pwn 0.5.783 → 0.5.785

data/spec/integration/readme_security_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'README security overview', :aggregate_failures do
+  let(:root) { File.expand_path('../..', __dir__) }
+  let(:readme) { File.read(File.join(root, 'README.md')) }
+  let(:security) do
+    readme[/^##### \*\*Vault and Sandboxing\*\* #####\n(.*?)(?=^#### )/m, 1].to_s.gsub(/\s+/, ' ')
+  end
+
+  it 'links a security subsection under Why PWN without replacing How PWN Works' do
+    expect(readme).to include('[Vault and Sandboxing](#vault-and-sandboxing)')
+    expect(readme).to match(/^#### \*\*Why PWN\*\* ####.*^##### \*\*Vault and Sandboxing\*\* #####.*^#### \*\*How PWN Works\*\* ####/m)
+  end
+
+  it 'explains credential handling at the tool boundary and engagement loot scope' do
+    expect(security).to include('security research', 'bug bounty hunting', 'penetration testing',
+                                'at rest', '{{vault:label}}', 'Dispatch', 'tool boundary',
+                                'prompts', 'logs', 'engagement', 'provenance', 'across engagements')
+  end
+
+  it 'documents the mandatory local boundary independently of optional sandbox profiles' do
+    expect(security).to include('untrusted PoCs', 'prompt injection', '~/.pwn/workspaces/runtime',
+                                'original operator request', 'parent', 'source', 'controller state',
+                                'read-only even if named', 'fail closed', 'Landlock', 'seccomp',
+                                'namespace', '`strict`', '`permissive`', '`off`')
+  end
+
+  it 'keeps encryption, provider privacy and operator responsibilities distinct' do
+    expect(security).to include('active process', 'LLM-provider privacy', 'whole-filesystem',
+                                'evidence/artifact encryption', 'redaction can miss',
+                                'not authorization', 'network isolation', 'perfect container',
+                                'guarantee against bugs', 'target authorization', 'least-privilege',
+                                'retention')
+  end
+
+  it 'links implementation and boundary documentation with existing local targets' do
+    expect(security).to include('(lib/pwn/plugins/vault.rb)', '(lib/pwn/ai/agent/dispatch.rb)',
+                                '(documentation/Runtime-Source-Protection.md)',
+                                '(documentation/Mission-Cancellation.md)',
+                                '(documentation/Configuration.md)', '(documentation/YubiKey-Vaults.md)')
+    refs = readme.scan(/\]\((?!https?:|#|mailto:)([^)\s]+)\)/).flatten.uniq
+    broken = refs.reject { |ref| File.exist?(File.expand_path(ref.split('#', 2).first, root)) }
+    expect(broken).to be_empty, "broken README relative links: #{broken.join(', ')}"
+  end
+end

