feat: pair trezor passphrase hidden wallets

[jvsena42]

Closes#1060

This PR:

1. Adds an optional Passphrase path to the Connect Hardware flow, so the hidden wallets of a paired Trezor can be watched alongside its standard wallet
2. Tracks each passphrase-derived account set as its own hardware wallet identity, with its own home tile, funds label, activity scope and removal
3. Asks for the passphrase again before signing a transfer when the Trezor session that held it is gone, and refuses to sign if it opens a different wallet
4. Lets the connect flow offer an already paired device, so passphrase wallets can be added after the initial pairing
5. Fixes a Trezor Bridge session bug that blocked every passphrase pairing after the first on the emulator

Description

Trezor keeps no record of its hidden wallets and forgets a passphrase with the session, so Bitkit watches each one by its extended public keys and asks for the passphrase again whenever a session has to be rebuilt. The passphrase is never persisted or logged, and both entry screens block screenshots and screen recording the same way the wallet's own passphrase screens do.

A device previously mapped to a single wallet. It now maps to one identity per passphrase, keyed by the wallet id derived from its accounts rather than by the transport id, which two identities on the same device share. Watchers, balances, activity, labels and removal all follow that identity, and removing one hidden wallet leaves the others paired.

Pairing a hidden wallet adds an entry next to the standard one instead of replacing it. The device is matched by shared key material, so re-reading accounts updates the right entry while a different passphrase creates a new one. Only the identity that currently holds the device session shows as connected, since only that one can sign.

Before signing a transfer, Bitkit reopens the hidden wallet and accepts the session only if its accounts resolve back to the wallet being spent from. A wrong passphrase is not rejected by the device — it silently derives another wallet — so the mismatch is caught, the stray wallet that reading its accounts created is dropped, and the transfer fails instead of signing from the wrong wallet. A session that is still open signs with no prompt.

Discovery skips devices that are already paired, which left the Add Hardware Wallet button searching forever and made the passphrase step unreachable after the first pairing. It now falls back to offering a known reachable device once no new one is found.

Separately, the Bridge transport used for the emulator offered a released session id as the previous one when re-acquiring, and the bridge answered wrong previous session. Since switching to a passphrase wallet closes and reopens the session, this blocked every passphrase pairing after the first. This only affects builds with the Bridge enabled; USB and BLE are unaffected.

Preview

no-wallet-add-with-passphrase.webm

Add.multiple.passphrase.wallets.webm

add-repeated-passphrase-wallet.webm

passphrase-disabled.webm

remove-wallet.webm

rename-wallet.webm

transfer-current-session.webm

transfer-other-section.mp4

QA Notes

Needs a Trezor with passphrase protection enabled. On the emulator start it with TREZOR_PASSPHRASE_PROTECTION=true ../bitkit-docker/scripts/trezor-emulator start and confirm on the device for every account a passphrase session reads, otherwise the call blocks until it times out.

Manual Tests

• 1a. Settings → Hardware Wallets → Add → Found → Connect: Device Connected shows Passphrase and Finish.
  • 1b. Passphrase → enter a passphrase → Continue: Passphrase Funds Found shows the balance and Label Funds prefilled with the device name.
  • 1c. Rename the label → Finish: home shows a second hardware tile under that name.
• 2. Home: headline total includes both hardware balances, and only the identity holding the device session shows a green connection indicator.
• 3. Paired or Passphrase Funds Found → Passphrase → re-enter a passphrase already watched: toast reports it is already added, no tile is added.
• 3b. Device with passphrase protection turned off in Trezor Suite (the factory default) → Paired → Passphrase → enter any passphrase: error says to enable passphrase protection in Trezor Suite, no wallet is added, and the standard wallet is not left marked as passphrase-protected (Settings ▸ Hardware Wallets → Transfer To Spending on it still signs without asking for a passphrase).
• 4a. Settings → Hardware Wallets: one row per identity, each with its own balance.
  • 4b. Rename one row: only that identity is renamed.
  • 4c. Delete the hidden wallet row: the standard wallet keeps working and the device stays paired, no re-pairing needed.
• 5. Settings → Hardware Wallets → Add on an already paired device: reaches Found and then Device Connected, instead of searching forever.
• 6a. Hidden wallet tile → Transfer To Spending → Amount → Sign → Open Trezor Connect while its session is still open: signs with no passphrase prompt.
  • 6b. Force-stop and relaunch the app, then repeat: the passphrase sheet opens before signing.
  • 6c. Enter a wrong passphrase: error says it opens a different wallet, nothing is signed or broadcast, and no extra tile appears.
  • 6d. Enter the correct passphrase: signing continues normally.
• 7.regression: Pair a device without using the Passphrase path: home tile, detail screen, rename, remove and Transfer To Spending behave as before.
• 8. Both passphrase screens: screenshots and screen recording are blocked, and the passphrase is absent from files/logs/ and files/datastore/ (release build; blocking is disabled in debug).

Automated Checks

• Unit tests added: cover a passphrase wallet being added next to the standard one, the flag surviving reconnects, and credentials surviving a scoped removal in TrezorRepoTest.kt.
• Unit tests added: cover two identities on one device, per-identity balances, connected state, funding account, scoped removal, and connectWithPassphrase including the already-watched case and a device with passphrase protection off in HwWalletRepoTest.kt.
• Unit tests added: cover the passphrase step effects, the duplicate toast, the label prefill, the paired step following the right identity, and the fallback to an already paired device in HwConnectViewModelTest.kt.
• Unit tests added: cover signing with a live session, prompting once it is gone, and refusing a passphrase that opens another wallet in TransferViewModelTest.kt.
• Unit tests added: cover re-acquiring after a release without the stale session in TrezorBridgeTransportTest.kt.
• Unit tests modified: existing hardware tests moved to wallet-id keying in HwWalletRepoTest.kt, TransferViewModelTest.kt and HwConnectViewModelTest.kt.
• Journeys added: passphrase-pairing.xml, passphrase-duplicate.xml, passphrase-settings-remove.xml and passphrase-transfer-to-spending.xml, including checks that the passphrase never reaches the logs or datastore.
• Verified on a Pixel emulator against the Trezor emulator: pairing two hidden wallets alongside the standard one, per-identity labels, three home tiles, the connected indicator, and no passphrase in the logs. The duplicate, settings-remove and transfer journeys were not executed; the transfer one additionally needs regtest funds on a hidden wallet.
• CI: standard compile, unit test and detekt checks run by the PR bot.

Known gaps

• A hidden wallet can persist with only part of its accounts when a read fails with a device error that is not classified as transient, and its wallet id would change once the missing accounts are read. This is a pre-existing gap in the partial-save guard that passphrase sessions make easier to hit.
• Two hidden wallets on the same device default to the same name until renamed, since the default label is the device name.

[greptile-apps]

Greptile Summary

The PR adds independently tracked Trezor hidden-wallet identities and passphrase-based session restoration while preserving wallet-scoped balances, activity, labels, signing, and removal.

• Keys hardware-wallet state and watchers by derived wallet identity instead of transport ID.
• Adds passphrase pairing and signing-reconnection flows with wallet-identity verification.
• Keeps sibling identities and transport credentials when removing one hidden wallet.
• Refreshes stale Trezor Bridge sessions before retrying acquisition.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt	Moves hardware-wallet aggregation, watcher lifecycle, signing, and removal to wallet-identity scope; the previously reported multi-transport removal issue is addressed.
app/src/main/java/to/bitkit/repositories/TrezorRepo.kt	Persists multiple identities per physical device and manages passphrase-bound sessions while atomically filtering scoped removals.
app/src/main/java/to/bitkit/services/TrezorBridgeTransport.kt	Clears released sessions and retries acquisition after refreshing a stale Bridge session.
app/src/main/java/to/bitkit/viewmodels/TransferViewModel.kt	Integrates passphrase restoration and identity verification into hardware-wallet signing.
app/src/main/java/to/bitkit/ui/sheets/hardware/HwConnectViewModel.kt	Adds passphrase-wallet pairing, duplicate handling, and known-device discovery fallback.
app/src/main/java/to/bitkit/ui/screens/transfer/hardware/HwPassphrasePromptSheet.kt	Adds the intentionally unmasked, screenshot-protected passphrase prompt used to restore signing sessions.

Sequence Diagram

sequenceDiagram
participant UI as Hardware Wallet UI
participant HW as HwWalletRepo
participant TR as TrezorRepo
participant Device as Trezor
participant Store as HwWalletStore
UI->>HW: connectWithPassphrase(deviceId, passphrase)
HW->>TR: set/connect passphrase wallet mode
TR->>Device: Open fresh passphrase session
Device-->>TR: Features and account keys
TR->>Store: Persist identity by derived wallet ID
TR-->>HW: Connected wallet identity
HW-->>UI: Add or select hidden-wallet tile
UI->>HW: Sign from wallet ID
alt matching session is live
HW->>Device: Sign transaction
else session is absent or belongs to another identity
UI->>HW: reconnectWithPassphrase(walletId, passphrase)
HW->>TR: Open fresh passphrase session
TR->>Device: Read account keys
alt derived wallet ID matches
HW->>Device: Sign transaction
else derived wallet ID differs
HW->>TR: Disconnect stray session
HW-->>UI: Reject passphrase mismatch
end
end

Loading

_{Reviews (3): Last reviewed commit: "fix: passphrase should not gate pending ..." | Re-trigger Greptile}

[jvsena42]

checking CI failures

Edit: both are backend failures

[jvsena42]

All test passing. Re-runned manual tests checklist with journeys

[ovitrif]

Looks good, passphrase identities stay scoped to their own tiles, session, and removal without replacing the standard wallet.

