pwn 0.5.784 → 0.5.787

data/lib/pwn/plugins/basic_auth.rb

@@ -17,7 +17,7 @@ module PWN
         basic_user = opts[:username]
         basic_pass = opts[:password]
         if (basic_user.nil? || basic_pass.nil?) && !opts[:host].to_s.empty?
-          hit = Array(PWN::Plugins::Vault.offer(host: opts[:host], service: opts[:service], engagement: opts[:engagement] || opts[:engagement_id])).first
+          hit = Array(PWN::Plugins::Vault.offer(host: opts[:host], service: opts[:service], engagement: opts[:engagement] || opts[:engagement_id], yubikey: opts[:yubikey])).first
           if hit
             basic_user = hit[:username] if basic_user.nil?
             basic_pass = hit[:secret] if basic_pass.nil?
@@ -63,6 +63,7 @@ module PWN
             password: 'optional - password; omitted values are filled from Vault.offer',
             host: 'optional - hostname used to offer recon loot when username or password is omitted',
             service: 'optional - service name such as http or ssh used to match loot',
+            yubikey: 'optional - YubiKey selector Hash forwarded to hardware-protected Vault loot',
             engagement: 'optional - engagement id scoping the loot file (defaults to default)',
             engagement_id: 'optional - alias for engagement'
           )

data/lib/pwn/plugins/google_workspace.rb

@@ -397,25 +397,13 @@ module PWN
         dec_path = dec_path.to_s.strip
         dec_path = "#{env_path}.decryptor" if dec_path.empty?
 
-        unless File.exist?(env_path) && File.exist?(dec_path) && File.readable?(dec_path)
+        unless File.exist?(env_path)
           puts '[*] INFO: Google Workspace OAuth tokens updated in this session only; ' \
-               "persistence to #{env_path} skipped (missing decryption artifacts)."
+               "persistence to #{env_path} skipped (missing vault)."
           return false
         end
 
-        decryptor = YAML.load_file(dec_path, symbolize_names: true)
-        key = decryptor.is_a?(Hash) ? decryptor[:key] : nil
-        iv = decryptor.is_a?(Hash) ? decryptor[:iv] : nil
-        unless real_config_value?(value: key) && real_config_value?(value: iv)
-          puts '[*] INFO: Google Workspace OAuth tokens updated in this session only; ' \
-               'decryptor has no usable key/iv.'
-          return false
-        end
-
-        PWN::Plugins::Vault.decrypt(file: env_path, key: key, iv: iv)
-        begin
-          vault = YAML.load_file(env_path, symbolize_names: true)
-          vault = {} unless vault.is_a?(Hash)
+        PWN::Plugins::Vault.update(file: env_path, decryptor_file: dec_path) do |vault|
           vault[:plugins] = {} unless vault[:plugins].is_a?(Hash)
           vault[:plugins][:google_workspace] = {} unless vault[:plugins][:google_workspace].is_a?(Hash)
           slot = vault[:plugins][:google_workspace][:oauth]
@@ -423,15 +411,10 @@ module PWN
           %i[bearer_token refresh_token expires_at client_id client_secret redirect_uri scope].each do |k|
             slot[k] = oauth[k] if oauth.key?(k) && !oauth[k].nil?
           end
-          yaml_env = YAML.dump(vault).gsub(/^(\s*):/, '\1')
-          File.write(env_path, yaml_env)
-          File.chmod(0o600, env_path)
-        ensure
-          PWN::Plugins::Vault.encrypt(file: env_path, key: key, iv: iv)
         end
         true
       rescue StandardError => e
-        warn "[!] Google Workspace OAuth vault persistence failed (session tokens still updated): #{e.class}: #{e.message}"
+        warn "[!] Google Workspace OAuth vault persistence failed (session tokens still updated): #{e.class}"
         false
       end
 

data/lib/pwn/plugins/jobs.rb

@@ -26,7 +26,7 @@ module PWN
 
         root = File.expand_path(JOBS_DIR)
         FileUtils.mkdir_p(root, mode: 0o700)
-        File.chmod(0o700, root)
+        File.chmod(0o700, root) unless (File.stat(root).mode & 0o777) == 0o700
         runtime = Float(opts[:max_runtime] || 0)
         raise ArgumentError, 'max_runtime must be finite and nonnegative' unless runtime.finite? && runtime >= 0
 

