pwn 0.5.784 → 0.5.787

data/spec/lib/pwn/ai/agent/tools/browser_act_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'PWN::AI::Agent::Tools browser_act' do
+  before(:all) do
+    PWN::AI::Agent::Registry.discover(force: true)
+    load '/opt/pwn/lib/pwn/ai/agent/tools/browser_act.rb'
+  end
+
+  it 'registers browser_act' do
+    expect(PWN::AI::Agent::Registry.lookup(name: 'browser_act')).not_to be_nil
+  end
+
+  it 'opens, acts, and closes when no browser is supplied' do
+    browser_obj = { type: :headless, browser: :stub }
+    allow(PWN::Plugins::TransparentBrowser).to receive(:open).with(browser_type: :headless).and_return(browser_obj)
+    allow(PWN::Plugins::TransparentBrowser).to receive(:act).and_return({ available: true, status: 'done' })
+    allow(PWN::Plugins::TransparentBrowser).to receive(:close)
+
+    result = PWN::AI::Agent::Registry.lookup(name: 'browser_act').handler.call(
+      'goal' => 'find the article',
+      'url' => 'https://example.test'
+    )
+
+    expect(result).to include(available: true, status: 'done')
+    expect(PWN::Plugins::TransparentBrowser).to have_received(:act).with(
+      hash_including(browser_obj: browser_obj, goal: 'find the article', url: 'https://example.test')
+    )
+    expect(PWN::Plugins::TransparentBrowser).to have_received(:close).with(browser_obj: browser_obj)
+  end
+
+  it 'does not close a browser the caller already owns' do
+    supplied = { type: :rest, browser: :kept }
+    allow(PWN::Plugins::TransparentBrowser).to receive(:open)
+    allow(PWN::Plugins::TransparentBrowser).to receive(:act).and_return({ available: false, status: 'unavailable' })
+    allow(PWN::Plugins::TransparentBrowser).to receive(:close)
+
+    PWN::AI::Agent::Registry.lookup(name: 'browser_act').handler.call(browser_obj: supplied, goal: 'look')
+
+    expect(PWN::Plugins::TransparentBrowser).not_to have_received(:open)
+    expect(PWN::Plugins::TransparentBrowser).not_to have_received(:close)
+  end
+end

data/spec/lib/pwn/ai/agent/tools/loot_query_yubikey_spec.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json_schemer'
+require 'tmpdir'
+
+RSpec.describe 'loot_query hardware selector' do
+  before(:all) do
+    PWN::AI::Agent::Registry.discover
+  end
+
+  it 'rejects an executable override at the actual Dispatch schema boundary' do
+    allow(PWN::AI::Agent::Manifest).to receive(:load).and_return({})
+    expect(PWN::Plugins::Vault).not_to receive(:store)
+    expect(PWN::Plugins::Vault).not_to receive(:expand)
+    raw = PWN::AI::Agent::Dispatch.call(tool_call: { function: { name: 'loot_query', arguments: { op: 'store', secret: 'fixture-secret', yubikey: { ykman: '/fixture/arbitrary-executable' } } } })
+    expect(JSON.parse(raw)).to include('success' => false, 'code' => 'SCHEMA_DENY')
+  end
+
+  it 'forwards selection through ingest while metadata-only query never opens the device' do
+    Dir.mktmpdir('pwn-loot-query-yubikey-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      allow(PWN::AI::Agent::Mission).to receive(:active_id).and_return(nil)
+      device = double('offline YubiKey fixture')
+      stub_const('PWN::Plugins::YubiKey', device)
+      allow(device).to receive(:challenge_response) do |opts|
+        expect(opts).to include(slot: 2, serial: '12345678', timeout: 2.5)
+        OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge))
+      end
+      handler = PWN::AI::Agent::Registry.lookup(name: 'loot_query').handler
+      saved = handler.call('op' => 'ingest', 'text' => 'username=fixture-user password=fixture-password', 'engagement' => 'lab',
+                           'yubikey' => { 'slot' => 2, 'serial' => '12345678', 'timeout' => 2.5 })
+      expect(saved.first).to include(stored: true, engagement: 'lab', source: 'recon')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+      expect(device).not_to receive(:challenge_response)
+      result = handler.call('op' => 'query', 'engagement' => 'lab')
+      expect(result[:records].first).to include(has_secret: true, username: 'fixture-user')
+      expect(result.to_s).not_to include('fixture-password')
+    end
+  end
+
+  it 'advertises only a non-secret hardware selector without adding a tool' do
+    count = PWN::AI::Agent::Registry.all.length
+    load File.expand_path('../../../../../../lib/pwn/ai/agent/tools/loot_query.rb', __dir__)
+    expect(PWN::AI::Agent::Registry.all.length).to eq(count)
+    schema = PWN::AI::Agent::Registry.lookup(name: 'loot_query').schema.fetch(:parameters)
+    selector = schema.fetch(:properties).fetch(:yubikey)
+    expect(selector.fetch(:properties).keys).to contain_exactly(:slot, :serial, :timeout)
+    validator = JSONSchemer.schema(JSON.parse(JSON.generate(schema)))
+    expect(validator.valid?({ 'op' => 'store', 'yubikey' => { 'slot' => 2, 'serial' => '12345678', 'timeout' => 2.5 } })).to be(true)
+    [{ 'ykman' => '/fixture/arbitrary-executable' }, { 'pin' => '123456' }, { 'slot' => 3 }, { 'serial' => 'invalid' }, { 'timeout' => 0 }, false].each do |invalid|
+      expect(validator.valid?({ 'yubikey' => invalid })).to be(false), invalid.inspect
+    end
+  end
+end

