@gendigital/sage-opencode 0.10.0 → 0.11.0

package/resources/threats/credentials.yaml

@@ -7,7 +7,6 @@
   category: secrets
   severity: critical
   confidence: 0.80
-  action: block
   pattern: "(sk-[a-zA-Z0-9_-]{20,}|sk-proj-[a-zA-Z0-9_-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|ghp_[0-9a-zA-Z]{36}|gho_[0-9a-zA-Z]{36}|glpat-[0-9a-zA-Z_-]{20,}|xox[baprs]-[0-9a-zA-Z-]+)"
   match_on: [command, content]
   title: "Known API key prefix detected"
@@ -17,9 +16,8 @@
 # --- Export of credential env vars ---
 - id: "CLT-CRED-002"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bexport\\s+[A-Z_]*(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH)[A-Z_]*="
   match_on: command
   title: "Export of environment variable with credential keyword"
@@ -29,9 +27,8 @@
 # --- .env file writes ---
 - id: "CLT-CRED-003"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(>>|>)\\s*\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.local|\\.production|\\.prod|\\.staging|\\.stage|\\.development|\\.dev|\\.test)?\\b"
   match_on: command
   title: "Write/append to .env file (potential credential exposure)"
@@ -41,9 +38,8 @@
 # --- Reading credential files ---
 - id: "CLT-CRED-004"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(cat|less|more|head|tail)\\s+.*(\\.(env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?)|credentials|\\.aws/credentials|\\.ssh/id_rsa|\\.ssh/id_ed25519|\\.netrc|\\.pgpass)"
   match_on: command
   title: "Reading credential or secret file"
@@ -53,9 +49,8 @@
 # --- Plaintext credential assignment ---
 - id: "CLT-CRED-005"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(PASSWORD|API_SECRET|SECRET_KEY|PRIVATE_KEY|DB_PASSWORD|MYSQL_PASSWORD|POSTGRES_PASSWORD)=[\"']?[^\\s\"']{8,}"
   match_on: [command, content]
   title: "Plaintext credential assignment detected"
@@ -67,7 +62,6 @@
   category: secrets
   severity: critical
   confidence: 0.92
-  action: block
   pattern: "(github_pat_[0-9a-zA-Z_]{22,}|SG\\.[0-9a-zA-Z_-]{22,}\\.[0-9a-zA-Z_-]{22,}|pk_live_[0-9a-zA-Z]{24,}|sk_live_[0-9a-zA-Z]{24,}|rk_live_[0-9a-zA-Z]{24,})"
   match_on: [command, content]
   title: "Long-form API key pattern detected (GitHub PAT, SendGrid, Stripe)"
@@ -77,9 +71,8 @@
 # --- Copy/move/link secret files ---
 - id: "CLT-CRED-007"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
   # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
   # kubeconfig, .kube/config, master.key, credentials.yml
@@ -92,9 +85,8 @@
 # --- Archive secret files ---
 - id: "CLT-CRED-008"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
   # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
   # kubeconfig, .kube/config, master.key, credentials.yml

package/resources/threats/dummy.yaml

@@ -24,7 +24,6 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "__sage_test_deny_cmd_a75bf229__"
   match_on: command
   title: "[TEST] Canary deny command (alpha)"
@@ -35,7 +34,6 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "__sage_test_deny_run_c3d91e4a__"
   match_on: command
   title: "[TEST] Canary deny command (bravo)"
@@ -44,9 +42,8 @@
 
 - id: "DUMMY-CMD-ASK-001"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "__sage_test_ask_cmd_8f2e6b71__"
   match_on: command
   title: "[TEST] Canary approval command (alpha)"
@@ -55,9 +52,8 @@
 
 - id: "DUMMY-CMD-ASK-002"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "__sage_test_ask_run_d4a09c53__"
   match_on: command
   title: "[TEST] Canary approval command (bravo)"
@@ -66,14 +62,14 @@
 