data/lib/pwn/plugins/log.rb

@@ -27,7 +27,7 @@ module PWN
         PWN::AI::Agent::Loop
         PWN::AI::Agent::Dispatch
       ].freeze
-      SECRET_KEY_RX = /password|passwd|secret|token|api[_-]?key|authorization|bearer|cookie|session[_-]?id|private[_-]?key|decryptor|credential|ssh[_-]?key|client[_-]?secret|refresh[_-]?token|access[_-]?token|id[_-]?token|vault|csrf/i
+      SECRET_KEY_RX = Regexp.union(PWN::Redaction::MASKED_FIELD, /password|passwd|secret|token|api[_-]?key|authorization|bearer|cookie|session[_-]?id|private[_-]?key|decryptor|credential|ssh[_-]?key|client[_-]?secret|refresh[_-]?token|access[_-]?token|id[_-]?token|vault|csrf/i)
       SECRET_VALUE_RX = %r{
         -----BEGIN\ [A-Z ]*PRIVATE\ KEY----- |
         Bearer\s+[A-Za-z0-9\-._~+/]+=* |
@@ -644,11 +644,13 @@ module PWN
       private_class_method def self.inspect_debug(opts = {})
         val = opts[:value]
         key = opts[:key]
+        return PWN::Redaction::CONSTANT_MASK if key.to_s.match?(PWN::Redaction::MASKED_FIELD)
         return PWN::Redaction.token(kind: 'credential', value: val.to_s) if secret_key?(key: key)
         return PWN::Redaction.token(kind: 'opaque', value: val) if opaque_secret?(key: key, value: val)
         return format_debug_hash(hash: val) if val.is_a?(Hash)
         return sanitize_debug_text(text: val) if val.is_a?(String) && val.match?(SECRET_VALUE_RX)
 
+        val = PWN::Redaction.redact(value: val) if val.is_a?(Array)
         raw = sanitize_debug_text(text: val.inspect)
         raw = "#{raw[0, DEBUG_VALUE_MAX]}…" if raw.length > DEBUG_VALUE_MAX
         raw

data/lib/pwn/plugins/preflight_checker.rb

@@ -6,9 +6,9 @@ require 'time'
 
 module PWN
   module Plugins
-    # Plugin/binary/capability preflight. Plugins declare required_bins /
-    # required_caps; HOST summaries list degraded modules without autoloading
-    # the whole plugin tree.
+    # Plugin/binary/capability preflight. Native probes load host libraries
+    # only: no device enumeration, authentication or I/O. HOST summaries list
+    # degraded modules without autoloading the whole plugin tree.
     module PreflightChecker
       class MissingBinary < StandardError; end
       class MissingCapability < StandardError; end
@@ -32,6 +32,13 @@ module PWN
         'PWN::Plugins::Semgrep' => { bins: %w[semgrep] },
         'PWN::Plugins::ExploitDB' => { bins: %w[searchsploit] },
         'PWN::Plugins::Recon' => { bins: %w[subfinder httpx] },
+        'PWN::Plugins::YubiKey' => {
+          bins: [],
+          native: [
+            { name: 'FIDO native transport', probe: 'PWN::Plugins::YubiKey', options: { application: :fido } },
+            { name: 'PC/SC native transport', probe: 'PWN::Plugins::YubiKey', options: { application: :oath } }
+          ]
+        },
         'PWN::Plugins::CredentialAttack' => { bins: %w[hydra john hashcat] }
       }.freeze
 
