pwn 0.5.784 → 0.5.787

data/spec/lib/pwn/plugins/vault_publication_safety_spec.rb

@@ -0,0 +1,258 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+require 'timeout'
+
+RSpec.describe PWN::Plugins::Vault, 'serialized publication safety' do
+  before do
+    @root = Dir.mktmpdir('vault-publication-safety-')
+    allow(Dir).to receive(:home).and_return(@root)
+    @device = double('offline YubiKey')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    allow(@device).to receive(:challenge_response) { |opts| OpenSSL::HMAC.digest('SHA1', 'fixture-slot', opts[:challenge]) }
+    @path = File.join(@root, 'vault')
+    @legacy = { key: Base64.strict_encode64('k' * 32), iv: Base64.strict_encode64('i' * 16) }
+    @document = { token: 'fixture', retained: 'original' }
+    @threads = []
+  end
+
+  after do
+    @threads.each do |thread|
+      thread.kill if thread.alive?
+      thread.join(1)
+    end
+    FileUtils.remove_entry(@root)
+  end
+
+  def writer_thread(role, &block)
+    thread = Thread.new do
+      Thread.current.report_on_exception = false
+      Thread.current[:vault_publication_role] = role
+      block.call
+    end
+    @threads << thread
+    thread
+  end
+
+  def prepare_vault(backend = :hardware)
+    access = backend == :hardware ? { yubikey: {} } : @legacy
+    File.binwrite(@path, described_class.encrypt_data(access.merge(data: YAML.dump(@document))))
+  end
+
+  def fake_editor
+    allow(File).to receive(:executable?).and_call_original
+    allow(File).to receive(:executable?).with('/offline-editor').and_return(true)
+    allow(described_class).to receive(:system).with('/offline-editor', anything) do |_editor, path|
+      File.write(path, YAML.dump(@document.merge(edited: true)))
+      true
+    end
+  end
+
+  %i[refresh_encryption_secrets edit].each do |writer|
+    it "serializes #{writer} against update even when paused after its baseline check", :aggregate_failures do
+      prepare_vault
+      fake_editor if writer == :edit
+      ready = Queue.new
+      release = Queue.new
+      attempts = Queue.new
+      allow(File).to receive(:rename).and_wrap_original do |rename, from, to|
+        if to == @path && Thread.current[:vault_publication_role] == :first
+          ready << true
+          release.pop
+        end
+        rename.call(from, to)
+      end
+      # Probe the updater's actual flock before blocking. This makes the old
+      # unchecked-rename interleaving deterministic, without sleeps or polling.
+      allow(File).to receive(:open).and_wrap_original do |open, *args, **kwargs, &block|
+        if args == [@root, File::RDONLY] && Thread.current[:vault_publication_role] == :updater
+          open.call(*args) do |lock|
+            allow(lock).to receive(:flock).and_wrap_original do |flock, operation|
+              if operation == File::LOCK_EX
+                acquired = flock.call(operation | File::LOCK_NB)
+                attempts << (acquired ? :acquired : :blocked)
+                acquired || flock.call(operation)
+              else
+                flock.call(operation)
+              end
+            end
+            block.call(lock)
+          end
+        else
+          open.call(*args, **kwargs, &block)
+        end
+      end
+      attempt = nil
+      Timeout.timeout(5) do
+        first = writer_thread(:first) { described_class.public_send(writer, file: @path, editor: '/offline-editor') }
+        ready.pop
+        updater = writer_thread(:updater) { described_class.update(file: @path) { |cfg| cfg[:updated] = true } }
+        attempt = attempts.pop
+        updater.value if attempt == :acquired
+        release << true
+        first.value
+        expect(updater.value).to eq(:saved)
+      end
+      expect(attempt).to eq(:blocked)
+      expected = @document.merge(updated: true)
+      expected[:edited] = true if writer == :edit
+      expect(described_class.dump(file: @path)).to eq(expected)
