pwn 0.5.783 → 0.5.785

data/lib/pwn/ai/agent/prompt_builder.rb

@@ -49,7 +49,8 @@ module PWN
 
               ENVIRONMENT
                 host       : #{host_line}
-                cwd        : #{Dir.pwd}
+                cwd        : #{Thread.current[:pwn_request_runtime]&.contract&.dig(:cwd) || PWN::Plugins::AISandbox.task_directory}
+                writes     : new files go to #{PWN::Plugins::AISandbox.workspace} unless the original operator request names another path
                 ruby       : #{RUBY_VERSION}
                 pwn        : #{pwn_version}
                 session_id : #{session_id || '(none)'}
@@ -77,7 +78,8 @@ module PWN
 
             ENVIRONMENT
               host       : #{host_line}
-              cwd        : #{Dir.pwd}
+              cwd        : #{Thread.current[:pwn_request_runtime]&.contract&.dig(:cwd) || PWN::Plugins::AISandbox.task_directory}
+              writes     : new files go to #{PWN::Plugins::AISandbox.workspace} unless the original operator request names another path
               ruby       : #{RUBY_VERSION}
               pwn        : #{pwn_version}
               session_id : #{session_id || '(none)'}
@@ -100,6 +102,9 @@ module PWN
               resolved mistake or a durable procedure change, `skills_update`
               folds that RL note into the matching skill.
               TransparentBrowser: open once, reuse browser_obj, close once.
+              If Open WebUI lists a Jev model, browser_act uses Jev for the
+              click/type/select decision and the active model only for field text.
+              #{workspace_prompt(engine: engine)}
 
             HOST LOAD
               #{host_load_block}
@@ -195,6 +200,12 @@ module PWN
           ''
         end
 
+        private_class_method def self.workspace_prompt(opts = {})
+          return '' unless opts[:engine].to_s == 'openwebui'
+
+          "Open WebUI workspace tools, including Ask Jev when it is installed, run on the server through workspace_tool. Do not put them in the client tools array.\n"
+        end
+
         private_class_method def self.host_line
           `uname -srm 2>/dev/null`.strip
         rescue StandardError

data/lib/pwn/ai/agent/request_runtime.rb

@@ -24,7 +24,7 @@ module PWN
           @request_id = (opts[:request_id] || SecureRandom.uuid).to_s.freeze
           @original_request = PWN::AI::Agent::Result.utf8_text(text: opts[:request]).freeze
           @request = @original_request
-          @cwd = Dir.pwd
+          @cwd = Thread.current[:pwn_solve_workspace] || PWN::Plugins::AISandbox.task_directory
           @amendments = [].freeze
           @observations = {}
           @events = []
@@ -87,10 +87,50 @@ module PWN
           mode == 'cancel' ? finish!(status: 'cancelled') : checkpoint!
         end
 
+        # Private in-memory exec handoff. Locks and cancellation callbacks belong
+        # to the caller; the enclosing namespace is the child's cancellation owner.
+        def mission_snapshot
+          @mutex.synchronize do
+            state = instance_variables.reject { |key| %i[@mutex @cancel @memory @router].include?(key) }.to_h { |key| [key, instance_variable_get(key)] }
+            state[:memory] = @memory.instance_variables.to_h { |key| [key, @memory.instance_variable_get(key)] }
+            state[:router] = @router.instance_variables.to_h { |key| [key, @router.instance_variable_get(key)] }
+            state
+          end
+        end
+
+        private_class_method def self.from_mission_snapshot(opts = {})
+          state = opts.fetch(:state).dup
+          runtime = allocate
+          { memory: EngagementMemory, router: Profiles }.each do |key, klass|
+            object = klass.allocate
+            state.delete(key).each { |name, value| object.instance_variable_set(name, value) }
+            runtime.instance_variable_set(:"@#{key}", object)
+          end
+          state.each { |name, value| runtime.instance_variable_set(name, value) }
+          runtime.instance_variable_set(:@mutex, Mutex.new)
+          runtime.worker_view!
+          runtime
+        end
+
+        # A fork gets routing and child-loop ownership, but must never persist
+        # the parent's checkpoint generation. The parent owns final receipts.
+        def worker_view!
+          @worker_copy = true
+          @trace = false
+        end
+
+        def worker_provenance!(opts = {})
+          @worker_provenance = opts.fetch(:rows).to_h.transform_keys(&:to_s)
+        end
+
         # Only host observations enter this store, never parsed tool stdout.
         def observe!(opts = {})
           @mutex.synchronize do
-            opts.fetch(:observations).each { |path, row| @observations[path.to_s] = row }
+            opts.fetch(:observations).each do |path, row|
+              child = @worker_provenance&.dig(path.to_s)
+              row = row.merge(child.slice(:child_request_id, :child_turn_id, :child_provenance)) if child && child[:artifact_turn_id] == @contract[:id] && child[:sha256] == row[:sha256] && child[:stat] == row[:stat] && child[:child_request_id]
+              @observations[path.to_s] = row
+            end
             checkpoint!
           end
         end
@@ -295,8 +335,38 @@ module PWN
             observed >= @started_at && observed <= Time.now && (!row[:max_age] || Time.now - observed <= row[:max_age].to_f)
         end
 
