pwn 0.5.739 → 0.5.741

data/lib/pwn/ai/agent/tools/shell.rb

@@ -25,14 +25,16 @@ PWN::AI::Agent::Registry.register(
                  'Pass timeout as a conservative integer seconds estimate given ' \
                  'HOST LOAD (loadavg, ncpu, mem). Omit for a host-derived default. ' \
                  'Explicit timeout is honored up to 10800s (3 hours) for any payload. On ' \
-                 'timeout, keep the same payload and retry with timeout += 180 ' \
-                 'until the 3-hour budget is gone; then rewrite (max 10 mutations/task).',
+                 'timeout for short foreground work, keep the same payload and retry with timeout += 180 ' \
+                 'until the 3-hour budget is gone; then rewrite (max 10 mutations/task). For fuzz campaigns, full scans, or Ghidra use job_run, or background:true here; poll the returned job id instead of timeout retries.',
     parameters: {
       type: 'object',
       properties: {
         command: { type: 'string', description: 'The exact shell command to run.' },
         encoding: { type: 'string', description: 'Set to base64 when data holds the command bytes.' },
         data: { type: 'string', description: 'Base64 command blob when encoding is base64.' },
+        background: { type: 'boolean', description: 'Run detached under the durable job supervisor, bypassing foreground timeout/retry budgets.' },
+        max_runtime: { type: 'integer', minimum: 0, description: 'Detached supervisor runtime in seconds; 0 unlimited. Use job_run for cwd/env/idempotency options.' },
         timeout: {
           type: 'integer',
           description: 'Conservative seconds this command should take given HOST LOAD. Omit for a host-derived default. Explicit values honored 1..10800 (3 hours). On timeout keep the same payload and timeout += 180; rewrite only after the 3-hour budget (max 10 mutations/task).'
@@ -47,20 +49,25 @@ PWN::AI::Agent::Registry.register(
     # Payload bytes are opaque; only the shell interprets command syntax.
     args = PWN::AI::Agent::ToolGuard.unwrap_payload(args: args, key: :command)
     args = PWN::AI::Agent::ToolGuard.coerce_args(args: args, required: %w[command])
-    return PWN::AI::Agent::ToolGuard.invalid_payload(hint: args[:__schema_hint]) if args[:__schema_error]
+    return PWN::AI::Agent::ToolGuard.invalid_payload(rule_id: 'payload.required', hint: args[:__schema_hint]) if args[:__schema_error]
 
     cmd = args[:command].to_s
-    if PWN::AI::Agent::ToolGuard.placeholder?(text: cmd, placeholder_ok: args[:placeholder_ok] || args['placeholder_ok'])
+    placeholder = PWN::AI::Agent::ToolGuard.placeholder_match(text: cmd, placeholder_ok: args[:placeholder_ok] || args['placeholder_ok'])
+    if placeholder
       return PWN::AI::Agent::ToolGuard.invalid_payload(
+        **placeholder,
         hint: 'command is required (string). Do not send ..., {...}, {…}.',
         text: cmd,
-        offending_token: '...'
+        remedy: 'Replace the placeholder with complete content or set placeholder_ok: true for intentional literal text. For quoting/transport use encoding: "base64" and data: Base64.strict_encode64(command); base64 does not bypass validation, so retain placeholder_ok: true when needed.'
       )
     end
-    if PWN::AI::Agent::ToolGuard.bashism?(text: cmd) && !PWN::AI::Agent::ToolGuard.shell_bash?
+    bashism = PWN::AI::Agent::ToolGuard.bashism_match(text: cmd)
+    if bashism && !PWN::AI::Agent::ToolGuard.shell_bash?
       return PWN::AI::Agent::ToolGuard.invalid_payload(
+        **bashism,
         hint: 'bash-only construct (PIPESTATUS/RANDOM/[[) is not POSIX. Rewrite for /bin/sh or set ai.agent.shell_bash.',
-        text: cmd
+        text: cmd,
+        remedy: 'Rewrite the matched construct for /bin/sh or enable ai.agent.shell_bash. Neither base64 nor placeholder_ok bypasses shell-syntax validation.'
       )
     end
     timeout = PWN::AI::Agent::ToolGuard.deadline_s(timeout: args[:timeout], kind: :shell, payload: cmd)
@@ -69,15 +76,20 @@ PWN::AI::Agent::Registry.register(
         hint: "command exceeds max payload size #{PWN::AI::Agent::ToolGuard::MAX_PAYLOAD_BYTES} bytes",
         text: cmd,
         byte_range: [PWN::AI::Agent::ToolGuard::MAX_PAYLOAD_BYTES, cmd.bytesize],
-        code: 'PAYLOAD_TOO_LARGE'
+        code: 'PAYLOAD_TOO_LARGE',
+        rule_id: 'payload.max_bytes',
+        remedy: 'Split the command into smaller complete calls within max_payload_bytes. Base64 and placeholder_ok do not increase the decoded size limit.'
       )
     end
-    return PWN::AI::Agent::ToolGuard.invalid_payload(hint: 'command must be a nonempty string') unless args[:command].is_a?(String) && !cmd.empty?
+    return PWN::AI::Agent::ToolGuard.invalid_payload(rule_id: 'payload.type', hint: 'command must be a nonempty string') unless args[:command].is_a?(String) && !cmd.empty?
 
     scoped = PWN::AI::Agent::ToolGuard.scope_refusal(command: cmd)
     return scoped if scoped
 
-    return PWN::Plugins::Jobs.start(command: cmd).merge(routed: 'job_run') if args[:timeout].to_i <= 0 && PWN::AI::Agent::ToolGuard.auto_job?(payload: cmd)
+    sandboxed = PWN::Plugins::AISandbox.wrap_shell(command: cmd, timeout: timeout)
+    return sandboxed unless sandboxed.nil?
+
+    return PWN::Plugins::Jobs.start(command: cmd, max_runtime: args[:max_runtime], session_id: Thread.current[:pwn_session_id]).merge(routed: 'job_run') if args[:background] == true || (args[:timeout].to_i <= 0 && PWN::AI::Agent::ToolGuard.auto_job?(payload: cmd))
 
     stdout = +''
     stderr = +''

data/lib/pwn/ai/agent/turn_finalizer.rb

@@ -2,6 +2,7 @@
 
 require 'json'
 require 'digest'
+require 'securerandom'
 
 module PWN
   module AI
@@ -178,6 +179,27 @@ module PWN
           MUTEX.synchronize { THREADS.count(&:alive?) }
         end
 
+        # Freeze operator-owned destinations once, before tools can change cwd.
+        public_class_method def self.commit_artifacts!(opts = {})
+          return Thread.current[:pwn_artifact_contract] if opts[:inherit] && Thread.current[:pwn_artifact_contract]
+
+          request = opts[:request].to_s.dup.freeze
+          paths = output_paths(request: request, cwd: opts[:cwd]).map(&:freeze).freeze
+          Thread.current[:pwn_artifact_contract] = {
+            id: SecureRandom.hex(16).freeze,
+            request: request,
+            required_artifacts: paths,
+            started_at: Time.now.freeze
+          }.freeze
+        end
+
+        public_class_method def self.required_artifacts(opts = {})
+          contract = Thread.current[:pwn_artifact_contract]
+          return contract[:required_artifacts] if contract && (contract[:request] == opts[:request].to_s || Thread.current[:pwn_loop_nested])
+
+          output_paths(request: opts[:request], cwd: opts[:cwd])
+        end
+
         # Literal destinations only; source paths are never delivery obligations.
         public_class_method def self.output_paths(opts = {})
           request = opts[:request].to_s
@@ -211,9 +233,13 @@ module PWN
           return {} unless opts[:success] == true && opts[:effect].to_s == 'write'
 
           before = opts[:before] || {}
-          artifact_snapshot(paths: opts[:paths]).select do |path, row|
+          observed = artifact_snapshot(paths: opts[:paths]).select do |path, row|
             row && before.key?(path) && before[path] != row
           end
+          observed.transform_values do |row|
+            contract = Thread.current[:pwn_artifact_contract]
+            contract ? row.merge(artifact_turn_id: contract[:id]) : row
+          end
         end
 
