pwn 0.5.739 → 0.5.741

data/lib/pwn/ai/agent/tools/exploitdev.rb

@@ -7,37 +7,57 @@ PWN::AI::Agent::Registry.register(
   toolset: 'pwn',
   schema: {
     name: 'exploitdev',
-    description: 'Exploit-dev helpers: pattern_create, pattern_offset, rop_gadgets, checksec, packing.',
+    description: 'Exploit-dev: cyclic pattern generate/offset, ROP gadgets, assemble/disassemble, ELF GOT/PLT resolve, process/remote IO, ret2libc chain.',
     parameters: {
       type: 'object',
       properties: {
-        action: { type: 'string', description: 'pattern_create|pattern_offset|rop_gadgets|p32|p64|checksec' },
+        action: { type: 'string', description: 'pattern_create|pattern_offset|rop_gadgets|assemble|disassemble|elf_resolve|p32|p64|io|ret2libc|checksec' },
         n: { type: 'integer' },
         length: { type: 'integer' },
         value: { type: 'string' },
         path: { type: 'string' },
-        filter: { type: 'string' }
+        filter: { type: 'string' },
+        asm: { type: 'string' },
+        bytes: { type: 'string' },
+        arch: { type: 'string' },
+        offset: { type: 'integer' },
+        extra: { type: 'string' },
+        cmd: { type: 'string' },
+        host: { type: 'string' },
+        port: { type: 'integer' },
+        kind: { type: 'string' }
       },
       required: %w[action]
     }
   },
   handler: lambda { |args|
-    act = (args[:action] || args['action']).to_s
+    args = args.transform_keys(&:to_sym)
+    act = args[:action].to_s
     case act
     when 'pattern_create'
-      PWN::Plugins::ExploitDev.cyclic(length: args[:n] || args[:length] || args['n'] || 200)
+      PWN::Plugins::ExploitDev.cyclic(length: args[:n] || args[:length] || 200)
     when 'pattern_offset'
-      PWN::Plugins::ExploitDev.cyclic_find(value: args[:value] || args['value'], length: args[:length] || args['length'] || 400)
+      PWN::Plugins::ExploitDev.cyclic_find(value: args[:value], length: args[:length] || 400)
     when 'rop_gadgets'
-      rows = Array(PWN::Plugins::ExploitDev.gadgets(path: args[:path] || args['path']))
-      filt = (args[:filter] || args['filter']).to_s
-      filt.empty? ? rows : rows.select { |r| r.to_s.downcase.include?(filt.downcase) }
+      PWN::Plugins::ExploitDev.gadgets(path: args[:path], filter: args[:filter], backend: args[:backend] || 'scan')
+    when 'assemble'
+      PWN::Plugins::Assembly.assemble(asm: args[:asm] || args[:value], arch: args[:arch] || 'x86_64')
+    when 'disassemble'
+      raw = args[:bytes] || args[:value]
+      raw = [raw].pack('H*') if raw.to_s.match?(/\A[0-9a-fA-F]+\z/)
+      PWN::Plugins::Assembly.disassemble(bytes: raw, arch: args[:arch] || 'x86_64')
+    when 'elf_resolve'
+      PWN::Plugins::BinaryParser.elf_resolve(path: args[:path])
     when 'p32'
-      PWN::Plugins::ExploitDev.p32(value: args[:value] || args['value'])
+      PWN::Plugins::ExploitDev.p32(value: args[:value])
     when 'p64'
-      PWN::Plugins::ExploitDev.p64(value: args[:value] || args['value'])
+      PWN::Plugins::ExploitDev.p64(value: args[:value])
+    when 'io'
+      PWN::Plugins::ExploitDev.io(kind: args[:kind] || 'process', cmd: args[:cmd] || args[:path], host: args[:host], port: args[:port])
+    when 'ret2libc'
+      PWN::Plugins::ExploitDev.ret2libc(path: args[:path], offset: args[:offset], extra: args[:extra])
     when 'checksec'
-      PWN::Plugins::GDB.mitigations(binary: args[:path] || args['path'])
+      PWN::Plugins::GDB.mitigations(binary: args[:path])
     else
       { error: "unknown action #{act}" }
     end

