@gendigital/sage-opencode 0.10.0 → 0.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (48) hide show
  1. package/README.md +6 -6
  2. package/dist/bundled-dirs.d.ts +1 -1
  3. package/dist/bundled-dirs.d.ts.map +1 -1
  4. package/dist/bundled-dirs.js +1 -1
  5. package/dist/bundled-dirs.js.map +1 -1
  6. package/dist/index.d.ts.map +1 -1
  7. package/dist/index.js +291 -71
  8. package/dist/index.js.map +1 -1
  9. package/dist/mcp-server.cjs +31882 -0
  10. package/dist/mcp-server.cjs.map +7 -0
  11. package/dist/plugin-discovery.d.ts +1 -0
  12. package/dist/plugin-discovery.d.ts.map +1 -1
  13. package/dist/plugin-discovery.js +27 -1
  14. package/dist/plugin-discovery.js.map +1 -1
  15. package/dist/startup-scan.d.ts +11 -3
  16. package/dist/startup-scan.d.ts.map +1 -1
  17. package/dist/startup-scan.js +60 -21
  18. package/dist/startup-scan.js.map +1 -1
  19. package/dist/tool-handler.d.ts +3 -2
  20. package/dist/tool-handler.d.ts.map +1 -1
  21. package/dist/tool-handler.js +22 -5
  22. package/dist/tool-handler.js.map +1 -1
  23. package/package.json +5 -3
  24. package/resources/threats/agent-layer.yaml +186 -0
  25. package/resources/threats/commands.yaml +24 -53
  26. package/resources/threats/credentials.yaml +12 -20
  27. package/resources/threats/dummy.yaml +44 -50
  28. package/resources/threats/files.yaml +34 -53
  29. package/resources/threats/mac-commands.yaml +20 -47
  30. package/resources/threats/mac-credentials.yaml +4 -12
  31. package/resources/threats/mac-files.yaml +5 -15
  32. package/resources/threats/mac-obfuscation.yaml +6 -13
  33. package/resources/threats/mac-persistence.yaml +11 -20
  34. package/resources/threats/mac-supply-chain.yaml +5 -8
  35. package/resources/threats/mitre.yaml +105 -167
  36. package/resources/threats/obfuscation.yaml +7 -15
  37. package/resources/threats/persistence.yaml +10 -17
  38. package/resources/threats/prompt-injection.yaml +92 -43
  39. package/resources/threats/self-defense.yaml +8 -12
  40. package/resources/threats/supply_chain.yaml +1 -2
  41. package/resources/threats/urls.yaml +9 -14
  42. package/resources/threats/win-commands.yaml +46 -106
  43. package/resources/threats/win-credentials.yaml +14 -24
  44. package/resources/threats/win-files.yaml +10 -20
  45. package/resources/threats/win-obfuscation.yaml +21 -37
  46. package/resources/threats/win-persistence.yaml +8 -16
  47. package/resources/threats/win-supply-chain.yaml +2 -3
  48. /package/resources/{allowlists → trusted-domains}/trusted-installer-domains.yaml +0 -0
package/resources/threats/win-files.yaml CHANGED
@@ -8,7 +8,6 @@
8
8
  category: secrets
9
9
  severity: critical
10
10
  confidence: 0.95
11
- action: block
12
11
  pattern: "(\\\\|/)Windows(\\\\|/)System32(\\\\|/)config(\\\\|/)(SAM|SECURITY|SYSTEM)"
13
12
  match_on: file_path
14
13
  title: "Access SAM/SECURITY/SYSTEM registry hive"
@@ -20,7 +19,6 @@
20
19
  category: secrets
