@gendigital/sage-opencode 0.11.0 → 0.13.0

package/resources/threats/dummy.yaml

@@ -2,8 +2,13 @@
 # Author: Test — NOT real threats
 #
 # Canary rules that match completely harmless, highly-specific marker strings.
-# The "__sage_test_" prefix would never appear in real-world code,
-# making false positives essentially impossible.
+# The markers are deliberately OPAQUE (e.g. "diagmark_cmd_a75bf229", not
+# "__sage_test_deny_cmd_..."): a self-describing name reads as a security probe, and
+# a safety-trained model given security context (e.g. OpenCode, which injects Sage's
+# scan findings into the prompt) will REFUSE to run it — so the artifact never
+# reaches Sage and the E2E deny/ask test can't fire. Opaque markers run as rote yet
+# stay unique random strings, so false positives are essentially impossible. The
+# rule id/title carry the human-readable meaning; the hex suffix aids traceability.
 #
 # Coverage matrix:
 #   Tool           match_on    block(deny)  require_approval(ask)  log(allow)
@@ -21,50 +26,60 @@
 # ─── Command patterns (Bash tool) ───────────────────────────────────
 
 - id: "DUMMY-CMD-DENY-001"
+  version: 1
+  detection_name: "CMD:SageTestCommandDeny-A [Tst]"
   category: testing
   severity: critical
   confidence: 0.95
-  pattern: "__sage_test_deny_cmd_a75bf229__"
+  pattern: "diagmark_cmd_a75bf229"
   match_on: command
   title: "[TEST] Canary deny command (alpha)"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-CMD-DENY-002"
+  version: 1
+  detection_name: "CMD:SageTestCommandDeny-B [Tst]"
   category: testing
   severity: critical
   confidence: 0.95
-  pattern: "__sage_test_deny_run_c3d91e4a__"
+  pattern: "diagmark_run_c3d91e4a"
   match_on: command
   title: "[TEST] Canary deny command (bravo)"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-CMD-ASK-001"
+  version: 1
+  detection_name: "CMD:SageTestCommandAsk-A [Tst]"
   category: testing
   severity: warning
   confidence: 0.60
-  pattern: "__sage_test_ask_cmd_8f2e6b71__"
+  pattern: "diagmark_cmd_8f2e6b71"
   match_on: command
   title: "[TEST] Canary approval command (alpha)"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-CMD-ASK-002"
+  version: 1
+  detection_name: "CMD:SageTestCommandAsk-B [Tst]"
   category: testing
   severity: warning
   confidence: 0.60
-  pattern: "__sage_test_ask_run_d4a09c53__"
+  pattern: "diagmark_run_d4a09c53"
   match_on: command
   title: "[TEST] Canary approval command (bravo)"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-CMD-LOG-001"
+  version: 1
+  detection_name: "CMD:SageTestCommandLog-A [Tst]"
   category: testing
   severity: info
   confidence: 0.10
-  pattern: "__sage_test_log_cmd_1b7e3f82__"
+  pattern: "diagmark_cmd_1b7e3f82"
   match_on: command
   title: "[TEST] Canary log-only command"
   expires_at: null
@@ -74,30 +89,36 @@
 # ─── File-path patterns (Write / Edit / Read / Delete tools) ────────
 
 - id: "DUMMY-FILE-DENY-001"
+  version: 1
+  detection_name: "FN:SageTestFileDeny-A [Tst]"
   category: testing
   severity: critical
   confidence: 0.95
-  pattern: "__sage_test_deny_file_e6c4a918__"
+  pattern: "diagmark_file_e6c4a918"
   match_on: file_path
   title: "[TEST] Canary deny file path"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-FILE-ASK-001"
+  version: 1
+  detection_name: "FN:SageTestFileAsk-A [Tst]"
   category: testing
   severity: warning
   confidence: 0.60
-  pattern: "__sage_test_ask_file_52fd7b36__"
+  pattern: "diagmark_file_52fd7b36"
   match_on: file_path
   title: "[TEST] Canary approval file path"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-FILE-LOG-001"
+  version: 1
+  detection_name: "FN:SageTestFileLog-A [Tst]"
   category: testing
   severity: info
   confidence: 0.10
-  pattern: "__sage_test_log_file_9a13de74__"
+  pattern: "diagmark_file_9a13de74"
   match_on: file_path
   title: "[TEST] Canary log-only file path"
   expires_at: null
@@ -107,30 +128,36 @@
 # ─── Content patterns (Write / Edit tools — file body) ──────────────
 
 - id: "DUMMY-CONTENT-DENY-001"
+  version: 1
+  detection_name: "Other:SageTestContentDeny-A [Tst]"
   category: testing
   severity: critical
   confidence: 0.95
-  pattern: "__SAGE_TEST_DENY_CONTENT_3c8f15b7__"
+  pattern: "diagmark_content_3c8f15b7"
   match_on: content
   title: "[TEST] Canary deny content"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-CONTENT-ASK-001"
+  version: 1
+  detection_name: "Other:SageTestContentAsk-A [Tst]"
   category: testing
   severity: warning
   confidence: 0.60
-  pattern: "__SAGE_TEST_ASK_CONTENT_7d4ea2c9__"
+  pattern: "diagmark_content_7d4ea2c9"
   match_on: content
   title: "[TEST] Canary approval content"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-CONTENT-LOG-001"
+  version: 1
+  detection_name: "Other:SageTestContentLog-A [Tst]"
   category: testing
   severity: info
   confidence: 0.10
-  pattern: "__SAGE_TEST_LOG_CONTENT_f0b683d1__"
+  pattern: "diagmark_content_f0b683d1"
   match_on: content
   title: "[TEST] Canary log-only content"
   expires_at: null
@@ -141,30 +168,36 @@
 # Uses .test TLD (RFC 2606 reserved, never resolves) for safety.
 
