pwn 0.5.712 → 0.5.714

data/lib/pwn/ai/agent/tool_guard.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require 'digest'
+require 'json'
+require 'fileutils'
+require 'securerandom'
 
 module PWN
   module AI
@@ -43,11 +46,50 @@ module PWN
         end
 
         public_class_method def self.bashism?(opts = {})
-          BASHISM_RX.match?(opts[:text].to_s)
+          BASHISM_RX.match?(shell_syntax_surface(text: opts[:text]))
         rescue StandardError
           false
         end
 
+        public_class_method def self.shell_syntax_surface(opts = {})
+          s = opts[:text].to_s.dup
+          s.gsub!(/<<[-~]?\s*(['"])(\w+)\1.*?^\2\s*$/m, ' ')
+          s.gsub!(/'[^']*'/, "''")
+          s
+        end
+
+        public_class_method def self.mint_canary(opts = {})
+          n = (opts[:bytes] || 8).to_i
+          n = 8 if n <= 0
+          tok = "PWNCANARY#{SecureRandom.hex(n)}"
+          Thread.current[:pwn_canary] = tok
+          tok
+        end
+
+        public_class_method def self.canary_leak?(opts = {})
+          tok = Thread.current[:pwn_canary].to_s
+          return false if tok.empty?
+
+          opts[:text].to_s.include?(tok)
+        end
+
+        public_class_method def self.injection_score(opts = {})
+          t = opts[:text].to_s
+          score = 0
+          score += 3 if t.match?(/ignore (all )?(previous|prior) (instructions|directives)/i)
+          score += 2 if t.match?(/system:\s|tool_call|function_call/i)
+          score += 2 if t.match?(/\bexfiltrat|\bdo not tell (the )?(user|operator)/i)
+          score
+        end
+
+        public_class_method def self.quarantine_output(opts = {})
+          text = opts[:text].to_s
+          score = injection_score(text: text)
+          return text unless score >= 3
+
+          "[QUARANTINED injection_score=#{score}]\n#{text}"
+        end
+
         public_class_method def self.shell_bash?
           v = (PWN::Env.dig(:ai, :agent, :shell_bash) if defined?(PWN::Env))
           v == true || v.to_s.match?(/\A(1|true|yes|on)\z/i)
@@ -63,6 +105,7 @@ module PWN
         # assign HTTP = "/path/http" or Digest = "(self.we" and then every
         # provider hop / payload_sig TypeErrors.
         CORE_CONSTS = %i[HTTP Digest JSON URI Timeout].freeze
+        RUNTIMES_FILE = File.join(Dir.home, '.pwn', 'metrics', 'runtimes.json')
 
         public_class_method def self.protect_http!
           protect_core_constants!
@@ -165,6 +208,9 @@ module PWN
           asked_i = asked.to_i
           return asked_i.clamp(1, TIMEOUT_MAX_S) if asked_i.positive?
 
+          learned = predicted_timeout(command_class: command_class(payload: opts[:payload].to_s))
+          return learned.clamp(1, TIMEOUT_MAX_S) if learned.to_i.positive?
+
           snap = host_load
           ncpu = [snap[:ncpu].to_i, 1].max
           load1 = snap[:load1].to_f
@@ -352,6 +398,96 @@ module PWN
           false
         end
 
