@onekeyfe/hd-core 1.2.0-alpha.22 → 1.2.0-alpha.23

package/src/api/device/DeviceUpdateBootloader.ts

@@ -11,7 +11,11 @@ import { DataManager } from '../../data-manager';
 import { checkBootloaderLength, checkBootloaderSourceLength } from '../firmware/updateBootloader';
 import { openFirmwareByteSource } from '../firmware/FirmwareArtifactSource';
 import { resolveFirmwareUpdateHostBinding } from '../firmware/FirmwareHostBinding';
-import { assertFirmwareUpdatePreparedPlanBinding } from '../firmware/FirmwareUpdatePreparedPlan';
+import {
+  assertFirmwareUpdatePreparedPlanBinding,
+  assertFirmwareUpdatePreparedPlanDeviceIdentity,
+} from '../firmware/FirmwareUpdatePreparedPlan';
+import { getDeviceUUID } from '../../utils';
 
 import type { DeviceUpdateBootloaderParams } from '../../types/api/deviceUpdateBootloader';
 import type { EFirmwareType } from '@onekeyfe/hd-shared';
@@ -160,6 +164,10 @@ export default class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod<any
       artifactReader: hostBinding?.artifactReader ?? payload.artifactReader,
     };
     if (payload.artifact) {
+      assertFirmwareUpdatePreparedPlanDeviceIdentity({
+        preparedPlan: payload.preparedPlan,
+        deviceIdentity: getDeviceUUID(features) || undefined,
+      });
       assertFirmwareUpdatePreparedPlanBinding({
         preparedPlan: payload.preparedPlan,
         executor: 'v2',

package/src/api/device/DeviceWipe.ts

@@ -24,10 +24,12 @@ export default class DeviceWipe extends BaseMethod<WipeDevice> {
       const res = await this.device.commands.typedCall('DeviceSettingsPageShow', 'Success', {
         page: DeviceSettingsPage.DeviceReset,
       });
+      this.device.invalidateAfterWipe();
       return Promise.resolve(res.message);
     }
 
     const res = await this.device.commands.typedCall('WipeDevice', 'Success');
+    this.device.invalidateAfterWipe();
 
     return Promise.resolve(res.message);
   }

package/src/api/firmware/FirmwareArtifactSource.ts

@@ -58,7 +58,7 @@ export const assertFirmwareArtifactReference = (
   return artifact;
 };
 
-export const assertFirmwareArtifactRead = (size: number, offset: number, length: number) => {
+const assertFirmwareArtifactRead = (size: number, offset: number, length: number) => {
   if (
     !Number.isSafeInteger(offset) ||
     offset < 0 ||

package/src/api/firmware/FirmwareUpdatePlan.ts

@@ -149,7 +149,7 @@ export const digestFirmwareUpdateContract = (value: unknown): string =>
     sha256(new TextEncoder().encode(JSON.stringify(canonicalizeFirmwareUpdateContract(value))))
   );
 
-export const digestFirmwareUpdatePlan = (plan: Omit<FirmwareUpdatePlan, 'planDigest'>): string =>
+const digestFirmwareUpdatePlan = (plan: Omit<FirmwareUpdatePlan, 'planDigest'>): string =>
   digestFirmwareUpdateContract(plan);
 
 const planError = (message: string): never => {

package/src/api/firmware/FirmwareUpdatePreparedPlan.ts

@@ -295,7 +295,21 @@ export const validateFirmwareUpdatePreparedPlan = (value: unknown): FirmwareUpda
   return preparedPlan;
 };
 