data/spec/lib/pwn/ai/agent/tools/recon_run_yubikey_spec.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json_schemer'
+require 'tmpdir'
+
+RSpec.describe 'recon_run hardware selector' do
+  before do
+    PWN::AI::Agent::Registry.discover
+  end
+
+  it 'advertises the nonsecret selector and rejects executable overrides before recon runs' do
+    entry = PWN::AI::Agent::Registry.lookup(name: 'recon_run')
+    selector = entry.schema.fetch(:parameters).fetch(:properties).fetch(:yubikey)
+    expect(selector.fetch(:properties).keys).to contain_exactly(:slot, :serial, :timeout)
+    validator = JSONSchemer.schema(JSON.parse(JSON.generate(entry.schema.fetch(:parameters))))
+    expect(validator.valid?({ 'target' => 'app.example.test', 'modules' => ['banner'], 'yubikey' => { 'slot' => 2, 'serial' => '12345678' } })).to be(true)
+    allow(PWN::AI::Agent::Manifest).to receive(:load).and_return({})
+    expect(PWN::Plugins::Recon).not_to receive(:run)
+    raw = PWN::AI::Agent::Dispatch.call(tool_call: { function: { name: 'recon_run', arguments: { target: 'app.example.test', modules: ['banner'], yubikey: { ykman: '/fixture/untrusted-executable' } } } })
+    expect(JSON.parse(raw)).to include('success' => false, 'code' => 'SCHEMA_DENY')
+  end
+
+  it 'carries JSON selector keys through the real recon handler into hardware-protected loot' do
+    Dir.mktmpdir('pwn-recon-tool-yubikey-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      allow(PWN::AI::Agent::Mission).to receive(:active_id).and_return(nil)
+      allow(PWN::Plugins::YubiKey).to receive(:challenge_response) do |opts|
+        expect(opts).to include(slot: 2, serial: '12345678', timeout: 4)
+        OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge))
+      end
+      socket = double('offline banner', readpartial: "username=fixture-user\npassword=fixture-password\n", remote_address: double(ip_address: '192.0.2.10'))
+      allow(Socket).to receive(:tcp).and_yield(socket)
+      entry = PWN::AI::Agent::Registry.lookup(name: 'recon_run')
+      selector = { 'slot' => 2, 'serial' => '12345678', 'timeout' => 4 }
+      result = entry.handler.call('target' => 'app.example.test', 'modules' => ['banner'], 'ports' => [22], 'root' => root,
+                                  'ingest' => false, 'engagement_id' => 'lab', 'yubikey' => selector)
+      label = result.fetch(:loot).first.fetch(:label)
+      expect(PWN::Plugins::Vault.fetch(label: label, engagement: 'lab', yubikey: selector)).to eq('fixture-password')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+    end
+  end
+end

