pwn 0.5.718 → 0.5.720

data/lib/pwn/ai/agent/engagement.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'fileutils'
+require 'ipaddr'
+require 'uri'
+
+module PWN
+  module AI
+    module Agent
+      # First-class engagement scope, RoE, and findings pointer.
+      module Engagement
+        ROOT = File.join(Dir.home, '.pwn', 'engagements')
+        ACTIVE_FILE = File.join(ROOT, 'active')
+
+        public_class_method def self.open(opts = {})
+          name = (opts[:name] || opts[:engagement] || 'default').to_s
+          raise 'ERROR: name is required' if name.empty?
+
+          FileUtils.mkdir_p(ROOT)
+          path = File.join(ROOT, "#{name}.json")
+          row = File.file?(path) ? JSON.parse(File.read(path), symbolize_names: true) : {}
+          row[:name] = name
+          row[:scope_cidrs] = Array(opts[:scope_cidrs] || row[:scope_cidrs])
+          row[:scope_domains] = Array(opts[:scope_domains] || row[:scope_domains])
+          row[:excluded] = Array(opts[:excluded] || row[:excluded])
+          row[:roe] = (opts[:roe] || row[:roe]).to_s
+          row[:window] = opts[:window] || row[:window]
+          row[:findings] ||= []
+          File.write(path, JSON.pretty_generate(row))
+          File.write(ACTIVE_FILE, name)
+          row.merge(path: path, active: true)
+        end
+
+        public_class_method def self.close(opts = {})
+          FileUtils.rm_f(ACTIVE_FILE) if opts.is_a?(Hash)
+          { active: nil }
+        end
+
+        public_class_method def self.status(opts = {})
+          name = (opts[:name] || current_name).to_s
+          return { active: nil } if name.empty?
+
+          path = File.join(ROOT, "#{name}.json")
+          return { active: name, missing: true } unless File.file?(path)
+
+          JSON.parse(File.read(path), symbolize_names: true).merge(active: name)
+        end
+
+        public_class_method def self.current_name(opts = {})
+          return nil unless opts.is_a?(Hash)
+          return nil unless File.file?(ACTIVE_FILE)
+
+          File.read(ACTIVE_FILE).strip
+        end
+
+        public_class_method def self.in_scope?(opts = {})
+          token = (opts[:host] || opts[:ip] || opts[:target] || opts[:url]).to_s
+          return true if token.empty?
+
+          row = status
+          return true if row[:active].nil? || row[:missing]
+
+          enforce = engagement_enforce
+          return true if enforce == 'off'
+
+          host = token
+          begin
+            host = URI.parse(token).host || token if token.include?('://')
+          rescue StandardError
+            host = token
+          end
+          host = host.sub(%r{\Ahttps?://}i, '').split('/').first.to_s.split(':').first
+          return false if Array(row[:excluded]).any? { |ex| host.include?(ex.to_s) }
+
+          cidrs = Array(row[:scope_cidrs]).map(&:to_s).reject(&:empty?)
+          domains = Array(row[:scope_domains]).map(&:to_s).reject(&:empty?)
+          return true if cidrs.empty? && domains.empty?
+
+          ip_ok = begin
+            addr = IPAddr.new(host)
+            cidrs.any? { |c| IPAddr.new(c).include?(addr) }
+          rescue StandardError
+            false
+          end
+          dom_ok = domains.any? { |d| host == d || host.end_with?(".#{d}") }
+          ip_ok || dom_ok
+        end
+
+        public_class_method def self.deny_if_out_of_scope(opts = {})
+          args = opts[:args] || opts[:command] || opts[:text]
+          blob = args.is_a?(Hash) ? args.inspect : args.to_s
+          tokens = blob.scan(/(?:\d{1,3}\.){3}\d{1,3}|[A-Za-z0-9.-]+\.[A-Za-z]{2,}/).uniq
+          bad = tokens.reject { |tok| in_scope?(host: tok) }
+          return nil if bad.empty?
+
+          {
+            success: false,
+            error: "out_of_scope: #{bad.first}",
+            code: 'SCOPE_DENY',
+            violating: bad
+          }
+        end
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        public_class_method def self.help
+          puts "USAGE:
+            # Open or update an engagement and mark it active.
+            #{self}.open(
+              name: 'required - engagement name',
+              engagement: 'optional - alias for name',
+              scope_cidrs: 'optional - Array of CIDR strings',
+              scope_domains: 'optional - Array of DNS suffixes',
+              excluded: 'optional - Array of excluded hosts',
+              roe: 'optional - rules of engagement text',
+              window: 'optional - time window string'
+            )
+
+            # Clear the active engagement pointer.
+            #{self}.close(
+              name: 'optional - unused; closing always clears the active pointer'
+            )
+
+            # Return the active engagement document.
+            #{self}.status(
+              name: 'optional - engagement name (defaults to active)'
+            )
+
+            # Return the active engagement name or nil.
+            #{self}.current_name(
+              unused: 'optional - reserved'
+            )
+
+            # True when host/ip/url is inside the active engagement scope.
+            #{self}.in_scope?(
+              host: 'optional - DNS hostname to test against scope_domains',
+              ip: 'optional - IPv4 or IPv6 address to test against scope_cidrs',
+              target: 'optional - host or IP alias when the caller has one field',
+              url: 'optional - URL whose host is extracted and tested'
+            )
+
+            # Structured denial when args mention an out-of-scope host.
+            #{self}.deny_if_out_of_scope(
+              args: 'optional - Hash of tool args',
+              command: 'optional - command string',
+              text: 'optional - free-form blob to scan'
+            )
+
+            # Print the AUTHOR(S) string for this module.
+            #{self}.authors
+          "
+          constants.sort
+        end
+
+        private_class_method def self.engagement_enforce
+          v = (PWN::Env.dig(:ai, :engagement, :enforce) if defined?(PWN::Env))
+          (v || 'block').to_s
+        rescue StandardError
+          'block'
+        end
+      end
+    end
+  end
+end