+        public_class_method def self.scope_refusal(opts = {})
+          cmd = opts[:command].to_s
+          path = File.join(Dir.home, '.pwn', 'scope.yaml')
+          return nil unless File.file?(path)
+
+          require 'yaml'
+          scope = YAML.safe_load_file(path, permitted_classes: [Symbol]) || {}
+          return nil if scope.nil? || scope.empty?
+
+          allow = Array(scope['cidr_allowlist'] || scope[:cidr_allowlist]).map(&:to_s)
+          domains = Array(scope['domain_allowlist'] || scope[:domain_allowlist]).map(&:to_s)
+          return nil if allow.empty? && domains.empty?
+
+          ips = cmd.scan(/\b\d{1,3}(?:\.\d{1,3}){3}\b/)
+          hosts = cmd.scan(/\b[a-z0-9][a-z0-9.-]+\.[a-z]{2,}\b/i)
+          bad_ip = allow.any? ? ips.find { |ip| !rfc1918?(ip: ip) && allow.none? { |cidr| ip_in_cidr?(ip: ip, cidr: cidr) } } : nil
+          bad_host = domains.any? ? hosts.find { |h| domains.none? { |d| h.downcase.end_with?(d.downcase) } } : nil
+          hit = bad_ip || bad_host
+          return nil unless hit
+
+          "Refused: #{hit} is outside ~/.pwn/scope.yaml allowlists."
+        rescue StandardError
+          nil
+        end
+
+        public_class_method def self.rfc1918?(opts = {})
+          oct = opts[:ip].to_s.split('.').map(&:to_i)
+          return false unless oct.length == 4
+
+          return true if [10, 127].include?(oct[0])
+          return true if oct[0] == 192 && oct[1] == 168
+          return true if oct[0] == 172 && oct[1].between?(16, 31)
+
+          false
+        end
+
+        public_class_method def self.ip_in_cidr?(opts = {})
+          ip = opts[:ip].to_s.split('.').map(&:to_i)
+          cidr, bits = opts[:cidr].to_s.split('/')
+          return false if ip.length != 4 || cidr.to_s.split('.').length != 4
+
+          mask = bits.to_i
+          mask = 32 if mask <= 0
+          a = ip.inject(0) { |acc, oct| (acc << 8) + oct }
+          b = cidr.split('.').map(&:to_i).inject(0) { |acc, oct| (acc << 8) + oct }
+          shift = 32 - mask
+          (a >> shift) == (b >> shift)
+        end
+
+        public_class_method def self.command_class(opts = {})
+          cmd = opts[:payload].to_s.split.first.to_s
+          cmd.empty? ? 'shell' : File.basename(cmd)
+        end
+
+        public_class_method def self.record_runtime(opts = {})
+          klass = opts[:command_class].to_s
+          secs = opts[:seconds].to_f
+          return {} if klass.empty? || secs <= 0
+
+          data = load_runtimes
+          data[klass] ||= []
+          data[klass] << secs
+          data[klass] = data[klass].last(50)
+          FileUtils.mkdir_p(File.dirname(RUNTIMES_FILE))
+          File.write(RUNTIMES_FILE, JSON.generate(data))
+          data
+        end
+
+        public_class_method def self.predicted_timeout(opts = {})
+          samples = Array(load_runtimes[opts[:command_class].to_s]).map(&:to_f)
+          return nil if samples.empty?
+
+          sorted = samples.sort
+          idx = [(sorted.length * 0.95).ceil - 1, 0].max
+          (sorted[idx] * 1.5).ceil
+        end
+
+        public_class_method def self.auto_job?(opts = {})
+          pred = opts[:predicted] || predicted_timeout(command_class: opts[:command_class] || command_class(payload: opts[:payload].to_s))
+          pred.to_i > 120
+        end
+
+        private_class_method def self.load_runtimes
+          return {} unless File.file?(RUNTIMES_FILE)
+
+          JSON.parse(File.read(RUNTIMES_FILE))
+        rescue StandardError
+          {}
+        end
+
         public_class_method def self.authors
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
@@ -373,6 +509,31 @@ module PWN
               text: 'optional - text value consumed by #bashism?'
             )
 
