pwn 0.5.783 → 0.5.785

data/spec/lib/pwn/plugins/yubikey_security_spec.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+require 'English'
+require 'spec_helper'
+require 'pwn/plugins/yubikey'
+
+RSpec.describe PWN::Plugins::YubiKey, 'native credential boundaries' do
+  before { expect(described_class::Transport).not_to receive(:open) }
+
+  it 'rejects legacy process settings and unknown parameters without exposing values' do
+    %i[ykman stdin input log_file max_output scp scp_ca scp_sd scp_oce arbitrary].each do |key|
+      expect do
+        described_class.command({ args: %w[otp info], key => 'synthetic-sensitive-value' })
+      end.to raise_error(ArgumentError, /[Uu]nknown|[Uu]nsupported/) { |error|
+        expect(error.full_message).not_to include('synthetic-sensitive-value')
+      }
+    end
+  end
+
+  it 'validates native selectors before opening anything' do
+    { serial: ['', 123, ' 123', '123x', "123\n", false],
+      reader: ['', false, "reader\n"], device_path: ['', false, "path\0"],
+      timeout: [0, -1, Float::NAN, Float::INFINITY, '30', nil, false], connection: [false, Object.new] }.each do |key, values|
+      values.each do |value|
+        expect { described_class.command({ args: %w[otp info], key => value }) }.to raise_error(ArgumentError)
+      end
+    end
+  end
+
+  it 'requires literal consent for mutations and authentication regardless of force flags' do
+    [%w[otp delete 2 --force], %w[fido reset], %w[piv access change-pin], %w[oath accounts code account],
+     %w[sd reset], %w[config usb --list --disable OTP], %w[hsmauth credentials generate name]].each do |args|
+      [nil, false, 'true', 1].each do |confirm|
+        expect { described_class.command(args: args, confirm: confirm) }.to raise_error(described_class::ConfirmationRequired)
+      end
+    end
+  end
+
+  it 'rejects secret argv including inline flags and surplus positional credentials' do
+    [%w[piv info --pin fixture-secret], %w[piv info --pin=fixture-secret],
+     %w[fido access change-pin -nfixture-secret], %w[otp --access-code fixture-secret info],
+     %w[otp chalresp 2 fixture-secret], %w[otp static 2 fixture-secret],
+     %w[oath accounts add account fixture-secret], %w[oath accounts uri otpauth://fixture-secret],
+     %w[sd keys import 1 1 fixture-secret], %w[info --log-file fixture-secret],
+     %w[future reset fixture-secret]].each do |args|
+      expect do
+        described_class.command(args: args, confirm: true)
+      end.to raise_error(ArgumentError) { |error| expect(error.full_message).not_to include('fixture-secret') }
+    end
+  end
+
+  it 'rejects malformed argv without coercion or control characters' do
+    ['info', [], [nil], [false], ["otp\0", 'info'], ['otp', 'info', 'x' * 65_537]].each do |args|
+      expect { described_class.command(args: args) }.to raise_error(ArgumentError)
+    end
+  end
+end
+
+RSpec.describe PWN::Plugins::YubiKey, 'native connection lifetime' do
+  let(:connection) { double('native connection', descriptor: { protocol: :apdu }, exchange: ''.b) }
+
+  [IOError, Interrupt, PWN::Plugins::YubiKey::TimeoutError].each do |error_class|
+    it "closes its owned connection on #{error_class}" do
+      expect(described_class::Transport).to receive(:open).and_return(connection)
+      expect(connection).to receive(:close).once
+      expect(described_class::OTP).to receive(:execute) do |params|
+        params[:connection].descriptor
+        raise error_class, 'fixture failure'
+      end
+      expected = error_class == IOError ? described_class::CommandError : error_class
+      expect { described_class.otp(args: ['info']) }.to raise_error(expected)
+    end
+  end
+
+  it 'never closes a borrowed connection even on an APDU failure' do
+    expect(connection).not_to receive(:close)
+    expect(connection).to receive(:exchange).and_return(['6982'].pack('H*'))
+    expect do
+      described_class.oath(args: ['info'], connection: connection)
+    end.to raise_error(described_class::Protocol::APDUError) { |error| expect(error.status).to eq(0x6982) }
+  end
+
+  it 'suppresses native IO diagnostic secrets and exception causes' do
+    expect(described_class::Transport).to receive(:open).and_raise(IOError, 'synthetic-sensitive-path')
+    expect do
+      described_class.otp(args: ['info'])
+    end.to raise_error(described_class::CommandError) { |error|
+      expect(error.full_message).not_to include('synthetic-sensitive-path')
+      expect(error.cause).to be_nil
+    }
+  end
+
+  [false, true].each do |owned|
+    it "wraps an explicit secure channel and preserves #{owned ? 'owned cleanup' : 'caller ownership'}" do
+      options = { scp: :scp03, kvn: 7, key_enc: 'e' * 16, key_mac: 'm' * 16 }.freeze
+      wrapper = double('secure connection', exchange: ''.b)
+      expect(described_class::Transport).to receive(:open).and_return(connection) if owned
+      if owned
+        expect(connection).to receive(:close).once
+      else
+        expect(connection).not_to receive(:close)
+      end
+      expect(described_class::SecurityDomain).to receive(:secure_connection) do |params|
+        expect(params).to include(options)
+        expect(params[:confirm]).to be(true)
+        expect(params[:connection].descriptor).to eq(protocol: :apdu)
+        params[:connection].close # SCP invalidation must not close the borrowed handle.