[jvsena42]

Closes#1060

This PR:

1. Adds an optional Passphrase path to the Connect Hardware flow, so the hidden wallets of a paired Trezor can be watched alongside its standard wallet
2. Tracks each passphrase-derived account set as its own hardware wallet identity, with its own home tile, funds label, activity scope and removal
3. Asks for the passphrase again before signing a transfer when the Trezor session that held it is gone, and refuses to sign if it opens a different wallet
4. Lets the connect flow offer an already paired device, so passphrase wallets can be added after the initial pairing
5. Fixes a Trezor Bridge session bug that blocked every passphrase pairing after the first on the emulator

Description

Trezor keeps no record of its hidden wallets and forgets a passphrase with the session, so Bitkit watches each one by its extended public keys and asks for the passphrase again whenever a session has to be rebuilt. The passphrase is never persisted or logged, and both entry screens block screenshots and screen recording the same way the wallet's own passphrase screens do.

A device previously mapped to a single wallet. It now maps to one identity per passphrase, keyed by the wallet id derived from its accounts rather than by the transport id, which two identities on the same device share. Watchers, balances, activity, labels and removal all follow that identity, and removing one hidden wallet leaves the others paired.

Pairing a hidden wallet adds an entry next to the standard one instead of replacing it. The device is matched by shared key material, so re-reading accounts updates the right entry while a different passphrase creates a new one. Only the identity that currently holds the device session shows as connected, since only that one can sign.

Before signing a transfer, Bitkit reopens the hidden wallet and accepts the session only if its accounts resolve back to the wallet being spent from. A wrong passphrase is not rejected by the device — it silently derives another wallet — so the mismatch is caught, the stray wallet that reading its accounts created is dropped, and the transfer fails instead of signing from the wrong wallet. A session that is still open signs with no prompt.

Discovery skips devices that are already paired, which left the Add Hardware Wallet button searching forever and made the passphrase step unreachable after the first pairing. It now falls back to offering a known reachable device once no new one is found.

Separately, the Bridge transport used for the emulator offered a released session id as the previous one when re-acquiring, and the bridge answered wrong previous session. Since switching to a passphrase wallet closes and reopens the session, this blocked every passphrase pairing after the first. This only affects builds with the Bridge enabled; USB and BLE are unaffected.

Preview

no-wallet-add-with-passphrase.webm

Add.multiple.passphrase.wallets.webm

add-repeated-passphrase-wallet.webm

passphrase-disabled.webm

remove-wallet.webm

rename-wallet.webm

transfer-current-session.webm

transfer-other-section.mp4

QA Notes

Needs a Trezor with passphrase protection enabled. On the emulator start it with TREZOR_PASSPHRASE_PROTECTION=true ../bitkit-docker/scripts/trezor-emulator start and confirm on the device for every account a passphrase session reads, otherwise the call blocks until it times out.

Manual Tests

• 1a. Settings → Hardware Wallets → Add → Found → Connect: Device Connected shows Passphrase and Finish.
  • 1b. Passphrase → enter a passphrase → Continue: Passphrase Funds Found shows the balance and Label Funds prefilled with the device name.
  • 1c. Rename the label → Finish: home shows a second hardware tile under that name.
• 2. Home: headline total includes both hardware balances, and only the identity holding the device session shows a green connection indicator.
• 3. Paired or Passphrase Funds Found → Passphrase → re-enter a passphrase already watched: toast reports it is already added, no tile is added.
• 3b. Device with passphrase protection turned off in Trezor Suite (the factory default) → Paired → Passphrase → enter any passphrase: error says to enable passphrase protection in Trezor Suite, no wallet is added, and the standard wallet is not left marked as passphrase-protected (Settings ▸ Hardware Wallets → Transfer To Spending on it still signs without asking for a passphrase).
• 4a. Settings → Hardware Wallets: one row per identity, each with its own balance.
  • 4b. Rename one row: only that identity is renamed.
  • 4c. Delete the hidden wallet row: the standard wallet keeps working and the device stays paired, no re-pairing needed.
• 5. Settings → Hardware Wallets → Add on an already paired device: reaches Found and then Device Connected, instead of searching forever.
• 6a. Hidden wallet tile → Transfer To Spending → Amount → Sign → Open Trezor Connect while its session is still open: signs with no passphrase prompt.
  • 6b. Force-stop and relaunch the app, then repeat: the passphrase sheet opens before signing.
  • 6c. Enter a wrong passphrase: error says it opens a different wallet, nothing is signed or broadcast, and no extra tile appears.
  • 6d. Enter the correct passphrase: signing continues normally.
• 7.regression: Pair a device without using the Passphrase path: home tile, detail screen, rename, remove and Transfer To Spending behave as before.
• 8. Both passphrase screens: screenshots and screen recording are blocked, and the passphrase is absent from files/logs/ and files/datastore/ (release build; blocking is disabled in debug).

Automated Checks

• Unit tests added: cover a passphrase wallet being added next to the standard one, the flag surviving reconnects, and credentials surviving a scoped removal in TrezorRepoTest.kt.
• Unit tests added: cover two identities on one device, per-identity balances, connected state, funding account, scoped removal, and connectWithPassphrase including the already-watched case and a device with passphrase protection off in HwWalletRepoTest.kt.
• Unit tests added: cover the passphrase step effects, the duplicate toast, the label prefill, the paired step following the right identity, and the fallback to an already paired device in HwConnectViewModelTest.kt.
• Unit tests added: cover signing with a live session, prompting once it is gone, and refusing a passphrase that opens another wallet in TransferViewModelTest.kt.
• Unit tests added: cover re-acquiring after a release without the stale session in TrezorBridgeTransportTest.kt.
• Unit tests modified: existing hardware tests moved to wallet-id keying in HwWalletRepoTest.kt, TransferViewModelTest.kt and HwConnectViewModelTest.kt.
• Journeys added: passphrase-pairing.xml, passphrase-duplicate.xml, passphrase-settings-remove.xml and passphrase-transfer-to-spending.xml, including checks that the passphrase never reaches the logs or datastore.
• Verified on a Pixel emulator against the Trezor emulator: pairing two hidden wallets alongside the standard one, per-identity labels, three home tiles, the connected indicator, and no passphrase in the logs. The duplicate, settings-remove and transfer journeys were not executed; the transfer one additionally needs regtest funds on a hidden wallet.
• CI: standard compile, unit test and detekt checks run by the PR bot.

Known gaps

• A hidden wallet can persist with only part of its accounts when a read fails with a device error that is not classified as transient, and its wallet id would change once the missing accounts are read. This is a pre-existing gap in the partial-save guard that passphrase sessions make easier to hit.
• Two hidden wallets on the same device default to the same name until renamed, since the default label is the device name.

[greptile-apps]

Greptile Summary

The PR adds independently tracked Trezor hidden-wallet identities and passphrase-based session restoration while preserving wallet-scoped balances, activity, labels, signing, and removal.

• Keys hardware-wallet state and watchers by derived wallet identity instead of transport ID.
• Adds passphrase pairing and signing-reconnection flows with wallet-identity verification.
• Keeps sibling identities and transport credentials when removing one hidden wallet.
• Refreshes stale Trezor Bridge sessions before retrying acquisition.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt	Moves hardware-wallet aggregation, watcher lifecycle, signing, and removal to wallet-identity scope; the previously reported multi-transport removal issue is addressed.
app/src/main/java/to/bitkit/repositories/TrezorRepo.kt	Persists multiple identities per physical device and manages passphrase-bound sessions while atomically filtering scoped removals.
app/src/main/java/to/bitkit/services/TrezorBridgeTransport.kt	Clears released sessions and retries acquisition after refreshing a stale Bridge session.
app/src/main/java/to/bitkit/viewmodels/TransferViewModel.kt	Integrates passphrase restoration and identity verification into hardware-wallet signing.
app/src/main/java/to/bitkit/ui/sheets/hardware/HwConnectViewModel.kt	Adds passphrase-wallet pairing, duplicate handling, and known-device discovery fallback.
app/src/main/java/to/bitkit/ui/screens/transfer/hardware/HwPassphrasePromptSheet.kt	Adds the intentionally unmasked, screenshot-protected passphrase prompt used to restore signing sessions.

Sequence Diagram

sequenceDiagram
participant UI as Hardware Wallet UI
participant HW as HwWalletRepo
participant TR as TrezorRepo
participant Device as Trezor
participant Store as HwWalletStore
UI->>HW: connectWithPassphrase(deviceId, passphrase)
HW->>TR: set/connect passphrase wallet mode
TR->>Device: Open fresh passphrase session
Device-->>TR: Features and account keys
TR->>Store: Persist identity by derived wallet ID
TR-->>HW: Connected wallet identity
HW-->>UI: Add or select hidden-wallet tile
UI->>HW: Sign from wallet ID
alt matching session is live
HW->>Device: Sign transaction
else session is absent or belongs to another identity
UI->>HW: reconnectWithPassphrase(walletId, passphrase)
HW->>TR: Open fresh passphrase session
TR->>Device: Read account keys
alt derived wallet ID matches
HW->>Device: Sign transaction
else derived wallet ID differs
HW->>TR: Disconnect stray session
HW-->>UI: Reject passphrase mismatch
end
end

Loading

_{Reviews (3): Last reviewed commit: "fix: passphrase should not gate pending ..." | Re-trigger Greptile}

[jvsena42]

checking CI failures

Edit: both are backend failures

[jvsena42]

All test passing. Re-runned manual tests checklist with journeys

[ovitrif]

Looks good, passphrase identities stay scoped to their own tiles, session, and removal without replacing the standard wallet.

