pwn 0.5.784 → 0.5.785

data/spec/lib/pwn/config_redaction_yubikey_spec.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Config, 'YubiKey configuration redaction' do
+  it 'redacts string-keyed hardware settings inside arrays without hiding public selectors' do
+    config = { devices: [{ 'PIN' => '1', 'management-key' => 'synthetic-key', 'oath-secret' => 'synthetic-oath', 'serial' => '12345678', 'slot' => 2 }] }
+    result = described_class.redact_sensitive_artifacts(config: config)
+    masked = result[:devices].first
+    expect(masked.values_at('PIN', 'management-key', 'oath-secret').uniq).to eq(['>>> REDACTED >>> USE `pwn-vault` FOR ADMINISTRATION <<< REDACTED <<<'])
+    expect(masked).to include('serial' => '12345678', 'slot' => 2)
+    expect(config.dig(:devices, 0, 'PIN')).to eq('1')
+  end
+
+  it 'uses the same constant mask for short PINs and hardware secrets while retaining public selectors' do
+    fields = %i[pin new_pin admin_pin puk new_puk management_key new_management_key management_password access_code new_access_code oath_secret oath_password unlock_code unlock_password lock_code new_lock_code reset_code scp scp_key scp_keys scp03_key scp11_key static_password hmac_secret]
+    values = fields.to_h { |field| [field, '123456'] }
+    values[:pin] = '1'
+    values[:puk] = '87654321'
+    config = { plugins: { yubikey: values.merge(serial: '12345678', slot: 2, reader: 'fixture-reader') } }
+    before = Marshal.dump(config)
+    redacted = described_class.redact_sensitive_artifacts(config: config).dig(:plugins, :yubikey)
+    mask = described_class.redact_sensitive_artifacts(config: { password: 'different-value' })[:password]
+    fields.each { |field| expect(redacted[field]).to eq(mask), "#{field} must use the constant mask" }
+    expect(redacted).to include(serial: '12345678', slot: 2, reader: 'fixture-reader')
+    expect(Marshal.dump(config)).to eq(before)
+  end
+end