+      expect(Dir.glob(File.join(@root, '.pwn-vault-*'))).to be_empty
+    end
+  end
+
+  %i[update refresh_encryption_secrets edit encrypt decrypt create legacy_refresh legacy_create].each do |writer|
+    it "holds the shared directory lock through every #{writer} rename" do
+      if %i[encrypt create legacy_create].include?(writer)
+        File.write(@path, YAML.dump(@document))
+      else
+        prepare_vault(writer == :legacy_refresh ? :legacy : :hardware)
+      end
+      fake_editor if writer == :edit
+      publications = 0
+      allow(File).to receive(:rename).and_wrap_original do |rename, from, to|
+        if to == @path
+          File.open(@root, File::RDONLY) do |probe|
+            expect(probe.flock(File::LOCK_EX | File::LOCK_NB)).to be(false)
+          end
+          publications += 1
+        end
+        rename.call(from, to)
+      end
+      Timeout.timeout(5) do
+        case writer
+        when :update
+          described_class.update(file: @path) { |cfg| cfg[:updated] = true }
+        when :legacy_refresh
+          described_class.refresh_encryption_secrets(@legacy.merge(file: @path))
+        when :legacy_create
+          described_class.create(file: @path, decryptor_file: "#{@path}.decryptor")
+        when :create, :encrypt
+          described_class.public_send(writer, file: @path, yubikey: {})
+        else
+          described_class.public_send(writer, file: @path, editor: '/offline-editor')
+        end
+      end
+      expect(publications).to be_positive
+    end
+  end
+
+  it 'allows nested updates in one directory without reacquiring its own lock' do
+    prepare_vault
+    sibling = File.join(@root, 'sibling')
+    File.binwrite(sibling, File.binread(@path))
+    Timeout.timeout(5) do
+      described_class.update(file: @path) do |cfg|
+        described_class.update(file: sibling) { |other| other[:nested] = true }
+        cfg[:outer] = true
+      end
+    end
+    expect(described_class.dump(file: @path)).to eq(@document.merge(outer: true))
+    expect(described_class.dump(file: sibling)).to eq(@document.merge(nested: true))
+  end
+
+  it 'retains expected-byte conflict detection for nested writes to the same vault' do
+    prepare_vault
+    Timeout.timeout(5) do
+      expect do
+        described_class.update(file: @path) do |cfg|
+          described_class.refresh_encryption_secrets(file: @path)
+          cfg[:stale] = true
+        end
+      end.to raise_error(IOError, /changed before replacement/)
+    end
+    expect(described_class.dump(file: @path)).to eq(@document)
+  end
+
+  it 'does not overwrite changes from a writer that bypasses the advisory lock' do
+    prepare_vault
+    replacement = described_class.encrypt_data(data: YAML.dump(@document.merge(external: true)), yubikey: {})
+    expect do
+      described_class.update(file: @path) do |cfg|
+        File.binwrite(@path, replacement)
+        cfg[:stale] = true
+      end
+    end.to raise_error(IOError, /changed before replacement/)
+    expect(File.binread(@path)).to eq(replacement)
+    expect(Dir.children(@root)).to eq(['vault'])
+  end
+
+  it 'recognizes directory aliases when reentering its own publication lock' do
+    prepare_vault
+    sibling = File.join(@root, 'sibling')
+    File.binwrite(sibling, File.binread(@path))
+    File.symlink(@root, File.join(@root, 'alias'))
+    Timeout.timeout(5) do
+      described_class.update(file: @path) do |cfg|
+        described_class.update(file: File.join(@root, 'alias', 'sibling')) { |other| other[:aliased] = true }
+        cfg[:outer] = true
+      end
+    end
+    expect(described_class.dump(file: sibling)).to eq(@document.merge(aliased: true))
+    expect(described_class.dump(file: @path)).to eq(@document.merge(outer: true))
+  end
+
+  it 'does not treat a lock inherited across fork as owned by the child' do
+    prepare_vault
+    reader, writer = IO.pipe
+    pid = nil
+    Timeout.timeout(8) do
+      described_class.update(file: @path) do |cfg|
