@gendigital/sage-opencode 0.10.0 → 0.11.0

package/dist/startup-scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"startup-scan.d.ts","sourceRoot":"","sources":["../src/startup-scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACN,KAAK,QAAQ,EAGb,KAAK,MAAM,EACX,MAAM,uBAAuB,CAAC;AAmB/B,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,QAAQ,GAAE,QAA0B,GAClC,MAAM,OAAO,CAAC,IAAI,CAAC,CAiBrB"}
+{"version":3,"file":"startup-scan.d.ts","sourceRoot":"","sources":["../src/startup-scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACN,KAAK,QAAQ,EAGb,KAAK,MAAM,EACX,MAAM,uBAAuB,CAAC;AAmB/B,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,QAAQ,GAAE,QAA0B,GAClC,MAAM,OAAO,CAAC,IAAI,CAAC,CAkBrB"}

package/dist/startup-scan.js

@@ -22,7 +22,7 @@ function resolveModelDownloadWorkerPath() {
     }
 }
 export function createSessionScanHandler(logger, projectDir, onResult, branding = defaultBranding) {
-    const { threatsDir, allowlistsDir } = getBundledDataDirs();
+    const { threatsDir, trustedDomainsDir } = getBundledDataDirs();
     const version = getSageVersion();
     return coreScanHandler({
         logger,
@@ -30,9 +30,10 @@ export function createSessionScanHandler(logger, projectDir, onResult, branding
         discoverPlugins: () => discoverOpenCodePlugins(logger, projectDir, branding),
         selfPrefix: "@gendigital/sage-opencode@",
         threatsDir,
-        allowlistsDir,
+        trustedDomainsDir,
         version,
         agentRuntime: "opencode",
+        // No agentRuntimeVersion: the OpenCode plugin SDK exposes no host version synchronously.
         branding,
         onResult,
         modelDownloadWorkerPath: resolveModelDownloadWorkerPath(),

package/dist/startup-scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"startup-scan.js","sourceRoot":"","sources":["../src/startup-scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAEN,iBAAiB,IAAI,eAAe,EACpC,eAAe,GAEf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE;;;;;GAKG;AACH,SAAS,8BAA8B;IACtC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,MAAc,EACd,UAAmB,EACnB,QAAgC,EAChC,WAAqB,eAAe;IAEpC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAC3D,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IAEjC,OAAO,eAAe,CAAC;QACtB,MAAM;QACN,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;QAC5E,UAAU,EAAE,4BAA4B;QACxC,UAAU;QACV,aAAa;QACb,OAAO;QACP,YAAY,EAAE,UAAU;QACxB,QAAQ;QACR,QAAQ;QACR,uBAAuB,EAAE,8BAA8B,EAAE;KACzD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"startup-scan.js","sourceRoot":"","sources":["../src/startup-scan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAEN,iBAAiB,IAAI,eAAe,EACpC,eAAe,GAEf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE;;;;;GAKG;AACH,SAAS,8BAA8B;IACtC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,MAAc,EACd,UAAmB,EACnB,QAAgC,EAChC,WAAqB,eAAe;IAEpC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IAEjC,OAAO,eAAe,CAAC;QACtB,MAAM;QACN,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;QAC5E,UAAU,EAAE,4BAA4B;QACxC,UAAU;QACV,iBAAiB;QACjB,OAAO;QACP,YAAY,EAAE,UAAU;QACxB,yFAAyF;QACzF,QAAQ;QACR,QAAQ;QACR,uBAAuB,EAAE,8BAA8B,EAAE;KACzD,CAAC,CAAC;AACJ,CAAC"}

package/dist/tool-handler.d.ts

@@ -2,7 +2,7 @@ import { type ApprovalStore, type Branding, type Logger } from "@gendigital/sage
 export interface ToolHandlerOptions {
     showToast?: (msg: string, variant: "info" | "success" | "warning" | "error") => void;
 }
-export declare function createToolHandlers(logger: Logger, approvalStore: ApprovalStore, threatsDir: string, allowlistsDir: string, options?: ToolHandlerOptions, branding?: Branding): {
+export declare function createToolHandlers(logger: Logger, approvalStore: ApprovalStore, threatsDir: string, trustedDomainsDir: string, options?: ToolHandlerOptions, branding?: Branding): {
     "tool.execute.before": (input: {
         tool: string;
         sessionID: string;