-export type FirmwareUpdatePreparedBinding = {
+export const assertFirmwareUpdatePreparedPlanDeviceIdentity = ({
+  preparedPlan: value,
+  deviceIdentity,
+}: {
+  preparedPlan: unknown;
+  deviceIdentity: string | undefined;
+}): FirmwareUpdatePreparedPlan => {
+  const preparedPlan = validateFirmwareUpdatePreparedPlan(value);
+  if (!deviceIdentity || preparedPlan.deviceIdentity !== deviceIdentity) {
+    throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckDeviceIdError);
+  }
+  return preparedPlan;
+};
+
+type FirmwareUpdatePreparedBinding = {
   target: FirmwareUpdatePlan['targetsToUpdate'][number];
   artifact: FirmwareArtifactReference;
   logicalName?: string;

package/src/core/index.ts

@@ -1262,6 +1262,7 @@ const onDevicePassphraseHandler = async (
       device: device.toMessageObject() as KnownDevice,
       passphraseState: device.passphraseState,
       existsAttachPinUser: requestPayload.existsAttachPinUser,
+      deviceOnly: requestPayload.deviceOnly,
       source: requestPayload.source,
       reason: requestPayload.reason,
       expectedPassphraseState: requestPayload.expectedPassphraseState,

package/src/data/messages/messages-protocol-v2.json

@@ -482,9 +482,10 @@
         "MessageType_DeviceStatus": 60603,
         "MessageType_DevGetOnboardingStatus": 60604,
         "MessageType_DevOnboardingStatus": 60605,
+        "MessageType_DeviceSessionGet": 60606,
         "MessageType_DeviceSession": 60607,
         "MessageType_DeviceSessionAskPin": 60608,
-        "MessageType_DeviceSessionOpen": 60609,
+        "MessageType_DeviceSessionAskPassphrase": 60609,
         "MessageType_FilesystemPermissionFix": 60800,
         "MessageType_FilesystemPathInfo": 60801,
         "MessageType_FilesystemPathInfoQuery": 60802,
@@ -506,8 +507,7 @@
         [90, 92],
         [114, 122],
         [300, 304],
-        [309, 312],
-        [60606, 60606]
+        [309, 312]
       ]
     },
     "AlephiumGetAddress": {
@@ -12446,81 +12446,42 @@
         "DeviceSessionError_Busy": 5
       }
     },
-    "DeviceSessionResume": {
+    "DeviceSessionGet": {
       "fields": {
         "session_id": {
-          "rule": "required",
           "type": "bytes",
           "id": 1
         }
       }
     },
-    "DeviceSessionHostPassphrase": {
-      "fields": {
-        "passphrase": {
-          "rule": "required",
-          "type": "string",
-          "id": 1
-        }
-      }
-    },
-    "DeviceSessionPassphraseOnDevice": {
-      "fields": {}
-    },
-    "DeviceSessionAttachPinOnDevice": {
-      "fields": {}
-    },
-    "DeviceSessionSelect": {
-      "oneofs": {
-        "access": {
-          "oneof": ["host_passphrase", "passphrase_on_device", "attach_pin_on_device"]
-        }
-      },
+    "DeviceSession": {
       "fields": {
-        "host_passphrase": {
-          "type": "DeviceSessionHostPassphrase",
+        "session_id": {
+          "type": "bytes",
           "id": 1
         },
-        "passphrase_on_device": {
-          "type": "DeviceSessionPassphraseOnDevice",
+        "btc_test_address": {
+          "type": "string",
           "id": 2
-        },
-        "attach_pin_on_device": {
-          "type": "DeviceSessionAttachPinOnDevice",
-          "id": 3
         }
       }
     },
-    "DeviceSessionOpen": {
-      "oneofs": {
-        "mode": {
-          "oneof": ["resume", "select"]
-        }
-      },
-      "fields": {
-        "resume": {
-          "type": "DeviceSessionResume",
-          "id": 1
-        },
-        "select": {
-          "type": "DeviceSessionSelect",
-          "id": 2
-        }
+    "DeviceSessionPinType": {
+      "values": {
+        "Any": 1,
+        "Main": 2,
+        "AttachToPin": 3
       }
     },
-    "DeviceSession": {
+    "DeviceSessionAskPin": {
       "fields": {
-        "session_id": {
-          "type": "bytes",
+        "type": {
+          "type": "DeviceSessionPinType",
           "id": 1
-        },
-        "btc_test_address": {
-          "type": "string",
-          "id": 2
         }
       }
     },
-    "DeviceSessionAskPin": {
+    "DeviceSessionAskPassphrase": {
       "fields": {}
     },
     "DeviceSessionAskPin_FailureSubCodes": {