data/lib/pwn/ai/agent/learning.rb

@@ -128,6 +128,16 @@ module PWN
           entry[:score] = opts[:score].to_f if opts.key?(:score)
           src = opts[:judge_source].to_s
           entry[:judge_source] = src unless src.empty?
+          vv = (opts[:verifier_verdict] || opts['verifier_verdict']).to_s
+          entry[:verifier_verdict] = vv unless vv.empty?
+          vc = (opts[:verdict_class] || opts['verdict_class']).to_s
+          entry[:verdict_class] = vc unless vc.empty?
+          entry[:remediation_hint] = opts[:remediation_hint].to_s unless opts[:remediation_hint].to_s.empty?
+          if vv == 'pass' && opts.key?(:score) && opts[:score].to_f < 0.6
+            entry[:status] = 'conflicted'
+            entry[:success] = true
+            success = true
+          end
           FileUtils.mkdir_p(File.dirname(LEARNING_FILE))
           File.open(LEARNING_FILE, 'a') { |f| f.puts(JSON.generate(entry)) }
           maybe_prune_outcomes!
@@ -137,7 +147,7 @@ module PWN
           # are promoted into PWN::Memory[:lesson] so PromptBuilder recall
           # survives across sessions. Without this, the agent re-learns
           # "run rubocop after every patch" every turn (empty memory.json).
-          promote_process_lesson(entry: entry) if defined?(PWN::Memory)
+          promote_process_lesson(entry: entry) if defined?(PWN::Memory) && entry[:status].to_s != 'conflicted'
           if opts.key?(:score) && defined?(Curriculum) && Curriculum.respond_to?(:calibrate)
             pred = opts[:predicted]
             pred = Thread.current[:pwn_plan_predicted] if pred.nil?
@@ -215,6 +225,8 @@ module PWN
           # envelope rows (REQUEST:/GOAL: prefixes) without starving the block.
           rows  = prefer_primary_tasks(rows: outcomes(limit: limit * 4)).first(limit)
           fails = prefer_primary_tasks(rows: outcomes(limit: 200, success: false))
+          fails = fails.reject { |r| r[:status].to_s == 'conflicted' }
+          fails = fails.reject { |r| r[:verifier_verdict].to_s == 'pass' }
           # Do not mirror the same ids under both headings — that doubled the
           # failure signal and made RECENT OUTCOMES == RECENT FAILURES when the
           # last N attempts all failed (the injected block looked "stuck").
@@ -234,8 +246,12 @@ module PWN
             # Surface a one-line cause crumb so the agent can actually learn
             # from failures instead of only seeing that they failed.
             if r[:success] != true
-              crumb = cause_crumb(details: r[:details])
-              line += "\n      cause: #{crumb}" unless crumb.empty?
+              if r[:verdict_class].to_s == ''
+                crumb = cause_crumb(details: r[:details])
+                line += "\n      cause: #{crumb}" unless crumb.empty?
+              else
+                line += "\n      cause: #{r[:verdict_class]} #{r[:remediation_hint]}"
+              end
             end
             line
           end
@@ -1049,6 +1065,7 @@ module PWN
 
