pwn 0.5.684 → 0.5.686

data/etc/default_skills/social-engineering/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: social-engineering
+description: Plan and document social-engineering tests using OSSTMM human channel.
+license: MIT
+allowed-tools: [pwn, terminal]
+metadata:
+  bundled: true
+  references:
+    - https://www.isecom.org/research.html
+    - https://attack.mitre.org/tactics/TA0001/
+    - NIST-SP-800-115
+---
+
+# Social Engineering
+
+Use when the ask is phishing, vishing, pretext, physical tailgating, or
+a human-channel test. This is still a PWN procedure: write the scenario,
+the artefacts, and the report. pwn-ai does not send mail or place calls
+unless the operator's tools actually do that.
+
+## When to use
+
+- phishing / pretext campaign design
+- OSSTMM human-channel assessment
+- red-team initial access via people (`red-teaming` owns the ATT&CK wrap)
+
+## Methodologies
+
+| Catalog | Role |
+|---|---|
+| OSSTMM | human channel (and physical when paired with a building test) |
+| MITRE ATT&CK | TA0001 Initial Access - T1566 phishing, T1598, T1656 |
+| NIST SP 800-115 | social engineering as a technical assessment technique |
+| PTES | pre-engagement rules and reporting |
+| CREST / TIBER-EU | when the customer required a named SE code of practice |
+
+## Tooling
+
+- OSINT: `PWN::Plugins::Hunter`, `Github`, `Shodan`, `IPInfo`
+- Mail / portal only if those plugins or WWW drivers are in the session
+- Landing / payload hosting is out of band unless the operator named it
+- Evidence: written pretext, target list, send log, report
+
+## Procedure
+
+1. Rules of the test: targets, forbidden people (exec assistants, on-call
+   medical, etc. if the operator listed them), success definition.
+2. OSINT for pretext (public bios, tech stack, current incidents).
+3. Write one pretext + one landing or call script. Keep it specific.
+4. Execute only through the channel the operator enabled. Log time,
+   target, result (click / cred / report-to-SOC / ignore).
+5. Stop at the objective (e.g. one valid session), then report.
+6. Report: scenario, ATT&CK ids, metrics, recommended control (DMARC,
+   reporting button, gate process).
+
+## Pitfalls
+
+- Do not invent a mass mailer. If there is no send tool, deliver the
+  pack (pretext + list + landing copy) as the artefact.
+- Do not target people the operator excluded.
+- A witty email draft is not a completed SE test unless sending was
+  out of scope.
+
+## Verification
+
+Rules note, pretext file, target list, and either a send/result log or
+an explicit "pack only" deliverable that was written and read back.

