pwn 0.5.784 → 0.5.787

data/spec/integration/harness_process_spec.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_relative '../support/harness/package_acceptance'
+require_relative '../support/harness/cli_faults'
+
+RSpec.describe 'harness process lifecycle' do
+  it 'preserves actual exit and stderr when startup fails before readiness' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      ready = File.join(root, 'ready')
+      command = [RbConfig.ruby, '-e', "warn 'unsupported architecture fixture'; exit 78"]
+      result = HarnessEvaluation.capture({ 'HOME' => root }, command, root, 1, ready_path: ready, startup_seconds: 2)
+      expect(result).to include(exit_status: 78, stderr: "unsupported architecture fixture\n", resource_cap: false, ready_observed: false, timeout_phase: nil)
+    end
+  end
+
+  it 'distinguishes a bounded boot timeout from an execution timeout' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      result = HarnessEvaluation.capture({ 'HOME' => root }, [RbConfig.ruby, '-e', 'sleep 60'], root, 1,
+                                         ready_path: File.join(root, 'ready'), startup_seconds: 0.05)
+      expect(result).to include(resource_cap: true, ready_observed: false, timeout_phase: 'startup', exit_status: nil, signal: Signal.list.fetch('KILL'))
+    end
+  end
+
+  it 'reports the real child failure when its fingerprint is missing, without inventing one' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      process = HarnessEvaluation.capture({ 'HOME' => root }, [RbConfig.ruby, '-e', "warn 'namespace unavailable'; exit 78"], root, 2)
+      File.write(File.join(root, 'initial-process.json'), JSON.generate(process))
+      row = { id: 'checkpoint-restart', artifact_root: root }
+      expect { HarnessPackageAcceptance.validate_fingerprints!([row], '/isolated/gems/pwn') }
+        .to raise_error(RuntimeError) { |error| expect(error.message).to include('checkpoint-restart', 'fingerprint', '"exit_status":78', 'namespace unavailable') }
+      expect(File.exist?(File.join(root, 'fingerprint.json'))).to be(false)
+    end
+  end
+
+  it 'records observed loaded components before an abrupt fixture exit bypasses at_exit' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      fixture = File.join(root, 'provider.json')
+      fingerprint = File.join(root, 'fingerprint.json')
+      File.write(fixture, JSON.generate(responses: []))
+      env = { 'HOME' => root, 'GEM_HOME' => Gem.dir, 'GEM_PATH' => Gem.path.join(File::PATH_SEPARATOR),
+              'PWN_HARNESS_FIXTURE' => fixture, 'PWN_HARNESS_EVENTS' => File.join(root, 'events.jsonl'), 'PWN_HARNESS_FINGERPRINT' => fingerprint }
+      command = [RbConfig.ruby, '-I', File.join(HarnessEvaluation::ROOT, 'lib'), '-r',
+                 File.join(HarnessEvaluation::ROOT, 'spec/support/harness/fake_provider.rb'), '-e', 'exit!(73)']
+      result = HarnessEvaluation.agent_capture(env, command, root, 5)
+      expect(result).to include(exit_status: 73, ready_observed: true)
+      expect(File.file?(fingerprint)).to be(true), result.inspect
+      expect(JSON.parse(File.read(fingerprint)).fetch('components')).not_to be_empty
+    end
+  end
+
+  it 'loads checkpoint controls across the real namespace exec boundary' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      fixture = File.join(root, 'provider.json')
+      runtime = File.join(root, 'runtime')
+      File.write(fixture, JSON.generate(responses: [{ fault: 'crash' }]))
+      env = { 'HOME' => root, 'PATH' => HarnessEvaluation.isolated_path, 'GEM_HOME' => Gem.dir, 'GEM_PATH' => Gem.path.join(File::PATH_SEPARATOR),
+              'PWN_HARNESS_FIXTURE' => fixture, 'PWN_HARNESS_EVENTS' => File.join(root, 'events.jsonl'),
+              'PWN_HARNESS_FINGERPRINT' => File.join(root, 'fingerprint.json'), 'PWN_HARNESS_RUNTIME' => runtime }
+      command = [RbConfig.ruby, '-I', File.join(HarnessEvaluation::ROOT, 'lib'), '-r',
+                 File.join(HarnessEvaluation::ROOT, 'spec/support/harness/fault_preload.rb'), '-e',
+                 'PWN::AI::Agent::MissionNamespace.force_exec = true; load ARGV.shift', File.join(HarnessEvaluation::ROOT, 'bin/pwn-ai'), '--ai', 'Offline checkpoint fixture']
+      result = HarnessEvaluation.agent_capture(env, command, root, 10)
+      expect(result).to include(exit_status: 73)
+      expect(File.file?(File.join(runtime, 'identity.json'))).to be(true), result.inspect
+    end
+  end
+
+  it 'does not resume a checkpoint that never started after a real child failure' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      failure = { exit_status: 78, resource_cap: false, ready_observed: false, stdout: '', stderr: 'namespace unavailable' }
+      allow(HarnessCLIFaults).to receive(:invoke).and_return(failure)
+      report = HarnessCLIFaults.run(output: root)
+      expect(HarnessCLIFaults).to have_received(:invoke).exactly(5).times
+      expect(report.fetch(:results)).to all(include(outcome: 'FAIL', exit_status: 78))
+    end
+  end
+
+  it 'redacts child diagnostics before reporting a missing fingerprint' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      row = { id: 'failed-boot', artifact_root: root, exit_status: 78, stderr: 'password=offline-secret' }
+      expect { HarnessPackageAcceptance.validate_fingerprints!([row], '/isolated/gems/pwn') }.to raise_error(RuntimeError) do |error|
+        expect(error.message).to include('REDACTED', '78')
+        expect(error.message).not_to include('offline-secret')
+      end
+    end
+  end
+
+  it 'requires fresh readiness on restart rather than accepting the previous process marker' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      File.write(File.join(root, 'harness-ready'), 'previous invocation')
+      command = [RbConfig.ruby, '-e', "sleep 0.2; puts 'booted'; STDOUT.flush; File.write(ENV.fetch('PWN_HARNESS_READY'), 'ready'); sleep 60"]
+      result = HarnessEvaluation.agent_capture({ 'HOME' => root }, command, root, 0.05)
+      expect(result).to include(resource_cap: true, ready_observed: true, stdout: "booted\n", timeout_phase: 'execution')
+    end
+  end
+end

