Mark-VIII/docs/superpowers/plans/2026-08-18-attacks-sync-harness.md

Attacks + Sync + Harness Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Ship a trustworthy Mark VIII: one-click Evil WPA/Open/Enterprise attacks, device-truth state sync with a pineapd health monitor, and an on-device MCP harness.

Architecture: Extend the existing single-file server.py (pure-socket HTTP/JSON, no deps — the device python3 has no pip) with attack orchestration, a health-monitor thread, UCI-truth state reads, and a Streamable-HTTP MCP endpoint. Extend the vanilla-JS SPA (www/js/views.js, app.js) with an Attacks section and a Harness page. Tests are stdlib unittest with module-level monkeypatching (tests/test_*.py), run one module per process.

Tech Stack: Python 3.11 (stdlib only), vanilla JS, UCI (uci show/set), daemon unix-socket API (/tmp/api.sock), hak5cmd/_pineap, iw, logread, hcxpcapngtool (on device), MCP Streamable HTTP (2025-06-18).

Global Constraints

• No new Python deps; no pip; device python3-light-compatible (no urllib/http.server/sqlite3 stdlib).
• Truth = device state (UCI /etc/config/wireless, /etc/config/pineapd, iw dev, live pineapd socket), never UI cache.
• Attacks only against <authorized-test-ssid> (authorized). No deauth blasts; band-aware inject only.
• SSID pool broadcast stays disabled (stock SIGSEGV bug).
• Writes must be verified by re-read before success is reported.
• Follow existing code style: device_run(), daemon_sock_call(), _daemon_proxy() helpers; h() DOM helper in views; routes registered with ROUTER.add.
• Tests: python3 -m unittest tests.test_<module> (one module per process).

File Structure

• payload/user/remote_access/pager-webui/server.py — all backend: attacks API, health monitor, truth reads, MCP endpoint.
• payload/user/remote_access/pager-webui/www/js/views.js — Attacks + Harness views.
• payload/user/remote_access/pager-webui/www/js/app.js — routes + side-menu items.
• payload/user/remote_access/pager-webui/www/css/app.css — small additions for launchers.
• tests/test_attacks.py, tests/test_health.py, tests/test_mcp.py, tests/test_getap.py — new tests.
• scripts/harness_stdio.py — optional stdio MCP wrapper for stdio-only agents.

---

Task 1: Backend truth reads — get_ap dual-radio + enterprise + mode derivation

Files:

• Modify: payload/user/remote_access/pager-webui/server.py (h_pineap_wifi_get_ap, h_pineap_mode_get)

Interfaces:

• Produces: GET /api/pineap/wifi/get_ap → {open: {...radio0...}, wpa: {...radio0...}, radio1_open: {...}, radio1_wpa: {...}, enterprise: {enabled, ssid, enctype, key}, pool: {...}, radios: {radio0: {band,channel,...}, radio1: {...}}}

• Produces: GET /api/pineap/mode → mode derived from live state; never "unknown" when pineap_disabled/autossidpool readable.

• Step 1: Rework h_pineap_wifi_get_ap to read all three AP pairs from UCI (wlan0open/wlan0wpa on radio0, wlan1open/wlan1wpa on radio1, wlan0ent enterprise) and return them as separate objects; include radio device info per radio.

• Step 2: Rework h_pineap_mode_get: derive mode = advanced if autossidpool is False or engine mismatch with preset; passive/active from stored preset ONLY when consistent with live enabled+collect+advertise; else advanced (never unknown).

• Step 3: Update tests/test_pineap_modes.py + new tests/test_getap.py for the new shapes; run all test modules; commit.

