torusguard 2.1.0 → 2.1.1

package/skills/torusguard/payload/rules/rag/TG-RAG-002-autonomous-llm-tool-unsandboxed-call.md

@@ -1,51 +1,51 @@
-# TG-RAG-002: Autonomous LLM Tool Unsandboxed Call
-
-## Severity
-Critical. Executing system shell commands, raw SQL, or filesystem modifications based directly on model tool call outputs without schema validation or sandboxing allows remote code execution (RCE).
-
-## Applies To
-- LLM Function Calling, Agent Tool Calling, ReAct loops, Model Context Protocol (MCP) servers
-- Python, Node.js, Go
-
-## Why It Matters
-When an AI agent calls external tools (e.g. `execute_code`, `query_database`, `run_bash`), the arguments originate from stochastic model generation. If the model was prompted or tricked via prompt injection to emit `rm -rf /` or `DROP TABLE users;`, executing those arguments without strict allowlists, parameterization, or sandboxing destroys data or compromises the server.
-
-## What TorusGuard Looks For
-1. Passing tool call arguments directly to `os.system`, `subprocess.run(..., shell=True)`, or `child_process.exec`.
-2. Evaluating raw SQL emitted by LLM tool calls without parameterization.
-3. Lack of human-in-the-loop confirmation on destructive tool invocations.
-
-## Unsafe Example
-```python
-# UNSAFE: Unsandboxed execution of model tool call
-def handle_tool_call(tool_call):
-    if tool_call.function.name == "run_command":
-        args = json.loads(tool_call.function.arguments)
-        # Directly executes arbitrary shell command generated by LLM!
-        return subprocess.check_output(args["cmd"], shell=True)
-```
-
-## Safe Example
-```python
-# SAFE: Strict schema validation, command allowlisting, and no shell=True
-ALLOWED_COMMANDS = {"git status", "git diff", "npm test"}
-
-def handle_tool_call(tool_call):
-    if tool_call.function.name == "run_command":
-        args = json.loads(tool_call.function.arguments)
-        cmd = args.get("cmd", "").strip()
-        
-        if cmd not in ALLOWED_COMMANDS:
-            raise PermissionError(f"Command not permitted: {cmd}")
-            
-        return subprocess.check_output(cmd.split(), shell=False)
-```
-
-## Remediation
-1. Enforce strict Pydantic/Zod schemas on all tool arguments.
-2. Ban `shell=True` when invoking sub-processes from AI tool calls.
-3. Require explicit human confirmation (Human Gate) for state-altering, file-writing, or network operations.
-
-## Related Rules
-- `TG-AGENT-002`: Unsafe Tool Dispatch
-- `TG-INPUT-003`: Unsafe Code Execution
+# TG-RAG-002: Autonomous LLM Tool Unsandboxed Call
+
+## Severity
+Critical. Executing system shell commands, raw SQL, or filesystem modifications based directly on model tool call outputs without schema validation or sandboxing allows remote code execution (RCE).
+
+## Applies To
+- LLM Function Calling, Agent Tool Calling, ReAct loops, Model Context Protocol (MCP) servers
+- Python, Node.js, Go
+
+## Why It Matters
+When an AI agent calls external tools (e.g. `execute_code`, `query_database`, `run_bash`), the arguments originate from stochastic model generation. If the model was prompted or tricked via prompt injection to emit `rm -rf /` or `DROP TABLE users;`, executing those arguments without strict allowlists, parameterization, or sandboxing destroys data or compromises the server.
+
+## What TorusGuard Looks For
+1. Passing tool call arguments directly to `os.system`, `subprocess.run(..., shell=True)`, or `child_process.exec`.
+2. Evaluating raw SQL emitted by LLM tool calls without parameterization.
+3. Lack of human-in-the-loop confirmation on destructive tool invocations.
+
+## Unsafe Example
+```python
+# UNSAFE: Unsandboxed execution of model tool call
+def handle_tool_call(tool_call):
+    if tool_call.function.name == "run_command":
+        args = json.loads(tool_call.function.arguments)
+        # Directly executes arbitrary shell command generated by LLM!
+        return subprocess.check_output(args["cmd"], shell=True)
+```
+
+## Safe Example
+```python
+# SAFE: Strict schema validation, command allowlisting, and no shell=True
+ALLOWED_COMMANDS = {"git status", "git diff", "npm test"}
+
+def handle_tool_call(tool_call):
+    if tool_call.function.name == "run_command":
+        args = json.loads(tool_call.function.arguments)
+        cmd = args.get("cmd", "").strip()
+        
+        if cmd not in ALLOWED_COMMANDS:
+            raise PermissionError(f"Command not permitted: {cmd}")
+            
+        return subprocess.check_output(cmd.split(), shell=False)
+```
+
+## Remediation
+1. Enforce strict Pydantic/Zod schemas on all tool arguments.
+2. Ban `shell=True` when invoking sub-processes from AI tool calls.
+3. Require explicit human confirmation (Human Gate) for state-altering, file-writing, or network operations.
+
+## Related Rules
+- `TG-AGENT-002`: Unsafe Tool Dispatch
+- `TG-INPUT-003`: Unsafe Code Execution

