pwn 0.5.684 → 0.5.686

data/lib/pwn/migrate.rb

@@ -210,6 +210,7 @@ module PWN
           { migrated: 0 }
         end
         io.puts "    · migrate_legacy_skills → #{r[:migrated]} converted" if r[:migrated].to_i.positive?
+        PWN::Config.install_default_skills if defined?(PWN::Config)
         PWN::Cron.install_defaults if defined?(PWN::Cron)
       }
     }.freeze
@@ -512,6 +513,7 @@ module PWN
         strip_bad_jsonl!(rel: f[:rel])
       when :skills
         PWN::Config.migrate_legacy_skills
+        PWN::Config.install_default_skills if PWN::Config.respond_to?(:install_default_skills)
       when :seed
         FileUtils.mkdir_p(File.join(PWN_ROOT, f[:rel])) if f[:kind] == :dir
         PWN::Cron.install_defaults if f[:rel].start_with?('cron/') && defined?(PWN::Cron)

data/lib/pwn/plugins/log.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'fileutils'
 require 'json'
 require 'logger'
 require 'securerandom'
@@ -8,6 +9,35 @@ module PWN
   module Plugins
     # This plugin is used to instantiate a PWN logger with a custom message format
     module Log
+      TRACE_SKIP_METHODS = %i[
+        authors help to_s inspect class object_id hash eql? == equal? !
+        method public_send send __send__ instance_eval class_eval
+        public_class_method private_class_method
+      ].freeze
+      TRACE_SKIP_PREFIXES = %w[
+        PWN::Plugins::Log
+        PWN::Plugins::REPL
+        PWN::Banner
+      ].freeze
+      DEFAULT_TRACE_PREFIXES = %w[
+        PWN::AI
+        PWN::Memory
+        PWN::Sessions
+        PWN::Config
+        PWN::Cron
+        PWN::Plugins
+      ].freeze
+      SECRET_KEY_RX = /password|passwd|secret|token|api[_-]?key|authorization|bearer|cookie|session[_-]?id|private[_-]?key|decryptor|credential|ssh[_-]?key|client[_-]?secret|refresh[_-]?token|access[_-]?token|id[_-]?token|vault|csrf/i
+      SECRET_VALUE_RX = %r{
+        -----BEGIN\ [A-Z ]*PRIVATE\ KEY----- |
+        Bearer\s+[A-Za-z0-9\-._~+/]+=* |
+        \beyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+ |
+        \b(?:sk|rk|pk|xai|xox[baprs]|ghp|gho|ghu|ghs|ghr|glpat|AKIA|ASIA|ya29)[-_][A-Za-z0-9\-_]{16,} |
+        \b(?:api[_-]?key|token|secret|password|passwd)\s*[:=]\s*\S+
+      }ix
+      DEBUG_VALUE_MAX = 240
+      DEBUG_ARGS_MAX = 1_800
+
       # Supported Method Parameters::
       # PWN::Log.create(
       # )
@@ -99,6 +129,271 @@ module PWN
         raise e
       end
 
