torusguard 2.1.1 → 2.1.2

package/skills/torusguard/payload/scripts/stride_generator.py

@@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+"""
+TorusGuard STRIDE Threat Modeling & Data Flow Diagram (DFD) Synthesizer
+Automatically maps application entry points, trust boundaries, and datastores to generate
+interactive Mermaid DFDs and structured STRIDE risk registers for security compliance.
+"""
+
+import os
+import re
+import json
+from pathlib import Path
+from typing import Dict, List, Set, Any
+
+
+def discover_architecture_components(root_dir: Path) -> Dict[str, Any]:
+    entrypoints = []
+    datastores = set()
+    external_sinks = set()
+    trust_boundaries = ["Public Internet", "API Perimeter / DMZ", "Protected Core Services", "Isolated Data Tier"]
+
+    skip_dirs = {"node_modules", ".git", ".torusguard", "dist", "build", ".next", "__pycache__"}
+
+    # Patterns for HTTP routes
+    route_patterns = [
+        re.compile(r"""(?:app|router|server)\.(get|post|put|delete|patch)\s*\(\s*['"]([^'"]+)['"]"""),
+        re.compile(r"""@(?:app|router)\.(get|post|put|delete|patch)\s*\(\s*['"]([^'"]+)['"]"""),
+        re.compile(r"""http\.HandleFunc\s*\(\s*['"]([^'"]+)['"]"""),
+    ]
+
+    # Patterns for datastores & sinks
+    db_patterns = [
+        (re.compile(r"""(?i)(postgres|pg|prisma|typeorm|sequelize)"""), "PostgreSQL / Relational DB"),
+        (re.compile(r"""(?i)(mongo|mongoose)"""), "MongoDB / Document Store"),
+        (re.compile(r"""(?i)(redis|ioredis)"""), "Redis / In-Memory Cache"),
+        (re.compile(r"""(?i)(sqlite|sqlite3)"""), "SQLite / Local DB"),
+    ]
+
+    sink_patterns = [
+        (re.compile(r"""(?i)(stripe|paypal)"""), "Payment Gateway (Stripe/PayPal)"),
+        (re.compile(r"""(?i)(openai|anthropic|bedrock)"""), "AI LLM Provider (OpenAI/Anthropic)"),
+        (re.compile(r"""(?i)(aws-sdk|boto3|s3)"""), "Cloud Storage (AWS S3)"),
+        (re.compile(r"""(?i)(sendgrid|nodemailer|twilio)"""), "Communication Gateway (Twilio/SendGrid)"),
+    ]
+
+    for root, dirs, files in os.walk(root_dir):
+        dirs[:] = [d for d in dirs if d not in skip_dirs]
+        for f in files:
+            ext = os.path.splitext(f)[1].lower()
+            if ext not in {".js", ".jsx", ".ts", ".tsx", ".py", ".go"}:
+                continue
+            file_path = Path(root) / f
+            try:
+                content = file_path.read_text(encoding="utf-8", errors="ignore")
+                rel_path = file_path.relative_to(root_dir).as_posix()
+
+                # Find routes
+                for pat in route_patterns:
+                    for method, path in pat.findall(content):
+                        entrypoints.append({
+                            "method": method.upper(),
+                            "path": path,
+                            "file": rel_path
+                        })
+
+                # Find DBs
+                for pat, name in db_patterns:
+                    if pat.search(content):
+                        datastores.add(name)
+
+                # Find Sinks
+                for pat, name in sink_patterns:
+                    if pat.search(content):
+                        external_sinks.add(name)
+
+            except Exception:
+                continue
+
+    return {
+        "entrypoints": entrypoints[:25],
+        "total_routes_detected": len(entrypoints),
+        "datastores": sorted(datastores) if datastores else ["Internal SQLite / Local Memory Store"],
+        "external_sinks": sorted(external_sinks) if external_sinks else ["Standard Outbound HTTPS Sinks"],
+        "trust_boundaries": trust_boundaries
+    }
+
+
+def generate_mermaid_dfd(components: Dict[str, Any]) -> str:
+    lines = [
+        "```mermaid",
+        "flowchart TB",
+        "    subgraph Zone1 [Public Internet / Client Tier]",
+        "        User([Web / Mobile Client])",
+        "        Attacker([Adversarial Threat Actor])",
+        "    end",
+        "",
+        "    subgraph Zone2 [API Perimeter & Trust Boundary]",
+        "        Gateway[API Gateway / Router Handlers]"
+    ]
+
+    for i, ep in enumerate(components["entrypoints"][:4]):
+        lines.append(f"        Route_{i}[{ep['method']} {ep['path']}]")
+
+    lines.extend([
+        "    end",
+        "",