data/spec/integration/mission_cancel_spec.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'open3'
+require 'tmpdir'
+require 'fileutils'
+require 'json'
+
+RSpec.describe 'mission cancellation through real subprocesses' do
+  def mission_fixture(name, *args)
+    Dir.mktmpdir('mission-cancel-') do |root|
+      home = File.join(root, 'home')
+      work = File.join(root, 'work')
+      FileUtils.mkdir_p([home, work])
+      fixture = File.expand_path("../support/harness/#{name}.rb", __dir__)
+      stdout, stderr, status = Open3.capture3({ 'HOME' => home }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, work, *args, chdir: work)
+      expect(status.success?).to be(true), stderr
+      JSON.parse(stdout)
+    end
+  end
+
+  it 'cancels the legacy interactive entrypoint through a native terminal and accepts its next mission' do
+    require 'pty'
+    require 'timeout'
+    Dir.mktmpdir('mission-legacy-') do |root|
+      FileUtils.mkdir_p(File.join(root, 'home'))
+      fixture = File.expand_path('../support/harness/mission_legacy.rb', __dir__)
+      PTY.spawn({ 'HOME' => File.join(root, 'home') }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, root, chdir: root) do |reader, writer, pid|
+        Timeout.timeout(15) { sleep 0.01 until File.exist?(File.join(root, 'ready')) }
+        writer.write("\x03")
+        output = +''
+        Timeout.timeout(15) do
+          loop { output << reader.readpartial(4096) }
+        rescue EOFError, Errno::EIO
+          nil
+        end
+        _child, status = Process.wait2(pid)
+        expect(status.success?).to be(true), output
+        row = output.lines.find { |line| line.start_with?('{') }
+        expect(JSON.parse(row)).to include('ready' => true, 'late' => false, 'second' => true, 'tty' => true)
+      ensure
+        begin
+          Process.kill('KILL', pid)
+          Process.wait(pid)
+        rescue Errno::ESRCH, Errno::ECHILD
+          nil
+        end
+      end
+    end
+  end
+
+  it 'reaps provider execution before accepting the next console mission' do
+    expect(mission_fixture('mission_console')).to include('ready' => true, 'late' => false, 'second' => true, 'fenced' => true)
+  end
+
+  it 'hard cancels local command descendants before the next mission' do
+    expect(mission_fixture('mission_console', 'command')).to include('ready' => true, 'late' => false, 'second' => true, 'fenced' => true)
+  end
+
+  it 'keeps detached tool jobs alive until their enclosing mission exits' do
+    expect(mission_fixture('mission_job_lifetime')).to include('survived_tool' => true)
+  end
+
+  it 'hard cancels independent swarm provider and tool descendants' do
+    expect(mission_fixture('mission_swarm')).to include('ready' => true, 'late' => false)
+  end
+
+  it 'fails closed and reaps startup when namespace creation is denied' do
+    expect(mission_fixture('mission_unsupported')).to include('blocked' => true, 'actionable' => true, 'reaped' => true)
+  end
+
+  it 'owns double-forked jobs on normal exit without killing unrelated processes' do
+    expect(mission_fixture('mission_normal_exit')).to include('reaped' => true, 'late' => false, 'unrelated' => true)
+  end
+
+  it 'stops and reaps a setsid descendant before cancellation returns' do
+    expect(mission_fixture('mission_dispatch')).to include('cancelled' => true, 'descendant_started' => true, 'reaped' => true, 'post_cancel_write' => false)
+  end
+end

