@xaccefy/pi-casefile 0.9.1 → 0.9.3

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 x4cc3
+Copyright (c) 2025 xaccefy
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -16,13 +16,17 @@ The attack-mode text stays **quiet by default** so your normal coding isn't buri
 
 | Control | Effect |
 |---------|--------|
-| `/xp` | Toggle ON/OFF |
-| `/xp on` / `/xp off` / `/xp lite` | Set explicitly |
-| `PI_XP_MODE=on` | Force ON for this process (overrides file) |
+| `/xp` | Toggle SWARM/OFF |
+| `/xp on` | Default enabled mode: SWARM |
+| `/xp swarm` | Bounded multi-agent workflow: auditor/tracer/skeptic/chain only |
+| `/xp lite` | Focused workflow: single-agent, no subagent dispatch |
+| `/xp off` | Quiet mode explicitly |
+| `PI_XP_MODE=on` | Force SWARM for this process (same as `swarm`) |
+| `PI_XP_MODE=swarm` | Force SWARM for this process (overrides file) |
 | `PI_XP_MODE=lite` | Force LITE (single-agent, no subagent dispatch) |
 | `PI_XP_MODE=off` | Force OFF |
 
-When **ON**, every prompt gets the attacker-minded workflow plus any open cases. **LITE** is the same discipline done by the main agent alone — no `subagent` dispatch (CTF / single-shot engagements). When **OFF**, nothing is added; tools still work.
+When **LITE**, every prompt gets the attacker-minded workflow plus any open cases, done by the main agent alone — no `subagent` dispatch (CTF / single-shot engagements). When **SWARM**, the bounded pipeline is injected and only auditor/tracer/skeptic/chain are delegated; validation, patching, reporting, and ConfirmFinding stay with the main agent. When **OFF**, nothing is added; tools still work.
 
 State is persisted next to the ledger as `xp-mode` (e.g. `.pi/xp-mode`).
 
@@ -48,10 +52,10 @@ hypothesis → investigating → confirmed → reported
 
 - **investigating** needs `evidence` + `confidence`
 - **confirmed** only through the two-phase gate — `PromoteFinding` runs the PoC 2× target + 1× control, requires complete zero-exit runs and nonce-bound discriminating response-body evidence, then the harness performs a DNS-pinned identical replay and requires two conclusive responses with `target_only`. Reflection-capable requests may add a post-PoC harness-generated canary that must appear only on target. Status-only/trivial matchers and incomplete response capture are rejected. Exit zero is necessary but never proof. The main agent performs semantic review and calls `ConfirmFinding`, which captures a second fresh harness replay and binds it to the verdict; worker processes are rejected. Blind/OOB claims fail closed without a source-separated oracle.
-- **Every promotion requires `control_path`** (the same bytes as the PoC — sha256 enforced) and a distinct `control_target` pre-approved by the operator in `PI_POC_CONTROL_TARGETS`; an agent cannot invent its own easy control. The control run is stored as `controlVerified`. Crashes, transport-inconclusive controls, status-only evidence, and missing evidence all block promotion.
+- **Every promotion requires a distinct `control_target`** pre-approved by the operator in `PI_POC_CONTROL_TARGETS`; an agent cannot invent its own easy control. `control_path` defaults to `poc_path` and exists only as an override — if supplied, it must contain the same bytes as the PoC (sha256 enforced). The control run is stored as `controlVerified`. Crashes, transport-inconclusive controls, status-only evidence, and missing evidence all block promotion.
 - **New cases require `disproveIf`** — falsification conditions (what would disprove this hypothesis). A hypothesis that can't say what kills it isn't one yet.
 - **A kill must be justified**: either an EvidenceAdd `refutation` item, or a canonical kill-reason token (intended_behavior, duplicate, framework_protection, out_of_scope, insufficient_impact, no_attack_path, ...) in assumptions/nextStep. Bare `status: "killed"` is rejected.
-- **reported** needs `CaseContext` first (records the report path; the report writer produces the final file)
+- **reported** needs `CaseContext` first (records the report path; the main agent produces the final file)
 - **killed** / **reported** are final (no more edits)
 
