meshtastic 0.0.180 → 0.0.181

data/spec/lib/meshtastic/admin/firmware/serial_bootloader_spec.rb

@@ -0,0 +1,263 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'pty'
+require 'digest'
+require 'timeout'
+require 'tempfile'
+require 'meshtastic/admin/firmware/serial_bootloader'
+
+RSpec.describe Meshtastic::Admin::Firmware::SerialBootloader do # rubocop:disable Metrics/BlockLength
+  def image(chip_id = 0)
+    header = [0xe9, 1, 2, 0x20, 0x40000000].pack('C4V')
+    header << [0xee, 0, 0, 0, chip_id, 0, 0, 0].pack('C4vCvv') << "\0\0\0\0\1".b
+    data = ("\xc0\xdb".b * 600)
+    body = header + [0x3ffb0000, data.bytesize].pack('V2') + data
+    body << "\0" until body.bytesize % 16 == 15
+    body << [data.bytes.reduce(0xef, :^)].pack('C')
+    body + Digest::SHA256.digest(body)
+  end
+
+  def frame(packet)
+    "\xc0".b + packet.bytes.map { |b|
+      if b == 0xc0
+        "\xdb\xdc".b
+      else
+        b == 0xdb ? "\xdb\xdd".b : b.chr
+      end
+    }.join.b + "\xc0".b
+  end
+
+  def receive_packet(io)
+    bytes = +''.b
+    started = false
+    loop do
+      b = io.readpartial(1).getbyte(0)
+      if b == 0xc0
+        return bytes.gsub("\xdb\xdc".b, "\xc0".b).gsub("\xdb\xdd".b, "\xdb".b) if started && !bytes.empty?
+
+        started = true
+      elsif started
+        bytes << b
+      end
+    end
+  end
+
+  def emulate(bytes:, chip_id: 0, failure: nil)
+    PTY.open do |master, slave|
+      commands = []
+      flash = +''.b
+      worker = Thread.new do
+        Thread.current.report_on_exception = false
+        loop do
+          packet = receive_packet(master)
+          direction, op, length, checksum = packet.unpack('CCvV')
+          payload = packet.byteslice(8..)
+          raise 'bad request framing' unless direction.zero? && length == payload.bytesize
+
+          commands << op
+          value = 0
+          response = +''.b
+          case op
+          when 8
+            raise 'bad sync' unless payload == "\x07\x07\x12\x20".b + ("\x55" * 32)
+
+            value = failure == :stub ? 0 : 0x20100707
+            next if failure == :sync_once && commands.count(8) == 1
+          when 10
+            address = payload.unpack1('V')
+            value = address == 0x40001000 ? 0x00f01d83 : 0
+            value = 0 if failure == :wrong_chip
+            value = 0x30 if failure == :secure && address == 0x3ff5a018
+          when 0x14
+            response = ([failure == :secure ? 1 : 0] + ([0] * 8) + [failure == :wrong_chip ? 99 : chip_id, 0]).pack('VC8V2')
+          when 0x0d
+            raise 'bad attach' unless payload == [0, 0].pack('V2')
+          when 0x0b
+            raise 'bad geometry' unless payload == [0, 4 * 1024 * 1024, 65_536, 4096, 256, 65_535].pack('V6')
+          when 2
+            params = payload.unpack('V*')
+            expected = [bytes.bytesize, (bytes.bytesize + 1023) / 1024, 1024, 0x10000]
+            expected << 0 unless chip_id.zero?
+            raise "bad begin #{params}" unless params == expected
+          when 3
+            size, sequence, reserved1, reserved2 = payload.unpack('V4')
+            block = payload.byteslice(16..)
+            raise 'bad block' unless size == 1024 && block.bytesize == size && sequence * 1024 == flash.bytesize && reserved1.zero? && reserved2.zero?
+            raise 'bad checksum' unless checksum == block.bytes.reduce(0xef, :^)
+
+            flash << block
+          when 0x13
+            raise 'bad verify range' unless payload == [0x10000, bytes.bytesize, 0, 0].pack('V4')
+            raise 'different flashed bytes' unless flash.byteslice(0, bytes.bytesize) == bytes
+
+            response = failure == :digest ? '0' * 32 : Digest::MD5.hexdigest(flash.byteslice(0, bytes.bytesize))
+          when 4
+            raise 'bad end' unless payload == [0].pack('V')
+          else
+            raise "unexpected opcode #{op}"
+          end
+          status = failure == op ? [1, 5, 0, 0].pack('C4') : "\0" * 4
+          response += status
+          reply = frame([1, op, response.bytesize, value].pack('CCvV') + response)
+          if op == 3
+            next if failure == :silent
+
+            reply = "\xc0\xdb\x01\xc0".b if failure == :bad_escape
+            reply = frame([1, 99, 4, 0].pack('CCvV') + ("\0" * 4)) if failure == :wrong_opcode
+            reply = frame([1, op, 99, 0].pack('CCvV') + ("\0" * 4)) if failure == :bad_length
+            reply = frame('short') if failure == :short
+          end
+          (op == 8 ? 8 : 1).times { master.write(reply) }
+          break if op == 4 || failure == op || (op == 0x13 && failure == :digest)
+        end
+      rescue EOFError, Errno::EIO
+        nil
+      end
+      begin
+        yield slave.path, commands
+      ensure
+        worker.kill
+        worker.join
+        worker.value
+      end
+    end
+  end
+
+  let(:installer) { Meshtastic::Admin::Firmware::SerialBootloader }
+  let(:bytes) { image }
+
+  it 'rejects invalid chip, image, flash geometry and options before opening any port' do
+    base = { port: '/dev/never-open', chip: :esp32, bytes: bytes, offset: 0x10000, flash_size: 4 * 1024 * 1024, reset: :none }
+    corrupt = bytes.dup
+    corrupt.setbyte(35, corrupt.getbyte(35) ^ 1)
+    corrupt_hash = bytes.dup
+    corrupt_hash.setbyte(-1, corrupt_hash.getbyte(-1) ^ 1)
+    invalid = [
+      { chip: :esp8266 }, { bytes: 'bad' }, { bytes: image(9) }, { bytes: corrupt },
+      { bytes: corrupt_hash },
+      { bytes: "#{bytes}junk" }, { bytes: bytes.byteslice(0, 35) },
+      { offset: -1 }, { offset: 0x10001 }, { offset: 0 }, { offset: 4 * 1024 * 1024 },
+      { flash_size: 123 }, { timeout: 0 }, { timeout: Float::INFINITY },
+      { reset: :magic }, { protocol: :nordic_serial }, { firmware: '/tmp/ambiguous' },
+      { surprise: true }, { port: '' }
+    ]
+    expect(UART).not_to receive(:open)
+    invalid.each do |change|
+      expect { installer.install(base.merge(change)) }.to raise_error(ArgumentError), change.inspect
+    end
+  end
+
+  { esp32s3: 9, esp32c3: 5 }.each do |chip, id|
+    it "identifies #{chip} with GET_SECURITY_INFO and uses extended FLASH_BEGIN" do
+      firmware = image(id)
+      emulate(bytes: firmware, chip_id: id) do |port, commands|
+        result = installer.install(port: port, chip: chip, bytes: firmware, offset: 0x10000, flash_size: 4 * 1024 * 1024, reset: :none)
+        expect(result[:chip]).to eq(chip)
+        expect(commands).to eq([8, 20, 13, 11, 2, 3, 3, 19, 4])
+      end
+    end
+  end
+
+  it 'retries only synchronization when the ROM misses its first request' do
+    emulate(bytes: bytes, failure: :sync_once) do |port, commands|
+      result = installer.install(port: port, chip: :esp32, bytes: bytes, offset: 0x10000, flash_size: 4 * 1024 * 1024, reset: :none, timeout: 0.1)
+      expect(result[:status]).to eq(:verified)
+      expect(commands.count(8)).to eq(2)
+      expect(commands.count(2)).to eq(1)
+    end
+  end
+
+  it 'rejects an already running flasher stub before any flash command' do
+    emulate(bytes: bytes, failure: :stub) do |port, commands|
+      expect { installer.install(port: port, chip: :esp32, bytes: bytes, offset: 0x10000, flash_size: 4 * 1024 * 1024, reset: :none) }.to raise_error(IOError, /stub/)
