pwn 0.5.783 → 0.5.785

data/spec/lib/pwn/plugins/repl/ai_legacy_containment_spec.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'timeout'
+
+describe 'regex-ReAct mission containment' do
+  include_context 'pwn tmp sandbox'
+
+  let(:repl) { PWN::Plugins::REPL }
+  let(:request) { +'offline legacy request' }
+  let(:pry) { double('pry', config: Pry::Config.new, input: double('input', line_buffer: request)) }
+
+  before do
+    allow(Dir).to receive(:home).and_return(@tmp)
+    @work = File.join(@tmp, 'work')
+    FileUtils.mkdir_p(@work)
+    allow(repl).to receive(:ready_tty!)
+    allow(PWN::Memory).to receive(:to_context).and_return('')
+    PWN::Env[:ai] = { active: :ollama, agent: { native_tools: false }, ollama: { response_history: { id: 'before' } } }
+    pry.config.pwn_ai = true
+    pry.config.pwn_ai_agent = true
+    allow(Pry.config).to receive(:hooks).and_return(Pry::Hooks.new)
+    repl.add_hooks
+  end
+
+  def submit
+    Pry.config.hooks.get_hook(:after_read, :pwn_ai_hook).call(request, pry)
+  end
+
+  it 'fails closed before calling a provider when mission containment is unavailable' do
+    allow(PWN::Plugins::AISandbox::MissionProcess).to receive(:new).and_raise(PWN::Plugins::AISandbox::NotStarted, 'enable user/PID namespaces')
+    expect(PWN::AI::Ollama).not_to receive(:chat)
+    expect { submit }.to output(%r{enable user/PID namespaces.*no uncontained retry}).to_stderr
+    expect(request).to eq('nil')
+    expect(PWN::Env.dig(:ai, :ollama, :response_history)).to eq(id: 'before')
+    expect(repl).to have_received(:ready_tty!)
+  end
+
+  it 'does not enter regex fallback after a failed native mission' do
+    PWN::Env[:ai][:agent][:native_tools] = true
+    allow(repl).to receive(:pwn_ai_run_steerable).and_raise(IOError, 'mission unavailable')
+    expect(repl).not_to receive(:pwn_ai_run_legacy)
+    expect(PWN::AI::Ollama).not_to receive(:chat)
+    expect { submit }.to output(/native agent loop failed/).to_stderr
+    expect(request).to eq('nil')
+  end
+
+  it 'does not retry a failed legacy provider in the controller or replace committed history' do
+    marker = File.join(@tmp, 'provider-calls')
+    allow(PWN::AI::Ollama).to receive(:chat) do
+      File.open(marker, 'a') { |file| file.puts(File.read('/proc/self/status')[/^NSpid:.*$/]) }
+      raise IOError, 'offline provider failed'
+    end
+    expect { submit }.to output(/offline provider failed.*no uncontained retry/).to_stderr
+    expect(File.readlines(marker).length).to eq(1)
+    expect(File.read(marker).split.length).to be > 2
+    expect(PWN::Env.dig(:ai, :ollama, :response_history)).to eq(id: 'before')
+    expect(request).to eq('nil')
+    expect(repl).to have_received(:ready_tty!)