+        # Uncertainty is a recovery state, not another instruction to rewrite
+        # artifacts forever. Retain the replay fence and return actionable IDs.
+        def blocker
+          last = events.reverse.find { |row| row[:phase] == 'end' }
+          return "Tool execution blocked before handler start: #{last[:diagnostic]}. Enable the required kernel protection or choose a supported host; no unsafe fallback was used." if last && last[:state] == 'rejected'
+
+          rows = blocking_effects
+          return nil if rows.empty?
+
+          details = rows.map { |row| "#{row[:tool]} action=#{row[:action_id]} payload_sha256=#{row[:payload_sha256]}" }
+          "Uncertain side effect: #{details.join('; ')}. Do not replay or rewrite blindly. " \
+            'Inspect the exact affected target and request operator-approved reconciliation; unrelated reads or new artifacts cannot resolve this action.'
+        end
+
         def unmet
-          @mutex.synchronize { @effects.value?('uncertain') ? ['uncertain_side_effect'] : [] }
+          blocking_effects.any? ? ['uncertain_side_effect'] : []
+        end
+
+        # A finished search is an observation. Only a write, a store, or a
+        # named remote target can block the answer. Replay of an interrupted
+        # command stays denied even when it does not block.
+        def blocking_effects
+          @mutex.synchronize do
+            @effects.select { |_key, state| state == 'uncertain' }.keys.filter_map do |key|
+              row = @events.reverse.find { |item| item[:payload_sha256] == key && item[:phase] == 'start' }
+              row if row && durable_effect?(effect: row[:effect], target: row[:target])
+            end
+          end
+        end
+
+        def durable_effect?(opts = {})
+          %w[write store].include?(opts[:effect].to_s) || !opts[:target].to_s.empty?
         end
 
         # A started mutation stays uncertain across interruption or process death.
@@ -320,15 +390,33 @@ module PWN
           end
           return { success: false, error: 'uncertain_side_effect', hint: 'Inspect the target before any operator-approved recovery; this mutation was not replayed.' } if denied
 
+          before = TurnFinalizer.artifact_snapshot(paths: @contract[:required_artifacts])
           begin
             result = provider_attempt(&)
-            failed = result.is_a?(Hash) && (result[:error] || result['error'] || result[:success] == false || result['success'] == false)
-            state = if failed
+            failed = result.is_a?(Hash) && (result[:error] || result['error'] || result[:success] == false || result['success'] == false || result[:ok] == false || (result.key?(:exit) && result[:exit] != 0))
+            timed_out = result.is_a?(Hash) && (result[:error] || result['error']).to_s.match?(/timeout/i)
+            # A returned timeout still may have applied. Only a finished
+            # command (exit/stdout, no timeout) is an observation.
+            observed = result.is_a?(Hash) && !timed_out && (result.key?(:exit) || result.key?('exit') || result.key?(:stdout) || result.key?('stdout'))
+            unless failed
+              # Classification is only scheduling advice: successful arbitrary
+              # code may write files even when classified eval/read. The host
+              # delta, not payload keywords or stdout, proves the actual write.
+              TurnFinalizer.observe_artifacts(paths: @contract[:required_artifacts], before: before,
+                                              effect: :write, success: true, action_id: opts[:action_id], tool: opts[:name])
+            end
+            state = if !failed
+                      'completed'
+                    elsif timed_out || !observed
                       mutation ? 'uncertain' : 'failed'
                     else
-                      'completed'
+                      'failed'
                     end
             result
+          rescue PWN::Plugins::AISandbox::NotStarted => e
+            state = 'rejected'
+            action[:diagnostic] = e.message
+            { success: false, error: e.message, execution_state: 'not_started' }
           ensure
             @mutex.synchronize do
               state ||= mutation ? 'uncertain' : 'interrupted'
@@ -474,18 +562,35 @@ module PWN
         end
 