 ## Evidence items
@@ -65,8 +69,8 @@ hypothesis → investigating → confirmed → reported
 | `CaseAdd` | Open a case (`title` + `disproveIf` required; start as `hypothesis` or `investigating`) |
 | `CaseUpdate` | Evidence, impact, severity, status (not direct confirm) |
 | `EvidenceAdd` | Role-typed, hashed evidence item on a case (refutation justifies kills; cleanup tracks cleanup) |
-| `PromoteFinding` | Phase 1: PoC 2× target + 1× operator-approved control, then DNS-pinned harness-owned replay requiring conclusive `target_only`; optional reflection canary upgrades the recorded proof strength when observed only on target. `local:true` and private replay are operator-gated; blind/OOB proof fails closed without source separation |
-| `ConfirmFinding` | Phase 2: main-agent-only semantic decision plus a fresh harness-owned target/control replay (CONFIRMED promotes; NOT_CONFIRMED keeps investigating; worker calls are rejected) |
+| `PromoteFinding` | Phase 1: main-agent-only PoC 2× target + 1× operator-approved control, then DNS-pinned harness-owned replay requiring conclusive `target_only`; optional reflection canary upgrades the recorded proof strength when observed only on target. `local:true` and private replay are operator-gated; blind/OOB proof fails closed without source separation |
+| `ConfirmFinding` | Phase 2: main-agent-only semantic decision plus a fresh harness-owned target/control replay (CONFIRMED promotes; NOT_CONFIRMED keeps investigating; worker/subagent gate calls are rejected) |
 | `CaseGet` / `CaseList` / `CaseSearch` | Read / filter / search |
 | `CaseLink` / `CaseUnlink` | Bidirectional exploit chains |
 | `ChainSuggest` | Scan cases for exploitable chain combinations (credential+endpoint→ATO, redirect+OAuth→token theft, XSS+state-change→CSRF, IDOR+user-data, SSTI→RCE, race+payment, info-disclosure+SSRF), ranked by confidence |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xaccefy/pi-casefile",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits",
   "keywords": [
     "pi-package",
@@ -49,7 +49,7 @@
   ],
   "main": "src/index.ts",
   "dependencies": {
-    "@xaccefy/pi-shared": "0.9.1",
+    "@xaccefy/pi-shared": "0.9.3",
     "undici": "^8.9.0"
   },
   "pi": {

package/skills/casefile/SKILL.md

@@ -13,9 +13,9 @@ Use Casefile to maintain durable security investigation state across agent turns
 1. Check existing cases before opening a new one with CaseList or CaseSearch.
 2. Open new leads with CaseAdd as `hypothesis` or `investigating`.
 3. Promote cases with CaseUpdate only after materially new evidence, proof, impact, blockers, remediation, or status changes.
-4. Mark `confirmed` only via the two-phase gate — `PromoteFinding` (PoC 2× target + 1× operator-approved control, nonce-bound body evidence, then a DNS-pinned conclusive `target_only` replay; use the post-PoC harness-generated canary for reflection-capable requests) → the main agent personally reviews → `ConfirmFinding`, which captures a fresh second harness replay before commit. Never delegate phase 2; worker calls are rejected. Exit zero is run integrity, never vulnerability proof. A predicate differential is evidence, not an automatic exploit verdict. Blind/OOB findings remain investigating without a source-separated oracle.
+4. Mark `confirmed` only via the two-phase gate — main-agent `PromoteFinding` (PoC 2× target + 1× operator-approved control, nonce-bound body evidence, then a DNS-pinned conclusive `target_only` replay; use the post-PoC harness-generated canary for reflection-capable requests) → the main agent personally reviews → `ConfirmFinding`, which captures a fresh second harness replay before commit. Never delegate validation or confirmation; worker/subagent gate calls are rejected. Exit zero is run integrity, never vulnerability proof. A predicate differential is evidence, not an automatic exploit verdict. Blind/OOB findings remain investigating without a source-separated oracle.
 5. Use CaseLink and CaseUnlink for exploit chains. Do not edit linked case IDs directly.
-6. Use CaseContext only for confirmed or already reported cases: it writes the full context bundle (complete record, verification logs, links, pipeline artifacts) and records the report path. Then have the report written (reporter agent in the full pipeline; yourself in lite mode) and CaseUpdate status=`reported`.
+6. Use CaseContext only for confirmed or already reported cases: it writes the full context bundle (complete record, verification logs, links, pipeline artifacts) and records the report path. Then write the report and CaseUpdate status=`reported`.
 7. Use `killed` for disproven, duplicate, or dead-end leads, and include evidence, blockers, next step, or assumptions explaining why.
 
