@gendigital/sage-opencode 0.12.0 → 0.13.0

package/dist/tool-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../src/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,iBAAiB,EAOtB,KAAK,MAAM,EAEX,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAc/D,CAAC;AA+BF,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;CACrF;AAED,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,kBAAkB,EAC5B,QAAQ,GAAE,QAA0B;mCAG5B;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,UAClD;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KACvC,OAAO,CAAC,IAAI,CAAC;EAyIhB"}
+{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../src/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,iBAAiB,EAOtB,KAAK,MAAM,EAGX,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAc/D,CAAC;AA+BF,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC;CACrF;AAED,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,kBAAkB,EAC5B,QAAQ,GAAE,QAA0B;mCAG5B;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,UAClD;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KACvC,OAAO,CAAC,IAAI,CAAC;EA2IhB"}

package/dist/tool-handler.js

@@ -1,4 +1,4 @@
-import { canonicalizeToolName, captureEnabled, captureHookInput, defaultBranding, formatDenyMessage, guardToolCall, summarizeArtifacts, } from "@gendigital/sage-core";
+import { canonicalizeToolName, captureEnabled, captureHookInput, defaultBranding, formatDenyMessage, guardToolCall, ruleLabel, summarizeArtifacts, } from "@gendigital/sage-core";
 export const OPENCODE_TOOL_MAP = {
     bash: "Bash",
     webfetch: "WebFetch",
@@ -99,9 +99,11 @@ export function createToolHandlers(logger, approvalStore, threatsDir, trustedDom
                 return;
             }
             try {
+                const rule = ruleLabel(verdict);
+                const ruleSuffix = rule ? ` [rule ${rule}]` : "";
                 const toastMsg = verdict.decision === "deny"
-                    ? `${branding.name} blocked: ${verdict.reasons[0] ?? "Threat detected"} (${verdict.category})`
-                    : `${branding.name} flagged: ${verdict.reasons[0] ?? "Action flagged"} (${verdict.category})`;
+                    ? `${branding.name} blocked: ${verdict.reasons[0] ?? "Threat detected"} (${verdict.category})${ruleSuffix}`
+                    : `${branding.name} flagged: ${verdict.reasons[0] ?? "Action flagged"} (${verdict.category})${ruleSuffix}`;
                 options?.showToast?.(toastMsg, verdict.severity === "critical" ? "error" : "warning");
             }
             catch {

