@gendigital/sage-opencode 0.9.0 → 0.11.0

package/resources/threats/win-files.yaml

@@ -8,7 +8,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "(\\\\|/)Windows(\\\\|/)System32(\\\\|/)config(\\\\|/)(SAM|SECURITY|SYSTEM)"
   match_on: file_path
   title: "Access SAM/SECURITY/SYSTEM registry hive"
@@ -20,7 +19,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "[Nn][Tt][Dd][Ss]\\.[Dd][Ii][Tt]"
   match_on: file_path
   title: "Access NTDS.dit (Active Directory database)"
@@ -30,9 +28,8 @@
 # Windows hosts file
 - id: "CLT-WIN-FILE-003"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(\\\\|/)Windows(\\\\|/)System32(\\\\|/)drivers(\\\\|/)etc(\\\\|/)hosts"
   match_on: file_path
   title: "Access Windows hosts file"
@@ -42,9 +39,8 @@
 # Startup folder
 - id: "CLT-WIN-FILE-004"
   category: tool
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(\\\\|/)(Startup|Start Menu(\\\\|/)Programs(\\\\|/)Startup)(\\\\|/)"
   match_on: file_path
   title: "Access Windows Startup folder"
@@ -56,7 +52,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(\\\\|/)Windows(\\\\|/)(System32|SysWOW64)(\\\\|/).*\\.(bat|cmd|ps1|vbs|wsf)$"
   match_on: file_path
   title: "Access executable script in System32/SysWOW64"
@@ -68,7 +63,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(\\\\|/)Windows(\\\\|/)System32(\\\\|/)drivers(\\\\|/).*\\.sys$"
   match_on: file_path
   title: "Access driver file in System32/drivers"
@@ -78,9 +72,8 @@
 # Task Scheduler directory
 - id: "CLT-WIN-FILE-007"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(Windows|WINDOWS)[/\\\\]System32[/\\\\]Tasks[/\\\\]"
   match_on: file_path
   title: "Access Windows Task Scheduler directory"
@@ -90,9 +83,8 @@
 # SSH key or config file (Windows path)
 - id: "CLT-WIN-FILE-008"
   category: secrets
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.ssh[\\\\](id_rsa|id_ed25519|id_ecdsa|id_dsa|config|authorized_keys)$"
   match_on: file_path
   title: "Access SSH key or config file (Windows path)"
@@ -102,9 +94,8 @@
 # AWS credentials file (Windows path)
 - id: "CLT-WIN-FILE-009"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.aws[\\\\]credentials$"
   match_on: file_path
   title: "Access AWS credentials file (Windows path)"
@@ -116,7 +107,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(Google[/\\\\]Chrome|Mozilla[/\\\\]Firefox|Microsoft[/\\\\]Edge)[/\\\\].*[/\\\\](Login Data|logins\\.json|Cookies)$"
   match_on: file_path
   title: "Access browser credential store"