+      public_class_method def self.debug_enabled?(opts = {})
+        return @debug_enabled == true if opts.is_a?(Hash)
+
+        @debug_enabled == true
+      end
+
+      public_class_method def self.debug_log_path(opts = {})
+        return @debug_path if opts.is_a?(Hash)
+
+        @debug_path
+      end
+
+      # Open /tmp/pwn-ai-DEBUG-TIMESTAMP.log, tee the same lines to the TUI
+      # (opts[:tee]), and TracePoint PWN modules that process a pwn-ai request.
+      DEBUG_LOG_MAX = 1_024_000
+
+      public_class_method def self.start_debug(opts = {})
+        return @debug_path if debug_enabled? && opts.is_a?(Hash)
+
+        ts = Time.now.strftime('%Y%m%d-%H%M%S')
+        path = opts[:path].to_s
+        path = "/tmp/pwn-ai-DEBUG-#{ts}.1.log" if path.empty?
+        stem, idx = debug_path_parts(path: path)
+        path = "#{stem}.#{idx}.log"
+        FileUtils.mkdir_p(File.dirname(path))
+        io = File.open(path, 'a')
+        io.sync = true
+        @debug_file = io
+        @debug_path = path
+        @debug_stem = stem
+        @debug_index = idx
+        @debug_tee = opts[:tee]
+        @debug_tui_quiet = false
+        @debug_enabled = true
+        start_trace!(prefixes: opts[:prefixes]) unless opts[:trace] == false
+        progress(msg: "debug session start path=#{path}", which_self: self)
+        path
+      end
+
+      public_class_method def self.stop_debug(opts = {})
+        reason = opts[:reason].to_s if opts.is_a?(Hash)
+        if debug_enabled?
+          tail = reason.to_s.empty? ? 'debug session stop' : "debug session stop reason=#{reason}"
+          progress(msg: tail, which_self: self)
+        end
+        stop_trace!
+        begin
+          @debug_file&.close unless @debug_file.nil? || @debug_file.closed?
+        rescue StandardError
+          nil
+        end
+        path = @debug_path
+        @debug_file = nil
+        @debug_path = nil
+        @debug_stem = nil
+        @debug_index = nil
+        @debug_tee = nil
+        @debug_tui_quiet = false
+        @debug_enabled = false
+        path
+      end
+
+      private_class_method def self.debug_path_parts(opts = {})
+        path = opts[:path].to_s
+        return [Regexp.last_match(1), Regexp.last_match(2).to_i] if path =~ /\A(.+)\.(\d+)\.log\z/
+
+        [path.sub(/\.log\z/, ''), 1]
+      end
+
+      private_class_method def self.roll_debug_log!(opts = {})
+        return if opts[:skip]
+        return if @debug_file.nil? || @debug_file.closed?
+        return if @debug_file.size < DEBUG_LOG_MAX
+
+        @debug_file.close
+        @debug_index = @debug_index.to_i + 1
+        path = "#{@debug_stem}.#{@debug_index}.log"
+        io = File.open(path, 'a')
+        io.sync = true
+        @debug_file = io
+        @debug_path = path
+        path
+      end
+
+      public_class_method def self.quiet_tui!(opts = {})
+        return if opts[:skip]
+
+        @debug_tui_quiet = true
+      end
+
+      public_class_method def self.loud_tui!(opts = {})
+        return if opts[:skip]
+
+        @debug_tui_quiet = false
+      end
+
+      # One progress line to the debug file and the TUI tee (same payload).
+      public_class_method def self.progress(opts = {})
+        return false unless debug_enabled?
+        return false if Thread.current[:pwn_log_progress]
+
+        Thread.current[:pwn_log_progress] = true
+        msg = sanitize_debug_text(text: opts[:msg].to_s)
+        which = opts[:which_self] || self
+        line = format_progress(msg: msg, which_self: which)
+        begin
+          @debug_file&.puts(line)
+          @debug_file&.flush
+          roll_debug_log!
+        rescue StandardError
+          nil
+        end
+        tee = opts.key?(:tee) ? opts[:tee] : @debug_tee
+        if !@debug_tui_quiet && tee.respond_to?(:puts)
+          begin
+            tee.puts(color_progress(line: line))
+          rescue StandardError
+            nil
+          end
+        end
+        true
+      ensure
+        Thread.current[:pwn_log_progress] = false
+      end
+
+      private_class_method def self.format_progress(opts = {})
+        msg = opts[:msg].to_s.tr("\n", ' ')[0, 4_000]
+        which = opts[:which_self]
+        who = if which.is_a?(Module)
+                (which.name || which.to_s).to_s
+              else
+                which.to_s
+              end
+        ts = Time.now.strftime('%Y-%m-%d %H:%M:%S.%L%z')