         private_class_method def self.cause_crumb(opts = {})
           d = opts[:details].to_s.gsub(/\s+/, ' ').strip
+          d = d.gsub(/overlap=\S+/, '').gsub(/ratio=\S+/, '').strip
           return '' if d.empty?
 
           # Prefer explicit FLAW / CORRECTED crumbs; else verdict(score) head.
@@ -1818,6 +1835,55 @@ module PWN
           File.write(LESSONS_FILE, JSON.pretty_generate(opts[:store]))
         end
 
+        private_class_method def self.learning_max_baks(opts = {})
+          n = opts[:max_baks]
+          return n.to_i if n.to_i.positive?
+          return 5 unless defined?(PWN::Env)
+
+          v = PWN::Env.dig(:ai, :learning, :max_baks)
+          v.to_i.positive? ? v.to_i : 5
+        rescue StandardError
+          5
+        end
+
+        public_class_method def self.list_conflicted(opts = {})
+          limit = (opts[:limit] || 50).to_i
+          outcomes(limit: 500).select { |r| r[:status].to_s == 'conflicted' }.first(limit)
+        end
+
+        public_class_method def self.requeue_conflicted(opts = {})
+          dry = opts[:dry_run] ? true : false
+          rows = list_conflicted(limit: 10_000)
+          return { rescored: 0, dry_run: dry } if rows.empty? || dry
+
+          n = 0
+          rows.each do |r|
+            note_outcome(
+              task: "requeue:#{r[:task]}",
+              success: true,
+              score: [r[:score].to_f, 0.7].max,
+              verifier_verdict: :pass,
+              details: 'rescored after verifier precedence',
+              tags: %w[requeue]
+            )
+            n += 1
+          end
+          { rescored: n, dry_run: false }
+        end
+
+        public_class_method def self.compact!(opts = {})
+          max_baks = (opts[:max_baks] || learning_max_baks).to_i
+          max_baks = 5 if max_baks <= 0
+          dir = File.dirname(LEARNING_FILE)
+          baks = Dir[File.join(dir, '*.bak*')].sort_by { |p| File.mtime(p) }.reverse
+          pruned = 0
+          baks.drop(max_baks).each do |path|
+            File.delete(path)
+            pruned += 1
+          end
+          { pruned: pruned, kept: [baks.length, max_baks].min, max_baks: max_baks }
+        end
+
         # Author(s):: 0day Inc. <support@0dayinc.com>
 
         public_class_method def self.authors
@@ -1839,7 +1905,25 @@ module PWN
               judge_source: 'required - judge source value consumed by #note_outcome',
               predicted: 'optional - predicted value consumed by #note_outcome',
               confidence: 'optional - confidence value consumed by #note_outcome',
-              engine: 'optional - engine value consumed by #note_outcome'
+              engine: 'optional - engine value consumed by #note_outcome',
+              verifier_verdict: 'optional - pass|fail from a deterministic verifier',
+              verdict_class: 'optional - missing_artifact|wrong_path|unverified_claim|scope_miss|partial_coverage|style_only',
+              remediation_hint: 'optional - one-line fix hint'
+            )
+
+            # List outcomes tagged conflicted (verifier PASS vs low judge).
+            #{self}.list_conflicted(
+              limit: 'optional - max entries (defaults to 50)'
+            )
+
+            # Rescore conflicted outcomes after verifier-precedence lands.
+            #{self}.requeue_conflicted(
+              dry_run: 'optional - true to count without writing'
+            )
+
+            # Prune excess *.bak siblings under the learning directory.
+            #{self}.compact!(
+              max_baks: 'optional - newest bak files to keep (defaults to 5)'
             )
 
