@xaccefy/pi-casefile

Offensive security case tracker for Pi Agent — bug bounties, CTFs, security audits

Packages

Package details

extension

Install @xaccefy/pi-casefile from npm and Pi will load the resources declared by the package manifest.

npm repohome report
$ pi install npm:@xaccefy/pi-casefile
Package
@xaccefy/pi-casefile
Version
0.11.1
Published
Sep 22, 2026
Downloads
693/mo · 77/wk
Author
xaccefy
License
MIT
Types
extension
Size
306.2 KB
Dependencies
1 dependency · 4 peers
Pi manifest JSON
{
  "extensions": [
    "./src/index.ts"
  ]
}

Security note

Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.

README

pi-casefile

Security case ledger for the Pi agent — evidence tracking with machine-verified PoC gates.

npm License: MIT

What it is

A structured ledger for offensive-security work — bug bounties, CTFs, audits — built around one idea: an agent's claim is not evidence until the machine replays it.

Cases move hypothesis → investigating → confirmed → reported. Promotion between phases is gated:

  • Zero exit is necessary but never proof — direct-response findings require nonce-bound body evidence plus a DNS-pinned, conclusive target_only attack-vs-baseline replay against the case target (recorded at promote; the bundle's baseline binding and differential are re-validated at confirm)
  • Differential confirmation — the attack request must satisfy the claimed predicate while a legitimate same-host baseline request must not, so "it worked" means the discriminator fired, not "the agent said so"
  • Only the main agent makes the semantic decision and commits phase transitions

Designed for human + AI workflows: every confirmed finding carries a reproducible evidence trail a human can audit.

Tools

Tool Purpose
CaseAdd / CaseList / CaseSearch / CaseGet / CaseUpdate / CaseLink / CaseUnlink / CaseContext case lifecycle, search, links, and report context
EvidenceAdd attach raw evidence to a case
CoverageAdd record tested (asset × class) cells — found or clean
PromoteFinding → harness replay → ConfirmFinding gated finding pipeline
ScratchpadWrite / ScratchpadRead / ScratchpadClear working notes, resume-safe (no pipeline orchestration)

Install

pi install npm:@xaccefy/pi-casefile

Peer-depends on a Pi-compatible agent host (@earendil-works/pi-coding-agent, pi-ai, pi-tui, typebox). Runtime deps: undici.

Development

bun install
bun test --isolate
bun run typecheck

License

MIT