Piolium Audit

# Default balanced audit against the current directory
vigolium agent piolium --source .

# Quick triage (lite, 4 phases) on a checkout
vigolium agent piolium --source ./backend --mode lite

# Deep audit (17 phases) on a remote repo, full clone history
vigolium agent piolium --source [email protected]:org/repo.git --mode deep

# Confirm an existing audit's findings live against a target
vigolium agent piolium --source ./backend --mode confirm

# Hail-mary file-by-file scan with a per-file budget
vigolium agent piolium --source ./backend --mode longshot --plm-longshot-limit 200

# Re-run with intensity preset (preset → mode + commit-depth)
vigolium agent piolium --source ./backend --intensity deep

+-----------------------------------------------------------+
|                  vigolium agent piolium                    |
|                                                            |
|  +------------------+    +-----------------------------+  |
|  |   Foreground      |    |  Subprocess (`pi --mode    |  |
|  |   Vigolium        |    |  json -p /piolium-<mode>`)  |  |
|  |                   |    |                             |  |
|  |  resolve source   |    |  Pi loads piolium ext.      |  |
|  |  spawn pi         |--->|  Phase orchestrator runs    |  |
|  |  decode JSONL     |<---|  spawns sub-agents          |  |
|  |  sync every 30s   |<---|  writes <source>/piolium/   |  |
|  |  parse findings   |<---|  exits                      |  |
|  +-------+-----------+    +-------------+---------------+  |
|          |                                                  |
|          v                                                  |
|  +-----------------------------------------------------+  |
|  |                     Database                         |  |
|  |  findings (source: scanner modules + piolium)       |  |
|  |  agentic_scans (mode=piolium, parent_uuid=...)      |  |
|  +-----------------------------------------------------+  |
+-----------------------------------------------------------+

vigolium agent piolium \
  [--mode {lite,balanced,deep,revisit,confirm,merge,diff,longshot,status,smoke}] \
  [--intensity {quick,balanced,deep}] \
  --source <path|git-url|gs://...|archive> \
  [--commit-depth N] \
  [--no-stream] \
  [--upload-results] \
  [--plm-* passthroughs]

# Balanced audit on a remote git URL, shallow clone
vigolium agent piolium \
  --source [email protected]:vigolium/piolium.git \
  --intensity balanced

# Deep audit with bounded commit history scan
vigolium agent piolium \
  --source ./backend \
  --mode deep \
  --plm-scan-limit 250 \
  --plm-scan-since "90 days ago"

# Longshot hunt on Python and Go files only
vigolium agent piolium \
  --source ./mono-repo \
  --mode longshot \
  --plm-longshot-langs python,go \
  --plm-longshot-limit 200

# Pinned scan UUID for cross-node sync
vigolium --scan-uuid 019aa... agent piolium --source ./backend

# Override pi's provider/model for this single run
vigolium agent piolium --source ./backend \
  --pi-provider vertex-anthropic \
  --pi-model claude-opus-4-6

vigolium agent piolium --source ./backend \
  --pi-provider google-vertex \
  --pi-model gemini-3.1-pro

# Default — runs archon then piolium sequentially
vigolium agent audit --source ./backend

# Just piolium (equivalent to `vigolium agent piolium`)
vigolium agent audit --driver piolium --source ./backend --mode lite

# Just archon (equivalent to `vigolium agent archon`)
vigolium agent audit --driver archon --source ./backend --agent claude

# Default — driver=both with intensity=balanced (archon then piolium,
# project-wide findings dedup after both exit)
curl -s -X POST http://localhost:9002/api/agent/run/audit \
  -H "Content-Type: application/json" \
  -d '{
    "source": "/home/user/src/my-app",
    "intensity": "balanced"
  }' | jq .

# Quick triage with intensity preset — driver=both, mode=lite,
# commit_depth=1 (resolved server-side from the preset)
curl -s -X POST http://localhost:9002/api/agent/run/audit \
  -H "Content-Type: application/json" \
  -d '{
    "source": "/home/user/src/my-app",
    "intensity": "quick",
    "driver": "both"
  }' | jq .

# Deep audit with full git history (intensity=deep → commit_depth=0)
# pinned to piolium only with a provider override
curl -s -X POST http://localhost:9002/api/agent/run/audit \
  -H "Content-Type: application/json" \
  -d '{
    "source": "[email protected]:org/repo.git",
    "intensity": "deep",
    "driver": "piolium",
    "pi_provider": "vertex-anthropic",
    "pi_model": "claude-opus-4-6"
  }' | jq .

# Source from Google Cloud Storage — server downloads + extracts the
# archive once, both drivers reuse the resolved tree (no double clone)
curl -s -X POST http://localhost:9002/api/agent/run/audit \
  -H "Content-Type: application/json" \
  -d '{
    "source": "gs://vigolium-uploads/acme/backend-2026-05-02.tar.gz",
    "intensity": "balanced",
    "project_uuid": "11111111-2222-3333-4444-555555555555"
  }' | jq .

# gs:// + driver=archon only (skip piolium even though it's installed)
curl -s -X POST http://localhost:9002/api/agent/run/audit \
  -H "Content-Type: application/json" \
  -d '{
    "source": "gs://vigolium-uploads/acme/backend-2026-05-02.zip",
    "driver": "archon",
    "agent": "claude",
    "intensity": "balanced"
  }' | jq .