+  end
+
+  it 'runs the fake provider and Ruby block in a real mission and returns history to the controller' do
+    marker = File.join(PWN::Plugins::AISandbox.workspace, 'tool-owner')
+    diagnostic = File.join(@tmp, 'provider-observation')
+    calls = 0
+    allow(PWN::AI::Ollama).to receive(:chat) do |options|
+      calls += 1
+      File.write(diagnostic, options[:request].to_s) if calls > 1
+      text = calls == 1 ? "```ruby\nFile.write(#{marker.inspect}, File.read('/proc/self/status'))\n```" : 'offline complete'
+      { id: 'after', choices: [{ content: text }] }
+    end
+    submit
+    expect(File).to exist(marker), File.read(diagnostic)
+    expect(File.read(marker)[/^NSpid:.*$/].split.length).to be > 2
+    expect(calls).to eq(0)
+    expect(PWN::Env.dig(:ai, :ollama, :response_history, :id)).to eq('after')
+    expect(request).to eq('nil')
+  end
+
+  %w[ruby bash].each do |language|
+    it "denies protected source writes through the actual legacy #{language} hook" do
+      source = File.join(@tmp, 'synthetic-source')
+      FileUtils.mkdir_p(source)
+      target = File.join(source, 'forbidden.txt')
+      original = PWN::Plugins::AISandbox.protected_roots
+      allow(PWN::Plugins::AISandbox).to receive(:protected_roots).and_return([source, *original])
+      code = language == 'ruby' ? "File.write(#{target.inspect}, 'forbidden')" : "printf forbidden > #{target.shellescape}"
+      calls = 0
+      allow(PWN::AI::Ollama).to receive(:chat) do
+        calls += 1
+        { choices: [{ content: calls == 1 ? "```#{language}\n#{code}\n```" : 'completed' }] }
+      end
+      submit
+      expect(File).not_to exist(target)
+      expect(request).to eq('nil')
+    end
+  end
+
+  it 'cancels regex-ReAct with a real PTY CTRL+C and completes the next submitted mission' do
+    require 'pty'
+    script = File.join(@tmp, 'regex_pty.rb')
+    File.write(script, <<~'RUBY')
+      require 'pwn'
+      require 'pry'
+      require 'ostruct'
+      require 'fileutils'
+      $stdout.sync = true
+      work = ARGV.fetch(0)
+      runtime = File.join(Dir.home, '.pwn', 'workspaces', 'runtime')
+      FileUtils.mkdir_p(runtime)
+      PWN::Env[:ai] = { active: :ollama, ollama: {} }
+      PWN::Memory.define_singleton_method(:to_context) { |*| '' }
+      PWN::AI::Ollama.define_singleton_method(:chat) do |opts|
+        if opts[:request] == 'second'
+          { id: 'second', choices: [{ content: 'SECOND COMPLETE' }] }
+        else
+          payload = "Process.setsid; File.write(#{File.join(runtime, 'pty-ready').inspect}, File.read('/proc/self/status')); sleep 1; File.write(#{File.join(runtime, 'pty-late').inspect}, 'late'); sleep 30"
+          code = "Process.spawn(#{RbConfig.ruby.inspect}, '-e', #{payload.inspect}, out: File::NULL, err: File::NULL); sleep 30"
+          { choices: [{ content: "```ruby\n#{code}\n```" }] }
+        end
+      end
