pwn 0.5.721 → 0.5.723

data/spec/lib/pwn/ai/open_ai_oauth_transport_spec.rb

@@ -0,0 +1,245 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::AI::OpenAI do
+  let(:engine) do
+    {
+      model: 'gpt-4o', base_uri: 'https://api.openai.com/v1', key: 'fake-api-key',
+      oauth: { bearer_token: 'fake-oauth-token', account_id: 'fake-account' }
+    }
+  end
+  let(:completed) do
+    {
+      id: 'resp_test', status: 'completed', usage: { input_tokens: 3, output_tokens: 2 },
+      output: [{ type: 'message', role: 'assistant', content: [{ type: 'output_text', text: 'Hello' }] }]
+    }
+  end
+
+  def event(type, fields = {})
+    "event: #{type}\ndata: #{fields.merge(type: type).to_json}\n\n"
+  end
+
+  before do
+    stub_const('PWN::Env', { ai: { openai: engine } })
+    allow(PWN::Plugins::TransparentBrowser).to receive(:open).with(browser_type: :rest).and_return(browser: RestClient)
+    allow(PWN::Plugins::TTYSpinner).to receive(:stop)
+    allow(described_class).to receive(:obtain_oauth_bearer_token).and_raise('Unexpected enrollment')
+    allow(described_class).to receive(:refresh_oauth_bearer_token).and_raise('Unexpected refresh')
+    allow(RestClient::Request).to receive(:execute).and_raise('Unexpected HTTP request')
+  end
+
+  it 'raises exhausted subscription timeouts instead of returning a blank result' do
+    allow(PWN::AI::HttpRetry).to receive(:max_attempts).and_return(1)
+    allow(RestClient::Request).to receive(:execute).and_raise(RestClient::Exceptions::ReadTimeout)
+    expect { described_class.chat(request: 'Hi', quiet: true) }.to raise_error(RestClient::Exceptions::ReadTimeout)
+  end
+
+  it 'rejects failed Responses events even in quiet mode' do
+    allow(RestClient::Request).to receive(:execute).and_return(
+      event('response.failed', response: { error: { message: 'Model unavailable' } })
+    )
+    expect { described_class.chat(request: 'Hi', quiet: true) }.to raise_error(RuntimeError, /Model unavailable/)
+  end
+
+  it 'routes subscription text chat to streaming Responses even for older model names' do
+    expect(RestClient::Request).to receive(:execute) do |request|
+      expect(request[:url]).to eq('https://chatgpt.com/backend-api/codex/responses')
+      expect(request[:headers]).to include(authorization: 'Bearer fake-oauth-token', accept: 'text/event-stream')
+      expect(request[:headers]['ChatGPT-Account-Id']).to eq('fake-account')
+      body = JSON.parse(request[:payload], symbolize_names: true)
+      expect(body).to include(model: 'gpt-4o', input: [{ role: 'user', content: 'Hi' }], instructions: '', store: false, stream: true)
+      expect(body.keys & %i[messages temperature max_tokens max_completion_tokens max_output_tokens]).to be_empty
+      event('response.completed', response: completed)
+    end
+
+    response = described_class.chat(request: 'Hi')
+    expect(response[:choices].last[:content]).to eq('Hello')
+    expect(response[:usage]).to eq(completed[:usage])
+  end
+
+  [
+    ['error', { error: { message: 'Stream rejected' } }, /Stream rejected/],
+    ['response.incomplete', { response: { incomplete_details: { reason: 'output limit' } } }, /output limit/],
+    ['response.completed', { response: { status: 'failed', error: { message: 'Failed completion' } } }, /Failed completion/],