+        wrapper
+      end
+      expect(wrapper).to receive(:close).once
+      expect(described_class::OATH).to receive(:execute).with(hash_including(connection: wrapper, args: ['info'], confirm: true)).and_return(:secure_result)
+      selected = owned ? {} : { connection: connection }
+      expect(described_class.oath(selected.merge(args: ['info'], confirm: true, secure_channel: options))).to eq(:secure_result)
+      expect(options).not_to have_key(:connection)
+    end
+  end
+
+  it 'never falls back to plaintext after secure-channel authentication failure' do
+    expect(described_class::Transport).to receive(:open).and_return(connection)
+    expect(connection).to receive(:close).once
+    expect(described_class::SecurityDomain).to receive(:secure_connection).and_raise(described_class::ResponseError, 'SCP authentication failed')
+    expect(described_class::OATH).not_to receive(:execute)
+    expect do
+      described_class.oath(args: ['info'], confirm: true, secure_channel: { scp: :scp03, kvn: 1, key_enc: 'e' * 16, key_mac: 'm' * 16 })
+    end.to raise_error(described_class::ResponseError, /SCP/)
+  end
+
+  it 'validates secure-channel options and explicit consent before opening hardware' do
+    expect(described_class::Transport).not_to receive(:open)
+    [false, 'scp03', {}, { scp: :scp03, confirm: true }, { connection: connection }].each do |value|
+      expect { described_class.oath(args: ['info'], confirm: true, secure_channel: value) }.to raise_error(ArgumentError)
+    end
+    expect do
+      described_class.oath(args: ['info'], secure_channel: { scp: :scp03, kvn: 1, key_enc: 'e' * 16, key_mac: 'm' * 16 })
+    end.to raise_error(described_class::ConfirmationRequired)
+  end
+
+  it 'loads the facade in a fresh Ruby without process libraries or device discovery' do
+    source = <<~RUBY
+      before = $LOADED_FEATURES.dup
+      require 'pwn/plugins/yubikey'
+      added = $LOADED_FEATURES - before
+      abort 'process library loaded' if added.any? { |path| path.match?(%r{/(?:open3|pty)(?:\\.|/)}) }
+      abort 'native transport eagerly loaded' unless PWN::Plugins::YubiKey.autoload?(:Transport)
+      puts 'native-only'
+    RUBY
+    output = IO.popen([RbConfig.ruby, '-Ilib', '-e', source], &:read)
+    expect($CHILD_STATUS).to be_success
+    expect(output).to eq("native-only\n")
+    text = File.read(File.expand_path('../../../../lib/pwn/plugins/yubikey.rb', __dir__))
+    expect(text).not_to match(/Open3|PTY|\b(?:system|spawn|popen|exec)\s*\(/)
+  end
+end
+
+RSpec.describe PWN::Plugins::YubiKey, 'total native operation deadline' do
+  before do
+    @now = 100.0
+    allow(Process).to receive(:clock_gettime).with(Process::CLOCK_MONOTONIC) { @now }
+  end
+
+  it 'shares one budget across acquisition, OATH SELECT, LIST and calculation' do
+    connection = double('APDU transport', descriptor: { protocol: :apdu })
+    expect(described_class::Transport).to receive(:open).with(hash_including(application: :oath, timeout: 3)) do
+      @now += 1
+      connection
+    end
+    expect(connection).to receive(:close).once
+    expect(connection).to receive(:exchange).with(hash_including(data: ['00a4040007a0000005272101'].pack('H*'), timeout: 2)).ordered do
+      @now += 1
+      ['79030507017101739000'].pack('H*')
+    end
+    expect(connection).to receive(:exchange).with(hash_including(data: ['00a1000000'].pack('H*'), timeout: 1)).ordered do
+      @now += 2
+      ['720221619000'].pack('H*')
+    end
+    expect do
+      described_class.oath_code(account: 'a', confirm: true, timeout: 3, timestamp: 59)
+    end.to raise_error(described_class::TimeoutError)
+  end
+
+  it 'charges secure-channel authentication to the same budget on a borrowed connection' do
+    connection = double('APDU transport', descriptor: { protocol: :apdu })
+    expect(connection).not_to receive(:close)
+    expect(described_class::SecurityDomain).to receive(:secure_connection) do |params|
+      expect(params[:timeout]).to eq(3)
+      @now += 2
+      params[:connection]
+    end
+    expect(connection).to receive(:exchange).with(hash_including(timeout: 1)).once do
+      @now += 2
+      ['79030507017101739000'].pack('H*')
+    end
+    expect do
+      described_class.oath(args: ['info'], connection: connection, confirm: true, timeout: 3,
+                           secure_channel: { scp: :scp03, kvn: 1, key_enc: 'e' * 16, key_mac: 'm' * 16 })
+    end.to raise_error(described_class::TimeoutError)
+  end
+
+  it 'refuses exchanges when acquisition exhausts the budget and still closes the owned handle' do
+    connection = double('late native transport', descriptor: { protocol: :otp })
+    expect(described_class::Transport).to receive(:open) do
+      @now += 4
+      connection
+    end
+    expect(connection).not_to receive(:exchange)
+    expect(connection).to receive(:close).once
+    expect { described_class.otp(args: ['info'], timeout: 3) }.to raise_error(described_class::TimeoutError)
+  end
+end
+
+RSpec.describe PWN::Plugins::YubiKey, 'validation before native acquisition' do
+  it 'does not open a device for missing PIV credentials or an invalid native slot' do
+    expect(described_class::Transport).not_to receive(:open)
+    expect { described_class.piv(args: %w[access change-pin], confirm: true) }.to raise_error(ArgumentError)
+    expect { described_class.otp(args: %w[delete invalid-slot], confirm: true) }.to raise_error(ArgumentError)
+  end
+
+  it 'runs explicit cache-only forget without discovering or opening a YubiKey' do
+    cache = double('caller encrypted cache', encrypted?: true, clear: nil, empty?: true)
+    expect(described_class::Transport).not_to receive(:open)
+    expect(described_class::Transport).not_to receive(:devices)
+    expect(cache).to receive(:clear).once
+    expect(described_class.oath(args: %w[access forget --all], confirm: true, encrypted_cache: cache)).to eq(forgotten: :all, verified: true)
+  end
+
+  it 'allows native read-only inventory without authorizing authentication or changes' do
+    connection = double('caller connection', exchange: nil)
+    expect(described_class::Management).to receive(:execute).with(hash_including(args: %w[usb --list])).and_return(:inventory)
+    expect(described_class.config(args: %w[usb --list], connection: connection)).to eq(:inventory)
+    expect(described_class::HSMAuth).to receive(:execute).with(hash_including(args: %w[credentials list])).and_return([])
+    expect(described_class.hsmauth(args: %w[credentials list], connection: connection)).to eq([])
+    expect do
+      described_class.config(args: %w[usb --list], disable: 'OTP', connection: connection)
+    end.to raise_error(described_class::ConfirmationRequired)
+  end
+
+  it 'keeps OATH list read-only only when no authentication or cache state is requested' do
+    connection = double('caller connection', descriptor: { protocol: :apdu })
+    expect(connection).to receive(:exchange).with(hash_including(data: ['00a4040007a0000005272101'].pack('H*'))).ordered.and_return(['79030507017101739000'].pack('H*'))
+    expect(connection).to receive(:exchange).with(hash_including(data: ['00a1000000'].pack('H*'))).ordered.and_return(['9000'].pack('H*'))
+    expect(described_class.oath(args: %w[accounts list], connection: connection)).to eq([])
+    expect do
+      described_class.oath(args: %w[accounts list], password: 'synthetic', connection: connection)
+    end.to raise_error(described_class::ConfirmationRequired)
+  end
+
+  it 'documents every public root API with native behavior and no executable backend' do
+    output = StringIO.new
+    prior = $stdout
+    $stdout = output
+    described_class.help
+    (described_class.singleton_methods(false) - [:help]).each do |method|
+      expect(output.string).to include("PWN::Plugins::YubiKey.#{method}")
+    end
+    expect(output.string).to include('native', 'secret_provider', 'operator:', 'total')
+    expect(output.string).not_to include('wrapper for official', 'executable path')
+  ensure
+    $stdout = prior
+  end
+end

data/spec/lib/pwn/plugins/yubikey_spec.rb

@@ -0,0 +1,209 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'pwn/plugins/yubikey'
+
+RSpec.describe PWN::Plugins::YubiKey do
+  it 'has no executable dependencies' do
+    expect(described_class.required_bins).to eq([])
+  end
+
+  it 'autoloads native children without probing a device' do
+    %i[Protocol Transport OTP Management OATH HSMAuth PIV FIDO OpenPGP SecurityDomain].each do |name|