data/spec/integration/web_cache_deception_yubikey_spec.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'pwn_web_cache_deception YubiKey options' do
+  let(:script) { File.expand_path('../../bin/pwn_web_cache_deception', __dir__) }
+  let(:browser) { double('offline browser', goto: nil, html: '<html>offline</html>') }
+  let(:browser_obj) { { browser: browser } }
+  let(:provider) { double('offline WWW provider', open: browser_obj, login: browser_obj, logout: browser_obj, close: nil) }
+  let(:driver_opts) { {} }
+  let(:account) { 'Example:tester@example.invalid' }
+  let(:serial) { '00123456' }
+  let(:args) do
+    ['--target-url=https://example.invalid/test', "--output-results=#{File.join(@tmpdir, 'results.txt')}",
+     '--pwn-www-mod=GitHub', '--username=tester@example.invalid', '--password=fake-password',
+     "--yubikey-account=#{account}", '--yubikey-confirm', "--yubikey-serial=#{serial}", '--no-mfa']
+  end
+
+  around do |example|
+    Dir.mktmpdir('pwn-wcd-yubikey-') do |dir|
+      @tmpdir = dir
+      example.run
+    end
+  end
+
+  before do
+    stub_const('ARGV', args.dup)
+    allow(PWN::Env).to receive(:[]).and_call_original
+    allow(PWN::Env).to receive(:[]).with(:driver_opts).and_return(driver_opts)
+    allow(PWN::Config).to receive(:refresh_env)
+    stub_const('PWN::WWW::GitHub', provider)
+    stub_const('PWN::Plugins::YubiKey', double('offline device boundary'))
+    stub_const('PWN::Plugins::TransparentBrowser', double('offline browser boundary', close: nil))
+    allow(PWN::Plugins::AuthenticationHelper).to receive(:mask_password).and_raise('unexpected password prompt')
+  end
+
+  it 'forwards exact account and serial options to GitHub login even with --no-mfa' do
+    expected = { browser_obj: browser_obj, username: 'tester@example.invalid', password: 'fake-password', mfa: false, yubikey: { account: account, confirm: true, serial: serial } }
+    expect(provider).to receive(:login).with(expected).and_return(browser_obj)
+    expect(PWN::Plugins::YubiKey).not_to receive(:oath_code)
+    load script, true
+  end
+
+  %w[Synack Twitter BugCrowd CoinbasePro AppCobaltIO].each do |name|
+    it "forwards YubiKey options only at #{name} login, not browser open" do
+      ARGV.map! { |arg| arg == '--pwn-www-mod=GitHub' ? "--pwn-www-mod=#{name}" : arg }
+      stub_const("PWN::WWW::#{name}", provider)
+      expect(provider).to receive(:open).with(browser_type: :chrome).and_return(browser_obj)
+      expect(provider).to receive(:login).with(hash_including(yubikey: { account: account, confirm: true, serial: serial }, mfa: false)).and_return(browser_obj)
+      load script, true
+    end
+  end
+
+  %w[Google Paypal].each do |name|
+    it "rejects YubiKey for #{name} before password prompts or opening a browser" do
+      ARGV.map! { |arg| arg == '--pwn-www-mod=GitHub' ? "--pwn-www-mod=#{name}" : arg }
+      ARGV.delete('--password=fake-password')
+      stub_const("PWN::WWW::#{name}", provider)
+      expect(provider).not_to receive(:open)
+      expect(provider).not_to receive(:login)
+      expect { load script, true }.to raise_error(ArgumentError, /YubiKey OATH.*supported/)
+    end
+  end
+
+  it 'requires a selected compatible provider before prompting or opening a browser' do
+    ARGV.delete('--pwn-www-mod=GitHub')
+    ARGV.delete('--password=fake-password')
+    expect { load script, true }.to raise_error(ArgumentError, /YubiKey OATH.*supported/)
+  end
+
+  it 'rejects a serial without an exact account instead of silently disabling YubiKey' do
+    ARGV.delete("--yubikey-account=#{account}")
+    ARGV.delete('--password=fake-password')
+    expect(provider).not_to receive(:open)
+    expect { load script, true }.to raise_error(ArgumentError, /serial.*account/)
+  end
+
+  it 'requires --yubikey-confirm before password prompts or browser open' do
+    ARGV.delete('--yubikey-confirm')
+    ARGV.delete('--password=fake-password')
+    expect(provider).not_to receive(:open)
+    expect(provider).not_to receive(:login)
+    expect { load script, true }.to raise_error(ArgumentError, /confirm: true.*HOTP.*authenticat/i)
+  end
+
+  it 'rejects confirmation without an account before password prompts or browser open' do
+    ARGV.reject! { |arg| arg.start_with?('--yubikey-account=', '--yubikey-serial=') || arg == '--password=fake-password' }
+    expect(provider).not_to receive(:open)
+    expect(provider).not_to receive(:login)
+    expect { load script, true }.to raise_error(ArgumentError, /--yubikey-confirm.*--yubikey-account/)
+  end
+
+  it 'does not accept a string value for the boolean --yubikey-confirm flag' do
+    ARGV.map! { |arg| arg == '--yubikey-confirm' ? '--yubikey-confirm=true' : arg }
+    expect(provider).not_to receive(:open)
+    expect { load script, true }.to raise_error(OptionParser::NeedlessArgument)
+  end
+
+  ['', '123x', ' 123', '-1'].each do |invalid|
+    it "rejects malformed serial #{invalid.inspect} before prompting or opening a browser" do
+      ARGV.map! { |arg| arg == "--yubikey-serial=#{serial}" ? "--yubikey-serial=#{invalid}" : arg }
+      ARGV.delete('--password=fake-password')
+      expect(provider).not_to receive(:open)
+      expect { load script, true }.to raise_error(ArgumentError, /serial.*decimal/)
+    end
+  end
+
+  it 'validates an empty account before password prompts or browser open' do
+    ARGV.map! { |arg| arg == "--yubikey-account=#{account}" ? '--yubikey-account=' : arg }
+    ARGV.delete('--yubikey-confirm')
+    ARGV.delete('--password=fake-password')
+    expect(provider).not_to receive(:open)
+    expect { load script, true }.to raise_error(ArgumentError, /account/)
+  end
+
+  it 'preserves an explicit MFA token from driver options rather than coercing it to true' do
+    ARGV.reject! { |arg| arg.start_with?('--yubikey-') || arg == '--no-mfa' }
+    driver_opts[:mfa] = '654321'
+    expect(provider).to receive(:login).with(hash_including(mfa: '654321')).and_return(browser_obj)
+    expect { load script, true }.not_to output(/fake-password|654321/).to_stdout
+    expect(File.read(File.join(@tmpdir, 'results.txt'))).not_to match(/fake-password|654321/)
+  end
+
+  it 'keeps the generic driver options unchanged when no YubiKey is requested' do
+    ARGV.reject! { |arg| arg.start_with?('--yubikey-') }
+    ARGV.map! { |arg| arg == '--pwn-www-mod=GitHub' ? '--pwn-www-mod=Google' : arg }
+    stub_const('PWN::WWW::Google', provider)
+    expect(provider).to receive(:login) do |options|
+      expect(options).not_to have_key(:yubikey)
+      expect(options[:mfa]).to be(false)
+      browser_obj
+    end
+    load script, true
+  end
+
+  it 'preserves the exact OATH name when the optional serial is omitted' do
+    exact = " #{account} "
+    ARGV.reject! { |arg| arg.start_with?('--yubikey-serial=') }
+    ARGV.map! { |arg| arg == "--yubikey-account=#{account}" ? "--yubikey-account=#{exact}" : arg }
+    expect(provider).to receive(:login).with(hash_including(yubikey: { account: exact, confirm: true })).and_return(browser_obj)
+    expect { load script, true }.not_to output(/fake-password|012345/).to_stdout
+  end
+
+  it 'documents account, consent risks, and serial flags with the supported-provider boundary' do
+    ARGV.replace(['--help'])
+    expect do
+      expect { load script, true }.to raise_error(SystemExit) { |error| expect(error.status).to eq(0) }
+    end.to output(/--yubikey-account.*GitHub.*Synack.*Twitter.*BugCrowd.*CoinbasePro.*AppCobaltIO.*Paypal.*--yubikey-confirm.*HOTP.*delete.*corrupt.*--yubikey-serial/m).to_stdout
+  end
+
+  it 'rejects an explicit token conflicting with YubiKey before password prompts' do
+    ARGV.delete('--no-mfa')
+    ARGV.delete('--yubikey-confirm')
+    ARGV.delete('--password=fake-password')
+    driver_opts[:mfa] = '654321'
+    expect(provider).not_to receive(:open)
+    expect { load script, true }.to raise_error(ArgumentError, /yubikey.*mfa/i)
+  end
+end