+    ['response.completed', {}, /missing response/]
+  ].each do |type, fields, message|
+    it "rejects invalid terminal stream event #{type} #{fields}" do
+      allow(RestClient::Request).to receive(:execute).and_return(event(type, fields))
+      expect { described_class.chat(request: 'Hi', quiet: true) }.to raise_error(RuntimeError, message)
+    end
+  end
+
+  it 'rejects streams ending without a completion rather than using partial text' do
+    allow(RestClient::Request).to receive(:execute).and_return(
+      "#{event('response.output_text.delta', delta: 'Partial')}data: [DONE]\n\n"
+    )
+    expect { described_class.chat(request: 'Hi', quiet: true) }.to raise_error(RuntimeError, /before response.completed/)
+  end
+
+  it 'preserves native tool outputs from done events when completion has only metadata' do
+    reasoning = { type: 'reasoning', id: 'rs_1', encrypted_content: 'fake-encrypted-reasoning' }
+    call = { type: 'function_call', id: 'fc_1', call_id: 'call_1', name: 'shell', arguments: '{"cmd":"pwd"}' }
+    expect(RestClient::Request).to receive(:execute) do |request|
+      expect(request[:url]).to end_with('/codex/responses')
+      body = JSON.parse(request[:payload], symbolize_names: true)
+      expect(body[:instructions]).to eq('Use tools')
+      expect(body[:tools].first).to include(type: 'function', name: 'shell')
+      expect(body[:tool_choice]).to eq(type: 'function', name: 'shell')
+      event('response.output_item.done', output_index: 1, item: call) +
+        event('response.output_item.done', output_index: 0, item: reasoning) +
+        event('response.completed', response: completed.except(:output))
+    end
+    result = described_class.chat_with_tools(
+      messages: [{ role: 'system', content: 'Use tools' }, { role: 'user', content: 'Hi' }],
+      tools: [{ type: 'function', function: { name: 'shell' } }],
+      tool_choice: { type: 'function', function: { name: 'shell' } }
+    )
+    expect(result[:assistant_message][:_native_content]).to eq([reasoning, call])
+    expected_calls = [{ id: 'call_1', type: 'function', function: { name: 'shell', arguments: '{"cmd":"pwd"}' } }]
+    expect(result[:assistant_message][:tool_calls]).to eq(expected_calls)
+  end
+
+  it 'uses Platform when a failed OAuth refresh falls back to an API key' do
+    engine[:base_uri] = 'https://chatgpt.com/backend-api/codex/'
+    engine[:oauth].merge!(expires_at: 1, refresh_token: 'fake-refresh')
+    expect(RestClient::Request).to receive(:execute) do |request|
+      expect(request[:url]).to eq('https://api.openai.com/v1/chat/completions')
+      expect(request[:headers][:authorization]).to eq('Bearer fake-api-key')
+      expect(request[:headers]).not_to have_key('ChatGPT-Account-Id')
+      expect(JSON.parse(request[:payload])).to eq('model' => 'gpt-4o', 'temperature' => 0.5, 'messages' => [])
+      '{}'
+    end
+    described_class.send(:open_ai_rest_call,
+                         rest_call: 'chat/completions', http_method: :post, non_interactive: true,
+                         http_body: { model: 'gpt-4o', temperature: 0.5, messages: [] })
+  end
+
+  it 'preserves an explicitly configured HTTPS compatible proxy without duplicate slashes' do
+    engine[:base_uri] = 'https://openai-proxy.example/codex/'