+            # Strip quoted heredocs and single-quoted strings before bash-syntax lint.
+            #{self}.shell_syntax_surface(
+              text: 'required - command string to lint'
+            )
+
+            # Mint a per-thread session canary token stored on Thread.current.
+            #{self}.mint_canary(
+              bytes: 'optional - hex length (defaults to 8)'
+            )
+
+            # True when text contains the current session canary.
+            #{self}.canary_leak?(
+              text: 'required - outbound argv or URL to inspect'
+            )
+
+            # Heuristic injection score for tool output (ignore-previous, tool-call spoof).
+            #{self}.injection_score(
+              text: 'required - tool output to score'
+            )
+
+            # Prefix high-score tool output with a QUARANTINED frame.
+            #{self}.quarantine_output(
+              text: 'required - tool output to wrap if injection_score >= 3'
+            )
+
             # Run shell bash and return its result
             #{self}.shell_bash?
 
@@ -458,6 +619,45 @@ module PWN
               args: 'optional - args value consumed by #refuse_copied_persist?'
             )
 
+            # Refuse a command whose IPs/hosts are outside the ~/.pwn scope yaml allowlists.
+            #{self}.scope_refusal(
+              command: 'required - shell command to inspect for IPs and hostnames'
+            )
+
+            # True when ip is RFC1918 or loopback (always in-scope unless strict).
+            #{self}.rfc1918?(
+              ip: 'required - IPv4 address'
+            )
+
+            # True when ip is inside cidr (e.g. 10.1.2.3 in 10.0.0.0/8).
+            #{self}.ip_in_cidr?(
+              ip: 'required - IPv4 address',
+              cidr: 'required - CIDR (e.g. 10.0.0.0/8)'
+            )
+
+            # First token of a payload used as the runtime class key.
+            #{self}.command_class(
+              payload: 'required - command string whose first token is the class'
+            )
+
+            # Append an observed runtime sample for a command class.
+            #{self}.record_runtime(
+              command_class: 'required - class key from the command first token',
+              seconds: 'required - observed wall seconds'
+            )
+
+            # p95 * 1.5 timeout from ~/.pwn/metrics/runtimes.json, or nil.
+            #{self}.predicted_timeout(
+              command_class: 'required - class key to look up'
+            )
+
+            # True when predicted timeout exceeds 120s (route to job_run).
+            #{self}.auto_job?(
+              command_class: 'optional - class key',
+              predicted: 'optional - override predicted seconds',
+              payload: 'optional - command string if class omitted'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "

data/lib/pwn/ai/agent/tools/artifacts.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'artifacts_list',
+  toolset: 'sessions',
+  schema: {
+    name: 'artifacts_list',
+    description: 'List loot under ~/.pwn/artifacts for a session.',
+    parameters: {
+      type: 'object',
+      properties: { session_id: { type: 'string' } }
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::ArtifactRegistry.list(session_id: args[:session_id] || args['session_id'] || 'default')
+  }
+)
+PWN::AI::Agent::Registry.register(
+  name: 'artifacts_get',
+  toolset: 'sessions',
+  schema: {
+    name: 'artifacts_get',
+    description: 'Read an artifact by path (sha256 + body cap).',
+    parameters: {
+      type: 'object',
+      properties: { path: { type: 'string' } },
+      required: %w[path]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::ArtifactRegistry.get(path: args[:path] || args['path'])
+  }
+)
+PWN::AI::Agent::Registry.register(
+  name: 'artifact_read',
+  toolset: 'sessions',
+  schema: {
+    name: 'artifact_read',
+    description: 'Page an artifact as text/hex/base64 from offset.',
+    parameters: {
+      type: 'object',
+      properties: {
+        path: { type: 'string' },
+        offset: { type: 'integer' },
+        length: { type: 'integer' },
+        mode: { type: 'string', description: 'text|hex|base64' }
+      },
+      required: %w[path]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::ArtifactRegistry.read_page(
+      path: args[:path] || args['path'],
+      offset: args[:offset] || args['offset'],
+      length: args[:length] || args['length'],
+      mode: args[:mode] || args['mode']
+    )
+  }
+)

