pwn 0.5.784 → 0.5.787

data/lib/pwn/www/github.rb

@@ -5,6 +5,8 @@ require 'yaml'
 module PWN
   module WWW
     # This plugin supports github.com actions.
+    # YubiKey OATH MFA requires explicit confirm: true because HOTP advances counters
+    # and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
     module GitHub
       # Supported Method Parameters::
       # browser_obj = PWN::WWW::GitHub.open(
@@ -29,10 +31,12 @@ module PWN
       #   username: 'required - username',
       #   password: 'optional - passwd (will prompt if blank)',
       #   mfa: 'optional - MFA / TOTP token string, or true to prompt (defaults to false)',
-      #   mfa_token: 'optional - MFA / TOTP token used to reach a post-authenticated state'
+      #   mfa_token: 'optional - MFA / TOTP token used to reach a post-authenticated state',
+      #   yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
       # )
 
       public_class_method def self.login(opts = {})
+        PWN::Plugins::AuthenticationHelper.validate_mfa_options(opts)
         browser_obj = opts[:browser_obj]
         username = opts[:username].to_s.scrub.strip.chomp
         password = opts[:password]
@@ -45,6 +49,7 @@ module PWN
           password = opts[:password].to_s.scrub.strip.chomp
         end
         mfa = opts[:mfa]
+        yubikey = opts[:yubikey]
         mfa_token = opts[:mfa_token].to_s.scrub.strip.chomp
         mfa_token = mfa.to_s.scrub.strip.chomp if mfa_token.empty? && mfa.is_a?(String)
 
@@ -54,7 +59,7 @@ module PWN
         browser.text_field(name: 'password').wait_until(&:present?).set(password)
         browser.input(name: 'commit').click!
 
-        if mfa || !mfa_token.empty?
+        if mfa || !mfa_token.empty? || !yubikey.nil?
           until browser.url == 'https://github.com/' ||
                 browser.url.include?('https://github.com/dashboard') ||
                 (
@@ -63,23 +68,28 @@ module PWN
                   !browser.url.include?('/session')
                 )
 
+            mfa_field = if browser.text_field(name: 'app_otp').exist?
+                          browser.text_field(name: 'app_otp')
+                        elsif browser.text_field(id: 'app_totp').exist?
+                          browser.text_field(id: 'app_totp')
+                        elsif browser.text_field(name: 'otp').exist?
+                          browser.text_field(name: 'otp')
+                        else
+                          raise ArgumentError, 'YubiKey OATH requires an authenticator challenge, not SMS' unless yubikey.nil?
+
+                          browser.text_field(name: 'sms_otp')
+                        end
+            mfa_field.wait_until(&:present?)
+
             token = if mfa_token.empty?
-                      PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token')
+                      PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token', yubikey: yubikey)
                     else
                       consumed = mfa_token
                       mfa_token = ''
                       consumed
                     end
 
-            if browser.text_field(name: 'app_otp').exist?
-              browser.text_field(name: 'app_otp').wait_until(&:present?).set(token)
-            elsif browser.text_field(id: 'app_totp').exist?
-              browser.text_field(id: 'app_totp').wait_until(&:present?).set(token)
-            elsif browser.text_field(name: 'otp').exist?
-              browser.text_field(name: 'otp').wait_until(&:present?).set(token)
-            else
-              browser.text_field(name: 'sms_otp').wait_until(&:present?).set(token)
-            end
+            mfa_field.set(token)
 
             if browser.input(name: 'commit').exist?
               browser.input(name: 'commit').click!
@@ -151,13 +161,19 @@ module PWN
             proxy: 'optional - scheme://proxy_host:port || tor'
           )
 
-          # Run login and return its result
+          # Log in with manual MFA or explicitly selected YubiKey OATH.
+          # YubiKey enables MFA even when mfa is false; failures never fall back to a prompt.
+          # Configure the service for an authenticator challenge, not SMS.
+          # Example yubikey: { account: 'EXACT_OATH_NAME', confirm: true, serial: '123456', timeout: 30 }
+          # Explicit consent is required: HOTP advances counters and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
+          # Reject conflicting explicit tokens before any login action.
           #{self}.login(
             browser_obj: 'required - browser_obj returned from #open method',
             username: 'required - username value consumed by #login',
             password: 'optional - passwd (will prompt if blank)',
             mfa: 'optional - MFA / TOTP token string, or true to prompt (defaults to false)',
-            mfa_token: 'optional - MFA / TOTP token used to reach a post-authenticated state'
+            mfa_token: 'optional - MFA / TOTP token used to reach a post-authenticated state',
+            yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
           )
 
