torusguard 2.1.1 → 2.1.3

package/.torusguard/skills/torusguard-review/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-review
+description: Differential PR and Git diff incremental security review — detects newly introduced vulnerabilities between Git branches or commits with net security score deltas.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.2
+last-updated: 2026-09-30
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Review — Differential Incremental PR Review
+
+TorusGuard Review performs rapid, surgical security review on Git changes (e.g. against `HEAD~1`, `main`, or PR target branch), analyzing only modified lines to prevent introducing security regressions.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard review [--diff <ref>]`
+- **Mode B (AI Chat Slash Command):** `/torusguard review` or `/torusguard-review`
+- **Mode C (Native MCP Tool):** `torusguard_review(target=".", diff_ref="HEAD~1")`
+
+## Core Capabilities
+
+1. **Sub-300ms Turnaround:** Only parses and checks modified/added lines in Git diffs.
+2. **Net Security Score Delta:** Tracks introduced vs. resolved vulnerabilities (`+0 Introduced, -2 Resolved`).
+3. **PR Gate Decision:** Blocks CI/CD pipelines if Critical or High severity flaws are introduced.
+4. **Alibaba OpenCodeReview Parity:** Outputs ready-to-post pull request inline review comments.

package/.torusguard/skills/torusguard-threatmodel/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: torusguard-threatmodel
+description: Synthesizes an architectural STRIDE threat model, interactive Mermaid Data Flow Diagram (DFD), and trust boundary register into SECURITY_THREAT_MODEL.md.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 2.1.2
+last-updated: 2026-09-30
+skills:
+  - torusguard
+  - torusguard-audit
+---
+
+# TorusGuard Threat Model — STRIDE & DFD Synthesizer
+
+TorusGuard Threat Model automatically maps routes, trust boundaries, datastores, and egress sinks to construct an architectural Data Flow Diagram and formal STRIDE threat model.
+
+## Invocation
+
+- **Mode A (Terminal CLI):** `torusguard threatmodel`
+- **Mode B (AI Chat Slash Command):** `/torusguard threatmodel` or `/torusguard-threatmodel`
+- **Mode C (Native MCP Tool):** `torusguard_threatmodel(target=".")`
+
+## Core Capabilities
+
+1. **Automated DFD Generation:** Renders interactive Mermaid diagram showing Zones 1–4 (Clients, Gateways, Core Services, Datastores).
+2. **STRIDE Risk Ledger:** Evaluates threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
+3. **Multi-Modal Vision Integration:** Discovers architectural diagrams and verifies that visual trust boundaries match code execution paths.
+4. **Living Compliance Artifact:** Emits `SECURITY_THREAT_MODEL.md` at workspace root.

package/.torusguard/workflows/review.md

@@ -0,0 +1,11 @@
+# TorusGuard Review Workflow (`/torusguard review`)
+
+## Purpose
+Executes differential incremental Git diff security review against a reference branch or commit (default: `HEAD~1`).
+Inspects changed lines for new security regressions, evaluates net security score deltas, and outputs pull request review comments.
+
+## Steps
+1. Determine reference branch or commit (e.g. `HEAD~1` or `origin/main`).
+2. Run differential scan via `torusguard review [--diff <ref>]` or native MCP tool `torusguard_review`.
+3. Check PR Gate Decision (`PASSED` or `BLOCKED`).
+4. If blocked, review newly introduced violations and formulate surgical Ponytail fixes via `/torusguard harden`.

package/.torusguard/workflows/threatmodel.md

@@ -0,0 +1,9 @@
+# TorusGuard Threat Model Workflow (`/torusguard threatmodel`)
+
+## Purpose
+Synthesizes architectural STRIDE threat models, interactive Mermaid Data Flow Diagrams (DFDs), and trust boundary registers directly into `SECURITY_THREAT_MODEL.md`.
+
+## Steps
+1. Execute `torusguard threatmodel` or native MCP tool `torusguard_threatmodel`.
+2. Inspect `SECURITY_THREAT_MODEL.md` to verify identified entrypoints, data stores, and trust boundaries.
+3. Align STRIDE risk controls against corresponding TorusGuard security invariants (`TG-AUTH`, `TG-DB`, `TG-RATE`, `TG-SSRF`).

