pwn 0.5.622 → 0.5.626

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4aeb484ae013e0feb9648009d60cfc493bbd4ec98ba42193745af669ed70bcc
-  data.tar.gz: 2dcffdf992ee24a9c8a10ae7b83c743ad5b6b1aed83e70063da56e8cf6e9ea85
+  metadata.gz: 67a226a1a110698db44ee0378d3f9a5fd290d96d633487a3dd4a7e72c1ac09d9
+  data.tar.gz: 8acea5ce6ab68d30486aef426c176611f379a31acf3092cdea7ced91e8dbf8e9
 SHA512:
-  metadata.gz: 2468ec9291d44be94de1f3877441380e60cde34e24953f6ac677bd39f0679c82ab6f82f6554b7fcacf1348b0c751c63bf8d8a23a369ac665023b5a9e74cc3a01
-  data.tar.gz: 722765fd660ca9da266a170da45f65eb061886b7629557143436a0765412dc89d3de3e56ac8f5bd8e9b32e5f25831d3644ac3568d851f6ac5f7629531b9e7768
+  metadata.gz: 48c6bca36c123d6419ee8fd12ff6813e2ab405b4fbd92fb31d1c64aea4ca3a2f75ee25e06e5db61d6db9d58775f8228b51783396c1c8e688dcf6afd224720025
+  data.tar.gz: 022c9adac00e0ccab76bbd4f6c86d603a32a55ce41e4e0b7d6093a59e52834b4692dbb700bb0e1c8ee2ba50bc0be1a5dd6db0fc80b76308d34188be1f623ce25

data/.rubocop.yml

@@ -16,9 +16,9 @@ Metrics/ClassLength:
 Metrics/CyclomaticComplexity:
   Max: 158
 Metrics/MethodLength:
-  Max: 733
+  Max: 800
 Metrics/ModuleLength:
-  Max: 1592
+  Max: 2900
 Metrics/PerceivedComplexity:
   Max: 157
 Style/HashEachMethods:

data/README.md

@@ -1,5 +1,11 @@
 ![PWN](https://raw.githubusercontent.com/0dayInc/pwn/master/documentation/PWN.png)
 
+<p align="center">
+  <img src="documentation/pwn_silent_help_learn_demo.gif" alt="PWN Silent Demo — Help Surfaces + Learning Feedback Loop" width="640">
+  <br>
+  <em>Silent walkthrough: <code>pwn</code> help surfaces → <code>pwn-ai</code> → recon → mistakes / learning / extrospection feedback loop</em>
+</p>
+
 ### **Table of Contents** ###
 
 - [Intro](#intro)
@@ -52,7 +58,7 @@ Five layers, edges only ever go down:
 
 The AI layer closes a **self-improvement loop** on every turn — Metrics +
 Learning + **Mistakes** (introspection / negative feedback) joined with
-Snapshot + Drift + Intel + RF + **Web** (extrospection) — plus browser-backed **`extro_verify`** self fact-checking — via `extro_correlate`, so the
+Snapshot + Drift + Intel + RF + **Web** (extrospection) — plus browser-backed **`extro_verify`** / **`extro_watch`** and RF **`extro_rf_tune`** sensing — via `extro_correlate`, so the
 agent knows whether a failure was *its* fault or *the world* changed —
 **and does not repeat the same mistake twice**:
 

data/bin/pwn_gqrx_scanner

@@ -76,8 +76,8 @@ PWN::Driver::Parser.new do |options|
     opts[:fft_scan] = f
   end
 
-  options.on('--sample-rate=RATE', '<Optional --fft-scan - Visible span/sample_rate in Hz (default 1_000_000). NOTE: no short flag; -S is --strength-lock>') do |s|
-    opts[:sample_rate] = s
+  options.on('--input-rate=RATE', '<Optional --fft-scan - GQRX Input rate / visible span in Hz (default 1_000_000). NOTE: no short flag; -S is --strength-lock>') do |s|
+    opts[:input_rate] = s
   end
 
   options.on('-NINT', '--nfft=INT', '<Optional --fft-scan - FFT bin size (default 2048)>') do |n|
@@ -100,13 +100,21 @@ PWN::Driver::Parser.new do |options|
     opts[:strength_offset_db] = o
   end
 
