pwn 0.5.761 → 0.5.763

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6748541ed45249f60331d0a819803c7c872527b763806edbcdd601ca30e862dc
-  data.tar.gz: e9f1ff039dafe19a3f250df08896bdf2498f6c5550d28dae4c83e2a071560c58
+  metadata.gz: fec3b367c44874a819aa4892a5b3c507cf858ed4649eb31d295b0509e8747c83
+  data.tar.gz: d8a004b8eee5f7bd996ae8c9208f895d93354b09f9149050cb3e93d8632fda8c
 SHA512:
-  metadata.gz: 4c07ed5325a0db30c3933f8157e72b65e1f1ff3428e1944fb43f5809390cc647486fd9ed36b76c3986a2c55f75fba0d49c552ab3a1cb4b6dc1dc1e7669e3615f
-  data.tar.gz: 880e597ef1c96a3cc197bdf56b317f1e0854d17ffafcf7780c6f97ca198bce7dbcda6c971bdf0fba0d2feea29de7794f6e7af1cf9d17d99471e325e19db9582a
+  metadata.gz: 7490168d3e50c940ff771fe6788f7373e89b15f96541a8d0cec29bd13b1cccdce7c377799a415628fcd899a0e912928bf3aeb5fef68c0cf0fda2217871f60d95
+  data.tar.gz: eb50e5646ee60e9394f92139b61c38901303fc6167b06f95cf559a413d88a09dbfa21eadeb1e46e8e9418295d348e53f81a62d4d4f25956ebb0284f7e9c2e572

data/Gemfile

@@ -77,7 +77,7 @@ gem 'rbvmomi2', '3.10.0'
 gem 'rdoc', '7.0.4'
 gem 'rest-client', '2.1.0'
 gem 'rex', '2.0.13'
-gem 'rmagick', '7.1.6'
+gem 'rmagick', '7.1.7'
 gem 'rqrcode', '3.2.0'
 gem 'rspec', '3.13.2'
 gem 'rtesseract', '3.1.4'

data/README.md

@@ -278,12 +278,12 @@ If this project helped you and you want to support the work, keep us caffeinated
 
 ### [**0x004D65726368**](https://0day.myspreadshop.com/) ###
 
-[![PWN Sticker](https://image.spreadshirtmedia.com/image-server/v1/products/T1459A839PA3861PT28D1044068794FS8193/views/1,width=300,height=300,appearanceId=839,backgroundColor=000000/ultimate-hacker-t-shirt-to-convey-to-the-public-a-hackers-favorite-past-time.jpg)](https://0day.myspreadshop.com/stickers)
+[![PWN Sticker](https://image.spreadshirtmedia.com/image-server/v1/products/T1459A839PA3861PT28D1044068794W10000H3537/views/1,width=300,height=300,appearanceId=839,backgroundColor=000000/ultimate-hacker-t-shirt-to-convey-to-the-public-a-hackers-favorite-past-time.jpg)](https://0day.myspreadshop.com/home+%26+living+stickers+%26+magnets)
 
-[![Coffee Mug](https://image.spreadshirtmedia.com/image-server/v1/products/T1313A1PA3933PT10X2Y25D1020472680FS6327/views/3,width=300,height=300,appearanceId=1,backgroundColor=000000/https0dayinccom.jpg)](https://0day.myspreadshop.com/accessories+mugs+%26+drinkware)
+[![Coffee Mug](https://image.spreadshirtmedia.com/image-server/v1/products/T1313A1PA3933PT10X3Y20D1044068794W5491H1942/views/3,width=300,height=300,appearanceId=1,backgroundColor=000000,crop=detail,modelId=11707/ultimate-hacker-t-shirt-to-convey-to-the-public-a-hackers-favorite-past-time.jpg)](https://0day.myspreadshop.com/home+%26+living+mugs+%26+drinkwear)
 
