pwn 0.5.737 → 0.5.739

data/lib/pwn/plugins/redb.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+
+require 'digest'
+require 'fileutils'
+require 'json'
+require 'sqlite3'
+require 'open3'
+require 'time'
+
+module PWN
+  module Plugins
+    # Persistent per-binary analysis DB under ~/.pwn/redb.
+    module REDB
+      ROOT = File.join(Dir.home, '.pwn', 'redb')
+
+      public_class_method def self.open(opts = {})
+        bin = (opts[:bin] || opts[:path]).to_s
+        raise ArgumentError, 'bin is required' if bin.empty?
+        raise ArgumentError, "binary not found: #{bin}" unless File.file?(bin)
+
+        sha = Digest::SHA256.file(bin).hexdigest
+        dir = File.join(ROOT, sha)
+        FileUtils.mkdir_p(dir)
+        db_path = File.join(dir, 'analysis.sqlite')
+        db = SQLite3::Database.new(db_path)
+        db.results_as_hash = true
+        migrate(db: db)
+        analyze(db: db, bin: bin) if db.get_first_value("SELECT COUNT(*) FROM meta WHERE key = 'analyzed'").to_i.zero?
+        { sha256: sha, dir: dir, db: db_path, bin: File.expand_path(bin) }
+      ensure
+        db&.close
+      end
+
+      public_class_method def self.funcs(opts = {})
+        with_db(opts) { |db| db.execute('SELECT * FROM functions ORDER BY name') }
+      end
+
+      public_class_method def self.xrefs_to(opts = {})
+        sym = (opts[:sym] || opts[:name] || opts[:addr]).to_s
+        raise ArgumentError, 'sym is required' if sym.empty?
+
+        with_db(opts) { |db| db.execute('SELECT * FROM xrefs WHERE dst = ?', [sym]) }
+      end
+
+      public_class_method def self.strings(opts = {})
+        needle = opts[:match].to_s
+        sql = 'SELECT * FROM strings'
+        args = []
+        unless needle.empty?
+          sql += ' WHERE value LIKE ?'
+          args << "%#{needle}%"
+        end
+        with_db(opts) { |db| db.execute(sql, args) }
+      end
+
+      public_class_method def self.decompile(opts = {})
+        func = (opts[:func] || opts[:name]).to_s
+        raise ArgumentError, 'func is required' if func.empty?
+
+        with_db(opts) do |db|
+          row = db.get_first_row('SELECT * FROM decompile WHERE name = ?', [func])
+          return row if row
+
+          text = objdump_func(bin: PWN::Plugins::REDB.open(opts)[:bin], func: func)
+          db.execute('INSERT OR REPLACE INTO decompile(name, text, cached_at) VALUES(?,?,?)', [func, text, Time.now.utc.iso8601])
+          { 'name' => func, 'text' => text }
+        end
+      end
+
+      public_class_method def self.annotate(opts = {})
+        note = opts[:text].to_s
+        target = (opts[:addr] || opts[:func] || opts[:sym]).to_s
+        raise ArgumentError, 'addr or func is required' if target.empty?
+
+        with_db(opts) do |db|
+          db.execute('INSERT INTO annotations(target, text, cached_at) VALUES(?,?,?)', [target, note, Time.now.utc.iso8601])
+          { target: target, text: note }
+        end
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # Open or reuse ~/.pwn/redb/<sha256> for a binary.
+          #{self}.open(
+            bin: 'required - filesystem path of the binary',
+            path: 'optional - alias for bin'
+          )
+
+          # List cached functions.
+          #{self}.funcs(
+            bin: 'required - filesystem path of the binary'
+          )
+
+          # Return callers of a symbol from cache.
+          #{self}.xrefs_to(
+            bin: 'required - filesystem path of the binary',
+            sym: 'required - destination symbol or address',
+            name: 'optional - alias for sym',
+            addr: 'optional - alias for sym'
+          )
+
+          # Search cached strings.
+          #{self}.strings(
+            bin: 'required - filesystem path of the binary',
+            match: 'optional - substring filter'