+        "    subgraph Zone3 [Core Application Execution Tier]",
+        "        AppEngine[TorusGuard Governed App Logic]",
+        "        AuthModule[Authentication & Tenant Scoper]",
+        "    end",
+        "",
+        "    subgraph Zone4 [Data & External Integration Tier]"
+    ])
+
+    for i, db in enumerate(components["datastores"]):
+        lines.append(f"        DB_{i}[({db})]")
+
+    for i, sink in enumerate(components["external_sinks"]):
+        lines.append(f"        Sink_{i}[/{sink}/]")
+
+    lines.extend([
+        "    end",
+        "",
+        "    User -->|HTTP / TLS| Gateway",
+        "    Attacker -.->|Untrusted Payloads| Gateway",
+        "    Gateway --> AppEngine",
+        "    AppEngine --> AuthModule",
+    ])
+
+    for i in range(len(components["datastores"])):
+        lines.append(f"    AuthModule -->|Scoped Query| DB_{i}")
+
+    for i in range(len(components["external_sinks"])):
+        lines.append(f"    AppEngine -->|Egress HTTPS| Sink_{i}")
+
+    lines.append("```")
+    return "\n".join(lines)
+
+
+def generate_stride_report(root_dir: Path) -> str:
+    comp = discover_architecture_components(root_dir)
+    mermaid = generate_mermaid_dfd(comp)
+
+    report = f"""# TorusGuard Architectural Threat Model & STRIDE Register
+
+**Generated by:** TorusGuard Threat Modeling Engine (v2.1.2)  
+**Workspace:** `{root_dir.resolve().as_posix()}`  
+**Analyzed Routes:** {comp['total_routes_detected']}  
+**Identified Data Stores:** {', '.join(comp['datastores'])}  
+**External Egress Sinks:** {', '.join(comp['external_sinks'])}  
+
+---
+
+## 1. Architectural Data Flow Diagram (DFD)
+
+{mermaid}
+
+---
+
+## 2. STRIDE Risk Assessment & Invariant Ledger
+
+| STRIDE Category | Threat Description | Attack Vector | TorusGuard Guardrail | Mitigation Status |
+| :--- | :--- | :--- | :---: | :---: |
+| **Spoofing** | Attacker impersonates legitimate user or service via unverified JWT or forged credentials. | Forged token on `{comp['entrypoints'][0]['path'] if comp['entrypoints'] else '/api'}` | `TG-AUTH-001` / `TG-SEC-001` | **Enforced** |
+| **Tampering** | Unsanitized parameter injection modifies database records or query logic across tenants. | Dynamic SQL concatenation or unpartitioned PK lookups | `TG-DB-001` / `TG-DB-002` | **Enforced** |
+| **Repudiation** | Actions executed without persistent audit traces or immutable transaction locks. | Missing audit headers on state-changing API endpoints | `TG-BIZ-002` / `TG-AUDIT-001` | **Monitored** |
+| **Information Disclosure** | Credentials, API tokens, or multi-tenant database partitions exposed to browser clients. | Bundled service keys or error stack traces | `TG-CLIENT-001` / `TG-DB-001` | **Enforced** |
+| **Denial of Service** | Resource exhaustion via unbounded regex backtracking or unthrottled authentication endpoints. | Catastrophic ReDoS input or unrate-limited auth routes | `TG-REDOS-001` / `TG-RATE-001` | **Enforced** |
+| **Elevation of Privilege** | Unsandboxed tool dispatch or privileged container execution breaks host isolation. | Docker socket mounts or missing role checks | `TG-CONT-002` / `TG-AGENT-002` | **Enforced** |
+
+---
+
+## 3. Trust Boundary Verification Checklist
+
+- [x] **Boundary 1 (Internet to Gateway):** Enforce strict TLS, rate limiting, and CORS origin verification (`TG-RATE-001`, `TG-WS-001`).
+- [x] **Boundary 2 (Gateway to App Core):** Mandatory tenant scoping and structural prompt isolation for LLMs (`TG-DB-001`, `TG-AGENT-001`).
+- [x] **Boundary 3 (App Core to Data Stores):** Parameterized queries and fail-closed entropy validation (`TG-DB-002`, `TG-SEC-004`).
+- [x] **Boundary 4 (App Core to External Sinks):** SSRF hostname whitelisting and private IP resolution blocking (`TG-SSRF-001`, `TG-SSRF-002`).
+
+*Report automatically synced with workspace security posture ledger.*
+"""
+    return report
+
+
+def main():
+    import sys
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8")
+    target = Path(sys.argv[1] if len(sys.argv) > 1 else ".")
+    report_content = generate_stride_report(target)
+    out_file = target / "SECURITY_THREAT_MODEL.md"
+    out_file.write_text(report_content, encoding="utf-8")
+    print(f"[+] Generated architectural STRIDE threat model: {out_file.as_posix()}")
+
+
+if __name__ == "__main__":
+    main()