data/lib/pwn/ai/agent/tools/finding_record.rb

@@ -7,7 +7,7 @@ PWN::AI::Agent::Registry.register(
   toolset: 'pwn',
   schema: {
     name: 'finding_record',
-    description: 'Record a validated finding with CVSS 3.x, evidence file paths and a required command/code PoC. File existence is not execution proof. Also supports query, chain and export.',
+    description: 'Record a finding with CVSS 3.x, severity justification, ordered reproduction steps, and evidence paths or artifact handles (pcap, screenshot, crash, PoC). Export embeds hash-verified evidence. Hashes are not execution proof.',
     parameters: {
       type: 'object',
       properties: {
@@ -17,7 +17,21 @@ PWN::AI::Agent::Registry.register(
         cvss_score: { type: 'number', minimum: 0, maximum: 10 },
         affected_asset: { type: 'string' },
         evidence_paths: { type: 'array', minItems: 1, items: { type: 'string' } },
+        artifact_handles: {
+          type: 'array', minItems: 1,
+          items: {
+            anyOf: [
+              { type: 'string', minLength: 1 },
+              { type: 'object', required: %w[handle], additionalProperties: false,
+                properties: { handle: { type: 'string', minLength: 1 }, kind: { type: 'string', enum: %w[pcap screenshot crash poc evidence] },
+                              label: { type: 'string', minLength: 1 }, sha256: { type: 'string', pattern: '^[0-9a-f]{64}$' } } }
+            ]
+          }
+        },
+        severity_justification: { type: 'string', minLength: 1, description: 'Explain demonstrated impact and why it supports the chosen CVSS metrics; do not claim untested escalation.' },
+        reproduction_steps: { type: 'array', minItems: 1, items: { type: 'string', minLength: 1 }, description: 'Ordered setup, PoC commands and expected observations for independent reproduction.' },
         attack_chain_refs: { type: 'array', items: { type: 'string' } },
+        enables: { type: 'array', uniqueItems: true, items: { type: 'string', minLength: 1 }, description: 'Outgoing finding IDs this finding enables, within the same engagement. Use op=link to update an existing finding.' },
         remediation: { type: 'string' },
         confidence: { type: 'number', minimum: 0, maximum: 1 },
         dir_path: { type: 'string' },
@@ -28,7 +42,8 @@ PWN::AI::Agent::Registry.register(
         poc: { type: 'string' },
         poc_artifacts: { type: 'array', items: { type: 'string' } },
         session_id: { type: 'string' },
-        op: { type: 'string', enum: %w[query export chain record verify retest chain_impact gaps] },
+        op: { type: 'string', enum: %w[query export chain record link verify retest chain_impact gaps] },
+        id: { type: 'string', minLength: 1 },
         parent_id: { type: 'string' },
         engagement_id: { type: 'string' },
         kind: { type: 'string', enum: %w[http script] },
@@ -36,21 +51,30 @@ PWN::AI::Agent::Registry.register(
         request_path: { type: 'string' },
         response_path: { type: 'string' },
         execution_log: { type: 'string' },
-        ids: { type: 'array', items: { type: 'string' } },
+        ids: { type: 'array', uniqueItems: true, items: { type: 'string' }, description: 'Ordered source-to-impact finding IDs for chain_impact.' },
         combined_impact_path: { type: 'string' },
         escalate: { type: 'boolean' },
         combined_severity: { type: 'string' }
       },
       required: %w[],
       anyOf: [
-        { properties: { op: { enum: %w[query export] } }, required: %w[op] },
-        { required: %w[title cwe cvss_vector cvss_score affected_asset evidence_paths poc attack_chain_refs remediation confidence] }
+        { properties: { op: { enum: %w[query export gaps] } }, required: %w[op] },
+        { properties: { op: { enum: %w[verify retest] } }, required: %w[op id kind impact],
+          anyOf: [{ required: %w[request_path response_path] }, { required: %w[execution_log] }] },
+        { properties: { op: { enum: %w[chain_impact] } }, required: %w[op ids combined_impact_path] },
+        { properties: { op: { enum: %w[link] } }, required: %w[op id enables] },
+        { properties: { op: { enum: %w[record chain] } }, required: %w[title cwe cvss_vector cvss_score affected_asset poc attack_chain_refs remediation confidence severity_justification reproduction_steps],
+          anyOf: [{ required: %w[evidence_paths] }, { required: %w[artifact_handles] }] }
       ]
     }
   },
   handler: lambda { |args|
     args = args.transform_keys(&:to_sym)
     op = (args[:op] || 'record').to_s
+    if %w[record chain].include?(op)
+      raise ArgumentError, 'severity_justification must be a nonempty string' unless args[:severity_justification].is_a?(String) && !args[:severity_justification].strip.empty?
+      raise ArgumentError, 'reproduction_steps are required' unless args.key?(:reproduction_steps) && !args[:reproduction_steps].nil?
+    end
     case op
     when 'query'
       PWN::Plugins::Findings.query(args)
@@ -67,6 +91,8 @@ PWN::AI::Agent::Registry.register(
       PWN::Plugins::Findings.retest(args)
     when 'chain_impact'
       PWN::Plugins::Findings.chain_impact(args)
+    when 'link'
+      PWN::Plugins::Findings.link(args)
     when 'gaps'
       PWN::Plugins::Findings.issue_work_gaps(args)
     when 'record'

