pwn 0.5.620 → 0.5.621

data/lib/pwn/ai/agent/extrospection.rb

@@ -9,6 +9,7 @@ require 'open3'
 require 'etc'
 require 'uri'
 require 'shellwords'
+require 'timeout'
 
 module PWN
   module AI
@@ -43,6 +44,12 @@ module PWN
         MAX_OBSERVATIONS = 500
         RF_BINS    = %w[rtl_sdr rtl_test rtl_433 hackrf_info gqrx dump1090 multimon-ng SoapySDRUtil].freeze
         PROBE_BINS = (%w[nmap curl git ruby python3 gcc msfconsole sqlmap burpsuite zaproxy openssl docker] + RF_BINS).freeze
+        WEB_SHOT_DIR = File.join(Dir.home, '.pwn', 'extrospection', 'web')
+        DEFAULT_WEB_ANCHORS = %w[
+          https://services.nvd.nist.gov/rest/json/cves/2.0
+          https://www.exploit-db.com/
+          https://raw.githubusercontent.com/0dayinc/pwn/master/lib/pwn/version.rb
+        ].freeze
 
         # Supported Method Parameters::
         # store = PWN::AI::Agent::Extrospection.load
@@ -72,7 +79,7 @@ module PWN
         # Supported Method Parameters::
         # snap = PWN::AI::Agent::Extrospection.snapshot(
         #   persist: 'optional - Boolean, write snapshot to disk & rotate previous (default true)',
-        #   sections: 'optional - Array subset of [:host, :net, :toolchain, :repo, :env, :rf] (default all)'
+        #   sections: 'optional - Array subset of [:host, :net, :toolchain, :repo, :env, :rf, :web] (default all except :web)'
         # )
         #
         # Captures a fingerprint of the OUTSIDE world. When persist:true the
@@ -94,6 +101,7 @@ module PWN
           snap[:repo]      = probe_repo      if sections.include?(:repo)
           snap[:env]       = probe_env       if sections.include?(:env)
           snap[:rf]        = probe_rf        if sections.include?(:rf)
+          snap[:web]       = probe_web       if sections.include?(:web)
           snap[:captured_at] = Time.now.utc.iso8601
           snap[:fingerprint] = Digest::SHA256.hexdigest(JSON.generate(snap.except(:captured_at)))[0, 16]
 
@@ -112,7 +120,7 @@ module PWN
         # obs = PWN::AI::Agent::Extrospection.observe(
         #   source: 'required - where the observation came from (nmap, shodan, burp, cve, human, ...)',
         #   data: 'required - the observation payload (String or Hash)',
-        #   category: 'optional - :recon, :vuln, :intel, :target, :network, :env, :rf, :misc (default :misc)',
+        #   category: 'optional - :recon, :vuln, :intel, :target, :network, :env, :rf, :web, :misc (default :misc)',
         #   target: 'optional - host/ip/url/asset the observation is about',
         #   tags: 'optional - Array of String labels',
         #   ttl: 'optional - seconds until this observation is considered stale (default nil = forever)'
@@ -238,6 +246,189 @@ module PWN
           { query: query, feeds: feeds, results: results, total: results.values.flatten.compact.length }
         end
 
+        # Supported Method Parameters::
+        # verdict = PWN::AI::Agent::Extrospection.verify(
+        #   claim:  'required - factual claim to fact-check against the live web',
+        #   kind:   'optional - :cve | :version | :doc | :generic (default auto-detect)',
+        #   url:    'optional - explicit URL the claim cites (forces kind: :doc)',
+        #   commit: 'optional - write Mistakes/Memory/observe on refute/confirm (default true)',
+        #   proxy:  'optional - upstream proxy for TransparentBrowser (e.g. "tor")'
+        # )
+        #
+        # Browser-backed self fact-checking. Drives PWN::Plugins::TransparentBrowser
+        # in :headless mode against a canonical source for the claim class,
+        # renders the DOM (JS executed), and returns:
+        #
+        #   { claim:, kind:, verdict: :confirmed|:refuted|:unknown,
+        #     confidence: 0.0..1.0,
+        #     evidence: [{url:, title:, excerpt:, dom_sha:, screenshot:}],
+        #     action_taken: :mistakes_record | :extro_observe | :learning_note | nil }
+        #
+        # On :refuted  -> Mistakes.record(tool:'assumption', error:claim) so the
+        #                 KNOWN MISTAKES block warns every future run.