             # Run outcomes and return its result

data/lib/pwn/ai/agent/loop.rb

@@ -661,7 +661,6 @@ module PWN
 
         private_class_method def self.declared_contract_unsatisfied?(opts = {})
           return false if verify_passed?(messages: opts[:messages])
-          return false if write_or_read_evidenced?(messages: opts[:messages])
 
           completion_unmet(opts).any?
         rescue StandardError
@@ -670,7 +669,6 @@ module PWN
 
         private_class_method def self.completion_unmet(opts = {})
           return [] if verify_passed?(messages: opts[:messages])
-          return [] if write_or_read_evidenced?(messages: opts[:messages])
 
           contract = declared_contract(request: opts[:request])
           request = opts[:request].to_s
@@ -3145,6 +3143,20 @@ module PWN
           TurnFinalizer.leave_user_path! if defined?(TurnFinalizer)
         end
 
+        public_class_method def self.budget_status(opts = {})
+          t0 = opts[:t0] || Thread.current[:pwn_loop_t0] || Time.now
+          elapsed = Time.now - t0
+          remain = (opts[:remaining_s] || Thread.current[:pwn_loop_budget_s] || 10_800).to_f - elapsed
+          {
+            elapsed_s: elapsed.round,
+            remaining_tool_budget_s: [remain, 0].max.round,
+            mutations_used: Thread.current[:pwn_loop_mutations].to_i,
+            mutations_max: 10,
+            context_tokens_used: Thread.current[:pwn_loop_tokens].to_i,
+            est_max: 128_000
+          }
+        end
+
         # Author(s):: 0day Inc. <support@0dayinc.com>
 
         public_class_method def self.authors
@@ -3203,6 +3215,12 @@ module PWN
               force_tools: 'optional - force tools value consumed by #run'
             )
 
+            # Remaining time/token/mutation budget for the current loop.
+            #{self}.budget_status(
+              t0: 'optional - session start Time (defaults to thread t0)',
+              remaining_s: 'optional - override remaining tool budget seconds'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "

data/lib/pwn/ai/agent/reward.rb

@@ -177,22 +177,36 @@ module PWN
             v[:confidence] = [v[:confidence].to_f, ground[:confidence].to_f].max if ground[:confidence]
           end
 
