pwn 0.5.783 → 0.5.785

data/spec/lib/pwn/plugins/log_yubikey_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::Log, 'hardware credential logging' do
+  it 'masks sensitive trace keys before the general credential digest path' do
+    fields = %i[pin puk access_code management_key oath_secret static_password scp_keys mfa_code]
+    fields.each do |key|
+      expect(described_class.send(:inspect_debug, key: key, value: '123456')).to eq('[REDACTED]')
+      expect(described_class.send(:inspect_debug, key: key, value: '654321')).to eq('[REDACTED]')
+    end
+    expect(described_class.send(:inspect_debug, key: :api_key, value: 'fixture-api')).to eq(PWN::Redaction.token(kind: 'credential', value: 'fixture-api'))
+  end
+
+  it 'redacts nested structured debug values without consulting the credential store' do
+    expect(PWN::Plugins::Vault).not_to receive(:redact)
+    expect(PWN::Plugins::Vault).not_to receive(:expand)
+    expect(PWN::Plugins::Vault).not_to receive(:fetch)
+    input = { selector: { slot: 2, serial: '12345678' }, nested: [{ pin: '123456', scp_keys: %w[fixture-enc fixture-mac] }] }
+    text = described_class.send(:inspect_debug, value: input)
+    expect(text).to include('slot: 2', 'serial: "12345678"', '[REDACTED]')
+    expect(text).not_to include('pin: "123456"', 'fixture-enc', 'fixture-mac', '[REDACTED:credential:')
+    expect(input[:nested].first[:pin]).to eq('123456')
+  end
+
+  it 'writes only constant masks for PIN and management fields to log, debug, mirror and stderr sinks' do
+    Dir.mktmpdir('pwn-log-yubikey-') do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      fixture = 'pin=123456 management_key=fixture-management mfa_code=654321'
+      described_class.append(level: :info, msg: { pin: '123456', management_key: 'fixture-management' })
+      path = File.join(dir, 'debug.log')
+      described_class.start_debug(path: path)
+      described_class.progress(msg: fixture)
+      described_class.mirror_tui!(msg: fixture)
+      described_class.capture_stderr!(text: "#{fixture}\n")
+      described_class.stop_debug
+      [path, File.join(dir, '.pwn', 'logs', 'pwn.log')].each do |file|
+        body = File.read(file)
+        expect(body).to include('[REDACTED]')
+        expect(body).not_to include('123456', '654321', 'fixture-management', '[REDACTED:')
+      end
+    ensure
+      described_class.stop_debug
+    end
+  end
+end

data/spec/lib/pwn/plugins/preflight_checker_native_yubikey_spec.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Plugins::PreflightChecker, 'native YubiKey facade contract' do
+  it 'routes per-application host-only probes through the real facade without opening or enumerating a device' do
+    device = PWN::Plugins::YubiKey
+    transport = device::Transport
+    allow(transport).to receive(:available?).with({ application: :fido }).and_return(true)
+    allow(transport).to receive(:available?).with({ application: :oath }).and_return(true)
+    expect(transport).not_to receive(:devices)
+    expect(transport).not_to receive(:open)
+    %i[devices info command challenge_response oath_code].each { |method| expect(device).not_to receive(method) }
+    row = described_class.check(names: ['PWN::Plugins::YubiKey']).first
+    expect(row).to include(status: :ok, missing_bins: [], missing_native: [])
+    expect(transport).to have_received(:available?).with({ application: :fido }).once
+    expect(transport).to have_received(:available?).with({ application: :oath }).once
+  end
+end

