pwn 0.5.706 → 0.5.708

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f9233042c1c9518d8cfdcbfe6499eb521cb0348384554e03ab6641abdda253b9
-  data.tar.gz: 51b81fd36f292bc54e762d4bb47f5641c9b263addf9f37997aaa4c2f6a00c49f
+  metadata.gz: 5d0deee1782b9f4be05a64ad407eb94b10e351f79481935e2bbd2fd79ac3855f
+  data.tar.gz: b559b0d6ebb5d6b02a51dcbe158f17f70f693a3ed918b2b3498771e5a261ba39
 SHA512:
-  metadata.gz: 370d8b9305f7dcd2a692061b6708feca282546109533131d244cd97d207d1b216afac16baf44847a8a098c9847467208dd30e81084729f79ee7e3c16c050ae32
-  data.tar.gz: 97725299f78baef12d73614b7258ebf5cc3664316c82d2bf53d6a82e3d9e0e0d2542a3143cbc686fc75b46b6883fb8edc0174cfd38ce74b88a0c908ab4864642
+  metadata.gz: 6829d1d1b0306785f50881d971fe95c5b5f284e18a60650850c2d98e6fbf48b8688474218a3bd099a59c5c842db20290356901bcccebee271713e1bd31df675b
+  data.tar.gz: 9904b5315b4946052e38e9f00b6bc6ff2e4dde07b9827153e0c982738281c093f7e6ad63609ca75091fffff08e50bacf71b3da09869445384d0be42f59190460

data/Gemfile

@@ -49,7 +49,7 @@ gem 'jwt', '3.2.0'
 gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
-gem 'mcp', '1.3.0'
+gem 'mcp', '1.4.0'
 gem 'meshtastic', '0.0.175'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.25.0'

data/documentation/Reinforcement-Learning.md

@@ -49,8 +49,8 @@ This is the live numeric controller. It does not replace planning.
 |---|---|
 | State | request kind, task family, plan quality, answer completeness, usable-result, last action, fail bin, and engine |
 | Action | tool name, or `final` |
-| Step reward | `Reward.semantic_ok` hygiene (`+0.05` / `-0.20`) |
-| Terminal reward | `Reward.judge` score (skipped when the cheap proxy is untrusted and there is no judge) |
+| Step reward | 0; −0.01 per tool after 8 |
+| Terminal reward | `Reward.judge` × confidence (sole large R). `plan_coverage` is a tag, not the score. |
 | Updates | Q-learning (`alpha=0.15`, `gamma=0.85`) and REINFORCE (`alpha=0.05`). Stored trajectories replay twice on warmup so a short table is not empty advice. |
 | Budget | Eight finished episodes (live or warmup-credited) unlock greedy suggestions. Until then the prompt omits them. |
 | Steer | Q-advantage in `Registry.rank` once the episode budget is met; keyword fit and CORE_TOOLS still come first. Suggested actions follow `Registry.preference_order` (`ai.agent.tool_preference`). |

data/documentation/Reporting.md

@@ -9,6 +9,7 @@
 
 | Module | Consumes | Emits |
 |---|---|---|
+| `Reports::PDF` / `HTML` / `Markdown` / `XML` / `CSV` / `JSON` | findings Hash | `.pdf` / `.html` / `.md` / `.xml` / `.csv` / `.json` |
 | `Reports::SAST` | `PWN::SAST::Factory` output | HTML (with `HTMLHeader`/`HTMLFooter`) + JSON |
 | `Reports::Fuzz` | `PWN::Plugins::Fuzz` crash log | HTML + JSON |
 | `Reports::URIBuster` | `pwn_www_uri_buster` output | HTML |

data/etc/default_skills/pwn/ai/agent/curriculum/SKILL.md

@@ -41,6 +41,7 @@ PWN::AI::Agent::Curriculum.practice(opts)
 - `red_team_plan`
 - `hindsight`
 - `train_and_gate`
+- `reclassify_backlog`
 - `practice_kpi`
 - `repeating_trend`
 - `calibrate`

data/etc/default_skills/pwn/ai/agent/metrics/SKILL.md

@@ -52,10 +52,14 @@ PWN::AI::Agent::Metrics.load(opts)
 - `changepoints`
 - `record_calibration`
 - `calibration`
+- `calibration_green`
+- `scale_prediction`
+- `scoreboard`
 - `health_line`
 - `reset`
 - `authors`
 - `help`
+- `calibration_green?`
 
