pwn 0.5.740 → 0.5.741

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4abf337af5fb9173890e87ee2d6d8523f93f62c6d9453d1fec9431f650f04a3e
-  data.tar.gz: 2639a24b9b3b1895e392b8168a604270b9f43118c743919c7b8348ec8f4dd929
+  metadata.gz: 3eb74de135994d78ce8af6b31729ef0622495f0cbe6ff72ddb5ecce5662a5aa7
+  data.tar.gz: 3f2d855056ef2cce6424ac399393e38492970850baa36fde37419d5e798ca2f8
 SHA512:
-  metadata.gz: e383699557934dab9374bef09204e3e37c0e4b255a3dd3c13ef1597c265fd46b7b71bb79dd8094d2fb42aea71512e01b5a7bce9eae08a3f74d8dfb7639f8ff00
-  data.tar.gz: 6f1aea7cd79a34738923014fbc13024797c614c33e28058ab8b565402f665ccb464aa440c148291a385f4ad6b2617412d42b3c526df5d2f6cdff349149872c9d
+  metadata.gz: 995de4dfb6c55750ed90c2f8c282c4d6ca14e876f41ec207b71aecdc1d162ab69359a20d3d479115c4aea9b9eee7d04d9c3bd1678ff73d1e1c06dbefcbef7c46
+  data.tar.gz: 30c2d6602caa5d1fef740508751d4457d69c7f51d861a6260e57f65251c5050d2425c21dad3e946181aa1776345f413e2a035ec3bcf411ae4eedce21441d61d4

data/Gemfile

@@ -22,7 +22,7 @@ gem 'brakeman', '8.0.6'
 gem 'bson', '5.2.0'
 gem 'bundler', '>=4.0.21'
 gem 'bundler-audit', '>=0.9.3'
-gem 'bunny', '3.3.0'
+gem 'bunny', '3.4.0'
 gem 'colorize', '1.1.0'
 gem 'credit_card_validations', '9.0.0'
 gem 'curses', '1.7.0'

data/etc/default_skills/pwn/plugins/sandbox/driver/SKILL.md

@@ -28,13 +28,20 @@ Class methods take `(opts = {})` and read `opts`.
 
 ```ruby
 PWNSandboxDriver.help
-PWNSandboxDriver.help(opts)
+PWNSandboxDriver.available?(opts)
 ```
 
 ## Public methods
 
 - `authors`
 - `help`
+- `available?`
+- `bounded`
+- `execute`
+- `fuzz`
+- `inside`
+- `main`
+- `snapshot`
 
 ## Source
 

data/lib/pwn/plugins/repl/mesh.rb

@@ -6,6 +6,7 @@ require 'json'
 require 'base64'
 require 'pry'
 require 'reline'
+require 'io/wait'
 
 module PWN
   module Plugins
@@ -134,10 +135,12 @@ module PWN
 
               # Curses owns input and rendering until this command returns to Pry.
               PWN.const_set(:MeshEvents, Queue.new)
-              PWN::Plugins::REPL.send(:mesh_start_rx!, env: meshtastic_env, obj: mesh_obj)
-              PWN::Plugins::REPL.send(:mesh_refresh_ui!, env: meshtastic_env)
-              PWN::Plugins::REPL.send(:mesh_ui_puts, text: 'Ready. /menu opens settings. Incoming channel messages appear here.')
-              PWN::Plugins::REPL.send(:mesh_console_loop, pry: pi)
+              PWN::Plugins::REPL.send(:mesh_capture_output, run: proc {
+                PWN::Plugins::REPL.send(:mesh_start_rx!, env: meshtastic_env, obj: mesh_obj)
+                PWN::Plugins::REPL.send(:mesh_refresh_ui!, env: meshtastic_env)
+                PWN::Plugins::REPL.send(:mesh_ui_puts, text: 'Ready. /menu opens settings. Incoming channel messages appear here.')
+                PWN::Plugins::REPL.send(:mesh_console_loop, pry: pi)
+              })
             rescue StandardError => e
               raise e
             ensure
@@ -146,6 +149,15 @@ module PWN
           end
         end
         PWN_MESH_TRANSPORTS = %i[serial bluetooth tcp mqtt].freeze
+        # meshtastic 0.0.184 loses protobuf defaults in Data#to_h. Empty
+        # decoded data is not an unsupported application payload.
+        EMPTY_DATA_DECODER = Module.new do
+          define_method(:decode_payload) do |opts = {}|
+            return nil if opts[:payload].nil? && opts[:msg_type].nil?
+
+            super(opts)
+          end
+        end
 
