pwn 0.5.784 → 0.5.787

data/spec/lib/pwn/plugins/ai_sandbox_spec.rb

@@ -14,6 +14,236 @@ describe PWN::Plugins::AISandbox do
     expect(described_class).to respond_to :help
   end
 
+  it 'enforces read-only roots in real workers while preserving outside writes and host cwd' do
+    Dir.mktmpdir('pwn-boundary') do |root|
+      protected = File.join(root, 'source')
+      workspace = File.join(root, 'work')
+      FileUtils.mkdir_p([protected, workspace])
+      target = File.join(protected, 'keep')
+      File.write(target, 'original')
+      File.symlink(protected, File.join(workspace, 'alias'))
+      cwd = Dir.pwd
+      result = described_class.protect_call(roots: [protected], workspace: workspace, write_roots: [File.join(workspace, 'outside.txt')]) do
+        errors = [target, File.join(workspace, 'alias', 'keep'), File.join(protected, '..', 'source', 'new')].map do |path|
+          File.write(path, 'bad')
+          'allowed'
+        rescue Errno::EACCES, Errno::EPERM
+          'denied'
+        end
+        File.write('outside.txt', 'allowed')
+        { errors: errors, original: File.read(target), cwd: Dir.pwd }
+      end
+      expect(result).to include(errors: %w[denied denied denied], original: 'original', cwd: workspace)
+      expect(File.read(File.join(workspace, 'outside.txt'))).to eq('allowed')
+      expect(File.read(target)).to eq('original')
+      metadata = described_class.protect_call(roots: [protected], workspace: workspace) do
+        File.chmod(0o600, target)
+        { changed: true }
+      end
+      expect(metadata[:success]).to be false
+      expect(metadata[:error]).to match(/Read-only file system|Permission denied|Operation not permitted/)
+      expect(Dir.pwd).to eq(cwd)
+    end
+  end
+
+  it 'writes only in the runtime workspace unless the original request names another path' do
+    Dir.mktmpdir('pwn-boundary') do |root|
+      source = File.join(root, 'source')
+      workspace = File.join(root, 'runtime')
+      named = File.join(root, 'named', 'report.txt')
+      FileUtils.mkdir_p([source, workspace])
+      File.write(File.join(source, 'keep'), 'original')
+      outside = File.join(root, 'unstated.txt')
+      result = described_class.protect_call(roots: [source], workspace: workspace, write_roots: [named, File.join(source, 'keep')]) do
+        File.write(named, 'allowed')
+        unstated = begin
+          File.write(outside, 'no')
+          'allowed'
+        rescue Errno::EACCES, Errno::EPERM
+          'denied'
+        end
+        protected_write = begin
+          File.write(File.join(source, 'keep'), 'bad')
+          'allowed'
+        rescue Errno::EACCES, Errno::EPERM
+          'denied'
+        end
+        { named: File.read(named), unstated: unstated, protected_write: protected_write }
+      end
+      expect(result).to include(named: 'allowed', unstated: 'denied', protected_write: 'denied')
+      expect(File.read(File.join(source, 'keep'))).to eq('original')
+      expect(described_class.workspace).to eq(File.expand_path(File.join(Dir.home, '.pwn', 'workspaces', 'runtime')))
+      Dir.chdir(root) { expect(described_class.workspace).to eq(File.expand_path(File.join(Dir.home, '.pwn', 'workspaces', 'runtime'))) }
+    end
+  end
+
+  it 'allows mv onto an extensionless destination named by the original request' do
+    Dir.mktmpdir('pwn-boundary') do |root|
+      source = File.join(root, 'source')
+      workspace = File.join(root, 'runtime')
+      dest_dir = File.join(root, 'dest')
+      FileUtils.mkdir_p([source, workspace, dest_dir])
+      destination = File.join(dest_dir, 'test')
+      result = described_class.protect_call(roots: [source], workspace: workspace, write_roots: [workspace, destination]) do
+        File.write('foo', 'data')
+        moved = begin
+          File.rename('foo', destination)
+          'allowed'
+        rescue Errno::EACCES, Errno::EPERM
+          'denied'
+        end
+        { moved: moved, body: File.read(destination), still_dir: File.directory?(destination) }
+      end
+      expect(result).to include(moved: 'allowed', body: 'data', still_dir: false)
+    end
+  end
+
+  it 'creates a named file when the destination parent contains an unreadable directory' do