 ## State machine
@@ -41,4 +41,4 @@ hypothesis → investigating → confirmed → reported
 - `CaseSearch`: search all fields or a scoped field.
 - `CaseLink`: bidirectionally link two cases.
 - `CaseUnlink`: remove a bidirectional case link.
-- `CaseContext`: write the case context bundle (complete record, PoC/disconfirmation logs, links, pipeline artifacts) for a confirmed or reported case and record the report path for the report writer.
+- `CaseContext`: write the case context bundle (complete record, PoC/disconfirmation logs, links, pipeline artifacts) for a confirmed or reported case and record the report path for the main agent.

package/src/evidence.ts

@@ -45,6 +45,14 @@ export type PoCEvidence = {
     expect: VerifyExpect;
     /** Optional stronger causality dimension, independent of the authored predicate. */
     canary?: VerifyCanary;
+    /**
+     * Differential shape. "inter_host" (default) = same request to target vs a
+     * distinct patched control host (body-carried proof). "intra_target" = attack
+     * request vs a legitimate same-host `baseline` request (access-control /
+     * business-logic classes, where the discriminating variable is identity or a
+     * parameter, not the host) — requires `baseline`.
+     */
+    mode?: "inter_host" | "intra_target";
   };
   /** What the script itself saw — corroboration only, never proof. */
   observations: string[];
@@ -137,6 +145,7 @@ function validRegexArray(v: unknown): v is string[] {
     boundedStringArray(v, MAX_REGEX_VALUES, MAX_REGEX_CHARS) &&
     v.every((re) => {
       try {
+        // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp -- compile-only validation; evaluation runs in a worker with a hard timeout.
         new RegExp(re);
         return true;
       } catch {
@@ -252,6 +261,19 @@ export function parsePoCEvidence(
       };
     }
   }
+  if (verify.mode !== undefined && verify.mode !== "inter_host" && verify.mode !== "intra_target") {
+    return {
+      ok: false,
+      error: 'evidence.json verify.mode must be "inter_host" or "intra_target"',
+    };
+  }
+  if (verify.mode === "intra_target" && !isRecord(raw.baseline)) {
+    return {
+      ok: false,
+      error:
+        "evidence.json verify.mode intra_target requires baseline — a legitimate same-host request whose response must NOT satisfy the attack predicate",
+    };
+  }
   const expect = verify.expect;
   if (!isRecord(expect))
     return { ok: false, error: "evidence.json verify.expect must be an object" };

package/src/harness-verify.ts

@@ -1,12 +1,12 @@
 /**
  * Harness-side target/control replay — Tier 2 of docs/poc-trust-model.md.
  *
- * The machine floor cannot trust a worker's self-reported `re_executed`
+ * The machine floor cannot trust a caller's self-reported `re_executed`
  * boolean. This module makes the HARNESS re-send the evidence's `verify`
  * request with its own HTTP client and apply the same `expect` predicates
  * (status / body_contains / body_regex) to target and control responses. The
- * worker supplies the predicate; the harness owns both evidence acquisition
- * and predicate execution. The main agent performs the later semantic review.
+ * main agent supplies the predicate; the harness owns both evidence acquisition
+ * and predicate execution before the later semantic review.
  *
  * Policy:
  * - Private/internal hosts require explicit operator authorization; otherwise
@@ -543,6 +543,29 @@ async function replayRequest(
   return { attempted: true, url: observedUrl(), note: "unreachable redirect state" };
 }
 
+/**
+ * Two requests are "the same" when method, URL, header set, and body all match.
+ * An intra-target differential whose attack and baseline are identical proves
+ * nothing — the discriminating variable must actually differ.
+ */
+export function sameRequest(
+  a: { method: string; url: string; headers?: Record<string, string>; body?: string },
+  b: { method: string; url: string; headers?: Record<string, string>; body?: string },
+): boolean {
+  const norm = (h?: Record<string, string>) =>
+    JSON.stringify(
+      Object.entries(h ?? {})
+        .map(([k, v]) => [k.toLowerCase(), v] as const)
+        .sort(([x], [y]) => (x < y ? -1 : x > y ? 1 : 0)),
+    );
+  return (
+    a.method.toUpperCase() === b.method.toUpperCase() &&
+    a.url === b.url &&
+    (a.body ?? "") === (b.body ?? "") &&
+    norm(a.headers) === norm(b.headers)
+  );
+}
+
 function injectCanary(
   verify: PoCEvidence["verify"],
   token: string | undefined,
@@ -612,6 +635,49 @@ export async function replayVerify(
   };
 }
 