 ## Source
 

data/etc/default_skills/pwn/ai/agent/policy/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::AI::Agent::Policy
 
-PWN::AI::Agent::Policy is the LIVE tabular RL controller that pwn-ai did not have before R5. Everything else in the harness is retrieval-plus-policy: scores are written to disk and re-injected as prose, or exported later for optional LoRA. This module is the missing MDP: state s — discretized (kind, task, plan, completeness, usable, last, fail) action a — tool name, or "final" reward r — step: semantic_ok hygiene; terminal: Reward.judge next s' — state after the tool result Each Loop turn is one episode. Transitions land in ~/.pwn/policy_traj.jsonl. Q(s,a) and REINFORCE logits H(s,a) are updated from those tuples and persisted in ~/.pwn/policy.json. The learned Q values are an ADVISORY term in Registry.rank. They never replace TaskSummarizer planning, plan_first, or CORE_TOOLS. Disable with PWN::Env[:ai][:agent][:policy] = false.
+PWN::AI::Agent::Policy is the LIVE tabular RL controller that pwn-ai did not have before R5. Everything else in the harness is retrieval-plus-policy: scores are written to disk and re-injected as prose, or exported later for optional LoRA. This module is the missing MDP: state s — discretized (kind, task, plan, completeness, usable, last, fail) action a — tool name, or "final" reward r — step: 0 (spam cost −0.01 after 8 tools); terminal: judge × confidence next s' — state after the tool result Each Loop turn is one episode. Transitions land in ~/.pwn/policy_traj.jsonl. Q(s,a) and REINFORCE logits H(s,a) are updated from those tuples and persisted in ~/.pwn/policy.json. The learned Q values are an ADVISORY term in Registry.rank. They never replace TaskSummarizer planning, plan_first, or CORE_TOOLS. Disable with PWN::Env[:ai][:agent][:policy] = false.
 
 ## When to use
 

data/etc/default_skills/pwn/ai/agent/reward/SKILL.md

@@ -34,6 +34,7 @@ PWN::AI::Agent::Reward.judge(opts)
 ## Public methods
 
 - `judge`
+- `promote_to_success`
 - `prm`
 - `plan_coverage`
 - `sentinel`
@@ -58,6 +59,7 @@ PWN::AI::Agent::Reward.judge(opts)
 - `judge_sample_weight`
 - `authors`
 - `help`
+- `promote_to_success?`
 - `usable_preference?`
 
 ## Source

data/etc/default_skills/pwn/ai/agent/tool_guard/SKILL.md

@@ -52,6 +52,7 @@ PWN::AI::Agent::ToolGuard.present(opts)
 - `timeout_lesson`
 - `timeout_result`
 - `timeout_prior_count`
+- `refuse_copied_persist`
 - `authors`
 - `help`
 - `bashism?`
@@ -60,6 +61,7 @@ PWN::AI::Agent::ToolGuard.present(opts)
 - `present?`
 - `protect_core_constants!`
 - `protect_http!`
+- `refuse_copied_persist?`
 - `reset_timeout_budget!`
 - `shell_bash?`
 

data/etc/default_skills/pwn/reports/SKILL.md

@@ -28,11 +28,13 @@ Class methods take `(opts = {})` and read `opts`.
 
 ```ruby
 PWN::Reports.help
-PWN::Reports.help(opts)
+PWN::Reports.resolve_path(opts)
 ```
 
 ## Public methods
 
+- `resolve_path`
+- `report_payload`
 - `authors`
 - `help`
 
@@ -46,5 +48,5 @@ PWN::Reports.help(opts)
 
