@onekeyfe/hardware-cli 1.2.0-alpha.25 → 1.2.0-alpha.27

package/dist/cli.d.ts

@@ -1,6 +1,16 @@
 import { Command } from 'commander';
 declare const program: Command;
 export declare function getLegacyFirmwareConnectTimeout(transport: 'usb' | 'ble'): 90000 | undefined;
+/**
+ * Prepare passphrase session before SDK calls.
+ *
+ * 1. If --use-empty-passphrase or --passphrase-state provided → use as-is
+ * 2. Try keychain → preloadSessionCache → use cached session
+ * 3. Keychain miss → openWalletSession (triggers 1/2/3 prompt) → save to keychain
+ *
+ * After this, globalOpts.passphraseState is set and getCommonParams will include it.
+ */
+export declare function prepareSession(sdk: typeof import('@onekeyfe/hd-common-connect-sdk').default, globalOpts: Record<string, any>): Promise<string | undefined>;
 export declare function buildWallpaperUploadMetrics({ totalBytes, transferredBytes, startedAt, endedAt, lastProgress, }: {
     totalBytes: number;
     transferredBytes: number;

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.program = exports.buildWallpaperUploadMetrics = exports.getLegacyFirmwareConnectTimeout = void 0;
+exports.program = exports.buildWallpaperUploadMetrics = exports.prepareSession = exports.getLegacyFirmwareConnectTimeout = void 0;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const commander_1 = require("commander");
@@ -12,30 +12,6 @@ const deviceSelection_1 = require("./deviceSelection");
 const deviceStateCommands_1 = require("./deviceStateCommands");
 const sdk_1 = require("./sdk");
 const session_1 = require("./session");
-function extractPassphraseSession(payload) {
-    if (typeof payload === 'string') {
-        return { passphraseState: payload };
-    }
-    if (!payload || typeof payload !== 'object') {
-        return {};
-    }
-    const statePayload = payload;
-    let passphraseState;
-    if (typeof statePayload.passphrase_state === 'string') {
-        passphraseState = statePayload.passphrase_state;
-    }
-    else if (typeof statePayload.passphraseState === 'string') {
-        passphraseState = statePayload.passphraseState;
-    }
-    let sessionId;
-    if (typeof statePayload.session_id === 'string') {
-        sessionId = statePayload.session_id;
-    }
-    else if (typeof statePayload.sessionId === 'string') {
-        sessionId = statePayload.sessionId;
-    }
-    return { passphraseState, sessionId };
-}
 const program = new commander_1.Command();
 exports.program = program;
 const { version: cliVersion } = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.resolve)(__dirname, '../package.json'), 'utf8'));
@@ -666,48 +642,30 @@ sessionCmd
         process.stderr.write('[onekey-hw] Device is locked. Unlocking (PIN required)...\n');
         await unlockWithRetry(sdk, connectId);
     }
-    // 3. Get passphraseState (triggers 1/2/3 selection)
-    const psResult = await sdk.getPassphraseState(connectId, {
-        initSession: true,
-        useEmptyPassphrase: false,
+    // 3. Open a hidden wallet session (triggers 1/2/3 selection).
+    const sessionResult = await sdk.openWalletSession(connectId, {
+        mode: 'select-hidden',
     });
-    if (!psResult.success) {
-        outputResult(globalOpts, psResult);
+    if (!sessionResult.success) {
+        outputResult(globalOpts, sessionResult);
         return;
     }
-    const { passphraseState, sessionId: passphraseSessionId } = extractPassphraseSession(psResult.payload);
-    if (!passphraseState) {
+    if (sessionResult.payload.walletType !== 'hidden') {
         outputResult(globalOpts, {
             success: false,
-            payload: { error: 'getPassphraseState did not return passphraseState' },
+            payload: { error: 'Hidden wallet selection did not return a hidden wallet session' },
         });
         return;
     }
+    const { deviceId, passphraseState, sessionId } = sessionResult.payload;
     // 4. Get address to verify + extract deviceId
-    const addrResult = await sdk.evmGetAddress(connectId, device.deviceId || '', {
+    const addrResult = await sdk.evmGetAddress(connectId, deviceId, {
         path: "m/44'/60'/0'/0/0",
         showOnOneKey: false,
         passphraseState,
     });
-    // 5. Fetch the now-active session_id via getFeatures.
-    //
-    // IMPORTANT: pass `passphraseState` here. Without it, the SDK's
-    // connectStateChange guard (core/index.ts) would see the payload's
-    // passphraseState flip from mnNy → undefined, clear the cached Device,
