@xaccefy/pi-casefile 0.10.0 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -6
- package/package.json +1 -2
- package/src/confirmation.ts +239 -323
- package/src/evidence.ts +101 -135
- package/src/harness-verify.ts +54 -247
- package/src/index.ts +188 -745
- package/src/ledger-internal.ts +118 -4
- package/src/ledger.ts +459 -175
- package/src/poc-runner.ts +43 -14
- package/src/scratchpad.ts +88 -143
- package/src/workflow.ts +6 -2
- package/src/oob-oracle.ts +0 -279
package/README.md
CHANGED
|
@@ -15,9 +15,8 @@ A structured ledger for offensive-security work — bug bounties, CTFs, audits
|
|
|
15
15
|
|
|
16
16
|
Cases move `hypothesis → investigating → confirmed → reported`. Promotion between phases is gated:
|
|
17
17
|
|
|
18
|
-
- **Zero exit is necessary but never proof** — direct-response findings require nonce-bound body evidence plus a DNS-pinned, conclusive `target_only` replay against
|
|
19
|
-
- **Differential confirmation** —
|
|
20
|
-
- **Blind/OOB classes** confirm through an operator-run oracle with per-run tokens and source-separation attestation
|
|
18
|
+
- **Zero exit is necessary but never proof** — direct-response findings require nonce-bound body evidence plus a DNS-pinned, conclusive `target_only` attack-vs-baseline replay against the case target (recorded at promote; the bundle's baseline binding and differential are re-validated at confirm)
|
|
19
|
+
- **Differential confirmation** — the attack request must satisfy the claimed predicate while a legitimate same-host baseline request must not, so "it worked" means *the discriminator fired*, not "the agent said so"
|
|
21
20
|
- Only the main agent makes the semantic decision and commits phase transitions
|
|
22
21
|
|
|
23
22
|
Designed for **human + AI workflows**: every confirmed finding carries a reproducible evidence trail a human can audit.
|
|
@@ -26,10 +25,11 @@ Designed for **human + AI workflows**: every confirmed finding carries a reprodu
|
|
|
26
25
|
|
|
27
26
|
| Tool | Purpose |
|
|
28
27
|
|---|---|
|
|
29
|
-
| `CaseAdd` / `CaseList` / `CaseUpdate` / `CaseContext` | case lifecycle and context
|
|
28
|
+
| `CaseAdd` / `CaseList` / `CaseSearch` / `CaseGet` / `CaseUpdate` / `CaseLink` / `CaseUnlink` / `CaseContext` | case lifecycle, search, links, and report context |
|
|
30
29
|
| `EvidenceAdd` | attach raw evidence to a case |
|
|
30
|
+
| `CoverageAdd` | record tested (asset × class) cells — found or clean |
|
|
31
31
|
| `PromoteFinding` → harness replay → `ConfirmFinding` | gated finding pipeline |
|
|
32
|
-
|
|
|
32
|
+
| `ScratchpadWrite` / `ScratchpadRead` / `ScratchpadClear` | working notes, resume-safe (no pipeline orchestration) |
|
|
33
33
|
|
|
34
34
|
## Install
|
|
35
35
|
|
|
@@ -43,7 +43,7 @@ Peer-depends on a Pi-compatible agent host (`@earendil-works/pi-coding-agent`, `
|
|
|
43
43
|
|
|
44
44
|
```bash
|
|
45
45
|
bun install
|
|
46
|
-
bun test --isolate
|
|
46
|
+
bun test --isolate
|
|
47
47
|
bun run typecheck
|
|
48
48
|
```
|
|
49
49
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xaccefy/pi-casefile",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.11.0",
|
|
4
4
|
"description": "Offensive security case tracker for Pi Agent \u2014 bug bounties, CTFs, security audits",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"pi-package",
|
|
@@ -35,7 +35,6 @@
|
|
|
35
35
|
"src/index.ts",
|
|
36
36
|
"src/evidence.ts",
|
|
37
37
|
"src/harness-verify.ts",
|
|
38
|
-
"src/oob-oracle.ts",
|
|
39
38
|
"src/confirmation.ts",
|
|
40
39
|
"src/ledger-internal.ts",
|
|
41
40
|
"src/safe-state.ts",
|