@xaccefy/pi-casefile 0.8.2 → 0.9.0

package/src/pipeline-submit.ts

@@ -18,7 +18,7 @@
  */
 
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { getRunDir, getScratchpadRoot, scratchpad_write } from "./scratchpad.ts";
 
@@ -120,6 +120,13 @@ export const SPECS: Record<SubmitStage, StageSpec> = {
     ],
     conditional: [
       { when: { field: "verdict", equals: "DISPROVEN" }, require: ["disproval_reason"] },
+      {
+        // A CONFIRMED verdict must carry the skeptic's own failed disproof —
+        // the workflow makes it the case's disconfirmation. "Could not
+        // disprove" alone is not an attempt.
+        when: { field: "verdict", equals: "CONFIRMED" },
+        require: ["disconfirmation_attempt"],
+      },
     ],
   },
   // schemas/stage-validation.json
@@ -189,6 +196,7 @@ type FindingRef = {
   key: string;
   file: string;
   line?: number;
+  endpoint?: string;
   vuln_class: string;
 };
 
@@ -204,19 +212,43 @@ function statePath(runId: string): string {
 function readState(runId: string): SubmitState {
   const p = statePath(runId);
   if (!existsSync(p)) return { repairs: {}, accepted_findings: [] };
-  try {
-    const raw = JSON.parse(readFileSync(p, "utf8")) as Partial<SubmitState>;
-    return {
-      repairs: raw.repairs ?? {},
-      accepted_findings: raw.accepted_findings ?? [],
-    };
-  } catch {
-    return { repairs: {}, accepted_findings: [] };
+  const raw = JSON.parse(readFileSync(p, "utf8")) as Partial<SubmitState>;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error(`Corrupt pipeline-submit state for ${runId}: root must be an object`);
+  }
+  const repairs = raw.repairs ?? {};
+  if (typeof repairs !== "object" || repairs === null || Array.isArray(repairs)) {
+    throw new Error(`Corrupt pipeline-submit state for ${runId}: repairs must be an object`);
+  }
+  for (const [k, v] of Object.entries(repairs)) {
+    if (typeof k !== "string" || typeof v !== "number" || !Number.isInteger(v) || v < 0) {
+      throw new Error(`Corrupt pipeline-submit state for ${runId}: invalid repair counter`);
+    }
+  }
+  const accepted = raw.accepted_findings ?? [];
+  if (!Array.isArray(accepted)) {
+    throw new Error(
+      `Corrupt pipeline-submit state for ${runId}: accepted_findings must be an array`,
+    );
   }
+  for (const [i, item] of accepted.entries()) {
+    if (typeof item !== "object" || item === null || Array.isArray(item)) {
+      throw new Error(
+        `Corrupt pipeline-submit state for ${runId}: accepted_findings[${i}] invalid`,
+      );
+    }
+  }
+  return {
+    repairs: repairs as Record<string, number>,
+    accepted_findings: accepted as FindingRef[],
+  };
 }
 
 function writeState(runId: string, state: SubmitState): void {
-  writeFileSync(statePath(runId), JSON.stringify(state, null, 2), "utf8");
+  const p = statePath(runId);
+  const tmp = `${p}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(tmp, JSON.stringify(state, null, 2), "utf8");
+  renameSync(tmp, p);
 }
 
 /** Project root containing the scratchpad (file-existence checks resolve here). */
@@ -272,6 +304,109 @@ function isNonEmptyString(v: unknown): v is string {
   return typeof v === "string" && v.trim().length > 0;
 }
 
