@xaccefy/pi-casefile 0.7.3 → 0.7.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xaccefy/pi-casefile",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits",
   "keywords": [
     "pi-package",

package/src/ledger.ts

@@ -1577,7 +1577,13 @@ function buildScratchpadSection(caseId: string): string {
     const resume = scratchpad_resume(entry.name);
     if (!resume) continue;
     const allIds = Object.values(resume.checkpoint.phase_ids ?? {}).flat() as string[];
-    if (!allIds.includes(caseId)) continue;
+    // Gate on the case id appearing in phase_ids OR in any artifact filename —
+    // checkpoint ids are often empty for recon/hunt, while artifact names like
+    // skeptic_case_<id>.json / trace_case_<id>.json are equally valid evidence.
+    const namedInArtifact = Object.values(resume.artifacts)
+      .flat()
+      .some((n) => n.includes(caseId));
+    if (!allIds.includes(caseId) && !namedInArtifact) continue;
 
     sections.push(`### Run: ${entry.name} (project root: ${resume.checkpoint.project_root})`);
     for (const phase of CONTEXT_PHASES) {

package/src/pipeline-submit.ts

@@ -251,11 +251,20 @@ function parseOutput(output: unknown): { obj?: Record<string, unknown>; error?:
 }
 
 /** Stable repair-bucket key for a submission. */
+/** Placeholder-y ids that carry no identity (observed in the wild: every
+ * submission in a run keyed "false"). Trusting them makes distinct findings
+ * share one key — one artifact name, one repair-budget bucket — so the last
+ * write clobbers the rest. Fall back to the content hash instead. */
+const JUNK_ID_RE =
+  /^(false|true|null|none|undefined|n\/?a|na|unknown|missing|empty|todo|tbd|pending|not-set)$/i;
+
 function submissionKey(stage: SubmitStage, obj: Record<string, unknown>): string {
+  const candidate =
+    (typeof obj.finding_id === "string" && obj.finding_id.trim()) ||
+    (typeof obj.title === "string" && obj.title.trim()) ||
+    (typeof obj.id === "string" && obj.id.trim());
   const id =
-    (typeof obj.finding_id === "string" && obj.finding_id) ||
-    (typeof obj.title === "string" && obj.title) ||
-    (typeof obj.id === "string" && obj.id);
+    candidate && candidate.length >= 3 && !JUNK_ID_RE.test(candidate) ? candidate : undefined;
   const tail = id ?? createHash("sha1").update(JSON.stringify(obj)).digest("hex").slice(0, 8);
   return `${stage}:${tail}`;
 }

package/src/scratchpad.ts

@@ -150,6 +150,19 @@ export function getStatePath(runId: string, projectRoot?: string): string {
   return join(getRunDir(runId, projectRoot), "state.json");
 }
 
+/**
+ * Sanitize an artifact name into a safe filename. Same allowlist as run_ids,
+ * plus dot-only rejection: a name like `..` or `.` would otherwise let join()
+ * point at the phase/run directory itself (EISDIR crash on write/read).
+ */
+function sanitizeArtifactName(artifactName: string): string {
+  const safe = artifactName.replace(/[^a-zA-Z0-9._-]/g, "_");
+  if (!safe || /^\.+$/.test(safe)) {
+    throw new Error(`Invalid artifact name: "${artifactName}" — nothing left after sanitization`);
+  }
+  return safe;
+}
+
 function emptyCheckpoint(runId: string, projectRoot: string): ScratchpadCheckpoint {
   const now = new Date().toISOString();
   return {
@@ -229,8 +242,8 @@ export function scratchpad_write(
   const runDir = getRunDir(runId, root);
   ensureRunDirs(runDir);
 
-  // Sanitize artifact name: no path traversal.
-  const safeName = artifactName.replace(/[^a-zA-Z0-9._-]/g, "_");
+  // Sanitize artifact name: no path traversal, no dot-only escape.
+  const safeName = sanitizeArtifactName(artifactName);
   const dir = join(runDir, PHASE_DIRS[phase]);
   const filePath = join(dir, safeName);
   writeFileSync(filePath, content, "utf8");
@@ -247,7 +260,7 @@ export function scratchpad_read(
   projectRoot?: string,
 ): string | null {
   const root = projectRoot ?? detectWorkspaceRoot();
-  const safeName = artifactName.replace(/[^a-zA-Z0-9._-]/g, "_");
+  const safeName = sanitizeArtifactName(artifactName);
   const filePath = join(getRunDir(runId, root), PHASE_DIRS[phase], safeName);
   if (!existsSync(filePath)) return null;
   return readFileSync(filePath, "utf8");