pwn 0.5.783 → 0.5.785

data/spec/lib/pwn/plugins/vault_store_safety_spec.rb

@@ -0,0 +1,241 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::Vault, 'loot corruption safety' do
+  before do
+    @root = Dir.mktmpdir('vault-loot-safety-')
+    allow(Dir).to receive(:home).and_return(@root)
+    allow(described_class).to receive(:note_mission_loot)
+    @device = double('offline YubiKey')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    allow(@device).to receive(:challenge_response) { |opts| OpenSSL::HMAC.digest('SHA1', 'fixture-slot', opts[:challenge]) }
+    @path = File.join(@root, '.pwn', 'engagements', 'default', 'loot.json')
+    @legacy_path = File.join(@root, '.pwn', 'vault-secrets.json')
+    FileUtils.mkdir_p(File.dirname(@path))
+  end
+
+  after do
+    FileUtils.remove_entry(@root)
+  end
+
+  {
+    'malformed JSON' => '{"PRIVATE_PARSE_MARKER":',
+    'nonmapping root' => '[]',
+    'nonarray records' => '{"records": {}}',
+    'null records' => '{"records": null}',
+    'nonmapping row' => '{"version": 2, "records": [false]}',
+    'missing secret' => '{"version": 2, "records": [{"label": "protected"}]}',
+    'nonmapping secret' => '{"version": 2, "records": [{"label": "protected", "secret": false}]}',
+    'nonstring label' => '{"version": 2, "records": [{"label": 123, "secret": {}}]}',
+    'invalid legacy row' => '{"protected": false}'
+  }.each do |description, damaged|
+    it "refuses #{description} before choosing a store backend", :aggregate_failures do
+      described_class.store(label: 'protected', secret: 'original-fixture', yubikey: {})
+      File.binwrite(@path, damaged)
+      expect do
+        described_class.store(label: 'protected', secret: 'replacement-fixture')
+      end.to raise_error(IOError, /loot store/)
+      expect(File.binread(@path)).to eq(damaged)
+      expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+    end
+  end
+
+  it 'does not overwrite corrupt records even with an explicit hardware destination' do
+    damaged = '{"records": [null]}'
+    File.write(@path, damaged)
+    expect(@device).not_to receive(:challenge_response)
+    expect { described_class.store(label: 'protected', secret: 'fixture', yubikey: {}) }.to raise_error(IOError, /loot store/)
+    expect(File.binread(@path)).to eq(damaged)
+  end
+
+  it 'rejects incomplete or unknown hardware envelopes rather than replacing them with software encryption', :aggregate_failures do
+    described_class.store(label: 'protected', secret: 'original-fixture', yubikey: {})
+    original = JSON.parse(File.read(@path))
+    [nil, 'unknown-kdf'].each do |invalid|
+      damaged = Marshal.load(Marshal.dump(original))
+      damaged['records'].first['secret']['kdf'] = invalid
+      File.write(@path, JSON.generate(damaged))
+      expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+      expect(JSON.parse(File.read(@path))).to eq(damaged)
+      expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+    end
+    original['records'].first['secret']['yubikey'] = nil
+    File.write(@path, JSON.generate(original))
+    expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+    expect(JSON.parse(File.read(@path))).to eq(original)
+  end
+
+  it 'reports unreadable existing stores without treating them as absent', :aggregate_failures do
+    File.write(@path, '{"records": []}')
+    allow(File).to receive(:read).and_call_original
+    allow(File).to receive(:read).with(@path).and_raise(Errno::EACCES, 'PRIVATE_PARSE_MARKER')
+    expect { described_class.store(label: 'protected', secret: 'fixture') }.to raise_error(IOError, /loot store/)
+    expect(File.binread(@path)).to eq('{"records": []}')
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'does not treat a nonregular existing store as absent' do
+    Dir.mkdir(@path)
+    expect { described_class.query }.to raise_error(IOError, /loot store/)
+    expect { described_class.store(label: 'protected', secret: 'fixture') }.to raise_error(IOError, /loot store/)
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'fails closed on corrupt legacy stores before creating engagement records' do
+    File.write(@legacy_path, '{"PRIVATE_PARSE_MARKER":')
+    expect { described_class.store(label: 'protected', secret: 'fixture') }.to raise_error(IOError, /loot store/)
+    expect(File).not_to exist(@path)