package/README.md

@@ -11,8 +11,8 @@
 
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License: MIT"></a>
-  <a href="https://github.com/githubmofo/TorusGuard/releases"><img src="https://img.shields.io/badge/version-v2.1.1-orange.svg" alt="Version"></a>
-  <a href="https://www.npmjs.com/package/torusguard"><img src="https://img.shields.io/badge/npm-v2.1.1-CB3837?logo=npm&logoColor=white" alt="npm: v2.1.1"></a>
+  <a href="https://github.com/githubmofo/TorusGuard/releases"><img src="https://img.shields.io/badge/version-v2.1.3-orange.svg" alt="Version"></a>
+  <a href="https://www.npmjs.com/package/torusguard"><img src="https://img.shields.io/badge/npm-v2.1.3-CB3837?logo=npm&logoColor=white" alt="npm: v2.1.3"></a>
   <img src="https://img.shields.io/badge/Privacy-Local_First-success" alt="Privacy: Local First">
   <img src="https://img.shields.io/badge/Dependencies-Zero-brightgreen" alt="Dependencies: Zero">
   <img src="https://img.shields.io/badge/SARIF-v2.1.0-6C3483" alt="SARIF">
@@ -118,52 +118,139 @@ TorusGuard uses a **tri-track architecture** where intelligence, deterministic e
 
 ```mermaid
 flowchart TD
-    subgraph Ingress["Unified Tri-Mode Ingress"]
-        ModeA["<b>Mode A: Terminal CLI</b><br/><code>torusguard &lt;cmd&gt;</code><br/>Deterministic Single Binary"]
-        ModeB["<b>Mode B: AI Chat Slash Commands</b><br/><code>/torusguard &lt;cmd&gt;</code><br/>Cursor &bull; Claude &bull; Windsurf &bull; Antigravity"]
-        ModeC["<b>Mode C: Native MCP Tools</b><br/><code>torusguard_*</code> (10 Tools &bull; 2 Resources)<br/>Stdio JSON-RPC 2.0 Agent Server"]
+    %% =========================================================================
+    %% STAGE 1: TRI-MODE INGRESS GATEWAY
+    %% =========================================================================
+    subgraph IngressGateway["1. Unified Tri-Mode Ingress Gateway"]
+        direction LR
+        CLI["<b>Mode A: Terminal CLI</b><br/><code>torusguard &lt;cmd&gt;</code><br/>25 Deterministic Commands"]
+        Chat["<b>Mode B: AI Chat Commands</b><br/><code>/torusguard &lt;cmd&gt;</code><br/>Cursor &bull; Claude &bull; Windsurf"]
+        MCP["<b>Mode C: Native MCP Server</b><br/><code>torusguard_*</code> (13 Tools &bull; 2 Resources)<br/>Stdio JSON-RPC 2.0 Protocol"]
     end
 
-    Ingress --> Router["<b>Command Router &amp; Dispatcher</b><br/>cmd/torusguard (21 Commands)"]
+    %% =========================================================================
+    %% STAGE 2: CORE DISPATCHER & RUNTIME KERNEL
+    %% =========================================================================
+    Kernel["<b>TorusGuard Core Dispatcher &amp; Runtime Kernel</b><br/><code>cmd/torusguard</code> (Single Standalone Go Binary)<br/>Command Parsing &bull; Flag Evaluation (<code>--yes</code>, <code>--html</code>, <code>--rules</code>) &bull; Sandbox Isolation"]
 
-    subgraph Core["TorusGuard Core Security Engine (Go Single Binary)"]
+    CLI -->|"Terminal Exec"| Kernel
+    Chat -->|"Slash Bridge"| Kernel
+    MCP -->|"Agent Tool Call"| Kernel
+
+    %% =========================================================================
+    %% STAGE 3: DETECTION & MULTI-MODAL SUITE
+    %% =========================================================================
+    subgraph DetectionSuite["2. Polyglot Static AST &amp; Multi-Modal Detection Suite"]
         direction TB
-        subgraph Scanners["First-Principles &amp; Multi-Modal Scanner Suite"]
-            AST["<b>Polyglot AST &amp; Heuristic Scanner</b><br/>Go &bull; TS/JS &bull; Python &bull; SQL &bull; Auth &bull; SSRF &bull; CSRF"]
-            OCR["<b>Multi-Modal Vision OCR Engine</b><br/>Tesseract v5.4.0 &bull; Leaked Keys in PNG/JPG &le;10MB"]
-            Container["<b>Container &amp; Dockerfile Auditor</b><br/>Root Execution &bull; Docker Sockets &bull; Build Secrets"]
-            GitMine["<b>Git History Secret Miner</b><br/>Past Commits &bull; Diff Logs &bull; Remote Credentials"]
-            ReDoS["<b>ReDoS Complexity Analyzer</b><br/>Polynomial &amp; Exponential Backtracking Loops"]
-            AIGuard["<b>AI Agent &amp; RAG Vector Guard</b><br/>Prompt Injection &bull; Tenant Vector Contamination"]
