pwn 0.5.771 → 0.5.772

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a5ecce60b421a59e80f691710dd5ae25cd79d083b59207b25baccf8fe8e5b35
-  data.tar.gz: 725ceb379d5436565b707e29d26e61e9cc10262b31e7cec537aec0e210d77fea
+  metadata.gz: c44656eba8412dd81f267cedd8f40d1954a9f51e528dddb1cc801084dff4d6b7
+  data.tar.gz: 2d3416bf7961deffcb1392bb2a18982bfacb944f9ca70724fb8e5b1d3b0e9eff
 SHA512:
-  metadata.gz: b94c6d9ca4ebb2cf3835ed1f6951a15eae48e3484966e272861105a1c361964fd90235731e8c9ccfd10cfa03af736b42d69edb990b17aed37cd1c1504954ed11
-  data.tar.gz: 39dd6eac404a8f55906c56f9dda74836bd9b934374eea9a8168d556b383ccfd69722b1a16debc893d20a0e58f37adfce54da11fef999a0666bf4f9a4f2258863
+  metadata.gz: d5c9dd294819d01c2c00878a96a911ef2f3964c112e5dcbc81bf46a4779ca476d433de0b5e9abdd2de25cfed8cf4eabb3581db6524ebbce06376b3924c73b667
+  data.tar.gz: 4f2e0a4f58d32a69a23a2f3226c1eb6a041ce45f1244a2d57f6b40b12d1376bd843e25df82487edb23e8859856ccd2e81e9f2b35fcf856948d82b670492f2a96

data/documentation/pwn-ai-Agent.md

@@ -336,15 +336,22 @@ OpenAI options come from the model catalog's `supported_reasoning_levels` and
 while typing. When metadata is absent, explicit documented GPT-5, GPT-5.1/5.2/
 5.4/5.5 and GPT-6 Astra API contracts provide fallback options. Astra never offers
 `none`. Grok 3 Mini and Grok 4.5/4.6/4.7 use their documented effort levels.
-Unknown models without capability metadata and Anthropic, Gemini, Ollama and
-OpenWebUI do not offer an effort list: those adapters do not consume this effort
-setting (their thinking controls, where present, are different).
+Anthropic prompts for documented effort models and sends `output_config.effort`
+with adaptive thinking. Gemini 3 and Gemini 4 prompt for `thinkingLevel`; Gemini
+2.5 stays on its thinking budget and is not an effort menu. Ollama and Open WebUI
+prompt only when `/api/show` (or the proxied `ollama/api/show`) publishes named
+`thinking.values`. Boolean on/off thinking is not an effort list. Unknown models
+without that metadata do not offer a list.
 
 Acceptance merges `ai.active`, the selected engine's `model` and its existing
 `reasoning_effort` field into the encrypted vault; other settings are retained.
-Missing decryptor files leave changes session-only. No schema migration is needed.
-Capability references: [OpenAI model pages](https://developers.openai.com/api/docs/models),
-[xAI reasoning](https://docs.x.ai/developers/model-capabilities/text/reasoning).
+Missing decryptor files leave changes session-only. Schema 10 backfills a missing
+`reasoning_effort` key for Anthropic, Gemini, Ollama, and Open WebUI without
+replacing an existing value. Capability references: [OpenAI model pages](https://developers.openai.com/api/docs/models),
+[xAI reasoning](https://docs.x.ai/developers/model-capabilities/text/reasoning),
+[Anthropic effort](https://platform.claude.com/docs/en/build-with-claude/effort),
+[Gemini thinking](https://ai.google.dev/gemini-api/docs/generate-content/thinking),
+[Ollama thinking](https://docs.ollama.com/capabilities/thinking).
 
 Settings and new requests are rejected while a request is running, rather than
 mutating its context concurrently. Network-capable local commands (`/mcp`,

data/lib/pwn/ai/anthropic.rb

@@ -567,6 +567,7 @@ module PWN
       #   model: 'optional - overrides PWN::Env[:ai][:anthropic][:model]',
       #   temp: 'optional - temperature (defaults to PWN::Env[:ai][:anthropic][:temp] || 1)',
       #   max_tokens: 'optional - defaults to PWN::Env[:ai][:anthropic][:max_tokens] || 128_000',
+      #   reasoning_effort: 'optional - output_config.effort when the model supports it',
       #   timeout: 'optional - seconds (default 900)',
       #   spinner: 'optional - display spinner (default false)'
       # )
@@ -613,6 +614,11 @@ module PWN
           end
           http_body[:tool_choice] = anth_tool_choice(choice: opts[:tool_choice], model: model) if opts[:tool_choice]
         end
+        effort = opts[:reasoning_effort].to_s
+        if !effort.empty? && effort != 'none' && reasoning_efforts(model: model)[:efforts].include?(effort)
+          http_body[:output_config] = { effort: effort }
+          http_body[:thinking] = { type: 'adaptive' } unless opts[:think] == false
+        end
 
         response = anthropic_rest_call(
           http_method: :post,
@@ -828,6 +834,41 @@ module PWN
         }
       end
 
+      private_class_method def self.reasoning_efforts(opts = {})
+        model = opts[:model].to_s.downcase
+        stamp = '(?:-\d{8})?(?:\z|-)'
+        return { efforts: [], default: nil } unless model.match?(/\Aclaude-/i)
+
+        patterns = [
+          /claude-opus-4-[5-8]#{stamp}/i,
+          /claude-sonnet-4-6#{stamp}/i,
+          /claude-(?:opus|sonnet)-5(?:-5)?#{stamp}/i,
+          /claude-haiku-5-5#{stamp}/i,
+          /claude-fable-5(?:-1)?#{stamp}/i,
+          /claude-mythos-(?:5(?:-1)?|preview)#{stamp}/i
+        ]
+        return { efforts: [], default: nil } unless patterns.any? { |pattern| model.match?(pattern) }
+
+        efforts = %w[low medium high]
+        newer = [
+          /claude-opus-4-[78]#{stamp}/i,
+          /claude-(?:opus|sonnet)-5(?:-5)?#{stamp}/i,
+          /claude-haiku-5-5#{stamp}/i,
+          /claude-fable-5(?:-1)?#{stamp}/i,
+          /claude-mythos-(?:5(?:-1)?|preview)#{stamp}/i
+        ]
+        efforts << 'xhigh' if newer.any? { |pattern| model.match?(pattern) }
+        claude5 = [
+          /claude-(?:opus|sonnet)-5(?:-5)?#{stamp}/i,
+          /claude-haiku-5-5#{stamp}/i,
+          /claude-fable-5(?:-1)?#{stamp}/i,
+          /claude-mythos-(?:5(?:-1)?|preview)#{stamp}/i
+        ]
+        efforts << 'max' if claude5.any? { |pattern| model.match?(pattern) }
+        default = model.match?(/claude-(?:opus-5-5|haiku-5-5)#{stamp}/i) ? 'medium' : 'high'
+        { efforts: efforts, default: default }
+      end
+
       private_class_method def self.anth_tool_choice(opts = {})
         choice = opts[:choice]
         mapped = case choice
@@ -1023,6 +1064,8 @@ module PWN
             model: 'optional - overrides PWN::Env[:ai][:anthropic][:model]',
             temp: 'optional - temperature (defaults to PWN::Env[:ai][:anthropic][:temp] || 1)',
             max_tokens: 'optional - defaults to PWN::Env[:ai][:anthropic][:max_tokens] || 128_000',
+            reasoning_effort: 'optional - output_config.effort when the model supports it',
+            think: 'optional - false omits adaptive thinking when an effort is set',
             timeout: 'optional - seconds (default 900)',
             spinner: 'optional - display spinner (default false)'
           )

data/lib/pwn/ai/gemini.rb

@@ -213,7 +213,8 @@ module PWN
             maxOutputTokens: opts[:max_tokens] || 8192
           }
         }
-        http_body[:generationConfig][:thinkingConfig] = { includeThoughts: true } unless opts[:think] == false
+        thinking = gemini_thinking_config(model: model, think: opts[:think], reasoning_effort: opts[:reasoning_effort])
+        http_body[:generationConfig][:thinkingConfig] = thinking if thinking
         if system_str && !system_str.empty?
           if defined?(PWN::AI::Agent::PromptCache) &&
              PWN::AI::Agent::PromptCache.enabled?(engine: :gemini)
@@ -369,6 +370,29 @@ module PWN
         }
       end
 
