@xaccefy/pi-casefile 0.8.3 → 0.9.1

package/src/pipeline-submit.ts

@@ -18,8 +18,15 @@
  */
 
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { existsSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { KILL_REASON_VALUES } from "./ledger.ts";
+import {
+  assertSafeRegularFile,
+  assertSafeStateDirectory,
+  readSafeFile,
+  writeSafeFileAtomic,
+} from "./safe-state.ts";
 import { getRunDir, getScratchpadRoot, scratchpad_write } from "./scratchpad.ts";
 
 // ── Types ────────────────────────────────────────────────────────────
@@ -45,6 +52,8 @@ export type SubmitResult = {
 };
 
 type StageSpec = {
+  /** Exact top-level field allowlist; mirrors additionalProperties:false. */
+  allowed: readonly string[];
   /** Fields that must be present and non-empty. */
   required: {
     name: string;
@@ -86,6 +95,18 @@ const VULN_CLASSES = [
 export const SPECS: Record<SubmitStage, StageSpec> = {
   // schemas/stage-finding.json
   hunt: {
+    allowed: [
+      "vuln_class",
+      "file",
+      "line",
+      "endpoint",
+      "sink",
+      "entry_point",
+      "confidence",
+      "evidence",
+      "attacker_model",
+      "subsystem",
+    ],
     required: [
       { name: "vuln_class", type: "string", enum: VULN_CLASSES },
       { name: "sink", type: "string" },
@@ -98,6 +119,15 @@ export const SPECS: Record<SubmitStage, StageSpec> = {
   },
   // schemas/stage-trace.json
   trace: {
+    allowed: [
+      "trace_result",
+      "entry_point",
+      "call_chain",
+      "defenses_checked",
+      "attacker_model",
+      "impact_if_reachable",
+      "unreachable_reason",
+    ],
     required: [
       { name: "trace_result", type: "string", enum: ["REACHABLE", "UNREACHABLE"] },
       { name: "entry_point", type: "string" },
@@ -112,6 +142,14 @@ export const SPECS: Record<SubmitStage, StageSpec> = {
   },
   // schemas/stage-skeptic.json
   skeptic: {
+    allowed: [
+      "finding_id",
+      "verdict",
+      "reasoning",
+      "evidence_reviewed",
+      "disconfirmation_attempt",
+      "disproval_reason",
+    ],
     required: [
       { name: "finding_id", type: "string" },
       { name: "verdict", type: "string", enum: ["CONFIRMED", "DISPROVEN"] },
@@ -120,19 +158,41 @@ export const SPECS: Record<SubmitStage, StageSpec> = {
     ],
     conditional: [
       { when: { field: "verdict", equals: "DISPROVEN" }, require: ["disproval_reason"] },
+      {
+        // A CONFIRMED verdict must carry the skeptic's own failed disproof —
+        // the workflow makes it the case's disconfirmation. "Could not
+        // disprove" alone is not an attempt.
+        when: { field: "verdict", equals: "CONFIRMED" },
+        require: ["disconfirmation_attempt"],
+      },
     ],
   },
   // schemas/stage-validation.json
   validate: {
+    allowed: [
+      "finding_id",
+      "status",
+      "technique_used",
+      "detection_method",
+      "poc_path",
+      "run_log",
+      "evidence_extracted",
+      "kill_reason",
+      "refinement_attempts",
+    ],
     required: [
       { name: "finding_id", type: "string" },
-      { name: "status", type: "string", enum: ["confirmed", "killed", "reported"] },
+      {
+        name: "status",
+        type: "string",
+        enum: ["pending_confirmation", "killed", "reported"],
+      },
       { name: "technique_used", type: "string" },
       { name: "detection_method", type: "string" },
     ],
     conditional: [
       {
-        when: { field: "status", equals: "confirmed" },
+        when: { field: "status", equals: "pending_confirmation" },
         require: ["poc_path", "run_log", "evidence_extracted"],
       },
       { when: { field: "status", equals: "killed" }, require: ["kill_reason"] },
@@ -140,6 +200,7 @@ export const SPECS: Record<SubmitStage, StageSpec> = {
   },
   // schemas/stage-chain.json
   chain: {
+    allowed: ["chains", "summary", "tokens_input", "tokens_output"],
     required: [
       { name: "chains", type: "array" },
       { name: "summary", type: "string" },
@@ -147,6 +208,16 @@ export const SPECS: Record<SubmitStage, StageSpec> = {
   },
   // schemas/stage-report.json
   report: {
+    allowed: [
+      "target",
+      "pipeline_status",
+      "total_tokens",
+      "findings",
+      "chains",
+      "coverage",
+      "summary",
+      "patches_applied",
+    ],
     required: [
       { name: "target", type: "string" },
       { name: "pipeline_status", type: "string", enum: ["complete", "partial", "aborted"] },
@@ -189,6 +260,7 @@ type FindingRef = {
   key: string;
   file: string;
   line?: number;
+  endpoint?: string;
   vuln_class: string;
 };
 