+        subgraph StaticGroup["Static Code &amp; Dependency Analysis"]
+            direction LR
+            AST["<b>Polyglot AST &amp; Taint Engine</b><br/>Tree-sitter &bull; 88 Rules across 22 Families<br/>Go &bull; TS/JS &bull; Python &bull; Java &bull; C# &bull; Rust"]
+            TGQL["<b>TG-QL Declarative AST DSL</b><br/>Custom YAML Pattern Queries<br/>Syntax Trees &bull; Taint Sinks &bull; Constraints"]
+            Reach["<b>Reachability &amp; OpenVEX</b><br/>Callgraph Traversal &bull; Reachable CVEs<br/>Zero Ineffective Dependency Alerts"]
+        end
+        subgraph DeepGroup["Forensics, RegEx &amp; Vision OCR"]
+            direction LR
+            OCR["<b>Multi-Modal Vision OCR Engine</b><br/>Tesseract v5.4.0 &bull; Leaked Secrets<br/>Architecture Diagrams &bull; Screenshots"]
+            ReDoS["<b>Thompson NFA ReDoS Engine</b><br/>Polynomial &amp; Exponential Exploder<br/>Catastrophic Backtracking Loops"]
+            GitMine["<b>Git History &amp; Container Audit</b><br/>Commit Packfile Secret Mining<br/>Dockerfile Non-Root Enforcement"]
         end
+    end
+
+    Kernel -->|"Scan Code &amp; Dependencies"| StaticGroup
+    Kernel -->|"Analyze Visuals &amp; Commits"| DeepGroup
+
+    %% =========================================================================
+    %% STAGE 4: CONSENSUS DELIBERATION & TRIAGE
+    %% =========================================================================
+    subgraph DeliberationTriage["3. Deliberation Tournament &amp; Evidence Triage"]
+        direction TB
+        Tournament["<b>3-Perspective Deliberation Tournament</b><br/>Vulnerability Hunter vs. Devil's Advocate / Sanitizer Verifier vs. Ponytail Remediator<br/>Eliminates False Positives &bull; Calibrated Confidence Scoring (0-100%)"]
+        PRGate{"<b>Differential PR Diff Gate</b><br/><code>torusguard review</code><br/>Incremental Git Diff Changes?"}
+        Tournament --> PRGate
+    end
+
+    StaticGroup -->|"Raw AST Findings"| Tournament
+    DeepGroup -->|"Extracted Secrets &amp; Complexities"| Tournament
+
+    %% =========================================================================
+    %% STAGE 5: GOVERNED REMEDIATION & PONYTAIL LOOP
+    %% =========================================================================
+    subgraph GovernedRemediation["4. Governed Remediation Loop &amp; Safety Guardrails (Ponytail Protocol)"]
+        direction TB
+        
+        Harden["<b>Surgical Patch Formulation</b><br/>Semantic Line Snippet Replacement<br/>Strict Line Budget: &le;35 Additions &bull; &le;25 Deletions"]
+        
+        BoundsCheck{"<b>Ponytail Bounds Check</b><br/>Exceeds 35 Add / 25 Del?"}
+        RejectDiff["<b>Diff Rejected</b><br/>Excess Churn Detected<br/>Prompt AI for Minimal Snippet"]
+        
+        SnapshotStore[("<b>Pre-Apply Snapshot Store</b><br/><code>.torusguard/snapshots/&lt;run_id&gt;/</code><br/>Byte-for-Byte Rollback Backup")]
+        
+        HumanGate{"<b>Human Gate Authorization</b><br/>Explicit <code>--yes</code> or Interactive Confirmation"}
+        UserAbort["<b>Operation Aborted</b><br/>Zero Files Touched &bull; Safe Exit"]
+        
+        ApplyPatch["<b>Atomic Patch Application</b><br/>Apply Unified Surgical Diff to Disk"]
+        
+        RecheckGate{"<b>Differential Recheck Engine</b><br/><code>torusguard recheck</code><br/>Fix Closed with Zero Regressions?"}
+        RollbackExec["<b>Auto-Rollback Triggered!</b><br/>Instant Restoration from Snapshot<br/>Quarantine Candidate Patch"]
+        
+        Harden --> BoundsCheck
+        BoundsCheck -->|"Violation"| RejectDiff
+        RejectDiff -.->|"Re-prompt AI"| Harden
+        BoundsCheck -->|"Pass (Within Bounds)"| SnapshotStore
+        SnapshotStore --> HumanGate
+        HumanGate -->|"Denied"| UserAbort
+        HumanGate -->|"Approved"| ApplyPatch
+        ApplyPatch --> RecheckGate
+        RecheckGate -->|"Regressions"| RollbackExec
+        RollbackExec -.->|"Restore Clean State"| SnapshotStore
+    end
+
+    PRGate -->|"Target Findings"| Harden
 
-        subgraph Governance["Governance &amp; Remediation Pipeline"]
