pwn 0.5.722 → 0.5.724

data/etc/default_skills/pwn/ai/agent/tools/capabilities/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: pwn-ai-agent-tools-capabilities
+description: Drive PWN::Ai::Agent::Tools::Capabilities from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Ai::Agent::Tools::Capabilities
+  source: pwn/ai/agent/tools/capabilities.rb
+---
+
+# PWN::Ai::Agent::Tools::Capabilities
+
+Public API for PWN::Ai::Agent::Tools::Capabilities.
+
+## When to use
+
+Call `PWN::Ai::Agent::Tools::Capabilities` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/tools/capabilities.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Ai::Agent::Tools::Capabilities.help
+PWN::Ai::Agent::Tools::Capabilities.help(opts)
+```
+
+## Public methods
+
+- _(no public class methods parsed)_
+
+## Source
+
+`pwn/ai/agent/tools/capabilities.rb`
+
+## Verification
+
+`PWN::Ai::Agent::Tools::Capabilities.respond_to?(:help)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/tools/context/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: pwn-ai-agent-tools-context
+description: Drive PWN::Ai::Agent::Tools::Context from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Ai::Agent::Tools::Context
+  source: pwn/ai/agent/tools/context.rb
+---
+
+# PWN::Ai::Agent::Tools::Context
+
+Public API for PWN::Ai::Agent::Tools::Context.
+
+## When to use
+
+Call `PWN::Ai::Agent::Tools::Context` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/tools/context.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Ai::Agent::Tools::Context.help
+PWN::Ai::Agent::Tools::Context.help(opts)
+```
+
+## Public methods
+
+- _(no public class methods parsed)_
+
+## Source
+
+`pwn/ai/agent/tools/context.rb`
+
+## Verification
+
+`PWN::Ai::Agent::Tools::Context.respond_to?(:help)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/verification/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: pwn-ai-agent-verification
+description: Drive PWN::AI::Agent::Verification from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent::Verification
+  source: pwn/ai/agent/verification.rb
+---
+
+# PWN::AI::Agent::Verification
+
+Explicit host-owned acceptance checks, not a model-facing tool.
+
+## When to use
+
+Call `PWN::AI::Agent::Verification` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/verification.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent::Verification.help
+PWN::AI::Agent::Verification.run(opts)
+```
+
+## Public methods
+
+- `run`
+- `snapshot`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/verification.rb`
+
+## Verification
+
+`PWN::AI::Agent::Verification.respond_to?(:run)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/context/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: pwn-ai-context
+description: Drive PWN::AI::Context from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Context
+  source: pwn/ai/context.rb
+---
+
+# PWN::AI::Context
+
+Attach files, hexdumps, disassembly, and HTTP transcripts to model context with auto-chunking. Oversize artifacts are summarized inline and persisted under ~/.pwn/artifacts/<session_id>/ with SHA-256.
+
+## When to use
+
+Call `PWN::AI::Context` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/context.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Context.help
+PWN::AI::Context.attach_file(opts)
+```
+
+## Public methods
+
+- `attach_file`
+- `attach_hexdump`
+- `attach_disasm`
+- `attach_http_transcript`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/context.rb`
+
+## Verification
+
+`PWN::AI::Context.respond_to?(:attach_file)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/http_retry/SKILL.md

@@ -37,11 +37,18 @@ PWN::AI::HttpRetry.timeout_s(opts)
 - `max_attempts`
 - `retryable`
 - `retry_after_s`
+- `quota_exhausted`
+- `quota_message`
 - `report_event`
 - `authors`
 - `help`
+- `quota_exhausted?`
 - `retryable?`
 
+## References
+
+- `references/urls.md` — URLs from source
+
 ## Source
 
 `pwn/ai/http_retry.rb`

data/etc/default_skills/pwn/ai/http_retry/references/urls.md

@@ -0,0 +1,4 @@
+# PWN::AI::HttpRetry source links
+
+- https://platform\.openai\.com/settings/organization/billing/?}]
+- https://platform.openai.com/settings/organization/billing/

data/etc/default_skills/pwn/ai/open_ai/SKILL.md

@@ -37,6 +37,7 @@ PWN::AI::OpenAI.refresh_oauth_bearer_token(opts)
 - `obtain_oauth_bearer_token`
 - `get_models`
 - `chat_with_tools`
+- `api_endpoint`
 - `chat`
 - `img_gen`
 - `vision`

data/etc/default_skills/pwn/ai/open_ai/references/urls.md

@@ -5,3 +5,4 @@
 - https://auth.openai.com/oauth/token
 - https://api.openai.com/auth
 - https://auth.openai.com/codex/device
+- https://chatgpt.com/backend-api/codex

