@gendigital/sage-opencode 0.9.0 → 0.11.0

package/resources/threats/files.yaml

@@ -8,7 +8,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "(/etc/passwd|/etc/shadow|/etc/sudoers)"
   match_on: file_path
   title: "Access system authentication file"
@@ -20,7 +19,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\.ssh/authorized_keys"
   match_on: file_path
   title: "Access SSH authorized_keys (unauthorized access persistence)"
@@ -30,9 +28,8 @@
 # --- SSH private keys and config ---
 - id: "CLT-FILE-003"
   category: secrets
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa|config)$"
   match_on: file_path
   title: "Access SSH key or config file"
@@ -42,9 +39,8 @@
 # --- Shell RC files ---
 - id: "CLT-FILE-004"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.(bashrc|zshrc|profile|bash_profile|zprofile|zshenv)$"
   match_on: file_path
   title: "Access shell RC file (persistence mechanism)"
@@ -54,9 +50,8 @@
 # --- Cron directories ---
 - id: "CLT-FILE-006"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(/etc/cron\\.(d|daily|hourly|weekly|monthly)/|/var/spool/cron/)"
   match_on: file_path
   title: "Access cron directory"
@@ -66,9 +61,8 @@
 # --- systemd unit files ---
 - id: "CLT-FILE-007"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "/etc/systemd/system/"
   match_on: file_path
   title: "Access systemd service unit file"
@@ -82,9 +76,8 @@
 # targeted than command-string matching.
 - id: "CLT-FILE-008"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "((^|[\\/\\\\])\\.env(\\.local|\\.production|\\.prod|\\.staging|\\.stage|\\.development|\\.dev|\\.test)?|\\.aws/credentials|\\.netrc|\\.pgpass)$"
   match_on: file_path
   title: "Access credential or environment file"
@@ -94,9 +87,8 @@
 # --- Git hooks ---
 - id: "CLT-FILE-009"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.git/hooks/"
   match_on: file_path
   title: "Access git hook (potential code execution on git events)"
@@ -106,9 +98,8 @@
 # --- Android signing files ---
 - id: "CLT-FILE-010"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(key\\.properties|release\\.keystore|\\.jks|\\.keystore)$"
   match_on: file_path
   title: "Access Android signing file"
@@ -118,9 +109,8 @@
 # --- Firebase config files ---
 - id: "CLT-FILE-011"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(google-services\\.json|GoogleService-Info\\.plist)$"
   match_on: file_path
   title: "Access Firebase configuration file"
@@ -130,9 +120,8 @@
 # --- Cloud provider credential files ---
 - id: "CLT-FILE-012"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(application_default_credentials\\.json|\\.azure/(accessTokens|msal_token_cache)\\.json|\\.config/doctl/config\\.yaml)$"
   match_on: file_path
   title: "Access cloud provider credential file"
@@ -142,9 +131,8 @@
 # --- Package manager tokens ---
 - id: "CLT-FILE-013"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(\\.npmrc|\\.pypirc|\\.gem/credentials|\\.cargo/credentials\\.toml|\\.docker/config\\.json)$"
   match_on: file_path
   title: "Access package manager credential file"
@@ -154,9 +142,8 @@
 # --- Terraform state files ---
 - id: "CLT-FILE-014"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.(tfstate(\\.backup)?|tfvars(\\.json)?)$"
   match_on: file_path
   title: "Access Terraform state or variables file"
@@ -166,9 +153,8 @@
 # --- Secrets/vault files ---
 - id: "CLT-FILE-015"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(master\\.key|credentials\\.yml\\.enc|secrets\\.yml|vault\\.yml|\\.vault-pass|\\.vault-token)$"
   match_on: file_path
   title: "Access secrets or vault file"
@@ -181,9 +167,8 @@
 # would miss private key exfiltration.
 - id: "CLT-FILE-016"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.(pem|p12|pfx|p8)$"
   match_on: file_path
   title: "Access private key or certificate file"
@@ -193,9 +178,8 @@
 # --- Kubeconfig ---
 - id: "CLT-FILE-017"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(\\.kube/config|kubeconfig(\\.yaml|\\.yml)?)$"
   match_on: file_path
   title: "Access Kubernetes configuration file"
@@ -205,9 +189,8 @@
 # --- Build system credential files ---
 - id: "CLT-FILE-018"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(\\.m2/settings\\.xml|gradle\\.properties)$"
   match_on: file_path
   title: "Access build system credential file"
@@ -217,9 +200,8 @@
 # --- Shell/REPL history files ---
 - id: "CLT-FILE-019"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.(bash_history|zsh_history|mysql_history|python_history|node_repl_history|psql_history|irb_history)$"
   match_on: file_path
   title: "Access shell or REPL history file"
@@ -229,9 +211,8 @@
 # --- JetBrains IDE database credentials ---
 - id: "CLT-FILE-020"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\.idea/dataSources(\\.xml|/)"
   match_on: file_path
   title: "Access JetBrains IDE database credential file"

