fix: load Protocol V2 resource archives

apps/cli/package.json

@@ -44,9 +44,9 @@
   },
   "dependencies": {
     "@napi-rs/keyring": "^1.3.0",
-    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.77",
-    "@onekeyfe/hd-core": "1.2.0-alpha.77",
-    "@onekeyfe/hd-transport-usb": "1.2.0-alpha.77",
+    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.99",
+    "@onekeyfe/hd-core": "1.2.0-alpha.99",
+    "@onekeyfe/hd-transport-usb": "1.2.0-alpha.99",
     "proper-lockfile": "^4.1.2"
   }
 }

apps/desktop/package.json

@@ -9,7 +9,7 @@
     "clean": "rimraf ./build-electron && rimraf .tamagui && rimraf ./app/build && rimraf ./app/dist && rimraf __generated__",
     "clean:build": "rimraf ./build-electron && rimraf ./app/build && rimraf ./app/dist && rimraf ./node_modules/.cache",
     "start": "cross-env NODE_OPTIONS=\"--max-old-space-size=8192\" yarn dev",
-    "start:rspack": "cross-env NODE_OPTIONS=\"--max-old-space-size=8192\" yarn dev:rspack",
+    "start:rspack": "cross-env NODE_OPTIONS=\"--max-old-space-size=16384\" yarn dev:rspack",
     "install-app-deps": "electron-builder install-app-deps && node scripts/apply-runtime-patches.js && node scripts/verify-runtime-patches.js",
     "dev": "npx concurrently \"yarn build:main:dev\" \"yarn dev:renderer\" \"cross-env LAUNCH_ELECTRON=true node scripts/dev.js\"",
     "dev:rspack": "npx concurrently \"yarn build:main:dev\" \"yarn dev:renderer:rspack\" \"cross-env LAUNCH_ELECTRON=true node scripts/dev.js\"",

apps/web-embed/postbuild.sh

@@ -21,4 +21,3 @@ echo "Syncing web-build to iOS assets..."
 rsync -r -c -v ./web-build/ ../mobile/ios/OneKeyWallet/web-embed/
 
