pwn 0.5.620 → 0.5.622

data/lib/pwn/ai/agent/{introspection.rb → reflect.rb}

@@ -5,14 +5,14 @@ require 'json'
 module PWN
   module AI
     module Agent
-      # PWN::AI::Agent::Introspection is the inward-facing counterpart to
+      # PWN::AI::Agent::Reflect is the inward-facing counterpart to
       # PWN::AI::Agent::Extrospection. Where Extrospection looks OUTWARD at
       # the world the agent operates in (host state, toolchain, network,
-      # threat-intel), Introspection looks INWARD - it lets pwn hand a
-      # request to the active AI engine and reflect on its own artifacts,
-      # transcripts, findings, code, or decisions.
+      # threat-intel), Reflect looks INWARD - it lets pwn hand a request to
+      # the active AI engine and reflect on its own artifacts, transcripts,
+      # findings, code, or decisions.
       #
-      # This module is gated by `PWN::Env[:ai][:introspection]` so that
+      # This module is gated by `PWN::Env[:ai][:module_reflection]` so that
       # potentially-sensitive local data is never shipped to a remote LLM
       # unless the operator has explicitly opted in via pwn-vault / config.
       #
@@ -21,16 +21,16 @@ module PWN
       # through when it wants an LLM opinion on locally-produced data, and
       # it is also what PWN::AI::Agent::Learning.reflect uses to distill
       # session transcripts into durable PWN::Memory lessons.
-      module Introspection
+      module Reflect
         # Supported Method Parameters::
-        # response = PWN::AI::Agent::Introspection.reflect_on(
+        # response = PWN::AI::Agent::Reflect.on(
         #   request: 'required - String - What you want the AI to reflect on',
         #   system_role_content: 'optional - context to set up the model behavior for reflection',
         #   spinner: 'optional - Boolean - Display spinner during operation (default: false)',
         #   suppress_pii_warning: 'optional - Boolean - Suppress PII Warnings (default: false)'
         # )
 
-        public_class_method def self.reflect_on(opts = {})
+        public_class_method def self.on(opts = {})
           request = opts[:request]
           raise 'ERROR: request must be provided' if request.nil?
 
@@ -42,14 +42,14 @@ module PWN
 
           response = nil
 
-          ai_introspection = PWN::Env[:ai][:introspection]
+          ai_module_reflection = PWN::Env[:ai][:module_reflection]
 
-          if ai_introspection && request.length.positive?
+          if ai_module_reflection && request.length.positive?
             engine = PWN::Env[:ai][:active].to_s.downcase.to_sym
             valid_ai_engines = PWN::AI.help.reject { |e| e.downcase == :agent }.map(&:downcase)
             raise "ERROR: Unsupported AI engine. Supported engines are: #{valid_ai_engines}" unless valid_ai_engines.include?(engine)
 
-            warn "AI Introspection is enabled.  Ensure #{engine} has been authorized for use and/or requests are sanitized properly." unless suppress_pii_warning
+            warn "AI Reflection is enabled.  Ensure #{engine} has been authorized for use and/or requests are sanitized properly." unless suppress_pii_warning
             response = PWN::AI::Agent::Loop.run(
               request: request.chomp,
               system_role_content: system_role_content,
@@ -75,7 +75,7 @@ module PWN
 
         public_class_method def self.help
           puts "USAGE:
-            #{self}.reflect_on(
+            #{self}.on(
               request: 'required - String - What you want the AI to reflect on',
               system_role_content: 'optional - context to set up the model behavior for reflection',
               spinner: 'optional - Boolean - Display spinner during operation (default: false)',

data/lib/pwn/ai/agent/sast.rb

@@ -16,7 +16,7 @@ module PWN
 
           system_role_content = 'Your sole purpose is to analyze source code snippets and generate an Exploit Prediction Scoring System (EPSS) score between 0% - 100%.  Just generate a score unless score is >= 75% in which a PoC and code fix should also be included.'
 