+      pi = OpenStruct.new(config: OpenStruct.new(pwn_ai_agent: true))
+      begin
+        PWN::Plugins::REPL.pwn_ai_run_legacy(request: +'first', original_request: 'first', pry: pi)
+      rescue Interrupt
+        puts 'CANCELLED READY'
+      end
+      next_request = $stdin.gets.to_s.strip
+      PWN::Plugins::REPL.pwn_ai_run_legacy(request: next_request.dup, original_request: next_request, pry: pi)
+      puts "HISTORY #{PWN::Env.dig(:ai, :ollama, :response_history, :id)}"
+    RUBY
+    output = +''
+    reader, writer, pid = PTY.spawn({ 'HOME' => @tmp }, RbConfig.ruby, '-I', File.expand_path('../../../../../lib', __dir__), script, @work)
+    drain = Thread.new do
+      loop { output << reader.readpartial(4096) }
+    rescue EOFError, Errno::EIO
+      nil
+    end
+    marker = File.join(@tmp, '.pwn', 'workspaces', 'runtime', 'pty-ready')
+    Timeout.timeout(10) { sleep 0.01 until File.exist?(marker) }
+    host_pid = File.read(marker)[/^NSpid:\s+(\d+)/, 1].to_i
+    writer.write("\x03")
+    Timeout.timeout(10) { sleep 0.01 until output.include?('CANCELLED READY') }
+    expect { Process.kill(0, host_pid) }.to raise_error(Errno::ESRCH)
+    writer.write("second\n")
+    Timeout.timeout(10) { Process.wait(pid) }
+    pid = nil
+    drain.join(5)
+    expect(output).to include('SECOND COMPLETE', 'HISTORY second')
+    sleep 1.1
+    expect(File).not_to exist(File.join(@tmp, '.pwn', 'workspaces', 'runtime', 'pty-late'))
+  ensure
+    if pid
+      begin
+        Process.kill('KILL', pid)
+      rescue StandardError
+        nil
+      end
+      begin
+        Process.wait(pid)
+      rescue StandardError
+        nil
+      end
+    end
+    [reader, writer].compact.each { |io| io.close unless io.closed? }
+    drain&.join(5)
+  end
+
+  %w[ruby bash].each do |language|
+    it "kills a detached #{language} descendant on interrupt before ready, then accepts another request" do
+      marker = File.join(PWN::Plugins::AISandbox.workspace, 'detached')
+      late = File.join(PWN::Plugins::AISandbox.workspace, 'late')
+      payload = "Process.setsid; File.write(#{marker.inspect}, File.read('/proc/self/status')); sleep 1; File.write(#{late.inspect}, 'escaped'); sleep 30"
+      ruby_code = "Process.spawn(#{RbConfig.ruby.inspect}, '-e', #{payload.inspect}, out: File::NULL, err: File::NULL); sleep 30"
+      code = language == 'ruby' ? ruby_code : [RbConfig.ruby, '-e', ruby_code].shelljoin
+      allow(PWN::AI::Ollama).to receive(:chat).and_return(choices: [{ content: "```#{language}\n#{code}\n```" }])
+      worker = Thread.new do
+        submit
+      rescue Interrupt
+        :cancelled
+      end
+      Timeout.timeout(10) { sleep 0.01 until File.exist?(marker) }
+      host_pid = File.read(marker)[/^NSpid:\s+(\d+)/, 1].to_i
+      worker.raise(Interrupt)
+      expect(Timeout.timeout(10) { worker.value }).to eq(:cancelled)
+      expect(repl).to have_received(:ready_tty!)