package/dist/tool-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../src/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,QAAQ,EAMb,KAAK,MAAM,EAEX,MAAM,uBAAuB,CAAC;AA+C/B,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;CACrF;AAED,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,kBAAkB,EAC5B,QAAQ,GAAE,QAA0B;mCAG5B;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,UAClD;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KACvC,OAAO,CAAC,IAAI,CAAC;EAiHhB"}
+{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../src/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,QAAQ,EAMb,KAAK,MAAM,EAEX,MAAM,uBAAuB,CAAC;AA+C/B,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;CACrF;AAED,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,kBAAkB,EAC5B,QAAQ,GAAE,QAA0B;mCAG5B;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,UAClD;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KACvC,OAAO,CAAC,IAAI,CAAC;EAuHhB"}

package/dist/tool-handler.js

@@ -37,7 +37,7 @@ function normalizeToolInput(toolName, args) {
             return args;
     }
 }
-export function createToolHandlers(logger, approvalStore, threatsDir, allowlistsDir, options, branding = defaultBranding) {
+export function createToolHandlers(logger, approvalStore, threatsDir, trustedDomainsDir, options, branding = defaultBranding) {
     const beforeToolUse = async (input, output) => {
         const completeHook = (result, data = {}) => {
             logger.debug("OpenCode tool hook completed", {
@@ -74,7 +74,7 @@ export function createToolHandlers(logger, approvalStore, threatsDir, allowlists
                 artifacts,
             }, {
                 threatsDir,
-                allowlistsDir,
+                trustedDomainsDir,
                 logger,
             }, approvalStore);
             if (verdict.decision === "allow") {
@@ -107,7 +107,13 @@ export function createToolHandlers(logger, approvalStore, threatsDir, allowlists
                 throw new SageVerdictBlockError(formatDenyMessage(verdict, branding));
             }
             // ask — actionId is always set for ask verdicts
-            const reasons = verdict.reasons.length > 0 ? verdict.reasons.slice(0, 3).join("; ") : verdict.category;
+            const maxReasons = 3;
+            const reasons = verdict.reasons.length > 0
+                ? verdict.reasons.slice(0, maxReasons).join("; ") +
+                    (verdict.reasons.length > maxReasons
+                        ? `; ... and ${verdict.reasons.length - maxReasons} more`
+                        : "")
+                : verdict.category;
             completeHook("evaluated", {
                 toolName,
                 decision: verdict.decision,

