@gendigital/sage-opencode 0.10.0 → 0.12.0

package/resources/threats/commands.yaml

@@ -1,14 +1,13 @@
 # Command threat patterns for Sage
 # Author: Gen Digital Inc.
 # License: DRL-1.1 (see threats/LICENSE)
-# Schema: id, category, severity, confidence, action, pattern, match_on, title, expires_at, revoked
+# Schema: id, category, severity, confidence, pattern, match_on, title, expires_at, revoked, flags
 
 # --- Pipe to shell (Remote Code Execution) ---
 - id: "CLT-CMD-001"
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "curl\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Remote code execution via curl pipe to shell"
@@ -19,7 +18,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "wget\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Remote code execution via wget pipe to shell"
@@ -31,8 +29,7 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
-  pattern: "/dev/tcp/"
+  pattern: "\\b(bash|sh|zsh|ksh|dash)\\s+-i\\b[\\s\\S]{0,160}/dev/tcp/"
   match_on: command
   title: "Reverse shell via /dev/tcp"
   expires_at: null
@@ -42,7 +39,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bnc\\b.*\\s-e\\s"
   match_on: command
   title: "Reverse shell via netcat -e"
@@ -53,7 +49,6 @@
   category: tool
   severity: critical
   confidence: 0.85
-  action: block
   pattern: "bash\\s+-i\\s+>\\s*&\\s*/dev/"
   match_on: command
   title: "Interactive reverse shell via bash"
@@ -65,7 +60,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\brm\\s+(-[a-zA-Z]*f[a-zA-Z]*\\s+)?(-[a-zA-Z]*r[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+(-[a-zA-Z]*r[a-zA-Z]*\\s+)?(-[a-zA-Z]*f[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+-[a-zA-Z]*rf[a-zA-Z]*\\s+/(\\s|$|[;&|*])"
   match_on: command
   title: "Recursive forced deletion from root"
@@ -76,7 +70,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bmkfs\\b"
   match_on: command
   title: "Filesystem format command"
@@ -85,9 +78,8 @@
 
 - id: "CLT-CMD-008"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\bdd\\s+if=.*of=/dev/"
   match_on: command
   title: "Direct disk write via dd"
@@ -98,7 +90,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bshred\\b"
   match_on: command
   title: "Secure file destruction via shred"
@@ -110,7 +101,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(curl|wget)\\s[\\s\\S]*?(&&|;)\\s*chmod\\s+\\+x"
   match_on: command
   title: "Download and execute chain"
@@ -120,9 +110,8 @@
 # --- Privilege escalation ---
 - id: "CLT-CMD-011"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bchmod\\s+777\\b"
   match_on: command
   title: "Overly permissive file permissions"
@@ -131,9 +120,8 @@
 
 - id: "CLT-CMD-012"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "NOPASSWD"
   match_on: command
   title: "Passwordless sudo configuration"
@@ -143,9 +131,8 @@
 # --- Data exfiltration ---
 - id: "CLT-CMD-013"
   category: network_egress
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "curl\\s[^|;]*(-d|--data|--data-binary)\\s\\S*(/etc/passwd|/etc/shadow|\\.ssh/|id_rsa|credentials|secrets)"
   match_on: command
   title: "Possible data exfiltration of sensitive files"
@@ -157,7 +144,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bsudo\\s+(curl|wget)\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Privileged pipe-to-shell (sudo curl/wget piped to shell)"
@@ -171,9 +157,8 @@
 # bounded non-greedy quantifier to avoid catastrophic backtracking.
 - id: "CLT-CMD-015"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "python[3]?\\s+-c\\s+[\"'][\\s\\S]{0,2048}?(?:os\\.(?:system|popen|exec[lv]?[ep]?e?)|subprocess\\.(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|__import__)\\s*\\("
   match_on: command
   title: "Python one-liner invoking shell/exec/subprocess call"
@@ -185,7 +170,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bbash\\s+<\\(\\s*(curl|wget)\\b"
   match_on: command
   title: "Process substitution executing remote content"
@@ -194,9 +178,8 @@
 
 - id: "CLT-CMD-017"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\beval\\b[^;|]*\\b(curl|wget)\\b"
   match_on: command
   title: "Eval executing remote download command"
@@ -205,13 +188,12 @@
 