+      expect(described_class.const_defined?(name, false)).to be(true)
+    end
+  end
+
+  it 'checks host availability without discovery' do
+    expect(described_class::Transport).to receive(:available?).with({}).and_return(true)
+    expect(described_class::Transport).not_to receive(:devices)
+    expect(described_class::Transport).not_to receive(:open)
+    expect(described_class.available?).to be(true)
+  end
+
+  it 'returns native descriptors from explicit discovery' do
+    records = [{ serial: '001234', protocol: :apdu, reader: 'Fixture NFC' }]
+    expect(described_class::Transport).to receive(:devices).with({ serial: '001234', timeout: 3 }).and_return(records)
+    expect(described_class.devices(serial: '001234', timeout: 3)).to equal(records)
+  end
+
+  it 'routes OTP info through the actual application and Protocol with owned cleanup' do
+    connection = double('native transport', descriptor: { protocol: :apdu }, close: :closed)
+    expect(described_class::Transport).to receive(:open) do |opened|
+      expect(opened).to include(application: :otp, serial: '001234', reader: 'Fixture NFC')
+      expect(opened[:timeout]).to be_positive.and be <= 3
+      connection
+    end
+    expect(connection).to receive(:exchange).with(protocol: :apdu, data: ['00a4040007a0000005272001'].pack('H*'), timeout: kind_of(Numeric)).and_return(['0507010302009000'].pack('H*'))
+    expect(connection).to receive(:close).once
+    result = described_class.command(args: %w[otp info], serial: '001234', reader: 'Fixture NFC', timeout: 3)
+    expect(result).to include(version: [5, 7, 1], programming_sequence: 3)
+    expect(result[:slots][2][:configured]).to be(true)
+  end
+end
+
+RSpec.describe PWN::Plugins::YubiKey, 'native family routing' do
+  { otp: ['otp', :OTP, :otp], config: ['config', :Management, :management], oath: ['oath', :OATH, :oath],
+    hsmauth: ['hsmauth', :HSMAuth, :hsmauth], piv: ['piv', :PIV, :piv], fido: ['fido', :FIDO, :fido],
+    openpgp: ['openpgp', :OpenPGP, :openpgp], security_domain: ['sd', :SecurityDomain, :security_domain] }.each do |method, (prefix, name, application)|
+    child = PWN::Plugins::YubiKey.const_get(name)
+    it "provides local #{prefix} help without a transport" do
+      expect(described_class::Transport).not_to receive(:open)
+      expect(described_class::Transport).not_to receive(:devices)
+      expect(described_class.public_send(method)).to include(application: application, operations: child.operations)
+      child.operations.each do |operation|
+        expect(described_class.cli_help(path: [prefix] + operation.split)).to include(operations: [operation])
+      end
+    end
+
+    child.operations.each do |operation|
+      it "routes #{prefix} #{operation} to the native child without rewriting options" do
+        connection = double('caller connection', exchange: nil)
+        expect(connection).not_to receive(:close)
+        opts = { args: operation.split.freeze, confirm: true, connection: connection, timeout: 4 }.freeze
+        expect(child).to receive(:execute).with(hash_including(opts.except(:connection))) do |received|
+          expect(received[:connection]).to respond_to(:exchange, :descriptor)
+          expect(received.keys).to match_array(opts.keys)
+          :native_result
+        end
+        expect(described_class.public_send(method, opts)).to eq(:native_result)
+        expect(opts[:args]).to eq(operation.split)
+      end
+    end
+  end
+
+  it 'forwards typed credentials and providers by identity, never as argv' do
+    connection = double('caller connection', exchange: nil)
+    pin = 'synthetic-pin'
+    provider = ->(_name) { raise 'unexpected prompt' }
+    expect(described_class::PIV).to receive(:execute).with(hash_including(args: %w[access change-pin], confirm: true, pin: pin, new_pin: 'synthetic-new-pin', secret_provider: provider)).and_return(:changed)
+    expect(described_class.piv(args: %w[access change-pin], confirm: true, connection: connection, pin: pin, new_pin: 'synthetic-new-pin', secret_provider: provider)).to eq(:changed)
+  end
+
+  it 'calls Management.info for root info without inventing a config subcommand' do
+    connection = double('caller connection', exchange: nil)
+    expect(described_class::Management).to receive(:info).with(hash_including(connection: respond_to(:exchange))).and_return(version: [5, 7, 1])
+    expect(described_class.info(connection: connection)).to eq(version: [5, 7, 1])
+  end
+
+  it 'dispatches root list and info aliases in Ruby' do
+    expect(described_class::Transport).to receive(:devices).with({}).and_return([{ serial: '001234' }])
+    expect(described_class.command(args: ['list'])).to eq([{ serial: '001234' }])
+    connection = double('caller connection', exchange: nil)
+    expect(described_class::Management).to receive(:info).with(hash_including(connection: respond_to(:exchange))).and_return(:information)
+    expect(described_class.command(args: ['info'], connection: connection)).to eq(:information)
+  end
+
+  it 'rejects arbitrary help paths without opening a device' do
+    expect(described_class::Transport).not_to receive(:open)
+    [%w[otp delete 2 --force], ['--help'], ['script'], ['future']].each do |path|
+      expect { described_class.cli_help(path: path) }.to raise_error(ArgumentError)
+    end
+    expect(described_class.command(args: ['--help'])).to include(backend: :native)
+  end
+end
+
+RSpec.describe PWN::Plugins::YubiKey, 'native Vault and MFA helpers' do
+  let(:connection) { double('native connection', descriptor: { protocol: :otp }, close: :closed) }
+
+  it 'returns the raw RFC 2202 HMAC from the native OTP exchange' do
+    expect(described_class::Transport).not_to receive(:open)
+    expect(connection).not_to receive(:close)
+    expect(connection).to receive(:exchange).with(protocol: :otp, command: 0, data: ''.b, response_length: 6, timeout: a_value_between(0, 3)).and_return(['050701030200'].pack('H*'))
+    expect(connection).to receive(:exchange).with(protocol: :otp, command: 0x38, data: 'Hi There'.b.ljust(64, "\0"), response_length: 20, timeout: a_value_between(0, 3)).and_return(['b617318655057264e28bc0b6fb378c8ef146be00'].pack('H*'))
+    opts = { challenge: 'Hi There', connection: connection, timeout: 3, confirm: true }.freeze
+    result = described_class.challenge_response(opts)
+    expect(result.unpack1('H*')).to eq('b617318655057264e28bc0b6fb378c8ef146be00')
+    expect(result.encoding).to eq(Encoding::BINARY)
+    expect(opts.keys).not_to include(:slot)
+  end
+
+  it 'programs and verifies a slot through the real OTP application without subprocesses' do
+    key = ['0b' * 20].pack('H*').freeze
+    before = ['050701030200'].pack('H*')
+    after = ['050701040200'].pack('H*')
+    expect(connection).to receive(:exchange).with(hash_including(command: 0)).ordered.and_return(before)
+    expect(connection).to receive(:exchange).with(hash_including(command: 3)).ordered do |request|
+      expect(request[:data].bytesize).to eq(58)
+      expect(request[:data].byteslice(22, 16)).to eq(key.byteslice(0, 16))
+      ''.b
+    end
+    expect(connection).to receive(:exchange).with(hash_including(command: 0)).ordered.and_return(after)
+    expect(connection).to receive(:exchange).with(hash_including(command: 0)).ordered.and_return(after)
+    expect(connection).to receive(:exchange).with(hash_including(command: 0x38)).ordered.and_return(['b617318655057264e28bc0b6fb378c8ef146be00'].pack('H*'))
+    expect(described_class.provision_challenge_response(key: key, connection: connection, serial: '001234', confirm: true, verification_challenge: 'Hi There')).to eq(:verified)
+  end
+
+  it 'validates helper arguments before opening a transport' do
+    expect(described_class::Transport).not_to receive(:open)
+    [nil, '', 'x' * 65, [], 42].each do |challenge|
+      expect { described_class.challenge_response(challenge: challenge, confirm: true) }.to raise_error(ArgumentError)
+    end
+    [0, 3, '2', 2.0, false].each do |slot|
+      expect { described_class.challenge_response(challenge: 'x', slot: slot, confirm: true) }.to raise_error(ArgumentError)
+    end
+    [nil, '', "bad\n", 'x' * 65].each do |account|
+      expect { described_class.oath_code(account: account, confirm: true) }.to raise_error(ArgumentError)
+    end
+    expect { described_class.oath_code(account: 'fixture', timestamp: -1, confirm: true) }.to raise_error(ArgumentError)