package/skills/torusguard/payload/rules/rag/TG-RAG-003-unpartitioned-vector-tenant-lookup.md

@@ -1,51 +1,51 @@
-# TG-RAG-003: Unpartitioned Vector Database Tenant Lookup
-
-## Severity
-High. Executing similarity searches across vector databases without multi-tenant metadata filters leaks private organization or user documents across tenant boundaries.
-
-## Applies To
-- Vector Databases: Pinecone, Qdrant, Chroma, Weaviate, Milvus, pgvector
-- RAG applications with multi-tenant users or workspaces
-
-## Why It Matters
-Vector embeddings from different tenants exist in the same high-dimensional embedding space. If an embedding lookup only searches by cosine similarity without an explicit `filter={"tenant_id": user.tenant_id}` or namespace partition, queries from User A will return private embeddings, contracts, or records belonging to User B.
-
-## What TorusGuard Looks For
-1. Vector similarity searches lacking metadata filter arguments (e.g. `index.query(vector=..., top_k=5)` with no `filter`).
-2. Missing tenant partitioning in vector retrieval endpoints.
-
-## Unsafe Example
-```python
-# UNSAFE: Vector similarity search across all tenants
-def search_knowledge_base(user: User, query_vector: list[float]):
-    results = pinecone_index.query(
-        vector=query_vector,
-        top_k=5,
-        include_metadata=True
-        # MISSING tenant filter!
-    )
-    return results
-```
-
-## Safe Example
-```python
-# SAFE: Mandatory tenant scoping in metadata filter
-def search_knowledge_base(user: User, query_vector: list[float]):
-    results = pinecone_index.query(
-        vector=query_vector,
-        top_k=5,
-        include_metadata=True,
-        filter={
-            "tenant_id": {"$eq": user.tenant_id}
-        }
-    )
-    return results
-```
-
-## Remediation
-1. Always scope vector similarity queries by tenant ID in the metadata filter.
-2. In pgvector, enforce row-level security (RLS) or explicit `WHERE tenant_id = :tenant_id` clauses on embedding queries.
-
-## Related Rules
-- `TG-DB-001`: Missing Tenant Query Isolation
-- `TG-RAG-001`: Untrusted RAG Context Injection
+# TG-RAG-003: Unpartitioned Vector Database Tenant Lookup
+
+## Severity
+High. Executing similarity searches across vector databases without multi-tenant metadata filters leaks private organization or user documents across tenant boundaries.
+
+## Applies To
+- Vector Databases: Pinecone, Qdrant, Chroma, Weaviate, Milvus, pgvector
+- RAG applications with multi-tenant users or workspaces
+
+## Why It Matters
+Vector embeddings from different tenants exist in the same high-dimensional embedding space. If an embedding lookup only searches by cosine similarity without an explicit `filter={"tenant_id": user.tenant_id}` or namespace partition, queries from User A will return private embeddings, contracts, or records belonging to User B.
+
+## What TorusGuard Looks For
+1. Vector similarity searches lacking metadata filter arguments (e.g. `index.query(vector=..., top_k=5)` with no `filter`).
+2. Missing tenant partitioning in vector retrieval endpoints.
+
+## Unsafe Example
+```python
+# UNSAFE: Vector similarity search across all tenants
+def search_knowledge_base(user: User, query_vector: list[float]):
+    results = pinecone_index.query(
+        vector=query_vector,
+        top_k=5,
+        include_metadata=True
+        # MISSING tenant filter!
+    )
+    return results
+```
+
+## Safe Example
+```python
+# SAFE: Mandatory tenant scoping in metadata filter
+def search_knowledge_base(user: User, query_vector: list[float]):
+    results = pinecone_index.query(
+        vector=query_vector,
+        top_k=5,
+        include_metadata=True,
+        filter={
+            "tenant_id": {"$eq": user.tenant_id}
+        }
+    )
+    return results
+```
+
+## Remediation
+1. Always scope vector similarity queries by tenant ID in the metadata filter.
+2. In pgvector, enforce row-level security (RLS) or explicit `WHERE tenant_id = :tenant_id` clauses on embedding queries.
+
+## Related Rules
+- `TG-DB-001`: Missing Tenant Query Isolation
+- `TG-RAG-001`: Untrusted RAG Context Injection

package/skills/torusguard/payload/rules/redos/TG-REDOS-001-catastrophic-exponential-backtracking.md

