@onekeyfe/hd-core 1.2.2-alpha.100 → 1.2.2-alpha.11

package/src/device/Device.ts

@@ -2005,7 +2005,8 @@ export class Device extends EventEmitter {
     passphraseState?: string,
     useEmptyPassphrase?: boolean,
     skipPassphraseCheck?: boolean,
-    deriveCardano?: boolean
+    deriveCardano?: boolean,
+    mainPinSelected?: boolean
   ) {
     if (this.isUnacquired()) return false;
 
@@ -2016,6 +2017,7 @@ export class Device extends EventEmitter {
         onlyMainPin: useEmptyPassphrase,
         deriveCardano,
         rejectAttachPinForMainWallet: useEmptyPassphrase === true,
+        mainPinSelected,
       });
 
     // Main wallet and unlock Attach Pin, throw safe error

package/src/device/DeviceConnector.ts

@@ -96,7 +96,8 @@ export default class DeviceConnector {
     forceCleanRunPromise?: boolean,
     expectedProtocol?: HardwareConnectProtocol,
     protocolHint?: HardwareConnectProtocol,
-    forceProtocolDetection?: boolean
+    forceProtocolDetection?: boolean,
+    skipProtocolProbe?: boolean
   ) {
     Log.debug('acquire', path, session, expectedProtocol, protocolHint);
     const env = DataManager.getSettings('env');
@@ -104,13 +105,15 @@ export default class DeviceConnector {
       const transport = this.getActiveTransport();
       let res;
       if (DataManager.isBleConnect(env)) {
-        res = await transport.acquire({
+        const acquireInput: Parameters<Transport['acquire']>[0] = {
           uuid: path,
           forceCleanRunPromise,
           expectedProtocol,
           protocolHint,
           forceProtocolDetection,
-        });
+          skipProtocolProbe,
+        };
+        res = await transport.acquire(acquireInput);
       } else {
         res = await transport.acquire({
           path,
@@ -118,6 +121,7 @@ export default class DeviceConnector {
           expectedProtocol,
           protocolHint,
           forceProtocolDetection,
+          skipProtocolProbe,
         });
       }
       if (expectedProtocol) {

package/src/events/logBlockEvent.ts

@@ -8,8 +8,9 @@ export const LogBlockEvent: Set<string> = new Set([
   UI_RESPONSE.RECEIVE_PASSPHRASE,
 ]);
 
-const LogLabelMethod: Set<string> = new Set([
-  'openWalletSession',
+// These resource/file APIs did not exist in 1.1.32. Skip the payload so
+// the log layer does not copy huge Base64 or binary data.
+const LogPayloadBlockMethod: Set<string> = new Set([
   'deviceUploadNft',
   'deviceUploadWallpaper',
   'uploadPortfolio',
@@ -17,61 +18,6 @@ const LogLabelMethod: Set<string> = new Set([
   'fileRead',
 ]);
 
-// 资源上传参数可能包含很大的 Base64 字符串。这里按方法整段跳过，避免日志层
-// 递归复制和序列化这些数据；资源 API 与传输内容本身保持不变。
-const LogPayloadBlockMethod: Set<string> = new Set([
-  'deviceUploadNft',
-  'deviceUploadWallpaper',
-  'uploadPortfolio',
-]);
-
-const SensitiveLogKeys: Set<string> = new Set([
-  'devicestate',
-  'entropy',
-  'expectedpassphrasestate',
-  'mnemonic',
-  'passphrase',
-  'passphrasestate',
-  'password',
-  'pin',
-  'privatekey',
-  'seed',
-  'session',
-  'sessionid',
-  'walletsessionid',
-  'xprv',
-]);
-
-const normalizeLogKey = (key: string) => key.replace(/[_-]/g, '').toLowerCase();
-
-const isSigningMethod = (methodName: string) => /sign/i.test(methodName);
-
-const redactLogValue = (value: unknown, seen: WeakSet<object>): unknown => {
-  if (ArrayBuffer.isView(value)) {
-    return `[BINARY:${value.byteLength}]`;
-  }
-  if (value instanceof ArrayBuffer) {
-    return `[BINARY:${value.byteLength}]`;
-  }
-  if (Array.isArray(value)) {
-    return value.map(item => redactLogValue(item, seen));
-  }
-  if (!value || typeof value !== 'object') return value;
-  if (seen.has(value)) return '[CIRCULAR]';
-
-  seen.add(value);
-  const redacted = Object.fromEntries(
-    Object.entries(value as Record<string, unknown>).map(([key, item]) => [
-      key,
-      SensitiveLogKeys.has(normalizeLogKey(key)) && item !== null && item !== undefined
-        ? '[REDACTED]'
-        : redactLogValue(item, seen),
-    ])
-  );
-  seen.delete(value);
-  return redacted;
-};
-
 export function getLogBlockLabel(message: unknown): string | undefined {
   if (!message || typeof message !== 'object') return undefined;
 
