pwn 0.5.784 → 0.5.787

data/spec/lib/pwn/redaction_yubikey_spec.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'pwn/redaction'
+
+RSpec.describe PWN::Redaction, 'hardware and MFA field redaction' do
+  it 'masks complete management-secret containers in serialized text' do
+    samples = [
+      'scp_keys=["fixture-enc", "fixture-mac"] slot=2',
+      'scp_keys: {enc: "fixture-enc", nested: ["fixture-mac", "fixture ] bracket"]} slot=2',
+      "scp_keys=[\n\"fixture-enc\",\n[\"fixture-mac\"]\n] slot=2"
+    ]
+    samples.each do |text|
+      clean = described_class.redact(value: text)
+      expect(clean).not_to include('fixture-enc', 'fixture-mac', 'fixture ] bracket')
+      expect(clean).to include('[REDACTED]', 'slot=2')
+      expect(described_class.redact(value: clean)).to eq(clean)
+    end
+    expect(described_class.redact(value: 'scp_keys=["fixture-enc"')).to eq('scp_keys=[REDACTED]')
+    expect(described_class.redact(value: 'oath_secret="fixture truncated secret')).to eq('oath_secret=[REDACTED]')
+  end
+
+  it 'does not let an existing mask exempt an adjacent ordinary secret from capture' do
+    text = 'password=fixture-prefix[REDACTED]fixture-suffix'
+    clean = described_class.capture(value: text, vault: false)
+    expect(clean[:redacted]).not_to include('fixture-prefix', 'fixture-suffix')
+    expect(clean[:refs]).not_to be_empty
+  end
+
+  it 'masks key-value text before ordinary token hashing or loot capture' do
+    samples = [
+      'pin=123456', 'PUK: 654321', 'new_pin="123 456"', "'management_key' => 'fixture key'",
+      '--access-code=112233', 'oath_secret=fixture-oath', 'static_password=fixture-static',
+      'scp_enc=fixture-enc', 'mfa_code=102938', '{"pin": "123456", "puk": 654321}'
+    ]
+    expect(PWN::Plugins::Vault).not_to receive(:store)
+    expect(PWN::Plugins::Vault).not_to receive(:fetch)
+    expect(PWN::Plugins::Vault).not_to receive(:expand)
+    samples.each do |text|
+      clean = described_class.redact(value: text)
+      expect(clean).to include('[REDACTED]'), text
+      expect(clean).not_to match(/123|654|112|102|fixture|\[REDACTED:[^\]]+/), text
+      expect(described_class.redact(value: clean)).to eq(clean)
+      expect(described_class.capture(value: text, entropy: true, yubikey: { slot: 2 })).to eq(redacted: clean, refs: [])
+    end
+    expect(described_class.redact(value: { api_key: 'fixture-api' })).to eq(api_key: described_class.token(kind: 'api_key', value: 'fixture-api'))
+  end
+
+  it 'uses a constant mask for structured PINs, PUKs, MFA codes and management secrets' do
+    fields = %w[pin PIN new_pin current-pin admin_pin user_pin fido2_pin piv_pin openpgp_pin puk new_puk access_code management_key management_password oath_secret static_password scp scp_key scp_keys scp_enc scp_mac scp_dek scp03_enc_key mfa_code mfa_token otp totp hotp otp_code totp_secret recovery_code verification_code]
+    fields.each do |field|
+      first = described_class.redact(value: { field => '123456' })
+      second = described_class.redact(value: { field => '654321' })
+      expect(first).to eq(field => '[REDACTED]'), field
+      expect(second).to eq(first), field
+    end
+    input = { nested: [{ pin: 1234, puk: nil, scp_keys: %w[fixture-one fixture-two] }], slot: 2, serial: '12345678', shipping: 'public' }
+    expect(described_class.redact(value: input)).to eq(nested: [{ pin: '[REDACTED]', puk: nil, scp_keys: '[REDACTED]' }], slot: 2, serial: '12345678', shipping: 'public')
+    expect(input[:nested].first[:pin]).to eq(1234)
+  end
+end