 ## Verification
 
-`PWN::Reports.respond_to?(:authors)` after the
+`PWN::Reports.respond_to?(:resolve_path)` after the
 module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/csv/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-csv
+description: Drive PWN::Reports::CSV from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::CSV
+  source: pwn/reports/csv.rb
+---
+
+# PWN::Reports::CSV
+
+Generic CSV report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::CSV` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/csv.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::CSV.help
+PWN::Reports::CSV.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/csv.rb`
+
+## Verification
+
+`PWN::Reports::CSV.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/html/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-html
+description: Drive PWN::Reports::HTML from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::HTML
+  source: pwn/reports/html.rb
+---
+
+# PWN::Reports::HTML
+
+Generic HTML report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::HTML` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/html.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::HTML.help
+PWN::Reports::HTML.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/html.rb`
+
+## Verification
+
+`PWN::Reports::HTML.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/json/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-json
+description: Drive PWN::Reports::JSON from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::JSON
+  source: pwn/reports/json.rb
+---
+
+# PWN::Reports::JSON
+
+Generic JSON report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::JSON` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/json.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::JSON.help
+PWN::Reports::JSON.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/json.rb`
+
+## Verification
+
+`PWN::Reports::JSON.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/markdown/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-markdown
+description: Drive PWN::Reports::Markdown from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::Markdown
+  source: pwn/reports/markdown.rb
+---
+
+# PWN::Reports::Markdown
+
+Generic Markdown report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::Markdown` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/markdown.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::Markdown.help
+PWN::Reports::Markdown.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/markdown.rb`
+
+## Verification
+
+`PWN::Reports::Markdown.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/pdf/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-pdf
+description: Drive PWN::Reports::PDF from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::PDF
+  source: pwn/reports/pdf.rb
+---
+
+# PWN::Reports::PDF
+
+Generic PDF report writer for pentest / findings payloads. Emits a minimal PDF 1.4 document (no wkhtmltopdf).
+
+## When to use
+
+Call `PWN::Reports::PDF` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/pdf.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::PDF.help
+PWN::Reports::PDF.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/pdf.rb`
+
+## Verification
+
+`PWN::Reports::PDF.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/xml/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-xml
+description: Drive PWN::Reports::XML from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::XML
+  source: pwn/reports/xml.rb
+---
+
+# PWN::Reports::XML
+
+Generic XML report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::XML` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/xml.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::XML.help
+PWN::Reports::XML.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/xml.rb`
+
+## Verification
+
+`PWN::Reports::XML.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/lib/pwn/ai/agent/curriculum.rb

@@ -94,15 +94,7 @@ module PWN
                          []
                        end
           cool = load_cooldown
-          # P17 — prefer budget-exhaustion fingerprints (agent_loop / critic)
-          # so nightly self-play attacks the #1 live skill gap first.
-          candidates = candidates.sort_by do |m|
-            t = m[:tool].to_s
-            e = m[:error].to_s.downcase
-            budget = t == 'agent_loop' || t == 'assistant_answer' ||
-                     e.include?('budget exhausted') || e.include?('iteration budget')
-            [budget ? 0 : 1, -m[:count].to_i]
-          end
+          candidates = candidates.sort_by { |m| -m[:count].to_i }
           targets = candidates.reject { |m| practice_skip?(mistake: m, cooldown: cool) }.first(limit)
           results = []
 