@@ -1,46 +1,46 @@
-# TG-REDOS-001: Catastrophic Exponential Backtracking in Regular Expression
-
-## Severity
-High. Regular expressions with catastrophic backtracking trigger exponential time complexity ($O(2^n)$) when evaluating non-matching input strings, freezing CPU cores and causing Denial of Service.
-
-## Applies To
-- JavaScript / TypeScript (`RegExp`, `pattern.test()`), Python (`re.match`, `re.search`), Go, Java, Ruby
-- Input validation patterns, email validators, URL extractors
-
-## Why It Matters
-Traditional regex engines using NFA backtracking (e.g. JavaScript V8, Python `re`, Java `java.util.regex`, PCRE) explore all possible match paths on failure. When a pattern contains overlapping nested repetitions like `(a+)+$`, an input of 30 characters like `aaaaaaaaaaaaaaaaaaaaaaaaaaaaab` can require over 1 billion comparison operations, freezing the Node.js event loop or Python GIL.
-
-## What TorusGuard Looks For
-1. Nested repetitions: `([a-zA-Z0-9]+)+`, `(a+)+`, `(\d+)*`.
-2. Overlapping alternations with outer quantifiers: `(a|aa)+`, `(x|x)*`.
-3. Greedy repetition with overlapping prefix and suffix.
-
-## Unsafe Example
-```javascript
-// UNSAFE: Catastrophic backtracking on non-matching strings
-const EMAIL_REGEX = /^([a-zA-Z0-9_\.\-])+@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;
-
-// Freezes server:
-EMAIL_REGEX.test("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!");
-```
-
-## Safe Example
-```javascript
-// SAFE: Linear time validation using atomic checks, character class bounds, or validator libraries
-const validator = require('validator');
-if (!validator.isEmail(input)) {
-  throw new Error("Invalid email");
-}
-
-// Or constrained regex without nested quantifiers:
-const SAFE_EMAIL = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
-```
-
-## Remediation
-1. Eliminate nested quantifiers (`(x+)+` -> `x+`).
-2. Disallow overlapping tokens in alternations.
-3. In Node.js, wrap untrusted input validation with `safe-regex` or strict input length bounds (e.g. `if (input.length > 256) return false;`).
-
-## Related Rules
-- `TG-REDOS-002`: Unbounded Nested Quantifier
-- `TG-RATE-003`: Unbounded Resource Consumption
+# TG-REDOS-001: Catastrophic Exponential Backtracking in Regular Expression
+
+## Severity
+High. Regular expressions with catastrophic backtracking trigger exponential time complexity ($O(2^n)$) when evaluating non-matching input strings, freezing CPU cores and causing Denial of Service.
+
+## Applies To
+- JavaScript / TypeScript (`RegExp`, `pattern.test()`), Python (`re.match`, `re.search`), Go, Java, Ruby
+- Input validation patterns, email validators, URL extractors
+
+## Why It Matters
+Traditional regex engines using NFA backtracking (e.g. JavaScript V8, Python `re`, Java `java.util.regex`, PCRE) explore all possible match paths on failure. When a pattern contains overlapping nested repetitions like `(a+)+$`, an input of 30 characters like `aaaaaaaaaaaaaaaaaaaaaaaaaaaaab` can require over 1 billion comparison operations, freezing the Node.js event loop or Python GIL.
+
+## What TorusGuard Looks For
+1. Nested repetitions: `([a-zA-Z0-9]+)+`, `(a+)+`, `(\d+)*`.
+2. Overlapping alternations with outer quantifiers: `(a|aa)+`, `(x|x)*`.
+3. Greedy repetition with overlapping prefix and suffix.
+
+## Unsafe Example
+```javascript
+// UNSAFE: Catastrophic backtracking on non-matching strings
+const EMAIL_REGEX = /^([a-zA-Z0-9_\.\-])+@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;
+
+// Freezes server:
+EMAIL_REGEX.test("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!");
+```
+
+## Safe Example
+```javascript
+// SAFE: Linear time validation using atomic checks, character class bounds, or validator libraries
+const validator = require('validator');
+if (!validator.isEmail(input)) {
+  throw new Error("Invalid email");
+}
+
+// Or constrained regex without nested quantifiers:
+const SAFE_EMAIL = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
+```
+
+## Remediation
+1. Eliminate nested quantifiers (`(x+)+` -> `x+`).
+2. Disallow overlapping tokens in alternations.
+3. In Node.js, wrap untrusted input validation with `safe-regex` or strict input length bounds (e.g. `if (input.length > 256) return false;`).
+
+## Related Rules
+- `TG-REDOS-002`: Unbounded Nested Quantifier
+- `TG-RATE-003`: Unbounded Resource Consumption