data/spec/lib/pwn/ai/agent/dispatch_spec.rb

@@ -6,18 +6,21 @@ require 'json'
 describe PWN::AI::Agent::Dispatch do
   it 'does not replay a timed-out real shell mutation after restoring its request checkpoint' do
     Dir.mktmpdir do |root|
-      options = { request: 'Write counter', session_id: 'timeout', request_id: 'fixture', artifact_root: root, trace: false }
+      work = File.join(root, 'work')
+      FileUtils.mkdir_p(work)
+      allow(PWN::Plugins::AISandbox).to receive(:workspace).and_return(work)
+      options = { request: 'Write counter', session_id: 'timeout', request_id: 'fixture', artifact_root: File.join(root, 'control'), trace: false }
       runtime = PWN::AI::Agent::RequestRuntime.new(options)
       Thread.current[:pwn_request_runtime] = runtime
       PWN::AI::Agent::Registry.discover
-      call = { id: 'mutation', function: { name: 'shell', arguments: { command: "printf effect >> #{root}/counter; sleep 3", timeout: 1 } } }
+      call = { id: 'mutation', function: { name: 'shell', arguments: { command: "printf effect >> #{work}/counter; sleep 3", timeout: 1 } } }
       first = JSON.parse(described_class.call(tool_call: call, scope_policy: { enabled: false }))
       expect(first.dig('result', 'error')).to include('timeout')
       Thread.current[:pwn_request_runtime] = PWN::AI::Agent::RequestRuntime.new(options.merge(resume: true))
       second = JSON.parse(described_class.call(tool_call: call, scope_policy: { enabled: false }))
       expect(second['success']).to be false
       expect(second.dig('result', 'error')).to eq('uncertain_side_effect')
-      expect(File.read(File.join(root, 'counter'))).to eq('effect')
+      expect(File.read(File.join(work, 'counter'))).to eq('effect')
       expect(call.dig(:function, :arguments, :timeout)).to eq(1)
     end
   ensure