21
20
  severity: critical
22
21
  confidence: 0.95
23
- action: block
24
22
  pattern: "[Nn][Tt][Dd][Ss]\\.[Dd][Ii][Tt]"
25
23
  match_on: file_path
26
24
  title: "Access NTDS.dit (Active Directory database)"
@@ -30,9 +28,8 @@
30
28
  # Windows hosts file
31
29
  - id: "CLT-WIN-FILE-003"
32
30
  category: tool
33
- severity: high
34
- confidence: 0.85
35
- action: require_approval
31
+ severity: warning
32
+ confidence: 0.60
36
33
  pattern: "(\\\\|/)Windows(\\\\|/)System32(\\\\|/)drivers(\\\\|/)etc(\\\\|/)hosts"
37
34
  match_on: file_path
38
35
  title: "Access Windows hosts file"
@@ -42,9 +39,8 @@
42
39
  # Startup folder
43
40
  - id: "CLT-WIN-FILE-004"
44
41
  category: tool
45
- severity: high
46
- confidence: 0.90
47
- action: require_approval
42
+ severity: warning
43
+ confidence: 0.60
48
44
  pattern: "(\\\\|/)(Startup|Start Menu(\\\\|/)Programs(\\\\|/)Startup)(\\\\|/)"
49
45
  match_on: file_path
50
46
  title: "Access Windows Startup folder"
@@ -56,7 +52,6 @@
56
52
  category: tool
57
53
  severity: critical
58
54
  confidence: 0.90
59
- action: block
60
55
  pattern: "(\\\\|/)Windows(\\\\|/)(System32|SysWOW64)(\\\\|/).*\\.(bat|cmd|ps1|vbs|wsf)$"
61
56
  match_on: file_path
62
57
  title: "Access executable script in System32/SysWOW64"
@@ -68,7 +63,6 @@
68
63
  category: tool
69
64
  severity: critical
70
65
  confidence: 0.90
71
- action: block
72
66
  pattern: "(\\\\|/)Windows(\\\\|/)System32(\\\\|/)drivers(\\\\|/).*\\.sys$"
73
67
  match_on: file_path
74
68
  title: "Access driver file in System32/drivers"
@@ -78,9 +72,8 @@
78
72
  # Task Scheduler directory
79
73
  - id: "CLT-WIN-FILE-007"
80
74
  category: tool
81
- severity: high
82
- confidence: 0.85
83
- action: require_approval
75
+ severity: warning
76
+ confidence: 0.60
84
77
  pattern: "(Windows|WINDOWS)[/\\\\]System32[/\\\\]Tasks[/\\\\]"
85
78
  match_on: file_path
86
79
  title: "Access Windows Task Scheduler directory"
@@ -90,9 +83,8 @@
90
83
  # SSH key or config file (Windows path)
91
84
  - id: "CLT-WIN-FILE-008"
92
85
  category: secrets
93
- severity: high
94
- confidence: 0.90
95
- action: require_approval
86
+ severity: warning
87
+ confidence: 0.60
96
88
  pattern: "\\.ssh[\\\\](id_rsa|id_ed25519|id_ecdsa|id_dsa|config|authorized_keys)$"
97
89
  match_on: file_path
98
90
  title: "Access SSH key or config file (Windows path)"
@@ -102,9 +94,8 @@
102
94
  # AWS credentials file (Windows path)
103
95
  - id: "CLT-WIN-FILE-009"
104
96
  category: secrets
105
- severity: high
106
- confidence: 0.85
107
- action: require_approval
97
+ severity: warning
98
+ confidence: 0.60
108
99
  pattern: "\\.aws[\\\\]credentials$"
109
100
  match_on: file_path
110
101
  title: "Access AWS credentials file (Windows path)"
@@ -116,7 +107,6 @@
116
107
  category: secrets
117
108
  severity: critical
118
109
  confidence: 0.90
119
- action: block
120
110
