trace-sec 2.1.2 → 2.1.4

package/bin/trace.js

@@ -51,8 +51,8 @@ if (args[0] === 'install-skill' || args[0] === 'setup-agent' || args[0] === 'ins
         trace: {
           command: isWin ? 'cmd.exe' : 'npx',
           args: isWin
-            ? ['/c', 'npx', '-y', 'github:VK-Amogh/TRACE', 'mcp']
-            : ['-y', 'github:VK-Amogh/TRACE', 'mcp'],
+            ? ['/c', 'npx', '-y', 'trace-sec', 'mcp']
+            : ['-y', 'trace-sec', 'mcp'],
           env: {
             PYTHONUNBUFFERED: '1',
           },
@@ -73,7 +73,7 @@ if (args[0] === 'install-skill' || args[0] === 'setup-agent' || args[0] === 'ins
     console.log('  • \x1b[32mAntigravity & Agentic IDEs:\x1b[0m .agents/plugins/trace-security active');
     console.log('  • \x1b[32mVerification Tools:\x1b[0m trace_scan, trace_findings, trace_verify, trace_harness_task');
     console.log('\n\x1b[90mTo register in Claude Code CLI directly:\x1b[0m');
-    console.log('  \x1b[37mclaude mcp add trace -- npx github:VK-Amogh/TRACE mcp\x1b[0m\n');
+    console.log('  \x1b[37mclaude mcp add trace -- npx trace-sec mcp\x1b[0m\n');
     process.exit(0);
   } else {
     console.error(`[TRACE] Bundle directory not found at ${bundleDir}`);
@@ -83,10 +83,14 @@ if (args[0] === 'install-skill' || args[0] === 'setup-agent' || args[0] === 'ins
 
 // Find virtual environment python or system python
 const isWin = process.platform === 'win32';
+const userHome = process.env.USERPROFILE || process.env.HOME || '';
 const candidatePythons = [
   process.env.TRACE_PYTHON,
-  join(process.cwd(), '.venv', isWin ? 'Scripts/python.exe' : 'bin/python'),
-  join(projectRoot, '.venv', isWin ? 'Scripts/python.exe' : 'bin/python'),
+  join(process.cwd(), '.venv', isWin ? 'Scripts' : 'bin', isWin ? 'python.exe' : 'python'),
+  join(projectRoot, '.venv', isWin ? 'Scripts' : 'bin', isWin ? 'python.exe' : 'python'),
+  isWin ? 'D:\\Startup\\TRACE\\.venv\\Scripts\\python.exe' : null,
+  join(userHome, '.trace', 'venv', isWin ? 'Scripts' : 'bin', isWin ? 'python.exe' : 'python'),
+  join(userHome, '.trace', 'models', 'venv', isWin ? 'Scripts' : 'bin', isWin ? 'python.exe' : 'python'),
   isWin ? 'python' : 'python3',
 ];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trace-sec",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "Threat Reconnaissance & Attack-path Correlation Engine — Security Verification Layer for Coding Agents with Fine-Tuned SecureBERT 2.0 & Laya AI",
   "type": "module",
   "main": "bin/trace.js",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "trace-sec"
-version = "1.0.0"
+version = "2.1.4"
 description = "Threat Reconnaissance & Attack-path Correlation Engine"
 readme = "README.md"
 requires-python = ">=3.11"

package/src/trace_engine/cli.py

@@ -1178,6 +1178,82 @@ def bench_intelligence():
     run_intelligence_benchmark()
 
