@gendigital/sage-openclaw 0.5.3 → 0.6.0

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "sage-openclaw",
   "name": "Sage",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "description": "Safety for Agents — ADR layer that guards commands, files, and web requests",
   "skills": [
     "resources/skills/security-awareness"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gendigital/sage-openclaw",
   "license": "Apache-2.0",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "type": "module",
   "description": "Safety for Agents — ADR layer for OpenClaw",
   "main": "./dist/index.cjs",
@@ -13,23 +13,15 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "pnpm -C ../core build && pnpm run clean && pnpm run sync:assets && node esbuild.config.js",
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true});require('node:fs').rmSync('resources',{recursive:true,force:true})\"",
-    "sync:assets": "node scripts/sync-assets.mjs",
-    "test": "vitest run"
-  },
   "optionalDependencies": {
     "koffi": "^2.9.0"
   },
-  "dependencies": {
-    "@sage/core": "workspace:*"
-  },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "typescript": "^5.9.0",
-    "vitest": "^4.0.0"
+    "vitest": "^4.0.0",
+    "@gendigital/sage-core": "0.6.0"
   },
   "openclaw": {
     "extensions": [
@@ -52,5 +44,11 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "pnpm -C ../core build && pnpm run clean && pnpm run sync:assets && node esbuild.config.js",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true});require('node:fs').rmSync('resources',{recursive:true,force:true})\"",
+    "sync:assets": "node scripts/sync-assets.mjs",
+    "test": "vitest run"
   }
-}
+}

package/resources/threats/commands.yaml

@@ -250,7 +250,7 @@
   severity: high
   confidence: 0.80
   action: block
-  pattern: "\\b(while|for)\\b[^;]*;\\s*do[^;]*\\b(bash|sh|curl|wget)\\b"
+  pattern: "\\b(while|for)\\b[^;]*;\\s*do[^;]*(\\b(bash|sh)\\s+-c\\b|\\b(curl|wget)\\b[^;]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:[^\\s\"']*[\\\\/])?(bash|sh|zsh|ksh|dash)\\b|\\b(curl|wget)\\b[^;]*(?:(-d|--data|--data-binary)\\s+['\\\"]?@\\S+|(--upload-file|-T)\\s+['\\\"]?\\S+))"
   match_on: command
   title: "Loop executing shell or download commands"
   expires_at: null
@@ -305,3 +305,40 @@
   title: "Recursive deletion of critical system directory"
   expires_at: null
   revoked: false
+
+# --- Deletion of .env files ---
+- id: "CLT-CMD-027"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*(\\S+[\\\\/])?\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?\\b"
+  match_on: command
+  title: "Deletion of .env file"
+  expires_at: null
+  revoked: false
+
+# --- Deletion of database files ---
+- id: "CLT-CMD-028"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*\\S+\\.(db|sqlite|sqlite3)\\b"
+  match_on: command
+  title: "Deletion of database file"
+  expires_at: null
+  revoked: false
+
+# --- Deletion of .git directory ---
+- id: "CLT-CMD-029"
+  category: tool
+  severity: high
+  confidence: 0.90
+  action: require_approval
+  pattern: "\\b(rm|del|rmdir|rd|Remove-Item|unlink)\\b.*(\\s|[\\\\/])\\.git(\\s|[\\\\/]|$)"
+  case_insensitive: true
+  match_on: command
+  title: "Deletion of .git directory"
+  expires_at: null
+  revoked: false