data/spec/lib/pwn/config_yubikey_spec.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Config, 'hardware vault configuration' do
+  around do |example|
+    Dir.mktmpdir('config-yubikey-') do |root|
+      @root = root
+      example.run
+    end
+  end
+
+  before do
+    allow(Dir).to receive(:home).and_return(@root)
+    stub_const('PWN::Env', {})
+    stub_const('PWN::EnvRedacted', {})
+    stub_const('PWN::Plugins::YubiKey', double('synthetic YubiKey'))
+    allow(PWN::Plugins::YubiKey).to receive(:challenge_response) do |opts|
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts[:challenge])
+    end
+    allow(described_class).to receive(:install_default_skills)
+    allow(described_class).to receive(:load_skills)
+    allow(PWN::Memory).to receive(:load)
+    allow(PWN::Cron).to receive(:install_defaults)
+    allow(PWN::Migrate).to receive(:needed?).and_return(false)
+    @path = File.join(@root, 'pwn.yaml')
+  end
+
+  it 'rejects an invalid hardware selector rather than falling back to a software sidecar' do
+    expect { described_class.default_env(pwn_env_path: @path, yubikey: false) }.to raise_error(ArgumentError)
+    expect(File).not_to exist(@path)
+    expect(File).not_to exist("#{@path}.decryptor")
+  end
+
+  it 'creates the default hardware configuration path when called directly' do
+    described_class.default_env(yubikey: { slot: 2 })
+    path = File.join(@root, '.pwn', 'pwn.yaml')
+    expect(PWN::Plugins::Vault.dump(file: path)).to eq(described_class.env_template)
+    expect(File).not_to exist("#{path}.decryptor")
+  end
+
+  it 'preserves multiline template values containing leading colons during creation' do
+    template = Marshal.load(Marshal.dump(described_class.env_template))
+    text = "before\n:leading-colon\nafter\n"
+    template[:ai][:ollama][:system_role_content] = text
+    allow(described_class).to receive(:env_template).and_return(template)
+    described_class.default_env(pwn_env_path: @path, yubikey: {})
+    expect(PWN::Plugins::Vault.dump(file: @path).dig(:ai, :ollama, :system_role_content)).to eq(text)
+  end
+
+  it 'retains software creation by default and honors the explicitly selected legacy decryptor' do
+    sidecar = File.join(@root, 'custom-sidecar')
+    expect(PWN::Plugins::YubiKey).not_to receive(:challenge_response)
+    described_class.refresh_env(pwn_env_path: @path, pwn_dec_path: sidecar)
+    expect(PWN::Plugins::Vault.hardware_encrypted?(file: @path)).to be(false)
+    credentials = YAML.safe_load_file(sidecar, symbolize_names: true)
+    expect(PWN::Plugins::Vault.dump(credentials.merge(file: @path))).to eq(described_class.env_template)
+    described_class.refresh_env(pwn_env_path: @path, pwn_dec_path: sidecar)
+    expect(PWN::Env.dig(:driver_opts, :pwn_dec_path)).to eq(sidecar)
+    expect(File).not_to exist("#{@path}.decryptor")
+  end
+
+  it 'creates a hardware vault only on explicit opt-in, without staging plaintext or making a sidecar' do
+    described_class.refresh_env(pwn_env_path: @path, yubikey: { slot: 2 })
+    expect(PWN::Plugins::Vault.hardware_encrypted?(file: @path)).to be(true)
+    expect(PWN::Plugins::Vault.dump(file: @path)).to eq(described_class.env_template)
+    expect(File).not_to exist("#{@path}.decryptor")
+    expect(File.stat(@path).mode & 0o777).to eq(0o600)
+    expect(PWN::Env).not_to have_key(:yubikey)
+  end
+
+  it 'leaves no plaintext configuration behind when opted-in hardware creation fails' do
+    allow(PWN::Plugins::YubiKey).to receive(:challenge_response).and_raise(IOError, 'synthetic device unavailable')
+    expect { described_class.default_env(pwn_env_path: @path, yubikey: { slot: 2 }) }.to raise_error(IOError)
+    expect(File).not_to exist(@path)
+    expect(File).not_to exist("#{@path}.decryptor")
+  end
+
+  it 'refreshes a self-describing hardware vault without a decryptor or software-key prompt' do
+    original = { ai: { active: 'ollama', ollama: { model: 'fixture-model' } }, retained: 'fixture-value' }
+    bytes = PWN::Plugins::Vault.encrypt_data(data: YAML.dump(original), yubikey: { slot: 2, serial: '12345678' })
+    File.binwrite(@path, bytes)
+    expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+    described_class.refresh_env(pwn_env_path: @path)
+    expect(PWN::Env.dig(:ai, :ollama, :model)).to eq('fixture-model')
+    expect(PWN::Env[:retained]).to eq('fixture-value')
+    expect(PWN::Env.dig(:driver_opts, :pwn_env_path)).to eq(@path)
+    expect(File.binread(@path)).to eq(bytes)
+    expect(File).not_to exist("#{@path}.decryptor")
+  end
+end

data/spec/lib/pwn/migrate_spec.rb

@@ -30,7 +30,7 @@ describe PWN::Migrate, 'exact migration snapshot scope' do
     File.write(File.join(@tmp, 'cron', 'worker.log'), 'new diagnostic')
     File.write(File.join(@tmp, 'cron', 'schedule-backups', 'receipt.json'), '{}')
     result = described_class.prune_backups(dry_run: false, expire_history: true)
-    expect(result[:deleted]).to eq(%w[20260101_000000 20260102_000000])
+    expect(result).to include(deleted: [], keep: 7, scope: 'global')
     expect(File.read(File.join(@tmp, 'cron', 'worker.log'))).to eq('new diagnostic')
   end
 end
@@ -76,57 +76,17 @@ describe PWN::Migrate do
       allow(PWN::Config).to receive(:pwn_skills_path).and_return(File.join(@tmp, 'skills'))
     end
 