package/dist/tool-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../src/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,aAAa,EAEb,kBAAkB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,iBAAiB,GAAsC;IAC5D,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,EAAE,EAAE,MAAM;IACV,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,WAAW;CACvB,CAAC;AAEF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAAgB,EAChB,IAA6B;IAE7B,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,OAAO;YACX,OAAO;gBACN,GAAG,IAAI;gBACP,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;gBACpE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;aACrC,CAAC;QACH,KAAK,MAAM;YACV,OAAO;gBACN,GAAG,IAAI;gBACP,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;gBACpE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;aACvE,CAAC;QACH;YACC,OAAO,IAAI,CAAC;IACd,CAAC;AACF,CAAC;AAMD,MAAM,UAAU,kBAAkB,CACjC,MAAc,EACd,aAA4B,EAC5B,UAAkB,EAClB,aAAqB,EACrB,OAA4B,EAC5B,WAAqB,eAAe;IAEpC,MAAM,aAAa,GAAG,KAAK,EAC1B,KAA0D,EAC1D,MAAyC,EACzB,EAAE;QAClB,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,OAAgC,EAAE,EAAQ,EAAE;YACjF,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAC5C,YAAY,EAAE,UAAU;gBACxB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,MAAM;gBACN,GAAG,IAAI;aACP,CAAC,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,UAAU;YACxB,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAE5D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,YAAY,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACrE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAChD;gBACC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,SAAS;gBAC/B,YAAY,EAAE,UAAU;gBACxB,QAAQ;gBACR,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC/C,SAAS;aACT,EACD;gBACC,UAAU;gBACV,aAAa;gBACb,MAAM;aACN,EACD,aAAa,CACb,CAAC;YAEF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,YAAY,CAAC,WAAW,EAAE;oBACzB,QAAQ;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;iBAChC,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,QAAQ,GACb,OAAO,CAAC,QAAQ,KAAK,MAAM;oBAC1B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,iBAAiB,KAAK,OAAO,CAAC,QAAQ,GAAG;oBAC9F,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,gBAAgB,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAChG,OAAO,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvF,CAAC;YAAC,MAAM,CAAC;gBACR,4DAA4D;YAC7D,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,YAAY,CAAC,WAAW,EAAE;oBACzB,QAAQ;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;iBAChC,CAAC,CAAC;gBACH,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvE,CAAC;YAED,gDAAgD;YAChD,MAAM,OAAO,GACZ,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACxF,YAAY,CAAC,WAAW,EAAE;gBACzB,QAAQ;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;gBAChC,QAAQ;aACR,CAAC,CAAC;YACH,MAAM,IAAI,qBAAqB,CAC9B;gBACC,GAAG,QAAQ,CAAC,IAAI,yBAAyB,OAAO,CAAC,QAAQ,MAAM,OAAO,EAAE;gBACxE,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;gBAC7C,kCAAkC,QAAQ,yCAAyC;gBACnF,0EAA0E;aAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,gFAAgF;YAChF,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,4BAA4B,EAAE;gBAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,YAAY,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACF,CAAC,CAAC;IAEF,OAAO;QACN,qBAAqB,EAAE,aAAa;KACpC,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../src/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,aAAa,EAEb,kBAAkB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,iBAAiB,GAAsC;IAC5D,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,EAAE,EAAE,MAAM;IACV,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,WAAW;CACvB,CAAC;AAEF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAAgB,EAChB,IAA6B;IAE7B,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,OAAO;YACX,OAAO;gBACN,GAAG,IAAI;gBACP,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;gBACpE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;aACrC,CAAC;QACH,KAAK,MAAM;YACV,OAAO;gBACN,GAAG,IAAI;gBACP,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;gBACpE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;aACvE,CAAC;QACH;YACC,OAAO,IAAI,CAAC;IACd,CAAC;AACF,CAAC;AAMD,MAAM,UAAU,kBAAkB,CACjC,MAAc,EACd,aAA4B,EAC5B,UAAkB,EAClB,iBAAyB,EACzB,OAA4B,EAC5B,WAAqB,eAAe;IAEpC,MAAM,aAAa,GAAG,KAAK,EAC1B,KAA0D,EAC1D,MAAyC,EACzB,EAAE;QAClB,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,OAAgC,EAAE,EAAQ,EAAE;YACjF,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAC5C,YAAY,EAAE,UAAU;gBACxB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,MAAM;gBACN,GAAG,IAAI;aACP,CAAC,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,UAAU;YACxB,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAE5D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,YAAY,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACrE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAChD;gBACC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,SAAS;gBAC/B,YAAY,EAAE,UAAU;gBACxB,QAAQ;gBACR,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC/C,SAAS;aACT,EACD;gBACC,UAAU;gBACV,iBAAiB;gBACjB,MAAM;aACN,EACD,aAAa,CACb,CAAC;YAEF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,YAAY,CAAC,WAAW,EAAE;oBACzB,QAAQ;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;iBAChC,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,QAAQ,GACb,OAAO,CAAC,QAAQ,KAAK,MAAM;oBAC1B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,iBAAiB,KAAK,OAAO,CAAC,QAAQ,GAAG;oBAC9F,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,gBAAgB,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAChG,OAAO,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvF,CAAC;YAAC,MAAM,CAAC;gBACR,4DAA4D;YAC7D,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,YAAY,CAAC,WAAW,EAAE;oBACzB,QAAQ;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;iBAChC,CAAC,CAAC;gBACH,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvE,CAAC;YAED,gDAAgD;YAChD,MAAM,UAAU,GAAG,CAAC,CAAC;YACrB,MAAM,OAAO,GACZ,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAChD,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU;wBACnC,CAAC,CAAC,aAAa,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,OAAO;wBACzD,CAAC,CAAC,EAAE,CAAC;gBACP,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACrB,YAAY,CAAC,WAAW,EAAE;gBACzB,QAAQ;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;gBAChC,QAAQ;aACR,CAAC,CAAC;YACH,MAAM,IAAI,qBAAqB,CAC9B;gBACC,GAAG,QAAQ,CAAC,IAAI,yBAAyB,OAAO,CAAC,QAAQ,MAAM,OAAO,EAAE;gBACxE,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;gBAC7C,kCAAkC,QAAQ,yCAAyC;gBACnF,0EAA0E;aAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,gFAAgF;YAChF,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,4BAA4B,EAAE;gBAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,YAAY,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACF,CAAC,CAAC;IAEF,OAAO;QACN,qBAAqB,EAAE,aAAa;KACpC,CAAC;AACH,CAAC"}