-          v[:success] = promote_to_success?(
-            orm: v[:source].to_s != 'heuristic' && v[:score].to_f >= 0.6,
-            verify: if ground.nil?
-                      nil
-                    else
-                      ground[:verdict] == :confirmed
-                    end,
-            critic: opts.key?(:critic_pass) ? opts[:critic_pass] : nil
-          )
+          pass = final.match?(/\bPASS\b/) && !(defined?(Learning) && final.match?(Learning::FAILURE_FINAL_RX))
+          v[:judge_score] = v[:score].to_f
+          vv = opts[:verifier_verdict]
+          vv = :pass if vv.nil? && (opts[:verifier_pass] == true || pass || (ground && ground[:verdict] == :confirmed))
+          vv = vv.to_s.to_sym if vv
+          v[:verifier_verdict] = vv
+          v[:verdict_class] = taxonomy_class(opts.merge(score: v[:score], verifier_verdict: vv, request: request, final: final))
+          v[:remediation_hint] = taxonomy_hint(verdict_class: v[:verdict_class])
+          prec = verifier_precedence?
+          if prec && vv == :pass
+            v[:success] = true
+          else
+            v[:success] = promote_to_success?(
+              orm: v[:source].to_s != 'heuristic' && v[:score].to_f >= 0.6,
+              verify: if ground.nil?
+                        nil
+                      else
+                        ground[:verdict] == :confirmed
+                      end,
+              critic: opts.key?(:critic_pass) ? opts[:critic_pass] : nil
+            )
+          end
           v[:needs_spot_check] = v[:success] && v[:score].to_f >= 0.85 && (rand < 0.05)
           v[:engine] = eng
-          pass = final.match?(/\bPASS\b/) && !(defined?(Learning) && final.match?(Learning::FAILURE_FINAL_RX))
           v[:task_class] = request.match?(/analy[sz]e|summar|strength|weakness|fitness/i) ? 'analysis' : 'operational'
           if pass
             v[:score] = [v[:score].to_f, 0.7].max
             v[:score] = [v[:score].to_f, 0.70].min
+            v[:success] = true if prec
+            v[:verifier_verdict] ||= :pass
           end
           v[:score_components] ||= {
             judge: v[:score].to_f,
@@ -201,7 +215,16 @@ module PWN
             weights: { overlap: pass ? 0.0 : 0.15 }
           }
           v[:score_components][:weights][:overlap] = 0.0 if pass
-          Learning.note_outcome(task: request[0, 80], success: v[:score].to_f >= 0.6, score: v[:score], details: v[:score_components].to_json) if commit && defined?(Learning) && opts[:persist_components]
+          if commit && defined?(Learning) && opts[:persist_components]
+            Learning.note_outcome(
+              task: request[0, 80],
+              success: v[:success],
+              score: v[:score],
+              details: v[:score_components].to_json,
+              verifier_verdict: v[:verifier_verdict],
+              verdict_class: v[:verdict_class]
+            )
+          end
           # W3 — write Brier on every judged turn so overconfidence can
           # throttle max_iters/critic even when plan_first never fired.
           if commit
@@ -1254,6 +1277,45 @@ module PWN
           false
         end
 
+        private_class_method def self.verifier_precedence?(opts = {})
+          return true unless opts.is_a?(Hash)
+          return true unless defined?(PWN::Env)
+
+          v = PWN::Env.dig(:ai, :reward, :verifier_precedence)
+          v != false
+        rescue StandardError
+          true
+        end
+
+        private_class_method def self.taxonomy_class(opts = {})
+          given = (opts[:verdict_class] || opts['verdict_class']).to_s
+          return given unless given.empty?
+
+          vv = opts[:verifier_verdict]
+          score = opts[:score].to_f
+          final = opts[:final].to_s
+          request = opts[:request].to_s
+          return 'unverified_claim' if vv == :pass && score < 0.6
+          return 'missing_artifact' if request.match?(%r{/(?:tmp|home|opt|var)/}) && !final.match?(%r{/(?:tmp|home|opt|var)/})
+          return 'wrong_path' if request.include?('/tmp/') && final.include?('/tmp/') && request.split.none? { |tok| tok.start_with?('/') && final.include?(tok) }
+          return 'scope_miss' if final.match?(/out of scope|SCOPE_DENY/i)
+          return 'partial_coverage' if score.between?(0.3, 0.59)
+          return 'style_only' if score >= 0.6 && Array(opts[:trace]).empty?
+
+          'unverified_claim'
+        end
+
+        private_class_method def self.taxonomy_hint(opts = {})
+          {
+            'missing_artifact' => 'Write the requested path then read it back.',
+            'wrong_path' => 'Use the absolute path named in the original request.',
+            'unverified_claim' => 'Add a verifier PASS (file readback, exit 0, or hash match).',
+            'scope_miss' => 'Stay inside the active engagement scope.',
+            'partial_coverage' => 'Finish remaining request clauses before claiming done.',
+            'style_only' => 'Produce a host-visible artifact, not prose restyling.'
+          }[opts[:verdict_class].to_s] || 'Produce evidence that matches the original request.'
+        end
+
         private_class_method def self.cheap_orm_timeout
           n = agent_flag(key: :reward_llm_timeout, default: CHEAP_ORM_TIMEOUT).to_i
           n = CHEAP_ORM_TIMEOUT if n < 2
@@ -1770,7 +1832,9 @@ module PWN
               critic_pass: 'optional - critic pass value consumed by #judge',
               predicted: 'optional - predicted value consumed by #judge',
               proxy_ok: 'optional - proxy ok value consumed by #judge',
-              persist_components: 'optional - write score_components into the learning ledger'
+              persist_components: 'optional - write score_components into the learning ledger',
+              verifier_verdict: 'optional - :pass when a deterministic verifier already succeeded',
+              verifier_pass: 'optional - true as a boolean alias for verifier_verdict :pass'
             )
 
