Merge branch 'payjoin-salvage' into pj/07-announcements

Author: i5hi

.github/workflows/bullock.yml

@@ -76,7 +76,11 @@ jobs:
     # Write-access gating happens twice: the first step fails fast for
     # non-write actors, and claude-code-action enforces it again internally —
     # this `if` just avoids spinning a runner on unrelated comments.
-    if: contains(github.event.comment.body, '@bullock')
+    # The Bot filter matters because GITHUB_TOKEN comments never retrigger
+    # workflows (GitHub anti-recursion) but GitHub-App comments DO: a claude.yml
+    # review quoting "@bullock" from the thread would otherwise spin a runner
+    # and die red at the access gate — noise on the PR, wasted runner.
+    if: contains(github.event.comment.body, '@bullock') && github.event.comment.user.type != 'Bot'
     runs-on: ubuntu-24.04
     # analyze_and_test's checks job needs ~30min for setup + `make checks` alone;
     # Bullock adds Claude's implement/verify loop on top of the same prefix.
@@ -213,6 +217,13 @@ jobs:
       # format, and Write the verdict sentinel.
       - name: Bullock (Claude Code)
         if: steps.src.outputs.cross != 'true'
+        # Step-level timeout on purpose: the job-level 60min timeout CANCELS the
+        # job, and "Act on Bullock's verdict" is guarded by !cancelled() — so a
+        # job timeout would be a silent red run with no comment. A step timeout
+        # merely FAILS this step, which degrades to the no-valid-verdict comment.
+        # Budget: ~6min gate+setup before this step + 45 here + ~2 of git/PR
+        # plumbing after stays under the job's 60.
+        timeout-minutes: 45
         uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -272,6 +283,7 @@ jobs:
 
             ## Step 4 — Implement (ONLY if sufficient)
             - Change ONLY what was requested. No opportunistic refactors, no unrelated cleanup.
+            - NEVER modify anything under `.github/` (workflows, actions, CI config) — the workflow refuses to commit such changes. If the request requires a CI change, treat it as insufficient and say so in "question".
             - Follow AGENTS.md strictly: use `fvm`; respect the layer/facade/failure/naming rules; NEVER log or expose secrets (mnemonic/seed/xpriv/PIN); no hardcoded user-facing strings (use `context.loc.*`); no raw colors.
             - After editing, format your new/changed Dart files so the CI format gate can't fail on untracked files:
               run `fvm dart format` on the files you touched, then `git add -A` for the changed source (do NOT add `.bullock/`).
@@ -319,7 +331,10 @@ jobs:
 
           if [ "$sufficient" != "true" ]; then
             body="🐂 Bullock needs more info before implementing:"
-            body="${body}"$'\n\n'"> ${question:-Please clarify what you'd like changed.}"
+            # NB: no apostrophes inside ${var:-word} — bash treats a single
+            # quote there as a quoting char even inside double quotes, which
+            # made this whole script unparseable (exit 2 at EOF).
+            body="${body}"$'\n\n'"> ${question:-Please clarify what you would like changed.}"
             comment "$body"
             echo "Insufficient info — asked for clarification, no PR opened."
             exit 0
@@ -329,22 +344,27 @@ jobs:
           git config user.name "bullock[bot]"
           git config user.email "bullock@users.noreply.github.com"
 