+    Dir.mktmpdir('pwn-boundary') do |root|
+      source = File.join(root, 'source')
+      workspace = File.join(root, 'runtime')
+      parent = File.join(root, 'dest')
+      hidden = File.join(parent, 'private')
+      destination = File.join(parent, 'test')
+      FileUtils.mkdir_p([source, workspace, parent, hidden])
+      File.chmod(0, hidden)
+      result = described_class.protect_call(roots: [source], workspace: workspace, write_roots: [destination]) do
+        created = begin
+          File.write(destination, 'data')
+          'allowed'
+        rescue Errno::EACCES, Errno::EPERM
+          'denied'
+        end
+        body = File.read(destination) if created == 'allowed'
+        { created: created, body: body }
+      end
+      expect(result).to include(created: 'allowed', body: 'data')
+    ensure
+      File.chmod(0o700, hidden) if hidden && File.directory?(hidden)
+    end
+  end
+
+  it 'fails closed on unsupported kernels and existing external hardlink aliases' do
+    Dir.mktmpdir('pwn-boundary') do |root|
+      source = File.join(root, 'source')
+      work = File.join(root, 'work')
+      FileUtils.mkdir_p([source, work])
+      path = File.join(source, 'protected')
+      File.write(path, 'original')
+      File.link(path, File.join(work, 'alias'))
+      result = described_class.protect_call(roots: [source], workspace: work) { File.write(File.join(work, 'alias'), 'bad') }
+      expect(result[:success]).to be false
+      expect(File.read(path)).to eq('original')
+      File.unlink(File.join(work, 'alias'))
+      allow(described_class).to receive(:repository_restrict!).and_raise(NotImplementedError, 'kernel unsupported')
+      expect { described_class.protect_call(roots: [source], workspace: work) { File.write(path, 'bad') } }.to raise_error(described_class::NotStarted, /kernel unsupported/)
+      expect(File.read(path)).to eq('original')
+    end
+  end
+
+  it 'keeps nested dispatch and detached subprocesses inside the inherited boundary' do
+    Dir.mktmpdir('pwn-boundary') do |root|
+      source = File.join(root, 'source')
+      work = File.join(root, 'work')
+      FileUtils.mkdir_p([source, work])
+      path = File.join(source, 'protected')
+      File.write(path, 'original')
+      jobs = File.join(work, 'jobs')
+      stub_const('PWN::Plugins::Jobs::JOBS_DIR', jobs)
+      result = described_class.protect_call(roots: [source], workspace: work, write_roots: [work]) do
+        PWN::AI::Agent::Registry.register(name: 'nested_boundary_fixture', toolset: 'test', schema: { name: 'nested_boundary_fixture', parameters: { type: 'object' } }, handler: ->(_args) { File.write(path, 'bad') })
+        nested = JSON.parse(PWN::AI::Agent::Dispatch.call(tool_call: { function: { name: 'nested_boundary_fixture', arguments: '{}' } }))
+        job = PWN::Plugins::Jobs.start(command: "printf bad > #{path}; printf done > #{work}/done", max_runtime: 10)
+        { nested: nested, job: job }
+      end
+      expect(result.dig(:nested, :success)).to be(false), result.inspect
+      expect(result.dig(:job, :id)).to be_a(String), result.inspect
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 15
+      sleep 0.02 until File.exist?(File.join(work, 'done')) || Process.clock_gettime(Process::CLOCK_MONOTONIC) > deadline
+      expect(File.read(File.join(work, 'done'))).to eq('done')
+      expect(File.read(path)).to eq('original')
+    end
+  end
+
+  it 'protects controller writes after a worker redirects checkpoint ancestry' do
+    Dir.mktmpdir('pwn-controller-boundary') do |root|
+      source = File.join(root, 'source')
+      work = File.join(root, 'work')
+      FileUtils.mkdir_p([source, work])
+      script = <<~RUBY
+        require 'pwn'
+        require 'json'
+        source, work = ARGV
+        PWN::Plugins::AISandbox.define_singleton_method(:protected_roots) { [source, '/opt/pwn'] }
+        runtime = PWN::AI::Agent::RequestRuntime.new(request: 'Create a report', session_id: 'boundary', artifact_root: File.join(work, 'state'), trace: false, retrieve: false)
+        Thread.current[:pwn_request_runtime] = runtime
+        directory = File.dirname(runtime.checkpoint_path)