-    it 'expires unique old history only after current recovery coverage is established' do
-      File.write(File.join(@tmp, 'memory.json'), '{"current":true}')
-      4.times do |i|
-        path = File.join(PWN::Migrate::BACKUP_ROOT, "2026010#{i + 1}_000000")
-        FileUtils.mkdir_p(path)
-        File.write(File.join(path, 'memory.json'), i == 3 ? '{"current":true}' : "{\"old\":#{i}}")
-      end
-      result = PWN::Migrate.prune_backups(dry_run: false, expire_history: true)
-      expect(result[:deleted]).to eq(['20260101_000000'])
-      expect(result[:retained].length).to eq(3)
-      expect(File).to exist(File.join(PWN::Migrate::BACKUP_ROOT, '.retention-manifest.json.gz'))
-      expect(File.read(File.join(@tmp, 'memory.json'))).to eq('{"current":true}')
-    end
-
-    context 'bounded historical expiry safeguards' do
-      before do
-        File.write(File.join(@tmp, 'memory.json'), '{}')
-        5.times do |i|
-          path = File.join(PWN::Migrate::BACKUP_ROOT, "2026010#{i + 1}_000000")
-          FileUtils.mkdir_p(path)
-          File.write(File.join(path, 'memory.json'), '{}')
-        end
-      end
-
-      it 'pins actual referenced evidence, not quoted inventory prose' do
-        File.write(File.join(@tmp, 'learning.jsonl'), "#{JSON.generate(evidence_path: "#{PWN::Migrate::BACKUP_ROOT}/20260101_000000/memory.json", prose: "old path #{PWN::Migrate::BACKUP_ROOT}/20260102_000000/memory.json")}\n")
-        FileUtils.cp(File.join(@tmp, 'learning.jsonl'), File.join(PWN::Migrate::BACKUP_ROOT, '20260105_000000', 'learning.jsonl'))
-        result = PWN::Migrate.prune_backups(dry_run: false, expire_history: true)
-        expect(result[:deleted]).to eq(['20260102_000000'])
-        expect(result[:pins]).to eq(['20260101_000000'])
-      end
-
-      it 'refuses expiry without current coverage or matching credential recovery' do
-        File.write(File.join(@tmp, 'pwn.yaml'), 'encrypted-current-fixture')
-        result = PWN::Migrate.prune_backups(dry_run: false, expire_history: true)
-        expect(result[:incomplete]).to be true
-        expect(result[:deleted]).to be_empty
-        File.write(File.join(PWN::Migrate::BACKUP_ROOT, '20260105_000000', 'pwn.yaml'), 'encrypted-old-fixture')
-        expect(PWN::Migrate.prune_backups(dry_run: false, expire_history: true)[:error]).to match(/encrypted configuration/)
-      end
-
-      it 'refuses symlinks and held producer locks and exhausted admission' do
-        File.symlink(File.join(@tmp, 'memory.json'), File.join(PWN::Migrate::BACKUP_ROOT, '20260101_000000', 'unsafe'))
-        expect(PWN::Migrate.prune_backups(dry_run: false, expire_history: true)[:deleted]).to be_empty
-        File.unlink(File.join(PWN::Migrate::BACKUP_ROOT, '20260101_000000', 'unsafe'))
-        File.open(File.join(PWN::Migrate::BACKUP_ROOT, '.retention.lock'), 'w') do |lock|
-          lock.flock(File::LOCK_EX)
-          expect(PWN::Migrate.prune_backups(dry_run: false, expire_history: true)[:error]).to eq('Backup maintenance active')
-        end
-        expect(PWN::Migrate.prune_backups(dry_run: false, expire_history: true, admission: ->(_bytes) { false })[:deleted]).to be_empty
-      end
+    it 'upgrades the existing three-folder policy to seven without pruning legacy data' do
+      FileUtils.mkdir_p(described_class::BACKUP_ROOT, mode: 0o700)
+      policy = File.join(described_class::BACKUP_ROOT, '.retention-policy.json')
+      File.write(policy, JSON.generate(version: 1, keep: 3, pins: [], expire_history: true))
+      File.write(described_class::SCHEMA_FILE, JSON.generate(schema: 11))
+      result = described_class.run(backup: false, io: io)
+      expect(result[:applied_migrations]).to eq([12])
+      expect(JSON.parse(File.read(policy))).to include('keep' => 7, 'scope' => 'global')
+      bytes = File.binread(policy)
+      expect(described_class.run(backup: false, io: io)[:applied_migrations]).to eq([])
+      expect(File.binread(policy)).to eq(bytes)
     end
 