data/lib/pwn/ai/agent/tools/fuzz_campaign.rb

@@ -1,54 +1,77 @@
 # frozen_string_literal: true
 
 require 'pwn/ai/agent/registry'
+require 'shellwords'
 
 PWN::AI::Agent::Registry.register(
   name: 'fuzz_campaign',
   toolset: 'pwn',
   schema: {
     name: 'fuzz_campaign',
-    description: 'Start, status, stop, or triage an AFL++ campaign via background jobs.',
+    description: 'AFL++/libFuzzer campaign: corpus, dictionary from binary strings, durable Jobs, crash dedup by backtrace hash, auto PWN-RE-003 triage (GDBMI + binary_triage + exploitdev). Poll job_status; no manual glue.',
     parameters: {
       type: 'object',
       properties: {
         action: { type: 'string', description: 'start|status|stop|triage|minimize' },
+        engine: { type: 'string', description: 'aflplusplus (default) or libfuzzer' },
         in_dir: { type: 'string' },
         out_dir: { type: 'string' },
         target: { type: 'string' },
-        id: { type: 'string' }
+        max_runtime: { type: 'integer', minimum: 0 },
+        session_id: { type: 'string' },
+        cwd: { type: 'string' },
+        env: { type: 'object', additionalProperties: { type: 'string' } },
+        idempotency_key: { type: 'string' },
+        id: { type: 'string' },
+        crash: { type: 'string' },
+        out: { type: 'string' }
       },
       required: %w[action]
     }
   },
   handler: lambda { |args|
-    act = (args[:action] || args['action']).to_s
+    args = args.transform_keys(&:to_sym)
+    act = args[:action].to_s
     case act
     when 'start'
-      in_dir = args[:in_dir] || args['in_dir']
-      out_dir = args[:out_dir] || args['out_dir']
-      target = args[:target] || args['target']
-      cmd = "afl-fuzz -i #{in_dir} -o #{out_dir} -- #{target}"
-      PWN::Plugins::Jobs.start(command: cmd)
+      in_dir = args[:in_dir]
+      out_dir = args[:out_dir]
+      target = args[:target]
+      raise ArgumentError, 'in_dir, out_dir and target are required' if [in_dir, out_dir, target].any? { |value| value.to_s.empty? }
+
+      env = args[:env]
+      cmd = PWN::Plugins::AFLplusplus.campaign_command(
+        engine: args[:engine] || 'aflplusplus',
+        in_dir: in_dir,
+        out_dir: out_dir,
+        target: target,
+        max_runtime: args[:max_runtime],
+        cwd: args[:cwd],
+        env: env&.transform_keys(&:to_s)
+      )
+      PWN::Plugins::Jobs.start(
+        command: cmd,
+        max_runtime: args[:max_runtime],
+        session_id: args[:session_id] || Thread.current[:pwn_session_id],
+        cwd: args[:cwd],
+        env: env&.transform_keys(&:to_s),
+        idempotency_key: args[:idempotency_key]
+      )
     when 'status'
-      row = PWN::Plugins::Jobs.status(id: args[:id] || args['id'])
-      out_dir = args[:out_dir] || args['out_dir']
+      row = PWN::Plugins::Jobs.status(id: args[:id])
+      out_dir = args[:out_dir]
       row = row.merge(PWN::Plugins::AFLplusplus.parse_stats(out_dir: out_dir)) if out_dir
-      if out_dir && defined?(PWN::Plugins::AFLplusplus)
-        begin
-          triage = PWN::Plugins::AFLplusplus.crash_triage(out_dir: out_dir)
-          row = row.merge(triage: triage) if triage
-        rescue StandardError
-          nil
-        end
+      if out_dir
+        triage = PWN::Plugins::AFLplusplus.crash_triage(out_dir: out_dir, target: args[:target], handoff: true)
+        row = row.merge(triage: triage)
       end
       row
     when 'stop'
-      PWN::Plugins::Jobs.stop(id: args[:id] || args['id'])
+      PWN::Plugins::Jobs.stop(id: args[:id])
     when 'triage'
-      out_dir = args[:out_dir] || args['out_dir']
-      PWN::Plugins::Fuzz.triage(dir: File.join(out_dir.to_s, 'crashes'), record: true, target: args[:target] || args['target'])
+      PWN::Plugins::AFLplusplus.crash_triage(out_dir: args[:out_dir], target: args[:target], handoff: true)
     when 'minimize'
-      PWN::Plugins::AFLplusplus.minimize(crash: args[:crash] || args['crash'], out: args[:out] || args['out'], target: args[:target] || args['target'])
+      PWN::Plugins::AFLplusplus.minimize(crash: args[:crash], out: args[:out], target: args[:target])
     else
       { error: "unknown action #{act}" }
     end