data/spec/lib/pwn/ai/agent/dispatch_vault_safety_spec.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json'
+
+RSpec.describe PWN::AI::Agent::Dispatch, 'vault access safety' do
+  before do
+    @calls = []
+    @result = { status: 'fixture-complete' }
+    handler = lambda do |args|
+      @calls << args
+      @result
+    end
+    entry = PWN::AI::Agent::Registry::Entry.new(name: 'vault_fixture', schema: { parameters: { type: 'object' } }, handler: handler)
+    allow(PWN::AI::Agent::Registry).to receive(:lookup).with(name: 'vault_fixture').and_return(entry)
+    allow(PWN::AI::Agent::Manifest).to receive(:load).and_return({})
+    allow(PWN::AI::Agent::Manifest).to receive(:check).and_return(nil)
+    allow(PWN::AI::Agent::ToolGuard).to receive_messages(scope_check!: nil, policy_decision: nil, canary_leak?: false, refuse_copied_persist?: false)
+    allow(PWN::AI::Agent::Engagement).to receive(:deny_if_out_of_scope).and_return(nil)
+    allow(PWN::AI::Agent::Mission).to receive(:active).and_return(nil)
+    allow(PWN::AI::Agent::Confirmation).to receive(:gate).and_return(nil)
+    allow(PWN::Plugins::Vault).to receive(:expand) { |opts| opts[:text] }
+    allow(PWN::Plugins::Vault).to receive(:redact) { |opts| opts[:text] }
+  end
+
+  it 'expands nested vault references once per leaf before invoking the handler' do
+    allow(PWN::Plugins::Vault).to receive(:expand).with(text: '{{vault:fixture}}').and_return('fixture-unlocked')
+    arguments = { nested: [{ secret: '{{vault:fixture}}' }], slot: 2 }
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: arguments } }))
+    expect(response['success']).to be(true)
+    expect(@calls).to eq([{ nested: [{ secret: 'fixture-unlocked' }], slot: 2 }])
+    expect(PWN::Plugins::Vault).to have_received(:expand).with(text: '{{vault:fixture}}').once
+    expect(arguments[:nested].first[:secret]).to eq('{{vault:fixture}}')
+  end
+
+  it 'blocks a nested vault access failure without exposing its exception text' do
+    allow(PWN::Plugins::Vault).to receive(:expand).with(text: '{{vault:fixture}}').and_raise(IOError, 'fixture-private-detail')
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: { nested: ['{{vault:fixture}}'] } } }))
+    expect(response).to include('success' => false, 'code' => 'VAULT_EXPANSION_FAILED')
+    expect(@calls).to be_empty
+    expect(response.to_s).not_to include('fixture-private-detail')
+  end
+
+  it 'withholds results when vault output redaction fails after handler execution' do
+    allow(PWN::Plugins::Vault).to receive(:redact).and_raise(IOError, 'fixture-private-detail')
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: {} } }))
+    expect(@calls.length).to eq(1)
+    expect(response).to include('success' => false, 'code' => 'VAULT_REDACTION_FAILED', 'handler_executed' => true)
+    expect(response.to_s).not_to include('fixture-private-detail', 'fixture-complete')
+    expect(response).not_to have_key('result')
+  end
+
+  it 'redacts secrets in array results such as loot offers before returning them' do
+    @result = [{ secret: 'fixture-private-value' }]
+    allow(PWN::Plugins::Vault).to receive(:redact) { |opts| opts[:text].gsub('fixture-private-value', '{{vault:fixture}}') }
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: {} } }))
+    expect(response).to include('success' => true, 'result' => [{ 'secret' => '{{vault:fixture}}' }])
+    expect(response.to_s).not_to include('fixture-private-value')
+  end
+
+  it 'blocks a real hardware-envelope expansion when the offline device fixture fails' do
+    Dir.mktmpdir('pwn-dispatch-yubikey-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      allow(PWN::AI::Agent::Mission).to receive(:active_id).and_return(nil)
+      device = double('offline YubiKey fixture')
+      stub_const('PWN::Plugins::YubiKey', device)
+      allow(device).to receive(:challenge_response) { |opts| OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge)) }
+      PWN::Plugins::Vault.store(label: 'fixture', secret: 'fixture-private-value', yubikey: { slot: 2 })
+      allow(PWN::Plugins::Vault).to receive(:expand).and_call_original
+      allow(device).to receive(:challenge_response).and_raise(IOError, 'fixture-private-detail')
+      response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: { password: '{{vault:fixture}}' } } }))
+      expect(response).to include('success' => false, 'code' => 'VAULT_EXPANSION_FAILED')
+      expect(@calls).to be_empty
+      expect(response.to_s).not_to include('fixture-private-detail', 'fixture-private-value')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+    end
+  end
+
+  it 'never invokes a real handler after expansion of a vault argument fails' do
+    allow(PWN::Plugins::Vault).to receive(:expand).with(text: '{{vault:fixture}}').and_raise(IOError, 'device absent; fixture-private-detail')
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: { password: '{{vault:fixture}}' } } }))
+    expect(@calls).to be_empty
+    expect(response).to include('success' => false, 'code' => 'VAULT_EXPANSION_FAILED')
+    expect(response.to_s).not_to include('fixture-private-detail')
+  end
+end