package/dist/tool-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../src/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,aAAa,EAEb,kBAAkB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,CAAC,MAAM,iBAAiB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,EAAE,EAAE,MAAM;IACV,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,WAAW;CACvB,CAAC;AAEF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAAgB,EAChB,IAA6B;IAE7B,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,OAAO;YACX,OAAO;gBACN,GAAG,IAAI;gBACP,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;gBACpE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;aACrC,CAAC;QACH,KAAK,MAAM;YACV,OAAO;gBACN,GAAG,IAAI;gBACP,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;gBACpE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;aACvE,CAAC;QACH;YACC,OAAO,IAAI,CAAC;IACd,CAAC;AACF,CAAC;AAMD,MAAM,UAAU,kBAAkB,CACjC,MAAc,EACd,aAA4B,EAC5B,UAAkB,EAClB,iBAAyB,EACzB,OAA4B,EAC5B,WAAqB,eAAe;IAEpC,MAAM,aAAa,GAAG,KAAK,EAC1B,KAA0D,EAC1D,MAAyC,EACzB,EAAE;QAClB,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,OAAgC,EAAE,EAAQ,EAAE;YACjF,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAC5C,YAAY,EAAE,UAAU;gBACxB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,MAAM;gBACN,GAAG,IAAI;aACP,CAAC,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,UAAU;YACxB,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAE/B,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,6DAA6D;YAC7D,IAAI,cAAc,EAAE,EAAE,CAAC;gBACtB,MAAM,gBAAgB,CACrB,YAAY,EACZ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAC5E;oBACC,QAAQ,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC;oBAC7D,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;iBAC/C,EACD,EAAE,UAAU,EAAE,WAAW,EAAE,CAC3B,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAE5D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,YAAY,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACrE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAChD;gBACC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,SAAS;gBAC/B,YAAY,EAAE,UAAU;gBACxB,QAAQ;gBACR,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC/C,SAAS;aACT,EACD;gBACC,UAAU;gBACV,iBAAiB;gBACjB,MAAM;aACN,EACD,aAAa,CACb,CAAC;YAEF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,YAAY,CAAC,WAAW,EAAE;oBACzB,QAAQ;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;iBAChC,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,QAAQ,GACb,OAAO,CAAC,QAAQ,KAAK,MAAM;oBAC1B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,iBAAiB,KAAK,OAAO,CAAC,QAAQ,GAAG;oBAC9F,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,gBAAgB,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAChG,OAAO,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvF,CAAC;YAAC,MAAM,CAAC;gBACR,4DAA4D;YAC7D,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,YAAY,CAAC,WAAW,EAAE;oBACzB,QAAQ;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;iBAChC,CAAC,CAAC;gBACH,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvE,CAAC;YAED,gDAAgD;YAChD,MAAM,UAAU,GAAG,CAAC,CAAC;YACrB,MAAM,OAAO,GACZ,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAChD,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU;wBACnC,CAAC,CAAC,aAAa,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,OAAO;wBACzD,CAAC,CAAC,EAAE,CAAC;gBACP,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACrB,YAAY,CAAC,WAAW,EAAE;gBACzB,QAAQ;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;gBAChC,QAAQ;aACR,CAAC,CAAC;YACH,MAAM,IAAI,qBAAqB,CAC9B;gBACC,GAAG,QAAQ,CAAC,IAAI,yBAAyB,OAAO,CAAC,QAAQ,MAAM,OAAO,EAAE;gBACxE,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;gBAC7C,kCAAkC,QAAQ,yCAAyC;gBACnF,0EAA0E;aAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,gFAAgF;YAChF,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,4BAA4B,EAAE;gBAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,YAAY,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACF,CAAC,CAAC;IAEF,OAAO;QACN,qBAAqB,EAAE,aAAa;KACpC,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../src/