           # Run logout and return its result

data/lib/pwn/www/paypal.rb

@@ -5,6 +5,9 @@ require 'yaml'
 module PWN
   module WWW
     # This plugin supports paypal.com actions.
+    # Its legacy login adapter selects SMS MFA; YubiKey OATH is unsupported even
+    # with confirm: true; it is rejected before login rather than submitting
+    # an authenticator code as SMS.
     module Paypal
       # Supported Method Parameters::
       # browser_obj = PWN::WWW::Paypal.open(
@@ -86,10 +89,14 @@ module PWN
       #   browser_obj: 'required - browser_obj returned from #open method',
       #   username: 'required - username (email address)',
       #   password: 'optional - passwd (will prompt if blank)',
-      #   mfa: 'optional - if true prompt for mfa token (defaults to false)'
+      #   mfa: 'optional - if true prompt for mfa token (defaults to false)',
+      #   yubikey: 'optional - rejected: exact OATH account Hash with :serial, :reader, :device_path, :connection, :timeout is unsupported even with confirm: true; this adapter is SMS-only; explicit mfa/mfa_token values conflict; omit to use manual SMS'
       # )
 
       public_class_method def self.login(opts = {})
+        PWN::Plugins::AuthenticationHelper.validate_mfa_options(opts)
+        raise ArgumentError, 'PayPal YubiKey OATH login is unsupported by this SMS-only browser adapter' unless opts[:yubikey].nil?
+
         browser_obj = opts[:browser_obj]
         username = opts[:username].to_s.scrub.strip.chomp
         password = opts[:password]
@@ -110,7 +117,7 @@ module PWN
         browser.button(id: 'btnLogin').click!
 
         if mfa
-          # Send code to SMS
+          # Send code to SMS; this legacy adapter does not select an OATH authenticator.
           browser.button(id: 'btnSelectSoftToken').wait_until(&:present?).click!
           until browser.url == 'https://www.paypal.com/myaccount/home'
             browser.text_field(id: 'security-code').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token'))
@@ -188,12 +195,16 @@ module PWN
             mfa: 'optional - mfa value consumed by #signup'
           )
 
-          # Run login and return its result
+          # Log in using the existing manual SMS challenge.
+          # YubiKey OATH is unsupported even with confirm: true; this SMS-only browser adapter rejects it before login.
+          # Service-level authenticator availability does not establish a compatible adapter flow.
+          # Validate options and reject conflicting explicit tokens before any login action.
           #{self}.login(
             browser_obj: 'required - browser_obj returned from #open method',
             username: 'required - username (email address)',
             password: 'optional - passwd (will prompt if blank)',
-            mfa: 'optional - if true prompt for mfa token (defaults to false)'
+            mfa: 'optional - if true prompt for mfa token (defaults to false)',
+            yubikey: 'optional - rejected: exact OATH account Hash with :serial, :reader, :device_path, :connection, :timeout is unsupported even with confirm: true; this adapter is SMS-only; explicit mfa/mfa_token values conflict; omit to use manual SMS'
           )
 
           # Run logout and return its result

data/lib/pwn/www/synack.rb

@@ -5,6 +5,8 @@ require 'yaml'
 module PWN
   module WWW
     # This plugin supports platform.synack.com actions.
+    # YubiKey OATH MFA requires explicit confirm: true because HOTP advances counters
+    # and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
     module Synack
       # Supported Method Parameters::
       # browser_obj = PWN::WWW::Synack.open(
@@ -28,10 +30,13 @@ module PWN
       #   browser_obj: 'required - browser_obj returned from #open method',
       #   username: 'required - username',
       #   password: 'optional - passwd (will prompt if blank)',
-      #   mfa: 'optional - if true prompt for mfa token (defaults to false)'
+      #   mfa: 'optional - if true prompt for mfa token (defaults to false)',
+      #   yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
       # )
 
       public_class_method def self.login(opts = {})
+        PWN::Plugins::AuthenticationHelper.validate_mfa_options(opts)
+        yubikey = opts[:yubikey]
         browser_obj = opts[:browser_obj]
         username = opts[:username].to_s.scrub.strip.chomp
         password = opts[:password]
@@ -51,9 +56,9 @@ module PWN
         browser.text_field(name: 'password').wait_until(&:present?).set(password)
         browser.button(class: 'btn').click!
 