data/lib/pwn/ai/agent/tools/job_run.rb

@@ -1,31 +1,41 @@
 # frozen_string_literal: true
 
 require 'pwn/ai/agent/registry'
+require 'shellwords'
+require 'rbconfig'
 
 PWN::AI::Agent::Registry.register(
   name: 'job_run',
   toolset: 'terminal',
   schema: {
     name: 'job_run',
-    description: 'Start a detached background job (nmap, afl, hashcat). Returns {id, pid, log}.',
+    description: 'Start durable detached work: fuzzers, full scans, Ghidra analysis or a job graph. Returns a job id immediately; survives agent/session exit. Poll job_status and incrementally read job_tail using next_offset. max_runtime is the supervisor lifetime, NOT a blocking tool timeout; 21600 allows six hours. Reuse idempotency_key on launch retries, never relaunch to poll.',
     parameters: {
       type: 'object',
       properties: {
         command: { type: 'string' },
         cmd: { type: 'string' },
         tag: { type: 'string' },
+        session_id: { type: 'string' },
+        max_runtime: { type: 'integer', minimum: 0, description: 'Independent wall runtime in seconds; 0 means no runtime limit.' },
+        cwd: { type: 'string' },
+        env: { type: 'object', additionalProperties: { type: 'string' } },
+        idempotency_key: { type: 'string', description: 'Stable launch key reused across retries/sessions to recover the same job.' },
         jobs: { type: 'array' },
         artifact_dir: { type: 'string' }
       },
-      required: %w[]
+      anyOf: [{ required: %w[command] }, { required: %w[cmd] }, { required: %w[jobs] }]
     }
   },
   handler: lambda { |args|
-    if args[:jobs] || args['jobs']
-      PWN::Plugins::Jobs.graph(jobs: args[:jobs] || args['jobs'], artifact_dir: args[:artifact_dir] || args['artifact_dir'])
-    else
-      PWN::Plugins::Jobs.start(command: args[:command] || args[:cmd] || args['command'], session_id: args[:tag] || args['tag'])
+    args = args.transform_keys(&:to_sym)
+    command = args[:command] || args[:cmd]
+    if args[:jobs]
+      payload = JSON.generate(jobs: args[:jobs], artifact_dir: args[:artifact_dir])
+      script = 'r=PWN::Plugins::Jobs.graph(JSON.parse(ARGV.fetch(0), symbolize_names:true)); puts JSON.generate(r); exit(r[:ok] ? 0 : 1)'
+      command = Shellwords.join([RbConfig.ruby, '-I', File.expand_path('../../../..', __dir__), '-rpwn', '-rjson', '-e', script, payload])
     end
+    PWN::Plugins::Jobs.start(command: command, session_id: args[:session_id] || args[:tag] || Thread.current[:pwn_session_id], max_runtime: args[:max_runtime], cwd: args[:cwd], env: args[:env]&.transform_keys(&:to_s), idempotency_key: args[:idempotency_key])
   }
 )
 PWN::AI::Agent::Registry.register(
@@ -33,15 +43,15 @@ PWN::AI::Agent::Registry.register(
   toolset: 'terminal',
   schema: {
     name: 'job_status',
-    description: 'Poll a job started by job_run.',
