Merge branch 'develop' into 2133-allow-creating-transactions-with-less-than-1-satvbyte-fee-rate

# Conflicts:
#	lib/features/send/ui/screens/send_screen.dart
#	test/features/send/presentation/bloc/send_state_test.dart

Author: ethicnology

.devcontainer/README.md

@@ -1,19 +1,81 @@
 # Dev Container
 
+Two host-specific configurations live side by side. They build the **same**
+image (the repo-root `Containerfile.tools`) but each folder is
+**self-contained** — it carries its own copy of the lifecycle scripts it needs
+(they are not shared).
+They differ only in the host integration the runtime can provide:
+
+| Config | Use on | Notable extras |
+| --- | --- | --- |
+| [`linux/devcontainer.json`](linux/devcontainer.json) | Linux hosts | GPU (`/dev/dri`), X11/Wayland forwarding, SSH-agent forwarding, gnome-keyring for the Flutter Linux desktop GUI |
+| [`macos/devcontainer.json`](macos/devcontainer.json) | macOS (Apple Silicon) | Rosetta bootstrap; GUI/GPU, SSH-agent and keyring all omitted (the VM can't provide them) |
+
 ## Usage
 
+`make devcontainer` auto-selects the config for your host OS (override with
+`make devcontainer DEVCONTAINER_OS=linux|macos`). It **reuses an existing
+container if one is present** — it only builds/creates when no container exists
+yet, otherwise it just (re)starts it (replaying the Linux keyring bootstrap,
+which dies on stop). So stopping and starting is safe and never rebuilds.
+
+The container is named **`bull`** — a static `--name` pinned in both `devcontainer.json` files and mirrored by `DEVCONTAINER_NAME` in the makefile — so repeated opens reuse the one container instead of creating a per-folder one. The workspace itself still mounts at `/workspaces/<checkout-folder>`. Because the name is shared, two different clones/worktrees can't each run their own container side by side: the second open attaches to whichever tree was mounted first.
+
 ```bash
-devcontainer up --workspace-folder . --config ./.devcontainer/devcontainer.json
+make devcontainer                          # host-detected
+make devcontainer DEVCONTAINER_OS=linux    # force linux
+make devcontainer DEVCONTAINER_OS=macos    # force macos
 ```
 
-## macOS (Apple Silicon)
+> **Applying a config change:** because `make devcontainer` never recreates an
+> existing container, edits to `devcontainer.json` / `Containerfile.tools` won't
+> take effect until you remove the old container first:
+> `podman rm -f bull && make devcontainer`.
 
-Before starting the container, run the setup script:
+Or invoke the CLI directly (this *will* recreate on a config change):
 
 ```bash
-.devcontainer/macos-setup.sh
+devcontainer up --workspace-folder . --config ./.devcontainer/linux/devcontainer.json
+devcontainer up --workspace-folder . --config ./.devcontainer/macos/devcontainer.json
 ```
 
-This ensures Rosetta is active in the Podman VM. Without it, x86_64 binaries fall back to QEMU and crash with SIGSEGV. See [containers/podman#28181](https://github.com/containers/podman/issues/28181).
+In VS Code, "Reopen in Container" prompts you to choose between the two.
+
+> The `devcontainer` CLI builds its **own** image (`vsc-bull-…`) from
+> `Containerfile.tools`; it does not reuse the `bull-tools` tag from
+> `make container-tools` (that one bakes a different `USERNAME` and so shares no
+> layer cache). `make devcontainer` therefore has no `container-tools`
+> prerequisite — only `container-app`/`android` build `bull-tools`.
+
+## macOS (Apple Silicon) notes
+
+The macOS target is the Android (x86_64-via-Rosetta) build + tests, not the
+Linux desktop GUI. The macOS config is a trimmed sibling of the Linux one.
+
+- **Rosetta** must be active in the podman VM, otherwise the linux/amd64 base
+  image falls back to QEMU and crashes with SIGSEGV
+  ([containers/podman#28181](https://github.com/containers/podman/issues/28181)).
+  It is on by default for Apple Silicon machines (podman ≥ 5.1).
+  [`macos/macos-setup.sh`](macos/macos-setup.sh) runs automatically via
+  `initializeCommand`; if Rosetta is off it sets the marker and restarts the
+  machine (a service-only restart is not enough).
+- **No GUI / GPU forwarding.** `--device=/dev/dri` and the X11/Wayland mounts
+  are dropped: applehv exposes no DRI node and macOS has no Linux display
+  server.
+- **No SSH-agent forwarding.** Impossible through the podman VM on macOS
+  (virtiofs; [containers/podman#23785](https://github.com/containers/podman/issues/23785)).
+  The agent socket is not mounted at all; `~/.ssh` is still mounted read-only,
+  so key-based (non-agent) auth works.
+- **No keyring/dbus bootstrap.** `flutter_secure_storage_linux` (libsecret)
+  only exercises the Secret Service when the rendered Linux app runs, which
+  macOS can't display — so the gnome-keyring bootstrap the Linux config does at
+  `postStart` is omitted.
+
+## adb device bridge (both configs)
 