[jvsena42]

Closes#1060

This PR:

1. Adds an optional Passphrase path to the Connect Hardware flow, so the hidden wallets of a paired Trezor can be watched alongside its standard wallet
2. Tracks each passphrase-derived account set as its own hardware wallet identity, with its own home tile, funds label, activity scope and removal
3. Asks for the passphrase again before signing a transfer when the Trezor session that held it is gone, and refuses to sign if it opens a different wallet
4. Lets the connect flow offer an already paired device, so passphrase wallets can be added after the initial pairing
5. Fixes a Trezor Bridge session bug that blocked every passphrase pairing after the first on the emulator

Description

Trezor keeps no record of its hidden wallets and forgets a passphrase with the session, so Bitkit watches each one by its extended public keys and asks for the passphrase again whenever a session has to be rebuilt. The passphrase is never persisted or logged, and both entry screens block screenshots and screen recording the same way the wallet's own passphrase screens do.

A device previously mapped to a single wallet. It now maps to one identity per passphrase, keyed by the wallet id derived from its accounts rather than by the transport id, which two identities on the same device share. Watchers, balances, activity, labels and removal all follow that identity, and removing one hidden wallet leaves the others paired.

Pairing a hidden wallet adds an entry next to the standard one instead of replacing it. The device is matched by shared key material, so re-reading accounts updates the right entry while a different passphrase creates a new one. Only the identity that currently holds the device session shows as connected, since only that one can sign.

Before signing a transfer, Bitkit reopens the hidden wallet and accepts the session only if its accounts resolve back to the wallet being spent from. A wrong passphrase is not rejected by the device — it silently derives another wallet — so the mismatch is caught, the stray wallet that reading its accounts created is dropped, and the transfer fails instead of signing from the wrong wallet. A session that is still open signs with no prompt.

Discovery skips devices that are already paired, which left the Add Hardware Wallet button searching forever and made the passphrase step unreachable after the first pairing. It now falls back to offering a known reachable device once no new one is found.

Separately, the Bridge transport used for the emulator offered a released session id as the previous one when re-acquiring, and the bridge answered wrong previous session. Since switching to a passphrase wallet closes and reopens the session, this blocked every passphrase pairing after the first. This only affects builds with the Bridge enabled; USB and BLE are unaffected.

Preview

no-wallet-add-with-passphrase.webm

Add.multiple.passphrase.wallets.webm

add-repeated-passphrase-wallet.webm

passphrase-disabled.webm

remove-wallet.webm

rename-wallet.webm

transfer-current-session.webm

transfer-other-section.mp4

QA Notes

Needs a Trezor with passphrase protection enabled. On the emulator start it with TREZOR_PASSPHRASE_PROTECTION=true ../bitkit-docker/scripts/trezor-emulator start and confirm on the device for every account a passphrase session reads, otherwise the call blocks until it times out.

Manual Tests

• 1a. Settings → Hardware Wallets → Add → Found → Connect: Device Connected shows Passphrase and Finish.
  • 1b. Passphrase → enter a passphrase → Continue: Passphrase Funds Found shows the balance and Label Funds prefilled with the device name.
  • 1c. Rename the label → Finish: home shows a second hardware tile under that name.
• 2. Home: headline total includes both hardware balances, and only the identity holding the device session shows a green connection indicator.
• 3. Paired or Passphrase Funds Found → Passphrase → re-enter a passphrase already watched: toast reports it is already added, no tile is added.
• 3b. Device with passphrase protection turned off in Trezor Suite (the factory default) → Paired → Passphrase → enter any passphrase: error says to enable passphrase protection in Trezor Suite, no wallet is added, and the standard wallet is not left marked as passphrase-protected (Settings ▸ Hardware Wallets → Transfer To Spending on it still signs without asking for a passphrase).
• 4a. Settings → Hardware Wallets: one row per identity, each with its own balance.
  • 4b. Rename one row: only that identity is renamed.
  • 4c. Delete the hidden wallet row: the standard wallet keeps working and the device stays paired, no re-pairing needed.
• 5. Settings → Hardware Wallets → Add on an already paired device: reaches Found and then Device Connected, instead of searching forever.
• 6a. Hidden wallet tile → Transfer To Spending → Amount → Sign → Open Trezor Connect while its session is still open: signs with no passphrase prompt.
  • 6b. Force-stop and relaunch the app, then repeat: the passphrase sheet opens before signing.
  • 6c. Enter a wrong passphrase: error says it opens a different wallet, nothing is signed or broadcast, and no extra tile appears.
  • 6d. Enter the correct passphrase: signing continues normally.
• 7.regression: Pair a device without using the Passphrase path: home tile, detail screen, rename, remove and Transfer To Spending behave as before.
• 8. Both passphrase screens: screenshots and screen recording are blocked, and the passphrase is absent from files/logs/ and files/datastore/ (release build; blocking is disabled in debug).

Automated Checks

• Unit tests added: cover a passphrase wallet being added next to the standard one, the flag surviving reconnects, and credentials surviving a scoped removal in TrezorRepoTest.kt.
• Unit tests added: cover two identities on one device, per-identity balances, connected state, funding account, scoped removal, and connectWithPassphrase including the already-watched case and a device with passphrase protection off in HwWalletRepoTest.kt.
• Unit tests added: cover the passphrase step effects, the duplicate toast, the label prefill, the paired step following the right identity, and the fallback to an already paired device in HwConnectViewModelTest.kt.
• Unit tests added: cover signing with a live session, prompting once it is gone, and refusing a passphrase that opens another wallet in TransferViewModelTest.kt.
• Unit tests added: cover re-acquiring after a release without the stale session in TrezorBridgeTransportTest.kt.
• Unit tests modified: existing hardware tests moved to wallet-id keying in HwWalletRepoTest.kt, TransferViewModelTest.kt and HwConnectViewModelTest.kt.
• Journeys added: passphrase-pairing.xml, passphrase-duplicate.xml, passphrase-settings-remove.xml and passphrase-transfer-to-spending.xml, including checks that the passphrase never reaches the logs or datastore.
• Verified on a Pixel emulator against the Trezor emulator: pairing two hidden wallets alongside the standard one, per-identity labels, three home tiles, the connected indicator, and no passphrase in the logs. The duplicate, settings-remove and transfer journeys were not executed; the transfer one additionally needs regtest funds on a hidden wallet.
• CI: standard compile, unit test and detekt checks run by the PR bot.

Known gaps

• A hidden wallet can persist with only part of its accounts when a read fails with a device error that is not classified as transient, and its wallet id would change once the missing accounts are read. This is a pre-existing gap in the partial-save guard that passphrase sessions make easier to hit.
• Two hidden wallets on the same device default to the same name until renamed, since the default label is the device name.

[greptile-apps]

Greptile Summary

The PR adds independently tracked Trezor hidden-wallet identities and passphrase-based session restoration while preserving wallet-scoped balances, activity, labels, signing, and removal.

• Keys hardware-wallet state and watchers by derived wallet identity instead of transport ID.
• Adds passphrase pairing and signing-reconnection flows with wallet-identity verification.
• Keeps sibling identities and transport credentials when removing one hidden wallet.
• Refreshes stale Trezor Bridge sessions before retrying acquisition.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt	Moves hardware-wallet aggregation, watcher lifecycle, signing, and removal to wallet-identity scope; the previously reported multi-transport removal issue is addressed.
app/src/main/java/to/bitkit/repositories/TrezorRepo.kt	Persists multiple identities per physical device and manages passphrase-bound sessions while atomically filtering scoped removals.
app/src/main/java/to/bitkit/services/TrezorBridgeTransport.kt	Clears released sessions and retries acquisition after refreshing a stale Bridge session.
app/src/main/java/to/bitkit/viewmodels/TransferViewModel.kt	Integrates passphrase restoration and identity verification into hardware-wallet signing.
app/src/main/java/to/bitkit/ui/sheets/hardware/HwConnectViewModel.kt	Adds passphrase-wallet pairing, duplicate handling, and known-device discovery fallback.
app/src/main/java/to/bitkit/ui/screens/transfer/hardware/HwPassphrasePromptSheet.kt	Adds the intentionally unmasked, screenshot-protected passphrase prompt used to restore signing sessions.

Sequence Diagram

sequenceDiagram
participant UI as Hardware Wallet UI
participant HW as HwWalletRepo
participant TR as TrezorRepo
participant Device as Trezor
participant Store as HwWalletStore
UI->>HW: connectWithPassphrase(deviceId, passphrase)
HW->>TR: set/connect passphrase wallet mode
TR->>Device: Open fresh passphrase session
Device-->>TR: Features and account keys
TR->>Store: Persist identity by derived wallet ID
TR-->>HW: Connected wallet identity
HW-->>UI: Add or select hidden-wallet tile
UI->>HW: Sign from wallet ID
alt matching session is live
HW->>Device: Sign transaction
else session is absent or belongs to another identity
UI->>HW: reconnectWithPassphrase(walletId, passphrase)
HW->>TR: Open fresh passphrase session
TR->>Device: Read account keys
alt derived wallet ID matches
HW->>Device: Sign transaction
else derived wallet ID differs
HW->>TR: Disconnect stray session
HW-->>UI: Reject passphrase mismatch
end
end

Loading

_{Reviews (3): Last reviewed commit: "fix: passphrase should not gate pending ..." | Re-trigger Greptile}

[jvsena42]

checking CI failures

Edit: both are backend failures

[jvsena42]

All test passing. Re-runned manual tests checklist with journeys

[ovitrif]

Looks good, passphrase identities stay scoped to their own tiles, session, and removal without replacing the standard wallet.