 - id: "CLT-CMD-018"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   # The lookarounds prevent matching short-option flags like `du -sh` or
   # identifiers like `shell`/`bashrc`; only standalone command invocations
   # (preceded by whitespace, `/`, etc.) are flagged.
-  pattern: "\\bxargs\\b[^|;]*(?<![-\\w])(curl|wget|bash|sh)(?![-\\w])"
+  pattern: "\\bxargs\\b[^|;\\r\\n]{0,400}(?:(?<![-\\w])(bash|sh)(?![-\\w])(?:\\s+-[\\w]*c\\b\\s+(?:\"(?!\\s*(?:head|cat|wc)\\b)[^\"\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^\"\\r\\n]{0,240}\"|'(?!\\s*(?:head|cat|wc)\\b)[^'\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^'\\r\\n]{0,240}')|(?!\\s+-[\\w]*c\\b))|(?<![-\\w])(curl|wget)(?![-\\w])[^|;\\r\\n]{0,400}(?:-d|--data|--data-binary|--upload-file|-T|--post-file|--post-data|--body-file)\\b)"
   match_on: command
   title: "xargs dispatching download or shell execution"
   expires_at: null
@@ -219,9 +201,8 @@
 
 - id: "CLT-CMD-019"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\bfind\\b[^|;]*-exec\\s+(bash|sh|curl|wget)\\b"
   match_on: command
   title: "find -exec executing shell or download commands"
@@ -231,9 +212,8 @@
 # --- DNS exfiltration ---
 - id: "CLT-CMD-020"
   category: network_egress
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   pattern: "\\b(nslookup|dig|host)\\b[^|;]*\\$\\([^)]+\\)\\.[a-zA-Z]"
   match_on: command
   title: "DNS exfiltration via command substitution as subdomain label"
@@ -242,9 +222,8 @@
 
 - id: "CLT-CMD-021"
   category: network_egress
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   pattern: "\\b(nslookup|dig|host)\\b[^|;]*`[^`]+`\\.[a-zA-Z]"
   match_on: command
   title: "DNS exfiltration via backtick substitution as subdomain label"
@@ -254,9 +233,8 @@
 # --- Loop-based indirect execution ---
 - id: "CLT-CMD-022"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   pattern: "\\b(while|for)\\b[^;]*;\\s*do[^;]*(\\b(bash|sh)\\s+-c\\b|\\b(curl|wget)\\b[^;]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:[^\\s\"']*[\\\\/])?(bash|sh|zsh|ksh|dash)\\b|\\b(curl|wget)\\b[^;]*(?:(-d|--data|--data-binary)\\s+['\\\"]?@\\S+|(--upload-file|-T)\\s+['\\\"]?\\S+))"
   match_on: command
   title: "Loop executing shell or download commands"
@@ -270,7 +248,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "python[23]?\\s+-c.*socket.*connect.*(\\/bin\\/zsh|\\/bin\\/sh|\\/bin\\/bash)"
   match_on: command
   title: "Python reverse shell via socket"
@@ -282,7 +259,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "ruby\\s+-e.*TCPSocket.*exec.*(\\/bin\\/zsh|\\/bin\\/sh)"
   match_on: command
   title: "Ruby reverse shell via TCPSocket"
@@ -294,7 +270,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bzsh\\s+-c\\b.*\\b(exec|socket|/dev/tcp)\\b"
   match_on: command
   title: "Zsh reverse shell pattern"
@@ -306,7 +281,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\brm\\s+(-[a-zA-Z]+\\s+)*-[a-zA-Z]*[rR][a-zA-Z]*(\\s+-[a-zA-Z]+)*\\s+/(home|Users|etc|usr|var|boot|bin|sbin|lib|lib64|opt|root|System|Applications|Library|Volumes|private|mnt)\\b/?(\\s|$|[;&|])"
   match_on: command
   title: "Recursive deletion of critical system directory"
@@ -316,9 +290,8 @@
 # --- Deletion of .env files ---
 - id: "CLT-CMD-027"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*(\\S+[\\\\/])?\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?\\b"
   match_on: command
   title: "Deletion of .env file"
@@ -328,9 +301,8 @@
 # --- Deletion of database files ---
 - id: "CLT-CMD-028"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*\\S+\\.(db|sqlite|sqlite3)\\b"
   match_on: command
   title: "Deletion of database file"
@@ -340,9 +312,8 @@
 # --- Deletion of .git directory ---
 - id: "CLT-CMD-029"
   category: tool
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(rm|del|rmdir|rd|Remove-Item|unlink)\\b.*(\\s|[\\\\/])\\.git(\\s|[\\\\/]|$)"
   case_insensitive: true
   match_on: command