             # Run promote to success and return its result

data/lib/pwn/ai/agent/swarm.rb

@@ -438,6 +438,34 @@ module PWN
           "FACTS #{rows.map { |r| "#{r[:kind]}=#{r[:value]}" }.join(' ')}"
         end
 
+        public_class_method def self.claim(opts = {})
+          eng = (opts[:engagement_id] || 'default').to_s
+          unit = opts[:unit].to_s
+          raise 'ERROR: unit is required' if unit.empty?
+
+          ttl = (opts[:ttl] || 300).to_i
+          agent = (opts[:agent_id] || 'anon').to_s
+          dir = File.join(Dir.home, '.pwn', 'swarm', eng)
+          FileUtils.mkdir_p(dir)
+          path = File.join(dir, "#{unit.gsub(/[^A-Za-z0-9._:-]/, '_')}.claim")
+          now = Time.now.to_i
+          File.open(path, File::RDWR | File::CREAT, 0o644) do |f|
+            f.flock(File::LOCK_EX)
+            existing = begin
+              JSON.parse(f.read, symbolize_names: true)
+            rescue StandardError
+              {}
+            end
+            return { ok: false, unit: unit, holder: existing[:agent_id] } if existing[:until].to_i > now && existing[:agent_id].to_s != agent
+
+            row = { unit: unit, agent_id: agent, until: now + ttl }
+            f.rewind
+            f.truncate(0)
+            f.write(JSON.generate(row))
+            { ok: true, unit: unit, agent_id: agent, until: row[:until] }
+          end
+        end
+
         # Author(s):: 0day Inc. <support@0dayinc.com>
 
         public_class_method def self.authors
@@ -535,6 +563,14 @@ module PWN
               engagement_id: 'optional - engagement id (defaults to default)'
             )
 
+            # Atomically claim a work unit (INSERT-or-fail until TTL).
+            #{self}.claim(
+              unit: 'required - normalized target+phase key',
+              engagement_id: 'optional - engagement id (defaults to default)',
+              ttl: 'optional - seconds until the claim expires (defaults to 300)',
+              agent_id: 'optional - claimant id'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "

data/lib/pwn/ai/agent/tool_guard.rb

@@ -442,6 +442,39 @@ module PWN
           nil
         end
 
+        public_class_method def self.policy_decision(opts = {})
+          name = opts[:name].to_s
+          blob = opts[:args].inspect
+          path = File.join(Dir.home, '.pwn', 'toolguard.yaml')
+          return nil unless File.file?(path)
+
+          require 'yaml'
+          doc = YAML.safe_load_file(path, permitted_classes: [Symbol]) || {}
+          Array(doc['rules'] || doc[:rules]).each do |rule|
+            next unless rule.is_a?(Hash)
+
+            tool = (rule['tool'] || rule[:tool]).to_s
+            next unless tool.empty? || tool == name
+
+            pat = (rule['arg_pattern'] || rule[:arg_pattern]).to_s
+            next if pat.empty? || blob.match?(Regexp.new(pat)) == false
+
+            action = (rule['action'] || rule[:action] || 'allow').to_s
+            next if action == 'allow'
+
+            return {
+              action: action,
+              success: false,
+              error: (rule['reason'] || rule[:reason] || 'toolguard policy deny').to_s,
+              code: 'POLICY_DENY',
+              tool: name
+            }
+          end
+          nil
+        rescue StandardError
+          nil
+        end
+
         public_class_method def self.rfc1918?(opts = {})
           oct = opts[:ip].to_s.split('.').map(&:to_i)
           return false unless oct.length == 4
@@ -690,6 +723,12 @@ module PWN
               payload: 'optional - command string if class omitted'
             )
 
+            # Evaluate ~/.pwn/toolguard.yaml first-match rules.
+            #{self}.policy_decision(
+              name: 'required - tool name',
+              args: 'required - Hash of tool arguments'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "