Mark-VIII/docs/superpowers/specs/2026-08-18-attacks-sync-harness-design.md

Mark VIII Night Sprint — Attacks, Sync, Harness

Date: 2026-08-18 Status: Approved (user: "Approved, go build")

Problem

The Mark VIII web UI (Pager firmware Pineapple Pager 24.10.1) is rough and desyncs from the device. Interrogation (2026-08-18, live device 172.16.52.1) found:

1. pineapd crash-loop: 34+ SIGSEGVs in logread; stock daemon restarts pineapd every ~30s. Root cause: SSID-pool broadcast (68 SSIDs, disable='0') segfaults pineapd; wlan1mon repeatedly fails to come up ("That device is not up" / "interface sysfs directory does not exist" every 5s).
2. State desync: GET /api/pineap/mode returns mode: "unknown" while the device is effectively Active; mode is a UI-stored preference, never derived from live state.
3. Wrong-band AP cards: get_ap reads radio1 (wlan1wpa/wlan1open) whenever those UCI sections exist (even disabled leftovers), so the 2.4GHz Evil WPA card silently shows 5GHz state.
4. Evil Enterprise is dead code: views.pineap_enterprise exists but has no route in app.js routes map and no tab.
5. Fire-and-forget writes: UI toasts success without verifying device state.
6. Hop hygiene: radio1-AP feature pauses wlan1mon hop and leaves it paused with leftover AP sections.

Research findings (verified on device)

• Enterprise AP recipe: create wireless.wlan0ent (device radio0, mode ap, encryption wpa2, key = passphrase), then PUT /api/settings/wifi/set_ap over unix socket /tmp/api.sock with {"configs":[{"interface":"wlan0ent","ssid":...,"enctype":"wpa2", "enabled":true,"key":...,"channel":1}]}. Result: wlan0ent AP live with ieee8021x=1, wpa=2, wpa_key_mgmt=WPA-EAP (PineAPE internal EAP server). Daemon-side hostapd reload is async (poll for iface in iw dev).
• hcxpcapngtool, tcpdump, sqlite3, aircrack-ng present on device.
• MCP Streamable HTTP transport (2025-06-18): single endpoint, POST JSON-RPC, respond application/json or SSE; Origin validation + auth required.
• Daemon unix-socket API (/tmp/api.sock) carries /api/pineap/*; TCP :1471 carries /api/settings/* and /api/login.

Design

Phase 1 — Attacks (top-level menu item)

New side-menu section Attacks with three launchers:

• Evil WPA (PSK): SSID, passphrase, enctype (psk2/sae/owe), band+channel (2.4 → wlan0wpa, 5/6 → wlan1wpa via radio1 feature), hidden. Deploy = UCI write + hop pause + wifi reload + PineAP response engine + karma on + handshake logging on. Stop = disable AP + hop resume. Live AP status from iw dev/UCI (never UI cache), live handshake table (hostap_handshake), Export .hc22000 (on-device hcxpcapngtool) + hashcat command, per-client deauth with band-aware inject interface.
• Evil Open: same shape for wlan0open / radio1 open AP.
• Evil Enterprise: SSID, encryption (wpa2/wpa3 enterprise), passphrase. Deploy = verified recipe above + PineAPE on + auth-pass capture on. Live cred tables (hostap_basic, hostap_chalresp) with Clear.

All three: verification banner ("applied & verified" vs "device state differs"), Stop button, and a post-write poll (UCI + iw dev) before success toast.

Phase 2 — Stabilize + sync

• SSID pool broadcast disabled on deploy of this build; server-side health monitor: _pineap PING every 15s; two failures → check SIGSEGV growth in logread → disable pool, restart pineapd, ip link set wlan1mon up.
• Mode derived from live enabled + collect + advertise; never "unknown" when state is readable.
• get_ap returns radio0 + radio1 + enterprise APs as separate objects.
• All writes verified by re-read; success only on match.
• Hop resumed when no radio1 AP active; leftover radio1 sections reported.

Phase 3 — Local Harness (MCP)

• POST /mcp on server.py: Streamable HTTP MCP server (JSON-RPC 2.0, pure socket, no deps), auth via session cookie/Bearer + Origin validation.
• Tools: recon.query, attack.deploy_evil_wpa / deploy_evil_open / deploy_evil_enterprise / stop_attack, attack.deauth, attack.capture, loot.handshakes, loot.export_hc22000, loot.enterprise_creds, device.state, pineap.set_filter, pineap.kick_client.
• Resources: recon DB tables (ssid, wifi_device, handshake, hostap_handshake, hostap_basic, hostap_chalresp), handshake files, loot listing, and the opencode skills (pineapple-control, wifi-deauth, aircrack-suite) as markdown resources.
• Prompts: attack playbooks (evil-wpa, evil-enterprise, recon).
• Harness UI page: endpoint + client config snippets (opencode/Claude/ Cursor), capability explorer, "prompt for pi.dev" generator, live state snapshot.
• Optional stdio wrapper scripts/harness_stdio.py for stdio-only agents.

Constraints

• Authorized target: <authorized-test-ssid> only (intermittent). Non-client environment; no deauth blasts; verify on-wire via monitor capture when needed.
• SSID pool stays disabled (stock bug; re-enabling re-crashes pineapd).

Out of scope

1471 takeover, Cloud C2, campaigns, physical display mirroring.