pwn 0.5.776 → 0.5.778

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a6df0a18952a14c2cd3acf7263a3e3393fb1406bf04d742fb80706b094a73df
-  data.tar.gz: abbe212e8cdfa3e4bc042b817092f05fa68ce20518587f432120563822049544
+  metadata.gz: 3bd715a7f2fae3e39f56f1c2e0d47629de11144461591acbfcbc7399e8a1da9a
+  data.tar.gz: 80b713ca6f117ba5f9862416f2796f777e3c4a1e1bba68fdf05fda02ea758635
 SHA512:
-  metadata.gz: 19dea9476ce02f9c29d35783856054e8a4910dbe6e1366a96c280e9e76864274e5fe5b119f8d17d76937dba828f16407ebd4ab1be50e7bdbec11be39e7e6cb69
-  data.tar.gz: b7d5a2ae8f764dd3ffbf3cf2d73aa3a995f896b722279bae74e438ccabef6ac9571ace8f3bb5eddbf227cd2af105a847fa1b8967902de23030151ce4fe2d9bc7
+  metadata.gz: e17ff89a41133b10913a559880f90220940fa02ae6e74694e6c914d1c74af793d94907b05bd5655f7a9ee27afac498e896888c2d8a0c206381e7910ed8233dca
+  data.tar.gz: acc1ceac0c1e58354e730a115e06d312d5873cabaf1775ab7f39149ebfa99bb20094e83eae12b9e33108d046bcba61ab0887b7c869471fe9c0a9c655d29a2c72

data/Gemfile

@@ -24,7 +24,7 @@ gem 'bundler', '>=4.0.23'
 gem 'bundler-audit', '>=0.9.3'
 gem 'bunny', '3.4.0'
 gem 'colorize', '1.1.0'
-gem 'credit_card_validations', '9.0.0'
+gem 'credit_card_validations', '10.0.0'
 gem 'curses', '1.7.0'
 gem 'diffy', '3.4.4'
 gem 'eventmachine', '1.2.7'
@@ -49,7 +49,7 @@ gem 'jwt', '3.3.0'
 gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
-gem 'mcp', '1.7.0'
+gem 'mcp', '1.8.0'
 gem 'meshtastic', '0.0.188'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.26.0'

data/Rakefile

@@ -38,9 +38,8 @@ default_tasks = %i[spec rubocop]
 default_tasks << :rerdoc if defined?(RDoc::Task)
 task default: default_tasks
 
-desc 'Regenerate etc/default_skills/pwn from live PWN modules'
+desc 'Regenerate etc/default_skills/pwn from live PWN modules. Not a spec dependency: writing the checkout blocks git merge on upgrade.'
 task :module_skills do
   require 'pwn'
   PWN::ModuleSkills.refresh!
 end
-Rake::Task[:spec].enhance([:module_skills])

data/build_gem.sh

@@ -19,6 +19,20 @@ git config pull.rebase false
 # Sync fork with upstream to avoid merge conflicts and ensure we are building the latest codebase
 git remote -v | grep 'upstream' || git remote add upstream https://github.com/0dayinc/pwn.git
 git fetch upstream
+# Preserve legacy generated-skill changes before switching branches or merging.
+# Leave the stash saved: popping it would recreate the next upgrade conflict.
+generated_skills=()
+while IFS= read -r skill; do
+  [[ -f "$skill" ]] || continue
+  [[ "$skill" == */SKILL.md ]] || continue
+  grep -Eq '^[[:space:]]*generated:[[:space:]]*true[[:space:]]*$' "$skill" || continue
+  grep -Eq '^[[:space:]]*preserve:[[:space:]]*true[[:space:]]*$' "$skill" && continue
+  generated_skills+=("$skill")
+done < <(git diff --name-only HEAD -- etc/default_skills/pwn)
+if (( ${#generated_skills[@]} )); then
+  git stash push -m 'pwn upgrade: saved generated module skills' -- "${generated_skills[@]}"
+  printf '%s\n' 'Generated skill edits saved in git stash; not reapplied after upgrade.'
+fi
 git checkout master
 git merge upstream/master
 git pull