+      expect(commands).to eq([8])
+    end
+  end
+
+  [3, :digest, :bad_escape, :wrong_opcode, :bad_length, :short, :silent].each do |failure|
+    it "fails closed on #{failure} without reboot or replaying FLASH_DATA and closes its UART" do
+      opened = nil
+      allow(UART).to(receive(:open).and_wrap_original { |original, *args| opened = original.call(*args) })
+      emulate(bytes: bytes, failure: failure) do |port, commands|
+        error = failure == :silent ? Timeout::Error : IOError
+        expect { installer.install(port: port, chip: :esp32, bytes: bytes, offset: 0x10000, flash_size: 4 * 1024 * 1024, reset: :none, timeout: 0.1) }.to raise_error(error)
+        expect(commands).not_to include(4)
+        expect(commands.count(3)).to eq(failure == :digest ? 2 : 1)
+      end
+      expect(opened).to be_closed
+    end
+  end
+
+  { esp32: 0, esp32s3: 9, esp32c3: 5 }.each do |chip, id|
+    %i[secure wrong_chip].each do |failure|
+      it "rejects #{failure} on #{chip} before erasing any flash" do
+        firmware = image(id)
+        emulate(bytes: firmware, chip_id: id, failure: failure) do |port, commands|
+          expect { installer.install(port: port, chip: chip, bytes: firmware, offset: 0x10000, flash_size: 4 * 1024 * 1024, reset: :none) }.to raise_error(IOError)
+          expect(commands).not_to include(2, 3)
+        end
+      end
+    end
+  end
+
+  it 'reads an image file and accepts the ESP format without an appended digest' do
+    firmware = bytes.byteslice(0, bytes.bytesize - 32)
+    firmware.setbyte(23, 0)
+    Tempfile.create(['esp-app', '.bin']) do |file|
+      file.binmode
+      file.write(firmware)
+      file.flush
+      emulate(bytes: firmware) do |port, _commands|
+        result = installer.install(port: port, chip: :esp32, firmware: file.path, offset: 0x10000, flash_size: 4 * 1024 * 1024, reset: :none)
+        expect(result[:md5]).to eq(Digest::MD5.hexdigest(firmware))
+      end
+    end
+  end
+
+  it 'clears inherited hardware flow control and hangup reset before writing ROM bytes' do
+    allow(UART).to receive(:open).and_wrap_original do |original, *args|
+      serial = original.call(*args)
+      attrs = Termios.tcgetattr(serial)
+      attrs.cflag |= Termios::CRTSCTS | Termios::HUPCL
+      Termios.tcsetattr(serial, Termios::TCSANOW, attrs)
+      allow(serial).to receive(:write).and_wrap_original do |write, *data|
+        expect(Termios.tcgetattr(serial).cflag & (Termios::CRTSCTS | Termios::HUPCL)).to eq(0)
+        write.call(*data)
+      end
+      serial
+    end
+    emulate(bytes: bytes) do |port, _commands|
+      installer.install(port: port, chip: :esp32, bytes: bytes, offset: 0x10000, flash_size: 4 * 1024 * 1024, reset: :none)
+    end
+  end
+
+  it 'uses classic DTR/RTS boot reset and a final EN pulse on a dedicated UART' do
+    controls = []
+    opened = nil
+    allow(UART).to receive(:open).and_wrap_original do |original, *args|
+      opened = original.call(*args)
+      allow(opened).to receive(:ioctl) { |op, bits| controls << [op, bits.unpack1('i')] }
+      opened
+    end
+    allow(installer).to receive(:sleep)
+    emulate(bytes: bytes) do |port, _commands|
+      installer.install(port: port, chip: :esp32, bytes: bytes, offset: 0x10000, flash_size: 4 * 1024 * 1024)
+    end
+    expect(controls).to eq([
+                             [Termios::TIOCMBIC, Termios::TIOCM_DTR], [Termios::TIOCMBIS, Termios::TIOCM_RTS],
+                             [Termios::TIOCMBIS, Termios::TIOCM_DTR], [Termios::TIOCMBIC, Termios::TIOCM_RTS],
+                             [Termios::TIOCMBIC, Termios::TIOCM_DTR],
+                             [Termios::TIOCMBIS, Termios::TIOCM_RTS], [Termios::TIOCMBIC, Termios::TIOCM_RTS]
+                           ])
+    expect(opened).to be_closed
+  end
+