  pattern: "(Google[/\\\\]Chrome|Mozilla[/\\\\]Firefox|Microsoft[/\\\\]Edge)[/\\\\].*[/\\\\](Login Data|logins\\.json|Cookies)$"
121
111
  match_on: file_path
122
112
  title: "Access browser credential store"
package/resources/threats/win-obfuscation.yaml CHANGED
@@ -7,7 +7,6 @@
7
7
  category: tool
8
8
  severity: critical
9
9
  confidence: 0.95
10
- action: block
11
10
  pattern: "-[Ee]nc(oded[Cc]ommand)?\\s+[A-Za-z0-9+/=]{20,}"
12
11
  match_on: command
13
12
  title: "PowerShell -EncodedCommand with base64 payload"
@@ -17,9 +16,8 @@
17
16
  # certutil -decode
18
17
  - id: "CLT-WIN-OBFUS-002"
19
18
  category: tool
20
- severity: high
21
- confidence: 0.85
22
- action: require_approval
19
+ severity: warning
20
+ confidence: 0.60
23
21
  pattern: "[Cc][Ee][Rr][Tt][Uu][Tt][Ii][Ll]\\s.*-decode"
24
22
  match_on: command
25
23
  title: "certutil base64 decode (obfuscation)"
@@ -29,9 +27,8 @@
29
27
  # Hidden PowerShell window
30
28
  - id: "CLT-WIN-OBFUS-003"
31
29
  category: tool
32
- severity: high
33
- confidence: 0.85
34
- action: require_approval
30
+ severity: warning
31
+ confidence: 0.60
35
32
  pattern: "-[Ww]indow[Ss]tyle\\s+[Hh]idden"
36
33
  match_on: command
37
34
  title: "Hidden PowerShell window"
@@ -41,9 +38,8 @@
41
38
  # Bypass + NoProfile combo
42
39
  - id: "CLT-WIN-OBFUS-004"
43
40
  category: tool
44
- severity: high
41
+ severity: warning
45
42
  confidence: 0.90
46
- action: block
47
43
  pattern: "-[Ee]xecution[Pp]olicy\\s+[Bb]ypass.*-[Nn]o[Pp]rofile"
48
44
  match_on: command
49
45
  title: "PowerShell -ExecutionPolicy Bypass -NoProfile (malware pattern)"
@@ -53,9 +49,8 @@
53
49
  # [char] code obfuscation
54
50
  - id: "CLT-WIN-OBFUS-005"
55
51
  category: tool
56
- severity: high
57
- confidence: 0.80
58
- action: require_approval
52
+ severity: warning
53
+ confidence: 0.60
59
54
  pattern: "\\[char\\]\\s*\\d+.*-[Jj]oin"
60
55
  match_on: [command, content]
61
56
  title: "PowerShell [char] code obfuscation with -join"
@@ -67,7 +62,6 @@
67
62
  category: tool
68
63
  severity: critical
69
64
  confidence: 0.90
70
- action: block
71
65
  pattern: "\\bSYSTEM\\\\CurrentControlSet\\\\Control\\\\SecurityProviders\\b"
72
66
  match_on: command
73
67
  title: "Security provider DLL injection via registry"
@@ -79,7 +73,6 @@
79
73
  category: tool
80
74
  severity: critical
81
75
  confidence: 0.90
82
- action: block
83
76
  pattern: "\\bmshta\\b.*\\bvbscript:(Execute|CreateObject|close\\s*\\()"
84
77
  case_insensitive: true
85
78
  match_on: command
@@ -92,7 +85,6 @@
92
85
  category: tool
93
86
  severity: critical
94
87
  confidence: 0.90
95
- action: block
96
88
  pattern: "\\bmshta\\b.*\\bjavascript:"
97
89
  case_insensitive: true
98
90
  match_on: command
@@ -105,7 +97,6 @@
105
97
  category: tool
106
98
  severity: critical
107
99
  confidence: 0.90
108
- action: block
109
100
  pattern: "(wscript|cscript)(\\.exe)?\\b.*//[Ee]:([Vv][Bb][Ss]cript|[Jj][Ss]cript)"
110
101
  case_insensitive: true