+    expect { described_class.provision_challenge_response(key: 'k' * 19, serial: '001234', confirm: true) }.to raise_error(ArgumentError)
+    expect { described_class.provision_challenge_response(key: 'k' * 20, confirm: true) }.to raise_error(ArgumentError)
+  end
+
+  it 'requires consent for provisioning and OATH calculation before opening a device' do
+    expect(described_class::Transport).not_to receive(:open)
+    [false, nil, 'true'].each do |confirm|
+      expect { described_class.oath_code(account: 'fixture', confirm: confirm) }.to raise_error(described_class::ConfirmationRequired)
+      expect { described_class.provision_challenge_response(key: 'k' * 20, serial: '001234', confirm: confirm) }.to raise_error(described_class::ConfirmationRequired)
+    end
+  end
+
+  it 'calculates an existing-slot HMAC without a mutation consent flag' do
+    connection = double('offline OTP', descriptor: { protocol: :otp }, close: :closed)
+    allow(described_class::Transport).to receive(:open).and_return(connection)
+    allow(described_class::OTP).to receive(:challenge_response).and_return('r'.b * 20)
+    expect(described_class.challenge_response(challenge: 'fixture')).to eq('r'.b * 20)
+  end
+end
+
+RSpec.describe PWN::Plugins::YubiKey, 'explicit native APDUs' do
+  let(:connection) { double('smartcard connection', descriptor: { protocol: :apdu }, close: :closed) }
+
+  it 'encodes typed APDUs through Protocol without putting payloads into argv' do
+    expect(connection).not_to receive(:close)
+    expect(connection).to receive(:exchange).with(protocol: :apdu, data: ['002000800431323334'].pack('H*'), timeout: kind_of(Numeric)).and_return(['9000'].pack('H*'))
+    expect(described_class.apdu(ins: 0x20, p2: 0x80, data: '1234'.b, connection: connection, confirm: true)).to eq(''.b)
+  end
+
+  it 'selects an explicit application and sends legacy nonsecret compact APDUs in Ruby' do
+    expect(connection).to receive(:exchange).with(hash_including(data: ['00a4040007a0000005272101'].pack('H*'))).ordered.and_return(['9000'].pack('H*'))
+    expect(connection).to receive(:exchange).with(hash_including(data: ['00a1000000'].pack('H*'))).ordered.and_return(['720221619000'].pack('H*'))
+    result = described_class.command(args: %w[apdu --app oath a1=], connection: connection, confirm: true)
+    expect(result).to eq([{ data: ['72022161'].pack('H*'), status: 0x9000 }])
+  end
+
+  it 'supports explicit full APDU frames with status records and no automatic retries' do
+    expect(connection).to receive(:exchange).with(hash_including(data: ['00a1000000'].pack('H*'))).once.and_return(['6982'].pack('H*'))
+    expect(described_class.apdu(args: %w[--send-apdu 00a1000000], connection: connection, confirm: true)).to eq([{ data: ''.b, status: 0x6982 }])
+  end
+
+  it 'checks expected status words without including command payloads in errors' do
+    expect(connection).to receive(:exchange).once.and_return(['6982'].pack('H*'))
+    expect do
+      described_class.apdu(args: ['20:31323334='], connection: connection, confirm: true)
+    end.to raise_error(described_class::Protocol::APDUError) { |error|
+      expect(error.status).to eq(0x6982)
+      expect(error.full_message).not_to include('31323334')
+    }
+  end
+
+  it 'rejects consent bypass, malformed frames and mixed inputs before transport acquisition' do
+    expect(described_class::Transport).not_to receive(:open)
+    expect { described_class.apdu(ins: 0xa1) }.to raise_error(described_class::ConfirmationRequired)
+    [%w[--send-apdu xyz], %w[--app oath --send-apdu 00a1000000], %w[--send-apdu 00a1], ['invalid']].each do |args|
+      expect { described_class.apdu(args: args, confirm: true) }.to raise_error(ArgumentError)
+    end
+    expect { described_class.apdu(ins: 256, confirm: true) }.to raise_error(ArgumentError)
+    expect(described_class.apdu).to include(operations: ['apdu'])
+  end
+end

data/spec/lib/pwn/plugins/yubikey_terminal_spec.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'pty'
+require 'io/console'
+require 'io/wait'
+require 'timeout'
+require 'fcntl'
+
+RSpec.describe PWN::Plugins::YubiKey, 'private native operator input' do
