@gendigital/sage-opencode 0.10.0 → 0.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (48) hide show
  1. package/README.md +6 -6
  2. package/dist/bundled-dirs.d.ts +1 -1
  3. package/dist/bundled-dirs.d.ts.map +1 -1
  4. package/dist/bundled-dirs.js +1 -1
  5. package/dist/bundled-dirs.js.map +1 -1
  6. package/dist/index.d.ts.map +1 -1
  7. package/dist/index.js +291 -71
  8. package/dist/index.js.map +1 -1
  9. package/dist/mcp-server.cjs +31882 -0
  10. package/dist/mcp-server.cjs.map +7 -0
  11. package/dist/plugin-discovery.d.ts +1 -0
  12. package/dist/plugin-discovery.d.ts.map +1 -1
  13. package/dist/plugin-discovery.js +27 -1
  14. package/dist/plugin-discovery.js.map +1 -1
  15. package/dist/startup-scan.d.ts +11 -3
  16. package/dist/startup-scan.d.ts.map +1 -1
  17. package/dist/startup-scan.js +60 -21
  18. package/dist/startup-scan.js.map +1 -1
  19. package/dist/tool-handler.d.ts +3 -2
  20. package/dist/tool-handler.d.ts.map +1 -1
  21. package/dist/tool-handler.js +22 -5
  22. package/dist/tool-handler.js.map +1 -1
  23. package/package.json +5 -3
  24. package/resources/threats/agent-layer.yaml +186 -0
  25. package/resources/threats/commands.yaml +24 -53
  26. package/resources/threats/credentials.yaml +12 -20
  27. package/resources/threats/dummy.yaml +44 -50
  28. package/resources/threats/files.yaml +34 -53
  29. package/resources/threats/mac-commands.yaml +20 -47
  30. package/resources/threats/mac-credentials.yaml +4 -12
  31. package/resources/threats/mac-files.yaml +5 -15
  32. package/resources/threats/mac-obfuscation.yaml +6 -13
  33. package/resources/threats/mac-persistence.yaml +11 -20
  34. package/resources/threats/mac-supply-chain.yaml +5 -8
  35. package/resources/threats/mitre.yaml +105 -167
  36. package/resources/threats/obfuscation.yaml +7 -15
  37. package/resources/threats/persistence.yaml +10 -17
  38. package/resources/threats/prompt-injection.yaml +92 -43
  39. package/resources/threats/self-defense.yaml +8 -12
  40. package/resources/threats/supply_chain.yaml +1 -2
  41. package/resources/threats/urls.yaml +9 -14
  42. package/resources/threats/win-commands.yaml +46 -106
  43. package/resources/threats/win-credentials.yaml +14 -24
  44. package/resources/threats/win-files.yaml +10 -20
  45. package/resources/threats/win-obfuscation.yaml +21 -37
  46. package/resources/threats/win-persistence.yaml +8 -16
  47. package/resources/threats/win-supply-chain.yaml +2 -3
  48. /package/resources/{allowlists → trusted-domains}/trusted-installer-domains.yaml +0 -0
package/resources/threats/mac-persistence.yaml CHANGED
@@ -6,9 +6,8 @@
6
6
  # LaunchAgent/LaunchDaemon plist (migrated from persistence.yaml CLT-PERSIST-004)
7
7
  - id: "CLT-MAC-PERSIST-001"
8
8
  category: tool
9
- severity: high
9
+ severity: warning
10
10
  confidence: 0.90
11
- action: block
12
11
  pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist"
13
12
  match_on: command
14
13
  title: "macOS LaunchAgent/LaunchDaemon persistence"
@@ -18,9 +17,8 @@
18
17
  # Login Items via osascript
19
18
  - id: "CLT-MAC-PERSIST-002"
20
19
  category: tool
21
- severity: high
22
- confidence: 0.85
23
- action: require_approval
20
+ severity: warning
21
+ confidence: 0.60
24
22
  pattern: "\\bosascript\\b.*login item"
25
23
  case_insensitive: true
26
24
  match_on: command
@@ -31,9 +29,8 @@
31
29