+      private_class_method def self.reasoning_efforts(opts = {})
+        model = opts[:model].to_s.downcase
+        return { efforts: [], default: nil } unless model.match?(/\Agemini-[34]/)
+        return { efforts: [], default: nil } if model.match?(/embed|imagen|veo|aqa|tts/)
+
+        if model.include?('flash')
+          { efforts: %w[minimal low medium high], default: model.include?('flash-lite') ? 'minimal' : 'medium' }
+        else
+          { efforts: %w[low medium high], default: 'medium' }
+        end
+      end
+
+      private_class_method def self.gemini_thinking_config(opts = {})
+        return nil if opts[:think] == false && opts[:reasoning_effort].to_s.empty?
+
+        config = {}
+        config[:includeThoughts] = true unless opts[:think] == false
+        effort = opts[:reasoning_effort].to_s
+        known = reasoning_efforts(model: opts[:model])[:efforts]
+        config[:thinkingLevel] = effort if known.include?(effort)
+        config.empty? ? nil : config
+      end
+
       private_class_method def self.gemini_tool_config(opts = {})
         choice = opts[:choice]
         case choice
@@ -509,7 +533,8 @@ module PWN
             max_tokens: 'optional - maxOutputTokens (defaults to 8192)',
             timeout: 'optional - seconds (default 900)',
             spinner: 'optional - display spinner (default false)',
-            think: 'optional - true includes Gemini thought parts (default true; false disables)'
+            think: 'optional - true includes Gemini thought parts (default true; false disables)',
+            reasoning_effort: 'optional - thinkingLevel when the model supports named levels'
           )
 
           # Run chat and return its result

data/lib/pwn/ai/grok.rb

@@ -153,7 +153,6 @@ module PWN
       # bearer lives in-session only.
       private_class_method def self.persist_oauth_to_vault(opts = {})
         oauth = opts[:oauth]
-        return false if Thread.current[:pwn_request_runtime]
         return false unless oauth.is_a?(Hash)
         return false unless real_config_value?(value: oauth[:bearer_token])
 
@@ -230,9 +229,9 @@ module PWN
       #   2. User opens verification_uri_complete in a browser and approves.
       #   3. Poll POST /oauth2/token (grant_type=device_code) until access_token.
       #
-      # On success the access_token + refresh_token are written back into the
-      # passed opts/oauth Hash (so PWN::Env[:ai][:grok][:oauth] is live-cached)
-      # and the operator is told exactly what to persist via pwn-vault.
+      # On success the access_token + refresh_token are written into the live
+      # request runtime (provider_config is a copy) and into the encrypted
+      # vault when the decryptor is present. Tokens are not printed.
       public_class_method def self.obtain_oauth_bearer_token(opts = {})
         client_id = real_config_value?(value: opts[:client_id]) ? opts[:client_id] : XAI_OAUTH_CLIENT_ID
         scope     = real_config_value?(value: opts[:scope])     ? opts[:scope]     : XAI_OAUTH_SCOPE
@@ -318,14 +317,14 @@ module PWN
         opts[:refresh_token] = refresh_token if refresh_token
         opts[:expires_at]    = Time.now.to_i + data['expires_in'].to_i if data['expires_in']
 
+        # provider_config returns a Marshal copy. Mutating that copy does not
+        # survive the next hop, so a dead vault refresh token is reused and
+        # the device flow starts again.
+        sync_oauth_into_env(oauth: opts)
+        persisted = persist_oauth_to_vault(oauth: opts)
+
         puts "\n[*] SUCCESS: xAI Grok OAuth bearer obtained via device_code grant."
-        puts '    Cached in-memory for this pwn / pwn-ai process.'
-        puts ''
-        puts '    TO MAKE THIS PERMANENT (recommended -- one-time), store via pwn-vault:'
-        puts "      ai.grok.oauth.refresh_token = #{refresh_token}" if refresh_token
-        puts "      ai.grok.oauth.bearer_token  = #{access_token}"
-        puts '    On future runs the refresh_token alone is enough -- PWN::AI::Grok will'
-        puts '    silently exchange it for a fresh access_token (no browser, no prompt).'
+        puts(persisted ? '    Tokens saved to the encrypted vault; future sessions can refresh automatically.' : '    Tokens available in this session only; encrypted vault persistence was unavailable.')
         puts ''
 
         access_token

data/lib/pwn/ai/ollama.rb

@@ -582,6 +582,42 @@ module PWN
         false
       end
 
+      private_class_method def self.thinking_controls(opts = {})
+        name = opts[:model].to_s.strip
+        return { efforts: [], default: nil } if name.empty?
+
+        names = [name]
+        names << "#{name}:latest" unless name.include?(':')
+        names.each do |candidate|
+          raw = ollama_rest_call(
+            http_method: :post, rest_call: 'api/show',
+            http_body: { model: candidate }, timeout: 8, quiet: true, non_interactive: true
+          )
+          parsed = raw.is_a?(Hash) ? raw : JSON.parse(raw.to_s)
+          thinking = parsed[:thinking] || parsed['thinking']
+          next unless thinking.is_a?(Hash)
+
+          values = Array(thinking[:values] || thinking['values'])
+          efforts = values.map(&:to_s).reject { |value| %w[true false].include?(value.downcase) }
+          next if efforts.empty?
+
+          default = (thinking[:default] || thinking['default']).to_s
+          default = nil unless efforts.include?(default)
+          return { efforts: efforts, default: default }
+        end
+        { efforts: [], default: nil }
+      rescue StandardError
+        { efforts: [], default: nil }
+      end
+
+      private_class_method def self.think_wire(opts = {})
+        effort = opts[:reasoning_effort].to_s
+        return false if opts[:think] == false || %w[none false].include?(effort)
+        return true if effort.empty? || effort == 'true'
+
+        effort
+      end
+
       # Supported Method Parameters::
       # response = PWN::AI::Ollama.chat_with_tools(
       #   messages: 'required - full OpenAI-format messages array (system/user/assistant/tool)',
@@ -634,7 +670,7 @@ module PWN
           http_body[:format] = fmt unless fmt.nil? || fmt.to_s.empty?
         end
         http_body[:tool_choice] = opts[:tool_choice] if opts[:tool_choice]
-        http_body[:think] = true unless opts[:think] == false
+        http_body[:think] = think_wire(reasoning_effort: opts[:reasoning_effort], think: opts[:think])
 
         response = ollama_rest_call(
           http_method: :post,
@@ -800,7 +836,8 @@ module PWN
             temp: 'optional - temperature (defaults to PWN::Env[:ai][:ollama][:temp] || 1)',
             timeout: 'optional - seconds (default 900)',
             spinner: 'optional - display spinner (default false)',
-            think: 'optional - true enables Ollama think (default true; false disables)'
+            think: 'optional - true enables Ollama think (default true; false disables)',
+            reasoning_effort: 'optional - think level from /api/show thinking.values'
           )
 
           # Run chat and return its result

data/lib/pwn/ai/open_web_ui.rb

@@ -614,6 +614,42 @@ module PWN
         false
       end
 
+      private_class_method def self.thinking_controls(opts = {})
+        name = opts[:model].to_s.strip
+        return { efforts: [], default: nil } if name.empty?
+
+        names = [name]
+        names << "#{name}:latest" unless name.include?(':')
+        names.each do |candidate|
+          raw = openwebui_rest_call(
+            http_method: :post, rest_call: 'ollama/api/show',
+            http_body: { model: candidate }, timeout: 8, quiet: true, non_interactive: true
+          )
+          parsed = raw.is_a?(Hash) ? raw : JSON.parse(raw.to_s)
+          thinking = parsed[:thinking] || parsed['thinking']
+          next unless thinking.is_a?(Hash)
+
+          values = Array(thinking[:values] || thinking['values'])
+          efforts = values.map(&:to_s).reject { |value| %w[true false].include?(value.downcase) }
+          next if efforts.empty?
+
+          default = (thinking[:default] || thinking['default']).to_s
+          default = nil unless efforts.include?(default)
+          return { efforts: efforts, default: default }
+        end
+        { efforts: [], default: nil }
+      rescue StandardError
+        { efforts: [], default: nil }
+      end
+
+      private_class_method def self.think_wire(opts = {})
+        effort = opts[:reasoning_effort].to_s
+        return false if opts[:think] == false || %w[none false].include?(effort)
+        return true if effort.empty? || effort == 'true'
+
+        effort
+      end
+
       # Supported Method Parameters::
       # response = PWN::AI::OpenWebUI.chat_with_tools(
       #   messages: 'required - full OpenAI-format messages array (system/user/assistant/tool)',
@@ -667,7 +703,7 @@ module PWN
           http_body[:format] = fmt unless fmt.nil? || fmt.to_s.empty?
         end
         http_body[:tool_choice] = opts[:tool_choice] if opts[:tool_choice]
-        http_body[:think] = true unless opts[:think] == false
+        http_body[:think] = think_wire(reasoning_effort: opts[:reasoning_effort], think: opts[:think])
 
         response = openwebui_rest_call(
           http_method: :post,
@@ -830,7 +866,8 @@ module PWN
             temp: 'optional - temperature (defaults to PWN::Env[:ai][:openwebui][:temp] || 1)',
             timeout: 'optional - seconds (default 900)',
             spinner: 'optional - display spinner (default false)',
-            think: 'optional - true enables backend think (default true; false disables)'
+            think: 'optional - true enables backend think (default true; false disables)',
+            reasoning_effort: 'optional - think level when the proxied model publishes named levels'
           )
 
           # Run chat and return its result

data/lib/pwn/config.rb

@@ -80,6 +80,7 @@ module PWN
             base_uri: 'optional - Base URI for Ollama server (default http://127.0.0.1:11434)',
             key: 'optional - bearer token only if a reverse-proxy sits in front of Ollama (stock ollama needs none)',
             model: 'required - Ollama model tag to use',
+            reasoning_effort: 'optional - think level published by /api/show',
             embed_model: 'optional - embedding model for PWN::MemoryIndex (default nomic-embed-text)',
             system_role_content: 'You are an ethically hacking Ollama agent.',
             temp: 'optional - Ollama temperature',
@@ -102,6 +103,7 @@ module PWN
             base_uri: 'required - Base URI for Open WebUI - e.g. https://openwebui.local',
             key: 'required - Open WebUI API Key Under Settings >> Account >> JWT Token',
             model: 'required - model id/tag exposed by Open WebUI',
+            reasoning_effort: 'optional - think level when the proxied model publishes named levels',
             embed_model: 'optional - embedding model for PWN::MemoryIndex when ollama direct is unset (default nomic-embed-text)',
             system_role_content: 'You are an ethically hacking Open WebUI agent.',
             temp: 'optional - Open WebUI temperature',
@@ -118,6 +120,7 @@ module PWN
             base_uri: 'optional - Base URI for Anthropic - Use private base OR defaults to https://api.anthropic.com/v1',
             key: 'required - Anthropic API Key',
             model: 'optional - Anthropic model id to use (see provider docs for currently-supported ids)',
+            reasoning_effort: 'optional - output_config.effort when the model supports it',
             system_role_content: 'You are an ethically hacking Anthropic agent.',
             temp: 'optional - Anthropic temperature',
             max_tokens: 'optional - Max output tokens per response (default 8192). Raise if tool calls truncate.',
@@ -145,6 +148,7 @@ module PWN
             base_uri: 'optional - Base URI for Gemini - Use private base OR defaults to https://generativelanguage.googleapis.com/v1beta',
             key: 'required - Google Gemini API Key',
             model: 'optional - Gemini model id to use (see provider docs for currently-supported ids)',
+            reasoning_effort: 'optional - thinkingLevel when the model supports named levels',
             system_role_content: 'You are an ethically hacking Gemini agent.',
             temp: 'optional - Gemini temperature',
             think: true,

data/lib/pwn/migrate.rb

@@ -49,7 +49,7 @@ module PWN
     # Bump this whenever the shape of any file under ~/.pwn changes in a
     # way that requires a one-time transform.  Add the transform as an
     # entry in MIGRATIONS keyed by the NEW schema number.
-    SCHEMA_VERSION = 9
+    SCHEMA_VERSION = 10
 
     OK   = "\e[32mok\e[0m"
     BAD  = "\e[31mFAIL\e[0m"
@@ -265,6 +265,10 @@ module PWN
       9 => lambda { |_root, io|
         io.puts '    · pwn.yaml plugins.meshtastic.channel short_name'
         PWN::Migrate.backfill_vault(io: io)
+      },
+      10 => lambda { |_root, io|
+        io.puts '    · pwn.yaml ai reasoning_effort for anthropic, gemini, ollama, openwebui'
+        PWN::Migrate.backfill_vault(io: io)
       }
     }.freeze
 

data/lib/pwn/plugins/repl/ai.rb

@@ -758,6 +758,22 @@ module PWN
               efforts = %w[low medium high xhigh] if %w[grok-4.6 grok-4.7].include?(model)
               efforts = %w[low medium high] if model == 'grok-4.5'
               efforts = %w[low high] if %w[grok-3-mini grok-3-mini-fast].include?(model)
+            elsif engine == 'anthropic'
+              selection = PWN::AI::Anthropic.send(:reasoning_efforts, model: model)
+              efforts = selection[:efforts]
+              default = selection[:default] || default
+            elsif engine == 'gemini'
+              selection = PWN::AI::Gemini.send(:reasoning_efforts, model: model)
+              efforts = selection[:efforts]
+              default = selection[:default] || default
+            elsif engine == 'ollama'
+              selection = PWN::AI::Ollama.send(:thinking_controls, model: model)
+              efforts = selection[:efforts]
+              default = selection[:default] || default
+            elsif engine == 'openwebui'
+              selection = PWN::AI::OpenWebUI.send(:thinking_controls, model: model)
+              efforts = selection[:efforts]
+              default = selection[:default] || default
             end
             current = PWN::Env.dig(:ai, engine.to_sym, :reasoning_effort).to_s
             efforts.delete('none') if engine == 'openai' && model.start_with?('gpt-6-astra')

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.771'
+  VERSION = '0.5.772'
 end

data/spec/lib/pwn/ai/agent/solve_spec.rb

@@ -320,16 +320,18 @@ RSpec.describe 'Swarm solve' do # rubocop:disable Metrics/BlockLength -- end-to-
     end
 
     it 'reaps a writer command when its role deadline expires' do
+      role_started = nil
       @hook = lambda do |handoff, _answer|
         next unless handoff[:phase] == 'build'
 
         @isolated = handoff[:workspace]
+        role_started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         PWN::AI::Agent::Dispatch.call(tool_call: { function: { name: 'shell', arguments: JSON.generate(command: 'sleep 4', timeout: 5) } })
       end
-      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
       out = PWN::AI::Agent::Swarm.solve(request: 'Write hello', workspace: @workspace, worktree: true, rounds: 1, role_timeout: 1)
       expect(out[:status]).to eq('incomplete')
-      expect(Process.clock_gettime(Process::CLOCK_MONOTONIC) - started).to be < 3
+      # Worktree checkout is outside the role deadline. Time the writer, not setup.
+      expect(Process.clock_gettime(Process::CLOCK_MONOTONIC) - role_started).to be < 3
       expect(File).not_to exist(File.join(@workspace, 'greeting.txt'))
     end
 

data/spec/lib/pwn/ai/grok_spec.rb

@@ -180,4 +180,39 @@ describe PWN::AI::Grok do
     src = File.read(described_class.method(:chat_with_tools).source_location.first)
     expect(src).to match(/HttpRetry\.report_event|Log\.progress/)
   end
+
+  it 'keeps a device grant in the request runtime and does not print the tokens' do
+    runtime = Class.new do
+      def initialize
+        @config = { grok: { oauth: { refresh_token: 'dead-refresh', bearer_token: 'expired-bearer' } } }
+      end
+
+      def provider_config(engine)
+        Marshal.load(Marshal.dump(@config[engine.to_sym] || {}))
+      end
+
+      def update_provider_oauth(engine, oauth)
+        @config[engine.to_sym][:oauth] = Marshal.load(Marshal.dump(oauth))
+        :updated
+      end
+    end.new
+    Thread.current[:pwn_request_runtime] = runtime
+    allow(described_class).to receive(:sleep)
+    allow(described_class).to receive(:persist_oauth_to_vault).and_return(false)
+    allow(RestClient).to receive(:post).and_return(
+      double(body: { device_code: 'dev', user_code: 'CODE', verification_uri: 'https://example.invalid/device', interval: 0, expires_in: 30 }.to_json),
+      double(body: { access_token: 'new-access', refresh_token: 'new-refresh', expires_in: 3600 }.to_json)
+    )
+    output = StringIO.new
+    original = $stdout
+    $stdout = output
+    copy = runtime.provider_config(:grok)[:oauth]
+    expect(described_class.obtain_oauth_bearer_token(copy)).to eq('new-access')
+    expect(runtime.provider_config(:grok)[:oauth]).to include(bearer_token: 'new-access', refresh_token: 'new-refresh')
+    expect(output.string).not_to include('new-access', 'new-refresh', 'dead-refresh')
+    expect(output.string).to include('session only')
+  ensure
+    $stdout = original if original
+    Thread.current[:pwn_request_runtime] = nil
+  end
 end

data/spec/lib/pwn/migrate_spec.rb

@@ -80,7 +80,7 @@ describe PWN::Migrate do
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 2))
       expect(described_class.needed?).to be(true)
       result = described_class.run(fix: false, backup: false, io: io)
-      expect(result[:applied_migrations]).to eq([3, 4, 5, 6, 7, 8, 9])
+      expect(result[:applied_migrations]).to eq([3, 4, 5, 6, 7, 8, 9, 10])
       expected = Marshal.load(Marshal.dump(original))
       expected['custom']['model'] = nil
       expect(YAML.safe_load_file(path)).to eq(expected)
@@ -189,7 +189,7 @@ describe PWN::Migrate do
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 3))
       expect(described_class.needed?).to be(true)
       result = described_class.run(fix: true, backup: false, io: io)
-      expect(result[:applied_migrations]).to eq([4, 5, 6, 7, 8, 9])
+      expect(result[:applied_migrations]).to eq([4, 5, 6, 7, 8, 9, 10])
       creds = YAML.safe_load_file(dec, symbolize_names: true)
       user = PWN::Plugins::Vault.dump(file: yaml, key: creds[:key], iv: creds[:iv])
       expect(user[:ai][:active]).to eq('grok')
@@ -215,7 +215,7 @@ describe PWN::Migrate do
       PWN::Plugins::Vault.create(file: yaml, decryptor_file: dec)
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 4))
       result = described_class.run(fix: true, backup: false, io: io)
-      expect(result[:applied_migrations]).to eq([5, 6, 7, 8, 9])
+      expect(result[:applied_migrations]).to eq([5, 6, 7, 8, 9, 10])
       creds = YAML.safe_load_file(dec, symbolize_names: true)
       user = PWN::Plugins::Vault.dump(file: yaml, key: creds[:key], iv: creds[:iv])
       expect(user.dig(:ai, :agent, :skill_review)).to eq('off')
@@ -240,7 +240,7 @@ describe PWN::Migrate do
       File.write(yaml, YAML.dump(stale).gsub(/^(\s*):/, '\1'))
       PWN::Plugins::Vault.create(file: yaml, decryptor_file: dec)
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 5))
-      expect(described_class.run(fix: true, backup: false, io: io)[:applied_migrations]).to eq([6, 7, 8, 9])
+      expect(described_class.run(fix: true, backup: false, io: io)[:applied_migrations]).to eq([6, 7, 8, 9, 10])
       creds = YAML.safe_load_file(dec, symbolize_names: true)
       user = PWN::Plugins::Vault.dump(file: yaml, key: creds[:key], iv: creds[:iv])
       theme = user.dig(:ai, :tui, :theme)
@@ -287,7 +287,7 @@ describe PWN::Migrate do
       File.write(yaml, YAML.dump(stale).gsub(/^(\s*):/, '\1'))
       PWN::Plugins::Vault.create(file: yaml, decryptor_file: dec)
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 8))
-      expect(described_class.run(fix: true, backup: false, io: io)[:applied_migrations]).to eq([9])
+      expect(described_class.run(fix: true, backup: false, io: io)[:applied_migrations]).to eq([9, 10])
       creds = YAML.safe_load_file(dec, symbolize_names: true)
       user = PWN::Plugins::Vault.dump(file: yaml, key: creds[:key], iv: creds[:iv])
       long_fast = user.dig(:plugins, :meshtastic, :channel, :LongFast)

data/spec/lib/pwn/plugins/repl_spec.rb

@@ -97,13 +97,35 @@ describe PWN::Plugins::REPL do # rubocop:disable Metrics/BlockLength
     end
 
     it 'does not offer effort controls for unsupported models' do
+      allow(PWN::AI::Ollama).to receive(:thinking_controls).and_return({ efforts: [], default: nil })
+      allow(PWN::AI::OpenWebUI).to receive(:thinking_controls).and_return({ efforts: [], default: nil })
       expect(described_class.pwn_ai_reasoning_selection(engine: 'grok', model: 'grok-4')[:efforts]).to eq([])
       expect(described_class.pwn_ai_reasoning_selection(engine: 'openai', model: 'gpt-4o')[:efforts]).to eq([])
-      %w[anthropic gemini ollama openwebui].each do |engine|
+      expect(described_class.pwn_ai_reasoning_selection(engine: 'anthropic', model: 'claude-3-haiku')[:efforts]).to eq([])
+      expect(described_class.pwn_ai_reasoning_selection(engine: 'gemini', model: 'gemini-2.5-pro')[:efforts]).to eq([])
+      %w[ollama openwebui].each do |engine|
         expect(described_class.pwn_ai_reasoning_selection(engine: engine, model: 'fixture')[:efforts]).to eq([])
       end
     end
 
+    it 'offers named effort levels only for models that publish them' do
+      anthropic = described_class.pwn_ai_reasoning_selection(engine: 'anthropic', model: 'claude-sonnet-4-6')
+      expect(anthropic[:efforts]).to eq(%w[low medium high])
+      expect(anthropic[:default]).to eq('high')
+      newer = described_class.pwn_ai_reasoning_selection(engine: 'anthropic', model: 'claude-opus-5-5')
+      expect(newer[:efforts]).to eq(%w[low medium high xhigh max])
+      expect(newer[:default]).to eq('medium')
+      gemini = described_class.pwn_ai_reasoning_selection(engine: 'gemini', model: 'gemini-4-argon')
+      expect(gemini[:efforts]).to eq(%w[low medium high])
+      expect(gemini[:default]).to eq('medium')
+      flash = described_class.pwn_ai_reasoning_selection(engine: 'gemini', model: 'gemini-3-flash')
+      expect(flash[:efforts]).to eq(%w[minimal low medium high])
+      allow(PWN::AI::Ollama).to receive(:thinking_controls).and_return({ efforts: %w[low medium high], default: 'medium' })
+      ollama = described_class.pwn_ai_reasoning_selection(engine: 'ollama', model: 'gpt-oss')
+      expect(ollama[:efforts]).to eq(%w[low medium high])
+      expect(ollama[:default]).to eq('medium')
+    end
+
     it 'cancels without changing any configuration or persisting' do
       PWN::Env[:ai] = { active: 'ollama', ollama: { model: 'old' }, grok: { model: 'old', reasoning_effort: 'high' } }
       before = Marshal.dump(PWN::Env[:ai])
@@ -112,9 +134,10 @@ describe PWN::Plugins::REPL do # rubocop:disable Metrics/BlockLength
       expect(Marshal.dump(PWN::Env[:ai])).to eq(before)
     end
 
-    it 'skips effort prompts and catalogs for engines without effort support' do
+    it 'skips effort prompts when the selected model publishes no named levels' do
       PWN::Env[:ai] = { active: 'ollama', ollama: { model: 'old', think: false } }
       allow(described_class).to receive(:persist_ai_selection).and_return(false)
+      allow(PWN::AI::Ollama).to receive(:thinking_controls).and_return({ efforts: [], default: nil })
       expect(PWN::AI::OpenAI).not_to receive(:get_models)
       prompt = double('prompt')
       expect(prompt).not_to receive(:call)

data/spec/lib/pwn/session_cleanup_default_spec.rb

@@ -24,7 +24,7 @@ RSpec.describe 'Bundled session cleanup' do
     original = PWN::Cron.create(name: 'session_cleanup', schedule: '12 9 * * *', ruby: 'custom guard', enabled: false)
     File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 7))
     result = PWN::Migrate.run(fix: false, backup: false, io: StringIO.new)
-    expect(result[:applied_migrations]).to eq([8, 9])
+    expect(result[:applied_migrations]).to eq([8, 9, 10])
     expect(PWN::Cron.list.fetch(original[:id])).to eq(original)
     expect(PWN::Cron.list.values.count { |job| job[:name] == 'session_cleanup' }).to eq(1)
     expect(File).to exist(File.join(PWN::Cron.cron_dir, 'session_cleanup.rb'))

data/spec/support/harness/cli_faults.rb

@@ -15,7 +15,7 @@ module HarnessCLIFaults
     path = File.join(root, 'provider.json')
     File.write(path, JSON.generate(fixture))
     source = options[:source_root] || HarnessEvaluation::ROOT
-    env = { 'HOME' => File.join(root, 'home'), 'PATH' => '/usr/bin:/bin', 'LANG' => 'C.UTF-8',
+    env = { 'HOME' => File.join(root, 'home'), 'PATH' => HarnessEvaluation.isolated_path, 'LANG' => 'C.UTF-8',
             'GEM_HOME' => options[:gem_home] || Gem.dir, 'GEM_PATH' => options[:gem_path] || Gem.path.join(File::PATH_SEPARATOR),
             'PWN_HARNESS_FIXTURE' => path, 'PWN_HARNESS_EVENTS' => File.join(root, 'events.jsonl'),
             'PWN_HARNESS_FINGERPRINT' => File.join(root, 'fingerprint.json'), 'PWN_HARNESS_RUNTIME' => File.join(root, 'runtime'),
@@ -25,7 +25,12 @@ module HarnessCLIFaults
     command += ['-r', File.join(source, 'spec/support/harness/fault_preload.rb'),
                 options[:executable] || File.join(source, 'bin/pwn-ai'), '--ai', prompt]
     ready_path = fixture[:await_cap_ready] ? env.fetch('PWN_HARNESS_CAP_READY') : nil
-    report = HarnessEvaluation.capture(env, command, root, fixture.fetch(:wall_seconds, 35), ready_path: ready_path)
+    startup = options[:executable] ? 180 : 45
+    report = if ready_path
+               HarnessEvaluation.capture(env, command, root, fixture.fetch(:wall_seconds, 35), ready_path: ready_path, startup_seconds: startup)
+             else
+               HarnessEvaluation.agent_capture(env, command, root, fixture.fetch(:wall_seconds, 35), options)
+             end
     phase = fixture[:resume] ? 'resumed' : 'initial'
     File.write(File.join(root, "#{phase}-process.json"), JSON.pretty_generate(report.merge(command: command)))
     report

data/spec/support/harness/evaluate.rb

@@ -13,6 +13,13 @@ module HarnessEvaluation
   ROOT = File.expand_path('../../..', __dir__)
   MANIFEST = File.join(ROOT, 'spec/fixtures/harness/manifest.json')
 
+  # Scripted shell tasks call `ruby`. A stripped PATH must still find the suite
+  # interpreter: /usr/bin/ruby may be older or lack json, which fails only the
+  # held-out JSON task while File-only tasks pass.
+  def self.isolated_path
+    [File.dirname(RbConfig.ruby), '/usr/bin', '/bin'].uniq.join(File::PATH_SEPARATOR)
+  end
+
   def self.validate_parity!(left, right)
     fields = %w[provider model revision endpoint reasoning temperature max_iterations max_tokens wall_seconds tool_capabilities network]
     fields.each do |key|
@@ -99,6 +106,14 @@ module HarnessEvaluation
       latency_seconds: Process.clock_gettime(Process::CLOCK_MONOTONIC) - started }
   end
 
+  # Gem activation is not part of the scripted work cap. Packaged boots get a
+  # separate finite startup bound; a missing ready file is a capped boot, not a parser crash.
+  def self.agent_capture(env, command, cwd, seconds, options = {})
+    ready = File.join(cwd, 'harness-ready')
+    startup = options[:executable] ? 180 : 45
+    capture(env.merge('PWN_HARNESS_READY' => ready), command, cwd, seconds, ready_path: ready, startup_seconds: startup)
+  end
+
   def self.run(options)
     manifest_path = options[:source_root] ? File.join(options[:source_root], 'spec/fixtures/harness/manifest.json') : MANIFEST
     manifest_bytes = File.binread(manifest_path)
@@ -121,7 +136,7 @@ module HarnessEvaluation
       File.write(fixture, JSON.generate(responses: task.fetch('responses')))
       events = File.join(root, 'events.jsonl')
       fingerprint = File.join(root, 'fingerprint.json')
-      env = { 'HOME' => home, 'PATH' => '/usr/bin:/bin', 'LANG' => 'C.UTF-8',
+      env = { 'HOME' => home, 'PATH' => isolated_path, 'LANG' => 'C.UTF-8',
               'GEM_HOME' => options[:gem_home] || Gem.dir,
               'GEM_PATH' => options[:gem_path] || Gem.path.join(File::PATH_SEPARATOR),
               'PWN_HARNESS_FIXTURE' => fixture, 'PWN_HARNESS_EVENTS' => events,
@@ -131,7 +146,7 @@ module HarnessEvaluation
       command = [ruby]
       command += ['-I', File.join(ROOT, 'lib')] unless options[:executable]
       command += ['-r', preload, executable, '--ai', task.fetch('prompt')]
-      result = capture(env, command, root, manifest.fetch('budget').fetch('wall_seconds'))
+      result = HarnessEvaluation.agent_capture(env, command, root, manifest.fetch('budget').fetch('wall_seconds'), options)
       grade = grade(task, root, result)
       File.write(File.join(root, 'stdout.txt'), result.delete(:stdout))
       File.write(File.join(root, 'stderr.txt'), result.delete(:stderr))
@@ -144,7 +159,7 @@ module HarnessEvaluation
         artifact_root: root, command: command }.merge(result).merge(grade)
     end
     fault_root = Dir.mktmpdir('runtime-faults-', output_root)
-    fault_env = { 'HOME' => fault_root, 'PATH' => '/usr/bin:/bin', 'LANG' => 'C.UTF-8',
+    fault_env = { 'HOME' => fault_root, 'PATH' => isolated_path, 'LANG' => 'C.UTF-8',
                   'GEM_HOME' => options[:gem_home] || Gem.dir,
                   'GEM_PATH' => options[:gem_path] || Gem.path.join(File::PATH_SEPARATOR) }
     fault_source = options[:source_root] || ROOT

