omp packages

@xaccefy/pi-casefile0.11.1

Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits

xaccefy Published 27 days ago MIT ~1K downloads/mo

Untested on omp

This is a pi package. No one has reported whether it works on omp yet. If you try it, add your result below.

Did it work for you?

Result

One report per person. A new report replaces your old one.

Reports 0

No reports yet.

Readme

pi-casefile

Security case ledger for the Pi agent — evidence tracking with machine-verified PoC gates.

npm License: MIT

What it is

A structured ledger for offensive-security work — bug bounties, CTFs, audits — built around one idea: an agent's claim is not evidence until the machine replays it.

Cases move hypothesis → investigating → confirmed → reported. Promotion between phases is gated:

  • Zero exit is necessary but never proof — direct-response findings require nonce-bound body evidence plus a DNS-pinned, conclusive target_only attack-vs-baseline replay against the case target (recorded at promote; the bundle's baseline binding and differential are re-validated at confirm)
  • Differential confirmation — the attack request must satisfy the claimed predicate while a legitimate same-host baseline request must not, so "it worked" means the discriminator fired, not "the agent said so"
  • Only the main agent makes the semantic decision and commits phase transitions

Designed for human + AI workflows: every confirmed finding carries a reproducible evidence trail a human can audit.

Tools

Tool Purpose
CaseAdd / CaseList / CaseSearch / CaseGet / CaseUpdate / CaseLink / CaseUnlink / CaseContext case lifecycle, search, links, and report context
EvidenceAdd attach raw evidence to a case
CoverageAdd record tested (asset × class) cells — found or clean
PromoteFinding → harness replay → ConfirmFinding gated finding pipeline
ScratchpadWrite / ScratchpadRead / ScratchpadClear working notes, resume-safe (no pipeline orchestration)

Install

pi install npm:@xaccefy/pi-casefile

Peer-depends on a Pi-compatible agent host (@earendil-works/pi-coding-agent, pi-ai, pi-tui, typebox). Runtime deps: undici.

Development

bun install
bun test --isolate
bun run typecheck

License

MIT