package/resources/threats/credentials.yaml

@@ -73,3 +73,33 @@
   title: "Long-form API key pattern detected (GitHub PAT, SendGrid, Stripe)"
   expires_at: null
   revoked: false
+
+# --- Copy/move/link secret files ---
+- id: "CLT-CRED-007"
+  category: secrets
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
+  # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
+  # kubeconfig, .kube/config, master.key, credentials.yml
+  pattern: "\\b(cp|mv|ln|rsync|install|ditto)\\s+.*(?<=[\\\\/\\s])(\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.\\w+)?(?=[\\s\\\\/]|$)|\\.aws/credentials|\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa)|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|key\\.properties|\\.docker/config\\.json|kubeconfig|\\.kube/config|master\\.key|credentials\\.yml)"
+  match_on: command
+  title: "Copy/move/link of credential or secret file"
+  expires_at: null
+  revoked: false
+
+# --- Archive secret files ---
+- id: "CLT-CRED-008"
+  category: secrets
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
+  # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
+  # kubeconfig, .kube/config, master.key, credentials.yml
+  pattern: "\\b(tar|zip|7z|rar|gzip)\\s+.*(?<=[\\\\/\\s])(\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.\\w+)?(?=[\\s\\\\/]|$)|\\.aws/credentials|\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa)|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|key\\.properties|\\.docker/config\\.json|kubeconfig|\\.kube/config|master\\.key|credentials\\.yml)"
+  match_on: command
+  title: "Archiving credential or secret file"
+  expires_at: null
+  revoked: false

package/resources/threats/files.yaml

@@ -102,3 +102,138 @@
   title: "Access git hook (potential code execution on git events)"
   expires_at: null
   revoked: false
+
+# --- Android signing files ---
+- id: "CLT-FILE-010"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(key\\.properties|release\\.keystore|\\.jks|\\.keystore)$"
+  match_on: file_path
+  title: "Access Android signing file"
+  expires_at: null
+  revoked: false
+
+# --- Firebase config files ---
+- id: "CLT-FILE-011"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(google-services\\.json|GoogleService-Info\\.plist)$"
+  match_on: file_path
+  title: "Access Firebase configuration file"
+  expires_at: null
+  revoked: false
+
+# --- Cloud provider credential files ---
+- id: "CLT-FILE-012"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(application_default_credentials\\.json|\\.azure/(accessTokens|msal_token_cache)\\.json|\\.config/doctl/config\\.yaml)$"
+  match_on: file_path
+  title: "Access cloud provider credential file"
+  expires_at: null
+  revoked: false
+
+# --- Package manager tokens ---
+- id: "CLT-FILE-013"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(\\.npmrc|\\.pypirc|\\.gem/credentials|\\.cargo/credentials\\.toml|\\.docker/config\\.json)$"
+  match_on: file_path
+  title: "Access package manager credential file"
+  expires_at: null
+  revoked: false
+
+# --- Terraform state files ---
+- id: "CLT-FILE-014"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.(tfstate(\\.backup)?|tfvars(\\.json)?)$"
+  match_on: file_path
+  title: "Access Terraform state or variables file"
+  expires_at: null
+  revoked: false
+
+# --- Secrets/vault files ---
+- id: "CLT-FILE-015"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(master\\.key|credentials\\.yml\\.enc|secrets\\.yml|vault\\.yml|\\.vault-pass|\\.vault-token)$"
+  match_on: file_path
+  title: "Access secrets or vault file"
+  expires_at: null
+  revoked: false
+
+# --- Private keys and certificates ---
+# NOTE: .pem also matches public cert chains (fullchain.pem, ca-bundle.pem).
+# Accepted trade-off: require_approval keeps noise bounded, and excluding .pem
+# would miss private key exfiltration.
+- id: "CLT-FILE-016"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.(pem|p12|pfx|p8)$"
+  match_on: file_path
+  title: "Access private key or certificate file"
+  expires_at: null
+  revoked: false
+
+# --- Kubeconfig ---
+- id: "CLT-FILE-017"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(\\.kube/config|kubeconfig(\\.yaml|\\.yml)?)$"
+  match_on: file_path
+  title: "Access Kubernetes configuration file"
+  expires_at: null
+  revoked: false
+
+# --- Build system credential files ---
+- id: "CLT-FILE-018"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(\\.m2/settings\\.xml|gradle\\.properties)$"
+  match_on: file_path
+  title: "Access build system credential file"
+  expires_at: null
+  revoked: false
+
+# --- Shell/REPL history files ---
+- id: "CLT-FILE-019"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.(bash_history|zsh_history|mysql_history|python_history|node_repl_history|psql_history|irb_history)$"
+  match_on: file_path
+  title: "Access shell or REPL history file"
+  expires_at: null
+  revoked: false
+
+# --- JetBrains IDE database credentials ---
+- id: "CLT-FILE-020"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.idea/dataSources(\\.xml|/)"
+  match_on: file_path
+  title: "Access JetBrains IDE database credential file"
+  expires_at: null
+  revoked: false

