Sync: read device_info in the device list, preferring it over legacy device data

[CDRussell]

Task/Issue URL: https://app.asana.com/1/137249556945/project/72649045549333/task/1216792641477211?focus=true
Tech Design URL (if applicable): https://app.asana.com/1/137249556945/project/72649045549333/task/1215838110052947?focus=true
API Proposals URL(s) (if applicable):

Description

Adds the read side of the unified device list, reading from device_info where it can and preferring that over the legacy device name/type.
Gated by sync feature flag: canReadUnifiedDeviceList. The logic is defined in Define feature flag for unified device list support [ 2h ] for when flag is enabled and disabled. When the flag is on, undecryptable devices are no longer logged out; they render as "Unknown device"

Adds in-memory cache of the wrapped account_info key entry in RealAccountInfoPrivateKeyProvider, as otherwise it's unnecessarily hammering the server and will get rate limited.

Pixels will come later.

Steps to test this PR

Note

Logcat filter: Sync-UnifiedDevices

Setup

• Fresh install internal build
• Launch Sync Dev Settings and tap Create account to quickly set up sync
• Find the "Unified Devices Migration" section in the dev screen and enable both canReadUnifiedDeviceList and canWriteUnifiedDeviceList toggles

Device list reads from legacy when device_info omitted

• Scroll to top and tap Launch Sync Settings to visit production Sync & Backup screen
• Verify you see a single device (your one), with its name rendering correctly
• Verify in logs: 0 via device_info, 1 via legacy

Device list reads from device_info if it's available

• Go back to Sync Dev Settings and tap Run migration now, verifying that migrated: true
• Scroll to top and tap Launch Sync Settings to visit production Sync & Backup screen
• Verify in logs: 1 via device_info, 0 via legacy

Warning

For the error handling scenarios, don't use this with your real sync setup as it could log other devices out

Note

Sync with another device so that you have 2 devices connected. You're about to apply patches to one of them to test error handling.

Error handling (device_info undecryptable)

• Apply "Patch A: device_info undecryptable" to one device (let's call it DEVICE A), install and launch app
• Visit Sync Dev Settings and tap Launch Sync Settings to visit production Sync & Backup screen
• Verify in logs that DEV forcing device_info undecryptable to confirm the patch is working, and
• Verify in logs 0 via device_info, 2 via legacy

Error handling (legacy undecryptable)

• Discard local changes (to get rid of first patch)
• Apply "Patch B: legacy undecryptable" to DEVICE A only, install and launch app
• Visit Sync Dev Settings and tap Launch Sync Settings to visit production Sync & Backup screen
• Verify in logs that 2 devices → 1 via device_info, 0 via legacy, 1 placeholder, 0 undecryptable

Error handling (legacy undecryptable with canRead FF off)

• Still on DEVICE A (with the patch), disable canReadUnifiedDeviceList, then return to production device list. This will auto-logout the other device, so you'll see:
  • Verify in logs, first 2 devices → 0 via device_info, 1 via legacy, 0 placeholder, 1 undecryptable
  • And then after a few seconds, 1 devices → 0 via device_info, 1 via legacy, 0 placeholder, 0 undecryptable

---

Note

Medium Risk
Changes production device-list decryption and when peers are auto-logged out (flag-gated), plus sync key fetch caching; crypto paths are involved but plaintext keys are not cached and legacy behavior remains when the flag is off.

Overview
Adds the read path for the unified device list behind canReadUnifiedDeviceList. When enabled, connected devices are decrypted from cross-credential device_info (one DeviceInfoDecryptor session per list) when present, with legacy name/type as fallback; when the flag is off, behavior stays on the legacy-only path.

With the read flag on, decrypt failures no longer feed undecryptable for auto-logout—devices show as "Unknown device" placeholders instead (flag off keeps the existing logout rules for confirmed corruption).

RealAccountInfoPrivateKeyProvider now caches only the wrapped account_info key per user+credential (single GET /sync/keys under burst reads), clears on sign-out, and still unwraps on every privateKey() call.

Internal Sync Dev Settings adds a canReadUnifiedDeviceList toggle alongside the write flag.

^{Reviewed by Cursor Bugbot for commit 48da81b. Configure here.}

[CDRussell]

• Remove gzip exclusion from /sync/devices endpoint now that backend supports it #9405 : 2 dependent PRs (#9415 , #9418 )
• Sync: read device_info in the device list, preferring it over legacy device data #9395 👈 (View in Graphite)
• develop

This stack of pull requests is managed by Graphite. Learn more about stacking.

[MiSikora]

@CDRussell I approved the PR but I left a comment in Asana. Please take a look before merging.