package/package.json

@@ -4,7 +4,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.10.0",
+  "version": "0.11.0",
   "type": "module",
   "description": "Safety for Agents - ADR layer for OpenCode",
   "homepage": "https://github.com/gendigitalinc/sage",
@@ -32,10 +32,12 @@
   ],
   "dependencies": {
     "@opencode-ai/plugin": "^1.14.48",
-    "@gendigital/sage-core": "0.10.0"
+    "@gendigital/sage-core": "0.11.0",
+    "@gendigital/sage-mcp": "0.11.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
+    "esbuild": "^0.25.0",
     "typescript": "^5.9.0",
     "vitest": "^4.0.0"
   },
@@ -52,7 +54,7 @@
     "malware-detection"
   ],
   "scripts": {
-    "build": "pnpm -C ../core build && pnpm run clean && pnpm run sync:assets && tsc",
+    "build": "pnpm run clean && pnpm run sync:assets && tsc && node esbuild.config.mjs",
     "clean": "node ../../scripts/clean.mjs dist resources tsconfig.tsbuildinfo",
     "sync:assets": "node scripts/sync-assets.mjs",
     "test": "vitest run"

package/resources/threats/agent-layer.yaml

@@ -0,0 +1,186 @@
+# Agent-layer threat patterns for Sage
+#
+# Author: ATR (Agent Threat Rules) community contributors
+# Upstream: https://github.com/Agent-Threat-Rule/agent-threat-rules
+# Contributed per issue #30 + vaclavbelak's comment
+#   (https://github.com/gendigitalinc/sage/issues/30#issuecomment-4266904912)
+#
+# License: MIT
+#   Rules in this file are adapted from the ATR project
+#   (https://github.com/Agent-Threat-Rule/agent-threat-rules),
+#   Copyright (c) 2026 ATR Contributors, and are included in Sage
+#   under the ATR MIT license per explicit agreement in issue #30.
+#   Sage-specific modifications to each rule are noted in its comment block.
+#
+# What this file covers (gaps vs Sage's existing rules):
+#   MCP tool / response attacks CLT-MCP-004      (1 rule -- path traversal)
+#   Skill package compromise    CLT-SKL-001..008  (6 rules -- IDs 001,002,004,005,006,008; 003/007 dropped for FP risk)
+#   Context exfiltration        CLT-CTX-003       (1 rule -- PEM key leak)
+#   Supply chain                CLT-SUPPLY-002    (1 rule)
+#
+#   All prompt_injection rules have been moved to prompt-injection.yaml:
+#     CLT-PI-052 (IMPORTANT-tag shadowing, ex CLT-MCP-002)
+#     CLT-PI-091..093 (HTML-comment delivery, jailbreak persona, CJK pivot)
+#   Dropped: CLT-CTX-002 (instruction tampering) -- covered by CLT-PI-001..005
+#
+# Design notes:
+#   - All rules use `match_on: content` so they fire on Write/Edit content,
+#     plugin/skill file scans, and any agent integration that passes a
+#     `content` artifact. They complement (do not duplicate) Sage's existing
+#     command/URL/credential-file rules.
+#   - Confidence values are calibrated to Sage's policy zones (docs/decision-pipeline.md):
+#     0.95 = attack-only signal, deny under all sensitivities
+#     0.85 = high-precision attack pattern, deny paranoid/balanced, ask relaxed
+#   - `case_insensitive: true` replaces ATR's `(?i)` inline flag.
+
+# ===========================================================================
+# MCP TOOL & RESPONSE POISONING
+# ===========================================================================
+
+- id: "CLT-MCP-004"
+  category: mcp_poisoning
+  severity: warning
+  confidence: 0.85
+  pattern: "\\.\\.[\\/\\\\](?:\\.\\.[\\/\\\\])+(?:etc|proc|root|sys|boot|passwd|shadow|shadow\\.bak|master\\.key)(?:[\\/\\\\]|\\s|$)"