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,aAAa,EAEb,SAAS,EACT,kBAAkB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,CAAC,MAAM,iBAAiB,GAAsC;IACnE,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,EAAE,EAAE,MAAM;IACV,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,WAAW;CACvB,CAAC;AAEF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAAgB,EAChB,IAA6B;IAE7B,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,OAAO;YACX,OAAO;gBACN,GAAG,IAAI;gBACP,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;gBACpE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;aACrC,CAAC;QACH,KAAK,MAAM;YACV,OAAO;gBACN,GAAG,IAAI;gBACP,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;gBACpE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;aACvE,CAAC;QACH;YACC,OAAO,IAAI,CAAC;IACd,CAAC;AACF,CAAC;AAMD,MAAM,UAAU,kBAAkB,CACjC,MAAc,EACd,aAA4B,EAC5B,UAAkB,EAClB,iBAAyB,EACzB,OAA4B,EAC5B,WAAqB,eAAe;IAEpC,MAAM,aAAa,GAAG,KAAK,EAC1B,KAA0D,EAC1D,MAAyC,EACzB,EAAE;QAClB,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,OAAgC,EAAE,EAAQ,EAAE;YACjF,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAC5C,YAAY,EAAE,UAAU;gBACxB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,MAAM;gBACN,GAAG,IAAI;aACP,CAAC,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;YAC1C,YAAY,EAAE,UAAU;YACxB,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAE/B,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,6DAA6D;YAC7D,IAAI,cAAc,EAAE,EAAE,CAAC;gBACtB,MAAM,gBAAgB,CACrB,YAAY,EACZ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAC5E;oBACC,QAAQ,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC;oBAC7D,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;iBAC/C,EACD,EAAE,UAAU,EAAE,WAAW,EAAE,CAC3B,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAE5D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,YAAY,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACR,CAAC;YAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACrE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAChD;gBACC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,SAAS;gBAC/B,YAAY,EAAE,UAAU;gBACxB,QAAQ;gBACR,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC/C,SAAS;aACT,EACD;gBACC,UAAU;gBACV,iBAAiB;gBACjB,MAAM;aACN,EACD,aAAa,CACb,CAAC;YAEF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClC,YAAY,CAAC,WAAW,EAAE;oBACzB,QAAQ;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;iBAChC,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,QAAQ,GACb,OAAO,CAAC,QAAQ,KAAK,MAAM;oBAC1B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,iBAAiB,KAAK,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE;oBAC3G,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,gBAAgB,KAAK,OAAO,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAC7G,OAAO,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvF,CAAC;YAAC,MAAM,CAAC;gBACR,4DAA4D;YAC7D,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACjC,YAAY,CAAC,WAAW,EAAE;oBACzB,QAAQ;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;iBAChC,CAAC,CAAC;gBACH,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvE,CAAC;YAED,gDAAgD;YAChD,MAAM,UAAU,GAAG,CAAC,CAAC;YACrB,MAAM,OAAO,GACZ,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAChD,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU;wBACnC,CAAC,CAAC,aAAa,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,OAAO;wBACzD,CAAC,CAAC,EAAE,CAAC;gBACP,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACrB,YAAY,CAAC,WAAW,EAAE;gBACzB,QAAQ;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,SAAS,CAAC,MAAM;gBAChC,QAAQ;aACR,CAAC,CAAC;YACH,MAAM,IAAI,qBAAqB,CAC9B;gBACC,GAAG,QAAQ,CAAC,IAAI,yBAAyB,OAAO,CAAC,QAAQ,MAAM,OAAO,EAAE;gBACxE,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;gBAC7C,kCAAkC,QAAQ,yCAAyC;gBACnF,0EAA0E;aAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,gFAAgF;YAChF,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,4BAA4B,EAAE;gBAC1D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,YAAY,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACF,CAAC,CAAC;IAEF,OAAO;QACN,qBAAqB,EAAE,aAAa;KACpC,CAAC;AACH,CAAC"}

