The padlock stops charging for hesitation: the password ask renders over the open wallet and Not now means exactly that, the logo opens a passwordless vault instead of guarding it, and a seed is born as Savings alone — Spending appears when you actually set it up

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JtaatFfAbx91Nh3xqKVqKz

2 files changed, 142 insertions, 13 deletions

diff --git a/src/app.js b/src/app.js
index 191b8fe..0b63492 100644
--- a/src/app.js
+++ b/src/app.js
@@ -1760,9 +1760,18 @@ function softLock() {
   const watch = loadWatchAccounts();
   let blankPw = false;
   try { decryptVault(loadVaultBlob(), ''); blankPw = true; } catch {}
-  // Nothing watchable, or a passwordless vault (locking would mean nothing):
-  // fall back to the classic flow, which offers to set a password.
-  if (!watch.length || !hasVault() || blankPw) { lock({ offerPassword: true }); ui.justLocked = true; return; }
+  // No protecting password yet: locking would protect nothing, so ask for one
+  // right here — keys intact, home still on screen. Submitting saves the
+  // vault under it and locks in place; "Not now" just closes the prompt.
+  // (Tearing the session down first meant "Not now" stranded people on the
+  // wallet list, signed out of a wallet they never asked to leave.)
+  if (!hasVault() || blankPw) {
+    ui.pw = { purpose: 'lock', mode: 'set', v0: '', v1: '', v2: '', error: '' };
+    render();
+    return;
+  }
+  // Nothing watchable: this session can't stay on screen — classic full lock.
+  if (!watch.length) { lock({ offerPassword: true }); ui.justLocked = true; return; }
   // A wallet that isn't IN the vault can't come back from a lock — unlocking
   // decrypts the vault, and this seed isn't there (created while the vault
   // sat locked, so autoSave couldn't write it). Save it first: with the
@@ -2172,6 +2181,12 @@ function goHome() {
   } else if (hasVault()) {
     // Locked with saved wallets: home is the unlock prompt, not the
     // create-a-new-wallet flow — the logo must never read as "start over".
+    // A passwordless vault isn't locked, though: open it silently and land
+    // home instead of demanding a password nobody set.
+    if (attemptVaultUnlock('') && accounts.length) {
+      activateAccount(accounts[0], { fresh: true });
+      return;
+    }
     ui.screen = 'vault';
   } else {
     ui.screen = 'unlock';
@@ -2757,13 +2772,18 @@ function onboardScreen() {
     h('button', { class: 'btn-primary btn-block', style: 'padding:14px', onClick: () => {
       try { localStorage.removeItem(ONB_STEP_KEY); } catch {}
       ui.onb = null;
-      // Spending exists now — latch it on the account (the claimed name
-      // usually proves it, but the flag survives a names hiccup) and land
-      // on the Spending face with the new address showing.
+      // Latch Spending onto the account only when the wizard actually set it
+      // up (a claimed address or funds prove it) — finishing the wizard on a
+      // network without names, or skipping the spend step, must not conjure
+      // a Spending wallet nobody asked for.
       const acc = activeAccount();
-      if (acc && !acc.spendingSetup) { acc.spendingSetup = true; persistAccounts(); }
-      ui.account = 'spending';
-      try { localStorage.setItem(ACCOUNT_KEY, 'spending'); } catch {}
+      const addr = featureHook('namesAddress');
+      const spendReady = (!!addr && !/^npub1/.test(addr)) || (featureHook('spendingSat') || 0) > 0;
+      if (spendReady) {
+        if (acc && !acc.spendingSetup) { acc.spendingSetup = true; persistAccounts(); }
+        ui.account = 'spending';
+        try { localStorage.setItem(ACCOUNT_KEY, 'spending'); } catch {}
+      }
       ui.tab = 'receive';
       render();
     } }, t('onbEnter')),
@@ -2804,6 +2824,11 @@ function walletScreen() {
     const s = onboardScreen();
     if (s) return s; // null = the wizard just handed over; fall through
   }
+  // The padlock's set-a-password ask renders here, over the open wallet —
+  // declining it must land back exactly where the tap happened.
+  if (ui.pw && ui.pw.purpose === 'lock') {
+    return h('div', { class: 'col', style: 'gap:16px' }, brandHeader(false), pwPromptCard());
+  }
   // A feature can hold the wallet behind a required onboarding step (picking
   // a username). Imported wallets skip it once their name is recovered.
   const ob = featureHook('onboardingView');
@@ -2872,10 +2897,14 @@ const ACCOUNT_KEY = 'btc-wallet-account';
 // whose name lookup isn't available right now.
 function spendingActive() {
   if (!featureHook('arkReady')) return false;
-  if (activeAccount()?.spendingSetup) return true;
-  if ((featureHook('spendingSat') || 0) > 0) return true;
+  const acc = activeAccount();
+  if (acc?.spendingSetup) return true;
   const addr = featureHook('namesAddress');
-  return !!addr && !/^npub1/.test(addr);
+  const evident = (featureHook('spendingSat') || 0) > 0 || (!!addr && !/^npub1/.test(addr));
+  // Latch demonstrated use onto the record, so the Wallets list keeps showing
+  // this seed's Spending side even while it's locked or not the active one.
+  if (evident && acc && !acc.spendingSetup) { acc.spendingSetup = true; persistAccounts(); }
+  return evident;
 }
 // ---- the flat wallet model -------------------------------------------------
 // Each seed record surfaces as up to two TOP-LEVEL wallets: its Spending (Ark)
@@ -2886,7 +2915,11 @@ function viewsOf(a) {
   if (!a) return [];
   if (a.kind) return [a.kind];
   if (a.type === 'watch') return ['savings'];
-  return ['spending', 'savings'];
+  // Spending is opt-in: a seed starts as its on-chain wallet alone, and grows