data/spec/integration/mission_curses_pty_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'pty'
+require 'io/console'
+require 'timeout'
+
+RSpec.describe 'native curses mission cancellation' do
+  %w[ordinary command].each do |mode|
+    it "handles terminal CTRL+C during #{mode} execution and accepts the next mission without late writes" do
+      Dir.mktmpdir('mission-curses-') do |root|
+        home = File.join(root, 'home')
+        work = File.join(root, 'work')
+        FileUtils.mkdir_p([home, work])
+        fixture = File.expand_path('../support/harness/mission_curses_pty.rb', __dir__)
+        PTY.spawn({ 'HOME' => home, 'TERM' => 'xterm-256color' }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, work, mode, chdir: work) do |reader, writer, pid|
+          writer.winsize = [32, 120]
+          output = +''
+          pump = Thread.new do
+            loop { output << reader.readpartial(4096) }
+          rescue EOFError, Errno::EIO
+            nil
+          end
+          %w[idle ready cancelled second].zip([mode == 'command' ? "/mcp fixture\r" : "first\r", "\x03", "second\r", "back\r"]).each do |marker, keys|
+            Timeout.timeout(20) { sleep 0.01 until File.exist?(File.join(work, marker)) }
+            writer.write(keys)
+          end
+          Timeout.timeout(20) { pump.join }
+          _child, status = Process.wait2(pid)
+          expect(status.success?).to be(true), output
+          expect(JSON.parse(output[/\{"ready":.*\}/])).to include('ready' => true, 'late' => false, 'second' => true, 'tty' => true)
+        ensure
+          begin
+            Process.kill('KILL', pid)
+            Process.wait(pid)
+          rescue Errno::ESRCH, Errno::ECHILD
+            nil
+          end
+          pump&.join(1)
+        end
+      end
+    end
+  end
+end