-[![Mouse Pad](https://image.spreadshirtmedia.com/image-server/v1/products/T993A1PA2168PT10X162Y26D1044068794S100/views/1,width=300,height=300,appearanceId=1,backgroundColor=000000/ultimate-hacker-t-shirt-to-convey-to-the-public-a-hackers-favorite-past-time.jpg)](https://0day.myspreadshop.com/accessories)
+[![Mouse Pad](https://image.spreadshirtmedia.com/image-server/v1/products/T993A1PA2168PT10X162Y26D1044068794W6102H2158/views/1,width=300,height=300,appearanceId=1,backgroundColor=000000/ultimate-hacker-t-shirt-to-convey-to-the-public-a-hackers-favorite-past-time.jpg)](https://0day.myspreadshop.com/home+%26+living+other)
 
-[![0day Inc.](https://image.spreadshirtmedia.com/image-server/v1/products/T951A550PA3076PT17X0Y73D1020472680FS8515/views/1,width=300,height=300,appearanceId=70,backgroundColor=000000/https0dayinccom.jpg)](https://shop.spreadshirt.com/0day/0dayinc-A5c3e498cf937643162a01b5f?productType=951&appearance=70)
+[![0day Inc.](https://image.spreadshirtmedia.com/image-server/v1/products/T803A2PA1648PT32X20Y18D1020472680W8807H1441/views/1,width=300,height=300,appearanceId=2,backgroundColor=000000,crop=detail,modelId=1723/https0dayinccom.jpg)](https://0day.myspreadshop.com/0dayinc-A5c3e498cf937643162a01b5f?productType=803&sellable=1naaRYxY1zhOoQlv7Mdg-803-34&appearance=2&size=29)
 
-[![Black Fingerprint Hoodie](https://image.spreadshirtmedia.com/image-server/v1/products/T111A2PA3208PT17X169Y51D1020472728FS6268/views/1,width=300,height=300,appearanceId=2/https0dayinccom.jpg)](https://shop.spreadshirt.com/0day/blackfingerprint-A5c3e49db1cbf3a0b9596b4d0?productType=111&appearance=2)
+[![Black Fingerprint Hoodie](https://image.spreadshirtmedia.com/image-server/v1/products/T111A2PA4247PT17X198Y27D1020472728W12744H19015/views/1,width=300,height=300,appearanceId=5,backgroundColor=000000,crop=detail,modelId=1159/https0dayinccom.jpg)](https://0day.myspreadshop.com/blackfingerprint-A5c3e49db1cbf3a0b9596b4d0?productType=111&sellable=ekXXmGonOyclynglNE87-111-22&appearance=5)

data/documentation/Banner.md

@@ -14,4 +14,22 @@ welcome-banner          # REPL command: redraw a random one
 
 Add your own: drop a module in `lib/pwn/banner/` implementing `self.get`.
 
+## pwn-ai startup pane
+
+The curses console starts with a white miniature derived directly from
+`PWN::Banner::WhiteRabbit.get`, without its dedication or wordmark. The full
+banner remains unchanged. The rabbit is centered and aspect-contained in the
+current pane: small panes use area-filtered 3×6 character strokes packed into
+ordinary 2×4 Braille text dots; when the original ASCII fits, it is displayed
+verbatim, centered without enlargement. This assumes typical 1:2 terminal cells.
+Small panes lose punctuation detail, and Braille dot spacing depends on the font;
+physically tiny panes cannot retain a recognizable rabbit. No image protocol,
+image file, graphics probe or runtime image library is used.
+
+No games or replays are computed until the animation pane first receives focus
+via Ctrl+T/Ctrl+X. That enables games for the console lifetime. Ctrl+G cycles
+games while focused; leaving the pane keeps the existing automatic animation,
+not the startup rabbit. Resizing, modal input priority and the mission draft
+retain their existing behavior. Monochrome terminals keep the same geometry.
+
 [← Home](Home.md)

data/documentation/Swarm.md

@@ -18,6 +18,119 @@ self-improvement loop covers the whole swarm.
 No daemon. Cross-session / cross-process communication == another `pwn-ai` (or
 a `PWN::Cron` job) calling `Swarm.ask` with the same `swarm_id`.
 
