@onekeyfe/hd-core 1.2.0-alpha.21 → 1.2.0-alpha.23

package/src/device/DeviceCommands.ts

@@ -1,6 +1,7 @@
 import { ERRORS, HardwareError, HardwareErrorCode } from '@onekeyfe/hd-shared';
 import {
   DeviceErrorCode,
+  DeviceSessionErrorCode,
   type FailureType,
   type Messages,
   type Transport,
@@ -8,7 +9,6 @@ import {
 } from '@onekeyfe/hd-transport';
 
 import TransportManager from '../data-manager/TransportManager';
-import DataManager from '../data-manager/DataManager';
 import { LoggerNames, getLogger, patchFeatures } from '../utils';
 import { DEVICE, type PassphraseRequestPayload } from '../events';
 import { DeviceModelToTypes } from '../types';
@@ -38,10 +38,6 @@ type TypedCallResponseMap = {
 };
 export type DefaultMessageResponse = TypedCallResponseMap[MessageKey];
 
-const MAX_DEBUG_ARRAY_ITEMS = 20;
-const MAX_DEBUG_OBJECT_KEYS = 40;
-const MAX_DEBUG_STRING_LENGTH = 512;
-const MAX_DEBUG_DEPTH = 4;
 const HIGH_VOLUME_DEBUG_CALLS = new Set([
   'FilesystemFileRead',
   'FilesystemFileWrite',
@@ -52,106 +48,16 @@ const HIGH_VOLUME_DEBUG_CALLS = new Set([
   'FirmwareUpload',
   'ResourceAck',
 ]);
-const SENSITIVE_DEBUG_CALLS = new Set(['DeviceSessionGet']);
+const DEVICE_SESSION_CALLS = new Set([
+  'DeviceSessionGet',
+  'DeviceSessionAskPin',
+  'DeviceSessionAskPassphrase',
+]);
 
 function shouldReduceDebugForCall(type: string) {
   return HIGH_VOLUME_DEBUG_CALLS.has(type);
 }
 