 echo "Postbuild completed successfully."
-

package.json

@@ -158,21 +158,21 @@
     "@onekeyfe/cross-inpage-provider-injected": "2.2.73",
     "@onekeyfe/cross-inpage-provider-types": "2.2.73",
     "@onekeyfe/extension-bridge-hosted": "2.2.73",
-    "@onekeyfe/hd-ble-sdk": "1.2.0-alpha.77",
-    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.77",
-    "@onekeyfe/hd-core": "1.2.0-alpha.77",
-    "@onekeyfe/hd-shared": "1.2.0-alpha.77",
-    "@onekeyfe/hd-transport": "1.2.0-alpha.77",
-    "@onekeyfe/hd-transport-electron": "1.2.0-alpha.77",
-    "@onekeyfe/hd-web-sdk": "1.2.0-alpha.77",
-    "@onekeyfe/hwk-adapter-core": "1.2.0-alpha.77",
-    "@onekeyfe/hwk-ledger-adapter": "1.2.0-alpha.77",
-    "@onekeyfe/hwk-ledger-connector-ble": "1.2.0-alpha.77",
-    "@onekeyfe/hwk-ledger-connector-webhid": "1.2.0-alpha.77",
-    "@onekeyfe/hwk-trezor-adapter": "1.2.0-alpha.77",
-    "@onekeyfe/hwk-trezor-connector-electron-ble": "1.2.0-alpha.77",
-    "@onekeyfe/hwk-trezor-connector-rn-ble": "1.2.0-alpha.77",
-    "@onekeyfe/hwk-trezor-connector-webusb": "1.2.0-alpha.77",
+    "@onekeyfe/hd-ble-sdk": "1.2.0-alpha.99",
+    "@onekeyfe/hd-common-connect-sdk": "1.2.0-alpha.99",
+    "@onekeyfe/hd-core": "1.2.0-alpha.99",
+    "@onekeyfe/hd-shared": "1.2.0-alpha.99",
+    "@onekeyfe/hd-transport": "1.2.0-alpha.99",
+    "@onekeyfe/hd-transport-electron": "1.2.0-alpha.99",
+    "@onekeyfe/hd-web-sdk": "1.2.0-alpha.99",
+    "@onekeyfe/hwk-adapter-core": "1.2.0-alpha.99",
+    "@onekeyfe/hwk-ledger-adapter": "1.2.0-alpha.99",
+    "@onekeyfe/hwk-ledger-connector-ble": "1.2.0-alpha.99",
+    "@onekeyfe/hwk-ledger-connector-webhid": "1.2.0-alpha.99",
+    "@onekeyfe/hwk-trezor-adapter": "1.2.0-alpha.99",
+    "@onekeyfe/hwk-trezor-connector-electron-ble": "1.2.0-alpha.99",
+    "@onekeyfe/hwk-trezor-connector-rn-ble": "1.2.0-alpha.99",
+    "@onekeyfe/hwk-trezor-connector-webusb": "1.2.0-alpha.99",
     "@onekeyfe/onekey-cross-webview": "2.2.73",
     "@polkadot/extension-inject": "0.54.1",
     "@polkadot/types": "14.3.1",
@@ -416,11 +416,11 @@
     "@reown/appkit-ethers5-react-native": "https://github.com/OneKeyHQ/app-modules#9d96daccc13625e5b3c8b236f9357956b049b884",
     "@reown/appkit-scaffold-react-native": "https://github.com/OneKeyHQ/app-modules#ef39e1c6682f8b50dc019a851f6e2211392d353a",
     "@reown/appkit-scaffold-utils-react-native": "https://github.com/OneKeyHQ/app-modules#aa31ef69e5058bb822c40f0a706ee9bdd191b005",
-    "@onekeyfe/hd-core": "1.2.0-alpha.77",
-    "@onekeyfe/hd-shared": "1.2.0-alpha.77",
-    "@onekeyfe/hd-transport": "1.2.0-alpha.77",
-    "@onekeyfe/hd-transport-http": "1.2.0-alpha.77",
-    "@onekeyfe/hd-transport-web-device": "1.2.0-alpha.77",
+    "@onekeyfe/hd-core": "1.2.0-alpha.99",
+    "@onekeyfe/hd-shared": "1.2.0-alpha.99",
+    "@onekeyfe/hd-transport": "1.2.0-alpha.99",
+    "@onekeyfe/hd-transport-http": "1.2.0-alpha.99",
+    "@onekeyfe/hd-transport-web-device": "1.2.0-alpha.99",
     "promise": "^8.3.0",
     "metro": "0.83.2",
     "metro-babel-transformer": "0.83.2",

packages/kit-bg/src/desktopApis/DesktopApiFirmwareArtifact.test.ts

@@ -27,13 +27,18 @@ describe('DesktopApiFirmwareArtifact URL admission', () => {
         new URL('https://web.onekey-asset.com/firmware.bin'),
       ),
     ).toBe(true);
+    expect(
+      isFirmwareArtifactUrlAllowed(
+        new URL('https://common.onekey-asset.com/firmware.bin'),
+      ),
+    ).toBe(true);
     expect(
       isFirmwareArtifactUrlAllowed(
         new URL(
-          'https://pub-d5c080673b4e4e9dae7e03680340378d.r2.dev/firmware.bin',
+          'https://pub-568cac7a13bf4c42b7a8113ffffc6793.r2.dev/firmware.bin',
         ),
       ),
-    ).toBe(true);
+    ).toBe(false);
     expect(
       isFirmwareArtifactUrlAllowed(
         new URL('https://web.onekey-asset.com.evil.test/firmware.bin'),
@@ -46,6 +51,90 @@ describe('DesktopApiFirmwareArtifact URL admission', () => {
     ).toBe(false);
   });
 