@@ -97,6 +104,11 @@ module PWN
         PLUGIN_DEPS.each do |mod, dep|
           missing = Array(dep[:bins]).reject { |b| bin?(name: b) }
           caps[mod] = { bins: dep[:bins], missing: missing, ok: missing.empty?, caps: Array(dep[:caps]) }
+          next unless dep[:native]
+
+          missing_native = Array(dep[:native]).reject { |probe| native_available?(probe: probe) }.map { |probe| probe[:name] }
+          caps[mod][:missing_native] = missing_native
+          caps[mod][:ok] &&= missing_native.empty?
         end
         row = {
           at: Time.now.utc.iso8601,
@@ -164,21 +176,25 @@ module PWN
           bins = Array(dep[:bins])
           caps = Array(dep[:caps])
           services = Array(dep[:services])
+          native = Array(dep[:native])
           missing_bins = bins.reject { |b| bin?(name: b) }
+          missing_native = native.reject { |probe| native_available?(probe: probe) }.map { |probe| probe[:name] }
           missing_caps = []
           if caps.include?('CAP_NET_RAW')
             pkt_ok = defined?(PWN::Plugins::Packet) && PWN::Plugins::Packet.respond_to?(:health) && PWN::Plugins::Packet.health[:ok]
             missing_caps << 'CAP_NET_RAW' unless pkt_ok || cap_net_raw?
           end
           missing_services = services.reject { |s| service?(name: s[:name] || s['name'], path: s[:path] || s['path']) }.map { |s| s[:name] || s['name'] }
-          status = if missing_bins.empty? && missing_caps.empty? && missing_services.empty?
+          status = if missing_bins.empty? && missing_caps.empty? && missing_services.empty? && missing_native.empty?
                      :ok
-                   elsif bins.any? && missing_bins.length == bins.length
+                   elsif (bins.any? && missing_bins.length == bins.length) || (native.any? && missing_native.length == native.length)
                      :dead
                    else
                      :degraded
                    end
-          { plugin: plugin, status: status, missing_bins: missing_bins, missing_caps: missing_caps, missing_services: missing_services }
+          row = { plugin: plugin, status: status, missing_bins: missing_bins, missing_caps: missing_caps, missing_services: missing_services }
+          row[:missing_native] = missing_native if dep[:native]
+          row
         end
       end
 
@@ -189,7 +205,7 @@ module PWN
         degraded = rows.select { |r| r[:status] == :degraded }
         lines = ["HOST plugins ok=#{rows.count { |r| r[:status] == :ok }} degraded=#{degraded.length} dead=#{dead.length}"]
         (degraded + dead).first(cap).each do |r|
-          miss = (Array(r[:missing_bins]) + Array(r[:missing_caps]) + Array(r[:missing_services])).join(',')
+          miss = (Array(r[:missing_bins]) + Array(r[:missing_caps]) + Array(r[:missing_services]) + Array(r[:missing_native])).join(',')
           fb = Array(FALLBACKS[r[:plugin]]).join(',')
           extra = fb.empty? ? '' : " fallback=#{fb}"
           anchor = r[:plugin].to_s.downcase.gsub(/[^a-z0-9]+/, '-').gsub(/\A-+|-+\z/, '')
@@ -198,6 +214,15 @@ module PWN
         lines.join("\n")
       end
 
+      # Only trusted declarations above may supply a host-only available? probe.
+      private_class_method def self.native_available?(opts = {})
+        probe = opts[:probe]
+        provider = probe.fetch(:probe).split('::').inject(Object) { |scope, name| scope.const_get(name, false) }
+        provider.available?(probe.fetch(:options, {})) == true
+      rescue LoadError, StandardError
+        false
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -247,7 +272,7 @@ module PWN
             path: 'required - unix socket path (e.g. /var/run/docker.sock)'
           )
 
-          # Run check and return its result
+          # Report dependencies; native rows add missing_native from host-only library probes, never device readiness.
           #{self}.check(
             names: 'optional - Array names value consumed by #check'
           )
@@ -258,7 +283,7 @@ module PWN
             limit: 'optional - limit value consumed by #host_summary'
           )
 
-          # Refresh ~/.pwn/capabilities.json with bin/CAP_* presence.
+          # Refresh ~/.pwn/capabilities.json with bin/CAP_* and host-native-library presence; no device discovery.
           #{self}.manifest(
             refresh: 'optional - unused reserved refresh flag'
           )