data/spec/lib/pwn/ai/agent/injection_guard_spec.rb

@@ -34,6 +34,7 @@ describe 'indirect prompt-injection guards' do
   it 'does not re-infer the acceptance contract on a nested loop' do
     Thread.current[:pwn_loop_active] = true
     Thread.current[:pwn_loop_nested] = true
+    PWN::AI::Agent::TurnFinalizer.commit_artifacts!(request: 'Write /tmp/frozen.pdf')
     Thread.current[:pwn_loop_deliverables] = {
       paths: ['/tmp/frozen.pdf'], min_seconds: 0, skills: [], proofs: [], hosts: []
     }
@@ -44,6 +45,7 @@ describe 'indirect prompt-injection guards' do
   ensure
     Thread.current[:pwn_loop_active] = nil
     Thread.current[:pwn_loop_nested] = nil
+    Thread.current[:pwn_artifact_contract] = nil
     Thread.current[:pwn_loop_deliverables] = nil
   end
 

data/spec/lib/pwn/ai/agent/learning_spec.rb

@@ -89,7 +89,7 @@ describe PWN::AI::Agent::Learning do
       expect(described_class.evidence_complete?(row: row)).to be(true)
       expect(File.binread(@source)).to eq(original_source)
       migration = Digest::SHA256.hexdigest(@original)
-      backup = File.join(@root, 'learning', 'migrations', "#{migration}.backup.jsonl")
+      backup = JSON.parse(File.read(result[:ledger])).fetch('backup')
       expect(File.binread(backup)).to eq(@original.b)
       expect(described_class.rollback_evidence(migration: migration)[:restored]).to be(true)
       expect(File.binread(@learning)).to eq(@original.b)
@@ -778,14 +778,14 @@ describe 'PWN::AI::Agent::Learning conflicted outcomes' do
     end
   end
 
-  it 'prunes bak files down to max_baks' do
+  it 'leaves legacy siblings untouched and reports the global seven-folder policy' do
     Dir.mktmpdir do |dir|
       stub_const('PWN::AI::Agent::Learning::LEARNING_FILE', File.join(dir, 'learning.jsonl'))
       File.write(File.join(dir, 'learning.jsonl'), "{}\n")
       7.times { |i| File.write(File.join(dir, "learning.jsonl.bak-#{i}"), 'x') }
       out = PWN::AI::Agent::Learning.compact!(max_baks: 5)
-      expect(Dir[File.join(dir, '*.bak*')].length).to eq(5)
-      expect(out[:pruned]).to eq(2)
+      expect(Dir[File.join(dir, '*.bak*')].length).to eq(7)
+      expect(out).to include(pruned: 0, max_baks: 7, scope: 'global')
     end
   end
 end

data/spec/lib/pwn/ai/agent/loop_artifacts_spec.rb

@@ -21,6 +21,11 @@ RSpec.describe PWN::AI::Agent::Loop do
     allow(PWN::AI::Agent::Mistakes).to receive(:record)
   end
 
+  it 'never adopts cached model destinations absent from the original request' do
+    Thread.current[:pwn_loop_deliverables] = { paths: ['/tmp/invented.pdf'] }
+    expect(described_class.send(:declared_deliverables, request: 'Generate a report')).to eq([])
+  end
+
   it 'does not let source read evidence bypass the destination contract' do
     Dir.mktmpdir do |dir|
       source = File.join(dir, 'source.md')