data/spec/lib/pwn/ai/agent/tools/workspace_tool_spec.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'PWN::AI::Agent::Tools workspace_tool' do
+  before(:all) do
+    PWN::AI::Agent::Registry.discover(force: true)
+    load '/opt/pwn/lib/pwn/ai/agent/tools/workspace_tool.rb'
+  end
+
+  it 'registers workspace_tool' do
+    expect(PWN::AI::Agent::Registry.lookup(name: 'workspace_tool')).not_to be_nil
+  end
+
+  it 'lists the Open WebUI workspace when no name is given' do
+    allow(PWN::AI::ServerTools).to receive(:list).with(engine: :openwebui).and_return([{ id: 'ask_jev', name: 'Ask Jev' }])
+    result = PWN::AI::Agent::Registry.lookup(name: 'workspace_tool').handler.call({})
+    expect(result).to eq([{ id: 'ask_jev', name: 'Ask Jev' }])
+  end
+end

data/spec/lib/pwn/ai/agent/turn_finalizer_spec.rb

@@ -11,6 +11,12 @@ describe PWN::AI::Agent::TurnFinalizer do
     expect(described_class).to respond_to :help
   end
 
+  it 'does not promote prose abbreviations into output filenames' do
+    request = 'Generate a report, i.e. a PDF; save /tmp/container_pentest-PWN.pdf'
+    expect(described_class.output_paths(request: request)).to eq(['/tmp/container_pentest-PWN.pdf'])
+    expect(described_class.output_paths(request: 'Write `i.e`')).to eq([File.expand_path('i.e')])
+  end
+
   describe 'user-path depth' do
     after { described_class.leave_user_path! while described_class.user_path? }
 
@@ -145,6 +151,7 @@ describe PWN::AI::Agent::TurnFinalizer do
 
     it 'preserves extensionless and quoted destination literals without inventing filenames' do
       expect(described_class.output_paths(request: 'Write the result to /tmp/answer')).to eq(['/tmp/answer'])
+      expect(described_class.output_paths(request: 'Are you able to mv foo to /tmp/test?')).to eq(['/tmp/test'])
       expect(described_class.output_paths(request: 'Save to "~/My Reports/answer.md"')).to eq([File.expand_path('~/My Reports/answer.md')])
       expect(described_class.output_paths(request: 'Use /tmp/source.md to write the report to ./result.md')).to eq([File.expand_path('./result.md')])
     end

data/spec/lib/pwn/ai/anthropic_vault_enrollment_spec.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+require 'stringio'
+
+RSpec.describe PWN::AI::Anthropic, 'hardware vault enrollment persistence' do
+  it 'persists initial enrollment as well as refresh without printing returned credentials' do
+    Dir.mktmpdir('anthropic-yubikey-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      path = File.join(root, 'vault')
+      config = { ai: { active: :anthropic, anthropic: { model: 'fixture-model', oauth: {} } }, driver_opts: { pwn_env_path: path } }
+      stub_const('PWN::Env', config)
+      device = double('offline YubiKey')
+      stub_const('PWN::Plugins::YubiKey', device)
+      allow(device).to receive(:challenge_response) { |opts| OpenSSL::HMAC.digest('SHA1', 'fixture-slot', opts[:challenge]) }
+      File.write(path, YAML.dump(config.except(:driver_opts)))
+      PWN::Plugins::Vault.create(file: path, yubikey: {})
+      allow(RestClient).to receive(:post).and_return(double(body: JSON.generate(access_token: 'synthetic-access-token', refresh_token: 'synthetic-refresh-token', expires_in: 3600)))
+      previous_input = $stdin
+      previous_output = $stdout
+      begin
+        $stdin = StringIO.new("synthetic-authorization-code\n")
+        $stdout = StringIO.new
+        expect(described_class.obtain_oauth_bearer_token).to eq('synthetic-access-token')
+        expect($stdout.string).not_to include('synthetic-access-token', 'synthetic-refresh-token')
+        expect(PWN::Env.dig(:ai, :anthropic, :oauth)).to include(bearer_token: 'synthetic-access-token')
+        persisted = PWN::Plugins::Vault.dump(file: path)
+        expect(persisted.dig(:ai, :anthropic, :oauth)).to include(bearer_token: 'synthetic-access-token', refresh_token: 'synthetic-refresh-token')
+        expect(File.binread(path)).to start_with(PWN::Plugins::Vault::YUBIKEY_HEADER)
+      ensure
+        $stdin = previous_input
+        $stdout = previous_output
+      end
+    end
+  end
+end

