Summary
Franklin installations can contain both the legacy Solana wallet record, ~/.blockrun/solana-wallet.json, and the canonical session file, ~/.blockrun/.solana-session.
In the SDK bundled through Franklin 3.35.5 and earlier (@blockrun/llm@3.5.2), startup scanned ~/.*/solana-wallet.json files and selected the newest candidate. This included the legacy Franklin JSON file.
Starting with Franklin 3.35.6 (bundling @blockrun/llm@3.8.3, also used by 3.38.0), wallet selection was intentionally tightened: normal startup now selects only SOLANA_WALLET_KEY, then ~/.blockrun/.solana-session, then creates a new wallet. The legacy JSON file is no longer selected.
This security correction can expose an invalid/stale canonical session, or make a customer appear to switch away from their historical Franklin address after upgrade. The issue is independent of any particular third-party wallet provider.
Expected
Upgrading Franklin must not silently change the active Solana wallet when a valid legacy Franklin wallet exists. No private key should be exposed to support or telemetry.
Proposed recovery / migration behavior
- Inspect both canonical session and legacy Franklin wallet locally.
- Derive only public addresses; never log or transmit private keys.
- If canonical session is invalid and legacy wallet is valid, offer safe recovery to the legacy wallet.
- If both are valid but differ, show both public addresses and require explicit customer selection.
- Back up before changing the canonical session.
- Persist non-secret provenance metadata (created by Franklin vs. migrated legacy wallet) for future support.
Acceptance criteria
- Regression tests cover installations with only legacy JSON, only canonical session, invalid canonical + valid legacy, and two valid but different wallets.
- UI/CLI recovery does not require customers to run shell commands or share wallet files/private keys.
- Active-wallet selection is deterministic and visible through a non-secret source label.
Notes
The SDK selection behavior changed in Franklin 3.35.6; customers may first notice it on a later upgrade such as 3.38.0 because that release still bundles the newer SDK.
Summary
Franklin installations can contain both the legacy Solana wallet record,
~/.blockrun/solana-wallet.json, and the canonical session file,~/.blockrun/.solana-session.In the SDK bundled through Franklin 3.35.5 and earlier (
@blockrun/llm@3.5.2), startup scanned~/.*/solana-wallet.jsonfiles and selected the newest candidate. This included the legacy Franklin JSON file.Starting with Franklin 3.35.6 (bundling
@blockrun/llm@3.8.3, also used by 3.38.0), wallet selection was intentionally tightened: normal startup now selects onlySOLANA_WALLET_KEY, then~/.blockrun/.solana-session, then creates a new wallet. The legacy JSON file is no longer selected.This security correction can expose an invalid/stale canonical session, or make a customer appear to switch away from their historical Franklin address after upgrade. The issue is independent of any particular third-party wallet provider.
Expected
Upgrading Franklin must not silently change the active Solana wallet when a valid legacy Franklin wallet exists. No private key should be exposed to support or telemetry.
Proposed recovery / migration behavior
Acceptance criteria
Notes
The SDK selection behavior changed in Franklin 3.35.6; customers may first notice it on a later upgrade such as 3.38.0 because that release still bundles the newer SDK.