pwn 0.5.783 → 0.5.785

data/lib/pwn/plugins.rb

@@ -111,6 +111,7 @@ module PWN
     autoload :Volatility, 'pwn/plugins/volatility'
     autoload :Vsphere, 'pwn/plugins/vsphere'
     autoload :XXD, 'pwn/plugins/xxd'
+    autoload :YubiKey, 'pwn/plugins/yubikey'
     autoload :Zaproxy, 'pwn/plugins/zaproxy'
 
     # Display a List of Every PWN::Plugins Module

data/lib/pwn/redaction.rb

@@ -4,7 +4,7 @@ require 'digest'
 require 'json'
 
 module PWN
-  # Write-boundary redaction; reject cyclic or over-100-level containers before inspecting secrets. Never opens a credential store.
+  # Write-boundary redaction; redact never opens a credential store. Capture optionally stores ordinary secrets. Hardware/MFA fields use constant masks, never digest markers or loot capture.
   module Redaction
     PATTERNS = {
       pem: /-----BEGIN [A-Z ]*PRIVATE KEY-----.*?(?:-----END [A-Z ]*PRIVATE KEY-----|\z)/m,
@@ -17,6 +17,15 @@ module PWN
       cookie: /\bSet-Cookie:\s*(?!\[REDACTED:)[^\r\n]+/i
     }.freeze
     SECRET_FIELD = /\A(?:password|passwd|secret|api[_-]?key|authorization|proxy-authorization|access[_-]?token|refresh[_-]?token|private[_-]?key|client[_-]?secret)\z/i
+    CONSTANT_MASK = '[REDACTED]'
+    MASKED_NAME = /(?:
+      (?:(?:new|current|old|admin|user|fido2?|piv|openpgp)[_-])?(?:pin|puk) |
+      access[_-]?code | management[_-]?(?:key|password) | oath[_-]?secret | static[_-]?password |
+      scp(?:03|11)?(?:[_-](?:key|keys|enc|mac|dek)(?:[_-]key)?)? |
+      (?:mfa|otp|totp|hotp)(?:[_-](?:code|token|secret))? | (?:recovery|verification)[_-]?code
+    )/ix
+    MASKED_FIELD = /\A#{MASKED_NAME}\z/
+    MASKED_TEXT = /(?<![\w-])((?:--)?["']?#{MASKED_NAME}["']?\s*(?:=>|[:=])\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\[REDACTED(?::[^\]]+)?\]|[^\s,;}\])]+)/
 
     public_class_method def self.redact(opts = {})
       value = opts[:value]
@@ -46,7 +55,9 @@ module PWN
       case value
       when Hash
         value.to_h do |key, item|
-          clean = if key.to_s.match?(SECRET_FIELD) && !item.nil?
+          clean = if key.to_s.match?(MASKED_FIELD) && !item.nil?
+                    CONSTANT_MASK
+                  elsif key.to_s.match?(SECRET_FIELD) && !item.nil?
                     token(kind: key.to_s.downcase, value: item.to_s)
                   else
                     redact_value(value: item)
@@ -55,15 +66,58 @@ module PWN
         end
       when Array then value.map { |item| redact_value(value: item) }
       when String
-        PATTERNS.reduce(value.dup) do |text, (kind, regex)|
-          text.split(/(\[REDACTED:[^:\]]+:[0-9a-f]{8}\])/).map do |part|
-            part.start_with?('[REDACTED:') ? part : part.gsub(regex) { |match| token(kind: kind, value: match) }
+        PATTERNS.reduce(mask_fields(text: value)) do |text, (kind, regex)|
+          text.split(/(\[REDACTED(?::[^:\]]+:[0-9a-f]{8})?\])/).map do |part|
+            part.start_with?('[REDACTED') ? part : part.gsub(regex) { |match| token(kind: kind, value: match) }
           end.join
         end
       else value
       end
     end
 
+    private_class_method def self.mask_fields(opts = {})
+      text = opts[:text]
+      clean = +''
+      offset = 0
+      while (match = MASKED_TEXT.match(text, offset))
+        clean << text[offset...match.begin(0)] << match[1] << CONSTANT_MASK
+        offset = masked_value_end(text: text, start: match.end(1), finish: match.end(0))
+      end
+      clean << text[offset..]
+    end
+
+    # Iterative scan prevents partial masks of serialized arrays/hashes of keys.
+    private_class_method def self.masked_value_end(opts = {})
+      text = opts[:text]
+      start = opts[:start]
+      pairs = { '[' => ']', '{' => '}' }
+      return opts[:finish] unless pairs.key?(text[start]) || ['"', "'"].include?(text[start])
+
+      stack = []
+      quote = nil
+      escaped = false
+      text[start..].each_char.with_index(start) do |char, index|
+        if quote
+          if escaped
+            escaped = false
+          elsif char == '\\'
+            escaped = true
+          elsif char == quote
+            quote = nil
+            return index + 1 if stack.empty?
+          end
+        elsif ['"', "'"].include?(char)
+          quote = char
+        elsif pairs.key?(char)
+          stack << pairs[char]
+        elsif pairs.value?(char)
+          return text.length unless stack.pop == char
+          return index + 1 if stack.empty?
+        end
+      end
+      text.length
+    end
+
     public_class_method def self.token(opts = {})
       value = opts[:value].to_s
       return value if value.match?(/\A\[REDACTED:[^:]+:[0-9a-f]{8}\]\z/)
@@ -75,19 +129,21 @@ module PWN
       value = opts[:value]
       return { redacted: redact(value: value), refs: [] } unless value.is_a?(String)
 
-      text = value.to_s
+      text = mask_fields(text: value)
       refs = []
       redacted = PATTERNS.reduce(text.dup) do |acc, (kind, regex)|
         acc.gsub(regex) do |match|
+          next match if match.match?(/\A[\w-]+\s*[:=]\s*\[REDACTED\]\z/)
+
           tok = token(kind: kind, value: match)
           refs << { kind: kind, token: tok }
-          PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
+          PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement], yubikey: opts[:yubikey]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
           tok
         rescue StandardError
           tok
         end
       end
-      redacted = capture_entropy(text: redacted, refs: refs, vault: opts[:vault], engagement: opts[:engagement]) if opts[:entropy] == true
+      redacted = capture_entropy(text: redacted, refs: refs, vault: opts[:vault], engagement: opts[:engagement], yubikey: opts[:yubikey]) if opts[:entropy] == true
       { redacted: redacted, refs: refs }
     end
 
@@ -100,10 +156,10 @@ module PWN
 
         tok = token(kind: 'entropy', value: match)
         refs << { kind: 'entropy', token: tok }
-        PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
+        PWN::Plugins::Vault.store(label: tok, secret: match, engagement: opts[:engagement], yubikey: opts[:yubikey]) if opts[:vault] != false && defined?(PWN::Plugins::Vault)
         tok
       rescue StandardError
-        match
+        tok || token(kind: 'entropy', value: match)
       end
     end
 
@@ -122,7 +178,7 @@ module PWN
 
     public_class_method def self.help
       puts "USAGE:
-        # Redact secret patterns before persistence; reject cycles/depth above 100 with JSON::NestingError.
+        # Redact before persistence; hardware/MFA fields use constant masks. Reject cycles/depth above 100 with JSON::NestingError.
         #{self}.redact(
           value: 'required - string or nested JSON-compatible data'
         )
@@ -131,10 +187,11 @@ module PWN
           kind: 'required - secret type label',
           value: 'required - sensitive value to hash'
         )
-        # Capture secrets into Vault labels and return a redacted copy.
+        # Capture ordinary secrets into Vault labels; mask hardware/MFA fields without storing them.
         #{self}.capture(
           value: 'required - string that may contain credentials',
           vault: 'optional - false skips Vault.store',
+          yubikey: 'optional - selector Hash for hardware-encrypted captured loot; no software fallback on failure',
           engagement: 'optional - engagement name stored with the vault label',
           entropy: 'optional - true also captures high-entropy tokens'
         )

data/lib/pwn/session_trace.rb

@@ -91,6 +91,10 @@ module PWN
       timeout = Float(opts.fetch(:timeout, 30))
       raise ArgumentError, 'Invalid rerun deadline' unless timeout.positive? && timeout <= 300
 
+      # A user-namespace caller that is not uid 0 may still hold capabilities.
+      # Bubblewrap rejects those. Uid 0 can already create the nested map;
+      # dropping every capability there makes the uid-map setup fail.
+      argv.unshift('setpriv', '--ambient-caps=-all', '--inh-caps=-all', '--bounding-set=-all', '--') if PWN::AI::Agent::MissionNamespace.prepared? && !Process.uid.zero?
       Open3.popen3(*argv, unsetenv_others: true, pgroup: true) do |stdin, stdout, stderr, wait|
         readers = [Thread.new { stdout.read }, Thread.new { stderr.read }]
         begin

data/lib/pwn/sessions.rb

@@ -88,11 +88,13 @@ module PWN
                      when :trace then ['traces', File.join(id, 'trace.jsonl')]
                      else raise ArgumentError, 'Invalid session support kind'
                      end
-      legacy = File.join(sessions_dir, name)
+      directory = opts[:read_only] ? SESSIONS_DIR : sessions_dir
+      legacy = File.join(directory, name)
       return legacy if File.exist?(legacy) || File.symlink?(legacy)
 
-      path = File.join(sessions_dir, 'support', folder, name)
-      return legacy unless File.exist?(path) || File.symlink?(path) || File.file?(File.join(sessions_dir, '.layout-v2'))
+      path = File.join(directory, 'support', folder, name)
+      return legacy unless File.exist?(path) || File.symlink?(path) || File.file?(File.join(directory, '.layout-v2'))
+      return path if opts[:read_only]
 
       FileUtils.mkdir_p(File.dirname(path), mode: 0o700)
       raise IOError, 'Unsafe session support directory' unless File.realpath(File.dirname(path)) == File.expand_path(File.dirname(path))
@@ -183,11 +185,31 @@ module PWN
       files.concat(Dir.glob(File.join(root, 'artifacts', '{manifest.jsonl,*/index.jsonl,*/engagement-memory.json}')))
       databases = Dir.glob(File.join(root, 'embeddings', '*.db'))
       errors.concat(%w[artifacts embeddings].map { |name| File.join(root, name) }.select { |dir| File.symlink?(dir) || (File.exist?(dir) && !File.directory?(dir)) })
+      admission = Thread.current[:pwn_maintenance_admission]
       directories.each do |dir|
         next unless File.directory?(dir) && !File.symlink?(dir)
 
-        files.concat(Dir.glob(File.join(dir, '**', '*.{json,jsonl}')).reject { |path| File.basename(path) == 'loot.json' })
-        errors.concat(Dir.glob(File.join(dir, '**', '*')).select { |path| File.symlink?(path) })
+        pending = [[dir, Dir.each_child(dir)]]
+        until pending.empty?
+          begin
+            path = File.join(pending.last[0], pending.last[1].next)
+          rescue StopIteration
+            pending.pop
+            next
+          end
+          if admission && !admission.call
+            errors << 'incomplete_dependency_index'
+            break
+          end
+          if File.symlink?(path)
+            errors << path
+          elsif File.directory?(path)
+            pending << [path, Dir.each_child(path)]
+          elsif %w[.json .jsonl].include?(File.extname(path)) && File.basename(path) != 'loot.json'
+            files << path
+          end
+        end
+        break if errors.include?('incomplete_dependency_index')
       end
       dependencies = {}
       evidence_dependencies = {}
@@ -206,12 +228,20 @@ module PWN
         errors << path
       end
       files.uniq.sort.each do |path|
+        if admission && !admission.call
+          errors << 'incomplete_dependency_index'
+          break
+        end
         next unless File.exist?(path) || File.symlink?(path)
 
         begin
           raise IOError, 'Unsafe dependency parent' if errors.any? { |parent| path.start_with?("#{parent}/") }
           raise IOError, 'Unsafe dependency store' unless File.file?(path) && File.realpath(path) == File.expand_path(path)
 
+          if admission && !admission.call(File.size(path))
+            errors << 'incomplete_dependency_index'
+            break
+          end
           bytes = File.binread(path)
           units = dependency_units(path: path, bytes: bytes)
           units.each do |locator, record|
@@ -560,9 +590,12 @@ module PWN
       sid = opts[:session_id].to_s
       raise ArgumentError, 'Invalid session ID' if sid.empty? || File.basename(sid) != sid || sid == '.' || sid == '..'
 
-      File.open(support_path(kind: :lease, session_id: sid), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |lock|
+      path = support_path(kind: :lease, session_id: sid, read_only: true)
+      File.open(path, File::RDONLY | File::NOFOLLOW) do |lock|
         !lock.flock(File::LOCK_EX | File::LOCK_NB)
       end
+    rescue Errno::ENOENT
+      false
     end
 
     # Supported Method Parameters::
@@ -752,7 +785,9 @@ module PWN
       # Character chunks keep Unicode intact, including four-byte characters.
       text.chars.each_slice(1500) do |chunk|
         output = PWN::AI::Router.summarize(text: "Previous overall summary: #{result[:summary]}\nNew conversation turns:\n#{chunk.join}", llm: true, session: true)
-        parsed = JSON.parse(output.to_s.sub(/\A```(?:json)?\s*/, '').sub(/\s*```\z/, ''), symbolize_names: true)
+        raise IOError, 'Session title provider returned no text' if output.to_s.strip.empty?
+
+        parsed = JSON.parse(output.to_s.strip.sub(/\A```(?:json)?\s*/, '').sub(/\s*```\z/, ''), symbolize_names: true)
         raise ArgumentError, 'Invalid summary response' unless parsed.is_a?(Hash) && parsed[:title].is_a?(String) && parsed[:summary].is_a?(String)
         raise ArgumentError, 'Invalid summary title' if !summary_title_valid?(title: parsed[:title]) || parsed[:summary].strip.empty?
 
@@ -835,7 +870,14 @@ module PWN
         content: content,
         timestamp: Time.now.utc.iso8601
       }
-      File.open(path, 'a') { |f| f.puts(JSON.dump(entry)) }
+      File.open("#{path}.write.lock", File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |writer|
+        writer.flock(File::LOCK_EX)
+        File.open(path, File::WRONLY | File::APPEND | File::NOFOLLOW) do |file|
+          file.puts(JSON.dump(entry))
+          file.flush
+          file.fsync
+        end
+      end
       provisional_title(session_id: sid, request: content) if role == 'user'
       entry
     ensure
@@ -1236,12 +1278,10 @@ module PWN
       return false unless File.exist?(path)
 
       lease = activate(session_id: File.basename(path, '.jsonl'))
+      writer = File.open("#{path}.write.lock", File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) # rubocop:disable Style/FileOpen -- held through atomic replace; ensure closes it
+      writer.flock(File::LOCK_EX)
       lines = File.readlines(path)
-      rows = lines.map do |l|
-        JSON.parse(l, symbolize_names: true)
-      rescue StandardError
-        nil
-      end.compact
+      rows = lines.map { |line| JSON.parse(line, symbolize_names: true) }
       return false if rows.empty?
 
       # Preserve last assistant fully-ish; compact tools and older assistants
@@ -1266,17 +1306,19 @@ module PWN
       end
       return changed if dry || !changed
 
-      tmp = "#{path}.#{Process.pid}.tmp"
-      File.open(tmp, File::WRONLY | File::CREAT | File::TRUNC, 0o600) do |f|
+      tmp = "#{path}.#{SecureRandom.hex(12)}.tmp"
+      File.open(tmp, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |f|
         f.flock(File::LOCK_EX)
         rows.each { |e| f.puts(JSON.generate(e)) }
         f.flush
         f.fsync
       end
       File.rename(tmp, path)
+      File.open(File.dirname(path), File::RDONLY, &:fsync)
       true
     ensure
       FileUtils.rm_f(tmp) if defined?(tmp) && tmp && File.exist?(tmp)
+      writer&.close
       deactivate(lease: lease)
     end
 
@@ -1358,7 +1400,7 @@ module PWN
         #{self}.list(include_hidden: 'optional - include unretained sessions for diagnostics and explicit resume', current_session_id: 'optional - include this active session regardless of naming classification', references: 'optional - precomputed structural dependency index')
 
         # Resolve housekeeping paths with legacy compatibility.
-        #{self}.support_path(kind: 'required - metadata, lease, owner or trace', session_id: 'required - support record identifier')
+        #{self}.support_path(kind: 'required - metadata, lease, owner or trace', session_id: 'required - support record identifier', read_only: 'optional - resolve without creating session or support directories')
 
         # Page retained sessions separately from global store diagnostics.
         #{self}.catalog(offset: 'optional - nonnegative retained session offset, omitted selects newest page', limit: 'optional - page size from one to 200, defaults 25 plus active row if outside page', current_session_id: 'optional - active session id always included without granting retention')

data/lib/pwn/setup.rb

@@ -129,10 +129,44 @@ module PWN
       }
     }.freeze
 
+    # Optional runtime libraries, not executables or Ruby build dependencies.
+    # macOS provides PC/SC as a system framework. Linux PC/SC also needs a
+    # daemon and CCID reader driver for actual I/O; doctor only loads libraries.
+    NATIVE_LIBRARIES = {
+      'hidapi' => {
+        apt: %w[libhidapi-hidraw0], dnf: %w[hidapi], pacman: %w[hidapi],
+        brew: %w[hidapi], port: %w[hidapi],
+        libraries: {
+          unix: %w[libhidapi-hidraw.so.0 libhidapi-hidraw.so libhidapi-libusb.so.0 libhidapi-libusb.so libhidapi.so],
+          macos: %w[libhidapi.dylib /opt/homebrew/lib/libhidapi.dylib /usr/local/lib/libhidapi.dylib /opt/local/lib/libhidapi.dylib],
+          windows: %w[hidapi.dll]
+        },
+        plugins: %w[PWN::Plugins::YubiKey]
+      },
+      'pcsc' => {
+        apt: %w[libpcsclite1 pcscd libccid], dnf: %w[pcsc-lite-libs pcsc-lite pcsc-lite-ccid],
+        pacman: %w[pcsclite ccid], brew: %w[], port: %w[],
+        libraries: {
+          unix: %w[libpcsclite.so.1 libpcsclite.so],
+          macos: %w[/System/Library/Frameworks/PCSC.framework/PCSC],
+          windows: %w[winscard.dll]
+        },
+        plugins: %w[PWN::Plugins::YubiKey]
+      }
+    }.freeze
+
     # External binaries PWN wraps → OS packages that provide them.
     # (Extrospection.probe_toolchain already knows how to *detect* these;
     #  this table knows how to *install* them.)
     TOOLCHAIN = {
+      'setpriv' => {
+        apt: %w[util-linux], dnf: %w[util-linux], pacman: %w[util-linux], brew: %w[], port: %w[],
+        plugins: %w[PWN::SessionTrace]
+      },
+      'unshare' => {
+        apt: %w[util-linux], dnf: %w[util-linux], pacman: %w[util-linux], brew: %w[], port: %w[],
+        plugins: %w[PWN::AI::Agent::MissionNamespace]
+      },
       'nmap' => {
         apt: %w[nmap], dnf: %w[nmap], pacman: %w[nmap], brew: %w[nmap], port: %w[nmap],
         plugins: %w[PWN::Plugins::NmapIt]
@@ -408,7 +442,7 @@ module PWN
       ai: {
         desc: 'verify at least one AI engine key/oauth in ~/.pwn/pwn.yaml',
         gems: %w[],
-        bins: %w[jq]
+        bins: %w[jq unshare setpriv]
       },
       web: {
         desc: 'TransparentBrowser · BurpSuite · Zaproxy · extro_verify · extro_watch',
@@ -446,9 +480,10 @@ module PWN
         bins: %w[msfconsole sqlmap]
       },
       hardware: {
-        desc: 'Serial · BusPirate · Android · BareSIP · extro_serial · extro_telecomm',
+        desc: 'Serial · BusPirate · Android · BareSIP · YubiKey · extro_serial · extro_telecomm',
         gems: %w[libusb],
-        bins: %w[adb baresip]
+        bins: %w[adb baresip],
+        libs: %w[hidapi pcsc]
       },
       re: {
         desc: 'Radare2 · GDB · ExploitDev · Frida · Android RE tier',
@@ -458,7 +493,8 @@ module PWN
       full: {
         desc: 'everything above',
         gems: NATIVE_GEMS.keys,
-        bins: TOOLCHAIN.keys
+        bins: TOOLCHAIN.keys,
+        libs: NATIVE_LIBRARIES.keys
       }
     }.freeze
 
