pwn 0.5.668 → 0.5.669

data/spec/lib/pwn/ai/agent/task_summarizer_spec.rb

@@ -360,6 +360,16 @@ describe PWN::AI::Agent::TaskSummarizer do
       expect(second).not_to include(subnet_req)
     end
 
+    it 'how-to goals stay explanation-only without rubocop verify padding' do
+      allow(PWN::Env).to receive(:dig).and_call_original
+      allow(PWN::Env).to receive(:dig).with(:ai, :agent, :task_summary_llm).and_return(false)
+      tasks = described_class.plan(request: 'how to do a ping sweep of a subnet using hping3?')
+      joined = tasks.join(' | ').downcase
+      expect(joined).to match(/explain|example|present|how/)
+      expect(joined).not_to match(/rubocop|live hosts|sweep the subnet|discover/)
+      expect(tasks.length).to be <= 3
+    end
+
     it 'falls back generically when LLM is disabled (no static domain scripts)' do
       allow(PWN::Env).to receive(:dig).and_call_original
       allow(PWN::Env).to receive(:dig).with(:ai, :agent, :task_summary_llm).and_return(false)

data/spec/lib/pwn/ai/agent/tools/shell_spec.rb

@@ -45,4 +45,25 @@ describe 'PWN::AI::Agent::Tools shell' do
     expect(r[:exit]).to eq(0)
     expect(r[:stdout].to_s).to include('holdout_ok_30e55')
   end
+
+  it 'blocks unauthorized hping3 subnet sweep style commands' do
+    Thread.current[:pwn_recon_authorized] = false
+    allow(PWN::Env).to receive(:dig).and_call_original
+    allow(PWN::Env).to receive(:dig).with(:ai, :agent, :recon_authorized).and_return(nil)
+    r = handler.call(command: 'hping3 -1 -c 1 192.168.1.1')
+    expect(r[:error]).to eq('unauthorized_recon_blocked')
+    expect(r[:exit]).to eq(126)
+    expect(r[:stderr].to_s).to match(/blocked unauthorized recon/)
+  ensure
+    Thread.current[:pwn_recon_authorized] = nil
+  end
+
+  it 'allows commands when recon_authorized thread flag is set' do
+    Thread.current[:pwn_recon_authorized] = true
+    r = handler.call(command: 'echo allowed_hping_guard')
+    expect(r[:exit]).to eq(0)
+    expect(r[:stdout].to_s).to include('allowed_hping_guard')
+  ensure
+    Thread.current[:pwn_recon_authorized] = nil
+  end
 end

data/spec/lib/pwn/plugins/repl_pwn_vault_spec.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'stringio'
+
+describe 'pwn-vault Config RuntimeError retry' do
+  # Source/behavior contract: after Vault.edit, Config.refresh_env must run
+  # inside the command so RuntimeError from invalid pwn.yaml prints the error,
+  # waits on "Press Enter to Resolve" via $stdin.gets, then re-opens the editor.
+  # Validation must NOT be deferred solely to the PS1 hook.
+  let(:repl_src) { File.read(PWN::Plugins::REPL.method(:add_commands).source_location.first) }
+  let(:vault_src) { File.read(PWN::Plugins::Vault.method(:edit).source_location.first) }
+  let(:block) do
+    start = repl_src.index("Pry::Commands.create_command 'pwn-vault'")
+    stop = repl_src.index("Pry::Commands.create_command 'toggle-pwn-ai-debug'")
+    repl_src[start...stop]
+  end
+
+  it 'validates via PWN::Config.refresh_env inside the pwn-vault command' do
+    expect(block).to include('PWN::Config.refresh_env')
+    expect(block).to include('PWN::Plugins::Vault.edit')
+    expect(block).to match(/loop do/)
+    expect(block).to match(/rescue RuntimeError/)
+  end
+
+  it 'prints the error, prompts, "Press ENTER to resolve...", and waits on $stdin.gets' do
+    expect(block).to include('puts e.message')
+    expect(block).to include("print 'Press ENTER to resolve...'")
+    expect(block).to include('$stdin.gets')
+  end
+
+  it 'clears refresh_pwn_env on Config RuntimeError so PS1 does not re-raise' do
+    expect(block).to include('Pry.config.refresh_pwn_env = false')
+  end
+
+  it 'defaults decryptor path to <pwn.yaml>.decryptor (Config canonical)' do
+    # Ruby source uses "#{pwn_env_path}.decryptor" — match that expression.
+    expect(block).to include('pwn_env_path}.decryptor')
+    expect(block).not_to include('pwn.decryptor.yaml')
+  end
+
+  it 'Vault.edit alone still only flags refresh (validation stays in command)' do
+    expect(vault_src).to include('Pry.config.refresh_pwn_env = true')
+    # edit method should not call refresh_env itself
+    edit_start = vault_src.index('def self.edit')
+    edit_chunk = vault_src[edit_start...(edit_start + 1200)]
+    expect(edit_chunk).not_to include('refresh_env')
+  end
+
+  describe 'retry loop behavioral double' do
+    it 'prints error + resolve prompt, waits on $stdin.gets, re-invokes edit until refresh_env succeeds' do
+      edit_calls = 0
+      refresh_calls = 0
+      gets_calls = 0
+      stdout = StringIO.new
+
+      vault = Module.new do
+        define_singleton_method(:edit) do |**_opts|
+          edit_calls += 1
+          true
+        end
+      end
+
+      config = Module.new do
+        define_singleton_method(:refresh_env) do |**_opts|
+          refresh_calls += 1
+          raise 'ERROR: Unsupported AI Engine: bogon' if refresh_calls < 3
+
+          true
+        end
+      end
+
+      # Mirror the production control flow without vim/Pry command plumbing.
+      # Use $stdin.gets (not Kernel#gets) so ARGF/ARGV from rspec/rake cannot
+      # steal the read the way bare gets does under `rake`.
+      original_stdout = $stdout
+      original_stdin = $stdin
+      begin
+        $stdout = stdout
+        $stdin = StringIO.new("\n\n")
+        loop do
+          vault.edit(file: 'x', key: 'k', iv: 'i')
+          begin
+            config.refresh_env(pwn_env_path: 'x', pwn_dec_path: 'y', key: 'k', iv: 'i')
+            break
+          rescue RuntimeError => e
+            puts e
+            puts 'Press Enter to Resolve'
+            $stdin.gets
+            gets_calls += 1
+          end
+        end
+      ensure
+        $stdout = original_stdout
+        $stdin = original_stdin
+      end
+
+      expect(edit_calls).to eq(3)
+      expect(refresh_calls).to eq(3)
+      expect(gets_calls).to eq(2)
+      out = stdout.string
+      expect(out).to include('ERROR: Unsupported AI Engine: bogon')
+      expect(out.scan('Press Enter to Resolve').size).to eq(2)
+    end
+
+    it 'does not retry when refresh_env succeeds on first try' do
+      edit_calls = 0
+      refresh_calls = 0
+      vault = Module.new do
+        define_singleton_method(:edit) do |**_|
+          edit_calls += 1
+        end
+      end
+      config = Module.new do
+        define_singleton_method(:refresh_env) do |**_|
+          refresh_calls += 1
+        end
+      end
+
+      loop do
+        vault.edit
+        begin
+          config.refresh_env
+          break
+        rescue RuntimeError
+          raise 'unexpected retry'
+        end
+      end
+
+      expect(edit_calls).to eq(1)
+      expect(refresh_calls).to eq(1)
+    end
+  end
+end