 
+@app.command(name="setup-models")
+@app.command(name="download-models")
+def setup_models():
+    """Download and provision fine-tuned SecureBERT 2.0 and Laya System 1 weights into ~/.trace/models."""
+    from trace_engine.intelligence.downloader import ensure_all_models
+    console.print("\n[bold green]TRACE Neural Model Provisioner[/bold green]")
+    console.print("[dim]Fetching fine-tuned weights from TRACE Git LFS Hub into ~/.trace/models...[/dim]\n")
+    ensure_all_models()
+    console.print("[bold green]✓ All fine-tuned models are installed, verified, and ready.[/bold green]\n")
+
+
+@app.command(name="install-skill")
+@app.command(name="setup-agent")
+def install_skill(
+    target_dir: Path = typer.Option(Path("."), "--target", "-t", help="Target repository directory to install skills and MCP"),
+):
+    """Install TRACE autonomous agent skill & MCP configurations for Claude Code, Antigravity, and Cursor."""
+    import shutil
+    project_root = Path(__file__).resolve().parents[2]
+    bundle_dir = project_root / "src" / "trace_engine" / "plugin" / "bundle"
+    target = target_dir.resolve()
+
+    console.print("\n[bold green]Installing TRACE Autonomous Security Agent Skill & MCP Tools...[/bold green]")
+
+    if bundle_dir.exists():
+        # 1. Antigravity plugin (.agents/plugins/trace-security)
+        agent_plugin_dir = target / ".agents" / "plugins" / "trace-security"
+        agent_plugin_dir.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copytree(bundle_dir, agent_plugin_dir, dirs_exist_ok=True)
+        console.print(f"  [bold green]✓[/bold green] Antigravity Plugin : [white]{agent_plugin_dir}[/white]")
+
+        # 2. Agent Skill & Claude Code Skill
+        skill_src = bundle_dir / "skills" / "trace-security-harness"
+        if skill_src.exists():
+            agent_skill_dir = target / ".agents" / "skills" / "trace-security-harness"
+            agent_skill_dir.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copytree(skill_src, agent_skill_dir, dirs_exist_ok=True)
+            console.print(f"  [bold green]✓[/bold green] Agent Skill        : [white]{agent_skill_dir}[/white]")
+
+            claude_skill_dir = target / ".claude" / "skills" / "trace-security"
+            claude_skill_dir.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copytree(skill_src, claude_skill_dir, dirs_exist_ok=True)
+            console.print(f"  [bold green]✓[/bold green] Claude Code Skill  : [white]{claude_skill_dir}[/white]")
+
+        # 3. MCP Configuration
+        import json
+        is_win = sys.platform == "win32"
+        mcp_config = {
+            "mcpServers": {
+                "trace": {
+                    "command": "cmd.exe" if is_win else "npx",
+                    "args": ["/c", "npx", "-y", "trace-sec", "mcp"] if is_win else ["-y", "trace-sec", "mcp"],
+                    "env": {
+                        "PYTHONUNBUFFERED": "1"
+                    }
+                }
+            }
+        }
+        mcp_json = target / ".mcp.json"
+        mcp_json.write_text(json.dumps(mcp_config, indent=2), encoding="utf-8")
+        console.print(f"  [bold green]✓[/bold green] Claude Code MCP    : [white]{mcp_json}[/white]")
+
+        cursor_dir = target / ".cursor"
+        cursor_dir.mkdir(parents=True, exist_ok=True)
+        (cursor_dir / "mcp.json").write_text(json.dumps(mcp_config, indent=2), encoding="utf-8")
+        console.print(f"  [bold green]✓[/bold green] Cursor IDE MCP     : [white]{cursor_dir / 'mcp.json'}[/white]")
+
+        console.print("\n[bold]Capabilities Enabled for AI Coding Agents:[/bold]")
+        console.print("  • [bold green]Claude Code Integration:[/bold green] Skills + MCP server configured")
+        console.print("  • [bold green]Antigravity & Agentic IDEs:[/bold green] .agents/plugins/trace-security active")
+        console.print("  • [bold green]Verification Tools:[/bold green] trace_scan, trace_findings, trace_verify, trace_harness_task\n")
+    else:
+        console.print(f"[bold red]Error:[/bold red] Plugin bundle not found at {bundle_dir}")
+        raise typer.Exit(code=1)
+
+
 if __name__ == "__main__":
     app()
 