-function shouldBlockDebugForCall(type: string) {
-  return SENSITIVE_DEBUG_CALLS.has(type);
-}
-
-function getBinaryByteLength(value: unknown): number | undefined {
-  if (value instanceof ArrayBuffer) {
-    return value.byteLength;
-  }
-
-  if (ArrayBuffer.isView(value)) {
-    return value.byteLength;
-  }
-
-  if (typeof Blob !== 'undefined' && value instanceof Blob) {
-    return value.size;
-  }
-
-  return undefined;
-}
-
-function summarizeRedactedData(value: unknown): string {
-  const byteLength = getBinaryByteLength(value);
-  if (byteLength !== undefined) {
-    return `[redacted data: ${byteLength} bytes]`;
-  }
-
-  if (typeof value === 'string') {
-    return `[redacted data: string length=${value.length}]`;
-  }
-
-  if (Array.isArray(value)) {
-    return `[redacted data: array length=${value.length}]`;
-  }
-
-  if (value && typeof value === 'object') {
-    return `[redacted data: object keys=${Object.keys(value).length}]`;
-  }
-
-  return `[redacted data: ${typeof value}]`;
-}
-
-function sanitizeDebugPayload(value: unknown, key = '', depth = 0): unknown {
-  if (key === 'data' && value !== null && value !== undefined) {
-    return summarizeRedactedData(value);
-  }
-
-  // Redact passphrase-bearing keys as defense in depth so wallet identifiers and
-  // host passphrases cannot reach diagnostic logs through a future call path.
-  if (key && /passphrase/i.test(key)) {
-    return '[redacted passphrase]';
-  }
-
-  const byteLength = getBinaryByteLength(value);
-  if (byteLength !== undefined) {
-    return `[binary: ${byteLength} bytes]`;
-  }
-
-  if (typeof value === 'string') {
-    return value.length > MAX_DEBUG_STRING_LENGTH
-      ? `${value.slice(0, MAX_DEBUG_STRING_LENGTH)}... (len=${value.length})`
-      : value;
-  }
-
-  if (!value || typeof value !== 'object') {
-    return value;
-  }
-
-  if (depth >= MAX_DEBUG_DEPTH) {
-    return Array.isArray(value)
-      ? `[array length=${value.length}]`
-      : `[object keys=${Object.keys(value).length}]`;
-  }
-
-  if (Array.isArray(value)) {
-    const items = value
-      .slice(0, MAX_DEBUG_ARRAY_ITEMS)
-      .map(item => sanitizeDebugPayload(item, key, depth + 1));
-    if (value.length > MAX_DEBUG_ARRAY_ITEMS) {
-      items.push(`... (${value.length - MAX_DEBUG_ARRAY_ITEMS} more)`);
-    }
-    return items;
-  }
-
-  const entries = Object.entries(value).slice(0, MAX_DEBUG_OBJECT_KEYS);
-  const sanitized: Record<string, unknown> = {};
-  entries.forEach(([entryKey, entryValue]) => {
-    sanitized[entryKey] = sanitizeDebugPayload(entryValue, entryKey, depth + 1);
-  });
-  if (Object.keys(value).length > MAX_DEBUG_OBJECT_KEYS) {
-    sanitized.__truncated__ = `${Object.keys(value).length - MAX_DEBUG_OBJECT_KEYS} more keys`;
-  }
-  return sanitized;
-}
-
 /**
  * Interactive acknowledgements must not inherit timeoutMs from the original call.
  * User confirmation and PIN/passphrase entry have unbounded think time. Preserve only
@@ -337,20 +243,27 @@ export class DeviceCommands {
     if (this.disposed) {
       return;
     }
-    this.dispose(true);
-    if (this.callPromise) {
-      try {
-        await Promise.all([
-          new Promise((_resolve, reject) =>
-            // eslint-disable-next-line no-promise-executor-return
-            setTimeout(() => reject(new Error('cancel timeout')), 10 * 1000)
-          ),
-          await this.callPromise,
-        ]);
-      } catch {
-        // device error
+    const activeCall = this.callPromise;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const cancellation = (async () => {
+      await this.dispose(true);
+      await activeCall?.catch(() => undefined);
+    })();
+
+    try {
+      await Promise.race([
+        cancellation,
+        new Promise<void>(resolve => {
+          timer = setTimeout(resolve, 10 * 1000);
+        }),
+      ]);
+    } finally {
+      if (timer) clearTimeout(timer);
+      if (this.callPromise === activeCall) {
         this.callPromise = undefined;
       }
+      // The cancellation work may finish after the bounded wait.
+      cancellation.catch(() => undefined);
     }
   }
 
@@ -369,14 +282,15 @@ export class DeviceCommands {
       const promise = this.transport.call(this.mainId, type, msg ?? {}, options) as any;
       this.callPromise = promise;
       const res = await promise;
-      if (res.type === 'Failure') {
-        LogCore.debug('[DeviceCommands] [call] Received', res.type, res.message);
-      } else if (!shouldReduceDebug) {
+      if (!shouldReduceDebug) {
         LogCore.debug('[DeviceCommands] [call] Received', res.type);
       }
       return res;
     } catch (error) {
-      LogCore.debug('[DeviceCommands] [call] Received error', error);
+      LogCore.debug('[DeviceCommands] [call] Received error', {
+        request: type,
+        errorCode: error?.errorCode,
+      });
       if (error.errorCode === HardwareErrorCode.BleDeviceBondError) {
         return {
           type: 'BleDeviceBondError',
@@ -397,9 +311,6 @@ export class DeviceCommands {
         }
       }
 
-      if (responseData) {
-        Log.debug('error response', responseData);
-      }
       if (responseError === 'device disconnected during action') {
         return { type: 'BridgeDeviceDisconnected', message: { error: responseError } } as any;
       }
@@ -444,32 +355,6 @@ export class DeviceCommands {
       );
     }
 
