pwn 0.5.655 → 0.5.657

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e41d71c8fc29542a4190d697603d8626138e2d2a10fba03d39637efb9103a1f
-  data.tar.gz: 3dc38eeb6c27e6e8899b5fb619f0b4d3afe9e31b3bf37ea7460197b48eac290e
+  metadata.gz: af75906b3c582dea27fb9ec31f19c7d3774aabcc928549cee27df74ad75220f3
+  data.tar.gz: c3424966d7b298c78b3edac59a777ee8e927f130ecefbf84fd0a46371256900e
 SHA512:
-  metadata.gz: 8f7ca9fa6a7f7784da54fd956eefd976d136c1226f48d5d7ecfe2911220b5b706b54d15b478c7cd69e0a751190ff876dc2f642068a9cc13320ffa3254929687d
-  data.tar.gz: c00d46ffc0b34013288c32ba279805ea9a617bc79eaa81e8b9e4ada48ecb5e5d6ab8d7b0926b4d2f0277e1cce3bd704407e85759f7a5196826ca96eb71db2e31
+  metadata.gz: 396a1f16a96e071396689cdfde74364ee9bae88544275f037137007b5ddd94dc1fc37f181a99ef239db5339b5fb24ecf750605ba67dd28bd62969ec9360ed5f6
+  data.tar.gz: 976c310a1e93bac33b383bcb7702a6350f2268062e71a0bb73ee28454d6ea23798fc654744b88dad048472d721d2417713d5664e81f39e819ddd2ccefe51c555

