@xaccefy/pi-casefile 0.2.0 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xaccefy/pi-casefile",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits",
   "keywords": [
     "pi-package",

package/src/index.ts

@@ -122,8 +122,15 @@ const ListSchema = Type.Object(
     status: Type.Optional(CaseStatusSchema),
     confidence: Type.Optional(CaseConfidenceSchema),
     severity: Type.Optional(CaseSeveritySchema),
+    minSeverity: Type.Optional(CaseSeveritySchema),
     priority: Type.Optional(CasePrioritySchema),
     tag: Type.Optional(Type.String({ description: "Filter by tag" })),
+    since: Type.Optional(
+      Type.String({ description: "ISO timestamp; only cases created at/after this time" }),
+    ),
+    until: Type.Optional(
+      Type.String({ description: "ISO timestamp; only cases created at/before this time" }),
+    ),
     limit: Type.Optional(Type.Number({ description: "Max results (default 50)" })),
     offset: Type.Optional(Type.Number({ description: "Skip N results for pagination" })),
   },
@@ -146,8 +153,15 @@ const SearchSchema = Type.Object(
     status: Type.Optional(CaseStatusSchema),
     confidence: Type.Optional(CaseConfidenceSchema),
     severity: Type.Optional(CaseSeveritySchema),
+    minSeverity: Type.Optional(CaseSeveritySchema),
     priority: Type.Optional(CasePrioritySchema),
-    tag: Type.Optional(Type.String()),
+    tag: Type.Optional(Type.String({ description: "Filter by tag" })),
+    since: Type.Optional(
+      Type.String({ description: "ISO timestamp; only cases created at/after this time" }),
+    ),
+    until: Type.Optional(
+      Type.String({ description: "ISO timestamp; only cases created at/before this time" }),
+    ),
     limit: Type.Optional(Type.Number()),
     offset: Type.Optional(Type.Number()),
   },
@@ -725,8 +739,11 @@ export default function casefileExtension(pi: ExtensionAPI) {
         status: params.status as CaseStatus | undefined,
         confidence: params.confidence as CaseConfidence | undefined,
         severity: params.severity as CaseSeverity | undefined,
+        minSeverity: params.minSeverity as CaseSeverity | undefined,
         priority: params.priority as CasePriority | undefined,
         tag: params.tag,
+        since: params.since as string | undefined,
+        until: params.until as string | undefined,
         limit: params.limit,
         offset: params.offset,
       });
@@ -772,8 +789,11 @@ export default function casefileExtension(pi: ExtensionAPI) {
         status: params.status as CaseStatus | undefined,
         confidence: params.confidence as CaseConfidence | undefined,
         severity: params.severity as CaseSeverity | undefined,
+        minSeverity: params.minSeverity as CaseSeverity | undefined,
         priority: params.priority as CasePriority | undefined,
         tag: params.tag,
+        since: params.since as string | undefined,
+        until: params.until as string | undefined,
         limit: params.limit,
         offset: params.offset,
       });

package/src/ledger.ts

@@ -141,8 +141,14 @@ export type CaseSearchOptions = {
   status?: CaseStatus;
   confidence?: CaseConfidence;
   severity?: CaseSeverity;
+  /** Return only cases at or above this severity (info < low < medium < high < critical). */
+  minSeverity?: CaseSeverity;
   priority?: CasePriority;
   tag?: string;
+  /** ISO timestamp; only cases created at/after this time. */
+  since?: string;
+  /** ISO timestamp; only cases created at/before this time. */
+  until?: string;
   limit?: number;
   offset?: number;
 };
@@ -190,10 +196,15 @@ export function getCasefilePath(): string {
 }
 
 export function setCasefilePath(path: string | undefined): void {
-  ledgerPathOverride = path;
   if (dbInstance) {
-    dbInstance = undefined; // Force reconnection on next getDb
+    try {
+      dbInstance.close();
+    } catch {
+      // Best-effort close.
+    }
   }
+  ledgerPathOverride = path;
+  dbInstance = undefined; // Force reconnection on next getDb
 }
 