+function requireStringArray(errors: string[], path: string, value: unknown, minItems = 0): void {
+  if (!Array.isArray(value)) {
+    errors.push(`${path}: missing or not an array`);
+    return;
+  }
+  if (value.length < minItems) errors.push(`${path}: needs at least ${minItems} item(s)`);
+  value.forEach((item, i) => {
+    if (!isNonEmptyString(item)) errors.push(`${path}[${i}]: missing or empty string`);
+  });
+}
+
+function asObject(value: unknown): Record<string, unknown> | undefined {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+function validateReport(errors: string[], obj: Record<string, unknown>): void {
+  const findingSeverities = ["info", "low", "medium", "high", "critical"];
+  if (Array.isArray(obj.findings)) {
+    obj.findings.forEach((item, i) => {
+      const finding = asObject(item);
+      if (!finding) {
+        errors.push(`findings[${i}]: not an object`);
+        return;
+      }
+      for (const field of ["id", "vuln_class", "severity", "status"] as const) {
+        if (!isNonEmptyString(finding[field]))
+          errors.push(`findings[${i}].${field}: missing or empty`);
+      }
+      if (!isNonEmptyString(finding.file) && !isNonEmptyString(finding.endpoint)) {
+        errors.push(`findings[${i}]: provide file or endpoint`);
+      }
+      if (isNonEmptyString(finding.severity) && !findingSeverities.includes(finding.severity)) {
+        errors.push(`findings[${i}].severity: invalid value`);
+      }
+      if (isNonEmptyString(finding.status) && !["confirmed", "reported"].includes(finding.status)) {
+        errors.push(`findings[${i}].status: invalid value`);
+      }
+      if (finding.chain_with !== undefined)
+        requireStringArray(errors, `findings[${i}].chain_with`, finding.chain_with);
+    });
+  }
+
+  const coverage = asObject(obj.coverage);
+  if (coverage) {
+    const allowed = ["COVERED", "SKIPPED", "NOT_FOUND", "INCOMPLETE"];
+    for (const [key, value] of Object.entries(coverage)) {
+      if (!/^[a-z-]+$/.test(key)) errors.push(`coverage.${key}: invalid class key`);
+      if (typeof value !== "string" || !allowed.includes(value)) {
+        errors.push(`coverage.${key}: must be one of { ${allowed.join(" | ")} }`);
+      }
+    }
+  }
+
+  if (obj.chains !== undefined) {
+    if (!Array.isArray(obj.chains)) {
+      errors.push("chains: not an array");
+    } else {
+      obj.chains.forEach((item, i) => {
+        const chain = asObject(item);
+        if (!chain) {
+          errors.push(`chains[${i}]: not an object`);
+          return;
+        }
+        if (chain.title !== undefined && !isNonEmptyString(chain.title))
+          errors.push(`chains[${i}].title: missing or empty`);
+        if (chain.steps !== undefined)
+          requireStringArray(errors, `chains[${i}].steps`, chain.steps);
+        if (
+          chain.severity !== undefined &&
+          (!isNonEmptyString(chain.severity) ||
+            !(CHAIN_SEVERITIES as readonly string[]).includes(chain.severity))
+        ) {
+          errors.push(`chains[${i}].severity: invalid value`);
+        }
+        if (chain.blocked_by_controls !== undefined) {
+          requireStringArray(errors, `chains[${i}].blocked_by_controls`, chain.blocked_by_controls);
+        }
+      });
+    }
+  }
+
+  if (obj.patches_applied !== undefined) {
+    if (!Array.isArray(obj.patches_applied)) {
+      errors.push("patches_applied: not an array");
+    } else {
+      obj.patches_applied.forEach((item, i) => {
+        const patch = asObject(item);
+        if (!patch) {
+          errors.push(`patches_applied[${i}]: not an object`);
+          return;
+        }
+        for (const field of ["finding_id", "diff_summary", "re_attack_result"] as const) {
+          if (patch[field] !== undefined && !isNonEmptyString(patch[field])) {
+            errors.push(`patches_applied[${i}].${field}: missing or empty`);
+          }
+        }
+      });
+    }
+  }
+}
+
 function validateStage(stage: SubmitStage, obj: Record<string, unknown>): string[] {
   const spec = SPECS[stage];
   const errors: string[] = [];
@@ -334,10 +469,92 @@ function validateStage(stage: SubmitStage, obj: Record<string, unknown>): string
     }
   }
 