+  match_on: content
+  case_insensitive: false
+  title: "Path traversal targeting system directory (/etc, /proc, /root, /sys, ...)"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00012: narrowed to require 2+ traversal hops terminating
+  # in a sensitive system directory (dropped dev, hosts from ATR's list); reduces
+  # FP on benign code examples that use relative paths like ../../src/.
+  # Fires in pre-hook (Write/Edit content blocking) and session-start plugin scans
+  # only; post-hook scanning is limited to category=prompt_injection rules.
+
+# ===========================================================================
+# SKILL PACKAGE COMPROMISE  --  malicious content inside SKILL.md, plugin
+# manifests, or skill package files.
+# ===========================================================================
+
+- id: "CLT-SKL-001"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.85
+  pattern: "you\\s+(must|should|will|shall)\\s+(ignore|disregard|override|forget|bypass|circumvent|supersede|set\\s+aside|discard|abandon)\\s+(all\\s+)?(previous|prior|system|safety|security)\\s+(instructions?|prompts?|rules?|guidelines?|policies|restrictions?)"
+  match_on: content
+  case_insensitive: true
+  title: "SKILL.md prompt injection via mandatory override"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00120: simplified to single regex targeting the
+  # mandatory-subject ("you must/shall") framing only; omits ATR's broader
+  # context-window injection and multi-condition layers.
+  # Intentional layering with CLT-PI-001..004: those rules catch the bare
+  # imperative verb; this rule adds a distinct signal for the explicit mandatory
+  # subject, increasing confidence when both fire on the same payload.
+
+# CLT-SKL-003 intentionally omitted — dropped for FP risk during ATR curation.
+
+- id: "CLT-SKL-002"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.85
+  pattern: "(eval\\s*\\$\\(\\s*echo\\s+[\"'][A-Za-z0-9+/=]{20,}[\"']\\s*\\|\\s*base64\\s+-d|echo\\s+[\"'][A-Za-z0-9+/=]{20,}[\"']\\s*\\|\\s*base64\\s+(-d|--decode)\\s*\\|\\s*(bash|sh|python|node|ruby|perl))"
+  match_on: content
+  case_insensitive: true
+  title: "Base64-encoded payload piped to interpreter inside skill content"
+  expires_at: null
+  revoked: false
+  # Source: ATR-2026-00121 (pattern unchanged from upstream).
+
+- id: "CLT-SKL-004"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.85
+  pattern: "<!--[\\s\\S]{0,200}?(agent\\s+should|send\\s+all|output\\s+all|exfiltrate|curl\\s|wget\\s|post\\s+.{0,30}(key|credential|token|password|secret)|api[_-]?key.{0,30}https?://)"
+  match_on: content
+  case_insensitive: true
+  title: "Hidden payload in HTML comment within skill content"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00128: changed ATR's [^>] lookahead to [\s\S] to avoid
+  # false negatives when a hyphen precedes an exfil keyword; maintains same
+  # exfil-keyword focus (distinct from CLT-PI-002's instruction-override focus).
+
+- id: "CLT-SKL-005"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.95
+  pattern: "(?:\\uDB40[\\uDC00-\\uDC7F]){3,}"
+  match_on: content
+  case_insensitive: false
+  title: "Unicode Tag character smuggling (U+E0000..U+E007F) in skill content"
+  expires_at: null
+  revoked: false