+        PWN::AI::Agent::Registry.register(name: 'boundary_fixture', toolset: 'fixture', schema: { name: 'boundary_fixture', parameters: { type: 'object' } }, handler: lambda { |_args|
+          FileUtils.rm_rf(directory)
+          File.symlink(source, directory)
+          { redirected: true }
+        })
+        result = JSON.parse(PWN::AI::Agent::Dispatch.call(tool_call: { function: { name: 'boundary_fixture', arguments: '{}' } }))
+        puts JSON.generate(changed: !Dir.children(source).empty?, result: result)
+      RUBY
+      command = [RbConfig.ruby, '-I', File.expand_path('lib'), '-e', script, source, work]
+      stdout, stderr, status = Open3.capture3({ 'HOME' => work }, *command)
+      expect(status.success?).to be(true), stderr
+      row = JSON.parse(stdout)
+      expect(row['changed']).to be(false), row.inspect
+      expect(row.dig('result', 'success')).to be(false)
+      expect(Dir.children(source)).to be_empty
+    end
+  end
+
+  it 'brokers actual spawn and ask without granting state redirection or handler bypass' do
+    Dir.mktmpdir('pwn-swarm-control') do |root|
+      work = File.join(root, 'work')
+      home = File.join(root, 'home')
+      FileUtils.mkdir_p([work, home])
+      tool = lambda do |command, id|
+        { role: 'assistant', content: '', tool_calls: [{ id: id, type: 'function', function: { name: 'shell', arguments: JSON.generate(command: command, timeout: 10) } }] }
+      end
+      fixture = File.join(work, 'provider.json')
+      File.write(fixture, JSON.generate(toolsets: %w[shell swarm], responses: [tool.call("printf 'alpha\\n' > result.txt", 'write'), tool.call('cat result.txt', 'read')] + Array.new(8) { { role: 'assistant', content: 'FIXTURE_COMPLETE', tool_calls: [] } }))
+      env = { 'HOME' => home, 'PWN_HARNESS_FIXTURE' => fixture, 'PWN_HARNESS_EVENTS' => File.join(work, 'events.jsonl'), 'PWN_HARNESS_FINGERPRINT' => File.join(work, 'fingerprint.json') }
+      command = [RbConfig.ruby, '-I', File.expand_path('lib'), '-r', File.expand_path('spec/support/harness/fake_provider.rb'), File.expand_path('spec/support/harness/swarm_control.rb'), work]
+      stdout, stderr, status = Open3.capture3(env, *command, chdir: work)
+      expect(status.success?).to be(true), "#{stderr}\n#{stdout}"
+      row = JSON.parse(stdout.lines.last)
+      expect(row.dig('spawn', 'success')).to be(true), row.inspect
+      expect(row.dig('ask', 'success')).to be(true), row.inspect
+      expect(row.dig('ask', 'result', 'reply')).to eq('FIXTURE_COMPLETE')
+      expect(row['bytes']).to eq("alpha\n")
+      expect(row['sentinel']).to eq('unchanged')
+      expect(row.dig('attack', 'result').values).to all(start_with('denied:'))
+      expect(row.dig('replacement', 'success')).to be(false)
+      expect(row.dig('observations', File.join(work, 'result.txt'), 'child_request_id')).to be_a(String)
+      persisted = YAML.safe_load_file(File.join(home, '.pwn', 'agents.yml'))
+      expect(persisted.fetch('fixture_worker').fetch('model')).to eq('offline-scripted-v1')
+    end
+  end
+
+  it 'pins controller directories across pathname replacement and rejects source ancestry' do
+    Dir.mktmpdir('pwn-control-fd') do |root|
+      source = File.join(root, 'source')
+      state = File.join(root, 'state')
+      moved = File.join(root, 'moved')
+      FileUtils.mkdir_p([source, state])
+      allow(described_class).to receive(:protected_roots).and_return([source])
+      described_class.control_directory(path: state) do |fd_path|
+        File.rename(state, moved)
+        File.symlink(source, state)
+        File.open(File.join(fd_path, 'receipt'), File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write('safe') }
+      end
+      expect(File.read(File.join(moved, 'receipt'))).to eq('safe')
+      expect(Dir.children(source)).to be_empty
+      expect { described_class.control_directory(path: state) { raise 'must not run' } }.to raise_error(Errno::ENOTDIR)
+      expect { described_class.control_directory(path: File.join(source, 'new')) { raise 'must not run' } }.to raise_error(described_class::NotStarted, /protected source/)
+      expect(Dir.children(source)).to be_empty
+    end
+  end
+
   it 'denies rm -rf /tmp/fake_root in strict mode without touching disk' do
     root = '/tmp/fake_root'
     FileUtils.mkdir_p(root)