data/spec/support/harness/experiments.rb

@@ -50,14 +50,14 @@ module HarnessExperiments
                 agent: { policy: arm == 'single-policy', max_iters: options.fetch(:max_iterations, 12) } }
     File.write(File.join(root, 'provider.json'), JSON.generate(fixture))
     source = options[:source_root] || HarnessEvaluation::ROOT
-    env = { 'HOME' => home, 'PATH' => '/usr/bin:/bin', 'LANG' => 'C.UTF-8',
+    env = { 'HOME' => home, 'PATH' => HarnessEvaluation.isolated_path, 'LANG' => 'C.UTF-8',
             'GEM_HOME' => options[:gem_home] || Gem.dir, 'GEM_PATH' => options[:gem_path] || Gem.path.join(File::PATH_SEPARATOR),
             'PWN_HARNESS_FIXTURE' => File.join(root, 'provider.json'), 'PWN_HARNESS_EVENTS' => File.join(root, 'events.jsonl'),
             'PWN_HARNESS_FINGERPRINT' => File.join(root, 'fingerprint.json'), 'PWN_HARNESS_OBSERVATIONS' => File.join(root, 'observations.json') }
     command = [RbConfig.ruby]
     command += ['-I', File.join(source, 'lib')] unless options[:executable]
     command += ['-r', File.join(source, 'spec/support/harness/experiment_preload.rb'), options[:executable] || File.join(source, 'bin/pwn-ai'), '--ai', task.fetch('prompt')]
-    result = HarnessEvaluation.capture(env, command, root, options.fetch(:wall_seconds, 35))
+    result = HarnessEvaluation.agent_capture(env, command, root, options.fetch(:wall_seconds, 35), options)
     grade = HarnessEvaluation.grade({ 'checks' => gold.fetch(task.fetch('id')), 'success_marker' => 'FIXTURE_COMPLETE' }, root, result)
     File.write(File.join(root, 'process.json'), JSON.pretty_generate(result.merge(command: command)))
     trace_path = File.join(root, 'events.jsonl')
@@ -105,7 +105,7 @@ module HarnessExperiments
 
       receipt = File.join(output, "#{task.fetch('id')}-receipt.json")
       File.write(receipt, JSON.generate(row))
-      env = { 'HOME' => row[:home], 'PATH' => '/usr/bin:/bin', 'LANG' => 'C.UTF-8',
+      env = { 'HOME' => row[:home], 'PATH' => HarnessEvaluation.isolated_path, 'LANG' => 'C.UTF-8',
               'GEM_HOME' => options[:gem_home] || Gem.dir, 'GEM_PATH' => options[:gem_path] || Gem.path.join(File::PATH_SEPARATOR) }
       recorded = HarnessEvaluation.capture(env, [RbConfig.ruby, '-I', File.join(source, 'lib'), File.join(source, 'spec/support/harness/record_training.rb'), receipt], output, 20)
       File.write(File.join(output, "#{task.fetch('id')}-learning.json"), JSON.pretty_generate(recorded))

data/spec/support/harness/fake_provider.rb

@@ -75,6 +75,8 @@ provider.define_singleton_method(:chat_with_tools) do |opts = {}|
   { choices: [{ message: row }] }
 end
 provider.define_singleton_method(:chat) { |*_args| raise 'unexpected text-only provider path' }
+ready = ENV['PWN_HARNESS_READY'].to_s
+File.write(ready, 'ready') unless ready.empty?
 at_exit do
   File.write(ENV.fetch('PWN_HARNESS_FINGERPRINT'), JSON.pretty_generate(PWN::RuntimeFingerprint.report))
 end

data/spec/support/harness/session_acceptance.rb

@@ -8,14 +8,14 @@ module HarnessSessionAcceptance
     source = options[:source_root] || HarnessEvaluation::ROOT
     FileUtils.mkdir_p(File.join(root, 'home'))
     File.write(File.join(root, 'provider.json'), JSON.generate(responses: steps))
-    env = { 'HOME' => File.join(root, 'home'), 'PATH' => '/usr/bin:/bin', 'LANG' => 'C.UTF-8',
+    env = { 'HOME' => File.join(root, 'home'), 'PATH' => HarnessEvaluation.isolated_path, 'LANG' => 'C.UTF-8',
             'GEM_HOME' => options[:gem_home] || Gem.dir, 'GEM_PATH' => options[:gem_path] || Gem.path.join(File::PATH_SEPARATOR),
             'PWN_HARNESS_FIXTURE' => File.join(root, 'provider.json'), 'PWN_HARNESS_EVENTS' => File.join(root, 'events.jsonl'),
             'PWN_HARNESS_FINGERPRINT' => File.join(root, 'fingerprint.json') }
     command = [RbConfig.ruby]
     command += ['-I', File.join(source, 'lib')] unless options[:executable]
     command += ['-r', File.join(source, 'spec/support/harness/fake_provider.rb'), options[:executable] || File.join(source, 'bin/pwn-ai')] + args
-    HarnessEvaluation.capture(env, command, root, 35).merge(command: command)
+    HarnessEvaluation.agent_capture(env, command, root, 35, options).merge(command: command)
   end
 
   def self.run(options)
@@ -29,7 +29,13 @@ module HarnessSessionAcceptance
       File.write(contract_path, JSON.generate(contract))
       initial = invoke(root, [HarnessExperiments.tool('shell', { command: "printf 'wrong\\n' > result.txt", timeout: 10 }, 'wrong')] + Array.new(8) { final },
                        ['--ai', prompt, '--verification-contract', contract_path], options)
-      old_path = Dir.glob(File.join(root, 'home/.pwn/sessions/requests/**/*.json')).fetch(0)
+      old_path = Dir.glob(File.join(root, 'home/.pwn/sessions/requests/**/*.json')).first
+      unless old_path
+        File.write(File.join(root, 'process.json'), JSON.pretty_generate(initial: initial))
+        next { id: name, outcome: 'FAIL', initial_exit_status: initial[:exit_status], exit_status: initial[:exit_status],
+               identity_preserved: false, artifact_root: root, task_outcome: nil, missing_checkpoint: true,
+               ready_observed: initial[:ready_observed], resource_cap: initial[:resource_cap] }
+      end
       old_bytes = File.binread(old_path)
       old = JSON.parse(old_bytes)
       sid = old.fetch('session_id')

data/spec/support/harness/swarm_acceptance.rb

@@ -29,14 +29,14 @@ module HarnessSwarmAcceptance
       steps += Array.new(16) { final }
       fixture = File.join(root, 'provider.json')
       File.write(fixture, JSON.generate(responses: steps, toolsets: %w[shell swarm], agent: { max_iters: 6 }))
-      env = { 'HOME' => home, 'PATH' => '/usr/bin:/bin', 'LANG' => 'C.UTF-8',
+      env = { 'HOME' => home, 'PATH' => HarnessEvaluation.isolated_path, 'LANG' => 'C.UTF-8',
               'GEM_HOME' => options[:gem_home] || Gem.dir, 'GEM_PATH' => options[:gem_path] || Gem.path.join(File::PATH_SEPARATOR),
               'PWN_HARNESS_FIXTURE' => fixture, 'PWN_HARNESS_EVENTS' => File.join(root, 'events.jsonl'),
               'PWN_HARNESS_FINGERPRINT' => File.join(root, 'fingerprint.json') }
       command = [RbConfig.ruby]
       command += ['-I', File.join(source, 'lib')] unless options[:executable]
       command += ['-r', File.join(source, 'spec/support/harness/fake_provider.rb'), options[:executable] || File.join(source, 'bin/pwn-ai'), '--ai', prompt]
-      result = HarnessEvaluation.capture(env, command, root, 35)
+      result = HarnessEvaluation.agent_capture(env, command, root, 35, options)
       File.write(File.join(root, 'process.json'), JSON.pretty_generate(result.merge(command: command)))
       checkpoints = Dir.glob(File.join(home, '.pwn/sessions/requests/**/*.json')).map { |path| JSON.parse(File.read(path)) }
       parent = checkpoints.find { |row| Array(row['enabled_toolsets']).include?('swarm') }