data/third_party/pwn_rdoc.jsonl

@@ -303,6 +303,7 @@
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Learning.verdict_for_score Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Learning.verdict_for_score`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.active_engine Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.active_engine`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.agent_flag Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.agent_flag`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.answer_howto Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.answer_howto`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.append_session Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.append_session`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.attribute_cause Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.attribute_cause`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.authors Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
@@ -332,7 +333,10 @@
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.parse_tool_arguments Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.parse_tool_arguments`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.plan_first Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.plan_first`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.publish_usage Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.publish_usage`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.recon_authorized? Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.recon_authorized?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.record_metrics Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.record_metrics`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.refuse_unauthorized_recon Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.refuse_unauthorized_recon`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.request_intent Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.request_intent`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.run Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.run`: Supported Method Parameters\n\nfinal = PWN::AI::Agent::Loop.run(\n\nrequest: 'required - what the human typed',\nsession_id: 'optional - PWN::Sessions id (transcript is appended to it)',\nenabled_toolsets: 'optional - subset of Registry.toolsets, or nil for all',\non_tool: 'optional - ->(name, args, result) callback for live UI',\nsystem_role_content: 'optional - override default system prompt (built from session_id if not provided)'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.should_auto_introspect? Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.should_auto_introspect?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::Loop.stringify_tool_arguments Usage"},{"role":"assistant","content":"`PWN::AI::Agent::Loop.stringify_tool_arguments`: "}]}
@@ -520,6 +524,7 @@
 {"messages":[{"role":"user","content":"PWN::AI::Agent::TaskSummarizer.fresh Usage"},{"role":"assistant","content":"`PWN::AI::Agent::TaskSummarizer.fresh`: Supported Method Parameters\n\nstate = PWN::AI::Agent::TaskSummarizer.fresh(\n\nrequest: 'optional - original user goal string'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::TaskSummarizer.help Usage"},{"role":"assistant","content":"`PWN::AI::Agent::TaskSummarizer.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::TaskSummarizer.heuristic_decompose Usage"},{"role":"assistant","content":"`PWN::AI::Agent::TaskSummarizer.heuristic_decompose`: Supported Method Parameters\n\ntasks = PWN::AI::Agent::TaskSummarizer.heuristic_decompose(\n\ngoal: 'required - user goal string'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::AI::Agent::TaskSummarizer.howto_goal? Usage"},{"role":"assistant","content":"`PWN::AI::Agent::TaskSummarizer.howto_goal?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::TaskSummarizer.intent_phrase Usage"},{"role":"assistant","content":"`PWN::AI::Agent::TaskSummarizer.intent_phrase`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::TaskSummarizer.interval_s Usage"},{"role":"assistant","content":"`PWN::AI::Agent::TaskSummarizer.interval_s`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Agent::TaskSummarizer.llm_decompose Usage"},{"role":"assistant","content":"`PWN::AI::Agent::TaskSummarizer.llm_decompose`: "}]}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.668
+  version: 0.5.669
 platform: ruby
 authors:
 - 0day Inc.
@@ -2532,6 +2532,7 @@ files:
 - spec/lib/pwn/plugins/ps_spec.rb
 - spec/lib/pwn/plugins/pwn_logger_spec.rb
 - spec/lib/pwn/plugins/rabbit_mq_spec.rb
+- spec/lib/pwn/plugins/repl_pwn_vault_spec.rb
 - spec/lib/pwn/plugins/repl_spec.rb
 - spec/lib/pwn/plugins/scannable_codes_spec.rb
 - spec/lib/pwn/plugins/serial_spec.rb