-    // Structured log of actual outgoing payloads (skip acks)
-    try {
-      const skipTypes: MessageKey[] = [
-        'ButtonAck',
-        'PinMatrixAck',
-        'PassphraseAck',
-        'Cancel',
-        'DeviceSessionGet',
-        'BixinPinInputOnDevice',
-        'FilesystemFileRead',
-        'FilesystemFileWrite',
-        'FileRead',
-        'FileWrite',
-        'EmmcFileRead',
-        'EmmcFileWrite',
-        'FirmwareUpload',
-        'ResourceAck',
-      ] as any;
-      if (!skipTypes.includes(type) && !shouldBlockDebugForCall(type) && msg) {
-        // Use debug channel to avoid noise escalation
-        Log.debug('[DeviceCommands] [typedCall] Sending payload', type, sanitizeDebugPayload(msg));
-      }
-    } catch (e) {
-      // ignore logging errors
-    }
-
     const expectedTypes = Array.isArray(resType) ? resType : resType.split('|');
     const response = await this._commonCall(type, msg, {
       ...options,
@@ -487,14 +372,11 @@ export class DeviceCommands {
       // throw bridge network error
       if (error instanceof HardwareError) {
         if (error.errorCode === HardwareErrorCode.ResponseUnexpectTypeError) {
-          if (!shouldBlockDebugForCall(type)) {
-            Log.debug('[DeviceCommands] [typedCall] Unexpected response type', {
-              request: type,
-              expected: resType,
-              received: response.type,
-              response: sanitizeDebugPayload(response.message),
-            });
-          }
+          Log.debug('[DeviceCommands] [typedCall] Unexpected response type', {
+            request: type,
+            expected: resType,
+            received: response.type,
+          });
           // Do not intercept CallMethodError
           // Do not intercept “assertType: Response of unexpected type” error
           // Blocking the above two messages will not know what the specific error message is, and the specific error should be handled by the subsequent business logic.
@@ -533,12 +415,11 @@ export class DeviceCommands {
     options?: TransportCallOptions
   ): Promise<DefaultMessageResponse> {
     try {
-      if (shouldReduceDebugForCall(callType) || shouldBlockDebugForCall(callType)) {
-        // Skip high-volume or security-sensitive response payloads.
-      } else if (DataManager.getSettings('env') === 'react-native') {
-        Log.debug('_filterCommonTypes: ', JSON.stringify(sanitizeDebugPayload(res)));
-      } else {
-        Log.debug('_filterCommonTypes: ', sanitizeDebugPayload(res));
+      if (!shouldReduceDebugForCall(callType)) {
+        Log.debug('_filterCommonTypes: ', {
+          request: callType,
+          response: res.type,
+        });
       }
     } catch (error) {
       // ignore
@@ -599,6 +480,42 @@ export class DeviceCommands {
         const isLegacyProtocolV2LockedFailure =
           this.device.isProtocolV2() && /^device (?:is )?locked$/i.test(normalizedMessage);
         if (
+          DEVICE_SESSION_CALLS.has(callType) &&
+          subcode === DeviceSessionErrorCode.DeviceSessionError_InvalidSession
+        ) {
+          error = ERRORS.TypedError(HardwareErrorCode.WalletSessionInvalid, message, {
+            failureCode: code,
+            subcode,
+            firmwareMessage: message,
+          });
+        } else if (
+          DEVICE_SESSION_CALLS.has(callType) &&
+          subcode === DeviceSessionErrorCode.DeviceSessionError_UserCancelled
+        ) {
+          error = ERRORS.TypedError(HardwareErrorCode.ActionCancelled, message, {
+            failureCode: code,
+            subcode,
+            firmwareMessage: message,
+          });
+        } else if (
+          DEVICE_SESSION_CALLS.has(callType) &&
+          subcode === DeviceSessionErrorCode.DeviceSessionError_AttachPinUnavailable
+        ) {
+          error = ERRORS.TypedError(HardwareErrorCode.DeviceCheckUnlockTypeError, message, {
+            failureCode: code,
+            subcode,
+            firmwareMessage: message,
+          });
+        } else if (
+          DEVICE_SESSION_CALLS.has(callType) &&
+          subcode === DeviceSessionErrorCode.DeviceSessionError_PassphraseDisabled
+        ) {
+          error = ERRORS.TypedError(HardwareErrorCode.DeviceNotOpenedPassphrase, message, {
+            failureCode: code,
+            subcode,
+            firmwareMessage: message,
+          });
+        } else if (
           subcode === DeviceErrorCode.DeviceError_ActionCancelled ||
           isLegacyProtocolV2ActionCancelledFailure
         ) {