+        # On :confirmed-> observe(category::intel, ttl:30d) reinforces w/ freshness.
+        # On :unknown  -> Learning.note_outcome(success:false, tags:['needs_human']).
+        #
+        # This is the extrospective mirror of Mistakes: a PROACTIVE trigger that
+        # catches the model being wrong about the world before a human does.
+
+        public_class_method def self.verify(opts = {})
+          claim = opts[:claim].to_s.strip
+          raise 'ERROR: claim is required' if claim.empty?
+
+          kind   = (opts[:kind] || detect_claim_kind(claim: claim, url: opts[:url])).to_sym
+          commit = opts.key?(:commit) ? !opts[:commit].nil? && opts[:commit] != false : true
+          proxy  = opts[:proxy] || web_config[:proxy]
+
+          evidence = []
+          verdict  = :unknown
+          conf     = 0.0
+
+          with_headless_browser(proxy: proxy) do |bo|
+            case kind
+            when :cve
+              cve = claim[/CVE-\d{4}-\d{4,}/i].to_s.upcase
+              %W[https://nvd.nist.gov/vuln/detail/#{cve} https://www.cve.org/CVERecord?id=#{cve}].each do |u|
+                fp = fingerprint_page(browser_obj: bo, url: u)
+                evidence << fp if fp
+              end
+              body = evidence.map { |e| e[:text].to_s }.join(' ')
+              if evidence.empty? || evidence.all? { |e| e[:status].to_i >= 400 } || body =~ /could not be found|does not exist|reserved but/i
+                verdict = :refuted
+                conf = 0.8
+              else
+                prod = claim.sub(/CVE-\d{4}-\d{4,}/i, '').gsub(/affects?|is|in|the/i, ' ').split.select { |w| w.length > 2 }
+                hit  = prod.count { |w| body.downcase.include?(w.downcase) }
+                if prod.empty? || hit.to_f / prod.length >= 0.5
+                  verdict = :confirmed
+                  conf = prod.empty? ? 0.6 : [0.5 + (hit.to_f / prod.length * 0.5), 0.95].min
+                else
+                  verdict = :refuted
+                  conf = 0.6
+                end
+              end
+            when :doc
+              u = opts[:url] || claim[URI::DEFAULT_PARSER.make_regexp(%w[http https])]
+              fp = fingerprint_page(browser_obj: bo, url: u)
+              evidence << fp if fp
+              if fp.nil? || fp[:status].to_i >= 400 || fp[:reachable] == false
+                verdict = :refuted
+                conf = 0.7
+              else
+                snippet = claim.sub(u.to_s, '').strip
+                overlap = fuzzy_overlap(needle: snippet, haystack: fp[:text].to_s)
+                if fp[:title].to_s =~ /not found|404|error/i && overlap < 0.2
+                  verdict = :refuted
+                  conf = 0.7
+                else
+                  verdict = overlap >= 0.4 ? :confirmed : :unknown
+                  conf    = overlap
+                end
+              end
+            when :version
+              proj = claim[/[A-Za-z][\w.+-]{2,}/].to_s
+              ver  = claim[/v?\d+\.\d+(?:\.\d+)?/].to_s
+              %W[https://rubygems.org/gems/#{proj} https://pypi.org/project/#{proj}/ https://github.com/search?q=#{URI.encode_www_form_component(proj)}&type=repositories].each do |u|
+                fp = fingerprint_page(browser_obj: bo, url: u)
+                evidence << fp if fp
+              end
+              body = evidence.map { |e| e[:text].to_s }.join(' ')
+              if !ver.empty? && body.include?(ver)
+                verdict = :confirmed
+                conf = 0.7
+              elsif body =~ /\d+\.\d+(?:\.\d+)?/
+                verdict = :unknown
+                conf = 0.3
+              end
+            else
+              q  = URI.encode_www_form_component(claim)
+              fp = fingerprint_page(browser_obj: bo, url: "https://html.duckduckgo.com/html/?q=#{q}")
+              evidence << fp if fp
+              overlap = fuzzy_overlap(needle: claim, haystack: fp ? fp[:text].to_s : '')
+              verdict = overlap >= 0.5 ? :confirmed : :unknown
+              conf    = overlap
+            end
+          end
+
+          evidence.each { |e| e.delete(:text) }
+          action = commit ? commit_verdict(claim: claim, kind: kind, verdict: verdict, confidence: conf, evidence: evidence) : nil
+          { claim: claim, kind: kind, verdict: verdict, confidence: conf.round(2), evidence: evidence, action_taken: action }
+        rescue StandardError => e
+          { claim: claim, kind: kind, verdict: :unknown, confidence: 0.0, evidence: evidence, error: "#{e.class}: #{e.message}", action_taken: nil }
+        end
+
+        # Supported Method Parameters::
+        # obs = PWN::AI::Agent::Extrospection.watch(
+        #   url:      'required - URL to render and fingerprint',
+        #   selector: 'optional - CSS selector whose innerText to hash (default full body)',
+        #   ttl:      'optional - seconds until stale (default 7 days)',
+        #   proxy:    'optional - upstream proxy for TransparentBrowser'
+        # )
+        #
+        # Passive change-detection on an external artefact you care about
+        # (target /api/version, vendor changelog, bounty scope page).
