pwn 0.5.707 → 0.5.709

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c1b656d9d2cde2b5141da85cc87dbce6985f3f1f264d81c25fd5607121459d7
-  data.tar.gz: e84304c2573991adf9e99eeff5ec29d4dcad224d719016f81ce3c675b29cbb06
+  metadata.gz: a21d92ef6104c4aec2f54470689f0398fda97a2894bb9a61b1034a72b5291e1f
+  data.tar.gz: 19a47d2db6aae502ab6a2380853569f172ff393839187818b891f01272029f5f
 SHA512:
-  metadata.gz: d7367762d5ee2d30b01ef7b01ba51020a0532459c50d3cc4b327818ebfebae1491253ba0ce1edd264085832ca738f32a0a91d6c1c1fa22c40eada9df79009b91
-  data.tar.gz: 6ee7b63319321faeb9a62f94c5177ddf83d2ac4d2b3353e8a19ce96a8d3d67d6a090aacb7f976a75ccf7ce28e0ea698923ef044e1026d24c435f147fba1198e0
+  metadata.gz: 79f9a1ac713919b1e4cd239f5475b9d14f2b73dcc19152fc0b1e82312d6f1c25062bb90f45ffe5533bd3fda09769faf3207d946110a196d3d050847344ac3549
+  data.tar.gz: 8718455cc9a5db44fa41ce916b26292a92889c4c7208ecaa74df310dddafeddfd4d8ba1983ea8c437b83c67a36bc589fb06d5c0d2729e6b104a3bff598c2a7c3

data/documentation/Installation.md

@@ -127,6 +127,7 @@ pwn setup --list-profiles
 | `voice` | `PWN::Plugins::Voice` · `extro_voice` · espeak-ng / sox |
 | `exploit` | `Metasploit` · `sqlmap` |
 | `hardware` | `Serial` · `BusPirate` · `Android` · `BareSIP` · `extro_serial` · `extro_telecomm` |
+| `re` | `Radare2` · `GDB` · `ExploitDev` · `Frida` · Android RE (`apktool`/`jadx`) |
 | `full` | everything above |
 
 ### All flags

data/documentation/Reinforcement-Learning.md

@@ -49,8 +49,8 @@ This is the live numeric controller. It does not replace planning.
 |---|---|
 | State | request kind, task family, plan quality, answer completeness, usable-result, last action, fail bin, and engine |
 | Action | tool name, or `final` |
-| Step reward | `Reward.semantic_ok` hygiene (`+0.05` / `-0.20`) |
-| Terminal reward | `Reward.judge` score (skipped when the cheap proxy is untrusted and there is no judge) |
+| Step reward | 0; −0.01 per tool after 8 |
+| Terminal reward | `Reward.judge` × confidence (sole large R). `plan_coverage` is a tag, not the score. |
 | Updates | Q-learning (`alpha=0.15`, `gamma=0.85`) and REINFORCE (`alpha=0.05`). Stored trajectories replay twice on warmup so a short table is not empty advice. |
 | Budget | Eight finished episodes (live or warmup-credited) unlock greedy suggestions. Until then the prompt omits them. |
 | Steer | Q-advantage in `Registry.rank` once the episode budget is met; keyword fit and CORE_TOOLS still come first. Suggested actions follow `Registry.preference_order` (`ai.agent.tool_preference`). |

data/etc/default_skills/pwn/ai/agent/curriculum/SKILL.md

@@ -41,6 +41,7 @@ PWN::AI::Agent::Curriculum.practice(opts)
 - `red_team_plan`
 - `hindsight`
 - `train_and_gate`
+- `reclassify_backlog`
 - `practice_kpi`
 - `repeating_trend`
 - `calibrate`

data/etc/default_skills/pwn/ai/agent/extrospection/osint/bridges/SKILL.md

@@ -1,22 +1,22 @@
 ---
-name: pwn-ai-agent-extrospection-osintbridges
-description: Drive PWN::AI::Agent::Extrospection::OSINTBridges from pwn_eval.
+name: pwn-ai-agent-extrospection
+description: Drive PWN::AI::Agent::Extrospection from pwn_eval.
 license: MIT
 allowed-tools: [pwn, pwn_eval]
 metadata:
   bundled: true
   generated: true
-  module: PWN::AI::Agent::Extrospection::OSINTBridges
+  module: PWN::AI::Agent::Extrospection
   source: pwn/ai/agent/extrospection/osint/bridges.rb
 ---
 