+  it 'opens a real UART PTY, syncs, flashes checksummed blocks and verifies the device MD5 before reboot' do
+    emulate(bytes: bytes) do |port, commands|
+      result = installer.install(port: port, chip: :esp32, bytes: bytes, offset: 0x10000, flash_size: 4 * 1024 * 1024, reset: :none)
+      expect(result).to include(status: :verified, chip: :esp32, bytes: bytes.bytesize, md5: Digest::MD5.hexdigest(bytes), reboot_requested: true, boot_verified: false)
+      expect(commands).to eq([8, 10, 10, 10, 13, 11, 2, 3, 3, 19, 4])
+    end
+  end
+end

data/spec/lib/meshtastic/admin/firmware_spec.rb

@@ -1,118 +1,315 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
-require 'tempfile'
+require 'socket'
 require 'digest'
+require 'tempfile'
+
+RSpec.describe Meshtastic::Admin::Firmware do
+  it 'dispatches explicitly to independent native bootloader protocols' do
+    %i[esp_rom nordic_dfu].each do |protocol|
+      name = protocol == :esp_rom ? :SerialBootloader : :NordicDFU
+      implementation = described_class.const_get(name)
+      options = { protocol: protocol, bytes: 'abc' }
+      expect(implementation).to receive(:install).with(options).and_return(status: :verified)
+      expect(described_class.install(options)).to eq(status: :verified)
+    end
+  end
+
+  it 'validates reboot verification before upload and only verifies after loader success' do
+    backend = double('BLE backend')
+    verify = { transport: :tcp, connection: { host: '192.0.2.1' }, expected_version: '2.7.1' }
+    options = { protocol: :unified_ble, backend: backend, bytes: 'abc' }
+    expect(described_class::BLE).to receive(:install).with(options).ordered.and_return(status: :verified, bytes: 3, reboot_verified: false, boot_verified: false)
+    expect(described_class).to receive(:verify_reboot).with(verify).ordered.and_return(status: :boot_verified, firmware_version: '2.7.1')
+    expect(described_class.install(options.merge(verify: verify))).to include(status: :boot_verified, loader_status: :verified, bytes: 3, reboot_verified: true, boot_verified: true)
+  end
+
+  it 'rejects invalid verification settings before any destructive transfer' do
+    base = { transport: :tcp, connection: { host: '192.0.2.1' }, expected_version: '2.7.1' }
+    invalid = [true, {}, base.merge(timeout: 0), base.merge(timeout: Float::INFINITY),
+               base.merge(reboot_delay: -1), base.merge(expected_version: ''), base.merge(transport: :mqtt),
+               base.merge(connection: {}), base.merge(reconnect: true), base.merge(expected_node: '!bad'),
+               base.merge(connection: { host: '192.0.2.1', socket: Object.new }),
+               base.merge(connection: { host: '192.0.2.1', port: 0 }),
+               base.merge(transport: :bluetooth, connection: { address: 'not-a-mac' })]
+    invalid.each do |verify|
+      expect(described_class::BLE).not_to receive(:install)
+      expect { described_class.install(protocol: :unified_ble, bytes: 'abc', verify: verify) }.to raise_error(ArgumentError)
+    end
+  end
+
+  it 'ignores cached metadata and checks a fresh correlated Admin reply after callback reconnect' do
+    queue = Queue.new
+    writer = Object.new
+    writer.define_singleton_method(:write) do |bytes|
+      request = Meshtastic::ToRadio.decode(bytes.byteslice(4..)).packet
+      payload = Meshtastic::AdminMessage.new(get_device_metadata_response: Meshtastic::DeviceMetadata.new(firmware_version: 'wrong')).to_proto
+      queue << Meshtastic::FromRadio.new(packet: Meshtastic::MeshPacket.new(from: 123, decoded: Meshtastic::Data.new(portnum: :ADMIN_APP, request_id: request.id, payload: payload)))
+      bytes.bytesize
+    end
+    writer.define_singleton_method(:flush) { true }
+    handle = { serial_conn: writer, from_radio_queue: queue, my_node_num: 123, metadata: { firmware_version: 'expected' } }
+    attempts = 0
+    reconnect = lambda do |_options|
+      attempts += 1
+      raise Errno::ECONNREFUSED if attempts == 1
