From 8a4f9382e464d46beea6966c20b33f5ea5921362 Mon Sep 17 00:00:00 2001
From: Guoguo <i@qwq.trade>
Date: Fri, 12 Jun 2026 09:02:43 -0700
Subject: [PATCH] =?UTF-8?q?fix:=20audit=20fixes=20=E2=80=94=20add=20checks?=
 =?UTF-8?q?um=5Fok=20to=20params=20parse,=20passthrough=20control=20in=20c?=
 =?UTF-8?q?ommand-sync?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- parseVendorStatus: add checksum_ok verification for 34-byte and 33-byte params
- command-sync.js: passthrough control, current_gain, hold_time from server payload
- Mark buildVendorCommand33 as deprecated alias
---
 miniprogram/services/ble/protocol.js | 5 +++++
 miniprogram/services/command-sync.js | 5 ++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/miniprogram/services/ble/protocol.js b/miniprogram/services/ble/protocol.js
index 0fcf116..93d8985 100644
--- a/miniprogram/services/ble/protocol.js
+++ b/miniprogram/services/ble/protocol.js
@@ -206,6 +206,7 @@ function buildVendorCommand(options) {
   return bytes
 }
 
+// deprecated: alias kept for backward compat, actually outputs 34 bytes
 function buildVendorCommand33(options) {
   return buildVendorCommand(options)
 }
@@ -259,6 +260,7 @@ function parseVendorStatus(buffer) {
         gain: (bytes[off34 + 4] << 8) | bytes[off34 + 5]
       })
     }
+    var expected34 = xorChecksum(bytes.slice(0, 33))
     return {
       type: 'params',
       is_heartbeat: false,
@@ -266,6 +268,7 @@ function parseVendorStatus(buffer) {
       hold_time: (bytes[30] << 8) | bytes[31],
       control: bytes[32],
       checksum: bytes[33],
+      checksum_ok: expected34 === bytes[33],
       raw_hex: bytesToHex(bytes)
     }
   }
@@ -279,6 +282,7 @@ function parseVendorStatus(buffer) {
         gain: (bytes[off + 4] << 8) | bytes[off + 5]
       })
     }
+    var expected33 = xorChecksum(bytes.slice(0, 32))
     return {
       type: 'params',
       is_heartbeat: false,
@@ -286,6 +290,7 @@ function parseVendorStatus(buffer) {
       hold_time: (bytes[30] << 8) | bytes[31],
       control: -1,
       checksum: bytes[32],
+      checksum_ok: expected33 === bytes[32],
       raw_hex: bytesToHex(bytes)
     }
   }
diff --git a/miniprogram/services/command-sync.js b/miniprogram/services/command-sync.js
index c27912d..01b235a 100644
--- a/miniprogram/services/command-sync.js
+++ b/miniprogram/services/command-sync.js
@@ -16,7 +16,10 @@ function execute(command) {
         wavelength: payload.wavelength,
         brightness: payload.brightness,
         duration_ms: payload.duration_ms,
-        mode: payload.mode
+        mode: payload.mode,
+        control: payload.control,
+        current_gain: payload.current_gain,
+        hold_time: payload.hold_time
       })
     case ble.CMD.START:
       return ble.startTreatment(payload.region_mask)