@gendigital/sage-opencode 0.9.0

package/resources/threats/obfuscation.yaml

@@ -0,0 +1,98 @@
+# Obfuscation threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+
+# --- Base64 decode piped to shell ---
+- id: "CLT-OBFUS-001"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "base64\\s+(-d|--decode)\\s*\\|\\s*(bash|sh|zsh|ksh|dash)"
+  match_on: command
+  title: "Base64 decode piped to shell execution"
+  expires_at: null
+  revoked: false
+
+# --- Hex escape sequences in printf ---
+- id: "CLT-OBFUS-002"
+  category: tool
+  severity: medium
+  confidence: 0.70
+  action: require_approval
+  pattern: "printf\\s+[\"']\\\\x[0-9a-fA-F]{2}(\\\\x[0-9a-fA-F]{2}){3,}"
+  match_on: command
+  title: "Hex escape sequences in printf (potential obfuscation)"
+  expires_at: null
+  revoked: false
+
+# --- Reversed string piped to shell ---
+- id: "CLT-OBFUS-003"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\|\\s*rev\\s*\\|\\s*(bash|sh|zsh|ksh|dash)"
+  match_on: command
+  title: "Reversed string piped to shell execution"
+  expires_at: null
+  revoked: false
+
+# --- Eval with decode ---
+- id: "CLT-OBFUS-004"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\beval\\s+.*\\$\\(\\s*base64|python[3]?\\s+-c\\s+[\"'].*exec\\(.*decode"
+  match_on: [command, content]
+  title: "Eval with decode (obfuscated code execution)"
+  expires_at: null
+  revoked: false
+
+# --- Shell metacharacter escaping ---
+- id: "CLT-OBFUS-005"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: block
+  pattern: "\\|\\s*[\\\\'\"]+(bash|sh|zsh|ksh|dash)[\\\\'\"]*(\\s|$)"
+  match_on: command
+  title: "Shell metacharacter escaping to hide pipe target"
+  expires_at: null
+  revoked: false
+
+# --- Alias/function redefinition ---
+- id: "CLT-OBFUS-006"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\balias\\s+(bash|sh|zsh|curl|wget|nc|netcat|python|ruby|perl|node)="
+  match_on: command
+  title: "Alias redefinition of security-relevant command"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-OBFUS-007"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\b(function\\s+)?(bash|sh|curl|wget|nc|python|ruby|perl|node)\\s*\\(\\s*\\)"
+  match_on: command
+  title: "Function redefinition of security-relevant command"
+  expires_at: null
+  revoked: false
+
+# --- Python encoded payload execution ---
+- id: "CLT-OBFUS-008"
+  category: tool
+  severity: critical
+  confidence: 0.85
+  action: block
+  pattern: "python[23]?\\s+-c\\s+[\"'].*\\b(exec|eval|compile|__import__)\\b.*\\b(base64|decode|decompress)\\b"
+  match_on: command
+  title: "Python encoded payload execution via -c"
+  expires_at: null
+  revoked: false

package/resources/threats/persistence.yaml

@@ -0,0 +1,87 @@
+# Persistence mechanism threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+
+# --- Shell RC file modification ---
+- id: "CLT-PERSIST-001"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(>>|>)\\s*~?/?(\\$HOME/)?\\.?(bashrc|zshrc|profile|bash_profile|zprofile|zshenv)"
+  match_on: command
+  title: "Write/append to shell RC file (persistence mechanism)"
+  expires_at: null
+  revoked: false
+
+# --- Crontab manipulation ---
+- id: "CLT-PERSIST-002"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bcrontab\\s+(-[er]|[^-])"
+  match_on: command
+  title: "Crontab manipulation (list, edit, or remove scheduled tasks)"
+  expires_at: null
+  revoked: false
+
+# --- Cron directory writes ---
+- id: "CLT-PERSIST-003"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "/etc/cron\\.(d|daily|hourly|weekly|monthly)/"
+  match_on: command
+  title: "Write to system cron directory"
+  expires_at: null
+  revoked: false
+
+# --- systemd service manipulation ---
+- id: "CLT-PERSIST-005"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bsystemctl\\s+(enable|start)\\b|/etc/systemd/system/"
+  match_on: command
+  title: "systemd service enable/start or unit file write"
+  expires_at: null
+  revoked: false
+
+# --- SSH authorized_keys modification ---
+- id: "CLT-PERSIST-006"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: ">>\\s*(~|\\/(root|home\\/[a-zA-Z0-9._-]{1,32}))?/?\\.ssh/authorized_keys"
+  match_on: command
+  title: "Append to SSH authorized_keys (unauthorized access persistence)"
+  expires_at: null
+  revoked: false
+
+# --- Echo/printf append to shell RC files ---
+- id: "CLT-PERSIST-007"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "(echo|printf)\\s+.*>>\\s*~?/?(\\$HOME/)?\\.?(bashrc|zshrc|profile|bash_profile)"
+  match_on: command
+  title: "Echo/printf append to shell RC file (code injection persistence)"
+  expires_at: null
+  revoked: false
+
+# --- at job scheduling ---
+- id: "CLT-PERSIST-008"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bat\\b\\s+(-f\\s+|now|midnight|noon|teatime)"
+  match_on: command
+  title: "At-job scheduling (persistence)"
+  expires_at: null
+  revoked: false

