pwn 0.5.706 → 0.5.707

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f9233042c1c9518d8cfdcbfe6499eb521cb0348384554e03ab6641abdda253b9
-  data.tar.gz: 51b81fd36f292bc54e762d4bb47f5641c9b263addf9f37997aaa4c2f6a00c49f
+  metadata.gz: 4c1b656d9d2cde2b5141da85cc87dbce6985f3f1f264d81c25fd5607121459d7
+  data.tar.gz: e84304c2573991adf9e99eeff5ec29d4dcad224d719016f81ce3c675b29cbb06
 SHA512:
-  metadata.gz: 370d8b9305f7dcd2a692061b6708feca282546109533131d244cd97d207d1b216afac16baf44847a8a098c9847467208dd30e81084729f79ee7e3c16c050ae32
-  data.tar.gz: 97725299f78baef12d73614b7258ebf5cc3664316c82d2bf53d6a82e3d9e0e0d2542a3143cbc686fc75b46b6883fb8edc0174cfd38ce74b88a0c908ab4864642
+  metadata.gz: d7367762d5ee2d30b01ef7b01ba51020a0532459c50d3cc4b327818ebfebae1491253ba0ce1edd264085832ca738f32a0a91d6c1c1fa22c40eada9df79009b91
+  data.tar.gz: 6ee7b63319321faeb9a62f94c5177ddf83d2ac4d2b3353e8a19ce96a8d3d67d6a090aacb7f976a75ccf7ce28e0ea698923ef044e1026d24c435f147fba1198e0

data/Gemfile

@@ -49,7 +49,7 @@ gem 'jwt', '3.2.0'
 gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
-gem 'mcp', '1.3.0'
+gem 'mcp', '1.4.0'
 gem 'meshtastic', '0.0.175'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.25.0'

data/documentation/Reporting.md

@@ -9,6 +9,7 @@
 
 | Module | Consumes | Emits |
 |---|---|---|
+| `Reports::PDF` / `HTML` / `Markdown` / `XML` / `CSV` / `JSON` | findings Hash | `.pdf` / `.html` / `.md` / `.xml` / `.csv` / `.json` |
 | `Reports::SAST` | `PWN::SAST::Factory` output | HTML (with `HTMLHeader`/`HTMLFooter`) + JSON |
 | `Reports::Fuzz` | `PWN::Plugins::Fuzz` crash log | HTML + JSON |
 | `Reports::URIBuster` | `pwn_www_uri_buster` output | HTML |

data/etc/default_skills/pwn/reports/SKILL.md

@@ -28,11 +28,13 @@ Class methods take `(opts = {})` and read `opts`.
 
 ```ruby
 PWN::Reports.help
-PWN::Reports.help(opts)
+PWN::Reports.resolve_path(opts)
 ```
 
 ## Public methods
 
+- `resolve_path`
+- `report_payload`
 - `authors`
 - `help`
 
@@ -46,5 +48,5 @@ PWN::Reports.help(opts)
 
