retrohound 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,9 @@
+RetroHound
+Copyright 2026 Raman Kumar
+
+This product includes software developed by Raman Kumar (https://github.com/Raman-Lab1/RetroHound).
+
+The code is licensed under the Apache License, Version 2.0 (LICENSE). The detection rules under rules/ are
+licensed under the Detection Rule License (DRL) 1.1 (rules/LICENSE).
+
+The bundled CLI (dist/cli.mjs) inlines third-party packages; their licences are in dist/THIRD_PARTY_LICENSES.

package/README.md

@@ -1,3 +1,236 @@
-# Temporary Holding Version
+# RetroHound
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/Raman-Lab1/RetroHound/actions/workflows/ci.yml/badge.svg)](https://github.com/Raman-Lab1/RetroHound/actions/workflows/ci.yml)
+[![Code: Apache-2.0](https://img.shields.io/badge/code-Apache--2.0-blue)](LICENSE)
+[![Rules: DRL 1.1](https://img.shields.io/badge/rules-DRL%201.1-blue)](rules/LICENSE)
+[![Network: zero calls](https://img.shields.io/badge/network-zero%20calls-brightgreen)](#privacy)
+
+**What did your AI coding agent actually run?** RetroHound reads the transcripts Claude Code, Codex CLI and
+Antigravity CLI already keep on your machine and checks them with Sigma rules: secrets read, scripts piped into a
+shell, agent config and hooks rewritten, data sent to paste sites, including what sub-agents did and what was blocked
+and then retried. Local, offline, and the evidence outlives the agent's own cleanup.
+
+<p align="center">
+  <img src="docs/assets/demo.gif" alt="retrohound scan lists findings by severity, retrohound show prints the session timeline, and the hook denies a curl | sh before it runs" width="100%">
+</p>
+<p align="center"><sub>Recorded on a synthetic history (<code>scripts/demo-history.ts</code>, <code>docs/demo/demo.tape</code>), not a real one.</sub></p>
+
+## Quick start
+
+With [Bun](https://bun.sh) and Node >= 22.13 (an npm package is coming):
+
+```sh
+git clone https://github.com/Raman-Lab1/RetroHound && cd RetroHound
+bun install && bun run build
+node dist/cli.mjs scan          # reads ~/.claude, prints findings; nothing leaves your machine
+```
+
+Then `node dist/cli.mjs show <session-id>` for one session's timeline. Below, `retrohound` means `node dist/cli.mjs`.
+
+## What it catches
+
+46 Sigma rules on an `ai_coding_agent` logsource ([rules/ai_coding_agent](rules/ai_coding_agent)), for example:
+
+| Family | Examples |
+|---|---|
+| Secrets | `.env` and SSH keys read, blocked then retried, then sent out; keys pasted into tool input; credential stores probed |
+| Execution | `curl \| sh`, download then run, decode to shell, LOLBin downloads, dangerous `rm -rf`, `git push --force`, privileged Docker |
+| Control plane | agent settings, hooks, MCP servers and LLM endpoints rewritten; safety modes turned off |
+| Persistence | shell profiles, LaunchAgents, startup folders, git global hooks, npm lifecycle scripts, auto-running VS Code tasks |
+| Instructions | invisible Unicode and concealment phrases in CLAUDE.md, AGENTS.md and skills |
+| Exfiltration | uploads to paste and file-drop sites, tunnels and webhooks |
+
+## How it works
+
+```
+~/.claude, ~/.codex, Antigravity history
+        │  parse (secrets masked)
+        ▼
+normalized events ──► Sigma rules ──► findings ──► table · JSON · SARIF · ECS / OCSF NDJSON
+        │                                 └──────► masked SQLite index (outlives transcript cleanup)
+        └ live, optional: PreToolUse hook ──► enforce-lane rules only ──► log / ask / deny (fails open)
+```
+
+## What it does
+
+Claude Code leaves a transcript of every session in `~/.claude/projects`. RetroHound reads them after the fact, with
+no setup and no hook, and reports:
+
+- **What the agent tried.** Tool calls Claude Code blocked, kept apart from the ones you rejected or interrupted, and
+  blocked-then-retried sequences (for example four attempts on one `.env`).
+- **Who did it.** Each finding carries the sub-agent id, so you can see what happened outside the main conversation.