 - id: "DUMMY-CMD-LOG-001"
   category: testing
-  severity: low
-  confidence: 0.90
-  action: log
+  severity: info
+  confidence: 0.10
   pattern: "__sage_test_log_cmd_1b7e3f82__"
   match_on: command
   title: "[TEST] Canary log-only command"
   expires_at: null
   revoked: false
+  flags: ["report"]
 
 # ─── File-path patterns (Write / Edit / Read / Delete tools) ────────
 
@@ -81,7 +77,6 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "__sage_test_deny_file_e6c4a918__"
   match_on: file_path
   title: "[TEST] Canary deny file path"
@@ -90,9 +85,8 @@
 
 - id: "DUMMY-FILE-ASK-001"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "__sage_test_ask_file_52fd7b36__"
   match_on: file_path
   title: "[TEST] Canary approval file path"
@@ -101,14 +95,14 @@
 
 - id: "DUMMY-FILE-LOG-001"
   category: testing
-  severity: low
-  confidence: 0.90
-  action: log
+  severity: info
+  confidence: 0.10
   pattern: "__sage_test_log_file_9a13de74__"
   match_on: file_path
   title: "[TEST] Canary log-only file path"
   expires_at: null
   revoked: false
+  flags: ["report"]
 
 # ─── Content patterns (Write / Edit tools — file body) ──────────────
 
@@ -116,7 +110,6 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "__SAGE_TEST_DENY_CONTENT_3c8f15b7__"
   match_on: content
   title: "[TEST] Canary deny content"
@@ -125,9 +118,8 @@
 
 - id: "DUMMY-CONTENT-ASK-001"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "__SAGE_TEST_ASK_CONTENT_7d4ea2c9__"
   match_on: content
   title: "[TEST] Canary approval content"
@@ -136,14 +128,14 @@
 
 - id: "DUMMY-CONTENT-LOG-001"
   category: testing
-  severity: low
-  confidence: 0.90
-  action: log
+  severity: info
+  confidence: 0.10
   pattern: "__SAGE_TEST_LOG_CONTENT_f0b683d1__"
   match_on: content
   title: "[TEST] Canary log-only content"
   expires_at: null
   revoked: false
+  flags: ["report"]
 
 # ─── URL patterns (WebFetch / Bash / Write content) ─────────────────
 # Uses .test TLD (RFC 2606 reserved, never resolves) for safety.
@@ -152,7 +144,6 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "sage-canary-deny-4e91ca37\\.test"
   match_on: url
   title: "[TEST] Canary deny URL"
@@ -161,9 +152,8 @@
 
 - id: "DUMMY-URL-ASK-001"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "sage-canary-ask-b26d80f5\\.test"
   match_on: url
   title: "[TEST] Canary approval URL"
@@ -172,14 +162,14 @@
 
 - id: "DUMMY-URL-LOG-001"
   category: testing
-  severity: low
-  confidence: 0.90
-  action: log
+  severity: info
+  confidence: 0.10
   pattern: "sage-canary-log-65f3d7a4\\.test"
   match_on: url
   title: "[TEST] Canary log-only URL"
   expires_at: null
   revoked: false
+  flags: ["report"]
 
 # ─── Domain pattern (verifies domain→url routing in heuristics) ─────
 
@@ -187,7 +177,6 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "sage-canary-domain-0c82eb16\\.test"
   match_on: domain
   title: "[TEST] Canary deny domain"