data/spec/lib/pwn/plugins/preflight_checker_yubikey_spec.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Plugins::PreflightChecker, 'YubiKey dependency reporting' do
+  let(:names) { ['PWN::Plugins::YubiKey'] }
+
+  before do
+    @device = double('unopened YubiKey')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    %i[devices info command challenge_response oath_code].each { |method| expect(@device).not_to receive(method) }
+    allow(@device).to receive(:available?).with({ application: :fido }).and_return(false)
+    allow(@device).to receive(:available?).with({ application: :oath }).and_return(false)
+    allow(described_class).to receive(:bin?).and_return(true)
+    expect(described_class).not_to receive(:bin?).with(name: 'ykman')
+  end
+
+  it 'reports unavailable native host libraries without a binary requirement or device probe' do
+    row = described_class.check(names: names).first
+    expect(row).to include(plugin: names.first, status: :dead, missing_bins: [], missing_caps: [], missing_services: [])
+    expect(row[:missing_native]).to eq(['FIDO native transport', 'PC/SC native transport'])
+    expect(described_class.host_summary(names: names)).to include('PC/SC native transport', 'documentation/Plugin-Degradation.md#pwn-plugins-yubikey')
+  end
+
+  it 'reports partial native host capability separately from all libraries being available' do
+    allow(@device).to receive(:available?).with({ application: :fido }).and_return(true)
+    expect(described_class.check(names: names).first).to include(status: :degraded, missing_native: ['PC/SC native transport'])
+    allow(@device).to receive(:available?).with({ application: :oath }).and_return(true)
+    expect(described_class.check(names: names).first).to include(status: :ok, missing_bins: [], missing_native: [])
+  end
+
+  it 'preserves rows for plugins without declared native dependencies' do
+    expected = { plugin: 'PWN::Plugins::NmapIt', status: :ok, missing_bins: [], missing_caps: [], missing_services: [] }
+    expect(described_class.check(names: ['PWN::Plugins::NmapIt'])).to eq([expected])
+  end
+
+  it 'includes native dependency status in the manifest without changing other plugin rows' do
+    Dir.mktmpdir('native-preflight-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      result = described_class.manifest
+      expect(result[:plugins].fetch(names.first)).to include(ok: false, missing: [], missing_native: ['FIDO native transport', 'PC/SC native transport'])
+      expect(result[:plugins].fetch('PWN::Plugins::NmapIt')).to eq(bins: ['nmap'], missing: [], ok: true, caps: [])
+      stored = JSON.parse(File.read(result.fetch(:path)))
+      expect(stored.fetch('plugins').fetch(names.first).fetch('missing_native')).to eq(result[:plugins][names.first][:missing_native])
+    end
+  end
+
+  it 'treats load or dependency errors as a missing host library without exposing backend messages' do
+    [LoadError, IOError].each do |error|
+      allow(@device).to receive(:available?).with({ application: :oath }).and_raise(error, 'private fixture path')
+      expect(described_class.check(names: names).first).to include(status: :dead, missing_native: ['FIDO native transport', 'PC/SC native transport'])
+      expect(described_class.host_summary(names: names)).not_to include('private fixture path')
+    end
+  end
+end

data/spec/lib/pwn/plugins/recon_yubikey_spec.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::Recon, 'hardware loot capture' do
+  it 'keeps hardware failures visible without creating software loot or a master key' do
+    Dir.mktmpdir('pwn-recon-yubikey-failure-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      device = double('offline unavailable YubiKey')
+      stub_const('PWN::Plugins::YubiKey', device)
+      allow(device).to receive(:challenge_response).and_raise(IOError, 'fixture device unavailable')
+      assets = [{ address: 'app.example.test', observations: [{ banner: 'password=fixture-password' }] }]
+      expect { described_class.harvest_loot(assets: assets, engagement_id: 'lab', yubikey: { slot: 2 }) }.to raise_error(IOError, 'fixture device unavailable')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+      expect(PWN::Plugins::Vault.query(engagement: 'lab')).to be_empty
+    end
+  end
+
+  it 'forwards the explicit selector through run and harvest into real hardware-encrypted loot' do
+    Dir.mktmpdir('pwn-recon-yubikey-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      allow(PWN::AI::Agent::Mission).to receive(:active_id).and_return(nil)
+      device = double('offline YubiKey fixture')
+      stub_const('PWN::Plugins::YubiKey', device)
+      selector = { slot: 2, serial: '12345678', timeout: 4, device_path: '/fixture/native-device' }
+      allow(device).to receive(:challenge_response) do |opts|
+        expect(opts).to include(selector)
+        OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge))
+      end
+      socket = double('offline banner', readpartial: "username=fixture-user\npassword=fixture-password\n", remote_address: double(ip_address: '192.0.2.10'))
+      allow(Socket).to receive(:tcp).and_yield(socket)
+      result = described_class.run(target: 'app.example.test', modules: ['banner'], ports: [22], engagement_id: 'lab', root: root, yubikey: selector)
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+      expect(device).to have_received(:challenge_response).once
+      rows = JSON.parse(File.read(File.join(root, '.pwn', 'engagements', 'lab', 'loot.json'))).fetch('records')
+      expect(rows.first.dig('secret', 'kdf')).to eq('yubikey-hmac-sha1-hkdf-sha256')
+      expect(rows.first.dig('secret', 'yubikey')).to include('slot' => 2, 'serial' => '12345678')
+      expect(result[:loot].first).to include(engagement: 'lab', source: 'recon', where: 'banner:22', host: '192.0.2.10')
+      expect(PWN::Plugins::Vault.fetch(label: result[:loot].first[:label], engagement: 'lab', yubikey: selector)).to eq('fixture-password')
+    end
+  end
+end