-          # GITHUB_TOKEN cannot push changes under .github/workflows/ — the push
-          # (below) would be rejected AFTER commit, going red with no feedback.
-          # Bail early with an explanation. This is also a deliberate backstop
-          # against Bullock modifying its own workflow. `git status --porcelain`
-          # reports both tracked edits and new untracked files, and is checked
-          # before staging so a workflow-file change never enters the commit.
-          if [ -n "$(git status --porcelain -- .github/workflows)" ]; then
-            comment "🐂 Bullock's changes touch \`.github/workflows/\`, which a bot token isn't allowed to push. Please make workflow changes manually."
-            echo "Workflow files touched — declined (GITHUB_TOKEN cannot push workflows)."
+          # ALL of .github/ is off-limits to Bullock, for two distinct reasons:
+          # - .github/workflows/: GITHUB_TOKEN cannot push these — the push
+          #   (below) would be rejected AFTER commit, going red with no feedback.
+          # - the rest (.github/actions/ composite, CI config): the token CAN
+          #   push them, but they execute in future CI runs with secrets — a
+          #   prompt-injected change here must be blocked mechanically, not just
+          #   by the prompt's SECURITY section. Bullock has no legitimate reason
+          #   to touch CI; a maintainer changes it manually.
+          # `git status --porcelain` reports both tracked edits and new
+          # untracked files, and is checked before staging so a CI-file change
+          # never enters the commit.
+          if [ -n "$(git status --porcelain -- .github)" ]; then
+            comment "🐂 Bullock's changes touch \`.github/\` (workflows or CI config), which Bullock isn't allowed to modify. Please make CI changes manually."
+            echo "CI files touched — declined (.github/ is off-limits to Bullock)."
             exit 0
           fi
 
           # Stage only source changes; never sweep the whole tree (build_runner
           # drift, make side effects, stray artifacts) into the stacked PR, and
-          # never stage workflow files (guarded above).
-          git add -A -- ':(exclude).github/workflows'
+          # never stage CI files (guarded above).
+          git add -A -- ':(exclude).github'
 
           if git diff --cached --quiet; then
             comment "🐂 Bullock judged the request actionable but produced no changes. Please re-summon with a more specific instruction."

Containerfile.tools

@@ -161,15 +161,21 @@ RUN fvm install ${FLUTTER_VERSION} --verbose --no-setup
 RUN fvm global ${FLUTTER_VERSION}
 ENV PATH="/home/$USER/fvm/default/bin:${PATH}"
 
+
 # Download Android cmdline-tools
-RUN sudo wget -q https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS_VERSION}_latest.zip -O /tmp/android-cmdline-tools.zip
+# (USER root instead of sudo: setuid binaries are unreliable under rootless
+# podman user namespaces — sudo fails with "account validation failure" —
+# and are unnecessary at build time since USER switching achieves the same.)
+USER root
+RUN wget -q https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS_VERSION}_latest.zip -O /tmp/android-cmdline-tools.zip
 
 # Set up Android SDK
-RUN sudo mkdir -p ${ANDROID_HOME}/cmdline-tools
-RUN sudo unzip -q /tmp/android-cmdline-tools.zip -d ${ANDROID_HOME}/cmdline-tools
-RUN sudo mv ${ANDROID_HOME}/cmdline-tools/cmdline-tools ${ANDROID_HOME}/cmdline-tools/latest
-RUN sudo rm /tmp/android-cmdline-tools.zip
-RUN sudo chown -R $USER ${ANDROID_HOME}
+RUN mkdir -p ${ANDROID_HOME}/cmdline-tools
+RUN unzip -q /tmp/android-cmdline-tools.zip -d ${ANDROID_HOME}/cmdline-tools
+RUN mv ${ANDROID_HOME}/cmdline-tools/cmdline-tools ${ANDROID_HOME}/cmdline-tools/latest
+RUN rm /tmp/android-cmdline-tools.zip
+RUN chown -R $USER ${ANDROID_HOME}
+USER $USER
 
 # Install Android SDK components
 RUN yes | sdkmanager --sdk_root=${ANDROID_HOME} --licenses

FEATURES.md

@@ -46,6 +46,7 @@ graph TB
     BUY[Buy]
     COINS[Coins / UTXOs]
     ANNOUNCEMENTS[Announcements]
+    CONSOLIDATION[Consolidation]
 
     %% Dependencies to Core (all features depend on Core, but showing it explicitly would clutter the diagram)
     %% Instead, we note this in the documentation below
@@ -84,6 +85,7 @@ graph TB
     RECIPIENTS --> EXCHANGE
     SECRETS --> CORE
     SELL --> EXCHANGE
+    SEND --> CONSOLIDATION
     SEND --> FEES
     SEND --> NETWORK
     SEND --> PAYJOIN
@@ -94,13 +96,15 @@ graph TB
     SETTINGS --> CORE
     SWAPS --> UTXO_MGMT
     TOR --> CORE
+    TRANSFER --> CONSOLIDATION
     TRANSFER --> SEND
     TRANSFER --> RECEIVE
     TX_HISTORY --> PAYJOIN
     TX_HISTORY --> WALLETS
     UTXO_MGMT --> LABELS
     UTXO_MGMT --> WALLETS
     WALLETS --> BIP85
+    WALLETS --> CONSOLIDATION
     WALLETS --> HW_WALLETS
     WALLETS --> NETWORK
     WALLETS --> SECRETS
@@ -112,7 +116,7 @@ graph TB
     classDef featureStyle fill:#1a202c,stroke:#2d3748,stroke-width:2px,color:#e2e8f0
 
