@xaccefy/pi-casefile 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xaccefy/pi-casefile",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits",
   "keywords": [
     "pi-package",

package/skills/casefile/SKILL.md

@@ -13,11 +13,23 @@ Use Casefile to maintain durable security investigation state across agent turns
 1. Check existing cases before opening a new one with CaseList or CaseSearch.
 2. Open new leads with CaseAdd as `hypothesis` or `investigating`.
 3. Promote cases with CaseUpdate only after materially new evidence, proof, impact, blockers, remediation, or status changes.
-4. Mark `confirmed` only when evidence and a PoC or repro are recorded.
+4. Mark `confirmed` only via PromoteFinding after a real PoC exit 0 (evidence, impact, severity, poc required).
 5. Use CaseLink and CaseUnlink for exploit chains. Do not edit linked case IDs directly.
-6. Use CaseReport only for confirmed or already reported cases.
+6. Use CaseReport only for confirmed or already reported cases, then CaseUpdate status=`reported`.
 7. Use `killed` for disproven, duplicate, or dead-end leads, and include evidence, blockers, next step, or assumptions explaining why.
 
+## State machine
+
+```
+hypothesis → investigating → confirmed → reported
+                 ↓               ↓
+              blocked         killed (terminal)
+```
+
+- investigating requires evidence + confidence
+- confirmed requires PromoteFinding (not CaseUpdate)
+- killed/reported are terminal (no field edits or re-links)
+
 ## Tool Map
 
 - `CaseAdd`: create a new case.

package/src/index.ts

@@ -3,7 +3,7 @@
  *
  * Tools: CaseAdd, CaseUpdate, PromoteFinding, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseReport
  * Command: /casefile — interactive dashboard
- * Event: before_agent_start — injects case summary context into the system prompt
+ * Event: before_agent_start — injects cyber workflow (+ active case list) once per user prompt
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
@@ -122,8 +122,15 @@ const ListSchema = Type.Object(
     status: Type.Optional(CaseStatusSchema),
     confidence: Type.Optional(CaseConfidenceSchema),
     severity: Type.Optional(CaseSeveritySchema),
+    minSeverity: Type.Optional(CaseSeveritySchema),
     priority: Type.Optional(CasePrioritySchema),
     tag: Type.Optional(Type.String({ description: "Filter by tag" })),
+    since: Type.Optional(
+      Type.String({ description: "ISO timestamp; only cases created at/after this time" }),
+    ),
+    until: Type.Optional(
+      Type.String({ description: "ISO timestamp; only cases created at/before this time" }),
+    ),
     limit: Type.Optional(Type.Number({ description: "Max results (default 50)" })),
     offset: Type.Optional(Type.Number({ description: "Skip N results for pagination" })),
   },
@@ -146,8 +153,15 @@ const SearchSchema = Type.Object(
     status: Type.Optional(CaseStatusSchema),
     confidence: Type.Optional(CaseConfidenceSchema),
     severity: Type.Optional(CaseSeveritySchema),
+    minSeverity: Type.Optional(CaseSeveritySchema),
     priority: Type.Optional(CasePrioritySchema),
-    tag: Type.Optional(Type.String()),
+    tag: Type.Optional(Type.String({ description: "Filter by tag" })),
+    since: Type.Optional(
+      Type.String({ description: "ISO timestamp; only cases created at/after this time" }),
+    ),
+    until: Type.Optional(
+      Type.String({ description: "ISO timestamp; only cases created at/before this time" }),
+    ),
     limit: Type.Optional(Type.Number()),
     offset: Type.Optional(Type.Number()),
   },
@@ -310,11 +324,20 @@ class CasefileDashboard {
 }
 
 // ── Context injection ─────────────────────────────────────────────────
+// Injected once per user prompt via before_agent_start (not every tool turn).
+// Skills are opt-in; this keeps bounty discipline always present even with an empty ledger.
 
 const STATIC_CYBER_WORKFLOW = `
-# Cyber Workflow
+# Cyber Workflow (Attacker-Oriented)
+
+Think like a real external attacker, not a code reviewer. Technical bugs are cheap; **reachable attacker impact** is what matters for bounty-valid findings.
 
-Every finding starts HYPOTHESIS. Nothing reaches CONFIRMED without a working PoC on disk. Optimize for correctness over novelty. Prefer rejecting a real bug temporarily rather than reporting a false positive. Every confirmed finding must survive skeptical review by another experienced security researcher.
+Every lead starts HYPOTHESIS. Nothing reaches CONFIRMED without:
+1. a working PoC on disk,
+2. a proven attacker path (who can trigger it, from where),
+3. demonstrated C/I/A impact (not theoretical).
+
+Prefer killing a cute-but-unusable bug over reporting noise. Every confirmed finding must survive skeptical review by another experienced security researcher **and** a program triage engineer.
 
 ## State Machine (CaseAdd → CaseUpdate → CaseReport)
 
@@ -329,96 +352,147 @@ HYPOTHESIS ──→ INVESTIGATING ──→ CONFIRMED ──→ REPORTED
 
 | Advance To | Required Case Fields | Must Exist on Disk |
 |-----------|---------------------|--------------------|
-| INVESTIGATING | \`evidence\` (source→sink trace), \`confidence\` | Path trace in notes |
-| **CONFIRMED** | \`evidence\`, **\`poc\`**, \`impact\`, \`severity\`, **\`impact_proof\`** | **PoC script + run.log with exit code 0, impact evidence on disk** |
-| KILLED | \`assumptions\` (why it died) | — |
+| INVESTIGATING | \`evidence\` (source→sink + **attacker reachability**), \`confidence\` | Path trace in notes |
+| **CONFIRMED** | \`evidence\`, **\`poc\`**, \`impact\` (attacker-real), \`severity\`, **\`impact_proof\`** | **PoC script + run.log exit 0 + proof of impact** |
+| KILLED | \`assumptions\` (why it died: no path / no impact / not applicable) | — |
 | REPORTED | Only after \`CaseReport(id)\` succeeds | Report file |
 
 **Rule: If a required field is empty, you cannot advance.** \`CaseUpdate({status:"confirmed", poc:""})\` is invalid. The fields are the gates.
 
