pwn 0.5.652 → 0.5.656

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6fd0197b1fa729406ea99bbe598d3730d27e3c6881251c374af0f894ea541729
-  data.tar.gz: 492617f851780cf17c04fcdecdd4eb491e54b2bcf115b04997f3972507528d3a
+  metadata.gz: ba4560cb04bae940cc23704a47b54f60a33a47587531101f340beb12897b12e9
+  data.tar.gz: 7635dbe7cb031343f1df74c430b22c1a9db3b2a23d3990812573e0785dd4aaa1
 SHA512:
-  metadata.gz: ad8894f7551643e63ec4819d7a2513e3114d0f2649eb21ea8b9554e150319a7df0d62e6c46d9979d5c0462c5617f054f93f2140c81704b74fa3d8f763c428d90
-  data.tar.gz: f84e73f55040588558281b2941a41b602b2f3a6471c5cbbacdd7afc42a9b2dbf91c8c9c01e68079dcaedee03a25aad25eb17558d3ffec62f0ce8539f5e6ef1a5
+  metadata.gz: e21ee1d6b4e66d692b6ad5896f1ec0f87426258854911d9dc7759d567dd3b472ab8dc99409ca33e7412afc7bab00d0174d56fa9cc979074b0192cc2bc43e0459
+  data.tar.gz: fdbed596d420d497b1874c1f5473c513327813b2625b2b9bedf7f21d5dbe51da26598c6e5a2082ebc7d2735f4f56e69a3f8feb9f99d2883899230c39b02e6b09

data/Gemfile

@@ -11,7 +11,7 @@ gemspec
 # In some circumstances custom flags are passed to gems in order
 # to build appropriately.  Defer to ./reinstall_pwn_gemset.sh
 # to review these custom flags (e.g. pg, serialport, etc).
-gem 'activesupport', '<8.1.3'
+gem 'activesupport', '<8.1.3.1'
 gem 'anemone', '0.7.2'
 gem 'authy', '3.0.1'
 gem 'aws-sdk', '3.3.0'
@@ -46,11 +46,11 @@ gem 'json', '>=2.13.2'
 gem 'jsonpath', '1.1.5'
 gem 'json_schemer', '2.5.0'
 gem 'jwt', '3.2.0'
-gem 'libusb', '0.7.2'
+gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
-gem 'mcp', '1.0.0'
-gem 'meshtastic', '0.0.172'
+gem 'mcp', '1.1.0'
+gem 'meshtastic', '0.0.173'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.25.0'
 gem 'msfrpc-client', '1.1.2'
@@ -77,11 +77,11 @@ gem 'rbvmomi2', '3.10.0'
 gem 'rdoc', '7.0.4'
 gem 'rest-client', '2.1.0'
 gem 'rex', '2.0.13'
-gem 'rmagick', '7.0.5'
+gem 'rmagick', '7.1.0'
 gem 'rqrcode', '3.2.0'
 gem 'rspec', '3.13.2'
 gem 'rtesseract', '3.1.4'
-gem 'rubocop', '1.88.2'
+gem 'rubocop', '1.89.0'
 gem 'rubocop-rake', '0.7.1'
 gem 'rubocop-rspec', '3.10.2'
 gem 'ruby-audio', '1.6.1'

data/lib/pwn/ai/agent/extrospection/osint/social.rb

@@ -327,7 +327,7 @@ module PWN
           body = r[:body].to_s
           absent = site[:absent_status].include?(code) ||
                    # substring match against page body — NOT a set intersection despite the cop name.
-                   site[:absent_body].any? { |s| body.include?(s) } || # rubocop:disable Style/ArrayIntersect
+                   site[:absent_body].any? { |s| body.include?(s) } ||
                    !code.between?(200, 399)
           absent ? :absent : :present
         end