@@ -86,7 +32,7 @@ export function getLogBlockLabel(message: unknown): string | undefined {
   }
 
   const methodName = method ?? payload?.method;
-  if (methodName && (LogLabelMethod.has(methodName) || isSigningMethod(methodName))) {
+  if (methodName && LogPayloadBlockMethod.has(methodName)) {
     return methodName;
   }
 
@@ -94,25 +40,10 @@ export function getLogBlockLabel(message: unknown): string | undefined {
 }
 
 export function getSafeLogPayload(value: unknown, blockLabel?: string): unknown {
-  if (
-    blockLabel &&
-    (LogBlockEvent.has(blockLabel) ||
-      LogPayloadBlockMethod.has(blockLabel) ||
-      isSigningMethod(blockLabel))
-  ) {
+  if (blockLabel) {
     return { method: blockLabel, payload: '[REDACTED]' };
   }
-
-  const redactedValue = redactLogValue(value, new WeakSet());
-  if (
-    blockLabel &&
-    redactedValue &&
-    typeof redactedValue === 'object' &&
-    !Array.isArray(redactedValue)
-  ) {
-    return { ...redactedValue, method: blockLabel };
-  }
-  return redactedValue;
+  return value;
 }
 
 export function formatLogMethodLabel(label: string, methodName?: string): string {

package/src/events/ui-request.ts

@@ -189,6 +189,9 @@ export interface FirmwareProgress {
     totalBytes?: number;
     rateBytesPerSecond?: number;
     elapsedMs?: number;
+    installTargetId?: number;
+    installPhase?: 'prepare' | 'install' | 'verify';
+    installPhaseProgress?: number;
   };
 }
 

package/src/protocols/protocol-v2/resources.ts

@@ -59,7 +59,15 @@ export function isProtocolV2ResourceArchiveEntryName(entryName: string): boolean
   return (
     fileName.length > 0 &&
     !fileName.startsWith('.') &&
-    !parts.some(part => part === '__MACOSX' || part === '.' || part === '..' || part === '')
+    !parts.some(
+      part =>
+        !part ||
+        part === '.' ||
+        part === '..' ||
+        part === '.DS_Store' ||
+        part.startsWith('._') ||
+        part.toUpperCase() === '__MACOSX'
+    )
   );
 }
 

package/src/protocols/protocol-v2/unlockPolicyRunner.ts

@@ -14,10 +14,14 @@ const Log = getLogger(LoggerNames.Core);
 
 export type ProtocolV2UnlockContext = {
   preflightCompleted: boolean;
+  preflightStatusRefreshed?: boolean;
+  preflightMainPinSelected?: boolean;
 };
 
 export const createProtocolV2UnlockContext = (): ProtocolV2UnlockContext => ({
   preflightCompleted: false,
+  preflightStatusRefreshed: false,
+  preflightMainPinSelected: false,
 });
 
 type RunnableMethod = Pick<
@@ -100,11 +104,12 @@ export async function runMethodWithUnlockPolicy<T = unknown>(
     await afterStatusBeforeUnlock?.();
 
     if (!status.unlocked) {
+      const preUnlockPinType = resolvePreUnlockPinType(method);
       const unlockInteraction: HardwareUiInteractionMeta | undefined = shouldCoordinateUi
         ? uiCoordinator.enterUnlockInteraction(method.name)
         : undefined;
       const unlockedStatus = await device.unlockDevice(
-        resolvePreUnlockPinType(method),
+        preUnlockPinType,
         shouldCoordinateUi
           ? { emitUiEvent: false, interaction: unlockInteraction }
           : {
@@ -120,9 +125,11 @@ export async function runMethodWithUnlockPolicy<T = unknown>(
           'Protocol V2 device remained locked after the unlock flow.'
         );
       }
+      context.preflightMainPinSelected = preUnlockPinType === DeviceSessionPinType.Main;
       Log.debug('Protocol V2 pre-unlock completed', { method: method.name });
     }
 