+    expect(RestClient::Request).to receive(:execute) do |request|
+      expect(request[:url]).to eq('https://openai-proxy.example/codex/responses')
+      expect(request[:verify_ssl]).to eq(true)
+      event('response.completed', response: completed)
+    end
+    described_class.chat(request: 'Hi')
+  end
+
+  it 'refuses to send subscription credentials to an insecure custom endpoint' do
+    engine[:base_uri] = 'http://openai-proxy.example/codex'
+    expect(RestClient::Request).not_to receive(:execute)
+    expect { described_class.chat(request: 'Hi', quiet: true) }.to raise_error(ArgumentError, /HTTPS/)
+  end
+
+  it 'raises subscription HTTP failures instead of returning a blank answer' do
+    allow(RestClient::Request).to receive(:execute).and_raise(RestClient::BadRequest)
+    expect { described_class.chat(request: 'Hi') }.to raise_error(RestClient::BadRequest)
+  end
+
+  it 'does not follow subscription redirects to another auth endpoint' do
+    expect(RestClient::Request).to receive(:execute) do |request|
+      expect(request[:max_redirects]).to eq(0)
+      event('response.completed', response: completed)
+    end
+    described_class.chat(request: 'Hi')
+  end
+
+  it 'round-trips encrypted reasoning and function items through the agent loop on a stateless tool continuation' do
+    PWN::Env[:ai][:active] = :openai
+    native = [
+      { type: 'reasoning', id: 'rs_1', encrypted_content: 'fake-encrypted-reasoning' },
+      { type: 'function_call', id: 'fc_1', call_id: 'call_1', name: 'shell', arguments: '{}' }
+    ]
+    messages = [{ role: 'user', content: 'Hi' }]
+    tools = [{ type: 'function', function: { name: 'shell' } }]
+    expect(RestClient::Request).to receive(:execute).ordered do |request|
+      body = JSON.parse(request[:payload], symbolize_names: true)
+      expect(body[:include]).to include('reasoning.encrypted_content')
+      event('response.completed', response: completed.merge(output: native))
+    end
+    first = described_class.chat_with_tools(messages: messages, tools: tools)
+    messages += [first[:assistant_message], { role: 'tool', tool_call_id: 'call_1', content: 'ok' }]
+    expect(RestClient::Request).to receive(:execute).ordered do |request|
+      body = JSON.parse(request[:payload], symbolize_names: true)
+      expected_input = [
+        { role: 'user', content: 'Hi' }, *native,
+        { type: 'function_call_output', call_id: 'call_1', output: 'ok' }
+      ]
+      expect(body[:input]).to eq(expected_input)
+      event('response.completed', response: completed)
+    end
+    expect(PWN::AI::Agent::Loop.send(:call_engine, messages: messages, tools: tools)[:content]).to eq('Hello')
+  end
+
+  it 'routes a newly enrolled credential to subscription Responses immediately' do
+    engine[:oauth] = { enroll: true }
+    allow(described_class).to receive(:obtain_oauth_bearer_token) do |oauth|
+      oauth[:account_id] = 'new-account'
+      'new-fake-token'
+    end
+    expect(RestClient::Request).to receive(:execute) do |request|
+      expect(request[:url]).to eq('https://chatgpt.com/backend-api/codex/responses')
+      expect(request[:headers]).to include(authorization: 'Bearer new-fake-token', 'ChatGPT-Account-Id' => 'new-account')
+      event('response.completed', response: completed)
+    end