+  it('skips hostname pinning only for pre-release downloads', () => {
+    const allow = { allowPreReleaseHosts: true };
+    expect(
+      isFirmwareArtifactUrlAllowed(
+        new URL(
+          'https://pub-568cac7a13bf4c42b7a8113ffffc6793.r2.dev/firmware.bin',
+        ),
+        allow,
+      ),
+    ).toBe(true);
+    expect(
+      isFirmwareArtifactUrlAllowed(
+        new URL('https://leonbucket.blob.core.windows.net/pro2/resource.zip'),
+        allow,
+      ),
+    ).toBe(true);
+    expect(
+      isFirmwareArtifactUrlAllowed(
+        new URL('https://web.onekey-asset.com/firmware.bin'),
+        allow,
+      ),
+    ).toBe(true);
+    expect(
+      isFirmwareArtifactUrlAllowed(
+        new URL(
+          'https://pub-568cac7a13bf4c42b7a8113ffffc6793.r2.dev/firmware.bin',
+        ),
+        { allowPreReleaseHosts: false },
+      ),
+    ).toBe(false);
+    // Structural checks still apply while hostname pinning is skipped.
+    expect(
+      isFirmwareArtifactUrlAllowed(
+        new URL('http://leonbucket.blob.core.windows.net/resource.zip'),
+        allow,
+      ),
+    ).toBe(false);
+    expect(
+      isFirmwareArtifactUrlAllowed(
+        new URL('https://leonbucket.blob.core.windows.net:8443/resource.zip'),
+        allow,
+      ),
+    ).toBe(false);
+    expect(
+      isFirmwareArtifactUrlAllowed(
+        new URL('https://user:pass@leonbucket.blob.core.windows.net/res.zip'),
+        allow,
+      ),
+    ).toBe(false);
+    expect(
+      isFirmwareArtifactUrlAllowed(
+        new URL('https://leonbucket.blob.core.windows.net/res.zip#fragment'),
+        allow,
+      ),
+    ).toBe(false);
+  });
+
+  it('opens the pre-release admission only for the literal boolean true', () => {
+    // The flag crosses an IPC boundary, so it may arrive as any JSON value.
+    // Only `true` may widen the allowlist: a truthy coercion here would let a
+    // malformed or hostile payload skip hostname pinning.
+    const devUrl = new URL('https://leonbucket.blob.core.windows.net/res.zip');
+    for (const value of [
+      undefined,
+      null,
+      false,
+      0,
+      1,
+      'true',
+      'false',
+      {},
+      [],
+    ]) {
+      expect(
+        isFirmwareArtifactUrlAllowed(devUrl, {
+          allowPreReleaseHosts: value as never,
+        }),
+      ).toBe(false);
+    }
+    expect(
+      isFirmwareArtifactUrlAllowed(devUrl, { allowPreReleaseHosts: true }),
+    ).toBe(true);
+  });
+
   it('probes its root and keeps the minimum lease lifecycle in memory', async () => {
     const adapter = new DesktopApiFirmwareArtifact({
       desktopApi: {} as never,
@@ -63,6 +152,54 @@ describe('DesktopApiFirmwareArtifact URL admission', () => {
     });
   });
 
+  it('enforces host admission at the download entry point, not just the predicate', async () => {
+    const adapter = new DesktopApiFirmwareArtifact({
+      desktopApi: {} as never,
+    });
+    const transactionId = 'fwtx:00000000-0000-4000-8000-000000000009';
+    const lease = await adapter.createLease(transactionId);
+    const input = {
+      taskId: 'resource',
+      transactionId,
+      leaseRef: lease.leaseRef,
+      artifactId: 'resource',
+      url: 'https://leonbucket.blob.core.windows.net/pro2/resource.zip',
+      route: { routeType: 'domain' } as const,
+      expectedSize: 1,
+      expectedSha256: 'a'.repeat(64),
+      maxBytes: 1,
+      overallDeadlineSeconds: 1,
+    };
+
+    await expect(adapter.download(input)).rejects.toThrow(
+      'ARTIFACT_INVALID_INPUT',
+    );
+    // A non-boolean value must not coerce its way past hostname pinning.
+    await expect(
+      adapter.download({
+        ...input,
+        allowPreReleaseHosts: 'true' as never,
+      }),
+    ).rejects.toThrow('ARTIFACT_INVALID_INPUT');
+    // Skipping hostname pinning requires pinned content.
+    await expect(
+      adapter.download({
+        ...input,
+        expectedSha256: undefined,
+        allowPreReleaseHosts: true,
+      }),
+    ).rejects.toThrow('ARTIFACT_INVALID_INPUT');
+    // Admitted: dev flag plus a pinned SHA-256 reaches the network stage.
+    await expect(
+      adapter.download({ ...input, allowPreReleaseHosts: true }),
+    ).rejects.toThrow('ARTIFACT_NETWORK_FAILED');
+
+    await adapter.releaseLease({
+      leaseRef: lease.leaseRef,
+      disposition: 'safeCancelled',
+    });
+  });
+
   it('rejects cancelled transactions until their lease is released', async () => {
     const adapter = new DesktopApiFirmwareArtifact({
       desktopApi: {} as never,

packages/kit-bg/src/desktopApis/DesktopApiFirmwareArtifact.ts

@@ -50,7 +50,6 @@ const FINAL_ARTIFACT_GRACE_MS = 24 * 60 * 60 * 1000;
 const PARTIAL_ARTIFACT_GRACE_MS = 7 * 24 * 60 * 60 * 1000;
 const FIRMWARE_ARTIFACT_HOSTNAMES = new Set([
   'common.onekey-asset.com',
-  'pub-d5c080673b4e4e9dae7e03680340378d.r2.dev',
   'web.onekey-asset.com',
 ]);
 
