feat: blind passphrase confirmation + PIN entry via physical keyboard

Passphrase: replace the show-and-confirm (Yes/No) screen with a second,
deliberately blank, keyboard entry titled Confirm Passphrase; the two
entries are compared and a mismatch restarts entry from scratch. The
old display-confirm activity is removed, and both entry buffers are
registered with the sensitive-data stack.

PIN/number entry: accept physical keyboard input alongside the wheel.
Adds gui_activity_wait_event_of_either_base() so the digit-entry loop
can wait on gui navigation and keyboard button events simultaneously.
Digits accepted as ascii 0-9 plus the letter keys with digits printed
on them on the T-Deck (w,e,r,s,d,f,z,x,c = 1-9); backspace steps back
(abandoning entry on the first digit), enter completes index entry.

Also log raw keyboard bytes at DEBUG level to identify unmapped keys
(eg. the mic key, which carries the printed 0).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 3rdIteration

main/gui.c

@@ -2767,6 +2767,31 @@ bool gui_activity_wait_event(gui_activity_t* activity, const char* event_base, u
     return ret == ESP_OK;
 }
 
+// As gui_activity_wait_event, but registered for (any event id of) two event bases,
+// eg. to wait on gui navigation events and keyboard button events at the same time.
+bool gui_activity_wait_event_of_either_base(gui_activity_t* activity, const char* event_base1,
+    const char* event_base2, esp_event_base_t* trigger_event_base, int32_t* trigger_event_id,
+    void** trigger_event_data, const TickType_t max_wait)
+{
+    JADE_ASSERT(activity);
+    JADE_ASSERT(event_base1);
+    JADE_ASSERT(event_base2);
+
+    // create a new wait-event-data structure and attach to the activity, which takes ownership
+    wait_event_data_t* const wait_event_data = gui_activity_make_wait_event_data(activity);
+    JADE_ASSERT(wait_event_data);
+
+    // register both bases against the same wait data so either can wake the caller
+    gui_activity_register_event(activity, event_base1, ESP_EVENT_ANY_ID, sync_wait_event_handler, wait_event_data);
+    gui_activity_register_event(activity, event_base2, ESP_EVENT_ANY_ID, sync_wait_event_handler, wait_event_data);
+
+    // immediately start waiting
+    const esp_err_t ret
+        = sync_wait_event(wait_event_data, trigger_event_base, trigger_event_id, trigger_event_data, max_wait);
+
+    return ret == ESP_OK;
+}
+
 int32_t gui_activity_wait_button(gui_activity_t* activity, const int32_t default_event_id)
 {
     int32_t ev_id = default_event_id;

main/gui.h

@@ -470,6 +470,9 @@ void gui_activity_register_event(
     gui_activity_t* activity, const char* event_base, uint32_t event_id, esp_event_handler_t handler, void* args);
 bool gui_activity_wait_event(gui_activity_t* activity, const char* event_base, uint32_t event_id,
     esp_event_base_t* trigger_event_base, int32_t* trigger_event_id, void** trigger_event_data, TickType_t max_wait);
+bool gui_activity_wait_event_of_either_base(gui_activity_t* activity, const char* event_base1,
+    const char* event_base2, esp_event_base_t* trigger_event_base, int32_t* trigger_event_id,
+    void** trigger_event_data, TickType_t max_wait);
 int32_t gui_activity_wait_button(gui_activity_t* activity, int32_t default_event_id);
 
 void gui_set_activity_initial_selection(gui_view_node_t* node);

main/input/tdeck.inc

@@ -59,6 +59,7 @@ static void tdeck_keyboard_task(void* unused)
         uint8_t key_byte = 0;
         const esp_err_t ret = i2c_master_receive(kb_i2c_dev, &key_byte, 1, KB_I2C_TIMEOUT_MS);
         if (ret == ESP_OK && key_byte != 0) {
+            JADE_LOGD("keyboard key 0x%02x", key_byte);
             if (key_byte == 0x0D) {
                 esp_event_post(GUI_BUTTON_EVENT, BTN_KEYBOARD_ENTER, NULL, 0, portMAX_DELAY);
             } else if (key_byte == 0x08) {

main/process/mnemonic.c

@@ -47,7 +47,6 @@ gui_activity_t* make_enter_wordlist_word_activity(gui_view_node_t** titletext, b
     size_t keys_len);
 gui_activity_t* make_calculate_final_word_activity(void);
 
-gui_activity_t* make_confirm_passphrase_activity(const char* passphrase, gui_view_node_t** textbox);
 
 gui_activity_t* make_export_qr_overview_activity(const Icon* icon, bool initial);
 gui_activity_t* make_export_qr_fragment_activity(
@@ -1190,13 +1189,9 @@ static void get_freetext_passphrase(char* passphrase, const size_t passphrase_le
     JADE_ASSERT(passphrase_len);
     passphrase[0] = '\0';
 
