bundles_dir.is_dir() else []
     if not bundle_meta_files:
         print()
-        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.6"))
+        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.4.0"))
         print()
         print(f"  {YELLOW}ℹ Zero candidate remediation bundles found in run: {run_folder.name}{RESET}")
         print(f"  {GRAY}The findings in this run require manual review or AI-assisted remediation.{RESET}\n")
@@ -163,13 +192,46 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
         except Exception:
             pass
 
+    # Diff Preview Mode
+    if diff_only:
+        print()
+        print(box_header("🛡️  TORUSGUARD GOVERNED PATCH DIFF PREVIEW", "Dry-Run Unified Diff Inspection (No Files Modified)", "v1.4.0"))
+        print()
+        print(border_top(f"Candidate Patches ({len(bundles)})"))
+        for idx, b in enumerate(bundles, 1):
+            rule_id = b.get("rule_id", "TG-SEC")
+            rel_path = b.get("target_file", "")
+            line_no = b.get("line_number", 1)
+            diff = b.get("proposed_diff", "")
+            desc = b.get("what_should_change", "")
+            print(f"  {YELLOW}─── [{idx}/{len(bundles)}] Candidate Patch: [{rule_id}] on {rel_path}:{line_no} ───{RESET}")
+            print(f"  Strategy: {WHITE}{desc}{RESET}")
+            print(f"  Ponytail: {GREEN}+{b.get('additions', 0)} / -{b.get('deletions', 0)}{RESET}\n")
+            for dline in diff.splitlines()[:16]:
+                if dline.startswith("+") and not dline.startswith("+++"):
+                    print(f"    {GREEN}{dline}{RESET}")
+                elif dline.startswith("-") and not dline.startswith("---"):
+                    print(f"    {RED}{dline}{RESET}")
+                elif dline.startswith("@"):
+                    print(f"    {CYAN}{dline}{RESET}")
+                else:
+                    print(f"    {DIM}{dline}{RESET}")
+            print()
+        print(border_bottom())
+        print(f"\n  {DIM}To apply these patches to disk, run: {CYAN}npx torusguard apply{RESET} or {CYAN}npx torusguard apply --yes{RESET}\n")
+        return {
+            "status": "diff_preview",
+            "bundles_count": len(bundles),
+            "bundles": bundles
+        }
+
     # Snapshot directory
     snapshot_dir = target_root / ".torusguard" / "snapshots" / run_folder.name
     snapshot_dir.mkdir(parents=True, exist_ok=True)
 
     # Header Card
     print()
-    print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.3.6"))
+    print(box_header("🛡️  TORUSGUARD GOVERNED PATCH APPLIER", "Human-Gate Authorization, Snapshots & Golden Recipe Distillation", "v1.4.0"))
     print()
 
     print(border_top("Candidate Bundles Ready for Application"))
@@ -181,7 +243,7 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
 
     applied_count = 0
     skipped_count = 0
-    all_approved = auto_approve
+    all_approved = False if selective else auto_approve
     diff_summary_lines = [f"# TorusGuard Applied Patch Summary: {run_folder.name}\n"]
     applied_bundles = []
 
@@ -357,6 +419,21 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
     print(border_bottom(border_color=GREEN, double=True))
     print()
 
+    if verify_post_apply and applied_count > 0:
+        recheck_script = scripts_dir / "recheck_runner.py"
+        if recheck_script.is_file():
+            print(f"\n  {CYAN}▸ Triggering differential recheck post-apply (--verify)...{RESET}\n")
+            try:
+                import importlib.util
+                spec = importlib.util.spec_from_file_location("recheck_runner", str(recheck_script))
+                if spec and spec.loader:
+                    rc_mod = importlib.util.module_from_spec(spec)
+                    spec.loader.exec_module(rc_mod)
+                    if hasattr(rc_mod, "execute_recheck"):
+                        rc_mod.execute_recheck(target_root, run_folder.name)
+            except Exception as e:
+                print(f"  {YELLOW}⚠ Post-apply recheck notice: {e}{RESET}")
+
     return {
         "applied_count": applied_count,
         "skipped_count": skipped_count,
@@ -368,19 +445,35 @@ def execute_apply(target_root: Path, run_id_arg: Optional[str] = None, auto_appr
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Governed Patch Application Engine")
     parser.add_argument("path", nargs="?", default=".", help="Target project root directory")
+    parser.add_argument("--target", "-t", help="Target project root directory (alias for path)")
     parser.add_argument("--run", "-r", help="Explicit run ID to apply")
     parser.add_argument("--yes", "-y", action="store_true", help="Auto-approve all patches (non-interactive)")
+    parser.add_argument("--diff", action="store_true", help="Preview unified diffs without modifying files on disk")
+    parser.add_argument("--selective", action="store_true", help="Interactively review and select patches one by one")
+    parser.add_argument("--verify", action="store_true", help="Trigger differential AST recheck immediately post-apply")
+    parser.add_argument("--list-snapshots", action="store_true", help="List historical pre-apply backup snapshots")
     parser.add_argument("--rollback", action="store_true", help="Rollback all applied patches using snapshots")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
     args = parser.parse_args()
 
