pwn 0.5.719 → 0.5.721

data/spec/lib/pwn/ai/agent/reward_spec.rb

@@ -411,7 +411,7 @@ describe 'PWN::AI::Agent::Reward vs TUI plan' do
 
   it 'floors verified PASS analytical answers at 0.6' do
     src = File.read(PWN::AI::Agent::Reward.method(:judge).source_location.first)
-    expect(src).to include('[score, 0.7].max')
+    expect(src).to include('[score, 0.6].max')
     expect(src).to include('\bPASS\b')
   end
 
@@ -422,4 +422,20 @@ describe 'PWN::AI::Agent::Reward vs TUI plan' do
     m = PWN::AI::Agent::Reward.send(:judge_model)
     expect(m).to eq('local-judge')
   end
+
+  it 'records verifier PASS as success even when the judge scores 0.0' do
+    allow(PWN::AI::Agent::Reward).to receive(:llm_judge).and_return(
+      { score: 0.0, source: 'heuristic', verdict: :wrong, rationale: 'overlap=0.01', confidence: 0.3 }
+    )
+    v = PWN::AI::Agent::Reward.judge(
+      request: 'write /tmp/x',
+      final: 'PASS file exists',
+      trace: ['{"success":true}'],
+      commit: false,
+      verifier_verdict: :pass
+    )
+    expect(v[:success]).to eq(true)
+    expect(v[:verifier_verdict]).to eq(:pass)
+    expect(v[:judge_score]).to be < 0.6
+  end
 end

data/spec/lib/pwn/ai/agent/swarm_spec.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
 
 describe PWN::AI::Agent::Swarm do
   it 'should display information for authors' do
@@ -43,4 +44,14 @@ describe PWN::AI::Agent::Swarm do
     expect(rows.length).to eq(4)
     expect(rows.map { |r| r[:port] }.uniq.length).to eq(4)
   end
+
+  it 'allows only one live claim per unit' do
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      a = described_class.claim(unit: '10.0.0.5:recon', agent_id: 'a', ttl: 60, engagement_id: 'lab')
+      b = described_class.claim(unit: '10.0.0.5:recon', agent_id: 'b', ttl: 60, engagement_id: 'lab')
+      expect(a[:ok]).to eq(true)
+      expect(b[:ok]).to eq(false)
+    end
+  end
 end

data/spec/lib/pwn/ai/agent/tool_guard_spec.rb

@@ -36,6 +36,15 @@ describe PWN::AI::Agent::ToolGuard do
     it 'rejects a real command' do
       expect(described_class.placeholder?(text: 'uname -r')).to be false
     end
+
+    it 'does not treat ellipsis inside a heredoc body as a placeholder command' do
+      body = "cat <<'EOF'\nThe token ... lives in the document body.\nEOF\n"
+      expect(described_class.placeholder?(text: body)).to be false
+    end
+
+    it 'still denies a command that is only a placeholder token' do
+      expect(described_class.placeholder?(text: ' ... ')).to be true
+    end
   end
 
   describe '.coerce_args' do

data/spec/lib/pwn/ai/agent/tools/debug_lane_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'PWN::AI::Agent::Tools debug_lane' do
+  before(:all) do
+    PWN::AI::Agent::Registry.discover(force: true)
+    load '/opt/pwn/lib/pwn/ai/agent/tools/debug_lane.rb'
+  end
+
+  it 'registers debug_session binary_diff crash_triage emulate detonate budget_status pty_expect' do
+    %w[debug_session binary_diff crash_triage capability_request emulate detonate budget_status pty_expect].each do |name|
+      expect(PWN::AI::Agent::Registry.lookup(name: name)).not_to be_nil
+    end
+  end
+end

data/spec/lib/pwn/ai/agent/tools/engagement_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'PWN::AI::Agent::Tools engagement' do
+  before(:all) do
+    PWN::AI::Agent::Registry.discover(force: true)
+    load '/opt/pwn/lib/pwn/ai/agent/tools/engagement.rb'
+  end
+
+  it 'registers engagement_open close and status' do
+    expect(PWN::AI::Agent::Registry.lookup(name: 'engagement_open')).not_to be_nil
+    expect(PWN::AI::Agent::Registry.lookup(name: 'engagement_close')).not_to be_nil
+    expect(PWN::AI::Agent::Registry.lookup(name: 'engagement_status')).not_to be_nil
+  end
+end