package/src/device/Device.ts

@@ -1,6 +1,6 @@
 import EventEmitter from 'events';
 import semver from 'semver';
-import { DeviceRebootType, Enum_Capability } from '@onekeyfe/hd-transport';
+import { DeviceRebootType, DeviceSessionPinType, Enum_Capability } from '@onekeyfe/hd-transport';
 import {
   EDeviceType,
   ERRORS,
@@ -322,8 +322,10 @@ export class Device extends EventEmitter {
       deviceId,
       path: this.originalDescriptor?.path,
       bleName,
-      name: bleName || label || `OneKey ${deviceType?.toUpperCase()}`,
-      label: label || 'OneKey',
+      name: label || bleName || `OneKey ${deviceType?.toUpperCase()}`,
+      // Keep the legacy top-level field string-compatible while preserving
+      // the canonical nullable value at state.identity.label.
+      label: label ?? '',
       mode: this.getMode(),
       features,
       state,
@@ -1068,6 +1070,22 @@ export class Device extends EventEmitter {
     this.clearPreInitialized();
   }
 
+  invalidateAfterWipe() {
+    const deviceId = this.getCurrentDeviceId();
+    if (deviceId) {
+      deviceWalletSessionStore.deleteDevice(deviceId);
+    }
+    if (this.isProtocolV2() && this.originalDescriptor.path !== deviceId) {
+      deviceWalletSessionStore.deleteDevice(this.originalDescriptor.path);
+      this.protocolV2StateNeedsReload = true;
+    }
+
+    this.passphraseState = undefined;
+    this.stateStore = new DeviceStateStore();
+    this.clearPreInitialized();
+    this.needReloadDevice = true;
+  }
+
   markProtocolV2Reboot(rebootType: DeviceRebootType) {
     if (!this.isProtocolV2()) return;
 
@@ -1418,12 +1436,17 @@ export class Device extends EventEmitter {
     };
   }
 
-  async unlockDevice() {
+  async unlockDevice(pinType: DeviceSessionPinType = DeviceSessionPinType.Main) {
     if (this.isProtocolV2()) {
       try {
-        await this.commands.typedCall('DeviceSessionAskPin', 'Success', undefined, {
-          timeoutMs: 120_000,
-        });
+        await this.commands.typedCall(
+          'DeviceSessionAskPin',
+          'Success',
+          { type: pinType },
+          {
+            timeoutMs: 120_000,
+          }
+        );
       } catch (error) {
         const errorText =
           error instanceof Error

package/src/device/DeviceCommands.ts

@@ -9,7 +9,6 @@ import {
 } from '@onekeyfe/hd-transport';
 
 import TransportManager from '../data-manager/TransportManager';
-import DataManager from '../data-manager/DataManager';
 import { LoggerNames, getLogger, patchFeatures } from '../utils';
 import { DEVICE, type PassphraseRequestPayload } from '../events';
 import { DeviceModelToTypes } from '../types';
@@ -39,10 +38,6 @@ type TypedCallResponseMap = {
 };
 export type DefaultMessageResponse = TypedCallResponseMap[MessageKey];
 
-const MAX_DEBUG_ARRAY_ITEMS = 20;
-const MAX_DEBUG_OBJECT_KEYS = 40;
-const MAX_DEBUG_STRING_LENGTH = 512;
-const MAX_DEBUG_DEPTH = 4;
 const HIGH_VOLUME_DEBUG_CALLS = new Set([
   'FilesystemFileRead',
   'FilesystemFileWrite',
@@ -53,106 +48,16 @@ const HIGH_VOLUME_DEBUG_CALLS = new Set([
   'FirmwareUpload',
   'ResourceAck',
 ]);
-const SENSITIVE_DEBUG_CALLS = new Set(['DeviceSessionOpen']);
+const DEVICE_SESSION_CALLS = new Set([
+  'DeviceSessionGet',
+  'DeviceSessionAskPin',
+  'DeviceSessionAskPassphrase',
+]);
 
 function shouldReduceDebugForCall(type: string) {
   return HIGH_VOLUME_DEBUG_CALLS.has(type);
 }
 
