Repository navigation
add host passphrase entry and typed device states - #137
Open
benma-agent wants to merge 5 commits into
Open
benma-agent wants to merge 5 commits into
benma-agent wants to merge 5 commits into
Conversation
The sequence counter is incremented after writing each continuation frame. After frame 127 it becomes 128, causing the encoder to reject a valid completed message. This affects payloads of 7,551 to 7,609 bytes. Only report too many frames if there is still payload left to encode.
The encoder casts message lengths to u16 before checking the required buffer size. Lengths above u16::MAX wrap, making that check unreliable; other oversized messages are only rejected later by buffer or frame limits. Reject payloads above the 7,609-byte U2F HID limit before narrowing the length or writing any frames.
U2fHidCommunication::write unconditionally unwraps the framing result. If a message is too large for U2F HID, encoding returns an error and the library panics instead of returning a transport error. Add U2fEncode and propagate encoding failures through ReadWrite::write.
Introduce a PairedBitBox enum with locked, unlocked and uninitialized variants backed by a private session. Expose wallet operations only on UnlockedBitBox, and consume UninitializedBitBox when restoring a wallet. Keep device entry and unlock before pairing on every firmware version. Validate the legacy unlock response to distinguish an unlocked wallet from an uninitialized device. Reserve LockedBitBox::unlock for a later transition; the connection flow cannot return that state yet. Adapt existing examples and simulator helpers to the typed states.
benma
marked this pull request as ready for review
October 13, 2026 10:43
Contributor
|
This is a breaking API change, but this library is on version |
Use paired protobuf unlock on firmware v9.28.0 and later, returning LockedBitBox after pairing and completing the transition through LockedBitBox::unlock. Keep legacy device entry on older firmware. Add PassphraseConfig with asynchronous input and optional availability callbacks. Integrations can offer a host-entry button while device entry is available, or request host entry automatically. Invoke the input callback only after approval on the device. Expire stale request handles and reset the session when unlocking fails. Copy the firmware protobuf definitions and regenerate the Rust bindings. Add a simple automatic CLI example and a Cursive example with a host button.
benma-agent
force-pushed
the
benma-agent/host-passphrase
branch
from
October 13, 2026 10:58
205c76e to
7f503d8
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add configurable host passphrase entry for firmware v9.28.0 and later,
supporting automatic entry or an optional host-entry button. Prompt for the
passphrase only after device approval, and keep legacy unlocking for older
firmware.
Introduce
PairedBitBox::{Locked, Unlocked, Uninitialized}so wallet operationsare only available on
UnlockedBitBox. This changeswait_confirm()to returnthe appropriate state; initialized devices on newer firmware use an explicit
LockedBitBox::unlock()after pairing.Includes copied firmware protobufs, simple CLI and Cursive examples, and
separate U2F fixes for the final continuation frame, payload size checking,
and encoding error propagation.