@onekeyfe/hd-core 1.2.0-alpha.135 → 1.2.0-alpha.137

package/src/api/device/DeviceVerify.ts

@@ -1,6 +1,5 @@
 import { sha256 } from '@noble/hashes/sha256';
 import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
-import { DeviceSessionPinType } from '@onekeyfe/hd-transport';
 import { bytesToHex } from '@noble/hashes/utils';
 
 import { formatAnyHex } from '../helpers/hexUtils';
@@ -12,15 +11,7 @@ import type { BixinVerifyDeviceRequest } from '@onekeyfe/hd-transport';
 import type { DeviceVerifySignature } from '../../types';
 
 export default class DeviceVerify extends BaseMethod<BixinVerifyDeviceRequest> {
-  getSupportedProtocols() {
-    return ['V1', 'V2'] as const;
-  }
-
   init() {
-    this.unlockPolicy = 'unlock-before-run';
-    // Protocol V2 device-management actions are not wallet-scoped, so either
-    // the main PIN or an Attach PIN may authorize them.
-    this.protocolV2PreUnlockPinType = DeviceSessionPinType.Any;
     this.useDevicePassphraseState = false;
 
     // check payload

package/src/api/device/DeviceWipe.ts

@@ -1,4 +1,4 @@
-import { DeviceSessionPinType, DeviceSettingsPage } from '@onekeyfe/hd-transport';
+import { DeviceSettingsPage } from '@onekeyfe/hd-transport';
 
 import { BaseMethod } from '../BaseMethod';
 
@@ -11,9 +11,6 @@ export default class DeviceWipe extends BaseMethod<WipeDevice> {
 
   init() {
     this.unlockPolicy = 'unlock-before-run';
-    // Protocol V2 device-management actions are not wallet-scoped, so either
-    // the main PIN or an Attach PIN may authorize them.
-    this.protocolV2PreUnlockPinType = DeviceSessionPinType.Any;
     this.useDevicePassphraseState = false;
     this.protocolV2UiInteraction = {
       request: 'button',

package/src/device/Device.ts

@@ -449,7 +449,8 @@ export class Device extends EventEmitter {
           undefined,
           true,
           strictProtocol,
-          undefined
+          undefined,
+          options?.forceProtocolDetection
         );
         this.mainId = (acquireResult as any)?.uuid ?? '';
         Log.debug('Expected uuid:', this.mainId);
@@ -459,7 +460,8 @@ export class Device extends EventEmitter {
           this.originalDescriptor.session,
           undefined,
           strictProtocol,
-          undefined
+          undefined,
+          options?.forceProtocolDetection
         );
         this.mainId = acquireResult as string | undefined;
         Log.debug('Expected session id:', this.mainId);
@@ -930,13 +932,18 @@ export class Device extends EventEmitter {
       };
 
       const expectedDeviceId = options?.deviceId;
-      if (expectedDeviceId) {
-        // 先只读校验物理设备身份；钱包上下文仍由下方携带完整参数的
-        // Initialize 选择，避免标准钱包请求复用此前的隐藏钱包上下文。
+
+      if (expectedDeviceId && !(this.features && this.checkDeviceId(expectedDeviceId))) {
+        // No locally-cached evidence that the device at this path is the
+        // expected one (first contact, or the cached features already disagree
+        // with the caller). Establish identity with a context-free Initialize
+        // BEFORE any wallet context (session_id / passphrase_state) goes on
+        // the wire. In normal flows features are always fresh — enumerate /
+        // getFeatures run first and every call response refreshes them — so
+        // this extra round trip is confined to the ambiguous cases where the
+        // disclosure risk actually lives.
         this.passphraseState = undefined;
-        const { message } = await this.commands.typedCall('GetFeatures', 'Features', {});
-        this._updateFeatures(message);
-        await TransportManager.reconfigure(this.features);
+        await callInitialize({ is_contains_attach: true });
         if (!this.checkDeviceId(expectedDeviceId)) {
           throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckDeviceIdError);
         }
@@ -960,7 +967,46 @@ export class Device extends EventEmitter {
         payload.derive_cardano = true;
       }
 