-function shouldBlockDebugForCall(type: string) {
-  return SENSITIVE_DEBUG_CALLS.has(type);
-}
-
-function getBinaryByteLength(value: unknown): number | undefined {
-  if (value instanceof ArrayBuffer) {
-    return value.byteLength;
-  }
-
-  if (ArrayBuffer.isView(value)) {
-    return value.byteLength;
-  }
-
-  if (typeof Blob !== 'undefined' && value instanceof Blob) {
-    return value.size;
-  }
-
-  return undefined;
-}
-
-function summarizeRedactedData(value: unknown): string {
-  const byteLength = getBinaryByteLength(value);
-  if (byteLength !== undefined) {
-    return `[redacted data: ${byteLength} bytes]`;
-  }
-
-  if (typeof value === 'string') {
-    return `[redacted data: string length=${value.length}]`;
-  }
-
-  if (Array.isArray(value)) {
-    return `[redacted data: array length=${value.length}]`;
-  }
-
-  if (value && typeof value === 'object') {
-    return `[redacted data: object keys=${Object.keys(value).length}]`;
-  }
-
-  return `[redacted data: ${typeof value}]`;
-}
-
-function sanitizeDebugPayload(value: unknown, key = '', depth = 0): unknown {
-  if (key === 'data' && value !== null && value !== undefined) {
-    return summarizeRedactedData(value);
-  }
-
-  // Redact passphrase-bearing keys as defense in depth so wallet identifiers and
-  // host passphrases cannot reach diagnostic logs through a future call path.
-  if (key && /passphrase/i.test(key)) {
-    return '[redacted passphrase]';
-  }
-
-  const byteLength = getBinaryByteLength(value);
-  if (byteLength !== undefined) {
-    return `[binary: ${byteLength} bytes]`;
-  }
-
-  if (typeof value === 'string') {
-    return value.length > MAX_DEBUG_STRING_LENGTH
-      ? `${value.slice(0, MAX_DEBUG_STRING_LENGTH)}... (len=${value.length})`
-      : value;
-  }
-
-  if (!value || typeof value !== 'object') {
-    return value;
-  }
-
-  if (depth >= MAX_DEBUG_DEPTH) {
-    return Array.isArray(value)
-      ? `[array length=${value.length}]`
-      : `[object keys=${Object.keys(value).length}]`;
-  }
-
-  if (Array.isArray(value)) {
-    const items = value
-      .slice(0, MAX_DEBUG_ARRAY_ITEMS)
-      .map(item => sanitizeDebugPayload(item, key, depth + 1));
-    if (value.length > MAX_DEBUG_ARRAY_ITEMS) {
-      items.push(`... (${value.length - MAX_DEBUG_ARRAY_ITEMS} more)`);
-    }
-    return items;
-  }
-
-  const entries = Object.entries(value).slice(0, MAX_DEBUG_OBJECT_KEYS);
-  const sanitized: Record<string, unknown> = {};
-  entries.forEach(([entryKey, entryValue]) => {
-    sanitized[entryKey] = sanitizeDebugPayload(entryValue, entryKey, depth + 1);
-  });
-  if (Object.keys(value).length > MAX_DEBUG_OBJECT_KEYS) {
-    sanitized.__truncated__ = `${Object.keys(value).length - MAX_DEBUG_OBJECT_KEYS} more keys`;
-  }
-  return sanitized;
-}
-
 /**
  * Interactive acknowledgements must not inherit timeoutMs from the original call.
  * User confirmation and PIN/passphrase entry have unbounded think time. Preserve only
@@ -377,14 +282,15 @@ export class DeviceCommands {
       const promise = this.transport.call(this.mainId, type, msg ?? {}, options) as any;
       this.callPromise = promise;
       const res = await promise;
-      if (res.type === 'Failure') {
-        LogCore.debug('[DeviceCommands] [call] Received', res.type, res.message);
-      } else if (!shouldReduceDebug) {
+      if (!shouldReduceDebug) {
         LogCore.debug('[DeviceCommands] [call] Received', res.type);
       }
       return res;
     } catch (error) {
-      LogCore.debug('[DeviceCommands] [call] Received error', error);
+      LogCore.debug('[DeviceCommands] [call] Received error', {
+        request: type,
+        errorCode: error?.errorCode,
+      });
       if (error.errorCode === HardwareErrorCode.BleDeviceBondError) {
         return {
           type: 'BleDeviceBondError',
@@ -405,9 +311,6 @@ export class DeviceCommands {
         }
       }
 