@@ -204,7 +276,11 @@ function statePath(runId: string): string {
 function readState(runId: string): SubmitState {
   const p = statePath(runId);
   if (!existsSync(p)) return { repairs: {}, accepted_findings: [] };
-  const raw = JSON.parse(readFileSync(p, "utf8")) as Partial<SubmitState>;
+  assertSafeStateDirectory(projectRoot(), [".scratchpad", basename(dirname(p))]);
+  assertSafeRegularFile(p, "Pipeline state");
+  const raw = JSON.parse(
+    readSafeFile(p, "Pipeline state").toString("utf8"),
+  ) as Partial<SubmitState>;
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new Error(`Corrupt pipeline-submit state for ${runId}: root must be an object`);
   }
@@ -238,9 +314,8 @@ function readState(runId: string): SubmitState {
 
 function writeState(runId: string, state: SubmitState): void {
   const p = statePath(runId);
-  const tmp = `${p}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync(tmp, JSON.stringify(state, null, 2), "utf8");
-  renameSync(tmp, p);
+  assertSafeStateDirectory(projectRoot(), [".scratchpad", basename(dirname(p))]);
+  writeSafeFileAtomic(p, JSON.stringify(state, null, 2));
 }
 
 /** Project root containing the scratchpad (file-existence checks resolve here). */
@@ -403,6 +478,11 @@ function validateStage(stage: SubmitStage, obj: Record<string, unknown>): string
   const spec = SPECS[stage];
   const errors: string[] = [];
 
+  const allowedFields = new Set(spec.allowed);
+  for (const name of Object.keys(obj)) {
+    if (!allowedFields.has(name)) errors.push(`${name}: unknown top-level field`);
+  }
+
   for (const field of spec.required) {
     const v = obj[field.name];
     if (field.type === "string") {
@@ -487,34 +567,31 @@ function validateStage(stage: SubmitStage, obj: Record<string, unknown>): string
   if (stage === "skeptic") {
     requireStringArray(errors, "evidence_reviewed", obj.evidence_reviewed, 1);
     if (obj.verdict === "DISPROVEN" && isNonEmptyString(obj.disproval_reason)) {
-      const allowed = [
-        "unreachable",
-        "framework_protection",
-        "input_validation_blocks",
-        "requires_privilege_attacker_lacks",
-        "intended_behavior",
-        "overstated_impact",
-        "duplicate",
-        "test_artifact",
-        "out_of_scope",
-      ];
-      if (!allowed.includes(obj.disproval_reason)) errors.push("disproval_reason: invalid value");
+      if (!(KILL_REASON_VALUES as readonly string[]).includes(obj.disproval_reason)) {
+        errors.push("disproval_reason: invalid value");
+      }
     }
   }
 