+    context.preflightStatusRefreshed = true;
     context.preflightCompleted = true;
   }
 

package/src/protocols/protocol-v2/walletSession.ts

@@ -63,35 +63,50 @@ const negotiateEventlessWalletSession = async (device: Device) => {
 const getDeviceSession = async (device: Device, request: DeviceSessionGet) =>
   device.commands.typedCall('DeviceSessionGet', 'DeviceSession', request);
 
+const STANDARD_SEED_DOMAINS = [DeviceSessionSeedDomain.SeedDomain_Standard];
+const CARDANO_SEED_DOMAINS = [
+  DeviceSessionSeedDomain.SeedDomain_Standard,
+  DeviceSessionSeedDomain.SeedDomain_Cardano,
+];
+
+const buildDeviceSessionSeedDomains = (deriveCardano?: boolean): DeviceSessionSeedDomain[] =>
+  deriveCardano === true ? CARDANO_SEED_DOMAINS : STANDARD_SEED_DOMAINS;
+
+const deviceSessionHasCardano = (message: { seed_domains?: DeviceSessionSeedDomain[] }) =>
+  Array.isArray(message.seed_domains) &&
+  message.seed_domains.includes(DeviceSessionSeedDomain.SeedDomain_Cardano);
+
+// origin/dev Get is read/resume only. Seed generation lives on AskPassphrase.
 const buildDeviceSessionGetRequest = ({
   sessionId,
   expectedPassphraseState,
-  deriveCardano,
 }: {
   sessionId?: string;
   expectedPassphraseState?: string;
-  deriveCardano?: boolean;
 } = {}): DeviceSessionGet => ({
   ...(sessionId ? { session_id: sessionId } : {}),
   ...(expectedPassphraseState ? { btc_test_address: expectedPassphraseState } : {}),
-  seed_domains:
-    deriveCardano === undefined
-      ? []
-      : [
-          DeviceSessionSeedDomain.SeedDomain_Standard,
-          ...(deriveCardano ? [DeviceSessionSeedDomain.SeedDomain_Cardano] : []),
-        ],
 });
 
-const askDevicePassphrase = async (device: Device, requestPayload: DeviceSessionAskPassphrase) => {
-  await device.commands.typedCall('DeviceSessionAskPassphrase', 'Success', requestPayload);
+const askDevicePassphrase = async (
+  device: Device,
+  requestPayload: Omit<DeviceSessionAskPassphrase, 'seed_domains'>,
+  deriveCardano?: boolean,
+  onStatusRefreshed?: () => void
+) => {
+  await device.commands.typedCall('DeviceSessionAskPassphrase', 'Success', {
+    ...requestPayload,
+    seed_domains: buildDeviceSessionSeedDomains(deriveCardano),
+  });
   await refreshProtocolV2DeviceStatus(device);
+  onStatusRefreshed?.();
 };
 
 const selectDeviceSession = async (
   device: Device,
   expectedPassphraseState?: string,
-  deriveCardano?: boolean
+  deriveCardano?: boolean,
+  onStatusRefreshed?: () => void
 ) => {
   const existsAttachPinUser = device.features?.attachToPinEnabled === true;
   const metadata = {
@@ -153,15 +168,36 @@ const selectDeviceSession = async (
       emitUiEvent: false,
       interaction: attachPinInteraction,
     });
-    return getDeviceSession(device, buildDeviceSessionGetRequest({ deriveCardano }));
+    onStatusRefreshed?.();
+    if (deriveCardano === true) {
+      await askDevicePassphrase(
+        device,
+        { passphrase: '', on_device: false },
+        true,
+        onStatusRefreshed
+      );
+      // Firmware AskPassphrase Success clears unlocked_by_attach_to_pin.
+      // Identity is still the Attach PIN wallet; keep the SDK flag so a later
+      // passphrase picker still locks instead of prompting.
+      if (device.features) {
+        device.features.unlockedAttachPin = true;
+      }
+    }
+    const attachPinSession = await getDeviceSession(device, buildDeviceSessionGetRequest());
+    return Object.assign(attachPinSession, { viaAttachPin: true as const });
   }
 
   if (hasHostPassphrase) {
-    await askDevicePassphrase(device, {
-      passphrase: hostPassphrase,
-      on_device: false,
-    });
-    return getDeviceSession(device, buildDeviceSessionGetRequest({ deriveCardano }));
+    await askDevicePassphrase(
+      device,
+      {
+        passphrase: hostPassphrase,
+        on_device: false,
+      },
+      deriveCardano,
+      onStatusRefreshed
+    );
+    return getDeviceSession(device, buildDeviceSessionGetRequest());
   }
 