package/src/device/DeviceStateMapper.ts

@@ -29,6 +29,23 @@ const definedEntries = <T extends Record<string, unknown>>(value: T): T =>
     Object.entries(value).filter(([, fieldValue]) => fieldValue !== undefined)
   ) as T;
 
+const sanitizeRawFeatures = (features: Features): Features['raw'] => {
+  if (!features.raw) return undefined;
+
+  const raw = { ...features.raw };
+  if (raw.protocolV1Features) {
+    const { session_id: _sessionId, ...protocolV1Features } = raw.protocolV1Features;
+    const compatibilityFields = protocolV1Features as typeof protocolV1Features & {
+      sessionId?: string;
+      passphraseState?: string;
+    };
+    delete compatibilityFields.sessionId;
+    delete compatibilityFields.passphraseState;
+    raw.protocolV1Features = compatibilityFields as PROTO.Features;
+  }
+  return raw;
+};
+
 const imageVersion = (image?: DeviceFirmwareImageInfo | null) => image?.version ?? undefined;
 
 const bytesToHex = (value: unknown): string | undefined => {
@@ -127,7 +144,7 @@ export const mapFeaturesToState = (features: Features): DeviceStatePatch => ({
   },
   capabilities: features.capabilities,
   verification: definedEntries(features.verify ?? {}),
-  raw: features.raw,
+  raw: sanitizeRawFeatures(features),
 });
 
 export const mapProtocolV1FeaturesToState = (

package/src/device/DeviceStateProjector.ts

@@ -16,6 +16,12 @@ export const projectFeatures = (state: StoredDeviceState): Features => {
   delete publicRawFeatures.session_id;
   delete publicRawFeatures.sessionId;
   delete publicRawFeatures.passphraseState;
+  const publicRaw = snapshot.raw
+    ? {
+        ...snapshot.raw,
+        protocolV1Features: publicRawFeatures,
+      }
+    : undefined;
   const rawOneKeyFeatures = snapshot.raw?.protocolV1OneKeyFeatures ?? {};
   const bootloaderMode =
     snapshot.protocol === 'V1'
@@ -84,7 +90,7 @@ export const projectFeatures = (state: StoredDeviceState): Features => {
     se04BootVersion: snapshot.versions.se04Boot,
     seVersion: snapshot.versions.se ?? null,
     verify: snapshot.verification,
-    raw: snapshot.raw,
+    raw: publicRaw,
     device_id: snapshot.identity.deviceId ?? undefined,
     ble_name: snapshot.identity.bleName ?? undefined,
     passphrase_protection: snapshot.status.passphraseProtection ?? undefined,

package/src/events/device.ts

@@ -54,6 +54,7 @@ export interface DeviceButtonRequestPayload extends Omit<PROTO.ButtonRequest, 'c
 
 export type PassphraseRequestPayload = {
   existsAttachPinUser?: boolean;
+  deviceOnly?: boolean;
   source?: 'wallet-session-coordinator';
   reason?: 'open-wallet' | 'session-recovery';
   expectedPassphraseState?: string;

package/src/events/logBlockEvent.ts

@@ -5,15 +5,6 @@ export const LogBlockEvent: Set<string> = new Set([
   UI_RESPONSE.RECEIVE_PASSPHRASE,
 ]);
 
-const LogBlockMethod: Set<string> = new Set([
-  'evmSignTypedData',
-  'openWalletSession',
-  'deviceUploadWallpaper',
-  'uploadPortfolio',
-  'fileWrite',
-  'fileRead',
-]);
-
 export function getLogBlockLabel(message: unknown): string | undefined {
   if (!message || typeof message !== 'object') return undefined;
 