+        bits = ["[DEBUG #{ts}]"]
+        bits << who unless who.empty?
+        bits << msg unless msg.empty?
+        sanitize_debug_text(text: bits.join(' '))
+      end
+
+      private_class_method def self.color_progress(opts = {})
+        line = opts[:line].to_s
+        "\001\e[35m\002#{line}\001\e[0m\002"
+      end
+
+      private_class_method def self.trace_module_name(opts = {})
+        tp = opts[:tp]
+        return '' unless tp
+
+        mod = tp.self.is_a?(Module) ? tp.self : tp.defined_class
+        name = if mod.respond_to?(:name) && mod.name
+                 mod.name
+               else
+                 mod.to_s
+               end
+        name.to_s.sub(/\A#<Class:(.+?)>\z/, '\1')
+      end
+
+      private_class_method def self.secret_key?(opts = {})
+        opts[:key].to_s.match?(SECRET_KEY_RX)
+      end
+
+      private_class_method def self.sanitize_debug_text(opts = {})
+        text = opts[:text].to_s
+        text = text.gsub(SECRET_VALUE_RX, '[REDACTED]')
+        text.gsub(/-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----/m, '[REDACTED]')
+      end
+
+      private_class_method def self.inspect_debug(opts = {})
+        val = opts[:value]
+        key = opts[:key]
+        return '[REDACTED]' if secret_key?(key: key)
+        return format_debug_hash(hash: val) if val.is_a?(Hash)
+        return '[REDACTED]' if val.is_a?(String) && val.match?(SECRET_VALUE_RX)
+
+        raw = sanitize_debug_text(text: val.inspect)
+        raw = "#{raw[0, DEBUG_VALUE_MAX]}…" if raw.length > DEBUG_VALUE_MAX
+        raw
+      rescue StandardError
+        "#<#{val.class}>"
+      end
+
+      private_class_method def self.format_debug_hash(opts = {})
+        hash = opts[:hash]
+        return '{}' unless hash.is_a?(Hash)
+
+        parts = hash.map do |k, v|
+          "#{k}: #{inspect_debug(value: v, key: k)}"
+        end
+        "{#{parts.join(', ')}}"
+      end
+
+      private_class_method def self.trace_arguments(opts = {})
+        tp = opts[:tp]
+        return '' unless tp
+
+        bind = tp.binding
+        parts = []
+        Array(tp.parameters).each do |kind, name|
+          next if name.nil?
+          next if %i[rest keyrest block].include?(kind)
+          next unless bind.local_variable_defined?(name)
+
+          val = bind.local_variable_get(name)
+          if name == :opts && val.is_a?(Hash)
+            rendered = format_debug_hash(hash: val)
+            return rendered == '{}' ? '' : rendered
+          end
+
+          parts << "#{name}=#{inspect_debug(value: val, key: name)}"
+        end
+        out = parts.join(', ')
+        out = "#{out[0, DEBUG_ARGS_MAX]}…" if out.length > DEBUG_ARGS_MAX
+        out
+      rescue StandardError
+        ''
+      end
+
+      private_class_method def self.format_trace_call(opts = {})
+        tp = opts[:tp]
+        klass = trace_module_name(tp: tp)
+        meth = tp.method_id
+        args = trace_arguments(tp: tp)
+        args.to_s.empty? ? "#{klass}.#{meth}" : "#{klass}.#{meth}(#{args})"
+      end
+
+      private_class_method def self.traceable?(opts = {})
+        tp = opts[:tp]
+        prefixes = opts[:prefixes] || DEFAULT_TRACE_PREFIXES
+        name = trace_module_name(tp: tp)
+        return false if name.empty?
+        return false if TRACE_SKIP_PREFIXES.any? { |p| name.start_with?(p) }
+        return false unless prefixes.any? { |p| name.start_with?(p) }
+        return false if TRACE_SKIP_METHODS.include?(tp.method_id)
+
+        true
+      end
+
+      public_class_method def self.start_trace!(opts = {})
+        return @debug_tp if @debug_tp && opts.is_a?(Hash)
+
+        prefixes = Array(opts[:prefixes] || DEFAULT_TRACE_PREFIXES).map(&:to_s)
+        prefixes = DEFAULT_TRACE_PREFIXES if prefixes.empty?
+        @debug_tp = TracePoint.new(:call) do |tp|
+          next unless debug_enabled?
+          next unless traceable?(tp: tp, prefixes: prefixes)
+
+          progress(
+            msg: format_trace_call(tp: tp),
+            which_self: ''
+          )
+        rescue StandardError
+          nil
+        end
+        @debug_tp.enable
+        @debug_tp
+      end
+
+      public_class_method def self.stop_trace!(opts = {})
+        return if opts[:skip]
+
+        @debug_tp&.disable
+        @debug_tp = nil
+      end
+
       # Author(s):: 0day Inc. <support@0dayinc.com>
 
