@gendigital/sage-opencode 0.12.0 → 0.13.0

package/dist/mcp-server.cjs

@@ -4230,7 +4230,8 @@ var init_types2 = __esm({
     VerdictSeveritySchema = external_exports.enum(["info", "warning", "critical"]);
     ThreatSchema = external_exports.object({
       id: external_exports.string(),
-      version: external_exports.number().int().optional(),
+      version: external_exports.number().int().positive(),
+      detectionName: external_exports.string(),
       category: external_exports.string(),
       severity: VerdictSeveritySchema,
       confidence: external_exports.number(),
@@ -4329,6 +4330,7 @@ var init_types2 = __esm({
       sensitivity: SensitivitySchema.default("balanced"),
       disabled_threats: external_exports.array(external_exports.string()).default([]),
       announce_clean_scans: external_exports.boolean().default(true),
+      manage_status_line: external_exports.boolean().default(true),
       brand_key: external_exports.string().min(1).max(32).regex(/^[a-z0-9_-]+$/u).optional(),
       community_iq: external_exports.boolean().default(true)
     });
@@ -20788,7 +20790,7 @@ init_file_utils();
 var import_meta = {};
 function resolveVersion() {
   if (true)
-    return "0.12.0";
+    return "0.13.0";
   try {
     const pkgPath = (0, import_node_path3.join)((0, import_node_path3.dirname)((0, import_node_url.fileURLToPath)(import_meta.url)), "..", "package.json");
     const pkg = JSON.parse(getFileContentSync(pkgPath));
@@ -31437,6 +31439,9 @@ function readContent(entry) {
     return {};
   return raw;
 }
+function readContentSnippet(entry) {
+  return asString(entry.content_snippet);
+}
 function isRuntimeVerdictEntry(v) {
   if (!v || typeof v !== "object" || Array.isArray(v))
     return false;
@@ -31482,9 +31487,10 @@ var ReportInputSchema = external_exports.object({
   entry_ids: external_exports.array(external_exports.string()).optional().describe(`REQUIRED in normal use: list of specific audit entry_ids to report as false positives. ALWAYS call sage_list_audit_entries first to inspect the audit log and identify the exact deny/ask verdict the user considers a false positive, then pass its entry_id here. Up to ${MAX_EXPLICIT_ENTRIES} entry_ids may be provided per call. Omitting this parameter is a fallback that submits up to ${MAX_IMPLICIT_ENTRIES} most recent deny/ask entries for the conversation, which may include irrelevant verdicts and should only be used when entry_id discovery is impossible.`),
   dry_run: external_exports.boolean().optional().describe("If true, do not POST; just show the payload.")
 });
-function parseAuditSignals(raw) {
+function parseAuditSignals(raw, options = {}) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw))
     return {};
+  const includePiContentSnippet = options.includePiContentSnippet ?? true;
   const obj = raw;
   const heuristicsRaw = obj.heuristics;
   const urlChecksRaw = obj.url_checks;
@@ -31496,11 +31502,16 @@ function parseAuditSignals(raw) {
     if (!h || typeof h !== "object" || Array.isArray(h))
       return null;
     const rec = h;
+    const detection_name = asString(rec.detection_name);
     const rule_id = asString(rec.rule_id);
     const rule_version = typeof rec.rule_version === "number" ? Math.trunc(rec.rule_version) : void 0;
     if (!rule_id)
       return null;
-    return { rule_id, rule_version };
+    return {
+      ...detection_name ? { detection_name } : {},
+      rule_id,
+      rule_version
+    };
   }).filter(Boolean) : void 0;
   const url_checks = Array.isArray(urlChecksRaw) ? urlChecksRaw.map((u) => {
     if (!u || typeof u !== "object" || Array.isArray(u))
@@ -31538,12 +31549,20 @@ function parseAuditSignals(raw) {
     if (!m || typeof m !== "object" || Array.isArray(m))
       return null;
     const rec = m;
+    const detection_name = asString(rec.detection_name);
     const risk = typeof rec.risk === "number" ? rec.risk : void 0;
     const model_id = asString(rec.model_id);
     const content_name = asString(rec.content_name);
+    const content_snippet = asString(rec.content_snippet);
     if (risk === void 0 || !model_id || !content_name)
       return null;
-    return { risk, model_id, content_name };
+    return {
+      ...detection_name ? { detection_name } : {},
+      risk,
+      model_id,
+      content_name,
+      ...content_snippet && includePiContentSnippet ? { content_snippet } : {}
+    };
   }).filter(Boolean) : void 0;
   const amsi_checks = Array.isArray(amsiChecksRaw) ? amsiChecksRaw.map((a) => {
     if (!a || typeof a !== "object" || Array.isArray(a))
@@ -31615,7 +31634,11 @@ function registerFalsePositiveTools(server, opts) {
         severity: asString(e.severity),
         source: asString(e.source),
         user_override: e.user_override,
-        signals: parseAuditSignals(e.signals),
+        // PI snippets are untrusted fetched content. Exclude their raw
+        // text—including the generic top-level content_snippet - from this
+        // model-visible response. Retain it only for the backend-only
+        // false-positive report below.
+        signals: parseAuditSignals(e.signals, { includePiContentSnippet: false }),
         content: readContent(e)
       }));
       complete("completed", {
@@ -31732,10 +31755,14 @@ ${reasoning}`;
         const agent_runtime = asString(e.agent_runtime) ?? "unknown";
         const tool_type = asString(e.tool_name) ?? "Unknown";
         const verdict = asString(e.verdict) ?? "deny";
-        const user_action = e.user_override === true ? "allowed" : "blocked";
+        const wasAllowed = verdict === "allow" || e.user_override === true;
+        const user_action = wasAllowed ? "allowed" : "blocked";
         const hook_type = asHookType(e.hook_type) ?? "PreToolUse";
-        const signals = parseAuditSignals(e.signals);
+        const signals = parseAuditSignals(e.signals, {
+          includePiContentSnippet: !dry_run
+        });
         const content = readContent(e);
+        const contentSnippet = readContentSnippet(e);
         const bestEffortSignals = {};
         if (signals.heuristics)
           bestEffortSignals.heuristics = signals.heuristics;
@@ -31764,7 +31791,8 @@ ${reasoning}`;
             user_action,
             timestamp,
             ...Object.keys(bestEffortSignals).length > 0 ? { signals: bestEffortSignals } : {},
-            content
+            content,
+            ...contentSnippet && !dry_run ? { content_snippet: contentSnippet } : {}
           },
           comment,
           event_id: entry_id ?? (0, import_node_crypto2.randomUUID)()
@@ -31869,7 +31897,7 @@ async function main() {
   );
   const branding = resolveBranding(config2.brand_key, logger);
   await runSageMcpServerStdio({
-    version: "0.12.0",
+    version: "0.13.0",
     logger,
     branding
   });