data/spec/lib/pwn/session_cleanup_default_spec.rb

@@ -32,7 +32,7 @@ RSpec.describe 'Bundled session cleanup' do
       File.write(policy, JSON.generate(config))
       File.write(PWN::Migrate::SCHEMA_FILE, JSON.generate(schema: 10))
       upgrade = PWN::Migrate.run(fix: false, backup: false, io: StringIO.new)
-      raise 'missing upgrade' unless upgrade[:applied_migrations] == [11]
+      raise 'missing upgrade' unless upgrade[:applied_migrations] == [11, 12]
       raise 'overwritten policy' unless JSON.parse(File.read(policy))['batch_size'] == 7
       raise 'non-idempotent upgrade' unless PWN::Migrate.run(fix: false, backup: false, io: StringIO.new)[:applied_migrations].empty?
       raise 'wrong helper' unless File.read(File.join(PWN::Cron.cron_dir, 'session_cleanup.rb')).include?('session_cleanup v10')
@@ -60,8 +60,10 @@ RSpec.describe 'Bundled session cleanup' do
       begin
         job = PWN::Plugins::Jobs.start(command: command, session_id: sid, cwd: Dir.home, max_runtime: 20)
         raise 'job not running' unless PWN::Plugins::Jobs.status(id: job[:id])[:status] == 'RUNNING'
-        maintenance = PWN::SessionCleanup.coordinate(dry_run: false)
-        raise 'missing coordinator phases' unless maintenance[:phases].keys == %i[maintenance memory_consolidation learning_retention mistakes_retention policy_retention]
+        proc_root = File.join(Dir.home, 'fixture-proc')
+        FileUtils.mkdir_p(proc_root)
+        maintenance = PWN::SessionCleanup.coordinate(dry_run: false, proc_root: proc_root)
+        raise "missing coordinator phases: \#{maintenance.inspect}" unless maintenance[:phases].keys == %i[maintenance memory_consolidation learning_retention mistakes_retention policy_retention]
         raise 'active job session deleted' unless File.file?(File.join(PWN::Sessions.sessions_dir, sid + '.jsonl'))
         raise 'job dependency omitted' unless PWN::Sessions.dependency_index[:dependencies].fetch(sid).any? { |path| path.include?('/jobs/') }
         File.write(release, 'release')
@@ -79,7 +81,7 @@ RSpec.describe 'Bundled session cleanup' do
     RUBY
     output, error, ran = Open3.capture3(env, RbConfig.ruby, '-e', script, chdir: @tmp)
     expect(ran.success?).to be(true), "#{output}\n#{error}"
-    expect(JSON.parse(output)).to include('installed' => true, 'schema' => 11)
+    expect(JSON.parse(output)).to include('installed' => true, 'schema' => 12)
   end
 
   it 'never seeds curriculum on fresh install, upgrade or repeated migration after deletion' do
@@ -187,7 +189,7 @@ RSpec.describe 'Bundled session cleanup' do
     original = PWN::Cron.create(name: 'session_cleanup', schedule: '12 9 * * *', ruby: 'custom guard', enabled: false)
     File.write(File.join(@tmp, '.schema'), JSON.generate(schema: 7))
     result = PWN::Migrate.run(fix: false, backup: false, io: StringIO.new)
-    expect(result[:applied_migrations]).to eq([8, 9, 10, 11])
+    expect(result[:applied_migrations]).to eq([8, 9, 10, 11, 12])
     expect(PWN::Cron.list.fetch(original[:id])).to eq(original)
     expect(PWN::Cron.list.values.count { |job| job[:name] == 'session_cleanup' }).to eq(1)
     expect(File).to exist(File.join(PWN::Cron.cron_dir, 'session_cleanup.rb'))

data/spec/lib/pwn/session_cleanup_payload_spec.rb

@@ -183,8 +183,8 @@ RSpec.describe PWN::SessionCleanup do
       Thread.current[:pwn_steering_input] = nil
     end
 
-    it 'expires only committed verified disposable backups and retains prepared recovery evidence' do
-      file = File.join(Dir.home, '.pwn', 'tmp', 'expired-backup')
+    it 'leaves centralized recovery expiry to shared admission rather than quarantine pruning' do
+      file = File.join(described_class.disposable_directory('tmp'), 'expired-backup')
       FileUtils.mkdir_p(File.dirname(file))
       File.write(file, 'disposable')
       described_class.register_disposable(path: file, category: 'tmp', expires_at: 0)
@@ -192,11 +192,10 @@ RSpec.describe PWN::SessionCleanup do
       backup = result[:records].first['backup']
       old = Time.now - (100 * 86_400)
       File.utime(old, old, result[:ledger])
-      expect(described_class.prune_quarantine(dry_run: true)[:eligible]).to eq([backup])
-      expect(File.file?(backup)).to be(true)
-      expect(described_class.prune_quarantine(dry_run: false)[:deleted]).to eq([backup])
-      expect(File.exist?(backup)).to be(false)
-      expect(JSON.parse(File.read(result[:ledger]))['state']).to eq('expired')
+      expect(described_class.prune_quarantine(dry_run: true)[:eligible]).to eq([])
+      expect(described_class.prune_quarantine(dry_run: false)[:deleted]).to eq([])
+      expect(File.read(backup)).to eq('disposable')
+      expect(JSON.parse(File.read(result[:ledger]))['state']).to eq('committed')
     end
 
     it 'requires explicit continuation retirement and preserves an active association' do
@@ -235,7 +234,7 @@ RSpec.describe PWN::SessionCleanup do
     end
 
     it 'preserves failed writes and exposes interrupted prepared records instead of declaring completion' do
-      file = File.join(Dir.home, '.pwn', 'tmp', 'failure')
+      file = File.join(described_class.disposable_directory('tmp'), 'failure')
       FileUtils.mkdir_p(File.dirname(file))
       File.binwrite(file, "binary\xFF".b)
       described_class.register_disposable(path: file, category: 'tmp', expires_at: 0)
@@ -252,7 +251,7 @@ RSpec.describe PWN::SessionCleanup do
     end
 
     it 'recovers exact disposable backups without overwriting changed destinations' do
-      file = File.join(Dir.home, '.pwn', 'tmp', 'binary')
+      file = File.join(described_class.disposable_directory('tmp'), 'binary')
       FileUtils.mkdir_p(File.dirname(file))
       bytes = "café\xFF\x00".b
       File.binwrite(file, bytes)
@@ -321,8 +320,9 @@ RSpec.describe PWN::SessionCleanup do
 
     it 'reports all storage categories read-only and preserves unknown files' do
       root = File.join(Dir.home, '.pwn')
-      FileUtils.mkdir_p(File.join(root, 'tmp'))
-      unknown = File.join(root, 'tmp', 'unknown.bin')
+      runtime = described_class.disposable_directory('tmp')
+      FileUtils.mkdir_p(runtime)
+      unknown = File.join(runtime, 'unknown.bin')
       File.binwrite(unknown, "\xFF\x00".b)
       before = Dir.glob(File.join(root, '**', '*'), File::FNM_DOTMATCH).sort
       status = described_class.status

data/spec/lib/pwn/session_cleanup_recovery_spec.rb

@@ -90,7 +90,7 @@ RSpec.describe PWN::SessionCleanup do
       expect(JSON.parse(File.read(report[:transaction_ledger]))['state']).to eq('interrupted')
     end
 
-    it 'indexes only committed legacy backup rows and compacts duplicates without unlinking the last copy' do
+    it 'keeps centralized copies out of the legacy compactor and retains learning rollback bytes' do
       described_class.install
       allow(described_class).to receive(:legacy_owners).and_return([])
       original = File.binread(path)
@@ -103,15 +103,15 @@ RSpec.describe PWN::SessionCleanup do
       PWN::Sessions.append(session_id: id, role: 'user', content: 'evidence')
       File.write(PWN::AI::Agent::Learning::LEARNING_FILE, JSON.generate(session_id: id, outcome: 'fixture'))
       migration = PWN::AI::Agent::Learning.migrate_evidence(dry_run: false)
-      learning_backup = migration[:ledger].sub('.json', '.backup.jsonl')
+      learning_backup = JSON.parse(File.read(migration[:ledger])).fetch('backup')
       inventory = described_class.legacy_backups.map { |row| row[:path] }
-      expect(inventory).to include(*backups, learning_backup)
+      expect(inventory & (backups + [learning_backup])).to be_empty
       config = described_class.policy
       config['retention_days']['maintenance'] = 0
       File.write(File.join(Dir.home, '.pwn', 'maintenance', 'policy.json'), JSON.generate(config))
       result = described_class.prune_legacy_backups(dry_run: false)
-      expect(result[:compacted] & backups).not_to be_empty
-      expect(File.identical?(*backups)).to be(true)
+      expect(result[:compacted] & backups).to be_empty
+      expect(backups.map { |file| File.binread(file) }).to eq([original, original])
       expect(File.file?(learning_backup)).to be(true)
       record = JSON.parse(File.read(migration[:ledger])).merge('state' => 'prepared')
       File.write(migration[:ledger], JSON.generate(record))
@@ -125,8 +125,11 @@ RSpec.describe PWN::SessionCleanup do
       layout = File.join(directory, 'layout.json')
       File.write(layout, JSON.generate(version: 1, categories: { learning: ['learning_evidence'] }))
       described_class.install
-      expect(JSON.parse(File.read(layout))).to include('version' => 2, 'categories' => described_class::STORAGE)
+      expect(JSON.parse(File.read(layout))).to include('version' => 3, 'categories' => described_class::STORAGE)
       expect(File.binread(File.join(directory, 'policy.json'))).to eq(config)
+      File.write(layout, JSON.generate(version: 2, categories: { 'tmp' => ['tmp'] }))
+      described_class.install
+      expect(JSON.parse(File.read(layout))).to include('version' => 3, 'categories' => described_class::STORAGE)
       File.write(layout, JSON.generate(version: 99, categories: {}))
       expect { described_class.install }.to raise_error(IOError, /inventory/)
     end
@@ -146,7 +149,7 @@ RSpec.describe PWN::SessionCleanup do
       lease&.close
     end
 
-    it 'prunes redundant physical continuation backups while preserving rollback paths and unique evidence' do
+    it 'preserves centralized continuation recovery and does not run a competing compactor' do
       described_class.install
       root = File.join(Dir.home, '.pwn', 'swarm')
       swarm = '20200101_010203_abcdef'
@@ -165,25 +168,19 @@ RSpec.describe PWN::SessionCleanup do
       File.write(File.join(Dir.home, '.pwn', 'maintenance', 'policy.json'), JSON.generate(config))
       expect(File.identical?(*backups)).to be(false)
       report = described_class.prune_legacy_backups(dry_run: false)
-      expect(report[:compacted].length).to eq(1)
-      expect(File.identical?(*backups)).to be(true)
-      expect(backups.map { |file| File.binread(file) }).to eq([original, original])
-      expect(described_class.prune_legacy_backups(dry_run: false)[:compacted]).to be_empty
-      expect(described_class.recovery_status(ledger: report[:ledger])[:state]).to eq('committed')
-      # Model interruption after the atomic replacement but before commit readback.
-      interrupted = JSON.parse(File.read(report[:ledger]))
-      interrupted['state'] = 'prepared'
-      interrupted['records'].each { |row| row['state'] = 'prepared' }
-      File.write(report[:ledger], JSON.generate(interrupted))
-      expect(described_class.recover(ledger: report[:ledger], action: 'resume', dry_run: false)[:state]).to eq('committed')
+      expect(report[:compacted]).to be_empty
+      expect(File.identical?(*backups)).to be(false)
       expect(backups.map { |file| File.binread(file) }).to eq([original, original])
+      ledger = File.join(File.dirname(backups.last), 'ledger.json')
+      expect(described_class.recover(ledger: ledger, action: 'rollback', dry_run: false)[:restored]).to eq([map])
+      expect(File.binread(map)).to eq(original)
     end
 