 // ── SQLite Schema Init ────────────────────────────────────────────────
@@ -210,6 +221,9 @@ function getDb(): DatabaseSync {
   }
 
   const db = new DatabaseSync(dbPath);
+  // Enable foreign-key enforcement so ON DELETE CASCADE actually fires
+  // (SQLite keeps FK off by default; bun:sqlite in particular defaults it off).
+  db.exec("PRAGMA foreign_keys = ON");
 
   // Create tables
   db.exec(`
@@ -353,8 +367,13 @@ export function getCaseById(id: string): CaseRecord | undefined {
 
 function validateCase(record: CaseRecord): void {
   if (!record.title.trim()) throw new Error("Case title cannot be empty");
-  if (record.status === "confirmed" && (!record.evidence || !record.poc)) {
-    throw new Error("Confirmed cases require both evidence and poc");
+  // Keep this gate in lockstep with promoteFindingResult: a case may only be
+  // CONFIRMED when it has evidence, a PoC, demonstrated impact, and a severity.
+  if (
+    record.status === "confirmed" &&
+    (!record.evidence || !record.poc || !record.impact || !record.severity)
+  ) {
+    throw new Error("Confirmed cases require evidence, poc, impact, and severity");
   }
   if (record.status === "blocked" && (record.blockers ?? []).length === 0) {
     throw new Error("Blocked cases require at least one blocker");
@@ -370,13 +389,10 @@ function validateCase(record: CaseRecord): void {
       "Killed cases require evidence, next step, blockers, or assumptions explaining why",
     );
   }
-  if (
-    record.status === "reported" &&
-    !record.poc &&
-    !record.remediation &&
-    (record.references ?? []).length === 0
-  ) {
-    throw new Error("Reported cases require poc, remediation, or references");
+  // A case becomes REPORTED only via CaseReport, which records reportPath. Require it
+  // here so validation stays consistent with the confirmed→reported transition gate.
+  if (record.status === "reported" && !record.reportPath) {
+    throw new Error("Reported cases require a generated report (run CaseReport first)");
   }
 }
 
@@ -810,57 +826,138 @@ export function unlinkCasesResult(sourceId: string, targetId: string): CaseLinkR
 