 ## Verification
 
-`PWN::Reports.respond_to?(:authors)` after the
+`PWN::Reports.respond_to?(:resolve_path)` after the
 module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/csv/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-csv
+description: Drive PWN::Reports::CSV from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::CSV
+  source: pwn/reports/csv.rb
+---
+
+# PWN::Reports::CSV
+
+Generic CSV report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::CSV` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/csv.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::CSV.help
+PWN::Reports::CSV.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/csv.rb`
+
+## Verification
+
+`PWN::Reports::CSV.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/html/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-html
+description: Drive PWN::Reports::HTML from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::HTML
+  source: pwn/reports/html.rb
+---
+
+# PWN::Reports::HTML
+
+Generic HTML report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::HTML` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/html.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::HTML.help
+PWN::Reports::HTML.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/html.rb`
+
+## Verification
+
+`PWN::Reports::HTML.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/json/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-json
+description: Drive PWN::Reports::JSON from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::JSON
+  source: pwn/reports/json.rb
+---
+
+# PWN::Reports::JSON
+
+Generic JSON report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::JSON` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/json.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::JSON.help
+PWN::Reports::JSON.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/json.rb`
+
+## Verification
+
+`PWN::Reports::JSON.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/markdown/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-markdown
+description: Drive PWN::Reports::Markdown from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::Markdown
+  source: pwn/reports/markdown.rb
+---
+
+# PWN::Reports::Markdown
+
+Generic Markdown report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::Markdown` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/markdown.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::Markdown.help
+PWN::Reports::Markdown.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/markdown.rb`
+
+## Verification
+
+`PWN::Reports::Markdown.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/pdf/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-pdf
+description: Drive PWN::Reports::PDF from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::PDF
+  source: pwn/reports/pdf.rb
+---
+
+# PWN::Reports::PDF
+
+Generic PDF report writer for pentest / findings payloads. Emits a minimal PDF 1.4 document (no wkhtmltopdf).
+
+## When to use
+
+Call `PWN::Reports::PDF` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/pdf.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::PDF.help
+PWN::Reports::PDF.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/pdf.rb`
+
+## Verification
+
+`PWN::Reports::PDF.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/etc/default_skills/pwn/reports/xml/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: pwn-reports-xml
+description: Drive PWN::Reports::XML from pwn_eval.
+license: MIT
+allowed-tools: [pwn, pwn_eval]
+metadata:
+  bundled: true
+  generated: true
+  module: PWN::Reports::XML
+  source: pwn/reports/xml.rb
+---
+
+# PWN::Reports::XML
+
+Generic XML report writer for pentest / findings payloads.
+
+## When to use
+
+Call `PWN::Reports::XML` from `pwn_eval` when the task needs this module.
+Do not reimplement it in shell.
+
+## Methodologies
+
+Generated from `pwn/reports/xml.rb`. Prefer the public class methods below.
+Class methods take `(opts = {})` and read `opts`.
+
+## How to call
+
+```ruby
+PWN::Reports::XML.help
+PWN::Reports::XML.generate(opts)
+```
+
+## Public methods
+
+- `generate`
+- `authors`
+- `help`
+
+## Source
+
+`pwn/reports/xml.rb`
+
+## Verification
+
+`PWN::Reports::XML.respond_to?(:generate)` after the
+module is loaded. Read the source for parameter names.

data/lib/pwn/ai/agent/curriculum.rb

@@ -94,15 +94,7 @@ module PWN
                          []
                        end
           cool = load_cooldown
-          # P17 — prefer budget-exhaustion fingerprints (agent_loop / critic)
-          # so nightly self-play attacks the #1 live skill gap first.
-          candidates = candidates.sort_by do |m|
-            t = m[:tool].to_s
-            e = m[:error].to_s.downcase
-            budget = t == 'agent_loop' || t == 'assistant_answer' ||
-                     e.include?('budget exhausted') || e.include?('iteration budget')
-            [budget ? 0 : 1, -m[:count].to_i]
-          end
+          candidates = candidates.sort_by { |m| -m[:count].to_i }
           targets = candidates.reject { |m| practice_skip?(mistake: m, cooldown: cool) }.first(limit)
           results = []
 