       public_class_method def self.authors
@@ -116,6 +411,13 @@ module PWN
             msg: 'required - message to log',
             which_self: 'required - pass in self object from module calling #{self}'
           )
+
+          path = #{self}.start_debug(
+            tee: $stdout,
+            path: 'optional - defaults to /tmp/pwn-ai-DEBUG-TIMESTAMP.log'
+          )
+          #{self}.progress(msg: 'stage', which_self: self)
+          #{self}.stop_debug
         "
       end
     end

data/lib/pwn/plugins/repl.rb

@@ -375,11 +375,10 @@ module PWN
             max_context = PWN::Env[:ai][engine][:max_prompt_length].to_i
             current_context_length = "#{PWN::Plugins::REPL.compact_context_tokens(tokens: used_tokens)}:" \
                                      "#{PWN::Plugins::REPL.compact_context_tokens(tokens: max_context)}"
-            plan_usage_glyph = PWN::AI.plan_usage_glyph(engine: engine)
 
             pname = "pwn.ai:#{engine}"
-            pname = "pwn.ai:#{engine}/#{model}/#{current_context_length}/#{plan_usage_glyph}" if model
-            pname = "pwn.ai:#{engine}/#{model}/#{current_context_length}/#{plan_usage_glyph}.SPEAK" if pi.config.pwn_ai_speak
+            pname = "pwn.ai:#{engine}/#{model}/#{current_context_length}" if model
+            pname = "pwn.ai:#{engine}/#{model}/#{current_context_length}.SPEAK" if pi.config.pwn_ai_speak
             pi.config.prompt_name = pname
 
             name = "\001\e[1m\002\001\e[33m\002#{pi.config.prompt_name}\001\e[0m\002"
@@ -1045,11 +1044,23 @@ module PWN
         end
 
         Pry::Commands.create_command 'toggle-pwn-ai-debug' do
-          description 'Display the response_history object while using pwn.ai'
+          description 'Stream pwn-ai module progress to the TUI and /tmp/pwn-ai-DEBUG-TIMESTAMP.log'
 
           def process
             pi = pry_instance
-            pi.config.pwn_ai_debug ? pi.config.pwn_ai_debug = false : pi.config.pwn_ai_debug = true
+            if pi.config.pwn_ai_debug
+              path = PWN::Plugins::Log.stop_debug
+              pi.config.pwn_ai_debug = false
+              if path
+                output.puts "pwn-ai debug OFF (was #{path})"
+              else
+                output.puts 'pwn-ai debug OFF'
+              end
+            else
+              path = PWN::Plugins::Log.start_debug(tee: output)
+              pi.config.pwn_ai_debug = true
+              output.puts "pwn-ai debug ON → #{path}"
+            end
           end
         end
 
@@ -1071,7 +1082,7 @@ module PWN
             pi.config.pwn_asm = false if pi.config.pwn_asm
             pi.config.pwn_ai = false if pi.config.pwn_ai
             pi.config.pwn_ai_agent = false if pi.config.pwn_ai_agent
-            pi.config.pwn_ai_debug = false if pi.config.pwn_ai_debug
+            # pi.config.pwn_ai_debug = false if pi.config.pwn_ai_debug
             pi.config.pwn_ai_speak = false if pi.config.pwn_ai_speak
             pi.config.completer = Pry::InputCompleter
             # pi.config.pwn_ai_original_input ||= Pry.config.input.clone
@@ -1215,10 +1226,19 @@ module PWN
                   request: orig_request,
                   session_id: sess_id,
                   enabled_toolsets: PWN::Env.dig(:ai, :agent, :toolsets),
-                  on_tool: on_tool
+                  on_tool: on_tool,
+                  debug: pi.config.pwn_ai_debug,
+                  debug_tee: $stdout
                 )
+                $stdout.flush
                 puts "\n\001\e[32m\002#{final}\001\e[0m\002\n\n"
-                pp PWN::Sessions.load(session_id: sess_id) if pi.config.pwn_ai_debug && sess_id && PWN.const_defined?(:Sessions)
+                $stdout.flush
+                if pi.config.pwn_ai_debug && sess_id && PWN.const_defined?(:Sessions)
+                  PWN::Plugins::Log.progress(
+                    msg: "session=#{sess_id}",
+                    which_self: PWN::Sessions
+                  )
+                end
                 request.replace('nil')
                 next
               rescue StandardError => e