+    described_class.chat(request: 'Hi')
+  end
+
+  it 'uses a refreshed OAuth credential even when a Platform key is configured' do
+    engine[:oauth].merge!(expires_at: 1, refresh_token: 'fake-refresh')
+    allow(described_class).to receive(:refresh_oauth_bearer_token).and_return('refreshed-fake-token')
+    expect(RestClient::Request).to receive(:execute) do |request|
+      expect(request[:url]).to eq('https://chatgpt.com/backend-api/codex/responses')
+      expect(request[:headers][:authorization]).to eq('Bearer refreshed-fake-token')
+      event('response.completed', response: completed)
+    end
+    described_class.chat(request: 'Hi')
+  end
+
+  it 'leaves API-key text chat on Chat Completions with its original parameters' do
+    engine[:oauth] = {}
+    expect(RestClient::Request).to receive(:execute) do |request|
+      expect(request[:url]).to eq('https://api.openai.com/v1/chat/completions')
+      expect(request[:headers]).not_to have_key('ChatGPT-Account-Id')
+      body = JSON.parse(request[:payload], symbolize_names: true)
+      expect(body).to include(temperature: 0.5, max_completion_tokens: 16_384)
+      expect(body.keys & %i[stream store input include]).to be_empty
+      { choices: [{ message: { role: 'assistant', content: 'API answer' } }] }.to_json
+    end
+    expect(described_class.chat(request: 'Hi', temp: 0.5)[:choices].last[:content]).to eq('API answer')
+  end
+
+  %w[gpt-4o gpt-5.5].each do |model|
+    it "leaves API-key tool routing and token caps unchanged for #{model}" do
+      engine[:oauth] = {}
+      expect(RestClient::Request).to receive(:execute) do |request|
+        body = JSON.parse(request[:payload], symbolize_names: true)
+        expect(body.keys & %i[stream store include]).to be_empty
+        if model == 'gpt-4o'
+          expect(request[:url]).to eq('https://api.openai.com/v1/chat/completions')
+          expect(body[:max_completion_tokens]).to eq(16_384)
+          expect(body[:messages].first).not_to have_key(:_native_content)
+          { choices: [{ message: { role: 'assistant', content: 'API answer' } }] }.to_json
+        else
+          expect(request[:url]).to eq('https://api.openai.com/v1/responses')
+          expect(body[:max_output_tokens]).to eq(16_384)
+          completed.to_json
+        end
+      end
+      described_class.chat_with_tools(model: model, messages: [{ role: 'user', content: 'Hi', _native_content: [] }])
+    end
+  end
+
+  it 'collects all completed text parts from a CRLF multiline SSE event' do
+    completed[:output].first[:content] << { type: 'output_text', text: ' world' }
+    payload = JSON.pretty_generate(type: 'response.completed', response: completed)
+    sse = ": heartbeat\r\n\r\nevent: response.completed\r\n#{payload.lines.map { |line| "data: #{line.chomp}\r\n" }.join}\r\n"
+    allow(RestClient::Request).to receive(:execute).and_return(sse)
+    expect(described_class.chat(request: 'Hi')[:choices].last[:content]).to eq('Hello world')
+  end
+
+  it 'rejects a truncated final SSE frame even when its JSON is complete' do
+    allow(RestClient::Request).to receive(:execute).and_return(event('response.completed', response: completed).rstrip)
+    expect { described_class.chat(request: 'Hi', quiet: true) }.to raise_error(RuntimeError, /before response.completed/)
+  end
+end