@@ -112,7 +104,7 @@ module PWN
 
               prompts = generate_reproducers(mistake: m, count: [per, 2].max)
               runs = dry_run ? [] : prompts.map { |p| self_play(prompt: p, tag: "practice:#{m[:signature]}") }
-              solved = runs.select { |r| r[:score].to_f >= 0.7 }
+              solved = runs.select { |r| r[:score].to_f >= 0.6 }
               mean = runs.empty? ? 0.0 : (runs.sum { |r| r[:score].to_f } / runs.length)
               resolved = false
               # 2.4 — auto-resolve only with N≥2 holdout successes + store trace
@@ -129,7 +121,12 @@ module PWN
                 trace_ok = winning.length >= 20 && (
                   !budgetish || winning.match?(/→|shell|pwn_eval|tool/i) || best[:final].to_s.length.between?(1, 800)
                 )
-                unless trace_ok
+                poc_ok = if budgetish || %w[agent_loop assistant_answer].include?(m[:tool].to_s)
+                           practice_poc_ok?(run: best)
+                         else
+                           true
+                         end
+                unless trace_ok && poc_ok
                   bump_cooldown!(cooldown: cool, signature: m[:signature], mean: mean) unless dry_run
                   results << {
                     signature: m[:signature], tool: m[:tool], prompts: prompts,
@@ -895,15 +892,11 @@ module PWN
                      'Return Dir.pwd from pwn_eval'
                    ]
                  when 'agent_loop', 'assistant_answer'
-                   # P17 — dominant live failure: iteration / critic budget exhaustion.
-                   # Practise finishing under a tight tool budget, not shell shapes.
                    [
-                     'Answer in one shell call: print kernel release with uname -r',
-                     'In at most two tools, show cwd and ruby version then stop',
-                     'Give a final answer with no tools: what is 7 times 8?',
-                     'Finish under three iterations: list /tmp and report file count',
-                     'Do not explore — one pwn_eval of Dir.pwd and return the path',
-                     'Short plan then one command: show free disk with df -h /'
+                     'Write a working PoC to /tmp/pwn-practice-poc.txt that proves the issue, then stop',
+                     'Save a chained-impact PoC under /tmp/pwn-practice-chain.txt with reproduction steps',
+                     'Use pwn_eval to call PWN::Reports::JSON.generate with a findings hash to /tmp/pwn-practice-findings.json',
+                     'Produce evidence-backed severity in /tmp/pwn-practice-sev.md including a PoC path'
                    ]
                  else
                    if err.include?('budget exhausted') || err.include?('iteration budget') ||
@@ -1000,7 +993,7 @@ module PWN
             capped = true
           end
           begin
-            final = Loop.run(request: prompt, session_id: sid, enabled_toolsets: %w[terminal pwn memory learning])
+            final = Loop.run(request: prompt, session_id: sid)
           ensure
             if capped && defined?(PWN::Env) && PWN::Env[:ai].is_a?(Hash) && PWN::Env[:ai][:agent].is_a?(Hash) && !PWN::Env[:ai][:agent].frozen?
               if prev_max == :__unset__
@@ -1083,6 +1076,15 @@ module PWN
           nil
         end
 
+        private_class_method def self.practice_poc_ok?(opts = {})
+          run = opts[:run] || {}
+          blob = "#{run[:final]}\n#{run[:trace]}\n#{run[:prompt]}"
+          paths = blob.scan(%r{(/tmp/[A-Za-z0-9._+-]+)})
+          paths.flatten.any? { |path| File.file?(path) && File.size(path).positive? }
+        rescue StandardError
+          false
+        end
+
         private_class_method def self.ask_persona(opts = {})
           return nil unless defined?(Swarm)
 

data/lib/pwn/ai/agent/learning.rb

@@ -568,9 +568,9 @@ module PWN
 
           # R1 judge — always attempt (heuristic is cheap; LLM gated inside)
           stages_run << :judge
-          v = Reward.judge(request: opts[:request], final: opts[:final], session_id: session_id, proxy_ok: proxy_ok, predicted: opts[:predicted], plan: opts[:plan]) if defined?(Reward)
+          v = Reward.judge(request: opts[:request], final: opts[:final], session_id: session_id, proxy_ok: proxy_ok, predicted: opts[:predicted]) if defined?(Reward)
           v ||= { score: proxy_ok ? 1.0 : 0.0, success: proxy_ok, verdict: proxy_ok ? :solved : :wrong }
-          v[:score] = [v[:score], 0.3].min if crit[:verdict] == :flaw
+          v[:score] = [v[:score], 0.3].min if crit[:verdict] == :flaw && v[:score].to_f < 0.6
           # P29 — critic floor used to leave stale verdict=:solved at score=0.3,
           # producing learning.jsonl rows tagged "solved" with success=false
           # (116+ rows). Always resync verdict/success from the final score.
@@ -598,14 +598,7 @@ module PWN
           if defined?(Reward) && Reward.respond_to?(:plan_coverage)
             begin
               plan_for_cov = opts[:plan]
-              plan_for_cov = opts[:ts_state][:plan] if plan_for_cov.nil? && opts[:ts_state].is_a?(Hash)
-              if plan_for_cov.nil? && defined?(TaskSummarizer)
-                # Recover numbered tasks from the final/request only when caller
-                # did not pass a plan — still keeps TaskSummarizer out of the
-                # credit path (parse is pure text).
-                plan_for_cov = nil
-              end
-              if !plan_for_cov.nil? || opts[:final].to_s.length.positive?
+              unless plan_for_cov.nil?
                 plan_cov = Reward.plan_coverage(
                   plan: plan_for_cov || [],
                   final: opts[:final],