111
102
  match_on: command
@@ -116,9 +107,8 @@
116
107
  # NTFS $INDEX_ALLOCATION folder creation (ex CLT-TECH-001)
117
108
  - id: "CLT-WIN-OBFUS-010"
118
109
  category: tool
119
- severity: high
120
- confidence: 0.80
121
- action: require_approval
110
+ severity: warning
111
+ confidence: 0.60
122
112
  pattern: "echo [\\S\\s]+> [a-zA-Z0-9.]+::\\$INDEX_ALLOCATION"
123
113
  case_insensitive: true
124
114
  match_on: command
@@ -129,9 +119,8 @@
129
119
  # ADS bypass via type redirect or wmic process create (ex CLT-TECH-002)
130
120
  - id: "CLT-WIN-OBFUS-011"
131
121
  category: tool
132
- severity: high
133
- confidence: 0.80
134
- action: require_approval
122
+ severity: warning
123
+ confidence: 0.60
135
124
  pattern: "(type [a-zA-Z+0-9.\\\\:]+ > [a-zA-Z+0-9.\\\\:]+:[0-9a-zA-Z+.]+|wmic process call create [a-zA-Z+0-9.\\\\:]+:[a-z0-9A-Z.]+)"
136
125
  case_insensitive: true
137
126
  match_on: command
@@ -142,9 +131,8 @@
142
131
  # Dotdotdot hidden folder (ex CLT-TECH-003)
143
132
  - id: "CLT-WIN-OBFUS-012"
144
133
  category: tool
145
- severity: high
146
- confidence: 0.80
147
- action: require_approval
134
+ severity: warning
135
+ confidence: 0.60
148
136
  pattern: "(mkdir\\s+\\.{3,}|[a-zA-Z]+\\s+[a-z0-9]+\\s+>\\s+\\.{3,})"
149
137
  case_insensitive: true
150
138
  match_on: command
@@ -155,9 +143,8 @@
155
143
  # cmd caret obfuscation (ex CLT-TECH-014)
156
144
  - id: "CLT-WIN-OBFUS-013"
157
145
  category: tool
158
- severity: high
159
- confidence: 0.80
160
- action: require_approval
146
+ severity: warning
147
+ confidence: 0.60
161
148
  pattern: "cmd.*([^\\^]\\^[a-z].*){5}"
162
149
  case_insensitive: true
163
150
  match_on: command
@@ -168,9 +155,8 @@
168
155
  # cmd substring concatenation obfuscation (ex CLT-TECH-015)
169
156
  - id: "CLT-WIN-OBFUS-014"
170
157
  category: tool
171
- severity: high
172
- confidence: 0.80
173
- action: require_approval
158
+ severity: warning
159
+ confidence: 0.60
174
160
  pattern: "cmd.*(%[^%]+:~[^%]*%[a-z]*){2}"
175
161
  case_insensitive: true
176
162
  match_on: command
@@ -181,9 +167,8 @@
181
167
  # PowerShell backtick obfuscation (ex CLT-TECH-021)
182
168
  - id: "CLT-WIN-OBFUS-015"
183
169
  category: tool
184
- severity: high
185
- confidence: 0.80
186
- action: require_approval
170
+ severity: warning
171
+ confidence: 0.60
187
172
  pattern: "powershell.*(`[a-z].*){4}"
188
173
  case_insensitive: true
189
174
  match_on: command
@@ -194,9 +179,8 @@
194
179
  # PowerShell XOR decryption (ex CLT-TECH-026)
195
180
  - id: "CLT-WIN-OBFUS-016"
196
181
  category: tool
197
- severity: high
198
- confidence: 0.80
199
- action: require_approval
182
+ severity: warning
183
+ confidence: 0.60
200
184
  pattern: "powershell.+-bxor\\s*['\"]"
201
185
  case_insensitive: true
202
186
  match_on: command
package/resources/threats/win-persistence.yaml CHANGED
@@ -8,7 +8,6 @@
8
8
  category: tool
9
9