data/documentation/General-PWN-Usage.md

@@ -59,10 +59,11 @@ MQTT receiver when the primary is Serial, Bluetooth, or TCP. Missing/empty
 MQTT configuration makes no additional connection attempt; primary MQTT uses
 only one subscription. MQTT connection failures leave the primary usable and
 are reported in the UI. `/transport` reconnects both subscriptions; `/back`
-closes them. Ctrl+T switches the active pane between COMPOSE and
-CONVERSATION. COMPOSE keeps Up/Down history. CONVERSATION scrolls with
-Up/Down one row, PgUp/PgDn a page, Home to the top, and End to the live
-bottom. The live bottom is not row 0, so PgDn there stays put. Typing or
+closes them. Ctrl+T cycles COMPOSE, CONVERSATION, SENDER, and RECEIVER.
+COMPOSE keeps Up/Down history. CONVERSATION selects messages
+with Up/Down, a page with PgUp/PgDn, Home for the first, and End for the
+latest, including when every message already fits. The latest selection is
+not row 0, so End stays on the last message. Typing or
 Enter returns to COMPOSE; Enter does not send while CONVERSATION is active.
 The active title is reversed and marked active.
 
@@ -79,14 +80,18 @@ uses sender, packet ID, network/channel path, destination and payload (not
 text alone), retaining at most 1000 packets for five minutes. No-ID packets
 cannot be safely merged.
 
-Each header ends with the sender's last known position. A valid fix is
-`lat,lon >> https://maps.google.com/?q=lat,lon` on that same header. The pane
-wraps on ` · `, and only at ` >> ` if the GPS field itself does not fit, so
-the coordinate is not split. This is the compact Maps URL; a maps.app.goo.gl
-code cannot be minted without a Google share request. Unknown, unset, or
-out-of-range positions display `GPS N/A` and omit the URL. `0,0` is kept when
+Each header ends with its direction and transport. Sender and receiver positions
+are not painted there. `SENDER` and `RECEIVER` sit to the right of
+CONVERSATION. A broadcast destination shows the channel name, not the word
+broadcast. Ctrl+T cycles COMPOSE, CONVERSATION, SENDER, and RECEIVER.
+A valid fix is the underlined coordinate.
+Click it, or press `g` while CONVERSATION, SENDER, or RECEIVER is active, to open
+`https://maps.google.com/?q=lat,lon`. The URL is not painted. Curses cannot
+hide a link inside the coordinate text. Unknown, unset, or
+out-of-range positions display `GPS: N/A` and omit the URL. A broadcast
+receiver has no single position, so that field is `GPS: N/A`. `0,0` is kept when
 a real location source is present and omitted when the source is unset. The
-value is the last position recorded for that sender, not a freshness guarantee.
+value is the last position recorded for that node, not a freshness guarantee.
 
 MQTT TX uses `channel.<name>.from` when set, otherwise the connected radio's
 node number, otherwise a node-shaped `mqtt.client_id`. It does not publish the