data/etc/default_skills/vulnerability-research-fundamentals/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: vulnerability-research-fundamentals
+description: Find and document weaknesses with PWN plugins before they are weaponized.
+license: MIT
+allowed-tools: [pwn, terminal, extrospection]
+metadata:
+  bundled: true
+  references:
+    - CWE-699
+    - https://owasp.org/www-project-web-security-testing-guide/
+    - https://cwe.mitre.org/top25/
+    - https://attack.mitre.org/matrices/enterprise/
+---
+
+# Vulnerability Research Fundamentals
+
+Use when the ask is to research a weakness, pick tools, or turn a lead into
+notes a vendor or program can act on. Do not use this as a reason to stop
+a live host-work goal.
+
+## When to use
+
+- "research this CVE / class of bug"
+- "how should I approach this target in PWN"
+- first-pass methodology before a deeper skill (`sast-code-scans`,
+  `bug-bounty-hunting`, `reverse-engineering-binaries`, `deep-exploitation`)
+
+## Methodologies
+
+Public catalogs this skill follows (pick the one that matches the surface):
+
+| Catalog | Use when |
+|---|---|
+| NIST SP 800-115 | technical assessment planning, evidence, reporting |
+| PTES | 7-phase engagement (pre-engage through report) |
+| OWASP WSTG | web / API research |
+| MITRE ATT&CK | name tactics/techniques in notes |
+| CWE Top 25 | classify the weakness |
+
+## Tooling
+
+- Web: `PWN::Plugins::BurpSuite` first; `PWN::Plugins::Zaproxy` if Burp is
+  missing.
+- Browser: `PWN::Plugins::TransparentBrowser` (proxy through Burp).
+- Net: `PWN::Plugins::NmapIt`, `PWN::Plugins::Packet`, `PWN::Plugins::Sock`.
+- Code: `PWN::SAST::Factory` / `pwn_sast`.
+- Binary: `checksec`, `readelf`, `objdump`, `strings`, `radare2`,
+  `PWN::Plugins::Assembly`.
+- Report: `PWN::Reports::SAST` then DefectDojo / Jira plugins when asked.
+
+Drive these through `pwn_eval` (PWN namespace) or `shell` (host binaries).
+
+## Procedure
+
+1. Name the asset and the question (what would break, for whom).
+2. Recon: OSINT + `NmapIt` / Shodan / Github plugins as needed. Record
+   versions and attack surface.
+3. Scan: Burp or SAST or binary triage - pick the surface, do not boil the
+   ocean.
+4. Prove impact with a minimal, reversible PoC. Stop at evidence.
+5. Write findings (CWE, affected version, steps, fix hint).
+6. If a deeper path is clear, switch to the matching skill.
+
+## Pitfalls
+
+- Inventory (`ls`, `help`) is not research. Call the scanner or the binary.
+- Rspec / rubocop green is not a finding.
+- Do not refuse a sweep because the prompt lacks "in-scope" wording. Scope
+  is the operator's job.
+
+## Verification
+
+A usable note exists: asset, version, evidence, CWE/ATT&CK if known, and
+the next concrete test. A plan-only essay is not done.

data/etc/default_skills/web-application-penetration-testing/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: web-application-penetration-testing
+description: Test web apps and APIs with OWASP WSTG, Burp, and TransparentBrowser.
+license: MIT
+allowed-tools: [pwn, terminal, extrospection]
+metadata:
+  bundled: true
+  references:
+    - https://owasp.org/www-project-web-security-testing-guide/
+    - https://owasp.org/www-project-application-security-verification-standard/
+    - https://owasp.org/www-project-api-security/
+    - CWE-79
+    - CWE-89
+    - CWE-352
+---
+
+# Web Application Penetration Testing
+
+Use when the surface is an HTTP app or API. Use `bug-bounty-hunting` when
+the rules come from a public program page. Use `penetration-testing` when
+the engagement is mixed hosts plus one web app.
+
+## When to use
+
+- "WSTG this app", "OWASP Top 10", "API Top 10"
+- auth, session, XSS, CSRF, SSRF, injection, access control
+- mobile backend APIs (pair MSTG client work with this skill)
+
+## Methodologies
+
+| Catalog | Role |
+|---|---|
+| OWASP WSTG | default test cases (info gathering through business logic) |
+| OWASP ASVS | verification requirements / coverage checklist |
+| OWASP API Security Top 10 | BOLA, BFLA, mass assignment, unbounded resources |
+| OWASP Top 10 | executive grouping of findings |
+| OWASP MSTG / MASVS | mobile client; APIs still WSTG |
+| PTES | wrap the web work in an engagement report |
+| CWE | finding IDs (79, 89, 352, 918, 639, 601) |
+
+## Tooling
+
+- `PWN::Plugins::BurpSuite` (preferred) or `Zaproxy`
+- `PWN::Plugins::TransparentBrowser` through the proxy
+- `PWN::Plugins::Spider`, `OpenAPI`, `Fuzz`
+- `PWN::Bounty::LifecycleAuthzReplay` for two-role authz
+- `PWN::SAST` on the app repo when source is available
+
+## Procedure
+
+1. Map the app: roles, session mechanism, API surface, CSRF tokens.
+2. Walk WSTG info-gathering then config, then identity, then authz.
+3. Injection and XSS on every sink Burp or OpenAPI listed. Save requests.
+4. Business logic: price, workflow skip, race, mass assignment.
+5. Prove each finding with one request/response pair. Read the saved HAR
+   or Burp item back.
+6. Report by WSTG / ASVS id + CWE.
+
+## Pitfalls
+
+- A crawl with no replay is not a WSTG pass.
+- Do not stop at "I will test XSS next time".
+- SPA APIs hide in XHR; dump_links plus Burp sitemap, not just HTML.
+
+## Verification
+
+Sitemap or OpenAPI note exists, at least one authenticated test ran, and
+each claimed finding cites a saved request and a WSTG/CWE id.