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.684'
+  VERSION = '0.5.686'
 end

data/spec/integration/config_spec.rb

@@ -65,4 +65,41 @@ RSpec.describe 'PWN::Config / etc/*.EXAMPLE hygiene', :aggregate_failures do
     end
     expect(PWN::Setup::PROFILES).to include(:core, :full)
   end
+
+  it 'install_default_skills seeds the bundled offensive skills and does not overwrite edits' do
+    Dir.mktmpdir('pwn_default_skills') do |dir|
+      expect(PWN::Config).to respond_to(:install_default_skills)
+      expect(PWN::Config).to respond_to(:default_skill_names)
+      names = PWN::Config.default_skill_names
+      expect(names).to eq %w[
+        vulnerability-research-fundamentals
+        deep-exploitation
+        bug-bounty-hunting
+        sast-code-scans
+        reverse-engineering-binaries
+        penetration-testing
+        web-application-penetration-testing
+        red-teaming
+        hardware-and-firmware-testing
+        social-engineering
+        osint
+      ]
+      seeded = PWN::Config.install_default_skills(pwn_skills_path: dir)
+      expect(seeded.map { |r| r[:name] }).to eq names
+      names.each do |name|
+        path = File.join(dir, name, 'SKILL.md')
+        expect(File.file?(path)).to eq(true), path
+        body = File.read(path)
+        expect(body).to start_with("---\n")
+        expect(body).to include("name: #{name}")
+        expect(body).not_to match(/hermes/i)
+        expect(body).to match(/## Methodolog/i)
+      end
+      marker = File.join(dir, 'bug-bounty-hunting', 'SKILL.md')
+      File.write(marker, "# user edited\n")
+      again = PWN::Config.install_default_skills(pwn_skills_path: dir)
+      expect(again).to eq([])
+      expect(File.read(marker)).to eq("# user edited\n")
+    end
+  end
 end

data/spec/lib/pwn/ai/agent/loop_spec.rb

@@ -622,7 +622,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     end
   end
 
-  describe 'intent routing (ollama/openwebui how-to + recon guard)' do
+  describe 'intent routing (how-to + greeting + recall)' do
     it 'classifies pure how-to vs live recon vs act' do
       expect(described_class.request_intent(request: 'how to do a ping sweep of a subnet using hping3?')).to eq(:howto)
       expect(described_class.request_intent(request: 'using hping3 what live hosts can you find in this subnet?')).to eq(:recon_act)
@@ -633,12 +633,42 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
       expect(described_class).not_to respond_to :request_kind
     end
 
-    it 'run does not short-circuit statement/question — they take the full tool loop' do
+    it 'does not invent a request type for world-knowledge; the full loop still accepts a text final' do
+      expect(described_class.world_knowledge?(request: 'what color is a passion fruit?')).to eq true
       src = File.read(described_class.method(:run).source_location.first)
-      expect(src).not_to match(/kind\.to_sym == :statement/)
-      expect(src).not_to match(/kind\.to_sym == :question/)
-      expect(src).not_to match(/Request type/)
-      expect(src).to match(/Every request gets a task compass/)
+      expect(src).not_to match(/request_kind/)
+      expect(src).not_to match(/world_knowledge\?.*?return answer_question/m)
+      expect(src).to match(/world_knowledge\?/)
+    end
+
+    it 'full tool loop accepts a text final for world-knowledge with no host-work tools' do
+      expect(described_class.world_knowledge?(request: 'what color is a passion fruit?')).to eq true
+      expect(described_class.send(:request_need, request: 'what color is a passion fruit?')).to eq :none
+      expect(
+        described_class.send(
+          :request_unsatisfied?,
+          request: 'what color is a passion fruit?',
+          messages: [{ role: 'assistant', content: 'Purple when ripe.', tool_calls: [] }]
+        )
+      ).to eq false
+      sess_tmp = Dir.mktmpdir('pwn-sess-fruit')
+      stub_const('PWN::Sessions::SESSIONS_DIR', sess_tmp)
+      sid = 'fruit_spec'
+      PWN::Sessions.create(id: sid, title: 'fruit')
+      allow(described_class).to receive(:should_auto_introspect?).and_return(false)
+      allow(described_class).to receive(:plan_first).and_raise('plan_first must not run on world-knowledge')
+      allow(PWN::AI::Agent::TaskSummarizer).to receive(:enabled?).and_return(false) if defined?(PWN::AI::Agent::TaskSummarizer)
+      allow(described_class).to receive(:call_engine).and_return(
+        { role: 'assistant', content: 'Purple when ripe.', tool_calls: [] }
+      )
+      out = described_class.run(
+        request: 'what color is a passion fruit?',
+        session_id: sid,
+        system_role_content: 'test system'
+      )
+      expect(out).to include('Purple when ripe.')
+    ensure
+      FileUtils.rm_rf(sess_tmp) if sess_tmp
     end
 