data/lib/pwn/plugins/recon.rb

@@ -138,7 +138,7 @@ module PWN
           File.rename(temp, path)
         end
         result = JSON.parse(File.read(path), symbolize_names: true).merge(path: path)
-        result[:loot] = harvest_loot(assets: result[:assets], engagement_id: engagement)
+        result[:loot] = harvest_loot(assets: result[:assets], engagement_id: engagement, yubikey: opts[:yubikey])
         if opts[:ingest]
           begin
             ingestor = opts[:ingestor] || PWN::AI::Context.method(:ingest)
@@ -285,6 +285,7 @@ module PWN
               source: 'recon',
               where: opts[:where] || "banner:#{obs[:port] || asset[:port]}",
               engagement: eng,
+              yubikey: opts[:yubikey],
               finding_id: opts[:finding_id]
             )
           end
@@ -354,6 +355,7 @@ module PWN
             modules: 'optional - Array nmap/banner/tls/subfinder/nuclei; defaults nmap/banner',
             ports: 'optional - Array of integer ports; defaults 80 and 443',
             engagement_id: 'optional - simple identifier; defaults default',
+            yubikey: 'optional - hardware selector Hash for harvested loot; device failure raises without software fallback',
             root: 'optional - engagements directory; defaults ~/.pwn/engagements',
             timeout: 'optional - per-operation timeout seconds; defaults 15, maximum 300',
             ingest: 'optional - invoke Context.ingest after persistence; defaults false',
@@ -366,6 +368,7 @@ module PWN
             assets: 'required - Array of recon asset hashes with address and observations',
             engagement_id: 'optional - engagement id scoping the loot file (defaults to default)',
             engagement: 'optional - alias for engagement_id',
+            yubikey: 'optional - hardware selector Hash forwarded to Vault.ingest for captured secrets',
             where: 'optional - provenance path overlay when observation port is missing',
             finding_id: 'optional - finding id linked onto harvested secrets'
           )