data/lib/pwn/ai/agent/loop.rb

@@ -100,6 +100,36 @@ module PWN
           false
         end
 
+        # P28 — incomplete / handoff finals: model emitted text-only before the
+        # goal was done ("shall I proceed?", "next step:", "want me to…").
+        # Loop.run treats no-tool_calls as FINAL; this detector lets us refuse
+        # that handoff and keep the tool loop alive for multi-step autonomy.
+        INCOMPLETE_FINAL_RX = /
+          \b(shall\s+i|should\s+i|may\s+i|can\s+i|want\s+me\s+to|do\s+you\s+want\s+me|
+             next\s+single\s+step|next\s+step\s*:|awaiting\s+your\s+(ok|approval|go-ahead|confirmation)|
+             if\s+you(?:'d|\s+would)\s+like\s+me\s+to|say\s+the\s+word|confirm\s+(before|and\s+i)|
+             ready\s+to\s+proceed|ok\s+to\s+(proceed|continue|apply)|proceed\?|
+             continue\?|before\s+i\s+(apply|change|run|continue|proceed)|
+             once\s+you\s+(confirm|approve)|let\s+me\s+know\s+if|
+             i(?:'ll|\s+will)\s+wait\b|waiting\s+for\s+(your\s+)?(go|ok|approval|confirmation)
+          )\b
+        /ix
+
+        private_class_method def self.incomplete_final?(opts = {})
+          text = opts[:text].to_s
+          return false if text.strip.empty?
+          # Hard last-iter forces a real final; do not bounce that forever.
+          return false if opts[:last_iter]
+          return true if text.match?(INCOMPLETE_FINAL_RX)
+          # Short status-only dumps with a trailing question are handoffs.
+          return true if text.include?('?') && text.length < 900 &&
+                         text.match?(/\b(proceed|continue|confirm|apply|next)\b/i)
+
+          false
+        rescue StandardError
+          false
+        end
+
         private_class_method def self.max_iters
           v = (PWN::Env.dig(:ai, :agent, :max_iters) if defined?(PWN::Env))
           n = v.to_i.positive? ? v.to_i : DEFAULT_MAX_ITERS
@@ -116,11 +146,12 @@ module PWN
           # is "iteration budget exhausted" ×N; more headroom only produces more
           # empty terminal failures for ORM/PRM/DPO.
           if budget_exhaustion_hot?
-            # P17 deepen² — remote was still burning full 12-step plans even when
-            # overconfidence sat just under the 0.25 gate (0.242 on grok). Always
-            # cap to 8 for ALL engines while budget fingerprints dominate; finish-
-            # under-N is the skill gap, more headroom only yields empty terminals.
-            n = [n, 8].min
+            # P17 + P28 — finish-under-N while budget fingerprints dominate, but
+            # do NOT collapse multi-step remote work to 8 (that re-creates the
+            # polite handoff / early empty-final failure mode P28 fixed).
+            # Local/ollama stays harsh at 8; remote engines keep the W3 runway.
+            hot_cap = active_engine == :ollama ? 8 : 40
+            n = [n, hot_cap].min
           end
           n
         rescue StandardError
@@ -141,11 +172,22 @@ module PWN
           # P17 — gate lowered 0.25→0.20: grok lived at 0.242 and never tripped,
           # leaving force_plan off while still thrashing tool budgets.
           bad   = brier > 0.35 || over > 0.20
+          # P28 — autonomy: overconfidence must force plan+critic and shrink thrash,
+          # but must NOT collapse multi-step remote work to 8 iters (user-visible
+          # "stop to confirm next step" / early text-only handoffs). Local models
+          # keep the harsh 8; remote engines keep a usable multi-step runway.
+          remote_cap = 40
+          local_cap  = 8
+          cap = if bad
+                  (eng == :ollama ? local_cap : remote_cap)
+                else
+                  25
+                end
           {
             overconfident: bad,
             force_plan: bad,
             force_critic: bad,
-            max_iters_cap: bad ? 8 : 25,
+            max_iters_cap: cap,
             cal: cal
           }
         rescue StandardError
@@ -281,7 +323,7 @@ module PWN
           plan_prompt = if hot
                           'Before acting: write AT MOST 3 numbered tool calls (name + key args) that finish the ask. Prefer fewer. LAST line: "p(success)=<0.0-1.0>". Reply ONLY with the plan + that line — no tools, no prose.'
                         else
-                          'Before acting: (1) list the exact tool calls (name + key args) you will make, in order; (2) on the LAST line write "p(success)=<0.0-1.0>". Reply ONLY with the numbered plan + that line — do NOT call any tool yet.'
+                          'Before acting: (1) list the exact tool calls (name + key args) that FULLY finish the user goal, in order — do not stop at a checkpoint for confirmation; (2) on the LAST line write "p(success)=<0.0-1.0>". Reply ONLY with the numbered plan + that line — do NOT call any tool yet.'
                         end
           plan_msg = call_engine(
             messages: messages + [{ role: 'user', content: plan_prompt }],
@@ -599,8 +641,10 @@ module PWN
               messages << {
                 role: 'user',
                 content: "[pwn-ai/p17] #{tag} — do NOT call any more tools. " \
-                         'Write the best answer you can from evidence already in this ' \
-                         'transcript. If blocked, say what failed and the next single step.'
+                         'Write the best complete answer you can from evidence already in this ' \
+                         'transcript. If the goal is unfinished, report exactly what is done, ' \
+                         'what is blocked, and the concrete remaining work — do NOT ask the ' \
+                         'user to confirm the next step.'
               }
             end
 
@@ -630,6 +674,19 @@ module PWN
             messages << msg
 
             if calls.empty?
+              # P28 — refuse polite mid-goal handoffs so multi-step tasks stay autonomous.
+              if incomplete_final?(text: text, last_iter: last_iter) && turn_fails['incomplete_final'].to_i < 2
+                turn_fails['incomplete_final'] += 1
+                warn "[pwn-ai/loop] incomplete final on iter=#{i}; continuing autonomously"
+                messages << {
+                  role: 'user',
+                  content: '[pwn-ai/p28] That reply handed control back before the goal was done. ' \
+                           'Do NOT ask the user to confirm the next step. Continue with the ' \
+                           'necessary tool calls now and finish the goal autonomously. Only ' \
+                           'emit a final answer when the request is complete or truly blocked.'
+                }
+                next
+              end
               append_session(session_id: session_id, role: 'assistant', content: text)
               Learning.auto_introspect(session_id: session_id, request: request, final: text, predicted: predicted) if defined?(Learning) && should_auto_introspect?(local: local, turn_fails: turn_fails, iter: i)
               return text
@@ -771,6 +828,9 @@ module PWN
                 :hindsight           - C3 HER-relabel failures (Boolean, default true)
                 :verify_as_reward    - E3 ground every final via extro_verify (Boolean)
 
+              P28 autonomy: incomplete-final detector refuses mid-goal handoffs;
+              W3 overconf max_iters_cap is 40 on remote engines (8 on ollama).
+
               #{self}.authors
           USAGE
         end

data/lib/pwn/ai/agent/prompt_builder.rb

@@ -54,6 +54,15 @@ module PWN
               no tool_calls is treated as your FINAL answer to the user.
               Prefer `pwn_eval` for anything in the PWN:: namespace and `shell`
               for OS commands. Save durable facts with `memory_remember`.
+
+            AUTONOMY
+              Multi-step goals must be finished in one Loop.run. Keep calling
+              tools until the request is done or truly blocked. Do NOT stop to
+              ask the user to confirm the next step, approve a partial plan, or
+              green-light the obvious continuation. Only ask when a credential,
+              irreversible destructive action, or missing external decision is
+              strictly required. Partial progress reports without completing the
+              goal are incorrect behavior.
           "
         end
 

