pwn 0.5.783 → 0.5.785

data/lib/pwn/plugins/repl/ai_swarm.rb

@@ -49,6 +49,29 @@ module PWN
           end
         end
 
+        # Parent-side typed control pipe for one namespace-owned job.
+        class RemoteControl
+          attr_accessor :observed_pause
+
+          def initialize(io)
+            @io = io
+          end
+
+          def submit(text)
+            send_control('submit', text)
+          end
+
+          def pause(value)
+            send_control('pause', value)
+          end
+
+          private
+
+          def send_control(action, value)
+            @io.write("#{JSON.generate([action, value])}\n")
+          end
+        end
+
         # Session-scoped swarm jobs. Workers never draw the terminal.
         class Controller # rubocop:disable Metrics/ClassLength -- one session-scoped swarm command surface
           MAX_JOBS = 8
@@ -164,7 +187,7 @@ module PWN
             when 'create' then create(tokens.join(' '))
             when 'use' then use(tokens.first)
             when 'spawn' then spawn(tokens)
-            when 'retire' then retire(tokens.first)
+            when 'retire' then retire(tokens.first, continuation: tokens.include?('--continuation'))
             when 'dm' then ask(tokens, opts)
             when 'mission' then solve(tokens, opts)
             when 'debate' then debate(tokens, opts)
@@ -180,7 +203,7 @@ module PWN
           def help_text
             {
               ok: true,
-              usage: '/swarm mission REQUEST|agents|status [JOB]|create [topic]|use ID|spawn NAME ROLE [--engine E --model M --toolsets a,b]|retire NAME|dm NAME REQUEST|debate NAMES TOPIC [--rounds N]|broadcast REQUEST [--names a,b]|tail [N]|steer JOB INSTRUCTION|pause JOB|resume JOB|cancel JOB|all'
+              usage: '/swarm mission REQUEST|agents|status [JOB]|create [topic]|use ID|spawn NAME ROLE [--engine E --model M --toolsets a,b]|retire NAME [--continuation]|dm NAME REQUEST|debate NAMES TOPIC [--rounds N]|broadcast REQUEST [--names a,b]|tail [N]|steer JOB INSTRUCTION|pause JOB|resume JOB|cancel JOB|all'
             }
           end
 
@@ -215,10 +238,10 @@ module PWN
             { ok: true, persona: result[:name], swarm_id: @swarm_id, scope: :swarm }
           end
 
-          def retire(name)
+          def retire(name, continuation: false)
             return { ok: false, error: 'invalid persona name' } unless identifier?(name)
 
-            result = PWN::AI::Agent::Swarm.retire(name: name, swarm_id: @swarm_id, local: true)
+            result = PWN::AI::Agent::Swarm.retire(name: name, swarm_id: @swarm_id, local: true, continuation: continuation)
             { ok: result[:removed], scope: result[:scope], name: name }
           end
 
@@ -227,23 +250,14 @@ module PWN
             request = tokens.join(' ')
             return { ok: false, error: 'usage: dm NAME REQUEST' } if name.to_s.empty? || request.empty?
 
-            start_job(agent: name, command: 'dm', opts: opts) do |job|
-              PWN::AI::Agent::Swarm.ask(name: name, request: request, swarm_id: ensure_swarm, steering: job[:control], usage_observer: opts[:usage_observer], on_tool: tool_callback(job, opts))
-            end
+            start_job(agent: name, command: 'dm', opts: opts, task: { name: name, request: request })
           end
 
           def solve(tokens, opts)
             request = opts.fetch(:solve_request, tokens.join(' '))
             return { ok: false, error: 'usage: mission REQUEST' } if request.strip.empty?
 