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'surfaces safe diagnostics on every read-only parser path instead of silently hiding records' do
+    File.write(@path, '{"PRIVATE_PARSE_MARKER":')
+    queries = [
+      -> { described_class.query },
+      -> { described_class.fetch(label: 'protected', engagement: 'default') },
+      -> { described_class.fetch(label: 'protected') },
+      -> { described_class.offer },
+      -> { described_class.expand(text: '{{vault:protected}}') },
+      -> { described_class.redact(text: 'fixture') }
+    ]
+    queries.each do |query|
+      expect(&query).to raise_error(IOError, /loot store/) do |error|
+        expect(error.message).to include(@path)
+        expect(error.message).not_to include('PRIVATE_PARSE_MARKER')
+        expect(error.cause).to be_nil
+      end
+    end
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'preserves absent and empty stores as empty collections' do
+    expect(described_class.query).to eq([])
+    expect(described_class.fetch(label: 'absent')).to be_nil
+    File.write(@path, JSON.generate(version: 2, records: []))
+    File.write(@legacy_path, '{}')
+    expect(described_class.query).to eq([])
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'reads a legacy label named records without mistaking its ciphertext for a modern collection' do
+    secret = described_class.send(:encrypt_secret, secret: 'records-fixture')
+    original = JSON.generate(records: secret)
+    File.write(@legacy_path, original)
+    expect(described_class.fetch(label: 'records')).to eq('records-fixture')
+    expect(described_class.query).to contain_exactly(label: 'records', engagement: 'default', host: '', source: 'legacy', has_secret: true)
+    described_class.store(label: 'hardware', secret: 'hardware-fixture', yubikey: {})
+    expect(described_class.fetch(label: 'records', engagement: 'default')).to eq('records-fixture')
+    expect(File.binread(@legacy_path)).to eq(original)
+  end
+
+  it 'rejects a versioned collection with a ciphertext Hash instead of a records array' do
+    secret = described_class.send(:encrypt_secret, secret: 'fixture', yubikey: {})
+    damaged = JSON.generate(version: 2, records: secret)
+    File.write(@path, damaged)
+    expect(@device).not_to receive(:challenge_response)
+    expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+    expect(File.binread(@path)).to eq(damaged)
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  %i[legacy hardware].each do |backend|
+    it "normalizes inline #{backend} ciphertext while preserving loot metadata and protection" do
+      access = backend == :hardware ? { yubikey: {} } : {}
+      secret = described_class.send(:encrypt_secret, access.merge(secret: 'flat-fixture'))
+      metadata = {
+        id: 'fixture-id', label: 'flat', kind: 'password', engagement: 'default', host: 'login.example.test',
+        service: 'ssh', username: 'fixture-user', source: 'legacy', where: '/fixture/path',
+        finding_id: 'fixture-finding', at: '2026-01-01T00:00:00Z'
+      }
+      original = JSON.generate(version: 2, records: [secret.merge(metadata)])
+      File.write(@path, original)
+      expect(described_class.fetch(label: 'flat')).to eq('flat-fixture')
+      expect(described_class.query).to contain_exactly(metadata.merge(has_secret: true))
+      expect(described_class.offer(host: metadata[:host]).first[:secret]).to eq('flat-fixture')
+      expect(described_class.expand(text: '{{vault:flat}}')).to eq('flat-fixture')
+      expect(described_class.redact(text: 'flat-fixture')).to eq('{{vault:flat}}')
+      expect(File.binread(@path)).to eq(original)
+
+      described_class.store(label: 'other', secret: 'other-fixture', yubikey: {})
+      saved = JSON.parse(File.read(@path))['records'].find { |row| row['label'] == 'flat' }
+      expect(saved).to eq(JSON.parse(JSON.generate(metadata.merge(secret: secret))))
+      described_class.store(label: 'flat', secret: 'replacement-fixture')
+      expect(described_class.fetch(label: 'flat')).to eq('replacement-fixture')
+      saved_secret = JSON.parse(File.read(@path))['records'].find { |row| row['label'] == 'flat' }['secret']
+      if backend == :hardware
+        expect(saved_secret['kdf']).to eq(described_class::YUBIKEY_KDF)
+        expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+      else