@@ -572,15 +608,23 @@ module PWN
       io.puts
 
       # ~/.pwn -----------------------------------------------------------
-      pwn_root  = File.join(Dir.home, '.pwn')
-      pwn_yaml  = File.join(pwn_root, 'pwn.yaml')
-      pwn_dec   = File.join(pwn_root, 'pwn.yaml.decryptor')
+      pwn_root = File.join(Dir.home, '.pwn')
+      driver = defined?(PWN::Env) && PWN::Env.is_a?(Hash) ? PWN::Env[:driver_opts] : nil
+      driver = {} unless driver.is_a?(Hash)
+      pwn_yaml  = driver[:pwn_env_path] || File.join(pwn_root, 'pwn.yaml')
+      pwn_dec   = driver[:pwn_dec_path] || "#{pwn_yaml}.decryptor"
       root_ok   = File.directory?(pwn_root)
       root_note = root_ok ? "(#{Dir.children(pwn_root).length} entries)" : '(will be created on first `pwn` launch)'
       io.puts "#{'~/.pwn/'.ljust(26)} #{root_ok ? OK : MISS}   #{root_note}"
       yaml_ok   = File.file?(pwn_yaml)
       dec_state = File.file?(pwn_dec) ? 'present' : 'MISSING'
-      yaml_note = yaml_ok ? "(encrypted, decryptor #{dec_state})" : '(run `pwn` once, then `pwn-vault` to configure)'
+      yaml_note = if !yaml_ok
+                    '(run `pwn` once, then `pwn-vault` to configure)'
+                  elsif PWN::Plugins::Vault.hardware_encrypted?(file: pwn_yaml)
+                    '(YubiKey encrypted; no software decryptor required)'
+                  else
+                    "(encrypted, decryptor #{dec_state})"
+                  end
       io.puts "#{'~/.pwn/pwn.yaml'.ljust(26)} #{yaml_ok ? OK : MISS}   #{yaml_note}"
       engine = ai_active_engine
       key_ok = ai_key_configured?(engine: engine)
@@ -603,6 +647,20 @@ module PWN
       end
       io.puts
 
+      # Runtime libraries ------------------------------------------------
+      io.puts 'Native libraries (host loading only; no device discovery)'
+      lib_missing = []
+      NATIVE_LIBRARIES.each do |name, meta|
+        ok = native_library_available?(name: name, os: os)
+        lib_missing << name unless ok
+        packages = Array(meta[pm[:key]])
+        hint = packages.empty? ? 'native OS library; see hardware profile' : packages.join(' ')
+        need = ok ? '' : "(needs: #{hint})"
+        io.puts "  #{name.ljust(14)} #{ok ? OK : MISS}  #{need} → #{Array(meta[:plugins]).join(', ')}"
+      end
+      io.puts '  Library presence does not verify device permissions, PC/SC service, reader or token readiness.'
+      io.puts
+
       # Toolchain --------------------------------------------------------
       io.puts "#{'External toolchain'.ljust(46)} used by"
       bin_missing = []
@@ -621,36 +679,41 @@ module PWN
         io.puts
       end
 
-      total   = NATIVE_GEMS.size + TOOLCHAIN.size
-      missing = gem_missing.size + bin_missing.size
+      total   = NATIVE_GEMS.size + TOOLCHAIN.size + NATIVE_LIBRARIES.size
+      missing = gem_missing.size + bin_missing.size + lib_missing.size
       io.puts "#{total - missing} / #{total} capabilities usable · #{missing} degraded"
       io.puts
       unless missing.zero?
-        io.puts 'Run `pwn setup --deps` to install missing OS headers/tools, or'
+        io.puts 'Run `pwn setup --deps` to install missing OS headers/tools/libraries, or'
         io.puts '    `pwn setup --profile <name>` for a subset. See `pwn setup --list-profiles`.'
       end
 
       # When a profile is given (`pwn setup --check --profile core`), :ok is
-      # gated ONLY on that profile's gems/bins so a partially-provisioned host
+      # gated ONLY on that profile's gems/bins/libs so a partially-provisioned host
       # can still pass its own doctor gate. `packer/provisioners/pwn.sh` and
       # spec/integration/fresh_install_spec.rb rely on this — a `core` leg of
       # install-matrix must not fail because gqrx/burpsuite/etc. are absent.
       gate_gems = gem_missing
       gate_bins = bin_missing
+      gate_libs = lib_missing
       if profile && PROFILES.key?(profile)
         prof      = PROFILES[profile]
         gate_gems = gem_missing & Array(prof[:gems])
         gate_bins = bin_missing & Array(prof[:bins])
+        gate_libs = lib_missing & Array(prof[:libs])
         io.puts
+        library_note = ", libs: #{gate_libs.empty? ? '—' : gate_libs.join(' ')}" unless Array(prof[:libs]).empty?
         io.puts "Profile '#{profile}' gate: " \
-                "#{gate_gems.empty? && gate_bins.empty? ? OK : MISS} " \
+                "#{gate_gems.empty? && gate_bins.empty? && gate_libs.empty? ? OK : MISS} " \
                 "(gems: #{gate_gems.empty? ? '—' : gate_gems.join(' ')}, " \
-                "bins: #{gate_bins.empty? ? '—' : gate_bins.join(' ')})"
+                "bins: #{gate_bins.empty? ? '—' : gate_bins.join(' ')}" \
+                "#{library_note})"
       end
 