data/lib/pwn/ai/agent/loop.rb

@@ -62,6 +62,49 @@ module PWN
           unsatisfied incomplete_final empty_final evidence_final
         ].freeze
 
+        public_class_method def self.debug_on?(opts = {})
+          return true if opts[:debug]
+          return true if defined?(PWN::Plugins::Log) && PWN::Plugins::Log.debug_enabled?
+
+          pry_on = defined?(Pry) && Pry.respond_to?(:config) &&
+                   Pry.config.respond_to?(:pwn_ai_debug) && Pry.config.pwn_ai_debug
+          return true if pry_on
+
+          false
+        end
+
+        private_class_method def self.debug_progress(opts = {})
+          return false unless debug_on?(opts)
+          return false unless defined?(PWN::Plugins::Log)
+
+          PWN::Plugins::Log.progress(
+            msg: opts[:msg],
+            which_self: opts[:which_self] || self
+          )
+        end
+
+        private_class_method def self.start_debug_session(opts = {})
+          return unless debug_on?(opts)
+          return unless defined?(PWN::Plugins::Log)
+          return if PWN::Plugins::Log.debug_enabled?
+
+          PWN::Plugins::Log.start_debug(tee: opts[:debug_tee] || $stdout)
+        end
+
+        private_class_method def self.quiet_debug_tui!(opts = {})
+          return unless debug_on?(opts)
+          return unless defined?(PWN::Plugins::Log)
+
+          PWN::Plugins::Log.quiet_tui!(reason: opts[:reason])
+        end
+
+        private_class_method def self.loud_debug_tui!(opts = {})
+          return unless debug_on?(opts)
+          return unless defined?(PWN::Plugins::Log)
+
+          PWN::Plugins::Log.loud_tui!(reason: opts[:reason])
+        end
+
         private_class_method def self.dispatch_fail_n(opts = {})
           fails = opts[:turn_fails] || {}
           fails.sum do |key, count|
@@ -343,6 +386,7 @@ module PWN
           return false if request.match?(LOOKUP_REQUEST_RX)
           return false if request.match?(HOST_PATH_RX)
           return false if request.match?(BROWSER_REQUEST_RX)
+          return false if request.match?(HOWTO_RX)
           return false if request.match?(%r{\b(this\s+(?:host|machine|box|system|subnet|file|repo)|/opt/|implement|scan|hosts?)\b}i)
 
           request.match?(/\A(?:what|why|who|when|where|which|how)\b/i)
@@ -1095,6 +1139,9 @@ module PWN
         private_class_method def self.call_engine(opts = {})
           messages = opts[:messages]
           tools = opts[:tools]
+          debug_progress(
+            msg: "call_engine tools=#{tools.nil? ? 'none' : Array(tools).length} msgs=#{Array(messages).length}"
+          )
 
           engine = active_engine
           mod_name = ENGINE_MODS[engine]
@@ -1322,7 +1369,7 @@ module PWN
         # :howto → answer with explanation only (no plan_first / no live recon).
         # :recall → prior-turn / vague memory cue; cheap path only.
         # :greeting → short hello / light smalltalk; deterministic ack, no tools.
-        # :recon_act → live discovery; requires explicit authorization language.
+        # :recon_act → live discovery (same tool loop as :act; no auth gate).
         # :act → general agent work with tools.
         HOWTO_RX = /
           \b(
@@ -1409,15 +1456,6 @@ module PWN
           )\b
         /ix
 