 ---
 
-## 1. Evidence-First Doctrine (Highest Priority)
+## 0. Attacker Model (Read First)
+
+Before escalating any finding, answer in evidence:
+
+1. **Who is the attacker?** (unauth internet, low-priv user, tenant peer, SSRF pivot, etc.)
+2. **What can they already do without the bug?** (baseline privileges)
+3. **What extra power does the bug grant beyond that baseline?**
+4. **Is the path realistic in production?** (auth, CSRF, WAF, network, feature flags, admin-only)
+
+If you cannot name a concrete attacker who gains something they should not have → do **not** confirm. Keep as hypothesis/investigating, or kill as \`insufficient_impact\` / \`environmental_issue\`.
+
+**Non-applicable / weak-impact defaults (KILL or do not promote):**
+- Self-XSS / self-DoS only (attacker harms only their own session/account)
+- Requires admin/root/already-trusted role that already has the same power
+- Local-only, offline, or impossible deployment assumptions
+- Spec-compliant / documented intentional behavior
+- Needs physical access, victim to paste payload into their own console, or other social-engineering-only steps with no trust-boundary break
+- "Interesting" logic quirks with **no confidentiality, integrity, availability, or financial effect**
+- PoC proves a code path exists but **not** that a real victim asset is affected
+
+Technical validity ≠ bounty validity. A true bug with no attacker-usable impact is still a kill for confirmed/report.
+
+---
+
+## 1. Evidence-First Doctrine
 Evidence overrides intuition. Never present speculation as fact. Every security claim must be traceable to:
 - Observed behavior (logs, responses, error traces)
 - Reproduced behavior (exact steps, scripts)
 - Source code / protocol analysis
 - Documented platform behavior
-If evidence is insufficient: explicitly state uncertainty, propose the next experiment, and do not escalate the finding. Produce the strongest conclusion supported by available evidence; never assume success where verification is incomplete.
+If evidence is insufficient: state uncertainty, propose the next experiment, do not escalate. Never assume success where verification is incomplete.
+
+---
+
+## 2. Impact Gate (Mandatory Before CONFIRMED)
+
+Prove at least **one** real attacker-facing violation:
+
+| Category | Required proof |
+|----------|----------------|
+| **Confidentiality** | Attacker reads data they must not see (other users/tenants/secrets) |
+| **Integrity** | Attacker changes data/state they must not control |
+| **Availability** | Attacker degrades service for **others** (not only self) |
+| **Financial / authz** | Direct money, privilege, or account takeover path |
+
+Impact text must answer: *who is hurt, what is lost, how the attacker reaches it.*  
+Vague impact like "could be dangerous" or "may lead to RCE" without a path is not impact_proof.
+
+If impact is only theoretical, needs a second unproven bug, or is not yet capable from the attacker's seat → stay INVESTIGATING (chain it) or KILL \`insufficient_impact\`. Do **not** confirm "valid but non-applicable" findings.
 
 ---
 
-## 2. Adversarial Self-Review (Mandatory Before CONFIRMED)
-Before confirming any vulnerability, argue against yourself:
-1. Explain why this might NOT be a vulnerability (e.g. intended behavior, sandbox limit, misconfiguration).
-2. List alternative explanations for the observed behavior.
-3. Explain why each alternative was rejected.
-4. Describe what specific evidence disproves those alternatives.
+## 3. Adversarial Self-Review (Mandatory Before CONFIRMED)
+Argue against yourself:
+1. Why this might NOT be a vulnerability (intended, sandbox, misconfig, already authorized).
+2. Alternative explanations for the observation.
+3. Why each alternative was rejected **with evidence**.
+4. What blocks a real attacker today (auth, CSRF, network, role checks) and whether each is bypassed.
+5. Would a program triage say "informative / N/A" because impact is self-only or privileged-only?
 
 ---
 
-## 3. False Positive Audit Checklist
-Attempt to falsify the finding. Immediately KILL the case if any of the following apply:
-- The behavior matches intended or documented specs.
-- The issue is caused by browser quirks, testing mistakes, or cache artifacts.
-- Framework/middleware protections render it unexploitable in production.
-- Environmental limitations prevent crossing a security boundary.
+## 4. False Positive / Non-Applicable Kill Checklist
+KILL immediately when any apply:
+- Matches documented/spec behavior (\`intended_behavior\`)
+- Browser quirk, test artifact, or cache noise
+- Framework/middleware/WAF blocks the path and is not bypassed (\`framework_protection\`)
+- Requires privileges the attacker already has or cannot obtain (\`environmental_issue\`)
+- No C/I/A/financial effect for anyone but the attacker themselves (\`insufficient_impact\`)
+- Exploit unreliable / not reproducible twice (\`exploit_unreliable\`)
+- Duplicate of an existing case (\`duplicate\`)
 
 ---
 
-## 4. Root Cause Before Impact
-Do not map "Behavior → Impact". You must trace:
+## 5. Root Cause → Boundary → Impact (Not Behavior → Hype)
+Trace:
 \`\`\`
-Observed Behavior ──→ Root Cause ──→ Security Boundary Broken ──→ Actual Impact
+Entry (attacker-controlled) ──→ Reachable code path ──→ Trust boundary crossed ──→ Victim impact
 \`\`\`
-- Minimum confirmation: Must reproduce successfully at least twice or via two independent methods.
-- Document case details structured as: **Observed Facts**, **Assumptions**, **Unknowns**, **Experiments Remaining**.
+- Minimum: reproduce successfully at least twice or via two independent methods.
+- Record: **Observed Facts**, **Assumptions**, **Unknowns**, **Experiments Remaining**.
+- If the bug is only a **primitive** (e.g. open redirect, limited SSRF, info leak of non-sensitive data), either chain to high impact or keep severity honest — do not inflate.
 
 ---
 
-## 5. Duplicate Check
-Before creating any new case, ask:
-- Is this actually new?
-- Could it be another manifestation of an existing case?
-- Do multiple endpoints share the same underlying root cause?
-Keep the database clean; consolidate related endpoints into single root-cause cases.
+## 6. Duplicate Check
+Before CaseAdd:
+- Is this new?
+- Same root cause as an open case?
+- Multiple endpoints, one bug?
+Continue the existing case ID when scope matches.
 