-    // and call Initialize again with no passphrase_state / no session_id.
-    // That Initialize resets the device to the standard wallet and returns
-    // a *standard-wallet* session_id — which we'd then save in the keychain
-    // paired with the hidden-wallet passphraseState. On the next CLI run
-    // the mismatch would trigger PassphraseRequest (1/2/3 again).
-    const featResult = await sdk.getFeatures(connectId, {
-        passphraseState,
-        skipPassphraseCheck: true,
-    });
-    const featPayload = featResult?.success ? featResult.payload : undefined;
-    const deviceId = featPayload?.deviceId || device.deviceId || '';
-    const sessionId = passphraseSessionId || featPayload?.sessionId || '';
-    // 6. Save to keychain
-    if (passphraseState && deviceId && sessionId) {
+    // 5. Persist only the session id returned by the explicit wallet-session API.
+    if (sessionId) {
         await (0, session_1.saveSessionToKeychain)(deviceId, passphraseState, sessionId);
     }
     outputResult(globalOpts, {
@@ -804,7 +762,7 @@ async function unlockWithRetry(sdk, connectId, maxAttempts = 3) {
  *
  * 1. If --use-empty-passphrase or --passphrase-state provided → use as-is
  * 2. Try keychain → preloadSessionCache → use cached session
- * 3. Keychain miss → getPassphraseState (triggers 1/2/3 prompt) → save to keychain
+ * 3. Keychain miss → openWalletSession (triggers 1/2/3 prompt) → save to keychain
  *
  * After this, globalOpts.passphraseState is set and getCommonParams will include it.
  */
@@ -816,7 +774,7 @@ globalOpts) {
         return globalOpts.passphraseState;
     }
     // Errors from the SDK calls below (PIN cancelled, transport broken,
-    // getPassphraseState rejection) intentionally propagate to runCommand's
+    // openWalletSession rejection) intentionally propagate to runCommand's
     // catch block, which renders them as structured `{ success: false,
     // payload: { error, code } }` output instead of silently falling through
     // to a confusing downstream error 112 / 114.
@@ -887,38 +845,26 @@ globalOpts) {
             return cached;
         }
     }
-    // ── Step 6: Keychain miss → getPassphraseState (triggers 1/2/3 prompt) ──
-    const psResult = await sdk.getPassphraseState(connectId, {
-        initSession: true,
-        useEmptyPassphrase: false,
+    // ── Step 6: Keychain miss → openWalletSession (triggers 1/2/3 prompt) ──
+    const sessionResult = await sdk.openWalletSession(connectId, {
+        mode: 'select-hidden',
     });
-    if (psResult.success && psResult.payload) {
-        const { passphraseState, sessionId: passphraseSessionId } = extractPassphraseSession(psResult.payload);
-        if (!passphraseState) {
+    if (sessionResult.success && sessionResult.payload) {
+        if (sessionResult.payload.walletType !== 'hidden') {
             return undefined;
         }
+        const { deviceId: sessionDeviceId, passphraseState, sessionId } = sessionResult.payload;
+        globalOpts.deviceId = sessionDeviceId;
         globalOpts.passphraseState = passphraseState;
-        // Save session to keychain for next invocation.
-        //
-        // Pass passphraseState to keep connectStateChange=false — otherwise
-        // Initialize would be re-run without passphrase_state, resetting the
-        // device to the standard wallet and returning a mismatched session_id.
-        // See the matching comment in `session connect`.
-        if (deviceId) {
-            const featAfter = await sdk.getFeatures(connectId, {
-                passphraseState,
-                skipPassphraseCheck: true,
-            });
-            const sessionId = passphraseSessionId || (featAfter?.success ? featAfter.payload?.sessionId : undefined);
-            if (sessionId) {
-                await (0, session_1.saveSessionToKeychain)(deviceId, passphraseState, sessionId);
-                await (0, session_1.preloadSessionFromKeychain)(deviceId);
-            }
+        if (sessionId) {
+            await (0, session_1.saveSessionToKeychain)(sessionDeviceId, passphraseState, sessionId);
+            await (0, session_1.preloadSessionFromKeychain)(sessionDeviceId);
         }
         return passphraseState;
     }
     return undefined;
 }
+exports.prepareSession = prepareSession;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function outputResult(_globalOpts, result) {
     console.log(JSON.stringify(result, null, 2));