data/lib/pwn/plugins/hacker_one.rb

@@ -1,113 +1,632 @@
 # frozen_string_literal: true
 
-require 'json'
 require 'base64'
+require 'json'
+require 'rest-client'
 
 module PWN
   module Plugins
-    # This plugin is used for interacting w/ HackerOne's REST API using
+    # This plugin is used for interacting w/ HackerOne's Hacker REST API using
     # the 'rest' browser type of PWN::Plugins::TransparentBrowser.
+    #
+    # Spec: https://api.hackerone.com/getting-started-hacker-api/#getting-started-hacker-api
+    #
+    # Auth: HTTP Basic on every request (username + API token).
+    # Base: https://api.hackerone.com/v1/hackers/
+    #
+    # Credentials are sourced from PWN::Env[:plugins][:hackerone]:
+    #   plugins:
+    #     hackerone:
+    #       username: your-h1-username
+    #       api_key:  your-h1-api-token
     module HackerOne
       @@logger = PWN::Plugins::PWNLogger.create
 
+      BASE_H1_API_URI = 'https://api.hackerone.com/v1/hackers'
+
+      # Resolve username: explicit opt -> PWN::Env -> ENV
+      private_class_method def self.resolve_username(opts = {})
+        opts[:username] ||
+          PWN::Env.dig(:plugins, :hackerone, :username) ||
+          ENV.fetch('HACKERONE_USERNAME', nil)
+      end
+
+      # Resolve API token: explicit opt -> PWN::Env -> ENV
+      # Accepts :api_key, :token, or :api_token aliases.
+      private_class_method def self.resolve_api_key(opts = {})
+        opts[:api_key] ||
+          opts[:token] ||
+          opts[:api_token] ||
+          PWN::Env.dig(:plugins, :hackerone, :api_key) ||
+          PWN::Env.dig(:plugins, :hackerone, :token) ||
+          ENV.fetch('HACKERONE_API_KEY', nil) ||
+          ENV.fetch('HACKERONE_TOKEN', nil)
+      end
+
       # Supported Method Parameters::
-      # h1_obj = PWN::Plugins::HackerOne.login(
-      #   username: 'required - username',
-      #   token: 'optional - api token (will prompt if nil)'
+      # h1_rest_call(
+      #   http_method: 'optional HTTP method (defaults to GET)',
+      #   rest_call: 'required rest path relative to /v1/hackers (e.g. "me/reports")',
+      #   params: 'optional query params Hash',
+      #   http_body: 'optional HTTP body (Hash/Array auto-JSONified; String passed through)',
+      #   username: 'optional - HackerOne username (default PWN::Env)',
+      #   api_key: 'optional - HackerOne API token (default PWN::Env)',
+      #   raw: 'optional - return raw RestClient::Response (default false)'
       # )
 
-      public_class_method def self.login(opts = {})
-        username = opts[:username].to_s.scrub
-        base_h1_api_uri = 'https://api.hackerone.com/v1/'.to_s.scrub
+      private_class_method def self.h1_rest_call(opts = {})
+        http_method = if opts[:http_method].nil?
+                        :get
+                      else
+                        opts[:http_method].to_s.scrub.to_sym
+                      end
+        rest_call = opts[:rest_call].to_s.scrub.sub(%r{\A/}, '')
+        params = opts[:params]
+        http_body = opts[:http_body]
+        http_body = http_body.to_json if http_body.is_a?(Hash) || http_body.is_a?(Array)
+        raw = opts[:raw]
 
-        token = if opts[:token].nil?
-                  PWN::Plugins::AuthenticationHelper.mask_password
-                else
-                  opts[:token].to_s.scrub
-                end
+        username = resolve_username(opts).to_s.scrub
+        api_key = resolve_api_key(opts).to_s.scrub
+        raise 'ERROR: HackerOne username missing - set plugins.hackerone.username in ~/.pwn/pwn.yaml' if username.empty?
+        raise 'ERROR: HackerOne api_key missing - set plugins.hackerone.api_key in ~/.pwn/pwn.yaml' if api_key.empty?
 
-        auth_payload = {}
-        auth_payload[:username] = username
-        auth_payload[:token] = token
+        basic_auth_header = "Basic #{Base64.strict_encode64("#{username}:#{api_key}")}"
 
-        base64_str = "#{username}:#{token}"
-        base64_encoded_auth = Base64.strict_encode64(base64_str).to_s.chomp
-        basic_auth_header = "Basic #{base64_encoded_auth}"
+        headers = {
+          authorization: basic_auth_header,
+          accept: 'application/json',
+          content_type: 'application/json; charset=UTF-8'
+        }
+        headers[:params] = params if params
 
-        @@logger.info("Logging into HackerOne REST API: #{base_h1_api_uri}")
         browser_obj = PWN::Plugins::TransparentBrowser.open(browser_type: :rest)
         rest_client = browser_obj[:browser]::Request
+
+        url = rest_call.empty? ? BASE_H1_API_URI : "#{BASE_H1_API_URI}/#{rest_call}"
+
         response = rest_client.execute(
-          method: :get,
-          url: base_h1_api_uri,
-          headers: {
-            authorization: basic_auth_header,
-            content_type: 'application/json; charset=UTF-8'
-          }
+          method: http_method,
+          url: url,
+          headers: headers,
+          payload: http_body,
+          verify_ssl: false
         )
 
-        # Return array containing the post-authenticated HackerOne REST API token
-        json_response = JSON.parse(response, symbolize_names: true)
-        h1_success = json_response['success']
-        api_token = json_response['token']
-        h1_obj = {}
-        h1_obj[:h1_success] = h1_success
-        h1_obj[:api_token] = api_token
-        h1_obj[:raw_response] = response
+        return response if raw
 
