aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Update balance/history optimistically right after a sendAdam Soltys2026-06-262-2/+54
| | | | | | | | | | | | | On the Electrum backend the post-send rescan is many round-trips, so the balance lagged a few seconds. Now a successful broadcast immediately applies the tx locally (applySentTx): drop the spent coins, credit change as pending, add a pending history row, recompute the balance, and emit — so the UI reflects the send instantly. The realtime watcher / backstop poll reconciles and fills in the confirmation once the explorer has indexed it (no immediate rescan, so a not-yet-indexed tx can't briefly revert the optimistic state). Verified the balance/utxo/history math. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Fix broadcast hanging forever on a stalled responseAdam Soltys2026-06-263-10/+15
| | | | | | | | | | | | The Esplora broadcast cleared its abort timer right after fetch() resolved, so the subsequent res.text() body read had no timeout — a stalled response body hung the whole broadcast (and the send spinner) indefinitely, with the tx never reaching the network. Keep the abort timer active through the body read, and add a hard 30s outer timeout in the send handler so a wedged broadcast always surfaces as 'timed out — try again' instead of spinning forever. (The silent-payment tx itself is valid — verified structure + BIP143 signature over the real outputs.) Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Don't hold the send spinner up during the post-broadcast rescanAdam Soltys2026-06-261-1/+4
| | | | | | | | | | broadcast() set the success result but kept ui.busy=true and didn't render until after awaiting wallet.scan(), so the 'Sign & broadcast' button spun for the whole post-send rescan (slow under rate-limiting / on the Electrum backend) — looking stuck even though the tx had already broadcast. Now it shows the success screen the instant the broadcast resolves and refreshes balances in the background. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Confirm before removing a single wallet (like Clear all)Adam Soltys2026-06-262-1/+18
| | | | | | | | The ✕ on a wallet now opens a confirmation screen warning it's removed from this device (keep its recovery phrase; other wallets unaffected) instead of deleting immediately. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Logo returns to the wallet's Receive page; add paste-from-clipboard buttonsAdam Soltys2026-06-262-24/+48
| | | | | | | | | | | - goHome: when a wallet is open, the logo goes to its Receive page (its tabs) instead of the create/import screen — so it's always a way back to your wallet. Only with no wallet open does it show create/import. - Paste buttons: a clipboard 'Paste' icon on the send address field and the import (seed/key/xpub) and 'load seed to spend' fields, filling them from the clipboard. Hidden where the Clipboard read API isn't available. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Add 'Change password' for the saved-to-device vaultAdam Soltys2026-06-262-5/+30
| | | | | | | | | | | A vault exists → Accounts screen shows Change password: enter the current password, then a new one (with confirm; leave blank to remove it). It decrypts the actual vault and re-encrypts it with the new password, so wallets not loaded in the current session are never dropped. Keeps the in-memory password in sync when the vault is already unlocked. Verified the re-encrypt round-trip (old rejected, new works, blank works). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Make auto log-out per-wallet — only signs out the wallet it's set forAdam Soltys2026-06-263-56/+117
| | | | | | | | | | | | | | | | | | The logout timer is now an account setting (stored per account in the session and the durable directory), not a global one, and it removes only that wallet from the device — its session entry, directory entry, cached state (xpub + seed keys), and its vault entry — leaving other wallets untouched. - wipeAccount(id) surgically removes one wallet; the active one falls back to the next account (or the unlock screen). - Background-away timestamp drives per-account evaluation on resume/boot; an armed timer fires for the soonest-due wallet so a blurred-but-visible window still signs out on time. Overdue saved wallets are removed from the vault when it's unlocked (the only point we can re-encrypt it). - New cacheKeyFor() export lets app code target one wallet's cache keys exactly (verified against the wallet's seed/xpub/watch keys). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Auto log-out wipes the saved-to-device vault too (full device wipe)Adam Soltys2026-06-262-14/+7
| | | | | | | | With a logout timer set, signing out now removes everything from the device including the password-protected vault — nothing survives, so the recovery phrase is required to return. Updated the setting copy to say so. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Auto log-out also wipes a blank-password (unprotected) vaultAdam Soltys2026-06-261-0/+11