+          )
+
+          # Return cached decompilation, filling the cache from objdump on miss.
+          #{self}.decompile(
+            bin: 'required - filesystem path of the binary',
+            func: 'required - function name',
+            name: 'optional - alias for func'
+          )
+
+          # Persist an analyst annotation for a later session.
+          #{self}.annotate(
+            bin: 'required - filesystem path of the binary',
+            addr: 'optional - address to annotate',
+            func: 'optional - function name to annotate',
+            sym: 'optional - symbol to annotate',
+            text: 'optional - annotation body'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.migrate(opts = {})
+        db = opts[:db]
+        db.execute('CREATE TABLE IF NOT EXISTS functions(name TEXT PRIMARY KEY, addr TEXT)')
+        db.execute('CREATE TABLE IF NOT EXISTS xrefs(src TEXT, dst TEXT)')
+        db.execute('CREATE TABLE IF NOT EXISTS strings(value TEXT PRIMARY KEY)')
+        db.execute('CREATE TABLE IF NOT EXISTS imports(name TEXT PRIMARY KEY)')
+        db.execute('CREATE TABLE IF NOT EXISTS exports(name TEXT PRIMARY KEY)')
+        db.execute('CREATE TABLE IF NOT EXISTS decompile(name TEXT PRIMARY KEY, text TEXT, cached_at TEXT, kind TEXT)')
+        db.execute('CREATE TABLE IF NOT EXISTS annotations(target TEXT, text TEXT, cached_at TEXT)')
+        db.execute('CREATE TABLE IF NOT EXISTS meta(key TEXT PRIMARY KEY, value TEXT)')
+      end
+
+      private_class_method def self.with_db(opts = {})
+        meta = PWN::Plugins::REDB.open(opts)
+        db = SQLite3::Database.new(meta[:db])
+        db.results_as_hash = true
+        yield db
+      ensure
+        db&.close
+      end
+
+      private_class_method def self.analyze(opts = {})
+        db = opts[:db]
+        bin = opts[:bin]
+        analyze_binutils(db: db, bin: bin)
+        db.execute("INSERT OR REPLACE INTO meta(key, value) VALUES('analyzed', ?)", [Time.now.utc.iso8601])
+      end
+
+      private_class_method def self.analyze_r2(opts = {})
+        analyze_binutils(opts)
+      end
+
+      private_class_method def self.analyze_binutils(opts = {})
+        db = opts[:db]
+        bin = opts[:bin]
+        nm, = Open3.capture2('nm', '-C', bin)
+        nm.each_line do |line|
+          if (m = line.match(/\s+U\s+(\S+)/))
+            db.execute('INSERT OR IGNORE INTO imports(name) VALUES(?)', [m[1]])
+            next
+          end
+          next unless (m = line.match(/\A([0-9a-fA-F]+)\s+(\w)\s+(\S+)/))
+
+          db.execute('INSERT OR REPLACE INTO functions(name, addr) VALUES(?,?)', [m[3], m[1]])
+          db.execute('INSERT OR IGNORE INTO exports(name) VALUES(?)', [m[3]]) if m[2] == 'T'
+        end
+        dump, = Open3.capture2('objdump', '-d', bin)
+        current = nil
+        dump.each_line do |line|
+          current = Regexp.last_match(1) if line =~ /<([^>]+)>:/
+          next unless current && (line =~ /call\w*\s+.*<([^>@]+)/ || line =~ /call\w*\s+([A-Za-z_]\w*)(?:@plt)?/)
+
+          db.execute('INSERT INTO xrefs(src, dst) VALUES(?,?)', [current, Regexp.last_match(1)])
+        end
+        strings, = Open3.capture2('strings', '-a', bin)
+        strings.each_line { |s| db.execute('INSERT OR IGNORE INTO strings(value) VALUES(?)', [s.chomp]) }
+      end
+
+      private_class_method def self.objdump_func(opts = {})
+        dump, = Open3.capture2('objdump', '-d', opts[:bin].to_s)
+        keep = false
+        rows = []
+        dump.each_line do |line|
+          if line =~ /<#{Regexp.escape(opts[:func].to_s)}>:/
+            keep = true
+            rows << line
+            next
+          end
+          break if keep && line =~ /<[^>]+>:/
+
+          rows << line if keep
+        end
+        rows.join
+      end
+    end
+  end
+end