[jvsena42]

Closes#1060

This PR:

1. Adds an optional Passphrase path to the Connect Hardware flow, so the hidden wallets of a paired Trezor can be watched alongside its standard wallet
2. Tracks each passphrase-derived account set as its own hardware wallet identity, with its own home tile, funds label, activity scope and removal
3. Asks for the passphrase again before signing a transfer when the Trezor session that held it is gone, and refuses to sign if it opens a different wallet
4. Lets the connect flow offer an already paired device, so passphrase wallets can be added after the initial pairing
5. Fixes a Trezor Bridge session bug that blocked every passphrase pairing after the first on the emulator

Description

Trezor keeps no record of its hidden wallets and forgets a passphrase with the session, so Bitkit watches each one by its extended public keys and asks for the passphrase again whenever a session has to be rebuilt. The passphrase is never persisted or logged, and both entry screens block screenshots and screen recording the same way the wallet's own passphrase screens do.

A device previously mapped to a single wallet. It now maps to one identity per passphrase, keyed by the wallet id derived from its accounts rather than by the transport id, which two identities on the same device share. Watchers, balances, activity, labels and removal all follow that identity, and removing one hidden wallet leaves the others paired.

Pairing a hidden wallet adds an entry next to the standard one instead of replacing it. The device is matched by shared key material, so re-reading accounts updates the right entry while a different passphrase creates a new one. Only the identity that currently holds the device session shows as connected, since only that one can sign.

Before signing a transfer, Bitkit reopens the hidden wallet and accepts the session only if its accounts resolve back to the wallet being spent from. A wrong passphrase is not rejected by the device — it silently derives another wallet — so the mismatch is caught, the stray wallet that reading its accounts created is dropped, and the transfer fails instead of signing from the wrong wallet. A session that is still open signs with no prompt.

Discovery skips devices that are already paired, which left the Add Hardware Wallet button searching forever and made the passphrase step unreachable after the first pairing. It now falls back to offering a known reachable device once no new one is found.

Separately, the Bridge transport used for the emulator offered a released session id as the previous one when re-acquiring, and the bridge answered wrong previous session. Since switching to a passphrase wallet closes and reopens the session, this blocked every passphrase pairing after the first. This only affects builds with the Bridge enabled; USB and BLE are unaffected.

Preview

no-wallet-add-with-passphrase.webm

Add.multiple.passphrase.wallets.webm

add-repeated-passphrase-wallet.webm

passphrase-disabled.webm

remove-wallet.webm

rename-wallet.webm

transfer-current-session.webm

transfer-other-section.mp4

QA Notes

Needs a Trezor with passphrase protection enabled. On the emulator start it with TREZOR_PASSPHRASE_PROTECTION=true ../bitkit-docker/scripts/trezor-emulator start and confirm on the device for every account a passphrase session reads, otherwise the call blocks until it times out.

Manual Tests

• 1a. Settings → Hardware Wallets → Add → Found → Connect: Device Connected shows Passphrase and Finish.
  • 1b. Passphrase → enter a passphrase → Continue: Passphrase Funds Found shows the balance and Label Funds prefilled with the device name.
  • 1c. Rename the label → Finish: home shows a second hardware tile under that name.
• 2. Home: headline total includes both hardware balances, and only the identity holding the device session shows a green connection indicator.
• 3. Paired or Passphrase Funds Found → Passphrase → re-enter a passphrase already watched: toast reports it is already added, no tile is added.
• 3b. Device with passphrase protection turned off in Trezor Suite (the factory default) → Paired → Passphrase → enter any passphrase: error says to enable passphrase protection in Trezor Suite, no wallet is added, and the standard wallet is not left marked as passphrase-protected (Settings ▸ Hardware Wallets → Transfer To Spending on it still signs without asking for a passphrase).
• 4a. Settings → Hardware Wallets: one row per identity, each with its own balance.
  • 4b. Rename one row: only that identity is renamed.
  • 4c. Delete the hidden wallet row: the standard wallet keeps working and the device stays paired, no re-pairing needed.
• 5. Settings → Hardware Wallets → Add on an already paired device: reaches Found and then Device Connected, instead of searching forever.
• 6a. Hidden wallet tile → Transfer To Spending → Amount → Sign → Open Trezor Connect while its session is still open: signs with no passphrase prompt.
  • 6b. Force-stop and relaunch the app, then repeat: the passphrase sheet opens before signing.
  • 6c. Enter a wrong passphrase: error says it opens a different wallet, nothing is signed or broadcast, and no extra tile appears.
  • 6d. Enter the correct passphrase: signing continues normally.
• 7.regression: Pair a device without using the Passphrase path: home tile, detail screen, rename, remove and Transfer To Spending behave as before.
• 8. Both passphrase screens: screenshots and screen recording are blocked, and the passphrase is absent from files/logs/ and files/datastore/ (release build; blocking is disabled in debug).

Automated Checks

• Unit tests added: cover a passphrase wallet being added next to the standard one, the flag surviving reconnects, and credentials surviving a scoped removal in TrezorRepoTest.kt.
• Unit tests added: cover two identities on one device, per-identity balances, connected state, funding account, scoped removal, and connectWithPassphrase including the already-watched case and a device with passphrase protection off in HwWalletRepoTest.kt.
• Unit tests added: cover the passphrase step effects, the duplicate toast, the label prefill, the paired step following the right identity, and the fallback to an already paired device in HwConnectViewModelTest.kt.
• Unit tests added: cover signing with a live session, prompting once it is gone, and refusing a passphrase that opens another wallet in TransferViewModelTest.kt.
• Unit tests added: cover re-acquiring after a release without the stale session in TrezorBridgeTransportTest.kt.
• Unit tests modified: existing hardware tests moved to wallet-id keying in HwWalletRepoTest.kt, TransferViewModelTest.kt and HwConnectViewModelTest.kt.
• Journeys added: passphrase-pairing.xml, passphrase-duplicate.xml, passphrase-settings-remove.xml and passphrase-transfer-to-spending.xml, including checks that the passphrase never reaches the logs or datastore.
• Verified on a Pixel emulator against the Trezor emulator: pairing two hidden wallets alongside the standard one, per-identity labels, three home tiles, the connected indicator, and no passphrase in the logs. The duplicate, settings-remove and transfer journeys were not executed; the transfer one additionally needs regtest funds on a hidden wallet.
• CI: standard compile, unit test and detekt checks run by the PR bot.

Known gaps

• A hidden wallet can persist with only part of its accounts when a read fails with a device error that is not classified as transient, and its wallet id would change once the missing accounts are read. This is a pre-existing gap in the partial-save guard that passphrase sessions make easier to hit.
• Two hidden wallets on the same device default to the same name until renamed, since the default label is the device name.

[greptile-apps]

Greptile Summary

The PR adds independently tracked Trezor hidden-wallet identities and passphrase-based session restoration while preserving wallet-scoped balances, activity, labels, signing, and removal.

• Keys hardware-wallet state and watchers by derived wallet identity instead of transport ID.
• Adds passphrase pairing and signing-reconnection flows with wallet-identity verification.
• Keeps sibling identities and transport credentials when removing one hidden wallet.
• Refreshes stale Trezor Bridge sessions before retrying acquisition.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt	Moves hardware-wallet aggregation, watcher lifecycle, signing, and removal to wallet-identity scope; the previously reported multi-transport removal issue is addressed.
app/src/main/java/to/bitkit/repositories/TrezorRepo.kt	Persists multiple identities per physical device and manages passphrase-bound sessions while atomically filtering scoped removals.
app/src/main/java/to/bitkit/services/TrezorBridgeTransport.kt	Clears released sessions and retries acquisition after refreshing a stale Bridge session.
app/src/main/java/to/bitkit/viewmodels/TransferViewModel.kt	Integrates passphrase restoration and identity verification into hardware-wallet signing.
app/src/main/java/to/bitkit/ui/sheets/hardware/HwConnectViewModel.kt	Adds passphrase-wallet pairing, duplicate handling, and known-device discovery fallback.
app/src/main/java/to/bitkit/ui/screens/transfer/hardware/HwPassphrasePromptSheet.kt	Adds the intentionally unmasked, screenshot-protected passphrase prompt used to restore signing sessions.

Sequence Diagram

sequenceDiagram
participant UI as Hardware Wallet UI
participant HW as HwWalletRepo
participant TR as TrezorRepo
participant Device as Trezor
participant Store as HwWalletStore
UI->>HW: connectWithPassphrase(deviceId, passphrase)
HW->>TR: set/connect passphrase wallet mode
TR->>Device: Open fresh passphrase session
Device-->>TR: Features and account keys
TR->>Store: Persist identity by derived wallet ID
TR-->>HW: Connected wallet identity
HW-->>UI: Add or select hidden-wallet tile
UI->>HW: Sign from wallet ID
alt matching session is live
HW->>Device: Sign transaction
else session is absent or belongs to another identity
UI->>HW: reconnectWithPassphrase(walletId, passphrase)
HW->>TR: Open fresh passphrase session
TR->>Device: Read account keys
alt derived wallet ID matches
HW->>Device: Sign transaction
else derived wallet ID differs
HW->>TR: Disconnect stray session
HW-->>UI: Reject passphrase mismatch
end
end

Loading

_{Reviews (3): Last reviewed commit: "fix: passphrase should not gate pending ..." | Re-trigger Greptile}

[jvsena42]

checking CI failures

Edit: both are backend failures

[jvsena42]

All test passing. Re-runned manual tests checklist with journeys

[ovitrif]

Looks good, passphrase identities stay scoped to their own tiles, session, and removal without replacing the standard wallet.