 ---
 
-## 6. Report-Readiness Gate
-Before marking Ready for Report:
-- Can another researcher reproduce this deterministically?
-- Are the steps completely reproducible?
-- Is the impact justified without inflating severity? (Would the vendor agree with this impact? Is a real trust boundary crossed?)
-- Are exact root causes and remedial code changes detailed?
+## 7. Report-Readiness Gate
+Before REPORTED:
+- Another researcher can reproduce deterministically
+- Steps are complete and production-realistic
+- Impact is justified without inflation (would the vendor agree?)
+- Root cause and fix guidance are concrete
+- Attacker model + victim impact are explicit in the write-up
 
 ---
 
-## 7. Permanent KILLED Case Cataloging
-Keep killed cases documented with a clear classification in the ledger:
+## 8. Permanent KILLED Cataloging
+Keep killed reasons explicit in assumptions/blockers:
 - \`intended_behavior\`
 - \`duplicate\`
 - \`framework_protection\`
 - \`exploit_unreliable\`
 - \`insufficient_impact\`
 - \`environmental_issue\`
-Documenting why ideas were rejected prevents revisiting the same dead ends.
-`;
+- \`not_applicable\` (true bug / interesting behavior, no realistic attacker value)
+Documenting kills prevents re-opening dead ends.
+`.trim();
+
+function sanitizeContextText(v?: string, max = 160): string | undefined {
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: strip C0 controls from untrusted case text
+  const controlChars = /[\r\n\t\u0000-\u001F\u007F\u2028\u2029]+/g;
+  const s = v
+    ?.replace(controlChars, " ")
+    .replace(/[<>]/g, (c) => (c === "<" ? "‹" : "›"))
+    .replace(/([\\`*_{}[\]()#+\-.!])/g, "\\$1")
+    .replace(/\s+/g, " ")
+    .trim();
+  return s ? (s.length > max ? `${s.slice(0, max - 1)}…` : s) : undefined;
+}
 
-function buildCaseContext(records: CaseRecord[]): string {
+/** Active-case ledger summary only (no workflow). Empty when nothing is open. */
+function buildCaseListContext(records: CaseRecord[]): string {
   if (records.length === 0) return "";
 
-  const safe = (v?: string, max = 160) => {
-    const controlChars = /[\r\n\t\u0000-\u001F\u007F\u2028\u2029]+/g;
-    const s = v
-      ?.replace(controlChars, " ")
-      .replace(/[<>]/g, (c) => (c === "<" ? "‹" : "›"))
-      .replace(/([\\`*_{}[\]()#+\-.!])/g, "\\$1")
-      .replace(/\s+/g, " ")
-      .trim();
-    return s ? (s.length > max ? `${s.slice(0, max - 1)}…` : s) : undefined;
-  };
-
   const count = (s: string) => records.filter((r) => r.status === s).length;
   const lines: string[] = [
     "<casefile_context>",
@@ -440,9 +514,11 @@ function buildCaseContext(records: CaseRecord[]): string {
     if (!subset.length) continue;
     lines.push(`  ${label}:`);
     for (const c of subset) {
-      const n = safe(c.nextStep, 180);
+      const n = sanitizeContextText(c.nextStep, 180);
       const extra = status === "confirmed" ? ` [${c.severity ?? "?"}]` : "";
-      lines.push(`  - ${c.id}: ${safe(c.title, 140) ?? "(untitled)"}${extra}${n ? ` → ${n}` : ""}`);
+      lines.push(
+        `  - ${c.id}: ${sanitizeContextText(c.title, 140) ?? "(untitled)"}${extra}${n ? ` → ${n}` : ""}`,
+      );
     }
   }
 
@@ -450,16 +526,22 @@ function buildCaseContext(records: CaseRecord[]): string {
   if (highPrio.length > 0) {
     lines.push("  High priority:");
     for (const c of highPrio) {
-      lines.push(`  - ${c.id}: ${safe(c.title, 140) ?? "(untitled)"} [${c.priority}]`);
+      lines.push(
+        `  - ${c.id}: ${sanitizeContextText(c.title, 140) ?? "(untitled)"} [${c.priority}]`,
+      );
     }
   }
 
   lines.push("</casefile_context>");
-  lines.push(STATIC_CYBER_WORKFLOW);
-
   return lines.join("\n");
 }
 
+/** Always includes cyber workflow; attaches case list when active cases exist. */
+function buildAgentInjection(active: CaseRecord[]): string {
+  const caseList = buildCaseListContext(active);
+  return caseList ? `${caseList}\n\n${STATIC_CYBER_WORKFLOW}` : STATIC_CYBER_WORKFLOW;
+}
+
 // ── Main extension ────────────────────────────────────────────────────
 
 export default function casefileExtension(pi: ExtensionAPI) {
@@ -636,6 +718,22 @@ export default function casefileExtension(pi: ExtensionAPI) {
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
       const run = runPoc(params.poc_path as string, params.local !== true);
+
+      // Fail closed without throwing: non-zero PoC must leave the case investigating.
+      if (run.exitCode !== 0) {
+        const record = getCaseById(params.id as string);
+        return {
+          content: [
+            {
+              type: "text",
+              text: `PoC failed (exit ${run.exitCode}). Case remains investigating.\nOutput:\n${run.output}`,
+            },
+          ],
+          isError: true,
+          details: { record, run },
+        };
+      }
+
       const result = promoteFindingResult(params.id as string, {
         path: run.path,
         exitCode: run.exitCode,
@@ -648,10 +746,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
         content: [
           {
             type: "text",
-            text:
-              run.exitCode === 0
-                ? `PoC verified (exit ${run.exitCode}). Case promoted to confirmed:\n${formatCaseDetail(record)}`
-                : `PoC failed (exit ${run.exitCode}). Case remains investigating.\nOutput:\n${run.output}`,
+            text: `PoC verified (exit ${run.exitCode}). Case promoted to confirmed:\n${formatCaseDetail(record)}`,
           },
         ],
         details: { record, run },
@@ -725,8 +820,11 @@ export default function casefileExtension(pi: ExtensionAPI) {
         status: params.status as CaseStatus | undefined,
         confidence: params.confidence as CaseConfidence | undefined,
         severity: params.severity as CaseSeverity | undefined,
+        minSeverity: params.minSeverity as CaseSeverity | undefined,
         priority: params.priority as CasePriority | undefined,
         tag: params.tag,
+        since: params.since as string | undefined,
+        until: params.until as string | undefined,
         limit: params.limit,
         offset: params.offset,
       });
@@ -772,8 +870,11 @@ export default function casefileExtension(pi: ExtensionAPI) {
         status: params.status as CaseStatus | undefined,
         confidence: params.confidence as CaseConfidence | undefined,
         severity: params.severity as CaseSeverity | undefined,
+        minSeverity: params.minSeverity as CaseSeverity | undefined,
         priority: params.priority as CasePriority | undefined,
         tag: params.tag,
+        since: params.since as string | undefined,
+        until: params.until as string | undefined,
         limit: params.limit,
         offset: params.offset,
       });
@@ -1004,22 +1105,23 @@ export default function casefileExtension(pi: ExtensionAPI) {
   // ── Event: Inject context into system prompt ──
 
   pi.on("before_agent_start", async () => {
+    // Once per user prompt (not every tool turn). Always inject workflow so empty
+    // ledgers still get attacker discipline; attach case list only when useful.
+    let active: CaseRecord[] = [];
     try {
       const records = readCasefile();
-      const active = records.filter((r) => r.status !== "killed" && r.status !== "reported");
-      if (active.length === 0) return;
-
-      const caseContext = buildCaseContext(active);
-      return {
-        message: {
-          customType: "casefile_summary",
-          content: caseContext,
-          display: false,
-        },
-      };
+      active = records.filter((r) => r.status !== "killed" && r.status !== "reported");
     } catch {
-      // No database yet
+      // No database yet — still inject workflow.
     }
+
+    return {
+      message: {
+        customType: "casefile_summary",
+        content: buildAgentInjection(active),
+        display: false,
+      },
+    };
   });
 