data/lib/pwn/plugins/repl/ai.rb

@@ -278,9 +278,294 @@ module PWN
         # 2. '/' anywhere else → :path (host-native file nav)
         # 3. else → :ruby (same Pry::InputCompleter menu as the pwn REPL)
         class << PWN::Plugins::REPL # rubocop:disable Metrics/ClassLength
-          # Foreground Loop plus one scoped terminal reader, not another Pry
-          # readline and not a worker thread running tools without their locals.
+          # The terminal owner survives CTRL+C; only its mission tree is killed.
           def pwn_ai_run_steerable(opts = {})
+            pwn_ai_run_mission(opts.merge(operation: :steerable))
+          end
+
+          # Both native tools and regex-ReAct must execute below the same owner.
+          # Never retry a failed mission in the terminal/controller process.
+          def pwn_ai_run_legacy(opts = {})
+            result = pwn_ai_run_mission(opts.merge(operation: :legacy))
+            PWN::Env[:ai][result.fetch(:engine).to_sym][:response_history] = result[:response_history]
+          rescue StandardError => e
+            warn "[pwn-ai] legacy agent mission failed (#{e.class}: #{e.message.to_s.split("\n").first}); no uncontained retry was attempted"
+          ensure
+            opts[:request]&.replace('nil')
+            PWN::Plugins::REPL.ready_tty!
+          end
+
+          def pwn_ai_run_mission(opts = {})
+            require 'io/console'
+            input = opts[:input] || $stdin
+            reader, writer = IO.pipe
+            run = proc do
+              config = %i[pwn_ai_session_id pwn_ai_debug pwn_ai_trace pwn_ai_speak pwn_ai_agent].to_h { |key| [key, opts[:pry]&.config&.public_send(key)] }
+              descriptor = { operation: opts.fetch(:operation), config: config, options: opts.except(:pry, :input, :on_tool, :steering, :debug_tee) }
+              mission = PWN::Plugins::AISandbox::MissionProcess.new(descriptor: descriptor, fds: { 4 => writer, 0 => input })
+              writer.close
+              envelope = {}
+              reader.each_line do |line|
+                frame = JSON.parse(line, symbolize_names: true)
+                if frame[:event] == 'tool'
+                  opts[:on_tool]&.call(*frame[:args])
+                else
+                  envelope = frame
+                end
+              end
+              raise IOError, envelope[:error] if envelope[:error]
+
+              envelope[:result]
+            ensure
+              mission&.close
+            end
+            input.tty? ? input.cooked(&run) : run.call
+          ensure
+            [reader, writer].compact.each { |io| io.close unless io.closed? }
+          end
+
+          def pwn_ai_mission_entry(opts = {})
+            pry = Pry.new
+            opts.fetch(:config).each { |key, value| pry.config.public_send("#{key}=", value) }
+            writer = PWN::AI::Agent::MissionNamespace.io(4)
+            options = { trace: pry.config.pwn_ai_trace }.merge(opts.fetch(:options)).merge(
+              pry: pry, input: PWN::AI::Agent::MissionNamespace.io(0),
+              on_tool: ->(*args) { writer.puts(JSON.generate(event: 'tool', args: args)) }
+            )
+            begin
+              result = opts[:operation] == :legacy ? pwn_ai_run_legacy_child(options) : pwn_ai_run_steerable_child(options)
+              writer.puts(JSON.generate(result: result))
+            rescue StandardError => e
+              writer.puts(JSON.generate(error: "#{e.class}: #{e.message}"))
+            ensure
+              writer.close
+            end
+          end
+
+          def pwn_ai_run_legacy_child(opts = {})
+            request = opts[:request]
+            orig_request = opts[:original_request]
+            pi = opts[:pry]
+            # Do NOT rebind the 'request' parameter (the string object passed by Pry's after_read hook).
+            # We will mutate it to 'nil' at the end of handling so Pry does not eval the natural-language
+            # prompt text as Ruby (which was causing noisy exceptions *after* the green AI response print).
+            debug = pi.config.pwn_ai_debug
+            engine = PWN::Env[:ai][:active].to_s.downcase.to_sym
+            response_history = PWN::Env[:ai][engine][:response_history]
+            speak_answer = pi.config.pwn_ai_speak
+            is_agent = (pi.config.pwn_ai_agent == true)
+
+            # pwn-ai agent mode: load skills context for autonomous task carrying
+            skills_context = ''
+            PWN::Skills.each { |n, m| skills_context += "\n--- SKILL #{n} ---\n#{m[:content].to_s[0, 1200]}\n" } if is_agent && PWN.const_defined?(:Skills) && PWN::Skills.is_a?(Hash)
+
+            memory_context = ''
+            memory_context = PWN::Memory.to_context(limit: 25) if is_agent && PWN.const_defined?(:Memory)
+
+            sess_id = begin
+              pi.config.pwn_ai_session_id
+            rescue StandardError
+              nil
+            end
+
+            # Pre-process for clear CLI execution intent (e.g. "what does `id` return?")
+            # This makes the agent actually *run* commands instead of just explaining them.
+            curr_req = orig_request.chomp
+            if is_agent && sess_id && PWN.const_defined?(:Sessions)
+              begin
+                PWN::Sessions.append(session_id: sess_id, role: 'user', content: orig_request)
+              rescue StandardError
+                nil
+              end
+            end
+            if is_agent && request =~ /`([^`]+)`/
+              potential = ::Regexp.last_match(1).strip
+              # Looks like a shell command (not PWN ruby)
+              unless potential =~ /^(PWN::|def |class |require |puts |pp )/
+                curr_req = "The user wants the *actual raw output* of this command (do not just describe it): `#{potential}`. " \
+                           'To fulfill the request accurately, you MUST immediately output ONLY a bash code block with the exact command. ' \
+                           "Example format: ```bash\n#{potential}\n``` . After the host executes it, you will receive the OBSERVATION with the real output."
+              end