     it '.needed? / .status on a fresh (empty) root' do
@@ -166,7 +126,7 @@ describe PWN::Migrate do
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 2))
       expect(described_class.needed?).to be(true)
       result = described_class.run(fix: false, backup: false, io: io)
-      expect(result[:applied_migrations]).to eq([3, 4, 5, 6, 7, 8, 9, 10, 11])
+      expect(result[:applied_migrations]).to eq([3, 4, 5, 6, 7, 8, 9, 10, 11, 12])
       expected = Marshal.load(Marshal.dump(original))
       expected['custom']['model'] = nil
       expect(YAML.safe_load_file(path)).to eq(expected)
@@ -275,7 +235,7 @@ describe PWN::Migrate do
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 3))
       expect(described_class.needed?).to be(true)
       result = described_class.run(fix: true, backup: false, io: io)
-      expect(result[:applied_migrations]).to eq([4, 5, 6, 7, 8, 9, 10, 11])
+      expect(result[:applied_migrations]).to eq([4, 5, 6, 7, 8, 9, 10, 11, 12])
       creds = YAML.safe_load_file(dec, symbolize_names: true)
       user = PWN::Plugins::Vault.dump(file: yaml, key: creds[:key], iv: creds[:iv])
       expect(user[:ai][:active]).to eq('grok')
@@ -301,7 +261,7 @@ describe PWN::Migrate do
       PWN::Plugins::Vault.create(file: yaml, decryptor_file: dec)
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 4))
       result = described_class.run(fix: true, backup: false, io: io)
-      expect(result[:applied_migrations]).to eq([5, 6, 7, 8, 9, 10, 11])
+      expect(result[:applied_migrations]).to eq([5, 6, 7, 8, 9, 10, 11, 12])
       creds = YAML.safe_load_file(dec, symbolize_names: true)
       user = PWN::Plugins::Vault.dump(file: yaml, key: creds[:key], iv: creds[:iv])
       expect(user.dig(:ai, :agent, :skill_review)).to eq('off')
@@ -326,7 +286,7 @@ describe PWN::Migrate do
       File.write(yaml, YAML.dump(stale).gsub(/^(\s*):/, '\1'))
       PWN::Plugins::Vault.create(file: yaml, decryptor_file: dec)
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 5))
-      expect(described_class.run(fix: true, backup: false, io: io)[:applied_migrations]).to eq([6, 7, 8, 9, 10, 11])
+      expect(described_class.run(fix: true, backup: false, io: io)[:applied_migrations]).to eq([6, 7, 8, 9, 10, 11, 12])
       creds = YAML.safe_load_file(dec, symbolize_names: true)
       user = PWN::Plugins::Vault.dump(file: yaml, key: creds[:key], iv: creds[:iv])
       theme = user.dig(:ai, :tui, :theme)
@@ -373,7 +333,7 @@ describe PWN::Migrate do
       File.write(yaml, YAML.dump(stale).gsub(/^(\s*):/, '\1'))
       PWN::Plugins::Vault.create(file: yaml, decryptor_file: dec)
       File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 8))
-      expect(described_class.run(fix: true, backup: false, io: io)[:applied_migrations]).to eq([9, 10, 11])
+      expect(described_class.run(fix: true, backup: false, io: io)[:applied_migrations]).to eq([9, 10, 11, 12])
       creds = YAML.safe_load_file(dec, symbolize_names: true)
       user = PWN::Plugins::Vault.dump(file: yaml, key: creds[:key], iv: creds[:iv])
       long_fast = user.dig(:plugins, :meshtastic, :channel, :LongFast)
@@ -411,20 +371,18 @@ describe PWN::Migrate, 'backup housekeeping' do
     expect(File.binread(File.join(@tmp, '.schema'))).to eq(before)
   end
 