  severity: critical
10
10
  confidence: 0.90
11
- action: block
12
11
  pattern: "\\b[Rr][Ee][Gg]\\b\\s+[Aa][Dd][Dd].*\\\\(Run|RunOnce)\\\\"
13
12
  match_on: command
14
13
  title: "Registry Run key persistence via reg add"
@@ -20,7 +19,6 @@
20
19
  category: tool
21
20
  severity: critical
22
21
  confidence: 0.90
23
- action: block
24
22
  pattern: "\\b[Ss][Cc]\\b\\s+(create|config).*binpath"
25
23
  match_on: command
26
24
  title: "Windows service creation/modification via sc"
@@ -30,9 +28,8 @@
30
28
  # schtasks /create
31
29
  - id: "CLT-WIN-PERSIST-003"
32
30
  category: tool
33
- severity: high
34
- confidence: 0.85
35
- action: require_approval
31
+ severity: warning
32
+ confidence: 0.60
36
33
  pattern: "\\b[Ss][Cc][Hh][Tt][Aa][Ss][Kk][Ss]\\b.*/[Cc]reate"
37
34
  match_on: command
38
35
  title: "Scheduled task creation via schtasks"
@@ -42,9 +39,8 @@
42
39
  # PowerShell New-ScheduledTask
43
40
  - id: "CLT-WIN-PERSIST-004"
44
41
  category: tool
45
- severity: high
46
- confidence: 0.85
47
- action: require_approval
42
+ severity: warning
43
+ confidence: 0.60
48
44
  pattern: "[Nn]ew-[Ss]cheduled[Tt]ask"
49
45
  match_on: command
50
46
  title: "PowerShell scheduled task creation"
@@ -56,7 +52,6 @@
56
52
  category: tool
57
53
  severity: critical
58
54
  confidence: 0.90
59
- action: block
60
55
  pattern: "[Ss]et-[Ii]tem[Pp]roperty.*\\\\(Run|RunOnce)\\\\"
61
56
  match_on: command
62
57
  title: "PowerShell Registry Run key persistence"
@@ -66,9 +61,8 @@
66
61
  # PowerShell New-Service
67
62
  - id: "CLT-WIN-PERSIST-006"
68
63
  category: tool
69
- severity: high
70
- confidence: 0.85
71
- action: require_approval
64
+ severity: warning
65
+ confidence: 0.60
72
66
  pattern: "\\b[Nn]ew-[Ss]ervice\\b"
73
67
  match_on: command
74
68
  title: "PowerShell Windows service creation"
@@ -78,9 +72,8 @@
78
72
  # Startup folder path
79
73
  - id: "CLT-WIN-PERSIST-007"
80
74
  category: tool
81
- severity: high
82
- confidence: 0.85
83
- action: require_approval
75
+ severity: warning
76
+ confidence: 0.60
84
77
  pattern: "\\\\(Startup|Start Menu\\\\Programs\\\\Startup)\\\\"
85
78
  match_on: command
86
79
  title: "Startup folder drop (persistence)"
@@ -92,7 +85,6 @@
92
85
  category: tool
93
86
  severity: critical
94
87
  confidence: 0.90
95
- action: block
96
88
  pattern: "\\b(CommandLineEventConsumer|ActiveScriptEventConsumer)\\b"
97
89
  match_on: command
98
90
  title: "WMI event subscription persistence"
package/resources/threats/win-supply-chain.yaml CHANGED
@@ -5,9 +5,8 @@
5
5
  # Install-Module without -RequiredVersion
6
6
  - id: "CLT-WIN-SUPPLY-001"
7
7
  category: supply_chain
8
- severity: medium
9
- confidence: 0.65
10
- action: require_approval
8
+ severity: warning
9
+ confidence: 0.60
11
10
  pattern: "[Ii]nstall-[Mm]odule\\s+(?!.*-[Rr]equired[Vv]ersion)"
12
11
  match_on: command
13
12
  title: "PowerShell Install-Module without -RequiredVersion"