data/spec/integration/readme_security_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'README security overview', :aggregate_failures do
+  let(:root) { File.expand_path('../..', __dir__) }
+  let(:readme) { File.read(File.join(root, 'README.md')) }
+  let(:security) do
+    readme[/^##### \*\*Vault and Sandboxing\*\* #####\n(.*?)(?=^#### )/m, 1].to_s.gsub(/\s+/, ' ')
+  end
+
+  it 'links a security subsection under Why PWN without replacing How PWN Works' do
+    expect(readme).to include('[Vault and Sandboxing](#vault-and-sandboxing)')
+    expect(readme).to match(/^#### \*\*Why PWN\*\* ####.*^##### \*\*Vault and Sandboxing\*\* #####.*^#### \*\*How PWN Works\*\* ####/m)
+  end
+
+  it 'explains credential handling at the tool boundary and engagement loot scope' do
+    expect(security).to include('security research', 'bug bounty hunting', 'penetration testing',
+                                'at rest', '{{vault:label}}', 'Dispatch', 'tool boundary',
+                                'prompts', 'logs', 'engagement', 'provenance', 'across engagements')
+  end
+
+  it 'documents the mandatory local boundary independently of optional sandbox profiles' do
+    expect(security).to include('untrusted PoCs', 'prompt injection', '~/.pwn/workspaces/runtime',
+                                'original operator request', 'parent', 'source', 'controller state',
+                                'read-only even if named', 'fail closed', 'Landlock', 'seccomp',
+                                'namespace', '`strict`', '`permissive`', '`off`')
+  end
+
+  it 'keeps encryption, provider privacy and operator responsibilities distinct' do
+    expect(security).to include('active process', 'LLM-provider privacy', 'whole-filesystem',
+                                'evidence/artifact encryption', 'redaction can miss',
+                                'not authorization', 'network isolation', 'perfect container',
+                                'guarantee against bugs', 'target authorization', 'least-privilege',
+                                'retention')
+  end
+
+  it 'links implementation and boundary documentation with existing local targets' do
+    expect(security).to include('(lib/pwn/plugins/vault.rb)', '(lib/pwn/ai/agent/dispatch.rb)',
+                                '(documentation/Runtime-Source-Protection.md)',
+                                '(documentation/Mission-Cancellation.md)',
+                                '(documentation/Configuration.md)', '(documentation/YubiKey-Vaults.md)')
+    refs = readme.scan(/\]\((?!https?:|#|mailto:)([^)\s]+)\)/).flatten.uniq
+    broken = refs.reject { |ref| File.exist?(File.expand_path(ref.split('#', 2).first, root)) }
+    expect(broken).to be_empty, "broken README relative links: #{broken.join(', ')}"
+  end
+end