+  # Source: ATR-2026-00129 (pattern unchanged from upstream). Tag characters
+  # are invisible to humans but visible to LLMs; 3+ in sequence is an
+  # injection signature with no legitimate use.
+
+- id: "CLT-SKL-006"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.85
+  pattern: "(tar|zip|7z)\\s+[^\\n]*~/?\\.ssh|(find|ls|cat|strings)\\s+[^\\n]*(wallet\\.dat|seed\\.txt|mnemonic|keystore)[^\\n]*(\\||>|>>|curl|wget|fetch|POST)|sqlite3\\s+[^\\n]*(Cookies|Login\\s*Data|cookies\\.sqlite|places\\.sqlite)"
+  match_on: content
+  case_insensitive: true
+  title: "Compound skill-content exfiltration (wallet/browser/SSH archival)"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00149: condensed ATR's 13 detection conditions into
+  # one regex covering SSH archival, crypto wallet exfil, and browser DB dump;
+  # omits ATR's DNS-exfil, IMDS metadata, and env-file piping layers.
+  # Intentional layering with CLT-CRED-008 (command artifact): that rule catches
+  # the same SSH archival at shell execution time; this rule catches it in
+  # written skill/plugin content before it executes.
+
+# CLT-SKL-007 intentionally omitted — dropped for FP risk during ATR curation.
+
+- id: "CLT-SKL-008"
+  category: skill_compromise
+  severity: warning
+  confidence: 0.85
+  pattern: "(?:(?:always|must|shall|will|should)\\s+){1,3}(?:approve|accept|allow|grant|permit)\\b[^.\\n]{0,80}(?:without|regardless|even\\s+if|despite)\\s+(?:confirmation|permission|approval|consent|asking|checking|verification|user)"
+  match_on: content
+  case_insensitive: true
+  title: "Hidden override instruction in skill -- auto-approve all"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00163: added "will"/"should" modals and "despite" as
+  # an additional consent-bypass synonym; bounded modal repetition to {1,3}.
+
+# ===========================================================================
+# CONTEXT EXFILTRATION
+# ===========================================================================
+
+- id: "CLT-CTX-003"
+  category: context_exfiltration
+  severity: critical
+  confidence: 0.95
+  pattern: "-----BEGIN\\s+[A-Z ]+PRIVATE\\s+KEY-----[\\s\\S]{40,}-----END\\s+[A-Z ]+PRIVATE\\s+KEY-----"
+  match_on: content
+  title: "PEM private key block appearing in agent content"
+  expires_at: null
+  revoked: false
+  # Source: ATR-2026-00021 (pattern unchanged from upstream). Fires on Write/Edit
+  # content and session-start plugin scans (category context_exfiltration is
+  # pre-hook only; post-hook scanning is limited to prompt_injection rules).
+  # Covers RSA, EC, DSA, OPENSSH, ENCRYPTED variants.
+
+# ===========================================================================
+# SUPPLY CHAIN
+# ===========================================================================
+
+- id: "CLT-SUPPLY-002"
+  category: supply_chain
+  severity: warning
+  confidence: 0.95
+  pattern: "(?:filesytem|filsystem|file_sytem|flie_system|filessystem|filesystm|filsystm|filesysem)[-_](?:read|write|list|delete|search)"
+  match_on: content
+  case_insensitive: true
+  title: "Typosquatted filesystem tool name (targets MCP filesystem server)"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00060: extracted filesystem-server typo variants only;
+  # narrows ATR's broader MCP squatting rule to the
+  # @modelcontextprotocol/server-filesystem impersonation family.

