@xaccefy/pi-casefile 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 x4cc3
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,68 @@
+# Casefile — Offensive Security Case Tracker
+
+Track durable security cases during bug bounties, CTFs, and security audits.
+
+## Surface Support
+
+- **pi extension** — registers tools and `/casefile` dashboard.
+
+## Tools (pi)
+
+| pi | Description |
+|---|---|
+| **CaseAdd** | Open a new hypothesis or investigation |
+| **CaseUpdate** | Update fields (status, evidence, impact, etc.) |
+| **PromoteFinding** | **PoC Runner**: Verify PoC in Docker to confirm |
+| **CaseGet** | Get full details of a single case |
+| **CaseList** / **Search** | Browse or search across fields |
+| **CaseLink** / **Unlink** | Connect primitives into exploit chains |
+| **CaseReport** | Generate markdown report (confirmed/reported only) |
+
+## PoC Runner (Docker / Local)
+
+To promote a case from `investigating` to `confirmed`, you must use `PromoteFinding` with an on-disk PoC path.
+
+- **Sandbox (Docker)**: Default. Runs in a `--network none` container with read-only mounts. Uses `python:3.12-slim` (.py) or `alpine` (.sh).
+- **Local**: Use `local: true`. Runs directly on the host (e.g. for network-dependent bugs).
+- **Verification**: Only promotes to `confirmed` if the PoC returns **exit code 0**.
+- **Timeout**: 30 second limit.
+
+## Offensive Security Workflow
+
+1. **Hypothesize**: `CaseAdd(status: hypothesis)`
+2. **Investigate**: `CaseUpdate(status: investigating, evidence, confidence)`
+3. **Confirm**: `PromoteFinding(id, poc_path, local?)` -> Exit 0 verifies and confirms.
+4. **Chain**: `CaseLink` primitives to escalations.
+5. **Report**: `CaseReport` -> `CaseUpdate(status: reported)`.
+6. **Kill**: `CaseUpdate(status: killed)` for dead ends.
+
+### State Gates
+- `hypothesis` → `investigating` requires `evidence` + `confidence`.
+- `investigating` → `confirmed` requires a verified PoC run (exit 0) and `poc`, `evidence`, `impact`, `severity`.
+- `confirmed` → `reported` requires `CaseReport` to have been generated.
+- `killed` and `reported` are **terminal**.
+
+## Storage & Environment
+
+Stored as **SQLite** at `.casefile/casefile.db` (project) or `~/.casefile/casefile.db` (global).
+
+- `CASEFILE_PATH`: Force exact ledger path.
+- `CASEFILE_SCOPE=project|global`: Set storage scope.
+
+## Project Structure
+
+```
+src/
+  index.ts        — pi extension (tools, commands, events)
+  ledger.ts       — SQLite storage engine
+  poc-runner.ts   — Docker/local PoC verification
+  sqlite-compat.ts — node:sqlite / bun:sqlite compat layer
+skills/
+  casefile/SKILL.md — agent skill prompt
+test/
+  ledger.test.ts   — unit tests
+```
+
+---
+Install: `pi install npm:pi-casefile`
+

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@xaccefy/pi-casefile",
+  "version": "0.1.0",
+  "description": "Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits",
+  "keywords": [
+    "pi-package",
+    "pi-extension",
+    "xpi",
+    "security",
+    "bug-bounty",
+    "ctf",
+    "casefile"
+  ],
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/x4cc3/pi-xpi.git",
+    "directory": "packages/pi-casefile"
+  },
+  "homepage": "https://github.com/x4cc3/pi-xpi/tree/main/packages/pi-casefile#readme",
+  "bugs": {
+    "url": "https://github.com/x4cc3/pi-xpi/issues"
+  },
+  "scripts": {
+    "test": "bun test test",
+    "typecheck": "tsc --noEmit --project tsconfig.json"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "files": [
+    "src/index.ts",
+    "src/ledger.ts",
+    "src/poc-runner.ts",
+    "src/sqlite-compat.ts",
+    "skills",
+    "README.md",
+    "LICENSE"
+  ],
+  "main": "src/index.ts",
+  "pi": {
+    "extensions": [
+      "./src/index.ts"
+    ],
+    "skills": [
+      "./skills"
+    ]
+  },
+  "dependencies": {
+    "@sinclair/typebox": "^0.32.34"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.14",
+    "typescript": "^6.0.3"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*"
+  }
+}

package/skills/casefile/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: casefile
+description: Use when tracking security investigations, bug bounty findings, CTF leads, audit evidence, exploit chains, dead ends, or reports in the Casefile ledger.
+license: MIT
+---
+
+# Casefile Tracker
+
+Use Casefile to maintain durable security investigation state across agent turns.
+
+## Workflow
+
+1. Check existing cases before opening a new one with CaseList or CaseSearch.
+2. Open new leads with CaseAdd as `hypothesis` or `investigating`.
+3. Promote cases with CaseUpdate only after materially new evidence, proof, impact, blockers, remediation, or status changes.
+4. Mark `confirmed` only when evidence and a PoC or repro are recorded.
+5. Use CaseLink and CaseUnlink for exploit chains. Do not edit linked case IDs directly.
+6. Use CaseReport only for confirmed or already reported cases.
+7. Use `killed` for disproven, duplicate, or dead-end leads, and include evidence, blockers, next step, or assumptions explaining why.
+
+## Tool Map
+
+- `CaseAdd`: create a new case.
+- `CaseUpdate`: update an existing case.
+- `PromoteFinding`: run an on-disk PoC script (Docker sandbox or local) and promote a case to confirmed on exit 0.
+- `CaseGet`: read one case by ID.
+- `CaseList`: list cases with filters and pagination.
+- `CaseSearch`: search all fields or a scoped field.
+- `CaseLink`: bidirectionally link two cases.
+- `CaseUnlink`: remove a bidirectional case link.
+- `CaseReport`: write a markdown report for a confirmed or reported case.