+
+      handle
+    end
+    expect(Meshtastic::Serial).to receive(:wait_for_config).with(serial_obj: handle, timeout: 1).and_return(handle)
+    expect(Meshtastic::Serial).to receive(:disconnect).with(serial_obj: handle)
+    expect do
+      described_class.verify_reboot(transport: :serial, reconnect: reconnect, expected_version: 'expected', reboot_delay: 0, timeout: 1)
+    end.to raise_error(IOError, /version mismatch/)
+  end
+
+  it 'verifies fresh post-reboot metadata over a new production TCP PhoneAPI connection' do
+    server = TCPServer.new('127.0.0.1', 0)
+    worker = Thread.new do
+      socket = server.accept
+      buffer = +''.b
+      loop do
+        buffer << socket.read(1)
+        next unless buffer.end_with?("\x94\xC3".b)
+
+        length = socket.read(2).unpack1('n')
+        request = Meshtastic::ToRadio.decode(socket.read(length))
+        replies = if request.want_config_id.positive?
+                    [Meshtastic::FromRadio.new(my_info: Meshtastic::MyNodeInfo.new(my_node_num: 123)),
+                     Meshtastic::FromRadio.new(metadata: Meshtastic::DeviceMetadata.new(firmware_version: 'STALE')),
+                     Meshtastic::FromRadio.new(config_complete_id: request.want_config_id)]
+                  elsif request.packet
+                    admin = Meshtastic::AdminMessage.decode(request.packet.decoded.payload)
+                    expect(admin.get_device_metadata_request).to be true
+                    payload = Meshtastic::AdminMessage.new(get_device_metadata_response: Meshtastic::DeviceMetadata.new(firmware_version: '2.7.1', hw_model: :HELTEC_V3)).to_proto
+                    [Meshtastic::FromRadio.new(packet: Meshtastic::MeshPacket.new(from: 123, decoded: Meshtastic::Data.new(portnum: :ADMIN_APP, request_id: request.packet.id, payload: payload)))]
+                  else
+                    []
+                  end
+        replies.each do |reply|
+          bytes = reply.to_proto
+          socket.write("\x94\xC3".b + [bytes.bytesize].pack('n') + bytes)
+        end
+        break if request.packet
+      end
+    ensure
+      socket&.close
+    end
+    worker.report_on_exception = false
+    result = described_class.verify_reboot(transport: :tcp, connection: { host: '127.0.0.1', port: server.addr[1] }, expected_version: '2.7.1', expected_node: 123, reboot_delay: 0, timeout: 2)
+    expect(result).to include(status: :boot_verified, firmware_version: '2.7.1', node_num: 123)
+    worker.value
+  ensure
+    worker&.kill
+    worker&.join
+    server&.close
+  end
+end
+
+RSpec.shared_context 'a unified OTA TCP loader' do
+  def with_loader(options = {}, &handler)
+    server = TCPServer.new('127.0.0.1', 0)
+    worker = Thread.new do
+      client = server.accept
+      handler.call(client)
+    ensure
+      client&.close
+    end
+    worker.report_on_exception = false
+    yield_options = { protocol: :unified_wifi, host: '127.0.0.1', port: server.addr[1], bytes: 'abc', timeout: 0.3 }
+    result = described_class.install(yield_options.merge(options))
+    raise 'loader handshake did not finish' unless worker.join(1)
+
+    worker.value
+    result
+  ensure
+    worker&.kill
+    worker&.join
+    server&.close
+  end
+end
 
 describe Meshtastic::Admin::Firmware do
-  def fake_serial_obj
-    written = +''.b
-    serial_conn = Object.new
-    serial_conn.define_singleton_method(:write) do |b|
-      written << b
-      b.bytesize
+  include_context 'a unified OTA TCP loader'
+
+  it 'performs the unified WiFi handshake and waits for final verified OK' do
+    result = with_loader do |client|
+      expect(client.gets).to eq("VERSION\n")
+      client.write("OK 1 2.7.0 3 v1.0\n")
+      expect(client.gets).to eq("OTA 3 #{Digest::SHA256.hexdigest('abc')}\n")
+      client.write("ERASING\nOK\n")
+      expect(client.read(3)).to eq('abc')
+      client.write("ACK\nOK\n")
     end