data/spec/lib/pwn/ai/agent/turn_finalizer_spec.rb

@@ -103,4 +103,22 @@ describe PWN::AI::Agent::TurnFinalizer do
       described_class.leave_user_path! while described_class.user_path?
     end
   end
+
+  it 'finalizes write-then-readback and names unmet without readback' do
+    Dir.mktmpdir do |dir|
+      path = File.join(dir, 'out.pdf')
+      File.write(path, 'pdf')
+      msgs = [
+        { role: 'tool', content: { success: true, result: { path: path }, effect: 'write' }.to_json },
+        { role: 'tool', content: { success: true, result: { stdout: path }, effect: 'read' }.to_json }
+      ]
+      row = described_class.arbitrate(request: "store #{path}", messages: msgs, paths: [path])
+      expect(row[:complete]).to eq(true)
+      expect(row[:unmet]).to eq([])
+      write_only = [{ role: 'tool', content: { success: true, result: { path: path }, effect: 'write' }.to_json }]
+      nag = described_class.arbitrate(request: "store #{path}", messages: write_only, paths: [path])
+      expect(nag[:complete]).to eq(false)
+      expect(nag[:unmet].map { |u| u[:criterion] }).to include('readback_missing')
+    end
+  end
 end

data/spec/lib/pwn/plugins/bin_workspace_spec.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+describe PWN::Plugins::BinWorkspace do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'persists annotations by sha256 across opens' do
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      stub_const('PWN::Plugins::BinWorkspace::ROOT', File.join(dir, '.pwn', 'binws'))
+      bin = File.join(dir, 'a.bin')
+      File.binwrite(bin, 'ELF')
+      described_class.annotate(path: bin, addr: '0x401000', kind: 'rename', name: 'win')
+      notes = described_class.notes(path: bin)
+      expect(notes[:'0x401000'][:name]).to eq('win')
+    end
+  end
+end

data/spec/lib/pwn/plugins/capability_spec.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Capability do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'does not apply setcap without operator_ack' do
+    row = described_class.request(cap: 'cap_net_raw', reason: 'packet')
+    expect(row[:needs_ack]).to eq(true)
+    expect(row[:ok]).to eq(false)
+  end
+end

data/spec/lib/pwn/plugins/detonate_spec.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+describe PWN::Plugins::Detonate do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'refuses when isolation preconditions are unmet' do
+    Dir.mktmpdir do |dir|
+      sample = File.join(dir, 's.bin')
+      File.write(sample, 'MZ')
+      allow(PWN::Plugins::PreflightChecker).to receive(:bin?).with(name: 'podman').and_return(false)
+      row = described_class.detonate(path: sample)
+      expect(row[:error].to_s).to match(/isolation/)
+    end
+  end
+end

data/spec/lib/pwn/plugins/emulator_spec.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::Emulator do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'returns stub plaintext for a decode function' do
+    row = described_class.emulate(binary: '/bin/true', addr: '0x401000', backend: 'stub', plaintext: 'secret')
+    expect(row[:ret]).to eq('secret')
+  end
+end

data/spec/lib/pwn/plugins/findings_spec.rb

@@ -7,7 +7,7 @@ describe PWN::Plugins::Findings do
   it 'records and reports a finding' do
     Dir.mktmpdir do |dir|
       stub_const('PWN::Plugins::Findings::FILE', File.join(dir, 'findings.jsonl'))
-      row = described_class.record(title: 'xss', severity: 'high', host: '127.0.0.1', poc: '/tmp/poc.rb')
+      row = described_class.record(title: 'xss', severity: 'high', host: '127.0.0.1', poc: '/tmp/poc.rb', evidence: 'PoC at /tmp/poc.rb reproduces XSS in search with a reflected payload.')
       expect(row[:id]).not_to be_empty
       expect(described_class.report.first[:title]).to eq('xss')
     end
@@ -19,7 +19,7 @@ describe PWN::Plugins::Findings do
       expect { described_class.record(title: 'xss') }.to raise_error(/poc/i)
       poc = File.join(dir, 'poc.rb')
       File.write(poc, 'puts 1')
-      row = described_class.record(title: 'xss', poc_artifacts: [poc], severity: 'high')
+      row = described_class.record(title: 'xss', poc_artifacts: [poc], severity: 'high', evidence: 'PoC file reproduces reflected XSS in search; see artifact path.')
       expect(row[:poc_artifacts]).to include(poc)
       out = described_class.render(dir_path: dir, report_name: 'findings')
       expect(File.file?(out[:markdown])).to be true
@@ -33,10 +33,23 @@ describe PWN::Plugins::Findings do
       stub_const('PWN::Plugins::Findings::FILE', File.join(dir, 'findings.jsonl'))
       poc = File.join(dir, 'poc.rb')
       File.write(poc, 'puts 1')
-      parent = described_class.record(title: 'xss', poc_artifacts: [poc], severity: 'medium')
+      parent = described_class.record(title: 'xss', poc_artifacts: [poc], severity: 'medium', evidence: 'PoC file reproduces reflected XSS in search; see artifact path.')
       child = described_class.chain(parent_id: parent[:id], title: 'account-takeover', poc_artifacts: [poc], severity: 'high')
       expect(child[:chain_parent_id]).to eq(parent[:id])
       expect(child[:composite_severity]).to eq('high')
     end
   end
+
+  it 'flags tampered evidence files' do
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      stub_const('PWN::Plugins::Findings::FILE', File.join(dir, 'findings.jsonl'))
+      poc = File.join(dir, 'poc.rb')
+      File.write(poc, 'puts 1')
+      described_class.record(title: 'xss', poc_artifacts: [poc], engagement_id: 'lab', evidence: 'PoC file reproduces reflected XSS in search; see artifact path.')
+      expect(described_class.evidence_verify(engagement_id: 'lab')[:ok]).to eq(true)
+      File.write(poc, 'tampered')
+      expect(described_class.evidence_verify(engagement_id: 'lab')[:ok]).to eq(false)
+    end
+  end
 end