+        pid = fork do
+          reader.close
+          allow(File).to receive(:open).and_wrap_original do |open, *args, **kwargs, &block|
+            if args == [@root, File::RDONLY]
+              open.call(*args) do |lock|
+                allow(lock).to receive(:flock).and_wrap_original do |flock, operation|
+                  if operation == File::LOCK_EX
+                    acquired = flock.call(operation | File::LOCK_NB)
+                    writer.puts(acquired ? 'acquired' : 'blocked')
+                    acquired || flock.call(operation)
+                  else
+                    flock.call(operation)
+                  end
+                end
+                block.call(lock)
+              end
+            else
+              open.call(*args, **kwargs, &block)
+            end
+          end
+          begin
+            described_class.update(file: @path) { |child| child[:child] = true }
+            writer.puts('saved')
+            exit! 0
+          rescue StandardError, RSpec::Mocks::MockExpectationError
+            writer.puts('failed')
+            exit! 1
+          end
+        end
+        writer.close
+        expect(reader.gets).to eq("blocked\n")
+        cfg[:parent] = true
+      end
+      expect(reader.gets).to eq("saved\n")
+      _, status = Process.waitpid2(pid)
+      pid = nil
+      expect(status.success?).to be(true)
+    end
+    expect(described_class.dump(file: @path)).to eq(@document.merge(parent: true, child: true))
+  ensure
+    if pid
+      Process.kill('KILL', pid)
+      Process.waitpid(pid)
+    end
+    reader&.close unless reader&.closed?
+    writer&.close unless writer&.closed?
+  end
+
+  it 'preserves original ciphertext and removes staging files when publication fails' do
+    prepare_vault
+    original = File.binread(@path)
+    allow(File).to receive(:rename).and_raise(IOError, 'fixture rename failure')
+    expect { described_class.update(file: @path) { |cfg| cfg[:changed] = true } }.to raise_error(IOError, 'fixture rename failure')
+    expect(File.binread(@path)).to eq(original)
+    expect(Dir.children(@root)).to eq(['vault'])
+  end
+end

data/spec/lib/pwn/plugins/vault_store_safety_spec.rb

@@ -0,0 +1,241 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::Vault, 'loot corruption safety' do
+  before do
+    @root = Dir.mktmpdir('vault-loot-safety-')
+    allow(Dir).to receive(:home).and_return(@root)
+    allow(described_class).to receive(:note_mission_loot)
+    @device = double('offline YubiKey')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    allow(@device).to receive(:challenge_response) { |opts| OpenSSL::HMAC.digest('SHA1', 'fixture-slot', opts[:challenge]) }
+    @path = File.join(@root, '.pwn', 'engagements', 'default', 'loot.json')
+    @legacy_path = File.join(@root, '.pwn', 'vault-secrets.json')
+    FileUtils.mkdir_p(File.dirname(@path))
+  end
+
+  after do
+    FileUtils.remove_entry(@root)
+  end
+
+  {
+    'malformed JSON' => '{"PRIVATE_PARSE_MARKER":',
+    'nonmapping root' => '[]',
+    'nonarray records' => '{"records": {}}',
+    'null records' => '{"records": null}',
+    'nonmapping row' => '{"version": 2, "records": [false]}',
+    'missing secret' => '{"version": 2, "records": [{"label": "protected"}]}',
+    'nonmapping secret' => '{"version": 2, "records": [{"label": "protected", "secret": false}]}',
+    'nonstring label' => '{"version": 2, "records": [{"label": 123, "secret": {}}]}',
+    'invalid legacy row' => '{"protected": false}'
+  }.each do |description, damaged|
+    it "refuses #{description} before choosing a store backend", :aggregate_failures do
+      described_class.store(label: 'protected', secret: 'original-fixture', yubikey: {})
+      File.binwrite(@path, damaged)
+      expect do
+        described_class.store(label: 'protected', secret: 'replacement-fixture')
+      end.to raise_error(IOError, /loot store/)
+      expect(File.binread(@path)).to eq(damaged)