-  it 'retains three recovery points and unique history but prunes verified duplicate snapshots' do
+  it 'leaves legacy snapshots alone instead of running a competing pruner' do
     root = described_class::BACKUP_ROOT
-    5.times do |i|
+    8.times do |i|
       dir = File.join(root, "2026010#{i + 1}_000000")
       FileUtils.mkdir_p(dir)
-      File.write(File.join(dir, 'learning.jsonl'), i.zero? ? 'unique evidence' : 'same evidence')
+      File.write(File.join(dir, 'learning.jsonl'), 'unique evidence')
     end
-    preview = described_class.prune_backups
-    expect(preview[:eligible].length).to eq(1)
-    expect(Dir.children(root).length).to eq(5)
-    applied = described_class.prune_backups(dry_run: false)
-    expect(applied[:deleted].length).to eq(1)
-    expect(File.binread(File.join(root, '20260101_000000', 'learning.jsonl'))).to eq('unique evidence')
-    expect(Dir.children(root).grep(/\A\d/).length).to eq(4)
+    result = described_class.prune_backups(dry_run: false, keep: 3, expire_history: true)
+    expect(result).to include(keep: 7, scope: 'global', deleted: [])
+    expect(Dir.children(root).length).to eq(8)
+    expect { described_class.send(:backup!) }.to raise_error(IOError)
+    expect(Dir.children(root).grep(/\A\d/).length).to eq(8)
   end
 
   it 'publishes a verified scoped snapshot and fails closed on a copy failure' do
@@ -441,21 +399,11 @@ describe PWN::Migrate, 'backup housekeeping' do
     expect { described_class.send(:backup!) }.to raise_error(IOError, 'copy failed')
   end
 
-  it 'rejects symlinked backup trees and exhausted admission without deleting anything' do
+  it 'rejects a symlinked backup root without touching its target' do
     root = described_class::BACKUP_ROOT
-    FileUtils.mkdir_p(root)
-    File.symlink(@tmp, File.join(root, '20260101_000000'))
-    expect(described_class.prune_backups(dry_run: false)[:incomplete]).to be(true)
-    File.unlink(File.join(root, '20260101_000000'))
-    4.times do |i|
-      dir = File.join(root, "2026010#{i + 1}_000000")
-      FileUtils.mkdir_p(dir)
-      File.write(File.join(dir, 'state'), 'same')
-    end
-    result = described_class.prune_backups(dry_run: false, admission: ->(_bytes) { false })
-    expect(result[:incomplete]).to be(true)
-    expect(result[:deleted]).to eq([])
-    expect(Dir.children(root).grep(/\A\d/).length).to eq(4)
+    File.symlink(@tmp, root)
+    expect { described_class.send(:backup!) }.to raise_error(IOError, /Symlink/)
+    expect(File.symlink?(root)).to be(true)
   end
 