+- **Evidence that outlives the cleanup.** Claude Code deletes transcripts after `cleanupPeriodDays` (default 30).
+  RetroHound keeps a masked, append-only index; deleted transcripts stay searchable there.
+- **Secrets, as rule #1.** Secret files read, secrets in tool input, with masked values and fingerprints, not raw text.
+
+Detections are Sigma v2.1 YAML with a proposed `ai_coding_agent` logsource. 46 rules ship today, plus 6 silent helper rules that only feed correlations (`rules/ai_coding_agent`).
+
+## What it does not do
+
+- Not a live guard by default. It reads history. The optional `hook` (v0.2, below) can ask or deny a tool call, but only
+  for the few high-precision `enforce` rules, and it fails open.
+- Not a secret scanner that rewrites transcripts. It never modifies or deletes them.
+- No MCP-server scanning, sandboxing, fleet console, cloud, or auto-remediation (spec non-goals).
+- Claude Code, Codex CLI and Antigravity CLI are parsed (`scan --agent claude_code|codex|antigravity`, one per run).
+  Gemini CLI and Cursor are not. Codex and Antigravity do not record the CLI's own approvals in their history, so a
+  denied command leaves no trace there; Codex's auto-review verdicts are kept and a refusal counts as blocked.
+
+## Install
+
+Not yet on npm; see [Quick start](#quick-start). In development, `bun src/cli/bin.ts` runs the same CLI.
+
+```
+retrohound scan                    # index ~/.claude and print findings
+retrohound scan --since 30d --level high
+retrohound scan --agent codex      # ~/.codex (or $CODEX_HOME); also --agent antigravity
+retrohound show 7f3c               # timeline of one session (id prefix works)
+retrohound wrapped --anonymize     # shareable HTML report card
+```
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `scan` | Scan an agent's transcripts (Claude Code by default), index them, report findings. |
+| `rules list` / `rules show <rule>` / `rules test [dir]` | Inspect loaded rules (and rejected ones, with the reason); check every rule has passing tests. |
+| `query <sql>` | Read-only SQL over the index. Tables: `events`, `sessions`, `findings`, `files_indexed`. |
+| `show <session-id>` | Timeline of one session with findings highlighted. |
+| `wrapped` | Write a self-contained HTML report card. |
+| `purge` | Delete the index database. |
+| `preflight [dir]` | Before opening a cloned repo with an agent: check its agent surface (`.claude/`, `.mcp.json`, CLAUDE.md/AGENTS.md, skills, `.vscode/tasks.json`, npm lifecycle scripts) with the same rules. Reads files as text; runs nothing. |
+| `hook install` / `hook uninstall` / `hook status` | Optional live guard (v0.2): a `PreToolUse` hook for Claude Code, Codex CLI or Antigravity CLI (`--agent`) that runs only `enforce`-lane rules. `--mode log` (record what it would do), `confirm` (ask you) or `block` (deny). Backs up the file, touches only its own entry, fails open. |
+| `mcp` | Serve the index to MCP clients over stdio, read-only: `scan_summary`, `list_findings`, `show_session`, `query`, `list_rules`. |
+
+Flags (from `--help`):
+
+- `scan`: `--since <30d|12h|date>`, `--agent <claude_code|codex|antigravity>`, `--project <path-substring>`, `--rules <dir>`,
+  `--level <informational|low|medium|high|critical>` (hide lower), `--format <table|json|sarif|ndjson-ecs|ndjson-ocsf>`, `--no-index` (evaluate in
+  memory, write nothing), `--fail-on <level>` (exit 1 at or above it, for CI), `--db <path>`,
+  `--root <dir>` (Claude config dir or its `projects` dir; default `~/.claude`).
+- `rules list`, `rules show`: `--rules <dir>`. `rules test [dir]`: `--tests <dir>` (default `<dir>/../tests`).
+- `query`: `--format <table|json>`, `--db <path>`.
+- `show`: `--db <path>`, `--rules <dir>`.
+- `wrapped`: `--since <when>` (default `365d`), `--anonymize` (hash project names, user name, project dirs),
+  `--out <file.html|file.svg>` (default `wrapped.html`), `--db <path>`, `--rules <dir>`. `--out card.svg` writes a
+  self-contained 1200x630 share card (system fonts, no scripts or external references, secrets masked) that any
+  browser shows and any tool can convert to PNG.