 // ── Search & Queries ─────────────────────────────────────────────────
 
-function caseHaystack(record: CaseRecord, field?: CaseSearchField): string {
-  if (field) {
-    const val = record[field];
-    if (Array.isArray(val)) return val.join(" ").toLowerCase();
-    return (typeof val === "string" ? val : String(val ?? "")).toLowerCase();
+// Searchable text columns (excludes ids/timestamps/JSON arrays for performance + signal).
+const SEARCH_COLUMNS = [
+  "title",
+  "summary",
+  "evidence",
+  "impact",
+  "target",
+  "endpoint",
+  "bugClass",
+  "poc",
+] as const;
+
+const FIELD_COLUMN: Record<CaseSearchField, string> = {
+  title: "title",
+  summary: "summary",
+  evidence: "evidence",
+  impact: "impact",
+  target: "target",
+  endpoint: "endpoint",
+  bugClass: "bugClass",
+  poc: "poc",
+};
+
+function severityRank(s: CaseSeverity): number {
+  return SEVERITY_VALUES.indexOf(s);
+}
+
+/**
+ * Build a parameterized WHERE clause + params for case queries. Pushes all
+ * structured filters (and free-text) into SQL so we never load the whole ledger
+ * into memory just to filter it in JS. Also returns a stable ORDER BY that keeps
+ * the original status precedence (hypothesis first) with updated_at as tiebreak.
+ */
+function buildCaseWhere(options: CaseSearchOptions): {
+  whereSql: string;
+  orderSql: string;
+  params: unknown[];
+} {
+  const where: string[] = [];
+  const params: unknown[] = [];
+
+  if (options.status) {
+    where.push("status = ?");
+    params.push(options.status);
   }
-  return Object.entries(record)
-    .filter(([k]) => !["id", "createdAt", "updatedAt", "reportedAt", "reportPath"].includes(k))
-    .map(([, v]) => (Array.isArray(v) ? v.join(" ") : String(v ?? "")))
-    .filter(Boolean)
-    .join("\n")
-    .toLowerCase();
+  if (options.confidence) {
+    where.push("confidence = ?");
+    params.push(options.confidence);
+  }
+  if (options.severity) {
+    where.push("severity = ?");
+    params.push(options.severity);
+  }
+  if (options.minSeverity) {
+    where.push(
+      "severity IS NOT NULL AND (CASE severity WHEN 'info' THEN 0 WHEN 'low' THEN 1 WHEN 'medium' THEN 2 WHEN 'high' THEN 3 WHEN 'critical' THEN 4 ELSE -1 END) >= ?",
+    );
+    params.push(severityRank(options.minSeverity));
+  }
+  if (options.priority) {
+    where.push("priority = ?");
+    params.push(options.priority);
+  }
+  if (options.tag) {
+    where.push("EXISTS (SELECT 1 FROM json_each(tags_json) WHERE lower(value) = ?)");
+    params.push(options.tag.trim().toLowerCase());
+  }
+  if (options.since) {
+    where.push("created_at >= ?");
+    params.push(options.since);
+  }
+  if (options.until) {
+    where.push("created_at <= ?");
+    params.push(options.until);
+  }
+
+  const query = options.query?.trim().toLowerCase();
+  if (query) {
+    const likeParam = `%${query}%`;
+    if (options.field) {
+      where.push(`lower(${FIELD_COLUMN[options.field]}) LIKE ?`);
+      params.push(likeParam);
+    } else {
+      const ors = SEARCH_COLUMNS.map((c) => `lower(${c}) LIKE ?`).join(" OR ");
+      where.push(`(${ors})`);
+      for (let i = 0; i < SEARCH_COLUMNS.length; i++) params.push(likeParam);
+    }
+  }
+
+  const orderSql =
+    "CASE status WHEN 'hypothesis' THEN 0 WHEN 'investigating' THEN 1 WHEN 'confirmed' THEN 2 " +
+    "WHEN 'blocked' THEN 3 WHEN 'killed' THEN 4 WHEN 'reported' THEN 5 ELSE 6 END, updated_at DESC";
+
+  return {
+    whereSql: where.length ? `WHERE ${where.join(" AND ")}` : "",
+    orderSql,
+    params,
+  };
+}
+
+/** Map DB rows to CaseRecords, attaching linkedCaseIds fetched in a single batch. */
+function mapRowsWithLinks(db: DatabaseSync, rows: any[]): CaseRecord[] {
+  if (rows.length === 0) return [];
+  const ids = rows.map((r) => r.id);
+  const placeholders = ids.map(() => "?").join(",");
+  const links = db
+    .prepare(`SELECT source_id, target_id FROM case_links WHERE source_id IN (${placeholders})`)
+    .all(...ids) as { source_id: string; target_id: string }[];
+  const linkMap = new Map<string, string[]>();
+  for (const l of links) {
+    if (!linkMap.has(l.source_id)) linkMap.set(l.source_id, []);
+    linkMap.get(l.source_id)!.push(l.target_id);
+  }
+  return rows.map((row) => mapRow(row, linkMap.get(row.id) ?? []));
 }
 
 export function searchCases(options: CaseSearchOptions = {}): {
   cases: CaseRecord[];
   total: number;
 } {
-  const query = options.query?.trim().toLowerCase();
-  const field = options.field;
-  const tag = options.tag?.trim().toLowerCase();
+  const db = getDb();
   const limit = Math.max(1, Math.min(options.limit ?? 50, 200));
   const offset = Math.max(0, options.offset ?? 0);
 