-  // Chain items have their own inner contract (≥2 steps, severity enum).
+  if (stage === "trace") {
+    requireStringArray(errors, "call_chain", obj.call_chain, 1);
+    if (Array.isArray(obj.defenses_checked)) {
+      obj.defenses_checked.forEach((item, i) => {
+        const defense = asObject(item);
+        if (!defense) {
+          errors.push(`defenses_checked[${i}]: not an object`);
+          return;
+        }
+        if (!isNonEmptyString(defense.defense))
+          errors.push(`defenses_checked[${i}].defense: missing or empty`);
+        if (!isNonEmptyString(defense.location))
+          errors.push(`defenses_checked[${i}].location: missing or empty`);
+        if (
+          !isNonEmptyString(defense.verdict) ||
+          !["bypassed", "blocked", "not-present"].includes(defense.verdict)
+        ) {
+          errors.push(`defenses_checked[${i}].verdict: must be bypassed, blocked, or not-present`);
+        }
+      });
+    }
+  }
+
+  if (stage === "skeptic") {
+    requireStringArray(errors, "evidence_reviewed", obj.evidence_reviewed, 1);
+    if (obj.verdict === "DISPROVEN" && isNonEmptyString(obj.disproval_reason)) {
+      const allowed = [
+        "unreachable",
+        "framework_protection",
+        "input_validation_blocks",
+        "requires_privilege_attacker_lacks",
+        "intended_behavior",
+        "overstated_impact",
+        "duplicate",
+        "test_artifact",
+        "out_of_scope",
+      ];
+      if (!allowed.includes(obj.disproval_reason)) errors.push("disproval_reason: invalid value");
+    }
+  }
+
+  if (stage === "validate") {
+    if (obj.status === "killed" && isNonEmptyString(obj.kill_reason)) {
+      const allowed = [
+        "unreachable",
+        "framework_protection",
+        "input_validation_blocks",
+        "requires_privilege_attacker_lacks",
+        "poc_failed_3x",
+        "no_real_impact",
+        "intended_behavior",
+        "duplicate",
+      ];
+      if (!allowed.includes(obj.kill_reason)) errors.push("kill_reason: invalid value");
+    }
+    if (obj.status === "confirmed" && isNonEmptyString(obj.poc_path)) {
+      // A validate submission asserting "confirmed" must point at a PoC file
+      // that actually exists in the project — same file-existence filter hunt
+      // findings get. Otherwise fabricated run logs pass the stage gate.
+      const raw = obj.poc_path as string;
+      const normalized = raw.replace(/^\.?\//, "");
+      const abs = isAbsolute(normalized) ? resolve(normalized) : resolve(projectRoot(), normalized);
+      const rel = relative(projectRoot(), abs);
+      if (rel.startsWith("..") || isAbsolute(rel)) {
+        errors.push("poc_path: must resolve inside the project root");
+      } else if (!existsSync(abs)) {
+        errors.push(`poc_path: "${raw}" does not exist under the project root`);
+      }
+    }
+    if (
+      obj.refinement_attempts !== undefined &&
+      (!Number.isInteger(obj.refinement_attempts) ||
+        (obj.refinement_attempts as number) < 1 ||
+        (obj.refinement_attempts as number) > 3)
+    ) {
+      errors.push("refinement_attempts: must be an integer from 1 to 3");
+    }
+  }
+
   if (stage === "chain" && Array.isArray(obj.chains)) {
     obj.chains.forEach((c, i) => {
-      const chain = c as Record<string, unknown>;
+      const chain = asObject(c);
+      if (!chain) {
+        errors.push(`chains[${i}]: not an object`);
+        return;
+      }
       if (!isNonEmptyString(chain.title)) errors.push(`chains[${i}].title: missing or empty`);
       if (
         !isNonEmptyString(chain.severity) ||
@@ -345,14 +562,17 @@ function validateStage(stage: SubmitStage, obj: Record<string, unknown>): string
       ) {
         errors.push(`chains[${i}].severity: must be one of { ${CHAIN_SEVERITIES.join(" | ")} }`);
       }
-      if (!Array.isArray(chain.steps) || chain.steps.length < 2) {
-        errors.push(`chains[${i}].steps: needs at least 2 case IDs`);
+      requireStringArray(errors, `chains[${i}].steps`, chain.steps, 2);
+      if (chain.blocked_by_controls !== undefined) {
+        requireStringArray(errors, `chains[${i}].blocked_by_controls`, chain.blocked_by_controls);
       }
       if (!isNonEmptyString(chain.narrative))
         errors.push(`chains[${i}].narrative: missing or empty`);
     });
   }
 