data/spec/lib/pwn/ai/open_ai_spec.rb

@@ -1,8 +1,98 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
+require 'rest-client'
 
 describe PWN::AI::OpenAI do
+  describe 'OAuth enrollment persistence' do
+    before do
+      @oauth_home = Dir.mktmpdir('pwn-openai-oauth')
+      stub_const('PWN::Env', { ai: { openai: { oauth: {} } }, driver_opts: { pwn_env_path: File.join(@oauth_home, 'pwn.yaml') } })
+      allow(described_class).to receive(:sleep)
+      @tokens = { access_token: 'fixture-access', refresh_token: 'fixture-refresh', expires_in: 3600 }
+      allow(RestClient).to receive(:post).and_return(
+        double(body: { device_auth_id: 'fixture-device', user_code: 'fixture-code', interval: 1 }.to_json),
+        double(body: { authorization_code: 'fixture-auth-code', code_verifier: 'fixture-verifier' }.to_json),
+        double(body: @tokens.to_json)
+      )
+    end
+
+    after { FileUtils.remove_entry(@oauth_home) }
+
+    it 'syncs a standalone enrollment into the live environment and attempts vault persistence' do
+      expect(described_class).to receive(:persist_oauth_to_vault).with(oauth: hash_including(bearer_token: 'fixture-access', refresh_token: 'fixture-refresh')).and_return(true)
+      expect(described_class.obtain_oauth_bearer_token).to eq('fixture-access')
+      expect(PWN::Env.dig(:ai, :openai, :oauth)).to include(bearer_token: 'fixture-access', refresh_token: 'fixture-refresh')
+    end
+
+    it 'does not print bearer or refresh tokens when enrollment succeeds without a vault' do
+      output = StringIO.new
+      original = $stdout
+      $stdout = output
+      described_class.obtain_oauth_bearer_token
+      expect(output.string).not_to include('fixture-access', 'fixture-refresh')
+      expect(output.string).to include('session only')
+    ensure
+      $stdout = original
+    end
+
+    context 'with an existing encrypted vault' do
+      before do
+        @vault_path = PWN::Env.dig(:driver_opts, :pwn_env_path)
+        @decryptor_path = File.join(@oauth_home, 'custom.decryptor')
+        PWN::Env[:driver_opts][:pwn_dec_path] = @decryptor_path
+        cipher = OpenSSL::Cipher.new('aes-256-cbc')
+        @vault_key = Base64.strict_encode64(cipher.random_key)
+        @vault_iv = Base64.strict_encode64(cipher.random_iv)
+        File.write(@decryptor_path, YAML.dump({ key: @vault_key, iv: @vault_iv }))
+        File.write(@vault_path, YAML.dump({ unrelated: 'preserved', ai: { openai: { model: 'test-model', oauth: { refresh_token: 'previous-refresh' } } } }))
+        PWN::Plugins::Vault.encrypt(file: @vault_path, key: @vault_key, iv: @vault_iv)
+        @original_ciphertext = File.binread(@vault_path)
+      end
+
+      it 'leaves the original vault encrypted and unchanged if re-encryption fails' do
+        allow(PWN::Plugins::Vault).to receive(:encrypt).and_raise(IOError, 'fixture write failure')
+        expect(described_class.send(:persist_oauth_to_vault, oauth: { bearer_token: 'fixture-access' })).to be(false)
+        expect(File.binread(@vault_path)).to eq(@original_ciphertext)
+        expect(Dir.children(@oauth_home)).to match_array(%w[pwn.yaml custom.decryptor])
+      end
+
+      it 'does not expose vault contents through persistence exception messages' do
+        allow(PWN::Plugins::Vault).to receive(:encrypt).and_raise(IOError, 'fixture-access in parser context')
+        expect do
+          described_class.send(:persist_oauth_to_vault, oauth: { bearer_token: 'fixture-access' })
+        end.to output(/vault persistence failed.*IOError/).to_stderr
+        expect do
+          described_class.send(:persist_oauth_to_vault, oauth: { bearer_token: 'fixture-access' })
+        end.not_to output(/fixture-access/).to_stderr
+      end
+
+      it 'persists enrollment with the same decryptor, restrictive permissions and unrelated settings intact' do
+        decryptor_before = File.binread(@decryptor_path)
+        oauth = { account_id: 'fixture-account' }
+        described_class.obtain_oauth_bearer_token(oauth)
+        expect(PWN::Plugins::Vault.file_encrypted?(file: @vault_path)).to be(true)
+        expect(File.stat(@vault_path).mode & 0o777).to eq(0o600)
+        expect(File.binread(@decryptor_path)).to eq(decryptor_before)
+        persisted = PWN::Plugins::Vault.dump(file: @vault_path, key: @vault_key, iv: @vault_iv)
+        expect(persisted[:unrelated]).to eq('preserved')
+        expect(persisted.dig(:ai, :openai, :model)).to eq('test-model')