-    serial_conn.define_singleton_method(:flush) { true }
-    serial_conn.define_singleton_method(:closed?) { false }
-    serial_conn.define_singleton_method(:close) { true }
-    { serial_conn: serial_conn, written: written, my_node_num: 0xb0b }
+    expect(result).to include(status: :verified, bytes: 3, sha256: Digest::SHA256.hexdigest('abc'))
   end
 
-  def decode_frames(serial_obj)
-    buf = serial_obj[:written].dup
-    frames = []
-    until buf.bytesize < 4
-      break unless buf.getbyte(0) == Meshtastic::START1 && buf.getbyte(1) == Meshtastic::START2
+  it 'retries refused loader connections before issuing the OTA command' do
+    attempts = 0
+    allow(Socket).to receive(:tcp).and_wrap_original do |original, *args, **keywords|
+      attempts += 1
+      raise Errno::ECONNREFUSED if attempts == 1
 
-      len = (buf.getbyte(2) << 8) + buf.getbyte(3)
-      break if buf.bytesize < 4 + len
+      original.call(*args, **keywords)
+    end
+    result = with_loader do |client|
+      expect(client.gets).to eq("VERSION\n")
+      client.write("OK 1 2.7.0 3 v1.0\n")
+      client.gets
+      client.write("OK\n")
+      client.read(3)
+      client.write("OK\n")
+    end
+    expect(result[:status]).to eq(:verified)
+    expect(attempts).to eq(2)
+  end
 
-      frames << Meshtastic::ToRadio.decode(buf.byteslice(4, len))
-      buf = buf.byteslice((4 + len)..)
+  it 'validates all install options before connecting or reading files' do
+    defaults = { protocol: :unified_wifi, host: '127.0.0.1', bytes: 'abc' }
+    [{ bytes: '' }, { bytes: 123 }, { bytes: nil }, { firmware: '/missing', bytes: 'abc' },
+     { host: '' }, { port: 0 }, { timeout: 0 }, { timeout: Float::INFINITY },
+     { retries: -1 }, { retry_delay: -1 }, { mode: :OTA_BLE }, { tcp_obj: Object.new },
+     { to: '!aabbccdd' }, { protocol: :unified_wifi, bluetooth_obj: Object.new }].each do |invalid|
+      expect(Socket).not_to receive(:tcp)
+      expect { described_class.install(defaults.merge(invalid)) }.to raise_error(ArgumentError)
     end
-    frames
   end
 
-  def firmware_file(bytes = "hello firmware\n")
-    file = Tempfile.new(['fw', '.bin'])
-    file.binmode
-    file.write(bytes)
-    file.flush
-    file
+  it 'rejects invalid OTA modes and inconsistent or nonbinary supplied hashes before sending' do
+    [{ mode: :UNKNOWN, bytes: 'abc' }, { ota_hash: Object.new },
+     { ota_hash: 'a' * 32, bytes: 'abc' }, { ota_hash: 'a' * 64 }].each do |invalid|
+      expect(Meshtastic::Admin).not_to receive(:send)
+      expect { described_class.request_ota(invalid) }.to raise_error(ArgumentError)
+    end
   end
+end
+
+describe Meshtastic::Admin::Firmware do
+  include_context 'a unified OTA TCP loader'
 
-  it 'sends ota_request with SHA-256 and BLE mode' do
-    serial_obj = fake_serial_obj
-    file = firmware_file('abc')
-    described_class.request_ota(serial_obj: serial_obj, firmware: file.path, mode: :OTA_BLE)
-    packet = decode_frames(serial_obj).last.packet
+  it 'hashes files and sends the real OTA and DFU Admin protobuf fields' do
+    written = +''.b
+    connection = Object.new
+    connection.define_singleton_method(:write) do |data|
+      written << data
+      data.bytesize
+    end
+    connection.define_singleton_method(:flush) { true }
+    serial = { serial_conn: connection, my_node_num: 0xb0b }
+    described_class.request_ota(serial_obj: serial, bytes: 'abc', mode: :OTA_WIFI)
+    length = written.byteslice(2, 2).unpack1('n')
+    packet = Meshtastic::ToRadio.decode(written.byteslice(4, length)).packet
     admin = Meshtastic::AdminMessage.decode(packet.decoded.payload)
     expect(packet.decoded.portnum).to eq(:ADMIN_APP)
-    expect(admin.ota_request.reboot_ota_mode).to eq(:OTA_BLE)
-    expect(admin.ota_request.ota_hash.bytesize).to eq(32)
-    expect(admin.ota_request.ota_hash).to eq(Digest::SHA256.digest('abc'))
-  ensure
-    file.close!