package/skills/torusguard/payload/rules/redos/TG-REDOS-002-unbounded-nested-quantifier.md

@@ -1,43 +1,43 @@
-# TG-REDOS-002: Unbounded Nested Quantifier in Input Validation
-
-## Severity
-Medium. Unbounded repeated capture groups without boundary anchors cause polynomial ($O(n^2)$) or exponential degradation on large payloads.
-
-## Applies To
-- Input validation filters, route path matchers, sanitizer regexes
-- Polyglot web backends and client-side form validators
-
-## Why It Matters
-When regexes use repeated capture groups like `(\w+\s*)+` without anchoring, trailing spaces or punctuation force the engine into deep recursive state branches. While not always pure exponential, large payloads (e.g. 50KB JSON strings) will peg CPU at 100% for minutes.
-
-## What TorusGuard Looks For
-1. Nested groups where both inner and outer components have greedy repetition (`+` or `*`).
-2. Regexes evaluated on user-supplied strings without a preceding string length check.
-
-## Unsafe Example
-```python
-# UNSAFE: Unbounded nested quantifier on user input
-import re
-
-TAG_REGEX = re.compile(r"^(<[a-z]+(\s+[a-z]+=[^>]+)*>)+$")
-match = TAG_REGEX.match(user_payload)
-```
-
-## Safe Example
-```python
-# SAFE: Bounded input length check + non-nested linear pattern
-import re
-
-if len(user_payload) > 512:
-    return False
-
-# Use a dedicated HTML parser (BeautifulSoup / html5lib) instead of regex
-```
-
-## Remediation
-1. Bound user input length *before* regex execution.
-2. Replace complex nested regexes with dedicated, parser-based validation libraries (e.g., standard parsers for HTML, URLs, and emails).
-
-## Related Rules
-- `TG-REDOS-001`: Catastrophic Exponential Backtracking
-- `TG-INPUT-001`: Missing Server Validation
+# TG-REDOS-002: Unbounded Nested Quantifier in Input Validation
+
+## Severity
+Medium. Unbounded repeated capture groups without boundary anchors cause polynomial ($O(n^2)$) or exponential degradation on large payloads.
+
+## Applies To
+- Input validation filters, route path matchers, sanitizer regexes
+- Polyglot web backends and client-side form validators
+
+## Why It Matters
+When regexes use repeated capture groups like `(\w+\s*)+` without anchoring, trailing spaces or punctuation force the engine into deep recursive state branches. While not always pure exponential, large payloads (e.g. 50KB JSON strings) will peg CPU at 100% for minutes.
+
+## What TorusGuard Looks For
+1. Nested groups where both inner and outer components have greedy repetition (`+` or `*`).
+2. Regexes evaluated on user-supplied strings without a preceding string length check.
+
+## Unsafe Example
+```python
+# UNSAFE: Unbounded nested quantifier on user input
+import re
+
+TAG_REGEX = re.compile(r"^(<[a-z]+(\s+[a-z]+=[^>]+)*>)+$")
+match = TAG_REGEX.match(user_payload)
+```
+
+## Safe Example
+```python
+# SAFE: Bounded input length check + non-nested linear pattern
+import re
+
+if len(user_payload) > 512:
+    return False
+
+# Use a dedicated HTML parser (BeautifulSoup / html5lib) instead of regex
+```
+
+## Remediation
+1. Bound user input length *before* regex execution.
+2. Replace complex nested regexes with dedicated, parser-based validation libraries (e.g., standard parsers for HTML, URLs, and emails).
+
+## Related Rules
+- `TG-REDOS-001`: Catastrophic Exponential Backtracking
+- `TG-INPUT-001`: Missing Server Validation

package/skills/torusguard/payload/scripts/audit_runner.py

@@ -42,8 +42,16 @@ def get_ist_now() -> datetime.datetime:
 