   it 'skips backups for fix mode when schema, files and vault have no drift' do

data/spec/lib/pwn/migrate_yubikey_spec.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+require 'stringio'
+
+RSpec.describe PWN::Migrate, 'hardware vault migrations' do
+  around do |example|
+    Dir.mktmpdir('migrate-yubikey-') do |root|
+      @root = root
+      example.run
+    end
+  end
+
+  before do
+    allow(Dir).to receive(:home).and_return(@root)
+    stub_const('PWN::Migrate::PWN_ROOT', @root)
+    stub_const('PWN::Env', { driver_opts: {} })
+    stub_const('PWN::Plugins::YubiKey', double('synthetic YubiKey'))
+    allow(PWN::Plugins::YubiKey).to receive(:challenge_response) do |opts|
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts[:challenge])
+    end
+    @path = File.join(@root, 'pwn.yaml')
+    @original = { ai: { active: 'ollama', ollama: { model: 'fixture-model' } }, retained: 'fixture-value' }
+    File.binwrite(@path, PWN::Plugins::Vault.encrypt_data(data: YAML.dump(@original), yubikey: { slot: 2 }))
+    @io = StringIO.new
+  end
+
+  it 'backfills through an atomic encrypted update, preserving the hardware format and user choices' do
+    expect(File).not_to receive(:write).with(@path, anything)
+    expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+    result = described_class.backfill_vault(io: @io)
+    expect(result[:added]).to be_positive
+    expect(PWN::Plugins::Vault.hardware_encrypted?(file: @path)).to be(true)
+    document = PWN::Plugins::Vault.dump(file: @path)
+    expect(document.dig(:ai, :ollama, :model)).to eq('fixture-model')
+    expect(document[:retained]).to eq('fixture-value')
+    expect(document.dig(:ai, :agent)).to eq(PWN::Config.env_template.dig(:ai, :agent))
+    bytes = File.binread(@path)
+    expect(described_class.backfill_vault(io: @io)[:added]).to eq(0)
+    expect(File.binread(@path)).to eq(bytes)
+    expect(Dir.children(@root)).to eq(['pwn.yaml'])
+  end
+
+  it 'uses driver-selected hardware vault paths without touching the canonical vault' do
+    custom = File.join(@root, 'selected-vault')
+    FileUtils.cp(@path, custom)
+    PWN::Env[:driver_opts] = { pwn_env_path: custom, pwn_dec_path: File.join(@root, 'absent-sidecar') }
+    canonical = File.binread(@path)
+    expect(described_class.backfill_vault(io: @io)[:added]).to be_positive
+    expect(described_class.vault_drift[:missing]).to be_empty
+    expect(File.binread(@path)).to eq(canonical)
+    expect(PWN::Plugins::Vault.hardware_encrypted?(file: custom)).to be(true)
+  end
+
+  it 'honors an explicit independent legacy decryptor and vault over driver defaults' do
+    custom = File.join(@root, 'legacy-vault')
+    sidecar = File.join(@root, 'separate-legacy-decryptor')
+    File.write(custom, YAML.dump(@original))
+    PWN::Plugins::Vault.create(file: custom, decryptor_file: sidecar)
+    canonical = File.binread(@path)
+    credentials = YAML.safe_load_file(sidecar, symbolize_names: true)
+    result = described_class.backfill_vault(pwn_env_path: custom, pwn_dec_path: sidecar, io: @io)
+    expect(result[:added]).to be_positive
+    expect(PWN::Plugins::Vault.dump(credentials.merge(file: custom)).dig(:ai, :agent)).to be_a(Hash)
+    expect(File.binread(@path)).to eq(canonical)
+  end
+
+  it 'forwards explicit vault selection and hardware overrides through numbered migrations and fix runs' do
+    custom = File.join(@root, 'selected-vault')
+    FileUtils.cp(@path, custom)
+    canonical = File.binread(@path)
+    allow(PWN::Backups).to receive(:active?).and_return(true)
+    allow(described_class).to receive(:status).and_return(schema_installed: 3, schema_current: 4, pwn_version: 'fixture', incompatible: [])
+    allow(described_class).to receive(:stamp!)
+    stub_const('PWN::Migrate::SCHEMA_VERSION', 4)
