feat(hive): account lifecycle wallet methods (multi-key, account_create/update)#50
Merged
Merged
Conversation
…hase 1) Plumbs the 3 proto messages that firmware 7.15.0 + device-protocol already support but the JS wallet couldn't call: - hiveGetPublicKeys (1604/1605) — fetch all 4 role keys in one interaction - hiveSignAccountCreate (1606/1607) — account_create (op 9), sponsor-funded - hiveSignAccountUpdate (1608/1609) — account_update (op 10), secure existing acct Adds hdwallet-core interfaces + hiveSlip48Path(role, accountIndex) helper, the hand-written jspb shims + runtime registration in hdwallet-keepkey, and the KeepKeyHDWallet methods. Unblocks the vault onboarding wizard (Phase 3). Tests: jspb round-trip for every new message (validates wire field numbers/ types), hiveSlip48Path derivation, registry 1604-1609, wrapper success + unexpected-response guard. 15 passing.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
- Run prettier on hive.test.ts (was missed; CI lint failed on trailing commas at lines 80/94/119/148/216) - Add hiveSignAccountUpdate wrapper tests (success + unexpected-response), guarding the 1608/1609 enum/response-class wiring that was untested
BitHighlander
added a commit
to keepkey/keepkey-vault
that referenced
this pull request
Jun 29, 2026
…300) * feat(hive): sponsor-backed account onboarding + ETH anti-drain gate Hive receive/onboarding panel (HiveAccountPanel) on the Hive asset page: resolves the device's active key to an account via Pioneer, or runs the in-app sponsor onboarding wizard (live username availability, device-derived SLIP-0048 role keys, @keepkey-sponsored on-chain creation; keys never leave the device). Backend RPCs: hiveGetRoleKeys, hiveGetAccount, hiveUsernameAvailable, hiveCreateAccount (device owner-signed account_create attestation -> Pioneer sponsor endpoint). hiveSignTx/hiveSignAccountCreate route through emuSigningOp on the emulator for the interactive confirm gate. ETH anti-drain gate: hiveCreateAccount signs a fixed EIP-191 message bound to username+ownerKey with the device ETH key (m/44'/60'/0'/0/0) and sends ethAddress+ethSignature. The server requires the address to hold mainnet ETH (one sponsored account per funded address) to keep the free service from being drained. 403 surfaces a dedicated 'fund your ETH address' screen. Bumps hdwallet 91a9e9d -> d51727e4 (master) for the Hive account-lifecycle wallet methods (keepkey/hdwallet#50). * fix(hive): address PR review — success poll, derive-error surfacing, username race - P1: after a successful create, poll hiveGetAccount (backing off, 90s cap) and only hand off to the parent once the account resolves, instead of a single 4.5s refresh that could bounce a real success back to the wizard when the pubkey->account lookup lagged. Poll halts on unmount. - P2: surface address-derivation failures instead of an infinite spinner — the panel now takes loading/deriveError/onRetryDerive; a null activeKey with an error (or no in-flight derive) shows an actionable Retry. - P2: ignore stale username-availability responses (tag avail with its name + latest-name guard) so a late 'available' can't enable creation for a different, unchecked name. create() guard hardened to match. * fix(hive): guard the View account button against the success bounce too The auto-poll already waited for hiveGetAccount to resolve before handing off, but the manual 'View account' button still called onCreated blind — a click before Pioneer resolved the pubkey would refresh()->noAccount->wizard, unmounting the celebration. Both paths now share a guarded resolveToAccount(): the button does the same lookup, keeps the success screen on noAccount, and shows a 'still finalizing' hint instead of bouncing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Hive account-lifecycle methods to
hdwallet-keepkey(Phase 1), needed by the vault Hive sponsor-onboarding flow:hiveGetPublicKeys— derive all four SLIP-0048 role keys (owner/active/memo/posting) for an account index in one callhiveSignAccountCreate— owner-signedaccount_createattestation (op 9)hiveSignAccountUpdate— owner-signedaccount_update(op 10)hdwallet-coretype additions +keepkey.tswiringDevice-protocol coordination
This package depends on the
@bithighlander/device-protocolfork (@bithighlander/device-protocol@7.16.0), which is wheremessages-hive.protolives —keepkey/device-protocolmaster does not carry the Hive proto. The field numbers and enum IDs (1604–1609) were verified againstBitHighlander/device-protocol'smessages-hive.proto.Context
The original
feat/hive-account-opsbranch was 9 commits behind master — bumping a consumer to it would have dropped THORChain any-denom (RUJI/TCY), the eip712 refactor, the webusb clearHalt fix, and zcash deshield fixes. This branch is that work re-applied onto current master (cherry-pick) — a clean superset: all master commits retained, only the Hive methods added.Test plan
hive.test.ts(17 tests): registry, jspb round-trip for every field, and wrapper success/unexpected-response forhiveGetPublicKeys,hiveSignAccountCreate, andhiveSignAccountUpdate(the 1608/1609 wiring).--max-warnings=0, prettier).Notes
account_createsignature is a proof-of-control attestation, not a broadcast (the sponsor re-signs with the creator's active key server-side).