-            Harden["<b>Harden &amp; Line Reflection</b><br/>Ponytail Bounds: &le;35 Add &bull; &le;25 Del"]
-            Snapshot["<b>Pre-Apply Snapshot Engine</b><br/>Byte-for-Byte Rollback Backups in .torusguard/snapshots/"]
-            HumanGate{"<b>Human Gate Authorization</b><br/>Explicit --yes Confirmation Required"}
-            Recheck["<b>Differential Recheck Engine</b><br/>Zero-Regression Fix Closure"]
+    %% =========================================================================
+    %% STAGE 6: LIVING SECURITY LEDGER & ENTERPRISE OUTPUTS
+    %% =========================================================================
+    subgraph EnterpriseDeliverables["5. Living Security Ledger &amp; Enterprise Deliverables"]
+        direction TB
+        Ledger[("<b>Living Security Ledger</b><br/><code>security_report.md</code><br/>Synchronized Single Source of Truth &bull; Status: RESOLVED 🟢")]
+        
+        subgraph DeliverableOutputs["Executive Reports &amp; Verified Memory"]
+            direction LR
+            ThreatModel["<b>STRIDE Threat Model</b><br/><code>SECURITY_THREAT_MODEL.md</code><br/>DFD Architecture Diagrams"]
+            SARIF["<b>OASIS SARIF v2.1.0</b><br/>GitHub Advanced Security<br/>CI/CD Security Center"]
+            HTMLReport["<b>Executive Dashboard</b><br/>Single-File HTML Report<br/>Interactive Posture Heatmap"]
+            GoldenRecipes[("<b>Golden Fix Memory</b><br/><code>.torusguard/recipes/</code><br/>Verified Distilled Fixes")]
         end
+
+        Ledger --> DeliverableOutputs
     end
 
-    Router --> Scanners
-    Scanners --> Ledger[("<b>Living Security Ledger</b><br/><code>security_report.md</code><br/>Single Source of Truth")]
-    Ledger --> Harden
-    Harden --> Snapshot
-    Snapshot --> HumanGate
-    HumanGate -- Approved --> Recheck
-    Recheck --> Outputs["<b>Enterprise Outputs</b><br/>OASIS SARIF v2.1.0 &bull; Dark-Mode HTML Report &bull; Golden Fix Distillation"]
-
-    classDef ingressStyle fill:#1e293b,stroke:#38bdf8,stroke-width:2px,color:#f8fafc;
-    classDef scannerStyle fill:#0f172a,stroke:#818cf8,stroke-width:2px,color:#f8fafc;
-    classDef govStyle fill:#0f172a,stroke:#34d399,stroke-width:2px,color:#f8fafc;
-    classDef ledgerStyle fill:#312e81,stroke:#a78bfa,stroke-width:2px,color:#f8fafc;
-    classDef outStyle fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#f8fafc;
-
-    class ModeA,ModeB,ModeC ingressStyle;
-    class AST,OCR,Container,GitMine,ReDoS,AIGuard scannerStyle;
-    class Harden,Snapshot,HumanGate,Recheck govStyle;
+    RecheckGate -->|"Fix Confirmed (Clean Closure)"| Ledger
+
+    %% =========================================================================
+    %% STYLING AND THEME (Modern Dark Cyber Palette)
+    %% =========================================================================
+    classDef ingressStyle fill:#0f172a,stroke:#38bdf8,stroke-width:2px,color:#f8fafc;
+    classDef routerStyle fill:#1e1b4b,stroke:#6366f1,stroke-width:2px,color:#f8fafc;
+    classDef scannerStyle fill:#022c22,stroke:#10b981,stroke-width:2px,color:#f8fafc;
+    classDef tourneyStyle fill:#2e1065,stroke:#a855f7,stroke-width:2px,color:#f8fafc;
+    classDef gateStyle fill:#451a03,stroke:#f59e0b,stroke-width:2px,color:#fef3c7;
+    classDef rejectStyle fill:#450a0a,stroke:#ef4444,stroke-width:2px,color:#fee2e2;
+    classDef actionStyle fill:#064e3b,stroke:#34d399,stroke-width:2px,color:#f8fafc;
+    classDef dbStyle fill:#1e293b,stroke:#94a3b8,stroke-width:2px,color:#f8fafc;
+    classDef ledgerStyle fill:#172554,stroke:#3b82f6,stroke-width:2px,color:#eff6ff;
+    classDef outputStyle fill:#042f2e,stroke:#14b8a6,stroke-width:2px,color:#f0fdfa;
+
+    class CLI,Chat,MCP ingressStyle;
+    class Kernel routerStyle;
+    class AST,TGQL,Reach,OCR,ReDoS,GitMine scannerStyle;
+    class Tournament tourneyStyle;
+    class PRGate,BoundsCheck,HumanGate,RecheckGate gateStyle;
+    class RejectDiff,UserAbort,RollbackExec rejectStyle;
+    class Harden,ApplyPatch actionStyle;
+    class SnapshotStore,GoldenRecipes dbStyle;
     class Ledger ledgerStyle;
-    class Outputs outStyle;
+    class ThreatModel,SARIF,HTMLReport outputStyle;
 ```
 
