feat: add trezor pin entry and hidden wallets#973
Conversation
Adds on-screen Trezor PIN entry and passphrase (hidden wallet) selection, built on the typed TrezorUiCallback from bitkit-core 0.1.62. - Passphrase: WalletModeChooserDialog PassphraseDialog let the user open the standard wallet or a hidden wallet, entering the passphrase on the phone (host) or on the Trezor. Modeled as TrezorWalletMode (STANDARD / PASSPHRASE_HOST / PASSPHRASE_DEVICE). Bumps bitkit-core 0.1.58 -> 0.1.62.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fe9ab311c2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| ) | ||
| VerticalSpacer(12.dp) | ||
| PinMatrix( | ||
| onDigit = { digit -> if (pin.length < 9) pin += digit }, |
There was a problem hiding this comment.
Trezor PINs can be up to 50 digits according to the official PIN rules (https://trezor.io/learn/a/pin-protection-on-trezor-devices), but this guard stops accepting input after 9 positions. Users who configured a 10+ digit PIN in Trezor Suite can never submit their full PIN here, so every PIN-protected operation from the app fails for those devices.
Useful? React with 👍 / 👎.
| ), | ||
| ) |
There was a problem hiding this comment.
When WalletModeRow is opened for a device with passphraseEntryCapable == false, it skips the chooser and shows this same host-entry dialog, but the dialog still always offers “Enter on Trezor instead”. Selecting it switches to PASSPHRASE_DEVICE even though the connected device reported that it cannot accept on-device passphrase entry, causing hidden-wallet connection to fail instead of keeping the user on the supported host-entry path.
Useful? React with 👍 / 👎.
- accept trezor pins up to 50 digits (was capped at 9) - only offer on-device passphrase entry when the device supports it - add braces to the multiline if/else in currentSelection (detekt)
2 participants
Adds on-screen Trezor PIN entry and passphrase (hidden wallet) selection, built on the typed TrezorUiCallback from bitkit-core 0.1.62.
Bumps bitkit-core 0.1.58 -> 0.1.62.
Description
App-side adoption of the typed Trezor UI callback and per-connection wallet
selection from bitkit-core 0.1.62 (
trezor-connect-rs0.2.8 → 0.3.2). Thelibrary replaced the stringly-typed passphrase callback — where
""wasoverloaded to mean cancel, leaving no way to express the standard wallet
(
Some("")on the device) — with a typedPassphraseResponse, and made eachconnection declare which wallet it opens.
PIN entry
PinEntryDialogrenders the 3×3 matrix; the user maps it to the scrambledlayout shown on the Trezor.
onPinRequestblocks on aCountDownLatch(120s timeout) until the PIN is submitted or cancelled (empty string).
Passphrase / hidden wallets
WALLETrow lets the user open the standard wallet or a hidden wallet.Devices reporting
passphraseEntryCapableare offered a choice(
WalletModeChooserDialog) of entering the passphrase on the phone (host,via
PassphraseDialog) or on the Trezor; otherwise host entry is used.Modeled as
TrezorWalletMode(STANDARD/PASSPHRASE_HOST/PASSPHRASE_DEVICE).onPassphraseRequestanswers withPassphraseResponse.Standard/Hidden { value }/OnDevicefrom a single source of truth, so THPdevices (Safe 5/7) — which bind the passphrase at session creation via the
new
WalletSelectionpassed toconnect()— and legacy devices — askedmid-operation — stay in lockstep.
Transport / reconnect fixes
USB; BLE falls back to
getRemoteDevice(address)when there's no fresh scanhandle; rejected sessions (wrong passphrase/on-device cancel) are treated
as definitive failures rather than retried.
Adopts the breaking FFI changes from bitkit-core 0.1.62:
onPassphraseRequestnow returns
PassphraseResponse(wasString) andtrezorConnecttakes arequired
selection: WalletSelection.QA Notes
Manual (PIN-protected device, ideally both a THP device — Safe 5/7 — and a legacy device):
scrambled layout on the Trezor; submit / delete / cancel / 120s timeout all
behave.
old
""-means-cancel encoding broke).passphrase → the hidden wallet's addresses differ from standard.
and the matching wallet opens.
the new mode applies on the next operation.
standard wallet.
entry → it connects over BLE, not hijacked to USB.