     class CORE coreStyle
-    class SETTINGS,TOR,PIN_CODE,LABELS,SECRETS,HW_WALLETS,BTC_PRICE,NETWORK,BIP85,FEES,WALLETS,EXCHANGE,APP_STARTUP,UTXO_MGMT,ADDRESS_MGMT,RECIPIENTS,FUNDING,BACKUPS,SWAPS,PAYJOIN,WITHDRAWAL,STATUS,SEND,RECEIVE,TRANSFER,TX_HISTORY,BG_TASKS,AUTOSWAPS,DCA,SELL,PAY,BUY,COINS,ANNOUNCEMENTS featureStyle
+    class SETTINGS,TOR,PIN_CODE,LABELS,SECRETS,HW_WALLETS,BTC_PRICE,NETWORK,BIP85,FEES,WALLETS,EXCHANGE,APP_STARTUP,UTXO_MGMT,ADDRESS_MGMT,RECIPIENTS,FUNDING,BACKUPS,SWAPS,PAYJOIN,WITHDRAWAL,STATUS,SEND,RECEIVE,TRANSFER,TX_HISTORY,BG_TASKS,AUTOSWAPS,DCA,SELL,PAY,BUY,COINS,ANNOUNCEMENTS,CONSOLIDATION featureStyle
 ```
 
 ## About Package Dependency Diagrams

ios/Runner.xcodeproj/project.pbxproj

@@ -481,11 +481,11 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = Runner/DebugProfile.entitlements;
-				CURRENT_PROJECT_VERSION = 191;
+				CURRENT_PROJECT_VERSION = 200;
 				DEVELOPMENT_TEAM = BX99T32YGS;
 				ENABLE_BITCODE = NO;
-				FLUTTER_BUILD_NAME = 6.12.0;
-				FLUTTER_BUILD_NUMBER = 191;
+				FLUTTER_BUILD_NAME = 6.13.0;
+				FLUTTER_BUILD_NUMBER = 200;
 				INFOPLIST_FILE = Runner/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = BULL;
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.finance";
@@ -494,7 +494,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 6.12.0;
+				MARKETING_VERSION = 6.13.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.bullbitcoin.app;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRIP_STYLE = "non-global";
@@ -674,11 +674,11 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = Runner/DebugProfile.entitlements;
-				CURRENT_PROJECT_VERSION = 191;
+				CURRENT_PROJECT_VERSION = 200;
 				DEVELOPMENT_TEAM = BX99T32YGS;
 				ENABLE_BITCODE = NO;
-				FLUTTER_BUILD_NAME = 6.12.0;
-				FLUTTER_BUILD_NUMBER = 191;
+				FLUTTER_BUILD_NAME = 6.13.0;
+				FLUTTER_BUILD_NUMBER = 200;
 				INFOPLIST_FILE = Runner/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = BULL;
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.finance";
@@ -687,7 +687,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 6.12.0;
+				MARKETING_VERSION = 6.13.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.bullbitcoin.app;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRIP_STYLE = "non-global";
@@ -705,11 +705,11 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = Runner/Release.entitlements;
-				CURRENT_PROJECT_VERSION = 191;
+				CURRENT_PROJECT_VERSION = 200;
 				DEVELOPMENT_TEAM = BX99T32YGS;
 				ENABLE_BITCODE = NO;
-				FLUTTER_BUILD_NAME = 6.12.0;
-				FLUTTER_BUILD_NUMBER = 191;
+				FLUTTER_BUILD_NAME = 6.13.0;
+				FLUTTER_BUILD_NUMBER = 200;
 				INFOPLIST_FILE = Runner/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = BULL;
 				INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.finance";
@@ -718,7 +718,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 6.12.0;
+				MARKETING_VERSION = 6.13.0;
 				PRODUCT_BUNDLE_IDENTIFIER = com.bullbitcoin.app;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				STRIP_STYLE = "non-global";

ios/Runner/Info.plist

@@ -59,6 +59,8 @@
 		<string>We need access to Bluetooth in order to connect to your hardware wallet when needed</string>
 		<key>NSLocationWhenInUseUsageDescription</key>
 		<string>The app itself never collects your location. Location access is only requested if a website opened in the in-app browser asks for it</string>