@@ -28,9 +19,5 @@ export function getLogBlockLabel(message: unknown): string | undefined {
   }
 
   const methodName = method ?? payload?.method;
-  if (methodName && LogBlockMethod.has(methodName)) {
-    return methodName;
-  }
-
-  return undefined;
+  return methodName;
 }

package/src/events/ui-request.ts

@@ -107,6 +107,7 @@ export interface UiRequestPassphrase {
     device: Device;
     passphraseState?: string;
     existsAttachPinUser?: boolean;
+    deviceOnly?: boolean;
     source?: 'wallet-session-coordinator';
     reason?: 'open-wallet' | 'session-recovery';
     expectedPassphraseState?: string;

package/src/index.ts

@@ -19,6 +19,11 @@ export * from './types';
 export { whitelist, whitelistExtension } from './data/config';
 export { executeCallback, cleanupCallback };
 export { preloadSessionCache } from './device/Device';
+export {
+  getFirmwareUpdateHostBindingGeneration,
+  registerFirmwareUpdateHostBinding,
+  unregisterFirmwareUpdateHostBinding,
+} from './api/firmware/FirmwareHostBinding';
 
 const HardwareSdk = ({
   init,

package/src/inject.ts

@@ -1,6 +1,17 @@
-import type { Unsuccessful } from './types';
+import { getFirmwareUpdateCapabilities } from './api/firmware/FirmwareUpdateCapabilities';
+import {
+  prepareFirmwareUpdatePlan,
+  validateFirmwareUpdatePreparedPlan,
+} from './api/firmware/FirmwareUpdatePreparedPlan';
+import {
+  getFirmwareUpdateHostBindingGeneration,
+  registerFirmwareUpdateHostBinding,
+  unregisterFirmwareUpdateHostBinding,
+} from './api/firmware/FirmwareHostBinding';
+
 import type { EventEmitter } from 'events';
 import type { CallMethod } from './events';
+import type { Unsuccessful } from './types';
 import type { CoreApi } from './types/api';
 import type { AllNetworkAddress } from './types/api/allNetworkGetAddress';
 
@@ -68,7 +79,10 @@ export const inject = ({
 
     call,
 
-    dispose,
+    dispose: async () => {
+      unregisterFirmwareUpdateHostBinding();
+      await dispose();
+    },
 
     uiResponse,
 
@@ -99,6 +113,12 @@ export const createCoreApi = (
   | 'updateSettings'
   | 'switchTransport'
 > => ({
+  getFirmwareUpdateCapabilities,
+  registerFirmwareUpdateHostBinding,
+  unregisterFirmwareUpdateHostBinding,
+  getFirmwareUpdateHostBindingGeneration,
+  prepareFirmwareUpdatePlan,
+  validateFirmwareUpdatePreparedPlan,
   getLogs: () => call({ method: 'getLogs' }),
   clearSessionCache: params => call({ ...params, method: 'clearSessionCache' }),
   /**
@@ -160,30 +180,7 @@ export const createCoreApi = (
     call({ ...params, connectId, method: 'deviceGetOnboardingStatus' }),
   deviceUploadWallpaper: (connectId, params) =>
     call({ ...params, connectId, method: 'deviceUploadWallpaper' }),
-  deviceInfoGet: (connectId, params) => call({ ...params, connectId, method: 'deviceInfoGet' }),
-  deviceStatusGet: (connectId, params) => call({ ...params, connectId, method: 'deviceStatusGet' }),
-  protocolInfoRequest: (connectId, params) =>
-    call({ ...params, connectId, method: 'protocolInfoRequest' }),
-  ping: (connectId, params) => call({ ...params, connectId, method: 'ping' }),
-  deviceFirmwareUpdate: (connectId, params) =>
-    call({ ...params, connectId, method: 'deviceFirmwareUpdate' }),
-  deviceGetFirmwareUpdateStatus: (connectId, params) =>
-    call({ ...params, connectId, method: 'deviceGetFirmwareUpdateStatus' }),
-  deviceFactoryInfoSet: (connectId, params) =>
-    call({ ...params, connectId, method: 'deviceFactoryInfoSet' }),
-  deviceFactoryInfoGet: (connectId, params) =>
-    call({ ...params, connectId, method: 'deviceFactoryInfoGet' }),
-  filesystemPermissionFix: (connectId, params) =>
-    call({ ...params, connectId, method: 'filesystemPermissionFix' }),
-  filesystemFormat: connectId => call({ connectId, method: 'filesystemFormat' }),
   uploadPortfolio: (connectId, params) => call({ ...params, connectId, method: 'uploadPortfolio' }),
-  fileRead: (connectId, params) => call({ ...params, connectId, method: 'fileRead' }),
-  fileWrite: (connectId, params) => call({ ...params, connectId, method: 'fileWrite' }),
-  fileDelete: (connectId, params) => call({ ...params, connectId, method: 'fileDelete' }),
-  dirList: (connectId, params) => call({ ...params, connectId, method: 'dirList' }),
-  dirMake: (connectId, params) => call({ ...params, connectId, method: 'dirMake' }),
-  dirRemove: (connectId, params) => call({ ...params, connectId, method: 'dirRemove' }),
-  pathInfo: (connectId, params) => call({ ...params, connectId, method: 'pathInfo' }),
   deviceRecovery: (connectId, params) => call({ ...params, connectId, method: 'deviceRecovery' }),
   deviceReset: (connectId, params) => call({ ...params, connectId, method: 'deviceReset' }),
   deviceSettings: (connectId, params) => call({ ...params, connectId, method: 'deviceSettings' }),