         private_class_method def self.artifact_readback(opts = {})
@@ -242,9 +268,9 @@ module PWN
         public_class_method def self.arbitrate(opts = {})
           request = opts[:request].to_s
           messages = Array(opts[:messages])
-          t0 = opts[:session_t0] || Thread.current[:pwn_loop_t0]
+          t0 = opts[:session_t0] || Thread.current[:pwn_artifact_contract]&.dig(:started_at) || Thread.current[:pwn_loop_t0]
           paths = Array(opts[:paths]).map { |path| File.expand_path(path.to_s) }
-          paths += output_paths(request: request)
+          paths += required_artifacts(request: request)
           paths.uniq!
           ledger = evidence_ledger(messages: messages)
           unmet = []
@@ -257,7 +283,10 @@ module PWN
             unmet << { criterion: 'empty_artifact', detail: path } if File.size(path) < 2
             unmet << { criterion: 'write_missing', detail: path } unless row && row[:write]
             unmet << { criterion: 'readback_missing', detail: path } unless row && row[:read]
-            unmet << { criterion: 'artifact_mtime_before_session', detail: path } if t0 && File.mtime(path) < t0
+            # Filesystem timestamps can lag Time.now by a clock tick. A bound
+            # current-turn write delta plus matching readback is stronger proof.
+            current_turn = row && row.dig(:evidence, :artifact_turn_id) == Thread.current[:pwn_artifact_contract]&.dig(:id) && Thread.current[:pwn_artifact_contract]
+            unmet << { criterion: 'artifact_mtime_before_session', detail: path } if t0 && File.mtime(path) < t0 && !current_turn
           end
           {
             complete: unmet.empty? && (!paths.empty? || ledger.any?),
@@ -274,8 +303,14 @@ module PWN
             next unless msg[:artifact_observations].is_a?(Hash)
 
             msg[:artifact_observations].each do |path, observed|
+              next unless observed.is_a?(Hash)
+
+              contract = Thread.current[:pwn_artifact_contract]
+              next if contract && observed[:artifact_turn_id] != contract[:id]
+
               current = artifact_readback(path: path)
-              next unless current && current == observed
+              readback = observed.except(:artifact_turn_id)
+              next unless current && current == readback
 
               ledger[path] = { write: true, read: true, evidence: observed }
             end
@@ -338,6 +373,12 @@ module PWN
             # Extract explicit output literals, excluding source/read paths.
             #{self}.output_paths(request: 'required - original user request', cwd: 'optional - relative path base')
 
+            # Precommit immutable required_artifacts for this turn before tools run.
+            #{self}.commit_artifacts!(request: 'required - original user request', cwd: 'optional - initial relative path base', inherit: 'optional - reuse the owning turn contract for a nested call')
+
+            # Return precommitted paths, or parse literals outside an active turn.
+            #{self}.required_artifacts(request: 'required - original user request', cwd: 'optional - relative path base outside a turn')
+
             # Snapshot named destinations immediately before a tool runs.
             #{self}.artifact_snapshot(paths: 'required - destination paths')
 

data/lib/pwn/ai/agent.rb

@@ -23,7 +23,8 @@ module PWN
       autoload :RequestRuntime, 'pwn/ai/agent/request_runtime'
       autoload :Profiles, 'pwn/ai/agent/profiles'
       autoload :EngagementMemory, 'pwn/ai/agent/engagement_memory'
-      autoload :Dispatch,      'pwn/ai/agent/dispatch'
+      autoload :Dispatch, 'pwn/ai/agent/dispatch'
+      autoload :Confirmation, 'pwn/ai/agent/confirmation'
       autoload :Result,        'pwn/ai/agent/result'
       autoload :PromptBuilder, 'pwn/ai/agent/prompt_builder'
       autoload :Loop, 'pwn/ai/agent/loop'
@@ -38,6 +39,7 @@ module PWN
       autoload :Verification,  'pwn/ai/agent/verification'
       autoload :Curriculum,    'pwn/ai/agent/curriculum'
       autoload :TaskSummarizer, 'pwn/ai/agent/task_summarizer'
+      autoload :TaskDAG, 'pwn/ai/agent/task_dag'
       autoload :Policy, 'pwn/ai/agent/policy'
       autoload :PolicyEvaluation, 'pwn/ai/agent/policy_evaluation'
       autoload :ToolGuard, 'pwn/ai/agent/tool_guard'