-          PWN::AI::Agent::Introspection.reflect_on(
+          PWN::AI::Agent::Reflect.on(
             system_role_content: system_role_content,
             request: request,
             suppress_pii_warning: true

data/lib/pwn/ai/agent/tools/extrospection.rb

@@ -29,7 +29,7 @@ PWN::AI::Agent::Registry.register(
       type: 'object',
       properties: {
         persist: { type: 'boolean', default: true, description: 'Write to disk & rotate previous baseline.' },
-        sections: { type: 'array', items: { type: 'string', enum: %w[host net toolchain repo env rf] }, description: 'Subset of probes to run (default all).' }
+        sections: { type: 'array', items: { type: 'string', enum: %w[host net toolchain repo env rf web] }, description: 'Subset of probes to run (default all).' }
       },
       required: []
     }
@@ -86,7 +86,7 @@ PWN::AI::Agent::Registry.register(
       properties: {
         source: { type: 'string', description: 'Where it came from (nmap, shodan, burp, cve, human, ...).' },
         data: { type: 'string', description: 'The observation itself.' },
-        category: { type: 'string', enum: %w[recon vuln intel target network env rf misc], default: 'misc' },
+        category: { type: 'string', enum: %w[recon vuln intel target network env rf web misc], default: 'misc' },
         target: { type: 'string', description: 'Host / IP / URL / asset the observation is about.' },
         tags: { type: 'array', items: { type: 'string' } },
         ttl: { type: 'integer', description: 'Seconds until stale (omit = forever).' }
@@ -187,7 +187,10 @@ PWN::AI::Agent::Registry.register(
                  'against toolchain drift / missing binaries, (b) Learning ' \
                  'failures against host/net/repo drift on the same day, ' \
                  '(c) recorded :intel observations against installed ' \
-                 'component versions. Returns actionable findings so the ' \
+                 'component versions, (d) :web DOM drift on watched targets ' \
+                 'against Learning failures citing that host, (e) refuted ' \
+                 'extro_verify claims against stale PWN::Memory :fact ' \
+                 'entries. Returns actionable findings so the ' \
                  'agent can distinguish "I did it wrong" from "the world ' \
                  'changed under me".',
     parameters: {
@@ -255,7 +258,7 @@ PWN::AI::Agent::Registry.register(
     name: 'extro_auto_toggle',
     description: 'Enable/disable end-of-run auto-extrospection ' \
                  '(PWN::Env[:ai][:agent][:auto_extrospect]). When enabled, ' \
-                 'Learning.auto_reflect ALSO calls Extrospection.auto_' \
+                 'Learning.auto_introspect ALSO calls Extrospection.auto_' \
                  'extrospect after every final answer, so host drift is ' \
                  'captured continuously without an explicit extro_snapshot ' \
                  'call. Omit `enabled` to just read the current state.',
@@ -278,3 +281,85 @@ PWN::AI::Agent::Registry.register(
     { previous: prev, current: ai[:agent][:auto_extrospect] ? true : false }
   }
 )
+
+PWN::AI::Agent::Registry.register(
+  name: 'extro_verify',
+  toolset: 'extrospection',
+  schema: {
+    name: 'extro_verify',
+    description: 'Browser-backed SELF FACT-CHECK. Drives ' \
+                 'PWN::Plugins::TransparentBrowser (:headless) against a ' \
+                 'canonical source for the claim class (NVD/CVE.org for ' \
+                 ':cve, rubygems/PyPI/GitHub for :version, the cited URL ' \
+                 'for :doc, DuckDuckGo HTML for :generic), renders the DOM ' \
+                 'with JS executed, and returns {claim:, kind:, verdict: ' \