     it 'classifies pure prior-turn recall and vague memory cues as :recall' do
@@ -668,12 +698,14 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
       expect(described_class.request_intent(request: 'how to do a ping sweep with hping3?')).to eq(:howto)
     end
 
-    it 'recon_authorized? requires scope language or env flag' do
-      expect(described_class.recon_authorized?(request: 'find live hosts on this subnet')).to eq(false)
-      expect(described_class.recon_authorized?(request: 'authorized engagement: find live hosts on this lab subnet')).to eq(true)
-      allow(PWN::Env).to receive(:dig).and_call_original
-      allow(PWN::Env).to receive(:dig).with(:ai, :agent, :recon_authorized).and_return(true)
-      expect(described_class.recon_authorized?(request: 'find live hosts')).to eq(true)
+    it 'does not refuse sweeps for missing scope language' do
+      expect(described_class).not_to respond_to(:recon_authorized?)
+      src = File.read(described_class.method(:run).source_location.first)
+      expect(src).not_to match(/AUTH_SCOPE_RX/)
+      expect(src).not_to match(/need scope language/)
+      expect(src).not_to match(/refuse the live scan/)
+      expect(src).not_to match(/pwn_recon_authorized/)
+      expect(src).not_to match(/in-scope authorization/)
     end
 
     it 'run short-circuits how-to without plan_first or tools' do
@@ -977,4 +1009,12 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     expect(src).not_to include('return false if kind == :statement')
     expect(src).not_to include('return false if kind == :question && fails.zero?')
   end
+
+  it 'streams request-processing progress through PWN::Plugins::Log when debug is on' do
+    src = File.read(described_class.method(:run).source_location.first)
+    expect(src).to match(/PWN::Plugins::Log\.start_debug/)
+    expect(src).to match(/PWN::Plugins::Log\.progress/)
+    expect(src).to match(/quiet_debug_tui!/)
+    expect(described_class).to respond_to(:debug_on?)
+  end
 end # rubocop:enable Metrics/BlockLength

data/spec/lib/pwn/ai/agent/mistakes_spec.rb

@@ -184,4 +184,11 @@ describe PWN::AI::Agent::Mistakes do
     expect(ctx).to include('shell')
     expect(ctx).not_to match(/iteration budget exhausted/)
   end
+
+  it 'does not classify or extinguish scars as unauthorized recon' do
+    src = File.read(described_class.method(:extinguish!).source_location.first)
+    expect(src).not_to match(/unauthorized_recon/)
+    expect(src).not_to match(/recon_blocked/)
+    expect(src).not_to match(/auth_gate/)
+  end
 end

data/spec/lib/pwn/ai/agent/signal_hygiene_spec.rb

@@ -36,15 +36,12 @@ describe 'P0 signal hygiene (handler + inbox + policy-cold + calibrate)' do
     expect(r[:hint].to_s).to match(/bash-only/i)
   end
 