+      expect { Process.kill(0, host_pid) }.to raise_error(Errno::ESRCH)
+      sleep 1.1
+      expect(File).not_to exist(late)
+      allow(PWN::AI::Ollama).to receive(:chat).and_return(id: 'second', choices: [{ content: 'second complete' }])
+      request.replace('second request')
+      submit
+      expect(PWN::Env.dig(:ai, :ollama, :response_history, :id)).to eq('second')
+      expect(request).to eq('nil')
+    ensure
+      worker&.raise(Interrupt) if worker&.alive?
+      worker&.join(10)
+    end
+  end
+end

data/spec/lib/pwn/plugins/repl/ai_swarm_spec.rb

@@ -5,6 +5,17 @@ require 'spec_helper'
 describe PWN::Plugins::REPL::AISwarm::Controller do
   include_context 'pwn tmp sandbox'
 
+  it 'routes explicit continuation retirement through the slash command without changing ordinary retire' do
+    controller = described_class.new(session_id: 'fixture')
+    allow(PWN::AI::Agent::Swarm).to receive(:create).and_return(swarm_id: 'fixture-swarm')
+    expect(PWN::AI::Agent::Swarm).to receive(:retire).with(hash_including(name: 'scout', continuation: true)).and_return(retired: true)
+    expect(PWN::AI::Agent::Swarm).to receive(:retire).with(hash_including(name: 'critic', continuation: false)).and_return(retired: true)
+    controller.execute(line: '/swarm retire scout --continuation')
+    controller.execute(line: '/swarm retire critic')
+  ensure
+    controller&.close
+  end
+
   it 'retains cancellation evidence and forwards bounded mission options unchanged' do
     allow(PWN::AI::Agent::Swarm).to receive(:solve) do |opts|
       expect(opts).to include(worktree: true, rounds: 2, verification_timeout: 120, role_timeout: 45)
@@ -89,7 +100,7 @@ describe PWN::Plugins::REPL::AISwarm::Controller do
     controller = described_class.new(session_id: 'fixture')
     controller.execute(line: "/swarm mission #{request}")
     controller.send(:workers).each(&:join)
-    expect(controller.snapshot[:jobs].first).to include(state: 'incomplete', team: include(roles: include(protagonist: 'build')))
+    expect(controller.snapshot[:jobs].first).to include(state: 'incomplete', team: include(roles: include('protagonist' => 'build')))
   ensure
     controller&.close
   end
@@ -120,20 +131,20 @@ describe PWN::Plugins::REPL::AISwarm::Controller do
   end
 
   it 'owns model interrupts on the job thread and copies request-local routing' do
-    entered = Queue.new
+    entered = PWNTestPipeQueue.new
     allow(PWN::AI::Agent::Swarm).to receive(:create).and_return(swarm_id: 'fixture')
     Thread.current[:pwn_workspace_fixture] = :copied
     allow(PWN::AI::Agent::Swarm).to receive(:ask) do |opts|
       control = opts[:steering]
-      entered << [control.instance_variable_get(:@owner), Thread.current, Thread.current[:pwn_workspace_fixture], Thread.current[:pwn_steering_input]]
+      entered << [control.instance_variable_get(:@owner) == Thread.current, Thread.current[:pwn_workspace_fixture], Thread.current[:pwn_steering_input].is_a?(PWN::Plugins::REPL::AISwarm::JobControl)]
       { reply: 'done' }
     end
     controller = described_class.new(session_id: 'fixture')
     controller.execute(line: '/swarm dm scout inspect')
-    owner, worker, local, marker = entered.pop
-    expect(owner).to eq(worker)
-    expect(local).to eq(:copied)
-    expect(marker).to be_a(PWN::Plugins::REPL::AISwarm::JobControl)
+    owner_matches, local, marker = entered.pop
+    expect(owner_matches).to be(true)
+    expect(local).to eq('copied')
+    expect(marker).to be(true)
   ensure
     controller&.close
     Thread.current[:pwn_workspace_fixture] = nil
@@ -141,9 +152,9 @@ describe PWN::Plugins::REPL::AISwarm::Controller do
 
   it 'passes prior speakers to debate, preserves literal flag-like missions, and retains failures' do
     allow(PWN::AI::Agent::Swarm).to receive(:create).and_return(swarm_id: 'fixture')
-    calls = []
+    recorded = PWNTestPipeQueue.new
     allow(PWN::AI::Agent::Swarm).to receive(:ask) do |opts|
-      calls << opts
+      recorded << opts.slice(:request, :name)
       raise IOError, 'fixture unavailable' if opts[:name] == 'broken'
 
       { reply: "reply from #{opts[:name]}" }
@@ -151,6 +162,8 @@ describe PWN::Plugins::REPL::AISwarm::Controller do
     controller = described_class.new(session_id: 'fixture')
     controller.execute(line: '/swarm debate scout,critic "--literal mission"')
     controller.send(:workers).each(&:join)
+    calls = []
+    calls << recorded.pop until recorded.empty?
     expect(calls.first[:request]).to eq('--literal mission')
     expect(calls.last[:request]).to include('reply from scout', '--literal mission')
     controller.execute(line: '/swarm dm broken inspect')
@@ -161,7 +174,7 @@ describe PWN::Plugins::REPL::AISwarm::Controller do
   end
 
   it 'cancels only its owned blocked model and cannot switch swarms while it runs' do
-    entered = Queue.new
+    entered = PWNTestPipeQueue.new
     foreign = Thread.new { sleep }
     allow(PWN::AI::Agent::Swarm).to receive(:create).and_return(swarm_id: 'fixture')
     allow(PWN::AI::Agent::Swarm).to receive(:ask) do |opts|
@@ -188,12 +201,13 @@ describe PWN::Plugins::REPL::AISwarm::Controller do
   end
 
   it 'runs, steers, and cancels a persona through the existing Swarm API' do
-    entered = Queue.new
+    entered = PWNTestPipeQueue.new
     allow(PWN::AI::Agent::Swarm).to receive(:ask) do |opts|
-      entered << opts[:steering]
+      entered << true
       opts[:on_tool].call('shell', { command: 'true' }, '{"success":true}')
-      sleep 0.01 until opts[:steering].instance_variable_get(:@stopping)
-      raise PWN::Plugins::REPL::AISwarm::JobControl::Stopped, 'cancelled'
+      sleep 0.01 while opts[:steering].instance_variable_get(:@pending).empty?