| | | | | | | | A vault saved with no password auto-unlocks on open, which would undo the sign-out. When a logout timer fires (or a boot is overdue), remove it too — only a password-protected vault survives. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Add auto log-out (background timer) + make vault passwords optionalAdam Soltys2026-06-262-10/+119
| | | | | | | | | | | | | | | | Auto log-out: a Settings option (Never default, 1m/5m/1h/1d) that, after the app has been backgrounded/unfocused that long, signs out completely — clears the session, the watch-only directory, and cached balance/history from the device (only password-saved vault wallets remain). The countdown only runs while the app is hidden/unfocused, never while it's open and focused; a background timestamp covers throttled/discarded-tab cases on resume/boot. Optional vault passwords: drop the 8-character minimum and allow a blank password. A blank-password vault auto-unlocks on open with no prompt (Save to device with no password = just persist). Verified blank round-trip + wrong- password rejection. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Persist wallets as watch-only across sessions; re-enter seed to spendAdam Soltys2026-06-263-25/+178
| | | | | | | | | | | | | | | | | | | | | | | Closing the browser without 'Save to device' used to wipe the wallet entirely. Now every wallet's account xpub is mirrored to a durable localStorage directory (never the seed), so it survives a session wipe as a watch-only entry — you keep seeing balance and history, and re-enter the seed to spend again. - Durable account directory: saveDirectory() mirrors {id,label,xpub} for every account; restore falls back to it as watch-only when there's no session/vault. - Instant view: a full wallet also caches under its xpub key, so the downgraded watch-only shows balance/history immediately (no rescan). Verified round-trip. - Re-enter seed to spend: the Send tab (now shown for watch-only) and Settings prompt for the recovery phrase / xprv; it must derive to this wallet's xpub (verified via accountXpubFor — wrong seed/passphrase rejected), with an option to Save to device at the same time. Upgrade is in place (id/label/cache kept). - Vault merge now dedupes by xpub so saved + non-saved wallets coexist without duplicates. Privacy note: the xpub now persists by default (someone with device access can see balance/history without the seed); 'Remove' clears it. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Stage Electrum failover + coinos-primary cutover switchAdam Soltys2026-06-262-12/+50
| | | | | | | | | | | | | | | | | Failover (live now): the Electrum backend now tries an ordered list of servers, advancing to the next when one fails to connect or dies within ~5s. Named public presets fall over to the other public servers; a custom your-node URL does NOT fall over (won't silently leak your addresses to a server you didn't pick). Verified: dead primary → auto-advances to a working server. Cutover switch (dormant): COINOS_ELECTRUM (false) flips 'coinos' mode from explorer-REST + watcher push to a full Electrum backend pointed at wss://coinos.io/electrum, with the public servers as failover, and disables the watcher for coinos mode. Flip it true once Fulcrum serves data behind that endpoint — no new logic needed at cutover. Flag off = current behavior exactly (default coinos → esplora + watcher), so this ships safely while Fulcrum syncs. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Fold the coinos opt-out into a single Data source pickerAdam Soltys2026-06-263-58/+57
| | | | | | | | | | | | | | | | | | | Replace the Esplora|Electrum backend toggle plus the separate 'Instant notifications' on/off with one 'Data source' selector: • coinos (instant) — default; explorer data + coinos push • Block explorer — REST + polling, nothing sent to coinos (the opt-out) • Electrum server — one WS server for data + push (your node / public) Picking a non-coinos source IS the privacy opt-out, so the standalone toggle is gone. A single 'mode' setting drives getBackend()/getRealtimeEnabled(), so the wallet/wsUrl logic is unchanged; existing per-feature settings migrate in (realtime=off → explorer, backend=electrum → electrum). coinos⇄explorer just flips the watcher (no rescan); to/from electrum rebuilds the backend. Sets up cleanly for a future coinos Fulcrum: 'coinos' mode upgrades from REST+watcher to a full Electrum backend transparently. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Add all working Electrum server presets from supertestnet's listAdam Soltys2026-06-261-0/+3
| | | | | | | | Tested all six suggestions: 5 connect and return correct data (blockstream electrs, btc.electroncash.dk / blackie / jochen Fulcrum, mempool.guide). Only bitcoin.grey.pw:50004 was unreachable, so it's left out. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Add Electrum-over-WebSocket as an alternative data backendAdam Soltys2026-06-265-59/+438