data/lib/pwn/ai/cli.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require 'optparse'
+require 'yaml'
+require 'json'
 require 'pwn'
 
 module PWN
@@ -10,10 +12,13 @@ module PWN
       public_class_method def self.parse(opts = {})
         result = {}
         parser = OptionParser.new do |options|
-          options.banner = 'Usage: pwn-ai [--analyze PATH | --replay ID | --rerun ID] [--ai PROMPT]'
+          options.banner = 'Usage: pwn-ai [--analyze PATH | --replay ID | --rerun ID | --plan-only | --execute PATH | --resume RUN_ID] [--ai PROMPT]'
           options.on('--analyze PATH', 'Ingest evidence before starting the AI session') { |v| result[:analyze] = v }
           options.on('--replay ID', 'Render saved trace without executing tools') { |v| result[:replay] = v }
           options.on('--rerun ID', 'Re-execute saved tools in a fresh context (side effects possible)') { |v| result[:rerun] = v }
+          options.on('--plan-only', 'Emit a YAML task DAG with zero side effects') { result[:plan_only] = true }
+          options.on('--execute PATH', 'Run an approved YAML task DAG') { |v| result[:execute] = v }
+          options.on('--resume RUN_ID', 'Resume a checkpointed DAG run, skipping completed steps') { |v| result[:resume] = v }
           options.on('--ai PROMPT', 'One-shot request; - reads standard input') { |v| result[:ai] = v }
           options.on('--pwn-env PATH', 'Use the specified encrypted configuration') { |v| result[:pwn_env_path] = v }
           options.on('--pwn-dec PATH', 'Use the specified decryptor') { |v| result[:pwn_dec_path] = v }
@@ -21,8 +26,9 @@ module PWN
         end
         remaining = parser.parse!(Array(opts[:argv]).dup)
         raise OptionParser::InvalidArgument, "unexpected arguments: #{remaining.join(' ')}" unless remaining.empty?
-        raise OptionParser::InvalidArgument, 'choose only one of --analyze, --replay, --rerun' if %i[analyze replay rerun].count { |key| result.key?(key) } > 1
+        raise OptionParser::InvalidArgument, 'choose only one of --analyze, --replay, --rerun, --plan-only, --execute, --resume' if %i[analyze replay rerun plan_only execute resume].count { |key| result.key?(key) } > 1
         raise OptionParser::InvalidArgument, '--ai cannot accompany --replay or --rerun' if result[:ai] && (result[:replay] || result[:rerun])
+        raise OptionParser::InvalidArgument, '--plan-only requires --ai' if result[:plan_only] && !result[:ai]
 
         result[:help_text] = parser.to_s
         result
@@ -37,6 +43,24 @@ module PWN
         end
 
         require 'pwn'
+        if parsed[:plan_only]
+          prompt = parsed[:ai] == '-' ? (opts[:input] || $stdin).read : parsed[:ai]
+          raise ArgumentError, '--ai requires a non-empty prompt' if prompt.to_s.strip.empty?
+
+          dag = PWN::AI::Agent::TaskDAG.plan(request: prompt)
+          output.puts(YAML.dump(JSON.parse(JSON.generate(dag))))
+          return 0
+        end
+        if parsed[:resume] || parsed[:execute]
+          PWN::Config.refresh_env(**parsed.slice(:pwn_env_path, :pwn_dec_path))
+          report = if parsed[:resume]
+                     PWN::AI::Agent::TaskDAG.resume(run_id: parsed[:resume])
+                   else
+                     PWN::AI::Agent::TaskDAG.execute(path: parsed[:execute])
+                   end
+          output.puts(JSON.generate(report))
+          return report[:ok] == false ? 1 : 0
+        end
         if parsed[:replay] || parsed[:rerun]
           require 'pwn/session_trace'
           if parsed[:replay]