data/spec/lib/pwn/ai/cli_spec.rb

@@ -16,10 +16,9 @@ RSpec.describe 'PWN::AI::CLI' do
       session = PWN::Sessions.create(source: 'fixture')
       PWN::AI::Agent::OpenGoal.begin!(request: 'Original objective', session_id: session[:id])
       expect(PWN::Sessions).not_to receive(:create)
-      expect(PWN::AI::Agent::Loop).to receive(:run) do |opts|
+      expect(PWN::AI::CLI).to receive(:mission_request) do |opts|
         expect(opts).to include(session_id: session[:id], request: 'continue')
-        opts[:on_outcome].call(status: 'blocked')
-        'Not complete'
+        { outcome: { status: 'blocked' }, final: 'Not complete' }
       end
       expect(PWN::AI::CLI.run(argv: ['--resume-session', session[:id]], output: StringIO.new)).to eq(1)
     end
@@ -33,10 +32,9 @@ RSpec.describe 'PWN::AI::CLI' do
       File.write(path, JSON.generate(contract))
       argv = ['--replace-session', session[:id], '--ai', 'New objective', '--verification-contract', path]
       expect { PWN::AI::CLI.parse(argv: argv) }.to raise_error(OptionParser::InvalidArgument, /approve-replacement/)
-      expect(PWN::AI::Agent::Loop).to receive(:run) do |opts|
+      expect(PWN::AI::CLI).to receive(:mission_request) do |opts|
         expect(opts).to include(session_id: session[:id], request: 'New objective', verification_contract: contract)
-        opts[:on_outcome].call(status: 'complete')
-        'fixture'
+        { outcome: { status: 'complete' }, final: 'fixture' }
       end
       expect(PWN::AI::CLI.run(argv: argv + ['--approve-replacement'], output: StringIO.new)).to eq(0)
     end
@@ -90,16 +88,11 @@ RSpec.describe 'PWN::AI::CLI' do
 
   it 'promotes only with both operator acknowledgements and rolls back using the saved receipt' do
     Dir.mktmpdir('pwn-cli-policy-', '/tmp') do |root|
-      output, error, status = Open3.capture3(
-        { 'HOME' => root, 'LANG' => 'C.UTF-8' }, RbConfig.ruby,
-        File.expand_path('../../../../scripts/benchmark_policy.rb', __dir__),
-        '--heldout', '--snapshot-dir', File.join(root, 'snapshots'), unsetenv_others: true
-      )
-      expect(status.success?).to be(true), error
+      report = PWN::AI::Agent::PolicyEvaluation.export_training(dir: File.join(root, 'snapshots'))
       baseline = File.join(root, 'snapshots', 'off.json')
       candidate = File.join(root, 'snapshots', 'on.json')
       reports = File.join(root, 'reports.json')
-      File.write(reports, JSON.generate(JSON.parse(output).fetch('heldout')))
+      File.write(reports, JSON.generate(report.fetch(:heldout)))
       live = File.join(root, 'live.json')
       FileUtils.cp(baseline, live)
       argv = ['--policy', 'promote', '--baseline', baseline, '--candidate', candidate, '--reports', reports, '--live-policy', live]
@@ -201,14 +194,13 @@ RSpec.describe 'PWN::AI::CLI' do
       allow(PWN::Config).to receive(:refresh_env)
       allow(PWN::AI::Context).to receive(:ingestion_db_path).and_return(File.join(root, 'evidence.db'))
       allow_any_instance_of(Net::HTTP).to receive(:request).and_raise(Errno::ECONNREFUSED)
-      expect(PWN::AI::Agent::Loop).to receive(:run) do |args|
+      expect(PWN::AI::CLI).to receive(:mission_request) do |args|
         db = SQLite3::Database.new(File.join(root, 'evidence.db'))
         expect(db.get_first_value('SELECT count(*) FROM chunks')).to be > 0
         db.close
         expect(File.file?(File.join(root, "#{args[:session_id]}.jsonl"))).to be(true)
         expect(args[:request]).to eq('explain')
-        args.fetch(:on_outcome).call(status: 'complete', unmet: [])
-        'fixture answer'
+        { outcome: { status: 'complete', unmet: [] }, final: 'fixture answer' }
       end
       output = StringIO.new
       expect(PWN::AI::CLI.run(argv: ['--analyze', source, '--ai', 'explain'], output: output)).to eq(0)