-# PWN::AI::Agent::Extrospection::OSINTBridges
+# PWN::AI::Agent::Extrospection
 
 Local-tool OSINT bridges for PWN::AI::Agent::Extrospection.osint. Wraps host binaries (theHarvester, spiderfoot, amass, recon-ng) already common on Kali / offensive-tooling images, parses their JSON/CSV output, and returns compact structured hits so they behave like any other feed. Every bridge: * checks binary presence first (returns {skipped:} when absent) * runs passive-only / bounded (timeouts, `-passive`, module lists) * NEVER launches a GUI or web UI
 
 ## When to use
 
-Call `PWN::AI::Agent::Extrospection::OSINTBridges` from `pwn_eval` when the task needs this module.
+Call `PWN::AI::Agent::Extrospection` from `pwn_eval` when the task needs this module.
 Do not reimplement it in shell.
 
 ## Methodologies
@@ -27,14 +27,36 @@ Class methods take `(opts = {})` and read `opts`.
 ## How to call
 
 ```ruby
-PWN::AI::Agent::Extrospection::OSINTBridges.help
-PWN::AI::Agent::Extrospection::OSINTBridges.help(opts)
+PWN::AI::Agent::Extrospection.help
+PWN::AI::Agent::Extrospection.auto_extrospect(opts)
 ```
 
 ## Public methods
 
 - `authors`
 - `help`
+- `auto_extrospect`
+- `correlate`
+- `drift`
+- `intel`
+- `load`
+- `observations`
+- `observe`
+- `osint`
+- `packet_sense`
+- `reset`
+- `revalidate_memory`
+- `rf_tune`
+- `save`
+- `serial_sense`
+- `snapshot`
+- `stats`
+- `telecomm`
+- `to_context`
+- `verify`
+- `vision`
+- `voice_sense`
+- `watch`
 
 ## Source
 
@@ -42,5 +64,5 @@ PWN::AI::Agent::Extrospection::OSINTBridges.help(opts)
 
 ## Verification
 
-`PWN::AI::Agent::Extrospection::OSINTBridges.respond_to?(:authors)` after the
+`PWN::AI::Agent::Extrospection.respond_to?(:authors)` after the
 module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/extrospection/osint/social/SKILL.md

@@ -1,22 +1,22 @@
 ---
-name: pwn-ai-agent-extrospection-osintsocial
-description: Drive PWN::AI::Agent::Extrospection::OSINTSocial from pwn_eval.
+name: pwn-ai-agent-extrospection
+description: Drive PWN::AI::Agent::Extrospection from pwn_eval.
 license: MIT
 allowed-tools: [pwn, pwn_eval]
 metadata:
   bundled: true
   generated: true
-  module: PWN::AI::Agent::Extrospection::OSINTSocial
+  module: PWN::AI::Agent::Extrospection
   source: pwn/ai/agent/extrospection/osint/social.rb
 ---
 
-# PWN::AI::Agent::Extrospection::OSINTSocial
+# PWN::AI::Agent::Extrospection
 
 Social-network / developer-identity OSINT feeds for PWN::AI::Agent::Extrospection.osint. All methods here reopen the Extrospection singleton so osint_dispatch can route to them exactly like the in-file feeds. Everything is best-effort: unreachable endpoints degrade to {error:} rather than raising. Feeds provided: :keybase :gravatar :mastodon :bluesky :hackernews :stackexchange :npm :pypi :rubygems :crates :dockerhub :codeberg :sourcehut :chesscom :lichess :steam :telegram :social_sweep New kind :social routes to the profile-fetch feeds; :username still returns the legacy 3-platform hash for back-compat but now also includes a truncated :social_sweep hit list.
 