+      entered << opts[:steering].instance_variable_get(:@pending)
+      sleep 30
     end
     events = Queue.new
     controller = described_class.new(session_id: 'console-session')
@@ -201,11 +215,11 @@ describe PWN::Plugins::REPL::AISwarm::Controller do
     allow(PWN::AI::Agent::Swarm).to receive(:spawn).and_return(name: 'scout')
     controller.execute(line: '/swarm spawn scout inspect evidence')
     queued = controller.execute(line: '/swarm dm scout inspect the fixture', on_event: ->(type, text) { events << [type, text] })
-    steering = entered.pop
+    expect(entered.pop).to be(true)
     expect(queued[:ok]).to eq(true)
     expect(controller.snapshot[:jobs].first[:state]).to eq('running')
     controller.execute(line: "/swarm steer #{queued[:job_id]} stop the scan")
-    expect(steering.instance_variable_get(:@pending)).to include('stop the scan')
+    expect(entered.pop).to include('stop the scan')
     controller.execute(line: "/swarm cancel #{queued[:job_id]}")
     sleep 0.05
     expect(controller.snapshot[:jobs].first[:state]).to eq('cancelled')

data/spec/lib/pwn/plugins/repl/ai_vault_edit_yubikey_spec.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+require 'stringio'
+
+RSpec.describe PWN::Plugins::REPL::AIConsole::VaultEdit, 'hardware vault editing' do
+  around do |example|
+    Dir.mktmpdir('vault-edit-yubikey-') do |root|
+      @root = root
+      example.run
+    end
+  end
+
+  before do
+    allow(Dir).to receive(:home).and_return(@root)
+    stub_const('PWN::Plugins::YubiKey', double('synthetic YubiKey'))
+    allow(PWN::Plugins::YubiKey).to receive(:challenge_response) do |opts|
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts[:challenge])
+    end
+    @path = File.join(@root, 'selected-vault')
+    @original = { ai: { active: 'ollama', ollama: { model: 'fixture-model', key: 'synthetic-private-value' } }, retained: ['fixture-value'] }
+    File.binwrite(@path, PWN::Plugins::Vault.encrypt_data(data: YAML.dump(@original), yubikey: { slot: 2, serial: '12345678' }))
+    File.chmod(0o600, @path)
+    stub_const('PWN::Env', @original.merge(driver_opts: { pwn_env_path: @path, pwn_dec_path: File.join(@root, 'absent-sidecar') }))
+    stub_const('PWN::EnvRedacted', {})
+    allow(Pry).to receive(:history).and_return(Pry::History.new(file_path: File.join(@root, 'history')))
+  end
+
+  it 'keeps malformed YAML and cancellation private and leaves hardware ciphertext untouched' do
+    console = PWN::Plugins::REPL::AIConsole::Console.new(pry: Pry.new, input: StringIO.new, curses: nil, getch: nil)
+    bytes = File.binread(@path)
+    console.submit('/vault edit')
+    console.instance_variable_get(:@vault_editor).replace('synthetic-private-value: [')
+    console.handle("\u0013")
+    expect(console.instance_variable_get(:@vault_error)).to include('Invalid YAML')
+    expect(console.instance_variable_get(:@vault_error)).not_to include('synthetic-private-value')
+    console.handle("\e")
+    expect(console.instance_variable_get(:@vault_editor)).to be_nil
+    expect(console.instance_variable_get(:@timeline).inspect).not_to include('synthetic-private-value', 'Invalid YAML')
+    expect(Pry.history.to_a.join).not_to include('synthetic-private-value')
+    expect(File.binread(@path)).to eq(bytes)
+  end
+
+  it 'preserves hardware ciphertext and Env when encryption fails or is interrupted' do
+    edit = described_class.new(%w[ai ollama model])
+    bytes = File.binread(@path)
+    env = PWN::Env
+    allow(PWN::Plugins::Vault).to receive(:encrypt_data).and_raise(IOError, 'synthetic-private-value')
+    expect { edit.save('new-model') }.to raise_error(described_class::Error, /Vault not saved/)
+    expect(File.binread(@path)).to eq(bytes)
+    expect(PWN::Env).to equal(env)
+    allow(PWN::Plugins::Vault).to receive(:encrypt_data).and_raise(Interrupt)
+    expect { edit.save('new-model') }.to raise_error(Interrupt)
+    expect(File.binread(@path)).to eq(bytes)
+    expect(PWN::Env).to equal(env)
+    expect(Dir.children(@root)).to eq(['selected-vault'])
+  end
+
+  it 'merges unrelated hardware edits and refuses a changed selected scope' do
+    edit = described_class.new(%w[ai ollama model])
+    described_class.new(['retained']).save("- changed\n")