@@ -112,7 +104,7 @@ module PWN
 
               prompts = generate_reproducers(mistake: m, count: [per, 2].max)
               runs = dry_run ? [] : prompts.map { |p| self_play(prompt: p, tag: "practice:#{m[:signature]}") }
-              solved = runs.select { |r| r[:score].to_f >= 0.7 }
+              solved = runs.select { |r| r[:score].to_f >= 0.6 }
               mean = runs.empty? ? 0.0 : (runs.sum { |r| r[:score].to_f } / runs.length)
               resolved = false
               # 2.4 — auto-resolve only with N≥2 holdout successes + store trace
@@ -129,7 +121,12 @@ module PWN
                 trace_ok = winning.length >= 20 && (
                   !budgetish || winning.match?(/→|shell|pwn_eval|tool/i) || best[:final].to_s.length.between?(1, 800)
                 )
-                unless trace_ok
+                poc_ok = if budgetish || %w[agent_loop assistant_answer].include?(m[:tool].to_s)
+                           practice_poc_ok?(run: best)
+                         else
+                           true
+                         end
+                unless trace_ok && poc_ok
                   bump_cooldown!(cooldown: cool, signature: m[:signature], mean: mean) unless dry_run
                   results << {
                     signature: m[:signature], tool: m[:tool], prompts: prompts,
@@ -327,7 +324,9 @@ module PWN
             scrub = Reward.scrub_preferences(dry_run: false) if Reward.respond_to?(:scrub_preferences)
             mix = Reward.generator_mix if Reward.respond_to?(:generator_mix)
           end
-          kpi = practice_kpi(results: []) if commit && respond_to?(:practice_kpi)
+          rec = { reclassified: 0 }
+          rec = reclassify_backlog if commit && respond_to?(:reclassify_backlog)
+          kpi = practice_kpi(results: [], reclassified_n: rec[:reclassified]) if commit && respond_to?(:practice_kpi)
           out = {
             scored: scored.length, mean: mean, since_hours: since_h,
             results: scored.first(10), sentinel_warm: warm,
@@ -582,7 +581,14 @@ module PWN
         # even on a box without GPU.
 
         public_class_method def self.train_and_gate(opts = {})
-          dry_run = opts.key?(:dry_run) ? opts[:dry_run] : true
+          dry_run = if opts.key?(:dry_run)
+                      opts[:dry_run]
+                    else
+                      mix = defined?(Reward) && Reward.respond_to?(:generator_mix) ? Reward.generator_mix : {}
+                      healthy = mix.is_a?(Hash) && mix[:healthy] == true
+                      cal_ok = defined?(Metrics) && Metrics.respond_to?(:calibration_green?) && Metrics.calibration_green?
+                      !(healthy && cal_ok)
+                    end
           FileUtils.mkdir_p(CURRICULUM_DIR)
           sft = defined?(Learning) ? Learning.export_finetune(format: :sharegpt) : nil
           dpo = defined?(Reward) ? Reward.export_dpo : nil
@@ -662,6 +668,40 @@ module PWN
 
         KPI_FILE = File.join(Dir.home, '.pwn', 'curriculum_kpi.jsonl')
 