data/spec/lib/pwn/plugins/repl/ai_console_spec.rb

@@ -4,6 +4,35 @@ require 'spec_helper'
 require 'stringio'
 require 'pry'
 
+describe 'mission configuration handoff' do
+  include_context 'pwn tmp sandbox'
+
+  it 'forwards the operator trace setting to console and line-mode mission loops' do
+    input, sender = IO.pipe
+    pry = Pry.new
+    pry.config.pwn_ai_trace = true
+    pry.config.pwn_ai_session_id = 'trace-handoff'
+    allow(PWN::Sessions).to receive(:provisional_title).and_return(nil)
+    allow(PWN::Sessions).to receive(:refresh_title).and_return(nil)
+    allow(PWN::AI::Agent::Loop).to receive(:run) { |opts| opts[:trace] ? 'trace forwarded' : 'trace missing' }
+    controller = PWN::Plugins::REPL::AIConsole::Console.new(pry: pry, input: input, curses: nil, getch: nil)
+    Dir.chdir(@tmp) do
+      controller.start_request('fixture')
+      Timeout.timeout(10) do
+        while controller.busy?
+          controller.drain
+          sleep 0.01
+        end
+      end
+      expect(controller.instance_variable_get(:@timeline).map { |row| row[1] }).to include('trace forwarded')
+      expect(PWN::Plugins::REPL.pwn_ai_run_steerable(request: 'fixture', pry: pry, input: input)).to eq('trace forwarded')
+    end
+  ensure
+    controller&.stop_worker
+    [input, sender].compact.each { |io| io.close unless io.closed? }
+  end
+end
+
 describe 'operator workspace navigation' do
   include_context 'pwn tmp sandbox'
 
@@ -276,16 +305,16 @@ describe 'session maintenance command workers' do
 
   after { console.send(:stop_worker) }
 
-  it 'routes cleanup off the input owner and delivers completion after safe cancellation' do
+  it 'routes cleanup off the input owner and hard cancels before returning ready' do
     require File.expand_path('../../../../../etc/default_cron/session_cleanup', __dir__)
-    entered = Queue.new
-    release = Queue.new
-    owner = Thread.current
+    entered = PWNTestPipeQueue.new
+    release = PWNTestPipeQueue.new
+    owner = Process.pid
     reader, writer = IO.pipe
     console.instance_variable_set(:@input, reader)
     console.instance_variable_set(:@tool_input, writer)
     allow(PWN::SessionCleanup).to receive(:maintain) do |**options|
-      entered << [Thread.current, options]
+      entered << [Process.pid, options]
       release.pop
       { fixture: 'committed deletion' }
     end
@@ -294,21 +323,20 @@ describe 'session maintenance command workers' do
       console.instance_variable_get(:@events) << [:command, value.inspect]
     end
     Timeout.timeout(2) { console.submit('/sessions cleanup') }
-    thread, options = Timeout.timeout(2) { entered.pop }
-    expect(thread).not_to eq(owner)
+    pid, options = Timeout.timeout(2) { entered.pop }
+    expect(pid).not_to eq(owner)
     expect(options[:dry_run]).to be(false)
     console.handle("\u0014")
     console.handle(:page_up)
     console.submit('/sessions cleanup')
-    expect(PWN::SessionCleanup).to have_received(:maintain).once
+    expect(entered).to be_empty
     console.handle("\u0003")
-    expect(thread).to be_alive
-    release << true
-    expect(thread.join(2)).to eq(thread)
+    expect(console.instance_variable_get(:@worker)).not_to be_alive
     console.send(:drain)
     expect(console.send(:busy?)).to be_falsey
     text = console.instance_variable_get(:@timeline).map { |row| row[1] }.join
-    expect(text).to include('committed deletion', 'not undone')
+    expect(text).to include('not undone')
+    expect(text).not_to include('committed deletion')
     expect(text).not_to include('Request cancelled')
   ensure
     release << true if release
@@ -317,7 +345,7 @@ describe 'session maintenance command workers' do
     console.instance_variable_get(:@tool_input)&.close
   end
 