+        # Renders headless, hashes the DOM text, screenshots, and persists as
+        # observe(category: :web). On subsequent snapshot(sections:[:web]) or
+        # watch of the same URL, a hash mismatch surfaces in drift() as
+        # ~web.<host>.dom_sha exactly like ~toolchain.nmap today.
+
+        public_class_method def self.watch(opts = {})
+          url = opts[:url].to_s
+          raise 'ERROR: url is required' if url.empty?
+
+          ttl   = opts[:ttl] || (7 * 24 * 3600)
+          proxy = opts[:proxy] || web_config[:proxy]
+          fp    = nil
+          with_headless_browser(proxy: proxy) do |bo|
+            fp = fingerprint_page(browser_obj: bo, url: url, selector: opts[:selector], screenshot: true)
+          end
+          raise "unreachable: #{url}" unless fp
+
+          prior = observations(category: 'web', target: url, limit: 1).first
+          changed = prior && prior.dig(:data, :dom_sha) && prior.dig(:data, :dom_sha) != fp[:dom_sha]
+          data = fp.slice(:status, :final_url, :title, :dom_sha, :cert_fp, :cert_not_after, :screenshot).merge(excerpt: fp[:text].to_s[0, 200])
+          observe(source: 'transparent_browser', category: :web, target: url, data: data, tags: (['watch'] + Array(opts[:tags])).compact, ttl: ttl)
+          { url: url, changed: changed, prior_sha: prior && prior.dig(:data, :dom_sha), current: data }
+        end
+
+        # Supported Method Parameters::
+        # report = PWN::AI::Agent::Extrospection.revalidate_memory(
+        #   limit: 'optional - max :fact entries to check (default 25)',
+        #   proxy: 'optional - upstream proxy for TransparentBrowser'
+        # )
+        #
+        # The browser as garbage-collector for PWN::Memory. Walks :fact entries
+        # containing a CVE id, version string or URL, runs verify() on each and
+        # prefixes stale ones with [UNVERIFIED yyyy-mm-dd] so the injected
+        # MEMORY block stops calcifying into confidently-wrong priors.