+        expect(persisted.dig(:ai, :openai, :oauth)).to include(oauth)
+        expect(persisted.dig(:ai, :openai, :oauth, :expires_at)).to be > Time.now.to_i
+        expect(Dir.children(@oauth_home)).to match_array(%w[pwn.yaml custom.decryptor])
+      end
+
+      it 'persists rotated refresh credentials as well as first enrollment' do
+        allow(RestClient).to receive(:post).and_return(double(body: { access_token: 'rotated-access', refresh_token: 'rotated-refresh', expires_in: 3600 }.to_json))
+        expect(described_class.refresh_oauth_bearer_token(refresh_token: 'previous-refresh')).to eq('rotated-access')
+        persisted = PWN::Plugins::Vault.dump(file: @vault_path, key: @vault_key, iv: @vault_iv)
+        expect(persisted.dig(:ai, :openai, :oauth)).to include(bearer_token: 'rotated-access', refresh_token: 'rotated-refresh')
+        expect(PWN::Env.dig(:ai, :openai, :oauth)).to include(bearer_token: 'rotated-access', refresh_token: 'rotated-refresh')
+      end
+    end
+  end
+
   it 'should display information for authors' do
     authors_response = PWN::AI::OpenAI
     expect(authors_response).to respond_to :authors
@@ -36,4 +126,64 @@ describe PWN::AI::OpenAI do
     expect(src).to include('prompt_cache_key')
     expect(src).to include('enabled?(engine: :openai)')
   end
+
+  it 'treats gpt-5 family as reasoning models' do
+    expect(described_class.send(:reasoning_model?, model: 'gpt-5.5')).to eq(true)
+    expect(described_class.send(:reasoning_model?, model: 'gpt-5-mini')).to eq(true)
+    expect(described_class.send(:reasoning_model?, model: 'gpt-6-astra')).to eq(true)
+    expect(described_class.send(:reasoning_model?, model: 'gpt-4o')).to eq(false)
+  end
+
+  it 'routes gpt-6-astra and gpt-5.4+ tool calls to responses, gpt-4o to chat/completions' do
+    tools = [{ type: 'function', function: { name: 'shell' } }]
+    expect(described_class.api_endpoint(model: 'gpt-6-astra', tools: tools)).to eq('responses')
+    expect(described_class.api_endpoint(model: 'gpt-5.5', tools: tools)).to eq('responses')
+    expect(described_class.api_endpoint(model: 'gpt-5.6-terra', tools: tools)).to eq('responses')
+    expect(described_class.api_endpoint(model: 'gpt-4o', tools: tools)).to eq('chat/completions')
+    expect(described_class.api_endpoint(model: 'gpt-5-mini', tools: tools)).to eq('chat/completions')
+  end
+
+  it 'converts chat tools and messages into Responses function items' do
+    tools = [{
+      type: 'function',
+      function: { name: 'shell', description: 'run', parameters: { type: 'object', properties: {} } }
+    }]
+    msgs = [
+      { role: 'system', content: 'sys' },
+      { role: 'user', content: 'hi' },
+      { role: 'assistant', tool_calls: [{ id: 'c1', type: 'function', function: { name: 'shell', arguments: '{}' } }] },
+      { role: 'tool', tool_call_id: 'c1', content: 'ok' }
+    ]
+    body = described_class.send(:responses_http_body, model: 'gpt-6-astra', messages: msgs, tools: tools, max_tokens: 128)
+    expect(body[:model]).to eq('gpt-6-astra')
+    expect(body[:instructions]).to include('sys')
+    expect(body[:tools].first[:name]).to eq('shell')
+    expect(body[:tools].first).not_to have_key(:function)
+    expect(body[:input]).to include(hash_including(type: 'function_call_output', call_id: 'c1'))
+    expect(body).not_to have_key(:messages)
+    expect(body).not_to have_key(:reasoning_effort)
+    expect(body[:max_output_tokens]).to eq(128)
+  end
+
+  it 'parses Responses function_call output into Loop assistant_message tool_calls' do
+    raw = {
+      output_text: '',
+      output: [
+        { type: 'function_call', call_id: 'c1', name: 'shell', arguments: '{"cmd":"id"}' },
+        { type: 'message', role: 'assistant', content: [{ type: 'output_text', text: '' }] }
+      ]
+    }
+    out = described_class.send(:parse_responses, raw: raw)
+    msg = out[:assistant_message]
+    expect(msg[:tool_calls].first[:id]).to eq('c1')
+    expect(msg[:tool_calls].first[:function][:name]).to eq('shell')
+    expect(msg[:_native_content]).to eq(raw[:output])
+  end
+
+  it 'caps chat_with_tools completion tokens and does not retry quota 429s' do
+    src = File.read(described_class.method(:chat_with_tools).source_location.first)
+    expect(src).to include('max_completion_tokens')
+    rest = File.read(described_class.method(:chat).source_location.first)
+    expect(rest).to include('quota_exhausted?')
+  end
 end