-        if mfa
+        if mfa || !yubikey.nil?
           until browser.url.include?('https://platform.synack.com')
-            browser.text_field(name: 'authy_token').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token'))
+            browser.text_field(name: 'authy_token').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token', yubikey: yubikey))
             browser.button(class: 'btn').click!
             sleep 3
           end
@@ -114,12 +119,18 @@ module PWN
             proxy: 'optional - scheme://proxy_host:port || tor'
           )
 
-          # Run login and return its result
+          # Log in with manual MFA or explicitly selected YubiKey OATH.
+          # YubiKey enables MFA even when mfa is false; failures never fall back to a prompt.
+          # Configure the service for an authenticator challenge, not SMS.
+          # Example yubikey: { account: 'EXACT_OATH_NAME', confirm: true, serial: '123456', timeout: 30 }
+          # Explicit consent is required: HOTP advances counters and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
+          # Reject conflicting explicit tokens before any login action.
           #{self}.login(
             browser_obj: 'required - browser_obj returned from #open method',
             username: 'required - username value consumed by #login',
             password: 'optional - passwd (will prompt if blank)',
-            mfa: 'optional - if true prompt for mfa token (defaults to false)'
+            mfa: 'optional - if true prompt for mfa token (defaults to false)',
+            yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
           )
 
           # Run logout and return its result

data/lib/pwn/www/twitter.rb

@@ -5,6 +5,8 @@ require 'yaml'
 module PWN
   module WWW
     # This plugin supports twitter.com actions.
+    # YubiKey OATH MFA requires explicit confirm: true because HOTP advances counters
+    # and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
     module Twitter
       # Supported Method Parameters::
       # browser_obj = PWN::WWW::Twitter.open(
@@ -28,10 +30,13 @@ module PWN
       #   browser_obj: 'required - browser_obj returned from #open method',
       #   username: 'required - username',
       #   password: 'optional - passwd (will prompt if blank)',
-      #   mfa: 'optional - if true prompt for mfa token (defaults to false)'
+      #   mfa: 'optional - if true prompt for mfa token (defaults to false)',
+      #   yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
       # )
 
       public_class_method def self.login(opts = {})
+        PWN::Plugins::AuthenticationHelper.validate_mfa_options(opts)
+        yubikey = opts[:yubikey]
         browser_obj = opts[:browser_obj]
         username = opts[:username].to_s.scrub.strip.chomp
         password = opts[:password]
@@ -45,17 +50,17 @@ module PWN
         end
         mfa = opts[:mfa]
 
-        browser_obj.goto('https://twitter.com/login')
+        browser.goto('https://twitter.com/login')
 
         browser.text_field(index: 2).wait_until(&:present?).set(username)
         browser.text_field(index: 3).wait_until(&:present?).set(password)
         browser.button(index: 1).click!
 
-        if mfa
+        if mfa || !yubikey.nil?
           until browser.url == 'https://twitter.com/' ||
                 browser.url == 'https://twitter.com/home'
 
-            browser.text_field(id: 'challenge_response').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token'))
+            browser.text_field(id: 'challenge_response').wait_until(&:present?).set(PWN::Plugins::AuthenticationHelper.mfa(prompt: 'enter mfa token', yubikey: yubikey))
             browser.button(id: 'email_challenge_submit').click!
             sleep 3
           end
@@ -116,12 +121,18 @@ module PWN
             proxy: 'optional - scheme://proxy_host:port || tor'
           )
 