     it 'owns actual festival input through use and removes it without a global tmp sweep' do
       observed = nil
       allow(PWN::Plugins::Voice).to receive(:text_to_speech) do |opts|
         observed = opts[:text_path]
-        expect(observed).to start_with("#{File.join(Dir.home, '.pwn', 'tmp')}/")
+        expect(observed).to start_with("#{described_class.disposable_directory('tmp')}/")
         expect(File.read(observed)).to eq('fixture speech')
         expect(described_class.clean_disposables(dry_run: false)[:deleted]).to be_empty
       end
@@ -224,11 +221,20 @@ RSpec.describe PWN::SessionCleanup do
       config['retention_days']['maintenance'] = 0
       File.write(File.join(Dir.home, '.pwn', 'maintenance', 'policy.json'), JSON.generate(config))
       2.times do |index|
-        file = File.join(Dir.home, '.pwn', 'tmp', "expiry-#{index}")
+        file = File.join(described_class.disposable_directory('tmp'), "expiry-#{index}")
         File.write(file, "bytes-#{index}")
         described_class.register_disposable(path: file, category: 'tmp', expires_at: 0)
       end
       result = described_class.clean_disposables(dry_run: false)
+      # Exercise the retained legacy recovery reader with a genuine old layout.
+      old_directory = File.dirname(result[:ledger])
+      legacy_directory = File.join(Dir.home, '.pwn', 'maintenance', 'quarantine', 'legacy-expiry')
+      FileUtils.mkdir_p(File.dirname(legacy_directory))
+      FileUtils.mv(old_directory, legacy_directory)
+      result = JSON.parse(JSON.generate(result).gsub(old_directory, legacy_directory), symbolize_names: true)
+      data = JSON.parse(File.read(result[:ledger]).gsub(old_directory, legacy_directory))
+      File.write(result[:ledger], JSON.generate(data))
+      result[:records] = data.fetch('records')
       backups = result[:records].map { |row| row['backup'] }
       allow(File).to receive(:unlink).and_call_original
       allow(File).to receive(:unlink).with(backups.last).and_raise(Interrupt)
@@ -309,6 +315,14 @@ RSpec.describe PWN::SessionCleanup, 'disposable admission and scan progress' do
     described_class.cache(path: cache, bytes: 'q' * 1_048_576)
     described_class.register_disposable(path: cache, category: 'cache', expires_at: 0)
     removed = described_class.clean_disposables(dry_run: false)
+    old_directory = File.dirname(removed[:ledger])
+    legacy_directory = File.join(Dir.home, '.pwn', 'maintenance', 'quarantine', 'legacy-budget')
+    FileUtils.mkdir_p(File.dirname(legacy_directory))
+    FileUtils.mv(old_directory, legacy_directory)
+    removed = JSON.parse(JSON.generate(removed).gsub(old_directory, legacy_directory), symbolize_names: true)
+    data = JSON.parse(File.read(removed[:ledger]).gsub(old_directory, legacy_directory))
+    File.write(removed[:ledger], JSON.generate(data))
+    removed[:records] = data.fetch('records')
     backup = removed[:records].first.fetch('backup')
     config = described_class.policy.merge('work_bytes' => 8192)
     config['retention_days']['maintenance'] = 0