[jvsena42]

Closes#1060

This PR:

1. Adds an optional Passphrase path to the Connect Hardware flow, so the hidden wallets of a paired Trezor can be watched alongside its standard wallet
2. Tracks each passphrase-derived account set as its own hardware wallet identity, with its own home tile, funds label, activity scope and removal
3. Asks for the passphrase again before signing a transfer when the Trezor session that held it is gone, and refuses to sign if it opens a different wallet
4. Lets the connect flow offer an already paired device, so passphrase wallets can be added after the initial pairing
5. Fixes a Trezor Bridge session bug that blocked every passphrase pairing after the first on the emulator

Description

Trezor keeps no record of its hidden wallets and forgets a passphrase with the session, so Bitkit watches each one by its extended public keys and asks for the passphrase again whenever a session has to be rebuilt. The passphrase is never persisted or logged, and both entry screens block screenshots and screen recording the same way the wallet's own passphrase screens do.

A device previously mapped to a single wallet. It now maps to one identity per passphrase, keyed by the wallet id derived from its accounts rather than by the transport id, which two identities on the same device share. Watchers, balances, activity, labels and removal all follow that identity, and removing one hidden wallet leaves the others paired.

Pairing a hidden wallet adds an entry next to the standard one instead of replacing it. The device is matched by shared key material, so re-reading accounts updates the right entry while a different passphrase creates a new one. Only the identity that currently holds the device session shows as connected, since only that one can sign.

Before signing a transfer, Bitkit reopens the hidden wallet and accepts the session only if its accounts resolve back to the wallet being spent from. A wrong passphrase is not rejected by the device — it silently derives another wallet — so the mismatch is caught, the stray wallet that reading its accounts created is dropped, and the transfer fails instead of signing from the wrong wallet. A session that is still open signs with no prompt.

Discovery skips devices that are already paired, which left the Add Hardware Wallet button searching forever and made the passphrase step unreachable after the first pairing. It now falls back to offering a known reachable device once no new one is found.

Separately, the Bridge transport used for the emulator offered a released session id as the previous one when re-acquiring, and the bridge answered wrong previous session. Since switching to a passphrase wallet closes and reopens the session, this blocked every passphrase pairing after the first. This only affects builds with the Bridge enabled; USB and BLE are unaffected.

Preview

no-wallet-add-with-passphrase.webm

Add.multiple.passphrase.wallets.webm

add-repeated-passphrase-wallet.webm

passphrase-disabled.webm

remove-wallet.webm

rename-wallet.webm

transfer-current-session.webm

transfer-other-section.mp4

QA Notes

Needs a Trezor with passphrase protection enabled. On the emulator start it with TREZOR_PASSPHRASE_PROTECTION=true ../bitkit-docker/scripts/trezor-emulator start and confirm on the device for every account a passphrase session reads, otherwise the call blocks until it times out.

Manual Tests

• 1a. Settings → Hardware Wallets → Add → Found → Connect: Device Connected shows Passphrase and Finish.
  • 1b. Passphrase → enter a passphrase → Continue: Passphrase Funds Found shows the balance and Label Funds prefilled with the device name.
  • 1c. Rename the label → Finish: home shows a second hardware tile under that name.
• 2. Home: headline total includes both hardware balances, and only the identity holding the device session shows a green connection indicator.
• 3. Paired or Passphrase Funds Found → Passphrase → re-enter a passphrase already watched: toast reports it is already added, no tile is added.
• 3b. Device with passphrase protection turned off in Trezor Suite (the factory default) → Paired → Passphrase → enter any passphrase: error says to enable passphrase protection in Trezor Suite, no wallet is added, and the standard wallet is not left marked as passphrase-protected (Settings ▸ Hardware Wallets → Transfer To Spending on it still signs without asking for a passphrase).
• 4a. Settings → Hardware Wallets: one row per identity, each with its own balance.
  • 4b. Rename one row: only that identity is renamed.
  • 4c. Delete the hidden wallet row: the standard wallet keeps working and the device stays paired, no re-pairing needed.
• 5. Settings → Hardware Wallets → Add on an already paired device: reaches Found and then Device Connected, instead of searching forever.
• 6a. Hidden wallet tile → Transfer To Spending → Amount → Sign → Open Trezor Connect while its session is still open: signs with no passphrase prompt.
  • 6b. Force-stop and relaunch the app, then repeat: the passphrase sheet opens before signing.
  • 6c. Enter a wrong passphrase: error says it opens a different wallet, nothing is signed or broadcast, and no extra tile appears.
  • 6d. Enter the correct passphrase: signing continues normally.
• 7.regression: Pair a device without using the Passphrase path: home tile, detail screen, rename, remove and Transfer To Spending behave as before.
• 8. Both passphrase screens: screenshots and screen recording are blocked, and the passphrase is absent from files/logs/ and files/datastore/ (release build; blocking is disabled in debug).

Automated Checks

• Unit tests added: cover a passphrase wallet being added next to the standard one, the flag surviving reconnects, and credentials surviving a scoped removal in TrezorRepoTest.kt.
• Unit tests added: cover two identities on one device, per-identity balances, connected state, funding account, scoped removal, and connectWithPassphrase including the already-watched case and a device with passphrase protection off in HwWalletRepoTest.kt.
• Unit tests added: cover the passphrase step effects, the duplicate toast, the label prefill, the paired step following the right identity, and the fallback to an already paired device in HwConnectViewModelTest.kt.
• Unit tests added: cover signing with a live session, prompting once it is gone, and refusing a passphrase that opens another wallet in TransferViewModelTest.kt.
• Unit tests added: cover re-acquiring after a release without the stale session in TrezorBridgeTransportTest.kt.
• Unit tests modified: existing hardware tests moved to wallet-id keying in HwWalletRepoTest.kt, TransferViewModelTest.kt and HwConnectViewModelTest.kt.
• Journeys added: passphrase-pairing.xml, passphrase-duplicate.xml, passphrase-settings-remove.xml and passphrase-transfer-to-spending.xml, including checks that the passphrase never reaches the logs or datastore.
• Verified on a Pixel emulator against the Trezor emulator: pairing two hidden wallets alongside the standard one, per-identity labels, three home tiles, the connected indicator, and no passphrase in the logs. The duplicate, settings-remove and transfer journeys were not executed; the transfer one additionally needs regtest funds on a hidden wallet.
• CI: standard compile, unit test and detekt checks run by the PR bot.

Known gaps

• A hidden wallet can persist with only part of its accounts when a read fails with a device error that is not classified as transient, and its wallet id would change once the missing accounts are read. This is a pre-existing gap in the partial-save guard that passphrase sessions make easier to hit.
• Two hidden wallets on the same device default to the same name until renamed, since the default label is the device name.

[greptile-apps]

Greptile Summary

The PR adds independently tracked Trezor hidden-wallet identities and passphrase-based session restoration while preserving wallet-scoped balances, activity, labels, signing, and removal.

• Keys hardware-wallet state and watchers by derived wallet identity instead of transport ID.
• Adds passphrase pairing and signing-reconnection flows with wallet-identity verification.
• Keeps sibling identities and transport credentials when removing one hidden wallet.
• Refreshes stale Trezor Bridge sessions before retrying acquisition.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt	Moves hardware-wallet aggregation, watcher lifecycle, signing, and removal to wallet-identity scope; the previously reported multi-transport removal issue is addressed.
app/src/main/java/to/bitkit/repositories/TrezorRepo.kt	Persists multiple identities per physical device and manages passphrase-bound sessions while atomically filtering scoped removals.
app/src/main/java/to/bitkit/services/TrezorBridgeTransport.kt	Clears released sessions and retries acquisition after refreshing a stale Bridge session.
app/src/main/java/to/bitkit/viewmodels/TransferViewModel.kt	Integrates passphrase restoration and identity verification into hardware-wallet signing.
app/src/main/java/to/bitkit/ui/sheets/hardware/HwConnectViewModel.kt	Adds passphrase-wallet pairing, duplicate handling, and known-device discovery fallback.
app/src/main/java/to/bitkit/ui/screens/transfer/hardware/HwPassphrasePromptSheet.kt	Adds the intentionally unmasked, screenshot-protected passphrase prompt used to restore signing sessions.

Sequence Diagram

sequenceDiagram
participant UI as Hardware Wallet UI
participant HW as HwWalletRepo
participant TR as TrezorRepo
participant Device as Trezor
participant Store as HwWalletStore
UI->>HW: connectWithPassphrase(deviceId, passphrase)
HW->>TR: set/connect passphrase wallet mode
TR->>Device: Open fresh passphrase session
Device-->>TR: Features and account keys
TR->>Store: Persist identity by derived wallet ID
TR-->>HW: Connected wallet identity
HW-->>UI: Add or select hidden-wallet tile
UI->>HW: Sign from wallet ID
alt matching session is live
HW->>Device: Sign transaction
else session is absent or belongs to another identity
UI->>HW: reconnectWithPassphrase(walletId, passphrase)
HW->>TR: Open fresh passphrase session
TR->>Device: Read account keys
alt derived wallet ID matches
HW->>Device: Sign transaction
else derived wallet ID differs
HW->>TR: Disconnect stray session
HW-->>UI: Reject passphrase mismatch
end
end

Loading

_{Reviews (3): Last reviewed commit: "fix: passphrase should not gate pending ..." | Re-trigger Greptile}

[jvsena42]

checking CI failures

Edit: both are backend failures

[jvsena42]

All test passing. Re-runned manual tests checklist with journeys

[ovitrif]

Looks good, passphrase identities stay scoped to their own tiles, session, and removal without replacing the standard wallet.