data/lib/pwn/ai/agent/loop.rb

@@ -100,6 +100,36 @@ module PWN
           false
         end
 
+        # P28 — incomplete / handoff finals: model emitted text-only before the
+        # goal was done ("shall I proceed?", "next step:", "want me to…").
+        # Loop.run treats no-tool_calls as FINAL; this detector lets us refuse
+        # that handoff and keep the tool loop alive for multi-step autonomy.
+        INCOMPLETE_FINAL_RX = /
+          \b(shall\s+i|should\s+i|may\s+i|can\s+i|want\s+me\s+to|do\s+you\s+want\s+me|
+             next\s+single\s+step|next\s+step\s*:|awaiting\s+your\s+(ok|approval|go-ahead|confirmation)|
+             if\s+you(?:'d|\s+would)\s+like\s+me\s+to|say\s+the\s+word|confirm\s+(before|and\s+i)|
+             ready\s+to\s+proceed|ok\s+to\s+(proceed|continue|apply)|proceed\?|
+             continue\?|before\s+i\s+(apply|change|run|continue|proceed)|
+             once\s+you\s+(confirm|approve)|let\s+me\s+know\s+if|
+             i(?:'ll|\s+will)\s+wait\b|waiting\s+for\s+(your\s+)?(go|ok|approval|confirmation)
+          )\b
+        /ix
+
+        private_class_method def self.incomplete_final?(opts = {})
+          text = opts[:text].to_s
+          return false if text.strip.empty?
+          # Hard last-iter forces a real final; do not bounce that forever.
+          return false if opts[:last_iter]
+          return true if text.match?(INCOMPLETE_FINAL_RX)
+          # Short status-only dumps with a trailing question are handoffs.
+          return true if text.include?('?') && text.length < 900 &&
+                         text.match?(/\b(proceed|continue|confirm|apply|next)\b/i)
+
+          false
+        rescue StandardError
+          false
+        end
+
         private_class_method def self.max_iters
           v = (PWN::Env.dig(:ai, :agent, :max_iters) if defined?(PWN::Env))
           n = v.to_i.positive? ? v.to_i : DEFAULT_MAX_ITERS
@@ -116,10 +146,12 @@ module PWN
           # is "iteration budget exhausted" ×N; more headroom only produces more
           # empty terminal failures for ORM/PRM/DPO.
           if budget_exhaustion_hot?
-            # P17 deepen² — remote was still burning full 12-step plans even when
-            # overconfidence sat just under the 0.25 gate (0.242 on grok). Always
-            # cap to 8 for ALL engines while budget fingerprints dominate; finish-
-            # under-N is the skill gap, more headroom only yields empty terminals.
+            # P17 — always 8 for ALL engines while budget fingerprints dominate.
+            # P28 remote runway (40) applies only to W3 overconf above; stacking
+            # a 40 hot-cap on top re-opens multi-dozen-iter thrash and is the
+            # 2026-08-04 regression (22 exhaust hits / day). Finish-under-8 is
+            # the sustained drop; incomplete_final? keeps multi-step autonomy
+            # inside that budget without polite handoffs.
             n = [n, 8].min
           end
           n
@@ -141,11 +173,22 @@ module PWN
           # P17 — gate lowered 0.25→0.20: grok lived at 0.242 and never tripped,
           # leaving force_plan off while still thrashing tool budgets.
           bad   = brier > 0.35 || over > 0.20
+          # P28 — autonomy: overconfidence must force plan+critic and shrink thrash,
+          # but must NOT collapse multi-step remote work to 8 iters (user-visible
+          # "stop to confirm next step" / early text-only handoffs). Local models
+          # keep the harsh 8; remote engines keep a usable multi-step runway.
+          remote_cap = 40
+          local_cap  = 8
+          cap = if bad
+                  (eng == :ollama ? local_cap : remote_cap)
+                else
+                  25
+                end
           {
             overconfident: bad,
             force_plan: bad,
             force_critic: bad,
-            max_iters_cap: bad ? 8 : 25,
+            max_iters_cap: cap,
             cal: cal
           }
         rescue StandardError
@@ -281,7 +324,7 @@ module PWN
           plan_prompt = if hot
                           'Before acting: write AT MOST 3 numbered tool calls (name + key args) that finish the ask. Prefer fewer. LAST line: "p(success)=<0.0-1.0>". Reply ONLY with the plan + that line — no tools, no prose.'
                         else
-                          'Before acting: (1) list the exact tool calls (name + key args) you will make, in order; (2) on the LAST line write "p(success)=<0.0-1.0>". Reply ONLY with the numbered plan + that line — do NOT call any tool yet.'
+                          'Before acting: (1) list the exact tool calls (name + key args) that FULLY finish the user goal, in order — do not stop at a checkpoint for confirmation; (2) on the LAST line write "p(success)=<0.0-1.0>". Reply ONLY with the numbered plan + that line — do NOT call any tool yet.'
                         end
           plan_msg = call_engine(
             messages: messages + [{ role: 'user', content: plan_prompt }],
@@ -592,15 +635,19 @@ module PWN
             # nothing the user (or ORM) can use.
             # P17 deepen — when budget_hot, force text-only on the LAST TWO
             # iters so a final tool_calls batch cannot burn the terminal slot.
-            text_only_iters = budget_exhaustion_hot? ? 2 : 1
+            # P17 deepen³ — under hot, force text-only on last THREE of the
+            # 8-iter cap so a late tool binge cannot burn every salvage slot.
+            text_only_iters = budget_exhaustion_hot? ? 3 : 1
             last_iter = (i >= max_iters - text_only_iters)
             if last_iter
               tag = i >= max_iters - 1 ? 'FINAL ITERATION' : 'PENULTIMATE — wrap up'
               messages << {
                 role: 'user',
                 content: "[pwn-ai/p17] #{tag} — do NOT call any more tools. " \
-                         'Write the best answer you can from evidence already in this ' \
-                         'transcript. If blocked, say what failed and the next single step.'
+                         'Write the best complete answer you can from evidence already in this ' \
+                         'transcript. If the goal is unfinished, report exactly what is done, ' \
+                         'what is blocked, and the concrete remaining work — do NOT ask the ' \
+                         'user to confirm the next step.'
               }
             end
 
@@ -630,6 +677,19 @@ module PWN
             messages << msg
 
             if calls.empty?
+              # P28 — refuse polite mid-goal handoffs so multi-step tasks stay autonomous.
+              if incomplete_final?(text: text, last_iter: last_iter) && turn_fails['incomplete_final'].to_i < 2
+                turn_fails['incomplete_final'] += 1
+                warn "[pwn-ai/loop] incomplete final on iter=#{i}; continuing autonomously"
+                messages << {
+                  role: 'user',
+                  content: '[pwn-ai/p28] That reply handed control back before the goal was done. ' \
+                           'Do NOT ask the user to confirm the next step. Continue with the ' \
+                           'necessary tool calls now and finish the goal autonomously. Only ' \
+                           'emit a final answer when the request is complete or truly blocked.'
+                }
+                next
+              end
               append_session(session_id: session_id, role: 'assistant', content: text)
               Learning.auto_introspect(session_id: session_id, request: request, final: text, predicted: predicted) if defined?(Learning) && should_auto_introspect?(local: local, turn_fails: turn_fails, iter: i)
               return text
@@ -771,6 +831,10 @@ module PWN
                 :hindsight           - C3 HER-relabel failures (Boolean, default true)
                 :verify_as_reward    - E3 ground every final via extro_verify (Boolean)
 