+      expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+    end
+  end
+
+  it 'does not overwrite corrupt records even with an explicit hardware destination' do
+    damaged = '{"records": [null]}'
+    File.write(@path, damaged)
+    expect(@device).not_to receive(:challenge_response)
+    expect { described_class.store(label: 'protected', secret: 'fixture', yubikey: {}) }.to raise_error(IOError, /loot store/)
+    expect(File.binread(@path)).to eq(damaged)
+  end
+
+  it 'rejects incomplete or unknown hardware envelopes rather than replacing them with software encryption', :aggregate_failures do
+    described_class.store(label: 'protected', secret: 'original-fixture', yubikey: {})
+    original = JSON.parse(File.read(@path))
+    [nil, 'unknown-kdf'].each do |invalid|
+      damaged = Marshal.load(Marshal.dump(original))
+      damaged['records'].first['secret']['kdf'] = invalid
+      File.write(@path, JSON.generate(damaged))
+      expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+      expect(JSON.parse(File.read(@path))).to eq(damaged)
+      expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+    end
+    original['records'].first['secret']['yubikey'] = nil
+    File.write(@path, JSON.generate(original))
+    expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+    expect(JSON.parse(File.read(@path))).to eq(original)
+  end
+
+  it 'reports unreadable existing stores without treating them as absent', :aggregate_failures do
+    File.write(@path, '{"records": []}')
+    allow(File).to receive(:read).and_call_original
+    allow(File).to receive(:read).with(@path).and_raise(Errno::EACCES, 'PRIVATE_PARSE_MARKER')
+    expect { described_class.store(label: 'protected', secret: 'fixture') }.to raise_error(IOError, /loot store/)
+    expect(File.binread(@path)).to eq('{"records": []}')
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'does not treat a nonregular existing store as absent' do
+    Dir.mkdir(@path)
+    expect { described_class.query }.to raise_error(IOError, /loot store/)
+    expect { described_class.store(label: 'protected', secret: 'fixture') }.to raise_error(IOError, /loot store/)
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'fails closed on corrupt legacy stores before creating engagement records' do
+    File.write(@legacy_path, '{"PRIVATE_PARSE_MARKER":')
+    expect { described_class.store(label: 'protected', secret: 'fixture') }.to raise_error(IOError, /loot store/)
+    expect(File).not_to exist(@path)
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'surfaces safe diagnostics on every read-only parser path instead of silently hiding records' do
+    File.write(@path, '{"PRIVATE_PARSE_MARKER":')
+    queries = [
+      -> { described_class.query },
+      -> { described_class.fetch(label: 'protected', engagement: 'default') },
+      -> { described_class.fetch(label: 'protected') },
+      -> { described_class.offer },
+      -> { described_class.expand(text: '{{vault:protected}}') },
+      -> { described_class.redact(text: 'fixture') }
+    ]
+    queries.each do |query|
+      expect(&query).to raise_error(IOError, /loot store/) do |error|
+        expect(error.message).to include(@path)
+        expect(error.message).not_to include('PRIVATE_PARSE_MARKER')
+        expect(error.cause).to be_nil
+      end
+    end
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'preserves absent and empty stores as empty collections' do
+    expect(described_class.query).to eq([])
+    expect(described_class.fetch(label: 'absent')).to be_nil
+    File.write(@path, JSON.generate(version: 2, records: []))
+    File.write(@legacy_path, '{}')
+    expect(described_class.query).to eq([])
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'reads a legacy label named records without mistaking its ciphertext for a modern collection' do
+    secret = described_class.send(:encrypt_secret, secret: 'records-fixture')