         # Meshtastic transport for pwn-mesh: auto (probe order) or a pinned kind.
         class << PWN::Plugins::REPL # rubocop:disable Metrics/ClassLength
@@ -557,6 +569,7 @@ module PWN
 
           # Subscribe for inbound TEXT_MESSAGE_APP frames.
           def mesh_subscribe(opts = {})
+            Meshtastic::MeshInterface.prepend(Mesh::EMPTY_DATA_DECODER) unless Meshtastic::MeshInterface.ancestors.include?(Mesh::EMPTY_DATA_DECODER)
             env = opts[:env] || {}
             obj = opts[:obj]
             psks = opts[:psks]
@@ -1002,7 +1015,13 @@ module PWN
               event = PWN::MeshEvents.pop(true)
               next if event[:obj] && (!PWN.const_defined?(:MeshObj) || !event[:obj].equal?(PWN::MeshObj))
 
-              event[:msg] ? mesh_handle_rx(msg: event[:msg]) : mesh_ui_puts(text: event[:text])
+              if event[:notice]
+                mesh_notice(text: event[:notice])
+              elsif event[:msg]
+                mesh_handle_rx(msg: event[:msg])
+              else
+                mesh_ui_puts(text: event[:text])
+              end
             end
           rescue ThreadError
             nil
@@ -1059,6 +1078,10 @@ module PWN
 
           def mesh_ui_puts(opts = {})
             text = opts[:text].to_s
+            if PWN.const_defined?(:MeshEvents) && text.match?(/warning|error|failed|disconnect|persist skipped|unknown command/i)
+              PWN::MeshEvents << { notice: text }
+              return text
+            end
             if PWN.const_defined?(:MeshRxBodyWin) && PWN.const_defined?(:MeshMutex)
               win = PWN.const_get(:MeshRxBodyWin)
               mutex = PWN.const_get(:MeshMutex)
@@ -1079,6 +1102,79 @@ module PWN
             text
           end
 