data/spec/lib/pwn/plugins/authentication_helper_native_yubikey_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Plugins::AuthenticationHelper, 'native YubiKey validation' do
+  before do
+    stub_const('PWN::Plugins::YubiKey', double('offline native device'))
+    expect(TTY::Prompt).not_to receive(:new)
+  end
+
+  [{ ykman: '/fixture/unsupported' }, { timeout: false }, { timeout: 0 }, { timeout: Float::INFINITY },
+   { reader: false }, { reader: '' }, { reader: "bad\nreader" }, { device_path: false }, { device_path: '' },
+   { device_path: "bad\0path" }, { serial: 123 }, { serial: false }, { serial: ' 123' },
+   { serial: '123', reader: 'Fixture reader' }, { reader: 'Fixture reader', device_path: '/fixture/native-device' }, { connection: false }, { connection: Object.new },
+   { password: false }, { password: '' }, { secret_provider: false }, { secret_provider: Object.new }].each do |invalid|
+    it "rejects #{invalid.keys.join('/')} controls before login, prompts or a device operation" do
+      selector = { account: 'Fixture:account', confirm: true }.merge(invalid)
+      expect(PWN::Plugins::YubiKey).not_to receive(:oath_code)
+      expect { described_class.validate_mfa_options(yubikey: selector) }.to raise_error(ArgumentError, /yubikey/i)
+      expect { described_class.mfa(yubikey: selector) }.to raise_error(ArgumentError, /yubikey/i)
+    end
+  end
+
+  it 'forwards an exact native connection and in-memory password without inspecting or persisting them' do
+    connection = double('native connection', exchange: ''.b)
+    selector = { account: ' Fixture:account ', confirm: true, reader: ' Fixture reader ', connection: connection, password: 'fixture-only-password' }.freeze
+    expect(PWN::Plugins::YubiKey).to receive(:oath_code).with(selector).and_return('000123')
+    expect(described_class.mfa(yubikey: selector)).to eq('000123')
+  end
+
+  it 'does not invoke a secret provider during source selection and passes it unchanged to the native helper' do
+    provider = double('operator secret provider', call: 'fixture-only-password')
+    expect(provider).not_to receive(:call)
+    selector = { account: 'Fixture:account', confirm: true, serial: '001234', device_path: '/fixture/native-device', secret_provider: provider }.freeze
+    options = { yubikey: selector }.freeze
+    expect(described_class.validate_mfa_options(options)).to equal(options)
+    expect(PWN::Plugins::YubiKey).to receive(:oath_code).with(selector).and_return('00123456')
+    expect(described_class.mfa(options)).to eq('00123456')
+  end
+end