package/resources/threats/mac-commands.yaml

@@ -10,7 +10,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bosascript\\b.*-e.*do shell script"
   case_insensitive: true
   match_on: command
@@ -23,7 +22,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bosascript\\b.*-l\\s+JavaScript"
   case_insensitive: true
   match_on: command
@@ -36,7 +34,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\|\\s*osascript"
   match_on: command
   title: "Piped input to osascript (stdin AppleScript execution)"
@@ -48,7 +45,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(curl|wget).*\\|.*osascript|osascript.*(curl|wget)"
   case_insensitive: true
   match_on: command
@@ -61,9 +57,8 @@
 # open -a Terminal (launch Terminal with script)
 - id: "CLT-MAC-CMD-005"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bopen\\s+-a\\s+Terminal"
   match_on: command
   title: "Launch Terminal application via open -a"
@@ -73,9 +68,8 @@
 # open with hidden/background flags
 - id: "CLT-MAC-CMD-006"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bopen\\s+(-[jg]|--hide|--background)"
   match_on: command
   title: "Launch application hidden/background via open"
@@ -87,9 +81,8 @@
 # dscl user/group manipulation
 - id: "CLT-MAC-CMD-007"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bdscl\\b.*(-create|-delete|-passwd|-append)"
   match_on: command
   title: "Directory Services user/group manipulation via dscl"
@@ -99,9 +92,8 @@
 # networksetup proxy/DNS manipulation
 - id: "CLT-MAC-CMD-008"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bnetworksetup\\b.*(-setwebproxy|-setsocksfirewallproxy|-setdnsservers|-setautoproxyurl)"
   case_insensitive: true
   match_on: command
@@ -114,7 +106,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bsystemsetup\\b.*(-setremotelogin\\s+on|-setwakeonnetworkaccess\\s+on)"
   case_insensitive: true
   match_on: command
@@ -127,7 +118,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "kickstart.*-activate.*-configure"
   case_insensitive: true
   match_on: command
@@ -138,9 +128,8 @@
 # installer -pkg -target / (silent package install)
 - id: "CLT-MAC-CMD-011"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\binstaller\\b.*-pkg.*-target"
   case_insensitive: true
   match_on: command
@@ -151,9 +140,8 @@
 # hdiutil mount remote DMG
 - id: "CLT-MAC-CMD-012"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bhdiutil\\b.*\\b(attach|mount)\\b.*https?://"
   case_insensitive: true
   match_on: command
@@ -164,9 +152,8 @@
 # pkgutil --forget (package receipt manipulation)
 - id: "CLT-MAC-CMD-013"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bpkgutil\\b.*--forget"
   match_on: command
   title: "Package receipt removal via pkgutil --forget"
@@ -180,7 +167,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bdiskutil\\b.*\\b(eraseDisk|partitionDisk|secureErase)\\b"
   match_on: command
   title: "Disk erase/partition via diskutil"
@@ -192,7 +178,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\btmutil\\b.*\\b(delete|disable)\\b"
   match_on: command
   title: "Time Machine backup deletion/disable via tmutil (ransomware indicator)"
@@ -206,7 +191,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bspctl\\b.*--master-disable"
   match_on: command
   title: "Gatekeeper disable via spctl --master-disable"
@@ -218,7 +202,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bcsrutil\\b.*\\bdisable\\b"
   match_on: command
   title: "System Integrity Protection disable via csrutil"
@@ -230,7 +213,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bdefaults\\b.*\\bwrite\\b.*LSQuarantine"
   case_insensitive: true
   match_on: command
@@ -241,9 +223,8 @@
 # xattr -d com.apple.quarantine (quarantine removal)
 - id: "CLT-MAC-CMD-019"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bxattr\\b.*-d.*com\\.apple\\.quarantine"
   match_on: command
   title: "Quarantine attribute removal via xattr"
@@ -255,7 +236,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bpfctl\\b.*\\s-d\\b"
   match_on: command
   title: "Packet filter (firewall) disable via pfctl -d"
@@ -267,7 +247,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\btccutil\\b.*\\breset\\b"
   match_on: command
   title: "TCC privacy permissions reset via tccutil"
@@ -279,7 +258,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\blaunchctl\\b.*\\b(unload|bootout)\\b.*(com\\.apple\\.MRT|com\\.apple\\.XProtect|com\\.apple\\.security)"
   case_insensitive: true
   match_on: command
@@ -292,7 +270,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bdefaults\\b.*\\bwrite\\b.*(com\\.apple\\.Finder\\s+AppleShowAllFiles|com\\.apple\\.LaunchServices\\s+LSQuarantine|com\\.apple\\.loginwindow)"
   case_insensitive: true
   match_on: command
@@ -307,7 +284,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bdscl\\b.*\\s-passwd\\b"
   match_on: command
   title: "User password change via dscl"
@@ -319,7 +295,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bdseditgroup\\b.*-o\\s+edit.*-a.*admin"
   match_on: command
   title: "Add user to admin group via dseditgroup"
@@ -329,9 +304,8 @@
 # createhomedir — create home directory for arbitrary user
 - id: "CLT-MAC-CMD-026"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bcreatehomedir\\b"
   match_on: command
   title: "Create home directory for user via createhomedir"
@@ -345,9 +319,8 @@
 # screencapture to remote or hidden location
 - id: "CLT-MAC-CMD-027"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bscreencapture\\b.*(-x|-C)"
   match_on: command
   title: "Silent screen capture via screencapture"