  # Login window manipulation via defaults
32
30
  - id: "CLT-MAC-PERSIST-003"
33
31
  category: tool
34
- severity: high
35
- confidence: 0.85
36
- action: require_approval
32
+ severity: warning
33
+ confidence: 0.60
37
34
  pattern: "\\bdefaults\\b.*\\bwrite\\b.*loginwindow.*(AutoLaunch|LoginHook|LogoutHook)"
38
35
  case_insensitive: true
39
36
  match_on: command
@@ -46,7 +43,6 @@
46
43
  category: tool
47
44
  severity: critical
48
45
  confidence: 0.90
49
- action: block
50
46
  pattern: "/Library/Security/SecurityAgentPlugins/"
51
47
  match_on: command
52
48
  title: "Authorization plugin drop in SecurityAgentPlugins"
@@ -56,9 +52,8 @@
56
52
  # Periodic script drop
57
53
  - id: "CLT-MAC-PERSIST-005"
58
54
  category: tool
59
- severity: high
60
- confidence: 0.85
61
- action: require_approval
55
+ severity: warning
56
+ confidence: 0.60
62
57
  pattern: "/etc/periodic/(daily|weekly|monthly)/"
63
58
  match_on: command
64
59
  title: "Periodic script persistence drop"
@@ -72,7 +67,6 @@
72
67
  category: tool
73
68
  severity: critical
74
69
  confidence: 0.90
75
- action: block
76
70
  pattern: "/etc/emond\\.d/rules/"
77
71
  match_on: command
78
72
  title: "Event Monitor daemon rules persistence"
@@ -84,7 +78,6 @@
84
78
  category: tool
85
79
  severity: critical
86
80
  confidence: 0.90
87
- action: block
88
81
  pattern: "DYLD_INSERT_LIBRARIES"
89
82
  match_on: command
90
83
  title: "DYLD_INSERT_LIBRARIES dylib injection (persistence/hijack)"
@@ -94,9 +87,8 @@
94
87
  # Folder Actions via osascript
95
88
  - id: "CLT-MAC-PERSIST-008"
96
89
  category: tool
97
- severity: high
98
- confidence: 0.85
99
- action: require_approval
90
+ severity: warning
91
+ confidence: 0.60
100
92
  pattern: "\\bosascript\\b.*folder action"
101
93
  case_insensitive: true
102
94
  match_on: command
@@ -107,9 +99,8 @@
107
99
  # launchctl load/bootstrap persistent agent
108
100
  - id: "CLT-MAC-PERSIST-009"
109
101
  category: tool
110
- severity: high
111
- confidence: 0.85
112
- action: require_approval
102
+ severity: warning
103
+ confidence: 0.60
113
104
  pattern: "\\blaunchctl\\b.*\\b(load|bootstrap)\\b"
114
105
  match_on: command
115
106
  title: "Load persistent launch agent/daemon via launchctl"
package/resources/threats/mac-supply-chain.yaml CHANGED
@@ -5,9 +5,8 @@
5
5
  # brew install without version pin
6
6
  - id: "CLT-MAC-SUPPLY-001"
7
7
  category: supply_chain
8
- severity: medium
9
- confidence: 0.65
10
- action: require_approval
8
+ severity: warning
9
+ confidence: 0.60
11
10
  pattern: "\\bbrew\\s+install\\b(?!.*@\\d)"
12
11
  match_on: command
13
12
  title: "Homebrew install without version pin"
@@ -17,9 +16,8 @@
17
16
  # installer -pkg from remote URL
18
17
  - id: "CLT-MAC-SUPPLY-002"
19
18
  category: supply_chain
20
- severity: high
19
+ severity: warning
21
20
  confidence: 0.85
22
- action: block
23
21
  pattern: "\\binstaller\\b.*-pkg.*https?://"
24
22
  case_insensitive: true
25
23
  match_on: command
@@ -30,9 +28,8 @@
30
28
  # brew install --cask from non-default tap
31
29
  - id: "CLT-MAC-SUPPLY-003"
32
30
  category: supply_chain
33
- severity: medium
34
- confidence: 0.65
35
- action: require_approval
31
+ severity: warning
32
+ confidence: 0.60
36
33
  pattern: "\\bbrew\\s+(install|reinstall)\\s+--cask\\b"
37
34
  match_on: command
38
35
  title: "Homebrew cask install (binary application)"