-            start_job(agent: 'team', command: 'mission', opts: opts) do |job|
-              PWN::AI::Agent::Swarm.solve(
-                request: request, swarm_id: ensure_swarm, steering: job[:control],
-                worktree: opts.fetch(:worktree, false), rounds: opts.fetch(:rounds, 3), verification_timeout: opts.fetch(:verification_timeout, 60), role_timeout: opts.fetch(:role_timeout, 300),
-                workspace: opts[:workspace], usage_observer: opts[:usage_observer], on_tool: tool_callback(job, opts),
-                on_state: ->(state) { @mutex.synchronize { job[:team] = state } }
-              )
-            end
+            start_job(agent: 'team', command: 'mission', opts: opts, task: { request: request })
           end
 
           def debate(tokens, opts)
@@ -254,18 +268,7 @@ module PWN
             return { ok: false, error: 'usage: debate NAME,NAME TOPIC [--rounds N]' } if names.length < 2 || topic.empty?
             return { ok: false, error: 'rounds must be between 1 and 10' } unless rounds.between?(1, 10)
 
-            start_job(agent: names.join(','), command: 'debate', opts: opts) do |job|
-              transcript = []
-              rounds.times do
-                names.each do |name|
-                  request = transcript.empty? ? topic : "#{topic}\n\nPrevious speaker: #{transcript.last}\nRespond, critique, or advance the objective."
-                  job[:control].check_stop
-                  result = PWN::AI::Agent::Swarm.ask(name: name, request: request, swarm_id: @swarm_id, steering: job[:control], usage_observer: opts[:usage_observer], on_tool: tool_callback(job, opts))
-                  transcript << "#{name}: #{result[:reply]}"
-                end
-              end
-              { reply: transcript.join("\n") }
-            end
+            start_job(agent: names.join(','), command: 'debate', opts: opts, task: { names: names, topic: topic, rounds: rounds })
           end
 
           def broadcast(tokens, opts)
@@ -274,14 +277,7 @@ module PWN
             names = flags['names']&.split(',') || agents
             return { ok: false, error: 'usage: broadcast REQUEST [--names a,b]' } if request.empty? || names.empty?
 
-            start_job(agent: names.join(','), command: 'broadcast', opts: opts) do |job|
-              replies = names.map do |name|
-                job[:control].check_stop
-                result = PWN::AI::Agent::Swarm.ask(name: name, request: request, swarm_id: ensure_swarm, steering: job[:control], usage_observer: opts[:usage_observer], on_tool: tool_callback(job, opts))
-                "#{name}: #{result[:reply]}"
-              end
-              { reply: replies.join("\n") }
-            end
+            start_job(agent: names.join(','), command: 'broadcast', opts: opts, task: { names: names, request: request })
           end
 
           def steer(tokens, opts)
@@ -315,7 +311,9 @@ module PWN
 
             return { ok: false, error: 'job is no longer active' } unless update_active(job, 'cancelling')
 
-            job[:control].stop
+            job[:mission].close
+            job[:worker]&.join
+            update(job, 'cancelled', error: 'Mission cancelled; all owned processes reaped.')
             { ok: true, job_id: job[:id] }
           end
 
@@ -331,7 +329,92 @@ module PWN
             { ok: true, messages: PWN::AI::Agent::Swarm.bus_tail(swarm_id: @swarm_id, limit: (limit || 8).to_i) }
           end
 