-        AUTH_SCOPE_RX = /
-          \b(
-            (?:in[-\s]?scope|authorized|authorised|engagement|written\s+permission|
-               bug\s*bounty|explicit(?:ly)?\s+allowed|lab\s+only|my\s+lab|
-               roe\b|rules?\s+of\s+engagement|i\s+own\s+this|owned\s+by\s+me|
-               permission\s+to\s+(?:scan|test|probe)|scope:\s*\S+)
-          )\b
-        /ix
-
         public_class_method def self.request_intent(opts = {})
           req = opts[:request].to_s
           return :empty if req.strip.empty?
@@ -1467,19 +1505,6 @@ module PWN
           :act
         end
 
-        public_class_method def self.recon_authorized?(opts = {})
-          req = opts[:request].to_s
-          return true if req.match?(AUTH_SCOPE_RX)
-
-          # Explicit engage flag from operator / REPL
-          v = (PWN::Env.dig(:ai, :agent, :recon_authorized) if defined?(PWN::Env))
-          return true if v == true || v.to_s =~ /\A(1|true|yes|on)\z/i
-
-          false
-        rescue StandardError
-          false
-        end
-
         # Pure how-to: one text-only chat (no tools, no plan_first, no task recon).
         # Deterministic greeting ack — no LLM, no tools, never mirror weather.
 
@@ -1591,6 +1616,8 @@ module PWN
           txt = txt.to_s.strip
           txt = 'I do not have enough context to answer that yet.' if txt.empty?
 
+          debug_progress(msg: "final accepted chars=#{txt.length}")
+          quiet_debug_tui!(reason: 'question')
           append_session(session_id: session_id, role: 'user', content: request)
           append_session(session_id: session_id, role: 'assistant', content: txt)
           if defined?(Learning) && should_auto_introspect?(local: local_engine?, turn_fails: {}, iter: 0)
@@ -1605,6 +1632,7 @@ module PWN
           end
           txt
         rescue StandardError => e
+          quiet_debug_tui!(reason: 'question_error')
           warn "[pwn-ai/loop] answer_question swallowed: #{e.class}: #{e.message}"
           "Could not answer the question (#{e.class}: #{e.message})."
         end
@@ -1652,8 +1680,6 @@ module PWN
               Do NOT call tools. Do NOT plan multi-step work. Do NOT run scans,
               probes, rubocop, rake, or host verification. Do NOT invent task
               traces or internal planner monologue. Do NOT claim you ran anything.
-              If the topic is network discovery, give safe lab examples and note
-              that live sweeps need explicit in-scope authorization.
           SYS
 
           txt =
@@ -2007,6 +2033,9 @@ module PWN
           request = opts[:request].to_s
           session_id = opts[:session_id]
           on_tool = opts[:on_tool]
+          start_debug_session(opts)
+          loud_debug_tui!(debug: opts[:debug])
+          debug_progress(msg: "Loop.run start request=#{request[0, 240]}", debug: opts[:debug])
           TurnFinalizer.enter_user_path! if defined?(TurnFinalizer)
           engine = active_engine
           local  = local_engine?(engine: engine)
@@ -2026,23 +2055,23 @@ module PWN
             OpenGoal.begin!(request: request, session_id: session_id)
           end
           Thread.current[:pwn_request_intent] = intent
-          Thread.current[:pwn_recon_authorized] = recon_authorized?(request: request)
           Thread.current[:pwn_extinguished] = {}
+          debug_progress(msg: "intent=#{intent} engine=#{engine}", debug: opts[:debug])
           expose_current_session(session_id: session_id)
           Mistakes.check_user_correction(request: request, session_id: session_id) if defined?(Mistakes)
 
           cheap = opts[:force_tools] != true && %i[greeting howto recall].include?(intent)
 