data/spec/lib/pwn/plugins/authentication_helper_yubikey_spec.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Plugins::AuthenticationHelper do
+  let(:yubikey) { { account: 'Example:tester@example.invalid', confirm: true, serial: '123456', device_path: '/fixture/native-device', timeout: 30 }.freeze }
+
+  before do
+    stub_const('PWN::Plugins::YubiKey', Module.new)
+    allow(PWN::Plugins::YubiKey).to receive(:oath_code).and_return('012345')
+    allow(TTY::Prompt).to receive(:new).and_raise('unexpected interactive prompt')
+  end
+
+  it 'returns the YubiKey OATH digits without removing a leading zero or prompting' do
+    expect(PWN::Plugins::YubiKey).to receive(:oath_code).with(yubikey).and_return('012345')
+    expect(described_class.mfa(yubikey: yubikey)).to eq('012345')
+  end
+
+  [false, true, 'Example', [], {}, { account: nil }, { account: 123 }, { account: '' }, { account: '  ' }, { account: "Example\nOther" }].each do |invalid|
+    it "rejects invalid YubiKey options #{invalid.inspect} without a device call or prompt" do
+      expect(PWN::Plugins::YubiKey).not_to receive(:oath_code)
+      expect { described_class.mfa(yubikey: invalid) }.to raise_error(ArgumentError, /yubikey|account/)
+    end
+  end
+
+  it 'preserves the exact account name and caller options' do
+    exact = { account: ' Example:tester@example.invalid ', confirm: true }.freeze
+    expect(PWN::Plugins::YubiKey).to receive(:oath_code).with(exact).and_return('00123456')
+    expect(described_class.mfa(yubikey: exact)).to eq('00123456')
+  end
+
+  it 'propagates a YubiKey failure without falling back to an interactive prompt' do
+    allow(PWN::Plugins::YubiKey).to receive(:oath_code).and_raise(IOError, 'device unavailable')
+    expect { described_class.mfa(yubikey: yubikey) }.to raise_error(IOError, 'device unavailable')
+  end
+
+  it 'rejects an OTP slot instead of treating it as an OATH credential' do
+    expect(PWN::Plugins::YubiKey).not_to receive(:oath_code)
+    expect { described_class.mfa(yubikey: yubikey.merge(slot: 2)) }.to raise_error(ArgumentError, /slot.*OATH/)
+  end
+
+  it 'propagates device cancellation instead of returning a value for a form' do
+    allow(PWN::Plugins::YubiKey).to receive(:oath_code).and_raise(Interrupt)
+    expect { described_class.mfa(yubikey: yubikey) }.to raise_error(Interrupt)
+  end
+
+  [nil, false, 'true', 1].each do |confirm|
+    it "rejects confirm #{confirm.inspect} before a device call or prompt" do
+      expect(PWN::Plugins::YubiKey).not_to receive(:oath_code)
+      expect { described_class.mfa(yubikey: yubikey.merge(confirm: confirm)) }.to raise_error(ArgumentError, /confirm: true.*HOTP.*authenticat/i)
+    end
+  end
+
+  it 'requires explicit consent during pre-login validation without modifying options' do
+    options = { yubikey: yubikey.except(:confirm).freeze }.freeze
+    expect(PWN::Plugins::YubiKey).not_to receive(:oath_code)
+    expect { described_class.validate_mfa_options(options) }.to raise_error(ArgumentError, /confirm: true/)
+    expect(options[:yubikey]).not_to have_key(:confirm)
+  end
+
+  it 'does not accept string-keyed consent as the literal confirm option' do
+    expect(PWN::Plugins::YubiKey).not_to receive(:oath_code)
+    expect { described_class.mfa(yubikey: yubikey.except(:confirm).merge('confirm' => true)) }.to raise_error(ArgumentError, /confirm: true/)
+  end
+
+  it 'keeps malformed-account and OTP-slot errors ahead of missing consent' do
+    expect { described_class.validate_mfa_options(yubikey: { account: '' }) }.to raise_error(ArgumentError, /account must/)
+    expect { described_class.validate_mfa_options(yubikey: { slot: 2 }) }.to raise_error(ArgumentError, /slot.*OATH/)
+  end
+
+  [{ mfa: '654321' }, { mfa_token: '654321' }].each do |conflict|
+    it "keeps the #{conflict.keys.first} conflict ahead of missing consent" do
+      expect { described_class.validate_mfa_options(conflict.merge(yubikey: yubikey.except(:confirm))) }.to raise_error(ArgumentError, /combined.*mfa.*mfa_token/)
+    end
+  end
+
+  it 'documents exact OATH selection, optional device controls, and fail-closed behavior' do
+    expect { described_class.help }.to output(/yubikey:.*exact.*account.*serial.*reader.*device_path.*connection.*timeout.*password.*secret_provider.*no OTP slot.*validate_mfa_options/m).to_stdout
+    expect { described_class.help }.to output(/Example yubikey: \{ account: 'EXACT_OATH_NAME', confirm: true.*HOTP.*authenticat/m).to_stdout
+    expect { described_class.help }.not_to output(/ykman/).to_stdout
+  end
+
+  it 'preserves the manual prompt when YubiKey is not selected' do
+    prompt = instance_double(TTY::Prompt)
+    allow(TTY::Prompt).to receive(:new).and_return(prompt)
+    expect(prompt).to receive(:ask).with('Test MFA: ').and_return(" 012345\n")
+    expect(PWN::Plugins::YubiKey).not_to receive(:oath_code)
+    expect(described_class.mfa(prompt: 'Test MFA')).to eq('012345')
+  end
+end