-    // We will need this activity later when confirming
-    gui_view_node_t* text_to_confirm = NULL;
-    gui_activity_t* const confirm_passphrase_activity = make_confirm_passphrase_activity(passphrase, &text_to_confirm);
-    int32_t ev_id;
-
     // For passphrase we want all 4 keyboards
     keyboard_entry_t kb_entry = { .max_allowed_len = passphrase_len - 1 };
+    SENSITIVE_PUSH(kb_entry.strdata, sizeof(kb_entry.strdata));
     kb_entry.keyboards[0] = KB_LOWER_CASE_CHARS;
     kb_entry.keyboards[1] = KB_UPPER_CASE_CHARS;
     kb_entry.keyboards[2] = KB_NUMBERS_SYMBOLS;
@@ -1206,20 +1201,39 @@ static void get_freetext_passphrase(char* passphrase, const size_t passphrase_le
     make_keyboard_entry_activity(&kb_entry, "Enter Passphrase");
     JADE_ASSERT(kb_entry.activity);
 
+    // A second, deliberately blank, entry screen to confirm by blind re-entry
+    // (do not display or pre-populate with the initial entry)
+    keyboard_entry_t kb_confirm = { .max_allowed_len = passphrase_len - 1 };
+    SENSITIVE_PUSH(kb_confirm.strdata, sizeof(kb_confirm.strdata));
+    memcpy(kb_confirm.keyboards, kb_entry.keyboards, sizeof(kb_entry.keyboards));
+    kb_confirm.num_kbs = kb_entry.num_kbs;
+
+    make_keyboard_entry_activity(&kb_confirm, "Confirm Passphrase");
+    JADE_ASSERT(kb_confirm.activity);
+
     bool done = false;
     while (!done) {
         // Run the keyboard entry loop to get a typed passphrase
         run_keyboard_entry_loop(&kb_entry);
 
-        // Ask user to confirm passphrase
-        gui_update_text(text_to_confirm, kb_entry.len > 0 ? kb_entry.strdata : "<no passphrase>");
-        gui_set_current_activity(confirm_passphrase_activity);
-        gui_activity_wait_event(confirm_passphrase_activity, GUI_BUTTON_EVENT, ESP_EVENT_ANY_ID, NULL, &ev_id, NULL, 0);
-        done = (ev_id == BTN_YES);
+        // Ask user to re-enter the passphrase to confirm
+        kb_confirm.strdata[0] = '\0';
+        kb_confirm.len = 0;
+        run_keyboard_entry_loop(&kb_confirm);
+
+        done = (kb_entry.len == kb_confirm.len) && !strcmp(kb_entry.strdata, kb_confirm.strdata);
+        if (!done) {
+            // Mismatch - start over from scratch
+            await_error_2("Passphrases do not", "match - please retry");
+            kb_entry.strdata[0] = '\0';
+            kb_entry.len = 0;
+        }
     }
 
     JADE_ASSERT(kb_entry.len < passphrase_len);
     strcpy(passphrase, kb_entry.strdata);
+    SENSITIVE_POP(kb_confirm.strdata);
+    SENSITIVE_POP(kb_entry.strdata);
 }
 
 void get_passphrase(char* passphrase, const size_t passphrase_len)

main/ui/digit_entry.c

@@ -4,6 +4,11 @@
 #include "../random.h"
 #include "../ui.h"
 
+#ifdef CONFIG_HAS_KEYBOARD
+#include <ctype.h>
+#include <string.h>
+#endif
+
 #define CHAR_BACKSPACE '|'
 #define CHAR_ENTER '~'
 static const char ENTRY_CHARS[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', CHAR_BACKSPACE, CHAR_ENTER };
@@ -202,6 +207,63 @@ static bool prev_selected_digit(digit_entry_t* digit_entry)
     return true;
 }
 