+    original = JSON.generate(records: secret)
+    File.write(@legacy_path, original)
+    expect(described_class.fetch(label: 'records')).to eq('records-fixture')
+    expect(described_class.query).to contain_exactly(label: 'records', engagement: 'default', host: '', source: 'legacy', has_secret: true)
+    described_class.store(label: 'hardware', secret: 'hardware-fixture', yubikey: {})
+    expect(described_class.fetch(label: 'records', engagement: 'default')).to eq('records-fixture')
+    expect(File.binread(@legacy_path)).to eq(original)
+  end
+
+  it 'rejects a versioned collection with a ciphertext Hash instead of a records array' do
+    secret = described_class.send(:encrypt_secret, secret: 'fixture', yubikey: {})
+    damaged = JSON.generate(version: 2, records: secret)
+    File.write(@path, damaged)
+    expect(@device).not_to receive(:challenge_response)
+    expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+    expect(File.binread(@path)).to eq(damaged)
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  %i[legacy hardware].each do |backend|
+    it "normalizes inline #{backend} ciphertext while preserving loot metadata and protection" do
+      access = backend == :hardware ? { yubikey: {} } : {}
+      secret = described_class.send(:encrypt_secret, access.merge(secret: 'flat-fixture'))
+      metadata = {
+        id: 'fixture-id', label: 'flat', kind: 'password', engagement: 'default', host: 'login.example.test',
+        service: 'ssh', username: 'fixture-user', source: 'legacy', where: '/fixture/path',
+        finding_id: 'fixture-finding', at: '2026-01-01T00:00:00Z'
+      }
+      original = JSON.generate(version: 2, records: [secret.merge(metadata)])
+      File.write(@path, original)
+      expect(described_class.fetch(label: 'flat')).to eq('flat-fixture')
+      expect(described_class.query).to contain_exactly(metadata.merge(has_secret: true))
+      expect(described_class.offer(host: metadata[:host]).first[:secret]).to eq('flat-fixture')
+      expect(described_class.expand(text: '{{vault:flat}}')).to eq('flat-fixture')
+      expect(described_class.redact(text: 'flat-fixture')).to eq('{{vault:flat}}')
+      expect(File.binread(@path)).to eq(original)
+
+      described_class.store(label: 'other', secret: 'other-fixture', yubikey: {})
+      saved = JSON.parse(File.read(@path))['records'].find { |row| row['label'] == 'flat' }
+      expect(saved).to eq(JSON.parse(JSON.generate(metadata.merge(secret: secret))))
+      described_class.store(label: 'flat', secret: 'replacement-fixture')
+      expect(described_class.fetch(label: 'flat')).to eq('replacement-fixture')
+      saved_secret = JSON.parse(File.read(@path))['records'].find { |row| row['label'] == 'flat' }['secret']
+      if backend == :hardware
+        expect(saved_secret['kdf']).to eq(described_class::YUBIKEY_KDF)
+        expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+      else
+        expect(saved_secret.keys).to contain_exactly('iv', 'ct', 'tag')
+      end
+    end
+  end
+
+  {
+    'unknown KDF' => { 'kdf' => 'unknown-kdf' },
+    'null KDF' => { 'kdf' => nil },
+    'invalid hardware metadata' => { 'yubikey' => false },
+    'runtime hardware options' => { 'yubikey' => { 'slot' => 2, 'challenge' => 'fixture', 'ykman' => '/untrusted/backend' } },
+    'explicit null secret' => { 'secret' => nil },
+    'explicit false secret' => { 'secret' => false }
+  }.each do |description, changes|
+    it "rejects inline ciphertext with #{description} instead of selecting software encryption" do
+      secret = described_class.send(:encrypt_secret, secret: 'original-fixture', yubikey: {})
+      damaged = JSON.generate(version: 2, records: [secret.merge('label' => 'protected').merge(changes)])
+      File.write(@path, damaged)
+      expect(@device).not_to receive(:challenge_response)
+      expect { described_class.fetch(label: 'protected') }.to raise_error(IOError, /loot store/)