         def checkpoint!
-          FileUtils.mkdir_p(File.dirname(@checkpoint_path), mode: 0o700)
-          File.open("#{@checkpoint_path}.lock", File::RDWR | File::CREAT, 0o600) do |lock|
-            lock.flock(File::LOCK_EX)
-            current = File.file?(@checkpoint_path) ? JSON.parse(File.read(@checkpoint_path)).fetch('generation', 0) : 0
-            raise IOError, 'stale request checkpoint: reload before proceeding' unless current == @generation
-
-            @generation += 1
-            write_checkpoint!
+          return if @worker_copy
+
+          PWN::Plugins::AISandbox.control_directory(path: File.dirname(@checkpoint_path)) do |directory|
+            path = File.join(directory, File.basename(@checkpoint_path))
+            File.open("#{path}.lock", File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |lock|
+              raise IOError, 'checkpoint lock must be a singly linked regular file' unless lock.stat.file? && lock.stat.nlink == 1
+
+              lock.flock(File::LOCK_EX)
+              current = checkpoint_generation(path: path)
+              raise IOError, 'stale request checkpoint: reload before proceeding' unless current == @generation
+
+              @generation += 1
+              write_checkpoint!(path: path)
+            end
+          end
+        end
+
+        def checkpoint_generation(opts = {})
+          File.open(opts.fetch(:path), File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+            raise IOError, 'checkpoint must be a singly linked regular file' unless file.stat.file? && file.stat.nlink == 1
+
+            JSON.parse(file.read).fetch('generation', 0)
           end
+        rescue Errno::ENOENT
+          0
         end
 
-        def write_checkpoint!
+        def write_checkpoint!(opts = {})
+          path = opts.fetch(:path)
           rows = @observations.transform_values do |row|
             row.merge(head: Base64.strict_encode64(row[:head]), tail: Base64.strict_encode64(row[:tail]))
           end
@@ -493,14 +598,13 @@ module PWN
                    request: @request, amendments: @amendments, cwd: @cwd, started_at: @started_at.iso8601(9),
                    observations: rows, outcome: @outcome, events: @events, effects: @effects, evidence: @evidence,
                    enabled_toolsets: @enabled_toolsets, verification_contract: @verification_contract }
-          FileUtils.mkdir_p(File.dirname(@checkpoint_path), mode: 0o700)
-          temp = "#{@checkpoint_path}.#{SecureRandom.hex(8)}.tmp"
+          temp = "#{path}.#{SecureRandom.hex(8)}.tmp"
           File.open(temp, File::WRONLY | File::CREAT | File::EXCL, 0o600) do |file|
             file.write(JSON.generate(PWN::AI::Agent::Result.utf8_value(value: data)))
             file.flush
             file.fsync
           end
-          File.rename(temp, @checkpoint_path)
+          File.rename(temp, path)
         ensure
           File.unlink(temp) if temp && File.exist?(temp)
         end

data/lib/pwn/ai/agent/reward.rb

@@ -1079,10 +1079,12 @@ module PWN
               reasons[why] += 1
             end
           end
+          bak = nil
           unless dry
-            bak = "#{path}.bak-p15-#{Time.now.utc.strftime('%Y%m%d%H%M%S')}"
-            FileUtils.cp(path, bak)
-            File.open(path, 'w') { |f| kept.each { |r| f.puts(JSON.generate(r)) } }
+            PWN::Backups.transaction do
+              bak = PWN::Backups.capture(path: path, label: 'preferences')
+              File.open(path, 'w') { |f| kept.each { |r| f.puts(JSON.generate(r)) } }
+            end
           end
           {
             before: raw.length,

data/lib/pwn/ai/agent/skill_consolidation.rb

@@ -85,6 +85,8 @@ module PWN
         end
 
         public_class_method def self.consolidate_file(opts = {})
+          return PWN::Backups.transaction { consolidate_file(opts) } if opts[:dry_run] == false && !PWN::Backups.active?
+
           path = File.expand_path(opts.fetch(:path))
           raise ArgumentError, 'symlink skills are not writable consolidation targets' if File.symlink?(path)
 