package/resources/threats/commands.yaml

@@ -1,14 +1,13 @@
 # Command threat patterns for Sage
 # Author: Gen Digital Inc.
 # License: DRL-1.1 (see threats/LICENSE)
-# Schema: id, category, severity, confidence, action, pattern, match_on, title, expires_at, revoked
+# Schema: id, category, severity, confidence, pattern, match_on, title, expires_at, revoked, flags
 
 # --- Pipe to shell (Remote Code Execution) ---
 - id: "CLT-CMD-001"
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "curl\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Remote code execution via curl pipe to shell"
@@ -19,7 +18,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "wget\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Remote code execution via wget pipe to shell"
@@ -31,8 +29,7 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
-  pattern: "/dev/tcp/"
+  pattern: "\\b(bash|sh|zsh|ksh|dash)\\s+-i\\b[\\s\\S]{0,160}/dev/tcp/"
   match_on: command
   title: "Reverse shell via /dev/tcp"
   expires_at: null
@@ -42,7 +39,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bnc\\b.*\\s-e\\s"
   match_on: command
   title: "Reverse shell via netcat -e"
@@ -53,7 +49,6 @@
   category: tool
   severity: critical
   confidence: 0.85
-  action: block
   pattern: "bash\\s+-i\\s+>\\s*&\\s*/dev/"
   match_on: command
   title: "Interactive reverse shell via bash"
@@ -65,7 +60,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\brm\\s+(-[a-zA-Z]*f[a-zA-Z]*\\s+)?(-[a-zA-Z]*r[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+(-[a-zA-Z]*r[a-zA-Z]*\\s+)?(-[a-zA-Z]*f[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+-[a-zA-Z]*rf[a-zA-Z]*\\s+/(\\s|$|[;&|*])"
   match_on: command
   title: "Recursive forced deletion from root"
@@ -76,7 +70,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bmkfs\\b"
   match_on: command
   title: "Filesystem format command"
@@ -85,9 +78,8 @@
 
 - id: "CLT-CMD-008"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\bdd\\s+if=.*of=/dev/"
   match_on: command
   title: "Direct disk write via dd"
@@ -98,7 +90,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bshred\\b"
   match_on: command
   title: "Secure file destruction via shred"
@@ -110,7 +101,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(curl|wget)\\s[\\s\\S]*?(&&|;)\\s*chmod\\s+\\+x"
   match_on: command
   title: "Download and execute chain"
@@ -120,9 +110,8 @@
 # --- Privilege escalation ---
 - id: "CLT-CMD-011"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bchmod\\s+777\\b"
   match_on: command
   title: "Overly permissive file permissions"
@@ -131,9 +120,8 @@
 
 - id: "CLT-CMD-012"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "NOPASSWD"
   match_on: command
   title: "Passwordless sudo configuration"
@@ -143,9 +131,8 @@
 # --- Data exfiltration ---
 - id: "CLT-CMD-013"
   category: network_egress
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "curl\\s[^|;]*(-d|--data|--data-binary)\\s\\S*(/etc/passwd|/etc/shadow|\\.ssh/|id_rsa|credentials|secrets)"
   match_on: command
   title: "Possible data exfiltration of sensitive files"
@@ -157,7 +144,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bsudo\\s+(curl|wget)\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Privileged pipe-to-shell (sudo curl/wget piped to shell)"
@@ -171,9 +157,8 @@
 # bounded non-greedy quantifier to avoid catastrophic backtracking.
 - id: "CLT-CMD-015"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "python[3]?\\s+-c\\s+[\"'][\\s\\S]{0,2048}?(?:os\\.(?:system|popen|exec[lv]?[ep]?e?)|subprocess\\.(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|__import__)\\s*\\("
   match_on: command
   title: "Python one-liner invoking shell/exec/subprocess call"
@@ -185,7 +170,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bbash\\s+<\\(\\s*(curl|wget)\\b"
   match_on: command
   title: "Process substitution executing remote content"
@@ -194,9 +178,8 @@
 
 - id: "CLT-CMD-017"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\beval\\b[^;|]*\\b(curl|wget)\\b"
   match_on: command
   title: "Eval executing remote download command"
@@ -205,13 +188,12 @@
 