 ## When to use
 
-Call `PWN::AI::Agent::Extrospection::OSINTSocial` from `pwn_eval` when the task needs this module.
+Call `PWN::AI::Agent::Extrospection` from `pwn_eval` when the task needs this module.
 Do not reimplement it in shell.
 
 ## Methodologies
@@ -27,14 +27,36 @@ Class methods take `(opts = {})` and read `opts`.
 ## How to call
 
 ```ruby
-PWN::AI::Agent::Extrospection::OSINTSocial.help
-PWN::AI::Agent::Extrospection::OSINTSocial.help(opts)
+PWN::AI::Agent::Extrospection.help
+PWN::AI::Agent::Extrospection.auto_extrospect(opts)
 ```
 
 ## Public methods
 
 - `authors`
 - `help`
+- `auto_extrospect`
+- `correlate`
+- `drift`
+- `intel`
+- `load`
+- `observations`
+- `observe`
+- `osint`
+- `packet_sense`
+- `reset`
+- `revalidate_memory`
+- `rf_tune`
+- `save`
+- `serial_sense`
+- `snapshot`
+- `stats`
+- `telecomm`
+- `to_context`
+- `verify`
+- `vision`
+- `voice_sense`
+- `watch`
 
 ## References
 
@@ -46,5 +68,5 @@ PWN::AI::Agent::Extrospection::OSINTSocial.help(opts)
 
 ## Verification
 
-`PWN::AI::Agent::Extrospection::OSINTSocial.respond_to?(:authors)` after the
+`PWN::AI::Agent::Extrospection.respond_to?(:authors)` after the
 module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/extrospection/osint/social/references/urls.md

@@ -1,4 +1,4 @@
-# PWN::AI::Agent::Extrospection::OSINTSocial source links
+# PWN::AI::Agent::Extrospection source links
 
 - https://keybase.io/_/api/1.0/user/lookup.json?usernames=[redacted].json
 - https://[redacted]/.well-known/webfinger?resource=acct:[redacted]/api/v1/accounts/lookup?acct=[redacted]/

data/etc/default_skills/pwn/ai/agent/extrospection/references/urls.md

@@ -29,4 +29,3 @@
 - https://data.police.uk/api/crime-last-updated
 - https://callook.info/[redacted]
 - https://api.microlink.io?url=[redacted]:[redacted]#{cmd.start_with?(
-- https://target/api/version

data/etc/default_skills/pwn/ai/agent/metrics/SKILL.md

@@ -52,10 +52,14 @@ PWN::AI::Agent::Metrics.load(opts)
 - `changepoints`
 - `record_calibration`
 - `calibration`
+- `calibration_green`
+- `scale_prediction`
+- `scoreboard`
 - `health_line`
 - `reset`
 - `authors`
 - `help`
+- `calibration_green?`
 
 ## Source
 

data/etc/default_skills/pwn/ai/agent/policy/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::AI::Agent::Policy
 