package/dist/session.d.ts

@@ -2,7 +2,7 @@
  * Passphrase session management for hd-cli.
  *
  * Aligns with app-monorepo's CLI pattern:
- *   Login:   getPassphraseState → passphraseState + sessionId → keychain
+ *   Login:   openWalletSession → passphraseState + sessionId → keychain
  *   Command: keychain → preloadSessionCache → SDK call (no passphrase prompt)
  *   Stale:   error 112 → clear keychain → re-prompt → retry
  *   Logout:  keychain delete

package/dist/session.js

@@ -3,7 +3,7 @@
  * Passphrase session management for hd-cli.
  *
  * Aligns with app-monorepo's CLI pattern:
- *   Login:   getPassphraseState → passphraseState + sessionId → keychain
+ *   Login:   openWalletSession → passphraseState + sessionId → keychain
  *   Command: keychain → preloadSessionCache → SDK call (no passphrase prompt)
  *   Stale:   error 112 → clear keychain → re-prompt → retry
  *   Logout:  keychain delete

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/hardware-cli",
-  "version": "1.2.0-alpha.25",
+  "version": "1.2.0-alpha.27",
   "description": "OneKey hardware wallet CLI for testing device communication",
   "author": "OneKey",
   "license": "Apache-2.0",
@@ -31,12 +31,12 @@
     "test": "jest"
   },
   "dependencies": {
-    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.25",
-    "@onekeyfe/hd-core": "1.2.0-alpha.25",
-    "@onekeyfe/hd-shared": "1.2.0-alpha.25",
-    "@onekeyfe/hd-transport-usb": "1.2.0-alpha.25",
+    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.27",
+    "@onekeyfe/hd-core": "1.2.0-alpha.27",
+    "@onekeyfe/hd-shared": "1.2.0-alpha.27",
+    "@onekeyfe/hd-transport-usb": "1.2.0-alpha.27",
     "@stoprocent/noble": "2.3.16",
     "commander": "^12.0.0"
   },
-  "gitHead": "20bb98b8530c509299b9e109d2b5ada7c6a6d034"
+  "gitHead": "ea3c188364a6fb968875484805085e4466d3ef99"
 }

package/src/__tests__/wallet-session.test.ts

@@ -0,0 +1,62 @@
+import { prepareSession } from '../cli';
+import { preloadSessionFromKeychain, saveSessionToKeychain } from '../session';
+
+jest.mock('../session', () => ({
+  clearSessionFromKeychain: jest.fn(),
+  preloadSessionFromKeychain: jest.fn(),
+  saveSessionToKeychain: jest.fn(),
+}));
+
+describe('CLI wallet session', () => {
+  test('persists the session returned by openWalletSession without reading it from features', async () => {
+    const sdk = {
+      searchDevices: jest.fn().mockResolvedValue({
+        success: true,
+        payload: [
+          {
+            connectId: 'pro2-connect-id',
+            deviceId: 'device-id',
+            deviceType: 'pro2',
+            features: {
+              deviceId: 'device-id',
+              deviceType: 'pro2',
+              unlocked: true,
+              passphraseProtection: true,
+            },
+          },
+        ],
+      }),
+      getFeatures: jest.fn(),
+      openWalletSession: jest.fn().mockResolvedValue({
+        success: true,
+        payload: {
+          protocol: 'V2',
+          walletType: 'hidden',
+          deviceId: 'device-id',
+          passphraseState: 'wallet-state',
+          sessionId: 'wallet-session-id',
+          resumed: false,
+        },
+      }),
+    };
+    const globalOpts: Record<string, unknown> = {};
+    (preloadSessionFromKeychain as jest.Mock).mockResolvedValueOnce(undefined);
+
+    await expect(prepareSession(sdk as never, globalOpts)).resolves.toBe('wallet-state');
+
+    expect(sdk.openWalletSession).toHaveBeenCalledWith('pro2-connect-id', {
+      mode: 'select-hidden',
+    });
+    expect(sdk.getFeatures).not.toHaveBeenCalled();
+    expect(saveSessionToKeychain).toHaveBeenCalledWith(
+      'device-id',
+      'wallet-state',
+      'wallet-session-id'
+    );
+    expect(globalOpts).toMatchObject({
+      connectId: 'pro2-connect-id',
+      deviceId: 'device-id',
+      passphraseState: 'wallet-state',
+    });
+  });
+});

package/src/cli.ts

@@ -31,41 +31,6 @@ import type {
 /** SearchDevice enriched with features fetched after discovery */
 type EnrichedSearchDevice = SearchDevice & { features?: Features };
 