 - id: "CLT-CMD-018"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   # The lookarounds prevent matching short-option flags like `du -sh` or
   # identifiers like `shell`/`bashrc`; only standalone command invocations
   # (preceded by whitespace, `/`, etc.) are flagged.
-  pattern: "\\bxargs\\b[^|;]*(?<![-\\w])(curl|wget|bash|sh)(?![-\\w])"
+  pattern: "\\bxargs\\b[^|;\\r\\n]{0,400}(?:(?<![-\\w])(bash|sh)(?![-\\w])(?:\\s+-[\\w]*c\\b\\s+(?:\"(?!\\s*(?:head|cat|wc)\\b)[^\"\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^\"\\r\\n]{0,240}\"|'(?!\\s*(?:head|cat|wc)\\b)[^'\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^'\\r\\n]{0,240}')|(?!\\s+-[\\w]*c\\b))|(?<![-\\w])(curl|wget)(?![-\\w])[^|;\\r\\n]{0,400}(?:-d|--data|--data-binary|--upload-file|-T|--post-file|--post-data|--body-file)\\b)"
   match_on: command
   title: "xargs dispatching download or shell execution"
   expires_at: null
@@ -219,9 +201,8 @@
 
 - id: "CLT-CMD-019"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\bfind\\b[^|;]*-exec\\s+(bash|sh|curl|wget)\\b"
   match_on: command
   title: "find -exec executing shell or download commands"
@@ -231,9 +212,8 @@
 # --- DNS exfiltration ---
 - id: "CLT-CMD-020"
   category: network_egress
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   pattern: "\\b(nslookup|dig|host)\\b[^|;]*\\$\\([^)]+\\)\\.[a-zA-Z]"
   match_on: command
   title: "DNS exfiltration via command substitution as subdomain label"
@@ -242,9 +222,8 @@
 
 - id: "CLT-CMD-021"
   category: network_egress
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   pattern: "\\b(nslookup|dig|host)\\b[^|;]*`[^`]+`\\.[a-zA-Z]"
   match_on: command
   title: "DNS exfiltration via backtick substitution as subdomain label"
@@ -254,9 +233,8 @@
 # --- Loop-based indirect execution ---
 - id: "CLT-CMD-022"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   pattern: "\\b(while|for)\\b[^;]*;\\s*do[^;]*(\\b(bash|sh)\\s+-c\\b|\\b(curl|wget)\\b[^;]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:[^\\s\"']*[\\\\/])?(bash|sh|zsh|ksh|dash)\\b|\\b(curl|wget)\\b[^;]*(?:(-d|--data|--data-binary)\\s+['\\\"]?@\\S+|(--upload-file|-T)\\s+['\\\"]?\\S+))"
   match_on: command
   title: "Loop executing shell or download commands"
@@ -270,7 +248,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "python[23]?\\s+-c.*socket.*connect.*(\\/bin\\/zsh|\\/bin\\/sh|\\/bin\\/bash)"
   match_on: command
   title: "Python reverse shell via socket"
@@ -282,7 +259,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "ruby\\s+-e.*TCPSocket.*exec.*(\\/bin\\/zsh|\\/bin\\/sh)"
   match_on: command
   title: "Ruby reverse shell via TCPSocket"
@@ -294,7 +270,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bzsh\\s+-c\\b.*\\b(exec|socket|/dev/tcp)\\b"
   match_on: command
   title: "Zsh reverse shell pattern"
@@ -306,7 +281,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\brm\\s+(-[a-zA-Z]+\\s+)*-[a-zA-Z]*[rR][a-zA-Z]*(\\s+-[a-zA-Z]+)*\\s+/(home|Users|etc|usr|var|boot|bin|sbin|lib|lib64|opt|root|System|Applications|Library|Volumes|private|mnt)\\b/?(\\s|$|[;&|])"
   match_on: command
   title: "Recursive deletion of critical system directory"
@@ -316,9 +290,8 @@
 # --- Deletion of .env files ---
 - id: "CLT-CMD-027"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*(\\S+[\\\\/])?\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?\\b"
   match_on: command
   title: "Deletion of .env file"
@@ -328,9 +301,8 @@
 # --- Deletion of database files ---
 - id: "CLT-CMD-028"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*\\S+\\.(db|sqlite|sqlite3)\\b"
   match_on: command
   title: "Deletion of database file"
@@ -340,9 +312,8 @@
 # --- Deletion of .git directory ---
 - id: "CLT-CMD-029"
   category: tool
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(rm|del|rmdir|rd|Remove-Item|unlink)\\b.*(\\s|[\\\\/])\\.git(\\s|[\\\\/]|$)"
   case_insensitive: true
   match_on: command