-  const STATUS_ORDER: CaseStatus[] = [
-    "hypothesis",
-    "investigating",
-    "confirmed",
-    "blocked",
-    "killed",
-    "reported",
-  ];
-
-  const filtered = readCasefile()
-    .filter((r) => !options.status || r.status === options.status)
-    .filter((r) => !options.confidence || r.confidence === options.confidence)
-    .filter((r) => !options.severity || r.severity === options.severity)
-    .filter((r) => !options.priority || r.priority === options.priority)
-    .filter((r) => !tag || r.tags?.some((t) => t.toLowerCase() === tag))
-    .filter((r) => !query || caseHaystack(r, field).includes(query))
-    .sort((a, b) => {
-      const aStatus = STATUS_ORDER.indexOf(a.status);
-      const bStatus = STATUS_ORDER.indexOf(b.status);
-      if (aStatus !== bStatus) return aStatus - bStatus;
-      return b.updatedAt.localeCompare(a.updatedAt);
-    });
+  const { whereSql, orderSql, params } = buildCaseWhere(options);
 
-  return {
-    total: filtered.length,
-    cases: filtered.slice(offset, offset + limit),
-  };
+  const total = (db.prepare(`SELECT COUNT(*) as c FROM cases ${whereSql}`).get(...params) as any).c;
+  const rows = db
+    .prepare(`SELECT * FROM cases ${whereSql} ORDER BY ${orderSql} LIMIT ? OFFSET ?`)
+    .all(...params, limit, offset) as any[];
+
+  return { total, cases: mapRowsWithLinks(db, rows) };
 }
 
 export function countCases(): {
@@ -868,14 +965,22 @@ export function countCases(): {
   byStatus: Record<string, number>;
   bySeverity: Record<string, number>;
 } {
-  const records = readCasefile();
+  const db = getDb();
+  const total = (db.prepare("SELECT COUNT(*) as c FROM cases").get() as any).c;
+  const statusRows = db
+    .prepare("SELECT status, COUNT(*) as n FROM cases GROUP BY status")
+    .all() as { status: string; n: number }[];
+  const severityRows = db
+    .prepare(
+      "SELECT severity, COUNT(*) as n FROM cases WHERE severity IS NOT NULL GROUP BY severity",
+    )
+    .all() as { severity: string; n: number }[];
+
   const byStatus: Record<string, number> = {};
   const bySeverity: Record<string, number> = {};
-  for (const r of records) {
-    byStatus[r.status] = (byStatus[r.status] ?? 0) + 1;
-    if (r.severity) bySeverity[r.severity] = (bySeverity[r.severity] ?? 0) + 1;
-  }
-  return { total: records.length, byStatus, bySeverity };
+  for (const r of statusRows) byStatus[r.status] = r.n;
+  for (const r of severityRows) bySeverity[r.severity] = r.n;
+  return { total, byStatus, bySeverity };
 }
 
 // ── Format helpers ───────────────────────────────────────────────────

package/src/poc-runner.ts

@@ -239,6 +239,12 @@ function buildDockerArgs(image: string, command: string, workspaceDir: string):
     "no-new-privileges",
     "--user",
     "1000:1000",
+    "--memory",
+    "256m",
+    "--pids-limit",
+    "128",
+    "--cpus",
+    "1.0",
     "-v",
     `${workspaceDir}:/workspace:rw`,
     image,
@@ -260,6 +266,27 @@ function renderCommand(template: string, pocPath: string, inSandbox: boolean): s
     .replace(/{{class}}/g, className);
 }
 