+- `purge`: `--db <path>`, `--yes`. Without `--yes` it only says what it would delete.
+- `preflight [dir]`: `--rules <dir>`, `--format <table|json>`, `--fail-on <level>`, `--ignore <file>`.
+- `hook install`: `--agent <claude_code|codex|antigravity>`, `--mode <log|confirm|block>`, `--scope <user|project|local>`, `--settings <path>`, `--fail-closed`,
+  `--dry-run`, `--allow-unsafe-path`. Start with `--mode log` and read `~/.retrohound/hook-log.jsonl` before blocking
+  anything.
+- `mcp`: `--db <path>`, `--rules <dir>`. Register it with `claude mcp add retrohound -- retrohound mcp`.
+- `scan`, `preflight`, `hook run` also take `--ignore <file>` (below).
+
+`scan --format json` prints one document, schema `retrohound.scan/0.1`; `sarif` is SARIF 2.1.0 and `ndjson-ecs` /
+`ndjson-ocsf` give one SIEM line per finding: [docs/output-schema.md](docs/output-schema.md).
+
+### Ignoring known-benign findings
+
+Put entries in `~/.retrohound/ignore.yml`, or pass a file with `--ignore <file>`:
+
+```yaml
+- rule: control_plane_hook_repo_script                      # rule id or name
+  match: { command_line: "node ./scripts/my-hook.mjs" }    # exact values, as shown in the JSON report
+  project_path: /home/x/acme                                # optional
+  reason: my own hook                                       # optional
+```
+
+A finding is hidden when its rule matches and every `match` field (and `project_path`) equals the finding's first
+event exactly. Hidden findings are counted ("N findings suppressed" in the table, `scan.suppressed` in JSON) and stay
+in the index. A malformed file stops the run with an error naming the file and entry. A repo's own
+`.retrohound-ignore.yml` is never read implicitly, because a malicious clone could hide its own activity with it: pass
+it with `--ignore` if you trust it.
+
+### Hook on Codex and Antigravity
+
+`hook install --agent codex` edits `~/.codex/hooks.json`; `--agent antigravity` edits `~/.gemini/config/hooks.json`
+(`--scope project` uses `.codex/` or `.agents/` in the repo). Both are set up from the vendors' docs and tested on temp
+files only, not yet in a live session:
+- Codex runs a new or changed hook only after you trust it in `/hooks`, and has no "ask", so `confirm` is refused there.
+- Antigravity's docs call the hook's `decision` required; RetroHound prints nothing when it has nothing to say (it
+  never prints "allow"). Try `--agent antigravity --scope project --mode log` in a throwaway repo first and check that
+  normal tool calls still run before installing it for your user.
+
+### Hook install safety
+
+The hook runs on every tool call, so `hook install` refuses (exit 2, nothing written) if the runtime (`node` or `bun`)
+or the RetroHound entry file could be changed by someone else. On macOS and Linux each of them and every parent
+directory up to the first root-owned system directory must be owned by you or root and not group- or world-writable
+(sticky directories such as `/tmp` are exempt); installing from the temp directory or from a world-writable current
+directory is refused. Windows permissions are ACLs, which RetroHound does not read: it only checks that both files
+exist, are not in the temp directory, and sit under your profile or a Program Files directory, so install from a folder
+only you control. For a safe setup that trips the check (for example Homebrew directories owned by an admin group),
+`--allow-unsafe-path` installs anyway with a warning, and `hook status` reports it. `hook status` re-checks the
+installed paths every time and warns if they no longer pass.
+
+## Privacy
+
+- **Zero network calls.** No telemetry, no uploads, no update checks. A test (`tests/guards.test.ts`) fails the build
+  if any module in `src/` imports a network module or calls `fetch`.
+- **Secrets are masked** in the index, in every output, and in logs. Findings keep pattern names and a short
+  fingerprint, never the value.
+- **Raw text is never stored.** Rules see raw text in memory while parsing; the index holds masked fields and a
+  pointer (`raw_ref`: file and line) back to the transcript.
+- **The index** is `~/.retrohound/index.db` (override with `--db`), directory 0700, file 0600 on macOS and Linux.
+  On Windows those modes protect nothing; rely on your user profile permissions. It is long-lived evidence, so it
+  may be the only copy of sessions Claude Code deleted. `retrohound purge --yes` deletes it.