+                 ':confirmed|:refuted|:unknown, confidence:, evidence:[], ' \
+                 'action_taken:}. On :refuted → Mistakes.record(tool:' \
+                 "'assumption') so KNOWN MISTAKES warns every future run; " \
+                 'on :confirmed → observe(:intel, ttl:30d); on :unknown → ' \
+                 'Learning.note_outcome(tags:[needs_human]). This is the ' \
+                 'PROACTIVE trigger that catches the model being wrong ' \
+                 'about the world before a human does — the extrospective ' \
+                 'mirror of mistakes_record.',
+    parameters: {
+      type: 'object',
+      properties: {
+        claim: { type: 'string', description: 'Factual claim to fact-check (a CVE assertion, "latest X is v1.2.3", a cited URL + quoted snippet, or free text).' },
+        kind: { type: 'string', enum: %w[cve version doc generic], description: 'Force a verifier. Omit to auto-detect from the claim.' },
+        url: { type: 'string', description: 'Explicit URL the claim cites (forces kind: :doc).' },
+        commit: { type: 'boolean', default: true, description: 'Write Mistakes/observe/Learning on the verdict.' },
+        proxy: { type: 'string', description: 'Upstream proxy for TransparentBrowser (e.g. "tor" or http://127.0.0.1:8080).' }
+      },
+      required: %w[claim]
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Extrospection) && PWN::AI::Agent::Extrospection.respond_to?(:verify) },
+  handler: lambda { |args|
+    o = { claim: args[:claim] }
+    o[:kind]   = args[:kind]   if args[:kind]
+    o[:url]    = args[:url]    if args[:url]
+    o[:commit] = args[:commit] if args.key?(:commit)
+    o[:proxy]  = args[:proxy]  if args[:proxy]
+    PWN::AI::Agent::Extrospection.verify(o)
+  }
+)
+
+PWN::AI::Agent::Registry.register(
+  name: 'extro_watch',
+  toolset: 'extrospection',
+  schema: {
+    name: 'extro_watch',
+    description: 'Passive change-detection on an external web artefact you ' \
+                 'care about (a target /api/version, a vendor changelog, a ' \
+                 'bug-bounty scope page). Renders the URL headlessly via ' \
+                 'PWN::Plugins::TransparentBrowser, hashes the RENDERED DOM ' \
+                 'text (JS-delivered changes count), captures title / TLS ' \
+                 'cert fp / screenshot, and persists it as observe(' \
+                 'category: :web). Re-running against the same URL returns ' \
+                 '{changed: true|false, prior_sha:, current:{…}}; a ' \
+                 'subsequent extro_snapshot(sections:["web"]) surfaces the ' \
+                 'delta in drift() as ~web.<host>.dom_sha exactly like ' \
+                 '~toolchain.nmap today.',
+    parameters: {
+      type: 'object',
+      properties: {
+        url: { type: 'string', description: 'URL to render, hash and watch.' },
+        selector: { type: 'string', description: 'CSS selector whose innerText to hash (default full body).' },
+        ttl: { type: 'integer', description: 'Seconds until this :web observation is stale (default 604800 = 7d).' },
+        tags: { type: 'array', items: { type: 'string' } },
+        proxy: { type: 'string', description: 'Upstream proxy for TransparentBrowser (e.g. "tor").' }
+      },
+      required: %w[url]
+    }
+  },
+  check: -> { defined?(PWN::AI::Agent::Extrospection) && PWN::AI::Agent::Extrospection.respond_to?(:watch) },
+  handler: lambda { |args|
+    PWN::AI::Agent::Extrospection.watch(
+      url: args[:url],
+      selector: args[:selector],
+      ttl: args[:ttl],
+      tags: args[:tags],
+      proxy: args[:proxy]
+    )
+  }
+)