data/documentation/Installation.md

@@ -381,8 +381,27 @@ edited SOP `SKILL.md`). Generated module skills under `etc/default_skills/pwn/`
 `PWN::` module, plus `references/` when the source has CWE/NIST/URLs) are
 copied to `~/.pwn/skills/pwn/` and **are** overwritten on
 `pwn setup --migrate` / first launch so they stay in sync with `lib/pwn`.
-`bundle exec rake` runs `:module_skills` (`PWN::ModuleSkills.refresh!`)
-before spec so `etc/default_skills/pwn` matches live `PWN::` class methods.
+`bundle exec rake` does not rewrite `etc/default_skills/pwn`. `rake module_skills`
+is the explicit regenerate. A spec or rake run that writes the checkout
+leaves a local `SKILL.md` edit, and the next `upgrade_pwn.sh` merge aborts.
+The upgrade saves modified generated module `SKILL.md` files in a named Git
+stash before merging; it does not automatically reapply those stale files.
+Skills marked `preserve: true` and unrelated edits are left alone.
+
+For a clone already blocked before it can obtain this fix, no reclone is needed:
+
+```bash
+cd /opt/pwn
+git stash push -m 'pwn: preserve legacy generated skills before upgrade' -- etc/default_skills/pwn
+./upgrade_pwn.sh
+```
+
+The stash preserves the prior skill edits for review with `git stash list` and
+`git stash show -p`. Do not blindly pop it after upgrading: that restores stale
+generated files and can recreate the conflict. The one-time command saves all
+edits under that skill subtree, including any hand-edited skills; recover those
+selectively after reviewing them. Other local changes are not stashed.
+
 `pwn setup --migrate` and `pwn-ai` start copy that tree to `~/.pwn/skills/pwn`. Add at least one
 LLM engine key with the `pwn-vault` REPL command to enable `pwn-ai` - see
 [Configuration](Configuration.md). `pwn setup` will report the AI-engine

data/documentation/pwn-REPL.md

@@ -102,14 +102,16 @@ session only; it is not written to disk.
 
 ### Message transport labels
 
-Each CONVERSATION header ends with its direction and the transport used for
-that individual message: `· RX via MQTT`, `· TX via Serial`, `· RX via Bluetooth`,
-or `· TX via TCP`. In `auto` mode this is the resolved connection, not the
-configured `auto` value. Received messages retain the subscribing transport's
+Each CONVERSATION header ends with `RX via <TRANSPORT>` or `TX via <TRANSPORT>`.
+SENDER and RECEIVER do not show that label. Ctrl+T cycles COMPOSE,
+CONVERSATION, SENDER, and RECEIVER. In `auto` mode this is the
+resolved connection, not the configured `auto` value. Received messages retain the subscribing transport's
 origin through queued rendering, even if the current transport changes.
 Missing origin metadata is shown as `Unknown`, not guessed from the current pin.
+GPS is not part of the header. SENDER and RECEIVER sit to the right of
+CONVERSATION. A broadcast receiver shows the channel name.
 
-Headers use `timestamp encryption · SHORT NAME · source path · destination path · direction via transport`,
+Headers use `timestamp encryption · SHORT NAME · source path · destination path · RX via <TRANSPORT>`,
 with exactly one space on either side of each `·`. RX uses the sender's
 `User.short_name` (`shortName` in JSON); TX uses the sending local node's User,
 never the destination's name. Device connections use their NodeInfo/NODEINFO
@@ -125,8 +127,8 @@ Unicode text and internal spaces are retained. Names are labels, not authenticat
 For example (placeholder node IDs):
 
 ```text
-2026-01-02 03:04:05+0000 🔍 · PEER · US/CA/2/e/LongFast/!aabbccdd · US/CA/2/e/LongFast/# · RX via MQTT
-2026-01-02 03:04:06+0000 🔍 · SELF · US/CA/2/e/LongFast/!bbccddee (ME) · US/CA/2/e/LongFast/# · TX via Serial
+2026-01-02 03:04:05+0000 🔍 · PEER · US/CA/2/e/LongFast/!aabbccdd · US/CA/2/e/LongFast/#
+2026-01-02 03:04:06+0000 🔍 · SELF · US/CA/2/e/LongFast/!bbccddee (ME) · US/CA/2/e/LongFast/#
 ```
 
 The timestamp, encryption indicator, source/destination paths, channel and

data/etc/default_skills/pwn/plugins/repl/mesh/references/urls.md

@@ -1,3 +1,4 @@
 # PWN::Plugins::REPL::Mesh source links
 
 - https://maps.google.com/?q=[redacted]
+- https://maps\.google\.com/\?q=-?\d+\.\d+,-?\d+\.\d+\z}