-          def start_job(agent:, command:, opts:)
+          private_class_method def self.mission_entry(opts = {})
+            data = opts[:descriptor]
+            controller = new(session_id: data[:session_id])
+            controller.instance_variable_set(:@swarm_id, data[:swarm_id])
+            controller.send(:mission_child, data[:job], data[:task], data[:options], PWN::AI::Agent::MissionNamespace.io(4), PWN::AI::Agent::MissionNamespace.io(5))
+          end
+
+          def mission_child(job, task, opts, writer, commands)
+            id = job[:id]
+            command = job[:command]
+            @child_events = AIConsole::MissionEvents.new(writer, id)
+            output = AIConsole::EventIO.new(@child_events)
+            $stdout = $stderr = output
+            opts[:on_event] = ->(type, text) { @child_events << [:event, [type, text]] }
+            opts[:usage_observer] = ->(usage) { @child_events << [:usage, usage] }
+            control_class = command == 'mission' ? MissionControl : JobControl
+            job[:control] = control_class.new(input: StringIO.new, output: StringIO.new)
+            Thread.current[:pwn_steering_input] = job[:control]
+            commands_thread = Thread.new do
+              commands.each_line do |line|
+                action, value = JSON.parse(line)
+                job[:control].submit(value) if action == 'submit'
+                job[:control].pause(value) if action == 'pause' && command == 'mission'
+              end
+            end
+            snapshot_thread = Thread.new do
+              loop do
+                @child_events << [:snapshot, { team: job[:team], paused: command == 'mission' && job[:control].observed_pause }]
+                sleep 0.05
+              end
+            end
+            begin
+              result = mission_operation(command, task, job, opts)
+              job[:control].check_stop unless command == 'mission'
+              state = command == 'mission' ? result[:status] : 'completed'
+              @child_events << [:complete, { state: state, result: summarize(result), team: command == 'mission' ? (job[:team] || {}).merge(result) : nil }]
+            rescue JobControl::Stopped, PWN::AI::Agent::Solve::Control::Stopped => e
+              @child_events << [:complete, { state: 'cancelled', error: e.message }]
+            rescue StandardError => e
+              @child_events << [:complete, { state: 'failed', error: "#{e.class}: #{e.message}" }]
+            ensure
+              commands_thread.kill.join
+              snapshot_thread.kill.join
+              output.flush
+              writer.close
+            end
+          end
+
+          def mission_operation(command, task, job, opts)
+            name = task[:name]
+            request = task[:request]
+            names = task[:names]
+            topic = task[:topic]
+            rounds = task[:rounds]
+            case command
+            when 'dm'
+              PWN::AI::Agent::Swarm.ask(name: name, request: request, swarm_id: ensure_swarm, steering: job[:control], usage_observer: opts[:usage_observer], on_tool: tool_callback(job, opts))
+            when 'mission'
+              PWN::AI::Agent::Swarm.solve(
+                request: request, swarm_id: ensure_swarm, steering: job[:control],
+                worktree: opts.fetch(:worktree, false), rounds: opts.fetch(:rounds, 3), verification_timeout: opts.fetch(:verification_timeout, 60), role_timeout: opts.fetch(:role_timeout, 300),
+                workspace: opts[:workspace], usage_observer: opts[:usage_observer], on_tool: tool_callback(job, opts),
+                on_state: ->(state) { @mutex.synchronize { job[:team] = state } }
+              )
+            when 'debate'
+              transcript = []
+              rounds.times do
+                names.each do |name|
+                  request = transcript.empty? ? topic : "#{topic}\n\nPrevious speaker: #{transcript.last}\nRespond, critique, or advance the objective."
+                  job[:control].check_stop
+                  result = PWN::AI::Agent::Swarm.ask(name: name, request: request, swarm_id: @swarm_id, steering: job[:control], usage_observer: opts[:usage_observer], on_tool: tool_callback(job, opts))
+                  transcript << "#{name}: #{result[:reply]}"
+                end
+              end
+              { reply: transcript.join("\n") }
+            when 'broadcast'
+              replies = names.map do |name|
+                job[:control].check_stop
+                result = PWN::AI::Agent::Swarm.ask(name: name, request: request, swarm_id: ensure_swarm, steering: job[:control], usage_observer: opts[:usage_observer], on_tool: tool_callback(job, opts))
+                "#{name}: #{result[:reply]}"
+              end
+              { reply: replies.join("\n") }
+            end
+          end
+
+          def start_job(agent:, command:, opts:, task:)
             return { ok: false, error: 'swarm controller is closed' } if @closed
             return { ok: false, error: 'mission requires exclusive workspace ownership; wait or cancel active jobs' } if (command == 'mission' && busy?) || snapshot[:jobs].any? { |row| row[:command] == 'mission' && ACTIVE.include?(row[:state]) }
 