data/lib/pwn/ai/agent/tools/learning.rb

@@ -190,13 +190,13 @@ PWN::AI::Agent::Registry.register(
 )
 
 PWN::AI::Agent::Registry.register(
-  name: 'learning_auto_reflect_toggle',
+  name: 'learning_auto_introspect_toggle',
   toolset: 'learning',
   schema: {
-    name: 'learning_auto_reflect_toggle',
+    name: 'learning_auto_introspect_toggle',
     description: 'Enable/disable end-of-run auto-reflection ' \
-                 '(PWN::Env[:ai][:agent][:auto_reflect]). When enabled, ' \
-                 'Loop.run calls Learning.auto_reflect on the session after ' \
+                 '(PWN::Env[:ai][:agent][:auto_introspect]). When enabled, ' \
+                 'Loop.run calls Learning.auto_introspect on the session after ' \
                  'every final answer. Disable during noisy fuzzing loops; ' \
                  're-enable for the summary turn. Omit `enabled` to just ' \
                  'read the current state.',
@@ -214,8 +214,8 @@ PWN::AI::Agent::Registry.register(
     raise 'PWN::Env[:ai] is unavailable or immutable' unless ai.is_a?(Hash) && !ai.frozen?
 
     ai[:agent] = (ai[:agent] || {}).dup if ai[:agent].nil? || ai[:agent].frozen?
-    prev = ai[:agent][:auto_reflect] ? true : false
-    ai[:agent][:auto_reflect] = (args[:enabled] ? true : false) if args.key?(:enabled)
-    { previous: prev, current: ai[:agent][:auto_reflect] ? true : false }
+    prev = ai[:agent][:auto_introspect] ? true : false
+    ai[:agent][:auto_introspect] = (args[:enabled] ? true : false) if args.key?(:enabled)
+    { previous: prev, current: ai[:agent][:auto_introspect] ? true : false }
   }
 )

data/lib/pwn/ai/agent/transparent_browser.rb

@@ -20,7 +20,7 @@ module PWN
 
           system_role_content = "Being an expert penetration tester skilled in code analysis, debugging, and exploitation while stepping through JavaScript in a Chrome DevTools debugging session:  1. Your sole purpose is to analyze each JavaScript step and generate an Exploit Prediction Scoring System (EPSS) score between 0% - 100%.  The step currently resides in this block of JavaScript:\n```\n#{source_to_review}\n```\n2. If the score is >= 75%, generate a JavaScript proof-of-concept that would allow a threat actor to directly exploit or target a user for exploitation (i.e. no self-exploit).  3. If the EPSS score is >= 75% also provide a code fix. *** If the EPSS score is < 75%, no explanations or summaries - just the EPSS score."
 
-          PWN::AI::Agent::Introspection.reflect_on(
+          PWN::AI::Agent::Reflect.on(
             system_role_content: system_role_content,
             request: request,
             suppress_pii_warning: true

data/lib/pwn/ai/agent/vuln_gen.rb

@@ -12,7 +12,7 @@ module PWN
       # 4. CVSS score, vector string, and first.org calculator URI
       # 5. CWE category, brief description, and CWE URI
       # 6. Relevant NIST 800-53 control
-      # It leverages the PWN::AI::Agent::Introspection.reflect_on method. Defaults to Jira for existing workflow compatibility.
+      # It leverages the PWN::AI::Agent::Reflect.on method. Defaults to Jira for existing workflow compatibility.
       module VulnGen
         # Supported Method Parameters::
         # ai_analysis = PWN::AI::Agent::VulnGen.analyze(
@@ -60,7 +60,7 @@ module PWN
           6. NIST 800-53 Security Control that is impacted by this vulnerability.
           "
 
-          analysis = PWN::AI::Agent::Introspection.reflect_on(
+          analysis = PWN::AI::Agent::Reflect.on(
             system_role_content: system_role_content,
             request: request,
             suppress_pii_warning: true

data/lib/pwn/ai/agent.rb

@@ -27,7 +27,7 @@ module PWN
       autoload :Learning,      'pwn/ai/agent/learning'
       autoload :Mistakes,      'pwn/ai/agent/mistakes'
       autoload :Extrospection, 'pwn/ai/agent/extrospection'
-      autoload :Introspection, 'pwn/ai/agent/introspection'
+      autoload :Reflect,       'pwn/ai/agent/reflect'
       autoload :Swarm,         'pwn/ai/agent/swarm'
 
       # Display a List of Every PWN::AI Module

data/lib/pwn/ai/open_ai.rb

@@ -250,17 +250,21 @@ module PWN
         end
         messages.push(user_role)
 