package/package.json

@@ -4,7 +4,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.12.0",
+  "version": "0.13.0",
   "type": "module",
   "description": "Safety for Agents - ADR layer for OpenCode",
   "homepage": "https://github.com/gendigitalinc/sage",
@@ -32,8 +32,8 @@
   ],
   "dependencies": {
     "@opencode-ai/plugin": "^1.14.48",
-    "@gendigital/sage-mcp": "0.12.0",
-    "@gendigital/sage-core": "0.12.0"
+    "@gendigital/sage-core": "0.13.0",
+    "@gendigital/sage-mcp": "0.13.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/resources/threats/_macros.yaml

@@ -0,0 +1,193 @@
+# Shared pattern vocabulary for Sage threat rules
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+#
+# These macros all serve one purpose: identifying which word in a command string
+# is the program being run. A rule with `match_on: command` receives the whole
+# command line, with no shell parsing and no notion of argv[0], so a rule meaning
+# "this program is being executed" has to express that itself.
+#
+#   ls;  sudo -u root  bash -c "  env FOO=1  /usr/bin/  shred  -u f"
+#   (1)  (2)           (3)        (4)        (5)        (6)    (7)
+#
+#   (1) command boundary          (5) optional path prefix
+#   (2) {{CMD_PREFIX}}            (6) the program + {{NOT_FILENAME}}
+#   (3) {{DISPATCH_CTX}}          (7) {{HAS_ARG}}
+#   (4) {{CMD_PREFIX}} again, now inside the dispatched payload
+#
+# {{CMD_POS}} is 1 through 5 — everything to the left of the program name. A rule
+# adds the name, {{NOT_FILENAME}}, and {{HAS_ARG}} when a bare mention of the
+# program must not fire:
+#
+#   pattern: "{{CMD_POS}}shred{{NOT_FILENAME}}{{HAS_ARG}}"
+#
+# Mechanics: this is the one file in threats/ the loader reads as a mapping, and
+# every other file must be a rule list. Macros may reference macros; a rule
+# naming an undefined one is skipped with a warning. For the reasoning behind
+# these patterns and the constraints on changing them, see "Writing
+# command-position patterns" in docs/developer-guide.md.
+
+# Interpreters that take a command payload as an argument (`bash -c "..."`).
+# Split from {{SHELLS}} below because the two families disagree on what an
+# *unquoted* payload means: POSIX `-c` takes exactly one argument as the
+# command string — anything after it becomes `$0`, `$1`, ... positional
+# parameters, not executed text (`bash -c sudo mkfs -t ext4 /dev/sdb1` only
+# ever runs `sudo`; `mkfs -t ext4 /dev/sdb1` is inert positional params).
+# PowerShell's `-Command` has no such rule — unquoted trailing words are
+# rejoined into one command line. DISPATCH_CTX below relies on this split to
+# require a quote only for the POSIX family.
+POSIX_SHELLS: "bash|sh|zsh|dash|ksh|ash|busybox"
+# powershell/pwsh admit an optional .exe suffix here, same as {{DISPATCH_CTX}}
+# already does for its own inline powershell/pwsh mention below -- real,
+# common Windows invocations. Left off {{POSIX_SHELLS}}'s own members for now:
+# their Windows ports (WSL/git-bash/busybox-w32) exist but are less certain
+# to appear with an explicit .exe suffix in practice; add if evidenced.
+SHELLS: "{{POSIX_SHELLS}}|powershell(?:\\.exe)?|pwsh(?:\\.exe)?"
+
+# Tokens that may sit between a boundary and the program name without changing
+# which word is the program: wrapper commands, their flags, `--`, `VAR=value`.
+#
+# Keep it an allowlist. Admitting arbitrary words makes prose that merely
+# mentions a command read as an invocation: `echo use bash -c "..."`.
+#
+# Never bound the loop. No token can match two of its branches, so the loop is
+# already linear — 0.9 ms against a 24 KB run that never reaches a program. A cap
+# would instead hand over an evasion, since inert padding is free: nine
+# assignments in `A0=1 ... A8=1 shred -u f` push the program past a cap of eight
+# and the rule goes quiet.
+CMD_PREFIX: "(?:(?:sudo|doas|env|nohup|time|xargs|wsl(?:\\.exe)?)\\s+|--\\s+|--?[\\w][\\w{}.,:-]*(?:=\\S+|\\s[^\\s\\-=][^\\s=]*)?\\s+|[A-Za-z_]\\w*=\\S*\\s+)*"
+
+# Points where a command line starts a *second* command, after which the next
+# word is a program name again: `find ... -exec`, a shell `-c` payload, a
+# `cmd /c` payload, or an `ssh host "..."` payload.
+#