+    allow(PWN::Plugins::YubiKey).to receive(:challenge_response) do |opts|
+      raise IOError, 'selector was not forwarded' unless opts[:device_path] == '/fixture/native-device'
+
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts[:challenge])
+    end
+    [false, true].each do |fix|
+      File.binwrite(custom, canonical)
+      allow(described_class).to receive(:status).and_return(schema_installed: fix ? 4 : 3, schema_current: 4, pwn_version: 'fixture', incompatible: [])
+      result = described_class.run(fix: fix, backup: false, io: @io, pwn_env_path: custom, yubikey: { device_path: '/fixture/native-device' })
+      expect(result[:applied_migrations]).to eq(fix ? [] : [4])
+      document = PWN::Plugins::Vault.dump(file: custom, yubikey: { device_path: '/fixture/native-device' })
+      expect(document.dig(:ai, :agent)).to be_a(Hash)
+      expect(File.binread(@path) == canonical).to be(true)
+    end
+  end
+
+  it 'reports the explicitly selected vault rather than a missing canonical file during migration' do
+    custom = File.join(@root, 'selected-vault')
+    File.rename(@path, custom)
+    stub_const('PWN::Migrate::SCHEMA_FILE', File.join(@root, '.schema'))
+    File.write(described_class::SCHEMA_FILE, JSON.generate(schema: described_class::SCHEMA_VERSION))
+    allow(PWN::Backups).to receive(:active?).and_return(true)
+    result = described_class.run(fix: true, backup: false, io: @io, pwn_env_path: custom)
+    expect(result[:before][:incompatible]).to be_empty
+    expect(result[:after][:incompatible]).to be_empty
+    expect(result[:after][:files].find { |row| row[:rel] == 'pwn.yaml' }[:path]).to eq(custom)
+    expect(File).not_to exist(@path)
+  end
+
+  it 'does not write during a dry run or when hardware encryption fails or is interrupted' do
+    bytes = File.binread(@path)
+    expect(described_class.backfill_vault(dry_run: true, io: @io)[:added]).to be_positive
+    expect(File.binread(@path)).to eq(bytes)
+    allow(PWN::Plugins::Vault).to receive(:encrypt_data).and_raise(IOError, 'synthetic device unavailable')
+    expect(described_class.backfill_vault(io: @io)).to be_nil
+    expect(File.binread(@path)).to eq(bytes)
+    allow(PWN::Plugins::Vault).to receive(:encrypt_data).and_raise(Interrupt)
+    expect { described_class.backfill_vault(io: @io) }.to raise_error(Interrupt)
+    expect(File.binread(@path)).to eq(bytes)
+    expect(Dir.children(@root)).to eq(['pwn.yaml'])
+  end
+
+  it 'reports missing keys in a hardware vault without a software decryptor' do
+    bytes = File.binread(@path)
+    expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+    result = described_class.vault_drift
+    expect(result).to include(user: @original)
+    expect(result[:missing]).to include('ai.agent')
+    expect(File.binread(@path)).to eq(bytes)
+    expect(File).not_to exist("#{@path}.decryptor")
+  end
+end

data/spec/lib/pwn/module_skills_spec.rb

@@ -51,6 +51,14 @@ describe PWN::ModuleSkills do
     expect(described_class).to respond_to :help
   end
 
+  it 'identifies the file-owning class rather than its enclosing module or nested error class' do
+    lib = File.expand_path('../../../lib', __dir__)
+    rec = described_class.send(:parse_file, path: File.join(lib, 'pwn/ai/agent/mission_namespace.rb'), lib_root: lib).first
+    expect(rec[:const]).to eq('PWN::AI::Agent::MissionNamespace')
+    expect(rec[:source]).to eq('pwn/ai/agent/mission_namespace.rb')
+    expect(described_class.render(module: rec)).to include('module: PWN::AI::Agent::MissionNamespace')
+  end
+
   it 'maps a constant or source file to a namespace-mirrored SKILL.md path' do
     expect(described_class.relpath(const: 'PWN::Plugins::TransparentBrowser')).to eq(
       'pwn/plugins/transparent_browser/SKILL.md'