+    edit.save('new-model')
+    expect(PWN::Plugins::Vault.dump(file: @path)[:retained]).to eq(['changed'])
+    bytes = File.binread(@path)
+    expect { edit.save('stale-model') }.to raise_error(described_class::Error, /scope changed/)
+    expect(File.binread(@path)).to eq(bytes)
+  end
+
+  it 'rejects a final ciphertext conflict without leaving a staging file' do
+    edit = described_class.new(%w[ai ollama model])
+    other = PWN::Plugins::Vault.encrypt_data(data: YAML.dump(@original.merge(retained: ['concurrent'])), yubikey: { slot: 2 })
+    allow(edit).to receive(:atomic_write).and_wrap_original do |method, encrypted, previous|
+      File.binwrite(@path, other)
+      method.call(encrypted, previous)
+    end
+    expect { edit.save('new-model') }.to raise_error(described_class::Error, /changed during save/)
+    expect(File.binread(@path)).to eq(other)
+    expect(Dir.children(@root)).to eq(['selected-vault'])
+  end
+
+  it 'fails closed with a different device response and redacted open errors' do
+    bytes = File.binread(@path)
+    allow(PWN::Plugins::YubiKey).to receive(:challenge_response).and_return('x' * 20)
+    expect { described_class.new([]) }.to raise_error(described_class::Error, /Cannot open vault/)
+    expect(File.binread(@path)).to eq(bytes)
+  end
+
+  it 'opens and saves the selected hardware scope without requiring or creating a decryptor' do
+    expect(PWN::Config).not_to receive(:refresh_env)
+    expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+    edit = described_class.new(%w[ai ollama model])
+    expect(edit.text).to include('fixture-model')
+    expect(edit.save('new-model')).to eq(:saved)
+    expect(PWN::Plugins::Vault.hardware_encrypted?(file: @path)).to be(true)
+    document = PWN::Plugins::Vault.dump(file: @path)
+    expect(document.dig(:ai, :ollama, :model)).to eq('new-model')
+    expect(document[:retained]).to eq(['fixture-value'])
+    expect(PWN::Env.dig(:ai, :ollama, :model)).to eq('new-model')
+    expect(PWN::EnvRedacted.dig(:ai, :ollama, :key)).to include('REDACTED')
+    expect(Dir.children(@root)).to eq(['selected-vault'])
+  end
+end

data/spec/lib/pwn/plugins/repl/ai_yubikey_spec.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::REPL, 'hardware vault settings persistence' do
+  around do |example|
+    Dir.mktmpdir('ai-yubikey-') do |root|
+      @root = root
+      example.run
+    end
+  end
+
+  before do
+    allow(Dir).to receive(:home).and_return(@root)
+    stub_const('PWN::Plugins::YubiKey', double('synthetic YubiKey'))
+    allow(PWN::Plugins::YubiKey).to receive(:challenge_response) do |opts|
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts[:challenge])
+    end
+    @path = File.join(@root, 'selected-vault')
+    @original = { ai: { active: 'ollama', ollama: { model: 'fixture-model', system_role_content: 'fixture-role' } }, retained: 'fixture-value' }
+    File.binwrite(@path, PWN::Plugins::Vault.encrypt_data(data: YAML.dump(@original), yubikey: { slot: 2 }))
+    stub_const('PWN::Env', @original.merge(driver_opts: { pwn_env_path: @path, pwn_dec_path: File.join(@root, 'absent-sidecar') }))
+  end
+
+  it 'preserves ciphertext and Env on encryption failure without logging private exception content' do
+    bytes = File.binread(@path)
+    env = Marshal.dump(PWN::Env)
+    allow(PWN::Plugins::Vault).to receive(:encrypt_data).and_raise(IOError, 'synthetic-private-exception')
+    expect do
+      expect(described_class.persist_ai_selection(engine: 'ollama', model: 'new-model')).to be(false)
+    end.to output(/settings persist failed: IOError/).to_stderr
+    expect(File.binread(@path)).to eq(bytes)
+    expect(Marshal.dump(PWN::Env)).to eq(env)
+    expect(Dir.children(@root)).to eq(['selected-vault'])
+    expect do
+      described_class.persist_ai_selection(engine: 'ollama', model: 'new-model')
+    end.not_to output(/synthetic-private-exception/).to_stderr
+  end
+
+  it 'persists model and effort into the hardware vault without converting its format or losing other settings' do
+    expect(described_class.persist_ai_selection(engine: 'ollama', model: 'new-model', reasoning_effort: 'high')).to be(true)
+    expect(PWN::Plugins::Vault.hardware_encrypted?(file: @path)).to be(true)