package/src/trace_engine/intelligence/downloader.py

@@ -0,0 +1,156 @@
+"""Automated model downloader and provisioner for TRACE fine-tuned weights."""
+
+import os
+import sys
+import logging
+import urllib.request
+from pathlib import Path
+from typing import Optional, Dict, List, Any
+
+logger = logging.getLogger(__name__)
+
+REPO_OWNER = "VK-Amogh"
+REPO_NAME = "TRACE"
+BRANCH = "main"
+
+MODEL_REGISTRY: Dict[str, Dict[str, Any]] = {
+    "securebert-finetuned": {
+        "files": {
+            "config.json": {
+                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/config.json",
+                "min_size": 500,
+            },
+            "tokenizer.json": {
+                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/tokenizer.json",
+                "min_size": 1000000,
+            },
+            "tokenizer_config.json": {
+                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/tokenizer_config.json",
+                "min_size": 200,
+            },
+            "model.safetensors": {
+                "url": f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/securebert-finetuned/model.safetensors",
+                "min_size": 100000000,  # ~498 MB
+            },
+        },
+    },
+    "laya-finetuned": {
+        "files": {
+            "laya_metadata.json": {
+                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_metadata.json",
+                "min_size": 300,
+            },
+            "tokenizer.json": {
+                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/tokenizer.json",
+                "min_size": 500000,
+            },
+            "tokenizer_config.json": {
+                "url": f"https://raw.githubusercontent.com/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/tokenizer_config.json",
+                "min_size": 200,
+            },
+            "laya_dual_head.onnx": {
+                "url": f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_dual_head.onnx",
+                "min_size": 50000000,  # ~267 MB
+            },
+            "laya_dual_head.pt": {
+                "url": f"https://media.githubusercontent.com/media/{REPO_OWNER}/{REPO_NAME}/{BRANCH}/.trace/models/laya-finetuned/laya_dual_head.pt",
+                "min_size": 50000000,  # ~267 MB
+            },
+        },
+    },
+}
+
+
+def get_default_models_dir() -> Path:
+    """Returns the default persistent directory for TRACE models (~/.trace/models)."""
+    target = Path.home() / ".trace" / "models"
+    target.mkdir(parents=True, exist_ok=True)
+    return target
+
+
+def is_model_installed(model_name: str, candidate_dir: Optional[Path] = None) -> bool:
+    """Checks if all required model files are present and valid (not empty or git lfs pointer stubs)."""
+    if model_name not in MODEL_REGISTRY:
+        return False
+
+    spec = MODEL_REGISTRY[model_name]
+    target_dir = candidate_dir or (get_default_models_dir() / model_name)
+    if not target_dir.exists():
+        return False
+
+    for filename, meta in spec["files"].items():
+        file_path = target_dir / filename
+        if not file_path.exists():
+            return False
+        if file_path.stat().st_size < meta["min_size"]:
+            return False
+
+    return True
+
+
+def ensure_model(model_name: str) -> Path:
+    """Ensures model is installed locally; downloads missing files from GitHub LFS/Repo if needed."""
+    models_dir = get_default_models_dir()
+    target_dir = models_dir / model_name
+    target_dir.mkdir(parents=True, exist_ok=True)
+
+    if is_model_installed(model_name, target_dir):
+        return target_dir
+
+    if model_name not in MODEL_REGISTRY:
+        raise ValueError(f"Unknown model: {model_name}")
+
+    spec = MODEL_REGISTRY[model_name]
+    print(f"\n\033[38;2;16;185;129m[TRACE Model Hub]\033[0m Downloading fine-tuned {model_name} neural weights...")
+
+    for filename, meta in spec["files"].items():
+        file_path = target_dir / filename
+        if file_path.exists() and file_path.stat().st_size >= meta["min_size"]:
+            continue
+
+        temp_path = target_dir / f"{filename}.tmp"
+        url = meta["url"]
+        print(f"  \033[38;2;255;158;59m›\033[0m Fetching {filename}...")
+
+        try:
+            req = urllib.request.Request(
+                url,
+                headers={"User-Agent": "TRACE-Security-Engine/2.1 (github:VK-Amogh/TRACE)"},
+            )
+            with urllib.request.urlopen(req, timeout=120) as resp:
+                total_size = int(resp.headers.get("Content-Length", 0))
+                downloaded = 0
+                block_size = 1024 * 1024  # 1 MB chunk
+
+                with open(temp_path, "wb") as f:
+                    while True:
+                        chunk = resp.read(block_size)
+                        if not chunk:
+                            break
+                        f.write(chunk)
+                        downloaded += len(chunk)
+                        if total_size > 0:
+                            percent = (downloaded / total_size) * 100
+                            mb_down = downloaded / (1024 * 1024)
+                            mb_tot = total_size / (1024 * 1024)
+                            sys.stdout.write(f"\r    [{percent:.1f}%] {mb_down:.1f} MB / {mb_tot:.1f} MB")
+                            sys.stdout.flush()
+
+            print()
+            if temp_path.exists():
+                temp_path.replace(file_path)
+
+        except Exception as e:
+            if temp_path.exists():
+                temp_path.unlink()
+            logger.warning(f"Failed to download {filename} from {url}: {e}")
+            raise RuntimeError(f"Could not download {filename} for {model_name}: {e}")
+
+    print(f"\033[38;2;16;185;129m✓ Successfully provisioned {model_name}\033[0m\n")
+    return target_dir
+
+
+def ensure_all_models() -> None:
+    """Proactively ensures all fine-tuned models are downloaded and verified."""
+    for model_name in MODEL_REGISTRY:
+        ensure_model(model_name)