@@ -99,8 +101,7 @@ module PWN
             lock.flock(File::LOCK_EX)
             raise ArgumentError, 'skill changed during consolidation' unless File.read(path) == original && !File.symlink?(path)
 
-            backup = "#{path}.#{digest}.bak"
-            File.open(backup, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write(original) } unless File.exist?(backup)
+            backup = PWN::Backups.capture(path: path, label: 'skill-consolidation')
             tmp = "#{path}.#{Process.pid}.tmp"
             File.open(tmp, File::WRONLY | File::CREAT | File::EXCL, File.stat(path).mode & 0o777) do |file|
               file.write(result[:content])

data/lib/pwn/ai/agent/skill_review.rb

@@ -80,6 +80,8 @@ module PWN
         #     skills_root: 'optional - local skills root; default ~/.pwn/skills'
         #   )
         public_class_method def self.decide(opts = {})
+          return PWN::Backups.transaction { decide(opts) } unless PWN::Backups.active?
+
           digest = opts[:source_sha256].to_s
           decision = opts[:decision].to_s
           root = File.realpath(opts[:skills_root] || File.join(Dir.home, '.pwn', 'skills'))
@@ -202,8 +204,7 @@ module PWN
           original = File.binread(path)
           raise 'skill source changed' unless Digest::SHA256.hexdigest(original) == proposal[:source_sha256]
 
-          backup = "#{path}.#{proposal[:source_sha256]}.bak"
-          File.open(backup, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) { |file| file.write(original) } unless File.exist?(backup)
+          backup = PWN::Backups.capture(path: path, label: 'skill-review')
           raise 'backup changed' unless !File.symlink?(backup) && File.binread(backup) == original
 
           content = "#{original}\n\n## Reviewed procedure\n\n#{procedure[:text]}\n"
@@ -330,14 +331,15 @@ module PWN
         end
 
         private_class_method def self.apply_update(opts = {})
+          lock = Learning.send(:learning_lock)
+          return PWN::Backups.transaction { apply_update(opts) } unless PWN::Backups.active?
+
           proposal = opts[:proposal]
           path = proposal[:path].to_s
           return finish(proposal.merge(action: 'refused', reason: 'skill path missing')) unless File.file?(path) && !File.symlink?(path)
 
           original = File.read(path)
-          digest = Digest::SHA256.hexdigest(original)
-          backup = "#{path}.#{digest}.bak"
-          File.open(backup, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write(original) } unless File.exist?(backup)
+          backup = PWN::Backups.capture(path: path, label: 'skill-review')
           signature = (opts[:evidence] || {})[:signature].to_s
           lesson = "#{signature}\n#{opts[:procedure][:text]}"
           written = Learning.update_skill(name: proposal[:name], lesson: lesson, query: proposal[:request], pwn_skills_path: opts[:skills_root])
@@ -349,6 +351,8 @@ module PWN
 
           PWN::Config.load_skills(pwn_skills_path: opts[:skills_root]) if defined?(PWN::Config) && PWN::Config.respond_to?(:load_skills)
           finish(proposal.merge(action: 'applied', backup: backup))
+        ensure
+          Learning.send(:learning_unlock, lock: lock)
         end
 
         private_class_method def self.finish(opts = {})

data/lib/pwn/ai/agent/swarm.rb

@@ -89,6 +89,8 @@ module PWN
         #   )
 