+    description: 'Poll durable job status by id, including exit/signal. Omit id to rediscover recent jobs from prior sessions. RUNNING is not completion; poll again instead of rerunning job_run.',
     parameters: {
       type: 'object',
-      properties: { id: { type: 'string' } },
-      required: %w[id]
+      properties: { id: { type: 'string' } }
     }
   },
   handler: lambda { |args|
-    PWN::Plugins::Jobs.status(id: args[:id] || args['id'])
+    id = args[:id] || args['id']
+    id ? PWN::Plugins::Jobs.status(id: id) : PWN::Plugins::Jobs.list(limit: 20)
   }
 )
 PWN::AI::Agent::Registry.register(
@@ -49,7 +59,7 @@ PWN::AI::Agent::Registry.register(
   toolset: 'terminal',
   schema: {
     name: 'job_result',
-    description: 'Fetch log tail and paths for a job_run id.',
+    description: 'Fetch durable status and a bounded log tail for a job id. Use job_tail for incremental byte-cursor reads.',
     parameters: {
       type: 'object',
       properties: { id: { type: 'string' }, lines: { type: 'integer' } },
@@ -65,15 +75,17 @@ PWN::AI::Agent::Registry.register(
   toolset: 'terminal',
   schema: {
     name: 'job_tail',
-    description: 'Tail a job log started by job_run.',
+    description: 'Read a bounded incremental job log page. Start offset=0, then use next_offset. eof means current log end, not job completion: also poll job_status. Preserve encoding when decoding binary logs.',
     parameters: {
       type: 'object',
-      properties: { id: { type: 'string' }, handle: { type: 'string' }, lines: { type: 'integer' } },
-      required: %w[id]
+      properties: { id: { type: 'string' }, handle: { type: 'string' }, offset: { type: 'integer', minimum: 0 }, length: { type: 'integer', minimum: 1 }, lines: { type: 'integer' } },
+      anyOf: [{ required: %w[id] }, { required: %w[handle] }]
     }
   },
   handler: lambda { |args|
-    PWN::Plugins::Jobs.job_tail(id: args[:id] || args[:handle] || args['id'], lines: args[:lines] || args['lines'])
+    args = args.transform_keys(&:to_sym)
+    length = (args[:length] || PWN::AI::Agent::Result.page_length).to_i.clamp(1, PWN::AI::Agent::Result.page_length)
+    PWN::Plugins::Jobs.tail(id: args[:id] || args[:handle], offset: args[:offset] || 0, length: length)
   }
 )
 PWN::AI::Agent::Registry.register(
@@ -81,14 +93,14 @@ PWN::AI::Agent::Registry.register(
   toolset: 'terminal',
   schema: {
     name: 'job_kill',
-    description: 'Stop a job started by job_run.',
+    description: 'Request supervised cancellation of a job and its process group. Poll job_status for terminal STOPPED state.',
     parameters: {
       type: 'object',
       properties: { id: { type: 'string' }, handle: { type: 'string' } },
-      required: %w[id]
+      anyOf: [{ required: %w[id] }, { required: %w[handle] }]
     }
   },
   handler: lambda { |args|
-    PWN::Plugins::Jobs.job_kill(id: args[:id] || args[:handle] || args['id'])
+    PWN::Plugins::Jobs.job_kill(id: args[:id] || args[:handle] || args['id'] || args['handle'])
   }
 )