+  // a Spending side only once the user sets one up (the wizard's spend step,
+  // an explicit Add wallet, or funds/an address arriving — see the latch in
+  // spendingActive).
+  return a.spendingSetup ? ['spending', 'savings'] : ['savings'];
 }
 // How a SEED reads to the user: the names of the wallets it carries
 // ("Spending + Savings") — its internal record label never surfaces.
diff --git a/tools/padlock-flow-test.js b/tools/padlock-flow-test.js
new file mode 100644
index 0000000..be4cdf9
--- /dev/null
+++ b/tools/padlock-flow-test.js
@@ -0,0 +1,96 @@
+// The padlock on a fresh (passwordless) wallet must never cost you your
+// session: the set-a-password ask renders over the open wallet, declining it
+// lands you exactly where you were, the logo stays a way home, and the
+// Wallets list shows only the on-chain wallet until Spending is set up.
+// Setting a password locks in place: watch-only home, closed padlock.
+// Run: bun tools/padlock-flow-test.js
+import puppeteer from 'puppeteer-core';
+import { generateMnemonic } from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english';
+import { buildHtml } from '../build.js';
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+let fails = 0;
+const check = (n, c, d = '') => { console.log(` ${c ? '✓' : '✗'} ${n}${d ? ' — ' + d : ''}`); if (!c) fails++; };
+
+const html = await buildHtml({ minify: true, pwa: false });
+const server = Bun.serve({ port: 5236, fetch: () => new Response(html, { headers: { 'content-type': 'text/html' } }) });
+const browser = await puppeteer.launch({ executablePath: '/usr/bin/google-chrome', headless: 'new', args: ['--no-sandbox'] });
+const page = await browser.newPage();
+await page.setViewport({ width: 420, height: 880 });
+
+const click = (sel, t) => page.evaluate((s, x) => { const e = [...document.querySelectorAll(s)].find((n) => n.textContent.trim().toLowerCase().includes(x.toLowerCase())); if (e) { e.click(); return true; } return false; }, sel, t);
+const clickTitle = (t) => page.evaluate((x) => { const b = [...document.querySelectorAll('button')].find((n) => n.title === x); if (b) { b.click(); return true; } return false; }, t);
+const body = () => page.evaluate(() => document.body.innerText);
+const waitText = async (x, ms = 20000) => { for (let i = 0; i < ms / 250; i++) { if ((await body()).toLowerCase().includes(x.toLowerCase())) return true; await sleep(250); } return false; };
+
+try {
+  await page.goto('http://localhost:5236/', { waitUntil: 'domcontentloaded' });
+  await page.evaluate(() => localStorage.setItem('btc-wallet-network', 'regtest'));
+  await page.reload({ waitUntil: 'domcontentloaded' });
+  await sleep(400);
+  await click('button', 'Get started');
+  await sleep(500);
+  await click('button', 'Import existing');
+  await sleep(400);
+  await page.waitForSelector('textarea');
+  await page.type('textarea', generateMnemonic(wordlist));
+  await click('button', 'Open wallet');
+  check('wallet open', await waitText('receive'));
+  await sleep(2000);
+
+  console.log('\n[the Wallets list before opting into Spending]');
+  await click('button', 'Wallets');
+  await sleep(600);
+  let txt = await body();
+  check('shows the on-chain wallet', /savings/i.test(txt), txt.slice(0, 140).replace(/\n+/g, ' | '));
+  check('and no un-asked-for Spending wallet', !/spending/i.test(txt), txt.slice(0, 140).replace(/\n+/g, ' | '));
+  await click('button', 'Back');
+  await sleep(500);
+  check('back home', await waitText('receive'));
+
+  console.log('\n[padlock with no password: declining is free]');
+  await clickTitle('Lock wallet');
+  await sleep(500);
+  txt = await body();
+  check('it asks for a password in place', (await page.$$('input[type=password]')).length >= 2, txt.slice(0, 120).replace(/\n+/g, ' | '));
+  check('with a way to decline', /not now/i.test(txt));
+  await click('button', 'Not now');
+  await sleep(600);
+  txt = await body();
+  check('declining lands back home', /receive/i.test(txt) && /balance/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
+  check('not on the wallets list', !/add wallet|clear all/i.test(txt));
+
+  console.log('\n[the logo still means home]');
+  await page.evaluate(() => document.querySelector('.brand')?.click());
+  await sleep(600);
+  txt = await body();
+  check('logo goes home, not to a password prompt', /receive/i.test(txt) && !/unlock saved|enter your password/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
+
+  console.log('\n[setting a password locks in place]');
+  await clickTitle('Lock wallet');
+  await sleep(500);
+  const fields = await page.$$('input[type=password]');
+  check('password form is up', fields.length >= 2, `${fields.length} field(s)`);
+  await fields[0].type('hunter22');
+  await fields[1].type('hunter22');
+  await click('button', 'Save');
+  await sleep(1200);
+  txt = await body();
+  check('still home (watch-only), not signed out', /receive/i.test(txt) && /balance/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
+  const closed = await page.evaluate(() => [...document.querySelectorAll('button')].some((b) => b.title && /unlock/i.test(b.title)));
+  check('padlock is closed', closed);
+
+  console.log('\n[and the padlock now asks for the password]');
+  await clickTitle('Unlock');
+  await sleep(600);
+  txt = await body();
+  check('unlock needs the password', /password/i.test(txt), txt.slice(0, 120).replace(/\n+/g, ' | '));
+} catch (e) {
+  check('run completed', false, e.message);
+} finally {
+  await browser.close();
+  server.stop(true);
+}
+console.log(fails ? '\n❌ failures above' : '\n✅ padlock flow behaves');
+process.exit(fails ? 1 : 0);