+		<key>NSLocationAlwaysAndWhenInUseUsageDescription</key>
+		<string>The app itself never collects your location. Location access is only requested if a website opened in the in-app browser asks for it</string>
 		<key>UIApplicationSupportsIndirectInputEvents</key>
 		<true/>
 		<key>UIDesignRequiresCompatibility</key>

lib/core/payjoin/data/datasources/local_payjoin_datasource.dart

@@ -58,8 +58,15 @@ class LocalPayjoinDatasource {
       Expression<bool> expr = const Constant(true); // identity
 
       if (onlyUnfinished) {
+        // isAborted is a terminal outcome too (we already broadcast the
+        // original in its place) — excluded here for the same reason
+        // isCompleted/isExpired are, otherwise an aborted session would
+        // keep being "resumed" on every app start.
         expr =
-            expr & row.isExpired.equals(false) & row.isCompleted.equals(false);
+            expr &
+            row.isExpired.equals(false) &
+            row.isCompleted.equals(false) &
+            row.isAborted.equals(false);
       }
 
       if (walletId != null) {
@@ -78,7 +85,10 @@ class LocalPayjoinDatasource {
 
       if (onlyUnfinished) {
         expr =
-            expr & row.isExpired.equals(false) & row.isCompleted.equals(false);
+            expr &
+            row.isExpired.equals(false) &
+            row.isCompleted.equals(false) &
+            row.isAborted.equals(false);
       }
 
       if (walletId != null) {
@@ -103,10 +113,24 @@ class LocalPayjoinDatasource {
     ];
   }
 
+  /// Fetches the payjoin session(s) a transaction id belongs to, matching
+  /// BOTH the payjoin transaction id and the original transaction id. The
+  /// original matters as much as the payjoin one: an aborted session (we
+  /// broadcast the original instead of completing a real payjoin — see
+  /// PayjoinStatus.aborted) has no [txId] at all, so the transaction that
+  /// actually hit the chain IS the original — matching only [txId] made
+  /// that transaction's details lose its payjoin context entirely, hiding
+  /// the very "aborted" outcome the status exists to communicate. The
+  /// transactions LIST already joins on both ids
+  /// (GetTransactionsUsecase); this keeps the details path consistent.
   Future<List<PayjoinModel>> fetchByTxId(String txId) async {
     final (receivers, senders) = await (
-      _db.managers.payjoinReceivers.filter((f) => f.txId(txId)).get(),
-      _db.managers.payjoinSenders.filter((f) => f.txId(txId)).get(),
+      _db.managers.payjoinReceivers
+          .filter((f) => f.txId(txId) | f.originalTxId(txId))
+          .get(),
+      _db.managers.payjoinSenders
+          .filter((f) => f.txId(txId) | f.originalTxId(txId))
+          .get(),
     ).wait;
 
     return [
@@ -124,6 +148,7 @@ class LocalPayjoinDatasource {
       receivers = await receiversTable
           .filter((f) => f.isExpired(false))
           .filter((f) => f.isCompleted(false))
+          .filter((f) => f.isAborted(false))
           .get();
     } else {
       receivers = await receiversTable.get();
@@ -147,6 +172,7 @@ class LocalPayjoinDatasource {
       senders = await sendersTable
           .filter((f) => f.isExpired(false))
           .filter((f) => f.isCompleted(false))
+          .filter((f) => f.isAborted(false))
           .get();
     } else {
       senders = await sendersTable.get();