+#ifdef CONFIG_HAS_KEYBOARD
+// Map physical key events to digits. Accept actual ascii digits, plus the
+// letter keys which have digits printed on them on the T-Deck keyboard:
+// w=1 e=2 r=3 s=4 d=5 f=6 z=7 x=8 c=9 (0 is on the mic key).
+static int keyboard_event_digit(const int32_t ev_id)
+{
+    static const char digit_key_aliases[] = "wersdfzxc"; // 1-9
+
+    if (ev_id <= BTN_KEYBOARD_ASCII_OFFSET) {
+        return -1;
+    }
+    const int ch = tolower(ev_id - BTN_KEYBOARD_ASCII_OFFSET);
+    if (ch >= '0' && ch <= '9') {
+        return ch - '0';
+    }
+    const char* const alias = strchr(digit_key_aliases, ch);
+    if (alias) {
+        return (alias - digit_key_aliases) + 1;
+    }
+    return -1;
+}
+
+// Handle a physical keyboard event - returns true (with 'done' set) when
+// entry is complete or abandoned, false to continue the entry loop.
+static bool handle_keyboard_event(digit_entry_t* digit_entry, const int32_t ev_id, bool* done)
+{
+    JADE_ASSERT(digit_entry);
+    JADE_ASSERT(done);
+
+    if (ev_id == BTN_KEYBOARD_BACKSPACE) {
+        if (!prev_selected_digit(digit_entry)) {
+            // Backspace on first digit - entry abandoned
+            *done = false;
+            return true;
+        }
+    } else if (ev_id == BTN_KEYBOARD_ENTER) {
+        // Only valid for 'index' entry (short numbers) - PIN requires all digits
+        if (digit_entry->entry_type == DIGIT_ENTRY_INDEX) {
+            // Enter on first digit abandons entry, otherwise completes it
+            *done = (digit_entry->selected_digit > 0);
+            return true;
+        }
+    } else {
+        const int digit = keyboard_event_digit(ev_id);
+        if (digit >= 0) {
+            digit_entry->current_selected_value = digit;
+            if (!next_selected_digit(digit_entry)) {
+                // Last digit typed - entry complete
+                *done = true;
+                return true;
+            }
+        }
+    }
+    return false;
+}
+#endif // CONFIG_HAS_KEYBOARD
+
 // Returns true if number entry completes and digit_entry->digit is valid,
 // and false if number entry abandoned and digit_entry->digit is not to be used.
 bool run_digit_entry_loop(digit_entry_t* digit_entry)
@@ -211,8 +273,22 @@ bool run_digit_entry_loop(digit_entry_t* digit_entry)
 
     int32_t ev_id;
     while (true) {
+#ifdef CONFIG_HAS_KEYBOARD
+        // Wait for a GUI event or a physical keyboard event
+        esp_event_base_t ev_base = NULL;
+        gui_activity_wait_event_of_either_base(
+            digit_entry->activity, GUI_EVENT, GUI_BUTTON_EVENT, &ev_base, &ev_id, NULL, 0);
+        if (ev_base == GUI_BUTTON_EVENT) {
+            bool done = false;
+            if (handle_keyboard_event(digit_entry, ev_id, &done)) {
+                return done;
+            }
+            continue;
+        }
+#else
         // wait for a GUI event
         gui_activity_wait_event(digit_entry->activity, GUI_EVENT, ESP_EVENT_ANY_ID, NULL, &ev_id, NULL, 0);
+#endif
         if (entry_invert_navigation()) {
             // Swap left/right wheel events
             if (ev_id == GUI_WHEEL_LEFT_EVENT) {

main/ui/mnemonic.c

@@ -383,34 +383,6 @@ gui_activity_t* make_calculate_final_word_activity(void)
     return act;
 }
 
-gui_activity_t* make_confirm_passphrase_activity(const char* passphrase, gui_view_node_t** textbox)
-{
-    JADE_ASSERT(passphrase);
-    JADE_INIT_OUT_PPTR(textbox);
-
-    gui_activity_t* const act = gui_make_activity();
-    gui_view_node_t* const parent = add_title_bar(act, "Confirm Passphrase", NULL, 0, NULL);
-
-    gui_view_node_t* vsplit;
-    gui_make_vsplit(&vsplit, GUI_SPLIT_RELATIVE, 2, 70, 30);
-    gui_set_parent(vsplit, parent);
-
-    // passphrase
-    gui_make_text(textbox, passphrase, TFT_WHITE);
-    gui_set_text_noise(*textbox, TFT_BLACK);
-    gui_set_parent(*textbox, vsplit);
-
-    gui_set_padding(*textbox, GUI_MARGIN_ALL_DIFFERENT, 12, 2, 0, 4);
-    gui_set_align(*textbox, GUI_ALIGN_LEFT, GUI_ALIGN_TOP);
-
-    // third row, Yes and No buttons
-    btn_data_t ftrbtns[] = { { .txt = "No", .font = GUI_DEFAULT_FONT, .ev_id = BTN_NO, .borders = GUI_BORDER_TOPRIGHT },
-        { .txt = "Yes", .font = GUI_DEFAULT_FONT, .ev_id = BTN_YES, .borders = GUI_BORDER_TOPLEFT } };
-    add_buttons(vsplit, UI_ROW, ftrbtns, 2);
-
-    return act;
-}
-
 gui_activity_t* make_export_qr_overview_activity(const Icon* icon, const bool initial)
 {
     JADE_ASSERT(icon);