data/etc/default_skills/pwn/plugins/findings/SKILL.md

@@ -39,6 +39,7 @@ PWN::Plugins::Findings.required_bins(opts)
 - `report`
 - `query`
 - `chain`
+- `chain_score`
 - `render`
 - `authors`
 - `help`

data/etc/default_skills/pwn/plugins/gdbmi/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: pwn-plugins-gdbmi
+description: Drive PWN::Plugins::GDBMI from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::GDBMI
+  source: pwn/plugins/gdbmi.rb
+---
+
+# PWN::Plugins::GDBMI
+
+GDB machine-interface bridge: breakpoints, stepping, registers, memory, backtraces, checksec. Pairs with ProcessTube for interactive sessions.
+
+## When to use
+
+Call `PWN::Plugins::GDBMI` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/gdbmi.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::GDBMI.help
+PWN::Plugins::GDBMI.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `open`
+- `break`
+- `step`
+- `registers`
+- `read_memory`
+- `backtrace`
+- `checksec`
+- `mi`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/gdbmi.rb`
+
+## Verification
+
+`PWN::Plugins::GDBMI.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/ghidra_headless/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: pwn-plugins-ghidraheadless
+description: Drive PWN::Plugins::GhidraHeadless from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Plugins::GhidraHeadless
+  source: pwn/plugins/ghidra_headless.rb
+---
+
+# PWN::Plugins::GhidraHeadless
+
+analyzeHeadless wrapper that exports decompiled C plus the symbol table as JSON, cached by binary SHA-256.
+
+## When to use
+
+Call `PWN::Plugins::GhidraHeadless` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/plugins/ghidra_headless.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Plugins::GhidraHeadless.help
+PWN::Plugins::GhidraHeadless.required_bins(opts)
+```
+
+## Public methods
+
+- `required_bins`
+- `analyze`
+- `decompile`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/plugins/ghidra_headless.rb`
+
+## Verification
+
+`PWN::Plugins::GhidraHeadless.respond_to?(:required_bins)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/jobs/SKILL.md

@@ -35,6 +35,11 @@ PWN::Plugins::Jobs.required_bins(opts)
 
 - `required_bins`
 - `start`
+- `run`
+- `job_run`
+- `job_status`
+- `job_tail`
+- `job_kill`
 - `watch`
 - `status`
 - `tail`

data/etc/default_skills/pwn/plugins/packet/SKILL.md

@@ -45,8 +45,11 @@ PWN::Plugins::Packet.open_pcap_file(opts)
 - `construct_udp`
 - `send`
 - `tcp_connect_scan`
+- `cap_net_raw`
+- `capture`
 - `authors`
 - `help`
+- `cap_net_raw?`
 
 ## Source
 

data/etc/default_skills/pwn/plugins/preflight_checker/SKILL.md

@@ -38,6 +38,7 @@ PWN::Plugins::PreflightChecker.required_bins(opts)
 - `require_bin`
 - `route`
 - `capability_coverage`
+- `manifest`
 - `pick`
 - `cap_net_raw`
 - `require_cap_net_raw`

data/etc/default_skills/pwn/plugins/radare2/SKILL.md

@@ -40,6 +40,7 @@ PWN::Plugins::Radare2.required_bins(opts)
 - `close`
 - `functions`
 - `xrefs_to`
+- `xrefs_from`
 - `disasm`
 - `strings`
 - `imports`

data/etc/default_skills/pwn/plugins/transparent_browser/SKILL.md

@@ -56,6 +56,9 @@ PWN::Plugins::TransparentBrowser.open(opts)
 - `jmp_devtools_panel`
 - `close`
 - `evidence`
+- `intercept`
+- `har_export`
+- `replay`
 - `authors`
 - `help`
 - `evidence!`

data/etc/default_skills/pwn/reports/engagement/SKILL.md

@@ -28,11 +28,12 @@ Class methods take `(opts = {})` and read `opts`.
 
 ```ruby
 PWN::Reports::Engagement.help
-PWN::Reports::Engagement.generate(opts)
+PWN::Reports::Engagement.render(opts)
 ```
 
 ## Public methods
 
+- `render`
 - `generate`
 - `authors`
 - `help`
@@ -43,5 +44,5 @@ PWN::Reports::Engagement.generate(opts)
 
 ## Verification
 
-`PWN::Reports::Engagement.respond_to?(:generate)` after the
+`PWN::Reports::Engagement.respond_to?(:render)` after the
 module is loaded. Read the source for parameter names.