+      expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+      expect(File.binread(@path)).to eq(damaged)
+      expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+    end
+  end
+
+  [1.0, 2.0].each do |slot|
+    %i[inline nested].each do |shape|
+      it "rejects float hardware slot #{slot} in #{shape} loot envelopes before selecting a backend" do
+        secret = described_class.send(:encrypt_secret, secret: 'original-fixture', yubikey: {})
+        secret['yubikey']['slot'] = slot
+        row = shape == :inline ? secret.merge(label: 'protected') : { label: 'protected', secret: secret }
+        damaged = JSON.generate(version: 2, records: [row])
+        File.write(@path, damaged)
+        expect(@device).not_to receive(:challenge_response)
+        expect { described_class.query }.to raise_error(IOError, /loot store/)
+        expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, /loot store/)
+        expect(File.binread(@path)).to eq(damaged)
+        expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+      end
+    end
+  end
+
+  it 'retains inline hardware ciphertext when the device is unavailable during replacement' do
+    secret = described_class.send(:encrypt_secret, secret: 'original-fixture', yubikey: {})
+    original = JSON.generate(version: 2, records: [secret.merge(label: 'protected')])
+    File.write(@path, original)
+    allow(@device).to receive(:challenge_response).and_raise(IOError, 'Device unavailable')
+    expect { described_class.store(label: 'protected', secret: 'replacement-fixture') }.to raise_error(IOError, 'Device unavailable')
+    expect(File.binread(@path)).to eq(original)
+    expect(File).not_to exist(File.join(@root, '.pwn-vault.key'))
+  end
+
+  it 'reads valid legacy label maps and preserves them when adding modern records' do
+    key = 'k' * 32
+    cipher = OpenSSL::Cipher.new('aes-256-gcm')
+    cipher.encrypt
+    cipher.key = key
+    iv = cipher.random_iv
+    cipher.auth_data = 'pwn-vault'
+    ct = cipher.update('legacy-fixture') + cipher.final
+    secret = { iv: Base64.strict_encode64(iv), ct: Base64.strict_encode64(ct), tag: Base64.strict_encode64(cipher.auth_tag) }
+    File.binwrite(File.join(@root, '.pwn-vault.key'), key)
+    File.write(@legacy_path, JSON.generate(legacy: secret))
+    expect(described_class.fetch(label: 'legacy')).to eq('legacy-fixture')
+    described_class.store(label: 'hardware', secret: 'hardware-fixture', yubikey: {})
+    expect(described_class.query.map { |row| row[:label] }).to include('legacy', 'hardware')
+    expect(described_class.fetch(label: 'legacy', engagement: 'default')).to eq('legacy-fixture')
+    expect(described_class.fetch(label: 'hardware', engagement: 'default')).to eq('hardware-fixture')
+    expect(JSON.parse(File.read(@legacy_path), symbolize_names: true)).to eq(legacy: secret)
+  end
+end

data/spec/lib/pwn/plugins/vault_yubikey_safety_spec.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe PWN::Plugins::Vault, 'YubiKey failure safety' do
+  before do
+    @device = double('offline YubiKey')
+    stub_const('PWN::Plugins::YubiKey', @device)
+    allow(@device).to receive(:challenge_response) { |opts| OpenSSL::HMAC.digest('SHA1', 'fixture-slot', opts[:challenge]) }
+    @legacy = { key: Base64.strict_encode64('k' * 32), iv: Base64.strict_encode64('i' * 16) }
+    allow(described_class).to receive(:note_mission_loot)
+  end
+
+  it 'never ignores explicit hardware selection when editing or rotating a legacy vault' do
+    Dir.mktmpdir('vault-no-fallback-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      path = File.join(root, 'vault')
+      original = described_class.encrypt_data(@legacy.merge(data: "token: fixture\n"))
+      File.binwrite(path, original)
+      expect(described_class).not_to receive(:system)
+      expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+      %i[edit refresh_encryption_secrets].each do |method|