   // ── Event: Update status bar ──

package/src/ledger.ts

@@ -141,8 +141,14 @@ export type CaseSearchOptions = {
   status?: CaseStatus;
   confidence?: CaseConfidence;
   severity?: CaseSeverity;
+  /** Return only cases at or above this severity (info < low < medium < high < critical). */
+  minSeverity?: CaseSeverity;
   priority?: CasePriority;
   tag?: string;
+  /** ISO timestamp; only cases created at/after this time. */
+  since?: string;
+  /** ISO timestamp; only cases created at/before this time. */
+  until?: string;
   limit?: number;
   offset?: number;
 };
@@ -190,10 +196,15 @@ export function getCasefilePath(): string {
 }
 
 export function setCasefilePath(path: string | undefined): void {
-  ledgerPathOverride = path;
   if (dbInstance) {
-    dbInstance = undefined; // Force reconnection on next getDb
+    try {
+      dbInstance.close();
+    } catch {
+      // Best-effort close.
+    }
   }
+  ledgerPathOverride = path;
+  dbInstance = undefined; // Force reconnection on next getDb
 }
 
 // ── SQLite Schema Init ────────────────────────────────────────────────
@@ -210,6 +221,9 @@ function getDb(): DatabaseSync {
   }
 
   const db = new DatabaseSync(dbPath);
+  // Enable foreign-key enforcement so ON DELETE CASCADE actually fires
+  // (SQLite keeps FK off by default; bun:sqlite in particular defaults it off).
+  db.exec("PRAGMA foreign_keys = ON");
 
   // Create tables
   db.exec(`
@@ -353,8 +367,13 @@ export function getCaseById(id: string): CaseRecord | undefined {
 
 function validateCase(record: CaseRecord): void {
   if (!record.title.trim()) throw new Error("Case title cannot be empty");
-  if (record.status === "confirmed" && (!record.evidence || !record.poc)) {
-    throw new Error("Confirmed cases require both evidence and poc");
+  // Keep this gate in lockstep with promoteFindingResult: a case may only be
+  // CONFIRMED when it has evidence, a PoC, demonstrated impact, and a severity.
+  if (
+    record.status === "confirmed" &&
+    (!record.evidence || !record.poc || !record.impact || !record.severity)
+  ) {
+    throw new Error("Confirmed cases require evidence, poc, impact, and severity");
   }
   if (record.status === "blocked" && (record.blockers ?? []).length === 0) {
     throw new Error("Blocked cases require at least one blocker");
@@ -370,13 +389,10 @@ function validateCase(record: CaseRecord): void {
       "Killed cases require evidence, next step, blockers, or assumptions explaining why",
     );
   }
-  if (
-    record.status === "reported" &&
-    !record.poc &&
-    !record.remediation &&
-    (record.references ?? []).length === 0
-  ) {
-    throw new Error("Reported cases require poc, remediation, or references");
+  // A case becomes REPORTED only via CaseReport, which records reportPath. Require it
+  // here so validation stays consistent with the confirmed→reported transition gate.
+  if (record.status === "reported" && !record.reportPath) {
+    throw new Error("Reported cases require a generated report (run CaseReport first)");
   }
 }
 
@@ -403,14 +419,21 @@ function validateTransition(
   if (to === "blocked") return;
 
   type Rule = (u: CaseUpdate, current?: CaseRecord) => string | null;
+
+  // Transition rules must consult both the update payload AND the current record.
+  // Agents often promote status alone after evidence was already written in a prior update.
+  const requireInvestigatingFields: Rule = (u, cur) => {
+    // Normalize so whitespace-only evidence cannot satisfy the gate.
+    const evidence = normalizeText(u.evidence ?? cur?.evidence);
+    const confidence = u.confidence ?? cur?.confidence;
+    if (!evidence) return "INVESTIGATING requires evidence (source→sink trace)";
+    if (!confidence) return "INVESTIGATING requires confidence level";
+    return null;
+  };
+
   const transitions: Partial<Record<CaseStatus, Partial<Record<CaseStatus, Rule>>>> = {
     hypothesis: {
-      investigating: (u) =>
-        !u.evidence
-          ? "INVESTIGATING requires evidence (source→sink trace)"
-          : !u.confidence
-            ? "INVESTIGATING requires confidence level"
-            : null,
+      investigating: requireInvestigatingFields,
       confirmed: () => "Cannot jump hypothesis → confirmed; promote to investigating first",
       reported: () => "Cannot jump hypothesis → reported; confirm first",
     },
@@ -427,12 +450,7 @@ function validateTransition(
       investigating: () => null,
     },
     blocked: {
-      investigating: (u) =>
-        !u.evidence
-          ? "INVESTIGATING requires evidence (source→sink trace)"
-          : !u.confidence
-            ? "INVESTIGATING requires confidence level"
-            : null,
+      investigating: requireInvestigatingFields,
       hypothesis: () => null,
     },
   };
@@ -498,7 +516,11 @@ function buildRecord(input: NormalizedCaseInput, existing?: CaseRecord): CaseRec
   };
 }
 
-function findDuplicateCaseInDb(db: DatabaseSync, candidate: CaseRecord): CaseRecord | undefined {
+function findDuplicateCaseInDb(
+  db: DatabaseSync,
+  candidate: Pick<CaseRecord, "title" | "target" | "endpoint" | "bugClass">,
+  excludeId?: string,
+): CaseRecord | undefined {
   const title = normalizeMatchText(candidate.title);
   if (!title) return undefined;
 
@@ -506,9 +528,12 @@ function findDuplicateCaseInDb(db: DatabaseSync, candidate: CaseRecord): CaseRec
   const endpoint = normalizeMatchText(candidate.endpoint);
   const bugClass = normalizeMatchText(candidate.bugClass);
 