package/resources/threats/credentials.yaml

@@ -7,7 +7,6 @@
   category: secrets
   severity: critical
   confidence: 0.80
-  action: block
   pattern: "(sk-[a-zA-Z0-9_-]{20,}|sk-proj-[a-zA-Z0-9_-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|ghp_[0-9a-zA-Z]{36}|gho_[0-9a-zA-Z]{36}|glpat-[0-9a-zA-Z_-]{20,}|xox[baprs]-[0-9a-zA-Z-]+)"
   match_on: [command, content]
   title: "Known API key prefix detected"
@@ -17,9 +16,8 @@
 # --- Export of credential env vars ---
 - id: "CLT-CRED-002"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bexport\\s+[A-Z_]*(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH)[A-Z_]*="
   match_on: command
   title: "Export of environment variable with credential keyword"
@@ -29,9 +27,8 @@
 # --- .env file writes ---
 - id: "CLT-CRED-003"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(>>|>)\\s*\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.local|\\.production|\\.prod|\\.staging|\\.stage|\\.development|\\.dev|\\.test)?\\b"
   match_on: command
   title: "Write/append to .env file (potential credential exposure)"
@@ -41,9 +38,8 @@
 # --- Reading credential files ---
 - id: "CLT-CRED-004"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(cat|less|more|head|tail)\\s+.*(\\.(env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?)|credentials|\\.aws/credentials|\\.ssh/id_rsa|\\.ssh/id_ed25519|\\.netrc|\\.pgpass)"
   match_on: command
   title: "Reading credential or secret file"
@@ -53,9 +49,8 @@
 # --- Plaintext credential assignment ---
 - id: "CLT-CRED-005"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(PASSWORD|API_SECRET|SECRET_KEY|PRIVATE_KEY|DB_PASSWORD|MYSQL_PASSWORD|POSTGRES_PASSWORD)=[\"']?[^\\s\"']{8,}"
   match_on: [command, content]
   title: "Plaintext credential assignment detected"
@@ -67,7 +62,6 @@
   category: secrets
   severity: critical
   confidence: 0.92
-  action: block
   pattern: "(github_pat_[0-9a-zA-Z_]{22,}|SG\\.[0-9a-zA-Z_-]{22,}\\.[0-9a-zA-Z_-]{22,}|pk_live_[0-9a-zA-Z]{24,}|sk_live_[0-9a-zA-Z]{24,}|rk_live_[0-9a-zA-Z]{24,})"
   match_on: [command, content]
   title: "Long-form API key pattern detected (GitHub PAT, SendGrid, Stripe)"
@@ -77,9 +71,8 @@
 # --- Copy/move/link secret files ---
 - id: "CLT-CRED-007"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
   # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
   # kubeconfig, .kube/config, master.key, credentials.yml
@@ -92,9 +85,8 @@
 # --- Archive secret files ---
 - id: "CLT-CRED-008"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
   # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
   # kubeconfig, .kube/config, master.key, credentials.yml

package/resources/threats/dummy.yaml

@@ -2,8 +2,13 @@
 # Author: Test — NOT real threats
 #
 # Canary rules that match completely harmless, highly-specific marker strings.
-# The "__sage_test_" prefix would never appear in real-world code,
-# making false positives essentially impossible.
+# The markers are deliberately OPAQUE (e.g. "diagmark_cmd_a75bf229", not
+# "__sage_test_deny_cmd_..."): a self-describing name reads as a security probe, and
+# a safety-trained model given security context (e.g. OpenCode, which injects Sage's
+# scan findings into the prompt) will REFUSE to run it — so the artifact never
+# reaches Sage and the E2E deny/ask test can't fire. Opaque markers run as rote yet
+# stay unique random strings, so false positives are essentially impossible. The
+# rule id/title carry the human-readable meaning; the hex suffix aids traceability.
 #
 # Coverage matrix:
 #   Tool           match_on    block(deny)  require_approval(ask)  log(allow)
@@ -24,8 +29,7 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
-  pattern: "__sage_test_deny_cmd_a75bf229__"
+  pattern: "diagmark_cmd_a75bf229"
   match_on: command
   title: "[TEST] Canary deny command (alpha)"
   expires_at: null
@@ -35,8 +39,7 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
-  pattern: "__sage_test_deny_run_c3d91e4a__"
+  pattern: "diagmark_run_c3d91e4a"
   match_on: command
   title: "[TEST] Canary deny command (bravo)"
   expires_at: null
@@ -44,10 +47,9 @@
 
 - id: "DUMMY-CMD-ASK-001"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
-  pattern: "__sage_test_ask_cmd_8f2e6b71__"
+  severity: warning
+  confidence: 0.60
+  pattern: "diagmark_cmd_8f2e6b71"
   match_on: command
   title: "[TEST] Canary approval command (alpha)"
   expires_at: null
@@ -55,10 +57,9 @@
 
 - id: "DUMMY-CMD-ASK-002"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
-  pattern: "__sage_test_ask_run_d4a09c53__"
+  severity: warning
+  confidence: 0.60
+  pattern: "diagmark_run_d4a09c53"
   match_on: command
   title: "[TEST] Canary approval command (bravo)"
   expires_at: null
@@ -66,14 +67,14 @@
 