data/lib/pwn/ai/context.rb

@@ -49,7 +49,8 @@ module PWN
         text = if defined?(PWN::Plugins::Radare2) && File.file?(path)
                  sid = PWN::Plugins::Radare2.open(path: path)
                  addr = fn.empty? ? 'main' : fn
-                 PWN::Plugins::Radare2.disasm(session: sid, addr: addr, n: 64)
+                 result = PWN::Plugins::Radare2.disasm(session: sid, addr: addr, n: 64)
+                 result.is_a?(String) ? result : JSON.pretty_generate(result)
                else
                  File.binread(path).to_s[0, CHUNK]
                end
@@ -136,8 +137,9 @@ module PWN
                    File.binwrite(dest, bytes)
                    { sha256: sha, path: dest, size: bytes.bytesize }
                  end
-        chunks = []
         body = summary.to_s
+        body = PWN::AI::Router.summarize(text: body) if bytes.bytesize > WINDOW && defined?(PWN::AI::Router)
+        chunks = []
         i = 0
         while i < body.bytesize
           chunks << body.byteslice(i, CHUNK)

data/lib/pwn/ai/router.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module PWN
+  module AI
+    # Task-class model routing from pwn.yaml ai_router / model_routes.
+    module Router
+      TASKS = %i[summarize plan exploit_dev triage].freeze
+      FRONTIER = %w[openai anthropic grok gemini].freeze
+      LOCAL = %w[ollama openwebui].freeze
+      ENGINE_MOD = {
+        'ollama' => 'PWN::AI::Ollama',
+        'openwebui' => 'PWN::AI::OpenWebUI',
+        'openai' => 'PWN::AI::OpenAI',
+        'anthropic' => 'PWN::AI::Anthropic',
+        'grok' => 'PWN::AI::Grok',
+        'gemini' => 'PWN::AI::Gemini'
+      }.freeze
+
+      public_class_method def self.required_bins
+        []
+      end
+
+      # Resolve engine/model fallbacks for a task class.
+      public_class_method def self.resolve(opts = {})
+        task = (opts[:task] || opts[:class] || :summarize).to_s.to_sym
+        entry = config_entry(task: task)
+        endpoints = expand_endpoints(entry: entry)
+        allow_frontier = !%i[summarize plan].include?(task)
+        allow_frontier &&= entry[:allow_frontier] != false && entry['allow_frontier'] != false
+        { task: task, endpoints: endpoints, allow_frontier: allow_frontier }
+      end
+
+      # Summarize text on the cheap local chain; never calls frontier models.
+      public_class_method def self.summarize(opts = {})
+        text = (opts[:text] || opts[:content]).to_s
+        reset_task = opts[:reset_usage]
+        reset_usage if reset_task
+        note_usage(task: :summarize, frontier_tokens: 0)
+        if opts[:llm]
+          resolve(task: :summarize)[:endpoints].each do |endpoint|
+            next if frontier?(engine: endpoint[:engine])
+
+            out = try_chat(endpoint: endpoint, request: "Summarize this artifact for paging. Be terse.\n#{text.byteslice(0, 8_192)}")
+            return out if out.to_s.strip != ''
+          end
+        end
+        extractive(text: text)
+      rescue StandardError
+        extractive(text: text)
+      end
+
+      # Return per-task token accounting (frontier_tokens is always 0 for summarize).
+      public_class_method def self.usage(opts = {})
+        _n = opts[:n]
+        @usage ||= {}
+        @usage
+      end
+
+      # Clear the in-process usage ledger.
+      public_class_method def self.reset_usage(opts = {})
+        _n = opts[:n]
+        @usage = {}
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Resolve engine/model fallbacks for a task class.
+          #{self}.resolve(
+            task: 'optional - summarize, plan, exploit_dev, or triage',
+            class: 'optional - alias for task'
+          )
+
+          # Summarize text on the cheap local chain; never calls frontier models.
+          #{self}.summarize(
+            text: 'optional - artifact or page text to summarize',
+            content: 'optional - alias for text',