| | | | | | | | | | | | | | | | | | | | | | | | | | Settings → Data source now offers 'Electrum' alongside the Esplora REST explorer. One Electrum WebSocket serves BOTH the wallet's data queries and scripthash push notifications, so pointing Hal at your own Fulcrum/electrs gives a fully self-hosted setup — no coinos, no public REST, nothing shared off your node. - src/electrum.js: ElectrumApi maps the Esplora shapes the wallet consumes onto Electrum methods (scripthash get_balance/listunspent/get_history, estimatefee, transaction.broadcast). electrs has no verbose tx lookup, so it parses raw txs and resolves input values from parent txs to compute fees (cached, in-flight deduped, bounded-parallel). Validated field-for-field against mempool.space: addressTxs (fee/vin/vout/status), getTx, outspend, balance, utxos. - wallet.js: the realtime socket already spoke Electrum's notify protocol; added request/response (_rpcCall) so the same connection answers data calls. Real Electrum notifications carry no tx data, so they reconcile via the backend. Replaced the fragile newline parser with a string-aware brace-depth scanner that handles every framing (newline, one-per-frame, concatenated, split) — fixes a buffer-poisoning hang under concurrent calls; also hardens the coinos watcher path. Esplora stays the default; nothing changes for existing users. Verified end-to-end against blockstream's electrs: concurrent transport, a full fresh-wallet scan (~2s), and the parser unit-tested on all framings. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Add Silent Payments (BIP-352) sendingAdam Soltys2026-06-254-9/+188
| | | | | | | | | | | | | | | | | Pay sp1… addresses: the wallet derives the one-time taproot output from the recipient's address + the transaction's own input keys (ECDH), so payments are unlinkable on-chain with no interaction. New src/silentpay.js implements the sender derivation + bech32m address decode, validated against the official BIP-352 test vectors (all P2WPKH-input / single-recipient cases pass; the rest exercise input types Hal never spends). buildTx detects sp1… recipients, selects coins against a same-size placeholder taproot output, then swaps in the script derived from the final input set (updateOutput). Works for normal sends, multi-recipient, and send-max. The review screen shows the sp1… address with a 'Silent payment' label (the on-chain output is a derived one-time taproot address). End-to-end signing verified. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Settings: let users opt out of coinos realtime notifications (privacy)Adam Soltys2026-06-253-8/+38
| | | | | | | | | | | The WS watcher is the one place the app shares addresses off-device (it subscribes your scripthashes to coinos to push instant payment updates). Add an 'Instant notifications' toggle in the explorer settings: off means the app never connects to coinos and polls your chosen explorer instead — a bit slower, more requests, but nothing is told to coinos. wsUrl returns null when disabled, so startRealtime cleanly skips the socket and relies on the polling fallback. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Open block-explorer links via window.open (reliable in standalone PWA)Adam Soltys2026-06-251-3/+10
| | | | | | | | Reorder the already-claimed actions (Create a wallet anyway above the explorer link) and force explorer links to open in a new window/tab via window.open — inside an installed PWA, <a target=_blank> can navigate the app away instead. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Already-claimed: move 'Create a wallet anyway' above the explorer linkAdam Soltys2026-06-251-5/+5
| | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Make the gift-claim wallet provisional until committedAdam Soltys2026-06-251-2/+22
| | | | | | | | | | | Opening a gift link generates a wallet only to claim into. Mark it provisional so bailing from an already-claimed gift (Go to home / logo) discards it instead of leaving an empty account in the session list. It's committed — kept for good — the moment the user claims, chooses 'Create a wallet anyway', or otherwise enters the wallet (incl. a refresh). Critically, commit on claim *success* so the backup step can't discard a wallet that just received funds. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Already-claimed gift: offer 'Create a wallet anyway' or go homeAdam Soltys2026-06-252-4/+13
| | | | | | | | The claim flow already generated a fresh wallet, so the dead-end screen now lets the opener keep it (→ back up the recovery phrase → into the wallet) or head to the home screen. The backup step's copy adapts (Claimed! vs Your new wallet). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Persist the active tab + open tx across refreshAdam Soltys2026-06-251-1/+13
| | | | | | | | | Save the wallet-screen nav (tab and open tx detail) to sessionStorage on each render and restore it on load, so refreshing keeps your place instead of jumping back to Receive. A restored tx detail re-fetches its fee/details if missing. Gift links still open the claim screen. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Lazily fetch a receive's fee when opening its detailAdam Soltys2026-06-251-1/+25
| | | | | | | | | A watcher-credited receive arrives with no fee (the push can't compute it from the raw tx, and the reduced reconcile doesn't revisit the now-used address). On opening the tx detail, fetch the full tx from the explorer to fill in the fee (and confirmations) — works for pending mempool txs too. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Celebrate a received payment once; don't re-show after refresh/reopenAdam Soltys2026-06-252-6/+10