package/resources/threats/mitre.yaml

@@ -100,7 +100,7 @@
   severity: high
   confidence: 0.80
   action: require_approval
-  pattern: "(rar(\\.exe)?.*[afu].*(-dw|-tb|-ta)|7z(\\.exe)?.*[au].*-sdel|Add-Exfiltration\\.ps1|Do-Exfiltration\\.ps1|Invoke-PostExfil\\.ps1)"
+  pattern: "(rar(\\.exe)?.*[afu].*\\s(-dw|-tb|-ta)|7z(\\.exe)?.*[au].*-sdel|Add-Exfiltration\\.ps1|Do-Exfiltration\\.ps1|Invoke-PostExfil\\.ps1)"
   case_insensitive: true
   match_on: command
   title: "MITRE ATT&CK T1020 - Automated Exfiltration"
@@ -737,7 +737,7 @@
   severity: high
   confidence: 0.80
   action: require_approval
-  pattern: "tscon(\\.exe)?.*$"
+  pattern: "(^|\\s|[;&|])(?:\"[^\"]*\\btscon(?:\\.exe)?\\b\"|'[^']*\\btscon(?:\\.exe)?\\b'|(?:[^\\s\"']*[\\\\/])?\\btscon(?:\\.exe)?\\b)\\s+\\S+(\\s+/dest:[^\\s]+)?"
   case_insensitive: true
   match_on: command
   title: "MITRE ATT&CK T1563.002 - RDP Hijacking"

package/resources/threats/self-defense.yaml

@@ -48,7 +48,7 @@
   severity: high
   confidence: 0.85
   action: require_approval
-  pattern: "heuristics_enabled.*false|url_check.*enabled.*false"
+  pattern: "\"heuristics_enabled\"\\s*:\\s*false|\"url_check\"\\s*:\\s*\\{[^}]*\"enabled\"\\s*:\\s*false"
   match_on: content
   title: "Attempt to disable Sage security features via config"
   expires_at: null

package/resources/threats/win-credentials.yaml

@@ -110,3 +110,19 @@
   title: "WLAN password extraction via netsh"
   expires_at: null
   revoked: false
+
+# --- Windows copy/move/link of secret files ---
+- id: "CLT-WIN-CRED-010"
+  category: secrets
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  # Protected files: .env*, .aws\credentials, .ssh\(id_rsa|id_ed25519|id_ecdsa|id_dsa),
+  # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker\config.json,
+  # kubeconfig, .kube\config, master.key, credentials.yml
+  pattern: "\\b(copy|xcopy|robocopy|Copy-Item|Move-Item|mklink)\\b.*(?<=[\\\\/\\s])(\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.\\w+)?(?=[\\s\\\\/]|$)|\\.aws[\\\\/]credentials|\\.ssh[\\\\/](id_rsa|id_ed25519|id_ecdsa|id_dsa)|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|key\\.properties|\\.docker[\\\\/]config\\.json|kubeconfig|\\.kube[\\\\/]config|master\\.key|credentials\\.yml)"
+  case_insensitive: true
+  match_on: command
+  title: "Windows copy/move of credential or secret file"
+  expires_at: null
+  revoked: false