+
+## Retention warning
+
+Claude Code deletes transcripts older than `cleanupPeriodDays` (default 30). `scan` prints your window and warns when
+it is 30 or less. To keep transcripts longer, set `"cleanupPeriodDays": 3650` in `~/.claude/settings.json`;
+RetroHound never edits that file. Fix secret findings first: longer retention keeps plaintext secrets longer. The
+index keeps the masked record either way, as long as you scan before the deletion.
+
+## What it found on my machine
+
+One developer machine (the author's), mostly sessions working on RetroHound itself, so self-referential. 9 sessions,
+3,272 events, 41 findings from 8 of the 38 rules shipped at that time (46 ship now). Counts only; see [docs/perf.md](docs/perf.md) for the review.
+
+| Rule | Level | Hits | Sessions |
+|---|---|---|---|
+| control_plane_hook_repo_script | medium | 19 | 4 |
+| control_plane_agent_config_write | medium | 7 | 2 |
+| exec_package_install_new | informational | 5 | 1 |
+| files_mcp_server_added | medium | 3 | 2 |
+| secrets_literal_in_tool_input | high | 3 | 1 |
+| control_plane_agent_config_risky_write | high | 2 | 1 |
+| exec_pipe_download_to_shell | high | 1 | 1 |
+| control_plane_llm_endpoint_override | high | 1 | 1 |
+
+Four of these are known false-positive patterns being tuned. One machine says little about yours.
+
+## Performance (measured, honest)
+
+Windows 10 laptop, Bun 1.4.4, idle, synthetic 1,000 sessions / 101,000 events ([docs/perf.md](docs/perf.md)).
+
+- Warm scan: about 310-380 ms (target < 5 s: met).
+- Rule evaluation: about 62k events/s on the synthetic sessions (target 50k: met), but about 19k events/s on real
+  transcripts with long heredoc command lines, where regex rules dominate. The target names an M-series Mac, not tested.
+- Cold scan: about 20 s for 101k events (5k events/s), dominated by SQLite inserts. No target was set.
+
+## Contributing
+
+New rules, false-positive reports and parsers for more agents are welcome: [CONTRIBUTING.md](CONTRIBUTING.md). Please
+read the [code of conduct](CODE_OF_CONDUCT.md), and report vulnerabilities or rule bypasses privately
+([SECURITY.md](SECURITY.md)).
+
+## Rules
+
+- Write your own: [CONTRIBUTING-RULES.md](CONTRIBUTING-RULES.md), copy [docs/rule-template.yml](docs/rule-template.yml).
+- Fields and categories: [docs/logsource.md](docs/logsource.md).
+- Transcript format notes: [docs/formats/claude-code.md](docs/formats/claude-code.md).
+
+## Roadmap
+
+- v0.2: `hook` (log / confirm / block) with a parsed-rule cache and install path checks, SARIF and NDJSON export,
+  `preflight`, `mcp`, ignore file, `wrapped` SVG card, Codex CLI and Antigravity CLI collectors. Next: `scan --agent all`,
+  Codex file-edit and MCP items once real samples exist, Gemini CLI.
+  Dropped: rule #22 (ssh/scp to an unknown host; no threat needs it and it is noisy).
+- Later: SIEM conversion via pySigma, upstream logsource proposal to SigmaHQ.
+
+## Licence
+
+Code: [Apache License 2.0](LICENSE). Detection rules: [Detection Rule License 1.1](rules/LICENSE). Both ask you to
+credit the author when you reuse or share them: Copyright 2026 Raman Kumar ([NOTICE](NOTICE)).

package/dist/THIRD_PARTY_LICENSES

@@ -0,0 +1,62 @@
+commander@15.1.0 (MIT)
+
+(The MIT License)
+
+Copyright (c) 2011 TJ Holowaychuk <tj@vision-media.ca>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+------------------------------------------------------------------------
+
+picocolors@1.1.1 (ISC)
+
+ISC License
+
+Copyright (c) 2021-2024 Oleksii Raspopov, Kostiantyn Denysov, Anton Verinov
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+------------------------------------------------------------------------
+
+yaml@2.9.1 (ISC)
+
+Copyright Eemeli Aro <eemeli@gmail.com>
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.