 > 🌐 **Interactive Architecture Visualizations:**
@@ -189,24 +276,55 @@ flowchart TD
 
 ---
 
-## 🚀 Installation
+## 🚀 Installation & How to Use (3 Options)
+
+TorusGuard can be run without installation via `npx`, installed globally or locally via `npm`, compiled from source with `go build`, or installed via `go install`.
+
+| Option | Method | Best For | Dedicated Guide |
+| :--- | :--- | :--- | :--- |
+| **Option 1** | **npm & npx** | Node.js developers, zero-install CLI, CI/CD | 📖 [Option 1 Guide](docs/usage/option-1-npm.md) |
+| **Option 2** | **Build from Source** | Contributors, custom rules, Go development | 📖 [Option 2 Guide](docs/usage/option-2-source.md) |
+| **Option 3** | **Go Install** | Go projects, single-binary, zero Node.js/npm | 📖 [Option 3 Guide](docs/usage/option-3-go-install.md) |
+
+---
 
 ### Option 1: npm (Primary)
 
+#### Method A: Direct NPX Zero-Install (Recommended)
+Run directly without installing any packages globally or locally:
+
 ```bash
-npm install -g torusguard
+npx torusguard init
 ```
 
-Or use directly without installing:
+*Tip: Use `npx torusguard@latest init` to guarantee the freshest release.*
 
+#### Method B: Global Installation
 ```bash
-npx torusguard init
+npm install -g torusguard
+torusguard init
+```
+
+#### Method C: Local Project Installation
+```bash
+npm install -D torusguard
 ```
 
+> 💡 **Using TorusGuard after `npm install torusguard`:**  
+> TorusGuard is a CLI security engine, not an importable JavaScript library. When installed locally, the binary resides in `node_modules/.bin/torusguard`.  
+> You can run it via:  
+> - `npx torusguard init` *(npx automatically uses your local `node_modules` binary)*  
+> - Adding `"security:audit": "torusguard audit"` to your `package.json` scripts (`npm run security:audit`)  
+> - Direct path: `./node_modules/.bin/torusguard audit`  
+
 <a href="https://www.npmjs.com/package/torusguard">
-  <img src="https://img.shields.io/badge/npm-v2.1.1-CB3837?logo=npm&logoColor=white" alt="npm package">
+  <img src="https://img.shields.io/badge/npm-v2.1.3-CB3837?logo=npm&logoColor=white" alt="npm package">
 </a>
 
+👉 **[Read the Full Option 1 (npm & npx) Dedicated Guide →](docs/usage/option-1-npm.md)**
+
+---
+
 ### Option 2: Build from Source (Recommended for Contributors)
 
 ```bash
@@ -215,12 +333,37 @@ cd TorusGuard
 go build -o torusguard ./cmd/torusguard
 ```
 
+On Windows:
+```powershell
+go build -o torusguard.exe ./cmd/torusguard
+```
+
+Run directly:
+```bash
+./torusguard init
+./torusguard audit
+```
+
+👉 **[Read the Full Option 2 (Build from Source) Dedicated Guide →](docs/usage/option-2-source.md)**
+
+---
+
 ### Option 3: Go Install
 