package/resources/threats/win-obfuscation.yaml

@@ -7,7 +7,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "-[Ee]nc(oded[Cc]ommand)?\\s+[A-Za-z0-9+/=]{20,}"
   match_on: command
   title: "PowerShell -EncodedCommand with base64 payload"
@@ -17,9 +16,8 @@
 # certutil -decode
 - id: "CLT-WIN-OBFUS-002"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "[Cc][Ee][Rr][Tt][Uu][Tt][Ii][Ll]\\s.*-decode"
   match_on: command
   title: "certutil base64 decode (obfuscation)"
@@ -29,9 +27,8 @@
 # Hidden PowerShell window
 - id: "CLT-WIN-OBFUS-003"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "-[Ww]indow[Ss]tyle\\s+[Hh]idden"
   match_on: command
   title: "Hidden PowerShell window"
@@ -41,9 +38,8 @@
 # Bypass + NoProfile combo
 - id: "CLT-WIN-OBFUS-004"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.90
-  action: block
   pattern: "-[Ee]xecution[Pp]olicy\\s+[Bb]ypass.*-[Nn]o[Pp]rofile"
   match_on: command
   title: "PowerShell -ExecutionPolicy Bypass -NoProfile (malware pattern)"
@@ -53,9 +49,8 @@
 # [char] code obfuscation
 - id: "CLT-WIN-OBFUS-005"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\[char\\]\\s*\\d+.*-[Jj]oin"
   match_on: [command, content]
   title: "PowerShell [char] code obfuscation with -join"
@@ -67,7 +62,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bSYSTEM\\\\CurrentControlSet\\\\Control\\\\SecurityProviders\\b"
   match_on: command
   title: "Security provider DLL injection via registry"
@@ -79,7 +73,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bmshta\\b.*\\bvbscript:(Execute|CreateObject|close\\s*\\()"
   case_insensitive: true
   match_on: command
@@ -92,7 +85,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bmshta\\b.*\\bjavascript:"
   case_insensitive: true
   match_on: command
@@ -105,7 +97,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(wscript|cscript)(\\.exe)?\\b.*//[Ee]:([Vv][Bb][Ss]cript|[Jj][Ss]cript)"
   case_insensitive: true
   match_on: command
@@ -116,9 +107,8 @@
 # NTFS $INDEX_ALLOCATION folder creation (ex CLT-TECH-001)
 - id: "CLT-WIN-OBFUS-010"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "echo [\\S\\s]+> [a-zA-Z0-9.]+::\\$INDEX_ALLOCATION"
   case_insensitive: true
   match_on: command
@@ -129,9 +119,8 @@
 # ADS bypass via type redirect or wmic process create (ex CLT-TECH-002)
 - id: "CLT-WIN-OBFUS-011"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(type [a-zA-Z+0-9.\\\\:]+ > [a-zA-Z+0-9.\\\\:]+:[0-9a-zA-Z+.]+|wmic process call create [a-zA-Z+0-9.\\\\:]+:[a-z0-9A-Z.]+)"
   case_insensitive: true
   match_on: command
@@ -142,9 +131,8 @@
 # Dotdotdot hidden folder (ex CLT-TECH-003)
 - id: "CLT-WIN-OBFUS-012"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(mkdir\\s+\\.{3,}|[a-zA-Z]+\\s+[a-z0-9]+\\s+>\\s+\\.{3,})"
   case_insensitive: true
   match_on: command
@@ -155,9 +143,8 @@
 # cmd caret obfuscation (ex CLT-TECH-014)
 - id: "CLT-WIN-OBFUS-013"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "cmd.*([^\\^]\\^[a-z].*){5}"
   case_insensitive: true
   match_on: command
@@ -168,9 +155,8 @@
 # cmd substring concatenation obfuscation (ex CLT-TECH-015)
 - id: "CLT-WIN-OBFUS-014"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "cmd.*(%[^%]+:~[^%]*%[a-z]*){2}"
   case_insensitive: true
   match_on: command
@@ -181,9 +167,8 @@
 # PowerShell backtick obfuscation (ex CLT-TECH-021)
 - id: "CLT-WIN-OBFUS-015"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "powershell.*(`[a-z].*){4}"
   case_insensitive: true
   match_on: command
@@ -194,9 +179,8 @@
 # PowerShell XOR decryption (ex CLT-TECH-026)
 - id: "CLT-WIN-OBFUS-016"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "powershell.+-bxor\\s*['\"]"
   case_insensitive: true
   match_on: command

package/resources/threats/win-persistence.yaml

@@ -8,7 +8,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\b[Rr][Ee][Gg]\\b\\s+[Aa][Dd][Dd].*\\\\(Run|RunOnce)\\\\"
   match_on: command
   title: "Registry Run key persistence via reg add"
@@ -20,7 +19,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\b[Ss][Cc]\\b\\s+(create|config).*binpath"
   match_on: command
   title: "Windows service creation/modification via sc"
@@ -30,9 +28,8 @@
 # schtasks /create
 - id: "CLT-WIN-PERSIST-003"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b[Ss][Cc][Hh][Tt][Aa][Ss][Kk][Ss]\\b.*/[Cc]reate"
   match_on: command
   title: "Scheduled task creation via schtasks"
@@ -42,9 +39,8 @@
 # PowerShell New-ScheduledTask
 - id: "CLT-WIN-PERSIST-004"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "[Nn]ew-[Ss]cheduled[Tt]ask"
   match_on: command
   title: "PowerShell scheduled task creation"
@@ -56,7 +52,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "[Ss]et-[Ii]tem[Pp]roperty.*\\\\(Run|RunOnce)\\\\"
   match_on: command
   title: "PowerShell Registry Run key persistence"
@@ -66,9 +61,8 @@
 # PowerShell New-Service
 - id: "CLT-WIN-PERSIST-006"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b[Nn]ew-[Ss]ervice\\b"
   match_on: command
   title: "PowerShell Windows service creation"
@@ -78,9 +72,8 @@
 # Startup folder path
 - id: "CLT-WIN-PERSIST-007"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\\\(Startup|Start Menu\\\\Programs\\\\Startup)\\\\"
   match_on: command
   title: "Startup folder drop (persistence)"
@@ -92,7 +85,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\b(CommandLineEventConsumer|ActiveScriptEventConsumer)\\b"
   match_on: command
   title: "WMI event subscription persistence"