data/lib/pwn/plugins/repl.rb

@@ -16,7 +16,6 @@ module PWN
     module REPL
       autoload :ASM, 'pwn/plugins/repl/asm'
       autoload :AI, 'pwn/plugins/repl/ai'
-      autoload :IRC, 'pwn/plugins/repl/irc'
       autoload :Mesh, 'pwn/plugins/repl/mesh'
       autoload :Vault, 'pwn/plugins/repl/vault'
 
@@ -442,7 +441,6 @@ module PWN
 
         PWN::Plugins::REPL::ASM.add_commands
         PWN::Plugins::REPL::AI.add_commands
-        PWN::Plugins::REPL::IRC.add_commands
         PWN::Plugins::REPL::Mesh.add_commands
         PWN::Plugins::REPL::Vault.add_commands
 
@@ -1221,6 +1219,5 @@ end
 
 require_relative 'repl/asm'
 require_relative 'repl/ai'
-require_relative 'repl/irc'
 require_relative 'repl/mesh'
 require_relative 'repl/vault'

data/lib/pwn/plugins/sbom.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+require 'open3'
+require 'json'
+
+module PWN
+  module Plugins
+    # Generic lockfile/image CVE scan with engine selection.
+    module SBOM
+      public_class_method def self.required_bins
+        []
+      end
+
+      public_class_method def self.scan(opts = {})
+        target = (opts[:path_or_image] || opts[:path] || opts[:image]).to_s
+        raise ArgumentError, 'path_or_image is required' if target.empty?
+
+        engine = (opts[:engine] || select_engine(target: target)).to_s
+        rows = case engine
+               when 'grype' then parse_grype(target: target)
+               when 'trivy' then parse_trivy(target: target)
+               when 'osv-scanner' then parse_osv(target: target)
+               when 'syft+grype', 'syft'
+                 inv = parse_syft(target: target)
+                 if PWN::Plugins::PreflightChecker.bin?(name: 'grype')
+                   parse_grype(target: target)
+                 else
+                   inv
+                 end
+               else
+                 raise IOError, 'no SBOM engine installed (syft, grype, trivy, or osv-scanner)'
+               end
+        findings = []
+        if defined?(PWN::Plugins::Findings) && opts[:record] == true
+          rows.each do |row|
+            next if row[:cve].to_s.empty?
+
+            findings << PWN::Plugins::Findings.record(title: "#{row[:package]} #{row[:cve]}", severity: row[:severity], host: target, evidence: row.inspect, poc: "sbom_scan #{target}")
+          end
+        end
+        { engine: engine, target: target, vulns: rows, findings: findings }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # List host binaries this module expects to be installed.
+          #{self}.required_bins
+
+          # Scan a lockfile or image with the first available engine.
+          #{self}.scan(
+            path_or_image: 'required - lockfile, directory, or image reference',
+            path: 'optional - alias for path_or_image',
+            image: 'optional - alias for path_or_image',
+            engine: 'optional - syft, grype, trivy, or osv-scanner',
+            record: 'optional - true records each CVE via Findings.record'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+
+      private_class_method def self.select_engine(opts = {})
+        _target = opts[:target]
+        %w[grype trivy osv-scanner syft].find { |bin| PWN::Plugins::PreflightChecker.bin?(name: bin) }
+      end
+
+      private_class_method def self.run!(opts = {})
+        argv = opts[:argv]
+        if Open3.respond_to?(:capture3)
+          out, err, st = Open3.capture3(*argv)
+          raise IOError, "#{argv.first} failed: #{err}" unless st.success? || opts[:allow_nonzero] == true
+
+        else
+          out, = Open3.capture2(*argv)
+        end
+        out
+      rescue Errno::ENOENT
+        out, = Open3.capture2(*opts[:argv])
+        out
+      end
+
+      private_class_method def self.parse_grype(opts = {})
+        out = run!(argv: ['grype', '-o', 'json', opts[:target]], allow_nonzero: true)
+        json = JSON.parse(out)
+        Array(json['matches']).map do |row|
+          art = row['artifact'] || {}
+          vuln = row['vulnerability'] || {}
+          normalize(package: art['name'], version: art['version'], cve: vuln['id'], severity: vuln['severity'], fix: vuln.dig('fix', 'versions'))
+        end
+      end
+
+      private_class_method def self.parse_trivy(opts = {})
+        target = opts[:target].to_s
+        sub = File.file?(target) && target.match?(/\.(tar|tar\.gz|tgz|tar\.zst)\z/i) ? 'image' : 'fs'
+        sub = 'image' if target.include?(':') && !File.exist?(target)
+        out = run!(argv: ['trivy', sub, '--format', 'json', target], allow_nonzero: true)
+        json = JSON.parse(out)
+        Array(json['Results']).flat_map do |res|
+          Array(res['Vulnerabilities']).map do |vuln|
+            normalize(package: vuln['PkgName'], version: vuln['InstalledVersion'], cve: vuln['VulnerabilityID'], severity: vuln['Severity'], fix: vuln['FixedVersion'])
+          end
+        end
+      end
+
+      private_class_method def self.parse_osv(opts = {})
+        target = opts[:target].to_s
+        argv = ['osv-scanner', '--json']
+        argv.concat(File.file?(target) ? [target] : ['-r', target])
+        out = run!(argv: argv, allow_nonzero: true)
+        json = JSON.parse(out)
+        Array(json['results']).flat_map do |res|
+          Array(res['packages']).flat_map do |pkg|
+            Array(pkg['vulnerabilities']).map do |vuln|
+              normalize(package: pkg.dig('package', 'name'), version: pkg.dig('package', 'version'), cve: vuln['id'], severity: 'unknown', fix: nil)
+            end
+          end
+        end
+      end
+
+      private_class_method def self.parse_syft(opts = {})
+        out = run!(argv: ['syft', '-o', 'json', opts[:target]])
+        json = JSON.parse(out)
+        Array(json['artifacts']).map do |art|
+          normalize(package: art['name'], version: art['version'], cve: nil, severity: 'info', fix: nil)
+        end
+      end
+
+      private_class_method def self.normalize(opts = {})
+        {
+          package: opts[:package].to_s,
+          version: opts[:version].to_s,
+          cve: opts[:cve].to_s,
+          severity: opts[:severity].to_s.downcase,
+          fix_version: Array(opts[:fix]).first.to_s
+        }
+      end
+    end
+  end
+end