-PWN::AI::Agent::Policy is the LIVE tabular RL controller that pwn-ai did not have before R5. Everything else in the harness is retrieval-plus-policy: scores are written to disk and re-injected as prose, or exported later for optional LoRA. This module is the missing MDP: state s — discretized (kind, task, plan, completeness, usable, last, fail) action a — tool name, or "final" reward r — step: semantic_ok hygiene; terminal: Reward.judge next s' — state after the tool result Each Loop turn is one episode. Transitions land in ~/.pwn/policy_traj.jsonl. Q(s,a) and REINFORCE logits H(s,a) are updated from those tuples and persisted in ~/.pwn/policy.json. The learned Q values are an ADVISORY term in Registry.rank. They never replace TaskSummarizer planning, plan_first, or CORE_TOOLS. Disable with PWN::Env[:ai][:agent][:policy] = false.
+PWN::AI::Agent::Policy is the LIVE tabular RL controller that pwn-ai did not have before R5. Everything else in the harness is retrieval-plus-policy: scores are written to disk and re-injected as prose, or exported later for optional LoRA. This module is the missing MDP: state s — discretized (kind, task, plan, completeness, usable, last, fail) action a — tool name, or "final" reward r — step: 0 (spam cost −0.01 after 8 tools); terminal: judge × confidence next s' — state after the tool result Each Loop turn is one episode. Transitions land in ~/.pwn/policy_traj.jsonl. Q(s,a) and REINFORCE logits H(s,a) are updated from those tuples and persisted in ~/.pwn/policy.json. The learned Q values are an ADVISORY term in Registry.rank. They never replace TaskSummarizer planning, plan_first, or CORE_TOOLS. Disable with PWN::Env[:ai][:agent][:policy] = false.
 
 ## When to use
 

data/etc/default_skills/pwn/ai/agent/reward/SKILL.md

@@ -34,6 +34,7 @@ PWN::AI::Agent::Reward.judge(opts)
 ## Public methods
 
 - `judge`
+- `promote_to_success`
 - `prm`
 - `plan_coverage`
 - `sentinel`
@@ -58,6 +59,7 @@ PWN::AI::Agent::Reward.judge(opts)
 - `judge_sample_weight`
 - `authors`
 - `help`
+- `promote_to_success?`
 - `usable_preference?`
 
 ## Source

data/etc/default_skills/pwn/ai/agent/tool_guard/SKILL.md

@@ -52,6 +52,7 @@ PWN::AI::Agent::ToolGuard.present(opts)
 - `timeout_lesson`
 - `timeout_result`
 - `timeout_prior_count`
+- `refuse_copied_persist`
 - `authors`
 - `help`
 - `bashism?`
@@ -60,6 +61,7 @@ PWN::AI::Agent::ToolGuard.present(opts)
 - `present?`
 - `protect_core_constants!`
 - `protect_http!`
+- `refuse_copied_persist?`
 - `reset_timeout_budget!`
 - `shell_bash?`
 

data/etc/default_skills/pwn/memory_index/SKILL.md

@@ -43,10 +43,6 @@ PWN::MemoryIndex.available(opts)
 - `help`
 - `available?`
 
-## References
-
-- `references/urls.md` — URLs from source
-
 ## Source
 
 `pwn/memory_index.rb`

data/etc/default_skills/pwn/plugins/aflplusplus/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: pwn-plugins-aflplusplus
+description: Drive PWN::Plugins::AFLplusplus from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::AFLplusplus
+  source: pwn/plugins/aflplusplus.rb
+---
+
+# PWN::Plugins::AFLplusplus
+
+AFL++ campaign wrapper.
+
+## When to use
+
+Call `PWN::Plugins::AFLplusplus` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/aflplusplus.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::AFLplusplus.help
+PWN::Plugins::AFLplusplus.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `fuzz`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/aflplusplus.rb`
+
+## Verification
+
+`PWN::Plugins::AFLplusplus.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/android/SKILL.md