 # ─── UI Formatter Bridge ──────────────────────────────────────────────────────
 scripts_dir = Path(__file__).resolve().parent
+tg_root = Path(__file__).resolve().parent.parent
+project_root = Path(__file__).resolve().parent.parent.parent
 if str(scripts_dir) not in sys.path:
     sys.path.insert(0, str(scripts_dir))
+if str(tg_root) not in sys.path:
+    sys.path.insert(0, str(tg_root))
+if str(project_root) not in sys.path:
+    sys.path.insert(0, str(project_root))
+
+
 
 try:
     import term_ui as tui
@@ -1240,9 +1248,10 @@ def scan_file(file_path: Path, target_root: Path) -> List[Dict[str, Any]]:
     return findings
 
 
-def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path) -> Tuple[List[Dict[str, Any]], Dict[str, List[Dict[str, Any]]]]:
+def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path, taint_paths: Optional[List[Any]] = None) -> Tuple[List[Dict[str, Any]], Dict[str, List[Dict[str, Any]]]]:
     """
-    Score each finding using finding_scorer.py and persistent memory patterns.
+    Score each finding using finding_scorer.py, persistent memory patterns,
+    and taint dataflow analysis.
     Returns (scored_findings, clusters_map).
     """
     try:
@@ -1253,6 +1262,15 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
     scored = []
     clusters: Dict[str, List[Dict[str, Any]]] = {}
 
+    # Map taint paths by (file_path, line_number)
+    taint_by_loc: Dict[Tuple[str, int], Any] = {}
+    if taint_paths:
+        for tp in taint_paths:
+            sink_node = getattr(tp, "sink", None)
+            if sink_node:
+                norm_p = getattr(sink_node, "file_path", "").replace("\\", "/")
+                taint_by_loc[(norm_p, getattr(sink_node, "line_number", 0))] = tp
+
     # Phase 1d: Pre-compute cross-file corroboration bonus
     # If multiple rule families flag the same file, each finding gets +5 confidence
     file_rule_families: Dict[str, set] = {}
@@ -1267,6 +1285,14 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
         band = "High Confidence"
         factors = {}
 
+        # Check for correlated taint path
+        matching_tp = taint_by_loc.get((f["file_path"], f["line_number"]))
+        is_taint_confirmed = matching_tp is not None
+        taint_depth = getattr(matching_tp, "depth", None) if matching_tp else None
+        is_sanitized = getattr(matching_tp, "is_sanitized", False) if matching_tp else False
+        if matching_tp and hasattr(matching_tp, "to_dict"):
+            f["taint_path"] = matching_tp.to_dict()
+
         if finding_scorer:
             try:
                 # Phase 1d: Dynamic evidence quality based on rule precision
@@ -1291,7 +1317,11 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
                     manual_review_status=mr,
                     rule_id=f["rule_id"],
                     file_path=f["file_path"],
-                    root_dir=target_root
+                    root_dir=target_root,
+                    taint_path_confirmed=is_taint_confirmed,
+                    taint_depth=taint_depth,
+                    sanitizer_present=is_sanitized,
+                    rule_severity=f.get("severity", "High")
                 )
                 score = s
                 band = b
@@ -1315,6 +1345,7 @@ def score_and_cluster_findings(findings: List[Dict[str, Any]], target_root: Path
     return scored, clusters
 
 
+
 def emit_run_artifacts(run_folder: Path, scored_findings: List[Dict[str, Any]], clusters: Dict[str, List[Dict[str, Any]]], target_root: Path) -> None:
     """Generate findings.json, findings.md, and summary.md into run folder."""
     now_ist = get_ist_now()
@@ -1501,7 +1532,14 @@ def run_watch_mode(target_root: Path, severity_floor: str = "medium", json_outpu
         print(f"\n  {YELLOW}🛑 Watch mode stopped.{RESET}\n")
 
 
-def execute_audit(target_root: Path, severity_floor: str = "medium", json_output: bool = False, include_tests: bool = False) -> Dict[str, Any]:
+def execute_audit(
+    target_root: Path,
+    severity_floor: str = "medium",
+    json_output: bool = False,
+    include_tests: bool = False,
+    incremental: bool = False,
+    use_taint: bool = True
+) -> Dict[str, Any]:
     """Execute the full TorusGuard static security audit."""
     start_time = time.perf_counter()
     target_root = target_root.resolve()
@@ -1522,14 +1560,64 @@ def execute_audit(target_root: Path, severity_floor: str = "medium", json_output
         except Exception:
             pass
 