+        expect { described_class.public_send(method, @legacy.merge(file: path, yubikey: {})) }.to raise_error(ArgumentError, /YubiKey/)
+        expect(File.binread(path)).to eq(original)
+      end
+    end
+  end
+
+  it 'rejects software credentials combined with hardware creation rather than discarding them' do
+    Dir.mktmpdir('vault-conflict-') do |root|
+      path = File.join(root, 'vault')
+      File.write(path, 'original')
+      expect { described_class.create(@legacy.merge(file: path, yubikey: {})) }.to raise_error(ArgumentError, /software/)
+      expect(File.read(path)).to eq('original')
+    end
+  end
+
+  it 'does not accept false as a hardware selector during unsealing' do
+    envelope = described_class.seal_credentials(credentials: { token: 'fixture' }, yubikey: {})
+    expect { described_class.open_credentials(envelope: envelope, yubikey: false) }.to raise_error(ArgumentError, /selector/)
+  end
+
+  [false, { slot: 3 }, { slot: 1.0 }, { slot: 2.0 }, { unexpected: true }, { serial: false }, { serial: 123 },
+   { timeout: false }, { timeout: 0 }, { timeout: Float::INFINITY }, { ykman: '' }, { ykman: false },
+   { ykman: '/fixture/unsupported-executable' }, { device_path: false }, { device_path: '' }, { device_path: "bad\npath" },
+   { reader: false }, { reader: '' }, { reader: "bad\0reader" }, { reader: 'Fixture reader', serial: '123' },
+   { connection: false }, { connection: Object.new }, { reader: 'Fixture reader', device_path: '/fixture/native-device' }, { 123 => 'invalid key' }].each do |selector|
+    %i[legacy hardware].each do |backend|
+      it "rejects destination selector #{selector.inspect} before opening a #{backend} vault" do
+        Dir.mktmpdir('vault-invalid-destination-') do |root|
+          allow(Dir).to receive(:home).and_return(root)
+          path = File.join(root, 'vault')
+          access = backend == :legacy ? @legacy : { yubikey: {} }
+          original = described_class.encrypt_data(access.merge(data: "token: fixture\n"))
+          File.binwrite(path, original)
+          expect(described_class).not_to receive(:decrypt_data)
+          expect(@device).not_to receive(:challenge_response)
+          expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+          expect do
+            expect { described_class.refresh_encryption_secrets(access.merge(file: path, new_yubikey: selector)) }.to raise_error(ArgumentError, /yubikey/i)
+          end.not_to output.to_stdout
+          expect(File.binread(path)).to eq(original)
+          expect(Dir.children(root)).to eq(['vault'])
+        end
+      end
+    end
+  end
+
+  it 'keeps entropy redacted when the hardware loot write fails' do
+    secret = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
+    allow(@device).to receive(:challenge_response).and_raise(IOError, 'Device unavailable')
+    Dir.mktmpdir('capture-no-device-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      result = PWN::Redaction.capture(value: secret, entropy: true, yubikey: {})
+      expect(result[:redacted]).not_to include(secret)
+      expect(result[:redacted]).to start_with('[REDACTED:entropy:')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+    end
+  end
+
+  it 'authenticates ciphertext and public metadata and rejects a wrong device response' do
+    envelope = described_class.seal_credentials(credentials: { value: 'fixture' }, yubikey: { slot: 1, serial: '12345678' })
+    %w[ct tag salt iv key_id].each do |field|
+      changed = Marshal.load(Marshal.dump(envelope))
+      changed[field] = field == 'key_id' ? 'different-context' : Base64.strict_encode64('x' * Base64.strict_decode64(changed[field]).bytesize)
+      expect { described_class.open_credentials(envelope: changed) }.to raise_error(ArgumentError)
+    end
+    expect(described_class.open_credentials(envelope: envelope, yubikey: { serial: '87654321' })).to eq('value' => 'fixture')
+    expect { described_class.open_credentials(envelope: envelope, yubikey: { slot: 2 }) }.to raise_error(ArgumentError, /slot/)