+Install directly into `$GOPATH/bin`:
+
 ```bash
-go install github.com/torusguard/torusguard/cmd/torusguard@latest
+go install github.com/githubmofo/TorusGuard/cmd/torusguard@latest
 ```
 
+Verify and run:
+```bash
+torusguard --version
+torusguard init
+```
+
+👉 **[Read the Full Option 3 (Go Install) Dedicated Guide →](docs/usage/option-3-go-install.md)**
+
 ---
 
 ## 💻 Usage
@@ -282,6 +425,9 @@ torusguard exploit-check
 | `init`           | Scaffold `.torusguard/` workspace, detect stack, activate rules |
 | `status`         | Diagnostic overview of posture, stack, and active rules         |
 | `audit`          | Static heuristic security scan against active TG-* rules       |
+| `review`         | Differential PR and Git diff incremental security review       |
+| `threatmodel`    | Synthesize architectural STRIDE threat model & Mermaid DFDs     |
+| `benchmark`      | Run SecurityReviewBench precision & recall evaluation suite    |
 | `verify`         | Live disk line match audit and evidence sufficiency check       |
 | `harden`         | Validate patches against Ponytail Protocol bounds              |
 | `apply`          | Apply patches with pre-apply `.bak` rollback snapshots         |
@@ -380,7 +526,7 @@ TorusGuard works natively inside AI coding assistants. Add the configuration fil
 
 ### Native MCP Tools (Agent Toolkit Mode)
 
-When configured with `.agents/mcp_config.json` or `mcp_config.json`, AI coding agents gain native tool calling:
+When configured with `.agents/mcp_config.json` or `mcp_config.json`, AI coding agents gain native tool calling (13 Tools & 2 Resources):
 
 - `torusguard_audit`: Deep static AST scan + Vision OCR; writes `security_report.md`
 - `torusguard_ocr_scan`: Dedicated image credential analysis via Tesseract (5-10MB bounds)
@@ -391,6 +537,9 @@ When configured with `.agents/mcp_config.json` or `mcp_config.json`, AI coding a
 - `torusguard_verify`: Asserts evidence sufficiency & line-shift invariant fingerprint matches
 - `torusguard_harden`: Validates remediation diff against Ponytail Protocol bounds
 - `torusguard_recheck`: Differential re-scan confirming fix closure
+- `torusguard_review`: Differential PR and Git diff incremental review; gate decisions
+- `torusguard_threatmodel`: Synthesizes STRIDE threat model & Mermaid DFDs (`SECURITY_THREAT_MODEL.md`)
+- `torusguard_benchmark`: Runs SecurityReviewBench self-evaluating precision & recall suite
 - `torusguard_status`: Workspace posture and tech stack inspection
 - `torusguard://security_report`: MCP Resource reading the living security report
 - `torusguard://rules_catalog`: MCP Resource exploring verified rules catalog & Golden Fix patterns

package/bin/torusguard.js

@@ -15,14 +15,15 @@ const command = args[0] || 'init';
 const rootDir = path.resolve(__dirname, '..');
 const cwd = process.cwd();
 
+let PKG_VERSION = '2.1.3';
+try {
+  const pkg = JSON.parse(fs.readFileSync(path.join(rootDir, 'package.json'), 'utf-8'));
+  PKG_VERSION = pkg.version || PKG_VERSION;
+} catch (e) {}
+
 // Parse version flag immediately
 if (command === '--version' || command === '-v' || command === 'version') {
-  let ver = '1.4.0';
-  try {
-    const pkg = JSON.parse(fs.readFileSync(path.join(rootDir, 'package.json'), 'utf-8'));
-    ver = pkg.version || ver;
-  } catch (e) {}
-  console.log(`torusguard v${ver}`);
+  console.log(`torusguard v${PKG_VERSION}`);
   process.exit(0);
 }
 
@@ -196,7 +197,7 @@ function cardDivider(title = '', borderColor = CYAN, double = false) {
   return `  ${borderColor}${left}${h.repeat(71)}${right}${RESET}`;
 }
 