package/skills/torusguard/payload/skills/torusguard/bootstrap.py

@@ -144,7 +144,7 @@ def card_divider(title: str = "", border_color: str = CYAN, double: bool = False
         return f"  {border_color}{left}{h} {BOLD}{WHITE}{title}{RESET}{border_color} {h * rem}{right}{RESET}"
     return f"  {border_color}{left}{h * 71}{right}{RESET}"
 
-def card_header(title: str, subtitle: str = "", version: str = "v2.1.1", border_color: str = CYAN) -> str:
+def card_header(title: str, subtitle: str = "", version: str = "v2.1.2", border_color: str = CYAN) -> str:
     """Generate standardized 75-column curved header box."""
     top = f"  {border_color}╭{'─' * 71}╮{RESET}"
     bottom = f"  {border_color}╰{'─' * 71}╯{RESET}"
@@ -164,7 +164,7 @@ def card_header(title: str, subtitle: str = "", version: str = "v2.1.1", border_
 def print_header():
     """Print the branded TorusGuard header card."""
     print()
-    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.1"))
+    print(card_header("🛡️  T O R U S G U A R D", "Autonomous Security Engine for AI-Built Applications", version="v2.1.2"))
     print()
 
 

package/skills/torusguard/payload/skills/torusguard-review/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-review
+description: Differential PR and Git diff incremental security review — detects newly introduced vulnerabilities between Git branches or commits with net security score deltas.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.2
+last-updated: 2026-09-30
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Review — Differential Incremental PR Review
+
+TorusGuard Review performs rapid, surgical security review on Git changes (e.g. against `HEAD~1`, `main`, or PR target branch), analyzing only modified lines to prevent introducing security regressions.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard review [--diff <ref>]`
+- **Mode B (AI Chat Slash Command):** `/torusguard review` or `/torusguard-review`
+- **Mode C (Native MCP Tool):** `torusguard_review(target=".", diff_ref="HEAD~1")`
+
+## Core Capabilities
+
+1. **Sub-300ms Turnaround:** Only parses and checks modified/added lines in Git diffs.
+2. **Net Security Score Delta:** Tracks introduced vs. resolved vulnerabilities (`+0 Introduced, -2 Resolved`).
+3. **PR Gate Decision:** Blocks CI/CD pipelines if Critical or High severity flaws are introduced.
+4. **Alibaba OpenCodeReview Parity:** Outputs ready-to-post pull request inline review comments.

package/skills/torusguard/payload/skills/torusguard-threatmodel/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-threatmodel
+description: Synthesizes an architectural STRIDE threat model, interactive Mermaid Data Flow Diagram (DFD), and trust boundary register into SECURITY_THREAT_MODEL.md.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.2
+last-updated: 2026-09-30
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Threat Model — STRIDE & DFD Synthesizer
+
+TorusGuard Threat Model automatically maps routes, trust boundaries, datastores, and egress sinks to construct an architectural Data Flow Diagram and formal STRIDE threat model.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard threatmodel`
+- **Mode B (AI Chat Slash Command):** `/torusguard threatmodel` or `/torusguard-threatmodel`
+- **Mode C (Native MCP Tool):** `torusguard_threatmodel(target=".")`
+
+## Core Capabilities
+
+1. **Automated DFD Generation:** Renders interactive Mermaid diagram showing Zones 1–4 (Clients, Gateways, Core Services, Datastores).
+2. **STRIDE Risk Ledger:** Evaluates threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
+3. **Multi-Modal Vision Integration:** Discovers architectural diagrams and verifies that visual trust boundaries match code execution paths.
+4. **Living Compliance Artifact:** Emits `SECURITY_THREAT_MODEL.md` at workspace root.