+          def mesh_capture_output(opts = {})
+            original_out = $stdout
+            original_err = $stderr
+            input, output = IO.pipe
+            output.sync = true
+            events = PWN::MeshEvents
+            collector = Thread.new do
+              loop do
+                text = input.readpartial(4096)
+                begin
+                  text << input.readpartial(4096) while text.bytesize < 16_384 && input.wait_readable(0.02)
+                rescue EOFError
+                  # Flush the last diagnostic even when the TUI is closing.
+                end
+                events << { notice: text.force_encoding(Encoding::UTF_8).scrub }
+              end
+            rescue IOError
+              nil
+            end
+            $stdout = output
+            $stderr = output
+            opts[:run].call
+          ensure
+            $stdout = original_out
+            $stderr = original_err
+            output&.close
+            collector&.join(1)
+            collector&.kill
+            input&.close
+          end
+
+          def mesh_notice(opts = {})
+            width = [Curses.cols - 2, 80].min
+            lines = mesh_wrap_text(text: opts[:text].to_s, width: [width - 4, 1].max)
+            height = [lines.size + 5, Curses.lines - 2].min
+            win = Curses::Window.new(height, width, (Curses.lines - height) / 2, (Curses.cols - width) / 2)
+            win.keypad(true)
+            offset = 0
+            loop do
+              win.erase
+              mesh_box!(win: win)
+              win.setpos(0, 2)
+              win.attron(Curses.color_pair(20) | Curses::A_BOLD)
+              win.addstr(' NOTICE ')
+              win.attroff(Curses.color_pair(20) | Curses::A_BOLD)
+              lines.drop(offset).first([height - 4, 1].max).each_with_index do |line, index|
+                win.setpos(index + 1, 2)
+                win.addstr(line)
+              end
+              win.setpos(height - 2, (width - 2) / 2)
+              win.attron(Curses.color_pair(20) | Curses::A_BOLD | Curses::A_REVERSE)
+              win.addstr('Ok')
+              win.attroff(Curses.color_pair(20) | Curses::A_BOLD | Curses::A_REVERSE)
+              win.refresh
+              key = opts[:getch] ? opts[:getch].call : win.getch
+              break if [10, 13, "\n", "\r", Curses::KEY_ENTER].include?(key)
+
+              offset = [offset - 1, 0].max if key == Curses::KEY_UP
+              offset += 1 if key == Curses::KEY_DOWN && offset < lines.size - (height - 4)
+            end
+          ensure
+            win&.close
+            %i[MeshRxHeaderWin MeshRxFrameWin MeshRxBodyWin MeshTxWin].each do |name|
+              next unless PWN.const_defined?(name)
+
+              pane = PWN.const_get(name)
+              pane.touch
+              pane.refresh
+            end
+          end
+
+          private :mesh_capture_output, :mesh_notice
+
           # Drop the submitted TX buffer so the next prompt is empty (Reline keeps the old line).
           def mesh_reset_input!(opts = {})
             return opts if PWN.const_defined?(:MeshEvents)
@@ -1264,7 +1360,25 @@ module PWN
             psks = mesh_active_psks(env: env) if psks.empty?
             PWN.const_set(:MeshRxState, { last_from: nil, last_line: nil }) unless PWN.const_defined?(:MeshRxState)
             events = PWN.const_defined?(:MeshEvents) ? PWN::MeshEvents : Queue.new
+            kind = mesh_bound_transport(env: env)
+            interval = Float(opts.fetch(:heartbeat_interval, 30))
+            raise ArgumentError, 'heartbeat interval must be positive and finite' unless interval.positive? && interval.finite?
+
             thread = Thread.new do
+              heartbeat = if obj.is_a?(Hash) && %i[serial bluetooth tcp].include?(kind)
+                            Thread.new do
+                              transport = { serial: Meshtastic::Serial, bluetooth: Meshtastic::Bluetooth, tcp: Meshtastic::TCP }.fetch(kind)
+                              bytes = Meshtastic::ToRadio.new(heartbeat: Meshtastic::Heartbeat.new(nonce: 0)).to_proto
+                              loop do
+                                break if obj[:closing]
+
+                                transport.send_to_radio({ "#{kind}_obj": obj, to_radio: bytes })
+                                sleep interval
+                              end
+                            rescue StandardError => e
+                              events << { text: "RX keepalive failed: #{e.class}: #{e.message}", obj: obj }
+                            end
+                          end
               mesh_subscribe(
                 env: env,
                 obj: obj,
@@ -1276,6 +1390,9 @@ module PWN
               events << { text: 'RX stopped: transport stream closed. Use /transport to reconnect.', obj: obj }
             rescue StandardError => e
               events << { text: "RX failed: #{e.class}: #{e.message}", obj: obj }
+            ensure
+              heartbeat&.kill
+              heartbeat&.join
             end
             PWN.send(:remove_const, :MeshSubThread) if PWN.const_defined?(:MeshSubThread)
             PWN.const_set(:MeshSubThread, thread)
@@ -1546,13 +1663,17 @@ module PWN
             if decoded[:emoji].to_i.zero?
               messages[[scope, id]] = { from: opts[:from], text: text } if id.positive?
               messages.shift while messages.size > 1000
-              return text
+              return text unless decoded[:reply_id].to_i.positive?
             end
 
             original = messages[[scope, decoded[:reply_id].to_i]]
             original ||= mesh_reaction_original(reply_id: decoded[:reply_id], index: opts[:index])
             target = original ? "#{original[:from]} >> #{original[:text]}" : "original message unavailable (packet #{decoded[:reply_id].to_i})"
-            "Reacted to: \"#{target}\" with: #{text}."
+            if decoded[:emoji].to_i.positive?
+              "Reacted to: \"#{target}\" with: #{text}."
+            else
+              "Replied to: \"#{target}\" with: #{text}"
+            end
           end
 
           def mesh_reaction_original(opts = {})
@@ -2058,7 +2179,7 @@ module PWN
             end
             true
           rescue StandardError => e
-            warn "[pwn-mesh] persist skipped: #{e.class}: #{e.message}"
+            mesh_ui_puts(text: "[pwn-mesh] persist skipped: #{e.class}: #{e.message}")
             false
           end
 