-      if (responseData) {
-        Log.debug('error response', responseData);
-      }
       if (responseError === 'device disconnected during action') {
         return { type: 'BridgeDeviceDisconnected', message: { error: responseError } } as any;
       }
@@ -452,32 +355,6 @@ export class DeviceCommands {
       );
     }
 
-    // Structured log of actual outgoing payloads (skip acks)
-    try {
-      const skipTypes: MessageKey[] = [
-        'ButtonAck',
-        'PinMatrixAck',
-        'PassphraseAck',
-        'Cancel',
-        'DeviceSessionOpen',
-        'BixinPinInputOnDevice',
-        'FilesystemFileRead',
-        'FilesystemFileWrite',
-        'FileRead',
-        'FileWrite',
-        'EmmcFileRead',
-        'EmmcFileWrite',
-        'FirmwareUpload',
-        'ResourceAck',
-      ] as any;
-      if (!skipTypes.includes(type) && !shouldBlockDebugForCall(type) && msg) {
-        // Use debug channel to avoid noise escalation
-        Log.debug('[DeviceCommands] [typedCall] Sending payload', type, sanitizeDebugPayload(msg));
-      }
-    } catch (e) {
-      // ignore logging errors
-    }
-
     const expectedTypes = Array.isArray(resType) ? resType : resType.split('|');
     const response = await this._commonCall(type, msg, {
       ...options,
@@ -495,14 +372,11 @@ export class DeviceCommands {
       // throw bridge network error
       if (error instanceof HardwareError) {
         if (error.errorCode === HardwareErrorCode.ResponseUnexpectTypeError) {
-          if (!shouldBlockDebugForCall(type)) {
-            Log.debug('[DeviceCommands] [typedCall] Unexpected response type', {
-              request: type,
-              expected: resType,
-              received: response.type,
-              response: sanitizeDebugPayload(response.message),
-            });
-          }
+          Log.debug('[DeviceCommands] [typedCall] Unexpected response type', {
+            request: type,
+            expected: resType,
+            received: response.type,
+          });
           // Do not intercept CallMethodError
           // Do not intercept “assertType: Response of unexpected type” error
           // Blocking the above two messages will not know what the specific error message is, and the specific error should be handled by the subsequent business logic.
@@ -541,12 +415,11 @@ export class DeviceCommands {
     options?: TransportCallOptions
   ): Promise<DefaultMessageResponse> {
     try {
-      if (shouldReduceDebugForCall(callType) || shouldBlockDebugForCall(callType)) {
-        // Skip high-volume or security-sensitive response payloads.
-      } else if (DataManager.getSettings('env') === 'react-native') {
-        Log.debug('_filterCommonTypes: ', JSON.stringify(sanitizeDebugPayload(res)));
-      } else {
-        Log.debug('_filterCommonTypes: ', sanitizeDebugPayload(res));
+      if (!shouldReduceDebugForCall(callType)) {
+        Log.debug('_filterCommonTypes: ', {
+          request: callType,
+          response: res.type,
+        });
       }
     } catch (error) {
       // ignore
@@ -607,7 +480,7 @@ export class DeviceCommands {
         const isLegacyProtocolV2LockedFailure =
           this.device.isProtocolV2() && /^device (?:is )?locked$/i.test(normalizedMessage);
         if (
-          callType === 'DeviceSessionOpen' &&
+          DEVICE_SESSION_CALLS.has(callType) &&
           subcode === DeviceSessionErrorCode.DeviceSessionError_InvalidSession
         ) {
           error = ERRORS.TypedError(HardwareErrorCode.WalletSessionInvalid, message, {
@@ -616,7 +489,7 @@ export class DeviceCommands {
             firmwareMessage: message,
           });
         } else if (
-          callType === 'DeviceSessionOpen' &&
+          DEVICE_SESSION_CALLS.has(callType) &&
           subcode === DeviceSessionErrorCode.DeviceSessionError_UserCancelled
         ) {
           error = ERRORS.TypedError(HardwareErrorCode.ActionCancelled, message, {
@@ -625,7 +498,7 @@ export class DeviceCommands {
             firmwareMessage: message,
           });
         } else if (
-          callType === 'DeviceSessionOpen' &&
+          DEVICE_SESSION_CALLS.has(callType) &&
           subcode === DeviceSessionErrorCode.DeviceSessionError_AttachPinUnavailable
         ) {
           error = ERRORS.TypedError(HardwareErrorCode.DeviceCheckUnlockTypeError, message, {
@@ -634,7 +507,7 @@ export class DeviceCommands {
             firmwareMessage: message,
           });
         } else if (
-          callType === 'DeviceSessionOpen' &&
+          DEVICE_SESSION_CALLS.has(callType) &&
           subcode === DeviceSessionErrorCode.DeviceSessionError_PassphraseDisabled
         ) {
           error = ERRORS.TypedError(HardwareErrorCode.DeviceNotOpenedPassphrase, message, {