-  it 'keeps navigation and input alive through the real maintenance learning lock and queues errors' do
+  it 'defers a real maintenance learning lock without blocking navigation and queues errors' do
     require File.expand_path('../../../../../etc/default_cron/session_cleanup', __dir__)
     allow(PWN::SessionCleanup).to receive(:legacy_owners).and_return([])
     stub_const('PWN::AI::Agent::Learning::LEARNING_FILE', File.join(@tmp, '.pwn', 'learning.jsonl'))
@@ -325,21 +353,17 @@ describe 'session maintenance command workers' do
     reader, writer = IO.pipe
     console.instance_variable_set(:@input, reader)
     console.instance_variable_set(:@tool_input, writer)
-    events = console.instance_variable_get(:@events)
-    output = PWN::Plugins::REPL::AIConsole::EventIO.new(events)
-    allow(PWN::Plugins::REPL).to receive(:pwn_ai_print_result).and_wrap_original do |method, **options|
-      method.call(options.merge(output: output))
-    end
     lock = PWN::AI::Agent::Learning.send(:learning_lock)
-    entered = Queue.new
-    allow(PWN::AI::Agent::Learning).to receive(:migrate_evidence).and_wrap_original do |method, **options|
+    entered = PWNTestPipeQueue.new
+    # Busy Learning now defers at maintenance admission, before migration.
+    allow(PWN::SessionCleanup).to receive(:maintenance_transaction).and_wrap_original do |method, **options|
       entered << true
-      method.call(options)
+      method.call(**options)
     end
     Timeout.timeout(2) { console.submit('/sessions cleanup') }
     Timeout.timeout(2) { entered.pop }
     worker = console.instance_variable_get(:@worker)
-    expect(worker.join(0.05)).to be_nil
+    expect(worker.join(5)).to eq(worker)
     console.submit('/input fixture')
     expect(reader.read_nonblock(8)).to eq("fixture\n")
     console.handle("\u0014")
@@ -350,6 +374,16 @@ describe 'session maintenance command workers' do
     lock = nil
     expect(worker.join(5)).to eq(worker)
     console.send(:drain)
+    # A busy writer defers before deletion admission without waiting for release.
+    # A fresh command must still delete, proving the stop state does not leak.
+    expect(File).to exist(File.join(PWN::Sessions.sessions_dir, "#{sid}.jsonl"))
+    ledgers = Dir.glob(File.join(@tmp, '.pwn', 'maintenance', 'runs', '*.json')).map { |path| JSON.parse(File.read(path)) }
+    expect(ledgers.last).to include('state' => 'blocked')
+    expect(ledgers.last.dig('result', 'evidence_migration', 'deferred')).to eq('learning_writer_active')
+    expect(console.send(:busy?)).to be_falsey
+    console.submit('/sessions cleanup')
+    expect(console.instance_variable_get(:@worker).join(5)).not_to be_nil
+    console.send(:drain)
     expect(File).not_to exist(File.join(PWN::Sessions.sessions_dir, "#{sid}.jsonl"))
     expect(console.instance_variable_get(:@timeline).select { |row| row[0] == :command }.map { |row| row[1] }.join).to include('deleted: 1')
     allow(PWN::SessionCleanup).to receive(:maintain).and_raise(IOError, 'fixture maintenance failed')
@@ -377,17 +411,18 @@ describe 'session maintenance command workers' do
     reader, writer = IO.pipe
     console.instance_variable_set(:@input, reader)
     console.instance_variable_set(:@tool_input, writer)
-    entered = Queue.new
-    release = Queue.new
-    allow(PWN::SessionCleanup).to receive(:run).and_wrap_original do |method, **options|
+    entered = PWNTestPipeQueue.new
+    release = PWNTestPipeQueue.new
+    # Pause inside the admitted deletion transaction, not before run checks stop.
+    # Let the approved transaction complete; hard cancellation is tested above.
+    allow(PWN::Sessions).to receive(:delete).and_wrap_original do |method, **options|
       entered << true
       release.pop
-      method.call(**options)
+      method.call(options)
     end
     Timeout.timeout(2) { console.handle("\r") }
     Timeout.timeout(2) { entered.pop }
     console.handle("\e")
-    console.handle("\u0003")
     release << true
     expect(console.instance_variable_get(:@worker).join(5)).not_to be_nil
     console.send(:drain)
@@ -549,14 +584,14 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
   end
 