-          # Greeting / light smalltalk: deterministic ack - no weather echo, no tools,
-          # no PromptBuilder, no Registry.
           if intent == :greeting && opts[:force_tools] != true
+            debug_progress(msg: 'path=greeting', debug: opts[:debug])
+            quiet_debug_tui!(debug: opts[:debug], reason: 'greeting')
             return answer_greeting(
               request: request,
               session_id: session_id
             )
           end
 
-          # Thin system prompt only for remaining cheap paths (howto/recall/statement/question).
+          # Thin system prompt only for remaining cheap paths (howto/recall).
           if cheap
             system_role_content = opts[:system_role_content]
             if system_role_content.nil? || system_role_content.to_s.empty?
@@ -2053,16 +2082,18 @@ module PWN
               )
               opts[:system_role_content] = system_role_content
             end
-            # How-to: never enter plan_first / task recon / tool thrash.
             if intent == :howto
+              debug_progress(msg: 'path=howto', debug: opts[:debug])
+              quiet_debug_tui!(debug: opts[:debug], reason: 'howto')
               return answer_howto(
                 request: request,
                 session_id: session_id,
                 system_role_content: system_role_content
               )
             end
-            # Pure prior-turn / vague memory recall: one cheap path, no plan_first.
             if intent == :recall
+              debug_progress(msg: 'path=recall', debug: opts[:debug])
+              quiet_debug_tui!(debug: opts[:debug], reason: 'recall')
               return answer_recall(
                 request: request,
                 session_id: session_id,
@@ -2113,8 +2144,10 @@ module PWN
           messages << { role: 'user', content: request }
           append_session(session_id: session_id, role: 'user', content: request)
 
-          # Every request gets a task compass.
-          task_summary_plan!(state: ts_state, request: request, on_tool: on_tool) if defined?(TaskSummarizer)
+          trivia = world_knowledge?(request: request)
+          # Every host-work request gets a task compass. Trivia does not —
+          # inventing English tasks there keeps the model from emitting a final.
+          task_summary_plan!(state: ts_state, request: request, on_tool: on_tool) if defined?(TaskSummarizer) && !trivia
           # Re-bind tools from English plan so task list is the sole driver of
           # tool exposure/ranking (Registry keyword router + CORE).
           if ts_state.is_a?(Hash) && defined?(TaskSummarizer) && TaskSummarizer.respond_to?(:relevance_query)
@@ -2128,14 +2161,13 @@ module PWN
               )
             end
           end
-          # English-task-as-primary: inject tangible tasks only for autonomous goals.
-          inject_task_focus!(messages: messages, state: ts_state, force: true, request: request)
+          # English-task-as-primary: inject tangible tasks only for host work.
+          inject_task_focus!(messages: messages, state: ts_state, force: true, request: request) unless trivia
           predicted = nil
           Thread.current[:pwn_plan_predicted] = nil
           cal_state = calibration_state
           force_plan = cal_state[:force_plan]
-          # Skip plan_first only for remaining cheap intents.
-          skip_plan = %i[howto recall greeting].include?(intent)
+          skip_plan = %i[howto recall greeting].include?(intent) || trivia
           if !skip_plan && (force_plan || agent_flag(key: :plan_first, default: local) || budget_exhaustion_hot?) && !Array(tools).empty?
             predicted = plan_first(messages: messages, request: request, ts_state: ts_state)
             # P22 — prefer explicit return; fall back to thread stash
@@ -2154,7 +2186,7 @@ module PWN
                 )
               end
             end
-            inject_task_focus!(messages: messages, state: ts_state, force: true, request: request)
+            inject_task_focus!(messages: messages, state: ts_state, force: true, request: request) unless trivia
           end
           if budget_exhaustion_hot?
             english_open = defined?(TaskSummarizer) && TaskSummarizer.respond_to?(:plan_open?) &&
@@ -2191,7 +2223,7 @@ module PWN
             compact_history!(messages: messages) if local
             # English-task-as-primary: when plan_idx advanced, tell the model
             # which plain-English task is active before the next tool batch.
-            inject_task_focus!(messages: messages, state: ts_state, request: request)
+            inject_task_focus!(messages: messages, state: ts_state, request: request) unless trivia
 