data/spec/lib/pwn/plugins/capability_broker/daemon_spec.rb

@@ -158,7 +158,7 @@ describe 'Native capability broker daemon' do
           status = File.read("/proc/#{pid}/status")
           expect(status[/^Uid:\s+(.+)/, 1].split.map(&:to_i)).to eq([Process.uid] * 4)
           expect(status[/^Gid:\s+(.+)/, 1].split.map(&:to_i)).to eq([Process.gid] * 4)
-          expect(status[/^Groups:[^\S\n]*([^\n]*)/, 1].split.map(&:to_i)).to eq(Process.groups.sort)
+          expect(status[/^Groups:[^\S\n]*([^\n]*)/, 1].split.map(&:to_i).sort).to eq(Process.groups.sort)
           expect(status[/^NoNewPrivs:\s+(\d+)/, 1]).to eq('1')
           expect(status[/^CapEff:\s+(\h+)/, 1].to_i(16) & ~((1 << 12) | (1 << 13))).to eq(0)
           expect(status[/^CapPrm:\s+(\h+)/, 1].to_i(16) & ~((1 << 12) | (1 << 13))).to eq(0)

data/spec/lib/pwn/plugins/google_workspace_spec.rb

@@ -86,34 +86,23 @@ describe PWN::Plugins::GoogleWorkspace do
     Dir.mktmpdir('pwn-gw-oauth-') do |dir|
       env_path = File.join(dir, 'pwn.yaml')
       dec_path = "#{env_path}.decryptor"
-      key = '0' * 32
-      iv = '1' * 16
-      File.write(env_path, "plugins:\n  google_workspace:\n    oauth:\n      client_id: cid\n      client_secret: sec\n")
-      File.write(dec_path, YAML.dump(key: key, iv: iv))
-      allow(PWN::Plugins::Vault).to receive(:decrypt)
-      allow(PWN::Plugins::Vault).to receive(:encrypt)
+      stub_const('PWN::Plugins::GoogleWorkspace::PENDING_FILE', File.join(dir, 'pending.json'))
+      stub_const('PWN::Env', {
+                   plugins: { google_workspace: { oauth: { client_id: 'cid', client_secret: 'sec' } } },
+                   driver_opts: { pwn_env_path: env_path, pwn_dec_path: dec_path }
+                 })
+      File.write(env_path, YAML.dump(PWN::Env))
+      PWN::Plugins::Vault.create(file: env_path, decryptor_file: dec_path)
+      credentials = YAML.safe_load_file(dec_path, symbolize_names: true)
       allow(RestClient).to receive(:post).and_return(
         instance_double(RestClient::Response, body: {
-          access_token: 'live-bearer',
-          refresh_token: 'live-refresh',
+          access_token: 'fixture-bearer',
+          refresh_token: 'fixture-refresh',
           expires_in: 3600,
           scope: 'https://www.googleapis.com/auth/gmail.modify'
         }.to_json)
       )
 
-      PWN::Env[:plugins] ||= {}
-      PWN::Env[:plugins][:google_workspace] ||= {}
-      PWN::Env[:plugins][:google_workspace][:oauth] ||= {}
-      slot = PWN::Env[:plugins][:google_workspace][:oauth]
-      prev = slot.dup
-      slot[:client_id] = 'cid'
-      slot[:client_secret] = 'sec'
-      slot[:bearer_token] = nil
-      slot[:refresh_token] = nil
-      PWN::Env[:driver_opts] ||= {}
-      PWN::Env[:driver_opts][:pwn_env_path] = env_path
-      PWN::Env[:driver_opts][:pwn_dec_path] = dec_path
-
       result = described_class.obtain_oauth_auth_url(
         client_id: 'cid',
         client_secret: 'sec',
@@ -122,20 +111,13 @@ describe PWN::Plugins::GoogleWorkspace do
         probe: ->(_redirect) { 'AUTHCODE' }
       )
 
-      expect(result[:bearer_token]).to eq('live-bearer')
-      expect(result[:refresh_token]).to eq('live-refresh')
-      expect(slot[:bearer_token]).to eq('live-bearer')
-      expect(slot[:refresh_token]).to eq('live-refresh')
-      vault = YAML.load_file(env_path, symbolize_names: true)
-      expect(vault.dig(:plugins, :google_workspace, :oauth, :bearer_token)).to eq('live-bearer')
-      expect(vault.dig(:plugins, :google_workspace, :oauth, :refresh_token)).to eq('live-refresh')
-    ensure
-      if prev
-        slot.clear
-        slot.merge!(prev)
-      end
-      PWN::Env[:driver_opts].delete(:pwn_env_path) if PWN::Env[:driver_opts].is_a?(Hash)
-      PWN::Env[:driver_opts].delete(:pwn_dec_path) if PWN::Env[:driver_opts].is_a?(Hash)
+      expect(result[:bearer_token]).to eq('fixture-bearer')
+      expect(result[:refresh_token]).to eq('fixture-refresh')
+      expect(PWN::Env.dig(:plugins, :google_workspace, :oauth)).to include(bearer_token: 'fixture-bearer', refresh_token: 'fixture-refresh')
+      vault = PWN::Plugins::Vault.dump({ file: env_path }.merge(credentials))
+      expect(vault.dig(:plugins, :google_workspace, :oauth)).to include(bearer_token: 'fixture-bearer', refresh_token: 'fixture-refresh')
+      expect(PWN::Plugins::Vault.file_encrypted?(file: env_path)).to be(true)
+      expect(File.stat(env_path).mode & 0o777).to eq(0o600)
     end
   end
 