-  // We query all cases where status is not killed, then match in JS for normalized forms
-  const stmt = db.prepare("SELECT * FROM cases WHERE status != 'killed'");
-  const rows = stmt.all();
+  // Query non-killed cases, then match normalized title/scope in JS.
+  const rows = excludeId
+    ? (db
+        .prepare("SELECT * FROM cases WHERE status != 'killed' AND id != ?")
+        .all(excludeId) as any[])
+    : (db.prepare("SELECT * FROM cases WHERE status != 'killed'").all() as any[]);
 
   for (const row of rows) {
     if (
@@ -517,9 +542,9 @@ function findDuplicateCaseInDb(db: DatabaseSync, candidate: CaseRecord): CaseRec
       normalizeMatchText(row.endpoint as string) === endpoint &&
       normalizeMatchText(row.bugClass as string) === bugClass
     ) {
-      // Find links
-      const linkStmt = db.prepare("SELECT target_id FROM case_links WHERE source_id = ?");
-      const links = linkStmt.all(row.id) as { target_id: string }[];
+      const links = db
+        .prepare("SELECT target_id FROM case_links WHERE source_id = ?")
+        .all(row.id) as { target_id: string }[];
       return mapRow(
         row,
         links.map((l) => l.target_id),
@@ -531,9 +556,11 @@ function findDuplicateCaseInDb(db: DatabaseSync, candidate: CaseRecord): CaseRec
 
 // ── SQLite Mutation Actions ───────────────────────────────────────────
 
-function insertOrReplaceCase(db: DatabaseSync, record: CaseRecord) {
+function upsertCase(db: DatabaseSync, record: CaseRecord) {
+  // Use ON CONFLICT DO UPDATE (not INSERT OR REPLACE) so FK CASCADE does not
+  // wipe case_links when updating an existing primary key.
   const stmt = db.prepare(`
-    INSERT OR REPLACE INTO cases (
+    INSERT INTO cases (
       id, title, status, confidence, severity, priority, target, endpoint, bugClass,
       summary, evidence, impact, nextStep, poc, remediation,
       references_json, blockers_json, tags_json, assumptions_json, poc_verified_json,
@@ -544,6 +571,30 @@ function insertOrReplaceCase(db: DatabaseSync, record: CaseRecord) {
       ?, ?, ?, ?, ?,
       ?, ?, ?, ?
     )
+    ON CONFLICT(id) DO UPDATE SET
+      title = excluded.title,
+      status = excluded.status,
+      confidence = excluded.confidence,
+      severity = excluded.severity,
+      priority = excluded.priority,
+      target = excluded.target,
+      endpoint = excluded.endpoint,
+      bugClass = excluded.bugClass,
+      summary = excluded.summary,
+      evidence = excluded.evidence,
+      impact = excluded.impact,
+      nextStep = excluded.nextStep,
+      poc = excluded.poc,
+      remediation = excluded.remediation,
+      references_json = excluded.references_json,
+      blockers_json = excluded.blockers_json,
+      tags_json = excluded.tags_json,
+      assumptions_json = excluded.assumptions_json,
+      poc_verified_json = excluded.poc_verified_json,
+      reported_at = excluded.reported_at,
+      report_path = excluded.report_path,
+      created_at = excluded.created_at,
+      updated_at = excluded.updated_at
   `);
 
   stmt.run(
@@ -590,7 +641,7 @@ export function addCaseResult(input: CaseInput): CaseAddResult {
     };
   }
 
-  insertOrReplaceCase(db, record);
+  upsertCase(db, record);
   return { record, created: true };
 }
 
@@ -601,6 +652,16 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
     throw new Error(`Case not found: ${id}`);
   }
 
+  // Terminal states: block all mutations (status and field edits). The transition
+  // gate only runs on status changes, so without this reported/killed cases could
+  // still be rewritten via field-only updates.
+  if (current.status === "killed") {
+    throw new Error("Cannot mutate a killed case; open a new case if the lead is revived");
+  }
+  if (current.status === "reported") {
+    throw new Error("Cannot mutate a reported case; file a follow-up case instead");
+  }
+
   const optionalFields = [
     "title",
     "target",
@@ -620,7 +681,7 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
     }
   }
 
-  const next = buildRecord(
+  let next = buildRecord(
     {
       ...optionalPatch,
       status: update.status ?? current.status,
@@ -638,6 +699,12 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
   if (update.status && update.status !== current.status) {
     validateTransition(current.status, next.status, update, current);
   }
+
+  // Demoting off confirmed invalidates prior PoC verification — re-promote required.
+  if (current.status === "confirmed" && next.status === "investigating") {
+    next = { ...next, pocVerified: undefined };
+  }
+
   validateCase(next);
 
   // Check material equality (we ignore links since links are mutated via CaseLink)
@@ -651,32 +718,7 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
     return { record: current, changed: false, reason };
   }
 
-  // Duplicate checks excluding current
-  const title = normalizeMatchText(next.title);
-  const target = normalizeMatchText(next.target);
-  const endpoint = normalizeMatchText(next.endpoint);
-  const bugClass = normalizeMatchText(next.bugClass);
-
-  const stmt = db.prepare("SELECT * FROM cases WHERE status != 'killed' AND id != ?");
-  const rows = stmt.all(id);
-  let duplicate: CaseRecord | undefined;
-  for (const row of rows) {
-    if (
-      normalizeMatchText(row.title as string) === title &&
-      normalizeMatchText(row.target as string) === target &&
-      normalizeMatchText(row.endpoint as string) === endpoint &&
-      normalizeMatchText(row.bugClass as string) === bugClass
-    ) {
-      const linkStmt = db.prepare("SELECT target_id FROM case_links WHERE source_id = ?");
-      const links = linkStmt.all(row.id) as { target_id: string }[];
-      duplicate = mapRow(
-        row,
-        links.map((l) => l.target_id),
-      );
-      break;
-    }
-  }
-
+  const duplicate = findDuplicateCaseInDb(db, next, id);
   if (duplicate) {
     return {
       record: current,
@@ -685,7 +727,7 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
     };
   }
 
-  insertOrReplaceCase(db, next);
+  upsertCase(db, next);
   return { record: next, changed: true };
 }
 
@@ -741,7 +783,7 @@ export function promoteFindingResult(id: string, verification: PocVerification):
   );
   validateCase(next);
 
-  insertOrReplaceCase(db, next);
+  upsertCase(db, next);
   return { record: next, changed: true };
 }
 
@@ -756,6 +798,12 @@ export function linkCasesResult(sourceId: string, targetId: string): CaseLinkRes
   const target = getCaseById(targetId);
   if (!source) throw new Error(`Case not found: ${sourceId}`);
   if (!target) throw new Error(`Case not found: ${targetId}`);
+  if (source.status === "killed" || source.status === "reported") {
+    throw new Error(`Cannot link terminal case ${sourceId} (${source.status})`);
+  }
+  if (target.status === "killed" || target.status === "reported") {
+    throw new Error(`Cannot link terminal case ${targetId} (${target.status})`);
+  }
 
   const checkStmt = db.prepare("SELECT 1 FROM case_links WHERE source_id = ? AND target_id = ?");
   const exists = checkStmt.get(sourceId, targetId);
@@ -765,14 +813,25 @@ export function linkCasesResult(sourceId: string, targetId: string): CaseLinkRes
   }
 