-  end
-
-  it 'sends enter_dfu_mode_request' do
-    serial_obj = fake_serial_obj
-    described_class.enter_dfu(serial_obj: serial_obj)
-    admin = Meshtastic::AdminMessage.decode(decode_frames(serial_obj).last.packet.decoded.payload)
-    expect(admin.enter_dfu_mode_request).to be true
-  end
-
-  it 'builds XModem SOH blocks with CRC16 and an EOT' do
-    blocks = described_class.xmodem_blocks(bytes: 'A' * 130)
-    expect(blocks.first.control).to eq(:SOH)
-    expect(blocks.first.seq).to eq(1)
-    expect(blocks.first.buffer.bytesize).to eq(128)
-    expect(blocks[1].seq).to eq(2)
-    expect(blocks.last.control).to eq(:EOT)
-  end
-
-  it 'streams XModem ToRadio frames after ota_request on serial' do
-    serial_obj = fake_serial_obj
-    file = firmware_file('A' * 10)
-    described_class.install(serial_obj: serial_obj, firmware: file.path, mode: :OTA_BLE)
-    frames = decode_frames(serial_obj)
-    admin = Meshtastic::AdminMessage.decode(frames.first.packet.decoded.payload)
-    expect(admin.ota_request.ota_hash.bytesize).to eq(32)
-    xmodem = frames[1..]
-    expect(xmodem.first.xmodemPacket.control).to eq(:SOH)
-    expect(xmodem.last.xmodemPacket.control).to eq(:EOT)
-  ensure
-    file.close!
-  end
-
-  it 'publishes ota_request over MQTT without XModem PhoneAPI frames' do
-    published = []
-    mqtt_obj = Object.new
-    mqtt_obj.define_singleton_method(:client_id) { '00000b0b' }
-    mqtt_obj.define_singleton_method(:publish) do |topic, payload|
-      published << { topic: topic, payload: payload }
-      payload.bytesize
-    end
-    file = firmware_file('xyz')
-    described_class.install(mqtt_obj: mqtt_obj, firmware: file.path, mode: :OTA_WIFI, to: '!aabbccdd')
-    expect(published.size).to eq(1)
-    envelope = Meshtastic::ServiceEnvelope.decode(published.first[:payload])
-    packet = envelope.packet
-    nonce = [packet.id].pack('V').ljust(8, "\x00") + [packet.from].pack('V').ljust(8, "\x00")
-    psk = Base64.strict_decode64('1PG7OiApB1nwvP+rz05pAQ==')
-    cipher = OpenSSL::Cipher.new('AES-128-CTR')
-    cipher.decrypt
-    cipher.key = psk
-    cipher.iv = nonce
-    data = Meshtastic::Data.decode(cipher.update(packet.encrypted) + cipher.final)
-    expect(data.portnum).to eq(:ADMIN_APP)
-    admin = Meshtastic::AdminMessage.decode(data.payload)
     expect(admin.ota_request.reboot_ota_mode).to eq(:OTA_WIFI)
-  ensure
-    file.close!