| | | | | | | | Persist the receive-ack the moment the 'Payment received!' screen is shown (not only on tap), so refreshing or navigating away without tapping won't bring it back. It still stays visible in the current session until dismissed. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Show the network fee on the tx detail page for receives tooAdam Soltys2026-06-251-1/+1
| | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Remove the gift-link description blurbAdam Soltys2026-06-251-1/+0
| | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Trim gift minimum note to just 'Minimum {n}.'Adam Soltys2026-06-251-1/+1
| | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Remove the gift-link warning boxAdam Soltys2026-06-251-1/+0
| | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Compact gift links: base32 codec + uppercase /g/ path for a smaller QRAdam Soltys2026-06-253-18/+98
| | | | | | | | | | | | | | | | | | Gift links now carry a compact binary encoding of just the claim-essential data (presigned inputs + the committed change output) instead of a full PSBT (~25% fewer bytes), base32-encoded and served at an uppercase /g/<code> path. The QR renders the uppercase URL in the QR alphanumeric mode (5.5 bits/char vs byte mode's 8), so the grid drops from ~73 to ~53 modules — much easier to scan. - wallet: _encodeCompactGift/_decodeCompactGift + _giftTx dispatcher; legacy base64url-PSBT links still claim (auto-detected by a magic byte). Verified round-trip + claim-byte-identical across 1/2/3-input and whole-balance gifts, against the real exported preview/claim/outpoint functions. - app: giftUrl uses /g/<code>; opener parses /g/ (and legacy #gift=); QR uses uppercase + Alphanumeric mode (qrSvg gains a mode option w/ byte fallback). - nginx already SPA-routes /g/*; the SW serves the shell for the new path. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Trim the tribute line to just 'a tribute to Hal Finney (1956–2014)'Adam Soltys2026-06-251-1/+1
| | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Gift QR: use error-correction level L for a less dense, easier-to-scan gridAdam Soltys2026-06-252-3/+6
| | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Gift claim: show a loading screen while checking, not the claimable amountAdam Soltys2026-06-252-0/+16
| | | | | | | | Avoids flashing 'You've been sent Bitcoin' before flipping to 'Already claimed' for a spent gift. Offline fallback clears the checking flag so the loader can't hang. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Gift claim: detect already-claimed (even unconfirmed) and block the raceAdam Soltys2026-06-254-3/+79
| | | | | | | | | | | | Opening a gift link now checks whether its funding coin is already spent — via the Esplora outspend endpoint, which reports a spend even by an unconfirmed claim. The Claim button is gated until that check passes; if the coin is spent, show an 'Already claimed' screen with a link to the claim tx instead of a claimable amount. doClaim also re-checks on broadcast failure (the race window), and refuses to run while unchecked/taken — so a second opener can't attempt a doomed double-spend. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Claimed screen: big green check instead of green-on-orange badgeAdam Soltys2026-06-251-1/+1
| | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Confirm transactions via the WebSocket push, not RESTAdam Soltys2026-06-252-41/+52
| | | | | | | | | | The watcher's block (rawblock) push now carries confirmed=true + the block time, and _applyTxNotification flips the matching history row and coins from pending to confirmed directly — for incoming and outgoing txs (flag-only, so no overcount). Confirmations no longer wait on a mempool.space reconcile; the 30s backstop poll just fills in block height / fee afterward. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Rename the app title from 'Hal Wallet' to just 'Hal'Adam Soltys2026-06-252-4/+4
| | | | | | | Header, browser tab title, PWA name, and apple web-app title. Tribute prose (explaining the name honors Hal Finney) left as-is. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Remove the Live/Polling badge; shorten explorer link to 'Block explorer'Adam Soltys2026-06-252-11/+2
| | | | Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Credit payments instantly from the watcher push (no REST on critical path)Adam Soltys2026-06-252-37/+115
| | | | | | | | | | | | | | | | | | The watcher push now carries the tx data (matched outputs + confirmed flag), so the app credits an incoming payment the moment the push arrives — no mempool.space round-trip. This removes the rate-limited REST reconcile from the path a user actually waits on, and lets us back the frontier poll way off when the socket is live (30s backstop vs the old 3s receive-tab hammer), cutting the 429s to a trickle. - watcher: notification includes { txid, confirmed, outputs:[{vout,value}] }. - wallet: _applyTxNotification credits the receive coin + a pending history row optimistically (receives only; change reconciles in the background), advances the frontier, updates the balance, and schedules a background reconcile for full accuracy off the critical path. - poll intervals relaxed now that the WS does the real work instantly. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Realtime via self-hosted ZMQ watcher (Electrum-over-WS)Adam Soltys2026-06-253-108/+350