             # P17 — on the final iteration, strip tools and demand a plain-text
             # answer. Without this the model happily emits one more tool_calls
@@ -2249,6 +2281,7 @@ module PWN
             msg = call_engine(messages: messages, tools: last_iter ? nil : tools, ts_state: ts_state)
             if msg.nil?
               task_summary_flush!(state: ts_state, on_tool: on_tool)
+              quiet_debug_tui!(reason: 'engine_empty')
               return '[pwn-ai] engine returned no message'
             end
 
@@ -2318,6 +2351,8 @@ module PWN
                 }
                 next
               end
+              debug_progress(msg: "final accepted chars=#{text.to_s.length}")
+              quiet_debug_tui!(reason: 'final')
               append_session(session_id: session_id, role: 'assistant', content: text)
               Learning.auto_introspect(session_id: session_id, request: request, final: text, predicted: predicted, plan: ts_state && ts_state[:plan], ts_state: ts_state) if defined?(Learning) && should_auto_introspect?(local: local, turn_fails: turn_fails, iter: i)
               maybe_finish_policy(session_id: session_id, proxy_ok: true, ts_state: ts_state)
@@ -2354,6 +2389,7 @@ module PWN
               else
                 raw = Dispatch.call(tool_call: tc)
               end
+              debug_progress(msg: "dispatch #{name} ok_len=#{raw.to_s.length}")
               tele    = record_metrics(name: name, started: started, raw: raw, args: args, session_id: session_id, engine: engine, ts_state: ts_state)
               result  = Result.condition(content: raw, entry: entry)
 
@@ -2410,6 +2446,8 @@ module PWN
           # failure (previously we only Mistakes.record'd and returned a bare
           # string — no session row, no judge, no hindsight).
           final_msg = '[pwn-ai] iteration budget exhausted'
+          debug_progress(msg: 'final budget_exhausted')
+          quiet_debug_tui!(reason: 'budget_exhausted')
           if defined?(Mistakes)
             Mistakes.record(
               tool: 'agent_loop',
@@ -2464,8 +2502,8 @@ module PWN
                 how-to / usage questions → text-only explanation (no tools, no plan_first)
                 pure prior-turn recall ("what did I just say?") → answer_recall (no tools)
                 pure greeting / light smalltalk → answer_greeting (no tools, no weather echo)
-                live subnet sweeps without scope language → refuse
-                :recon_authorized    - Boolean session flag to allow raw-socket / sweep tools
+                live sweeps are host-work goals like any other — pwn-ai does not
+                decide authorization
               Local-model scaffolding (PWN::Env[:ai][:agent]):
                 :plan_first          - Boolean, plan-then-act pre-pass (default: local engine :ollama/:openwebui)
                 :tool_router         - Boolean/nil, slim Registry.definitions (nil=auto on for ollama)