-      { ok: gate_gems.empty? && gate_bins.empty? && Array(migrate && migrate[:incompatible]).empty?,
+      { ok: gate_gems.empty? && gate_bins.empty? && gate_libs.empty? && Array(migrate && migrate[:incompatible]).empty?,
         native_gems_missing: gem_missing, toolchain_missing: bin_missing,
-        state: migrate, pkg_manager: pm[:key], os: os, arch: arch }
+        state: migrate, pkg_manager: pm[:key], os: os, arch: arch,
+        native_libraries_missing: lib_missing }
     rescue StandardError => e
       raise e
     end
@@ -690,6 +753,7 @@ module PWN
       bins     = Array(prof[:bins])
       os_pkgs  = []
       gems.each { |g| os_pkgs.concat(Array(NATIVE_GEMS.dig(g, pm[:key]))) }
+      Array(prof[:libs]).each { |lib| os_pkgs.concat(Array(NATIVE_LIBRARIES.dig(lib, pm[:key]))) }
       bins.each { |b| os_pkgs.concat(packages_for(bin: b, distro: distro, version: version, pm_key: pm[:key])) }
       os_pkgs = os_pkgs.reject(&:empty?).uniq
       alts = alt_install_cmds(bins: bins, pm_key: pm[:key], distro: distro, version: version)
@@ -765,7 +829,7 @@ module PWN
     #      third_party/terminator/pwn_shift_enter.py to
     #      ~/.config/terminator/plugins/ and enables the PWNShiftEnter
     #      plugin in ~/.config/terminator/config — WITH confirmation and
-    #      a .pwnbak backup. This is the only VTE emulator we can fix at
+    #      a shared recovery backup. This is the only VTE emulator we can fix at
     #      the GTK layer without patching libvte itself.
     #
     # Everything here is host-config mutation, which is why it lives in
@@ -831,7 +895,7 @@ module PWN
       io.puts
       io.puts "    write   #{plugin_dst}"
       io.puts "    edit    #{cfg_path}   (add PWNShiftEnter to enabled_plugins)"
-      io.puts "    backup  #{cfg_path}.pwnbak"
+      io.puts '    backup  ~/.pwn/backup (shared seven-generation store)'
       io.puts
 
       unless yes
@@ -858,7 +922,7 @@ module PWN
         if cfg.include?('PWNShiftEnter')
           io.puts "  #{OK} PWNShiftEnter already enabled in #{cfg_path}"
         else
-          FileUtils.cp(cfg_path, "#{cfg_path}.pwnbak") unless File.exist?("#{cfg_path}.pwnbak")
+
           new_cfg =
             if cfg =~ /^\s*enabled_plugins\s*=\s*(.*)$/
               cfg.sub(/^(\s*enabled_plugins\s*=\s*)(.*)$/) do
@@ -871,8 +935,11 @@ module PWN
             else
               "[global_config]\n  enabled_plugins = PWNShiftEnter\n#{cfg}"
             end
-          File.write(cfg_path, new_cfg)
-          io.puts "  #{OK} enabled PWNShiftEnter in #{cfg_path} (backup: config.pwnbak)"
+          PWN::Backups.transaction do
+            backup = PWN::Backups.capture(path: cfg_path, label: 'terminator')
+            File.write(cfg_path, new_cfg)
+            io.puts "  #{OK} enabled PWNShiftEnter in #{cfg_path} (backup: #{backup})"
+          end
         end
       else
         FileUtils.mkdir_p(File.dirname(cfg_path))
@@ -900,6 +967,7 @@ module PWN
         io.puts "  #{name.to_s.ljust(10)} #{meta[:desc]}"
         io.puts "  #{''.ljust(10)}   gems: #{meta[:gems].join(' ')}" unless meta[:gems].empty?
         io.puts "  #{''.ljust(10)}   bins: #{meta[:bins].join(' ')}" unless meta[:bins].empty?
+        io.puts "  #{''.ljust(10)}   libs: #{meta[:libs].join(' ')}" unless Array(meta[:libs]).empty?
         io.puts
       end
       PROFILES.keys
@@ -998,6 +1066,28 @@ module PWN
       ''
     end
 