+/**
+ * Translate a spawnSync result into a robust exit code.
+ *
+ * `spawnSync` returns `status: null` AND `signal: null` when it cannot even start
+ * the child (e.g. the binary is missing → ENOENT, or the docker daemon is
+ * unavailable). The previous `result.status ?? (result.signal ? 1 : 0)` then
+ * collapsed to `0`, making a never-executed PoC look successful — which let
+ * PromoteFinding promote an investigating case to CONFIRMED without the PoC
+ * ever running. We fail closed: a spawn error or a missing status/signal is
+ * always a non-zero exit.
+ */
+function spawnExitCode(result: {
+  status: number | null;
+  signal: string | null;
+  error?: Error;
+}): number {
+  if (result.error) return 127;
+  if (result.status !== null) return result.status;
+  return 1;
+}
+
 function runSandboxed(pocPath: string, language: PocLanguage): PocRun {
   const ranAt = new Date().toISOString();
   const sourceName = basename(pocPath);
@@ -283,10 +310,11 @@ function runSandboxed(pocPath: string, language: PocLanguage): PocRun {
       maxBuffer: MAX_BUFFER,
     });
 
-    const output = sanitizeOutput((result.stdout ?? "") + (result.stderr ?? ""));
+    const spawnErr = result.error ? `\n[spawn error] ${result.error.message}` : "";
+    const output = sanitizeOutput((result.stdout ?? "") + (result.stderr ?? "") + spawnErr);
     return {
       path: pocPath,
-      exitCode: result.status ?? (result.signal ? 1 : 0),
+      exitCode: spawnExitCode(result),
       output,
       ranAt,
       sandbox: true,
@@ -314,11 +342,15 @@ function runLocal(pocPath: string, language: PocLanguage): PocRun {
     throw new Error("Language config has no run command");
   }
 
-  // For local execution, split the run command into binary and args.
+  // The run template is `<interpreter> <file>`. Preserve multi-arg run commands for
+  // normal paths, but keep a space-containing PoC path as a single argument (no shell
+  // is used, so args are passed verbatim).
   const command = renderCommand(language.run, pocPath, false);
-  const [interpreter, ...args] = command.split(" ");
-  // Note: the file path is already substituted in the args if {{file}} was used.
-  // We just need to spawn.
+  const trimmed = command.trim();
+  const firstSpace = trimmed.indexOf(" ");
+  const interpreter = firstSpace === -1 ? trimmed : trimmed.slice(0, firstSpace);
+  const rest = firstSpace === -1 ? "" : trimmed.slice(firstSpace + 1);
+  const args = pocPath.includes(" ") ? (rest ? [rest] : []) : rest ? rest.split(" ") : [];
 
   const result = spawnSync(interpreter, args, {
     encoding: "utf8",
@@ -326,10 +358,11 @@ function runLocal(pocPath: string, language: PocLanguage): PocRun {
     maxBuffer: MAX_BUFFER,
   });
 
-  const output = sanitizeOutput((result.stdout ?? "") + (result.stderr ?? ""));
+  const spawnErr = result.error ? `\n[spawn error] ${result.error.message}` : "";
+  const output = sanitizeOutput((result.stdout ?? "") + (result.stderr ?? "") + spawnErr);
   return {
     path: pocPath,
-    exitCode: result.status ?? (result.signal ? 1 : 0),
+    exitCode: spawnExitCode(result),
     output,
     ranAt,
     sandbox: false,

package/src/sqlite-compat/index.ts

@@ -8,8 +8,15 @@ try {
   // biome-ignore lint/suspicious/noExplicitAny: Runtime module swappability
   DatabaseSyncConstructor = _require("bun:sqlite").Database as any;
 } catch {
-  // biome-ignore lint/suspicious/noExplicitAny: Runtime module swappability
-  DatabaseSyncConstructor = (_require("node:sqlite") as any).DatabaseSync;
+  try {
+    // biome-ignore lint/suspicious/noExplicitAny: Runtime module swappability
+    DatabaseSyncConstructor = (_require("node:sqlite") as any).DatabaseSync;
+  } catch (e) {
+    throw new Error(
+      "XPI requires bun:sqlite (Bun runtime) or node:sqlite (Node >= 22.5). " +
+        `Neither SQLite backend is available: ${(e as Error).message}`,
+    );
+  }
 }
 
 // biome-ignore lint/suspicious/noExplicitAny: Standard SQLite API returns any