data/lib/pwn/plugins.rb

@@ -27,6 +27,7 @@ module PWN
     autoload :PreflightChecker, 'pwn/plugins/preflight_checker'
     autoload :PWNLogger, 'pwn/plugins/pwn_logger'
     autoload :DAOLDAP, 'pwn/plugins/dao_ldap'
+    autoload :Debugger, 'pwn/plugins/debugger'
     autoload :DAOMongo, 'pwn/plugins/dao_mongo'
     autoload :DAOPostgres, 'pwn/plugins/dao_postgres'
     autoload :DAOSQLite3, 'pwn/plugins/dao_sqlite3'
@@ -49,6 +50,7 @@ module PWN
     autoload :Github, 'pwn/plugins/github'
     autoload :GoogleWorkspace, 'pwn/plugins/google_workspace'
     autoload :HackerOne, 'pwn/plugins/hacker_one'
+    autoload :Handler, 'pwn/plugins/handler'
     autoload :Hunter, 'pwn/plugins/hunter'
     autoload :IPInfo, 'pwn/plugins/ip_info'
     autoload :IRC, 'pwn/plugins/irc'
@@ -79,9 +81,11 @@ module PWN
     autoload :RabbitMQ, 'pwn/plugins/rabbit_mq'
     autoload :Radare2, 'pwn/plugins/radare2'
     autoload :Recon, 'pwn/plugins/recon'
+    autoload :REDB, 'pwn/plugins/redb'
     autoload :REPL, 'pwn/plugins/repl'
     autoload :ROP, 'pwn/plugins/rop'
     autoload :Sandbox, 'pwn/plugins/sandbox'
+    autoload :SBOM, 'pwn/plugins/sbom'
     autoload :ScannableCodes, 'pwn/plugins/scannable_codes'
     autoload :Semgrep, 'pwn/plugins/semgrep'
     autoload :Serial, 'pwn/plugins/serial'