-  options.on('--min-snr-db=FLOAT', '<Optional --fft-scan - Minimum SNR (dB above per-chunk noise floor) to report a signal (default 12.0)>') do |m|
+  options.on('--min-snr-db=FLOAT', '<Optional --fft-scan - Minimum SNR (dB above per-chunk noise floor) to report a signal (default 18.0)>') do |m|
     opts[:min_snr_db] = m
   end
 
-  options.on('--min-bw-ratio=FLOAT', '<Optional --fft-scan - Reject FFT peaks narrower than RATIO * band-plan bandwidth as spurs (default 0.30)>') do |r|
+  options.on('--min-bw-ratio=FLOAT', '<Optional --fft-scan - Reject FFT peaks narrower than RATIO * band-plan bandwidth as spurs (default 0.0 = off)>') do |r|
     opts[:min_bw_ratio] = r
   end
+
+  options.on('--no-refine', '<Optional --fft-scan - Skip the post-FFT iterative edge/peak refine pass that locks the exact channel frequency (default: refine ON)>') do
+    opts[:refine] = false
+  end
+
+  options.on('--refine-mode=MODE', '<Optional --fft-scan - Refine strategy: lock (default, fast S-meter raster hunt), fft (legacy local high-res FFT zoom), hybrid (both)>') do |m|
+    opts[:refine_mode] = m
+  end
 end.parse!
 
 begin
@@ -122,13 +130,55 @@ begin
   end
 
   profile = opts[:profile]
+
+  # Common user-facing aliases → canonical band_plans keys.
+  # (historical/typo names should not crash with Hash#merge! TypeError)
+  profile_aliases = {
+    'flex_pager' => 'pager_flex',
+    'flex' => 'pager_flex',
+    'pocsag_pager' => 'pager_pocsag',
+    'pocsag' => 'pager_pocsag',
+    'pager' => 'pager_all',
+    'pagers' => 'pager_all',
+    'adsb' => 'ads_b1090',
+    'adsb1090' => 'ads_b1090',
+    'adsb978' => 'ads_b978',
+    'fm' => 'fm_radio',
+    'noaa' => 'noaa_weather',
+    'wx' => 'noaa_weather',
+    'weather' => 'noaa_weather'
+  }.freeze
+
+  resolve_band_plan = lambda do |name|
+    return nil if name.nil?
+
+    key = name.to_s.strip.downcase.tr('-', '_').to_sym
+    key = profile_aliases[key.to_s].to_sym if profile_aliases.key?(key.to_s)
+    return key if band_plans.key?(key)
+
+    # fuzzy suggestions for helpful errors
+    cand = band_plans.keys.map(&:to_s)
+    suggestions = cand.select do |k|
+      k.include?(key.to_s) || key.to_s.include?(k) ||
+        k.split('_').intersect?(key.to_s.split('_'))
+    end
+    suggestions = cand.grep(/#{Regexp.escape(key.to_s.split('_').first)}/i) if suggestions.empty? && !key.to_s.empty?
+    msg = "ERROR: Unknown band plan profile: #{name.inspect}."
+    msg += " Did you mean: #{suggestions.sort.first(8).join(', ')}?" unless suggestions.empty?
+    msg += ' Use --list-band-plans to display supported profiles.'
+    raise msg
+  end
+
+  profile_key = resolve_band_plan.call(profile)
+  warn "[*] alias #{profile.inspect} → band plan #{profile_key}" if profile_key && profile.to_s.strip.downcase.tr('-', '_') != profile_key.to_s
+
   # Merge opts with profile values if profile provided
-  opts.merge!(band_plans[profile.to_sym]) unless profile.nil?
+  opts.merge!(band_plans[profile_key]) unless profile_key.nil?
 
   scan_ranges = opts[:scan_ranges]
-  raise 'ERROR: --assume-band-plan || --scan-ranges is required.' if scan_ranges.nil? && profile.nil?
+  raise 'ERROR: --assume-band-plan || --scan-ranges is required.' if scan_ranges.nil? && profile_key.nil?
 