-function cardHeader(title, subtitle = '', version = 'v1.3.6', borderColor = CYAN) {
+function cardHeader(title, subtitle = '', version = `v${PKG_VERSION}`, borderColor = CYAN) {
   const top = `  ${borderColor}╭${'─'.repeat(71)}╮${RESET}`;
   const bottom = `  ${borderColor}╰${'─'.repeat(71)}╯${RESET}`;
   const empty = `  ${borderColor}│${' '.repeat(71)}│${RESET}`;
@@ -214,7 +215,7 @@ function cardHeader(title, subtitle = '', version = 'v1.3.6', borderColor = CYAN
 
 function printHelp() {
   console.log();
-  console.log(cardHeader('🛡️  T O R U S G U A R D   C L I', 'Autonomous Security Engine for AI-Built Applications', 'v1.4.0'));
+  console.log(cardHeader('🛡️  T O R U S G U A R D   C L I', 'Autonomous Security Engine for AI-Built Applications', `v${PKG_VERSION}`));
   console.log(`\n  ${BOLD}Usage:${RESET}  ${GREEN}npx torusguard${RESET} ${WHITE}[command]${RESET} ${GRAY}[options]${RESET}\n`);
 
   console.log(cardBorderTop('Commands'));
@@ -309,7 +310,7 @@ if (command === 'status') {
       }
 
       console.log();
-      console.log(cardHeader('🛡️  TORUSGUARD SECURITY POSTURE', '', 'v1.3.6'));
+      console.log(cardHeader('🛡️  TORUSGUARD SECURITY POSTURE', '', `v${PKG_VERSION}`));
       console.log(`\n  ${BOLD}▸ Workspace:${RESET}        ${GREEN}${cwd}${RESET}`);
       console.log(`  ${BOLD}▸ Governance:${RESET}       ${GREEN}Full Local Governance (.torusguard/)${RESET}`);
       console.log(`  ${BOLD}▸ Living Report:${RESET}    ${CYAN}security_report.md${RESET}\n`);
@@ -331,7 +332,7 @@ if (command === 'status') {
       console.log();
 
       console.log(cardBorderTop('Governance Telemetry'));
-      console.log(formatBoxLine(`Rules Catalog:     ${GREEN}74 Canonical Security Rules${RESET} (18 families)`));
+      console.log(formatBoxLine(`Rules Catalog:     ${GREEN}88 Canonical Security Rules${RESET} (22 families)`));
       console.log(formatBoxLine(`Severity Floor:    ${YELLOW}${cfg.severity_threshold || 'medium'}${RESET}`));
       console.log(formatBoxLine(`Runs Directory:    ${DIM}${cfg.runs_dir || '.torusguard/runs'}${RESET}`));
       console.log(formatBoxLine(`Ponytail Bounds:   ${GREEN}<= 35 additions, <= 25 deletions${RESET}`));
@@ -339,16 +340,18 @@ if (command === 'status') {
       console.log(cardBorderBottom());
       console.log();
 