package/skills/torusguard/payload/workflows/review.md

@@ -0,0 +1,11 @@
+# TorusGuard Review Workflow (`/torusguard review`)
+
+## Purpose
+Executes differential incremental Git diff security review against a reference branch or commit (default: `HEAD~1`).
+Inspects changed lines for new security regressions, evaluates net security score deltas, and outputs pull request review comments.
+
+## Steps
+1. Determine reference branch or commit (e.g. `HEAD~1` or `origin/main`).
+2. Run differential scan via `torusguard review [--diff <ref>]` or native MCP tool `torusguard_review`.
+3. Check PR Gate Decision (`PASSED` or `BLOCKED`).
+4. If blocked, review newly introduced violations and formulate surgical Ponytail fixes via `/torusguard harden`.

package/skills/torusguard/payload/workflows/threatmodel.md

@@ -0,0 +1,9 @@
+# TorusGuard Threat Model Workflow (`/torusguard threatmodel`)
+
+## Purpose
+Synthesizes architectural STRIDE threat models, interactive Mermaid Data Flow Diagrams (DFDs), and trust boundary registers directly into `SECURITY_THREAT_MODEL.md`.
+
+## Steps
+1. Execute `torusguard threatmodel` or native MCP tool `torusguard_threatmodel`.
+2. Inspect `SECURITY_THREAT_MODEL.md` to verify identified entrypoints, data stores, and trust boundaries.
+3. Align STRIDE risk controls against corresponding TorusGuard security invariants (`TG-AUTH`, `TG-DB`, `TG-RATE`, `TG-SSRF`).

package/skills/torusguard-review/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-review
+description: Differential PR and Git diff incremental security review — detects newly introduced vulnerabilities between Git branches or commits with net security score deltas.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.2
+last-updated: 2026-09-30
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Review — Differential Incremental PR Review
+
+TorusGuard Review performs rapid, surgical security review on Git changes (e.g. against `HEAD~1`, `main`, or PR target branch), analyzing only modified lines to prevent introducing security regressions.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard review [--diff <ref>]`
+- **Mode B (AI Chat Slash Command):** `/torusguard review` or `/torusguard-review`
+- **Mode C (Native MCP Tool):** `torusguard_review(target=".", diff_ref="HEAD~1")`
+
+## Core Capabilities
+
+1. **Sub-300ms Turnaround:** Only parses and checks modified/added lines in Git diffs.
+2. **Net Security Score Delta:** Tracks introduced vs. resolved vulnerabilities (`+0 Introduced, -2 Resolved`).
+3. **PR Gate Decision:** Blocks CI/CD pipelines if Critical or High severity flaws are introduced.
+4. **Alibaba OpenCodeReview Parity:** Outputs ready-to-post pull request inline review comments.

package/skills/torusguard-threatmodel/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-threatmodel
+description: Synthesizes an architectural STRIDE threat model, interactive Mermaid Data Flow Diagram (DFD), and trust boundary register into SECURITY_THREAT_MODEL.md.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.2
+last-updated: 2026-09-30
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Threat Model — STRIDE & DFD Synthesizer
+
+TorusGuard Threat Model automatically maps routes, trust boundaries, datastores, and egress sinks to construct an architectural Data Flow Diagram and formal STRIDE threat model.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard threatmodel`
+- **Mode B (AI Chat Slash Command):** `/torusguard threatmodel` or `/torusguard-threatmodel`
+- **Mode C (Native MCP Tool):** `torusguard_threatmodel(target=".")`
+
+## Core Capabilities
+
+1. **Automated DFD Generation:** Renders interactive Mermaid diagram showing Zones 1–4 (Clients, Gateways, Core Services, Datastores).
+2. **STRIDE Risk Ledger:** Evaluates threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
+3. **Multi-Modal Vision Integration:** Discovers architectural diagrams and verifies that visual trust boundaries match code execution paths.
+4. **Living Compliance Artifact:** Emits `SECURITY_THREAT_MODEL.md` at workspace root.