+# Each dispatcher must itself be at program position, which is why every branch
+# sits behind {{CMD_PREFIX}}. A branch that can match anywhere matches inside
+# somebody else's argument, and the rule fires on text about the command rather
+# than the command. Two consequences of the same requirement: `-exec` demands a
+# `find`, and a shell name takes at most a `.exe` suffix — with a looser suffix,
+# `bashful -c "..."` and `shellcheck -c "..."` count as shells.
+#
+# The cmd and PowerShell branches don't require the dispatched payload to be
+# quoted: `cmd /c diskpart` and `powershell -Command shred -u f` are as real
+# an invocation as the quoted forms, since both join unquoted trailing words
+# back into one command line. The POSIX branch mostly keeps the quote
+# mandatory — see {{POSIX_SHELLS}} above for why an unquoted multi-token
+# payload there isn't the same thing — with one exception: a single trailing
+# token with nothing after it (`bash -c diskpart`) has no positional
+# parameters to misattribute, since there is nothing left over for them to
+# be. That token is the entire command string either way, quoted or not.
+#
+# Known misses: a dispatcher named by absolute path (`/bin/bash -c "..."`,
+# `C:\Windows\System32\cmd.exe /c ...`), command-runners that are not shells
+# (`su -c "..."`), and a dispatched payload that is itself another dispatch
+# (`cmd /c powershell -Command shred -u f`) — {{CMD_POS}} models one hop.
+DISPATCH_CTX: "(?:{{CMD_PREFIX}}(?:\\bfind\\s[^;&|(\\n\"']{0,200}?-exec(?:dir)?\\s|\\bcmd(?:\\.exe)?\\s+(?:/[A-Za-z]+(?::\\S+)?\\s+)*/[ckCK]\\s*[\"']?|\\b(?:{{POSIX_SHELLS}})(?:\\.exe)?\\s+(?:-{1,2}[\\w-]+\\s+)*-{1,2}[A-Za-z]*[cC](?:ommand)?\\s*(?:[\"']|(?=[^\\s\"']+(?:$|[;&|(\\n`])))|\\b(?:powershell|pwsh)(?:\\.exe)?\\s+(?:-{1,2}[\\w-]+\\s+)*-{1,2}[A-Za-z]*[cC](?:ommand)?\\s*[\"']?|\\bssh\\s+(?:[^\\s\"']+\\s+){1,6}[\"']))?"
+
+# Everything to the left of the program name — items 1 through 5 above.
+#
+# Known gap: `(` and a backtick are boundaries unconditionally, so a quoted
+# mention containing either still matches: `echo "(shred -u f)"`, or a commit
+# message quoting a command in backticks. Closing it means gating them the way
+# quotes are gated, which costs `$(...)` and backtick substitution. Left open
+# deliberately — one decision for every rule that adopts this macro, not one per
+# rule.
+#
+# Used inside a variable-length lookbehind by {{NOT_AFTER_TEXT_CMD}} below --
+# some regex constructs valid outside a lookbehind are invalid inside one, so
+# check that macro's own comment before changing this pattern's shape.
+CMD_POS: "(?:^|[;&|(\\n`])\\s*{{DISPATCH_CTX}}\\s*{{CMD_PREFIX}}(?:[^\\s\"';|&]{0,200}[\\\\/])?"
+
+# Right-hand guard: reject longer names, so `shred` does not match `shred.py`
+# or `shred-latency-probe`.
+NOT_FILENAME: "(?![-\\w.])"
+
+# Require at least one argument, so a bare mention of the program does not fire.
+HAS_ARG: "(?=\\s+\\S)"
+
+# Symmetric guard for identifiers that are legitimately not in command position
+# — cmdlets, WMI class names — but must still not match as a fragment of a
+# longer identifier or hyphenated compound: `Clear-EventLog` must not match
+# `Clear-EventLogViewer` or `Old-Clear-EventLog`. Unlike {{NOT_FILENAME}}, the
+# right-hand side does not also reject a trailing dot.
+NOT_COMPOUND_LEFT: "(?<![-\\w])"
+NOT_COMPOUND_RIGHT: "(?![-\\w])"
+
+# Backward-looking guard for argument-position identifiers (used alongside
+# {{NOT_COMPOUND_LEFT}}/{{NOT_COMPOUND_RIGHT}} above, on the left side): an
+# argument value can appear in benign prose or a search command instead of a
+# real invocation — `grep "CommandLineEventConsumer"`, `Select-String -Pattern
+# "CommandLineEventConsumer"`. Neither {{NOT_COMPOUND_LEFT}} nor a filename
+# guard catches this, since the identifier isn't a compound fragment or a
+# filename there — it's a plain, correctly-bounded word, just not one being
+# passed to something that acts on it.
+#
+# This suppresses a match only when the nearest preceding command-position
+# token — found by reusing {{CMD_POS}} itself as the lookbehind's prefix, so
+# any boundary, dispatch context, or wrapper prefix it already recognizes
+# (`cmd /c findstr X`, `powershell -Command "Select-String X"`, `sudo grep