data/spec/lib/pwn/setup_native_yubikey_spec.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'ffi'
+
+RSpec.describe PWN::Setup, 'native library doctor' do
+  around do |example|
+    Dir.mktmpdir('native-library-doctor-') do |root|
+      @root = root
+      example.run
+    end
+  end
+
+  before do
+    allow(Dir).to receive(:home).and_return(@root)
+    stub_const('PWN::Env', {})
+    allow(PWN::Migrate).to receive(:check).and_return(incompatible: [])
+    allow(described_class).to receive(:pkg_manager).and_return(key: :apt, install: 'install-package')
+    allow(described_class).to receive(:which).and_return('/fixture/bin')
+    allow(described_class).to receive(:gem_loadable?).and_return(true)
+    allow(described_class).to receive(:detect_os_attr).with(attr: :type, fallback: anything).and_return(:linux)
+    allow(described_class).to receive(:detect_os_attr).with(attr: :arch, fallback: anything).and_return('fixture')
+    allow(FFI::DynamicLibrary).to receive(:open).and_raise(LoadError, 'fixture library missing')
+    device = double('untouched native device')
+    stub_const('PWN::Plugins::YubiKey', device)
+    %i[devices info command challenge_response oath_code].each { |method| expect(device).not_to receive(method) }
+  end
+
+  it 'reports missing optional libraries but gates only hardware and full profiles on them' do
+    %i[core hardware full].each do |profile|
+      io = StringIO.new
+      report = described_class.check(profile: profile, io: io)
+      expect(report[:ok]).to eq(profile == :core)
+      expect(report[:native_libraries_missing]).to eq(%w[hidapi pcsc])
+      expect(report[:native_gems_missing]).to eq([])
+      expect(report[:toolchain_missing]).to eq([])
+      expect(io.string).to include('Native libraries', 'hidapi', 'pcsc', 'no device discovery')
+    end
+  end
+
+  it 'loads only library handles and accepts the alternative HIDAPI libusb backend' do
+    flags = FFI::DynamicLibrary::RTLD_LAZY | FFI::DynamicLibrary::RTLD_LOCAL
+    allow(FFI::DynamicLibrary).to receive(:open).with('libhidapi-libusb.so.0', flags).and_return(double('HID library'))
+    allow(FFI::DynamicLibrary).to receive(:open).with('libpcsclite.so.1', flags).and_return(double('PCSC library'))
+    report = described_class.check(profile: :hardware, io: StringIO.new)
+    expect(report[:ok]).to be(true)
+    expect(report[:native_libraries_missing]).to eq([])
+    expect(FFI::DynamicLibrary).to have_received(:open).with('libhidapi-hidraw.so.0', flags)
+  end
+
+  it 'recognizes the built-in macOS PCSC framework and Homebrew HIDAPI path' do
+    allow(described_class).to receive(:detect_os_attr).with(attr: :type, fallback: anything).and_return(:osx)
+    flags = FFI::DynamicLibrary::RTLD_LAZY | FFI::DynamicLibrary::RTLD_LOCAL
+    allow(FFI::DynamicLibrary).to receive(:open).with('/System/Library/Frameworks/PCSC.framework/PCSC', flags).and_return(double('system PCSC framework'))
+    allow(FFI::DynamicLibrary).to receive(:open).with('/opt/homebrew/lib/libhidapi.dylib', flags).and_return(double('HID library'))
+    report = described_class.check(profile: :hardware, io: StringIO.new)
+    expect(report[:ok]).to be(true)
+    expect(report[:native_libraries_missing]).to eq([])
+  end
+
+  it 'lists optional native libraries in profile descriptions' do
+    io = StringIO.new
+    described_class.list_profiles(io: io)
+    expect(io.string).to include('libs: hidapi pcsc')
+  end
+end

data/spec/lib/pwn/setup_vault_yubikey_spec.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+require 'stringio'
+
+RSpec.describe PWN::Setup, 'hardware vault doctor' do
+  around do |example|
+    Dir.mktmpdir('setup-yubikey-') do |root|
+      @root = root
+      example.run
+    end
+  end
+
+  before do
+    allow(Dir).to receive(:home).and_return(@root)
+    @pwn_root = File.join(@root, '.pwn')
+    FileUtils.mkdir_p(@pwn_root)
+    stub_const('PWN::Env', {})
+    stub_const('PWN::Migrate::PWN_ROOT', @pwn_root)
+    stub_const('PWN::Migrate::SCHEMA_FILE', File.join(@pwn_root, '.schema'))
+    stub_const('PWN::Setup::NATIVE_GEMS', {})
+    stub_const('PWN::Setup::TOOLCHAIN', {})
+    stub_const('PWN::Setup::NATIVE_LIBRARIES', {})
+    allow(described_class).to receive(:pkg_manager).and_return(key: :fixture)
+    allow(described_class).to receive(:detect_os_attr).and_return('fixture')
+    stub_const('PWN::Plugins::YubiKey', double('synthetic YubiKey'))
+    allow(PWN::Plugins::YubiKey).to receive(:challenge_response) do |opts|
+      OpenSSL::HMAC.digest('SHA1', 'synthetic-slot-secret', opts[:challenge])
+    end
+    @path = File.join(@pwn_root, 'pwn.yaml')
+    File.binwrite(@path, PWN::Plugins::Vault.encrypt_data(data: YAML.dump(ai: { active: 'ollama' }), yubikey: { slot: 2 }))
+    @io = StringIO.new
+  end
+
+  it 'uses Config driver paths consistently in setup and the migration state verifier' do
+    custom = File.join(@root, 'custom-vault')
+    File.rename(@path, custom)
+    PWN::Env[:driver_opts] = { pwn_env_path: custom, pwn_dec_path: File.join(@root, 'custom-sidecar') }
+    expect(PWN::Plugins::YubiKey).not_to receive(:challenge_response)
+    report = described_class.check(io: @io)
+    expect(report[:ok]).to be(true)
+    expect(report.dig(:state, :files).find { |row| row[:rel] == 'pwn.yaml' }).to include(ok: true, path: custom)
+    expect(@io.string).to include('YubiKey', 'no software decryptor required')
+    expect(File).not_to exist(@path)
+    expect(File).not_to exist(PWN::Env.dig(:driver_opts, :pwn_dec_path))
+  end
+
+  it 'recognizes hardware vaults without a missing-decryptor warning or a device operation' do
+    bytes = File.binread(@path)
+    expect(PWN::Plugins::YubiKey).not_to receive(:challenge_response)
+    expect(PWN::Plugins::Vault).not_to receive(:create)
+    report = described_class.check(io: @io)
+    expect(report[:ok]).to be(true)
+    expect(report.dig(:state, :incompatible)).to be_empty
+    expect(@io.string).to include('YubiKey', 'no software decryptor required')
+    expect(@io.string).not_to include('decryptor MISSING')
+    expect(File.binread(@path)).to eq(bytes)
+    expect(Dir.children(@pwn_root)).to eq(['pwn.yaml'])
+  end
+end