-      await callInitialize(payload, options?.initSession);
+      if (this.features) {
+        // Re-sync the V1 message schema for THIS device before encoding
+        // Initialize: the process-global schema may still reflect another
+        // device (e.g. legacy-firmware Touch/Mini) on multi-device setups, and
+        // a stale legacy schema would silently strip passphrase_state /
+        // is_contains_attach from the wire message. Local operation, no wire
+        // I/O; a no-op when the schema is unchanged.
+        await TransportManager.reconfigure(this.features);
+      }
+
+      // Initialize's own Features response carries device_id, so the physical
+      // device identity is validated on the same round trip instead of via a
+      // separate read-only GetFeatures preflight (which doubled the wire cost
+      // of every deviceId-carrying call). The method fn has not run yet, so a
+      // mismatch still fails before any wallet data can be derived, with the
+      // same DeviceCheckDeviceIdError. Wallet-context selection is unchanged:
+      // it is decided by the Initialize payload above either way.
+      const assertExpectedDeviceIdentity = () => {
+        if (expectedDeviceId && !this.checkDeviceId(expectedDeviceId)) {
+          // The mismatched Initialize may have cached a session under the wrong
+          // device's identity; drop it so no wallet context survives from it.
+          // (This also evicts any session the wrong device legitimately cached
+          // under the same passphraseState — a deliberate conservative purge
+          // after a physical-swap event, consistent with
+          // reconcileDeviceIdentity purging the previous device's sessions.)
+          this.clearInternalState();
+          throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckDeviceIdError);
+        }
+      };
+
+      try {
+        await callInitialize(payload, options?.initSession);
+      } catch (error) {
+        // callInitialize can fail AFTER the wire call cached the session (e.g.
+        // TransportManager.reconfigure rejecting); the identity check must
+        // still run so a wrong-device session never survives the error path.
+        assertExpectedDeviceIdentity();
+        throw error;
+      }
+      assertExpectedDeviceIdentity();
     } catch (error) {
       Log.error('Initialization failed:', error);
       throw error;
@@ -1530,18 +1576,15 @@ export class Device extends EventEmitter {
     const error = ERRORS.TypedError(HardwareErrorCode.DeviceInterruptedFromUser);
     const cleanupPromise = this.runCleanupPromise;
     const { cancelableAction } = this;
-    const env = DataManager.getSettings('env');
     if (cancelableAction) {
       await cancelableAction(error);
     } else if (
       this.isProtocolV2() &&
-      (DataManager.isBleConnect(env) ||
-        DataManager.isBrowserWebUsb(env) ||
-        DataManager.isDesktopWebUsb(env)) &&
+      DataManager.isBleConnect(DataManager.getSettings('env')) &&
       this.hasDeviceAcquire()
     ) {
       await this.commands?.cancelDevice?.().catch(cancelError => {
-        Log.debug('Protocol V2 fallback cancel error', cancelError);
+        Log.debug('Protocol V2 BLE fallback cancel error', cancelError);
       });
     }
     await this.commands?.cancel();

package/src/device/DeviceCommands.ts

@@ -69,7 +69,7 @@ const DEVICE_CONTROL_CALLS = new Set([
 // Older Protocol V2 firmware may omit the cancellation subcode, so retain a
 // narrow message fallback for compatibility.
 const isProtocolV2ActionCancelledMessage = (message: string) =>
-  /^(?:cancel(?:led|ed)(?: on device)?|confirm dismissed|update cancel(?:led|ed)|user cancel(?:led|ed)(?:\s+.*)?)$/i.test(
+  /^(?:cancel(?:led|ed)(?: on device)?|confirm dismissed|user cancel(?:led|ed)(?:\s+.*)?)$/i.test(
     message
   );
 

package/src/device/DeviceConnector.ts

@@ -95,7 +95,8 @@ export default class DeviceConnector {
     session?: string | null,
     forceCleanRunPromise?: boolean,
     expectedProtocol?: HardwareConnectProtocol,
-    protocolHint?: HardwareConnectProtocol
+    protocolHint?: HardwareConnectProtocol,
+    forceProtocolDetection?: boolean
   ) {
     Log.debug('acquire', path, session, expectedProtocol, protocolHint);
     const env = DataManager.getSettings('env');
@@ -108,6 +109,7 @@ export default class DeviceConnector {
           forceCleanRunPromise,
           expectedProtocol,
           protocolHint,
+          forceProtocolDetection,
         });
       } else {
         res = await transport.acquire({
@@ -115,6 +117,7 @@ export default class DeviceConnector {
           previous: session ?? null,
           expectedProtocol,
           protocolHint,
+          forceProtocolDetection,
         });
       }
       if (expectedProtocol) {