data/spec/integration/web_cache_deception_yubikey_spec.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'pwn_web_cache_deception YubiKey options' do
+  let(:script) { File.expand_path('../../bin/pwn_web_cache_deception', __dir__) }
+  let(:browser) { double('offline browser', goto: nil, html: '<html>offline</html>') }
+  let(:browser_obj) { { browser: browser } }
+  let(:provider) { double('offline WWW provider', open: browser_obj, login: browser_obj, logout: browser_obj, close: nil) }
+  let(:driver_opts) { {} }
+  let(:account) { 'Example:tester@example.invalid' }
+  let(:serial) { '00123456' }
+  let(:args) do
+    ['--target-url=https://example.invalid/test', "--output-results=#{File.join(@tmpdir, 'results.txt')}",
+     '--pwn-www-mod=GitHub', '--username=tester@example.invalid', '--password=fake-password',
+     "--yubikey-account=#{account}", '--yubikey-confirm', "--yubikey-serial=#{serial}", '--no-mfa']
+  end
+
+  around do |example|
+    Dir.mktmpdir('pwn-wcd-yubikey-') do |dir|
+      @tmpdir = dir
+      example.run
+    end
+  end
+
+  before do
+    stub_const('ARGV', args.dup)
+    allow(PWN::Env).to receive(:[]).and_call_original
+    allow(PWN::Env).to receive(:[]).with(:driver_opts).and_return(driver_opts)
+    allow(PWN::Config).to receive(:refresh_env)
+    stub_const('PWN::WWW::GitHub', provider)
+    stub_const('PWN::Plugins::YubiKey', double('offline device boundary'))
+    stub_const('PWN::Plugins::TransparentBrowser', double('offline browser boundary', close: nil))
+    allow(PWN::Plugins::AuthenticationHelper).to receive(:mask_password).and_raise('unexpected password prompt')
+  end
+
+  it 'forwards exact account and serial options to GitHub login even with --no-mfa' do
+    expected = { browser_obj: browser_obj, username: 'tester@example.invalid', password: 'fake-password', mfa: false, yubikey: { account: account, confirm: true, serial: serial } }
+    expect(provider).to receive(:login).with(expected).and_return(browser_obj)
+    expect(PWN::Plugins::YubiKey).not_to receive(:oath_code)
+    load script, true
+  end
+
+  %w[Synack Twitter BugCrowd CoinbasePro AppCobaltIO].each do |name|
+    it "forwards YubiKey options only at #{name} login, not browser open" do
+      ARGV.map! { |arg| arg == '--pwn-www-mod=GitHub' ? "--pwn-www-mod=#{name}" : arg }
+      stub_const("PWN::WWW::#{name}", provider)
+      expect(provider).to receive(:open).with(browser_type: :chrome).and_return(browser_obj)
+      expect(provider).to receive(:login).with(hash_including(yubikey: { account: account, confirm: true, serial: serial }, mfa: false)).and_return(browser_obj)
+      load script, true
+    end
+  end
+
+  %w[Google Paypal].each do |name|
+    it "rejects YubiKey for #{name} before password prompts or opening a browser" do
+      ARGV.map! { |arg| arg == '--pwn-www-mod=GitHub' ? "--pwn-www-mod=#{name}" : arg }
+      ARGV.delete('--password=fake-password')
+      stub_const("PWN::WWW::#{name}", provider)
+      expect(provider).not_to receive(:open)
+      expect(provider).not_to receive(:login)
+      expect { load script, true }.to raise_error(ArgumentError, /YubiKey OATH.*supported/)
+    end
+  end
+
+  it 'requires a selected compatible provider before prompting or opening a browser' do
+    ARGV.delete('--pwn-www-mod=GitHub')
+    ARGV.delete('--password=fake-password')
+    expect { load script, true }.to raise_error(ArgumentError, /YubiKey OATH.*supported/)
+  end
+
+  it 'rejects a serial without an exact account instead of silently disabling YubiKey' do
+    ARGV.delete("--yubikey-account=#{account}")
+    ARGV.delete('--password=fake-password')
+    expect(provider).not_to receive(:open)
+    expect { load script, true }.to raise_error(ArgumentError, /serial.*account/)
+  end
+
+  it 'requires --yubikey-confirm before password prompts or browser open' do
+    ARGV.delete('--yubikey-confirm')
+    ARGV.delete('--password=fake-password')
+    expect(provider).not_to receive(:open)
+    expect(provider).not_to receive(:login)
+    expect { load script, true }.to raise_error(ArgumentError, /confirm: true.*HOTP.*authenticat/i)
+  end
+
+  it 'rejects confirmation without an account before password prompts or browser open' do
+    ARGV.reject! { |arg| arg.start_with?('--yubikey-account=', '--yubikey-serial=') || arg == '--password=fake-password' }
+    expect(provider).not_to receive(:open)
+    expect(provider).not_to receive(:login)
+    expect { load script, true }.to raise_error(ArgumentError, /--yubikey-confirm.*--yubikey-account/)
+  end
+
+  it 'does not accept a string value for the boolean --yubikey-confirm flag' do
+    ARGV.map! { |arg| arg == '--yubikey-confirm' ? '--yubikey-confirm=true' : arg }
+    expect(provider).not_to receive(:open)
+    expect { load script, true }.to raise_error(OptionParser::NeedlessArgument)
+  end
+
+  ['', '123x', ' 123', '-1'].each do |invalid|
+    it "rejects malformed serial #{invalid.inspect} before prompting or opening a browser" do
+      ARGV.map! { |arg| arg == "--yubikey-serial=#{serial}" ? "--yubikey-serial=#{invalid}" : arg }
+      ARGV.delete('--password=fake-password')
+      expect(provider).not_to receive(:open)
+      expect { load script, true }.to raise_error(ArgumentError, /serial.*decimal/)
+    end
+  end
+
+  it 'validates an empty account before password prompts or browser open' do
+    ARGV.map! { |arg| arg == "--yubikey-account=#{account}" ? '--yubikey-account=' : arg }
+    ARGV.delete('--yubikey-confirm')
+    ARGV.delete('--password=fake-password')
+    expect(provider).not_to receive(:open)
+    expect { load script, true }.to raise_error(ArgumentError, /account/)
+  end
+
+  it 'preserves an explicit MFA token from driver options rather than coercing it to true' do
+    ARGV.reject! { |arg| arg.start_with?('--yubikey-') || arg == '--no-mfa' }
+    driver_opts[:mfa] = '654321'
+    expect(provider).to receive(:login).with(hash_including(mfa: '654321')).and_return(browser_obj)
+    expect { load script, true }.not_to output(/fake-password|654321/).to_stdout
+    expect(File.read(File.join(@tmpdir, 'results.txt'))).not_to match(/fake-password|654321/)
+  end
+
+  it 'keeps the generic driver options unchanged when no YubiKey is requested' do
+    ARGV.reject! { |arg| arg.start_with?('--yubikey-') }
+    ARGV.map! { |arg| arg == '--pwn-www-mod=GitHub' ? '--pwn-www-mod=Google' : arg }
+    stub_const('PWN::WWW::Google', provider)
+    expect(provider).to receive(:login) do |options|
+      expect(options).not_to have_key(:yubikey)
+      expect(options[:mfa]).to be(false)
+      browser_obj
+    end
+    load script, true
+  end
+
+  it 'preserves the exact OATH name when the optional serial is omitted' do
+    exact = " #{account} "
+    ARGV.reject! { |arg| arg.start_with?('--yubikey-serial=') }
+    ARGV.map! { |arg| arg == "--yubikey-account=#{account}" ? "--yubikey-account=#{exact}" : arg }
+    expect(provider).to receive(:login).with(hash_including(yubikey: { account: exact, confirm: true })).and_return(browser_obj)
+    expect { load script, true }.not_to output(/fake-password|012345/).to_stdout
+  end
+
+  it 'documents account, consent risks, and serial flags with the supported-provider boundary' do
+    ARGV.replace(['--help'])
+    expect do
+      expect { load script, true }.to raise_error(SystemExit) { |error| expect(error.status).to eq(0) }
+    end.to output(/--yubikey-account.*GitHub.*Synack.*Twitter.*BugCrowd.*CoinbasePro.*AppCobaltIO.*Paypal.*--yubikey-confirm.*HOTP.*delete.*corrupt.*--yubikey-serial/m).to_stdout
+  end
+
+  it 'rejects an explicit token conflicting with YubiKey before password prompts' do
+    ARGV.delete('--no-mfa')
+    ARGV.delete('--yubikey-confirm')
+    ARGV.delete('--password=fake-password')
+    driver_opts[:mfa] = '654321'
+    expect(provider).not_to receive(:open)
+    expect { load script, true }.to raise_error(ArgumentError, /yubikey.*mfa/i)
+  end
+end