+            reset_usage: 'optional - true clears the usage ledger first',
+            llm: 'optional - true tries local-engine chat after skipping frontier endpoints'
+          )
+
+          # Return per-task token accounting (frontier_tokens is always 0 for summarize).
+          #{self}.usage(
+            n: 'optional - unused placeholder so the method reads opts'
+          )
+
+          # Clear the in-process usage ledger.
+          #{self}.reset_usage(
+            n: 'optional - unused placeholder so the method reads opts'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.config_entry(opts = {})
+        task = opts[:task]
+        router = env_hash(key: :ai_router)
+        routes = env_dig(keys: %i[ai agent model_routes])
+        raw = (router[task] || router[task.to_s] || routes[task] || routes[task.to_s]).dup
+        raw = default_entry(task: task) if raw.nil? || raw == {}
+        raw.is_a?(Hash) ? raw.transform_keys(&:to_sym) : { engine: raw.to_s }
+      end
+
+      private_class_method def self.default_entry(opts = {})
+        task = opts[:task]
+        case task
+        when :exploit_dev
+          { engine: 'ollama', model: 'qwen2.5-coder', fallbacks: [{ engine: 'openai' }] }
+        when :summarize, :plan, :triage
+          { engine: 'ollama', fallbacks: [{ engine: 'openwebui' }], allow_frontier: false }
+        else
+          { engine: env_dig(keys: %i[ai active]).to_s }
+        end
+      end
+
+      private_class_method def self.expand_endpoints(opts = {})
+        entry = opts[:entry]
+        head = { engine: (entry[:engine] || entry[:endpoint] || 'ollama').to_s, model: entry[:model] }
+        rest = Array(entry[:fallbacks] || entry[:fallback]).map do |item|
+          item.is_a?(Hash) ? item.transform_keys(&:to_sym) : { engine: item.to_s }
+        end
+        ([head] + rest).map { |row| { engine: row[:engine].to_s.downcase, model: row[:model] } }
+      end
+
+      private_class_method def self.frontier?(opts = {})
+        FRONTIER.include?(opts[:engine].to_s.downcase)
+      end
+
+      private_class_method def self.try_chat(opts = {})
+        endpoint = opts[:endpoint]
+        engine = endpoint[:engine].to_s
+        const = ENGINE_MOD[engine]
+        return nil unless const
+
+        mod = Object.const_get(const)
+        return nil unless mod.respond_to?(:chat)
+
+        resp = mod.chat(request: opts[:request], model: endpoint[:model], spinner: false, quiet: true, timeout: 8)
+        text = resp.is_a?(Hash) ? (resp[:content] || resp['content'] || resp.dig(:choices, 0, :content)).to_s : resp.to_s
+        text.strip.empty? ? nil : text
+      rescue StandardError
+        nil
+      end
+
+      private_class_method def self.extractive(opts = {})
+        text = opts[:text].to_s
+        text.byteslice(0, 2_048).to_s
+      end
+
+      private_class_method def self.note_usage(opts = {})
+        task = opts[:task].to_sym
+        @usage ||= {}
+        @usage[task] ||= { frontier_tokens: 0, local_tokens: 0 }
+        @usage[task][:frontier_tokens] = opts[:frontier_tokens].to_i if opts.key?(:frontier_tokens)
+        @usage[task][:local_tokens] += opts[:local_tokens].to_i if opts[:local_tokens]
+      end
+
+      private_class_method def self.env_hash(opts = {})
+        return {} unless defined?(PWN::Env)
+
+        val = PWN::Env[opts[:key]]
+        if val.is_a?(Hash)
+          val.transform_keys { |key| key.is_a?(String) ? key.to_sym : key }
+        else
+          {}
+        end
+      rescue StandardError
+        {}
+      end
+
+      private_class_method def self.env_dig(opts = {})
+        return {} unless defined?(PWN::Env) && PWN::Env.respond_to?(:dig)
+
+        val = PWN::Env.dig(*opts[:keys])
+        if val.is_a?(Hash)
+          val.transform_keys { |key| key.is_a?(String) ? key.to_sym : key }
+        else
+          val
+        end
+      rescue StandardError
+        {}
+      end
+    end
+  end
+end