data/third_party/pwn_rdoc.jsonl

@@ -1158,7 +1158,7 @@
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.anthropic_schema_notes Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.anthropic_schema_notes`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.authors Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.chat Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.chat`: Supported Method Parameters\n\nresponse = PWN::AI::Anthropic.chat(\n\nrequest: 'required - message to Anthropic',\nmodel: 'optional - model to use for text generation (defaults to PWN::Env[:ai][:anthropic][:model])',\ntemp: 'optional - creative response float (defaults to PWN::Env[:ai][:anthropic][:temp])',\nsystem_role_content: 'optional - context to set up the model behavior for conversation (Default: PWN::Env[:ai][:anthropic][:system_role_content])',\nresponse_history: 'optional - pass response back in to have a conversation',\nspeak_answer: 'optional speak answer using PWN::Plugins::Voice.text_to_speech (Default: nil)',\ntimeout: 'optional timeout in seconds (defaults to 900)',\nspinner: 'optional - display spinner (defaults to false)'\n\n)\n"}]}
-{"messages":[{"role":"user","content":"PWN::AI::Anthropic.chat_with_tools Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.chat_with_tools`: Supported Method Parameters\n\nresponse = PWN::AI::Anthropic.chat_with_tools(\n\nmessages: 'required - OpenAI-format messages array (system/user/assistant/tool)',\ntools: 'optional - OpenAI tools array [{type:\"function\", function:{...}}]',\ntool_choice: 'optional - \"auto\" | \"none\" | \"required\" | {type:\"function\", function:{name:..}}',\nmodel: 'optional - overrides PWN::Env[:ai][:anthropic][:model]',\ntemp: 'optional - temperature (defaults to PWN::Env[:ai][:anthropic][:temp] || 1)',\nmax_tokens: 'optional - defaults to PWN::Env[:ai][:anthropic][:max_tokens] || 128_000',\ntimeout: 'optional - seconds (default 900)',\nspinner: 'optional - display spinner (default false)'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::AI::Anthropic.chat_with_tools Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.chat_with_tools`: Supported Method Parameters\n\nresponse = PWN::AI::Anthropic.chat_with_tools(\n\nmessages: 'required - OpenAI-format messages array (system/user/assistant/tool)',\ntools: 'optional - OpenAI tools array [{type:\"function\", function:{...}}]',\ntool_choice: 'optional - \"auto\" | \"none\" | \"required\" | {type:\"function\", function:{name:..}}',\nmodel: 'optional - overrides PWN::Env[:ai][:anthropic][:model]',\ntemp: 'optional - temperature (defaults to PWN::Env[:ai][:anthropic][:temp] || 1)',\nmax_tokens: 'optional - defaults to PWN::Env[:ai][:anthropic][:max_tokens] || 128_000',\nreasoning_effort: 'optional - output_config.effort when the model supports it',\ntimeout: 'optional - seconds (default 900)',\nspinner: 'optional - display spinner (default false)'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.forced_tool_choice? Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.forced_tool_choice?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.get_model Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.get_model`: Supported Method Parameters\n\nmodel = PWN::AI::Anthropic.get_model(name: ‘required - model id’)\n\nThe Models API lists id and capabilities. Pricing, when Anthropic includes it on that record, is passed through unchanged. A missing price field is not filled from a public price table.\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.get_models Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.get_models`: Supported Method Parameters\n\nmodels = PWN::AI::Anthropic.get_models\n"}]}
@@ -1171,6 +1171,7 @@
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.persist_oauth_to_vault Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.persist_oauth_to_vault`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.pkce_pair Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.pkce_pair`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.real_config_value? Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.real_config_value?`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Anthropic.reasoning_efforts Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.reasoning_efforts`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.refresh_oauth_bearer_token Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.refresh_oauth_bearer_token`: Supported Method Parameters\n\naccess_token = PWN::AI::Anthropic.refresh_oauth_bearer_token(\n\nrefresh_token: 'required - Anthropic OAuth refresh_token',\nclient_id:     'optional - defaults to Claude Code public client',\ntoken_uri:     'optional - defaults to platform.claude.com token endpoint'\n\n) On success, writes :bearer_token (and a rotated :refresh_token if returned) back into the passed opts/oauth Hash so the live PWN::Env stays warm for the rest of the process. Also mirrors those values onto PWN::Env[:anthropic] when that Hash is available, then attempts to re-encrypt the updated tokens into ~/.pwn/pwn.yaml when the matching decryptor (key + iv) is present.\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Anthropic.sync_oauth_into_env Usage"},{"role":"assistant","content":"`PWN::AI::Anthropic.sync_oauth_into_env`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::CLI.authors Usage"},{"role":"assistant","content":"`PWN::AI::CLI.authors`: "}]}
@@ -1205,11 +1206,13 @@
 {"messages":[{"role":"user","content":"PWN::AI::Gemini.chat_with_tools Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.chat_with_tools`: Supported Method Parameters\n\nresponse = PWN::AI::Gemini.chat_with_tools(\n\nmessages: 'required - OpenAI-format messages array (system/user/assistant/tool)',\ntools: 'optional - OpenAI tools array [{type:\"function\", function:{...}}]',\ntool_choice: 'optional - \"auto\" | \"none\" | \"required\" | {type:\"function\", function:{name:..}}',\nmodel: 'optional - overrides PWN::Env[:ai][:gemini][:model]',\ntemp: 'optional - temperature (defaults to PWN::Env[:ai][:gemini][:temp] || 1)',\nmax_tokens: 'optional - maxOutputTokens (defaults to 8192)',\ntimeout: 'optional - seconds (default 900)',\nspinner: 'optional - display spinner (default false)'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Gemini.gemini_resp_to_oa Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.gemini_resp_to_oa`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Gemini.gemini_rest_call Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.gemini_rest_call`: Supported Method Parameters\n\ngemini_rest_call(\n\nhttp_method: 'optional HTTP method (defaults to GET)',\nrest_call: 'required rest call to make per the schema',\nparams: 'optional params passed in the URI or HTTP Headers',\nhttp_body: 'optional HTTP body sent in HTTP methods that support it e.g. POST',\ntimeout: 'optional timeout in seconds (defaults to 900)',\nspinner: 'optional - display spinner (defaults to false)'\n\n)\n"}]}
+{"messages":[{"role":"user","content":"PWN::AI::Gemini.gemini_thinking_config Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.gemini_thinking_config`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Gemini.gemini_tool_config Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.gemini_tool_config`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Gemini.get_model Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.get_model`: Supported Method Parameters\n\nmodel = PWN::AI::Gemini.get_model(name: ‘required - model id or models/<id>’)\n\nGemini names models as models/<id> and usually publishes token limits, not USD rates. A pricing object on the record is kept; none is invented.\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Gemini.get_models Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.get_models`: Supported Method Parameters\n\nmodels = PWN::AI::Gemini.get_models\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Gemini.help Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Gemini.oa_messages_to_gemini Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.oa_messages_to_gemini`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Gemini.reasoning_efforts Usage"},{"role":"assistant","content":"`PWN::AI::Gemini.reasoning_efforts`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Grok.authors Usage"},{"role":"assistant","content":"`PWN::AI::Grok.