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.740'
+  VERSION = '0.5.741'
 end

data/spec/lib/pwn/plugins/repl_mesh_channel_route_spec.rb

@@ -80,6 +80,10 @@ describe PWN::Plugins::REPL, 'mesh packet channel routing' do
       expect(win).to have_received(:addstr).with(" Reacted to: \"!aabbccdd >> Meet at noon\" with: 👍.\n")
       expect(win).to have_received(:attron).with((local ? 23 : 21) | Curses::A_BOLD).at_least(:once)
       expect(described_class).to have_received(:mesh_maybe_dispatch_to_pwn_ai).once
+      reply = Meshtastic::MeshPacket.new(id: 125, from: 0xb0b, to: 0xffffffff, channel: 1,
+                                         decoded: { portnum: :TEXT_MESSAGE_APP, payload: 'See you there!', reply_id: 123 }).to_h
+      described_class.send(:mesh_handle_rx, local: local, msg: { packet: reply })
+      expect(win).to have_received(:addstr).with(" Replied to: \"!aabbccdd >> Meet at noon\" with: See you there!\n")
     end
   end
 
@@ -140,6 +144,8 @@ describe PWN::Plugins::REPL, 'mesh packet channel routing' do
     text = described_class.send(:mesh_reaction_text, packet: packet, text: '👍', channel: 'LongFast', index: 1)
     expect(text).to eq('Reacted to: "original message unavailable (packet 999)" with: 👍.')
     packet[:decoded][:emoji] = 0
+    expect(described_class.send(:mesh_reaction_text, packet: packet, text: 'Reply')).to eq('Replied to: "original message unavailable (packet 999)" with: Reply')
+    packet[:decoded].delete(:reply_id)
     expect(described_class.send(:mesh_reaction_text, packet: packet, text: '👍')).to eq('👍')
   end
 

data/spec/lib/pwn/plugins/repl_mesh_history_spec.rb

@@ -1,8 +1,130 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'meshtastic'
 