[jvsena42]

Closes#1060

This PR:

1. Adds an optional Passphrase path to the Connect Hardware flow, so the hidden wallets of a paired Trezor can be watched alongside its standard wallet
2. Tracks each passphrase-derived account set as its own hardware wallet identity, with its own home tile, funds label, activity scope and removal
3. Asks for the passphrase again before signing a transfer when the Trezor session that held it is gone, and refuses to sign if it opens a different wallet
4. Lets the connect flow offer an already paired device, so passphrase wallets can be added after the initial pairing
5. Fixes a Trezor Bridge session bug that blocked every passphrase pairing after the first on the emulator

Description

Trezor keeps no record of its hidden wallets and forgets a passphrase with the session, so Bitkit watches each one by its extended public keys and asks for the passphrase again whenever a session has to be rebuilt. The passphrase is never persisted or logged, and both entry screens block screenshots and screen recording the same way the wallet's own passphrase screens do.

A device previously mapped to a single wallet. It now maps to one identity per passphrase, keyed by the wallet id derived from its accounts rather than by the transport id, which two identities on the same device share. Watchers, balances, activity, labels and removal all follow that identity, and removing one hidden wallet leaves the others paired.

Pairing a hidden wallet adds an entry next to the standard one instead of replacing it. The device is matched by shared key material, so re-reading accounts updates the right entry while a different passphrase creates a new one. Only the identity that currently holds the device session shows as connected, since only that one can sign.

Before signing a transfer, Bitkit reopens the hidden wallet and accepts the session only if its accounts resolve back to the wallet being spent from. A wrong passphrase is not rejected by the device — it silently derives another wallet — so the mismatch is caught, the stray wallet that reading its accounts created is dropped, and the transfer fails instead of signing from the wrong wallet. A session that is still open signs with no prompt.

Discovery skips devices that are already paired, which left the Add Hardware Wallet button searching forever and made the passphrase step unreachable after the first pairing. It now falls back to offering a known reachable device once no new one is found.

Separately, the Bridge transport used for the emulator offered a released session id as the previous one when re-acquiring, and the bridge answered wrong previous session. Since switching to a passphrase wallet closes and reopens the session, this blocked every passphrase pairing after the first. This only affects builds with the Bridge enabled; USB and BLE are unaffected.

Preview

no-wallet-add-with-passphrase.webm

Add.multiple.passphrase.wallets.webm

add-repeated-passphrase-wallet.webm

passphrase-disabled.webm

remove-wallet.webm

rename-wallet.webm

transfer-current-session.webm

transfer-other-section.mp4

QA Notes

Needs a Trezor with passphrase protection enabled. On the emulator start it with TREZOR_PASSPHRASE_PROTECTION=true ../bitkit-docker/scripts/trezor-emulator start and confirm on the device for every account a passphrase session reads, otherwise the call blocks until it times out.

Manual Tests

• 1a. Settings → Hardware Wallets → Add → Found → Connect: Device Connected shows Passphrase and Finish.
  • 1b. Passphrase → enter a passphrase → Continue: Passphrase Funds Found shows the balance and Label Funds prefilled with the device name.
  • 1c. Rename the label → Finish: home shows a second hardware tile under that name.
• 2. Home: headline total includes both hardware balances, and only the identity holding the device session shows a green connection indicator.
• 3. Paired or Passphrase Funds Found → Passphrase → re-enter a passphrase already watched: toast reports it is already added, no tile is added.
• 3b. Device with passphrase protection turned off in Trezor Suite (the factory default) → Paired → Passphrase → enter any passphrase: error says to enable passphrase protection in Trezor Suite, no wallet is added, and the standard wallet is not left marked as passphrase-protected (Settings ▸ Hardware Wallets → Transfer To Spending on it still signs without asking for a passphrase).
• 4a. Settings → Hardware Wallets: one row per identity, each with its own balance.
  • 4b. Rename one row: only that identity is renamed.
  • 4c. Delete the hidden wallet row: the standard wallet keeps working and the device stays paired, no re-pairing needed.
• 5. Settings → Hardware Wallets → Add on an already paired device: reaches Found and then Device Connected, instead of searching forever.
• 6a. Hidden wallet tile → Transfer To Spending → Amount → Sign → Open Trezor Connect while its session is still open: signs with no passphrase prompt.
  • 6b. Force-stop and relaunch the app, then repeat: the passphrase sheet opens before signing.
  • 6c. Enter a wrong passphrase: error says it opens a different wallet, nothing is signed or broadcast, and no extra tile appears.
  • 6d. Enter the correct passphrase: signing continues normally.
• 7.regression: Pair a device without using the Passphrase path: home tile, detail screen, rename, remove and Transfer To Spending behave as before.
• 8. Both passphrase screens: screenshots and screen recording are blocked, and the passphrase is absent from files/logs/ and files/datastore/ (release build; blocking is disabled in debug).

Automated Checks

• Unit tests added: cover a passphrase wallet being added next to the standard one, the flag surviving reconnects, and credentials surviving a scoped removal in TrezorRepoTest.kt.
• Unit tests added: cover two identities on one device, per-identity balances, connected state, funding account, scoped removal, and connectWithPassphrase including the already-watched case and a device with passphrase protection off in HwWalletRepoTest.kt.
• Unit tests added: cover the passphrase step effects, the duplicate toast, the label prefill, the paired step following the right identity, and the fallback to an already paired device in HwConnectViewModelTest.kt.
• Unit tests added: cover signing with a live session, prompting once it is gone, and refusing a passphrase that opens another wallet in TransferViewModelTest.kt.
• Unit tests added: cover re-acquiring after a release without the stale session in TrezorBridgeTransportTest.kt.
• Unit tests modified: existing hardware tests moved to wallet-id keying in HwWalletRepoTest.kt, TransferViewModelTest.kt and HwConnectViewModelTest.kt.
• Journeys added: passphrase-pairing.xml, passphrase-duplicate.xml, passphrase-settings-remove.xml and passphrase-transfer-to-spending.xml, including checks that the passphrase never reaches the logs or datastore.
• Verified on a Pixel emulator against the Trezor emulator: pairing two hidden wallets alongside the standard one, per-identity labels, three home tiles, the connected indicator, and no passphrase in the logs. The duplicate, settings-remove and transfer journeys were not executed; the transfer one additionally needs regtest funds on a hidden wallet.
• CI: standard compile, unit test and detekt checks run by the PR bot.

Known gaps

• A hidden wallet can persist with only part of its accounts when a read fails with a device error that is not classified as transient, and its wallet id would change once the missing accounts are read. This is a pre-existing gap in the partial-save guard that passphrase sessions make easier to hit.
• Two hidden wallets on the same device default to the same name until renamed, since the default label is the device name.

[greptile-apps]

Greptile Summary

The PR adds independently tracked Trezor hidden-wallet identities and passphrase-based session restoration while preserving wallet-scoped balances, activity, labels, signing, and removal.

• Keys hardware-wallet state and watchers by derived wallet identity instead of transport ID.
• Adds passphrase pairing and signing-reconnection flows with wallet-identity verification.
• Keeps sibling identities and transport credentials when removing one hidden wallet.
• Refreshes stale Trezor Bridge sessions before retrying acquisition.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt	Moves hardware-wallet aggregation, watcher lifecycle, signing, and removal to wallet-identity scope; the previously reported multi-transport removal issue is addressed.
app/src/main/java/to/bitkit/repositories/TrezorRepo.kt	Persists multiple identities per physical device and manages passphrase-bound sessions while atomically filtering scoped removals.
app/src/main/java/to/bitkit/services/TrezorBridgeTransport.kt	Clears released sessions and retries acquisition after refreshing a stale Bridge session.
app/src/main/java/to/bitkit/viewmodels/TransferViewModel.kt	Integrates passphrase restoration and identity verification into hardware-wallet signing.
app/src/main/java/to/bitkit/ui/sheets/hardware/HwConnectViewModel.kt	Adds passphrase-wallet pairing, duplicate handling, and known-device discovery fallback.
app/src/main/java/to/bitkit/ui/screens/transfer/hardware/HwPassphrasePromptSheet.kt	Adds the intentionally unmasked, screenshot-protected passphrase prompt used to restore signing sessions.

Sequence Diagram

sequenceDiagram
participant UI as Hardware Wallet UI
participant HW as HwWalletRepo
participant TR as TrezorRepo
participant Device as Trezor
participant Store as HwWalletStore
UI->>HW: connectWithPassphrase(deviceId, passphrase)
HW->>TR: set/connect passphrase wallet mode
TR->>Device: Open fresh passphrase session
Device-->>TR: Features and account keys
TR->>Store: Persist identity by derived wallet ID
TR-->>HW: Connected wallet identity
HW-->>UI: Add or select hidden-wallet tile
UI->>HW: Sign from wallet ID
alt matching session is live
HW->>Device: Sign transaction
else session is absent or belongs to another identity
UI->>HW: reconnectWithPassphrase(walletId, passphrase)
HW->>TR: Open fresh passphrase session
TR->>Device: Read account keys
alt derived wallet ID matches
HW->>Device: Sign transaction
else derived wallet ID differs
HW->>TR: Disconnect stray session
HW-->>UI: Reject passphrase mismatch
end
end

Loading

_{Reviews (3): Last reviewed commit: "fix: passphrase should not gate pending ..." | Re-trigger Greptile}

[jvsena42]

checking CI failures

Edit: both are backend failures

[jvsena42]

All test passing. Re-runned manual tests checklist with journeys

[ovitrif]

Looks good, passphrase identities stay scoped to their own tiles, session, and removal without replacing the standard wallet.