+        expect(saved_secret.keys).to contain_exactly('iv', 'ct', 'tag')
+      end
+    end
+  end
+
+  {
+    'unknown KDF' => { 'kdf' => 'unknown-kdf' },
+    'null KDF' => { 'kdf' => nil },
+    'invalid hardware metadata' => { 'yubikey' => false },
+    'runtime hardware options' => { 'yubikey' => { 'slot' => 2, 'challenge' => 'fixture', 'ykman' => '/untrusted/backend' } },
+    'explicit null secret' => { 'secret' => nil },
+    'explicit false secret' => { 'secret' => false }
+  }.each do |description, changes|
+    it "rejects inline ciphertext with #{description} instead of selecting software encryption" do
+      secret = described_class.send(:encrypt_secret, secret: 'original-fixture', yubikey: {})
+      damaged = JSON.generate(version: 2, records: [secret.merge('label' => 'protected').merge(changes)])
+      File.write(@path, damaged)
+      expect(@device).not_to receive(:challenge_response)
+      expect { described_class.fetch(label: 'protected') }.to raise_error(IOError, /loot store/)
+      expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+      expect(File.binread(@path)).to eq(damaged)
+      expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+    end
+  end
+
+  [1.0, 2.0].each do |slot|
+    %i[inline nested].each do |shape|
+      it "rejects float hardware slot #{slot} in #{shape} loot envelopes before selecting a backend" do
+        secret = described_class.send(:encrypt_secret, secret: 'original-fixture', yubikey: {})
+        secret['yubikey']['slot'] = slot
+        row = shape == :inline ? secret.merge(label: 'protected') : { label: 'protected', secret: secret }
+        damaged = JSON.generate(version: 2, records: [row])
+        File.write(@path, damaged)
+        expect(@device).not_to receive(:challenge_response)
+        expect { described_class.query }.to raise_error(IOError, /loot store/)
+        expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+        expect(File.binread(@path)).to eq(damaged)
+        expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+      end
+    end
+  end
+
+  it 'retains inline hardware ciphertext when the device is unavailable during replacement' do
+    secret = described_class.send(:encrypt_secret, secret: 'original-fixture', yubikey: {})
+    original = JSON.generate(version: 2, records: [secret.merge(label: 'protected')])
+    File.write(@path, original)
+    allow(@device).to receive(:challenge_response).and_raise(IOError, 'Device unavailable')
+    expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, 'Device unavailable')
+    expect(File.binread(@path)).to eq(original)
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'reads valid legacy label maps and preserves them when adding modern records' do
+    key = 'k' * 32
+    cipher = OpenSSL::Cipher.new('aes-256-gcm')
+    cipher.encrypt
+    cipher.key = key
+    iv = cipher.random_iv
+    cipher.auth_data = 'pwn-vault'
+    ct = cipher.update('legacy-fixture') + cipher.final
+    secret = { iv: Base64.strict_encode64(iv), ct: Base64.strict_encode64(ct), tag: Base64.strict_encode64(cipher.auth_tag) }
+    File.binwrite(File.join(@root, '.pwn-vault.key'), key)
+    File.write(@legacy_path, JSON.generate(legacy: secret))
+    expect(described_class.fetch(label: 'legacy')).to eq('legacy-fixture')
+    described_class.store(label: 'hardware', secret: 'hardware-fixture', yubikey: {})
+    expect(described_class.query.map { |row| row[:label] }).to include('legacy', 'hardware')
+    expect(described_class.fetch(label: 'legacy', engagement: 'default')).to eq('legacy-fixture')
+    expect(described_class.fetch(label: 'hardware', engagement: 'default')).to eq('hardware-fixture')
+    expect(JSON.parse(File.read(@legacy_path), symbolize_names: true)).to eq(legacy: secret)
+  end
+end

data/spec/lib/pwn/plugins/vault_yubikey_safety_spec.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::Vault, 'YubiKey failure safety' do
+  before do
+    @device = double('offline YubiKey')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    allow(@device).to receive(:challenge_response) { |opts| OpenSSL::HMAC.digest('SHA1', 'fixture-slot', opts[:challenge]) }
+    @legacy = { key: Base64.strict_encode64('k' * 32), iv: Base64.strict_encode64('i' * 16) }
+    allow(described_class).to receive(:note_mission_loot)
+  end
+
+  it 'never ignores explicit hardware selection when editing or rotating a legacy vault' do