   // Atomic insert both directions into junction table
-  const linkStmt = db.prepare("INSERT INTO case_links (source_id, target_id) VALUES (?, ?)");
-  linkStmt.run(sourceId, targetId);
-  linkStmt.run(targetId, sourceId);
-
-  const now = new Date().toISOString();
-  const updateTimeStmt = db.prepare("UPDATE cases SET updated_at = ? WHERE id = ?");
-  updateTimeStmt.run(now, sourceId);
-  updateTimeStmt.run(now, targetId);
+  db.exec("BEGIN");
+  try {
+    const linkStmt = db.prepare("INSERT INTO case_links (source_id, target_id) VALUES (?, ?)");
+    linkStmt.run(sourceId, targetId);
+    linkStmt.run(targetId, sourceId);
+
+    const now = new Date().toISOString();
+    const updateTimeStmt = db.prepare("UPDATE cases SET updated_at = ? WHERE id = ?");
+    updateTimeStmt.run(now, sourceId);
+    updateTimeStmt.run(now, targetId);
+    db.exec("COMMIT");
+  } catch (err) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+      // ignore
+    }
+    throw err;
+  }
 
   const finalSource = getCaseById(sourceId)!;
   const finalTarget = getCaseById(targetId)!;
@@ -785,6 +844,12 @@ export function unlinkCasesResult(sourceId: string, targetId: string): CaseLinkR
   const target = getCaseById(targetId);
   if (!source) throw new Error(`Case not found: ${sourceId}`);
   if (!target) throw new Error(`Case not found: ${targetId}`);
+  if (source.status === "killed" || source.status === "reported") {
+    throw new Error(`Cannot unlink terminal case ${sourceId} (${source.status})`);
+  }
+  if (target.status === "killed" || target.status === "reported") {
+    throw new Error(`Cannot unlink terminal case ${targetId} (${target.status})`);
+  }
 
   const checkStmt = db.prepare("SELECT 1 FROM case_links WHERE source_id = ? AND target_id = ?");
   const exists = checkStmt.get(sourceId, targetId);
@@ -793,15 +858,26 @@ export function unlinkCasesResult(sourceId: string, targetId: string): CaseLinkR
     return { source, target, changed: false, reason: "Cases are not linked" };
   }
 
-  const unlinkStmt = db.prepare(
-    "DELETE FROM case_links WHERE (source_id = ? AND target_id = ?) OR (source_id = ? AND target_id = ?)",
-  );
-  unlinkStmt.run(sourceId, targetId, targetId, sourceId);
-
-  const now = new Date().toISOString();
-  const updateTimeStmt = db.prepare("UPDATE cases SET updated_at = ? WHERE id = ?");
-  updateTimeStmt.run(now, sourceId);
-  updateTimeStmt.run(now, targetId);
+  db.exec("BEGIN");
+  try {
+    const unlinkStmt = db.prepare(
+      "DELETE FROM case_links WHERE (source_id = ? AND target_id = ?) OR (source_id = ? AND target_id = ?)",
+    );
+    unlinkStmt.run(sourceId, targetId, targetId, sourceId);
+
+    const now = new Date().toISOString();
+    const updateTimeStmt = db.prepare("UPDATE cases SET updated_at = ? WHERE id = ?");
+    updateTimeStmt.run(now, sourceId);
+    updateTimeStmt.run(now, targetId);
+    db.exec("COMMIT");
+  } catch (err) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+      // ignore
+    }
+    throw err;
+  }
 
   const finalSource = getCaseById(sourceId)!;
   const finalTarget = getCaseById(targetId)!;
@@ -810,57 +886,138 @@ export function unlinkCasesResult(sourceId: string, targetId: string): CaseLinkR
 
 // ── Search & Queries ─────────────────────────────────────────────────
 
-function caseHaystack(record: CaseRecord, field?: CaseSearchField): string {
-  if (field) {
-    const val = record[field];
-    if (Array.isArray(val)) return val.join(" ").toLowerCase();
-    return (typeof val === "string" ? val : String(val ?? "")).toLowerCase();
+// Searchable text columns (excludes ids/timestamps/JSON arrays for performance + signal).
+const SEARCH_COLUMNS = [
+  "title",
+  "summary",
+  "evidence",
+  "impact",
+  "target",
+  "endpoint",
+  "bugClass",
+  "poc",
+] as const;
+
+const FIELD_COLUMN: Record<CaseSearchField, string> = {
+  title: "title",
+  summary: "summary",
+  evidence: "evidence",
+  impact: "impact",
+  target: "target",
+  endpoint: "endpoint",
+  bugClass: "bugClass",
+  poc: "poc",
+};
+
+function severityRank(s: CaseSeverity): number {
+  return SEVERITY_VALUES.indexOf(s);
+}
+
+/**
+ * Build a parameterized WHERE clause + params for case queries. Pushes all
+ * structured filters (and free-text) into SQL so we never load the whole ledger
+ * into memory just to filter it in JS. Also returns a stable ORDER BY that keeps
+ * the original status precedence (hypothesis first) with updated_at as tiebreak.
+ */
+function buildCaseWhere(options: CaseSearchOptions): {
+  whereSql: string;
+  orderSql: string;
+  params: unknown[];
+} {
+  const where: string[] = [];
+  const params: unknown[] = [];
+
+  if (options.status) {
+    where.push("status = ?");
+    params.push(options.status);
   }
-  return Object.entries(record)
-    .filter(([k]) => !["id", "createdAt", "updatedAt", "reportedAt", "reportPath"].includes(k))
-    .map(([, v]) => (Array.isArray(v) ? v.join(" ") : String(v ?? "")))
-    .filter(Boolean)
-    .join("\n")
-    .toLowerCase();
+  if (options.confidence) {
+    where.push("confidence = ?");
+    params.push(options.confidence);
+  }
+  if (options.severity) {
+    where.push("severity = ?");
+    params.push(options.severity);
+  }
+  if (options.minSeverity) {
+    where.push(
+      "severity IS NOT NULL AND (CASE severity WHEN 'info' THEN 0 WHEN 'low' THEN 1 WHEN 'medium' THEN 2 WHEN 'high' THEN 3 WHEN 'critical' THEN 4 ELSE -1 END) >= ?",
+    );
+    params.push(severityRank(options.minSeverity));
+  }
+  if (options.priority) {
+    where.push("priority = ?");
+    params.push(options.priority);
+  }
+  if (options.tag) {
+    where.push("EXISTS (SELECT 1 FROM json_each(tags_json) WHERE lower(value) = ?)");
+    params.push(options.tag.trim().toLowerCase());
+  }
+  if (options.since) {
+    where.push("created_at >= ?");
+    params.push(options.since);
+  }
+  if (options.until) {
+    where.push("created_at <= ?");
+    params.push(options.until);
+  }
+
+  const query = options.query?.trim().toLowerCase();
+  if (query) {
+    const likeParam = `%${query}%`;
+    if (options.field) {
+      where.push(`lower(${FIELD_COLUMN[options.field]}) LIKE ?`);
+      params.push(likeParam);
+    } else {
+      const ors = SEARCH_COLUMNS.map((c) => `lower(${c}) LIKE ?`).join(" OR ");
+      where.push(`(${ors})`);
+      for (let i = 0; i < SEARCH_COLUMNS.length; i++) params.push(likeParam);
+    }
+  }
+
+  const orderSql =
+    "CASE status WHEN 'hypothesis' THEN 0 WHEN 'investigating' THEN 1 WHEN 'confirmed' THEN 2 " +
+    "WHEN 'blocked' THEN 3 WHEN 'killed' THEN 4 WHEN 'reported' THEN 5 ELSE 6 END, updated_at DESC";
+
+  return {
+    whereSql: where.length ? `WHERE ${where.join(" AND ")}` : "",
+    orderSql,
+    params,
+  };
+}
+
+/** Map DB rows to CaseRecords, attaching linkedCaseIds fetched in a single batch. */
+function mapRowsWithLinks(db: DatabaseSync, rows: any[]): CaseRecord[] {
+  if (rows.length === 0) return [];
+  const ids = rows.map((r) => r.id);
+  const placeholders = ids.map(() => "?").join(",");
+  const links = db
+    .prepare(`SELECT source_id, target_id FROM case_links WHERE source_id IN (${placeholders})`)
+    .all(...ids) as { source_id: string; target_id: string }[];
+  const linkMap = new Map<string, string[]>();
+  for (const l of links) {
+    if (!linkMap.has(l.source_id)) linkMap.set(l.source_id, []);
+    linkMap.get(l.source_id)!.push(l.target_id);
+  }
+  return rows.map((row) => mapRow(row, linkMap.get(row.id) ?? []));
 }
 