package/resources/threats/files.yaml

@@ -8,7 +8,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "(/etc/passwd|/etc/shadow|/etc/sudoers)"
   match_on: file_path
   title: "Access system authentication file"
@@ -20,7 +19,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\.ssh/authorized_keys"
   match_on: file_path
   title: "Access SSH authorized_keys (unauthorized access persistence)"
@@ -30,9 +28,8 @@
 # --- SSH private keys and config ---
 - id: "CLT-FILE-003"
   category: secrets
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa|config)$"
   match_on: file_path
   title: "Access SSH key or config file"
@@ -42,9 +39,8 @@
 # --- Shell RC files ---
 - id: "CLT-FILE-004"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.(bashrc|zshrc|profile|bash_profile|zprofile|zshenv)$"
   match_on: file_path
   title: "Access shell RC file (persistence mechanism)"
@@ -54,9 +50,8 @@
 # --- Cron directories ---
 - id: "CLT-FILE-006"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(/etc/cron\\.(d|daily|hourly|weekly|monthly)/|/var/spool/cron/)"
   match_on: file_path
   title: "Access cron directory"
@@ -66,9 +61,8 @@
 # --- systemd unit files ---
 - id: "CLT-FILE-007"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "/etc/systemd/system/"
   match_on: file_path
   title: "Access systemd service unit file"
@@ -82,9 +76,8 @@
 # targeted than command-string matching.
 - id: "CLT-FILE-008"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "((^|[\\/\\\\])\\.env(\\.local|\\.production|\\.prod|\\.staging|\\.stage|\\.development|\\.dev|\\.test)?|\\.aws/credentials|\\.netrc|\\.pgpass)$"
   match_on: file_path
   title: "Access credential or environment file"
@@ -94,9 +87,8 @@
 # --- Git hooks ---
 - id: "CLT-FILE-009"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.git/hooks/"
   match_on: file_path
   title: "Access git hook (potential code execution on git events)"
@@ -106,9 +98,8 @@
 # --- Android signing files ---
 - id: "CLT-FILE-010"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(key\\.properties|release\\.keystore|\\.jks|\\.keystore)$"
   match_on: file_path
   title: "Access Android signing file"
@@ -118,9 +109,8 @@
 # --- Firebase config files ---
 - id: "CLT-FILE-011"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(google-services\\.json|GoogleService-Info\\.plist)$"
   match_on: file_path
   title: "Access Firebase configuration file"
@@ -130,9 +120,8 @@
 # --- Cloud provider credential files ---
 - id: "CLT-FILE-012"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(application_default_credentials\\.json|\\.azure/(accessTokens|msal_token_cache)\\.json|\\.config/doctl/config\\.yaml)$"
   match_on: file_path
   title: "Access cloud provider credential file"
@@ -142,9 +131,8 @@
 # --- Package manager tokens ---
 - id: "CLT-FILE-013"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(\\.npmrc|\\.pypirc|\\.gem/credentials|\\.cargo/credentials\\.toml|\\.docker/config\\.json)$"
   match_on: file_path
   title: "Access package manager credential file"
@@ -154,9 +142,8 @@
 # --- Terraform state files ---
 - id: "CLT-FILE-014"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.(tfstate(\\.backup)?|tfvars(\\.json)?)$"
   match_on: file_path
   title: "Access Terraform state or variables file"
@@ -166,9 +153,8 @@
 # --- Secrets/vault files ---
 - id: "CLT-FILE-015"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(master\\.key|credentials\\.yml\\.enc|secrets\\.yml|vault\\.yml|\\.vault-pass|\\.vault-token)$"
   match_on: file_path
   title: "Access secrets or vault file"
@@ -181,9 +167,8 @@
 # would miss private key exfiltration.
 - id: "CLT-FILE-016"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.(pem|p12|pfx|p8)$"
   match_on: file_path
   title: "Access private key or certificate file"
@@ -193,9 +178,8 @@
 # --- Kubeconfig ---
 - id: "CLT-FILE-017"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(\\.kube/config|kubeconfig(\\.yaml|\\.yml)?)$"
   match_on: file_path
   title: "Access Kubernetes configuration file"
@@ -205,9 +189,8 @@
 # --- Build system credential files ---
 - id: "CLT-FILE-018"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(\\.m2/settings\\.xml|gradle\\.properties)$"
   match_on: file_path
   title: "Access build system credential file"
@@ -217,9 +200,8 @@
 # --- Shell/REPL history files ---
 - id: "CLT-FILE-019"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.(bash_history|zsh_history|mysql_history|python_history|node_repl_history|psql_history|irb_history)$"
   match_on: file_path
   title: "Access shell or REPL history file"
@@ -229,9 +211,8 @@
 # --- JetBrains IDE database credentials ---
 - id: "CLT-FILE-020"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.idea/dataSources(\\.xml|/)"
   match_on: file_path
   title: "Access JetBrains IDE database credential file"