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Grok.chat Usage"},{"role":"assistant","content":"`PWN::AI::Grok.chat`: Supported Method Parameters\n\nresponse = PWN::AI::Grok.chat(\n\nrequest: 'required - message to Grok'\nmodel: 'optional - model to use for text generation (defaults to PWN::Env[:ai][:grok][:model])',\ntemp: 'optional - creative response float (deafults to PWN::Env[:ai][:grok][:temp])',\nsystem_role_content: 'optional - context to set up the model behavior for conversation (Default: PWN::Env[:ai][:grok][:system_role_content])',\nresponse_history: 'optional - pass response back in to have a conversation',\nspeak_answer: 'optional speak answer using PWN::Plugins::Voice.text_to_speech (Default: nil)',\ntimeout: 'optional timeout in seconds (defaults to 900)',\nspinner: 'optional - display spinner (defaults to false)'\n\n)\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Grok.chat_with_tools Usage"},{"role":"assistant","content":"`PWN::AI::Grok.chat_with_tools`: Supported Method Parameters\n\nresponse = PWN::AI::Grok.chat_with_tools(\n\nmessages: 'required - full OpenAI-format messages array (system/user/assistant/tool)',\ntools: 'optional - OpenAI tools array [{type:\"function\", function:{...}}]',\ntool_choice: 'optional - \"auto\" | \"none\" | \"required\" | {type:\"function\", function:{name:..}}',\nmodel: 'optional - overrides PWN::Env[:ai][:grok][:model]',\ntemp: 'optional - temperature (defaults to PWN::Env[:ai][:grok][:temp] || 1)',\ntimeout: 'optional - seconds (default 180)',\nspinner: 'optional - display spinner (default false)'\n\n)\n\nReturns the raw chat/completions response Hash with :choices intact (including :message) — used by PWN::AI::Agent::Loop. xAI’s API is OpenAI-compatible for tool calling, so the request and response shapes are identical to PWN::AI::OpenAI.chat_with_tools.\n"}]}
@@ -1219,7 +1222,7 @@
 {"messages":[{"role":"user","content":"PWN::AI::Grok.help Usage"},{"role":"assistant","content":"`PWN::AI::Grok.help`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Grok.jwt_exp Usage"},{"role":"assistant","content":"`PWN::AI::Grok.jwt_exp`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Grok.oauth_token_expiring? Usage"},{"role":"assistant","content":"`PWN::AI::Grok.oauth_token_expiring?`: "}]}
-{"messages":[{"role":"user","content":"PWN::AI::Grok.obtain_oauth_bearer_token Usage"},{"role":"assistant","content":"`PWN::AI::Grok.obtain_oauth_bearer_token`: Supported Method Parameters\n\nbearer = PWN::AI::Grok.obtain_oauth_bearer_token(\n\nclient_id: 'optional - xAI OAuth Client ID (defaults to public Grok-CLI client)',\nscope:     'optional - space-delimited scopes (defaults to XAI_OAUTH_SCOPE)',\ntimeout:   'optional - seconds to wait for user consent (default 300)'\n\n)\n\nRuns the RFC 8628 OAuth 2.0 Device Authorization Grant against auth.x.ai using xAI’s public Grok-CLI client (no client_secret). This is the same identity path ‘hermes auth add xai-oauth` uses – a SuperGrok / X Premium+ subscription on the account is what grants api:access at consent time.\n\n1. POST /oauth2/device/code    -> device_code, user_code, verification_uri\n2. User opens verification_uri_complete in a browser and approves.\n3. Poll POST /oauth2/token (grant_type=device_code) until access_token.\n\nOn success the access_token + refresh_token are written back into the passed opts/oauth Hash (so PWN::Env[:grok] is live-cached) and the operator is told exactly what to persist via pwn-vault.\n"}]}
+{"messages":[{"role":"user","content":"PWN::AI::Grok.obtain_oauth_bearer_token Usage"},{"role":"assistant","content":"`PWN::AI::Grok.obtain_oauth_bearer_token`: Supported Method Parameters\n\nbearer = PWN::AI::Grok.obtain_oauth_bearer_token(\n\nclient_id: 'optional - xAI OAuth Client ID (defaults to public Grok-CLI client)',\nscope:     'optional - space-delimited scopes (defaults to XAI_OAUTH_SCOPE)',\ntimeout:   'optional - seconds to wait for user consent (default 300)'\n\n)\n\nRuns the RFC 8628 OAuth 2.0 Device Authorization Grant against auth.x.ai using xAI’s public Grok-CLI client (no client_secret). This is the same identity path ‘hermes auth add xai-oauth` uses – a SuperGrok / X Premium+ subscription on the account is what grants api:access at consent time.\n\n1. POST /oauth2/device/code    -> device_code, user_code, verification_uri\n2. User opens verification_uri_complete in a browser and approves.\n3. Poll POST /oauth2/token (grant_type=device_code) until access_token.\n\nOn success the access_token + refresh_token are written into the live request runtime (provider_config is a copy) and into the encrypted vault when the decryptor is present. Tokens are not printed.\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::Grok.persist_oauth_to_vault Usage"},{"role":"assistant","content":"`PWN::AI::Grok.persist_oauth_to_vault`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Grok.real_config_value? Usage"},{"role":"assistant","content":"`PWN::AI::Grok.real_config_value?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Grok.refresh_oauth_bearer_token Usage"},{"role":"assistant","content":"`PWN::AI::Grok.refresh_oauth_bearer_token`: Supported Method Parameters\n\naccess_token = PWN::AI::Grok.refresh_oauth_bearer_token(\n\nrefresh_token: 'required - xAI OAuth refresh_token',\nclient_id:     'optional - defaults to public Grok-CLI client',\ntoken_uri:     'optional - defaults to https://auth.x.ai/oauth2/token'\n\n)\n\nExchanges a refresh_token for a fresh access_token at auth.x.ai. On success, writes :bearer_token (and a rotated :refresh_token if returned) back into the passed opts/oauth Hash so the live PWN::Env stays warm for the rest of the process. Also mirrors those values onto PWN::Env[:grok] when that Hash is available, then attempts to re-encrypt the updated tokens into ~/.pwn/pwn.yaml when the matching decryptor (key + iv) is present.\n"}]}
@@ -1305,6 +1308,8 @@
 {"messages":[{"role":"user","content":"PWN::AI::Ollama.real_config_value? Usage"},{"role":"assistant","content":"`PWN::AI::Ollama.real_config_value?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Ollama.strict_system_template? Usage"},{"role":"assistant","content":"`PWN::AI::Ollama.strict_system_template?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Ollama.template_rejects_later_system? Usage"},{"role":"assistant","content":"`PWN::AI::Ollama.template_rejects_later_system?`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Ollama.think_wire Usage"},{"role":"assistant","content":"`PWN::AI::Ollama.think_wire`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::Ollama.thinking_controls Usage"},{"role":"assistant","content":"`PWN::AI::Ollama.thinking_controls`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::Ollama.visible_from_thinking Usage"},{"role":"assistant","content":"`PWN::AI::Ollama.visible_from_thinking`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::OpenAI.api_endpoint Usage"},{"role":"assistant","content":"`PWN::AI::OpenAI.api_endpoint`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::OpenAI.authors Usage"},{"role":"assistant","content":"`PWN::AI::OpenAI.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
@@ -1359,6 +1364,8 @@
 {"messages":[{"role":"user","content":"PWN::AI::OpenWebUI.real_config_value? Usage"},{"role":"assistant","content":"`PWN::AI::OpenWebUI.real_config_value?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::OpenWebUI.strict_system_template? Usage"},{"role":"assistant","content":"`PWN::AI::OpenWebUI.strict_system_template?`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::OpenWebUI.template_rejects_later_system? Usage"},{"role":"assistant","content":"`PWN::AI::OpenWebUI.template_rejects_later_system?`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::OpenWebUI.think_wire Usage"},{"role":"assistant","content":"`PWN::AI::OpenWebUI.think_wire`: "}]}
+{"messages":[{"role":"user","content":"PWN::AI::OpenWebUI.thinking_controls Usage"},{"role":"assistant","content":"`PWN::AI::OpenWebUI.thinking_controls`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::OpenWebUI.visible_from_thinking Usage"},{"role":"assistant","content":"`PWN::AI::OpenWebUI.visible_from_thinking`: "}]}
 {"messages":[{"role":"user","content":"PWN::AI::RedTeam.authors Usage"},{"role":"assistant","content":"`PWN::AI::RedTeam.authors`: Author(s)\n\n0day Inc. <support@0dayinc.com>\n"}]}
 {"messages":[{"role":"user","content":"PWN::AI::RedTeam.help Usage"},{"role":"assistant","content":"`PWN::AI::RedTeam.help`: "}]}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.771
+  version: 0.5.772
 platform: ruby
 authors:
 - 0day Inc.