+    expected = { ai: { active: 'ollama', ollama: { model: 'new-model', system_role_content: 'fixture-role', reasoning_effort: 'high' } }, retained: 'fixture-value' }
+    expect(PWN::Plugins::Vault.dump(file: @path)).to eq(expected)
+    expect(Dir.children(@root)).to eq(['selected-vault'])
+  end
+end

data/spec/lib/pwn/plugins/repl/mesh_vault_persistence_spec.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::REPL, 'mesh vault persistence' do
+  before do
+    @home = Dir.mktmpdir('pwn-mesh-vault-')
+    allow(Dir).to receive(:home).and_return(@home)
+    @path = File.join(@home, 'custom-vault')
+    @decryptor = File.join(@home, 'independent-decryptor')
+    stub_const('PWN::Env', { driver_opts: { pwn_env_path: @path, pwn_dec_path: @decryptor }, plugins: {} })
+    @device = double('offline YubiKey')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    allow(@device).to receive(:challenge_response) do |opts|
+      expect(opts).to include(slot: 2, serial: '123456')
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge))
+    end
+    @cfg = {
+      unrelated: 'keep', plugins: {
+        meshtastic: {
+          transport: 'mqtt', channel: { active: 'LongFast', LongFast: { psk: 'fixture-psk', topic: '2/e/LongFast/#' } },
+          mqtt: { username: 'fixture-user', password: 'fixture-password' }, serial: { port: '/dev/fixture-old', baud: 115_200 }
+        }
+      }
+    }
+    File.write(@path, YAML.dump(@cfg))
+    PWN::Plugins::Vault.encrypt(file: @path, yubikey: { slot: 2, serial: '123456' })
+    expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+    allow(described_class).to receive(:mesh_ui_puts)
+    allow(ENV).to receive(:fetch).and_call_original
+    allow(ENV).to receive(:fetch).with('PWN_DECRYPTOR_KEY', nil).and_return(nil)
+    allow(ENV).to receive(:fetch).with('PWN_DECRYPTOR_IV', nil).and_return(nil)
+  end
+
+  after { FileUtils.remove_entry(@home) }
+
+  it 'merges menu settings into a hardware vault without a decryptor or plaintext rewrite' do
+    expect(PWN::Plugins::Vault).to receive(:update).with(file: @path, decryptor_file: @decryptor).and_call_original
+    expect(PWN::Plugins::Vault).not_to receive(:decrypt)
+    expect(PWN::Plugins::Vault).not_to receive(:encrypt)
+    expect(File).not_to receive(:write)
+    mesh = { 'transport' => 'serial', 'serial' => { 'port' => '/dev/fixture-new' }, 'channel' => { 'active' => 'LongFast' } }
+
+    expect(described_class.persist_mesh_env(mesh: mesh)).to be(true)
+    persisted = PWN::Plugins::Vault.dump(file: @path)
+    expect(persisted.dig(:plugins, :meshtastic)).to eq(@cfg.dig(:plugins, :meshtastic).merge(transport: 'serial', serial: { port: '/dev/fixture-new', baud: 115_200 }))
+    expect(persisted[:unrelated]).to eq('keep')
+    expect(File.binread(@path)).to start_with(PWN::Plugins::Vault::YUBIKEY_HEADER)
+    expect(File.stat(@path).mode & 0o777).to eq(0o600)
+    expect(Dir.children(@home)).to eq(['custom-vault'])
+    expect(described_class).not_to have_received(:mesh_ui_puts)
+  end
+
+  it 'keeps legacy credentials and nested mesh settings while staging ciphertext only' do
+    credentials = { key: Base64.strict_encode64('k' * 32), iv: Base64.strict_encode64('i' * 16) }
+    File.write(@decryptor, YAML.dump(credentials))
+    File.chmod(0o400, @decryptor)
+    File.write(@path, YAML.dump(@cfg))
+    PWN::Plugins::Vault.encrypt({ file: @path }.merge(credentials))
+    before = File.binread(@path)
+    sidecar_before = File.binread(@decryptor)
+    expect(File).not_to receive(:write)
+    expect(PWN::Plugins::Vault).not_to receive(:decrypt)
+    expect(PWN::Plugins::Vault).not_to receive(:encrypt)
+    expect(Tempfile).to receive(:create).and_wrap_original do |create, *args, &block|
+      create.call(*args) do |temp|
+        expect(temp).to receive(:write).and_wrap_original do |write, bytes|
+          plaintext = PWN::Plugins::Vault.decrypt_data(credentials.merge(data: bytes))
+          expect(YAML.safe_load(plaintext, permitted_classes: [Symbol], symbolize_names: true).dig(:plugins, :meshtastic, :serial)).to eq(port: '/dev/fixture-new', baud: 115_200)
+          expect(bytes).not_to include('fixture-password', 'fixture-psk')
+          expect(File.binread(@path)).to eq(before)