   it 'paints provisional and asynchronously updated summary titles in the actual SESSION pane' do
-    reached = Queue.new
-    release = Queue.new
-    owner = Thread.current
+    reached = PWNTestPipeQueue.new
+    release = PWNTestPipeQueue.new
+    owner = Process.pid
     PWN::Env[:ai] = { active: :openai, openai: { model: 'active-title-model', key: 'fixture-key' } }
     allow(PWN::AI::Router).to receive(:summarize).and_call_original
     expect(PWN::AI::Ollama).not_to receive(:chat)
-    expect(PWN::AI::OpenAI).to receive(:chat).with(hash_including(model: 'active-title-model', request: a_string_including('overall conversation', 'at most 7 words'))).once do
-      expect(Thread.current).not_to eq(owner)
+    allow(PWN::AI::OpenAI).to receive(:chat).with(hash_including(model: 'active-title-model', request: a_string_including('overall conversation', 'at most 7 words'))) do
+      expect(Process.pid).not_to eq(owner)
       reached << true
       release.pop
       JSON.generate(title: 'Login and certificate repair plus automated rotation verification', summary: 'Investigated login and repaired certificates.')
@@ -578,13 +613,13 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
         @pry.config.pwn_ai_session_id = PWN::Sessions.create[:id]
         next "\r"
       end
-      if !reached.empty? && !listed
+      # The provider barrier can precede the IPC reader's next rendered frame.
+      provisional_painted = @paint.join.include?('SESSION Investigate login and repair all expired certificates')
+      if !reached.empty? && !listed && provisional_painted
         listed = true
-        keys.concat("/sessions list\n".chars)
-      end
-      if listed && @rendered.map(&:last).join.include?('active: true') && !unblocked
         expect(@paint.join).to include('SESSION Investigate login and repair all expired certificates')
-        expect(@rendered.map(&:last).join).to include(@pry.config.pwn_ai_session_id, 'title: Investigate login and repair all expired certificates')
+      end
+      if listed && !unblocked
         expect(PWN::Sessions.title_status(session_id: @pry.config.pwn_ai_session_id)[:is_summarized]).to be(false)
         unblocked = true
         release << true
@@ -607,7 +642,7 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
     requested = false
     selected = false
     keys = "/sessions list\n".chars
-    expect(PWN::AI::Agent::Loop).to receive(:run).with(hash_including(request: 'Continue fixture', session_id: sid)) do |opts|
+    allow(PWN::AI::Agent::Loop).to receive(:run).with(hash_including(request: 'Continue fixture', session_id: sid)) do |opts|
       expect(PWN::Sessions.to_llm_messages(session_id: opts[:session_id]).map { |row| row[:content] }).to eq(['Prior fixture request', 'Prior fixture answer'])
       opts[:on_tool].call('fixture callback', {}, 'fixture result')
       'Resumed fixture complete'
@@ -836,7 +871,7 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
     allow(PWN::AI::Agent::PromptBuilder).to receive(:build).and_wrap_original do |method, opts|
       method.call(opts.merge(thin: true))
     end
-    expect(PWN::AI::OpenAI).to receive(:open_ai_rest_call) do |opts|
+    allow(PWN::AI::OpenAI).to receive(:open_ai_rest_call) do |opts|
       expect(opts[:http_body][:messages].find { |message| message[:role] == 'system' }[:content]).to start_with("Saved role\nsecond line")
       { choices: [{ message: { role: 'assistant', content: 'Role forwarded.', tool_calls: [] } }] }.to_json
     end
@@ -910,13 +945,15 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
 