data/spec/lib/pwn/ai/oauth_vault_persistence_spec.rb

@@ -0,0 +1,195 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe 'OAuth vault persistence' do
+  before do
+    @home = Dir.mktmpdir('pwn-oauth-vault-')
+    allow(Dir).to receive(:home).and_return(@home)
+    @path = File.join(@home, 'custom-vault')
+    @decryptor = File.join(@home, 'independent-decryptor')
+    stub_const('PWN::Env', { driver_opts: { pwn_env_path: @path, pwn_dec_path: @decryptor }, ai: {}, plugins: {} })
+    @runtime = Thread.current[:pwn_request_runtime]
+    Thread.current[:pwn_request_runtime] = nil
+    @cfg = { unrelated: 'keep', ai: {}, plugins: {} }
+    @key = Base64.strict_encode64('k' * 32)
+    @iv = Base64.strict_encode64('i' * 16)
+    allow(ENV).to receive(:fetch).and_call_original
+    allow(ENV).to receive(:fetch).with('PWN_DECRYPTOR_KEY', nil).and_return(nil)
+    allow(ENV).to receive(:fetch).with('PWN_DECRYPTOR_IV', nil).and_return(nil)
+    @selector = { yubikey: { slot: 2, serial: '123456' } }
+    @device = double('offline YubiKey')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    allow(@device).to receive(:challenge_response) do |opts|
+      expect(opts).to include(@selector[:yubikey])
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge))
+    end
+    File.write(@path, YAML.dump(@cfg))
+    PWN::Plugins::Vault.encrypt(file: @path, key: @key, iv: @iv)
+    expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+  end
+
+  after do
+    Thread.current[:pwn_request_runtime] = @runtime
+    FileUtils.remove_entry(@home)
+  end
+
+  {
+    PWN::AI::OpenAI => %i[ai openai],
+    PWN::AI::Anthropic => %i[ai anthropic],
+    PWN::AI::Grok => %i[ai grok],
+    PWN::Plugins::GoogleWorkspace => %i[plugins google_workspace]
+  }.each do |provider, config_path|
+    describe provider do
+      before do
+        @cfg[config_path.first][config_path.last] = { model: 'fixture-model', oauth: { refresh_token: 'previous-refresh' } }
+      end
+
+      it 'merges OAuth fields through the shared updater without requiring a sidecar' do
+        oauth = { bearer_token: 'rotated-access', refresh_token: 'rotated-refresh', expires_at: 123, ignored: 'do-not-persist' }
+        expect(PWN::Plugins::Vault).not_to receive(:decrypt)
+        expect(PWN::Plugins::Vault).not_to receive(:encrypt)
+        expect(PWN::Plugins::Vault).to receive(:update).with(file: @path, decryptor_file: @decryptor).and_yield(@cfg).and_return(:saved)
+
+        expect(described_class.send(:persist_oauth_to_vault, oauth: oauth)).to be(true)
+        expect(@cfg.dig(*config_path, :oauth)).to eq(oauth.except(:ignored))
+        expect(@cfg.dig(*config_path, :model)).to eq('fixture-model')
+        expect(@cfg[:unrelated]).to eq('keep')
+        expect(File).not_to exist(@decryptor)
+      end
+
+      %i[legacy hardware].each do |format|
+        it "preserves #{format} credentials and field merge semantics with ciphertext-only staging" do
+          access = format == :hardware ? @selector : { key: @key, iv: @iv }
+          File.write(@decryptor, YAML.dump(key: @key, iv: @iv)) if format == :legacy
+          @cfg.dig(*config_path, :oauth).merge!(expires_at: 42, keep: 'unchanged')
+          File.write(@path, YAML.dump(@cfg))
+          PWN::Plugins::Vault.encrypt({ file: @path }.merge(access))
+          before = File.binread(@path)
+          sidecar_before = File.binread(@decryptor) if format == :legacy
+          oauth = { bearer_token: 'rotated-access', refresh_token: nil, expires_at: nil,
+                    id_token: 'rotated-id', account_id: 'rotated-account', client_id: 'fixture-client-id',
+                    client_secret: 'fixture-client-secret', redirect_uri: 'https://example.invalid/callback', scope: 'fixture-scope', ignored: 'ignored' }
+          accepted = %i[bearer_token]
+          accepted += %i[id_token account_id] if config_path.last == :openai
+          accepted += %i[client_id client_secret redirect_uri scope] if config_path.last == :google_workspace
+          expected = Marshal.load(Marshal.dump(@cfg))
+          expected.dig(*config_path, :oauth).merge!(oauth.slice(*accepted))
+          expect(PWN::Plugins::Vault).not_to receive(:decrypt)
+          expect(PWN::Plugins::Vault).not_to receive(:encrypt)
+          expect(File).not_to receive(:write)
+          expect(Tempfile).to receive(:create).and_wrap_original do |create, *args, &block|
+            create.call(*args) do |temp|
+              expect(temp).to receive(:write).and_wrap_original do |write, bytes|
+                plaintext = PWN::Plugins::Vault.decrypt_data(access.merge(data: bytes))
+                expect(YAML.safe_load(plaintext, permitted_classes: [Symbol], symbolize_names: true)).to eq(expected)
+                expect(bytes).not_to include('rotated-access', 'fixture-client-secret')
+                expect(File.binread(@path)).to eq(before)
+                expect(temp.stat.mode & 0o777).to eq(0o600)
+                write.call(bytes)
+              end
+              block.call(temp)
+            end
+          end
+
+          expect(described_class.send(:persist_oauth_to_vault, oauth: oauth)).to be(true)
+          expect(PWN::Plugins::Vault.dump({ file: @path }.merge(access))).to eq(expected)
+          expect(File.stat(@path).mode & 0o777).to eq(0o600)