-  ranges = band_plans[profile.to_sym][:ranges] unless profile.nil?
+  ranges = band_plans[profile_key][:ranges] unless profile_key.nil?
   if ranges.nil?
     # Convert comma-delimited string to array of hashes
     ranges = scan_ranges.split(',').map do |r|
@@ -179,11 +229,19 @@ begin
   location = opts[:location]
 
   # Merge opts one last time to ensure parameters passed to the driver are included
-  opts.merge!(band_plans[profile.to_sym]) unless profile.nil?
+  opts.merge!(band_plans[profile_key]) unless profile_key.nil?
 
   fft_scan = opts[:fft_scan]
-  sample_rate = opts[:sample_rate] || 1_000_000
+  # Prefer (1) explicit --input-rate, (2) band-plan :input_rate from
+  # FrequencyAllocation (merged above), (3) historic 1 Msps default.
+  # GQRX device Input rate is separate from this *assumption* — use
+  # PWN::SDR::GQRX.apply_band_plan_input_rate to push the plan rate into
+  # ~/.config/gqrx/*.conf for the connected SDR.
+  # Local var + fast_scan_range kwarg remain sample_rate for library parity.
+  sample_rate = opts[:input_rate] || 1_000_000
   sample_rate = sample_rate.to_i
+  puts "[*] input_rate (FFT/scan chunk / IQ span assumption): #{sample_rate} Hz" \
+       "#{" (band plan #{profile_key})" if profile_key}"
   nfft = opts[:nfft] || 2048
   nfft = nfft.to_i
   avgv = opts[:avg] || 8
@@ -200,6 +258,11 @@ begin
 
   if fft_scan
     puts '[*] --fft-scan requested: using fast FFT panoramic mode (#fast_scan_range)'
+    refine_flag = opts.fetch(:refine, true)
+    puts "[*] band-plan / session params: mode=#{demodulator_mode.inspect} bw=#{bandwidth.inspect} " \
+         "squelch=#{squelch.inspect} precision=#{precision} decoder=#{decoder.inspect} " \
+         "rf_gain=#{rf_gain.inspect} if_gain=#{intermediate_gain.inspect} bb_gain=#{baseband_gain.inspect} " \
+         "refine=#{refine_flag}"
     fast_resp = PWN::SDR::GQRX.fast_scan_range(
       gqrx_sock: gqrx_sock,
       ranges: ranges,
@@ -213,9 +276,15 @@ begin
       min_snr_db: min_snr_db,
       precision: precision,
       min_bw_ratio: min_bw_ratio,
+      refine: opts.fetch(:refine, true),
+      refine_mode: opts[:refine_mode] || :lock,
       demodulator_mode: demodulator_mode,
       bandwidth: bandwidth,
       squelch: squelch,
+      audio_gain_db: audio_gain_db,
+      rf_gain: rf_gain,
+      intermediate_gain: intermediate_gain,
+      baseband_gain: baseband_gain,
       decoder: decoder,
       location: location,
       scan_log: scan_log

data/documentation/Agent-Tool-Registry.md

@@ -6,7 +6,7 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 
 ![Tool registry](diagrams/agent-tool-registry.svg)
 
-## Toolsets → Tools  (10 toolsets · 54 tools)
+## Toolsets → Tools  (10 toolsets · 61 tools)
 