+  if (stage === "report") validateReport(errors, obj);
+
   return errors;
 }
 
@@ -381,6 +601,23 @@ function prefilterHunt(obj: Record<string, unknown>): string | null {
       `Findings must reference files inside the target repository.`
     );
   }
+  // Symlink containment (same defense as the PoC runner): resolve() is
+  // lexical, and existsSync() dereferences symlinks — a workspace symlink to
+  // /etc (ln -s /etc etc-link) would otherwise pass both checks and let a
+  // "finding" point at host paths outside the project.
+  let real: string;
+  try {
+    real = realpathSync(abs);
+  } catch {
+    return `file-existence filter: "${file}" cannot be resolved under the project root (${root}).`;
+  }
+  const realRel = relative(root, real);
+  if (realRel.startsWith("..") || isAbsolute(realRel)) {
+    return (
+      `containment filter: "${file}" resolves through a symlink to outside the project root ` +
+      `(${real}). Symlinked files outside ${root} are rejected.`
+    );
+  }
   if (!existsSync(abs)) {
     return (
       `file-existence filter: "${file}" does not exist under the project root ` +
@@ -392,12 +629,19 @@ function prefilterHunt(obj: Record<string, unknown>): string | null {
 
 function dedupHunt(state: SubmitState, obj: Record<string, unknown>): { duplicateOf?: string } {
   const file = typeof obj.file === "string" ? obj.file.replace(/^\.?\//, "") : undefined;
+  const endpoint = typeof obj.endpoint === "string" ? obj.endpoint.trim() : undefined;
   const vulnClass = typeof obj.vuln_class === "string" ? obj.vuln_class : undefined;
   const line = typeof obj.line === "number" ? obj.line : undefined;
-  if (!file || !vulnClass) return {};
+  if (!vulnClass) return {};
   for (const accepted of state.accepted_findings) {
     if (accepted.vuln_class !== vulnClass) continue;
-    if (accepted.file !== file) continue;
+    // Live locator: same endpoint + class is the same finding (re-submissions
+    // after a repair must not be accepted repeatedly).
+    if (!file && endpoint !== undefined) {
+      if (accepted.endpoint === endpoint) return { duplicateOf: accepted.key };
+      continue;
+    }
+    if (!file || accepted.file !== file) continue;
     if (
       line !== undefined &&
       accepted.line !== undefined &&
@@ -474,24 +718,33 @@ export function pipeline_submit(runId: string, stage: SubmitStage, output: unkno
         duplicate_of: duplicateOf,
       };
     }
-    if (typeof obj.file === "string" && typeof obj.vuln_class === "string") {
-      state.accepted_findings.push({
-        key,
-        file: obj.file.replace(/^\.?\//, ""),
-        line: typeof obj.line === "number" ? obj.line : undefined,
-        vuln_class: obj.vuln_class,
-      });
+    if (typeof obj.vuln_class === "string") {
+      const isFileFinding = typeof obj.file === "string";
+      const isEndpointFinding = !isFileFinding && typeof obj.endpoint === "string";
+      if (isFileFinding || isEndpointFinding) {
+        state.accepted_findings.push({
+          key,
+          file: isFileFinding ? (obj.file as string).replace(/^\.?\//, "") : "",
+          line: typeof obj.line === "number" ? obj.line : undefined,
+          endpoint: isEndpointFinding ? (obj.endpoint as string).trim() : undefined,
+          vuln_class: obj.vuln_class,
+        });
+      }
       writeState(runId, state);
     }
   }
 
   // Submit stages are a subset of scratchpad phases, so the stage name IS
-  // the phase directory.
+  // the phase directory. The filename gets a content hash: distinct findings
+  // sharing one plausible id (the stable repair-bucket key) must not clobber
+  // each other's accepted artifact.
+  const json = JSON.stringify(obj, null, 2);
+  const contentHash = createHash("sha1").update(json).digest("hex").slice(0, 8);
   const artifact = scratchpad_write(
     runId,
     stage,
-    `${key.replace(/[^a-zA-Z0-9._:-]/g, "_")}.json`,
-    JSON.stringify(obj, null, 2),
+    `${key.replace(/[^a-zA-Z0-9._:-]/g, "_")}-${contentHash}.json`,
+    json,
   );
   return { verdict: "accepted", stage, errors: [], key, artifact };
 }