+    allow(@device).to receive(:challenge_response) { 'w' * 20 }
+    expect { described_class.open_credentials(envelope: envelope) }.to raise_error(ArgumentError, /authentication/)
+  end
+
+  it 'rejects caller-only native controls injected into envelope metadata before contacting hardware' do
+    original = described_class.seal_credentials(credentials: {}, yubikey: {})
+    expect(@device).not_to receive(:challenge_response)
+    %w[ykman reader device_path connection timeout].each do |field|
+      envelope = Marshal.load(Marshal.dump(original))
+      envelope['yubikey'][field] = '/untrusted/backend'
+      expect { described_class.open_credentials(envelope: envelope) }.to raise_error(ArgumentError, /metadata/)
+    end
+  end
+
+  it 'preserves ciphertext when the device disappears on the encryption half of an update' do
+    Dir.mktmpdir('vault-save-failure-') do |root|
+      path = File.join(root, 'vault')
+      File.write(path, "token: original\n")
+      described_class.create(file: path, yubikey: {})
+      before = File.binread(path)
+      calls = 0
+      allow(@device).to receive(:challenge_response) do |opts|
+        calls += 1
+        raise IOError, 'Device removed' if calls > 1
+
+        OpenSSL::HMAC.digest('SHA1', 'fixture-slot', opts[:challenge])
+      end
+      expect do
+        described_class.update(file: path) do |cfg|
+          cfg[:token] = 'changed'
+          expect(File.binread(path)).to eq(before)
+        end
+      end.to raise_error(IOError, 'Device removed')
+      expect(File.binread(path)).to eq(before)
+      expect(Dir.children(root)).to eq(['vault'])
+    end
+  end
+
+  it 'converts a legacy vault in memory and never downgrades a hardware loot label on replacement' do
+    Dir.mktmpdir('vault-conversion-') do |root|
+      allow(Dir).to receive(:home).and_return(root)
+      path = File.join(root, 'vault')
+      File.binwrite(path, described_class.encrypt_data(@legacy.merge(data: "token: original\n")))
+      described_class.refresh_encryption_secrets(@legacy.merge(file: path, new_yubikey: {}))
+      expect(described_class.dump(file: path)).to eq(token: 'original')
+      expect(File.stat(path).mode & 0o777).to eq(0o600)
+      described_class.store(label: 'fixed', secret: 'first', yubikey: {})
+      described_class.store(label: 'fixed', secret: 'second')
+      expect(described_class.fetch(label: 'fixed')).to eq('second')
+      expect(File).not_to exist(File.join(root, '.pwn-vault.key'))
+    end
+  end
+
+  %i[legacy hardware].each do |backend|
+    it "preserves untouched multiline YAML scalars during a #{backend} update" do
+      Dir.mktmpdir('vault-yaml-scalars-') do |root|
+        path = File.join(root, 'vault')
+        original = {
+          banner: ":first\n:second\n\n  :indented\nlast:\n",
+          nested: { values: [":array-line\n:next\n", :symbol, false, nil, 123], unicode: "é\n:行\n" }
+        }
+        access = backend == :legacy ? @legacy : { yubikey: {} }
+        File.binwrite(path, described_class.encrypt_data(access.merge(data: YAML.dump(original))))
+        expect(described_class.update(access.merge(file: path)) { |cfg| cfg[:changed] = true }).to eq(:saved)
+        expect(described_class.dump(access.merge(file: path))).to eq(original.merge(changed: true))
+      end
+    end
+  end
+
+  it 'supports empty binary data with independent challenge, salt and nonce on every encryption' do
+    first = described_class.encrypt_data(data: ''.b, yubikey: {})
+    second = described_class.encrypt_data(data: ''.b, yubikey: {})
+    expect(described_class.decrypt_data(data: first)).to eq(''.b)
+    a, b = [first, second].map { |ciphertext| JSON.parse(ciphertext.delete_prefix(described_class::YUBIKEY_HEADER)) }
+    %w[salt iv].each { |field| expect(a[field]).not_to eq(b[field]) }
+    expect(a['yubikey']['challenge']).not_to eq(b['yubikey']['challenge'])
+  end
+end