-          # Run login and return its result
+          # Log in with manual MFA or explicitly selected YubiKey OATH.
+          # YubiKey enables MFA even when mfa is false; failures never fall back to a prompt.
+          # Configure the service for an authenticator challenge, not SMS.
+          # Example yubikey: { account: 'EXACT_OATH_NAME', confirm: true, serial: '123456', timeout: 30 }
+          # Explicit consent is required: HOTP advances counters and protected OATH accounts may require authentication; no automatic repair or deletion occurs.
+          # Reject conflicting explicit tokens before any login action.
           #{self}.login(
             browser_obj: 'required - browser_obj returned from #open method',
             username: 'required - username value consumed by #login',
             password: 'optional - passwd (will prompt if blank)',
-            mfa: 'optional - if true prompt for mfa token (defaults to false)'
+            mfa: 'optional - if true prompt for mfa token (defaults to false)',
+            yubikey: 'optional - Hash selecting an exact OATH account (required :account and literal :confirm true); optional :serial exact decimal String, :reader or :device_path nonempty control-free String, :connection native exchange object, :timeout finite positive seconds (default 30), in-memory :password or callable :secret_provider; serial/reader and reader/device_path are mutually exclusive; no OTP slot; explicit mfa/mfa_token values conflict'
           )
 
           # Run logout and return its result

data/lib/pwn.rb

@@ -24,6 +24,7 @@ module PWN
   autoload :Memory, 'pwn/memory'
   autoload :MemoryIndex, 'pwn/memory_index'
   autoload :Migrate, 'pwn/migrate'
+  autoload :Backups, 'pwn/backups'
   autoload :ModuleSkills, 'pwn/module_skills'
   autoload :Sessions, 'pwn/sessions'
   autoload :SessionTrace, 'pwn/session_trace'

data/spec/documentation/installation_md_spec.rb

@@ -66,7 +66,7 @@ RSpec.describe 'documentation/Installation.md' do
     it 'programmatic API section is truthful' do
       expect(PWN::Setup).to respond_to(:check, :deps, :list_profiles, :pkg_manager, :migrate)
       expect(PWN::Setup.check(io: StringIO.new).keys)
-        .to eq(%i[ok native_gems_missing toolchain_missing state pkg_manager os arch])
+        .to eq(%i[ok native_gems_missing toolchain_missing state pkg_manager os arch native_libraries_missing])
       expect(PWN::Setup.pkg_manager.keys).to eq(%i[key install sudo])
       expect(PWN::Setup.constants).to include(:NATIVE_GEMS, :TOOLCHAIN, :PROFILES)
     end

data/spec/fixtures/yubikey/apdu_frames.json

@@ -0,0 +1,162 @@
+{
+  "reference": "Yubico yubikey-manager 5.9.1 smartcard formatters; generated offline with synthetic bytes, not a hardware capture",
+  "source": "https://github.com/Yubico/yubikey-manager/blob/5.9.1/yubikit/core/smartcard/__init__.py",
+  "vectors": [
+    {
+      "name": "short-0-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "",
+        "le": null,
+        "extended": false
+      },
+      "expected_hex": "00ca010200"
+    },
+    {
+      "name": "short-0-1",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "",
+        "le": 1,
+        "extended": false
+      },
+      "expected_hex": "00ca010201"
+    },
+    {
+      "name": "short-1-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "00",
+        "le": null,
+        "extended": false
+      },
+      "expected_hex": "00ca01020100"
+    },
+    {
+      "name": "short-16-16",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f",
+        "le": 16,
+        "extended": false
+      },
+      "expected_hex": "00ca010210000102030405060708090a0b0c0d0e0f10"
+    },
+    {
+      "name": "short-255-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe",
+        "le": null,
+        "extended": false
+      },
+      "expected_hex": "00ca0102ff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe"
+    },
+    {
+      "name": "short-255-255",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe",
+        "le": 255,
+        "extended": false
+      },
+      "expected_hex": "00ca0102ff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff"
+    },
+    {
+      "name": "extended-0-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "",
+        "le": null,
+        "extended": true
+      },
+      "expected_hex": "00ca0102"
+    },
+    {
+      "name": "extended-0-256",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "",
+        "le": 256,
+        "extended": true
+      },
+      "expected_hex": "00ca0102000100"
+    },
+    {
+      "name": "extended-1-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "00",
+        "le": null,
+        "extended": true
+      },
+      "expected_hex": "00ca010200000100"
+    },
+    {
+      "name": "extended-255-256",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe",
+        "le": 256,
+        "extended": true
+      },
+      "expected_hex": "00ca01020000ff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe0100"
+    },
+    {
+      "name": "extended-256-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
+        "le": null,
+        "extended": true
+      },
+      "expected_hex": "00ca0102000100000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff"
+    },
+    {
+      "name": "extended-512-1024",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
+        "le": 1024,
+        "extended": true
+      },
+      "expected_hex": "00ca0102000200000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff0400"
+    }
+  ]
+}