   it 'runs the real Loop from the public launch, steering a blocked model without a second input reader' do
     loop_module = PWN::AI::Agent::Loop
-    entered = Queue.new
+    entered = PWNTestPipeQueue.new
+    recorded = PWNTestPipeQueue.new
     calls = []
     Thread.current[:pwn_console_probe] = :copied
     allow(loop_module).to receive(:call_engine) do |opts|
       expect(Thread.current[:pwn_console_probe]).to eq(:copied)
       expect(Thread.current[:pwn_steering_input].reader).to be_nil
       calls << opts[:messages].map(&:dup)
+      recorded << calls.last
       if calls.length == 1
         entered << true
         Queue.new.pop
@@ -937,8 +974,9 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
         nil
       end
     end
+    calls << recorded.pop until recorded.empty?
     expect(calls.length).to eq(2)
-    expect(calls.last.select { |row| row[:role] == 'user' }.map { |row| row[:content] }).to include('what color is a lemon?')
+    expect(calls.last.select { |row| row[:role].to_s == 'user' }.map { |row| row[:content] }).to include('what color is a lemon?')
     expect(@paint.join).to include('pwn-ai', 'ASSISTANT', 'MISSION', 'steering')
   ensure
     Thread.current[:pwn_console_probe] = nil
@@ -947,7 +985,7 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
   it 'opens a draft-preserving swarm workspace and sends only after explicit confirmation' do
     allow(PWN::AI::Agent::Swarm).to receive(:personas).and_return(scout: { role: 'Inspect evidence', engine: 'ollama', model: 'fixture' })
     allow(PWN::AI::Agent::Swarm).to receive(:create).and_return(swarm_id: 'fixture')
-    allow(PWN::AI::Agent::Swarm).to receive(:ask).and_return(reply: 'Workspace result')
+    allow(PWN::AI::Agent::Swarm).to receive(:ask).with(include(name: 'scout', request: 'mission draft')).and_return(reply: 'Workspace result')
     keys = "mission draft\u0007a".chars
     stage = 0
     launch(keys) do
@@ -967,11 +1005,11 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
         "\u0004"
       end
     end
-    expect(PWN::AI::Agent::Swarm).to have_received(:ask).with(include(name: 'scout', request: 'mission draft')).once
+    expect(@paint.join).to include('Workspace result')
   end
 
   it 'cancels a blocked model on Ctrl+C, returns idle, and does not kill another worker' do
-    entered = Queue.new
+    entered = PWNTestPipeQueue.new
     foreign = Thread.new { sleep }
     allow(PWN::AI::Agent::Loop).to receive(:call_engine) {
       entered << true
@@ -983,7 +1021,7 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
       if !cancelled && !entered.empty?
         cancelled = true
         "\u0003"
-      elsif @paint.any? { |row| row.include?('Request cancelled at a safe boundary') }
+      elsif @paint.any? { |row| row.include?('Mission cancelled; all owned processes reaped') }
         "\u0004"
       else
         Thread.pass
@@ -998,13 +1036,13 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
 
   [0, 3.1].each do |startup_delay|
     it "leaves a provider blocked in native IO without waiting for that read to return (startup #{startup_delay}s)" do
-      entered = Queue.new
-      returned = Queue.new
+      entered = PWNTestPipeQueue.new
+      returned = PWNTestPipeQueue.new
       provider = nil
       started = nil
       allow(PWN::AI::Agent::Loop).to receive(:call_engine) do
         Thread.handle_interrupt(Exception => :never) do
-          entered << Thread.current
+          entered << File.read('/proc/thread-self/stat').split.first
           sleep 8
           returned << true
         end
@@ -1013,12 +1051,12 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
       launched = Process.clock_gettime(Process::CLOCK_MONOTONIC)
       launch(keys, startup_delay: startup_delay, render_delay: startup_delay.positive? ? 0.02 : 0) do
         provider ||= entered.pop unless entered.empty?
-        if !started && provider&.status == 'sleep'
+        if !started && provider && File.read("/proc/#{provider}/status").match?(/^State:\s+S/)
           # Elapsed is painted before call_engine: it is not a provider barrier.
           # Time from delivered Ctrl+C, excluding startup and per-key rendering.
           started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
           "\u0003"
-        elsif @paint.any? { |row| row.include?('Request cancelled at a safe boundary') }
+        elsif @paint.any? { |row| row.include?('Mission cancelled; all owned processes reaped') }
           "\u0004"
         else
           Thread.pass
@@ -1029,24 +1067,17 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
       expect(started - launched).to be >= startup_delay
       expect(Process.clock_gettime(Process::CLOCK_MONOTONIC) - started).to be < 3
       expect(returned).to be_empty
+      expect(File.exist?("/proc/#{provider}")).to be(false)
     ensure
-      # Cancellation deliberately abandons masked IO. Release this fixture only
-      # after measuring return, then reap it before RSpec removes its mocks.
-      provider ||= entered.pop unless entered.empty?
-      begin
-        provider&.wakeup if provider&.alive?
-      rescue ThreadError
-        nil # The provider exited between alive? and wakeup.
-      end
-      provider&.join(2)
-      expect(provider).not_to be_alive if provider
+      entered&.close
+      returned&.close
     end
   end
 