Task 2: Attack orchestration backend

Files:

• Modify: payload/user/remote_access/pager-webui/server.py (new handlers + ROUTER.add)
• Test: tests/test_attacks.py

Interfaces:

• POST /api/attacks/deploy body {kind: 'wpa'|'open'|'enterprise', ...fields} → applies UCI + daemon, returns {ok, verified: bool, detail}

• POST /api/attacks/stop body {kind} → disables AP(s), resumes hop, returns {ok, verified}

• GET /api/attacks/status → per-kind {active, ssid, iface, channel, band, live (iw dev check), handshakes: n}

• GET /api/attacks/handshakes (reuse h_handshakes_get), GET /api/attacks/hc22000 → runs hcxpcapngtool -o on captured pcap(s) into /root/loot/hc22000/ and returns download

• POST /api/attacks/deauth {bssid, client, band} → band-aware inject: 2.4 → _pineap INTERFACE INJECT wlan0mon then PINEAPPLE_DEAUTH_CLIENT; 5/6 → wlan1mon

• POST /api/attacks/enterprise toggles PineAPE (pineape_disabled, pineape_auth_pass)

• Step 1: Write failing tests for deploy/stop/status/deauth (mock device_run, daemon_sock_call, hak5).

• Step 2: Implement handlers; verify tests pass; commit.

Task 3: Health monitor + stabilization

Files:

• Modify: payload/user/remote_access/pager-webui/server.py (thread + helpers)
• Test: tests/test_health.py

Interfaces:

• health_check() — _pineap PING; on failure twice in a row: count SIGSEGV in logread; if growing → uci set pineapd.@ssidpool[0].disable=1, restart pineapd; bring wlan1mon up (ip link set wlan1mon up) if iw dev shows it down; only one fix action per interval (cooldown 20s).

• start_health_monitor() — daemon thread every 15s, started on server boot.

• GET /api/health → {pineap: 'up'|'down', sigsegv_count, pool_disabled, wlan1mon_up, last_action, fixes: n}

• Step 1: Failing tests for health logic (mock device_run, hak5).

• Step 2: Implement; verify on-device that SIGSEGV count stops climbing; commit.

Task 4: Attacks UI

Files:

• Modify: www/js/views.js (3 launchers + shared shell), www/js/app.js (routes + menu), www/css/app.css

Interfaces:

• Menu: Attacks (icon attack) → #/attacks with tabs #/attacks/wpa, #/attacks/open, #/attacks/enterprise.

• Each launcher: fields + Deploy/Stop + status card (live from /api/attacks/status) + handshake/cred table + export buttons + deauth table of target clients.

• Step 1: Implement shared launcher shell + Evil WPA page (deploy/stop/status/export/deauth).

• Step 2: Evil Open page; Evil Enterprise page (creds table + clear + toggles).

• Step 3: Wire routes + menu; manual browser smoke test against device; commit.

Task 5: MCP harness server + Harness UI

Files:

• Modify: payload/user/remote_access/pager-webui/server.py (/mcp endpoint)
• Create: scripts/harness_stdio.py
• Modify: www/js/views.js, www/js/app.js (Harness page)

Interfaces:

• POST /mcp — Streamable HTTP MCP: initialize, notifications/initialized (202), tools/list, tools/call, resources/list, resources/read, prompts/list, prompts/get; JSON responses; session cookie auth + Origin validation.

• Tools wrap Task 1/2 endpoints + recon.query (sqlite3 CLI read-only) + loot.*.

• Resources: recon tables, handshake files, skill markdown (bundled copies of pineapple-control/wifi-deauth/aircrack-suite), loot listing.

• Prompts: evil-wpa-playbook, evil-enterprise-playbook, recon-playbook.

• GET /api/harness/capabilities → human-readable capability doc for the UI page.

• Step 1: Failing tests for MCP JSON-RPC dispatch (tests/test_mcp.py).

• Step 2: Implement /mcp + capabilities endpoint; tests pass; commit.

• Step 3: Harness UI page (endpoint info, config snippets, capability explorer, pi.dev prompt generator); commit.

Task 6: Deploy + on-device verification

• Step 1: Run full test suite locally (each module separately).
• Step 2: Deploy via ./scripts/deploy.sh --password '<device-password>'.
• Step 3: On-device smoke: login, status, health endpoint, attacks deploy/stop round-trip (Evil WPA on 2.4GHz with <authorized-test-ssid> SSID — no deauth), enterprise deploy/stop, MCP initialize+tools/list via curl.
• Step 4: Leave device in clean state (no active attacks, hop resumed, pool disabled, wlan1mon up).