 describe PWN::Plugins::REPL, 'mesh compose history' do
+  it 'does not warn when the real subscriber sees an empty protobuf Data message' do
+    stub_const('PWN::MeshTransport', :serial)
+    queue = Queue.new
+    encoded = Meshtastic::FromRadio.new(packet: { decoded: Meshtastic::Data.new }).to_proto
+    queue << Meshtastic::FromRadio.decode(encoded)
+    queue << Meshtastic::FromRadio.new(queueStatus: { free: 1 })
+    queue.close
+    received = []
+    output = StringIO.new
+    old = $stdout
+    $stdout = output
+    described_class.send(:mesh_subscribe, obj: { from_radio_queue: queue }, psks: {}, on_message: proc { |message| received << message })
+    expect(received.size).to eq(2)
+    expect(output.string).not_to include("Can't decode")
+    Meshtastic::MeshInterface.new.decode_payload(payload: 'unsupported', msg_type: :PRIVATE_APP)
+    expect(output.string).to include("Can't decode", 'unsupported')
+  ensure
+    $stdout = old
+  end
+
+  it 'queues warnings for acknowledgement instead of writing through the TUI' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    expect(described_class).not_to receive(:puts)
+    described_class.send(:mesh_ui_puts, text: 'WARNING: fixture warning')
+    expect(events.pop(true)).to eq(notice: 'WARNING: fixture warning')
+  end
+
+  it 'displays queued diagnostics on the UI thread' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    events << { notice: 'RX failed: fixture' }
+    expect(described_class).to receive(:mesh_notice).with(text: 'RX failed: fixture')
+    described_class.send(:mesh_drain_events)
+  end
+
+  it 'captures dependency stdout and stderr and restores both streams on failure' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    original = [$stdout, $stderr]
+    expect do
+      described_class.send(:mesh_capture_output, run: proc {
+        puts 'WARNING: decoder fixture'
+        warn 'ERROR: transport fixture'
+        raise IOError, 'fixture'
+      })
+    end.to raise_error(IOError, 'fixture')
+    expect([$stdout, $stderr]).to eq(original)
+    output = []
+    output << events.pop(true)[:notice] until events.empty?
+    expect(output.join).to include('WARNING: decoder fixture', 'ERROR: transport fixture')
+  end
+
+  it 'centers a reverse-colored Ok button and repaints the underlying panes' do
+    win = double('notice', maxx: 78, maxy: 6)
+    %i[keypad erase setpos addstr refresh close attron attroff].each { |method| allow(win).to receive(method) }
+    allow(Curses).to receive(:color_pair).with(20).and_return(5120)
+    allow(Curses).to receive(:cols).and_return(80)
+    allow(Curses).to receive(:lines).and_return(24)
+    allow(Curses::Window).to receive(:new).and_return(win)
+    pane = double('pane', touch: nil, refresh: nil)
+    stub_const('PWN::MeshTxWin', pane)
+    keys = ["\e", 'q', "\n"]
+    described_class.send(:mesh_notice, text: 'Decoder warning', getch: proc { keys.shift })
+    expect(keys).to be_empty
+    expect(win).to have_received(:addstr).with('Ok').exactly(3).times
+    expect(win).not_to have_received(:addstr).with(a_string_matching(/Acknowledged|Enter/))
+    expect(win).to have_received(:setpos).with(4, 38).exactly(3).times
+    expect(win).to have_received(:attron).with(5120 | Curses::A_BOLD | Curses::A_REVERSE).exactly(3).times
+    expect(win).to have_received(:attroff).with(5120 | Curses::A_BOLD | Curses::A_REVERSE).exactly(3).times
+    expect(win).to have_received(:close)
+    expect(pane).to have_received(:touch)
+  end
+
+  it 'keeps an idle PhoneAPI session alive and stops its heartbeat with the subscriber' do
+    events = Queue.new
+    beats = Queue.new
+    release = Queue.new
+    obj = {}
+    stub_const('PWN::MeshEvents', events)
+    stub_const('PWN::MeshObj', obj)
+    stub_const('PWN::MeshTransport', :serial)
+    allow(Meshtastic::Serial).to receive(:send_to_radio) do |args|
+      beats << [Thread.current, Meshtastic::ToRadio.decode(args[:to_radio])]
+    end
+    allow(described_class).to receive(:mesh_subscribe) do |args|
+      release.pop
+      args[:on_message].call(packet: { decoded: { portnum: 1, payload: 'after idle' } })
+    end
+    thread = described_class.send(:mesh_start_rx!, env: { channel: {} }, obj: obj, heartbeat_interval: 0.01)
+    first = beats.pop(timeout: 1)
+    second = beats.pop(timeout: 1)
+    expect(first).not_to be_nil
+    expect(second).not_to be_nil
+    expect(second.last.payload_variant).to eq(:heartbeat)
+    expect(second.last.heartbeat.nonce).to eq(0)
+    release << true
+    expect(thread.join(1)).to eq(thread)
+    expect(first.first).not_to be_alive
+    expect(events.pop[:msg].dig(:packet, :decoded, :payload)).to eq('after idle')
+  ensure
+    thread&.kill
+    thread&.join(1)
+  end
+
+  it 'drains incoming messages during idle input polls without a keypress' do
+    pi = double('pry', config: double('config', pwn_mesh: true))
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    message = { packet: { decoded: { portnum: 1, payload: 'idle RX' } } }
+    polls = 0
+    allow(described_class).to receive(:mesh_draw_input)
+    expect(described_class).to receive(:mesh_handle_rx).with(msg: message)
+    reader = proc do
+      polls += 1
+      events << { msg: message } if polls == 20
+      polls > 20 ? "\u0004" : nil
+    end
+    described_class.send(:mesh_console_loop, pry: pi, getch: reader)
+  end
+
   it 'recalls submissions with Up/Down and restores the unfinished draft and cursor' do
     config = double('config', pwn_mesh: true)
     pry = double('pry', config: config)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.740
+  version: 0.5.741
 platform: ruby
 authors:
 - 0day Inc.
@@ -169,14 +169,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.3.0
+        version: 3.4.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.3.0
+        version: 3.4.0
 - !ruby/object:Gem::Dependency
   name: colorize
   requirement: !ruby/object:Gem::Requirement