+              P28 autonomy: incomplete-final detector refuses mid-goal handoffs;
+              W3 overconf max_iters_cap is 40 on remote engines (8 on ollama).
+              P17 budget-hot always caps max_iters to 8 for ALL engines (not only ollama).
+
               #{self}.authors
           USAGE
         end

data/lib/pwn/ai/agent/prompt_builder.rb

@@ -54,6 +54,15 @@ module PWN
               no tool_calls is treated as your FINAL answer to the user.
               Prefer `pwn_eval` for anything in the PWN:: namespace and `shell`
               for OS commands. Save durable facts with `memory_remember`.
+
+            AUTONOMY
+              Multi-step goals must be finished in one Loop.run. Keep calling
+              tools until the request is done or truly blocked. Do NOT stop to
+              ask the user to confirm the next step, approve a partial plan, or
+              green-light the obvious continuation. Only ask when a credential,
+              irreversible destructive action, or missing external decision is
+              strictly required. Partial progress reports without completing the
+              goal are incorrect behavior.
           "
         end
 

data/lib/pwn/plugins/hacker_one.rb

@@ -2,6 +2,7 @@
 
 require 'base64'
 require 'json'
+require 'rest-client'
 
 module PWN
   module Plugins
@@ -95,13 +96,13 @@ module PWN
         return response if raw
 
         JSON.parse(response.body, symbolize_names: true)
-      rescue RestClient::TooManyRequests
+      rescue ::RestClient::TooManyRequests
         @@logger.warn('HackerOne rate limit (429). Sleeping 10s then retrying...')
         sleep 10
         retry
-      rescue RestClient::Unauthorized, RestClient::Forbidden,
-             RestClient::BadRequest, RestClient::NotFound,
-             RestClient::UnprocessableEntity => e
+      rescue ::RestClient::Unauthorized, ::RestClient::Forbidden,
+             ::RestClient::BadRequest, ::RestClient::NotFound,
+             ::RestClient::UnprocessableEntity => e
         @@logger.error("HackerOne #{e.class}: #{e.response&.body}")
         raise e
       rescue StandardError => e

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.655'
+  VERSION = '0.5.657'
 end

data/spec/integration/reinforced_feedback_loop_spec.rb

@@ -1502,5 +1502,35 @@ RSpec.describe 'PWN::AI::Agent reinforced feedback loop', :aggregate_failures do
       expect(doc).to match(/Last-iter force-final/)
     end
   end
+
+  describe 'P28 · autonomy (remote overconf runway + incomplete-final)' do
+    it 'sets W3 overconf max_iters_cap to 40 on remote, 8 on ollama' do
+      src = File.read(loop_mod.method(:run).source_location.first)
+      expect(src).to match(/P28/)
+      expect(src).to match(/remote_cap = 40/)
+      expect(src).to match(/local_cap\s*=\s*8/)
+      expect(src).to match(/eng == :ollama \? local_cap : remote_cap/)
+      # budget-hot still always 8 (P17)
+      expect(src).to match(/n = \[n, 8\]\.min/)
+    end
+
+    it 'defines incomplete_final? and continues on mid-goal handoff' do
+      src = File.read(loop_mod.method(:run).source_location.first)
+      expect(src).to match(/incomplete_final\?/)
+      expect(src).to match(/INCOMPLETE_FINAL_RX/)
+      expect(src).to match(%r{\[pwn-ai/p28\]})
+      expect(src).to match(/continuing autonomously/)
+      # last-iter wording no longer coaches "next single step" handoffs
+      expect(src).not_to match(/next single step/)
+      expect(src).to match(/do NOT ask the/)
+    end
+
+    it 'PromptBuilder injects AUTONOMY block' do
+      src = File.read(File.expand_path('../../lib/pwn/ai/agent/prompt_builder.rb', __dir__))
+      expect(src).to match(/AUTONOMY/)
+      expect(src).to match(/Do NOT stop to/)
+      expect(src).to match(/Multi-step goals must be finished in one Loop\.run/)
+    end
+  end
 end
 # rubocop:enable Metrics/BlockLength

data/third_party/pwn_rdoc.jsonl

@@ -301,6 +301,7 @@
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.expose_current_session Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.expose_current_session`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.guard_repeated_failure Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.guard_repeated_failure`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.help Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.help`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.incomplete_final? Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.incomplete_final?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.max_iters Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.max_iters`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.normalize_llm Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.normalize_llm`: Supported Method Parameters\n\nmsg = PWN::AI::Agent::Loop.normalize_llm(\n\nresponse: 'required - chat_with_tools response Hash from any provider'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.plan_first Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.plan_first`: "}]}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.655
+  version: 0.5.657
 platform: ruby
 authors:
 - 0day Inc.