kleidos/src/ui/debug/ at main · jmrp.io/kleidos · Tangled

jmrp.io / kleidos

0

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

0

kleidos / src / ui / debug /

at main 10 files

José M. Requena Plens Add the WiFi-station store and NTP clock-sync backend 5d ago

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

5 days ago

debug_console.cpp

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

5 days ago

debug_console.h

docs: fix Doxygen doc-lint errors (74 -> 0) Clear all pre-existing doc-lint failures so the API-docs gate passes: - Add @param/@return to documented members that were missing them (Inplace{Vector,String,Queue,Function} accessors and constructors, app_runtime FSM seams, debug_console::handleCmd, button setState, TDeckTouch::injectDrag). - Fix unresolvable \ref commands: drop the stray trailing colon that the parser swallowed into the target, qualify namespace-scope references in @file blocks, and downgrade ambiguous unqualified member references (names shared across containers) and overload-by-signature references to @c code spans. Comment-only; no functional change. Verified with doxygen 1.17.0 (the CI pin): doxygen Doxyfile exits 0.

1 month ago

debug_diagnostics.cpp

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

5 days ago

debug_internal.h

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

5 days ago

Add NAV SETCLOCK and TOTPCODE debug hooks and wire the deferred QA Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 week ago

debug_popup.cpp

Rename VaultStateHandler to HomeStateHandler (home_state, AppState::Home) The FSM state handler was misnamed — "vault" belongs to the storage/crypto layer (src/vault/, VaultStore, VaultCrypto), whereas this handler is the post-unlock home orchestrator (menu + settings + admin + device config + BLE hosts + cred-detail). Rename it throughout: class VaultStateHandler -> HomeStateHandler; files src/states/vault_state.{h,cpp} -> home_state.{h,cpp} (+ the mirror test test_vault_state -> test_home_state); enum AppState::VaultMenu -> AppState::Home; the debug screen-name strings "VAULT_MENU/..." -> "HOME/..."; the appStateName() label "VAULT_MENU" -> "HOME"; the "requires VAULT_MENU" debug messages; and the FSM references in the docs, .github skills/agents, and QA scripts. The GOTO debug command keeps "VAULT_MENU" as a back-compat alias alongside the new "HOME". The src/vault/ storage/crypto layer keeps "vault" (correct usage); the VaultMenuView / vault_row_widgets / cred_row_cache helpers keep their names (they name the vault-contents menu, still accurate). Pure rename, no logic change. Verified: native 1168/1168, pio check clean, guards, full fleet -Werror (9 variants + debug), and on-device QA on Stick S3 + M5Stack Gray (boot, PIN dial via PinEntryRenderer, home menu nav, HOME/... state strings). Completes the vault-state god-object split: HomeStateHandler is device-agnostic and ~30 methods / ~16 fields, under the Sonar S1448/S1820 thresholds. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

2 weeks ago

debug_regmap.cpp

Wire RTC_CNTL MMIO introspection into the registry, console and QA Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 week ago

serial_debug.cpp

Feed the watchdog during debug screenshot dumps on classic boards streamFramebufferScreenshot emits the whole frame inside one command handler on the TWDT-subscribed loop task. On classic-ESP32 boards behind a 115200 UART bridge the dump takes ~25 s while the watchdog window is 5 s, so the TWDT panicked mid-dump (plus2 at ~157/240 rows, coreink at ~109/200) and rebooted the DUT. Feed the task watchdog through the platform facade every 8 rows (~1 s of UART time worst case); a no-op microseconds-scale call on fast USB-JTAG links, so S3 dumps are unaffected. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 week ago

Rename VaultStateHandler to HomeStateHandler (home_state, AppState::Home) The FSM state handler was misnamed — "vault" belongs to the storage/crypto layer (src/vault/, VaultStore, VaultCrypto), whereas this handler is the post-unlock home orchestrator (menu + settings + admin + device config + BLE hosts + cred-detail). Rename it throughout: class VaultStateHandler -> HomeStateHandler; files src/states/vault_state.{h,cpp} -> home_state.{h,cpp} (+ the mirror test test_vault_state -> test_home_state); enum AppState::VaultMenu -> AppState::Home; the debug screen-name strings "VAULT_MENU/..." -> "HOME/..."; the appStateName() label "VAULT_MENU" -> "HOME"; the "requires VAULT_MENU" debug messages; and the FSM references in the docs, .github skills/agents, and QA scripts. The GOTO debug command keeps "VAULT_MENU" as a back-compat alias alongside the new "HOME". The src/vault/ storage/crypto layer keeps "vault" (correct usage); the VaultMenuView / vault_row_widgets / cred_row_cache helpers keep their names (they name the vault-contents menu, still accurate). Pure rename, no logic change. Verified: native 1168/1168, pio check clean, guards, full fleet -Werror (9 variants + debug), and on-device QA on Stick S3 + M5Stack Gray (boot, PIN dial via PinEntryRenderer, home menu nav, HOME/... state strings). Completes the vault-state god-object split: HomeStateHandler is device-agnostic and ~30 methods / ~16 fields, under the Sonar S1448/S1820 thresholds. Claude-Session: https://claude.ai/code/session_01Y7Cy1HetRp6TZAUAeekN8X

2 weeks ago