package/resources/threats/win-supply-chain.yaml

@@ -5,9 +5,8 @@
 # Install-Module without -RequiredVersion
 - id: "CLT-WIN-SUPPLY-001"
   category: supply_chain
-  severity: medium
-  confidence: 0.65
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "[Ii]nstall-[Mm]odule\\s+(?!.*-[Rr]equired[Vv]ersion)"
   match_on: command
   title: "PowerShell Install-Module without -RequiredVersion"

package/dist/logger-adaptor.d.ts

@@ -1,15 +0,0 @@
-/**
- * Bridges OpenCode's client logger to Sage's Logger interface.
- */
-import type { Logger } from "@gendigital/sage-core";
-import type { PluginInput } from "@opencode-ai/plugin";
-export declare class OpencodeLogger implements Logger {
-    private client;
-    constructor(client: PluginInput["client"]);
-    debug(msg: string, data?: Record<string, unknown>): Promise<void>;
-    info(msg: string, data?: Record<string, unknown>): Promise<void>;
-    warn(msg: string, data?: Record<string, unknown>): Promise<void>;
-    error(msg: string, data?: Record<string, unknown>): Promise<void>;
-    private write;
-}
-//# sourceMappingURL=logger-adaptor.d.ts.map

package/dist/logger-adaptor.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger-adaptor.d.ts","sourceRoot":"","sources":["../src/logger-adaptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,qBAAa,cAAe,YAAW,MAAM;IAC5C,OAAO,CAAC,MAAM,CAAwB;gBAE1B,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;IAI5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIjD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIhD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIhD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;YAIhD,KAAK;CAUnB"}

package/dist/logger-adaptor.js

@@ -1,32 +0,0 @@
-/**
- * Bridges OpenCode's client logger to Sage's Logger interface.
- */
-export class OpencodeLogger {
-    client;
-    constructor(client) {
-        this.client = client;
-    }
-    async debug(msg, data) {
-        await this.write("debug", msg, data).catch(() => { });
-    }
-    async info(msg, data) {
-        await this.write("info", msg, data).catch(() => { });
-    }
-    async warn(msg, data) {
-        await this.write("warn", msg, data).catch(() => { });
-    }
-    async error(msg, data) {
-        await this.write("error", msg, data).catch(() => { });
-    }
-    async write(level, msg, data) {
-        await this.client.app.log({
-            body: {
-                service: "sage-opencode",
-                level,
-                message: msg,
-                extra: data && typeof data === "object" ? data : undefined,
-            },
-        });
-    }
-}
-//# sourceMappingURL=logger-adaptor.js.map

package/dist/logger-adaptor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger-adaptor.js","sourceRoot":"","sources":["../src/logger-adaptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,OAAO,cAAc;IAClB,MAAM,CAAwB;IAEtC,YAAY,MAA6B;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,IAA8B;QAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAA8B;QAC5D,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAA8B;QAC5D,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,IAA8B;QAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,KAA0C,EAAE,GAAW,EAAE,IAAc;QAC1F,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACzB,IAAI,EAAE;gBACL,OAAO,EAAE,eAAe;gBACxB,KAAK;gBACL,OAAO,EAAE,GAAG;gBACZ,KAAK,EAAE,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,SAAS;aACvF;SACD,CAAC,CAAC;IACJ,CAAC;CACD"}