         public_class_method def self.spawn(opts = {})
+          return PWN::Plugins::AISandbox.swarm_control(operation: 'spawn', args: opts) if Thread.current[:pwn_swarm_controller]
+
           name = opts[:name].to_s
           raise ArgumentError, 'name is required' if name.strip.empty?
           raise ArgumentError, 'role is required' if opts[:role].to_s.strip.empty?
@@ -120,12 +122,19 @@ module PWN
         public_class_method def self.retire(opts = {})
           name = opts[:name].to_s
           sid = opts[:swarm_id].to_s
+          continuation = nil
+          if opts[:continuation]
+            raise ArgumentError, 'Continuation retirement requires local and swarm_id' unless opts[:local] == true && !sid.empty?
+
+            require File.expand_path('../../../../etc/default_cron/session_cleanup', __dir__)
+            continuation = PWN::SessionCleanup.retire_continuation(root: SWARM_ROOT, swarm_id: sid, name: name)
+          end
           if opts[:local] == true && !sid.empty?
             path = File.join(SWARM_ROOT, sid, 'agents.yml')
             all = load_personas_file(path: path)
             gone = all.delete(name.to_sym)
             File.write(path, YAML.dump(deep_stringify(hash: all))) if gone
-            return { name: name, removed: !gone.nil?, scope: :swarm }
+            return { name: name, removed: !gone.nil?, scope: :swarm, continuation: continuation }
           end
 
           all  = personas
@@ -236,6 +245,8 @@ module PWN
           empty_tools = false
           prior_id = Thread.current[:pwn_swarm_id]
           prior_honesty = Thread.current[:pwn_swarm_honesty]
+          return PWN::Plugins::AISandbox.swarm_control(operation: 'ask', args: opts) if Thread.current[:pwn_swarm_controller]
+
           sid     = opts[:swarm_id] || create(topic: opts[:request].to_s[0, 60])[:swarm_id]
           persona = opts[:persona] || personas(swarm_id: sid)[name.to_sym]
           raise ArgumentError, "unknown persona: #{name} (see #{AGENTS_FILE})" unless persona
@@ -414,21 +425,28 @@ module PWN
           sid  = opts[:swarm_id].to_s
           name = opts[:name].to_s
           map_path = File.join(SWARM_ROOT, sid, 'personas.json')
-          map = File.exist?(map_path) ? JSON.parse(File.read(map_path)) : {}
-          if map[name]
-            opts[:leases] << PWN::Sessions.activate(session_id: map[name]) if opts[:leases]
-            return map[name]
-          end
+          require File.expand_path('../../../../etc/default_cron/session_cleanup', __dir__)
+          PWN::SessionCleanup.with_continuation_lock(root: File.dirname(SWARM_ROOT)) do
+            raise IOError, 'Unsafe continuation map' if File.symlink?(map_path)
 
-          sess = PWN::Sessions.create(
-            title: "swarm:#{sid} persona:#{name}",
-            source: 'pwn-ai-swarm',
-            active: !opts[:leases].nil?
-          )
-          opts[:leases] << sess[:lease] if opts[:leases]
-          map[name] = sess[:id]
-          File.write(map_path, JSON.pretty_generate(map))
-          sess[:id]
+            map = File.exist?(map_path) ? JSON.parse(File.read(map_path)) : {}
+            raise IOError, 'Unknown continuation map' unless map.is_a?(Hash)
+
+            if map[name]
+              opts[:leases] << PWN::Sessions.activate(session_id: map[name]) if opts[:leases]
+              next map[name]
+            end
+
+            sess = PWN::Sessions.create(
+              title: "swarm:#{sid} persona:#{name}",
+              source: 'pwn-ai-swarm',
+              active: !opts[:leases].nil?
+            )
+            opts[:leases] << sess[:lease] if opts[:leases]
+            map[name] = sess[:id]
+            PWN::SessionCleanup.publish(map_path, JSON.pretty_generate(map))
+            sess[:id]
+          end
         end
 
         private_class_method def self.build_persona_prompt(opts = {})
@@ -759,7 +777,8 @@ module PWN
             #{self}.retire(
               name: 'required - persona name',
               swarm_id: 'optional - swarm directory when local is true',
-              local: 'optional - true retires only that swarm registry'
+              local: 'optional - true retires only that swarm registry',
+              continuation: 'optional - explicitly retire the inactive saved conversation association; requires local and swarm_id'
             )
 