data/spec/lib/pwn/ai/agent/dispatch_spec.rb

@@ -6,18 +6,21 @@ require 'json'
 describe PWN::AI::Agent::Dispatch do
   it 'does not replay a timed-out real shell mutation after restoring its request checkpoint' do
     Dir.mktmpdir do |root|
-      options = { request: 'Write counter', session_id: 'timeout', request_id: 'fixture', artifact_root: root, trace: false }
+      work = File.join(root, 'work')
+      FileUtils.mkdir_p(work)
+      allow(PWN::Plugins::AISandbox).to receive(:workspace).and_return(work)
+      options = { request: 'Write counter', session_id: 'timeout', request_id: 'fixture', artifact_root: File.join(root, 'control'), trace: false }
       runtime = PWN::AI::Agent::RequestRuntime.new(options)
       Thread.current[:pwn_request_runtime] = runtime
       PWN::AI::Agent::Registry.discover
-      call = { id: 'mutation', function: { name: 'shell', arguments: { command: "printf effect >> #{root}/counter; sleep 3", timeout: 1 } } }
+      call = { id: 'mutation', function: { name: 'shell', arguments: { command: "printf effect >> #{work}/counter; sleep 3", timeout: 1 } } }
       first = JSON.parse(described_class.call(tool_call: call, scope_policy: { enabled: false }))
       expect(first.dig('result', 'error')).to include('timeout')
       Thread.current[:pwn_request_runtime] = PWN::AI::Agent::RequestRuntime.new(options.merge(resume: true))
       second = JSON.parse(described_class.call(tool_call: call, scope_policy: { enabled: false }))
       expect(second['success']).to be false
       expect(second.dig('result', 'error')).to eq('uncertain_side_effect')
-      expect(File.read(File.join(root, 'counter'))).to eq('effect')
+      expect(File.read(File.join(work, 'counter'))).to eq('effect')
       expect(call.dig(:function, :arguments, :timeout)).to eq(1)
     end
   ensure