+  let(:connection) { double('caller native connection', exchange: nil) }
+
+  it 'reads a masked credential directly from the console and returns no secrets or device results' do
+    master, terminal = PTY.open
+    flags = terminal.fcntl(Fcntl::F_GETFL)
+    screen = ''.b
+    captured = nil
+    opts = { args: %w[oath accounts list], confirm: true, operator: true, terminal: terminal, connection: connection, timeout: 5 }.freeze
+    expect(described_class::OATH).to receive(:execute) do |received|
+      captured = received[:secret_provider].call(:password)
+      expect(captured).to eq('synthetic-password')
+      'sensitive-device-output'
+    end
+    operator = Thread.new do
+      Timeout.timeout(5) do
+        screen << master.readpartial(1024) until screen.include?('YubiKey password: ')
+        expect(terminal.echo?).to be(false)
+        master.write("synthetic-password\n")
+      end
+    end
+    expect do
+      expect(described_class.interact(opts)).to eq(:completed)
+    end.not_to output.to_stdout
+    operator.value
+    screen << master.readpartial(1024) while master.wait_readable(0)
+    expect(screen).not_to include('synthetic-password', 'sensitive-device-output')
+    expect(captured).to eq("\0" * 'synthetic-password'.bytesize)
+    expect(terminal).not_to be_closed
+    expect(terminal.echo?).to be(true)
+    expect(terminal.fcntl(Fcntl::F_GETFL)).to eq(flags)
+    expect(opts).not_to have_key(:secret_provider)
+  ensure
+    operator&.kill&.join
+    master&.close
+    terminal&.close
+  end
+
+  it 'requires literal operator opt-in and refuses agent request contexts before looking up a console' do
+    expect(IO).not_to receive(:console)
+    expect(described_class::Transport).not_to receive(:open)
+    expect { described_class.interact(args: %w[oath accounts list]) }.to raise_error(described_class::ConfirmationRequired)
+    expect { described_class.interact(args: %w[oath accounts list], confirm: true) }.to raise_error(ArgumentError, /operator/)
+    prior = Thread.current[:pwn_request_runtime]
+    Thread.current[:pwn_request_runtime] = Object.new
+    expect do
+      described_class.interact(args: %w[oath accounts list], confirm: true, operator: true)
+    end.to raise_error(ArgumentError, /private.*operator|agent/)
+  ensure
+    Thread.current[:pwn_request_runtime] = prior
+  end
+
+  it 'rejects virtual terminals, credential argv and an overriding provider before device acquisition' do
+    expect(described_class::Transport).not_to receive(:open)
+    expect do
+      described_class.interact(args: %w[oath accounts list], confirm: true, operator: true, terminal: StringIO.new)
+    end.to raise_error(ArgumentError, /terminal/)
+    expect do
+      described_class.interact(args: %w[piv info --pin synthetic-secret], confirm: true, operator: true, terminal: StringIO.new)
+    end.to raise_error(ArgumentError)
+    expect do
+      described_class.interact(args: %w[oath accounts list], confirm: true, operator: true, secret_provider: ->(_name) { 'synthetic-secret' })
+    end.to raise_error(ArgumentError)
+  end
+
+  [false, true].each do |interrupt|
+    it "restores echo and descriptor flags on #{interrupt ? 'interruption' : 'input timeout'} without closing caller IO" do
+      master, terminal = PTY.open
+      flags = terminal.fcntl(Fcntl::F_GETFL) | Fcntl::O_NONBLOCK
+      terminal.fcntl(Fcntl::F_SETFL, flags)
+      expect(described_class::OATH).to receive(:execute) { |opts| opts[:secret_provider].call(:password) }
+      worker = Thread.new do
+        Thread.current.report_on_exception = false
+        described_class.interact(args: %w[oath accounts list], confirm: true, operator: true, terminal: terminal, connection: connection, timeout: interrupt ? 5 : 0.2)
+      end
+      screen = ''.b
+      Timeout.timeout(5) { screen << master.readpartial(1024) until screen.include?('YubiKey password: ') }
+      worker.raise(Interrupt) if interrupt
+      expect { Timeout.timeout(5) { worker.value } }.to raise_error(interrupt ? Interrupt : described_class::TimeoutError)
+      expect(terminal).not_to be_closed
+      expect(terminal.echo?).to be(true)
+      expect(terminal.fcntl(Fcntl::F_GETFL)).to eq(flags)
+    ensure
+      worker.kill.join if worker&.alive?