[jvsena42]

Closes#1060

This PR:

1. Adds an optional Passphrase path to the Connect Hardware flow, so the hidden wallets of a paired Trezor can be watched alongside its standard wallet
2. Tracks each passphrase-derived account set as its own hardware wallet identity, with its own home tile, funds label, activity scope and removal
3. Asks for the passphrase again before signing a transfer when the Trezor session that held it is gone, and refuses to sign if it opens a different wallet
4. Lets the connect flow offer an already paired device, so passphrase wallets can be added after the initial pairing
5. Fixes a Trezor Bridge session bug that blocked every passphrase pairing after the first on the emulator

Description

Trezor keeps no record of its hidden wallets and forgets a passphrase with the session, so Bitkit watches each one by its extended public keys and asks for the passphrase again whenever a session has to be rebuilt. The passphrase is never persisted or logged, and both entry screens block screenshots and screen recording the same way the wallet's own passphrase screens do.

A device previously mapped to a single wallet. It now maps to one identity per passphrase, keyed by the wallet id derived from its accounts rather than by the transport id, which two identities on the same device share. Watchers, balances, activity, labels and removal all follow that identity, and removing one hidden wallet leaves the others paired.

Pairing a hidden wallet adds an entry next to the standard one instead of replacing it. The device is matched by shared key material, so re-reading accounts updates the right entry while a different passphrase creates a new one. Only the identity that currently holds the device session shows as connected, since only that one can sign.

Before signing a transfer, Bitkit reopens the hidden wallet and accepts the session only if its accounts resolve back to the wallet being spent from. A wrong passphrase is not rejected by the device — it silently derives another wallet — so the mismatch is caught, the stray wallet that reading its accounts created is dropped, and the transfer fails instead of signing from the wrong wallet. A session that is still open signs with no prompt.

Discovery skips devices that are already paired, which left the Add Hardware Wallet button searching forever and made the passphrase step unreachable after the first pairing. It now falls back to offering a known reachable device once no new one is found.

Separately, the Bridge transport used for the emulator offered a released session id as the previous one when re-acquiring, and the bridge answered wrong previous session. Since switching to a passphrase wallet closes and reopens the session, this blocked every passphrase pairing after the first. This only affects builds with the Bridge enabled; USB and BLE are unaffected.

Preview

no-wallet-add-with-passphrase.webm

Add.multiple.passphrase.wallets.webm

add-repeated-passphrase-wallet.webm

passphrase-disabled.webm

remove-wallet.webm

rename-wallet.webm

transfer-current-session.webm

transfer-other-section.mp4

QA Notes

Needs a Trezor with passphrase protection enabled. On the emulator start it with TREZOR_PASSPHRASE_PROTECTION=true ../bitkit-docker/scripts/trezor-emulator start and confirm on the device for every account a passphrase session reads, otherwise the call blocks until it times out.

Manual Tests

• 1a. Settings → Hardware Wallets → Add → Found → Connect: Device Connected shows Passphrase and Finish.
  • 1b. Passphrase → enter a passphrase → Continue: Passphrase Funds Found shows the balance and Label Funds prefilled with the device name.
  • 1c. Rename the label → Finish: home shows a second hardware tile under that name.
• 2. Home: headline total includes both hardware balances, and only the identity holding the device session shows a green connection indicator.
• 3. Paired or Passphrase Funds Found → Passphrase → re-enter a passphrase already watched: toast reports it is already added, no tile is added.
• 3b. Device with passphrase protection turned off in Trezor Suite (the factory default) → Paired → Passphrase → enter any passphrase: error says to enable passphrase protection in Trezor Suite, no wallet is added, and the standard wallet is not left marked as passphrase-protected (Settings ▸ Hardware Wallets → Transfer To Spending on it still signs without asking for a passphrase).
• 4a. Settings → Hardware Wallets: one row per identity, each with its own balance.
  • 4b. Rename one row: only that identity is renamed.
  • 4c. Delete the hidden wallet row: the standard wallet keeps working and the device stays paired, no re-pairing needed.
• 5. Settings → Hardware Wallets → Add on an already paired device: reaches Found and then Device Connected, instead of searching forever.
• 6a. Hidden wallet tile → Transfer To Spending → Amount → Sign → Open Trezor Connect while its session is still open: signs with no passphrase prompt.
  • 6b. Force-stop and relaunch the app, then repeat: the passphrase sheet opens before signing.
  • 6c. Enter a wrong passphrase: error says it opens a different wallet, nothing is signed or broadcast, and no extra tile appears.
  • 6d. Enter the correct passphrase: signing continues normally.
• 7.regression: Pair a device without using the Passphrase path: home tile, detail screen, rename, remove and Transfer To Spending behave as before.
• 8. Both passphrase screens: screenshots and screen recording are blocked, and the passphrase is absent from files/logs/ and files/datastore/ (release build; blocking is disabled in debug).

Automated Checks

• Unit tests added: cover a passphrase wallet being added next to the standard one, the flag surviving reconnects, and credentials surviving a scoped removal in TrezorRepoTest.kt.
• Unit tests added: cover two identities on one device, per-identity balances, connected state, funding account, scoped removal, and connectWithPassphrase including the already-watched case and a device with passphrase protection off in HwWalletRepoTest.kt.
• Unit tests added: cover the passphrase step effects, the duplicate toast, the label prefill, the paired step following the right identity, and the fallback to an already paired device in HwConnectViewModelTest.kt.
• Unit tests added: cover signing with a live session, prompting once it is gone, and refusing a passphrase that opens another wallet in TransferViewModelTest.kt.
• Unit tests added: cover re-acquiring after a release without the stale session in TrezorBridgeTransportTest.kt.
• Unit tests modified: existing hardware tests moved to wallet-id keying in HwWalletRepoTest.kt, TransferViewModelTest.kt and HwConnectViewModelTest.kt.
• Journeys added: passphrase-pairing.xml, passphrase-duplicate.xml, passphrase-settings-remove.xml and passphrase-transfer-to-spending.xml, including checks that the passphrase never reaches the logs or datastore.
• Verified on a Pixel emulator against the Trezor emulator: pairing two hidden wallets alongside the standard one, per-identity labels, three home tiles, the connected indicator, and no passphrase in the logs. The duplicate, settings-remove and transfer journeys were not executed; the transfer one additionally needs regtest funds on a hidden wallet.
• CI: standard compile, unit test and detekt checks run by the PR bot.

Known gaps

• A hidden wallet can persist with only part of its accounts when a read fails with a device error that is not classified as transient, and its wallet id would change once the missing accounts are read. This is a pre-existing gap in the partial-save guard that passphrase sessions make easier to hit.
• Two hidden wallets on the same device default to the same name until renamed, since the default label is the device name.

[greptile-apps]

Greptile Summary

The PR adds independently tracked Trezor hidden-wallet identities and passphrase-based session restoration while preserving wallet-scoped balances, activity, labels, signing, and removal.

• Keys hardware-wallet state and watchers by derived wallet identity instead of transport ID.
• Adds passphrase pairing and signing-reconnection flows with wallet-identity verification.
• Keeps sibling identities and transport credentials when removing one hidden wallet.
• Refreshes stale Trezor Bridge sessions before retrying acquisition.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt	Moves hardware-wallet aggregation, watcher lifecycle, signing, and removal to wallet-identity scope; the previously reported multi-transport removal issue is addressed.
app/src/main/java/to/bitkit/repositories/TrezorRepo.kt	Persists multiple identities per physical device and manages passphrase-bound sessions while atomically filtering scoped removals.
app/src/main/java/to/bitkit/services/TrezorBridgeTransport.kt	Clears released sessions and retries acquisition after refreshing a stale Bridge session.
app/src/main/java/to/bitkit/viewmodels/TransferViewModel.kt	Integrates passphrase restoration and identity verification into hardware-wallet signing.
app/src/main/java/to/bitkit/ui/sheets/hardware/HwConnectViewModel.kt	Adds passphrase-wallet pairing, duplicate handling, and known-device discovery fallback.
app/src/main/java/to/bitkit/ui/screens/transfer/hardware/HwPassphrasePromptSheet.kt	Adds the intentionally unmasked, screenshot-protected passphrase prompt used to restore signing sessions.

Sequence Diagram

sequenceDiagram
participant UI as Hardware Wallet UI
participant HW as HwWalletRepo
participant TR as TrezorRepo
participant Device as Trezor
participant Store as HwWalletStore
UI->>HW: connectWithPassphrase(deviceId, passphrase)
HW->>TR: set/connect passphrase wallet mode
TR->>Device: Open fresh passphrase session
Device-->>TR: Features and account keys
TR->>Store: Persist identity by derived wallet ID
TR-->>HW: Connected wallet identity
HW-->>UI: Add or select hidden-wallet tile
UI->>HW: Sign from wallet ID
alt matching session is live
HW->>Device: Sign transaction
else session is absent or belongs to another identity
UI->>HW: reconnectWithPassphrase(walletId, passphrase)
HW->>TR: Open fresh passphrase session
TR->>Device: Read account keys
alt derived wallet ID matches
HW->>Device: Sign transaction
else derived wallet ID differs
HW->>TR: Disconnect stray session
HW-->>UI: Reject passphrase mismatch
end
end

Loading

_{Reviews (3): Last reviewed commit: "fix: passphrase should not gate pending ..." | Re-trigger Greptile}

[jvsena42]

checking CI failures

Edit: both are backend failures

[jvsena42]

All test passing. Re-runned manual tests checklist with journeys

[ovitrif]

Looks good, passphrase identities stay scoped to their own tiles, session, and removal without replacing the standard wallet.