data/spec/integration/authentication_helper_oath_spec.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tty-prompt'
+
+RSpec.describe 'AuthenticationHelper native OATH integration' do
+  let(:account) { '-例:tester@example.invalid .+  ' }
+  let(:serial) { '00123456' }
+  let(:connection) { double('offline APDU connection', descriptor: { protocol: :apdu }, close: :closed) }
+  let(:yubikey) { { account: account, confirm: true, serial: serial, connection: connection, timeout: 5 }.freeze }
+  let(:select_apdu) { ['00a4040007a0000005272101'].pack('H*') }
+  let(:list_apdu) { ['00a1000000'].pack('H*') }
+  let(:calculate_apdu) do
+    body = [0x71, account.bytesize].pack('CC') + account.b + [0x74, 8].pack('CC') + [1].pack('Q>')
+    [0, 0xa2, 0, 1, body.bytesize].pack('C*') + body
+  end
+
+  before do
+    @ready = false
+    @frames = []
+    allow(Time).to receive(:now).and_return(Time.at(59))
+    allow(TTY::Prompt).to receive(:new).and_raise('unexpected interactive prompt')
+    expect(PWN::Plugins::YubiKey::Transport).not_to receive(:open)
+    expect(connection).not_to receive(:close)
+    allow(connection).to receive(:exchange) do |request|
+      expect(@ready).to be(true)
+      expect(request[:protocol]).to eq(:apdu)
+      @frames << request[:data]
+      case request[:data]
+      when select_apdu
+        [0x79, 3, 5, 7, 1, 0x71, 8].pack('C*') + 'fixture!'.b + "\x90\0".b
+      when list_apdu
+        [0x72, account.bytesize + 1, 0x21].pack('C*') + account.b + "\x90\0".b
+      when calculate_apdu
+        [0x76, 5, 8, 12_345].pack('CCCN') + "\x90\0".b
+      else
+        raise 'Unexpected APDU in offline OATH fixture'
+      end
+    end
+  end
+
+  it 'runs the real helper, root facade, OATH.code and Protocol against a fake APDU transport' do
+    @ready = true
+    options = { yubikey: yubikey }.freeze
+    expect do
+      expect(PWN::Plugins::AuthenticationHelper.mfa(options)).to eq('00012345')
+    end.not_to output.to_stdout
+    expect(@frames).to eq([select_apdu, list_apdu, calculate_apdu])
+    expect(options[:yubikey]).to equal(yubikey)
+  end
+
+  [nil, false, 'true'].each do |confirm|
+    it "rejects unconfirmed OATH #{confirm.inspect} before any APDU or prompt" do
+      expect do
+        PWN::Plugins::AuthenticationHelper.mfa(yubikey: yubikey.merge(confirm: confirm).freeze)
+      end.to raise_error(ArgumentError, /confirm: true/)
+      expect(@frames).to be_empty
+    end
+  end
+
+  it 'propagates exact-account errors without calculation, credential repair or manual fallback' do
+    @ready = true
+    expect do
+      PWN::Plugins::AuthenticationHelper.mfa(yubikey: yubikey.merge(account: 'missing@example.invalid'))
+    end.to raise_error(PWN::Plugins::YubiKey::ResponseError, /exact account/)
+    expect(@frames).to eq([select_apdu, list_apdu])
+  end
+
+  context 'through the real GitHub login and helper' do
+    let(:browser) { double('offline browser') }
+    let(:browser_obj) { { browser: browser } }
+    let(:credential_field) { double('offline credential field', set: nil, present?: true) }
+    let(:otp_field) { double('offline OATH field', present?: true, exist?: true) }
+    let(:submit) { double('offline submit', exist?: true) }
+    let(:login_opts) { { browser_obj: browser_obj, username: 'tester@example.invalid', password: 'fake-password', mfa: false, yubikey: yubikey } }
+
+    before do
+      @authenticated = false
+      @otp_written = false
+      allow(PWN::WWW::GitHub).to receive(:sleep)
+      allow(browser).to receive(:goto)
+      allow(browser).to receive(:url) { @authenticated ? 'https://github.com/' : 'https://github.com/sessions/two-factor' }
+      allow(browser).to receive(:text_field).and_return(credential_field)
+      allow(credential_field).to receive(:wait_until).and_return(credential_field)
+      allow(browser).to receive(:text_field).with(name: 'app_otp').and_return(otp_field)
+      allow(otp_field).to receive(:wait_until) do
+        expect(@frames).to be_empty
+        @ready = true
+        otp_field
+      end
+      allow(browser).to receive(:input).with(name: 'commit').and_return(submit)
+      allow(submit).to receive(:click!) { @authenticated = true if @otp_written }
+    end
+
+    it 'types actual native OATH digits only after the authenticator field is ready' do
+      expect(otp_field).to receive(:set).with('00012345') { @otp_written = true }
+      expect(PWN::WWW::GitHub.login(login_opts)).to equal(browser_obj)
+      expect(@frames).to eq([select_apdu, list_apdu, calculate_apdu])
+    end
+
+    it 'does not touch a token for an already authenticated redirect' do
+      @authenticated = true
+      expect(otp_field).not_to receive(:set)
+      expect(PWN::WWW::GitHub.login(login_opts)).to equal(browser_obj)
+      expect(@frames).to be_empty
+    end
+
+    it 'rejects absent consent before asking for a password or navigating' do
+      expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+      expect(browser).not_to receive(:goto)
+      expect do
+        PWN::WWW::GitHub.login(login_opts.except(:password).merge(yubikey: yubikey.except(:confirm)))
+      end.to raise_error(ArgumentError, /confirm: true/)
+      expect(@frames).to be_empty
+    end
+  end
+end