   const passphraseOnDeviceInteraction = device.createProtocolV2UiPhaseMetadata?.(
@@ -172,8 +208,8 @@ const selectDeviceSession = async (
     ...metadata,
     ...(passphraseOnDeviceInteraction ? { interaction: passphraseOnDeviceInteraction } : {}),
   });
-  await askDevicePassphrase(device, { on_device: true });
-  return getDeviceSession(device, buildDeviceSessionGetRequest({ deriveCardano }));
+  await askDevicePassphrase(device, { on_device: true }, deriveCardano, onStatusRefreshed);
+  return getDeviceSession(device, buildDeviceSessionGetRequest());
 };
 
 export async function getProtocolV2WalletSession(
@@ -191,11 +227,17 @@ export async function getProtocolV2WalletSession(
     deriveCardano?: boolean;
     /** Read the wallet already selected by Attach PIN without reopening wallet selection. */
     readCurrentAttachPinSession?: boolean;
+    /** The current call already selected the Main PIN during its unlock preflight. */
+    mainPinSelected?: boolean;
   }
 ) {
   const forceWalletSelection =
     options?.forceWalletSelection === true || options?.initSession === true;
   const readCurrentAttachPinSession = options?.readCurrentAttachPinSession === true;
+  const sessionIsAttachPinWallet = (session?: unknown) =>
+    readCurrentAttachPinSession ||
+    (session as { viaAttachPin?: boolean } | undefined)?.viaAttachPin === true ||
+    device.features?.unlockedAttachPin === true;
 
   if (forceWalletSelection) {
     if (options.onlyMainPin) {
@@ -227,10 +269,20 @@ export async function getProtocolV2WalletSession(
       : undefined;
   let response;
   let resumed = false;
-  let mainPinSelected =
-    options?.onlyMainPin === true &&
-    device.features?.unlocked === true &&
-    device.features?.unlockedAttachPin === false;
+  let walletStatusRefreshed = false;
+  const markWalletStatusRefreshed = () => {
+    walletStatusRefreshed = true;
+  };
+  if (options?.onlyMainPin && options.mainPinSelected !== true) {
+    await refreshProtocolV2DeviceStatus(device);
+    markWalletStatusRefreshed();
+  }
+  let mainPinAuthenticated =
+    options?.mainPinSelected === true ||
+    (options?.onlyMainPin === true &&
+      device.features?.unlocked === true &&
+      device.features?.unlockedAttachPin === false);
+  let standardWalletSelected = options?.mainPinSelected === true;
 
   const clearCurrentWalletSession = () => {
     if (options?.onlyMainPin) {
@@ -240,8 +292,41 @@ export async function getProtocolV2WalletSession(
     }
   };
 
+  const sessionGetRequest = ({
+    sessionId,
+    expectedPassphraseState: passphraseState,
+  }: {
+    sessionId?: string;
+    expectedPassphraseState?: string;
+  } = {}) =>
+    buildDeviceSessionGetRequest({
+      sessionId,
+      expectedPassphraseState: passphraseState,
+    });
+
+  const askEmptyPassphraseAndGet = async ({
+    deriveCardano,
+    keepAttachPin,
+  }: {
+    deriveCardano?: boolean;
+    keepAttachPin?: boolean;
+  } = {}) => {
+    await askDevicePassphrase(
+      device,
+      { passphrase: '', on_device: false },
+      deriveCardano,
+      markWalletStatusRefreshed
+    );
+    if (keepAttachPin && device.features) {
+      device.features.unlockedAttachPin = true;
+    }
+    const session = await getDeviceSession(device, buildDeviceSessionGetRequest());
+    return keepAttachPin ? Object.assign(session, { viaAttachPin: true as const }) : session;
+  };
+
   const rejectMismatchedAttachPinWallet = async () => {
     const features = await refreshProtocolV2DeviceStatus(device);
+    markWalletStatusRefreshed();
     if (features.unlockedAttachPin !== true) {
       return;
     }
@@ -260,35 +345,63 @@ export async function getProtocolV2WalletSession(
     throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckUnlockTypeError);
   };
 