data/lib/pwn/ai/agent/tools/binary_triage.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'binary_triage',
+  toolset: 'pwn',
+  schema: {
+    name: 'binary_triage',
+    description: 'Triage an ELF/PE/Mach-O binary (format, arch, imports, exports) and spill JSON to ~/.pwn/artifacts.',
+    parameters: {
+      type: 'object',
+      properties: { path: { type: 'string', description: 'Filesystem path of the binary.' } },
+      required: %w[path]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::BinaryParser.triage(path: args[:path] || args['path'])
+  }
+)

data/lib/pwn/ai/agent/tools/decompile.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'decompile',
+  toolset: 'pwn',
+  schema: {
+    name: 'decompile',
+    description: 'Decompile a binary via Ghidra analyzeHeadless, or r2 pdg if Ghidra is absent.',
+    parameters: {
+      type: 'object',
+      properties: {
+        bin: { type: 'string' },
+        path: { type: 'string' },
+        project_dir: { type: 'string' }
+      },
+      required: %w[bin]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::Ghidra.decompile(
+      bin: args[:bin] || args[:path] || args['bin'],
+      project_dir: args[:project_dir] || args['project_dir']
+    )
+  }
+)

data/lib/pwn/ai/agent/tools/exploitdev.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'exploitdev',
+  toolset: 'pwn',
+  schema: {
+    name: 'exploitdev',
+    description: 'Exploit-dev helpers: pattern_create, pattern_offset, rop_gadgets, checksec, packing.',
+    parameters: {
+      type: 'object',
+      properties: {
+        action: { type: 'string', description: 'pattern_create|pattern_offset|rop_gadgets|p32|p64|checksec' },
+        n: { type: 'integer' },
+        length: { type: 'integer' },
+        value: { type: 'string' },
+        path: { type: 'string' },
+        filter: { type: 'string' }
+      },
+      required: %w[action]
+    }
+  },
+  handler: lambda { |args|
+    act = (args[:action] || args['action']).to_s
+    case act
+    when 'pattern_create'
+      PWN::Plugins::ExploitDev.cyclic(length: args[:n] || args[:length] || args['n'] || 200)
+    when 'pattern_offset'
+      PWN::Plugins::ExploitDev.cyclic_find(value: args[:value] || args['value'], length: args[:length] || args['length'] || 400)
+    when 'rop_gadgets'
+      rows = Array(PWN::Plugins::ExploitDev.gadgets(path: args[:path] || args['path']))
+      filt = (args[:filter] || args['filter']).to_s
+      filt.empty? ? rows : rows.select { |r| r.to_s.downcase.include?(filt.downcase) }
+    when 'p32'
+      PWN::Plugins::ExploitDev.p32(value: args[:value] || args['value'])
+    when 'p64'
+      PWN::Plugins::ExploitDev.p64(value: args[:value] || args['value'])
+    when 'checksec'
+      PWN::Plugins::GDB.mitigations(binary: args[:path] || args['path'])
+    else
+      { error: "unknown action #{act}" }
+    end
+  }
+)

data/lib/pwn/ai/agent/tools/finding_record.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'finding_record',
+  toolset: 'pwn',
+  schema: {
+    name: 'finding_record',
+    description: 'Append a finding row (title, severity, host, evidence, poc path) to ~/.pwn/findings.jsonl.',
+    parameters: {
+      type: 'object',
+      properties: {
+        title: { type: 'string' },
+        severity: { type: 'string' },
+        host: { type: 'string' },
+        evidence: { type: 'string' },
+        poc: { type: 'string' },
+        poc_artifacts: { type: 'array', items: { type: 'string' } },
+        session_id: { type: 'string' }
+      },
+      required: %w[title]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::Findings.record(
+      title: args[:title] || args['title'],
+      severity: args[:severity] || args['severity'],
+      host: args[:host] || args['host'],
+      evidence: args[:evidence] || args['evidence'],
+      poc: args[:poc] || args['poc'],
+      poc_artifacts: args[:poc_artifacts] || args['poc_artifacts'],
+      session_id: args[:session_id] || args['session_id']
+    )
+  }
+)
+PWN::AI::Agent::Registry.register(
+  name: 'finding_report',
+  toolset: 'pwn',
+  schema: {
+    name: 'finding_report',
+    description: 'List recorded findings from ~/.pwn/findings.jsonl.',
+    parameters: { type: 'object', properties: {} }
+  },
+  handler: lambda { |_args|
+    PWN::Plugins::Findings.report
+  }
+)