 export function searchCases(options: CaseSearchOptions = {}): {
   cases: CaseRecord[];
   total: number;
 } {
-  const query = options.query?.trim().toLowerCase();
-  const field = options.field;
-  const tag = options.tag?.trim().toLowerCase();
+  const db = getDb();
   const limit = Math.max(1, Math.min(options.limit ?? 50, 200));
   const offset = Math.max(0, options.offset ?? 0);
 
-  const STATUS_ORDER: CaseStatus[] = [
-    "hypothesis",
-    "investigating",
-    "confirmed",
-    "blocked",
-    "killed",
-    "reported",
-  ];
-
-  const filtered = readCasefile()
-    .filter((r) => !options.status || r.status === options.status)
-    .filter((r) => !options.confidence || r.confidence === options.confidence)
-    .filter((r) => !options.severity || r.severity === options.severity)
-    .filter((r) => !options.priority || r.priority === options.priority)
-    .filter((r) => !tag || r.tags?.some((t) => t.toLowerCase() === tag))
-    .filter((r) => !query || caseHaystack(r, field).includes(query))
-    .sort((a, b) => {
-      const aStatus = STATUS_ORDER.indexOf(a.status);
-      const bStatus = STATUS_ORDER.indexOf(b.status);
-      if (aStatus !== bStatus) return aStatus - bStatus;
-      return b.updatedAt.localeCompare(a.updatedAt);
-    });
+  const { whereSql, orderSql, params } = buildCaseWhere(options);
 
-  return {
-    total: filtered.length,
-    cases: filtered.slice(offset, offset + limit),
-  };
+  const total = (db.prepare(`SELECT COUNT(*) as c FROM cases ${whereSql}`).get(...params) as any).c;
+  const rows = db
+    .prepare(`SELECT * FROM cases ${whereSql} ORDER BY ${orderSql} LIMIT ? OFFSET ?`)
+    .all(...params, limit, offset) as any[];
+
+  return { total, cases: mapRowsWithLinks(db, rows) };
 }
 
 export function countCases(): {
@@ -868,14 +1025,22 @@ export function countCases(): {
   byStatus: Record<string, number>;
   bySeverity: Record<string, number>;
 } {
-  const records = readCasefile();
+  const db = getDb();
+  const total = (db.prepare("SELECT COUNT(*) as c FROM cases").get() as any).c;
+  const statusRows = db
+    .prepare("SELECT status, COUNT(*) as n FROM cases GROUP BY status")
+    .all() as { status: string; n: number }[];
+  const severityRows = db
+    .prepare(
+      "SELECT severity, COUNT(*) as n FROM cases WHERE severity IS NOT NULL GROUP BY severity",
+    )
+    .all() as { severity: string; n: number }[];
+
   const byStatus: Record<string, number> = {};
   const bySeverity: Record<string, number> = {};
-  for (const r of records) {
-    byStatus[r.status] = (byStatus[r.status] ?? 0) + 1;
-    if (r.severity) bySeverity[r.severity] = (bySeverity[r.severity] ?? 0) + 1;
-  }
-  return { total: records.length, byStatus, bySeverity };
+  for (const r of statusRows) byStatus[r.status] = r.n;
+  for (const r of severityRows) bySeverity[r.severity] = r.n;
+  return { total, byStatus, bySeverity };
 }
 
 // ── Format helpers ───────────────────────────────────────────────────
@@ -934,6 +1099,11 @@ export function writeCaseReport(id: string): { path: string; record: CaseRecord
     throw new Error("Case reports require a confirmed or reported case");
   }
 
+  // Reported cases are terminal artifacts — return the existing report path if present.
+  if (current.status === "reported" && current.reportPath && existsSync(current.reportPath)) {
+    return { path: current.reportPath, record: current };
+  }
+
   const db = getDb();
   const dbPath = getCasefilePath();
 
@@ -989,6 +1159,6 @@ export function writeCaseReport(id: string): { path: string; record: CaseRecord
     updatedAt: new Date().toISOString(),
   };
 
-  insertOrReplaceCase(db, next);
+  upsertCase(db, next);
   return { path: reportPath, record: next };
 }

package/src/poc-runner.ts

@@ -1,7 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { copyFileSync, existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 
 export type PocRun = {
   path: string;
@@ -145,18 +145,18 @@ function resolveLanguage(pocPath: string): { key: string; language: PocLanguage
     if (shebangKey) return { key: shebangKey, language: languages[shebangKey] };
   }
 