[jvsena42]

Closes#1060

This PR:

1. Adds an optional Passphrase path to the Connect Hardware flow, so the hidden wallets of a paired Trezor can be watched alongside its standard wallet
2. Tracks each passphrase-derived account set as its own hardware wallet identity, with its own home tile, funds label, activity scope and removal
3. Asks for the passphrase again before signing a transfer when the Trezor session that held it is gone, and refuses to sign if it opens a different wallet
4. Lets the connect flow offer an already paired device, so passphrase wallets can be added after the initial pairing
5. Fixes a Trezor Bridge session bug that blocked every passphrase pairing after the first on the emulator

Description

Trezor keeps no record of its hidden wallets and forgets a passphrase with the session, so Bitkit watches each one by its extended public keys and asks for the passphrase again whenever a session has to be rebuilt. The passphrase is never persisted or logged, and both entry screens block screenshots and screen recording the same way the wallet's own passphrase screens do.

A device previously mapped to a single wallet. It now maps to one identity per passphrase, keyed by the wallet id derived from its accounts rather than by the transport id, which two identities on the same device share. Watchers, balances, activity, labels and removal all follow that identity, and removing one hidden wallet leaves the others paired.

Pairing a hidden wallet adds an entry next to the standard one instead of replacing it. The device is matched by shared key material, so re-reading accounts updates the right entry while a different passphrase creates a new one. Only the identity that currently holds the device session shows as connected, since only that one can sign.

Before signing a transfer, Bitkit reopens the hidden wallet and accepts the session only if its accounts resolve back to the wallet being spent from. A wrong passphrase is not rejected by the device — it silently derives another wallet — so the mismatch is caught, the stray wallet that reading its accounts created is dropped, and the transfer fails instead of signing from the wrong wallet. A session that is still open signs with no prompt.

Discovery skips devices that are already paired, which left the Add Hardware Wallet button searching forever and made the passphrase step unreachable after the first pairing. It now falls back to offering a known reachable device once no new one is found.

Separately, the Bridge transport used for the emulator offered a released session id as the previous one when re-acquiring, and the bridge answered wrong previous session. Since switching to a passphrase wallet closes and reopens the session, this blocked every passphrase pairing after the first. This only affects builds with the Bridge enabled; USB and BLE are unaffected.

Preview

no-wallet-add-with-passphrase.webm

Add.multiple.passphrase.wallets.webm

add-repeated-passphrase-wallet.webm

passphrase-disabled.webm

remove-wallet.webm

rename-wallet.webm

transfer-current-session.webm

transfer-other-section.mp4

QA Notes

Needs a Trezor with passphrase protection enabled. On the emulator start it with TREZOR_PASSPHRASE_PROTECTION=true ../bitkit-docker/scripts/trezor-emulator start and confirm on the device for every account a passphrase session reads, otherwise the call blocks until it times out.

Manual Tests

• 1a. Settings → Hardware Wallets → Add → Found → Connect: Device Connected shows Passphrase and Finish.
  • 1b. Passphrase → enter a passphrase → Continue: Passphrase Funds Found shows the balance and Label Funds prefilled with the device name.
  • 1c. Rename the label → Finish: home shows a second hardware tile under that name.
• 2. Home: headline total includes both hardware balances, and only the identity holding the device session shows a green connection indicator.
• 3. Paired or Passphrase Funds Found → Passphrase → re-enter a passphrase already watched: toast reports it is already added, no tile is added.
• 3b. Device with passphrase protection turned off in Trezor Suite (the factory default) → Paired → Passphrase → enter any passphrase: error says to enable passphrase protection in Trezor Suite, no wallet is added, and the standard wallet is not left marked as passphrase-protected (Settings ▸ Hardware Wallets → Transfer To Spending on it still signs without asking for a passphrase).
• 4a. Settings → Hardware Wallets: one row per identity, each with its own balance.
  • 4b. Rename one row: only that identity is renamed.
  • 4c. Delete the hidden wallet row: the standard wallet keeps working and the device stays paired, no re-pairing needed.
• 5. Settings → Hardware Wallets → Add on an already paired device: reaches Found and then Device Connected, instead of searching forever.
• 6a. Hidden wallet tile → Transfer To Spending → Amount → Sign → Open Trezor Connect while its session is still open: signs with no passphrase prompt.
  • 6b. Force-stop and relaunch the app, then repeat: the passphrase sheet opens before signing.
  • 6c. Enter a wrong passphrase: error says it opens a different wallet, nothing is signed or broadcast, and no extra tile appears.
  • 6d. Enter the correct passphrase: signing continues normally.
• 7.regression: Pair a device without using the Passphrase path: home tile, detail screen, rename, remove and Transfer To Spending behave as before.
• 8. Both passphrase screens: screenshots and screen recording are blocked, and the passphrase is absent from files/logs/ and files/datastore/ (release build; blocking is disabled in debug).

Automated Checks

• Unit tests added: cover a passphrase wallet being added next to the standard one, the flag surviving reconnects, and credentials surviving a scoped removal in TrezorRepoTest.kt.
• Unit tests added: cover two identities on one device, per-identity balances, connected state, funding account, scoped removal, and connectWithPassphrase including the already-watched case and a device with passphrase protection off in HwWalletRepoTest.kt.
• Unit tests added: cover the passphrase step effects, the duplicate toast, the label prefill, the paired step following the right identity, and the fallback to an already paired device in HwConnectViewModelTest.kt.
• Unit tests added: cover signing with a live session, prompting once it is gone, and refusing a passphrase that opens another wallet in TransferViewModelTest.kt.
• Unit tests added: cover re-acquiring after a release without the stale session in TrezorBridgeTransportTest.kt.
• Unit tests modified: existing hardware tests moved to wallet-id keying in HwWalletRepoTest.kt, TransferViewModelTest.kt and HwConnectViewModelTest.kt.
• Journeys added: passphrase-pairing.xml, passphrase-duplicate.xml, passphrase-settings-remove.xml and passphrase-transfer-to-spending.xml, including checks that the passphrase never reaches the logs or datastore.
• Verified on a Pixel emulator against the Trezor emulator: pairing two hidden wallets alongside the standard one, per-identity labels, three home tiles, the connected indicator, and no passphrase in the logs. The duplicate, settings-remove and transfer journeys were not executed; the transfer one additionally needs regtest funds on a hidden wallet.
• CI: standard compile, unit test and detekt checks run by the PR bot.

Known gaps

• A hidden wallet can persist with only part of its accounts when a read fails with a device error that is not classified as transient, and its wallet id would change once the missing accounts are read. This is a pre-existing gap in the partial-save guard that passphrase sessions make easier to hit.
• Two hidden wallets on the same device default to the same name until renamed, since the default label is the device name.

[greptile-apps]

Greptile Summary

The PR adds independently tracked Trezor hidden-wallet identities and passphrase-based session restoration while preserving wallet-scoped balances, activity, labels, signing, and removal.

• Keys hardware-wallet state and watchers by derived wallet identity instead of transport ID.
• Adds passphrase pairing and signing-reconnection flows with wallet-identity verification.
• Keeps sibling identities and transport credentials when removing one hidden wallet.
• Refreshes stale Trezor Bridge sessions before retrying acquisition.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt	Moves hardware-wallet aggregation, watcher lifecycle, signing, and removal to wallet-identity scope; the previously reported multi-transport removal issue is addressed.
app/src/main/java/to/bitkit/repositories/TrezorRepo.kt	Persists multiple identities per physical device and manages passphrase-bound sessions while atomically filtering scoped removals.
app/src/main/java/to/bitkit/services/TrezorBridgeTransport.kt	Clears released sessions and retries acquisition after refreshing a stale Bridge session.
app/src/main/java/to/bitkit/viewmodels/TransferViewModel.kt	Integrates passphrase restoration and identity verification into hardware-wallet signing.
app/src/main/java/to/bitkit/ui/sheets/hardware/HwConnectViewModel.kt	Adds passphrase-wallet pairing, duplicate handling, and known-device discovery fallback.
app/src/main/java/to/bitkit/ui/screens/transfer/hardware/HwPassphrasePromptSheet.kt	Adds the intentionally unmasked, screenshot-protected passphrase prompt used to restore signing sessions.

Sequence Diagram

sequenceDiagram
participant UI as Hardware Wallet UI
participant HW as HwWalletRepo
participant TR as TrezorRepo
participant Device as Trezor
participant Store as HwWalletStore
UI->>HW: connectWithPassphrase(deviceId, passphrase)
HW->>TR: set/connect passphrase wallet mode
TR->>Device: Open fresh passphrase session
Device-->>TR: Features and account keys
TR->>Store: Persist identity by derived wallet ID
TR-->>HW: Connected wallet identity
HW-->>UI: Add or select hidden-wallet tile
UI->>HW: Sign from wallet ID
alt matching session is live
HW->>Device: Sign transaction
else session is absent or belongs to another identity
UI->>HW: reconnectWithPassphrase(walletId, passphrase)
HW->>TR: Open fresh passphrase session
TR->>Device: Read account keys
alt derived wallet ID matches
HW->>Device: Sign transaction
else derived wallet ID differs
HW->>TR: Disconnect stray session
HW-->>UI: Reject passphrase mismatch
end
end

Loading

_{Reviews (3): Last reviewed commit: "fix: passphrase should not gate pending ..." | Re-trigger Greptile}

[jvsena42]

checking CI failures

Edit: both are backend failures

[jvsena42]

All test passing. Re-runned manual tests checklist with journeys

[ovitrif]

Looks good, passphrase identities stay scoped to their own tiles, session, and removal without replacing the standard wallet.