-        h1_obj
+        JSON.parse(response.body, symbolize_names: true)
+      rescue ::RestClient::TooManyRequests
+        @@logger.warn('HackerOne rate limit (429). Sleeping 10s then retrying...')
+        sleep 10
+        retry
+      rescue ::RestClient::Unauthorized, ::RestClient::Forbidden,
+             ::RestClient::BadRequest, ::RestClient::NotFound,
+             ::RestClient::UnprocessableEntity => e
+        @@logger.error("HackerOne #{e.class}: #{e.response&.body}")
+        raise e
       rescue StandardError => e
         raise e
       end
 
       # Supported Method Parameters::
-      # h1_rest_call(
-      #   h1_obj: 'required h1_obj returned from #login method',
-      #   http_method: 'optional HTTP method (defaults to GET)
-      #   rest_call: 'required rest call to make per the schema',
-      #   http_body: 'optional HTTP body sent in HTTP methods that support it e.g. POST'
+      # h1_obj = PWN::Plugins::HackerOne.login(
+      #   username: 'optional - username (default PWN::Env[:plugins][:hackerone][:username])',
+      #   api_key: 'optional - api token (default PWN::Env; will prompt if still nil)',
+      #   token: 'optional - alias for api_key'
       # )
+      # Backward-compatible session object. Auth is HTTP Basic on every subsequent
+      # call; login simply resolves + validates credentials against me/reports.
 
-      private_class_method def self.h1_rest_call(opts = {})
-        h1_obj = opts[:h1_obj]
-        http_method = if opts[:http_method].nil?
-                        :get
-                      else
-                        opts[:http_method].to_s.scrub.to_sym
-                      end
-        rest_call = opts[:rest_call].to_s.scrub
-        http_body = opts[:http_body].to_s.scrub
-        h1_success = h1_obj[:h1_success].to_s.scrub
-        base_h1_api_uri = 'https://api.hackerone.com/v1/'.to_s.scrub
-        api_token = h1_obj[:api_token]
+      public_class_method def self.login(opts = {})
+        username = resolve_username(opts)
+        api_key = resolve_api_key(opts)
 
-        browser_obj = PWN::Plugins::TransparentBrowser.open(browser_type: :rest)::Request
-        rest_client = browser_obj[:browser]::Request
+        api_key = PWN::Plugins::AuthenticationHelper.mask_password if api_key.nil? || api_key.to_s.empty?
 
-        case http_method
-        when :get
-          response = rest_client.execute(
-            method: :get,
-            url: "#{base_h1_api_uri}/#{rest_call}",
-            headers: {
-              content_type: 'application/json; charset=UTF-8',
-              params: { token: api_token }
-            }
-          )
+        username = username.to_s.scrub
+        api_key = api_key.to_s.scrub
+        raise 'ERROR: HackerOne username required' if username.empty?
+        raise 'ERROR: HackerOne api_key required' if api_key.empty?
 
-        when :post
-          response = rest_client.execute(
-            method: :post,
-            url: "#{base_h1_api_uri}/#{rest_call}",
-            headers: {
-              content_type: 'application/json; charset=UTF-8'
-            },
-            payload: http_body
-          )
+        @@logger.info("Validating HackerOne Hacker API credentials for #{username}")
+        # Prefer a cheap authenticated endpoint (balance is small; me/reports is list)
+        h1_rest_call(
+          rest_call: 'payments/balance',
+          username: username,
+          api_key: api_key
+        )
+
+        {
+          username: username,
+          api_key: api_key,
+          base_h1_api_uri: BASE_H1_API_URI
+        }
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # response = PWN::Plugins::HackerOne.api(
+      #   path: 'required - path relative to /v1/hackers (e.g. "me/reports")',
+      #   method: 'optional - :get|:post|:put|:patch|:delete (default :get)',
+      #   params: 'optional - query params Hash',
+      #   body: 'optional - request body Hash/Array/String',
+      #   username: 'optional',
+      #   api_key: 'optional',
+      #   h1_obj: 'optional - session from #login (supplies username/api_key)',
+      #   raw: 'optional - return raw response (default false)'
+      # )
+
+      public_class_method def self.api(opts = {})
+        creds = creds_from(opts)
+        h1_rest_call(
+          http_method: opts[:method] || opts[:http_method] || :get,
+          rest_call: opts[:path].to_s.delete_prefix('/'),
+          params: opts[:params],
+          http_body: opts[:body] || opts[:http_body],
+          username: creds[:username],
+          api_key: creds[:api_key],
+          raw: opts[:raw]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Pull username/api_key from opts or h1_obj session.
+      private_class_method def self.creds_from(opts = {})
+        h1_obj = opts[:h1_obj] || {}
+        {
+          username: opts[:username] || h1_obj[:username],
+          api_key: opts[:api_key] || opts[:token] || opts[:api_token] || h1_obj[:api_key] || h1_obj[:token]
+        }
+      end
+
+      # ---- Reports -------------------------------------------------------
+
+      # Supported Method Parameters::
+      # reports = PWN::Plugins::HackerOne.get_me_reports(
+      #   params: 'optional - query params Hash (e.g. page/filter)',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_me_reports(opts = {})
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: 'me/reports',
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
 