+  // The passphrase picker would prompt. Empty host AskPassphrase does not;
+  // that path is Attach PIN / standard Cardano. Switching to a different
+  // passphrase wallet still locks first.
+  const lockAttachPinBeforePassphraseSelection = async () => {
+    if (readCurrentAttachPinSession || options?.onlyMainPin) {
+      return;
+    }
+    if (device.features?.unlockedAttachPin !== true) {
+      return;
+    }
+    await rejectMismatchedAttachPinWallet();
+  };
+
   if (options?.onlyMainPin && options.rejectAttachPinForMainWallet) {
     await rejectMismatchedAttachPinWallet();
   }
 
   const selectMainPin = async (force = false) => {
-    if (force || !mainPinSelected) {
+    if (force || !mainPinAuthenticated) {
       await device.unlockDevice(DeviceSessionPinType.Main, {
         source: 'wallet-session-coordinator',
         reason: expectedPassphraseState ? 'session-recovery' : 'open-wallet',
         deviceOnly: true,
       });
-      mainPinSelected = true;
+      markWalletStatusRefreshed();
+      mainPinAuthenticated = true;
+      standardWalletSelected = true;
     }
   };
 
-  const selectStandardWallet = async () => {
-    // Main PIN authenticates the device; an empty host passphrase selects the standard derivation.
-    await selectMainPin();
+  const selectStandardWallet = async (forceMainPin = false) => {
     if (device.features?.passphraseProtection === true) {
-      await askDevicePassphrase(device, {
-        passphrase: '',
-        on_device: false,
-      });
+      // Main PIN authenticates the device; an empty host passphrase selects the standard derivation.
+      await selectMainPin();
+      await askDevicePassphrase(
+        device,
+        {
+          passphrase: '',
+          on_device: false,
+        },
+        options?.deriveCardano,
+        markWalletStatusRefreshed
+      );
+      standardWalletSelected = true;
+    } else if (!standardWalletSelected) {
+      // Without passphrase protection there is no empty-passphrase selector.
+      // An unlocked non-Attach-PIN device is already in the only available wallet context.
+      // Force Main PIN only when recovering from a mismatched cached standard session.
+      await selectMainPin(forceMainPin);
+      standardWalletSelected = true;
     }
   };
 
   if (readCurrentAttachPinSession) {
     const status = await requestProtocolV2DeviceStatus(device);
     device.updateProtocolV2Status(status);
+    markWalletStatusRefreshed();
     if (
       status.unlocked !== true ||
       status.passphrase_enabled !== true ||
@@ -297,10 +410,7 @@ export async function getProtocolV2WalletSession(
       device.clearInternalState();
       throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckUnlockTypeError);
     }
-    response = await getDeviceSession(
-      device,
-      buildDeviceSessionGetRequest({ deriveCardano: options?.deriveCardano })
-    );
+    response = await getDeviceSession(device, sessionGetRequest());
   } else if (options?.onlyMainPin) {
     expectedPassphraseState = cachedStandardSession?.passphraseState;
     if (cachedStandardSession) {
@@ -310,10 +420,9 @@ export async function getProtocolV2WalletSession(
         }
         response = await getDeviceSession(
           device,
-          buildDeviceSessionGetRequest({
+          sessionGetRequest({
             sessionId: cachedStandardSession.sessionId,
             expectedPassphraseState,
-            deriveCardano: options?.deriveCardano,
           })
         );
         resumed = true;
@@ -328,19 +437,15 @@ export async function getProtocolV2WalletSession(
 
     if (!response) {
       await selectStandardWallet();
-      response = await getDeviceSession(
-        device,
-        buildDeviceSessionGetRequest({ deriveCardano: options?.deriveCardano })
-      );
+      response = await getDeviceSession(device, sessionGetRequest());
     }
   } else if (cachedSessionId && expectedPassphraseState) {
     try {
       response = await getDeviceSession(
         device,
-        buildDeviceSessionGetRequest({
+        sessionGetRequest({
           sessionId: cachedSessionId,
           expectedPassphraseState,
-          deriveCardano: options?.deriveCardano,
         })
       );
       resumed = true;
@@ -350,14 +455,18 @@ export async function getProtocolV2WalletSession(
         throw error;
       }
       resumed = false;
+      if (device.features?.unlockedAttachPin === true) {
+        // Locking invalidates the old handle, but Attach PIN already selected the wallet.
+        // Read the current session and validate its passphrase state below.
+        response = await getDeviceSession(device, sessionGetRequest());
+      }
     }
   } else if (expectedPassphraseState) {
     try {
       response = await getDeviceSession(
         device,
-        buildDeviceSessionGetRequest({
+        sessionGetRequest({
           expectedPassphraseState,
-          deriveCardano: options?.deriveCardano,
         })
       );
     } catch (error) {
@@ -372,7 +481,13 @@ export async function getProtocolV2WalletSession(
       device.clearInternalState();
       throw ERRORS.TypedError(HardwareErrorCode.WalletSessionInvalid);
     }
-    response = await selectDeviceSession(device, expectedPassphraseState, options?.deriveCardano);
+    await lockAttachPinBeforePassphraseSelection();
+    response = await selectDeviceSession(
+      device,
+      expectedPassphraseState,
+      options?.deriveCardano,
+      markWalletStatusRefreshed
+    );
   }
 