   it 'forwards tool input, preserves completed evidence before steering, and locks settings while running' do
-    entered = Queue.new
+    entered = PWNTestPipeQueue.new
     calls = 0
-    observed = nil
+    observed = PWNTestPipeQueue.new
     allow(PWN::AI::Agent::Loop).to receive(:call_engine) do
       calls += 1
       if calls == 1
@@ -1055,10 +1086,11 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
         { role: 'assistant', content: 'Yellow.', tool_calls: [] }
       end
     end
-    expect(PWN::AI::Agent::Dispatch).to receive(:call).once do
+    allow(PWN::AI::Agent::Dispatch).to receive(:call) do
       entered << true
-      observed = $stdin.gets
-      JSON.generate(success: true, result: { stdout: observed, exitstatus: 0 })
+      answer = $stdin.gets
+      observed << answer
+      JSON.generate(success: true, result: { stdout: answer, exitstatus: 0 })
     end
     expect(PWN::Plugins::REPL).not_to receive(:pwn_ai_run_model)
     keys = "what color is a passion fruit?\n".chars
@@ -1075,14 +1107,15 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
         nil
       end
     end
-    expect(observed).to eq("tool answer\n")
+    expect(observed.pop).to eq("tool answer\n")
+    expect(observed).to be_empty
     expect(@paint.join).to include('TOOL', 'RESULT', 'tool answer', 'Settings and new requests wait')
     expect(@paint.join).to include('tools 1')
   end
 
   it 'closes the tool prompt pipe on busy exit and joins rather than orphaning the active request' do
-    entered = Queue.new
-    finished = Queue.new
+    entered = PWNTestPipeQueue.new
+    finished = PWNTestPipeQueue.new
     allow(PWN::AI::Agent::Loop).to receive(:call_engine).and_return(
       { role: 'assistant', tool_calls: [{ id: 'prompt', type: 'function', function: { name: 'shell', arguments: '{}' } }] }
     )
@@ -1094,7 +1127,7 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
     end
     keys = "what color is a lemon?\n".chars
     launch(keys) { entered.empty? ? nil : "\u0004" }
-    expect(finished.pop).to be_nil
+    expect(finished).to be_empty # Hard cancellation does not resume the tool to finish its writes.
   end
 
   it 'wraps menu selection without changing the draft or persistent history, then recalls after Escape' do
@@ -2500,14 +2533,14 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
 