data/lib/pwn/ai/agent/curriculum.rb

@@ -104,11 +104,12 @@ module PWN
 
               prompts = generate_reproducers(mistake: m, count: [per, 2].max)
               runs = dry_run ? [] : prompts.map { |p| self_play(prompt: p, tag: "practice:#{m[:signature]}") }
-              solved = runs.select { |r| r[:score].to_f >= 0.6 }
-              mean = runs.empty? ? 0.0 : (runs.sum { |r| r[:score].to_f } / runs.length)
+              solved = runs.select { |r| r[:success] == true && !r[:training_score].nil? }
+              scored = runs.reject { |r| r[:training_score].nil? }
+              mean = scored.empty? ? nil : (scored.sum { |r| r[:training_score].to_f } / scored.length)
               resolved = false
               # 2.4 — auto-resolve only with N≥2 holdout successes + store trace
-              # P23 — auto-resolve only with N≥2 holdouts at judge≥0.7 AND a
+              # P23 — auto-resolve only with N≥2 trusted holdout successes AND a
               # real tool trace (not empty-final luck). Budget fingerprints
               # additionally require mean holdout ≥0.7 and short-horizon tags.
               if solved.length >= 2 && defined?(Mistakes)
@@ -130,7 +131,7 @@ module PWN
                   bump_cooldown!(cooldown: cool, signature: m[:signature], mean: mean) unless dry_run
                   results << {
                     signature: m[:signature], tool: m[:tool], prompts: prompts,
-                    runs: runs.map { |r| { score: r[:score], verdict: r[:verdict] } },
+                    runs: runs,
                     resolved: false, mean_score: mean.round(3),
                     reason: 'holdouts_ok_but_trace_weak'
                   }
@@ -177,14 +178,14 @@ module PWN
                 end
                 resolved = true
                 cool.delete(m[:signature].to_s)
-              elsif !dry_run
+              elsif !dry_run && !mean.nil?
                 # P1 — track zero-progress nights; park after COOLDOWN_FAIL_NIGHTS
                 bump_cooldown!(cooldown: cool, signature: m[:signature], mean: mean)
               end
               results << {
                 signature: m[:signature], tool: m[:tool], prompts: prompts,
-                runs: runs.map { |r| { score: r[:score], verdict: r[:verdict] } },
-                resolved: resolved, mean_score: mean.round(3)
+                runs: runs,
+                resolved: resolved, mean_score: mean&.round(3)
               }
             end
           end
@@ -264,7 +265,7 @@ module PWN
 
             if commit && defined?(Learning)
               prior = Learning.outcomes(limit: 500).find do |o|
-                o[:session_id].to_s == sid.to_s && o[:score] && Array(o[:tags]).include?('offline_judge')
+                o[:session_id].to_s == sid.to_s && !o[:training_score].nil? && Array(o[:tags]).include?('offline_judge')
               end
               next if prior
             end
@@ -278,38 +279,31 @@ module PWN
             next if req.strip.empty? || fin.strip.empty?
 
             v = Reward.judge(request: req, final: fin, session_id: sid, commit: commit)
-            Reward.prm(request: req, session_id: sid) if do_prm
+            known = !v[:training_score].nil?
+            Reward.prm(request: req, session_id: sid) if do_prm && commit && known
             # P7/W3 — offline path must also fill calibration so the controller
             # (force plan_first/critic at n≥8) actually becomes reachable under
             # :failure_only local introspect. Pull p(success)= out of any PLAN.
-            if commit
+            if commit && known
               plan = t.find { |e| e[:role].to_s == 'assistant' && e[:content].to_s.start_with?('PLAN:') }
               pred = plan && plan[:content].to_s[/p\(success\)\s*=\s*([01](?:\.\d+)?)/i, 1]
               if pred
                 eng = (PWN::Env.dig(:ai, :active) if defined?(PWN::Env))
-                calibrate(predicted: pred.to_f, actual: v[:score].to_f, engine: eng)
+                calibrate(predicted: pred.to_f, actual: v[:success] ? 1.0 : 0.0, engine: eng)
               end
             end
             if commit && defined?(Learning)
-              # P29 — keep verdict tag score-aligned (same as auto_introspect).
-              sc = v[:score].to_f
-              verd = if defined?(Learning) && Learning.respond_to?(:verdict_for_score, true)
-                       Learning.send(:verdict_for_score, score: sc).to_s
-                     elsif sc >= 0.6 then 'solved'
-                     elsif sc >= 0.3 then 'partial'
-                     else 'wrong'
-                     end
+              verd = v[:verdict].to_s
               Learning.note_outcome(
                 task: req[0, 120],
-                success: sc >= 0.6,
-                score: sc,
-                details: "offline_judge #{verd}(#{sc.round(2)}) #{v[:rationale]}",
+                outcome: v,
+                details: "offline_judge #{verd}(#{v[:score]}) #{v[:rationale]}",
                 session_id: sid,
                 tags: ['offline_judge', 'auto', verd],
                 judge_source: v[:source]
               )
             end
-            scored << { session_id: sid, score: v[:score], verdict: v[:verdict] }
+            scored << v.merge(session_id: sid)
           end
 