             # Swarm lifecycle & bus

data/lib/pwn/ai/agent/tools/browser_act.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'browser_act',
+  toolset: 'pwn',
+  schema: {
+    name: 'browser_act',
+    description: 'Drive a live browser toward a goal. When Open WebUI has a Jev model, Jev picks each CLICK, TYPE_TEXT, SELECT, scroll, WAIT, DONE, or BLOCKED target from visible controls. The active pwn-ai model writes field text only. If Jev is not configured, the call reports unavailable and does not invent clicks.',
+    parameters: {
+      type: 'object',
+      properties: {
+        goal: { type: 'string', description: 'Natural-language goal for the current page.' },
+        url: { type: 'string', description: 'Optional HTTP(S) URL to open before the first observation.' },
+        steps: { type: 'integer', description: 'Maximum decision cycles, 1 to 60. Defaults to 12.' },
+        browser_type: { type: 'string', description: 'Browser type when no browser_obj is supplied. Defaults to headless.' }
+      },
+      required: ['goal']
+    }
+  },
+  handler: lambda { |args|
+    args = args.transform_keys(&:to_sym)
+    owned = args[:browser_obj].nil?
+    browser_obj = args[:browser_obj] || PWN::Plugins::TransparentBrowser.open(browser_type: (args[:browser_type] || :headless).to_sym)
+    begin
+      PWN::Plugins::TransparentBrowser.act(browser_obj: browser_obj, goal: args[:goal], url: args[:url], steps: args[:steps])
+    ensure
+      PWN::Plugins::TransparentBrowser.close(browser_obj: browser_obj) if owned && browser_obj
+    end
+  }
+)

data/lib/pwn/ai/agent/tools/loot_query.rb

@@ -7,7 +7,7 @@ PWN::AI::Agent::Registry.register(
   toolset: 'pwn',
   schema: {
     name: 'loot_query',
-    description: 'Query the engagement-scoped encrypted loot store (creds/tokens/keys with provenance). Use for lateral-movement planning; BasicAuth.encode(host:) auto-offers matching secrets when a service prompts for auth.',
+    description: 'Query engagement-scoped encrypted loot metadata without decrypting secrets. Store/ingest/offer can select YubiKey hardware protection; hardware access failures never fall back to software. BasicAuth.encode(host:) auto-offers matching secrets when a service prompts for auth.',
     parameters: {
       type: 'object',
       properties: {
@@ -23,6 +23,16 @@ PWN::AI::Agent::Registry.register(
         username: { type: 'string' },
         where: { type: 'string' },
         source: { type: 'string' },
+        yubikey: {
+          type: 'object',
+          description: 'Non-secret selector for an already provisioned HMAC-SHA1 slot. Omit for the existing backend; an empty object selects hardware defaults.',
+          properties: {
+            slot: { type: 'integer', enum: [1, 2] },
+            serial: { type: 'string', pattern: '^[0-9]+$' },
+            timeout: { type: 'number', exclusiveMinimum: 0 }
+          },
+          additionalProperties: false
+        },
         label: { type: 'string' }
       }
     }

data/lib/pwn/ai/agent/tools/recon_run.rb

@@ -7,7 +7,7 @@ PWN::AI::Agent::Registry.register(
   toolset: 'pwn',
   schema: {
     name: 'recon_run',
-    description: 'Run selected recon modules against one hostname/IP, persist normalized assets with stable IDs and evidence paths, and ingest the asset model for retrieval. Scanner observations are not proven findings.',
+    description: 'Run selected recon modules against one hostname/IP, persist normalized assets with stable IDs and evidence paths, and ingest the asset model for retrieval. Optional YubiKey selection protects harvested loot, not raw recon evidence. Scanner observations are not proven findings.',
     parameters: {
       type: 'object',
       properties: {
@@ -15,6 +15,16 @@ PWN::AI::Agent::Registry.register(
         modules: { type: 'array', minItems: 1, items: { type: 'string', enum: %w[nmap banner tls subfinder nuclei] } },
         ports: { type: 'array', items: { type: 'integer', minimum: 1, maximum: 65_535 } },
         engagement_id: { type: 'string' },
+        yubikey: {
+          type: 'object',
+          description: 'Non-secret selector for hardware-encrypted harvested loot using an already provisioned HMAC-SHA1 slot. No software fallback on hardware failure.',
+          properties: {
+            slot: { type: 'integer', enum: [1, 2] },
+            serial: { type: 'string', pattern: '^[0-9]+$' },
+            timeout: { type: 'number', exclusiveMinimum: 0 }
+          },
+          additionalProperties: false
+        },
         timeout: { type: 'number', minimum: 0, maximum: 300 },
         ingest: { type: 'boolean', default: true }
       },