 - id: "DUMMY-URL-DENY-001"
+  version: 1
+  detection_name: "FN:SageTestUrlDeny-A [Tst]"
   category: testing
   severity: critical
   confidence: 0.95
-  pattern: "sage-canary-deny-4e91ca37\\.test"
+  pattern: "diaghost-4e91ca37\\.test"
   match_on: url
   title: "[TEST] Canary deny URL"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-URL-ASK-001"
+  version: 1
+  detection_name: "FN:SageTestUrlAsk-A [Tst]"
   category: testing
   severity: warning
   confidence: 0.60
-  pattern: "sage-canary-ask-b26d80f5\\.test"
+  pattern: "diaghost-b26d80f5\\.test"
   match_on: url
   title: "[TEST] Canary approval URL"
   expires_at: null
   revoked: false
 
 - id: "DUMMY-URL-LOG-001"
+  version: 1
+  detection_name: "FN:SageTestUrlLog-A [Tst]"
   category: testing
   severity: info
   confidence: 0.10
-  pattern: "sage-canary-log-65f3d7a4\\.test"
+  pattern: "diaghost-65f3d7a4\\.test"
   match_on: url
   title: "[TEST] Canary log-only URL"
   expires_at: null
@@ -174,10 +207,12 @@
 # ─── Domain pattern (verifies domain→url routing in heuristics) ─────
 
 - id: "DUMMY-DOMAIN-DENY-001"
+  version: 1
+  detection_name: "FN:SageTestDomainDeny-A [Tst]"
   category: testing
   severity: critical
   confidence: 0.95
-  pattern: "sage-canary-domain-0c82eb16\\.test"
+  pattern: "diaghost-0c82eb16\\.test"
   match_on: domain
   title: "[TEST] Canary deny domain"
   expires_at: null

package/resources/threats/files.yaml

@@ -5,6 +5,8 @@
 
 # --- System auth files ---
 - id: "CLT-FILE-001"
+  version: 1
+  detection_name: "FN:SageFile-A [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
@@ -16,6 +18,8 @@
 
 # --- SSH authorized_keys ---
 - id: "CLT-FILE-002"
+  version: 1
+  detection_name: "FN:SageFile-B [Heur]"
   category: secrets
   severity: critical
   confidence: 0.95
@@ -27,6 +31,8 @@
 
 # --- SSH private keys and config ---
 - id: "CLT-FILE-003"
+  version: 1
+  detection_name: "FN:SageFile-C [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -38,6 +44,8 @@
 
 # --- Shell RC files ---
 - id: "CLT-FILE-004"
+  version: 1
+  detection_name: "FN:SageFile-D [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -49,6 +57,8 @@
 
 # --- Cron directories ---
 - id: "CLT-FILE-006"
+  version: 1
+  detection_name: "FN:SageFile-F [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -60,6 +70,8 @@
 
 # --- systemd unit files ---
 - id: "CLT-FILE-007"
+  version: 1
+  detection_name: "FN:SageFile-G [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -75,6 +87,8 @@
 # match CRED-003 but not FILE-008 — intentional, since file_path matching is more
 # targeted than command-string matching.
 - id: "CLT-FILE-008"
+  version: 1
+  detection_name: "FN:SageFile-H [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -86,6 +100,8 @@
 
 # --- Git hooks ---
 - id: "CLT-FILE-009"
+  version: 1
+  detection_name: "FN:SageFile-I [Heur]"
   category: tool
   severity: warning
   confidence: 0.60
@@ -97,6 +113,8 @@
 
 # --- Android signing files ---
 - id: "CLT-FILE-010"
+  version: 1
+  detection_name: "FN:SageFile-J [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -108,6 +126,8 @@
 
 # --- Firebase config files ---
 - id: "CLT-FILE-011"
+  version: 1
+  detection_name: "FN:SageFile-K [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -119,6 +139,8 @@
 
 # --- Cloud provider credential files ---
 - id: "CLT-FILE-012"
+  version: 1
+  detection_name: "FN:SageFile-L [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -130,6 +152,8 @@
 
 # --- Package manager tokens ---
 - id: "CLT-FILE-013"
+  version: 1
+  detection_name: "FN:SageFile-M [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -141,6 +165,8 @@
 
 # --- Terraform state files ---
 - id: "CLT-FILE-014"
+  version: 1
+  detection_name: "FN:SageFile-N [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -152,6 +178,8 @@
 
 # --- Secrets/vault files ---
 - id: "CLT-FILE-015"
+  version: 1
+  detection_name: "FN:SageFile-O [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -166,6 +194,8 @@
 # Accepted trade-off: require_approval keeps noise bounded, and excluding .pem
 # would miss private key exfiltration.
 - id: "CLT-FILE-016"
+  version: 1
+  detection_name: "FN:SageFile-P [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -177,6 +207,8 @@
 
 # --- Kubeconfig ---
 - id: "CLT-FILE-017"
+  version: 1
+  detection_name: "FN:SageFile-Q [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -188,6 +220,8 @@
 
 # --- Build system credential files ---
 - id: "CLT-FILE-018"
+  version: 1
+  detection_name: "FN:SageFile-R [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -199,6 +233,8 @@
 
 # --- Shell/REPL history files ---
 - id: "CLT-FILE-019"
+  version: 1
+  detection_name: "FN:SageFile-S [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60
@@ -210,6 +246,8 @@
 
 # --- JetBrains IDE database credentials ---
 - id: "CLT-FILE-020"
+  version: 1
+  detection_name: "FN:SageFile-T [Heur]"
   category: secrets
   severity: warning
   confidence: 0.60