+            end
+
+            # Strict system prompt for agent mode (forces tool use over explanation)
+            system_role = nil
+            if is_agent
+              base = PWN::Env[:ai][engine][:system_role_content] || 'You are an ethical hacker.'
+              system_role = base + <<~PROMPT
+
+                                You are operating as an autonomous agent inside the PWN REPL driver.
+
+                                PRIMARY RULE FOR CLI AND TOOLS: When the user asks for the output of a command, "what does X return?", "run X", or anything that requires real execution, you MUST use a tool call.#{' '}
+                                NEVER just explain what a command does or what its output "would be".#{' '}
+                                To execute anything:
+                                  - Output *exactly and only* a fenced code block.
+                                  - For shell/CLI: ```bash
+                                <exact command here>
+                                ```
+                                  - For PWN Ruby modules: ```ruby
+                                PWN::Plugins::NmapIt.port_scan(...)
+                                ```
+                                The host will execute it (Ruby in full PWN context, bash via shell) and reply with an OBSERVATION containing the real result.#{' '}
+                                Then continue or give the final answer.
+
+                                Available tools include all PWN::Plugins (NmapIt, TransparentBrowser, etc.), SAST, Reports, and any CLI via bash blocks.
+                                Skills available this session:#{skills_context}
+                #{memory_context}
+
+                                PERSISTENT CAPABILITIES (use via ruby code blocks or direct calls):
+                                - Memory (cross-session): PWN::Memory.remember(key: :key, value: val, category: :fact|:preference|:lesson)
+                                  PWN::Memory.recall(query: 'foo'), PWN::Memory.forget(key: key)
+                                - Sessions: current session id = #{sess_id}; PWN::Sessions.append(session_id: '#{sess_id}', role: 'observation', content: obs)
+                                - Cron: PWN::Cron.create(schedule: '0 * * * *', prompt: 'task here', name: 'foo')
+                                  PWN::Cron.run(id: 'id'); list with PWN::Cron.list
+                                - Agents/Delegation: PWN::AI::Agent::SAST.analyze(request: ...); PWN::AI::Agent::VulnGen etc.
+                                  For sub-agents use threads or separate eval calls and feed results back as OBS.
+
+                                After receiving an observation, decide the next step or conclude.
+                                If you output text without a code block, it will be treated as your final answer to the user.
+              PROMPT
+            end
+
+            max_turns = is_agent ? 7 : 1
+            turn = 0
+            last_response = ''
+            tool_was_executed_this_turn = false
+
+            while turn < max_turns
+              chat_opts = {
+                request: curr_req,
+                response_history: response_history,
+                speak_answer: speak_answer,
+                spinner: false
+              }
+              chat_opts[:system_role_content] = system_role if system_role
+
+              case engine
+              when :anthropic
+                response = PWN::AI::Anthropic.chat(chat_opts)
+              when :gemini
+                response = PWN::AI::Gemini.chat(chat_opts)
+              when :grok
+                response = PWN::AI::Grok.chat(chat_opts)
+              when :ollama
+                response = PWN::AI::Ollama.chat(chat_opts)
+              when :openai
+                response = PWN::AI::OpenAI.chat(chat_opts)
+              when :openwebui
+                response = PWN::AI::OpenWebUI.chat(chat_opts)
+              else
+                raise "ERROR: Unsupported AI Engine: #{engine}"
+              end
+
+              if response.nil?
+                last_response = 'Model not currently supported with API key.'
+              else
+                if response[:choices].last.keys.include?(:text)
+                  last_response = response[:choices].last[:text].to_s
+                else
+                  last_response = response[:choices].last[:content].to_s
+                end
+                response_history = {
+                  id: response[:id],
+                  object: response[:object],
+                  model: response[:model],
+                  usage: response[:usage]
+                }
+                response_history[:choices] ||= response[:choices]
+              end
+
+              puts "\n\001\e[32m\002#{last_response}\001\e[0m\002\n\n"
+              if is_agent && sess_id && PWN.const_defined?(:Sessions)
+                begin
+                  PWN::Sessions.append(session_id: sess_id, role: 'assistant', content: last_response)
+                rescue StandardError
+                  nil
+                end
+              end
+
+              if debug
+                puts 'DEBUG: response_history => '
+                pp response_history
+              end
+              PWN::Env[:ai][engine][:response_history] = response_history
+
+              # === Agent tool execution: parse code blocks from *this* response and actually run them ===
+              tool_was_executed_this_turn = false
+              if is_agent
+                # Robust regex: tolerate language specifier, extra whitespace, and text around the block
+                last_response.scan(/```(?:\s*(ruby|bash|sh|shell|zsh))?\s*\n?(.*?)\n?```/m).each do |lang, code|
+                  code = code.strip
+                  next if code.empty? || tool_was_executed_this_turn
+
+                  lang = (lang || 'bash').downcase
+                  puts "\001\e[33m\002[ pwn-ai AGENT EXEC #{lang} ]
\e[0m\002 #{code[0..90]}..."
+
+                  obs = ''
+                  begin
+                    obs = PWN::Plugins::AISandbox.protect_call do