@@ -339,36 +422,71 @@ module PWN
 
             ensure_swarm
             id = SecureRandom.hex(3)
-            locals = Thread.current.keys.grep(/^pwn_/).to_h { |key| [key, Thread.current[key]] }
-            variables = Thread.current.thread_variables.grep(/^pwn_/).to_h { |key| [key, Thread.current.thread_variable_get(key)] }
-            ready = Queue.new
-            job = { id: id, agent: agent, command: command, state: 'queued' }
+            reader, writer = IO.pipe
+            commands, sender = IO.pipe
+            job = { id: id, agent: agent, command: command, state: 'queued', sender: sender }
             @mutex.synchronize { @jobs[id] = job }
+            on_event = opts[:on_event]
+            on_usage = opts[:usage_observer]
+            job[:mission] = PWN::Plugins::AISandbox::MissionProcess.new(
+              descriptor: { operation: :swarm, session_id: @session_id, swarm_id: @swarm_id, job: job.slice(:id, :agent, :command), task: task, options: opts.except(:on_event, :usage_observer) },
+              fds: { 4 => writer, 5 => commands }
+            )
+            writer.close
+            commands.close
+            job[:control] = RemoteControl.new(sender)
+            update(job, 'running')
             job[:worker] = Thread.new do
-              locals.each { |key, value| Thread.current[key] = value }
-              variables.each { |key, value| Thread.current.thread_variable_set(key, value) }
-              control_class = command == 'mission' ? MissionControl : JobControl
-              job[:control] = control_class.new(input: StringIO.new, output: StringIO.new)
-              Thread.current[:pwn_steering_input] = job[:control]
-              ready << true
-              update(job, 'running')
-              result = yield(job)
-              job[:control].check_stop unless command == 'mission'
-              state = command == 'mission' ? result[:status] : 'completed'
-              @mutex.synchronize { job[:team] = (job[:team] || {}).merge(result) } if command == 'mission'
-              update(job, state, result: summarize(result))
-              opts[:on_event]&.call(:assistant, "#{agent} [#{id}] #{command} #{state}\n#{summarize(result)}")
-              result
-            rescue JobControl::Stopped, PWN::AI::Agent::Solve::Control::Stopped => e
-              update(job, 'cancelled', error: e.message)
-              opts[:on_event]&.call(:warning, "#{agent} [#{id}] #{e.message}")
-            rescue StandardError => e
-              update(job, 'failed', error: "#{e.class}: #{e.message}")
-              opts[:on_event]&.call(:warning, "#{agent} [#{id}] #{e.class}: #{e.message}")
+              result = nil
+              reader.each_line do |line|
+                tag, type, value = JSON.parse(line, symbolize_names: true)
+                next unless tag == id && job[:state] != 'cancelling'
+
+                restore_team_maps(value[:team]) if value.is_a?(Hash) && value[:team].is_a?(Hash)
+                case type
+                when 'complete' then result = value
+                when 'event' then on_event&.call(value[0].to_sym, value[1])
+                when 'notice' then on_event&.call(:notice, value)
+                when 'usage' then on_usage&.call(value)
+                when 'snapshot'
+                  @mutex.synchronize { job[:team] = value[:team] if value[:team] }
+                  job[:control].observed_pause = value[:paused]
+                when 'tool' then update(job, job[:state], last_tool: value)
+                end
+              end
+            ensure
+              job[:mission].close
+              reader.close
+              sender.close
+              unless job[:state] == 'cancelling'
+                result ||= { state: 'failed', error: 'mission process exited without a result' }
+                @mutex.synchronize { job[:team] = (job[:team] || {}).merge(result[:team]) } if result[:team]
+                update(job, result.fetch(:state), **result.slice(:result, :error))
+                on_event&.call(result[:error] ? :warning : :assistant, "#{agent} [#{id}] #{command} #{job[:state]}\n#{result[:result] || result[:error]}")
+              end
             end
             job[:worker].report_on_exception = false
-            ready.pop
             { ok: true, job_id: id, state: 'queued' }
+          rescue StandardError => e
+            [reader, writer, commands, sender].compact.each { |io| io.close unless io.closed? }
+            job&.dig(:mission)&.close
+            update(job, 'failed', error: e.message) if job
+            { ok: false, error: "Mission not started: #{e.message}" }
+          end
+
+          # JSON object member names are strings on wire. Restore data maps whose
+          # keys are identifiers or filenames, rather than protocol field names.
+          def restore_team_maps(value)
+            case value
+            when Hash
+              value.each do |key, child|
+                value[key] = child = child.transform_keys(&:to_s) if %i[roles artifacts dependencies requirements inputs modes].include?(key) && child.is_a?(Hash)
+                restore_team_maps(child)
+              end
+            when Array
+              value.each { |child| restore_team_maps(child) }
+            end
+            value
           end
 