data/lib/pwn/ai/agent/tools/workspace_tool.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'pwn/ai/agent/registry'
+
+PWN::AI::Agent::Registry.register(
+  name: 'workspace_tool',
+  toolset: 'pwn',
+  schema: {
+    name: 'workspace_tool',
+    description: 'Run one provider-hosted tool. Open WebUI workspace tools, including Ask Jev, execute on that server and are not mixed into the client tools array. Other engines expose only their own hosted tools, such as web_search, google_search, or x_search. Ollama has none. Omit name to list the Open WebUI workspace.',
+    parameters: {
+      type: 'object',
+      properties: {
+        name: { type: 'string', description: 'Workspace tool name, such as Ask Jev, or a hosted tool name such as web_search.' },
+        request: { type: 'string', description: 'Question or state to send with the tool. Required unless name is omitted to list Open WebUI tools.' },
+        engine: { type: 'string', description: 'Optional provider. Ask Jev uses Open WebUI when that provider is configured, even if another model is active.' }
+      },
+      required: []
+    }
+  },
+  handler: lambda { |args|
+    args = args.transform_keys(&:to_sym)
+    if args[:name].to_s.strip.empty?
+      PWN::AI::ServerTools.list(engine: :openwebui)
+    else
+      PWN::AI::ServerTools.call(name: args[:name], request: args[:request], engine: args[:engine])
+    end
+  }
+)

data/lib/pwn/ai/agent/turn_finalizer.rb

@@ -209,10 +209,14 @@ module PWN
           request.to_enum(:scan, %r{["'`]((?:~/|/|\./|\.\./)[^"'`\n]+|[^"'`\n]+\.[A-Za-z0-9]+)["'`]|(?<![\w:/])((?:~/|/|\./|\.\./)[\w.+/-]+|[\w+-]+\.[A-Za-z0-9]+)}).each do
             match = Regexp.last_match
             literal = match[1] || match[2].sub(/[.,;:]+\z/, '')
+            # Unquoted dotted initials followed by a period are prose (i.e.,
+            # e.g., U.S.), not a filename. Quoted literals remain authoritative.
+            next if !match[1] && literal.match?(/\A(?:[A-Za-z]\.)+[A-Za-z]\z/) && request[match.end(0)] == '.'
+
             prefix = request[previous_end...match.begin(0)]
             previous_end = match.end(0)
-            intent = prefix.scan(/\b(write|save|store|output|export|create|update|modify|edit|generate|put|produce|deliver|read|inspect|review|analy[sz]e|summari[sz]e|from|using)\b/i).flatten.last&.downcase || intent
-            next unless %w[write save store output export create update modify edit generate put produce deliver].include?(intent)
+            intent = prefix.scan(/\b(write|save|store|output|export|create|update|modify|edit|generate|put|produce|deliver|into|mv|move|copy|cp|rename|to|read|inspect|review|analy[sz]e|summari[sz]e|from|using)\b/i).flatten.last&.downcase || intent
+            next unless %w[write save store output export create update modify edit generate put produce deliver into mv move copy cp rename to].include?(intent)
 
             paths << File.expand_path(literal, opts[:cwd] || Dir.pwd)
           end

data/lib/pwn/ai/agent.rb

@@ -48,6 +48,7 @@ module PWN
       autoload :TurnFinalizer, 'pwn/ai/agent/turn_finalizer'
       autoload :Engagement, 'pwn/ai/agent/engagement'
       autoload :Mission, 'pwn/ai/agent/mission'
+      autoload :MissionNamespace, 'pwn/ai/agent/mission_namespace'
       autoload :OpenGoal, 'pwn/ai/agent/open_goal'
       autoload :PromptCache, 'pwn/ai/agent/prompt_cache'
 

data/lib/pwn/ai/anthropic.rb

@@ -163,7 +163,6 @@ module PWN
       # bearer lives in-session only.
       private_class_method def self.persist_oauth_to_vault(opts = {})
         oauth = opts[:oauth]
-        return false if Thread.current[:pwn_request_runtime]
         return false unless oauth.is_a?(Hash)
         return false unless real_config_value?(value: oauth[:bearer_token])
 
@@ -178,27 +177,13 @@ module PWN
         dec_path = dec_path.to_s.strip
         dec_path = "#{env_path}.decryptor" if dec_path.empty?
 
