pwn 0.5.774 → 0.5.777

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fcf08f4e689259063fd8b459d824890336bda15e3756416871cff38a21135730
-  data.tar.gz: cf3c78ae724f5fbf5702510ef6d7cd13800bbdba292a8613cf25d5216200da5d
+  metadata.gz: 77cd821e27ebf793d043b1b73139ff68b17badf106a91f42832769ac7760785e
+  data.tar.gz: '0708df0d0f8258f249e0b57556898e3a1e675ef90a8caa162eac0fc4366b652e'
 SHA512:
-  metadata.gz: 7bbf2b429a197fc2a5157764d50bc7e3c890351035f306fe46426362b5dd9925890135168ff6b6a49af0fa75f18943b6929dfa2b83c21f017d3560dc294cbb4b
-  data.tar.gz: '08eb6976dc48727a1baab7625500b214b30f1f1ffe3185c561b7bd9b8ceed18a827017b797280f67c986f29ad70d28c2c46c0c77168193b0aaeae7d054f84ac2'
+  metadata.gz: 338c0443dd72e44e29b50c8b3afd11251ab84643f1b105304c698789cda148f69e4f68468b9c2cdc4824dc1570591f2d9d51c17d5a678c4cea4eace72c27be4e
+  data.tar.gz: d60694fcbbe66c4b48eb2e35f5235e508d5bcc66f5d2172b7a5ebd604b755a778b83c428ea47578c61985078231382a5182dfca213e46400c61af5bdf8f9fd9a

data/Gemfile

@@ -49,7 +49,7 @@ gem 'jwt', '3.3.0'
 gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
-gem 'mcp', '1.7.0'
+gem 'mcp', '1.8.0'
 gem 'meshtastic', '0.0.188'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.26.0'

data/documentation/General-PWN-Usage.md

@@ -59,10 +59,11 @@ MQTT receiver when the primary is Serial, Bluetooth, or TCP. Missing/empty
 MQTT configuration makes no additional connection attempt; primary MQTT uses
 only one subscription. MQTT connection failures leave the primary usable and
 are reported in the UI. `/transport` reconnects both subscriptions; `/back`
-closes them. Ctrl+T switches the active pane between COMPOSE and
-CONVERSATION. COMPOSE keeps Up/Down history. CONVERSATION scrolls with
-Up/Down one row, PgUp/PgDn a page, Home to the top, and End to the live
-bottom. The live bottom is not row 0, so PgDn there stays put. Typing or
+closes them. Ctrl+T cycles COMPOSE, CONVERSATION, SENDER, and RECEIVER.
+COMPOSE keeps Up/Down history. CONVERSATION selects messages
+with Up/Down, a page with PgUp/PgDn, Home for the first, and End for the
+latest, including when every message already fits. The latest selection is
+not row 0, so End stays on the last message. Typing or
 Enter returns to COMPOSE; Enter does not send while CONVERSATION is active.
 The active title is reversed and marked active.
 
@@ -79,14 +80,18 @@ uses sender, packet ID, network/channel path, destination and payload (not
 text alone), retaining at most 1000 packets for five minutes. No-ID packets
 cannot be safely merged.
 
-Each header ends with the sender's last known position. A valid fix is
-`lat,lon >> https://maps.google.com/?q=lat,lon` on that same header. The pane
-wraps on ` · `, and only at ` >> ` if the GPS field itself does not fit, so
-the coordinate is not split. This is the compact Maps URL; a maps.app.goo.gl
-code cannot be minted without a Google share request. Unknown, unset, or
-out-of-range positions display `GPS N/A` and omit the URL. `0,0` is kept when
+Each header ends with its direction and transport. Sender and receiver positions
+are not painted there. `SENDER` and `RECEIVER` sit to the right of
+CONVERSATION. A broadcast destination shows the channel name, not the word
+broadcast. Ctrl+T cycles COMPOSE, CONVERSATION, SENDER, and RECEIVER.
+A valid fix is the underlined coordinate.
+Click it, or press `g` while CONVERSATION, SENDER, or RECEIVER is active, to open
+`https://maps.google.com/?q=lat,lon`. The URL is not painted. Curses cannot
+hide a link inside the coordinate text. Unknown, unset, or
+out-of-range positions display `GPS: N/A` and omit the URL. A broadcast
+receiver has no single position, so that field is `GPS: N/A`. `0,0` is kept when
 a real location source is present and omitted when the source is unset. The
-value is the last position recorded for that sender, not a freshness guarantee.
+value is the last position recorded for that node, not a freshness guarantee.
 
 MQTT TX uses `channel.<name>.from` when set, otherwise the connected radio's
 node number, otherwise a node-shaped `mqtt.client_id`. It does not publish the

data/documentation/pwn-REPL.md

@@ -102,14 +102,16 @@ session only; it is not written to disk.
 
 ### Message transport labels
 
-Each CONVERSATION header ends with its direction and the transport used for
-that individual message: `· RX via MQTT`, `· TX via Serial`, `· RX via Bluetooth`,
-or `· TX via TCP`. In `auto` mode this is the resolved connection, not the
-configured `auto` value. Received messages retain the subscribing transport's
+Each CONVERSATION header ends with `RX via <TRANSPORT>` or `TX via <TRANSPORT>`.
+SENDER and RECEIVER do not show that label. Ctrl+T cycles COMPOSE,
+CONVERSATION, SENDER, and RECEIVER. In `auto` mode this is the
+resolved connection, not the configured `auto` value. Received messages retain the subscribing transport's
 origin through queued rendering, even if the current transport changes.
 Missing origin metadata is shown as `Unknown`, not guessed from the current pin.
+GPS is not part of the header. SENDER and RECEIVER sit to the right of
+CONVERSATION. A broadcast receiver shows the channel name.
 
-Headers use `timestamp encryption · SHORT NAME · source path · destination path · direction via transport`,
+Headers use `timestamp encryption · SHORT NAME · source path · destination path · RX via <TRANSPORT>`,
 with exactly one space on either side of each `·`. RX uses the sender's
 `User.short_name` (`shortName` in JSON); TX uses the sending local node's User,
 never the destination's name. Device connections use their NodeInfo/NODEINFO
@@ -125,8 +127,8 @@ Unicode text and internal spaces are retained. Names are labels, not authenticat
 For example (placeholder node IDs):
 
 ```text
-2026-01-02 03:04:05+0000 🔍 · PEER · US/CA/2/e/LongFast/!aabbccdd · US/CA/2/e/LongFast/# · RX via MQTT
-2026-01-02 03:04:06+0000 🔍 · SELF · US/CA/2/e/LongFast/!bbccddee (ME) · US/CA/2/e/LongFast/# · TX via Serial
+2026-01-02 03:04:05+0000 🔍 · PEER · US/CA/2/e/LongFast/!aabbccdd · US/CA/2/e/LongFast/#
+2026-01-02 03:04:06+0000 🔍 · SELF · US/CA/2/e/LongFast/!bbccddee (ME) · US/CA/2/e/LongFast/#
 ```
 
 The timestamp, encryption indicator, source/destination paths, channel and

data/etc/default_skills/pwn/json_text/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-jsontext
+description: Drive PWN::JSONText from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::JSONText
+  source: pwn/json_text.rb
+---
+
+# PWN::JSONText
+
+Retag or scrub strings before the JSON generator sees them.
+
+## When to use
+
+Call `PWN::JSONText` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/json_text.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::JSONText.help
+PWN::JSONText.prepare(opts)
+```
+
+## Public methods
+
+- `prepare`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/json_text.rb`
+
+## Verification
+
+`PWN::JSONText.respond_to?(:prepare)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/plugins/repl/mesh/references/urls.md

@@ -1,3 +1,4 @@
 # PWN::Plugins::REPL::Mesh source links
 
 - https://maps.google.com/?q=[redacted]
+- https://maps\.google\.com/\?q=-?\d+\.\d+,-?\d+\.\d+\z}

data/lib/pwn/json_text.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+# Retag or scrub strings before the JSON generator sees them.
+module PWN
+  # json 2.21 warns when valid UTF-8 is still tagged BINARY, and raises
+  # JSON::GeneratorError on a malformed sequence. Both show up in the session pane.
+  module JSONText
+    # Supported Method Parameters::
+    # safe = PWN::JSONText.prepare(
+    #   value: 'required - string, hash, or array that may contain binary-tagged text',
+    #   depth: 'optional - nesting already walked; containers stop at 100'
+    # )
+
+    public_class_method def self.prepare(opts = {})
+      value = opts[:value]
+      depth = opts[:depth].to_i
+      case value
+      when String
+        utf = value.dup.force_encoding(Encoding::UTF_8)
+        utf.valid_encoding? ? utf : utf.scrub
+      when Hash
+        return value if depth >= 100
+
+        value.each_with_object({}) do |(key, item), out|
+          out[key.is_a?(String) ? prepare(value: key, depth: depth + 1) : key] = prepare(value: item, depth: depth + 1)
+        end
+      when Array
+        return value if depth >= 100
+
+        value.map { |item| prepare(value: item, depth: depth + 1) }
+      else
+        value
+      end
+    end
+
+    # Author(s):: 0day Inc. <support@0dayinc.com>
+
+    public_class_method def self.authors
+      "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+    end
+
+    # Display Usage for this Module.
+
+    public_class_method def self.help
+      puts "USAGE:
+        # Retag valid UTF-8 that is still tagged binary, or scrub an illegal sequence.
+        #{self}.prepare(
+          value: 'required - string, hash, or array that may contain binary-tagged text',
+          depth: 'optional - nesting already walked; containers stop at 100'
+        )
+
+        # Print the AUTHOR(S) string for this module.
+        #{self}.authors
+      "
+      constants.sort
+    end
+  end
+end
+
+# json 2.21 warns inside JSON.generate before State.generate. json 2.18 warns
+# inside the C to_json methods. Retag at both doors.
+class << JSON
+  %i[generate fast_generate pretty_generate dump].each do |name|
+    alias_method :"#{name}_without_json_text", name
+    define_method(name) do |obj, *rest|
+      public_send(:"#{name}_without_json_text", PWN::JSONText.prepare(value: obj), *rest)
+    end
+  end
+end
+
+if defined?(JSON::Ext::Generator::GeneratorMethods)
+  JSON::Ext::Generator::GeneratorMethods.constants.each do |kind|
+    mod = JSON::Ext::Generator::GeneratorMethods.const_get(kind)
+    next unless mod.is_a?(Module) && mod.method_defined?(:to_json)
+
+    mod.class_eval do
+      alias_method :to_json_without_json_text, :to_json unless method_defined?(:to_json_without_json_text)
+      define_method(:to_json) do |*rest|
+        prepared = PWN::JSONText.prepare(value: self)
+        mod.instance_method(:to_json_without_json_text).bind_call(prepared, *rest)
+      end
+    end
+  end
+end