+          if format == :legacy
+            expect(File.binread(@decryptor)).to eq(sidecar_before)
+            expect(Dir.children(@home)).to match_array(%w[custom-vault independent-decryptor])
+          else
+            expect(File.binread(@path)).to start_with(PWN::Plugins::Vault::YUBIKEY_HEADER)
+            expect(Dir.children(@home)).to eq(['custom-vault'])
+          end
+        end
+      end
+
+      it 'fails closed without prompting when legacy credentials are missing' do
+        before = File.binread(@path)
+        expect(PWN::Plugins::Vault).not_to receive(:decrypt_data)
+        expect(PWN::Plugins::Vault).not_to receive(:encrypt_data)
+        expect(described_class.send(:persist_oauth_to_vault, oauth: { bearer_token: 'rotated-access' })).to be(false)
+        expect(File.binread(@path)).to eq(before)
+        expect(Dir.children(@home)).to eq(['custom-vault'])
+      end
+
+      it 'keeps ciphertext unchanged and excludes secret-bearing exception text on encryption failure' do
+        File.write(@decryptor, YAML.dump(key: @key, iv: @iv))
+        before = File.binread(@path)
+        allow(PWN::Plugins::Vault).to receive(:encrypt_data).and_raise(IOError, 'synthetic-private-error')
+        expect(PWN::Plugins::Vault).not_to receive(:decrypt)
+        expect(File).not_to receive(:write)
+        expect(Tempfile).not_to receive(:create)
+        result = nil
+
+        expect do
+          result = described_class.send(:persist_oauth_to_vault, oauth: { bearer_token: 'rotated-access' })
+        end.to output(/\A\[!\] .* OAuth vault persistence failed \(session tokens still updated\): IOError\n\z/).to_stderr
+        expect(result).to be(false)
+        expect(File.binread(@path)).to eq(before)
+        expect(Dir.children(@home)).to match_array(%w[custom-vault independent-decryptor])
+      end
+
+      it 'uses the default vault path with hardware metadata and no sidecar' do
+        default_path = File.join(@home, '.pwn', 'pwn.yaml')
+        FileUtils.mkdir_p(File.dirname(default_path))
+        File.write(default_path, YAML.dump(@cfg))
+        PWN::Plugins::Vault.encrypt({ file: default_path }.merge(@selector))
+        custom_before = File.binread(@path)
+        PWN::Env[:driver_opts] = {}
+
+        expect(described_class.send(:persist_oauth_to_vault, oauth: { bearer_token: 'rotated-access' })).to be(true)
+        expect(PWN::Plugins::Vault.dump(file: default_path).dig(*config_path, :oauth, :bearer_token)).to eq('rotated-access')
+        expect(File.binread(@path)).to eq(custom_before)
+        expect(Dir.children(File.dirname(default_path))).to eq(['pwn.yaml'])
+      end
+
+      it 'leaves hardware ciphertext unchanged when the device disappears after decryption' do
+        File.write(@path, YAML.dump(@cfg))
+        PWN::Plugins::Vault.encrypt({ file: @path }.merge(@selector))
+        before = File.binread(@path)
+        calls = 0
+        allow(@device).to receive(:challenge_response) do |opts|
+          calls += 1
+          raise IOError, 'synthetic-private-error' if calls > 1
+
+          OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge))
+        end
+        expect(PWN::Plugins::Vault).not_to receive(:decrypt)
+        expect(File).not_to receive(:write)
+        expect(Tempfile).not_to receive(:create)
+        result = nil
+
+        expect do
+          result = described_class.send(:persist_oauth_to_vault, oauth: { bearer_token: 'rotated-access' })
+        end.to output(/\A\[!\] .* OAuth vault persistence failed \(session tokens still updated\): IOError\n\z/).to_stderr
+        expect(result).to be(false)
+        expect(calls).to eq(2)
+        expect(File.binread(@path)).to eq(before)
+        expect(Dir.children(@home)).to eq(['custom-vault'])
+      end
+
+      it 'persists a rotated provider refresh token during a request runtime to a hardware vault' do
+        File.write(@path, YAML.dump(@cfg))
+        PWN::Plugins::Vault.encrypt({ file: @path }.merge(@selector))
+        runtime = double('request runtime')
+        Thread.current[:pwn_request_runtime] = runtime
+        expect(runtime).to receive(:update_provider_oauth).with(config_path.last, hash_including(bearer_token: 'rotated-access', refresh_token: 'rotated-refresh')).and_return(:updated) if config_path.first == :ai
+        allow(RestClient).to receive(:post).and_return(double(body: { access_token: 'rotated-access', refresh_token: 'rotated-refresh', expires_in: 3600 }.to_json))
+        expect(PWN::Plugins::Vault).not_to receive(:decrypt)
+        expect(PWN::Plugins::Vault).not_to receive(:encrypt)
+
+        expect(described_class.refresh_oauth_bearer_token(refresh_token: 'previous-refresh', client_id: 'fixture-id', client_secret: 'fixture-secret')).to eq('rotated-access')
+        persisted = PWN::Plugins::Vault.dump(file: @path)
+        expect(persisted.dig(*config_path, :oauth)).to include(bearer_token: 'rotated-access', refresh_token: 'rotated-refresh')
+        expect(persisted.dig(*config_path, :model)).to eq('fixture-model')
+        expect(persisted[:unrelated]).to eq('keep')
+        expect(File.binread(@path)).to start_with(PWN::Plugins::Vault::YUBIKEY_HEADER)
+        expect(File.stat(@path).mode & 0o777).to eq(0o600)
+        expect(Dir.children(@home)).to eq(['custom-vault'])
+      end
+    end
+  end
+end