data/spec/lib/pwn/plugins/log_yubikey_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::Log, 'hardware credential logging' do
+  it 'masks sensitive trace keys before the general credential digest path' do
+    fields = %i[pin puk access_code management_key oath_secret static_password scp_keys mfa_code]
+    fields.each do |key|
+      expect(described_class.send(:inspect_debug, key: key, value: '123456')).to eq('[REDACTED]')
+      expect(described_class.send(:inspect_debug, key: key, value: '654321')).to eq('[REDACTED]')
+    end
+    expect(described_class.send(:inspect_debug, key: :api_key, value: 'fixture-api')).to eq(PWN::Redaction.token(kind: 'credential', value: 'fixture-api'))
+  end
+
+  it 'redacts nested structured debug values without consulting the credential store' do
+    expect(PWN::Plugins::Vault).not_to receive(:redact)
+    expect(PWN::Plugins::Vault).not_to receive(:expand)
+    expect(PWN::Plugins::Vault).not_to receive(:fetch)
+    input = { selector: { slot: 2, serial: '12345678' }, nested: [{ pin: '123456', scp_keys: %w[fixture-enc fixture-mac] }] }
+    text = described_class.send(:inspect_debug, value: input)
+    expect(text).to include('slot: 2', 'serial: "12345678"', '[REDACTED]')
+    expect(text).not_to include('pin: "123456"', 'fixture-enc', 'fixture-mac', '[REDACTED:credential:')
+    expect(input[:nested].first[:pin]).to eq('123456')
+  end
+
+  it 'writes only constant masks for PIN and management fields to log, debug, mirror and stderr sinks' do
+    Dir.mktmpdir('pwn-log-yubikey-') do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      fixture = 'pin=123456 management_key=fixture-management mfa_code=654321'
+      described_class.append(level: :info, msg: { pin: '123456', management_key: 'fixture-management' })
+      path = File.join(dir, 'debug.log')
+      described_class.start_debug(path: path)
+      described_class.progress(msg: fixture)
+      described_class.mirror_tui!(msg: fixture)
+      described_class.capture_stderr!(text: "#{fixture}\n")
+      described_class.stop_debug
+      [path, File.join(dir, '.pwn', 'logs', 'pwn.log')].each do |file|
+        body = File.read(file)
+        expect(body).to include('[REDACTED]')
+        expect(body).not_to include('123456', '654321', 'fixture-management', '[REDACTED:')
+      end
+    ensure
+      described_class.stop_debug
+    end
+  end
+end

data/spec/lib/pwn/plugins/preflight_checker_native_yubikey_spec.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Plugins::PreflightChecker, 'native YubiKey facade contract' do
+  it 'routes per-application host-only probes through the real facade without opening or enumerating a device' do
+    device = PWN::Plugins::YubiKey
+    transport = device::Transport
+    allow(transport).to receive(:available?).with({ application: :fido }).and_return(true)
+    allow(transport).to receive(:available?).with({ application: :oath }).and_return(true)
+    expect(transport).not_to receive(:devices)
+    expect(transport).not_to receive(:open)
+    %i[devices info command challenge_response oath_code].each { |method| expect(device).not_to receive(method) }
+    row = described_class.check(names: ['PWN::Plugins::YubiKey']).first
+    expect(row).to include(status: :ok, missing_bins: [], missing_native: [])
+    expect(transport).to have_received(:available?).with({ application: :fido }).once
+    expect(transport).to have_received(:available?).with({ application: :oath }).once
+  end
+end