-**Note:** SSH agent forwarding is not supported on macOS due to Podman's inability to mount host Unix sockets into containers through the VM layer. See [containers/podman#23785](https://github.com/containers/podman/issues/23785).
+[`init-adb.sh`](linux/init-adb.sh) exposes the **host's** adb server to the
+container (`ADB_SERVER_SOCKET=tcp:host.containers.internal:5037`) so a host-side
+device or emulator is reachable from inside. Note it (re)starts the host adb
+server with `-a` (binds `0.0.0.0:5037`) — see the security note in the script
+before using it on an untrusted network. Host and container adb versions must
+match.

.devcontainer/devcontainer.json

@@ -0,0 +1,53 @@
+// Linux host dev container. Builds ../../Containerfile.tools and forwards the
+// host GPU (/dev/dri) + X11/Wayland so the Flutter Linux desktop GUI can run.
+{
+  "name": "bull",
+  "build": {
+    "dockerfile": "../../Containerfile.tools",
+    "args": {
+      "USERNAME": "${localEnv:USER}",
+    },
+  },
+  "remoteUser": "${localEnv:USER}",
+  "updateRemoteUserUID": true,
+  "shutdownAction": "stopContainer",
+  "initializeCommand": "sh -c '.devcontainer/linux/init-ssh-agent.sh && .devcontainer/linux/init-adb.sh'",
+  "runArgs": [
+    "--name",
+    "bull",
+    "--hostname",
+    "bull",
+    "--memory=8g",
+    "--device=/dev/dri",
+    // Pin DNS to public resolvers: podman's VM/netns default resolver has been
+    // unreliable for pub.dev/crates.io fetches. On networks that require an
+    // internal/split-horizon resolver (corp VPN, captive portal), drop or
+    // change these two pairs.
+    "--dns",
+    "1.1.1.1",
+    "--dns",
+    "9.9.9.9",
+    "--security-opt",
+    "label=disable",
+  ],
+  "mounts": [
+    "source=${localEnv:HOME}/.ssh,target=/home/${localEnv:USER}/.ssh,type=bind,readonly",
+    "source=${localEnv:HOME}/.ssh-agent-devcontainer.sock,target=/ssh-agent,type=bind",
+    "source=${localEnv:HOME}/.gitconfig,target=/home/${localEnv:USER}/.gitconfig,type=bind",
+    "source=/tmp/.X11-unix,target=/tmp/.X11-unix,type=bind",
+    "source=bull-bash-history,target=/home/${localEnv:USER}/.history,type=volume",
+    "source=bull-keyrings,target=/home/${localEnv:USER}/.local/share/keyrings,type=volume",
+    "source=${localEnv:XDG_RUNTIME_DIR},target=/run/host-runtime,type=bind",
+  ],
+  "containerEnv": {
+    "SSH_AUTH_SOCK": "/ssh-agent",
+    "ADB_SERVER_SOCKET": "tcp:host.containers.internal:5037",
+    "DISPLAY": "${localEnv:DISPLAY}",
+    "XDG_RUNTIME_DIR": "/tmp",
+    "WAYLAND_DISPLAY": "/run/host-runtime/${localEnv:WAYLAND_DISPLAY}",
+    "GDK_BACKEND": "wayland,x11",
+    "DBUS_SESSION_BUS_ADDRESS": "unix:path=/tmp/dbus-session.sock",
+  },
+  "postCreateCommand": "sudo chown -R ${localEnv:USER}:${localEnv:USER} /home/${localEnv:USER}/.local /home/${localEnv:USER}/.history && touch /home/${localEnv:USER}/.history/bash_history",
+  "postStartCommand": ".devcontainer/linux/init-keyring.sh",
+}