   let { message } = response;
@@ -395,14 +510,17 @@ export async function getProtocolV2WalletSession(
     }
     if (options?.onlyMainPin) {
       device.clearStandardInternalState?.();
-      await selectStandardWallet();
-      response = await getDeviceSession(
-        device,
-        buildDeviceSessionGetRequest({ deriveCardano: options?.deriveCardano })
-      );
+      await selectStandardWallet(true);
+      response = await getDeviceSession(device, sessionGetRequest());
     } else {
       device.clearInternalState();
-      response = await selectDeviceSession(device, expectedPassphraseState, options?.deriveCardano);
+      await lockAttachPinBeforePassphraseSelection();
+      response = await selectDeviceSession(
+        device,
+        expectedPassphraseState,
+        options?.deriveCardano,
+        markWalletStatusRefreshed
+      );
     }
     message = response.message;
     try {
@@ -422,6 +540,54 @@ export async function getProtocolV2WalletSession(
     }
   }
 
+  // origin/dev generates Cardano on AskPassphrase, not Get. Empty host
+  // passphrase is the Attach PIN / standard-wallet secret. Hidden wallets
+  // still need a real passphrase Ask. Passphrase-off Get auto-requests Cardano.
+  if (options?.deriveCardano === true && !deviceSessionHasCardano(message)) {
+    if (options?.resumeOnly) {
+      device.clearInternalState();
+      throw ERRORS.TypedError(HardwareErrorCode.WalletSessionInvalid);
+    }
+    resumed = false;
+    const previousAddress = message.btc_test_address;
+    if (sessionIsAttachPinWallet(response)) {
+      response = await askEmptyPassphraseAndGet({ deriveCardano: true, keepAttachPin: true });
+    } else if (device.features?.passphraseProtection === false) {
+      response = await getDeviceSession(device, buildDeviceSessionGetRequest());
+    } else if (options?.onlyMainPin) {
+      await selectMainPin();
+      response = await askEmptyPassphraseAndGet({ deriveCardano: true });
+    } else {
+      await lockAttachPinBeforePassphraseSelection();
+      response = await selectDeviceSession(
+        device,
+        expectedPassphraseState,
+        true,
+        markWalletStatusRefreshed
+      );
+    }
+    message = response.message;
+    try {
+      assertCompleteDeviceSession(message);
+    } catch (error) {
+      if (options?.onlyMainPin) {
+        device.clearStandardInternalState?.();
+      } else {
+        device.clearInternalState();
+      }
+      throw error;
+    }
+    if (previousAddress && previousAddress !== message.btc_test_address) {
+      await rejectMismatchedAttachPinWallet();
+      clearCurrentWalletSession();
+      throw ERRORS.TypedError(HardwareErrorCode.DeviceCheckPassphraseStateError);
+    }
+    if (!deviceSessionHasCardano(message)) {
+      clearCurrentWalletSession();
+      throw ERRORS.TypedError(HardwareErrorCode.WalletSessionInvalid);
+    }
+  }
+
   const internalStateArgs = [
     true,
     message.btc_test_address,
@@ -436,9 +602,9 @@ export async function getProtocolV2WalletSession(
   }
 
   let unlockedAttachPin: boolean | undefined;
-  if (readCurrentAttachPinSession) {
+  if (readCurrentAttachPinSession || sessionIsAttachPinWallet(response)) {
     unlockedAttachPin = true;
-  } else if (mainPinSelected) {
+  } else if (mainPinAuthenticated) {
     unlockedAttachPin = false;
   }
 
@@ -447,6 +613,7 @@ export async function getProtocolV2WalletSession(
     newSession: message.session_id,
     unlockedAttachPin,
     resumed,
+    walletStatusRefreshed,
   };
 }