data/spec/lib/pwn/plugins/preflight_checker_yubikey_spec.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Plugins::PreflightChecker, 'YubiKey dependency reporting' do
+  let(:names) { ['PWN::Plugins::YubiKey'] }
+
+  before do
+    @device = double('unopened YubiKey')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    %i[devices info command challenge_response oath_code].each { |method| expect(@device).not_to receive(method) }
+    allow(@device).to receive(:available?).with({ application: :fido }).and_return(false)
+    allow(@device).to receive(:available?).with({ application: :oath }).and_return(false)
+    allow(described_class).to receive(:bin?).and_return(true)
+    expect(described_class).not_to receive(:bin?).with(name: 'ykman')
+  end
+
+  it 'reports unavailable native host libraries without a binary requirement or device probe' do
+    row = described_class.check(names: names).first
+    expect(row).to include(plugin: names.first, status: :dead, missing_bins: [], missing_caps: [], missing_services: [])
+    expect(row[:missing_native]).to eq(['FIDO native transport', 'PC/SC native transport'])
+    expect(described_class.host_summary(names: names)).to include('PC/SC native transport', 'documentation/Plugin-Degradation.md#pwn-plugins-yubikey')
+  end
+
+  it 'reports partial native host capability separately from all libraries being available' do
+    allow(@device).to receive(:available?).with({ application: :fido }).and_return(true)
+    expect(described_class.check(names: names).first).to include(status: :degraded, missing_native: ['PC/SC native transport'])
+    allow(@device).to receive(:available?).with({ application: :oath }).and_return(true)
+    expect(described_class.check(names: names).first).to include(status: :ok, missing_bins: [], missing_native: [])
+  end
+
+  it 'preserves rows for plugins without declared native dependencies' do
+    expected = { plugin: 'PWN::Plugins::NmapIt', status: :ok, missing_bins: [], missing_caps: [], missing_services: [] }
+    expect(described_class.check(names: ['PWN::Plugins::NmapIt'])).to eq([expected])
+  end
+
+  it 'includes native dependency status in the manifest without changing other plugin rows' do
+    Dir.mktmpdir('native-preflight-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      result = described_class.manifest
+      expect(result[:plugins].fetch(names.first)).to include(ok: false, missing: [], missing_native: ['FIDO native transport', 'PC/SC native transport'])
+      expect(result[:plugins].fetch('PWN::Plugins::NmapIt')).to eq(bins: ['nmap'], missing: [], ok: true, caps: [])
+      stored = JSON.parse(File.read(result.fetch(:path)))
+      expect(stored.fetch('plugins').fetch(names.first).fetch('missing_native')).to eq(result[:plugins][names.first][:missing_native])
+    end
+  end
+
+  it 'treats load or dependency errors as a missing host library without exposing backend messages' do
+    [LoadError, IOError].each do |error|
+      allow(@device).to receive(:available?).with({ application: :oath }).and_raise(error, 'private fixture path')
+      expect(described_class.check(names: names).first).to include(status: :dead, missing_native: ['FIDO native transport', 'PC/SC native transport'])
+      expect(described_class.host_summary(names: names)).not_to include('private fixture path')
+    end
+  end
+end

data/spec/lib/pwn/plugins/recon_yubikey_spec.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::Recon, 'hardware loot capture' do
+  it 'keeps hardware failures visible without creating software loot or a master key' do
+    Dir.mktmpdir('pwn-recon-yubikey-failure-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      device = double('offline unavailable YubiKey')
+      stub_const('PWN::Plugins::YubiKey', device)
+      allow(device).to receive(:challenge_response).and_raise(IOError, 'fixture device unavailable')
+      assets = [{ address: 'app.example.test', observations: [{ banner: 'password=fixture-password' }] }]
+      expect { described_class.harvest_loot(assets: assets, engagement_id: 'lab', yubikey: { slot: 2 }) }.to raise_error(IOError, 'fixture device unavailable')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+      expect(PWN::Plugins::Vault.query(engagement: 'lab')).to be_empty
+    end
+  end
+
+  it 'forwards the explicit selector through run and harvest into real hardware-encrypted loot' do
+    Dir.mktmpdir('pwn-recon-yubikey-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      allow(PWN::AI::Agent::Mission).to receive(:active_id).and_return(nil)
+      device = double('offline YubiKey fixture')
+      stub_const('PWN::Plugins::YubiKey', device)
+      selector = { slot: 2, serial: '12345678', timeout: 4, device_path: '/fixture/native-device' }
+      allow(device).to receive(:challenge_response) do |opts|
+        expect(opts).to include(selector)
+        OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts.fetch(:challenge))
+      end
+      socket = double('offline banner', readpartial: "username=fixture-user\npassword=fixture-password\n", remote_address: double(ip_address: '192.0.2.10'))
+      allow(Socket).to receive(:tcp).and_yield(socket)
+      result = described_class.run(target: 'app.example.test', modules: ['banner'], ports: [22], engagement_id: 'lab', root: root, yubikey: selector)
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+      expect(device).to have_received(:challenge_response).once
+      rows = JSON.parse(File.read(File.join(root, '.pwn', 'engagements', 'lab', 'loot.json'))).fetch('records')
+      expect(rows.first.dig('secret', 'kdf')).to eq('yubikey-hmac-sha1-hkdf-sha256')
+      expect(rows.first.dig('secret', 'yubikey')).to include('slot' => 2, 'serial' => '12345678')
+      expect(result[:loot].first).to include(engagement: 'lab', source: 'recon', where: 'banner:22', host: '192.0.2.10')
+      expect(PWN::Plugins::Vault.fetch(label: result[:loot].first[:label], engagement: 'lab', yubikey: selector)).to eq('fixture-password')
+    end
+  end
+end