@@ -91,13 +90,23 @@ const assertSafeInteger = (value: number, label: string): void => {
   }
 };
 
-export const isFirmwareArtifactUrlAllowed = (url: URL): boolean =>
+// allowPreReleaseHosts is only sent by bg while developer mode +
+// "Use pre-release config" are on: pre-release artifacts live in
+// developer-owned buckets whose hostnames cannot be pinned in advance. The
+// structural checks below still apply, and validateDownloadInput additionally
+// requires a pinned SHA-256 for these downloads, so every admitted artifact is
+// covered by a reviewed hostname or by pinned content.
+export const isFirmwareArtifactUrlAllowed = (
+  url: URL,
+  options?: { allowPreReleaseHosts?: boolean },
+): boolean =>
   url.protocol === 'https:' &&
   url.port === '' &&
   !url.username &&
   !url.password &&
   !url.hash &&
-  FIRMWARE_ARTIFACT_HOSTNAMES.has(url.hostname.toLowerCase());
+  (options?.allowPreReleaseHosts === true ||
+    FIRMWARE_ARTIFACT_HOSTNAMES.has(url.hostname.toLowerCase()));
 
 const validatePortableEntryName = (
   name: string,
@@ -487,7 +496,16 @@ class DesktopApiFirmwareArtifact implements IFirmwareArtifactAdapter {
 
   private validateDownloadInput(input: IDownloadInput): void {
     const url = new URL(input.url);
-    if (!isFirmwareArtifactUrlAllowed(url)) {
+    const allowPreReleaseHosts = input.allowPreReleaseHosts === true;
+    // Dropping hostname pinning is only acceptable against pinned content, so
+    // a pre-release artifact without a pinned digest must never be admitted.
+    if (allowPreReleaseHosts && input.expectedSha256 === undefined) {
+      throw new FirmwareArtifactDesktopError(
+        'ARTIFACT_INVALID_INPUT',
+        'Pre-release firmware artifacts require a pinned SHA-256',
+      );
+    }
+    if (!isFirmwareArtifactUrlAllowed(url, { allowPreReleaseHosts })) {
       throw new FirmwareArtifactDesktopError(
         'ARTIFACT_INVALID_INPUT',
         'Firmware URL is outside the reviewed artifact host allowlist',

packages/kit-bg/src/services/ServiceDevSetting.ts

@@ -24,6 +24,7 @@ import {
   devSettingsPersistAtom,
   firmwareUpdateDevSettingsPersistAtom,
   getDevSettingsNetworkThrottleEnabled,
+  getGatedFirmwareUpdateDevSetting,
 } from '../states/jotai/atoms/devSettings';
 
 import ServiceBase from './ServiceBase';
@@ -308,12 +309,7 @@ class ServiceDevSetting extends ServiceBase {
   public async getFirmwareUpdateDevSettings<
     T extends IFirmwareUpdateDevSettingsKeys,
   >(key: T): Promise<IFirmwareUpdateDevSettings[T] | undefined> {
-    const dev = await devSettingsPersistAtom.get();
-    if (!dev.enabled) {
-      return undefined;
-    }
-    const fwDev = await firmwareUpdateDevSettingsPersistAtom.get();
-    return fwDev[key];
+    return getGatedFirmwareUpdateDevSetting(key);
   }
 
   @backgroundMethod()

packages/kit-bg/src/services/ServiceFirmwareUpdate/FirmwareArtifactAdapter.types.ts

@@ -48,6 +48,9 @@ export interface IFirmwareArtifactAdapter {
     expectedSha256?: string;
     maxBytes: number;
     overallDeadlineSeconds: number;
+    // Set by bg only while developer mode + "Use pre-release config" are on;
+    // pre-release artifact hosts (developer buckets) are not pinned in advance.
+    allowPreReleaseHosts?: boolean;
   }): Promise<IFirmwareArtifactReceipt>;
   cancelDownloads(transactionId: string): Promise<void>;
   materialize(input: {