package/resources/threats/mac-credentials.yaml

@@ -7,7 +7,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bsecurity\\b.*\\bfind-generic-password\\b.*-w"
   match_on: command
   title: "Keychain password extraction via security find-generic-password"
@@ -19,7 +18,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bsecurity\\b.*\\bfind-internet-password\\b.*-w"
   match_on: command
   title: "Keychain internet password extraction via security find-internet-password"
@@ -31,7 +29,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bsecurity\\b.*\\bdump-keychain\\b"
   match_on: command
   title: "Full keychain dump via security dump-keychain"
@@ -43,7 +40,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bsecurity\\b.*\\bunlock-keychain\\b.*-p"
   match_on: command
   title: "Keychain unlock with plaintext password"
@@ -53,9 +49,8 @@
 # Keychain export
 - id: "CLT-MAC-CRED-005"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bsecurity\\b.*\\bexport\\b.*-k"
   match_on: command
   title: "Keychain item export via security export"
@@ -67,7 +62,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bsecurity\\b.*\\bdelete-keychain\\b"
   match_on: command
   title: "Keychain deletion via security delete-keychain"
@@ -77,9 +71,8 @@
 # Directory Services auth data read
 - id: "CLT-MAC-CRED-007"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bdscl\\b.*-read.*(AuthenticationAuthority|Password|ShadowHash)"
   match_on: command
   title: "Read user authentication data via dscl"
@@ -91,7 +84,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bsqlite3\\b.*(/Library/Keychains/|login\\.keychain)"
   match_on: command
   title: "Direct Keychain database access via sqlite3"