+## Run one mission with a built-in team
+
+```text
+/swarm mission Write and test a Ruby function that validates the supplied data format
+```
+
+No persona setup is required. The exact text after `/swarm mission ` remains the
+user request for **every** role; role instructions and JSON handoffs go in system
+context, not a replacement task. Empty requests fail before dispatch. Existing
+`dm`, `broadcast`, and `debate` retain their messaging semantics. `/swarm agents`
+lists available personas; `/swarm dm NAME REQUEST` messages one persona.
+The renamed slash commands replace the previous spellings without compatibility
+aliases. Ruby APIs `Swarm.solve`, `Swarm.ask`, and the `Solve` coordinator are unchanged.
+
+`/menu` and Tab use case-insensitive alphabetical ordering at every depth:
+root commands, command actions, and live parameter lists (including agents,
+jobs, MCP tools, sessions, skills, memory keys, and cron jobs). Exact spelling
+breaks case-insensitive ties; selections keep their original command payloads.
+
+1. **Antagonist** independently enumerates requirements and risks before seeing
+   a candidate. `R0` always contains the entire unchanged original request.
+2. **Protagonist** builds the candidate using the ordinary nested tool-calling
+   `Loop.run` through `Swarm.ask`, then declares relative artifact paths.
+3. **Antagonist** critiques the candidate and returns unresolved objections.
+4. **Verifier** proposes requirement-indexed commands and exact expected stdout.
+   The coordinator executes them via the registered `shell` tool and `Dispatch`,
+   capturing actual stdout, stderr, and exit status. Model-supplied observations
+   are never accepted as execution evidence.
+5. **Integrator** reviews those observations and either accepts or sends a
+   targeted repair to the protagonist. Repairs always repeat critique and tests.
+
+Acceptance additionally requires every requirement ID to have passing executed
+evidence, no open objections, every check to exit zero with its expected output,
+and unchanged artifact hashes and steering revision. A model's `accept` alone
+cannot complete the job. Candidate and handoff revisions are SHA-256-bound;
+changed files, stale handoffs, failed checks, uncovered requirements, malformed
+JSON, provider failures and limits return **INCOMPLETE**, never success. Structured
+records and raw execution observations are saved with owner-only permissions in
+`~/.pwn/swarm/<solve-id>/solve.json`. Every solve gets fresh role sessions, so an
+earlier candidate cannot contaminate the independent initial assessment.
+
+### Console and controls
+
+Open the swarm workspace with **Ctrl+S / Ctrl+G**, keep a mission in the composer,
+then press **v — Mission with team**. Enter confirms the exact draft and built-in
+roles; Esc aborts without changing the draft or cursor. The jobs detail view
+shows actual role phases, original requirements, provider/model routes, artifact
+hashes, and open objections. There is one integrated final result. Provider usage
+continues through the console's existing usage observer (no invented estimates).
+
+```text
+/swarm status JOB
+/swarm steer JOB Add this verification constraint
+/swarm pause JOB
+/swarm resume JOB
+/swarm cancel JOB
+```
+
+The same slash routes work in the legacy line console. Steering belongs to the
+coordinator and is propagated to later roles; it invalidates previously accepted
+candidate evidence without replacing the original goal. Pause stops future
+dispatch at safe boundaries. Cancel interrupts the owned model wait; an already
+running tool finishes first, and its changes are not undone. Another job cannot
+start in the same controller while solve owns the workspace. A workspace file
+lock also excludes overlapping solve coordinators across processes.
+
+### Role configuration and limits
+
+All roles inherit the already selected provider and that provider's configured
+default model. Optional overrides use **existing** persona fields; no new vault
+configuration keys or schema migration is needed:
+
+```text
+/swarm spawn solve_antagonist Review correctness --engine ollama --model YOUR_INSTALLED_MODEL
+```
+
+The other names are `solve_protagonist`, `solve_verifier`, and `solve_integrator`.
+They can also be defined in `agents.yml`. Engine/model overrides are request-local;
+there is no superiority ranking, automatic diversity, or fallback to a different
+provider. Remote credentials must already be configured. Solve never initiates
+OAuth login or prompts for API keys; configured OAuth refresh remains the provider's
+normal noninteractive operation. Implicit local-agent escalation is disabled for
+solve. A missing provider fails visibly rather than silently switching.
+
+Ruby API: `Swarm.solve(request:, workspace: Dir.pwd, rounds: 3, swarm_id: nil,
+steering: nil, on_state: nil, on_tool: nil, usage_observer: nil)`. `swarm_id` supplies
+role overrides; the returned solve ID identifies the independent records. The
+default round limit is 3 (API range 1–10), each role turn is limited to 25 model
+calls, and each of at most 32 checks per round has a 60-second tool timeout.
+
+### Boundaries, not a security sandbox
+
+The protagonist is the only model role with write-capable tools (`shell` and
+`pwn_eval`). Review roles have no tools; Dispatch denies invented tool calls even
+if a provider ignores its empty tool schema. Integrator repairs are dispatched
+back to that one writer. This is role capability enforcement, **not** confinement
+of arbitrary protagonist Ruby or shell code or other processes on the host.
+
+Verification runs in fresh disposable copies of declared regular-file artifacts;
+all test dependencies must be declared. Symlinks/out-of-workspace artifacts are
+rejected, and input copies must retain their candidate hashes after a check.
+Files over 128 KiB cannot currently be passed to full-content review and produce
+an explicit incomplete result. A disposable directory is **not an OS sandbox**:
+test code can use absolute paths, network, installed dependencies and host resources.
+Existing Dispatch confirmation and `ai_sandbox` policies still apply. Use only
+trusted test commands or supply external OS isolation when executing untrusted code.
+
+Requirement extraction and test relevance still require model judgment. Executed
+checks are evidence for their stated assertions, not mathematical proof of an
+arbitrary natural-language goal; the saved commands, outputs, requirements and
+revisions make that judgment inspectable. No live-provider reliability or automatic
+security isolation is implied by the deterministic offline integration tests.
+
 ## Define personas
 