+    Dir.mktmpdir('vault-no-fallback-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      path = File.join(root, 'vault')
+      original = described_class.encrypt_data(@legacy.merge(data: "token: fixture\n"))
+      File.binwrite(path, original)
+      expect(described_class).not_to receive(:system)
+      expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+      %i[edit refresh_encryption_secrets].each do |method|
+        expect { described_class.public_send(method, @legacy.merge(file: path, yubikey: {})) }.to raise_error(ArgumentError, /YubiKey/)
+        expect(File.binread(path)).to eq(original)
+      end
+    end
+  end
+
+  it 'rejects software credentials combined with hardware creation rather than discarding them' do
+    Dir.mktmpdir('vault-conflict-') do |root|
+      path = File.join(root, 'vault')
+      File.write(path, 'original')
+      expect { described_class.create(@legacy.merge(file: path, yubikey: {})) }.to raise_error(ArgumentError, /software/)
+      expect(File.read(path)).to eq('original')
+    end
+  end
+
+  it 'does not accept false as a hardware selector during unsealing' do
+    envelope = described_class.seal_credentials(credentials: { token: 'fixture' }, yubikey: {})
+    expect { described_class.open_credentials(envelope: envelope, yubikey: false) }.to raise_error(ArgumentError, /selector/)
+  end
+
+  [false, { slot: 3 }, { slot: 1.0 }, { slot: 2.0 }, { unexpected: true }, { serial: false }, { serial: 123 },
+   { timeout: false }, { timeout: 0 }, { timeout: Float::INFINITY }, { ykman: '' }, { ykman: false },
+   { ykman: '/fixture/unsupported-executable' }, { device_path: false }, { device_path: '' }, { device_path: "bad\npath" },
+   { reader: false }, { reader: '' }, { reader: "bad\0reader" }, { reader: 'Fixture reader', serial: '123' },
+   { connection: false }, { connection: Object.new }, { reader: 'Fixture reader', device_path: '/fixture/native-device' }, { 123 => 'invalid key' }].each do |selector|
+    %i[legacy hardware].each do |backend|
+      it "rejects destination selector #{selector.inspect} before opening a #{backend} vault" do
+        Dir.mktmpdir('vault-invalid-destination-') do |root|
+          allow(Dir).to receive(:home).and_return(root)
+          path = File.join(root, 'vault')
+          access = backend == :legacy ? @legacy : { yubikey: {} }
+          original = described_class.encrypt_data(access.merge(data: "token: fixture\n"))
+          File.binwrite(path, original)
+          expect(described_class).not_to receive(:decrypt_data)
+          expect(@device).not_to receive(:challenge_response)
+          expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+          expect do
+            expect { described_class.refresh_encryption_secrets(access.merge(file: path, new_yubikey: selector)) }.to raise_error(ArgumentError, /yubikey/i)
+          end.not_to output.to_stdout
+          expect(File.binread(path)).to eq(original)
+          expect(Dir.children(root)).to eq(['vault'])
+        end
+      end
+    end
+  end
+
+  it 'keeps entropy redacted when the hardware loot write fails' do
+    secret = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+    allow(@device).to receive(:challenge_response).and_raise(IOError, 'Device unavailable')
+    Dir.mktmpdir('capture-no-device-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      result = PWN::Redaction.capture(value: secret, entropy: true, yubikey: {})
+      expect(result[:redacted]).not_to include(secret)
+      expect(result[:redacted]).to start_with('[REDACTED:entropy:')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+    end
+  end
+
+  it 'authenticates ciphertext and public metadata and rejects a wrong device response' do
+    envelope = described_class.seal_credentials(credentials: { value: 'fixture' }, yubikey: { slot: 1, serial: '12345678' })
+    %w[ct tag salt iv key_id].each do |field|
+      changed = Marshal.load(Marshal.dump(envelope))
+      changed[field] = field == 'key_id' ? 'different-context' : Base64.strict_encode64('x' * Base64.strict_decode64(changed[field]).bytesize)
+      expect { described_class.open_credentials(envelope: changed) }.to raise_error(ArgumentError)
+    end
+    expect(described_class.open_credentials(envelope: envelope, yubikey: { serial: '87654321' })).to eq('value' => 'fixture')