data/spec/lib/pwn/migrate_spec.rb

@@ -68,6 +68,30 @@ describe PWN::Migrate do
       end
     end
 
+    it 'schema 2 patches stock escalator/scribe toolsets and leaves engines alone' do
+      File.write(File.join(@tmp, 'agents.yml'), <<~YML)
+        ---
+        scribe:
+          role: report
+          engine: grok
+          toolsets: [memory, skills, learning, sessions]
+        escalator:
+          role: hint
+          engine: grok
+          toolsets: [terminal, pwn, memory]
+        custom_coach:
+          role: keep my tools
+          engine: grok
+          toolsets: [terminal, pwn, memory]
+      YML
+      PWN::Migrate.run(fix: false, backup: false, io: io)
+      raw = YAML.safe_load_file(File.join(@tmp, 'agents.yml'), permitted_classes: [Symbol], symbolize_names: true)
+      expect(Array(raw[:escalator][:toolsets] || raw[:escalator]['toolsets'])).to eq([])
+      expect(Array(raw[:scribe][:toolsets] || raw[:scribe]['toolsets'])).to include('pwn')
+      expect(raw[:escalator][:engine] || raw[:escalator]['engine']).to eq('grok')
+      expect(Array(raw[:custom_coach][:toolsets] || raw[:custom_coach]['toolsets'])).to include('terminal')
+    end
+
     it 'detects & autofixes a corrupt JSON store (quarantine)' do
       File.write(File.join(@tmp, 'metrics.json'), '{{{ not json')
       st = PWN::Migrate.status

data/spec/lib/pwn/plugins/artifact_registry_spec.rb

@@ -22,4 +22,23 @@ describe PWN::Plugins::ArtifactRegistry do
       expect(rows.first[:kind]).to eq('loot')
     end
   end
+
+  it 'greps an artifact by regex' do
+    Dir.mktmpdir do |dir|
+      src = File.join(dir, 'dump.txt')
+      File.write(src, "nop\ncall system\nret\n")
+      hits = described_class.read_page(path: src, grep: 'call.*system')
+      expect(hits[:matches].first[:text]).to include('call system')
+    end
+  end
+
+  it 'round-trips put then get by sha256' do
+    Dir.mktmpdir do |dir|
+      stub_const('PWN::Plugins::ArtifactRegistry::ROOT', File.join(dir, 'art'))
+      stored = described_class.put(bytes: 'pcap-bytes', kind: 'pcap', tags: ['net'])
+      got = described_class.get(sha256: stored[:sha256])
+      expect(got[:body]).to include('pcap-bytes')
+      expect(stored[:tags]).to include('net')
+    end
+  end
 end

data/spec/lib/pwn/plugins/findings_spec.rb

@@ -37,6 +37,8 @@ describe PWN::Plugins::Findings do
       child = described_class.chain(parent_id: parent[:id], title: 'account-takeover', poc_artifacts: [poc], severity: 'high')
       expect(child[:chain_parent_id]).to eq(parent[:id])
       expect(child[:composite_severity]).to eq('high')
+      score = described_class.chain_score(ids: [parent[:id], child[:id]])
+      expect(score[:combined_severity]).to eq('critical')
     end
   end
 

data/spec/lib/pwn/plugins/gdbmi_spec.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::GDBMI do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'break requires a location' do
+    expect { described_class.break(location: '') }.to raise_error(/location/)
+  end
+end

data/spec/lib/pwn/plugins/ghidra_headless_spec.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe PWN::Plugins::GhidraHeadless do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'analyze requires a binary path' do
+    expect { described_class.analyze(bin: '') }.to raise_error(/bin is required/)
+  end
+end