pwn 0.5.766 → 0.5.772

data/etc/default_skills/pwn/ai/agent/open_goal/SKILL.md

@@ -35,6 +35,7 @@ PWN::AI::Agent::OpenGoal.goal_file(opts)
 
 - `goal_file`
 - `current`
+- `for_session`
 - `begin`
 - `clear`
 - `resume`

data/etc/default_skills/pwn/ai/agent/skill_review/SKILL.md

@@ -36,6 +36,8 @@ PWN::AI::Agent::SkillReview.review(opts)
 - `review`
 - `review_turn`
 - `note_reuse`
+- `decide`
+- `evidence_transcript`
 - `authors`
 - `help`
 

data/etc/default_skills/pwn/ai/agent/solve/SKILL.md

@@ -28,11 +28,13 @@ Class methods take `(opts = {})` and read `opts`.
 
 ```ruby
 PWN::AI::Agent::Solve.help
-PWN::AI::Agent::Solve.help(opts)
+PWN::AI::Agent::Solve.apply_patch(opts)
 ```
 
 ## Public methods
 
+- `apply_patch`
+- `cleanup_worktree`
 - `authors`
 - `help`
 
@@ -42,5 +44,5 @@ PWN::AI::Agent::Solve.help(opts)
 
 ## Verification
 
-`PWN::AI::Agent::Solve.respond_to?(:authors)` after the
+`PWN::AI::Agent::Solve.respond_to?(:apply_patch)` after the
 module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/ai/context_ingestion/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::AI::Context
 
-Local evidence ingestion; unavailable embeddings never become synthetic vectors.
+Local evidence ingestion; XML is bounded to 100 element levels before XPath. Unavailable embeddings never become synthetic vectors.
 
 ## When to use
 

data/etc/default_skills/pwn/ai/http_retry/SKILL.md

@@ -35,6 +35,7 @@ PWN::AI::HttpRetry.timeout_s(opts)
 
 - `timeout_s`
 - `max_attempts`
+- `provider_config`
 - `retryable`
 - `retry_after_s`
 - `quota_exhausted`

data/etc/default_skills/pwn/plugins/repl/ai_console/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::Plugins::REPL::AIConsole
 
-Single-owner fullscreen agent console. Workers never paint the terminal.
+Single-owner fullscreen console: wrapped completion and private /vault edit; Ctrl+S saves encrypted, Esc cancels.
 
 ## When to use
 

data/etc/default_skills/pwn/plugins/repl/mesh/SKILL.md

@@ -37,6 +37,10 @@ PWN::Plugins::REPL::Mesh.add_commands(opts)
 - `authors`
 - `help`
 
+## References
+
+- `references/urls.md` — URLs from source
+
 ## Source
 
 `pwn/plugins/repl/mesh.rb`

data/etc/default_skills/pwn/plugins/repl/mesh/references/urls.md

@@ -0,0 +1,3 @@
+# PWN::Plugins::REPL::Mesh source links
+
+- https://maps.google.com/?q=[redacted]

data/etc/default_skills/pwn/redaction/SKILL.md

@@ -12,7 +12,7 @@ metadata:
 
 # PWN::Redaction
 
-Shared write-boundary redaction. Never opens a credential store.
+Write-boundary redaction; reject cyclic or over-100-level containers before inspecting secrets. Never opens a credential store.
 
 ## When to use
 

data/etc/default_skills/pwn/runtime_fingerprint/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-runtimefingerprint
+description: Drive PWN::RuntimeFingerprint from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::RuntimeFingerprint
+  source: pwn/runtime_fingerprint.rb
+---
+
+# PWN::RuntimeFingerprint
+
+Read-only deployment diagnostics. A disk observation at compilation is not an attestation of VM bytecode, native extensions, or later monkey patches.
+
+## When to use
+
+Call `PWN::RuntimeFingerprint` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/runtime_fingerprint.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::RuntimeFingerprint.help
+PWN::RuntimeFingerprint.report(opts)
+```
+
+## Public methods
+
+- `report`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/runtime_fingerprint.rb`
+
+## Verification
+
+`PWN::RuntimeFingerprint.respond_to?(:report)` after the
+module is loaded. Read the source for parameter names.

data/lib/pwn/ai/agent/dispatch.rb

@@ -51,6 +51,9 @@ module PWN
           entry = Registry.lookup(name: name) || Registry.lookup(name: repair_name(name: name))
           return JSON.generate(error: "unknown tool: #{name}") unless entry
 
+          owner = Thread.current[:pwn_request_runtime]
+          return JSON.generate(success: false, error: 'request_tool_permission_denied') if owner && !owner.tool_allowed?(name: entry.name, toolset: entry.toolset)
+
           solve_tools = Thread.current[:pwn_solve_tools]
           return JSON.generate(success: false, error: 'Tool denied by solve role capability boundary') if solve_tools && !solve_tools.include?(entry.name.to_s)
 