-        # `max_tokens` is deprecated on /v1/chat/completions; the unified
-        # parameter is `max_completion_tokens` and works for every chat model
+        # Wire config key `max_tokens` (kept for cross-engine naming parity with
+        # Anthropic/Gemini) to the OpenAI wire-format field `max_completion_tokens`.
+        # OpenAI deprecated the request-body key `max_tokens` on /v1/chat/completions
+        # in favour of `max_completion_tokens`, which works for every chat model
         # including the reasoning family. Don't try to guess per-model caps —
-        # let the server clamp; default to a generous ceiling that the
-        # operator can override via PWN::Env[:ai][:openai][:max_completion_tokens].
-        max_completion_tokens = (engine[:max_completion_tokens] || 16_384).to_i
+        # let the server clamp; default to a generous ceiling that the operator
+        # can override via PWN::Env[:ai][:openai][:max_tokens].
+        # Accept legacy :max_completion_tokens as a one-release alias so existing
+        # pwn.yaml files keep working without a silent clamp to the default.
+        max_tokens = (engine[:max_tokens] || engine[:max_completion_tokens] || 16_384).to_i
 
         http_body = {
           model: model,
           messages: messages,
-          max_completion_tokens: max_completion_tokens
+          max_completion_tokens: max_tokens
         }
         # Reasoning models reject sampler params (temperature, top_p, etc.)
         http_body[:temperature] = temp unless reasoning

data/lib/pwn/config.rb

@@ -29,7 +29,7 @@ module PWN
       env = {
         ai: {
           active: 'grok',
-          introspection: false,
+          module_reflection: false,
           grok: {
             base_uri: 'optional - Base URI for Grok - Use private base OR defaults to https://api.x.ai/v1',
             key: 'required - xAI Grok API Key',
@@ -58,6 +58,7 @@ module PWN
             model: 'optional - OpenAI model to use',
             system_role_content: 'You are an ethically hacking OpenAI agent.',
             temp: 'optional - OpenAI temperature',
+            max_tokens: 'optional - Max output tokens per response (default 16384). Mapped to OpenAI wire param max_completion_tokens.',
             max_prompt_length: 128_000
           },
           ollama: {
@@ -90,9 +91,9 @@ module PWN
             max_iters: 25,
             # Swarm (agent_ask/agent_debate) sub-agent recursion cap
             max_depth: 3,
-            # run PWN::AI::Agent::Learning.auto_reflect after every final answer
-            auto_reflect: true,
-            # also run PWN::AI::Agent::Extrospection.auto_extrospect from auto_reflect
+            # run PWN::AI::Agent::Learning.auto_introspect after every final answer
+            auto_introspect: true,
+            # also run PWN::AI::Agent::Extrospection.auto_extrospect from auto_introspect
             auto_extrospect: false,
             toolsets: nil
             # multi-agent personas : ~/.pwn/agents.yml  (see PWN::AI::Agent::Swarm.help)

data/lib/pwn/plugins/burp_suite.rb

@@ -50,7 +50,7 @@ module PWN
       #   type: 'required - type of history to introspect (:sitemap, :proxy_history, :websocket_history)'
       # )
       private_class_method def self.init_introspection_thread(opts = {})
-        #  if PWN::Env[:ai][:introspection] is true,
+        #  if PWN::Env[:ai][:module_reflection] is true,
         #  spin up Thread to:
         #  1. Periodically call get_proxy_history(burp_obj: burp_obj) method
         #  2. For each entry w/ empty comment,
@@ -65,7 +65,7 @@ module PWN
         type = opts[:type]
         raise "ERROR: type parameter is required and must be one of: #{valid_types.join(', ')}" unless valid_types.include?(type)
 
-        if PWN::Env[:ai][:introspection]
+        if PWN::Env[:ai][:module_reflection]
           introspection_thread_arr = burp_obj[:introspection_threads] ||= []
           introspection_thread = Thread.new do
             get_highlight_color = lambda do |opts = {}|

data/lib/pwn/sast/pom_version.rb

@@ -19,8 +19,8 @@ module PWN
         dir_path = opts[:dir_path]
         git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
         result_arr = []
-        ai_introspection = PWN::Env[:ai][:introspection]
-        logger_results = "AI Introspection => #{PWN::Env[:ai][:introspecction]} => "
+        ai_module_reflection = PWN::Env[:ai][:module_reflection]
+        logger_results = "AI Module Reflection => #{PWN::Env[:ai][:module_reflection]} => "
 