data/lib/pwn/redaction.rb

@@ -47,6 +47,51 @@ module PWN
       "[REDACTED:#{opts[:kind]}:#{Digest::SHA256.hexdigest(value)[0, 8]}]"
     end
 
+    public_class_method def self.capture(opts = {})
+      value = opts[:value]
+      return { redacted: redact(value: value), refs: [] } unless value.is_a?(String)
+
+      text = value.to_s
+      refs = []
+      redacted = PATTERNS.reduce(text.dup) do |acc, (kind, regex)|
+        acc.gsub(regex) do |match|
+          tok = token(kind: kind, value: match)
+          refs << { kind: kind, token: tok }
+          PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
+          tok
+        rescue StandardError
+          tok
+        end
+      end
+      redacted = capture_entropy(text: redacted, refs: refs, vault: opts[:vault], engagement: opts[:engagement]) if opts[:entropy] == true
+      { redacted: redacted, refs: refs }
+    end
+
+    private_class_method def self.capture_entropy(opts = {})
+      text = opts[:text].to_s
+      refs = opts[:refs] || []
+      text.gsub(%r{[A-Za-z0-9+/=_-]{40,}}) do |match|
+        next match if match.start_with?('[REDACTED:')
+        next match unless entropy?(text: match)
+
+        tok = token(kind: 'entropy', value: match)
+        refs << { kind: 'entropy', token: tok }
+        PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
+        tok
+      rescue StandardError
+        match
+      end
+    end
+
+    private_class_method def self.entropy?(opts = {})
+      s = opts[:text].to_s
+      return false if s.length < 40
+
+      freq = s.each_char.tally
+      psum = freq.values.sum { |n| (n.to_f / s.length) * Math.log2(n.to_f / s.length) }
+      -psum >= 3.5
+    end
+
     public_class_method def self.authors
       "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
     end
@@ -62,6 +107,14 @@ module PWN
           kind: 'required - secret type label',
           value: 'required - sensitive value to hash'
         )
+        # Capture secrets into Vault labels and return a redacted copy.
+        #{self}.capture(
+          value: 'required - string that may contain credentials',
+          vault: 'optional - false skips Vault.store',
+          engagement: 'optional - engagement name stored with the vault label',
+          entropy: 'optional - true also captures high-entropy tokens'
+        )
+
         # Print the author information.
         #{self}.authors
       "

data/lib/pwn/reports/engagement.rb

@@ -21,7 +21,8 @@ module PWN
         rows = if opts[:findings]
                  Array(opts[:findings])
                elsif defined?(PWN::Plugins::Findings)
-                 PWN::Plugins::Findings.report
+                 rows = PWN::Plugins::Findings.report
+                 rows = rows.select { |row| row[:engagement_id].to_s == name || name == 'default' }
                else
                  []
                end

data/lib/pwn/sessions.rb

@@ -93,7 +93,9 @@ module PWN
       raise "Session #{sid} not found" unless File.exist?(path)
 
       role = (opts[:role] || 'user').to_s
-      content = PWN::Redaction.redact(value: opts[:content])
+      raw = opts[:content]
+      PWN::Redaction.capture(value: raw, vault: true) if raw.is_a?(String) && %w[tool observation].include?(role)
+      content = PWN::Redaction.redact(value: raw)
       if content.is_a?(String)
         # Write-path policy: cap bulk by role using compact limits so append
         # cannot grow transcripts past TOOL_CONTENT_MAX / ASSISTANT_CONTENT_MAX.