+        # Designed to be scheduled: cron_create(schedule:'0 4 * * 0',
+        #   ruby:'PWN::AI::Agent::Extrospection.revalidate_memory')
+
+        public_class_method def self.revalidate_memory(opts = {})
+          return { checked: 0, refuted: [], confirmed: [], unknown: [] } unless defined?(PWN::Memory)
+
+          lim   = opts[:limit] || 25
+          proxy = opts[:proxy] || web_config[:proxy]
+          rx    = %r{(CVE-\d{4}-\d{4,}|v?\d+\.\d+\.\d+|https?://\S+)}i
+          out   = { checked: 0, refuted: [], confirmed: [], unknown: [] }
+
+          PWN::Memory.load.each do |key, v|
+            break if out[:checked] >= lim
+            next unless v.is_a?(Hash) && v[:category].to_s == 'fact' && v[:value].to_s =~ rx
+            next if v[:value].to_s.start_with?('[UNVERIFIED')
+
+            res = verify(claim: v[:value].to_s[0, 400], commit: false, proxy: proxy)
+            out[:checked] += 1
+            out[res[:verdict]] << key
+            next unless res[:verdict] == :refuted && res[:confidence] >= 0.6
+
+            stamp = Time.now.utc.strftime('%Y-%m-%d')
+            PWN::Memory.remember(key: key, value: "[UNVERIFIED #{stamp}] #{v[:value]}", category: :fact)
+            observe(source: 'extro_verify', category: :web, target: key.to_s, data: "Memory :fact '#{key}' failed re-validation (#{res[:confidence]})", tags: %w[stale memory])
+          end
+          out
+        end
+
         # Supported Method Parameters::
         # findings = PWN::AI::Agent::Extrospection.correlate(
         #   limit: 'optional - max findings returned (default 10)'
@@ -304,7 +495,40 @@ module PWN
             end
           end
 
-          # 5) raw drift as low-priority findings when nothing else matched
+          # 5) :web drift on a target the same day a Learning failure references it —
+          #    "your exploit stopped working because the TARGET changed, not your approach"
+          if defined?(Learning)
+            observations(category: 'web', limit: 50).each do |ob|
+              tgt  = ob[:target].to_s
+              host = safe_host(url: tgt)
+              Learning.outcomes(limit: 30, success: false).each do |o|
+                next unless o[:task].to_s.include?(host) || o[:details].to_s.include?(host)
+
+                findings << { kind: :target_web_drift, target: tgt, dom_sha: ob.dig(:data, :dom_sha), task: o[:task], advice: "Target #{host} DOM changed (#{ob[:timestamp]}) around this failure — re-recon before assuming your technique is wrong." }
+              end
+            end
+          end
+
+          # 6) extro_verify refutations whose claim substring appears in a PWN::Memory :fact -> stale memory
+          if defined?(PWN::Memory)
+            observations(category: 'web', tag: 'stale', limit: 50).each do |ob|
+              findings << { kind: :stale_memory_fact, key: ob[:target], evidence: ob[:data], advice: "PWN::Memory[:#{ob[:target]}] failed browser re-verification — audit or memory_forget it before it poisons future prompts." }
+            end
+          end
+
+          # 7) :intel observations whose source anchor is currently probe_web-unreachable -> downgrade
+          web = snap[:web] || {}
+          web.each do |host, fp|
+            next unless fp.is_a?(Hash) && (fp[:reachable] == false || fp[:status].to_i >= 500)
+
+            observations(category: 'intel', limit: 100).each do |ob|
+              next unless ob[:source].to_s.include?(host.to_s) || ob[:data].to_s.include?(host.to_s)
+
+              findings << { kind: :intel_source_unreachable, source: host, status: fp[:status], intel: ob[:data].to_s[0, 120], advice: "Feed anchor #{host} is currently unreachable (#{fp[:status] || 'down'}) — treat this :intel as stale until probe_web sees it 2xx again." }
+            end
+          end
+
+          # 8) raw drift as low-priority findings when nothing else matched
           Array(delta[:added]).first(5).each   { |c| findings << { kind: :env_added,   detail: c } } if findings.empty?
           Array(delta[:removed]).first(5).each { |c| findings << { kind: :env_removed, detail: c } } if findings.empty?
 
@@ -363,7 +587,8 @@ module PWN
             drift_removed: Array(delta[:removed]).length,
             toolchain_bins: (snap[:toolchain] || {}).count { |_, v| !v.to_s.empty? },
             listening_ports: Array(snap.dig(:net, :listening)).length,
-            rf_devices: (snap[:rf] || {}).values_at(:rtl_sdr, :hackrf, :flipper, :gqrx_sock).count { |v| rf_present?(val: v) }
+            rf_devices: (snap[:rf] || {}).values_at(:rtl_sdr, :hackrf, :flipper, :gqrx_sock).count { |v| rf_present?(val: v) },
+            web_anchors: (snap[:web] || {}).count { |_, v| v.is_a?(Hash) && v[:reachable] }
           }
         end
 
@@ -536,6 +761,202 @@ module PWN
           []
         end
 
+        # Rendered-DOM fingerprint of a small, config-declared set of canonical
+        # web anchors the agent depends on for truth (feed reachability,
+        # upstream drift, in-scope target tech fingerprint). OPT-IN — never
+        # part of the default auto_extrospect section set because a headless
+        # browser is ~1-3s cold vs ~50ms for probe_host.
+        private_class_method def self.probe_web
+          anchors = web_anchors
+          return { anchors: 0 } if anchors.empty?
+
+          out = {}
+          with_headless_browser(proxy: web_config[:proxy]) do |bo|
+            anchors.first(web_config[:max_anchors]).each do |u|
+              host = safe_host(url: u).tr('.', '_')
+              fp   = fingerprint_page(browser_obj: bo, url: u, screenshot: web_config[:screenshot])
+              out[host.to_sym] = fp ? fp.slice(:status, :final_url, :title, :dom_sha, :server, :generator, :cert_fp, :cert_not_after, :reachable, :screenshot) : { reachable: false }
+            end
+          end
+          out
+        rescue StandardError => e
+          { error: "#{e.class}: #{e.message}" }
+        end
+
+        private_class_method def self.web_config
+          cfg = (PWN::Env.dig(:ai, :agent, :extrospection, :web) if defined?(PWN::Env) && PWN::Env.is_a?(Hash)) || {}
+          {
+            anchors: Array(cfg[:anchors] || cfg[:web_anchors]),
+            proxy: cfg[:proxy],
+            max_anchors: (cfg[:max_anchors] || 8).to_i,
+            per_page_timeout: (cfg[:per_page_timeout] || 15).to_i,
+            screenshot: cfg.key?(:screenshot) ? !cfg[:screenshot].nil? && cfg[:screenshot] != false : false,
+            allow_targets: cfg[:allow_targets] ? true : false
+          }
+        rescue StandardError
+          { anchors: [], proxy: nil, max_anchors: 8, per_page_timeout: 15, screenshot: false, allow_targets: false }
+        end
+
+        private_class_method def self.web_anchors
+          a = web_config[:anchors]
+          a = DEFAULT_WEB_ANCHORS.dup if a.empty?
+          a += Array(PWN::Env[:targets]) if defined?(PWN::Env) && PWN::Env.is_a?(Hash) && web_config[:allow_targets]
+          a.compact.map(&:to_s).reject(&:empty?).uniq
+        rescue StandardError
+          DEFAULT_WEB_ANCHORS.dup
+        end
+
+        private_class_method def self.safe_host(opts = {})
+          URI.parse(opts[:url].to_s).host || opts[:url].to_s
+        rescue StandardError
+          opts[:url].to_s
+        end
+
+        # One shared headless browser per call — open once, reuse across
+        # anchors, always close in ensure. Prefers :headless (firefox) which
+        # is lightest; degrades to :rest (RestClient) if watir/selenium is
+        # unavailable so probe_web/verify/watch never hard-fail the loop.
+        private_class_method def self.with_headless_browser(opts = {})
+          require 'pwn/plugins/transparent_browser'
+          bo = nil
+          begin
+            bo = PWN::Plugins::TransparentBrowser.open(browser_type: :headless, proxy: opts[:proxy])
+          rescue StandardError
+            bo = PWN::Plugins::TransparentBrowser.open(browser_type: :rest, proxy: opts[:proxy])
+          end
+          yield bo
+        ensure
+          begin
+            PWN::Plugins::TransparentBrowser.close(browser_obj: bo) if bo
+          rescue StandardError
+            nil
+          end
+        end
+
+        private_class_method def self.fingerprint_page(opts = {})
+          bo  = opts[:browser_obj]
+          url = opts[:url].to_s
+          return nil if bo.nil? || url.empty?
+
+          tmo = web_config[:per_page_timeout]
+          b   = bo[:browser]
+          if bo[:type] == :rest
+            resp = b.get(url) { |r, _rq, _res| r }
+            body = resp.body.to_s
+            require 'nokogiri'
+            doc  = Nokogiri::HTML.parse(body)
+            text = doc.text.to_s
+            cfp, cna = tls_fingerprint(url: url)
+            return { url: url, final_url: url, status: resp.code.to_i, title: doc.title.to_s,
+                     server: resp.headers[:server].to_s, generator: doc.at('meta[name="generator"]')&.[]('content').to_s,
+                     dom_sha: Digest::SHA256.hexdigest(text)[0, 16], text: text, cert_fp: cfp,
+                     cert_not_after: cna, reachable: resp.code.to_i < 400 }
+          end
+          Timeout.timeout(tmo) { b.goto(url) }
+          text  = extract_text(browser: b, selector: opts[:selector])
+          title = safe_attr(browser: b, meth: :title)
+          final = safe_attr(browser: b, meth: :url) || url
+          gen   = safe_meta(browser: b, name: 'generator')
+          shot  = opts[:screenshot] ? capture_screenshot(browser: b, url: url) : nil
+          cfp, cna = tls_fingerprint(url: final)
+          { url: url, final_url: final, status: 200, title: title.to_s, generator: gen.to_s, server: nil,
+            dom_sha: Digest::SHA256.hexdigest(text.to_s)[0, 16], text: text.to_s,
+            cert_fp: cfp, cert_not_after: cna, screenshot: shot, reachable: true }
+        rescue StandardError => e
+          { url: url, reachable: false, status: 0, error: "#{e.class}: #{e.message.to_s[0, 120]}", text: '' }
+        end
+
+        private_class_method def self.extract_text(opts = {})
+          b   = opts[:browser]
+          sel = opts[:selector]
+          return b.element(css: sel).text if sel && b.element(css: sel).exists?
+
+          b.text
+        rescue StandardError
+          b.respond_to?(:text) ? b.text.to_s : ''
+        end
+
+        private_class_method def self.safe_attr(opts = {})
+          opts[:browser].public_send(opts[:meth])
+        rescue StandardError
+          nil
+        end
+
+        private_class_method def self.safe_meta(opts = {})
+          el = opts[:browser].element(css: "meta[name=\"#{opts[:name]}\"]")
+          el.exists? ? el.attribute_value('content') : ''
+        rescue StandardError
+          ''
+        end
+
+        private_class_method def self.capture_screenshot(opts = {})
+          FileUtils.mkdir_p(WEB_SHOT_DIR)
+          host = safe_host(url: opts[:url]).gsub(/[^\w.-]/, '_')
+          path = File.join(WEB_SHOT_DIR, "#{host}.png")
+          opts[:browser].screenshot.save(path)
+          path
+        rescue StandardError
+          nil
+        end
+
+        private_class_method def self.tls_fingerprint(opts = {})
+          u = URI.parse(opts[:url].to_s)
+          return [nil, nil] unless u.scheme == 'https'
+
+          require 'openssl'
+          ssl = tcp = nil
+          tcp = TCPSocket.new(u.host, u.port || 443)
+          ctx = OpenSSL::SSL::SSLContext.new
+          ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
+          ssl = OpenSSL::SSL::SSLSocket.new(tcp, ctx)
+          ssl.hostname = u.host
+          ssl.connect
+          cert = ssl.peer_cert
+          [Digest::SHA256.hexdigest(cert.to_der)[0, 16], cert.not_after.utc.iso8601]
+        rescue StandardError
+          [nil, nil]
+        ensure
+          ssl&.close
+          tcp&.close
+        end
+
+        private_class_method def self.fuzzy_overlap(opts = {})
+          needle = opts[:needle].to_s.downcase.scan(/[a-z0-9]{3,}/).uniq
+          hay    = opts[:haystack].to_s.downcase
+          return 0.0 if needle.empty?
+
+          hit = needle.count { |w| hay.include?(w) }
+          hit.to_f / needle.length
+        end
+
+        private_class_method def self.detect_claim_kind(opts = {})
+          c = opts[:claim].to_s
+          return :doc     if opts[:url] || c =~ URI::DEFAULT_PARSER.make_regexp(%w[http https])
+          return :cve     if c =~ /CVE-\d{4}-\d{4,}/i
+          return :version if c =~ /\bv?\d+\.\d+(?:\.\d+)?\b/
+
+          :generic
+        end
+
+        private_class_method def self.commit_verdict(opts = {})
+          claim = opts[:claim]
+          ev    = Array(opts[:evidence]).first
+          case opts[:verdict]
+          when :refuted
+            Mistakes.record(tool: 'assumption', error: "REFUTED (extro_verify #{opts[:kind]}, conf=#{opts[:confidence].round(2)}): #{claim}", args: ev&.dig(:final_url), source: :model) if defined?(Mistakes)
+            observe(source: 'extro_verify', category: :web, target: ev&.dig(:final_url), data: "REFUTED: #{claim}", tags: %w[verify refuted], ttl: 30 * 24 * 3600)
+            :mistakes_record
+          when :confirmed
+            observe(source: 'extro_verify', category: :intel, target: ev&.dig(:final_url), data: claim, tags: %w[verify confirmed], ttl: 30 * 24 * 3600)
+            :extro_observe
+          else
+            Learning.note_outcome(task: "extro_verify: #{claim[0, 120]}", success: false, details: 'verdict :unknown — needs human review', tags: %w[needs_human extro_verify]) if defined?(Learning) && Learning.respond_to?(:note_outcome)
+            :learning_note
+          end
+        rescue StandardError
+          nil
+        end
+
         private_class_method def self.flatten(opts = {})
           hash   = opts[:hash] || {}
           prefix = opts[:prefix].to_s
@@ -663,11 +1084,19 @@ module PWN
               PWN::AI::Agent::Extrospection.to_context                        # injected by PromptBuilder
               PWN::AI::Agent::Extrospection.stats
               PWN::AI::Agent::Extrospection.auto_extrospect(session_id: sid)  # called from Learning.auto_reflect
+              PWN::AI::Agent::Extrospection.snapshot(sections: %i[web])        # opt-in browser probe of web_anchors
+              PWN::AI::Agent::Extrospection.watch(url: 'https://target/api/version')
+              PWN::AI::Agent::Extrospection.verify(claim: 'CVE-2026-12345 affects OpenSSL 3.2.1')
+              PWN::AI::Agent::Extrospection.revalidate_memory                  # cron: GC stale PWN::Memory :fact entries
               PWN::AI::Agent::Extrospection.reset
 
               Enable end-of-run auto-extrospection with:
                 PWN::Env[:ai][:agent][:auto_extrospect] = true
 
+              Configure browser-backed :web probe / verify / watch with:
+                PWN::Env[:ai][:agent][:extrospection][:web] =
+                  { anchors: [...], proxy: 'tor', max_anchors: 8, per_page_timeout: 15, screenshot: false, allow_targets: false }
+
               #{self}.authors
           USAGE
         end

data/lib/pwn/ai/agent/tools/extrospection.rb

@@ -29,7 +29,7 @@ PWN::AI::Agent::Registry.register(
       type: 'object',
       properties: {
         persist: { type: 'boolean', default: true, description: 'Write to disk & rotate previous baseline.' },
-        sections: { type: 'array', items: { type: 'string', enum: %w[host net toolchain repo env rf] }, description: 'Subset of probes to run (default all).' }
+        sections: { type: 'array', items: { type: 'string', enum: %w[host net toolchain repo env rf web] }, description: 'Subset of probes to run (default all).' }
       },
       required: []
     }
@@ -86,7 +86,7 @@ PWN::AI::Agent::Registry.register(
       properties: {
         source: { type: 'string', description: 'Where it came from (nmap, shodan, burp, cve, human, ...).' },
         data: { type: 'string', description: 'The observation itself.' },
-        category: { type: 'string', enum: %w[recon vuln intel target network env rf misc], default: 'misc' },
+        category: { type: 'string', enum: %w[recon vuln intel target network env rf web misc], default: 'misc' },
         target: { type: 'string', description: 'Host / IP / URL / asset the observation is about.' },
         tags: { type: 'array', items: { type: 'string' } },
         ttl: { type: 'integer', description: 'Seconds until stale (omit = forever).' }
@@ -187,7 +187,10 @@ PWN::AI::Agent::Registry.register(
                  'against toolchain drift / missing binaries, (b) Learning ' \
                  'failures against host/net/repo drift on the same day, ' \
                  '(c) recorded :intel observations against installed ' \
-                 'component versions. Returns actionable findings so the ' \
+                 'component versions, (d) :web DOM drift on watched targets ' \
+                 'against Learning failures citing that host, (e) refuted ' \
+                 'extro_verify claims against stale PWN::Memory :fact ' \
+                 'entries. Returns actionable findings so the ' \
                  'agent can distinguish "I did it wrong" from "the world ' \
                  'changed under me".',
     parameters: {
@@ -278,3 +281,85 @@ PWN::AI::Agent::Registry.register(
     { previous: prev, current: ai[:agent][:auto_extrospect] ? true : false }
   }
 )
+
+PWN::AI::Agent::Registry.register(
+  name: 'extro_verify',
+  toolset: 'extrospection',
+  schema: {
+    name: 'extro_verify',
+    description: 'Browser-backed SELF FACT-CHECK. Drives ' \
+                 'PWN::Plugins::TransparentBrowser (:headless) against a ' \
+                 'canonical source for the claim class (NVD/CVE.org for ' \
+                 ':cve, rubygems/PyPI/GitHub for :version, the cited URL ' \
+                 'for :doc, DuckDuckGo HTML for :generic), renders the DOM ' \
+                 'with JS executed, and returns {claim:, kind:, verdict: ' \
+                 ':confirmed|:refuted|:unknown, confidence:, evidence:[], ' \
+                 'action_taken:}. On :refuted → Mistakes.record(tool:' \
+                 "'assumption') so KNOWN MISTAKES warns every future run; " \
+                 'on :confirmed → observe(:intel, ttl:30d); on :unknown → ' \
+                 'Learning.note_outcome(tags:[needs_human]). This is the ' \
+                 'PROACTIVE trigger that catches the model being wrong ' \
+                 'about the world before a human does — the extrospective ' \
+                 'mirror of mistakes_record.',
+    parameters: {
+      type: 'object',
+      properties: {
+        claim: { type: 'string', description: 'Factual claim to fact-check (a CVE assertion, "latest X is v1.2.3", a cited URL + quoted snippet, or free text).' },
+        kind: { type: 'string', enum: %w[cve version doc generic], description: 'Force a verifier. Omit to auto-detect from the claim.' },
+        url: { type: 'string', description: 'Explicit URL the claim cites (forces kind: :doc).' },
+        commit: { type: 'boolean', default: true, description: 'Write Mistakes/observe/Learning on the verdict.' },
+        proxy: { type: 'string', description: 'Upstream proxy for TransparentBrowser (e.g. "tor" or http://127.0.0.1:8080).' }
+      },
+      required: %w[claim]
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Extrospection) && PWN::AI::Agent::Extrospection.respond_to?(:verify) },
+  handler: lambda { |args|
+    o = { claim: args[:claim] }
+    o[:kind]   = args[:kind]   if args[:kind]
+    o[:url]    = args[:url]    if args[:url]
+    o[:commit] = args[:commit] if args.key?(:commit)
+    o[:proxy]  = args[:proxy]  if args[:proxy]
+    PWN::AI::Agent::Extrospection.verify(o)
+  }
+)
+
+PWN::AI::Agent::Registry.register(
+  name: 'extro_watch',
+  toolset: 'extrospection',
+  schema: {
+    name: 'extro_watch',
+    description: 'Passive change-detection on an external web artefact you ' \
+                 'care about (a target /api/version, a vendor changelog, a ' \
+                 'bug-bounty scope page). Renders the URL headlessly via ' \
+                 'PWN::Plugins::TransparentBrowser, hashes the RENDERED DOM ' \
+                 'text (JS-delivered changes count), captures title / TLS ' \
+                 'cert fp / screenshot, and persists it as observe(' \
+                 'category: :web). Re-running against the same URL returns ' \
+                 '{changed: true|false, prior_sha:, current:{…}}; a ' \
+                 'subsequent extro_snapshot(sections:["web"]) surfaces the ' \
+                 'delta in drift() as ~web.<host>.dom_sha exactly like ' \
+                 '~toolchain.nmap today.',
+    parameters: {
+      type: 'object',
+      properties: {
+        url: { type: 'string', description: 'URL to render, hash and watch.' },
+        selector: { type: 'string', description: 'CSS selector whose innerText to hash (default full body).' },
+        ttl: { type: 'integer', description: 'Seconds until this :web observation is stale (default 604800 = 7d).' },
+        tags: { type: 'array', items: { type: 'string' } },
+        proxy: { type: 'string', description: 'Upstream proxy for TransparentBrowser (e.g. "tor").' }
+      },
+      required: %w[url]
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Extrospection) && PWN::AI::Agent::Extrospection.respond_to?(:watch) },
+  handler: lambda { |args|
+    PWN::AI::Agent::Extrospection.watch(
+      url: args[:url],
+      selector: args[:selector],
+      ttl: args[:ttl],
+      tags: args[:tags],
+      proxy: args[:proxy]
+    )
+  }
+)