data/spec/lib/pwn/plugins/gdb_spec.rb

@@ -25,4 +25,14 @@ describe PWN::Plugins::GDB do
       expect(joined).to include('break *0x401000')
     end
   end
+
+  it 'parses crash_info from gdb output' do
+    allow(Open3).to receive(:capture3).and_return(
+      ["Program received signal SIGSEGV\nrip            0x401000\n#0  0x401000 in foo ()\n", '', instance_double(Process::Status, exitstatus: 0)]
+    )
+    allow(PWN::Plugins::PreflightChecker).to receive(:require_bin!)
+    row = described_class.crash_info(binary: '/bin/true')
+    expect(row[:signal]).to include('SEGV')
+    expect(row[:exploitability_heuristic]).to eq('likely-exploitable')
+  end
 end

data/spec/lib/pwn/plugins/packet_spec.rb

@@ -12,4 +12,10 @@ describe PWN::Plugins::Packet do
     help_response = PWN::Plugins::Packet
     expect(help_response).to respond_to :help
   end
+
+  it 'flags connect-scan results as degraded' do
+    row = described_class.tcp_connect_scan(hosts: ['127.0.0.1'], ports: [1], timeout: 0.05)
+    expect(row[:degraded]).to eq(true)
+    expect(row[:results]).to be_an(Array)
+  end
 end

data/spec/lib/pwn/plugins/repl_spec.rb

@@ -82,7 +82,7 @@ describe PWN::Plugins::REPL do
       hits = described_class.pwn_ai_complete(target: '/sk', line: '/sk')
       expect(hits).to include('/skills')
       hits = described_class.pwn_ai_complete(target: '/', line: '/')
-      %w[/cron /skills /sessions /memory /debug /trace /back /help /model].each do |cmd|
+      %w[/cron /skills /sessions /memory /debug /trace /back /help /model /learning].each do |cmd|
         expect(hits).to include(cmd)
       end
       hits = described_class.pwn_ai_complete(target: 'li', line: '/cron li')

data/spec/lib/pwn/plugins/vault_spec.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
 
 describe PWN::Plugins::Vault do
   it 'should display information for authors' do
@@ -12,4 +13,14 @@ describe PWN::Plugins::Vault do
     help_response = PWN::Plugins::Vault
     expect(help_response).to respond_to :help
   end
+
+  it 'expands vault tokens and redacts stored secrets' do
+    Dir.mktmpdir do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      described_class.store(label: 'api', secret: 's3cret-value')
+      expect(described_class.fetch(label: 'api')).to eq('s3cret-value')
+      expect(described_class.expand(text: 'tok={{vault:api}}')).to include('s3cret-value')
+      expect(described_class.redact(text: 'tok=s3cret-value')).to include('{{vault:api}}')
+    end
+  end
 end

data/spec/lib/pwn/reports/engagement_spec.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+describe PWN::Reports::Engagement do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'writes html for two findings with poc paths' do
+    Dir.mktmpdir do |dir|
+      poc = File.join(dir, 'poc.rb')
+      File.write(poc, 'puts 1')
+      out = described_class.generate(
+        engagement: 'lab',
+        dir_path: dir,
+        findings: [
+          { title: 'a', severity: 'high', poc: poc },
+          { title: 'b', severity: 'low', poc: poc }
+        ]
+      )
+      expect(File.file?(out[:html])).to eq(true)
+    end
+  end
+end