+    private_class_method def self.native_library_available?(opts = {})
+      require 'ffi'
+      os = opts[:os].to_s
+      platform = if os.match?(/darwin|osx|macos/i)
+                   :macos
+                 elsif os.match?(/mswin|mingw|cygwin|windows/i)
+                   :windows
+                 else
+                   :unix
+                 end
+      libraries = NATIVE_LIBRARIES.fetch(opts[:name]).fetch(:libraries).fetch(platform)
+      flags = ::FFI::DynamicLibrary::RTLD_LAZY | ::FFI::DynamicLibrary::RTLD_LOCAL
+      libraries.any? do |library|
+        ::FFI::DynamicLibrary.open(library, flags)
+        true
+      rescue LoadError
+        false
+      end
+    rescue LoadError
+      false
+    end
+
     private_class_method def self.gem_loadable?(opts = {})
       name = opts[:name].to_s
       Gem::Specification.find_by_name(name)
@@ -1047,22 +1137,20 @@ module PWN
       end
 
       if dry_run
-        st = PWN::Cron.scheduler_status(apply: false)
+        st = { worker: PWN::Cron.worker_status, backend: :worker }
         io.puts "#{'cron worker'.ljust(26)} #{st.dig(:worker, :running) ? OK : MISS}   (dry-run, backend=#{st[:backend]}, enabled=#{enabled})"
         return { ok: true, dry_run: true, worker: st[:worker], backend: st[:backend], enabled: enabled }
       end
 
       unless enabled
-        native = begin
-          PWN::Cron.uninstall_scheduler(apply: opts.fetch(:apply, PWN::Cron.apply_native?))
-        rescue StandardError => e
-          io.puts "#{'cron scheduler'.ljust(26)} #{MISS}   #{e.class}: #{e.message}"
-          { ok: false, error: "#{e.class}: #{e.message}" }
-        end
+        PWN::Cron.persist_scheduler_config(enabled: false)
+        worker = PWN::Cron.stop_worker
+        native = { backend: :worker, worker: worker }
         io.puts "#{'cron scheduler'.ljust(26)} #{OK}   disabled (#{native[:backend] || 'none'})"
         return { ok: true, enabled: false, native: native, seeded: [] }
       end
 
+      PWN::Cron.persist_scheduler_config(enabled: true) if opts.key?(:enabled)
       seeded = begin
         PWN::Cron.install_defaults
       rescue StandardError => e
@@ -1078,6 +1166,7 @@ module PWN
           seeded: seeded,
           worker: live.merge(already_running: true),
           skipped_spawn: true,
+          backend: :worker,
           enabled: true
         }
       end
@@ -1097,16 +1186,9 @@ module PWN
       mark = st[:running] ? OK : MISS
       io.puts "#{'cron worker'.ljust(26)} #{mark}   #{label} pid=#{st[:pid] || worker[:pid] || 'none'}"
 
-      native = begin
-        PWN::Cron.install_scheduler(
-          enabled: true,
-          apply: opts.fetch(:apply, PWN::Cron.apply_native?)
-        )
-      rescue StandardError => e
-        io.puts "#{'cron scheduler'.ljust(26)} #{MISS}   #{e.class}: #{e.message}"
-        { ok: false, error: "#{e.class}: #{e.message}" }
-      end
-      backend = native.is_a?(Hash) ? native[:backend] : nil
+      # Setup never installs, starts, removes or repairs native schedulers.
+      native = { ok: true, backend: :worker, persisted: false }
+      backend = :worker
       io.puts "#{'cron scheduler'.ljust(26)} #{native[:ok] == false ? MISS : OK}   backend=#{backend || 'none'}"
 
       {
@@ -1145,13 +1227,13 @@ module PWN
           pm_key: 'optional - package-manager family (:apt :dnf :pacman :brew :port :pkg)'
         )
 
-        # Run check and return its result
+        # Check gems, binaries and native host libraries; native_libraries_missing reports HIDAPI/PCSC without device discovery.
         #{self}.check(
           io: 'optional - IO to write the report to (default $stdout)',
-          profile: 'optional - profile value consumed by #check'
+          profile: 'optional - gate only this profile; core never requires hardware libraries'
         )
 
-        # Install OS packages + native gems for a capability profile.
+        # Install OS packages and gems; hardware/full add HIDAPI and PC/SC, not a Python or executable YubiKey backend.
         #{self}.deps(
           profile: 'optional - one of PROFILES.keys (default :full)',
           yes: 'optional - non-interactive; assume yes to prompts (default false)',