Feat/hw three parties by ByteZhang1024 · Pull Request #11048 · OneKeyHQ/app-monorepo

ByteZhang1024 · 2026-04-03T06:49:03Z

No description provided.

- Add Ledger adapter infrastructure (connector-loader, vendorProfile, adapter types) - Implement Ledger keyrings for BTC, EVM, SOL, TRON chains - Add device fingerprint verification for Ledger cross-session identity - Support HID device permission and auto-selection for desktop - Add third-party hardware UI state management (toast/dialog) - Store vendor in DB settingsRaw (no schema migration needed) - Filter Ledger devices from OneKey device management and cloud sync - Fix dgram polyfill and Ledger package main field in postinstall

…nse<T>

…Device in EVM keyring

- Use proper types for DeviceScannerUtils vendor param (EHardwareVendor) - Cast rawXpub to IRawXpub union type instead of any - Cast dbAccount to IDBUtxoAccount for xpub/xpubSegwit access - Use navigator.hid directly with @types/w3c-web-hid - Fix null→undefined for connectId param - Mark unused vendor param with underscore prefix

revan-zhang · 2026-04-03T06:49:26Z

⛔ Snyk checks have failed. 1 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (1)
⛔	Open Source Security	0	1	0	0	1 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

socket-security · 2026-04-03T06:52:01Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality
	@aptos-labs/ts-sdk@1.39.0
	@babel/plugin-proposal-class-properties@7.18.6
	@babel/plugin-proposal-class-static-block@7.21.0
	@babel/plugin-proposal-nullish-coalescing-operator@7.18.6
	@babel/plugin-proposal-private-methods@7.18.6
	@babel/plugin-proposal-private-property-in-object@7.21.11
	@mymonero/mymonero-keyimage-cache@3.0.0
	@bytezhang/hardware-ledger-connector-ble@0.0.43
	@bytezhang/hardware-ledger-connector-webhid@0.0.43
	@babel/plugin-transform-numeric-separator@7.25.9
	@bytezhang/hardware-wallet-core@0.0.43
	@expo/plist@0.1.3
	@magiceden-oss/open_creator_protocol@0.3.5
	@types/node-fetch@2.6.9
	@bytezhang/ledger-adapter@0.0.43
	@aptos-labs/siwa@0.4.0
	@mymonero/mymonero-app-bridge@3.0.0
	@babel/preset-typescript@7.27.1
	esbuild@0.27.2
	@keystonehq/keystone-sdk@0.4.1
	@babel/plugin-transform-optional-chaining@7.27.1 ⏵ 7.25.9	⁺¹	⁺¹
	@formatjs/intl-pluralrules@4.3.3
	expo-keep-awake@14.1.4
	@formatjs/intl-locale@2.4.47
	@aivenio/tsc-output-parser@2.1.1
	@formatjs/intl-getcanonicallocales@1.9.2
	@babel/preset-env@7.28.6
	@glif/filecoin-rpc-client@3.0.2
	@benfen/bfc.js@0.2.7
	@alephium/web3@1.5.2
	@babel/core@7.27.1
	@glif/filecoin-message@2.0.44
	@electron/remote@2.1.1
See 20 more rows in the dashboard

View full report

socket-security · 2026-04-03T06:52:02Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@emurgo/cardano-message-signing-asmjs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/@emurgo/cardano-message-signing-asmjs@1.0.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emurgo/cardano-message-signing-asmjs@1.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@ledgerhq/device-management-kit` is 93.0% likely obfuscated Confidence: 0.93 Location: Package overview From: `?` → `npm/@bytezhang/hardware-ledger-connector-ble@0.0.43` → `npm/@bytezhang/ledger-adapter@0.0.43` → `npm/@bytezhang/hardware-ledger-connector-webhid@0.0.43` → `npm/@ledgerhq/device-management-kit@1.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@ledgerhq/device-management-kit@1.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

… vendor stub - Define IKeyringMap in VaultBase.ts (includes hwLedger + hwTrezor slots) - All 4 Vault files use IKeyringMap instead of inline intersection types - Replace hardcoded 'ledger' strings with EHardwareVendor.ledger in ServiceHardware and fingerprintUtils - Fix Trezor vendorProfile stub to have isThirdParty=true (prevents being treated as OneKey) - Remove unused IDBWalletType and KeyringBase imports from Vault files

- Remove non-existent ETranslations keys, use English defaultMessage - Cast avatarKey to IAllWalletAvatarImageNamesWithoutDividers - Fix null-to-undefined for connectId assignments - Fix import paths in EVM KeyringHardwareLedger - Remove path/inputDerivations from btcSignTransaction (not in SDK type) - Use (navigator as any).hid for CI compatibility

When adding an account to an existing third-party hardware wallet (Ledger, Trezor), only create accounts for the currently selected network instead of all default networks. Wallet creation still creates all default networks. BTC/LTC derive types are properly expanded when the current network is BTC/LTC.

…llet creation When creating a third-party HW wallet (Ledger/Trezor), if all chains fail due to app-not-installed, show a single toast instead of one per chain. If some chains succeed, silently filter out AppNotInstalled errors. Non-AppNotInstalled errors still surface via the existing per-chain toast loop.

ByteZhang1024 added 5 commits April 3, 2026 14:39

fix: correct callLedgerWithFingerprintRetry generic type to use Respo…

85b124f

…nse<T>

fix: replace any types with proper IThirdPartyHardwareAdapter and IDB…

ca0a663

…Device in EVM keyring

fix: only auto-select Ledger HID devices, reject other vendors

74957e1

ByteZhang1024 force-pushed the feat/hwThreeParties branch from 9825487 to b831cf6 Compare April 3, 2026 09:28

ByteZhang1024 added 5 commits April 3, 2026 17:37

chore: bump @bytezhang SDK packages to 0.0.41

c3beebf

chore: bump @bytezhang SDK packages to 0.0.43

34bab09

ByteZhang1024 force-pushed the feat/hwThreeParties branch from b831cf6 to 34bab09 Compare April 8, 2026 10:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat/hw three parties#11048

Feat/hw three parties#11048
ByteZhang1024 wants to merge 11 commits intoxfrom
feat/hwThreeParties

ByteZhang1024 commented Apr 3, 2026

Uh oh!

revan-zhang commented Apr 3, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Apr 3, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Apr 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ByteZhang1024 commented Apr 3, 2026

Uh oh!

revan-zhang commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⛔ Snyk checks have failed. 1 issues have been found so far.

Uh oh!

socket-security bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

revan-zhang commented Apr 3, 2026 •

edited

Loading

socket-security bot commented Apr 3, 2026 •

edited

Loading

socket-security bot commented Apr 3, 2026 •

edited

Loading