   if (stage === "validate") {
     if (obj.status === "killed" && isNonEmptyString(obj.kill_reason)) {
-      const allowed = [
-        "unreachable",
-        "framework_protection",
-        "input_validation_blocks",
-        "requires_privilege_attacker_lacks",
-        "poc_failed_3x",
-        "no_real_impact",
-        "intended_behavior",
-        "duplicate",
-      ];
-      if (!allowed.includes(obj.kill_reason)) errors.push("kill_reason: invalid value");
+      if (!(KILL_REASON_VALUES as readonly string[]).includes(obj.kill_reason)) {
+        errors.push("kill_reason: invalid value");
+      }
+    }
+    if (obj.status === "pending_confirmation" && isNonEmptyString(obj.poc_path)) {
+      // A phase-1 validation submission must point at a PoC file
+      // that actually exists in the project — same file-existence filter hunt
+      // findings get. Otherwise fabricated run logs pass the stage gate.
+      const raw = obj.poc_path as string;
+      const normalized = raw.replace(/^\.?\//, "");
+      const abs = isAbsolute(normalized) ? resolve(normalized) : resolve(projectRoot(), normalized);
+      const rel = relative(projectRoot(), abs);
+      if (rel.startsWith("..") || isAbsolute(rel)) {
+        errors.push("poc_path: must resolve inside the project root");
+      } else if (!existsSync(abs)) {
+        errors.push(`poc_path: "${raw}" does not exist under the project root`);
+      }
     }
     if (
       obj.refinement_attempts !== undefined &&
@@ -579,6 +656,23 @@ function prefilterHunt(obj: Record<string, unknown>): string | null {
       `Findings must reference files inside the target repository.`
     );
   }
+  // Symlink containment (same defense as the PoC runner): resolve() is
+  // lexical, and existsSync() dereferences symlinks — a workspace symlink to
+  // /etc (ln -s /etc etc-link) would otherwise pass both checks and let a
+  // "finding" point at host paths outside the project.
+  let real: string;
+  try {
+    real = realpathSync(abs);
+  } catch {
+    return `file-existence filter: "${file}" cannot be resolved under the project root (${root}).`;
+  }
+  const realRel = relative(root, real);
+  if (realRel.startsWith("..") || isAbsolute(realRel)) {
+    return (
+      `containment filter: "${file}" resolves through a symlink to outside the project root ` +
+      `(${real}). Symlinked files outside ${root} are rejected.`
+    );
+  }
   if (!existsSync(abs)) {
     return (
       `file-existence filter: "${file}" does not exist under the project root ` +
@@ -590,12 +684,19 @@ function prefilterHunt(obj: Record<string, unknown>): string | null {
 
 function dedupHunt(state: SubmitState, obj: Record<string, unknown>): { duplicateOf?: string } {
   const file = typeof obj.file === "string" ? obj.file.replace(/^\.?\//, "") : undefined;
+  const endpoint = typeof obj.endpoint === "string" ? obj.endpoint.trim() : undefined;
   const vulnClass = typeof obj.vuln_class === "string" ? obj.vuln_class : undefined;
   const line = typeof obj.line === "number" ? obj.line : undefined;
-  if (!file || !vulnClass) return {};
+  if (!vulnClass) return {};
   for (const accepted of state.accepted_findings) {
     if (accepted.vuln_class !== vulnClass) continue;
-    if (accepted.file !== file) continue;
+    // Live locator: same endpoint + class is the same finding (re-submissions
+    // after a repair must not be accepted repeatedly).
+    if (!file && endpoint !== undefined) {
+      if (accepted.endpoint === endpoint) return { duplicateOf: accepted.key };
+      continue;
+    }
+    if (!file || accepted.file !== file) continue;
     if (
       line !== undefined &&
       accepted.line !== undefined &&
@@ -672,24 +773,33 @@ export function pipeline_submit(runId: string, stage: SubmitStage, output: unkno
         duplicate_of: duplicateOf,
       };
     }
-    if (typeof obj.file === "string" && typeof obj.vuln_class === "string") {
-      state.accepted_findings.push({
-        key,
-        file: obj.file.replace(/^\.?\//, ""),
-        line: typeof obj.line === "number" ? obj.line : undefined,
-        vuln_class: obj.vuln_class,
-      });
+    if (typeof obj.vuln_class === "string") {
+      const isFileFinding = typeof obj.file === "string";
+      const isEndpointFinding = !isFileFinding && typeof obj.endpoint === "string";
+      if (isFileFinding || isEndpointFinding) {
+        state.accepted_findings.push({
+          key,
+          file: isFileFinding ? (obj.file as string).replace(/^\.?\//, "") : "",
+          line: typeof obj.line === "number" ? obj.line : undefined,
+          endpoint: isEndpointFinding ? (obj.endpoint as string).trim() : undefined,
+          vuln_class: obj.vuln_class,
+        });
+      }
       writeState(runId, state);
     }
   }
 
   // Submit stages are a subset of scratchpad phases, so the stage name IS
-  // the phase directory.
+  // the phase directory. The filename gets a content hash: distinct findings
+  // sharing one plausible id (the stable repair-bucket key) must not clobber
+  // each other's accepted artifact.
+  const json = JSON.stringify(obj, null, 2);
+  const contentHash = createHash("sha1").update(json).digest("hex").slice(0, 8);
   const artifact = scratchpad_write(
     runId,
     stage,
-    `${key.replace(/[^a-zA-Z0-9._:-]/g, "_")}.json`,
-    JSON.stringify(obj, null, 2),
+    `${key.replace(/[^a-zA-Z0-9._:-]/g, "_")}-${contentHash}.json`,
+    json,
   );
   return { verdict: "accepted", stage, errors: [], key, artifact };
 }