+                      if lang == 'ruby'
+                        require 'stringio'
+                        old_stdout = $stdout
+                        $stdout = StringIO.new
+                        res = eval(code, TOPLEVEL_BINDING) # rubocop:disable Security/Eval -- intentional sandboxed legacy tool evaluation
+                        captured = $stdout.string
+                        $stdout = old_stdout
+                        (captured + "\n=> #{res.inspect}").strip
+                      else
+                        require 'open3'
+                        stdout, stderr, status = Open3.capture3(code)
+                        output = stdout
+                        output += "\n[stderr]\n#{stderr}" unless stderr.to_s.strip.empty?
+                        output += "\n[exit: #{status.exitstatus}]" unless status.success?
+                        output.strip
+                      end
+                    end
+                    obs = JSON.generate(obs) unless obs.is_a?(String)
+                  rescue StandardError => e
+                    obs = "ERROR executing #{lang} block: #{e.class} - #{e.message}"
+                  end
+
+                  puts "\001\e[36m\002[OBSERVATION from #{lang}]\001\e[0m\002\n#{obs[0..700]}\n"
+                  if is_agent && sess_id && PWN.const_defined?(:Sessions)
+                    begin
+                      PWN::Sessions.append(session_id: sess_id, role: 'observation', content: obs)
+                    rescue StandardError
+                      nil
+                    end
+                  end
+
+                  # Feed real result back to the model as the next "user" message in the loop
+                  curr_req = "OBSERVATION (#{lang} execution result for previous block):\n#{obs}\n\n" \
+                             "Now continue fulfilling the original user request: #{orig_request}. " \
+                             'If the task is complete, give the final answer (no more code blocks). Otherwise output the next needed tool block.'
+
+                  tool_was_executed_this_turn = true
+                  turn += 1
+                  break # one execution per model turn for controlled pacing
+                end
+              end
+
+              # If we executed something, loop to let the model react to the OBS
+              next if tool_was_executed_this_turn
+
+              # No tool executed this turn -> this last_response is the final answer
+              break
+            end
+
+            # If in agent mode and the model never produced an executable block but the query clearly wanted execution,
+            # give one last chance with a strong reminder (helps weaker models like some Ollama ones)
+            if is_agent && !tool_was_executed_this_turn && orig_request =~ /`[^`]+`/ && turn < max_turns
+              reminder = 'The user explicitly asked about the output of a command in backticks. ' \
+                         'Do not describe the command. Output *only* the corresponding ```bash block now so the host can run it and give you the real result.'
+              curr_req = "#{reminder}\nOriginal: #{orig_request}"
+              # One final direct call (no full re-loop to avoid complexity)
+              # (The main loop already handled most cases; this is a safety net)
+            end
+            { engine: engine, response_history: response_history }
+          end
+
+          def pwn_ai_run_steerable_child(opts = {})
             previous = Thread.current[:pwn_steering_input]
             workspace = File.realpath(Dir.pwd)
             lock_path = File.join(Dir.tmpdir, "pwn-solve-#{Digest::SHA256.hexdigest(workspace)}.lock")
@@ -862,24 +1147,11 @@ module PWN
             env_path = File.join(Dir.home, '.pwn', 'pwn.yaml') if env_path.empty?
             dec_path = dec_path.to_s.strip
             dec_path = "#{env_path}.decryptor" if dec_path.empty?
-            return false unless File.exist?(env_path) && File.exist?(dec_path) && File.readable?(dec_path)
-
-            decryptor = YAML.load_file(dec_path, symbolize_names: true)
-            key = decryptor.is_a?(Hash) ? decryptor[:key] : nil
-            iv = decryptor.is_a?(Hash) ? decryptor[:iv] : nil
-            return false if key.to_s.strip.empty? || iv.to_s.strip.empty?
-
-            # Never decrypt the live vault in place: failed encryption must leave
-            # the previous ciphertext intact. Rename only the encrypted merge.
-            require 'tempfile'
-            Tempfile.create(['.pwn-ai-selection', '.yaml'], File.dirname(env_path)) do |file|
-              file.binmode
-              file.write(File.binread(env_path))
-              file.flush
-              path = file.path
-              PWN::Plugins::Vault.decrypt(file: path, key: key, iv: iv)
-              cfg = YAML.load_file(path, symbolize_names: true)
-              cfg = {} unless cfg.is_a?(Hash)
+            return false unless File.exist?(env_path)
+
+            # Shared update preserves hardware or legacy format and publishes only
+            # ciphertext after a locked re-read and final conflict comparison.
+            PWN::Plugins::Vault.update(file: env_path, decryptor_file: dec_path) do |cfg|
               cfg[:ai] = {} unless cfg[:ai].is_a?(Hash)
               cfg[:ai][:active] = engine unless opts.key?(:system_role_content)
               unless model.to_s.strip.empty?
@@ -895,15 +1167,10 @@ module PWN
                 cfg[:ai][engine.to_sym] ||= {}
                 cfg[:ai][engine.to_sym][:system_role_content] = opts[:system_role_content]
               end
-              yaml_env = YAML.dump(cfg).gsub(/^(\s*):/, '\1')
-              File.write(path, yaml_env)
-              File.chmod(0o600, path)
-              PWN::Plugins::Vault.encrypt(file: path, key: key, iv: iv)
-              File.rename(path, env_path)
             end
             true
           rescue StandardError => e
-            warn "[pwn-ai] settings persist failed: #{e.class}: #{e.message}"
+            warn "[pwn-ai] settings persist failed: #{e.class}; check vault access and retry."
             false
           end