 Each persona accepts optional `engine` and `model` keys. `model` is the exact

data/documentation/pwn-ai-Agent.md

@@ -300,7 +300,7 @@ and Ctrl+D still work. A running tool finishes cooperatively: neither rollback
 nor remote provider billing cancellation is promised. Swarm jobs should use
 noninteractive tools; their individual stdin prompts are not multiplexed.
 
-Typed `/swarm roster|status|create|use|spawn|retire|ask|broadcast|debate|tail|steer|cancel`
+Typed `/swarm agents|mission|status|create|use|spawn|retire|dm|broadcast|debate|tail|steer|pause|resume|cancel`
 commands remain available, including parameter completion. These are direct
 operator commands and do not add the workspace's extra confirmation step.
 `/swarm status JOB` includes retained outcomes. Jobs shown here belong to this

data/etc/default_skills/pwn/ai/agent/solve/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: pwn-ai-agent-solve
+description: Drive PWN::AI::Agent::Solve from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::AI::Agent::Solve
+  source: pwn/ai/agent/solve.rb
+---
+
+# PWN::AI::Agent::Solve
+
+Revision-bound, single-writer team coordinator. Role replies are proposals, never observations. Only host-executed checks can become evidence.
+
+## When to use
+
+Call `PWN::AI::Agent::Solve` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/ai/agent/solve.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::AI::Agent::Solve.help
+PWN::AI::Agent::Solve.help(opts)
+```
+
+## Public methods
+
+- `authors`
+- `help`
+
+## Source
+
+`pwn/ai/agent/solve.rb`
+
+## Verification
+
+`PWN::AI::Agent::Solve.respond_to?(:authors)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/agent/swarm/SKILL.md

@@ -43,6 +43,7 @@ PWN::AI::Agent::Swarm.personas(opts)
 - `ask`
 - `debate`
 - `broadcast`
+- `solve`
 - `map_targets`
 - `fact_record`
 - `facts_prompt`

data/lib/pwn/ai/agent/dispatch.rb

@@ -51,6 +51,9 @@ module PWN
           entry = Registry.lookup(name: name) || Registry.lookup(name: repair_name(name: name))
           return JSON.generate(error: "unknown tool: #{name}") unless entry
 