-  it 'blocks unauthorized recon inside pwn_eval' do
+  it 'does not refuse pwn_eval host-discovery as unauthorized' do
+    src = File.read('/opt/pwn/lib/pwn/ai/agent/tools/ruby_eval.rb')
+    expect(src).not_to match(/recon_blocked/)
     handler = PWN::AI::Agent::Registry.lookup(name: 'pwn_eval').handler
-    Thread.current[:pwn_recon_authorized] = false
-    allow(PWN::Env).to receive(:dig).and_call_original
-    allow(PWN::Env).to receive(:dig).with(:ai, :agent, :recon_authorized).and_return(nil)
-    r = handler.call(code: 'PWN::Plugins::NmapIt.help')
-    expect(r[:error]).to eq('unauthorized_recon_blocked')
-  ensure
-    Thread.current[:pwn_recon_authorized] = nil
+    r = handler.call(code: '1 + 1')
+    expect(r[:error]).not_to eq('unauthorized_recon_blocked')
   end
 
   it 'Dispatch aliases value= onto command; handler reports schema errors' do

data/spec/lib/pwn/ai/agent/tools/shell_spec.rb

@@ -46,24 +46,16 @@ describe 'PWN::AI::Agent::Tools shell' do
     expect(r[:stdout].to_s).to include('holdout_ok_30e55')
   end
 
-  it 'blocks unauthorized hping3 subnet sweep style commands' do
-    Thread.current[:pwn_recon_authorized] = false
-    allow(PWN::Env).to receive(:dig).and_call_original
-    allow(PWN::Env).to receive(:dig).with(:ai, :agent, :recon_authorized).and_return(nil)
-    r = handler.call(command: 'hping3 -1 -c 1 192.168.1.1')
-    expect(r[:error]).to eq('unauthorized_recon_blocked')
-    expect(r[:exit]).to eq(126)
-    expect(r[:stderr].to_s).to match(/blocked unauthorized recon/)
-  ensure
-    Thread.current[:pwn_recon_authorized] = nil
-  end
-
-  it 'allows commands when recon_authorized thread flag is set' do
-    Thread.current[:pwn_recon_authorized] = true
-    r = handler.call(command: 'echo allowed_hping_guard')
+  it 'does not refuse sweep-shaped commands as unauthorized' do
+    src = File.read('/opt/pwn/lib/pwn/ai/agent/tools/shell.rb')
+    expect(src).not_to match(/recon_blocked/)
+    expect(src).not_to match(/recon_authorized\?/)
+    expect(PWN::AI::Agent::ToolGuard).not_to respond_to(:recon_authorized?)
+    expect(PWN::AI::Agent::ToolGuard).not_to respond_to(:recon_text?)
+    guard = File.read('/opt/pwn/lib/pwn/ai/agent/tool_guard.rb')
+    expect(guard).not_to match(/RECON_RX/)
+    r = handler.call(command: 'echo sweep_guard_removed')
+    expect(r[:error]).not_to eq('unauthorized_recon_blocked')
     expect(r[:exit]).to eq(0)
-    expect(r[:stdout].to_s).to include('allowed_hping_guard')
-  ensure
-    Thread.current[:pwn_recon_authorized] = nil
   end
 end

data/spec/lib/pwn/ai/anthropic_spec.rb

@@ -47,8 +47,8 @@ describe PWN::AI::Anthropic do
     end
   end
 
-  it 'exposes get_plan_usage for the PS1 subscription suffix' do
-    expect(described_class).to respond_to(:get_plan_usage)
+  it 'does not expose get_plan_usage' do
+    expect(described_class).not_to respond_to(:get_plan_usage)
   end
 
   describe 'Hermes prompt-cache breakpoint' do

data/spec/lib/pwn/ai/gemini_spec.rb

@@ -13,8 +13,8 @@ describe PWN::AI::Gemini do
     expect(help_response).to respond_to :help
   end
 
-  it 'exposes get_plan_usage for the PS1 subscription suffix' do
-    expect(described_class).to respond_to(:get_plan_usage)
+  it 'does not expose get_plan_usage' do
+    expect(described_class).not_to respond_to(:get_plan_usage)
   end
 
   it 'chat_with_tools honors PromptCache when prompt_cache is on' do

data/spec/lib/pwn/ai/grok_spec.rb

@@ -18,8 +18,8 @@ describe PWN::AI::Grok do
     expect(src).to match(/openai_wire_messages/)
   end
 
-  it 'exposes get_plan_usage for the PS1 subscription suffix' do
-    expect(described_class).to respond_to(:get_plan_usage)
+  it 'does not expose get_plan_usage' do
+    expect(described_class).not_to respond_to(:get_plan_usage)
   end
 
   it 'grok_rest_call swallows ReadTimeout quietly without ERROR: print' do