+/**
+ * Combine the two observations into the differential verdict. Shared by the
+ * inter-host (target vs control host) and intra-target (attack vs same-host
+ * baseline) replays — only the note labels differ.
+ */
+function judgeDifferential(
+  target: HarnessResponseObservation,
+  control: HarnessResponseObservation,
+  token: string | undefined,
+  label: { kind: string; a: string; b: string },
+): HarnessVerifyResult {
+  const attempted = target.attempted && control.attempted;
+  const conclusive = target.matched !== undefined && control.matched !== undefined;
+  const differential = conclusive
+    ? target.matched === true
+      ? control.matched === true
+        ? "both"
+        : "target_only"
+      : control.matched === true
+        ? "control_only"
+        : "neither"
+    : undefined;
+  const canary = canaryResult(token, target, control);
+  const pass =
+    attempted &&
+    conclusive &&
+    differential === "target_only" &&
+    (canary === undefined || canary.pass === true);
+  return {
+    attempted,
+    pass,
+    status: target.status,
+    target,
+    control,
+    differential,
+    canary,
+    proofStrength: canary?.pass ? "canary_differential" : "predicate_differential",
+    note:
+      `harness ${label.kind} ${differential ?? "inconclusive"}: ${label.a} (${target.note}); ` +
+      `${label.b} (${control.note})${canary ? `; ${canary.note}` : ""}`,
+  };
+}
+
 /**
  * Execute one harness-owned request template against both the case target and
  * a distinct control origin. The PoC cannot weaken the control request: the
@@ -658,36 +724,75 @@ export async function replayDifferential(
     token,
     opts,
   );
-  const attempted = target.attempted && control.attempted;
-  const conclusive = target.matched !== undefined && control.matched !== undefined;
-  const targetMatched = target.matched === true;
-  const controlMatched = control.matched === true;
-  const differential = conclusive
-    ? targetMatched
-      ? controlMatched
-        ? "both"
-        : "target_only"
-      : controlMatched
-        ? "control_only"
-        : "neither"
+  return judgeDifferential(target, control, token, {
+    kind: "differential",
+    a: "target",
+    b: "control",
+  });
+}
+
+/**
+ * Same-host differential (Tier 2, intra-target). For access-control and
+ * business-logic classes the discriminating variable is the attacker's
+ * identity or a request parameter, NOT the host — so the sound baseline is a
+ * legitimate request to the SAME target, not the same request to another host.
+ * The harness sends the attack request and the model-declared `evidence.baseline`
+ * request to the case target, applies the attack's `verify.expect` predicates to
+ * BOTH responses, and passes only when the proof appears on the attack response
+ * and is absent from the baseline (`target_only`, where "target" = attack and
+ * "control" = baseline). The baseline is bound to the case target so it cannot
+ * be redirected to a weaker origin, and it must differ from the attack request.
+ */
+export async function replayIntraTarget(
+  evidence: PoCEvidence,
+  caseTarget: string,
+  opts?: ReplayOptions,
+): Promise<HarnessVerifyResult> {
+  const baseline = evidence.baseline;
+  if (!baseline) {
+    return {
+      attempted: false,
+      pass: false,
+      note: "intra-target differential requires evidence.baseline (a legitimate same-host request)",
+    };
+  }
+  const attackBinding = verifyUrlBindingError(evidence.verify.url, caseTarget);
+  if (attackBinding) {
+    return { attempted: false, pass: false, note: `attack binding failed: ${attackBinding}` };
+  }
+  const baselineBinding = verifyUrlBindingError(baseline.url, caseTarget);
+  if (baselineBinding) {
+    return { attempted: false, pass: false, note: `baseline binding failed: ${baselineBinding}` };
+  }
+  if (sameRequest(evidence.verify, baseline)) {
+    return {
+      attempted: false,
+      pass: false,
+      note: "attack and baseline requests are identical — an intra-target differential must vary identity or a parameter",
+    };
+  }
+
+  const token = evidence.verify.canary
+    ? `poc_canary_${randomBytes(24).toString("hex")}`
     : undefined;
-  const canary = canaryResult(token, target, control);
-  const pass =
-    attempted &&
-    conclusive &&
-    differential === "target_only" &&
-    (canary === undefined || canary.pass === true);
-  return {
-    attempted,
-    pass,
-    status: target.status,
-    target,
-    control,
-    differential,
-    canary,
-    proofStrength: canary?.pass ? "canary_differential" : "predicate_differential",
-    note:
-      `harness differential ${differential ?? "inconclusive"}: target (${target.note}); ` +
-      `control (${control.note})${canary ? `; ${canary.note}` : ""}`,
-  };
+  const attackVerify = injectCanary(evidence.verify, token);
+  const attack = await replayRequest(attackVerify, attackVerify.expect, token, opts);
+  // The baseline carries the attack's predicates: the proof must be ABSENT here.
+  const baselineVerify = injectCanary(
+    {
+      ...evidence.verify,
+      method: baseline.method,
+      url: baseline.url,
+      headers: baseline.headers,
+      body: baseline.body,
+    },
+    token,
+  );
+  const base = await replayRequest(baselineVerify, attackVerify.expect, token, opts);
+
+  return judgeDifferential(attack, base, token, {
+    kind: "intra-target",
+    a: "attack",
+    b: "baseline",
+  });
 }