@@ -123,7 +126,12 @@ module PWN
 
           started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
           begin
-            result = entry.handler.call(args)
+            runtime = Thread.current[:pwn_request_runtime]
+            result = if runtime
+                       runtime.execute_tool(name: entry.name, args: args, effect: effect(name: entry.name, args: args), action_id: tool_call[:id] || tool_call['id']) { entry.handler.call(args) }
+                     else
+                       entry.handler.call(args)
+                     end
           rescue StandardError => e
             finish_budget(budget: budget, result: { error: e.is_a?(Timeout::Error) ? 'timeout' : e.class.name }, elapsed: Process.clock_gettime(Process::CLOCK_MONOTONIC) - started)
             raise
@@ -138,6 +146,7 @@ module PWN
             result = JSON.parse(PWN::Plugins::Vault.redact(text: JSON.generate(result)))
           end
           response = { success: true, result: result, effect: effect(name: entry.name, args: args) }
+          response[:success] = false if result.is_a?(Hash) && (result[:error] || result['error'] || result[:success] == false || result['success'] == false)
           response[:budget] = telemetry if telemetry
           if telemetry && telemetry[:remaining_s].zero?
             response[:success] = false
@@ -207,6 +216,8 @@ module PWN
         private_class_method def self.prepare_budget(opts = {})
           entry = opts[:entry]
           args = opts[:args]
+          return nil if Thread.current[:pwn_request_runtime] && args.key?(:timeout)
+
           if entry.name == 'shell' && (args[:background] == true || (!args.key?(:timeout) && ToolGuard.auto_job?(payload: args[:command].to_s)))
             args[:background] = true
             return nil
@@ -299,15 +310,18 @@ module PWN
 
         private_class_method def self.drop_required(opts = {})
           node = opts[:node]
+          depth = opts.fetch(:depth, 0)
+          raise JSON::NestingError, 'tool schema exceeds JSON nesting limit (100)' if depth >= 100 && (node.is_a?(Hash) || node.is_a?(Array))
+
           case node
           when Hash
             node.each_with_object({}) do |(key, value), acc|
               next if key.to_s == 'required'
 
-              acc[key] = drop_required(node: value)
+              acc[key] = drop_required(node: value, depth: depth + 1)
             end
           when Array
-            node.map { |value| drop_required(node: value) }
+            node.map { |value| drop_required(node: value, depth: depth + 1) }
           else
             node
           end
@@ -514,9 +528,34 @@ module PWN
           learning_note_outcome skill_create skill_add_reference skills_update
         ].freeze
 
+        # Audited local reads only. Resource conflicts deliberately serialize
+        # even two reads of one handle, and every other tool is a barrier.
+        PARALLEL_READS = %w[artifact_read artifact_grep artifacts_get artifact_get job_tail].freeze
+
+        # Supported Method Parameters::
+        # metadata = PWN::AI::Agent::Dispatch.scheduling(
+        #   tool_call: 'required - tool call whose audited read resources are resolved'
+        # )
+        public_class_method def self.scheduling(opts = {})
+          call = opts[:tool_call]
+          name = call.dig(:function, :name).to_s
+          args = call.dig(:function, :arguments)
+          args = JSON.parse(args) if args.is_a?(String)
+          args = args.transform_keys(&:to_s)
+          resource = args['id'] if name == 'job_tail'
+          if PARALLEL_READS.include?(name) && name != 'job_tail'
+            handle = args['handle'] || args['sha256']
+            path = handle ? PWN::Plugins::ArtifactRegistry.resolve(handle: handle)[:path] : args['path'] || args['ref']
+            resource = File.realpath(path) if path
+          end
+          { exclusive: !PARALLEL_READS.include?(name) || resource.to_s.empty?, resources: ["handle:#{resource}"] }
+        rescue JSON::ParserError, NoMethodError, ArgumentError, SystemCallError
+          { exclusive: true, resources: ['*'] }
+        end
+
         public_class_method def self.effect(opts = {})
           name = opts[:name].to_s
-          return :read if name.empty?
+          return :read if PARALLEL_READS.include?(name)
           return :recall if RECALL_TOOLS.include?(name)
           return :store if STORE_TOOLS.include?(name)
 
@@ -525,9 +564,9 @@ module PWN
           return :browse if blob.match?(BROWSE_ARGV_RX)
           return :eval if name == 'pwn_eval'
 
-          :read
+          :exclusive
         rescue StandardError
-          :read
+          :exclusive
         end
 
         private_class_method def self.argv_blob(opts = {})
@@ -632,6 +671,11 @@ module PWN
               call: 'optional - shell{command: uname -s} / tool:shell{command:id}'
             )
 
+            # Resolve audited read resources; unknown tools are exclusive barriers.
+            #{self}.scheduling(
+              tool_call: 'required - tool call with function name and arguments'
+            )
+
             # Run effect and return its result
             #{self}.effect(
               name: 'required - binary or identifier name',