-  // 2. Project type detection.
+  // 2. Extension-based language (prefer the PoC file itself over ambient project markers).
+  // A .py PoC in a Node monorepo must still run under python, not node.
+  if (extKey && languages[extKey]) {
+    return { key: extKey, language: languages[extKey] };
+  }
+
+  // 3. Project type detection only when the extension is unknown/unmapped.
   const projectType = detectProjectType(languages);
   if (projectType && languages[projectType]) {
-    // If the file extension matches the project type or type has no extension restrictions, use it.
     return { key: projectType, language: languages[projectType] };
   }
 
-  // 3. Extension-based fallback.
-  if (extKey && languages[extKey]) {
-    return { key: extKey, language: languages[extKey] };
-  }
-
   // 4. Unknown extension: allow env override specifying a single language key.
   const envDefault = process.env.PI_POC_DEFAULT_LANGUAGE?.trim();
   if (envDefault && languages[envDefault]) {
@@ -186,13 +186,12 @@ function validatePocPath(pocPath: string): string {
     throw new Error("PoC path contains null bytes");
   }
 
-  const parts = normalized.split(/[\\/]/);
-  if (parts.includes("..")) {
-    throw new Error(`PoC path contains traversal segments: ${pocPath}`);
-  }
-
   const root = getProjectRoot();
-  if (!normalized.startsWith(`${root}/`) && normalized !== root) {
+  // Use path.relative so prefix-sibling escapes like /tmp/proj vs /tmp/proj-evil are rejected.
+  // startsWith(`${root}/`) would accept /tmp/proj-evil when root is /tmp/proj.
+  const rel = relative(root, normalized);
+  const outsideWorkspace = rel === "" ? false : rel.startsWith("..") || isAbsolute(rel);
+  if (outsideWorkspace) {
     const allowAbsolute = process.env.PI_POC_ALLOW_ABSOLUTE === "1";
     if (!allowAbsolute) {
       throw new Error(
@@ -239,6 +238,12 @@ function buildDockerArgs(image: string, command: string, workspaceDir: string):
     "no-new-privileges",
     "--user",
     "1000:1000",
+    "--memory",
+    "256m",
+    "--pids-limit",
+    "128",
+    "--cpus",
+    "1.0",
     "-v",
     `${workspaceDir}:/workspace:rw`,
     image,
@@ -260,6 +265,27 @@ function renderCommand(template: string, pocPath: string, inSandbox: boolean): s
     .replace(/{{class}}/g, className);
 }
 
+/**
+ * Translate a spawnSync result into a robust exit code.
+ *
+ * `spawnSync` returns `status: null` AND `signal: null` when it cannot even start
+ * the child (e.g. the binary is missing → ENOENT, or the docker daemon is
+ * unavailable). The previous `result.status ?? (result.signal ? 1 : 0)` then
+ * collapsed to `0`, making a never-executed PoC look successful — which let
+ * PromoteFinding promote an investigating case to CONFIRMED without the PoC
+ * ever running. We fail closed: a spawn error or a missing status/signal is
+ * always a non-zero exit.
+ */
+function spawnExitCode(result: {
+  status: number | null;
+  signal: string | null;
+  error?: Error;
+}): number {
+  if (result.error) return 127;
+  if (result.status !== null) return result.status;
+  return 1;
+}
+
 function runSandboxed(pocPath: string, language: PocLanguage): PocRun {
   const ranAt = new Date().toISOString();
   const sourceName = basename(pocPath);
@@ -283,10 +309,11 @@ function runSandboxed(pocPath: string, language: PocLanguage): PocRun {
       maxBuffer: MAX_BUFFER,
     });
 
-    const output = sanitizeOutput((result.stdout ?? "") + (result.stderr ?? ""));
+    const spawnErr = result.error ? `\n[spawn error] ${result.error.message}` : "";
+    const output = sanitizeOutput((result.stdout ?? "") + (result.stderr ?? "") + spawnErr);
     return {
       path: pocPath,
-      exitCode: result.status ?? (result.signal ? 1 : 0),
+      exitCode: spawnExitCode(result),
       output,
       ranAt,
       sandbox: true,
@@ -314,11 +341,15 @@ function runLocal(pocPath: string, language: PocLanguage): PocRun {
     throw new Error("Language config has no run command");
   }
 
-  // For local execution, split the run command into binary and args.
+  // The run template is `<interpreter> <file>`. Preserve multi-arg run commands for
+  // normal paths, but keep a space-containing PoC path as a single argument (no shell
+  // is used, so args are passed verbatim).
   const command = renderCommand(language.run, pocPath, false);
-  const [interpreter, ...args] = command.split(" ");
-  // Note: the file path is already substituted in the args if {{file}} was used.
-  // We just need to spawn.
+  const trimmed = command.trim();
+  const firstSpace = trimmed.indexOf(" ");
+  const interpreter = firstSpace === -1 ? trimmed : trimmed.slice(0, firstSpace);
+  const rest = firstSpace === -1 ? "" : trimmed.slice(firstSpace + 1);
+  const args = pocPath.includes(" ") ? (rest ? [rest] : []) : rest ? rest.split(" ") : [];
 
   const result = spawnSync(interpreter, args, {
     encoding: "utf8",
@@ -326,10 +357,11 @@ function runLocal(pocPath: string, language: PocLanguage): PocRun {
     maxBuffer: MAX_BUFFER,
   });
 
-  const output = sanitizeOutput((result.stdout ?? "") + (result.stderr ?? ""));
+  const spawnErr = result.error ? `\n[spawn error] ${result.error.message}` : "";
+  const output = sanitizeOutput((result.stdout ?? "") + (result.stderr ?? "") + spawnErr);
   return {
     path: pocPath,
-    exitCode: result.status ?? (result.signal ? 1 : 0),
+    exitCode: spawnExitCode(result),
     output,
     ranAt,
     sandbox: false,

package/src/sqlite-compat/index.ts

@@ -8,8 +8,15 @@ try {
   // biome-ignore lint/suspicious/noExplicitAny: Runtime module swappability
   DatabaseSyncConstructor = _require("bun:sqlite").Database as any;
 } catch {
-  // biome-ignore lint/suspicious/noExplicitAny: Runtime module swappability
-  DatabaseSyncConstructor = (_require("node:sqlite") as any).DatabaseSync;
+  try {
+    // biome-ignore lint/suspicious/noExplicitAny: Runtime module swappability
+    DatabaseSyncConstructor = (_require("node:sqlite") as any).DatabaseSync;
+  } catch (e) {
+    throw new Error(
+      "XPI requires bun:sqlite (Bun runtime) or node:sqlite (Node >= 22.5). " +
+        `Neither SQLite backend is available: ${(e as Error).message}`,
+    );
+  }
 }
 
 // biome-ignore lint/suspicious/noExplicitAny: Standard SQLite API returns any