package/src/lowLevelInject.ts

@@ -1,4 +1,5 @@
 import { createCoreApi } from './inject';
+import { unregisterFirmwareUpdateHostBinding } from './api/firmware/FirmwareHostBinding';
 
 import type { EventEmitter } from 'events';
 import type { CallMethod, CoreMessage } from './events';
@@ -43,7 +44,10 @@ export const lowLevelInject = ({
 
     call,
 
-    dispose,
+    dispose: async () => {
+      unregisterFirmwareUpdateHostBinding();
+      await dispose();
+    },
 
     uiResponse,
 

package/src/protocols/protocol-v2/settingsUnlockPolicy.ts

@@ -3,7 +3,6 @@ import type { UnlockPolicy } from '../../api/BaseMethod';
 import type { ProtocolV2InteractionDescriptor } from './uiInteraction';
 
 const LOCK_FREE_DEVICE_SETTINGS = new Set<keyof DeviceSettings>([
-  'label',
   'language',
   'brightness',
   'haptic_feedback',
@@ -12,7 +11,7 @@ const LOCK_FREE_DEVICE_SETTINGS = new Set<keyof DeviceSettings>([
 export const getProtocolV2SettingsUnlockPolicy = (settings: DeviceSettings): UnlockPolicy =>
   Object.keys(settings).every(key => LOCK_FREE_DEVICE_SETTINGS.has(key as keyof DeviceSettings))
     ? 'none'
-    : 'retry-on-locked';
+    : 'unlock-before-run';
 
 export type ProtocolV2SettingsOperation =
   | {
@@ -32,7 +31,7 @@ export const getProtocolV2SettingsBehavior = (
 } => {
   if (operation.kind === 'page') {
     return {
-      unlockPolicy: 'retry-on-locked',
+      unlockPolicy: 'unlock-before-run',
       uiInteraction: {
         request: 'button',
         source: 'method-lifecycle',