-        else
-          raise @@logger.error("Unsupported HTTP Method #{http_method} for #{self} Plugin")
+      # Supported Method Parameters::
+      # report = PWN::Plugins::HackerOne.get_report(
+      #   id: 'required - report id',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_report(opts = {})
+        id = opts[:id]
+        raise 'ERROR: report id required' if id.nil? || id.to_s.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: "reports/#{id}",
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # report = PWN::Plugins::HackerOne.create_report(
+      #   team_handle: 'required - program handle',
+      #   title: 'required - report title',
+      #   vulnerability_information: 'required - detailed description',
+      #   impact: 'optional - impact text',
+      #   severity_rating: 'optional - none|low|medium|high|critical',
+      #   weakness_id: 'optional - weakness id integer',
+      #   structured_scope_id: 'optional - structured scope id',
+      #   body: 'optional - full JSON:API body Hash (overrides attribute kwargs)',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.create_report(opts = {})
+        creds = creds_from(opts)
+        http_body = opts[:body]
+        if http_body.nil?
+          attrs = {
+            team_handle: opts[:team_handle],
+            title: opts[:title],
+            vulnerability_information: opts[:vulnerability_information]
+          }
+          attrs[:impact] = opts[:impact] if opts.key?(:impact)
+          attrs[:severity_rating] = opts[:severity_rating] if opts.key?(:severity_rating)
+          attrs[:weakness_id] = opts[:weakness_id] if opts.key?(:weakness_id)
+          attrs[:structured_scope_id] = opts[:structured_scope_id] if opts.key?(:structured_scope_id)
+
+          raise 'ERROR: team_handle required' if attrs[:team_handle].to_s.empty?
+          raise 'ERROR: title required' if attrs[:title].to_s.empty?
+          raise 'ERROR: vulnerability_information required' if attrs[:vulnerability_information].to_s.empty?
+
+          http_body = {
+            data: {
+              type: 'report',
+              attributes: attrs
+            }
+          }
         end
+
+        h1_rest_call(
+          http_method: :post,
+          rest_call: 'reports',
+          http_body: http_body,
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # ---- Payments ------------------------------------------------------
+
+      # Supported Method Parameters::
+      # balance = PWN::Plugins::HackerOne.get_balance(
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_balance(opts = {})
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: 'payments/balance',
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # earnings = PWN::Plugins::HackerOne.get_earnings(
+      #   params: 'optional - query params Hash',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_earnings(opts = {})
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: 'payments/earnings',
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # payouts = PWN::Plugins::HackerOne.get_payouts(
+      #   params: 'optional - query params Hash',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_payouts(opts = {})
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: 'payments/payouts',
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # ---- Programs -------------------------------------------------------
+
+      # Supported Method Parameters::
+      # programs = PWN::Plugins::HackerOne.get_programs(
+      #   params: 'optional - query params Hash',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_programs(opts = {})
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: 'programs',
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # program = PWN::Plugins::HackerOne.get_program(
+      #   handle: 'required - program handle',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_program(opts = {})
+        handle = opts[:handle].to_s.scrub
+        raise 'ERROR: program handle required' if handle.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: "programs/#{handle}",
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # scopes = PWN::Plugins::HackerOne.get_structured_scopes(
+      #   handle: 'required - program handle',
+      #   params: 'optional',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_structured_scopes(opts = {})
+        handle = opts[:handle].to_s.scrub
+        raise 'ERROR: program handle required' if handle.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: "programs/#{handle}/structured_scopes",
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # exclusions = PWN::Plugins::HackerOne.get_scope_exclusions(
+      #   handle: 'required - program handle',
+      #   params: 'optional',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_scope_exclusions(opts = {})
+        handle = opts[:handle].to_s.scrub
+        raise 'ERROR: program handle required' if handle.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: "programs/#{handle}/scope_exclusions",
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # weaknesses = PWN::Plugins::HackerOne.get_weaknesses(
+      #   handle: 'required - program handle',
+      #   params: 'optional',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_weaknesses(opts = {})
+        handle = opts[:handle].to_s.scrub
+        raise 'ERROR: program handle required' if handle.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: "programs/#{handle}/weaknesses",
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # ---- Hacktivity -----------------------------------------------------
+
+      # Supported Method Parameters::
+      # items = PWN::Plugins::HackerOne.get_hacktivity(
+      #   params: 'optional - query params Hash',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_hacktivity(opts = {})
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: 'hacktivity',
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # ---- Report Intents ------------------------------------------------
+
+      # Supported Method Parameters::
+      # intents = PWN::Plugins::HackerOne.get_report_intents(
+      #   params: 'optional',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_report_intents(opts = {})
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: 'report_intents',
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # intent = PWN::Plugins::HackerOne.get_report_intent(
+      #   id: 'required - report intent id',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_report_intent(opts = {})
+        id = opts[:id]
+        raise 'ERROR: report intent id required' if id.nil? || id.to_s.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: "report_intents/#{id}",
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # intent = PWN::Plugins::HackerOne.create_report_intent(
+      #   body: 'required - full JSON:API body Hash',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.create_report_intent(opts = {})
+        body = opts[:body]
+        raise 'ERROR: body required for create_report_intent' if body.nil?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          http_method: :post,
+          rest_call: 'report_intents',
+          http_body: body,
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # intent = PWN::Plugins::HackerOne.update_report_intent(
+      #   id: 'required - report intent id',
+      #   body: 'required - full JSON:API body Hash',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.update_report_intent(opts = {})
+        id = opts[:id]
+        body = opts[:body]
+        raise 'ERROR: report intent id required' if id.nil? || id.to_s.empty?
+        raise 'ERROR: body required for update_report_intent' if body.nil?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          http_method: :put,
+          rest_call: "report_intents/#{id}",
+          http_body: body,
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # result = PWN::Plugins::HackerOne.delete_report_intent(
+      #   id: 'required - report intent id',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.delete_report_intent(opts = {})
+        id = opts[:id]
+        raise 'ERROR: report intent id required' if id.nil? || id.to_s.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          http_method: :delete,
+          rest_call: "report_intents/#{id}",
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # result = PWN::Plugins::HackerOne.submit_report_intent(
+      #   id: 'required - report intent id',
+      #   body: 'optional - JSON:API body Hash',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.submit_report_intent(opts = {})
+        id = opts[:id]
+        raise 'ERROR: report intent id required' if id.nil? || id.to_s.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          http_method: :post,
+          rest_call: "report_intents/#{id}/submit",
+          http_body: opts[:body],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # attachments = PWN::Plugins::HackerOne.get_report_intent_attachments(
+      #   report_intent_id: 'required - report intent id',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.get_report_intent_attachments(opts = {})
+        rid = opts[:report_intent_id] || opts[:id]
+        raise 'ERROR: report_intent_id required' if rid.nil? || rid.to_s.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          rest_call: "report_intents/#{rid}/attachments",
+          params: opts[:params],
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # result = PWN::Plugins::HackerOne.delete_report_intent_attachment(
+      #   report_intent_id: 'required - report intent id',
+      #   id: 'required - attachment id',
+      #   username: 'optional', api_key: 'optional', h1_obj: 'optional'
+      # )
+
+      public_class_method def self.delete_report_intent_attachment(opts = {})
+        rid = opts[:report_intent_id]
+        id = opts[:id]
+        raise 'ERROR: report_intent_id required' if rid.nil? || rid.to_s.empty?
+        raise 'ERROR: attachment id required' if id.nil? || id.to_s.empty?
+
+        creds = creds_from(opts)
+        h1_rest_call(
+          http_method: :delete,
+          rest_call: "report_intents/#{rid}/attachments/#{id}",
+          username: creds[:username],
+          api_key: creds[:api_key]
+        )
       rescue StandardError => e
         raise e
       end
@@ -116,11 +635,13 @@ module PWN
       # PWN::Plugins::HackerOne.logout(
       #   h1_obj: 'required h1_obj returned from #login method'
       # )
+      # Clears the session hash in-place (no server-side session to destroy).
 