package/resources/threats/prompt-injection.yaml

@@ -0,0 +1,334 @@
+# Prompt injection detection heuristic rules (tier 1)
+# Catches common PI patterns with zero model dependency, ~1ms.
+# Designed for low false-positive rate on coding content.
+#
+# Sources: original Sage PI prototype, PR #90 (promptware), @stackone/defender patterns.
+# These complement the ML model (tier 2) which handles subtler attacks.
+
+# ── Instruction Override ────────────────────────────────────────────
+# The most common PI pattern family. Well-established attack surface.
+
+- id: "CLT-PI-001"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "ignore\\s+(all\\s+)?(previous|prior|above|earlier)\\s+(instructions?|directives?|rules?|guidelines?|prompts?|directions?)"
+  match_on: content
+  title: "Instruction override: ignore previous"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-002"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "disregard\\s+(all\\s+)?(previous|prior|above|your)\\s+(instructions?|directives?|rules?|guidelines?|safety)"
+  match_on: content
+  title: "Instruction override: disregard directives"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-003"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "forget\\s+(all\\s+)?(your\\s+)?(previous\\s+)?(instructions?|rules?|guidelines?|restrictions?|constraints?|context)"
+  match_on: content
+  title: "Instruction override: forget instructions"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-004"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "override\\s+(the\\s+)?(system\\s+)?(prompt|instructions?|rules?|guidelines?)"
+  match_on: content
+  title: "Instruction override: direct override"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-005"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "(new|updated?|revised?|changed?)\\s+instructions?:\\s*"
+  match_on: content
+  title: "Instruction override: inject new instructions"
+  expires_at: null
+  revoked: false
+
+# ── Role / Persona Override ─────────────────────────────────────────
+# Attempts to reassign the AI's identity or role.
+
+- id: "CLT-PI-010"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "you\\s+are\\s+now\\s+(a\\s+)?(different|new|the|my|an?\\s+unrestricted|an?\\s+unfiltered)"
+  match_on: content
+  title: "Role override: identity reassignment"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-011"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "\\bDAN\\b.*?(do\\s+anything|jailbreak|no\\s+restrictions)"
+  match_on: content
+  title: "Role override: DAN jailbreak"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-012"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "developer\\s+mode\\s+(is\\s+)?(now\\s+)?(enabled?|activated?|on).{0,50}(comply|content\\s+polic|no\\s+restrict|without\\s+restrict|any\\s+request)"
+  match_on: content
+  title: "Role override: developer mode jailbreak"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-013"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "act\\s+(as|like)\\s+(a\\s+)?(system|admin|root|superuser)"
+  match_on: content
+  title: "Role override: privileged role assumption"
+  expires_at: null
+  revoked: false
+
+# ── Security Bypass ─────────────────────────────────────────────────
+# Attempts to disable safety mechanisms.
+
+- id: "CLT-PI-020"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "(bypass|disable)\\s+(the\\s+)?(security|safety|guardrails?|filters?|restrictions?)"
+  match_on: content
+  title: "Security bypass: disable safety features"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-021"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "ignore\\s+(the\\s+)?(safety|security|ethical)\\s+(guidelines?|rules?|restrictions?)"
+  match_on: content
+  title: "Security bypass: ignore safety guidelines"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-022"
+  category: prompt_injection
+  severity: high
+  confidence: 0.80
+  action: block
+  case_insensitive: true
+  pattern: "skip\\s+(all\\s+)?security\\s+checks"
+  match_on: content
+  title: "Security bypass: skip security checks"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-023"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "system\\s+override.{0,50}(execut|disabl|bypass|security|safet|comply|filter)"