data/lib/pwn/ai/agent/tools/loot_query.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'loot_query',
+  toolset: 'pwn',
+  schema: {
+    name: 'loot_query',
+    description: 'Query the engagement-scoped encrypted loot store (creds/tokens/keys with provenance). Use for lateral-movement planning; BasicAuth.encode(host:) auto-offers matching secrets when a service prompts for auth.',
+    parameters: {
+      type: 'object',
+      properties: {
+        host: { type: 'string' },
+        service: { type: 'string' },
+        kind: { type: 'string' },
+        engagement: { type: 'string' },
+        engagement_id: { type: 'string' },
+        finding_id: { type: 'string' },
+        op: { type: 'string', enum: %w[query offer ingest store] },
+        text: { type: 'string' },
+        secret: { type: 'string' },
+        username: { type: 'string' },
+        where: { type: 'string' },
+        source: { type: 'string' },
+        label: { type: 'string' }
+      }
+    }
+  },
+  handler: lambda { |args|
+    args = args.transform_keys(&:to_sym)
+    op = (args[:op] || 'query').to_s
+    case op
+    when 'offer'
+      PWN::Plugins::Vault.offer(args)
+    when 'ingest'
+      PWN::Plugins::Vault.ingest(args.merge(source: args[:source] || 'recon'))
+    when 'store'
+      PWN::Plugins::Vault.store(args)
+    else
+      { records: PWN::Plugins::Vault.query(args) }
+    end
+  }
+)

data/lib/pwn/ai/agent/tools/nmap_scan.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'nmap_scan',
+  toolset: 'pwn',
+  schema: {
+    name: 'nmap_scan',
+    description: 'Ingest nmap XML into the engagement store (hosts, services, scripts) and return diff vs last scan. since=yesterday answers what changed since yesterday in one call.',
+    parameters: {
+      type: 'object',
+      properties: {
+        xml: { type: 'string', description: 'Path to nmap XML (ingest).' },
+        xml_file: { type: 'string' },
+        since: { type: 'string', description: 'yesterday | last-scan | ISO8601. Omit xml to only query the diff.' },
+        engagement: { type: 'string' },
+        override: { type: 'boolean' },
+        at: { type: 'string' }
+      }
+    }
+  },
+  handler: lambda { |args|
+    args = args.transform_keys(&:to_sym)
+    xml = args[:xml] || args[:xml_file]
+    if xml.to_s.empty?
+      PWN::Plugins::NmapIt.changes(since: args[:since] || 'yesterday', engagement: args[:engagement])
+    else
+      PWN::Plugins::NmapIt.scan(xml: xml, engagement: args[:engagement], override: args[:override], at: args[:at])
+    end
+  }
+)

data/lib/pwn/ai/agent/tools/nuclei_scan.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'nuclei_scan',
+  toolset: 'pwn',
+  schema: {
+    name: 'nuclei_scan',
+    description: 'Run or ingest nuclei JSONL (optionally after httpx tech-detect). Records web findings with matched-at URL, template id, and severity into the findings store.',
+    parameters: {
+      type: 'object',
+      properties: {
+        jsonl: { type: 'string', description: 'nuclei JSONL path or raw JSONL (skips the nuclei binary).' },
+        target: { type: 'string' },
+        url: { type: 'string' },
+        httpx_jsonl: { type: 'string', description: 'httpx JSONL used to select nuclei tags by tech stack.' },
+        techs: { type: 'array', items: { type: 'string' } },
+        record: { type: 'boolean' },
+        templates: { type: 'string' },
+        severity: { type: 'string' }
+      }
+    }
+  },
+  handler: lambda { |args|
+    args = args.transform_keys(&:to_sym)
+    techs = Array(args[:techs])
+    techs = PWN::Plugins::Httpx.probe(jsonl: args[:httpx_jsonl])[:techs] if techs.empty? && !args[:httpx_jsonl].to_s.empty?
+    PWN::Plugins::Nuclei.scan(args.merge(techs: techs, record: args.fetch(:record, true)))
+  }
+)