       public_class_method def self.logout(opts = {})
         h1_obj = opts[:h1_obj]
-        @@logger.info('Logging out...')
-        h1_obj = nil
+        @@logger.info('Clearing HackerOne session object...')
+        h1_obj.clear if h1_obj.respond_to?(:clear)
+        nil
       rescue StandardError => e
         raise e
       end
@@ -138,14 +659,46 @@ module PWN
       public_class_method def self.help
         puts "USAGE:
           h1_obj = #{self}.login(
-            username: 'required username',
-            token: 'optional api token (will prompt if nil)'
+            username: 'optional - default PWN::Env[:plugins][:hackerone][:username]',
+            api_key: 'optional - default PWN::Env[:plugins][:hackerone][:api_key]'
           )
 
-          h1_obj = #{self}.logout(
-            h1_obj: 'required h1_obj returned from #login method'
+          reports = #{self}.get_me_reports(h1_obj: h1_obj)
+          report  = #{self}.get_report(id: 12345)
+          report  = #{self}.create_report(
+            team_handle: 'security',
+            title: 'Example',
+            vulnerability_information: 'Details...'
+          )
+
+          balance  = #{self}.get_balance
+          earnings = #{self}.get_earnings
+          payouts  = #{self}.get_payouts
+
+          programs = #{self}.get_programs
+          program  = #{self}.get_program(handle: 'security')
+          scopes   = #{self}.get_structured_scopes(handle: 'security')
+          excl     = #{self}.get_scope_exclusions(handle: 'security')
+          weak     = #{self}.get_weaknesses(handle: 'security')
+
+          items = #{self}.get_hacktivity
+
+          intents = #{self}.get_report_intents
+          intent  = #{self}.get_report_intent(id: 1)
+          intent  = #{self}.create_report_intent(body: { data: { type: 'report-intent', attributes: {} } })
+          intent  = #{self}.update_report_intent(id: 1, body: { data: { type: 'report-intent', attributes: {} } })
+          #{self}.submit_report_intent(id: 1)
+          #{self}.delete_report_intent(id: 1)
+          atts = #{self}.get_report_intent_attachments(report_intent_id: 1)
+          #{self}.delete_report_intent_attachment(report_intent_id: 1, id: 2)
+
+          json = #{self}.api(
+            path: 'me/reports',
+            method: :get,
+            params: { page: { number: 1 } }
           )
 
+          #{self}.logout(h1_obj: h1_obj)
           #{self}.authors
         "
       end

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.652'
+  VERSION = '0.5.656'
 end

data/packer/provisioners/apache2.sh

@@ -16,6 +16,7 @@ pwn_provider=`echo $PWN_PROVIDER`
 $screen_cmd "${apt} install -y apache2 ${assess_update_errors}"
 $screen_cmd "a2enmod proxy ${assess_update_errors}"
 $screen_cmd "a2enmod proxy_http ${assess_update_errors}"
+$screen_cmd "a2enmod proxy_wstunnel ${assess_update_errors}"
 $screen_cmd "a2enmod rewrite ${assess_update_errors}"
 $screen_cmd "a2enmod ssl ${assess_update_errors}"
 $screen_cmd "a2enmod headers ${assess_update_errors}"