           def tool_callback(job, opts)
@@ -378,6 +496,7 @@ module PWN
                 return
               end
               update(job, job[:state], last_tool: name)
+              @child_events << [:tool, name] if @child_events
               opts[:on_event]&.call(:tool, "#{job[:agent]} [#{job[:id]}] #{name}\n#{args.inspect}")
               opts[:on_event]&.call(:result, result.to_s)
             end

data/lib/pwn/plugins/repl/mesh.rb

@@ -3906,17 +3906,9 @@ class << PWN::Plugins::REPL # rubocop:disable Metrics/ClassLength
     env_path = File.join(Dir.home, '.pwn', 'pwn.yaml') if env_path.empty?
     dec_path = dec_path.to_s.strip
     dec_path = "#{env_path}.decryptor" if dec_path.empty?
-    return false unless File.exist?(env_path) && File.exist?(dec_path) && File.readable?(dec_path)
+    return false unless File.exist?(env_path)
 
-    decryptor = YAML.load_file(dec_path, symbolize_names: true)
-    key = decryptor.is_a?(Hash) ? decryptor[:key] : nil
-    iv = decryptor.is_a?(Hash) ? decryptor[:iv] : nil
-    return false if key.to_s.strip.empty? || iv.to_s.strip.empty?
-
-    PWN::Plugins::Vault.decrypt(file: env_path, key: key, iv: iv)
-    begin
-      cfg = YAML.load_file(env_path, symbolize_names: true)
-      cfg = {} unless cfg.is_a?(Hash)
+    PWN::Plugins::Vault.update(file: env_path, decryptor_file: dec_path) do |cfg|
       cfg[:plugins] = {} unless cfg[:plugins].is_a?(Hash)
       dst = cfg[:plugins][:meshtastic]
       dst = {} unless dst.is_a?(Hash)
@@ -3933,15 +3925,10 @@ class << PWN::Plugins::REPL # rubocop:disable Metrics/ClassLength
         end
       end
       cfg[:plugins][:meshtastic] = dst
-      yaml_env = YAML.dump(cfg).gsub(/^(\s*):/, '\1')
-      File.write(env_path, yaml_env)
-      File.chmod(0o600, env_path)
-    ensure
-      PWN::Plugins::Vault.encrypt(file: env_path, key: key, iv: iv)
     end
     true
   rescue StandardError => e
-    mesh_ui_puts(text: "[pwn-mesh] persist skipped: #{e.class}: #{e.message}")
+    mesh_ui_puts(text: "[pwn-mesh] persist skipped: #{e.class}")
     false
   end
 

data/lib/pwn/plugins/repl/vault.rb

@@ -23,14 +23,12 @@ module PWN
               # Prefer driver_opts (set by Config.refresh_env); fall back to the
               # canonical sidecar path Config uses: <pwn.yaml>.decryptor
               pwn_dec_path = PWN::Env[:driver_opts][:pwn_dec_path] ||= "#{pwn_env_path}.decryptor"
-              unless File.exist?(pwn_dec_path)
+              unless PWN::Plugins::Vault.hardware_encrypted?(file: pwn_env_path) || File.exist?(pwn_dec_path)
                 puts "ERROR: pwn decryptor file not found: #{pwn_dec_path}"
                 return
               end
 
-              decryptor = YAML.load_file(pwn_dec_path, symbolize_names: true)
-              key = decryptor[:key]
-              iv = decryptor[:iv]
+              access = PWN::Plugins::Vault.access_options(file: pwn_env_path, decryptor_file: pwn_dec_path)
 