@@ -49,6 +49,7 @@ PWN::Plugins::Android.adb_net_connect(opts)
 - `close_app`
 - `invoke_event_listener`
 - `adb_net_disconnect`
+- `apk_pipeline`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/plugins/artifact_registry/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: pwn-plugins-artifactregistry
+description: Drive PWN::Plugins::ArtifactRegistry from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::ArtifactRegistry
+  source: pwn/plugins/artifact_registry.rb
+---
+
+# PWN::Plugins::ArtifactRegistry
+
+~/.pwn/artifacts/<session>/ loot index for session_recall.
+
+## When to use
+
+Call `PWN::Plugins::ArtifactRegistry` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/artifact_registry.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::ArtifactRegistry.help
+PWN::Plugins::ArtifactRegistry.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `register`
+- `list`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/artifact_registry.rb`
+
+## Verification
+
+`PWN::Plugins::ArtifactRegistry.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/binary_parser/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: pwn-plugins-binaryparser
+description: Drive PWN::Plugins::BinaryParser from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::BinaryParser
+  source: pwn/plugins/binary_parser.rb
+---
+
+# PWN::Plugins::BinaryParser
+
+ELF/PE/Mach-O headers, sections, symbols, imports/exports, relocations via Metasm loaders.
+
+## When to use
+
+Call `PWN::Plugins::BinaryParser` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/binary_parser.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::BinaryParser.help
+PWN::Plugins::BinaryParser.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `load_exe`
+- `info`
+- `sections`
+- `symbols`
+- `imports`
+- `exports`
+- `relocations`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/binary_parser.rb`
+
+## Verification
+
+`PWN::Plugins::BinaryParser.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/credential_attack/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: pwn-plugins-credentialattack
+description: Drive PWN::Plugins::CredentialAttack from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::CredentialAttack
+  source: pwn/plugins/credential_attack.rb
+---
+
+# PWN::Plugins::CredentialAttack
+
+hydra/john/hashcat wrappers and ~/.pwn/wordlists convention.
+
+## When to use
+
+Call `PWN::Plugins::CredentialAttack` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/credential_attack.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::CredentialAttack.help
+PWN::Plugins::CredentialAttack.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `wordlist_dir`
+- `hydra`
+- `john`
+- `hashcat`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/credential_attack.rb`
+
+## Verification
+
+`PWN::Plugins::CredentialAttack.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/doctor/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: pwn-plugins-doctor
+description: Drive PWN::Plugins::Doctor from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::Doctor
+  source: pwn/plugins/doctor.rb
+---
+
+# PWN::Plugins::Doctor
+
+Plugin/binary/capability preflight. Plugins declare required_bins / required_caps; HOST summaries list degraded modules without autoloading the whole plugin tree.
+
+## When to use
+
+Call `PWN::Plugins::Doctor` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/doctor.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::Doctor.help
+PWN::Plugins::Doctor.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `bin`
+- `require_bin`
+- `cap_net_raw`
+- `require_cap_net_raw`
+- `check`
+- `host_summary`
+- `authors`
+- `help`
+- `bin?`
+- `cap_net_raw?`
+- `require_bin!`
+- `require_cap_net_raw!`
+
+## Source
+
+`pwn/plugins/doctor.rb`
+
+## Verification
+
+`PWN::Plugins::Doctor.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/exploit_dev/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: pwn-plugins-exploitdev
+description: Drive PWN::Plugins::ExploitDev from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::ExploitDev
+  source: pwn/plugins/exploit_dev.rb
+---
+
+# PWN::Plugins::ExploitDev
+
+p8/p16/p32/p64, cyclic, flat, fmt writes, gadget search.
+
+## When to use
+
+Call `PWN::Plugins::ExploitDev` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/exploit_dev.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::ExploitDev.help
+PWN::Plugins::ExploitDev.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `p8`
+- `p16`
+- `p32`
+- `p64`
+- `u8`
+- `u16`
+- `u32`
+- `u64`
+- `cyclic`
+- `cyclic_find`
+- `flat`
+- `shellcode`
+- `fmt_writes`
+- `gadgets`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/exploit_dev.rb`
+
+## Verification
+
+`PWN::Plugins::ExploitDev.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/frida/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: pwn-plugins-frida
+description: Drive PWN::Plugins::Frida from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::Frida
+  source: pwn/plugins/frida.rb
+---
+
+# PWN::Plugins::Frida
+
+Frida attach/spawn + script injection.
+
+## When to use
+
+Call `PWN::Plugins::Frida` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/frida.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::Frida.help
+PWN::Plugins::Frida.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `ps`
+- `attach`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/frida.rb`
+
+## Verification
+
+`PWN::Plugins::Frida.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.