 - id: "DUMMY-CMD-LOG-001"
   category: testing
-  severity: low
-  confidence: 0.90
-  action: log
-  pattern: "__sage_test_log_cmd_1b7e3f82__"
+  severity: info
+  confidence: 0.10
+  pattern: "diagmark_cmd_1b7e3f82"
   match_on: command
   title: "[TEST] Canary log-only command"
   expires_at: null
   revoked: false
+  flags: ["report"]
 
 # ─── File-path patterns (Write / Edit / Read / Delete tools) ────────
 
@@ -81,8 +82,7 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
-  pattern: "__sage_test_deny_file_e6c4a918__"
+  pattern: "diagmark_file_e6c4a918"
   match_on: file_path
   title: "[TEST] Canary deny file path"
   expires_at: null
@@ -90,10 +90,9 @@
 
 - id: "DUMMY-FILE-ASK-001"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
-  pattern: "__sage_test_ask_file_52fd7b36__"
+  severity: warning
+  confidence: 0.60
+  pattern: "diagmark_file_52fd7b36"
   match_on: file_path
   title: "[TEST] Canary approval file path"
   expires_at: null
@@ -101,14 +100,14 @@
 
 - id: "DUMMY-FILE-LOG-001"
   category: testing
-  severity: low
-  confidence: 0.90
-  action: log
-  pattern: "__sage_test_log_file_9a13de74__"
+  severity: info
+  confidence: 0.10
+  pattern: "diagmark_file_9a13de74"
   match_on: file_path
   title: "[TEST] Canary log-only file path"
   expires_at: null
   revoked: false
+  flags: ["report"]
 
 # ─── Content patterns (Write / Edit tools — file body) ──────────────
 
@@ -116,8 +115,7 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
-  pattern: "__SAGE_TEST_DENY_CONTENT_3c8f15b7__"
+  pattern: "diagmark_content_3c8f15b7"
   match_on: content
   title: "[TEST] Canary deny content"
   expires_at: null
@@ -125,10 +123,9 @@
 
 - id: "DUMMY-CONTENT-ASK-001"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
-  pattern: "__SAGE_TEST_ASK_CONTENT_7d4ea2c9__"
+  severity: warning
+  confidence: 0.60
+  pattern: "diagmark_content_7d4ea2c9"
   match_on: content
   title: "[TEST] Canary approval content"
   expires_at: null
@@ -136,14 +133,14 @@
 
 - id: "DUMMY-CONTENT-LOG-001"
   category: testing
-  severity: low
-  confidence: 0.90
-  action: log
-  pattern: "__SAGE_TEST_LOG_CONTENT_f0b683d1__"
+  severity: info
+  confidence: 0.10
+  pattern: "diagmark_content_f0b683d1"
   match_on: content
   title: "[TEST] Canary log-only content"
   expires_at: null
   revoked: false
+  flags: ["report"]
 
 # ─── URL patterns (WebFetch / Bash / Write content) ─────────────────
 # Uses .test TLD (RFC 2606 reserved, never resolves) for safety.
@@ -152,8 +149,7 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
-  pattern: "sage-canary-deny-4e91ca37\\.test"
+  pattern: "diaghost-4e91ca37\\.test"
   match_on: url
   title: "[TEST] Canary deny URL"
   expires_at: null
@@ -161,10 +157,9 @@
 
 - id: "DUMMY-URL-ASK-001"
   category: testing
-  severity: high
-  confidence: 0.90
-  action: require_approval
-  pattern: "sage-canary-ask-b26d80f5\\.test"
+  severity: warning
+  confidence: 0.60
+  pattern: "diaghost-b26d80f5\\.test"
   match_on: url
   title: "[TEST] Canary approval URL"
   expires_at: null
@@ -172,14 +167,14 @@
 
 - id: "DUMMY-URL-LOG-001"
   category: testing
-  severity: low
-  confidence: 0.90
-  action: log
-  pattern: "sage-canary-log-65f3d7a4\\.test"
+  severity: info
+  confidence: 0.10
+  pattern: "diaghost-65f3d7a4\\.test"
   match_on: url
   title: "[TEST] Canary log-only URL"
   expires_at: null
   revoked: false
+  flags: ["report"]
 
 # ─── Domain pattern (verifies domain→url routing in heuristics) ─────
 
@@ -187,8 +182,7 @@
   category: testing
   severity: critical
   confidence: 0.95
-  action: block
-  pattern: "sage-canary-domain-0c82eb16\\.test"
+  pattern: "diaghost-0c82eb16\\.test"
   match_on: domain
   title: "[TEST] Canary deny domain"
   expires_at: null