.devcontainer/init-ssh-agent.sh

@@ -14,8 +14,15 @@
 # replug). adb's server binds to 127.0.0.1 by default — unreachable from the
 # container's network namespace — so we (re)start it with -a (all interfaces).
 #
-# NOTE: host and container adb must be the same version (container ships
-# platform-tools 37.0.0); a mismatch makes adb refuse to connect.
+# SECURITY: -a binds the adb server to 0.0.0.0:5037, so any host on the same
+# network can drive it (install APKs, open an adb shell). adb has no per-
+# interface bind for its server, so on untrusted networks (cafe/airport Wi-Fi)
+# either skip this adb bridge or firewall tcp/5037 to localhost + the podman
+# gateway.
+#
+# NOTE: host and container adb must be the same version or adb refuses to
+# connect. The container's platform-tools is whatever sdkmanager ships latest
+# (unpinned), so match the host to the container's `adb --version`.
 set -e
 
 # No adb on the host (or not on PATH) -> nothing to expose; the container falls

.devcontainer/linux/devcontainer.json

@@ -71,6 +71,6 @@ if ! keyring_ok; then
   echo "  killall -9 gnome-keyring-daemon dbus-daemon" >&2
   echo "  rm -f /tmp/dbus-session.sock" >&2
   echo "  rm -rf ~/.local/share/keyrings" >&2
-  echo "  .devcontainer/init-keyring.sh" >&2
+  echo "  .devcontainer/linux/init-keyring.sh" >&2
   exit 1
 fi

.devcontainer/init-adb.sh .devcontainer/linux/init-adb.sh.devcontainer/init-adb.sh renamed to .devcontainer/linux/init-adb.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+# Linux host: normalize bind-mount sources for the Linux dev container.
+#
+# Every bind mount in devcontainer.json is a hard dependency: if its host
+# source is missing at create/start time, the container fails to come up.
+# This script guarantees every source exists — real when available, harmless
+# placeholder when not — so the container starts regardless of whether SSH,
+# git, or an agent are set up. Missing pieces degrade gracefully.
+#
+# The SSH agent socket lives under $HOME so it is reachable by the runtime.
+# Wayland needs no action here: the Linux config forwards the host's
+# XDG_RUNTIME_DIR at /run/host-runtime and points WAYLAND_DISPLAY at it.
+SSH_SOCKET="${HOME}/.ssh-agent-devcontainer.sock"
+
+# ~/.ssh and ~/.gitconfig are bind-mounted into the container; a fresh machine
+# may lack either, which would fail the mount.
+mkdir -p "${HOME}/.ssh"
+[ -e "${HOME}/.gitconfig" ] || touch "${HOME}/.gitconfig"
+
+# X11 socket dir bind-mounted at /tmp/.X11-unix. Absent on headless or
+# Wayland-only hosts — create it so the mount never fails (an empty dir just
+# means no X11 apps, not a broken container).
+mkdir -p /tmp/.X11-unix
+
+# SSH agent: only symlink a *real* agent socket. If no agent is running,
+# $SSH_AUTH_SOCK is empty/stale — `ln -sf "" ...` would make a broken link.
+# Leave a placeholder file instead so the mount succeeds; the agent is simply
+# unavailable inside the container.
+if [ -n "$SSH_AUTH_SOCK" ] && [ -S "$SSH_AUTH_SOCK" ]; then
+  ln -sf "$SSH_AUTH_SOCK" "$SSH_SOCKET"
+else
+  rm -f "$SSH_SOCKET"
+  touch "$SSH_SOCKET"
+fi