 | Toolset | Tools | Backed by |
 |---|---|---|
@@ -17,7 +17,7 @@ toolsets; the JSON-Schema for each tool is what the model actually sees.
 | `sessions` | `sessions_list` · `sessions_view` · `sessions_current` · `sessions_delete` · `sessions_stats` | `PWN::Sessions` → `~/.pwn/sessions/` |
 | `learning` | `learning_note_outcome` · `learning_reflect` · `learning_distill_skill` · `learning_stats` · `learning_outcomes` · `learning_consolidate` · `learning_reset` · `learning_auto_introspect_toggle` · **`mistakes_list`** · **`mistakes_record`** · **`mistakes_resolve`** · **`mistakes_reset`** | `PWN::AI::Agent::Learning` + `PWN::AI::Agent::Mistakes` → `~/.pwn/learning.jsonl` + `~/.pwn/mistakes.json` |
 | `metrics` | `metrics_summary` · `metrics_reset` | `PWN::AI::Agent::Metrics` → `~/.pwn/metrics.json` |
-| `extrospection` | `extro_snapshot` · `extro_drift` · `extro_observe` · `extro_observations` · `extro_intel` · **`extro_watch`** · **`extro_verify`** · `extro_correlate` · `extro_stats` · `extro_reset` · `extro_auto_toggle` | `PWN::AI::Agent::Extrospection` (+ `PWN::Plugins::TransparentBrowser`) → `~/.pwn/extrospection.json` |
+| `extrospection` | `extro_snapshot` · `extro_drift` · `extro_observe` · `extro_observations` · `extro_intel` · **`extro_watch`** · **`extro_verify`** · **`extro_rf_tune`** · **`extro_osint`** · **`extro_serial`** · **`extro_telecomm`** · **`extro_packet`** · **`extro_vision`** · **`extro_voice`** · `extro_correlate` · `extro_stats` · `extro_reset` · `extro_auto_toggle` | `PWN::AI::Agent::Extrospection` (+ Serial/Packet/OCR/Voice/BareSIP/TransparentBrowser) → `~/.pwn/extrospection.json` |
 | `cron` | `cron_list` · `cron_create` · `cron_run` · `cron_enable` · `cron_disable` · `cron_remove` | `PWN::Cron` → `~/.pwn/cron/jobs.yml` |
 | `swarm` | `agent_list` · `agent_spawn` · `agent_ask` · `agent_debate` · `agent_broadcast` · `swarm_bus` · `swarm_list` | `PWN::AI::Agent::Swarm` → `~/.pwn/agents.yml` + `~/.pwn/swarm/` |
 

data/documentation/Configuration.md

@@ -82,7 +82,7 @@ ai:
     max_iters: 25                  # Hard cap on tool-call rounds per user turn before a forced final answer.
     max_depth: 3                   # Recursion guard: how many levels deep agent_ask/agent_debate sub-agents may spawn sub-agents.
     auto_introspect: true          # Run Learning.auto_introspect (outcome logging + lesson mining) after every final answer.
-    auto_extrospect: false         # Also run Extrospection.auto_extrospect (host/toolchain/net/repo drift capture) after every final answer.
+    auto_extrospect: false         # Optional ambient baseline (host/repo/env ONLY — never launches burpsuite/zaproxy/msf/gqrx). Sense tools (intel/verify/watch/rf_tune/observe) stay on-demand.
     toolsets: ~                    # Allow-list of toolsets exposed to the agent. nil = all. Valid: cron, extrospection, learning, memory, metrics, pwn, sessions, skills, swarm, terminal.
     extrospection:
       web:
@@ -94,6 +94,11 @@ ai:
         per_page_timeout: 15       # Seconds before a single page render is abandoned and recorded as unreachable.
         screenshot: false          # Persist a PNG per anchor to ~/.pwn/extrospection/web/ (disk-heavy; off by default).
         allow_targets: false       # true → also merge top-level `targets:` into anchors (opt-in — off so in-scope hosts aren't touched unprompted).
+      rf:
+        host: 127.0.0.1            # GQRX remote-control host for extro_rf_tune.
+        port: 7356                 # GQRX remote-control port.
+        settle_secs: 8             # Seconds to sample RDS after tuning (max 30).
+        ttl: 300                   # Observation TTL for :rf (songs change — keep short).
 
 plugins:
   asm:
@@ -154,6 +159,10 @@ cron:
 