data/spec/integration/reinforced_feedback_loop_spec.rb

@@ -1502,5 +1502,35 @@ RSpec.describe 'PWN::AI::Agent reinforced feedback loop', :aggregate_failures do
       expect(doc).to match(/Last-iter force-final/)
     end
   end
+
+  describe 'P28 · autonomy (remote overconf runway + incomplete-final)' do
+    it 'sets W3 overconf max_iters_cap to 40 on remote, 8 on ollama' do
+      src = File.read(loop_mod.method(:run).source_location.first)
+      expect(src).to match(/P28/)
+      expect(src).to match(/remote_cap = 40/)
+      expect(src).to match(/local_cap\s*=\s*8/)
+      expect(src).to match(/eng == :ollama \? local_cap : remote_cap/)
+      # budget-hot still always 8 (P17)
+      expect(src).to match(/n = \[n, 8\]\.min/)
+    end
+
+    it 'defines incomplete_final? and continues on mid-goal handoff' do
+      src = File.read(loop_mod.method(:run).source_location.first)
+      expect(src).to match(/incomplete_final\?/)
+      expect(src).to match(/INCOMPLETE_FINAL_RX/)
+      expect(src).to match(%r{\[pwn-ai/p28\]})
+      expect(src).to match(/continuing autonomously/)
+      # last-iter wording no longer coaches "next single step" handoffs
+      expect(src).not_to match(/next single step/)
+      expect(src).to match(/do NOT ask the/)
+    end
+
+    it 'PromptBuilder injects AUTONOMY block' do
+      src = File.read(File.expand_path('../../lib/pwn/ai/agent/prompt_builder.rb', __dir__))
+      expect(src).to match(/AUTONOMY/)
+      expect(src).to match(/Do NOT stop to/)
+      expect(src).to match(/Multi-step goals must be finished in one Loop\.run/)
+    end
+  end
 end
 # rubocop:enable Metrics/BlockLength