+      master&.close
+      terminal&.close
+    end
+  end
+end
+
+RSpec.describe PWN::Plugins::YubiKey, 'terminal access and descriptor ownership' do
+  %i[file wrapper].each do |kind|
+    %w[r w].each do |mode|
+      it "rejects #{kind} terminal mode #{mode} before consuming input or opening a device" do
+        master, slave = PTY.open
+        terminal = kind == :file ? File.open(slave.path, mode) : IO.for_fd(slave.fileno, mode, autoclose: false)
+        slave.echo = false
+        master.write("untouched-input\n")
+        expect(slave.wait_readable(1)).to eq(slave)
+        flags = terminal.fcntl(Fcntl::F_GETFL)
+        expect(flags & Fcntl::O_ACCMODE).to eq(Fcntl::O_RDWR) if kind == :wrapper
+        expect(described_class::Transport).not_to receive(:open)
+        expect(terminal).not_to receive(:getpass)
+        expect do
+          described_class.interact(args: %w[piv reset --force], confirm: true, operator: true, terminal: terminal)
+        end.to raise_error(ArgumentError, /readable and writable/)
+        expect(terminal).not_to be_closed
+        expect(terminal.fcntl(Fcntl::F_GETFL)).to eq(flags)
+        expect(slave.echo?).to be(false)
+        expect(Timeout.timeout(1) { slave.gets }).to eq("untouched-input\n")
+        expect(master.wait_readable(0)).to be_nil
+      ensure
+        terminal&.close
+        master&.close
+        slave&.close
+      end
+    end
+  end
+
+  it 'uses IO.console by default without consuming pending input for a read-only operation' do
+    master, terminal = PTY.open
+    terminal.echo = false
+    master.write("queued-fixture\n")
+    expect(terminal.wait_readable(1)).to eq(terminal)
+    flags = terminal.fcntl(Fcntl::F_GETFL)
+    connection = double('native OTP connection', descriptor: { protocol: :otp })
+    expect(connection).to receive(:exchange).with(hash_including(command: 0)).and_return(['050701030200'].pack('H*'))
+    expect(connection).not_to receive(:close)
+    expect(IO).to receive(:console).and_return(terminal)
+    expect(described_class.interact(args: %w[otp info], confirm: true, operator: true, connection: connection)).to eq(:completed)
+    expect(terminal.gets).to eq("queued-fixture\n")
+    expect(terminal.echo?).to be(false)
+    expect(terminal.fcntl(Fcntl::F_GETFL)).to eq(flags)
+  ensure
+    master&.close
+    terminal&.close
+  end
+end

data/spec/lib/pwn/redaction_spec.rb

@@ -40,22 +40,25 @@ RSpec.describe 'Persistence redaction' do
   it 'sanitizes regular, learning, debug, mirror, stderr and fallback writes' do
     Dir.mktmpdir do |dir|
       secret = 'ASIAABCDEFGHIJKLMNOP'
-      path = File.join(dir, 'log')
-      allow(File).to receive(:open).and_call_original
-      allow(File).to(receive(:open).with('/tmp/pwn.log', 'a').and_wrap_original { |m, _, mode| m.call(path, mode) })
+      allow(Dir).to receive(:home).and_return(dir)
+      path = File.join(dir, '.pwn', 'logs', 'pwn.log')
       PWN::Plugins::Log.append(level: :info, msg: secret, which_self: secret)
       PWN::Plugins::Log.append(level: :info, msg: { api_key: 'nested-fixture-only' })
       expect(File.read(path)).not_to include(secret, 'nested-fixture-only')
       expect(File.read(path)).to include('[REDACTED:aws:')
-      PWN::Plugins::Log.start_debug(path: path)
-      PWN::Plugins::Log.progress(msg: secret)
-      PWN::Plugins::Log.mirror_tui!(msg: secret)
-      PWN::Plugins::Log.capture_stderr!(text: "#{secret}\n")
+      debug_path = File.join(dir, '.pwn', 'logs', 'debug.log')
+      PWN::Plugins::Log.start_debug(path: debug_path)
+      PWN::Plugins::Log.progress(msg: "progress-sink #{secret}")
+      PWN::Plugins::Log.mirror_tui!(msg: "mirror-sink #{secret}")
+      PWN::Plugins::Log.capture_stderr!(text: "stderr-sink #{secret}\n")
       allow(PWN::Plugins::Log).to receive(:progress).and_return(false)
-      PWN::Plugins::Log.note_interrupt!(where: secret)
+      PWN::Plugins::Log.note_interrupt!(where: "fallback-sink #{secret}")
       PWN::Plugins::Log.stop_debug
-      expect(File.read(path)).not_to include(secret)
-      expect(File.read(path)).to include('[REDACTED:aws:')
+      body = File.read(debug_path)
+      expect(body).not_to include(secret)
+      %w[progress-sink mirror-sink stderr-sink fallback-sink].each do |sink|
+        expect(body).to include("#{sink} [REDACTED:aws:")
+      end
     ensure
       PWN::Plugins::Log.stop_debug
     end