data/spec/integration/controller_spill_spec.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'open3'
+require 'tmpdir'
+require 'fileutils'
+require 'json'
+
+RSpec.describe 'controller spill boundary through actual Dispatch' do
+  %w[checkpoint transcript].each do |mode|
+    it "does not create source files when a worker redirects the parent #{mode} spill path" do
+      Dir.mktmpdir('spill-boundary-') do |root|
+        source = File.join(root, 'source')
+        home = File.join(root, 'home')
+        work = File.join(root, 'work')
+        FileUtils.mkdir_p([source, home, work])
+        fixture = File.expand_path('../support/harness/controller_spill.rb', __dir__)
+        stdout, stderr, status = Open3.capture3({ 'HOME' => home }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, source, work, mode, chdir: work)
+        expect(status.success?).to be(true), stderr
+        row = JSON.parse(stdout)
+        expect(row['changed']).to be(false), row.inspect
+        expect(row['dispatch_success']).to be(false)
+        expect(row['dispatch_error']).to include('Permission denied')
+      end
+    end
+  end
+
+  %w[ordinary aliased].each do |mode|
+    it "denies the #{mode} controller-state inventory while preserving workspace output" do
+      Dir.mktmpdir('controller-inventory-') do |root|
+        source = File.join(root, 'source')
+        home = File.join(root, 'home')
+        work = File.join(root, 'work')
+        FileUtils.mkdir_p([source, home, work])
+        fixture = File.expand_path('../support/harness/controller_state.rb', __dir__)
+        stdout, stderr, status = Open3.capture3({ 'HOME' => home }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, source, work, mode, chdir: work)
+        expect(status.success?).to be(true), stderr
+        row = JSON.parse(stdout)
+        expect(row.dig('result', 'success')).to be(true), row.inspect
+        attempts = row.dig('result', 'result')
+        expect(attempts.length).to eq(29)
+        expect(attempts.values.uniq).to eq(['denied']), attempts.inspect
+        expect(row['source_unchanged']).to be(true)
+        expect(row['output']).to eq('output remains writable')
+      end
+    end
+  end
+end