         PWN::Plugins::FileFu.recurse_in_dir(dir_path: dir_path) do |entry|
           if File.file?(entry) && File.basename(entry) == 'pom.xml' && entry !~ /test/i

data/lib/pwn/sast/test_case_engine.rb

@@ -63,7 +63,7 @@ module PWN
         git_repo_root_uri = opts[:git_repo_root_uri].to_s.scrub
 
         result_arr = []
-        logger_results = "AI Introspection => #{PWN::Env[:ai][:introspection]} => "
+        logger_results = "AI Module Reflection => #{PWN::Env[:ai][:module_reflection]} => "
 
         PWN::Plugins::FileFu.recurse_in_dir(
           dir_path: dir_path,

data/lib/pwn/sdr/decoder/adsb.rb

@@ -1,15 +1,16 @@
 # frozen_string_literal: true
 
-require 'shellwords'
-
 module PWN
   module SDR
     module Decoder
-      # ADS-B (Automatic Dependent Surveillance – Broadcast) decoder for
-      # aircraft transponder squitters on 1090 MHz (Mode-S / ES) and 978 MHz
-      # (UAT). 2 Mbit/s PPM cannot be recovered from GQRX audio, so this
-      # module drives `dump1090` (or `dump978-fa`) directly against the SDR
-      # and structures each SBS-1/BaseStation CSV line it emits on stdout.
+      # Pure-Ruby ADS-B (1090 MHz Mode-S / 978 MHz UAT) activity detector.
+      #
+      # Mode-S Extended Squitter is 2 Mbit/s PPM with 8/120 μs frames on a
+      # 2 MHz-wide channel — physically unrecoverable from GQRX's 48 kHz
+      # demodulated-audio tap. Rather than shell out to `dump1090`, this
+      # module runs Base.run_detector to characterise squitter density
+      # (bursts/sec, peak dBFS, floor) natively in Ruby. `parse_line` is
+      # retained for offline SBS-1 CSV analysis.
       module ADSB
         SBS_FIELDS = %i[
           msg_type tx_type session_id aircraft_id icao24 flight_id
@@ -25,28 +26,13 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
-
-          hz   = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
-          gain = (freq_obj[:rf_gain] || 40).to_s.to_f
-          uat  = hz.between?(977_000_000, 979_000_000)
-
-          direct_cmd =
-            if uat && PWN::SDR::Decoder::Base.bin_available?(bin: 'dump978-fa')
-              "bash -c #{Shellwords.escape("dump978-fa --sdr driver=rtlsdr --sdr-gain #{gain} --raw-stdout 2>/dev/null | uat2text")}"
-            elsif PWN::SDR::Decoder::Base.bin_available?(bin: 'dump1090-fa')
-              "dump1090-fa --device-type rtlsdr --gain #{gain} --net-sbs-stdout --quiet"
-            else
-              "dump1090 --gain #{gain} --net-sbs-stdout --quiet"
-            end
-
-          PWN::SDR::Decoder::Base.run_pipeline(
+          hz  = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          uat = hz.between?(977_000_000, 979_000_000)
+          PWN::SDR::Decoder::Base.run_detector(
             freq_obj: freq_obj,
             protocol: uat ? 'ADSB-UAT978' : 'ADSB-1090ES',
-            required_bins: uat ? %w[dump978-fa uat2text] : %w[dump1090],
-            direct_cmd: direct_cmd,
-            line_match: /^(MSG,|-|\+)/,
-            parser: proc { |line| parse_line(line: line) }
+            note: '2 Mbit/s PPM squitters exceed the 48 kHz audio-tap Nyquist limit; native mode reports squitter-burst density only. Feed captured SBS-1 CSV to .parse_line for full field decode.',
+            describe: proc { |b| { modulation: 'PPM', frame_len_us: 120, classification: b[:duration_ms] < 5 ? 'squitter' : 'interrogation-train' } }
           )
         end
 