package/src/trace_engine/intelligence/laya/router.py

@@ -57,10 +57,11 @@ class LayaDecisionEngine:
     def _resolve_laya_dir(self) -> Optional[Path]:
         """Resolves Laya model directory across project root, package dir, and home."""
         candidates = [
+            Path.home() / ".trace/models/laya-finetuned",
             Path(".trace/models/laya-finetuned"),
             Path(__file__).resolve().parents[4] / ".trace/models/laya-finetuned",
             Path(__file__).resolve().parents[2] / "models/laya-finetuned",
-            Path.home() / ".trace/models/laya-finetuned",
+            Path("D:/Startup/TRACE/.trace/models/laya-finetuned"),
         ]
         repo_root = Path(__file__).resolve().parents[4]
         for p in candidates:
@@ -76,6 +77,13 @@ class LayaDecisionEngine:
                 return p.resolve()
             if onnx_file.exists() and onnx_file.stat().st_size >= 10000:
                 return p.resolve()
+
+        try:
+            from trace_engine.intelligence.downloader import ensure_model
+            return ensure_model("laya-finetuned")
+        except Exception as e:
+            logger.debug(f"Automatic Laya download deferred: {e}")
+
         return None
 
     def _load_onnx_model(self) -> None:
@@ -125,8 +133,11 @@ class LayaDecisionEngine:
     def _load_agent(self) -> None:
         """Attempt to load Laya in-process model."""
         try:
-            import laya
-            self._agent = laya.load(self.model_id)
+            import warnings
+            with warnings.catch_warnings():
+                warnings.filterwarnings("ignore", category=RuntimeWarning)
+                import laya
+                self._agent = laya.load(self.model_id)
             logger.info(f"Laya agent loaded: {self.model_id}")
         except Exception as e:
             logger.debug(f"Laya in-process loading: {e}. Using calibrated fallback.")

package/src/trace_engine/intelligence/securebert/classifier.py

@@ -34,12 +34,14 @@ class SecureBERTClassifier:
         cache_path: Optional[Path] = None,
     ):
         candidates = [
+            Path.home() / ".trace/models/securebert-finetuned",
             Path(".trace/models/securebert-finetuned"),
             Path(__file__).resolve().parents[4] / ".trace/models/securebert-finetuned",
             Path(__file__).resolve().parents[2] / "models/securebert-finetuned",
-            Path.home() / ".trace/models/securebert-finetuned",
+            Path("D:/Startup/TRACE/.trace/models/securebert-finetuned"),
         ]
-        default_model = "ehsanaghaei/SecureBERT"
+        default_model = None
+        repo_root = Path(__file__).resolve().parents[4]
         for cand in candidates:
             weight_file = cand / "model.safetensors"
             if weight_file.exists():
@@ -53,6 +55,15 @@ class SecureBERTClassifier:
                     default_model = str(cand.resolve())
                     break
 
+        if not default_model:
+            try:
+                from trace_engine.intelligence.downloader import ensure_model
+                model_dir = ensure_model("securebert-finetuned")
+                default_model = str(model_dir.resolve())
+            except Exception as e:
+                logger.debug(f"Automatic model download deferred: {e}")
+                default_model = "ehsanaghaei/SecureBERT"
+
         self.model_name = model_name or default_model
         cache_file = cache_path or Path(".trace/cache/securebert_cache.json")
         self.cache = SecureBERTCache(cache_file)
@@ -68,6 +79,8 @@ class SecureBERTClassifier:
         self._initialized = True
         try:
             import torch
+            import transformers
+            transformers.logging.set_verbosity_error()
             from transformers import AutoTokenizer, AutoModelForSequenceClassification
 
             self._device = "cuda" if torch.cuda.is_available() else "cpu"