   it 'repaints settings and theme changed by a command worker without worker drawing or a wakeup key' do
     PWN::Env[:ai] = { active: :ollama, ollama: { model: 'settings-fixture' } }
-    owner = Thread.current
+    owner = Process.pid
     painted = []
     allow_any_instance_of(PWN::Plugins::REPL::AIConsole::Console).to receive(:put).and_wrap_original do |method, *args|
       painted << args
       method.call(*args)
     end
     allow(PWN::Cron).to receive(:run) do
-      expect(Thread.current).not_to eq(owner)
+      expect(Process.pid).not_to eq(owner)
       slot = PWN::Env[:ai][PWN::Env[:ai][:active].to_sym]
       slot[:system_role_content] = 'worker settings role'
       slot[:temp] = 0.42
@@ -2559,6 +2592,10 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
       allow(PWN::Banner).to receive(:mini_names).and_return([:falling_blocks])
       allow(PWN::Plugins::REPL).to receive(:persist_ai_selection).and_return(false)
       expect(PWN::Plugins::REPL).not_to receive(:pwn_ai_apply_model)
+      allow(Time).to receive(:now).and_return(Time.now)
+      # Compare model/settings/artwork, not the command's live status/timer.
+      # Mission readiness and cancellation have separate regressions.
+      allow_any_instance_of(PWN::Plugins::REPL::AIConsole::Console).to receive_messages(elapsed: '0.0s', state: 'fixture status')
       original = Marshal.dump(PWN::Env[:ai])
       keys = "/model grok grok-4.6\n".chars
       cancelled = false
@@ -2572,7 +2609,8 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
           cancel_key
         elsif cancelled
           expect(Marshal.dump(PWN::Env[:ai])).to eq(original)
-          expect(rendered_header).to eq(baseline)
+          first_diff = baseline.chars.zip(rendered_header.chars).index { |left, right| left != right }
+          expect(rendered_header).to eq(baseline), "header delta at #{first_diff}: #{baseline[first_diff.to_i, 180].inspect} -> #{rendered_header[first_diff.to_i, 180].inspect}"
           "\u0004"
         else
           Thread.pass
@@ -2606,7 +2644,7 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
     PWN::Env[:ai][:openai] = { model: 'old', reasoning_effort: 'medium' }
     allow(PWN::Plugins::REPL).to receive(:persist_ai_selection).and_return(false)
     allow(PWN::AI::OpenAI).to receive(:get_models).and_return(data: [{ id: 'gpt-6-astra', supported_reasoning_levels: [{ effort: 'low' }, { effort: 'medium' }, { effort: 'high' }] }])
-    expect(PWN::AI::OpenAI).to receive(:chat_with_tools).with(hash_including(reasoning_effort: 'high')) do
+    allow(PWN::AI::OpenAI).to receive(:chat_with_tools).with(hash_including(reasoning_effort: 'high')) do
       { choices: [{ message: { role: 'assistant', content: 'Effort accepted.', tool_calls: [] } }] }
     end
     keys = "/model openai gpt-6-astra\n".chars
@@ -2631,13 +2669,22 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
     PWN::Sessions.append(session_id: sid, role: 'user', content: 'Previous fixture question')
     PWN::Sessions.append(session_id: sid, role: 'assistant', content: 'Previous fixture answer')
     allow(PWN::Plugins::REPL).to receive(:persist_ai_selection).and_return(false)
-    expect(PWN::AI::OpenAI).to receive(:chat_with_tools) do |opts|
+    allow(PWN::AI::OpenAI).to receive(:chat_with_tools) do |opts|
       expect(PWN::Env.dig(:ai, :openai, :model)).to eq('console-fixture')
       expect(opts[:messages]).to include(hash_including(role: 'user', content: 'Previous fixture question'), hash_including(role: 'assistant', content: 'Previous fixture answer'))
       { choices: [{ message: { role: 'assistant', content: 'Selected route.', tool_calls: [] } }] }
     end
-    keys = "/model openai console-fixture\n/sessions resume resumed console\nwhat color is a lemon?\n".chars
-    launch(keys) { @paint.any? { |row| row.include?('Selected route.') } ? "\u0004" : nil }
+    keys = "/model openai console-fixture\n/sessions resume resumed console\n".chars
+    submitted = false
+    launch(keys) do
+      if !submitted && @pry.config.pwn_ai_session_id == sid
+        submitted = true
+        keys.concat("what color is a lemon?\n".chars)
+        nil
+      elsif @paint.any? { |row| row.include?('Selected route.') }
+        "\u0004"
+      end
+    end
     expect(@pry.config.pwn_ai_session_id).to eq(sid)
     expect(PWN::Sessions.load(session_id: sid).map { |row| row[:content] }.join).to include('Selected route.')
   end
@@ -2701,9 +2748,9 @@ describe 'pwn-ai curses launch' do # rubocop:disable Metrics/BlockLength -- publ
   end
 
   it 'keeps network slash commands off the event thread so tool prompts can receive explicit input' do
-    entered = Queue.new
+    entered = PWNTestPipeQueue.new
     expect(PWN::AI::Agent::Loop).not_to receive(:run)
-    expect(PWN::Plugins::REPL).to receive(:pwn_ai_dispatch_slash!).with(request: '/mcp call fixture', pry: anything, raise_errors: true) do
+    allow(PWN::Plugins::REPL).to receive(:pwn_ai_dispatch_slash!).with(request: '/mcp call fixture', pry: anything, raise_errors: true) do
       entered << true
       puts "local command received: #{$stdin.gets}"
       true