data/lib/pwn/ai/tools/README.md

@@ -20,6 +20,11 @@ risk_gates:
   med: prompt
   high: prompt
   crit: deny
+confirmation:
+  read_only: auto
+  active_scan: auto
+  exploit: prompt
+  destructive: prompt
 ```
 
 Missing risk gates deny; unannotated tools use `crit`. `enabled: false` explicitly

data/lib/pwn/ai.rb

@@ -17,6 +17,7 @@ module PWN
     autoload :OpenAI, 'pwn/ai/open_ai'
     autoload :OpenWebUI, 'pwn/ai/open_web_ui'
     autoload :RedTeam, 'pwn/ai/red_team'
+    autoload :Router, 'pwn/ai/router'
 
     # Display a List of Every PWN::AI Module
 

data/lib/pwn/config.rb

@@ -17,6 +17,13 @@ module PWN
     #     user values on `pwn setup --migrate --fix`
     public_class_method def self.env_template
       {
+        ai_sandbox: 'off',
+        ai_router: {
+          summarize: { engine: 'ollama', model: nil, fallbacks: [{ engine: 'openwebui' }], allow_frontier: false },
+          plan: { engine: 'ollama', model: nil, fallbacks: [{ engine: 'openwebui' }], allow_frontier: false },
+          exploit_dev: { engine: 'ollama', model: 'qwen2.5-coder', fallbacks: [{ engine: 'openai' }] },
+          triage: { engine: 'ollama', model: nil, fallbacks: [{ engine: 'openwebui' }] }
+        },
         ai: {
           active: 'grok',
           module_reflection: false,
@@ -204,6 +211,9 @@ module PWN
             max_total_mb: 512,
             model_routes: {
               summarize: nil,
+              plan: nil,
+              exploit_dev: nil,
+              triage: nil,
               judge: nil,
               act: nil,
               sensitive: nil

data/lib/pwn/engagement.rb

@@ -3,6 +3,7 @@
 require 'json'
 require 'fileutils'
 require 'ipaddr'
+require 'time'
 
 module PWN
   # Engagement scope, host state, and vault refs under ~/.pwn/engagements.
@@ -85,6 +86,31 @@ module PWN
       hosts(name: opts[:engagement] || opts[:name])
     end
 
+    public_class_method def self.record_scan(opts = {})
+      name = (opts[:engagement] || opts[:name] || PWN::AI::Agent::Engagement.current_name || 'default').to_s
+      dir = File.join(PWN::AI::Agent::Engagement::ROOT, name, 'scans')
+      FileUtils.mkdir_p(dir)
+      at = opts[:at] || Time.now.utc
+      at = Time.parse(at.to_s).utc unless at.is_a?(Time)
+      path = File.join(dir, "nmap-#{at.utc.strftime('%Y%m%dT%H%M%SZ')}.json")
+      body = {
+        at: at.utc.iso8601,
+        kind: opts[:kind] || 'nmap',
+        xml: opts[:xml],
+        hosts: opts[:hosts],
+        ports: opts[:ports]
+      }
+      File.write(path, JSON.pretty_generate(body))
+      body.merge(path: path)
+    end
+
+    public_class_method def self.scans(opts = {})
+      name = (opts[:name] || opts[:engagement] || PWN::AI::Agent::Engagement.current_name || 'default').to_s
+      Dir[File.join(PWN::AI::Agent::Engagement::ROOT, name, 'scans', 'nmap-*.json')].map do |path|
+        JSON.parse(File.read(path), symbolize_names: true).merge(path: path)
+      end
+    end
+
     public_class_method def self.authors
       "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
     end
@@ -147,7 +173,25 @@ module PWN
         #{self}.merge_scan(
           hosts: 'optional - Array of {host, port, service} hashes',
           results: 'optional - alias for hosts',
-          override: 'optional - true records out-of-scope hosts'
+          override: 'optional - true records out-of-scope hosts',
+          engagement: 'optional - engagement identifier (defaults to active)'
+        )
+
+        # Persist a timestamped nmap inventory snapshot under the engagement scans/ dir.
+        #{self}.record_scan(
+          hosts: 'required - inventory host array from NmapIt',
+          ports: 'optional - flattened port rows',
+          xml: 'optional - source nmap XML path',
+          at: 'optional - Time or ISO8601 timestamp of the scan',
+          kind: 'optional - scanner kind (defaults to nmap)',
+          engagement: 'optional - engagement identifier',
+          name: 'optional - alias for engagement'
+        )
+
+        # List persisted nmap snapshots oldest-first.
+        #{self}.scans(
+          name: 'optional - engagement identifier',
+          engagement: 'optional - alias for name'
         )
 
         # Print the AUTHOR(S) string for this module.