-    target = Path(args.path).resolve()
+    target = Path(args.target or args.path).resolve()
+
+    if args.list_snapshots:
+        list_snapshots(target)
+        return
 
     if args.rollback:
         execute_rollback(target, run_id_arg=args.run)
         return
 
-    result = execute_apply(target, run_id_arg=args.run, auto_approve=args.yes)
+    result = execute_apply(
+        target,
+        run_id_arg=args.run,
+        auto_approve=args.yes,
+        diff_only=args.diff,
+        selective=args.selective,
+        verify_post_apply=args.verify
+    )
     if args.json:
         print(json.dumps(result, indent=2))
 

package/.torusguard/scripts/audit_runner.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-TorusGuard Autonomous Static Security Audit Engine (v1.3.6)
+TorusGuard Autonomous Static Security Audit Engine (v1.4.0)
 Multi-language static pattern & AST security scanner.
 Evaluates source trees against canonical TorusGuard rule families,
 augments confidence via the persistent security memory subsystem,
@@ -12,6 +12,7 @@ Pure Python 3.10+ standard library (zero external dependencies).
 import sys
 import os
 import re
+import time
 import json
 import hashlib
 import argparse
@@ -369,7 +370,9 @@ RULE_PATTERNS: List[RulePattern] = [
         "patterns": [
             (re.compile(r'(?:query|execute|raw)\s*\(\s*f["\'].*SELECT.*\{', re.IGNORECASE), "Python f-string interpolation in raw SQL query"),
             (re.compile(r'(?:query|execute|raw)\s*\(\s*[`"\'].*SELECT.*\$\{', re.IGNORECASE), "JavaScript template literal interpolation in SQL query"),
-            (re.compile(r'(?:query|execute|raw)\s*\(\s*["\'].*SELECT.*\+\s*(?:req|input|params)', re.IGNORECASE), "String concatenation in raw SQL query")
+            (re.compile(r'(?:query|execute|raw)\s*\(\s*["\'].*SELECT.*\+\s*(?:req|input|params)', re.IGNORECASE), "String concatenation in raw SQL query"),
+            (re.compile(r'(?:db|tx)\.(?:Query|Exec|QueryRow)\s*\(\s*fmt\.Sprintf\s*\(\s*["\'].*(?:SELECT|INSERT|UPDATE|DELETE).*%s', re.IGNORECASE), "Go database/sql query using fmt.Sprintf string interpolation instead of parameterized placeholders"),
+            (re.compile(r'(?:db|tx)\.(?:Query|Exec|QueryRow)\s*\(\s*["\'].*(?:SELECT|INSERT|UPDATE|DELETE).*\+\s*(?:r\.URL|c\.Query|input|param)', re.IGNORECASE), "Go database/sql query with string concatenation")
         ]
     },
     {
@@ -414,7 +417,8 @@ RULE_PATTERNS: List[RulePattern] = [
         "cluster": "cluster-injection",
         "patterns": [
             (re.compile(r'(?:open|readFile|readFileSync)\s*\([^)]*\+\s*(?:req|params|query)'), "File read operation using unsanitized user request path"),
-            (re.compile(r'path\.join\s*\([^)]*(?:req\.params|req\.query)\.[a-zA-Z0-9_]+\)'), "Path traversal sink in path.join without basename sanitization")
+            (re.compile(r'path\.join\s*\([^)]*(?:req\.params|req\.query)\.[a-zA-Z0-9_]+\)'), "Path traversal sink in path.join without basename sanitization"),
+            (re.compile(r'(?:os\.Open|os\.ReadFile|ioutil\.ReadFile)\s*\([^)]*(?:c\.Query|c\.Param|r\.URL\.Query|filepath\.Join\([^)]*(?:c\.Query|c\.Param|r\.URL\.Query))'), "Go file read operation using unsanitized user request parameter")
         ]
     },
 