+          solve_tools = Thread.current[:pwn_solve_tools]
+          return JSON.generate(success: false, error: 'Tool denied by solve role capability boundary') if solve_tools && !solve_tools.include?(entry.name.to_s)
+
           args = parse_args(raw: raw, entry: entry)
           args = alias_known_keys(args: args, entry: entry)
           schema = entry.schema[:parameters] || entry.schema['parameters'] || { type: 'object' }

data/lib/pwn/ai/agent/loop.rb

@@ -1704,6 +1704,8 @@ module PWN
         # export_finetune can later teach the LoRA to NOT need it.
         @escalate_warned = false
         private_class_method def self.escalate(opts = {})
+          return if Thread.current[:pwn_solve_tools]
+
           request    = opts[:request]
           turn_fails = opts[:turn_fails]
           persona    = agent_flag(key: :escalation_persona)
@@ -2058,7 +2060,7 @@ module PWN
           )
 
           runtime = Thread.current[:pwn_request_runtime]
-          if runtime.respond_to?(:call)
+          if runtime.respond_to?(:call) && !Thread.current[:pwn_solve_tools]
             return runtime.call(messages: messages, tools: tools) do |prepared, route|
               invoke_provider_chat(engine: (route || {})[:provider] || active_engine, messages: prepared, tools: tools, model: (route || {})[:model], temp: (route || {})[:temperature])
             end
@@ -3160,6 +3162,16 @@ module PWN
         end
 
         # Commit the returned tool before unwinding, without stale recovery work.
+        # Child handoffs are proposals, never a user completion. Solve owns
+        # the original objective and the final artifact/evidence gate.
+        private_class_method def self.solve_handoff?(opts = {})
+          return false unless opts[:solve_handoff] && Thread.current[:pwn_solve_tools] && Array(opts[:calls]).empty?
+
+          JSON.parse(opts[:text]).is_a?(Hash)
+        rescue JSON::ParserError
+          false
+        end
+
         private_class_method def self.steering_tool_checkpoint!(opts = {})
           opts[:steering]&.checkpoint(messages: opts[:messages], phase: :tool) do
             tc = opts[:tool_call]
@@ -3348,7 +3360,7 @@ module PWN
           trivia = world_knowledge?(request: request)
           catalog = catalog_lookup?(request: request)
           browse = request_need(request: request) == :browse
-          skip_compass = trivia || catalog || no_tools || browse
+          skip_compass = trivia || catalog || no_tools || browse || opts[:solve_handoff]
           # Trivia / catalog / browse do not get an implement-shaped
           # English compass. Inventing "apply code/host changes" there
           # keeps the model on a Navigate task after the page already loaded.
@@ -3372,7 +3384,7 @@ module PWN
           Thread.current[:pwn_plan_predicted] = nil
           cal_state = calibration_state
           force_plan = cal_state[:force_plan]
-          skip_plan = %i[howto recall greeting].include?(intent) || trivia || catalog || no_tools || browse
+          skip_plan = %i[howto recall greeting].include?(intent) || skip_compass
           did_plan = false
           if !skip_plan && (force_plan || agent_flag(key: :plan_first, default: local) || budget_exhaustion_hot?) && !Array(tools).empty?
             predicted = plan_first(messages: messages, request: request, ts_state: ts_state)
@@ -3523,6 +3535,8 @@ module PWN
 
             messages << msg
 
+            return text if solve_handoff?(opts.merge(text: text, calls: calls))
+
             if calls.empty?
               # P28 — refuse polite mid-goal handoffs so multi-step tasks stay autonomous.
               if incomplete_final?(text: text, last_iter: false)
@@ -3650,7 +3664,7 @@ module PWN
                 # P17 — never fork counterfactual when budget fingerprints dominate:
                 # CF is another mini agent loop and is the #1 amplifier of
                 # iteration-budget exhaustion on this host.
-                if count >= thresh && !retryable_execution_failure?(raw: raw) && !escalated && defined?(Curriculum) && !budget_exhaustion_hot?
+                if count >= thresh && !retryable_execution_failure?(raw: raw) && !escalated && defined?(Curriculum) && !budget_exhaustion_hot? && !opts[:solve_handoff]
                   cf = (turn_fails["cf:#{fkey}"] += 1) == 1 ? Curriculum.counterfactual(request: request, name: name, args: args, error: tele[:err] || raw[0, 200], hint: hint) : nil
                   hint = "#{hint}\n[pwn-ai/counterfactual] branch #{cf[:branch]} (score=#{cf[:score].round(2)}): #{cf[:content]}" if cf
                 end