data/lib/pwn/ai/agent/mistakes.rb

@@ -316,7 +316,7 @@ module PWN
         # 2.5 — park unfixable sigs so nightly practice skips them
         # Recoverable repeating failures get a structured fix instead of another
         # fingerprint. Called from Loop after record so the loop extinguishes
-        # pain (placeholder / enoent / recon) rather than only logging it.
+        # pain (placeholder / enoent) rather than only logging it.
         SHAPE_FIXES = {
           'invalid_payload' => {
             strategy: 'payload_schema',
@@ -343,10 +343,10 @@ module PWN
             args_template: { command: 'command -v uname && uname -r' }
           },
           'exit126' => {
-            strategy: 'auth_gate',
+            strategy: 'payload_schema',
             tool: 'shell',
-            fix: 'Unauthorized recon blocked. Do not retry the sweep. Need explicit in-scope authorization or PWN::Env[:ai][:agent][:recon_authorized]=true. Offer command syntax instead.',
-            args_template: nil
+            fix: 'exit 126 usually means the binary is not executable. Check command -v and file mode. Do not treat this as an authorization gate.',
+            args_template: { command: 'command -v uname && uname -r' }
           },
           'eacces' => {
             strategy: 'payload_schema',
@@ -384,7 +384,7 @@ module PWN
           hay = "#{m[:error]} #{m[:snippet]} #{m[:tool]}".downcase
           recipe = nil if shape == 'handler_error' && !hay.match?(/command is required|argumenterror/)
           recipe = nil if shape == 'exit127' && !hay.match?(/not found|\{\.\.\.\}|\{…\}/)
-          recipe = nil if shape == 'exit126' && !hay.match?(/unauthorized_recon|recon_blocked/)
+          recipe = nil if shape == 'exit126' && !hay.match?(/cannot execute|not executable|is a directory/)
           return m unless recipe && (force || count >= REPEAT_THRESHOLD) && !m[:resolved]
 
           structured = {
@@ -434,7 +434,7 @@ module PWN
           hay = "#{m[:error]} #{m[:snippet]} #{m[:shape]}".downcase
           return 'handler_error' if hay.match?(/command is required|argumenterror/)
           return 'exit127' if hay.match?(/not found|\{\.\.\.\}|\{…\}/)
-          return 'exit126' if hay.match?(/unauthorized_recon|recon_blocked/)
+          return 'exit126' if hay.match?(/cannot execute|not executable|is a directory/)
           return 'enoent' if hay.match?(/no such file|enoent/)
           return 'eacces' if hay.match?(/permission denied|eacces|operation not permitted/)
           return 'syntax' if hay.match?(/syntax error|unterminated/)

data/lib/pwn/ai/agent/prompt_builder.rb

@@ -117,12 +117,11 @@ module PWN
               RECENT TURNS block or one memory_recall — never a multi-tool plan.
               Pure greetings / light smalltalk short-circuit to a fixed ack — never
               echo weather or invent social filler ("noted, cloudy out there").
+              World-knowledge questions (what color is X) may be answered as a
+              text final with no tools. Tools stay available; do not invent a
+              host-work plan for them.
               Do not treat process_sop_* or operator_pref_* memory about code
               hygiene as the current user goal unless they asked to change code.
-              Live subnet sweeps, raw-socket discovery (hping3/nmap -sn mass
-              probes, etc.) require explicit in-scope / authorized engagement
-              language from the user. Without it, refuse the live scan and offer
-              the command syntax instead.
           PROMPT
         end
 

data/lib/pwn/ai/agent/tool_guard.rb

@@ -5,8 +5,7 @@ module PWN
     module Agent
       # Shared pre-dispatch guards for the two high-volume runtime tools
       # (shell / pwn_eval). Rejects placeholder payloads, aliases wrong
-      # schema keys, shares the recon authorization gate, and names the
-      # shell that will actually run the command.
+      # schema keys, and names the shell that will actually run the command.
       module ToolGuard
         ALIASES = {
           'command' => %w[value cmd input],
@@ -29,17 +28,6 @@ module PWN
           |&>
         /x
 