data/spec/lib/pwn/setup_yubikey_spec.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe PWN::Setup, 'optional native YubiKey libraries' do
+  before do
+    allow(described_class).to receive(:check).and_return(ok: true)
+    allow(described_class).to receive(:gem_loadable?).and_return(true)
+    expect(described_class).not_to receive(:system)
+  end
+
+  it 'replaces executable provisioning with optional HIDAPI and PC/SC libraries' do
+    expect(described_class::TOOLCHAIN).not_to have_key('ykman')
+    expect(described_class::PROFILES.fetch(:hardware).fetch(:bins)).not_to include('ykman')
+    expect(described_class::PROFILES.fetch(:full).fetch(:bins)).not_to include('ykman')
+    expect(described_class::PROFILES.fetch(:hardware).fetch(:libs)).to eq(%w[hidapi pcsc])
+    expect(described_class::PROFILES.fetch(:full).fetch(:libs)).to eq(described_class::NATIVE_LIBRARIES.keys)
+    expect(Array(described_class::PROFILES.fetch(:core)[:libs])).to be_empty
+  end
+
+  { apt: %w[libhidapi-hidraw0 libpcsclite1 pcscd libccid],
+    dnf: %w[hidapi pcsc-lite-libs pcsc-lite pcsc-lite-ccid],
+    pacman: %w[hidapi pcsclite ccid], brew: %w[hidapi], port: %w[hidapi] }.each do |manager, libraries|
+    it "plans native host packages for #{manager} without a Python or CLI backend" do
+      allow(described_class).to receive(:pkg_manager).and_return(key: manager, install: 'install-package')
+      result = described_class.deps(profile: :hardware, dry_run: true, io: StringIO.new, distro: :fixture, version: 'test')
+      commands = result.fetch(:ran).map { |row| row.fetch(:cmd) }
+      libraries.each { |package| expect(commands).to include("install-package #{package}") }
+      expect(commands.join('\n')).not_to match(/ykman|yubikey-manager|python|\bpip(?:[23x])?\b/)
+      expect(result.fetch(:ran)).to all(include(dry_run: true))
+      expect(commands.join('\n')).not_to match(/pcsc|ccid/) if %i[brew port].include?(manager)
+    end
+  end
+
+  it 'does not install hardware packages in the core profile' do
+    allow(described_class).to receive(:pkg_manager).and_return(key: :apt, install: 'install-package')
+    result = described_class.deps(profile: :core, dry_run: true, io: StringIO.new, distro: :fixture, version: 'test')
+    expect(result.fetch(:ran).map { |row| row.fetch(:cmd) }.join('\n')).not_to match(/hidapi|pcsclite|pcscd|ccid|ykman/)
+  end
+end