@gendigital/sage-openclaw 0.14.0 → 0.15.0

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "sage-openclaw",
   "name": "Sage",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Safety for Agents — ADR layer that guards commands, files, and web requests",
   "skills": [
     "resources/skills/security-awareness"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gendigital/sage-openclaw",
   "license": "Apache-2.0",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "type": "module",
   "description": "Safety for Agents — ADR layer for OpenClaw",
   "homepage": "https://github.com/gendigitalinc/sage",
@@ -30,8 +30,8 @@
     "esbuild": "^0.25.0",
     "typescript": "^5.9.0",
     "vitest": "^4.0.0",
-    "@gendigital/sage-core": "0.14.0",
-    "@gendigital/sage-mcp": "0.14.0"
+    "@gendigital/sage-core": "0.15.0",
+    "@gendigital/sage-mcp": "0.15.0"
   },
   "openclaw": {
     "extensions": [

package/resources/threats/credentials.yaml

@@ -9,7 +9,7 @@
   category: secrets
   severity: critical
   confidence: 0.80
-  pattern: "(sk-[a-zA-Z0-9_-]{20,}|sk-proj-[a-zA-Z0-9_-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|ghp_[0-9a-zA-Z]{36}|gho_[0-9a-zA-Z]{36}|glpat-[0-9a-zA-Z_-]{20,}|xox[baprs]-[0-9a-zA-Z-]+)"
+  pattern: "\\b(sk-[a-zA-Z0-9_-]{20,}|sk-proj-[a-zA-Z0-9_-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|ghp_[0-9a-zA-Z]{36}|gho_[0-9a-zA-Z]{36}|glpat-[0-9a-zA-Z_-]{20,}|xox[baprs]-[0-9a-zA-Z-]+)"
   match_on: [command, content]
   title: "Known API key prefix detected"
   expires_at: null

package/resources/threats/dummy.yaml

@@ -19,6 +19,9 @@
 #   WebFetch/Bash  url         ✓            ✓                      ✓
 #   WebFetch/Bash  domain      ✓            —                      —
 #
+# Submit-only (flags: ["submit_only"], allow + capped non-blocking telemetry):
+#   Bash (command), Write/Edit/Read (file_path)
+#
 # The file_path rules also cover Read, Delete, Glob, and LS tools
 # (they produce the same artifact type).
 # The url rules also cover URLs embedded in Bash commands and file content.
@@ -84,7 +87,6 @@
   title: "[TEST] Canary log-only command"
   expires_at: null
   revoked: false
-  flags: ["report"]
 
 # ─── File-path patterns (Write / Edit / Read / Delete tools) ────────
 
@@ -123,7 +125,6 @@
   title: "[TEST] Canary log-only file path"
   expires_at: null
   revoked: false
-  flags: ["report"]
 
 # ─── Content patterns (Write / Edit tools — file body) ──────────────
 
@@ -162,7 +163,6 @@
   title: "[TEST] Canary log-only content"
   expires_at: null
   revoked: false
-  flags: ["report"]
 
 # ─── URL patterns (WebFetch / Bash / Write content) ─────────────────
 # Uses .test TLD (RFC 2606 reserved, never resolves) for safety.
@@ -202,7 +202,6 @@
   title: "[TEST] Canary log-only URL"
   expires_at: null
   revoked: false
-  flags: ["report"]
 
 # ─── Domain pattern (verifies domain→url routing in heuristics) ─────
 
@@ -217,3 +216,37 @@
   title: "[TEST] Canary deny domain"
   expires_at: null
   revoked: false
+
+# ─── Submit-only patterns (telemetry, never block) ──────────────────
+#
+# `flags: ["submit_only"]` removes the rule from the verdict entirely and
+# instead submits a non-blocking event to /v2/heuristic, capped at one submit
+# per rule per client per 24h (packages/core/src/submit-limits.ts). The
+# confidence is deliberately deny-level so a regression that lets the flag
+# leak into the verdict shows up as a deny.
+
+- id: "DUMMY-CMD-SUBMIT-001"
+  version: 1
+  detection_name: "CMD:SageTestCommandSubmit-A [Tst]"
+  category: testing
+  severity: critical
+  confidence: 0.95
+  pattern: "diagmark_cmd_d7e7127e"
+  match_on: command
+  title: "[TEST] Canary submit-only command"
+  expires_at: null
+  revoked: false
+  flags: ["submit_only"]
+
+- id: "DUMMY-FILE-SUBMIT-001"
+  version: 1
+  detection_name: "FN:SageTestFileSubmit-A [Tst]"
+  category: testing
+  severity: critical
+  confidence: 0.95
+  pattern: "diagmark_file_57871281"
+  match_on: file_path
+  title: "[TEST] Canary submit-only file path"
+  expires_at: null
+  revoked: false
+  flags: ["submit_only"]

package/resources/threats/prompt-injection.yaml

@@ -440,3 +440,16 @@
   expires_at: null
   revoked: false
   # Source: ATR-2026-00097 (pattern unchanged from upstream). Covers zh-CN, zh-TW, ja, ko.
+
+- id: "CLT-PI-094"
+  version: 1
+  detection_name: "Other:SagePromptInjection-CP [Heur]"
+  category: prompt_injection
+  severity: warning
+  confidence: 0.70
+  case_insensitive: true
+  pattern: "\\b(?:disregard|ignore|forget|override)\\s+(?:all\\s+|any\\s+)?(?:your|the|my)\\s+system\\s+(?:prompt|message|instructions?)\\b"
+  match_on: content
+  title: "Instruction override: disregard system prompt"
+  expires_at: null
+  revoked: false