+        public_class_method def self.reclassify_backlog(opts = {})
+          rows = defined?(Mistakes) ? Mistakes.top(limit: opts[:limit] || 80, unresolved_only: true) : []
+          inbox = if defined?(Mistakes) && Mistakes.respond_to?(:operator_inbox)
+                    Array(Mistakes.operator_inbox(limit: 80)[:items] || Mistakes.operator_inbox(limit: 80)[:rows])
+                  else
+                    []
+                  end
+          counts = { fixable_by_agent: 0, needs_code_change: 0, wontfix_obsolete: 0, reclassified: 0 }
+          now = Time.now.utc
+          (rows + inbox).uniq { |m| m[:signature] }.each do |m|
+            next unless m.is_a?(Hash)
+
+            err = m[:error].to_s
+            age_d = begin
+              (now - Time.parse(m[:last_seen].to_s)) / 86_400.0
+            rescue StandardError
+              0.0
+            end
+            obsolete = err.match?(/PATH=|utf-8|invalid byte|generator/i) || (age_d > 7 && m[:count].to_i <= 1)
+            if obsolete || (m[:parked] && age_d > 7)
+              Mistakes.park(signature: m[:signature], reason: 'wontfix_obsolete') if defined?(Mistakes) && Mistakes.respond_to?(:park)
+              counts[:wontfix_obsolete] += 1
+              counts[:reclassified] += 1
+            elsif m[:needs_code_change]
+              counts[:needs_code_change] += 1
+            else
+              counts[:fixable_by_agent] += 1
+            end
+          end
+          counts
+        rescue StandardError => e
+          { error: "#{e.class}: #{e.message}" }
+        end
+
         public_class_method def self.practice_kpi(opts = {})
           results = Array(opts[:results])
           top = defined?(Mistakes) ? Mistakes.top(limit: 50, unresolved_only: true) : []
@@ -680,11 +720,12 @@ module PWN
             budget_repeating_n: budgetish,
             practiced: results.length,
             resolved_tonight: results.count { |r| r[:resolved] },
-            mean_holdout: if results.empty?
-                            nil
-                          else
-                            (results.sum { |r| r[:mean_score].to_f } / results.length).round(3)
-                          end
+            reclassified_n: (opts[:reclassified_n] || 0).to_i,
+            mean_holdout: begin
+              hold = results.map { |r| r[:mean_score] || r[:score] }.compact
+              hold = Learning.outcomes(limit: 20).filter_map { |o| o[:score] } if hold.empty? && defined?(Learning)
+              hold.empty? ? 0.0 : (hold.sum(&:to_f) / hold.length).round(3)
+            end
           }
           begin
             FileUtils.mkdir_p(File.dirname(KPI_FILE))
@@ -895,15 +936,11 @@ module PWN
                      'Return Dir.pwd from pwn_eval'
                    ]
                  when 'agent_loop', 'assistant_answer'
-                   # P17 — dominant live failure: iteration / critic budget exhaustion.
-                   # Practise finishing under a tight tool budget, not shell shapes.
                    [
-                     'Answer in one shell call: print kernel release with uname -r',
-                     'In at most two tools, show cwd and ruby version then stop',
-                     'Give a final answer with no tools: what is 7 times 8?',
-                     'Finish under three iterations: list /tmp and report file count',
-                     'Do not explore — one pwn_eval of Dir.pwd and return the path',
-                     'Short plan then one command: show free disk with df -h /'
+                     'Write a working PoC to /tmp/pwn-practice-poc.txt that proves the issue, then stop',
+                     'Save a chained-impact PoC under /tmp/pwn-practice-chain.txt with reproduction steps',
+                     'Use pwn_eval to call PWN::Reports::JSON.generate with a findings hash to /tmp/pwn-practice-findings.json',
+                     'Produce evidence-backed severity in /tmp/pwn-practice-sev.md including a PoC path'
                    ]
                  else
                    if err.include?('budget exhausted') || err.include?('iteration budget') ||
@@ -1000,7 +1037,7 @@ module PWN
             capped = true
           end
           begin
-            final = Loop.run(request: prompt, session_id: sid, enabled_toolsets: %w[terminal pwn memory learning])
+            final = Loop.run(request: prompt, session_id: sid)
           ensure
             if capped && defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash) && !PWN::Env[:ai][:agent].frozen?
               if prev_max == :__unset__
@@ -1083,6 +1120,15 @@ module PWN
           nil
         end
 
+        private_class_method def self.practice_poc_ok?(opts = {})
+          run = opts[:run] || {}
+          blob = "#{run[:final]}\n#{run[:trace]}\n#{run[:prompt]}"
+          paths = blob.scan(%r{(/tmp/[A-Za-z0-9._+-]+)})
+          paths.flatten.any? { |path| File.file?(path) && File.size(path).positive? }
+        rescue StandardError
+          false
+        end
+
         private_class_method def self.ask_persona(opts = {})
           return nil unless defined?(Swarm)
 

data/lib/pwn/ai/agent/dispatch.rb

@@ -46,6 +46,13 @@ module PWN
           args = parse_args(raw: raw, entry: entry)
           required = Array(entry.schema&.dig(:parameters, :required))
           args = ToolGuard.coerce_args(args: args, required: required) if defined?(ToolGuard)
+          if defined?(ToolGuard) && ToolGuard.respond_to?(:refuse_copied_persist?) &&
+             ToolGuard.refuse_copied_persist?(name: entry.name, args: args)
+            return JSON.generate(
+              success: false,
+              error: 'refused: memory_remember/skills_update text copied from last tool output'
+            )
+          end
           result = entry.handler.call(args)
           JSON.generate(success: true, result: result, effect: effect(name: entry.name, args: args))
         rescue StandardError => e