package/resources/threats/mac-files.yaml

@@ -6,9 +6,8 @@
 # LaunchAgent/LaunchDaemon plist (migrated from files.yaml CLT-FILE-005)
 - id: "CLT-MAC-FILE-001"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.90
-  action: block
   pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist$"
   match_on: file_path
   title: "Access macOS LaunchAgent/LaunchDaemon plist"
@@ -20,7 +19,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "com\\.apple\\.TCC/TCC\\.db"
   match_on: file_path
   title: "Access TCC privacy permissions database"
@@ -32,7 +30,6 @@
   category: secrets
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "(/etc/authorization|/var/db/auth\\.db)"
   match_on: file_path
   title: "Access macOS authorization database"
@@ -44,7 +41,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(/Library/Extensions/|/System/Library/Extensions/).*\\.kext"
   match_on: file_path
   title: "Access kernel extension (.kext)"
@@ -56,7 +52,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/Library/Security/SecurityAgentPlugins/"
   match_on: file_path
   title: "Access SecurityAgentPlugins directory"
@@ -66,9 +61,8 @@
 # Periodic scripts directory
 - id: "CLT-MAC-FILE-006"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "/etc/periodic/(daily|weekly|monthly)/"
   match_on: file_path
   title: "Access macOS periodic scripts directory"
@@ -80,7 +74,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/etc/emond\\.d/rules/"
   match_on: file_path
   title: "Access Event Monitor daemon rules directory"
@@ -92,7 +85,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/Safari/(Cookies\\.binarycookies|LastSession\\.plist|Databases|LocalStorage)"
   match_on: file_path
   title: "Access Safari credential/cookie store"
@@ -102,9 +94,8 @@
 # Managed Preferences (MDM profiles)
 - id: "CLT-MAC-FILE-009"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "/Library/Managed Preferences/"
   match_on: file_path
   title: "Access Managed Preferences (MDM profile injection)"
@@ -116,7 +107,6 @@
   category: secrets
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "/Library/Keychains/.*\\.keychain"
   match_on: file_path
   title: "Access system Keychain file"

package/resources/threats/mac-obfuscation.yaml

@@ -7,7 +7,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bosascript\\b.*do shell script"
   case_insensitive: true
   match_on: command
@@ -20,7 +19,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bosascript\\b.*-l\\s+JavaScript.*-e"
   case_insensitive: true
   match_on: command
@@ -33,7 +31,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "base64\\s+(-d|-D|--decode).*\\|.*osascript"
   match_on: command
   title: "Base64 decode piped to osascript (encoded payload execution)"
@@ -45,7 +42,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "DYLD_INSERT_LIBRARIES=.*\\.(dylib|so)"
   match_on: command
   title: "Dynamic library injection via DYLD_INSERT_LIBRARIES"
@@ -55,9 +51,8 @@
 # Quarantine attribute removal (evasion)
 - id: "CLT-MAC-OBFUS-005"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bxattr\\b.*(-d|-c).*com\\.apple\\.quarantine"
   match_on: command
   title: "Quarantine attribute removal (Gatekeeper evasion)"
@@ -69,9 +64,8 @@
 # plutil plist manipulation (payload hiding)
 - id: "CLT-MAC-OBFUS-006"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bplutil\\b.*-convert\\s+(binary1|raw)"
   match_on: command
   title: "Plist conversion to binary (payload obfuscation)"
@@ -81,9 +75,8 @@
 # Swift/swiftc inline execution
 - id: "CLT-MAC-OBFUS-007"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bswift\\b\\s+-e\\s+[\"'].*\\b(Process|NSTask|URLSession|shell)\\b"
   case_insensitive: true
   match_on: command