data/spec/lib/pwn/ai/agent/dispatch_vault_safety_spec.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json'
+
+RSpec.describe PWN::AI::Agent::Dispatch, 'vault access safety' do
+  before do
+    @calls = []
+    @result = { status: 'fixture-complete' }
+    handler = lambda do |args|
+      @calls << args
+      @result
+    end
+    entry = PWN::AI::Agent::Registry::Entry.new(name: 'vault_fixture', schema: { parameters: { type: 'object' } }, handler: handler)
+    allow(PWN::AI::Agent::Registry).to receive(:lookup).with(name: 'vault_fixture').and_return(entry)
+    allow(PWN::AI::Agent::Manifest).to receive(:load).and_return({})
+    allow(PWN::AI::Agent::Manifest).to receive(:check).and_return(nil)
+    allow(PWN::AI::Agent::ToolGuard).to receive_messages(scope_check!: nil, policy_decision: nil, canary_leak?: false, refuse_copied_persist?: false)
+    allow(PWN::AI::Agent::Engagement).to receive(:deny_if_out_of_scope).and_return(nil)
+    allow(PWN::AI::Agent::Mission).to receive(:active).and_return(nil)
+    allow(PWN::AI::Agent::Confirmation).to receive(:gate).and_return(nil)
+    allow(PWN::Plugins::Vault).to receive(:expand) { |opts| opts[:text] }
+    allow(PWN::Plugins::Vault).to receive(:redact) { |opts| opts[:text] }
+  end
+
+  it 'expands nested vault references once per leaf before invoking the handler' do
+    allow(PWN::Plugins::Vault).to receive(:expand).with(text: '{{vault:fixture}}').and_return('fixture-unlocked')
+    arguments = { nested: [{ secret: '{{vault:fixture}}' }], slot: 2 }
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: arguments } }))
+    expect(response['success']).to be(true)
+    expect(@calls).to eq([{ nested: [{ secret: 'fixture-unlocked' }], slot: 2 }])
+    expect(PWN::Plugins::Vault).to have_received(:expand).with(text: '{{vault:fixture}}').once
+    expect(arguments[:nested].first[:secret]).to eq('{{vault:fixture}}')
+  end
+
+  it 'blocks a nested vault access failure without exposing its exception text' do
+    allow(PWN::Plugins::Vault).to receive(:expand).with(text: '{{vault:fixture}}').and_raise(IOError, 'fixture-private-detail')
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: { nested: ['{{vault:fixture}}'] } } }))
+    expect(response).to include('success' => false, 'code' => 'VAULT_EXPANSION_FAILED')
+    expect(@calls).to be_empty
+    expect(response.to_s).not_to include('fixture-private-detail')
+  end
+
+  it 'withholds results when vault output redaction fails after handler execution' do
+    allow(PWN::Plugins::Vault).to receive(:redact).and_raise(IOError, 'fixture-private-detail')
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: {} } }))
+    expect(@calls.length).to eq(1)
+    expect(response).to include('success' => false, 'code' => 'VAULT_REDACTION_FAILED', 'handler_executed' => true)
+    expect(response.to_s).not_to include('fixture-private-detail', 'fixture-complete')
+    expect(response).not_to have_key('result')
+  end
+
+  it 'redacts secrets in array results such as loot offers before returning them' do
+    @result = [{ secret: 'fixture-private-value' }]
+    allow(PWN::Plugins::Vault).to receive(:redact) { |opts| opts[:text].gsub('fixture-private-value', '{{vault:fixture}}') }
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: {} } }))
+    expect(response).to include('success' => true, 'result' => [{ 'secret' => '{{vault:fixture}}' }])
+    expect(response.to_s).not_to include('fixture-private-value')
+  end
+
+  it 'blocks a real hardware-envelope expansion when the offline device fixture fails' do
+    Dir.mktmpdir('pwn-dispatch-yubikey-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      allow(PWN::AI::Agent::Mission).to receive(:active_id).and_return(nil)
+      device = double('offline YubiKey fixture')
+      stub_const('PWN::Plugins::YubiKey', device)
+      allow(device).to receive(:challenge_response) { |opts| OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge)) }
+      PWN::Plugins::Vault.store(label: 'fixture', secret: 'fixture-private-value', yubikey: { slot: 2 })
+      allow(PWN::Plugins::Vault).to receive(:expand).and_call_original
+      allow(device).to receive(:challenge_response).and_raise(IOError, 'fixture-private-detail')
+      response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: { password: '{{vault:fixture}}' } } }))
+      expect(response).to include('success' => false, 'code' => 'VAULT_EXPANSION_FAILED')
+      expect(@calls).to be_empty
+      expect(response.to_s).not_to include('fixture-private-detail', 'fixture-private-value')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+    end
+  end
+
+  it 'never invokes a real handler after expansion of a vault argument fails' do
+    allow(PWN::Plugins::Vault).to receive(:expand).with(text: '{{vault:fixture}}').and_raise(IOError, 'device absent; fixture-private-detail')
+    response = JSON.parse(described_class.call(tool_call: { function: { name: 'vault_fixture', arguments: { password: '{{vault:fixture}}' } } }))
+    expect(@calls).to be_empty
+    expect(response).to include('success' => false, 'code' => 'VAULT_EXPANSION_FAILED')
+    expect(response.to_s).not_to include('fixture-private-detail')
+  end
+end