               # Vault.edit decrypts -> opens editor -> encrypts and only sets
               # Pry.config.refresh_pwn_env = true. PWN::Config.refresh_env (which
@@ -40,19 +38,10 @@ module PWN
               # prompt "Press Enter to Resolve", wait on $stdin.gets, then re-open
               # the editor until the vault loads cleanly.
               loop do
-                PWN::Plugins::Vault.edit(
-                  file: pwn_env_path,
-                  key: key,
-                  iv: iv
-                )
+                PWN::Plugins::Vault.edit(access.merge(file: pwn_env_path))
 
                 begin
-                  PWN::Config.refresh_env(
-                    pwn_env_path: pwn_env_path,
-                    pwn_dec_path: pwn_dec_path,
-                    key: key,
-                    iv: iv
-                  )
+                  PWN::Config.refresh_env(access.merge(pwn_env_path: pwn_env_path, pwn_dec_path: pwn_dec_path))
                   break
                 rescue RuntimeError => e
                   # Keep the prior in-memory Env usable if the operator aborts

data/lib/pwn/plugins/repl.rb

@@ -642,222 +642,7 @@ module PWN
             # engines have a working .chat_with_tools and the native loop has had
             # real-API smoke time on each).
             # ----------------------------------------------------------------
-            # Do NOT rebind the 'request' parameter (the string object passed by Pry's after_read hook).
-            # We will mutate it to 'nil' at the end of handling so Pry does not eval the natural-language
-            # prompt text as Ruby (which was causing noisy exceptions *after* the green AI response print).
-            debug = pi.config.pwn_ai_debug
-            engine = PWN::Env[:ai][:active].to_s.downcase.to_sym
-            response_history = PWN::Env[:ai][engine][:response_history]
-            speak_answer = pi.config.pwn_ai_speak
-            is_agent = (pi.config.pwn_ai_agent == true)
-
-            # pwn-ai agent mode: load skills context for autonomous task carrying
-            skills_context = ''
-            PWN::Skills.each { |n, m| skills_context += "\n--- SKILL #{n} ---\n#{m[:content].to_s[0, 1200]}\n" } if is_agent && PWN.const_defined?(:Skills) && PWN::Skills.is_a?(Hash)
-
-            memory_context = ''
-            memory_context = PWN::Memory.to_context(limit: 25) if is_agent && PWN.const_defined?(:Memory)
-
-            sess_id = begin
-              pi.config.pwn_ai_session_id
-            rescue StandardError
-              nil
-            end
-
-            # Pre-process for clear CLI execution intent (e.g. "what does `id` return?")
-            # This makes the agent actually *run* commands instead of just explaining them.
-            curr_req = orig_request.chomp
-            if is_agent && sess_id && PWN.const_defined?(:Sessions)
-              begin
-                PWN::Sessions.append(session_id: sess_id, role: 'user', content: orig_request)
-              rescue StandardError
-                nil
-              end
-            end
-            if is_agent && request =~ /`([^`]+)`/
-              potential = ::Regexp.last_match(1).strip
-              # Looks like a shell command (not PWN ruby)
-              unless potential =~ /^(PWN::|def |class |require |puts |pp )/
-                curr_req = "The user wants the *actual raw output* of this command (do not just describe it): `#{potential}`. " \
-                           'To fulfill the request accurately, you MUST immediately output ONLY a bash code block with the exact command. ' \
-                           "Example format: ```bash\n#{potential}\n``` . After the host executes it, you will receive the OBSERVATION with the real output."
-              end
-            end
-
-            # Strict system prompt for agent mode (forces tool use over explanation)
-            system_role = nil
-            if is_agent
-              base = PWN::Env[:ai][engine][:system_role_content] || 'You are an ethical hacker.'
-              system_role = base + <<~PROMPT
-
-                                You are operating as an autonomous agent inside the PWN REPL driver.
-
-                                PRIMARY RULE FOR CLI AND TOOLS: When the user asks for the output of a command, "what does X return?", "run X", or anything that requires real execution, you MUST use a tool call.#{' '}
-                                NEVER just explain what a command does or what its output "would be".#{' '}
-                                To execute anything:
-                                  - Output *exactly and only* a fenced code block.
-                                  - For shell/CLI: ```bash
-                                <exact command here>
-                                ```
-                                  - For PWN Ruby modules: ```ruby