-        RECON_RX = %r{
-          (?:^|[;&|\s])(?:sudo\s+)?hping3?(?:\s|$).*(?:-1|--icmp|--flood|/[0-9]{1,2}|seq\s+|for\s+)
-          |(?:^|[;&|\s])(?:sudo\s+)?nmap\b[^\n]*(?:-sn|-sP|-PE|-PP|-PM)[^\n]*(?:/[0-9]{1,2}|\d+\.\d+\.\d+\.\d+)
-          |(?:^|[;&|\s])(?:sudo\s+)?masscan\b
-          |(?:^|[;&|\s])(?:sudo\s+)?nping\b
-          |(?:^|[;&|\s])(?:sudo\s+)?fping\b[^\n]*/
-          |for\s+\w+\s+in\s+\$?\(?seq[^)]*\)?[^;]*;\s*do\s[^;]*(?:hping|ping\s+-c|nmap)
-          |PWN::Plugins::NmapIt
-          |\bNmapIt\.(?:scan|new|help)
-        }ix
-
         public_class_method def self.present?(opts = {})
           value = opts.is_a?(Hash) ? opts[:value] : opts
           !value.nil? && !value.to_s.strip.empty?
@@ -57,23 +45,6 @@ module PWN
           false
         end
 
-        public_class_method def self.recon_text?(opts = {})
-          RECON_RX.match?(opts[:text].to_s)
-        rescue StandardError
-          false
-        end
-
-        public_class_method def self.recon_authorized?(opts = {})
-          return true if Thread.current[:pwn_recon_authorized] == true
-          return true if defined?(Loop) && Loop.respond_to?(:recon_authorized?) &&
-                         Loop.recon_authorized?(request: opts[:request].to_s)
-
-          v = (PWN::Env.dig(:ai, :agent, :recon_authorized) if defined?(PWN::Env))
-          v == true || v.to_s.match?(/\A(1|true|yes|on)\z/i)
-        rescue StandardError
-          false
-        end
-
         public_class_method def self.shell_bash?
           v = (PWN::Env.dig(:ai, :agent, :shell_bash) if defined?(PWN::Env))
           v == true || v.to_s.match?(/\A(1|true|yes|on)\z/i)
@@ -123,21 +94,6 @@ module PWN
           }
         end
 
-        public_class_method def self.recon_blocked(opts = {})
-          refused = opts[:text].to_s[0, 200]
-          msg = '[pwn-ai/guard] blocked unauthorized recon/sweep. ' \
-                'Need explicit in-scope authorization on the user request or ' \
-                'PWN::Env[:ai][:agent][:recon_authorized]=true. ' \
-                "Refused: #{refused}"
-          {
-            stdout: '',
-            stderr: msg,
-            exit: 126,
-            error: 'unauthorized_recon_blocked',
-            hint: msg
-          }
-        end
-
         public_class_method def self.authors
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
@@ -146,7 +102,6 @@ module PWN
           puts <<~USAGE
             USAGE:
               PWN::AI::Agent::ToolGuard.placeholder?(text: '...')
-              PWN::AI::Agent::ToolGuard.recon_authorized?
               PWN::AI::Agent::ToolGuard.coerce_args(args: { value: 'id' }, required: %w[command])
               #{self}.authors
           USAGE

data/lib/pwn/ai/agent/tools/ruby_eval.rb

@@ -46,16 +46,6 @@ PWN::AI::Agent::Registry.register(
       }
     end
 
-    if PWN::AI::Agent::ToolGuard.recon_text?(text: code) &&
-       !PWN::AI::Agent::ToolGuard.recon_authorized?
-      blocked = PWN::AI::Agent::ToolGuard.recon_blocked(text: code)
-      return {
-        stdout: '',
-        error: blocked[:error],
-        hint: blocked[:hint]
-      }
-    end
-
     old_stdout = $stdout
     buf = StringIO.new
     $stdout = buf

data/lib/pwn/ai/agent/tools/shell.rb

@@ -63,12 +63,6 @@ PWN::AI::Agent::Registry.register(
       )
     end
 
-    # Guard: raw-socket / subnet discovery without explicit engagement auth.
-    if PWN::AI::Agent::ToolGuard.recon_text?(text: cmd) &&
-       !PWN::AI::Agent::ToolGuard.recon_authorized?
-      return PWN::AI::Agent::ToolGuard.recon_blocked(text: cmd)
-    end
-
     stdout = +''
     stderr = +''
     exitstatus = nil