data/spec/lib/pwn/ai/open_ai_spec.rb

@@ -65,14 +65,14 @@ describe PWN::AI::OpenAI do
       end
 
       it 'leaves the original vault encrypted and unchanged if re-encryption fails' do
-        allow(PWN::Plugins::Vault).to receive(:encrypt).and_raise(IOError, 'fixture write failure')
+        allow(PWN::Plugins::Vault).to receive(:encrypt_data).and_raise(IOError, 'fixture write failure')
         expect(described_class.send(:persist_oauth_to_vault, oauth: { bearer_token: 'fixture-access' })).to be(false)
         expect(File.binread(@vault_path)).to eq(@original_ciphertext)
         expect(Dir.children(@oauth_home)).to match_array(%w[pwn.yaml custom.decryptor])
       end
 
       it 'does not expose vault contents through persistence exception messages' do
-        allow(PWN::Plugins::Vault).to receive(:encrypt).and_raise(IOError, 'fixture-access in parser context')
+        allow(PWN::Plugins::Vault).to receive(:encrypt_data).and_raise(IOError, 'fixture-access in parser context')
         expect do
           described_class.send(:persist_oauth_to_vault, oauth: { bearer_token: 'fixture-access' })
         end.to output(/vault persistence failed.*IOError/).to_stderr