-function extractPassphraseSession(payload: unknown): {
-  passphraseState?: string;
-  sessionId?: string;
-} {
-  if (typeof payload === 'string') {
-    return { passphraseState: payload };
-  }
-  if (!payload || typeof payload !== 'object') {
-    return {};
-  }
-
-  const statePayload = payload as {
-    passphrase_state?: unknown;
-    passphraseState?: unknown;
-    session_id?: unknown;
-    sessionId?: unknown;
-  };
-
-  let passphraseState: string | undefined;
-  if (typeof statePayload.passphrase_state === 'string') {
-    passphraseState = statePayload.passphrase_state;
-  } else if (typeof statePayload.passphraseState === 'string') {
-    passphraseState = statePayload.passphraseState;
-  }
-
-  let sessionId: string | undefined;
-  if (typeof statePayload.session_id === 'string') {
-    sessionId = statePayload.session_id;
-  } else if (typeof statePayload.sessionId === 'string') {
-    sessionId = statePayload.sessionId;
-  }
-
-  return { passphraseState, sessionId };
-}
-
 const program = new Command();
 const { version: cliVersion } = JSON.parse(
   readFileSync(resolve(__dirname, '../package.json'), 'utf8')
@@ -847,7 +812,7 @@ sessionCmd
         });
         return;
       }
-      const device: EnrichedSearchDevice = searchResult.payload[0];
+      const device = searchResult.payload[0] as SearchDevice & { features?: Features };
       const connectId = device.connectId || globalOpts.connectId;
 
       // 2. Unlock if locked — getPassphraseState below talks to a live
@@ -858,53 +823,32 @@ sessionCmd
         await unlockWithRetry(sdk, connectId);
       }
 
-      // 3. Get passphraseState (triggers 1/2/3 selection)
-      const psResult = await sdk.getPassphraseState(connectId, {
-        initSession: true,
-        useEmptyPassphrase: false,
+      // 3. Open a hidden wallet session (triggers 1/2/3 selection).
+      const sessionResult = await sdk.openWalletSession(connectId, {
+        mode: 'select-hidden',
       });
-      if (!psResult.success) {
-        outputResult(globalOpts, psResult);
+      if (!sessionResult.success) {
+        outputResult(globalOpts, sessionResult);
         return;
       }
-      const { passphraseState, sessionId: passphraseSessionId } = extractPassphraseSession(
-        psResult.payload
-      );
-      if (!passphraseState) {
+      if (sessionResult.payload.walletType !== 'hidden') {
         outputResult(globalOpts, {
           success: false,
-          payload: { error: 'getPassphraseState did not return passphraseState' },
+          payload: { error: 'Hidden wallet selection did not return a hidden wallet session' },
         });
         return;
       }
+      const { deviceId, passphraseState, sessionId } = sessionResult.payload;
 
       // 4. Get address to verify + extract deviceId
-      const addrResult = await sdk.evmGetAddress(connectId, device.deviceId || '', {
+      const addrResult = await sdk.evmGetAddress(connectId, deviceId, {
         path: "m/44'/60'/0'/0/0",
         showOnOneKey: false,
         passphraseState,
       });
 
-      // 5. Fetch the now-active session_id via getFeatures.
-      //
-      // IMPORTANT: pass `passphraseState` here. Without it, the SDK's
-      // connectStateChange guard (core/index.ts) would see the payload's
-      // passphraseState flip from mnNy → undefined, clear the cached Device,
-      // and call Initialize again with no passphrase_state / no session_id.
-      // That Initialize resets the device to the standard wallet and returns
-      // a *standard-wallet* session_id — which we'd then save in the keychain
-      // paired with the hidden-wallet passphraseState. On the next CLI run
-      // the mismatch would trigger PassphraseRequest (1/2/3 again).
-      const featResult = await sdk.getFeatures(connectId, {
-        passphraseState,
-        skipPassphraseCheck: true,
-      });
-      const featPayload = featResult?.success ? featResult.payload : undefined;
-      const deviceId = featPayload?.deviceId || device.deviceId || '';
-      const sessionId = passphraseSessionId || featPayload?.sessionId || '';
-
-      // 6. Save to keychain
-      if (passphraseState && deviceId && sessionId) {
+      // 5. Persist only the session id returned by the explicit wallet-session API.
+      if (sessionId) {
         await saveSessionToKeychain(deviceId, passphraseState, sessionId);
       }
 