data/lib/pwn/ai/agent/tools/fuzz_campaign.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'fuzz_campaign',
+  toolset: 'pwn',
+  schema: {
+    name: 'fuzz_campaign',
+    description: 'Start, status, stop, or triage an AFL++ campaign via background jobs.',
+    parameters: {
+      type: 'object',
+      properties: {
+        action: { type: 'string', description: 'start|status|stop|triage' },
+        in_dir: { type: 'string' },
+        out_dir: { type: 'string' },
+        target: { type: 'string' },
+        id: { type: 'string' }
+      },
+      required: %w[action]
+    }
+  },
+  handler: lambda { |args|
+    act = (args[:action] || args['action']).to_s
+    case act
+    when 'start'
+      in_dir = args[:in_dir] || args['in_dir']
+      out_dir = args[:out_dir] || args['out_dir']
+      target = args[:target] || args['target']
+      cmd = "afl-fuzz -i #{in_dir} -o #{out_dir} -- #{target}"
+      PWN::Plugins::Jobs.start(command: cmd)
+    when 'status'
+      row = PWN::Plugins::Jobs.status(id: args[:id] || args['id'])
+      out_dir = args[:out_dir] || args['out_dir']
+      out_dir ? row.merge(PWN::Plugins::AFLplusplus.parse_stats(out_dir: out_dir)) : row
+    when 'stop'
+      PWN::Plugins::Jobs.stop(id: args[:id] || args['id'])
+    when 'triage'
+      PWN::Plugins::AFLplusplus.crash_triage(out_dir: args[:out_dir] || args['out_dir'])
+    else
+      { error: "unknown action #{act}" }
+    end
+  }
+)

data/lib/pwn/ai/agent/tools/intel_lookup.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'intel_lookup',
+  toolset: 'pwn',
+  schema: {
+    name: 'intel_lookup',
+    description: 'Look up CVE/CWE/CPE via local intel then searchsploit JSON.',
+    parameters: {
+      type: 'object',
+      properties: {
+        query: { type: 'string' },
+        cve: { type: 'string' },
+        cpe: { type: 'string' }
+      }
+    }
+  },
+  handler: lambda { |args|
+    q = args[:query] || args['query'] || args[:cve] || args['cve'] || args[:cpe] || args['cpe']
+    PWN::Plugins::ExploitDB.search(query: q)
+  }
+)

data/lib/pwn/ai/agent/tools/job_run.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'job_run',
+  toolset: 'terminal',
+  schema: {
+    name: 'job_run',
+    description: 'Start a detached background job (nmap, afl, hashcat). Returns {id, pid, log}.',
+    parameters: {
+      type: 'object',
+      properties: {
+        command: { type: 'string' },
+        cmd: { type: 'string' },
+        tag: { type: 'string' }
+      },
+      required: %w[command]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::Jobs.start(command: args[:command] || args[:cmd] || args['command'], session_id: args[:tag] || args['tag'])
+  }
+)
+PWN::AI::Agent::Registry.register(
+  name: 'job_status',
+  toolset: 'terminal',
+  schema: {
+    name: 'job_status',
+    description: 'Poll a job started by job_run.',
+    parameters: {
+      type: 'object',
+      properties: { id: { type: 'string' } },
+      required: %w[id]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::Jobs.status(id: args[:id] || args['id'])
+  }
+)
+PWN::AI::Agent::Registry.register(
+  name: 'job_result',
+  toolset: 'terminal',
+  schema: {
+    name: 'job_result',
+    description: 'Fetch log tail and paths for a job_run id.',
+    parameters: {
+      type: 'object',
+      properties: { id: { type: 'string' }, lines: { type: 'integer' } },
+      required: %w[id]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::Jobs.result(id: args[:id] || args['id'], lines: args[:lines] || args['lines'])
+  }
+)