data/third_party/pwn_rdoc.jsonl

@@ -301,6 +301,7 @@
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.expose_current_session Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.expose_current_session`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.guard_repeated_failure Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.guard_repeated_failure`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.help Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.help`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.incomplete_final? Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.incomplete_final?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.max_iters Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.max_iters`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.normalize_llm Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.normalize_llm`: Supported Method Parameters\n\nmsg = PWN::AI::Agent::Loop.normalize_llm(\n\nresponse: 'required - chat_with_tools response Hash from any provider'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.plan_first Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.plan_first`: "}]}
@@ -1422,11 +1423,35 @@
 {"messages":[{"role":"user","content":"PWN::Plugins::Github.resolve_username Usage"},{"role":"assistant","content":"`PWN::Plugins::Github.resolve_username`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Github.workflow_run_jobs Usage"},{"role":"assistant","content":"`PWN::Plugins::Github.workflow_run_jobs`: Supported Method Parameters\n\njobs = PWN::Plugins::Github.workflow_run_jobs(\n\nowner: 'required - repo owner (default PWN::Env[:plugins][:github][:username])',\nrepo: 'required - repo name',\nrun_id: 'required - workflow run id'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Github.workflow_runs Usage"},{"role":"assistant","content":"`PWN::Plugins::Github.workflow_runs`: Supported Method Parameters\n\nruns = PWN::Plugins::Github.workflow_runs(\n\nowner: 'required - repo owner (default PWN::Env[:plugins][:github][:username])',\nrepo: 'required - repo name',\nworkflow: 'optional - workflow file name or id (e.g. install-matrix.yml). Omit for all runs.',\nparams: 'optional - {branch:, status:, per_page:, page:}'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.api Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.api`: Supported Method Parameters\n\nresponse = PWN::Plugins::HackerOne.api(\n\npath: 'required - path relative to /v1/hackers (e.g. \"me/reports\")',\nmethod: 'optional - :get|:post|:put|:patch|:delete (default :get)',\nparams: 'optional - query params Hash',\nbody: 'optional - request body Hash/Array/String',\nusername: 'optional',\napi_key: 'optional',\nh1_obj: 'optional - session from #login (supplies username/api_key)',\nraw: 'optional - return raw response (default false)'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.authors Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
-{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.h1_rest_call Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.h1_rest_call`: Supported Method Parameters\n\nh1_rest_call(\n\nh1_obj: 'required h1_obj returned from #login method',\nhttp_method: 'optional HTTP method (defaults to GET)\nrest_call: 'required rest call to make per the schema',\nhttp_body: 'optional HTTP body sent in HTTP methods that support it e.g. POST'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.create_report Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.create_report`: Supported Method Parameters\n\nreport = PWN::Plugins::HackerOne.create_report(\n\nteam_handle: 'required - program handle',\ntitle: 'required - report title',\nvulnerability_information: 'required - detailed description',\nimpact: 'optional - impact text',\nseverity_rating: 'optional - none|low|medium|high|critical',\nweakness_id: 'optional - weakness id integer',\nstructured_scope_id: 'optional - structured scope id',\nbody: 'optional - full JSON:API body Hash (overrides attribute kwargs)',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.create_report_intent Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.create_report_intent`: Supported Method Parameters\n\nintent = PWN::Plugins::HackerOne.create_report_intent(\n\nbody: 'required - full JSON:API body Hash',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.creds_from Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.creds_from`: "}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.delete_report_intent Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.delete_report_intent`: Supported Method Parameters\n\nresult = PWN::Plugins::HackerOne.delete_report_intent(\n\nid: 'required - report intent id',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.delete_report_intent_attachment Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.delete_report_intent_attachment`: Supported Method Parameters\n\nresult = PWN::Plugins::HackerOne.delete_report_intent_attachment(\n\nreport_intent_id: 'required - report intent id',\nid: 'required - attachment id',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_balance Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_balance`: Supported Method Parameters\n\nbalance = PWN::Plugins::HackerOne.get_balance(\n\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_earnings Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_earnings`: Supported Method Parameters\n\nearnings = PWN::Plugins::HackerOne.get_earnings(\n\nparams: 'optional - query params Hash',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_hacktivity Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_hacktivity`: Supported Method Parameters\n\nitems = PWN::Plugins::HackerOne.get_hacktivity(\n\nparams: 'optional - query params Hash',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_me_reports Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_me_reports`: Supported Method Parameters\n\nreports = PWN::Plugins::HackerOne.get_me_reports(\n\nparams: 'optional - query params Hash (e.g. page/filter)',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_payouts Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_payouts`: Supported Method Parameters\n\npayouts = PWN::Plugins::HackerOne.get_payouts(\n\nparams: 'optional - query params Hash',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_program Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_program`: Supported Method Parameters\n\nprogram = PWN::Plugins::HackerOne.get_program(\n\nhandle: 'required - program handle',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_programs Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_programs`: Supported Method Parameters\n\nprograms = PWN::Plugins::HackerOne.get_programs(\n\nparams: 'optional - query params Hash',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_report Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_report`: Supported Method Parameters\n\nreport = PWN::Plugins::HackerOne.get_report(\n\nid: 'required - report id',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_report_intent Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_report_intent`: Supported Method Parameters\n\nintent = PWN::Plugins::HackerOne.get_report_intent(\n\nid: 'required - report intent id',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_report_intent_attachments Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_report_intent_attachments`: Supported Method Parameters\n\nattachments = PWN::Plugins::HackerOne.get_report_intent_attachments(\n\nreport_intent_id: 'required - report intent id',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_report_intents Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_report_intents`: Supported Method Parameters\n\nintents = PWN::Plugins::HackerOne.get_report_intents(\n\nparams: 'optional',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_scope_exclusions Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_scope_exclusions`: Supported Method Parameters\n\nexclusions = PWN::Plugins::HackerOne.get_scope_exclusions(\n\nhandle: 'required - program handle',\nparams: 'optional',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_structured_scopes Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_structured_scopes`: Supported Method Parameters\n\nscopes = PWN::Plugins::HackerOne.get_structured_scopes(\n\nhandle: 'required - program handle',\nparams: 'optional',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.get_weaknesses Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.get_weaknesses`: Supported Method Parameters\n\nweaknesses = PWN::Plugins::HackerOne.get_weaknesses(\n\nhandle: 'required - program handle',\nparams: 'optional',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.h1_rest_call Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.h1_rest_call`: Supported Method Parameters\n\nh1_rest_call(\n\nhttp_method: 'optional HTTP method (defaults to GET)',\nrest_call: 'required rest path relative to /v1/hackers (e.g. \"me/reports\")',\nparams: 'optional query params Hash',\nhttp_body: 'optional HTTP body (Hash/Array auto-JSONified; String passed through)',\nusername: 'optional - HackerOne username (default PWN::Env)',\napi_key: 'optional - HackerOne API token (default PWN::Env)',\nraw: 'optional - return raw RestClient::Response (default false)'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.help Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.help`: "}]}
-{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.login Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.login`: Supported Method Parameters\n\nh1_obj = PWN::Plugins::HackerOne.login(\n\nusername: 'required - username',\ntoken: 'optional - api token (will prompt if nil)'\n\n)\n"}]}
-{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.logout Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.logout`: Supported Method Parameters\n\nPWN::Plugins::HackerOne.logout(\n\nh1_obj: 'required h1_obj returned from #login method'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.login Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.login`: Supported Method Parameters\n\nh1_obj = PWN::Plugins::HackerOne.login(\n\nusername: 'optional - username (default PWN::Env[:plugins][:hackerone][:username])',\napi_key: 'optional - api token (default PWN::Env; will prompt if still nil)',\ntoken: 'optional - alias for api_key'\n\n) Backward-compatible session object. Auth is HTTP Basic on every subsequent call; login simply resolves + validates credentials against me/reports.\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.logout Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.logout`: Supported Method Parameters\n\nPWN::Plugins::HackerOne.logout(\n\nh1_obj: 'required h1_obj returned from #login method'\n\n) Clears the session hash in-place (no server-side session to destroy).\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.resolve_api_key Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.resolve_api_key`: "}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.resolve_username Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.resolve_username`: "}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.submit_report_intent Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.submit_report_intent`: Supported Method Parameters\n\nresult = PWN::Plugins::HackerOne.submit_report_intent(\n\nid: 'required - report intent id',\nbody: 'optional - JSON:API body Hash',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::Plugins::HackerOne.update_report_intent Usage"},{"role":"assistant","content":"`PWN::Plugins::HackerOne.update_report_intent`: Supported Method Parameters\n\nintent = PWN::Plugins::HackerOne.update_report_intent(\n\nid: 'required - report intent id',\nbody: 'required - full JSON:API body Hash',\nusername: 'optional', api_key: 'optional', h1_obj: 'optional'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Hunter.authors Usage"},{"role":"assistant","content":"`PWN::Plugins::Hunter.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Hunter.help Usage"},{"role":"assistant","content":"`PWN::Plugins::Hunter.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::Plugins::Hunter.hunter_rest_call Usage"},{"role":"assistant","content":"`PWN::Plugins::Hunter.hunter_rest_call`: Supported Method Parameters\n\nhunter_rest_call(\n\nhttp_method: 'optional HTTP method (defaults to GET)\nrest_call: 'required rest call to make per the schema',\nparams: 'optional params passed in the URI or HTTP Headers',\nhttp_body: 'optional HTTP body sent in HTTP methods that support it e.g. POST'\n\n)\n"}]}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.652
+  version: 0.5.656
 platform: ruby
 authors:
 - 0day Inc.
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: 8.1.3
+        version: 8.1.3.1
 - !ruby/object:Gem::Dependency
   name: anemone
   requirement: !ruby/object:Gem::Requirement
@@ -463,14 +463,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.7.2
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
   name: luhn
   requirement: !ruby/object:Gem::Requirement
@@ -505,28 +505,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.1.0
 - !ruby/object:Gem::Dependency
   name: meshtastic
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.172
+        version: 0.0.173
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.0.172
+        version: 0.0.173
 - !ruby/object:Gem::Dependency
   name: metasm
   requirement: !ruby/object:Gem::Requirement
@@ -897,14 +897,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.5
+        version: 7.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.5
+        version: 7.1.0
 - !ruby/object:Gem::Dependency
   name: rqrcode
   requirement: !ruby/object:Gem::Requirement
@@ -953,14 +953,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.88.2
+        version: 1.89.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.88.2
+        version: 1.89.0
 - !ruby/object:Gem::Dependency
   name: rubocop-rake
   requirement: !ruby/object:Gem::Requirement