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.737'
+  VERSION = '0.5.739'
 end

data/lib/pwn.rb

@@ -17,6 +17,8 @@ module PWN
   autoload :Blockchain, 'pwn/blockchain'
   autoload :Config, 'pwn/config'
   autoload :Cron, 'pwn/cron'
+  autoload :Corpus, 'pwn/corpus'
+  autoload :Engagement, 'pwn/engagement'
   autoload :Memory, 'pwn/memory'
   autoload :MemoryIndex, 'pwn/memory_index'
   autoload :Migrate, 'pwn/migrate'

data/packer/provisioners/irc.sh

@@ -10,4 +10,4 @@ sudo sed -e 's/^new_cursors=true/new_cursors=false/g' \
 sudo systemctl enable inspircd
 sudo systemctl restart inspircd
 
-# TODO: tweak /etc/inspircd/inspircd.conf to compliment pwn-irc AI agents
+# inspircd/irssi for PWN::Plugins::IRC clients

data/spec/lib/pwn/ai/agent/harness_2026_09_15_spec.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json'
+require 'tmpdir'
+require 'socket'
+
+describe 'pwn-ai 2026-09-15 harness patches' do
+  it 'allows a heredoc range and markdown ellipsis but denies a trailing bare token' do
+    ok = <<~CMD
+      cat <<'EOF'
+      1...10 and wait...
+      EOF
+    CMD
+    expect(PWN::AI::Agent::ToolGuard.placeholder?(text: ok)).to eq(false)
+    expect(PWN::AI::Agent::ToolGuard.placeholder?(text: "echo hi\n...\n")).to eq(true)
+    expect(PWN::AI::Agent::ToolGuard.placeholder?(text: 'echo hi ...')).to eq(false)
+    expect(PWN::AI::Agent::ToolGuard.placeholder?(text: '[ ... ]')).to eq(true)
+    expect(PWN::AI::Agent::ToolGuard.placeholder?(text: '...', placeholder_ok: true)).to eq(false)
+  end
+
+  it 'names the colliding payload hash and normalized fields on identical retry' do
+    3.times do
+      n = PWN::AI::Agent::Loop.send(:note_same_payload!, name: 'shell', args: { command: "echo  hi\n" })
+      next if n < 3
+
+      raw = PWN::AI::Agent::Loop.send(:checkpoint_result, name: 'shell', args: { command: "echo  hi\n" })
+      body = JSON.parse(raw)
+      expect(body['payload_hash']).to match(/\A[0-9a-f]{16}\z/)
+      expect(body['normalized_fields']).to include('command')
+      expect(body['error']).to include("hash=#{body['payload_hash']}")
+    end
+  end
+
+  it 'injects extracted output paths into the system prompt' do
+    prompt = PWN::AI::Agent::PromptBuilder.build(request: 'Write the report to /tmp/pwn-harness-out.md')
+    expect(prompt).to include('DELIVERABLES')
+    expect(prompt).to include('/tmp/pwn-harness-out.md')
+  end
+
+  it 'expects a regex over a PTY session' do
+    id = PWN::Plugins::ProcessTube.spawn(cmd: ['printf', "uid=0(root)\n"])[:id]
+    out = PWN::Plugins::ProcessTube.expect(id: id, pattern: /uid=\d+/, timeout: 2, strip_ansi: true)
+    expect(out[:matched]).to match(/uid=/)
+    PWN::Plugins::ProcessTube.close(id: id)
+  end
+
+  it 'consumes matched PTY output so a second expect needs new bytes' do
+    id = PWN::Plugins::ProcessTube.spawn(cmd: ['printf', "uid=0(root)\nready\n"])[:id]
+    first = PWN::Plugins::ProcessTube.expect(id: id, pattern: /uid=\d+/, timeout: 2)
+    second = PWN::Plugins::ProcessTube.expect(id: id, pattern: /ready/, timeout: 2)
+    expect(first[:matched]).to match(/uid=/)
+    expect(second[:matched]).to include('ready')
+    PWN::Plugins::ProcessTube.close(id: id)
+  end
+