package/src/events/device.ts

@@ -54,6 +54,7 @@ export interface DeviceButtonRequestPayload extends Omit<PROTO.ButtonRequest, 'c
 
 export type PassphraseRequestPayload = {
   existsAttachPinUser?: boolean;
+  deviceOnly?: boolean;
   source?: 'wallet-session-coordinator';
   reason?: 'open-wallet' | 'session-recovery';
   expectedPassphraseState?: string;

package/src/events/logBlockEvent.ts

@@ -5,16 +5,6 @@ export const LogBlockEvent: Set<string> = new Set([
   UI_RESPONSE.RECEIVE_PASSPHRASE,
 ]);
 
-const LogBlockMethod: Set<string> = new Set([
-  'evmSignTypedData',
-  'openWalletSession',
-  'DeviceSessionOpen',
-  'deviceUploadWallpaper',
-  'uploadPortfolio',
-  'fileWrite',
-  'fileRead',
-]);
-
 export function getLogBlockLabel(message: unknown): string | undefined {
   if (!message || typeof message !== 'object') return undefined;
 
@@ -29,9 +19,5 @@ export function getLogBlockLabel(message: unknown): string | undefined {
   }
 
   const methodName = method ?? payload?.method;
-  if (methodName && LogBlockMethod.has(methodName)) {
-    return methodName;
-  }
-
-  return undefined;
+  return methodName;
 }

package/src/events/ui-request.ts

@@ -107,6 +107,7 @@ export interface UiRequestPassphrase {
     device: Device;
     passphraseState?: string;
     existsAttachPinUser?: boolean;
+    deviceOnly?: boolean;
     source?: 'wallet-session-coordinator';
     reason?: 'open-wallet' | 'session-recovery';
     expectedPassphraseState?: string;

package/src/protocols/protocol-v2/deviceSession.ts

@@ -18,7 +18,7 @@ export function assertCompleteDeviceSession(
   ) {
     throw ERRORS.TypedError(
       HardwareErrorCode.RuntimeError,
-      'DeviceSessionOpen returned an incomplete DeviceSession response.'
+      'DeviceSessionGet returned an incomplete DeviceSession response.'
     );
   }
 }

package/src/protocols/protocol-v2/settingsUnlockPolicy.ts

@@ -3,7 +3,6 @@ import type { UnlockPolicy } from '../../api/BaseMethod';
 import type { ProtocolV2InteractionDescriptor } from './uiInteraction';
 
 const LOCK_FREE_DEVICE_SETTINGS = new Set<keyof DeviceSettings>([
-  'label',
   'language',
   'brightness',
   'haptic_feedback',