-      console.log(cardBorderTop('Rule Families (18 Families / 74 Rules)'));
-      console.log(formatBoxLine(`${YELLOW}TG-SEC${RESET}     Secrets (7)              ${YELLOW}TG-DB${RESET}      Database Safety (4)`));
-      console.log(formatBoxLine(`${YELLOW}TG-INPUT${RESET}   Input Validation (6)     ${YELLOW}TG-AUTH${RESET}    Authentication (8)`));
+      console.log(cardBorderTop('Rule Families (22 Families / 88 Rules)'));
+      console.log(formatBoxLine(`${YELLOW}TG-SEC${RESET}     Secrets & Tokens (7)     ${YELLOW}TG-AUTH${RESET}    Authentication (8)`));
+      console.log(formatBoxLine(`${YELLOW}TG-DB${RESET}      Database Isolation (4)   ${YELLOW}TG-INPUT${RESET}   Input & Traversal (8)`));
       console.log(formatBoxLine(`${YELLOW}TG-RATE${RESET}    Rate Limiting (3)        ${YELLOW}TG-AGENT${RESET}   AI Agent Security (4)`));
-      console.log(formatBoxLine(`${YELLOW}TG-SSRF${RESET}    Server Request (4)       ${YELLOW}TG-WEBHOOK${RESET} Webhook Trust (4)`));
-      console.log(formatBoxLine(`${YELLOW}TG-WS${RESET}      WebSocket (4)            ${YELLOW}TG-CSRF${RESET}    Cross-Site Request (2)`));
-      console.log(formatBoxLine(`${YELLOW}TG-GQL${RESET}     GraphQL Security (4)     ${YELLOW}TG-SUPPLY${RESET}  Supply Chain (6)`));
-      console.log(formatBoxLine(`${YELLOW}TG-BIZ${RESET}     Business Logic (4)       ${YELLOW}TG-CACHE${RESET}   Cache Isolation (3)`));
-      console.log(formatBoxLine(`${YELLOW}TG-CLIENT${RESET}  Client Bundles (2)       ${YELLOW}TG-PLATFORM${RESET}Platform Config (4)`));
-      console.log(formatBoxLine(`${YELLOW}TG-DIFF${RESET}    Diff Inspection (3)      ${YELLOW}TG-EDGE${RESET}    Serverless / Edge (2)`));
+      console.log(formatBoxLine(`${YELLOW}TG-SSRF${RESET}    Server-Side Request (4)  ${YELLOW}TG-WEBHOOK${RESET} Webhook Signature (4)`));
+      console.log(formatBoxLine(`${YELLOW}TG-WS${RESET}      WebSocket Safety (4)     ${YELLOW}TG-CSRF${RESET}    Cross-Site Request (2)`));
+      console.log(formatBoxLine(`${YELLOW}TG-GQL${RESET}     GraphQL Introspection (4)${YELLOW}TG-SUPPLY${RESET}  Supply Chain Health (6)`));
+      console.log(formatBoxLine(`${YELLOW}TG-BIZ${RESET}     Business Logic (4)       ${YELLOW}TG-CACHE${RESET}   Cache Poisoning (3)`));
+      console.log(formatBoxLine(`${YELLOW}TG-CLIENT${RESET}  Client Bundle Secrets (2)${YELLOW}TG-PLATFORM${RESET}Platform Hardening (4)`));
+      console.log(formatBoxLine(`${YELLOW}TG-DIFF${RESET}    Polyglot Bypass Guard (3)${YELLOW}TG-EDGE${RESET}    Edge & Serverless (2)`));
+      console.log(formatBoxLine(`${YELLOW}TG-CONT${RESET}    Container Hardening (4)  ${YELLOW}TG-GIT${RESET}     Git Secret Mining (3)`));
+      console.log(formatBoxLine(`${YELLOW}TG-REDOS${RESET}   ReDoS Complexity Guard (2)${YELLOW}TG-RAG${RESET}    RAG & Vector Scoping (3)`));
       console.log(cardBorderBottom());
 
       console.log(`\n  ${DIM}Quick Action:${RESET} In your AI chat, run ${CYAN}/torusguard-audit${RESET} to scan.\n`);
@@ -640,6 +643,9 @@ if (command === 'recipes') {
 if (command === 'init') {
   const { target, remaining } = parseTargetAndArgs(args);
   const targetDir = path.resolve(cwd, target);
+  if (!fs.existsSync(targetDir)) {
+    fs.mkdirSync(targetDir, { recursive: true });
+  }
   const localBootstrap = path.join(rootDir, 'skills', 'torusguard', 'bootstrap.py');
   const localInstall = path.join(rootDir, 'install.py');
   const scriptToRun = fs.existsSync(localBootstrap) ? localBootstrap : localInstall;
@@ -655,13 +661,7 @@ if (command === 'init') {
 // Subcommand: update
 if (command === 'update') {
   const https = require('https');
-  const pkgJsonPath = path.join(rootDir, 'package.json');
-  let currentVersion = '1.4.0';
-  try {
-    if (fs.existsSync(pkgJsonPath)) {
-      currentVersion = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8')).version || currentVersion;
-    }
-  } catch (e) {}
+  const currentVersion = PKG_VERSION;
 
   console.log();
   console.log(cardHeader('🛡️  TORUSGUARD UPDATE CHECK', 'Package Distribution & Registry Verifier', `v${currentVersion}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "torusguard",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Security guardrails, governed remediation, and authorized runtime validation for AI-built web applications.",
   "main": "bin/torusguard.js",
   "bin": {
@@ -15,10 +15,14 @@
     "LICENSE"
   ],
   "scripts": {
+    "postinstall": "node -e \"console.log('\\n🛡️  TorusGuard v2.1.3 installed! Run: npx torusguard init\\n')\"",
     "test": "python harness/runner.py",
     "init": "node bin/torusguard.js init",
     "status": "node bin/torusguard.js status",
     "audit": "node bin/torusguard.js audit",
+    "review": "node bin/torusguard.js review",
+    "threatmodel": "node bin/torusguard.js threatmodel",
+    "benchmark": "node bin/torusguard.js benchmark",
     "harden": "node bin/torusguard.js harden",
     "apply": "node bin/torusguard.js apply",
     "recipes": "node bin/torusguard.js recipes",