-        unless File.exist?(env_path) && File.exist?(dec_path) && File.readable?(dec_path)
+        unless File.exist?(env_path)
           puts '[*] INFO: Anthropic OAuth tokens updated in this session only; ' \
-               "persistence to #{env_path} skipped (missing decryption artifacts" \
-               "#{" at #{dec_path}" unless dec_path.empty?})."
+               "persistence to #{env_path} skipped (missing vault)."
           return false
         end
 
-        decryptor = YAML.load_file(dec_path, symbolize_names: true)
-        key = decryptor.is_a?(Hash) ? decryptor[:key] : nil
-        iv  = decryptor.is_a?(Hash) ? decryptor[:iv]  : nil
-        unless real_config_value?(value: key) && real_config_value?(value: iv)
-          puts '[*] INFO: Anthropic OAuth tokens updated in this session only; ' \
-               "persistence to #{env_path} skipped (decryptor at #{dec_path} " \
-               'has no usable key/iv).'
-          return false
-        end
-
-        PWN::Plugins::Vault.decrypt(file: env_path, key: key, iv: iv)
-        begin
-          cfg = YAML.load_file(env_path, symbolize_names: true)
-          cfg = {} unless cfg.is_a?(Hash)
+        PWN::Plugins::Vault.update(file: env_path, decryptor_file: dec_path) do |cfg|
           cfg[:ai] = {} unless cfg[:ai].is_a?(Hash)
           cfg[:ai][:anthropic] = {} unless cfg[:ai][:anthropic].is_a?(Hash)
           vault_oauth = cfg[:ai][:anthropic][:oauth]
@@ -207,19 +192,11 @@ module PWN
           vault_oauth[:bearer_token] = oauth[:bearer_token]
           vault_oauth[:refresh_token] = oauth[:refresh_token] if real_config_value?(value: oauth[:refresh_token])
           vault_oauth[:expires_at] = oauth[:expires_at] if oauth.key?(:expires_at) && !oauth[:expires_at].nil?
-
-          # Match PWN::Config.default_env YAML style (string keys, no leading ':').
-          yaml_env = YAML.dump(cfg).gsub(/^(\s*):/, '\1')
-          File.write(env_path, yaml_env)
-          File.chmod(0o600, env_path)
-        ensure
-          # Always re-encrypt with the IDENTICAL key + iv — never rotate.
-          PWN::Plugins::Vault.encrypt(file: env_path, key: key, iv: iv)
         end
 
         true
       rescue StandardError => e
-        warn "[!] Anthropic OAuth vault persistence failed (session tokens still updated): #{e.class}: #{e.message}"
+        warn "[!] Anthropic OAuth vault persistence failed (session tokens still updated): #{e.class}"
         false
       end
 
@@ -297,14 +274,11 @@ module PWN
         opts[:refresh_token] = refresh_token if refresh_token
         opts[:expires_at]    = Time.now.to_i + data['expires_in'].to_i if data['expires_in']
 
+        sync_oauth_into_env(oauth: opts)
+        persisted = persist_oauth_to_vault(oauth: opts)
         puts "\n[*] SUCCESS: Anthropic OAuth bearer obtained via authorization_code + PKCE."
         puts '    Cached in-memory for this pwn / pwn-ai process.'
-        puts ''
-        puts '    TO MAKE THIS PERMANENT (recommended -- one-time), store via pwn-vault:'
-        puts "      ai.anthropic.oauth.refresh_token = #{refresh_token}" if refresh_token
-        puts "      ai.anthropic.oauth.bearer_token  = #{access_token}"
-        puts '    On future runs the refresh_token alone is enough -- PWN::AI::Anthropic will'
-        puts '    silently exchange it for a fresh access_token (no browser, no prompt).'
+        puts(persisted ? '    Saved to the encrypted configuration vault.' : '    Session only: encrypted vault persistence unavailable.')
         puts ''
 
         access_token
@@ -614,6 +588,7 @@ module PWN
           end
           http_body[:tool_choice] = anth_tool_choice(choice: opts[:tool_choice], model: model) if opts[:tool_choice]
         end
+        http_body = PWN::AI::ServerTools.attach(engine: :anthropic, http_body: http_body, request: opts)
         effort = opts[:reasoning_effort].to_s
         if !effort.empty? && effort != 'none' && reasoning_efforts(model: model)[:efforts].include?(effort)
           http_body[:output_config] = { effort: effort }