@@ -502,7 +506,8 @@ RULE_PATTERNS: List[RulePattern] = [
         "category": "ssrf",
         "cluster": "cluster-ssrf",
         "patterns": [
-            (re.compile(r'(?:fetch|axios\.get|requests\.get|urllib\.request\.urlopen)\s*\(\s*(?:req\.query|req\.body|request\.GET)\.[a-zA-Z0-9_]+'), "Outbound HTTP request directly invoking user-supplied URL parameter")
+            (re.compile(r'(?:fetch|axios\.get|requests\.get|urllib\.request\.urlopen)\s*\(\s*(?:req\.query|req\.body|request\.GET)\.[a-zA-Z0-9_]+'), "Outbound HTTP request directly invoking user-supplied URL parameter"),
+            (re.compile(r'http\.(?:Get|Post|Head)\s*\(\s*(?:r\.URL\.Query|c\.Query|c\.Param|req\.)'), "Go http.Get/Post directly invoking user-supplied URL parameter")
         ]
     },
     {
@@ -533,7 +538,9 @@ RULE_PATTERNS: List[RulePattern] = [
         "category": "ssrf",
         "cluster": "cluster-ssrf",
         "patterns": [
-            (re.compile(r'requests\.(?:get|post|put)\s*\((?![^)]*\btimeout\s*=)[^)]*\)'), "Python requests call without explicit timeout parameter")
+            (re.compile(r'requests\.(?:get|post|put)\s*\((?![^)]*\btimeout\s*=)[^)]*\)'), "Python requests call without explicit timeout parameter"),
+            (re.compile(r'&http\.Client\s*\{\s*\}'), "Go http.Client initialized without explicit Timeout boundary (defaults to unbounded zero)"),
+            (re.compile(r'http\.DefaultClient\.(?:Get|Post|Do)\s*\('), "Go http.DefaultClient call with zero/unbounded request timeout")
         ]
     },
 
@@ -693,7 +700,8 @@ RULE_PATTERNS: List[RulePattern] = [
         "category": "supply",
         "cluster": "cluster-supply-chain",
         "patterns": [
-            (re.compile(r'^\s*package-lock\.json\s*$', re.MULTILINE), "Lockfile package-lock.json explicitly ignored in .gitignore")
+            (re.compile(r'^\s*package-lock\.json\s*$', re.MULTILINE), "Lockfile package-lock.json explicitly ignored in .gitignore"),
+            (re.compile(r'^\s*go\.sum\s*$', re.MULTILINE), "Go dependency checksum lockfile go.sum explicitly ignored in .gitignore")
         ]
     },
     {
@@ -1362,7 +1370,7 @@ def emit_run_artifacts(run_folder: Path, scored_findings: List[Dict[str, Any]],
             pass
 
 
-def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: List[Dict[str, Any]], clusters: Dict[str, List[Dict[str, Any]]], run_folder: Path, detected_stack: Optional[Dict[str, Any]] = None) -> None:
+def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: List[Dict[str, Any]], clusters: Dict[str, List[Dict[str, Any]]], run_folder: Path, detected_stack: Optional[Dict[str, Any]] = None, perf_metrics: Optional[Dict[str, Any]] = None) -> None:
     """Print the unified 75-column TorusGuard Static Audit results card."""
     crit_count = sum(1 for f in scored_findings if f["severity"] == "Critical")
     high_count = sum(1 for f in scored_findings if f["severity"] == "High")
@@ -1373,13 +1381,17 @@ def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: L
         stack_str = f"{detected_stack.get('framework')} ({detected_stack.get('language')})"
 
     print()
-    print(card_header("🛡️  TORUSGUARD STATIC SECURITY AUDIT", "Autonomous AST & Invariant Security Scanner", "v1.3.6"))
+    print(card_header("🛡️  TORUSGUARD STATIC SECURITY AUDIT", "Autonomous AST & Invariant Security Scanner", "v1.4.0"))
     print()
 