+  match_on: content
+  title: "Security bypass: system override with action"
+  expires_at: null
+  revoked: false
+
+# ── Anti-Transparency ──────────────────────────────────────────────
+# Instructions to hide activity from the user.
+
+- id: "CLT-PI-030"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "do\\s+not\\s+(tell|inform|mention|reveal|show|disclose)\\s+(the\\s+)?(user|human|operator|developer)"
+  match_on: content
+  title: "Anti-transparency: hide from user"
+  expires_at: null
+  revoked: false
+
+# ── Prompt Exfiltration ────────────────────────────────────────────
+# Attempts to extract the system prompt or instructions.
+
+- id: "CLT-PI-040"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "reveal\\s+(your\\s+)?(system\\s+)?prompt"
+  match_on: content
+  title: "Prompt exfiltration: reveal system prompt"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-041"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "show\\s+(me\\s+)?(your\\s+)?(initial|original|system|hidden)\\s+instructions?"
+  match_on: content
+  title: "Prompt exfiltration: show hidden instructions"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-042"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "repeat\\s+(back\\s+)?(everything|all|your\\s+instructions?)"
+  match_on: content
+  title: "Prompt exfiltration: repeat instructions"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-043"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "output\\s+(your\\s+)?(initialization|system\\s+prompt|initial\\s+instructions?)"
+  match_on: content
+  title: "Prompt exfiltration: output initialization"
+  expires_at: null
+  revoked: false
+
+# ── Structural Injection ───────────────────────────────────────────
+# Injection hiding in HTML, markdown, or JSON structures.
+
+- id: "CLT-PI-050"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "<!--\\s*(?:system|ignore|instruction|prompt|important|override|execute).*?-->"
+  match_on: content
+  title: "Structural injection: HTML comment with injection keywords"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-051"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "\\[.*?\\]\\(.*?(?:ignore|forget|system|instruction|override).*?\\)"
+  match_on: content
+  title: "Structural injection: markdown link with hidden injection"
+  expires_at: null
+  revoked: false
+
+# ── Role Marker Injection ──────────────────────────────────────────
+# Fake conversation turn markers to confuse the model.
+
+- id: "CLT-PI-060"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "\\n\\s*\\n\\s*(Human|User|Assistant|System)\\s*:"
+  match_on: content
+  title: "Role marker injection: fake conversation turn"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-061"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "\\[INST\\]|\\[/INST\\]"
+  match_on: content
+  title: "Role marker injection: Llama instruction format"
+  expires_at: null
+  revoked: false
+
+# ── Encoding / Obfuscation ─────────────────────────────────────────
+# Obfuscated injection attempts.
+
+- id: "CLT-PI-070"
+  category: prompt_injection
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  case_insensitive: true
+  pattern: "1gn0r3|f0rg3t|byp4ss|syst3m|4dm1n"
+  match_on: content
+  title: "Encoding: leetspeak obfuscation of injection keywords"
+  expires_at: null
+  revoked: false
+
+# ── Credential Exfiltration via Injection ──────────────────────────
+# PI-driven data exfiltration patterns. Note: bare curl/wget commands
+# are NOT PI — these only match when combined with credential targets.
+
+- id: "CLT-PI-080"
+  category: prompt_injection
+  severity: high
+  confidence: 0.80
+  action: block
+  case_insensitive: true
+  pattern: "cat\\s+~/\\.(env|ssh|aws|gnupg).*\\|.*curl"
+  match_on: content
+  title: "Credential exfiltration: pipe dotfile to curl"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-081"
+  category: prompt_injection
+  severity: high
+  confidence: 0.80
+  action: block
+  case_insensitive: true
+  pattern: "output\\s+(all\\s+)?(the\\s+)?environment\\s+variables.{0,50}(send|post|upload|exfiltrat|curl|fetch)"
+  match_on: content
+  title: "Credential exfiltration: dump env vars and send"
+  expires_at: null
+  revoked: false