+          expect(temp.stat.mode & 0o777).to eq(0o600)
+          write.call(bytes)
+        end
+        block.call(temp)
+      end
+    end
+
+    expect(described_class.persist_mesh_env(mesh: { serial: { port: '/dev/fixture-new' } })).to be(true)
+    persisted = PWN::Plugins::Vault.dump({ file: @path }.merge(credentials))
+    expect(persisted.dig(:plugins, :meshtastic)).to eq(@cfg.dig(:plugins, :meshtastic).merge(serial: { port: '/dev/fixture-new', baud: 115_200 }))
+    expect(persisted[:unrelated]).to eq('keep')
+    expect(File.binread(@decryptor)).to eq(sidecar_before)
+    expect(File.stat(@decryptor).mode & 0o777).to eq(0o400)
+    expect(File.stat(@path).mode & 0o777).to eq(0o600)
+    expect(Dir.children(@home)).to match_array(%w[custom-vault independent-decryptor])
+  end
+
+  it 'uses the default vault and live mesh settings when no overrides are supplied' do
+    default_path = File.join(@home, '.pwn', 'pwn.yaml')
+    FileUtils.mkdir_p(File.dirname(default_path))
+    FileUtils.cp(@path, default_path)
+    before = File.binread(@path)
+    PWN::Env[:driver_opts] = {}
+    PWN::Env[:plugins][:meshtastic] = { transport: 'serial' }
+
+    expect(described_class.persist_mesh_env).to be(true)
+    expect(PWN::Plugins::Vault.dump(file: default_path).dig(:plugins, :meshtastic)).to eq(@cfg.dig(:plugins, :meshtastic).merge(transport: 'serial'))
+    expect(File.binread(@path)).to eq(before)
+    expect(Dir.children(File.dirname(default_path))).to eq(['pwn.yaml'])
+  end
+
+  it 'does not overwrite a concurrent ciphertext change' do
+    concurrent = PWN::Plugins::Vault.encrypt_data(data: YAML.dump(@cfg.merge(unrelated: 'newer')), yubikey: { slot: 2, serial: '123456' })
+    allow(PWN::Plugins::Vault).to receive(:encrypt_data).and_wrap_original do |encrypt, opts|
+      ciphertext = encrypt.call(opts)
+      File.binwrite(@path, concurrent)
+      ciphertext
+    end
+
+    expect(described_class.persist_mesh_env(mesh: { transport: 'serial' })).to be(false)
+    expect(File.binread(@path)).to eq(concurrent)
+    expect(Dir.children(@home)).to eq(['custom-vault'])
+    expect(described_class).to have_received(:mesh_ui_puts).with(text: '[pwn-mesh] persist skipped: IOError')
+  end
+
+  it 'does not use a software sidecar when the hardware device is unavailable' do
+    File.write(@decryptor, YAML.dump(key: Base64.strict_encode64('k' * 32), iv: Base64.strict_encode64('i' * 16)))
+    before = File.binread(@path)
+    sidecar_before = File.binread(@decryptor)
+    allow(@device).to receive(:challenge_response).and_raise(IOError, 'synthetic-private-error')
+    expect(PWN::Plugins::Vault).not_to receive(:encrypt_data)
+
+    expect(described_class.persist_mesh_env(mesh: { transport: 'serial' })).to be(false)
+    expect(File.binread(@path)).to eq(before)
+    expect(File.binread(@decryptor)).to eq(sidecar_before)
+    expect(described_class).to have_received(:mesh_ui_puts).with(text: '[pwn-mesh] persist skipped: IOError')
+  end
+
+  it 'leaves hardware ciphertext untouched when the device disappears during re-encryption' do
+    before = File.binread(@path)
+    calls = 0
+    allow(@device).to receive(:challenge_response) do |opts|
+      calls += 1
+      raise IOError, 'synthetic-private-error' if calls > 1
+
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge))
+    end
+    expect(PWN::Plugins::Vault).not_to receive(:decrypt)
+    expect(File).not_to receive(:write)
+    expect(Tempfile).not_to receive(:create)
+
+    expect(described_class.persist_mesh_env(mesh: { transport: 'serial' })).to be(false)
+    expect(described_class).to have_received(:mesh_ui_puts).with(text: '[pwn-mesh] persist skipped: IOError')
+    expect(File.binread(@path)).to eq(before)
+    expect(Dir.children(@home)).to eq(['custom-vault'])
+  end
+end

data/spec/lib/pwn/plugins/repl/vault_yaml_serialization_spec.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Plugins::REPL::AIConsole::VaultEdit, 'YAML scalar fidelity' do
+  it 'preserves colon-prefixed lines inside nested mapping and array values' do
+    value = { setting: "before\n:leading-colon\nafter\n", rows: [{ text: "line\n:other: value\n" }] }
+    editor = described_class.allocate
+    expect(editor.parse(editor.serialize(value))).to eq(value)
+  end
+end