@@ -60,7 +46,6 @@ module PWN
           f   = line.split(',', -1)
           out = { protocol: 'ADSB' }
           SBS_FIELDS.each_with_index { |k, i| out[k] = f[i] unless f[i].to_s.empty? }
-
           bits = []
           bits << "ICAO=#{out[:icao24]}" if out[:icao24]
           bits << "CS=#{out[:callsign].to_s.strip}" if out[:callsign]
@@ -81,15 +66,11 @@ module PWN
         # Display Usage for this Module
 
         public_class_method def self.help
-          puts "USAGE:
+          puts "USAGE (ruby-native detector, no external binaries):
             #{self}.decode(
               freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
             )
 
-            NOTE: Requires `dump1090` (1090 MHz Mode-S/ES) or
-                  `dump978-fa` + `uat2text` (978 MHz UAT). Owns the SDR
-                  directly — set freq_obj[:sdr_args] if GQRX has device 0.
-
             #{self}.parse_line(line: 'MSG,3,1,1,ABCDEF,1,...')
 
             #{self}.authors

data/lib/pwn/sdr/decoder/apt.rb

@@ -1,16 +1,100 @@
 # frozen_string_literal: true
 
-require 'shellwords'
-
 module PWN
   module SDR
     module Decoder
-      # NOAA APT (Automatic Picture Transmission) decoder for the 137 MHz
-      # polar-orbiting weather satellites (NOAA-15/18/19). APT is a 2400 Hz
-      # AM subcarrier inside a 34 kHz-wide FM downlink; GQRX's UDP audio is
-      # recorded to a WAV, then handed to `noaa-apt` (or `satdump`) to render
-      # the two-channel visible/IR image strip.
+      # Pure-Ruby NOAA APT (Automatic Picture Transmission) decoder for the
+      # 137 MHz polar-orbiting weather satellites (NOAA-15/18/19).
+      #
+      # APT is a 2400 Hz AM subcarrier inside a ~34 kHz-wide FM downlink
+      # carrying two 909-pixel image channels at 2 lines/second (4160
+      # words/line). This module envelope-demodulates the 2400 Hz carrier
+      # from GQRX's 48 kHz UDP audio, resamples to 4160 words/sec, aligns
+      # each line on the 7-pulse Sync-A pattern, and appends the resulting
+      # 8-bit greyscale rows to a Netpbm PGM (P5) file — all in Ruby.
+      # No `sox`, no `noaa-apt`.
       module APT
+        WORDS_PER_LINE = 4160
+        LINES_PER_SEC  = 2
+        WORD_RATE      = WORDS_PER_LINE * LINES_PER_SEC # 8320 Hz
+        # Sync-A: 7 cycles of 1040 Hz square = 1 1 0 0 repeated 7 times
+        SYNC_A = ([1, 1, 0, 0] * 7).freeze
+
+        # Streaming APT demodulator fed by Base.run_native.
+        class Demod
+          def initialize(rate: 48_000, out_path: nil)
+            @rate     = rate
+            @carrier  = 2400.0
+            @env_win  = (rate / @carrier).round # ≈20 samples per cycle
+            @stamp    = Time.now.strftime('%Y%m%d_%H%M%S')
+            @pgm_path = out_path || "/tmp/apt_#{@stamp}.pgm"
+            @rows     = []
+            @word_buf = []
+            @minv     = 1.0
+            @maxv     = 0.0
+          end
+
+          def feed(samples, &)
+            env   = PWN::SDR::Decoder::DSP.envelope(samples: samples, window: @env_win)
+            words = PWN::SDR::Decoder::DSP.resample(samples: env, src_rate: @rate, dst_rate: WORD_RATE)
+            @word_buf.concat(words)
+            extract_lines(&)
+          end
+
+          private
+
+          def extract_lines
+            while @word_buf.length >= WORDS_PER_LINE * 2
+              off = sync_offset(@word_buf[0, WORDS_PER_LINE])
+              @word_buf.shift(off) if off.positive?
+              break if @word_buf.length < WORDS_PER_LINE
+
+              row = @word_buf.shift(WORDS_PER_LINE)
+              lo, hi = row.minmax
+              @minv = lo if lo < @minv
+              @maxv = hi if hi > @maxv
+              @rows << row