+# X`) also counts here — is a command that only ever consumes its argument as
+# inert text: a search, print, or read command. It is a denylist, and
+# deliberately so: it can only ever remove false positives, never true
+# positives, because nothing on the list executes or creates the thing the
+# identifier names, so "not immediately after one of these" never hides a
+# real invocation.
+#
+# Applies per occurrence, not per line: `Write-Host "mentions X"; New-CimInstance
+# -ClassName X` suppresses the first X (immediately after Write-Host) but not
+# the second (immediately after New-CimInstance), because the bounded span
+# below cannot cross the `;` to misattribute the second occurrence to
+# Write-Host. `(` is excluded from that span for the same reason: {{CMD_POS}}
+# treats it as a command boundary (subshell/group open), so without the
+# exclusion `Write-Host $(New-CimInstance -ClassName X)` would misattribute
+# the real invocation inside the subshell to the outer Write-Host and
+# suppress it.
+#
+# That `(` exclusion is narrowed to exempt one when it's glued directly to a
+# preceding quote character (`(?<=["'])\(`): a real subshell/group open is
+# always `$(` or a bare `(` after whitespace/a boundary, never immediately
+# after `"` or `'`, so a `(` there can only be prose/data inside a quoted
+# argument -- `grep "(CommandLineEventConsumer)"` -- not a nested command.
+# Without the exemption this reintroduces the exact false positive the
+# guard exists to remove.
+#
+# Deliberately does not gate on quotes. Real invocations routinely quote
+# string parameters (`-ClassName "CommandLineEventConsumer"`), so treating
+# "inside quotes" as the signal would hand an attacker a trivial evasion —
+# just quote the real value. This guard keys on what precedes the identifier
+# instead, which indirection through a listed command can still dodge
+# (`$c = echo X; New-CimInstance -ClassName $c`) but quoting cannot.
+#
+# Known gaps, accepted:
+# - The denylist is inherently incomplete — an unlisted benign command
+#   (`title X` on Windows) still false-positives. Expand as found, same
+#   posture as {{CMD_PREFIX}}'s wrapper list.
+# - The quote-glued exemption above only catches `(` immediately after the
+#   opening quote. A `(` deeper inside the same quoted string --
+#   `grep "the (CommandLineEventConsumer) tool"` -- still breaks the span
+#   and false-positives, since telling that apart from a real subshell open
+#   would need actual quote-state tracking, which this no-shell-parsing
+#   engine doesn't have (same reason quoting isn't gated on generally,
+#   above). Narrower than before the fix, not eliminated.
+#
+# The {0,500} cap on the gap between the denylisted command and the
+# identifier is a lookbehind-width bound, not a semantic limit -- it only
+# needs to comfortably cover realistic flag/argument text before the
+# identifier (e.g. `grep -rn --include=*.ps1 CommandLineEventConsumer`);
+# widen it if a real invocation needs more room. Raised from 200 -> 500
+# after a longer-than-200-char real grep/Select-String invocation was shown
+# to fall outside it and false-positive; 500 is still a small bounded
+# constant, so it doesn't change the linear-time argument below.
+#
+# Embedding {{CMD_POS}} (rather than a bare boundary-char class) costs
+# nothing extra: {{CMD_POS}}'s own quantifiers are already bounded, so
+# nesting it inside a variable-length lookbehind stays linear -- verified
+# against 10-50K character adversarial inputs (repeated near-miss dispatch
+# fragments, VAR=value chains, boundary characters), all well under 2ms.
+#
+# Depth budget: this macro's chain (NOT_AFTER_TEXT_CMD -> CMD_POS ->
+# {DISPATCH_CTX, CMD_PREFIX} -> {CMD_PREFIX, POSIX_SHELLS}) fully resolves in
+# 4 of MAX_MACRO_PASSES's 5 passes -- one pass of headroom. That limit exists
+# to catch a self-referencing cycle, not to cap legitimate depth, so raise it
+# if a real change needs the extra pass rather than working around it here.
+NOT_AFTER_TEXT_CMD: "(?<!{{CMD_POS}}(?:grep|egrep|fgrep|rg|ag|ack|awk|sed|cat|head|tail|less|more|strings|echo|printf|findstr|type|Select-String|sls|Write-Output|Write-Host|Write-Verbose|Write-Debug|Compare-Object)\\b(?:[^;&|(\\n`]|(?<=[\"'])\\(){0,500})"