+    expect { described_class.open_credentials(envelope: envelope, yubikey: { slot: 2 }) }.to raise_error(ArgumentError, /slot/)
+    allow(@device).to receive(:challenge_response) { 'w' * 20 }
+    expect { described_class.open_credentials(envelope: envelope) }.to raise_error(ArgumentError, /authentication/)
+  end
+
+  it 'rejects caller-only native controls injected into envelope metadata before contacting hardware' do
+    original = described_class.seal_credentials(credentials: {}, yubikey: {})
+    expect(@device).not_to receive(:challenge_response)
+    %w[ykman reader device_path connection timeout].each do |field|
+      envelope = Marshal.load(Marshal.dump(original))
+      envelope['yubikey'][field] = '/untrusted/backend'
+      expect { described_class.open_credentials(envelope: envelope) }.to raise_error(ArgumentError, /metadata/)
+    end
+  end
+
+  it 'preserves ciphertext when the device disappears on the encryption half of an update' do
+    Dir.mktmpdir('vault-save-failure-') do |root|
+      path = File.join(root, 'vault')
+      File.write(path, "token: original\n")
+      described_class.create(file: path, yubikey: {})
+      before = File.binread(path)
+      calls = 0
+      allow(@device).to receive(:challenge_response) do |opts|
+        calls += 1
+        raise IOError, 'Device removed' if calls > 1
+
+        OpenSSL::HMAC.digest('SHA1', 'fixture-slot', opts[:challenge])
+      end
+      expect do
+        described_class.update(file: path) do |cfg|
+          cfg[:token] = 'changed'
+          expect(File.binread(path)).to eq(before)
+        end
+      end.to raise_error(IOError, 'Device removed')
+      expect(File.binread(path)).to eq(before)
+      expect(Dir.children(root)).to eq(['vault'])
+    end
+  end
+
+  it 'converts a legacy vault in memory and never downgrades a hardware loot label on replacement' do
+    Dir.mktmpdir('vault-conversion-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      path = File.join(root, 'vault')
+      File.binwrite(path, described_class.encrypt_data(@legacy.merge(data: "token: original\n")))
+      described_class.refresh_encryption_secrets(@legacy.merge(file: path, new_yubikey: {}))
+      expect(described_class.dump(file: path)).to eq(token: 'original')
+      expect(File.stat(path).mode & 0o777).to eq(0o600)
+      described_class.store(label: 'fixed', secret: 'first', yubikey: {})
+      described_class.store(label: 'fixed', secret: 'second')
+      expect(described_class.fetch(label: 'fixed')).to eq('second')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+    end
+  end
+
+  %i[legacy hardware].each do |backend|
+    it "preserves untouched multiline YAML scalars during a #{backend} update" do
+      Dir.mktmpdir('vault-yaml-scalars-') do |root|
+        path = File.join(root, 'vault')
+        original = {
+          banner: ":first\n:second\n\n  :indented\nlast:\n",
+          nested: { values: [":array-line\n:next\n", :symbol, false, nil, 123], unicode: "é\n:行\n" }
+        }
+        access = backend == :legacy ? @legacy : { yubikey: {} }
+        File.binwrite(path, described_class.encrypt_data(access.merge(data: YAML.dump(original))))
+        expect(described_class.update(access.merge(file: path)) { |cfg| cfg[:changed] = true }).to eq(:saved)
+        expect(described_class.dump(access.merge(file: path))).to eq(original.merge(changed: true))
+      end
+    end
+  end
+
+  it 'supports empty binary data with independent challenge, salt and nonce on every encryption' do
+    first = described_class.encrypt_data(data: ''.b, yubikey: {})
+    second = described_class.encrypt_data(data: ''.b, yubikey: {})
+    expect(described_class.decrypt_data(data: first)).to eq(''.b)
+    a, b = [first, second].map { |ciphertext| JSON.parse(ciphertext.delete_prefix(described_class::YUBIKEY_HEADER)) }
+    %w[salt iv].each { |field| expect(a[field]).not_to eq(b[field]) }
+    expect(a['yubikey']['challenge']).not_to eq(b['yubikey']['challenge'])
+  end
+end

data/spec/lib/pwn/plugins/vault_yubikey_spec.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::Vault, 'YubiKey credential envelopes' do
+  before do
+    @device = double('YubiKey HMAC fixture')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    allow(@device).to receive(:challenge_response) do |opts|
+      expect(opts[:slot]).to eq(2)
+      expect(opts[:challenge].bytesize).to eq(32)