data/lib/pwn/ai/agent/tools/pty_session.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'pty_open',
+  toolset: 'terminal',
+  schema: {
+    name: 'pty_open',
+    description: 'Open a persistent PTY (gdb, r2, ssh, sh). Returns {id, pid}.',
+    parameters: {
+      type: 'object',
+      properties: { cmd: { type: 'string' }, command: { type: 'string' } },
+      required: %w[cmd]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::ProcessTube.spawn(cmd: args[:cmd] || args[:command] || args['cmd'])
+  }
+)
+PWN::AI::Agent::Registry.register(
+  name: 'pty_send',
+  toolset: 'terminal',
+  schema: {
+    name: 'pty_send',
+    description: 'Write a line to a PTY opened by pty_open.',
+    parameters: {
+      type: 'object',
+      properties: { id: { type: 'string' }, line: { type: 'string' }, data: { type: 'string' } },
+      required: %w[id]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::ProcessTube.write_line(id: args[:id] || args['id'], line: args[:line] || args[:data] || args['line'])
+  }
+)
+PWN::AI::Agent::Registry.register(
+  name: 'pty_read',
+  toolset: 'terminal',
+  schema: {
+    name: 'pty_read',
+    description: 'Read a PTY until a string or one line.',
+    parameters: {
+      type: 'object',
+      properties: { id: { type: 'string' }, until: { type: 'string' }, timeout: { type: 'integer' } },
+      required: %w[id]
+    }
+  },
+  handler: lambda { |args|
+    id = args[:id] || args['id']
+    if args[:until] || args['until']
+      PWN::Plugins::ProcessTube.recvuntil(id: id, until: args[:until] || args['until'], timeout: args[:timeout])
+    else
+      PWN::Plugins::ProcessTube.recvline(id: id, timeout: args[:timeout])
+    end
+  }
+)
+PWN::AI::Agent::Registry.register(
+  name: 'pty_close',
+  toolset: 'terminal',
+  schema: {
+    name: 'pty_close',
+    description: 'Close a PTY handle from pty_open.',
+    parameters: {
+      type: 'object',
+      properties: { id: { type: 'string' } },
+      required: %w[id]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Plugins::ProcessTube.close(id: args[:id] || args['id'])
+  }
+)

data/lib/pwn/ai/agent/tools/session_export.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'session_export',
+  toolset: 'sessions',
+  schema: {
+    name: 'session_export',
+    description: 'Export a session transcript plus attached artifacts as a tar.gz under ~/.pwn/exports.',
+    parameters: {
+      type: 'object',
+      properties: { session_id: { type: 'string' } },
+      required: %w[session_id]
+    }
+  },
+  handler: lambda { |args|
+    PWN::Sessions.export(session_id: args[:session_id] || args['session_id'])
+  }
+)

data/lib/pwn/ai/agent/tools/shell.rb

@@ -71,6 +71,11 @@ PWN::AI::Agent::Registry.register(
       )
     end
 
+    scoped = PWN::AI::Agent::ToolGuard.scope_refusal(command: cmd)
+    return scoped if scoped
+
+    return PWN::Plugins::Jobs.start(command: cmd).merge(routed: 'job_run') if args[:timeout].to_i <= 0 && PWN::AI::Agent::ToolGuard.auto_job?(payload: cmd)
+
     stdout = +''
     stderr = +''
     exitstatus = nil