# Explicit mode wins over intensity — longshot is piolium-only, so
# driver must be set to piolium (driver=both would 400)
curl -s -X POST http://localhost:9002/api/agent/run/audit \
  -H "Content-Type: application/json" \
  -d '{
    "source": "/home/user/src/mono-repo",
    "driver": "piolium",
    "mode": "longshot",
    "plm_longshot_langs": "python,go",
    "plm_longshot_limit": 200
  }' | jq .

# Skip the post-pass dedup (driver=both only — single-driver runs
# already INSERT-time-dedup by finding_hash)
curl -s -X POST http://localhost:9002/api/agent/run/audit \
  -H "Content-Type: application/json" \
  -d '{
    "source": "/home/user/src/my-app",
    "intensity": "balanced",
    "no_dedup": true
  }' | jq .

{
  "agentic_scan_uuid": "b1e100e5-1131-4b41-995d-f0991534ac14",
  "status": "running",
  "message": "audit (driver=both) started"
}

# Run both drivers, multiplexed SSE
curl -N -s -X POST http://localhost:9002/api/agent/run/audit \
  -H "Content-Type: application/json" \
  -d '{
    "source": "/home/user/src/my-app",
    "mode": "balanced",
    "driver": "both",
    "stream": true
  }'

# Autopilot — explicit piolium audit
curl -s -X POST http://localhost:9002/api/agent/run/autopilot \
  -H "Content-Type: application/json" \
  -d '{
    "target": "https://example.com",
    "source": "/home/user/src/my-app",
    "piolium": "balanced"
  }' | jq .

# Swarm — opt-in piolium audit during a targeted scan
curl -s -X POST http://localhost:9002/api/agent/run/swarm \
  -H "Content-Type: application/json" \
  -d '{
    "input": "https://example.com/api/users?id=1",
    "source": "/home/user/src/my-app",
    "discover": true,
    "piolium": "lite"
  }' | jq .

# Autopilot — let auto-pick decide; pi+piolium on this host means piolium wins
curl -s -X POST http://localhost:9002/api/agent/run/autopilot \
  -H "Content-Type: application/json" \
  -d '{
    "target": "https://example.com",
    "source": "/home/user/src/my-app"
  }' | jq .

ℹ Cost: ~$0.02 (model gpt-5.5)

agent:
  sessions_dir: ~/.vigolium/agent-sessions/   # session artifacts root

pi config set defaultProvider openai-codex
pi config set defaultModel gpt-5.5

<source_path>/
└── piolium/
    ├── audit-state.json               # Phase progress (snake_case keys, archon-compatible)
    ├── attack-surface/                # Recon, KB, SAST, probe summaries
    │   ├── lite-recon.md
    │   ├── knowledge-base-report.md
    │   ├── sast-merged.sarif
    │   ├── source-sink-flows-all-severities.md
    │   ├── public-routes-authz-matrix.md
    │   └── ...
    ├── findings-draft/                # Candidate findings (filed during a run)
    │   ├── q2-001-sql-injection-user-lookup.md
    │   └── ...
    ├── findings/                      # Final consolidated findings
    │   ├── p10-001-direct-git-url-ref-…/
    │   │   ├── draft.md               # Frontmatter metadata
    │   │   ├── report.md              # Polished, structured analysis
    │   │   ├── poc.{sh,ts,py,…}       # Executable proof
    │   │   └── evidence/              # Supporting files
    │   └── ...
    ├── final-audit-report.md          # Top-level report
    ├── confirmation-report.md         # confirm-mode output
    ├── chamber-workspace/             # Adversarial debate transcripts (deep mode)
    ├── codeql-artifacts/              # CodeQL DBs, SARIF
    ├── semgrep-rules/
    └── tmp/                           # Per-sub-agent run transcripts (cleaned up)

~/.vigolium/agent-sessions/<uuid>/
├── piolium-audit/                     # Synced from <source>/piolium/
│   ├── audit-state.json
│   ├── attack-surface/
│   ├── findings/
│   ├── final-audit-report.md
│   └── ...
├── audit-stream.jsonl                 # Raw Pi --mode json events
├── piolium-audit-output.md            # Captured stdout (fallback when stream is empty)
└── runtime.log                        # Replayable feed via `vigolium log <uuid>`

---
id: p10-001
phase: P10
source-draft: p4-001
slug: direct-git-url-ref-reaches-simple-git-clone
severity: high
verdict: VALID
debate: piolium/chamber-workspace/c01-git-and-lock-command/debate.md
---
PoC-Status: executed
Protocol: local
Auth-Required: no

# Direct git URL/ref reaches vulnerable simple-git clone boundary

## Summary
…

## Location
- Source: `src/add.ts:895-942`
- Sink:   `src/git.ts:25-62`

## Impact
…

## Evidence
…

# Via CLI
vigolium finding list --source piolium

# Via API
GET /api/findings?source=piolium

# Combined with archon
vigolium finding list --source piolium,archon

vigolium import /path/to/piolium-output/

# Default (uses whatever pi has configured as defaultProvider/defaultModel)
make test-e2e-piolium

# Override the provider/model for the run
VIGOLIUM_E2E_PI_PROVIDER=vertex-anthropic \
VIGOLIUM_E2E_PI_MODEL=claude-opus-4-6 \
  make test-e2e-piolium

VIGOLIUM_E2E_PI_PROVIDER=google-vertex \
VIGOLIUM_E2E_PI_MODEL=gemini-3.1-pro \
  make test-e2e-piolium

# Keep the session dir for inspection
VIGOLIUM_E2E_PI_KEEP=1 \
  make test-e2e-piolium

# Custom timeout (defaults to 5m)
VIGOLIUM_E2E_PI_TIMEOUT=10m make test-e2e-piolium