-    # 2. Collect files & scan
+    # 2. Collect files to scan
     files = find_files_to_scan(target_root, include_tests=include_tests)
     all_findings = []
-    for f in files:
-        all_findings.extend(scan_file(f, target_root))
 
-    # 3. Score & Cluster
-    scored_findings, clusters = score_and_cluster_findings(all_findings, target_root)
+    inc_scanner = None
+    files_to_scan = files
+    unchanged_files = []
+
+    if incremental:
+        try:
+            from core.incremental import IncrementalScanner
+            inc_scanner = IncrementalScanner(target_root)
+            files_to_scan, unchanged_files = inc_scanner.get_changed_files(files)
+            # Rehydrate findings for unchanged files
+            for uf in unchanged_files:
+                all_findings.extend(inc_scanner.get_cached_findings(uf))
+        except Exception:
+            files_to_scan = files
+            unchanged_files = []
+
+    # Parallel or sequential scan on files_to_scan
+    new_findings = []
+    try:
+        from core.parallel import ParallelAuditExecutor
+        executor = ParallelAuditExecutor()
+        new_findings = executor.scan_files_parallel(files_to_scan, lambda f: scan_file(f, target_root))
+    except Exception:
+        for f in files_to_scan:
+            new_findings.extend(scan_file(f, target_root))
+
+    all_findings.extend(new_findings)
+
+    # Update cache if incremental scanner is active
+    if inc_scanner:
+        # Group new findings by file
+        file_to_findings: Dict[Path, List[Dict[str, Any]]] = {f: [] for f in files_to_scan}
+        for nf in new_findings:
+            raw_fp = nf.get("file_path", "")
+            target_f = target_root / raw_fp
+            if target_f in file_to_findings:
+                file_to_findings[target_f].append(nf)
+        for target_f, f_list in file_to_findings.items():
+            inc_scanner.update_file_cache(target_f, f_list)
+        inc_scanner.save_cache()
+
+    # 2.5 Taint Dataflow Analysis (if enabled)
+    taint_paths = []
+    if use_taint:
+        try:
+            from core.cross_file_taint import CrossFileTaintAnalyzer
+            analyzer = CrossFileTaintAnalyzer(target_root)
+            # Analyze target files (capped to 200 files for high responsiveness)
+            taint_paths = analyzer.analyze_project(files[:200])
+        except Exception:
+            taint_paths = []
+
+    # 3. Score & Cluster with Taint Evidence
+    scored_findings, clusters = score_and_cluster_findings(all_findings, target_root, taint_paths=taint_paths)
 
     # 4. Allocate run folder
     runs_dir = target_root / ".torusguard" / "runs"
@@ -1595,6 +1683,8 @@ def main():
     parser.add_argument("--scope", "-s", help="Alternative path to target project")
     parser.add_argument("--severity", choices=["critical", "high", "medium", "low"], default="medium", help="Severity floor")
     parser.add_argument("--watch", "-w", action="store_true", help="Continuous watch mode: re-scan on file save")
+    parser.add_argument("--incremental", "-i", action="store_true", help="Incremental mode: only scan modified files")
+    parser.add_argument("--no-taint", action="store_true", help="Disable taint-aware dataflow analysis")
     parser.add_argument("--sarif", action="store_true", help="Automatically export findings to OASIS SARIF v2.1.0")
     parser.add_argument("--sarif-out", help="Output file path for SARIF export")
     parser.add_argument("--json", action="store_true", help="Output raw JSON")
@@ -1607,10 +1697,18 @@ def main():
         run_watch_mode(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests, sarif=args.sarif, sarif_out=args.sarif_out)
         sys.exit(0)
 
-    res = execute_audit(target, severity_floor=args.severity, json_output=args.json, include_tests=args.include_tests)
+    res = execute_audit(
+        target,
+        severity_floor=args.severity,
+        json_output=args.json,
+        include_tests=args.include_tests,
+        incremental=args.incremental,
+        use_taint=(not args.no_taint)
+    )
     if args.sarif:
         export_sarif(target, res.get("run_folder"), args.sarif_out)
 
+
     sys.exit(0 if res["critical_count"] == 0 else 1)