package/resources/threats/self-defense.yaml

@@ -0,0 +1,55 @@
+# Self-defense patterns — protect Sage and Claude Code configuration
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+# These flag when the AI agent may be manipulated into disabling its own guardrails
+# Using require_approval (not block) to allow legitimate plugin dev and config changes
+
+# Delete .sage directory
+- id: "CLT-SELF-001"
+  category: self_defense
+  severity: critical
+  confidence: 0.90
+  action: require_approval
+  pattern: "(rm|del|rmdir|rd|Remove-Item|unlink)\\s.*\\.sage(\\s|[\\\\/]|$)"
+  case_insensitive: true
+  match_on: command
+  title: "Attempt to delete Sage configuration directory"
+  expires_at: null
+  revoked: false
+
+# Access Sage config files
+- id: "CLT-SELF-002"
+  category: self_defense
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\.sage[\\\\/](allowlist|config|exceptions|pending-exceptions)\\.json"
+  match_on: file_path
+  title: "Access Sage configuration files"
+  expires_at: null
+  revoked: false
+
+# Delete Claude Code hook or plugin config
+- id: "CLT-SELF-003"
+  category: self_defense
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "(rm|del|Remove-Item|unlink)\\s.*\\.claude[\\\\/].*(hooks\\.json|installed_plugins)"
+  case_insensitive: true
+  match_on: command
+  title: "Attempt to delete Claude Code hook or plugin configuration"
+  expires_at: null
+  revoked: false
+
+# Disable Sage security features via config
+- id: "CLT-SELF-004"
+  category: self_defense
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\"heuristics_enabled\"\\s*:\\s*false|\"url_check\"\\s*:\\s*\\{[^}]*\"enabled\"\\s*:\\s*false"
+  match_on: content
+  title: "Attempt to disable Sage security features via config"
+  expires_at: null
+  revoked: false

package/resources/threats/supply_chain.yaml

@@ -0,0 +1,15 @@
+# Supply chain threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+
+# --- Install scripts piped to shell ---
+- id: "CLT-SUPPLY-001"
+  category: supply_chain
+  severity: high
+  confidence: 0.85
+  action: block
+  pattern: "(curl|wget)\\s+.*install.*\\|\\s*(bash|sh|zsh|sudo\\s+bash|sudo\\s+sh)"
+  match_on: command
+  title: "Install script piped to shell (supply chain risk)"
+  expires_at: null
+  revoked: false

package/resources/threats/urls.yaml

@@ -0,0 +1,66 @@
+# URL/domain threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+# Schema: id, category, severity, confidence, action, pattern, match_on, title, expires_at, revoked
+
+# --- Known malware hosting patterns ---
+- id: "CLT-URL-001"
+  category: network_egress
+  severity: critical
+  confidence: 0.85
+  action: block
+  pattern: "raw\\.githubusercontent\\.com/.*/malware"
+  match_on: url
+  title: "Known malware hosting pattern on GitHub raw"
+  expires_at: null
+  revoked: false
+
+# --- Paste sites used for C2 ---
+- id: "CLT-URL-002"
+  category: network_egress
+  severity: high
+  confidence: 0.75
+  action: require_approval
+  pattern: "pastebin\\.com/raw/"
+  match_on: url
+  title: "Pastebin raw content (commonly used for C2 payloads)"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-URL-003"
+  category: network_egress
+  severity: high
+  confidence: 0.75
+  action: require_approval
+  pattern: "paste\\.ee/r/"
+  match_on: url
+  title: "paste.ee raw content (commonly used for C2 payloads)"
+  expires_at: null
+  revoked: false
+
+# --- IP-based URLs (often C2 or staging) ---
+# Excludes loopback (127/8), unspecified (0/8), RFC1918 private
+# (10/8, 172.16/12, 192.168/16), and link-local (169.254/16) ranges,
+# which are common in local development and rarely indicate C2 traffic.
+- id: "CLT-URL-004"
+  category: network_egress
+  severity: medium
+  confidence: 0.65
+  action: require_approval
+  pattern: "https?://(?!(?:127|10|0)\\.|192\\.168\\.|169\\.254\\.|172\\.(?:1[6-9]|2\\d|3[01])\\.)\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}[:/]"
+  match_on: url
+  title: "Direct public IP address URL (potential C2 or staging server)"
+  expires_at: null
+  revoked: false
+
+# --- Executable downloads ---
+- id: "CLT-URL-005"
+  category: network_egress
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "/[^/\\s]{1,255}\\.(exe|msi|bat|cmd|ps1|vbs|scr|pif|hta|inf)([?#]|$)"
+  match_on: url
+  title: "URL pointing to executable file download"
+  expires_at: null
+  revoked: false