@@ -1023,11 +967,11 @@ async function unlockWithRetry(
  *
  * 1. If --use-empty-passphrase or --passphrase-state provided → use as-is
  * 2. Try keychain → preloadSessionCache → use cached session
- * 3. Keychain miss → getPassphraseState (triggers 1/2/3 prompt) → save to keychain
+ * 3. Keychain miss → openWalletSession (triggers 1/2/3 prompt) → save to keychain
  *
  * After this, globalOpts.passphraseState is set and getCommonParams will include it.
  */
-async function prepareSession(
+export async function prepareSession(
   sdk: typeof import('@onekeyfe/hd-common-connect-sdk').default,
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   globalOpts: Record<string, any>
@@ -1038,7 +982,7 @@ async function prepareSession(
   }
 
   // Errors from the SDK calls below (PIN cancelled, transport broken,
-  // getPassphraseState rejection) intentionally propagate to runCommand's
+  // openWalletSession rejection) intentionally propagate to runCommand's
   // catch block, which renders them as structured `{ success: false,
   // payload: { error, code } }` output instead of silently falling through
   // to a confusing downstream error 112 / 114.
@@ -1147,38 +1091,22 @@ async function prepareSession(
     }
   }
 
-  // ── Step 6: Keychain miss → getPassphraseState (triggers 1/2/3 prompt) ──
-  const psResult = await sdk.getPassphraseState(connectId, {
-    initSession: true,
-    useEmptyPassphrase: false,
+  // ── Step 6: Keychain miss → openWalletSession (triggers 1/2/3 prompt) ──
+  const sessionResult = await sdk.openWalletSession(connectId, {
+    mode: 'select-hidden',
   });
 
-  if (psResult.success && psResult.payload) {
-    const { passphraseState, sessionId: passphraseSessionId } = extractPassphraseSession(
-      psResult.payload
-    );
-    if (!passphraseState) {
+  if (sessionResult.success && sessionResult.payload) {
+    if (sessionResult.payload.walletType !== 'hidden') {
       return undefined;
     }
+    const { deviceId: sessionDeviceId, passphraseState, sessionId } = sessionResult.payload;
+    globalOpts.deviceId = sessionDeviceId;
     globalOpts.passphraseState = passphraseState;
 
-    // Save session to keychain for next invocation.
-    //
-    // Pass passphraseState to keep connectStateChange=false — otherwise
-    // Initialize would be re-run without passphrase_state, resetting the
-    // device to the standard wallet and returning a mismatched session_id.
-    // See the matching comment in `session connect`.
-    if (deviceId) {
-      const featAfter = await sdk.getFeatures(connectId, {
-        passphraseState,
-        skipPassphraseCheck: true,
-      });
-      const sessionId =
-        passphraseSessionId || (featAfter?.success ? featAfter.payload?.sessionId : undefined);
-      if (sessionId) {
-        await saveSessionToKeychain(deviceId, passphraseState, sessionId);
-        await preloadSessionFromKeychain(deviceId);
-      }
+    if (sessionId) {
+      await saveSessionToKeychain(sessionDeviceId, passphraseState, sessionId);
+      await preloadSessionFromKeychain(sessionDeviceId);
     }
 
     return passphraseState;

package/src/session.ts

@@ -2,7 +2,7 @@
  * Passphrase session management for hd-cli.
  *
  * Aligns with app-monorepo's CLI pattern:
- *   Login:   getPassphraseState → passphraseState + sessionId → keychain
+ *   Login:   openWalletSession → passphraseState + sessionId → keychain
  *   Command: keychain → preloadSessionCache → SDK call (no passphrase prompt)
  *   Stale:   error 112 → clear keychain → re-prompt → retry
  *   Logout:  keychain delete