 targets:                           # Optional — engagement-scope URLs/hosts. Merged into :web snapshot anchors
   - https://target.example.com     #   ONLY when ai.agent.extrospection.web.allow_targets: true.
+| `ai.agent.extrospection.rf.host` | String | `127.0.0.1` | `Extrospection.rf_tune` | GQRX remote-control host for the RF sense organ. |
+| `ai.agent.extrospection.rf.port` | Integer | `7356` | `Extrospection.rf_tune` | GQRX remote-control port. |
+| `ai.agent.extrospection.rf.settle_secs` | Integer | `8` | `Extrospection.rf_tune` | Seconds to sample RDS after tuning (capped at 30). |
+| `ai.agent.extrospection.rf.ttl` | Integer | `300` | `Extrospection.rf_tune` | TTL (seconds) for `:rf` observations written by `extro_rf_tune` (ephemeral radio content). |
 ```
 
 ---
@@ -206,7 +215,7 @@ PWN::Config.refresh_env
 | `ai.agent.max_iters` | Integer | `25` | `PWN::AI::Agent::Loop.run`, `PWN::AI::Agent::Swarm` | Hard cap on tool-call rounds per user turn before a forced final answer. |
 | `ai.agent.max_depth` | Integer | `3` | `PWN::AI::Agent::Swarm` | Recursion guard for `agent_ask` / `agent_debate` sub-agents spawning sub-agents. |
 | `ai.agent.auto_introspect` | Boolean | `true` | `PWN::AI::Agent::Learning.auto_introspect` | Run outcome logging + lesson mining after every final answer. Toggle live via `learning_auto_introspect_toggle`. |
-| `ai.agent.auto_extrospect` | Boolean | `false` | `PWN::AI::Agent::Extrospection.auto_extrospect` | Also capture host/toolchain/net/repo drift after every final answer. Toggle live via `extro_auto_toggle`. |
+| `ai.agent.auto_extrospect` | Boolean | `false` | `PWN::AI::Agent::Extrospection.auto_extrospect` | Optional ambient baseline after every final answer (`AUTO_SECTIONS` = host/repo/env only; never spawns GUI/JVM tools). Prefer on-demand sense tools (`intel`/`verify`/`watch`/`rf_tune`/`observe`). Toggle live via `extro_auto_toggle`. |
 | `ai.agent.toolsets` | Array\<String\> \| `nil` | `nil` (all) | `bin/pwn`, `PWN::Plugins::REPL`, `PWN::AI::Agent::Registry` | Allow-list of toolsets exposed to the agent. Valid: `cron`, `extrospection`, `learning`, `memory`, `metrics`, `pwn`, `sessions`, `skills`, `swarm`, `terminal`. |
 | `ai.agent.extrospection.web.anchors` | Array\<String\> | `DEFAULT_WEB_ANCHORS` | `PWN::AI::Agent::Extrospection.probe_web` | URLs the headless browser fingerprints on `extro_snapshot(sections:[:web])`. Alias: `web_anchors`. |
 | `ai.agent.extrospection.web.proxy` | String | — | `Extrospection.probe_web` / `.verify` / `.watch` | Upstream proxy for `PWN::Plugins::TransparentBrowser` (e.g. `tor`, `http://127.0.0.1:8080`). |

data/documentation/Cron.md

@@ -37,9 +37,11 @@ cron_create(
 ```
 
 At 02:00 the system cron fires `PWN::Cron.run`, which spins up a headless
-`pwn-ai` turn. Because `auto_introspect` and `auto_extrospect` are on, the run
-also updates Learning/Metrics/Extrospection — so tomorrow's interactive
-session already knows what changed overnight.
+`pwn-ai` turn. With `auto_introspect` on (and optional `auto_extrospect` for
+the cheap `AUTO_SECTIONS` baseline), the run updates Learning/Metrics — and,
+if enabled, host/repo/env posture — so tomorrow's interactive session already
+knows what changed overnight. Sense tools (`intel`/`verify`/`watch`) stay
+on-demand; cron is not expected to launch Burp/ZAP/msf/GQRX.
 
 ```ruby
 cron_create(

data/documentation/Diagrams.md

@@ -59,7 +59,7 @@ groups) so lines never criss-cross.
 [source](diagrams/dot/ai-integration-tool-calling.dot) · doc: [AI Integration](AI-Integration.md)
 ![ai-integration-tool-calling](diagrams/ai-integration-tool-calling.svg)
 
-### Agent Tool Registry (10 toolsets · 54 tools)
+### Agent Tool Registry (10 toolsets · 61 tools)
 [source](diagrams/dot/agent-tool-registry.dot) · doc: [Agent Tool Registry](Agent-Tool-Registry.md)
 ![agent-tool-registry](diagrams/agent-tool-registry.svg)