     print(card_border_top("Audit Execution Scope"))
     print(format_box_line(f"{BOLD}Target:{RESET}       {WHITE}{str(target_root)}{RESET}"))
     print(format_box_line(f"{BOLD}Stack:{RESET}        {GREEN}{stack_str}{RESET}"))
     print(format_box_line(f"{BOLD}Files:{RESET}        {WHITE}{file_count} files evaluated across 18 rule families (74 rules){RESET}"))
+    if perf_metrics:
+        ms = perf_metrics.get("elapsed_ms", 0)
+        fps = perf_metrics.get("throughput_fps", 0)
+        print(format_box_line(f"{BOLD}Metrics:{RESET}      {CYAN}{ms}ms{RESET} elapsed · {GREEN}{fps} files/sec{RESET} throughput"))
     print(card_border_bottom())
     print()
 
@@ -1389,6 +1401,17 @@ def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: L
     print(format_box_line(f"Status:      {status_icon}"))
     print(format_box_line(f"Findings:    {RED}{crit_count} Critical{RESET}  {YELLOW}{high_count} High{RESET}  {CYAN}{med_count} Medium/Low{RESET}  ({len(scored_findings)} total)"))
     print(format_box_line(f"Clusters:    {WHITE}{len(clusters)} architectural root causes identified{RESET}"))
+
+    # Rule Family Breakdown
+    if scored_findings:
+        fam_counts: Dict[str, int] = {}
+        for f in scored_findings:
+            rid = f.get("rule_id", "")
+            parts = rid.split("-")
+            fam = f"{parts[0]}-{parts[1]}" if len(parts) >= 2 else "OTHER"
+            fam_counts[fam] = fam_counts.get(fam, 0) + 1
+        fam_items = [f"{YELLOW}{k}{RESET}: {v}" for k, v in sorted(fam_counts.items(), key=lambda x: -x[1])[:4]]
+        print(format_box_line(f"Families:    {'  '.join(fam_items)}"))
     print(card_divider())
 
     if not scored_findings:
@@ -1418,8 +1441,69 @@ def print_audit_dashboard(target_root: Path, file_count: int, scored_findings: L
     print()
 
 
+def export_sarif(target_root: Path, run_folder_str: Optional[str], sarif_out: Optional[str] = None) -> None:
+    """Export audit run findings to OASIS SARIF v2.1.0 format."""
+    s_dir = Path(__file__).resolve().parent
+    sarif_script = s_dir / "sarif_exporter.py"
+    if sarif_script.is_file():
+        try:
+            import importlib.util
+            spec = importlib.util.spec_from_file_location("sarif_exporter", str(sarif_script))
+            if spec and spec.loader:
+                mod = importlib.util.module_from_spec(spec)
+                spec.loader.exec_module(mod)
+                run_id = Path(run_folder_str).name if run_folder_str else "audit-run"
+                findings = []
+                if run_folder_str and (Path(run_folder_str) / "findings.json").is_file():
+                    with open(Path(run_folder_str) / "findings.json", "r", encoding="utf-8") as f:
+                        findings = json.load(f)
+                sarif_data = mod.generate_sarif(findings, run_id=run_id)
+                out_path = Path(sarif_out) if sarif_out else (target_root / ".torusguard" / "reports" / "torusguard-audit.sarif")
+                out_path.parent.mkdir(parents=True, exist_ok=True)
+                with open(out_path, "w", encoding="utf-8") as f:
+                    json.dump(sarif_data, f, indent=2)
+                print(f"  {GREEN}✔ OASIS SARIF v2.1.0 exported to:{RESET} {CYAN}{out_path}{RESET}\n")
+        except Exception as e:
+            print(f"  {YELLOW}⚠ SARIF export notice: {e}{RESET}")
+
+
+def run_watch_mode(target_root: Path, severity_floor: str = "medium", json_output: bool = False, include_tests: bool = False, sarif: bool = False, sarif_out: Optional[str] = None) -> None:
+    """Run audit continuously, re-scanning when files are modified."""
+    print(f"\n  {CYAN}👀 TorusGuard Watch Mode active.{RESET} Watching {WHITE}{target_root}{RESET} (Ctrl+C to stop)...\n")
+
+    def get_file_mtimes() -> Dict[str, float]:
+        mtimes = {}
+        for f in find_files_to_scan(target_root, include_tests=include_tests):
+            try:
+                mtimes[str(f)] = f.stat().st_mtime
+            except OSError:
+                pass
+        return mtimes
+
+    last_mtimes = get_file_mtimes()
+    res = execute_audit(target_root, severity_floor=severity_floor, json_output=json_output, include_tests=include_tests)
+    if sarif:
+        export_sarif(target_root, res.get("run_folder"), sarif_out)
+
+    try:
+        while True:
+            time.sleep(1.0)
+            curr_mtimes = get_file_mtimes()
+            if curr_mtimes != last_mtimes:
+                changed = [f for f in curr_mtimes if f not in last_mtimes or curr_mtimes[f] != last_mtimes.get(f)]
+                last_mtimes = curr_mtimes
+                now_str = get_ist_now().strftime("%H:%M:%S")
+                print(f"\n  {CYAN}↻ File changes detected ({len(changed)} file(s)) at {now_str}. Re-scanning...{RESET}\n")
+                res = execute_audit(target_root, severity_floor=severity_floor, json_output=json_output, include_tests=include_tests)
+                if sarif:
+                    export_sarif(target_root, res.get("run_folder"), sarif_out)
+    except KeyboardInterrupt:
+        print(f"\n  {YELLOW}🛑 Watch mode stopped.{RESET}\n")
+
+
 def execute_audit(target_root: Path, severity_floor: str = "medium", json_output: bool = False, include_tests: bool = False) -> Dict[str, Any]:
     """Execute the full TorusGuard static security audit."""
+    start_time = time.perf_counter()
     target_root = target_root.resolve()
     s_dir = Path(__file__).resolve().parent
 