-                                PWN::Plugins::NmapIt.port_scan(...)
-                                ```
-                                The host will execute it (Ruby in full PWN context, bash via shell) and reply with an OBSERVATION containing the real result.#{' '}
-                                Then continue or give the final answer.
-
-                                Available tools include all PWN::Plugins (NmapIt, TransparentBrowser, etc.), SAST, Reports, and any CLI via bash blocks.
-                                Skills available this session:#{skills_context}
-                #{memory_context}
-
-                                PERSISTENT CAPABILITIES (use via ruby code blocks or direct calls):
-                                - Memory (cross-session): PWN::Memory.remember(key: :key, value: val, category: :fact|:preference|:lesson)
-                                  PWN::Memory.recall(query: 'foo'), PWN::Memory.forget(key: key)
-                                - Sessions: current session id = #{sess_id}; PWN::Sessions.append(session_id: '#{sess_id}', role: 'observation', content: obs)
-                                - Cron: PWN::Cron.create(schedule: '0 * * * *', prompt: 'task here', name: 'foo')
-                                  PWN::Cron.run(id: 'id'); list with PWN::Cron.list
-                                - Agents/Delegation: PWN::AI::Agent::SAST.analyze(request: ...); PWN::AI::Agent::VulnGen etc.
-                                  For sub-agents use threads or separate eval calls and feed results back as OBS.
-
-                                After receiving an observation, decide the next step or conclude.
-                                If you output text without a code block, it will be treated as your final answer to the user.
-              PROMPT
-            end
-
-            max_turns = is_agent ? 7 : 1
-            turn = 0
-            last_response = ''
-            tool_was_executed_this_turn = false
-
-            while turn < max_turns
-              chat_opts = {
-                request: curr_req,
-                response_history: response_history,
-                speak_answer: speak_answer,
-                spinner: false
-              }
-              chat_opts[:system_role_content] = system_role if system_role
-
-              case engine
-              when :anthropic
-                response = PWN::AI::Anthropic.chat(chat_opts)
-              when :gemini
-                response = PWN::AI::Gemini.chat(chat_opts)
-              when :grok
-                response = PWN::AI::Grok.chat(chat_opts)
-              when :ollama
-                response = PWN::AI::Ollama.chat(chat_opts)
-              when :openai
-                response = PWN::AI::OpenAI.chat(chat_opts)
-              when :openwebui
-                response = PWN::AI::OpenWebUI.chat(chat_opts)
-              else
-                raise "ERROR: Unsupported AI Engine: #{engine}"
-              end
-
-              if response.nil?
-                last_response = 'Model not currently supported with API key.'
-              else
-                if response[:choices].last.keys.include?(:text)
-                  last_response = response[:choices].last[:text].to_s
-                else
-                  last_response = response[:choices].last[:content].to_s
-                end
-                response_history = {
-                  id: response[:id],
-                  object: response[:object],
-                  model: response[:model],
-                  usage: response[:usage]
-                }
-                response_history[:choices] ||= response[:choices]
-              end
-
-              puts "\n\001\e[32m\002#{last_response}\001\e[0m\002\n\n"
-              if is_agent && sess_id && PWN.const_defined?(:Sessions)
-                begin
-                  PWN::Sessions.append(session_id: sess_id, role: 'assistant', content: last_response)
-                rescue StandardError
-                  nil
-                end
-              end
-
-              if debug
-                puts 'DEBUG: response_history => '
-                pp response_history
-              end
-              PWN::Env[:ai][engine][:response_history] = response_history
-
-              # === Agent tool execution: parse code blocks from *this* response and actually run them ===
-              tool_was_executed_this_turn = false
-              if is_agent
-                # Robust regex: tolerate language specifier, extra whitespace, and text around the block
-                last_response.scan(/```(?:\s*(ruby|bash|sh|shell|zsh))?\s*\n?(.*?)\n?```/m).each do |lang, code|
-                  code = code.strip
-                  next if code.empty? || tool_was_executed_this_turn
-
-                  lang = (lang || 'bash').downcase