           mean = scored.empty? ? nil : (scored.sum { |r| r[:score].to_f } / scored.length).round(3)
@@ -1059,9 +1053,11 @@ module PWN
           rescue StandardError
             nil
           end
-          { session_id: sid, prompt: opts[:prompt], final: final, score: v[:score], verdict: v[:verdict], trace: trace }
+          v.merge(session_id: sid, prompt: opts[:prompt], final: final, trace: trace)
         rescue StandardError => e
-          { prompt: opts[:prompt], error: e.message, score: 0.0, trace: nil }
+          Reward.resolve_outcome(outcome: { source: :error, error: e.message }).merge(
+            session_id: sid, prompt: opts[:prompt], final: final, trace: trace
+          )
         end
 
         private_class_method def self.score_branch(opts = {})
@@ -1204,7 +1200,8 @@ module PWN
           smoke_ok = cand_smoke[:resolved].to_i >= base_smoke[:resolved].to_i &&
                      cand_smoke[:mean_score].to_f + 0.05 >= base_smoke[:mean_score].to_f
 
-          promote = resolved_win && mean_win && smoke_ok
+          outcomes_known = [baseline, candid, base_smoke, cand_smoke].all? { |r| r[:unknown]&.zero? }
+          promote = outcomes_known && resolved_win && mean_win && smoke_ok
           {
             baseline: opts[:baseline],
             candidate: opts[:candidate],
@@ -1223,6 +1220,7 @@ module PWN
             resolved_win: resolved_win,
             mean_win: mean_win,
             smoke_ok: smoke_ok,
+            outcomes_known: outcomes_known,
             promote: promote,
             evalset_size: evalset.length,
             gate_version: 2
@@ -1270,34 +1268,28 @@ module PWN
 
         private_class_method def self.replay_on_detailed(opts = {})
           tag = opts[:tag].to_s
-          return { resolved: 0, mean_score: 0.0, scores: [] } if tag.empty?
+          return { resolved: 0, mean_score: 0.0, scores: [], outcomes: [], unknown: Array(opts[:evalset]).length } if tag.empty?
 
-          scores = []
+          outcomes = []
           with_ollama_model(tag: tag) do
             Array(opts[:evalset]).each do |e|
-              r = self_play(prompt: e[:prompt], tag: "gate:#{tag}")
-              scores << r[:score].to_f
+              outcomes << self_play(prompt: e[:prompt], tag: "gate:#{tag}")
             end
           end
-          resolved = scores.count { |s| s >= 0.7 }
-          mean = scores.empty? ? 0.0 : (scores.sum / scores.length)
-          { resolved: resolved, mean_score: mean.round(3), scores: scores }
+          known = outcomes.reject { |r| r[:training_score].nil? }
+          resolved = known.count { |r| r[:success] == true }
+          mean = known.empty? ? 0.0 : (known.sum { |r| r[:training_score] } / known.length)
+          {
+            resolved: resolved, mean_score: mean.round(3),
+            scores: outcomes.map { |r| r[:score] }, outcomes: outcomes,
+            unknown: outcomes.length - known.length
+          }
         rescue StandardError
-          { resolved: 0, mean_score: 0.0, scores: [] }
+          { resolved: 0, mean_score: 0.0, scores: [], outcomes: outcomes || [], unknown: Array(opts[:evalset]).length }
         end
 
         private_class_method def self.replay_on(opts = {})
-          tag = opts[:tag].to_s
-          return 0 if tag.empty?
-
-          with_ollama_model(tag: tag) do
-            opts[:evalset].count do |e|
-              r = self_play(prompt: e[:prompt], tag: "gate:#{tag}")
-              r[:score].to_f >= 0.7
-            end
-          end
-        rescue StandardError
-          0
+          replay_on_detailed(tag: opts[:tag], evalset: opts[:evalset])[:resolved]
         end
 
         private_class_method def self.with_ollama_model(opts = {})