@@ -1474,6 +1558,13 @@ def execute_audit(target_root: Path, severity_floor: str = "medium", json_output
     except Exception:
         pass
 
+    elapsed_ms = int((time.perf_counter() - start_time) * 1000)
+    throughput = round(len(files) / max(0.001, (elapsed_ms / 1000.0)), 1)
+    perf_metrics = {
+        "elapsed_ms": elapsed_ms,
+        "throughput_fps": throughput
+    }
+
     result = {
         "status": "completed",
         "target_root": str(target_root),
@@ -1484,13 +1575,15 @@ def execute_audit(target_root: Path, severity_floor: str = "medium", json_output
         "medium_count": sum(1 for f in scored_findings if f["severity"] in ("Medium", "Low")),
         "clusters_count": len(clusters),
         "run_folder": str(run_folder),
-        "findings": scored_findings
+        "findings": scored_findings,
+        "elapsed_ms": elapsed_ms,
+        "throughput_fps": throughput
     }
 
     if json_output:
         print(json.dumps(result, indent=2))
     else:
-        print_audit_dashboard(target_root, len(files), scored_findings, clusters, run_folder, detected_stack)
+        print_audit_dashboard(target_root, len(files), scored_findings, clusters, run_folder, detected_stack, perf_metrics=perf_metrics)
 
     return result
 
@@ -1498,14 +1591,26 @@ def execute_audit(target_root: Path, severity_floor: str = "medium", json_output
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Static Security Audit Engine")
     parser.add_argument("path", nargs="?", default=".", help="Target project root directory to audit")
+    parser.add_argument("--target", "-t", help="Target project root directory (alias for path)")
     parser.add_argument("--scope", "-s", help="Alternative path to target project")
     parser.add_argument("--severity", choices=["critical", "high", "medium", "low"], default="medium", help="Severity floor")
+    parser.add_argument("--watch", "-w", action="store_true", help="Continuous watch mode: re-scan on file save")
+    parser.add_argument("--sarif", action="store_true", help="Automatically export findings to OASIS SARIF v2.1.0")
+    parser.add_argument("--sarif-out", help="Output file path for SARIF export")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
     parser.add_argument("--include-tests", action="store_true", help="Include test files and harness fixtures in scan")
     args = parser.parse_args()
 
-    target = Path(args.scope or args.path).resolve()
+    target = Path(args.target or args.scope or args.path).resolve()
+
+    if args.watch:
+        run_watch_mode(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests, sarif=args.sarif, sarif_out=args.sarif_out)
+        sys.exit(0)
+
     res = execute_audit(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests)
+    if args.sarif:
+        export_sarif(target, res.get("run_folder"), args.sarif_out)
+
     sys.exit(0 if res["critical_count"] == 0 else 1)