+              write_pgm if (@rows.length % 20).zero?
+              yield(
+                protocol: 'NOAA-APT',
+                lines: @rows.length,
+                seconds: @rows.length / LINES_PER_SEC,
+                pgm: @pgm_path,
+                summary: "APT line #{@rows.length} (#{@rows.length / LINES_PER_SEC}s) → #{@pgm_path}"
+              )
+            end
+          end
+
+          def sync_offset(row)
+            mid = row.sum / row.length
+            best_off = 0
+            best_cor = -1.0
+            (0..(row.length - SYNC_A.length)).each do |o|
+              cor = 0.0
+              SYNC_A.each_with_index do |s, i|
+                cor += (row[o + i] - mid) * (s.zero? ? -1.0 : 1.0)
+              end
+              if cor > best_cor
+                best_cor = cor
+                best_off = o
+              end
+            end
+            best_off
+          end
+
+          def write_pgm
+            span = @maxv - @minv
+            span = 1.0 if span <= 0
+            File.open(@pgm_path, 'wb') do |f|
+              f.write("P5\n#{WORDS_PER_LINE} #{@rows.length}\n255\n")
+              @rows.each do |row|
+                bytes = row.map { |v| (((v - @minv) / span) * 255).clamp(0, 255).round }
+                f.write(bytes.pack('C*'))
+              end
+            end
+          end
+        end
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::APT.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -18,35 +102,11 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
-
-          stamp   = Time.now.strftime('%Y%m%d_%H%M%S')
-          wav_out = "/tmp/apt_#{stamp}.wav"
-          png_out = "/tmp/apt_#{stamp}.png"
-
-          # Record 11 025 Hz WAV (noaa-apt's native rate) until [ENTER],
-          # emitting a heartbeat line per second so the spinner stays live,
-          # then decode to PNG on exit.
-          inner = 'sox -t raw -e signed-integer -b 16 -r 22050 -c 1 - ' \
-                  "-t wav -r 11025 #{Shellwords.escape(wav_out)} & SOXPID=$!; " \
-                  'trap "kill $SOXPID 2>/dev/null" EXIT INT TERM; ' \
-                  'while kill -0 $SOXPID 2>/dev/null; do ' \
-                  "echo APT_REC seconds=$SECONDS file=#{wav_out}; sleep 1; done"
-
-          PWN::SDR::Decoder::Base.run_pipeline(
+          PWN::SDR::Decoder::Base.run_native(
             freq_obj: freq_obj,
             protocol: 'NOAA-APT',
-            required_bins: %w[sox noaa-apt],
-            decode_cmd: "bash -c #{Shellwords.escape(inner)}",
-            line_match: /^APT_REC/,
-            parser: proc { |line| { protocol: 'NOAA-APT', wav: wav_out, png: png_out, summary: line.strip } }
+            demod: Demod.new
           )
-
-          return unless File.exist?(wav_out) && File.size(wav_out).positive?
-
-          system('noaa-apt', wav_out, '-o', png_out)
-
-          puts "[*] APT image written: #{png_out}" if File.exist?(png_out)
         end
 
         # Author(s):: 0day Inc. <support@0dayinc.com>
@@ -58,13 +118,14 @@ module PWN
         # Display Usage for this Module
 
         public_class_method def self.help
-          puts "USAGE:
+          puts "USAGE (ruby-native, no external binaries):
             #{self}.decode(
               freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
             )
 
-            NOTE: Requires `sox` and `noaa-apt`. Set GQRX to FM, ~34 kHz BW.
-                  Records the pass to /tmp/apt_<ts>.wav, decodes to PNG on exit.
+            NOTE: Set GQRX to WFM (mono), ~34 kHz filter. Writes an 8-bit
+                  greyscale Netpbm P5 image to /tmp/apt_<ts>.pgm every 10 s
+                  of received pass. Both A/B channels are in one strip.
 
             #{self}.authors
           "