package/src/protocols/protocol-v2/unlockPolicy.ts

@@ -0,0 +1,105 @@
+export type UnlockPolicy = 'none' | 'unlock-before-run' | 'retry-on-locked';
+
+/**
+ * Protocol V2 methods that are safe to replay after a locked response.
+ *
+ * Keep this as an exact allowlist. Name-pattern matching can silently make a new
+ * state-changing method replayable when it happens to share a suffix.
+ */
+export const PROTOCOL_V2_RETRY_ON_LOCKED_METHODS = [
+  'cipherKeyValue',
+  'allNetworkGetAddress',
+  'allNetworkGetAddressByLoop',
+  'btcGetAddress',
+  'btcGetPublicKey',
+  'btcSignMessage',
+  'btcSignPsbt',
+  'btcSignTransaction',
+  'btcVerifyMessage',
+  'confluxGetAddress',
+  'confluxSignMessage',
+  'confluxSignTransaction',
+  'evmGetAddress',
+  'evmGetPublicKey',
+  'evmSignMessage',
+  'evmSignTransaction',
+  'evmSignTypedData',
+  'evmVerifyMessage',
+  'starcoinGetAddress',
+  'starcoinGetPublicKey',
+  'starcoinSignMessage',
+  'starcoinSignTransaction',
+  'starcoinVerifyMessage',
+  'nemGetAddress',
+  'nemSignTransaction',
+  'solGetAddress',
+  'solSignTransaction',
+  'solSignOffchainMessage',
+  'solSignMessage',
+  'stellarGetAddress',
+  'stellarSignTransaction',
+  'tronGetAddress',
+  'tronSignMessage',
+  'tronSignTransaction',
+  'nearGetAddress',
+  'nearSignTransaction',
+  'aptosGetAddress',
+  'aptosGetPublicKey',
+  'aptosSignTransaction',
+  'aptosSignMessage',
+  'aptosSignInMessage',
+  'algoGetAddress',
+  'algoSignTransaction',
+  'cosmosGetAddress',
+  'cosmosGetPublicKey',
+  'cosmosSignTransaction',
+  'xrpGetAddress',
+  'xrpSignTransaction',
+  'suiGetAddress',
+  'suiGetPublicKey',
+  'suiSignMessage',
+  'suiSignTransaction',
+  'cardanoGetAddress',
+  'cardanoGetPublicKey',
+  'cardanoSignTransaction',
+  'cardanoSignMessage',
+  'filecoinGetAddress',
+  'filecoinSignTransaction',
+  'polkadotGetAddress',
+  'polkadotSignTransaction',
+  'kaspaGetAddress',
+  'kaspaSignTransaction',
+  'nexaGetAddress',
+  'nexaSignTransaction',
+  'nostrGetPublicKey',
+  'nostrSignEvent',
+  'nostrEncryptMessage',
+  'nostrDecryptMessage',
+  'nostrSignSchnorr',
+  'lnurlAuth',
+  'nervosGetAddress',
+  'nervosSignTransaction',
+  'dnxGetAddress',
+  'dnxSignTransaction',
+  'tonGetAddress',
+  'tonSignMessage',
+  'tonSignProof',
+  'tonSignData',
+  'scdoGetAddress',
+  'scdoSignTransaction',
+  'scdoSignMessage',
+  'alephiumGetAddress',
+  'alephiumSignTransaction',
+  'alephiumSignMessage',
+  'benfenGetAddress',
+  'benfenGetPublicKey',
+  'benfenSignMessage',
+  'benfenSignTransaction',
+  'neoGetAddress',
+  'neoSignTransaction',
+] as const;
+
+const retryOnLockedMethods = new Set<string>(PROTOCOL_V2_RETRY_ON_LOCKED_METHODS);
+
+export const getProtocolV2UnlockPolicy = (methodName: string): UnlockPolicy =>
+  retryOnLockedMethods.has(methodName) ? 'retry-on-locked' : 'none';

package/src/protocols/protocol-v2/unlockRetry.ts

@@ -25,9 +25,7 @@ export async function runMethodWithUnlockRetry(
 ) {
   const shouldEmitUi = isProtocolV2UiEnabled(method);
   const shouldUnlockBeforeRun =
-    device.isProtocolV2() &&
-    method.unlockPolicy === 'retry-on-locked' &&
-    device.features?.unlocked === false;
+    device.isProtocolV2() && method.unlockPolicy !== 'none' && device.features?.unlocked === false;
 
   if (shouldUnlockBeforeRun) {
     if (shouldEmitUi) {