package/resources/threats/agent-layer.yaml

@@ -38,6 +38,8 @@
 # ===========================================================================
 
 - id: "CLT-MCP-004"
+  version: 1
+  detection_name: "Other:SageMcp-D [Heur]"
   category: mcp_poisoning
   severity: warning
   confidence: 0.85
@@ -59,6 +61,8 @@
 # ===========================================================================
 
 - id: "CLT-SKL-001"
+  version: 1
+  detection_name: "Other:SageSkill-A [Heur]"
   category: skill_compromise
   severity: critical
   confidence: 0.85
@@ -78,10 +82,12 @@
 # CLT-SKL-003 intentionally omitted — dropped for FP risk during ATR curation.
 
 - id: "CLT-SKL-002"
+  version: 1
+  detection_name: "Other:SageSkill-B [Heur]"
   category: skill_compromise
   severity: critical
   confidence: 0.85
-  pattern: "(eval\\s*\\$\\(\\s*echo\\s+[\"'][A-Za-z0-9+/=]{20,}[\"']\\s*\\|\\s*base64\\s+-d|echo\\s+[\"'][A-Za-z0-9+/=]{20,}[\"']\\s*\\|\\s*base64\\s+(-d|--decode)\\s*\\|\\s*(bash|sh|python|node|ruby|perl))"
+  pattern: "(eval\\s*\\$\\(\\s*echo\\s+[\"'][A-Za-z0-9+/=]{20,}[\"']\\s*\\|\\s*base64\\s+-d|echo\\s+[\"'][A-Za-z0-9+/=]{20,}[\"']\\s*\\|\\s*base64\\s+(-d|--decode)\\s*\\|\\s*(?:{{SHELLS}}|python|node|ruby|perl))"
   match_on: content
   case_insensitive: true
   title: "Base64-encoded payload piped to interpreter inside skill content"
@@ -90,6 +96,8 @@
   # Source: ATR-2026-00121 (pattern unchanged from upstream).
 
 - id: "CLT-SKL-004"
+  version: 1
+  detection_name: "Other:SageSkill-D [Heur]"
   category: skill_compromise
   severity: critical
   confidence: 0.85
@@ -104,6 +112,8 @@
   # exfil-keyword focus (distinct from CLT-PI-002's instruction-override focus).
 
 - id: "CLT-SKL-005"
+  version: 1
+  detection_name: "Other:SageSkill-E [Heur]"
   category: skill_compromise
   severity: critical
   confidence: 0.95
@@ -118,6 +128,8 @@
   # injection signature with no legitimate use.
 
 - id: "CLT-SKL-006"
+  version: 1
+  detection_name: "Other:SageSkill-F [Heur]"
   category: skill_compromise
   severity: critical
   confidence: 0.85
@@ -137,6 +149,8 @@
 # CLT-SKL-007 intentionally omitted — dropped for FP risk during ATR curation.
 
 - id: "CLT-SKL-008"
+  version: 1
+  detection_name: "Other:SageSkill-H [Heur]"
   category: skill_compromise
   severity: warning
   confidence: 0.85
@@ -154,6 +168,8 @@
 # ===========================================================================
 
 - id: "CLT-CTX-003"
+  version: 1
+  detection_name: "Other:SageContext-C [Heur]"
   category: context_exfiltration
   severity: critical
   confidence: 0.95
@@ -172,6 +188,8 @@
 # ===========================================================================
 
 - id: "CLT-SUPPLY-002"
+  version: 1
+  detection_name: "Other:SageSupplyChain-B [Heur]"
   category: supply_chain
   severity: warning
   confidence: 0.95