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts[:challenge])
+    end
+  end
+
+  it 'round trips credentials with a hardware-derived key and no software key material in the envelope' do
+    envelope = described_class.seal_credentials(credentials: { 'token' => 'fixture-token' }, yubikey: { slot: 2 })
+    expect(envelope['kdf']).to eq('yubikey-hmac-sha1-hkdf-sha256')
+    expect(envelope.fetch('yubikey')).to include('slot' => 2)
+    expect(JSON.generate(envelope)).not_to include('fixture-token', 'synthetic-slot-secret')
+    expect(described_class.open_credentials(envelope: envelope)).to eq('token' => 'fixture-token')
+    expect(@device).to have_received(:challenge_response).twice
+  end
+
+  it 'encrypts a binary file and dumps or decrypts it without a software decryptor' do
+    Dir.mktmpdir('vault-yubikey-') do |root|
+      path = File.join(root, 'fixture')
+      bytes = "binary\x00\xff\n".b
+      File.binwrite(path, bytes)
+      expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+      described_class.encrypt(file: path, yubikey: { slot: 2 })
+      ciphertext = File.binread(path)
+      expect(ciphertext).to start_with(described_class::YUBIKEY_HEADER)
+      expect(described_class.file_encrypted?(file: path)).to be(true)
+      expect(described_class.dump(file: path, yaml: false)).to eq(bytes)
+      expect(File.binread(path)).to eq(ciphertext)
+      described_class.decrypt(file: path)
+      expect(File.binread(path)).to eq(bytes)
+    end
+  end
+
+  it 'updates a hardware configuration without requiring a sidecar or ever writing plaintext' do
+    Dir.mktmpdir('vault-update-') do |root|
+      path = File.join(root, 'pwn.yaml')
+      File.write(path, YAML.dump(ai: { active: 'ollama', ollama: { model: 'before' } }, retained: 'fixture'))
+      described_class.encrypt(file: path, yubikey: { slot: 2 })
+      before = File.binread(path)
+      expect(described_class.access_options(file: path)).to eq(yubikey: { slot: 2 })
+      expect(described_class.update(file: path) { |cfg| cfg[:ai][:ollama][:model] = 'after' }).to eq(:saved)
+      expect(File.binread(path)).not_to eq(before)
+      expect(described_class.dump(file: path)).to include(ai: { active: 'ollama', ollama: { model: 'after' } }, retained: 'fixture')
+      before = File.binread(path)
+      allow(@device).to receive(:challenge_response).and_raise(IOError, 'Device unavailable')
+      expect { described_class.update(file: path, &:clear) }.to raise_error(IOError, 'Device unavailable')
+      expect(File.binread(path)).to eq(before)
+      expect(Dir.children(root)).to eq(['pwn.yaml'])
+    end
+  end
+
+  it 'creates and rotates a hardware vault without printing or persisting a software decryptor' do
+    Dir.mktmpdir('vault-create-') do |root|
+      path = File.join(root, 'secret.yaml')
+      File.write(path, "token: fixture-only\n")
+      expect { described_class.create(file: path, yubikey: { slot: 2 }) }.not_to output.to_stdout
+      before = File.binread(path)
+      described_class.refresh_encryption_secrets(file: path)
+      expect(File.binread(path)).not_to eq(before)
+      expect(described_class.dump(file: path)).to eq(token: 'fixture-only')
+      expect(Dir.children(root)).to eq(['secret.yaml'])
+    end
+  end
+
+  it 'edits only a private temporary copy and retains ciphertext if the key disappears before save' do
+    Dir.mktmpdir('vault-edit-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      path = File.join(root, 'vault')
+      File.write(path, "token: original\n")
+      described_class.create(file: path, yubikey: { slot: 2 })
+      before = File.binread(path)
+      edited = nil
+      expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+      allow(described_class).to receive(:system) do |editor, temporary|
+        expect(editor).to eq('/usr/bin/true')
+        expect(temporary).not_to eq(path)
+        expect(File.stat(temporary).mode & 0o777).to eq(0o600)
+        expect(File.binread(path)).to eq(before)
+        edited = temporary
+        File.write(temporary, "token: changed\n")
+        allow(@device).to receive(:challenge_response).and_raise(IOError, 'Device removed')
+        true
+      end
+      expect { described_class.edit(file: path, editor: '/usr/bin/true') }.to raise_error(IOError, 'Device removed')
+      expect(File.binread(path)).to eq(before)