+  it 'runs a three-node job graph with partials on failure' do
+    Dir.mktmpdir('jobs') do |dir|
+      result = PWN::Plugins::Jobs.graph(
+        artifact_dir: dir,
+        jobs: [
+          { id: 'a', command: 'echo enum > a.txt' },
+          { id: 'b', command: 'echo httpx >> a.txt', needs: ['a'] },
+          { id: 'c', command: 'echo nuclei >> a.txt', needs: ['b'] }
+        ]
+      )
+      expect(result[:ok]).to eq(true)
+      expect(File.read(File.join(dir, 'a.txt'))).to include('nuclei')
+    end
+  end
+
+  it 'retains partials when an upstream job fails' do
+    Dir.mktmpdir('jobs-fail') do |dir|
+      result = PWN::Plugins::Jobs.graph(
+        artifact_dir: dir,
+        jobs: [
+          { id: 'a', command: 'false' },
+          { id: 'b', command: 'echo b', needs: ['a'] },
+          { id: 'c', command: 'echo c', needs: ['b'] }
+        ]
+      )
+      expect(result[:jobs]['a'][:ok]).to eq(false)
+      expect(result[:jobs]['b'][:skipped]).to eq(true)
+      expect(result[:jobs]['c'][:skipped]).to eq(true)
+    end
+  end
+
+  it 'enforces a per-job timeout' do
+    Dir.mktmpdir('jobs-to') do |dir|
+      result = PWN::Plugins::Jobs.graph(
+        artifact_dir: dir,
+        jobs: [{ id: 'slow', command: 'sleep 2', timeout: 0.05 }]
+      )
+      expect(result[:jobs]['slow'][:timeout]).to eq(true)
+    end
+  end
+
+  it 'dedups fuzz crashes and scores the minimized file' do
+    Dir.mktmpdir('crash') do |dir|
+      a = File.join(dir, '1')
+      b = File.join(dir, '2')
+      File.binwrite(a, 'AAAAAAAAB')
+      File.binwrite(b, 'AAAAAAAAB')
+      rows = PWN::Plugins::Fuzz.triage(dir: dir)
+      expect(rows.length).to eq(1)
+      expect(rows.first[:count]).to eq(2)
+      expect(rows.first[:exploitability]).to eq('pc_control_candidate')
+    end
+  end
+
+  it 'raises on an offline corpus cache miss' do
+    Dir.mktmpdir('corpus-miss') do |dir|
+      stub_const('PWN::Corpus::ROOT', dir)
+      expect { PWN::Corpus.get(name: :subdomains_top1m, offline: true) }.to raise_error(IOError, /offline/)
+    end
+  end
+
+  it 'parses nmap XML without requiring a live scan' do
+    Dir.mktmpdir('nmap') do |dir|
+      xml = File.join(dir, 'scan.xml')
+      File.write(xml, <<~XML)
+        <?xml version="1.0"?>
+        <nmaprun>
+          <host><address addr="10.0.0.1" addrtype="ipv4"/>
+            <ports><port protocol="tcp" portid="22"><state state="open"/><service name="ssh"/></port></ports>
+          </host>
+        </nmaprun>
+      XML
+      allow(PWN::Engagement).to receive(:warn_unless_in_scope).and_return({ ok: true })
+      allow(PWN::Engagement).to receive(:merge_scan)
+      row = PWN::Plugins::NmapIt.scan(xml: xml, engagement: false)
+      expect(row[:hosts].first[:host]).to eq('10.0.0.1')
+      expect(row[:ports].first[:port]).to eq(22)
+    end
+  end
+
+  it 'health lines include Plugin-Degradation anchors' do
+    doc = File.read(File.join(__dir__, '../../../../../documentation/Plugin-Degradation.md'))
+    PWN::Plugins::PreflightChecker::PLUGIN_DEPS.each_key do |plugin|
+      anchor = plugin.to_s.downcase.gsub(/[^a-z0-9]+/, '-').gsub(/\A-+|-+\z/, '')
+      expect(doc).to include("## #{anchor}")
+    end
+  end
+end