-                  puts "\001\e[33m\002[ pwn-ai AGENT EXEC #{lang} ]
\e[0m\002 #{code[0..90]}..."
-
-                  obs = ''
-                  begin
-                    if lang == 'ruby'
-                      require 'stringio'
-                      old_stdout = $stdout
-                      $stdout = StringIO.new
-                      res = eval(code, TOPLEVEL_BINDING) # rubocop:disable Security/Eval -- intentional for pwn-ai agent to run PWN Ruby modules/tools in REPL context
-                      captured = $stdout.string
-                      $stdout = old_stdout
-                      obs = (captured + "\n=> #{res.inspect}").strip
-                    else
-                      # CLI execution - use Open3 for cleaner capture (no extra shell if possible, but backticks are simple and work)
-                      require 'open3'
-                      stdout, stderr, status = Open3.capture3(code)
-                      obs = stdout
-                      obs += "\n[stderr]\n#{stderr}" unless stderr.to_s.strip.empty?
-                      obs += "\n[exit: #{status.exitstatus}]" unless status.success?
-                      obs = obs.strip
-                    end
-                  rescue StandardError => e
-                    obs = "ERROR executing #{lang} block: #{e.class} - #{e.message}"
-                  end
-
-                  puts "\001\e[36m\002[OBSERVATION from #{lang}]\001\e[0m\002\n#{obs[0..700]}\n"
-                  if is_agent && sess_id && PWN.const_defined?(:Sessions)
-                    begin
-                      PWN::Sessions.append(session_id: sess_id, role: 'observation', content: obs)
-                    rescue StandardError
-                      nil
-                    end
-                  end
-
-                  # Feed real result back to the model as the next "user" message in the loop
-                  curr_req = "OBSERVATION (#{lang} execution result for previous block):\n#{obs}\n\n" \
-                             "Now continue fulfilling the original user request: #{orig_request}. " \
-                             'If the task is complete, give the final answer (no more code blocks). Otherwise output the next needed tool block.'
-
-                  tool_was_executed_this_turn = true
-                  turn += 1
-                  break # one execution per model turn for controlled pacing
-                end
-              end
-
-              # If we executed something, loop to let the model react to the OBS
-              next if tool_was_executed_this_turn
-
-              # No tool executed this turn -> this last_response is the final answer
-              break
-            end
-
-            # If in agent mode and the model never produced an executable block but the query clearly wanted execution,
-            # give one last chance with a strong reminder (helps weaker models like some Ollama ones)
-            if is_agent && !tool_was_executed_this_turn && orig_request =~ /`[^`]+`/ && turn < max_turns
-              reminder = 'The user explicitly asked about the output of a command in backticks. ' \
-                         'Do not describe the command. Output *only* the corresponding ```bash block now so the host can run it and give you the real result.'
-              curr_req = "#{reminder}\nOriginal: #{orig_request}"
-              # One final direct call (no full re-loop to avoid complexity)
-              # (The main loop already handled most cases; this is a safety net)
-            end
-            request.replace('nil') if request.respond_to?(:replace)
-            PWN::Plugins::REPL.ready_tty!
+            PWN::Plugins::REPL.pwn_ai_run_legacy(request: request, original_request: orig_request, pry: pi)
           end
         end
 

data/lib/pwn/plugins/sandbox/driver.rb

@@ -155,6 +155,10 @@ module PWNSandboxDriver
           command = ['bwrap', '--unshare-all', '--die-with-parent', '--new-session', '--cap-drop', 'ALL', '--clearenv', '--setenv', 'PATH', '/usr/bin:/bin', '--ro-bind', '/usr', '/usr']
           %w[/lib /lib64 /bin /sbin].each { |name| command.push('--ro-bind', name, name) if File.exist?(name) }
           command.push('--proc', '/proc', '--dev', '/dev', '--tmpfs', '/tmp', '--ro-bind', artifacts, '/artifacts', '--chdir', '/tmp', File.realpath('/usr/bin/ruby'), '/artifacts/worker.rb', '--inside')
+          # A nonroot caller inside a user namespace may retain capabilities;
+          # bubblewrap rejects those before creating its own namespace.
+          effective = File.read('/proc/self/status')[/^CapEff:\s+(\h+)/, 1].to_i(16)
+          command.unshift('setpriv', '--ambient-caps=-all', '--inh-caps=-all', '--bounding-set=-all', '--') if !Process.uid.zero? && effective.positive?
         end
         begin
           result = bounded(command, (seconds * 3) + 10, JSON.generate(payload))