data/lib/pwn/ai/agent/tools/radare2.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'r2_functions',
+  toolset: 'pwn',
+  schema: {
+    name: 'r2_functions',
+    description: 'Open a binary in r2/rizin (r2pipe) and return parsed aflj function JSON. Pair with r2_disasm for main.',
+    parameters: {
+      type: 'object',
+      properties: {
+        bin: { type: 'string', description: 'Filesystem path of the binary.' },
+        path: { type: 'string', description: 'Alias for bin.' },
+        session: { type: 'string', description: 'Existing r2pipe session id from a prior r2_* call.' },
+        backend: { type: 'string', enum: %w[r2 rizin] }
+      },
+      anyOf: [{ required: %w[bin] }, { required: %w[path] }, { required: %w[session] }]
+    }
+  },
+  handler: lambda { |args|
+    args = args.transform_keys(&:to_sym)
+    session = args[:session] || PWN::Plugins::Radare2.open(args)
+    { session: session, command: 'aflj', functions: PWN::Plugins::Radare2.functions(session: session) }
+  }
+)
+PWN::AI::Agent::Registry.register(
+  name: 'r2_disasm',
+  toolset: 'pwn',
+  schema: {
+    name: 'r2_disasm',
+    description: 'Return parsed pdfj/pdj disassembly JSON for an address or function (default main) from an r2pipe session.',
+    parameters: {
+      type: 'object',
+      properties: {
+        bin: { type: 'string' },
+        path: { type: 'string' },
+        session: { type: 'string' },
+        addr: { type: 'string', description: 'Function, symbol, or 0x address. Defaults to main.' },
+        n: { type: 'integer', minimum: 1, maximum: 4096, description: 'If set, use pdj for n instructions; otherwise pdfj.' },
+        backend: { type: 'string', enum: %w[r2 rizin] }
+      },
+      anyOf: [{ required: %w[bin] }, { required: %w[path] }, { required: %w[session] }]
+    }
+  },
+  handler: lambda { |args|
+    args = args.transform_keys(&:to_sym)
+    session = args[:session] || PWN::Plugins::Radare2.open(args)
+    addr = args[:addr]
+    addr = 'main' if addr.nil? || addr.to_s.empty?
+    { session: session, command: args[:n] ? 'pdj' : 'pdfj', addr: addr,
+      disasm: PWN::Plugins::Radare2.disasm(args.merge(session: session, addr: addr)) }
+  }
+)

data/lib/pwn/ai/agent/tools/ruby_eval.rb

@@ -35,6 +35,7 @@ PWN::AI::Agent::Registry.register(
         code: { type: 'string', description: 'Ruby source to evaluate.' },
         encoding: { type: 'string', description: 'Set to base64 when data holds the Ruby source.' },
         data: { type: 'string', description: 'Base64 Ruby source when encoding is base64.' },
+        placeholder_ok: { type: 'boolean', description: 'Explicitly permit placeholder tokens; Ruby must still parse and execute. Literal strings/heredocs never require this.' },
         timeout: {
           type: 'integer',
           description: 'Conservative seconds this eval should take given HOST LOAD. Omit for a host-derived default. Explicit values honored 1..10800 (3 hours). On timeout keep the same payload and timeout += 180; rewrite only after the 3-hour budget (max 10 mutations/task).'
@@ -58,11 +59,27 @@ PWN::AI::Agent::Registry.register(
     code = args[:code].to_s
     return PWN::AI::Agent::ToolGuard.invalid_payload(hint: 'code must be a nonempty string') unless args[:code].is_a?(String) && !code.empty?
 
+    placeholder = PWN::AI::Agent::ToolGuard.placeholder_match(text: code, language: :ruby, placeholder_ok: args[:placeholder_ok])
+    if placeholder
+      return PWN::AI::Agent::ToolGuard.invalid_payload(
+        **placeholder,
+        text: code,
+        hint: 'Ruby source contains an elided code stub outside literal data.',
+        remedy: 'Replace the matched stub with complete Ruby code. Strings and heredocs may contain ellipses without placeholder_ok. Explicit placeholder_ok: true skips this guard but not Ruby parsing; base64 data is decoded before validation.'
+      )
+    end
+
+    timeout = PWN::AI::Agent::ToolGuard.deadline_s(timeout: args[:timeout], kind: :eval, payload: code)
+    PWN::AI::Agent::ToolGuard.protect_http!
+    sandboxed = PWN::Plugins::AISandbox.wrap_ruby(code: code, timeout: timeout)
+    return sandboxed unless sandboxed.nil?
+
+    blocked = PWN::Plugins::MethodCatalog.guard_eval(code: code)
+    return blocked if blocked
+
     old_stdout = $stdout
     buf = StringIO.new
     $stdout = buf
-    timeout = PWN::AI::Agent::ToolGuard.deadline_s(timeout: args[:timeout], kind: :eval, payload: code)
-    PWN::AI::Agent::ToolGuard.protect_http!
     begin
       # rubocop:disable Security/Eval
       # INTENTIONAL: this IS the pwn-ai → PWN bridge