data/spec/lib/pwn/ai/open_web_ui_workspace_spec.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Open WebUI workspace tools' do
+  before do
+    Thread.current[:pwn_openwebui_workspace_tools] = nil
+    allow(PWN::AI::HttpRetry).to receive(:provider_config).with(engine: :openwebui).and_return(
+      { model: 'llama', temp: 1, max_prompt_length: 10_000, system_role_content: 'sys' }
+    )
+    allow(PWN::AI::OpenWebUI).to receive(:strict_system_template?).and_return(false)
+    allow(PWN::AI::OpenWebUI).to receive(:workspace_tools).and_return([{ id: 'ask_jev', name: 'Ask Jev' }])
+  end
+
+  it 'asks the server to run Ask Jev and does not send client tools' do
+    captured = nil
+    allow(PWN::AI::OpenWebUI).to receive(:openwebui_rest_call) do |opts|
+      captured = opts[:http_body]
+      { choices: [{ message: { role: 'assistant', content: '0.82 yes' } }], sources: [] }.to_json
+    end
+
+    result = PWN::AI::OpenWebUI.chat(request: 'Is the login bypassed?', server_tools: ['Ask Jev'], spinner: false)
+
+    expect(captured[:tool_ids]).to eq(['ask_jev'])
+    expect(captured[:params]).to eq({ function_calling: 'legacy' })
+    expect(captured[:stream]).to be(false)
+    expect(captured).not_to have_key(:tools)
+    expect(result[:choices].last[:content]).to eq('0.82 yes')
+  end
+
+  it 'does not run workspace tools on the proxied Ollama chat path' do
+    expect do
+      PWN::AI::OpenWebUI.chat_with_tools(messages: [{ role: 'user', content: 'hi' }], server_tools: ['Ask Jev'])
+    end.to raise_error(ArgumentError, /proxied Ollama/)
+  end
+end

data/spec/lib/pwn/ai/router_spec.rb

@@ -25,7 +25,7 @@ describe PWN::AI::Router do
     it "routes session summaries only to the active #{engine} model" do
       stub_const('PWN::Env', { ai: { active: engine.to_sym, engine.to_sym => { model: 'selected-model', key: 'fixture-key', base_uri: 'http://localhost:1234' } } })
       mod = Object.const_get(described_class::ENGINE_MOD.fetch(engine))
-      expect(mod).to receive(:chat).with(hash_including(model: 'selected-model', quiet: true, spinner: false)).and_return('{"title":"Topic","summary":"Overall conversation context."}')
+      expect(mod).to receive(:chat).with(hash_including(model: 'selected-model', quiet: true, spinner: false, timeout: 90, reasoning_effort: 'none')).and_return('{"title":"Topic","summary":"Overall conversation context."}')
       expect(described_class.summarize(text: 'Conversation', llm: true, session: true)).to include('Topic')
       expect(PWN::Env[:ai][:active]).to eq(engine.to_sym)
     end

data/spec/lib/pwn/ai/server_tools_spec.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::AI::ServerTools do
+  it 'does not invent a workspace for Ollama' do
+    expect(described_class.catalog(engine: :ollama)).to include(workspace: false, tools: [])
+    expect(described_class.call(name: 'web_search', request: 'today', engine: :ollama)).to include(available: false)
+  end
+
+  it 'keeps Ask Jev on Open WebUI when another model is active' do
+    allow(PWN::Env).to receive(:dig).and_call_original
+    allow(PWN::Env).to receive(:dig).with(:ai, :openwebui).and_return({ base_uri: 'https://ow.example', key: 'token' })
+    allow(PWN::Env).to receive(:dig).with(:ai, :active).and_return(:grok)
+    allow(PWN::AI::OpenWebUI).to receive(:workspace_tools).and_return([{ id: 'ask_jev', name: 'Ask Jev' }])
+    allow(PWN::AI::OpenWebUI).to receive(:chat).and_return({ choices: [{ role: 'assistant', content: 'yes 0.8' }], sources: [{ name: 'Ask Jev' }] })
+
+    result = described_class.call(name: 'Ask Jev', request: 'Is the login bypassed?', engine: :grok)
+
+    expect(result).to include(available: true, engine: :openwebui, content: 'yes 0.8')
+    expect(PWN::AI::OpenWebUI).to have_received(:chat).with(hash_including(server_tools: ['Ask Jev'], request: 'Is the login bypassed?'))
+  end
+
+  it 'appends a hosted tool beside client function tools' do
+    body = described_class.attach(
+      engine: :anthropic,
+      http_body: { tools: [{ name: 'shell', input_schema: { type: 'object' } }] },
+      request: { server_tools: ['web_search'] }
+    )
+    expect(body[:tools].last).to include(type: 'web_search_20250305', name: 'web_search')
+    expect(body[:tools].first[:name]).to eq('shell')
+  end
+
+  it 'refuses to mix OpenAI hosted tools into a chat-completions body' do
+    expect do
+      described_class.attach(engine: :openai, http_body: { messages: [] }, request: { server_tools: ['web_search'] })
+    end.to raise_error(ArgumentError, /Responses API/)
+  end
+end