+      expect(File).not_to exist(edited)
+    end
+  end
+
+  it 'protects engagement loot and its offer, expansion and redaction consumers without a disk master key' do
+    Dir.mktmpdir('vault-loot-hardware-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      selector = { slot: 2 }
+      described_class.store(label: 'hardware', secret: 'fixture-password', host: 'login.example.test', username: 'fixture-user', yubikey: selector)
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+      expect(described_class.fetch(label: 'hardware')).to eq('fixture-password')
+      expect(described_class.offer(host: 'login.example.test').first[:secret]).to eq('fixture-password')
+      expect(described_class.expand(text: '{{vault:hardware}}', yubikey: selector)).to eq('fixture-password')
+      expect(described_class.redact(text: 'fixture-password', yubikey: selector)).to eq('{{vault:hardware}}')
+      expect(PWN::Plugins::BasicAuth.encode(host: 'login.example.test', yubikey: selector)).to eq(Base64.strict_encode64('fixture-user:fixture-password'))
+      before = File.binread(File.join(root, '.pwn', 'engagements', 'default', 'loot.json'))
+      allow(@device).to receive(:challenge_response).and_raise(IOError, 'Device unavailable')
+      expect { described_class.fetch(label: 'hardware') }.to raise_error(IOError, 'Device unavailable')
+      expect { described_class.store(label: 'hardware', secret: 'replacement', yubikey: selector) }.to raise_error(IOError)
+      expect(File.binread(File.join(root, '.pwn', 'engagements', 'default', 'loot.json'))).to eq(before)
+    end
+  end
+
+  it 'allows redaction capture to explicitly use the hardware loot backend' do
+    Dir.mktmpdir('redaction-yubikey-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      capture = PWN::Redaction.capture(value: 'password=fixture-password', yubikey: { slot: 2 })
+      label = capture[:refs].first.fetch(:token)
+      expect(capture[:redacted]).not_to include('fixture-password')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+      expect(described_class.fetch(label: label)).to eq('password=fixture-password')
+    end
+  end
+end

data/spec/lib/pwn/plugins/vault_yubikey_vector_spec.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Plugins::Vault, 'independent hardware envelope vector' do
+  # Offline fixture: key bytes 00..13, challenge 00..1f, salt 00..0f,
+  # nonce 20..2b. Independently computed with Python hmac, manual RFC 5869
+  # extract/expand, and cryptography AESGCM, not the production Vault encoder.
+  let(:envelope) do
+    {
+      'version' => 1, 'cipher' => 'aes-256-gcm', 'kdf' => 'yubikey-hmac-sha1-hkdf-sha256',
+      'key_id' => 'pwn-ai-credentials', 'iterations' => 600_000,
+      'salt' => 'AAECAwQFBgcICQoLDA0ODw==',
+      'yubikey' => { 'slot' => 2, 'serial' => '12345678', 'challenge' => 'AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=' },
+      'iv' => 'ICEiIyQlJicoKSor', 'ct' => '3SNJ2cNhpHZ2I/o6/9fiAE9MeMop+YfsWrGP',
+      'tag' => 'w4t/Vmz98ro9opHAmz472Q=='
+    }
+  end
+
+  before do
+    arguments = { slot: 2, serial: '12345678', challenge: (0...32).to_a.pack('C*') }
+    allow(PWN::Plugins::YubiKey).to receive(:challenge_response).with(arguments).and_return(['533bd067d1bbf825ed021f8f278adbb571c51627'].pack('H*'))
+  end
+
+  it 'opens independently produced authenticated ciphertext without re-encoding it' do
+    ciphertext = "#{described_class::YUBIKEY_HEADER}#{JSON.generate(envelope)}\n"
+    expect(described_class.decrypt_data(data: ciphertext)).to eq("offline:\x00\xff\n".b)
+  end
+
+  it 'matches the independent envelope with fixed public randomness' do
+    allow(OpenSSL::Random).to receive(:random_bytes).with(16).and_return((0...16).to_a.pack('C*'))
+    allow(OpenSSL::Random).to receive(:random_bytes).with(32).and_return((0...32).to_a.pack('C*'))
+    allow(OpenSSL::Cipher).to receive(:new).and_wrap_original do |build, *args|
+      cipher = build.call(*args)
+      allow(cipher).to receive(:random_iv) do
+        nonce = (32...44).to_a.pack('C*')
+        cipher.iv = nonce
+        nonce
+      end
+      cipher
+    end
+    ciphertext = described_class.encrypt_data(data: "offline:\x00\xff\n".b, yubikey: { slot: 2, serial: '12345678' })
+    expect(JSON.parse(ciphertext.delete_prefix(described_class::YUBIKEY_HEADER))).to eq(envelope)
+  end
+end