data/spec/lib/pwn/ai/agent/injection_guard_spec.rb

@@ -34,6 +34,7 @@ describe 'indirect prompt-injection guards' do
   it 'does not re-infer the acceptance contract on a nested loop' do
     Thread.current[:pwn_loop_active] = true
     Thread.current[:pwn_loop_nested] = true
+    PWN::AI::Agent::TurnFinalizer.commit_artifacts!(request: 'Write /tmp/frozen.pdf')
     Thread.current[:pwn_loop_deliverables] = {
       paths: ['/tmp/frozen.pdf'], min_seconds: 0, skills: [], proofs: [], hosts: []
     }
@@ -44,6 +45,7 @@ describe 'indirect prompt-injection guards' do
   ensure
     Thread.current[:pwn_loop_active] = nil
     Thread.current[:pwn_loop_nested] = nil
+    Thread.current[:pwn_artifact_contract] = nil
     Thread.current[:pwn_loop_deliverables] = nil
   end
 

data/spec/lib/pwn/ai/agent/learning_spec.rb

@@ -89,7 +89,7 @@ describe PWN::AI::Agent::Learning do
       expect(described_class.evidence_complete?(row: row)).to be(true)
       expect(File.binread(@source)).to eq(original_source)
       migration = Digest::SHA256.hexdigest(@original)
-      backup = File.join(@root, 'learning', 'migrations', "#{migration}.backup.jsonl")
+      backup = JSON.parse(File.read(result[:ledger])).fetch('backup')
       expect(File.binread(backup)).to eq(@original.b)
       expect(described_class.rollback_evidence(migration: migration)[:restored]).to be(true)
       expect(File.binread(@learning)).to eq(@original.b)
@@ -778,14 +778,14 @@ describe 'PWN::AI::Agent::Learning conflicted outcomes' do
     end
   end
 
-  it 'prunes bak files down to max_baks' do
+  it 'leaves legacy siblings untouched and reports the global seven-folder policy' do
     Dir.mktmpdir do |dir|
       stub_const('PWN::AI::Agent::Learning::LEARNING_FILE', File.join(dir, 'learning.jsonl'))
       File.write(File.join(dir, 'learning.jsonl'), "{}\n")
       7.times { |i| File.write(File.join(dir, "learning.jsonl.bak-#{i}"), 'x') }
       out = PWN::AI::Agent::Learning.compact!(max_baks: 5)
-      expect(Dir[File.join(dir, '*.bak*')].length).to eq(5)
-      expect(out[:pruned]).to eq(2)
+      expect(Dir[File.join(dir, '*.bak*')].length).to eq(7)
+      expect(out).to include(pruned: 0, max_baks: 7, scope: 'global')
     end
   end
 end

data/spec/lib/pwn/ai/agent/loop_artifacts_spec.rb

@@ -21,6 +21,11 @@ RSpec.describe PWN::AI::Agent::Loop do
     allow(PWN::AI::Agent::Mistakes).to receive(:record)
   end
 
+  it 'never adopts cached model destinations absent from the original request' do
+    Thread.current[:pwn_loop_deliverables] = { paths: ['/tmp/invented.pdf'] }
+    expect(described_class.send(:declared_deliverables, request: 'Generate a report')).to eq([])
+  end
+
   it 'does not let source read evidence bypass the destination contract' do
     Dir.mktmpdir do |dir|
       source = File.join(dir, 'source.md')