+    expect(admin.ota_request.ota_hash).to eq(Digest::SHA256.digest('abc'))
+    written.clear
+    described_class.enter_dfu(serial_obj: serial)
+    length = written.byteslice(2, 2).unpack1('n')
+    packet = Meshtastic::ToRadio.decode(written.byteslice(4, length)).packet
+    expect(Meshtastic::AdminMessage.decode(packet.decoded.payload).enter_dfu_mode_request).to be true
+    Tempfile.create('firmware') do |file|
+      file.write('abc')
+      file.flush
+      expect(described_class.sha256(firmware: file.path)).to eq(Digest::SHA256.digest('abc'))
+    end
+  end
+
+  it 'rejects malformed VERSION responses before sending OTA' do
+    ["ERR Unknown Command\n", "OK\n", 'x' * 513, "OK 1 fw 2 loader"].each do |reply|
+      expect do
+        with_loader do |client|
+          client.gets
+          client.write(reply)
+        end
+      end.to raise_error(IOError)
+    end
+  end
+
+  it 'surfaces loader handshake and final integrity errors without retrying OTA' do
+    [false, true].each do |after_upload|
+      expect do
+        with_loader do |client|
+          client.gets
+          client.write("OK 1 fw 2 loader\n")
+          client.gets
+          if after_upload
+            client.write("OK\n")
+            client.read(3)
+          end
+          client.write("ERR Hash Mismatch\n")
+        end
+      end.to raise_error(IOError, /ERR Hash Mismatch/)
+    end
+  end
+
+  it 'does not treat disconnect or ACK as final verification' do
+    expect do
+      with_loader do |client|
+        client.gets
+        client.write("OK 1 fw 2 loader\n")
+        client.gets
+        client.write("OK\n")
+        client.read(3)
+        client.write("ACK\n")
+      end
+    end.to raise_error(IOError, /closed before confirmation/)
+  end
+
+  it 'bounds a silent loader handshake and closes its connection' do
+    expect do
+      with_loader do |client|
+        client.gets
+        expect(client.read).to eq('')
+      end
+    end.to raise_error(Timeout::Error)
+  end
+
+  it 'exhausts bounded connection retries without sending any admin commands' do
+    expect(Meshtastic::Admin).not_to receive(:send)
+    expect(Socket).to receive(:tcp).exactly(3).times.and_raise(Errno::ECONNREFUSED)
+    expect do
+      described_class.install(protocol: :unified_wifi, host: '127.0.0.1', bytes: 'abc', retries: 2, retry_delay: 0)
+    end.to raise_error(Errno::ECONNREFUSED)
   end
 
-  it 'prints usage without raising' do
-    expect { described_class.help }.to output(/firmware/).to_stdout
+  it 'drains TCP ACKs during upload rather than deadlocking on backpressure' do
+    allow(Socket).to receive(:tcp).and_wrap_original do |original, *args, **keywords|
+      socket = original.call(*args, **keywords)
+      socket.setsockopt(Socket::SOL_SOCKET, Socket::SO_SNDBUF, 1024)
+      socket
+    end
+    bytes = 'a' * 1_048_576
+    result = with_loader(bytes: bytes, timeout: 5) do |client|
+      client.setsockopt(Socket::SOL_SOCKET, Socket::SO_SNDBUF, 1024)
+      client.gets
+      client.write("OK 1 fw 2 loader\n")
+      client.gets
+      client.write("OK\n")
+      received = +''
+      while received.bytesize < bytes.bytesize
+        received << client.read(1024)
+        client.write("ACK\n" * 1024)
+      end
+      expect(received).to eq(bytes)
+      client.write("OK\n")
+    end
+    expect(result[:bytes]).to eq(bytes.bytesize)
+  end
+
+  it 'rejects obsolete firmware XModem helpers and unhandled legacy OTA reboot' do
+    %i[xmodem_blocks send_xmodem reboot_ota].each do |method|
+      expect { described_class.public_send(method, bytes: 'abc') }
+        .to raise_error(NotImplementedError)
+    end
+  end
+
+  it 'rejects PhoneAPI and MQTT installation without sending any commands' do
+    %i[serial_obj tcp_obj bluetooth_obj mqtt_obj].each do |transport|
+      expect(Meshtastic::Admin).not_to receive(:send)
+      expect { described_class.install(transport => Object.new, bytes: 'abc') }
+        .to raise_error(NotImplementedError, /unified_wifi/)
+    end
   end
 end