| | | | | | | | | | | | | | | | | | | Replace the unreliable public WebSocket push (mempool/blockchain.info address subscriptions never reliably fire) with a private notification service: - tools/zmq-watcher.js: a standalone Bun service (reusing coinos lib/zmq.ts's ZMTP subscriber) that reads Bitcoin Core's ZMQ rawtx/rawblock, computes the scripthash of each output, and pushes a blockchain.scripthash.subscribe notification to subscribed clients. No historical index (~24MB RAM) — just the live tx stream. Runs on the coinos box reading its Core's ZMQ. - wallet.js: realtime client now speaks the Electrum protocol (server.version, scripthash.subscribe, server.ping) over the WS; any scripthash notification triggers the existing refreshLive() (REST stays the source of truth). - api.js: wsUrl -> wss://coinos.io/electrum. Verified end-to-end: live mempool txs to subscribed addresses notify instantly. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Fast-poll the receive address while watching for a paymentAdam Soltys2026-06-252-1/+41
| | | | | | | | | | | The WS badge reads Live but mempool.space's free address tracking doesn't reliably push incoming mempool txs, so a deposit could take ~18s to appear (the 25s safety poll catching it). While the user is on the Receive tab (online), now poll just the fresh receive address every ~3s regardless of Live state — one cheap request that guarantees near-instant arrival. Toggled idempotently from render() based on the active tab; stops when they navigate away. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Faster WS reconnect; stop double-running the held-coin reconcileAdam Soltys2026-06-251-1/+9
| | | | | | | | | | | | - _scheduleReconnect now backs off exponentially from ~0.6s (was a flat 4s), so a first socket attempt that's transiently rejected retries fast — the wallet reaches Live in well under a second instead of ~4s. Backoff resets on open. - refreshLive now stamps _lastPoll at its start, so a socket-open refresh and the poll-timer tick don't both fire reconcileHeld back-to-back on load. A cached load does one held-coin reconcile (verify coins still unspent + frontier check) instead of ~3x. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Stop full-scanning the API on every load; go Live before NostrAdam Soltys2026-06-251-9/+17
| | | | | | | | | | | | | | | | The refresh request storm (and the 429s) was a full API re-scan running on every load even when the local cache or Nostr already held the complete state. Now the full scan runs ONLY when there's neither cache nor Nostr (a seed on a fresh device); otherwise the socket + frontier poll keep things current and reconcile held coins — a handful of requests instead of re-querying every historical address plus its utxos and txs. Also reordered: startRealtime() now runs BEFORE syncFromNostr (which blocks up to 6s waiting on the relay) and before any discovery scan, so the wallet goes Live immediately instead of sitting in Polling. retrack() after sync/scan re-subscribes to the final frontier; a fresh open re-baselines its celebration against it. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Detect stuck low-fee txs and stop actively monitoring themAdam Soltys2026-06-243-5/+41
| | | | | | | | | | | | | | | A pending tx is judged 'stuck' once it has waited ~10 blocks (≈100 min) and its fee rate (fee/vsize) is below the mempool's current floor (minimumFee) — i.e. it's been purged and won't confirm without a bump. _txSummary now records vsize and a firstSeen timestamp (persisted in cache) to support this. Stuck txs are dropped from active monitoring: excluded from the watched-address set and from the fast-poll trigger, so they don't hold a socket slot or keep us in the 6s lane. The slow ~25s reconcile still catches one if the floor later drops and it confirms. History flags them (⚠ stuck) and the detail view explains it — pointing outgoing ones at the existing fee bump. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Watch pending-coin addresses; let per-address rescans queueAdam Soltys2026-06-242-20/+30
| | | | | | | | | | | | | | - watchedAddresses() now includes any address holding an unconfirmed coin (not just the frontier), so a pending deposit's confirmation pushes over the socket instantly. Capped at the socket's 10-address limit. refreshLive/rescanAddress retrack when a new pending coin changes the set. - While any coin is pending, the frontier poll runs every ~6s even when live, so confirmations show fast as a belt-and-suspenders to the WS push. - Per-address rescans no longer disable each other: clicking many queues them, and the api.js global scheduler (1 concurrent, 500ms spacing, 429 backoff) serializes and staggers the underlying requests within the rate limit. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Drop background/full rescans for on-demand per-address rescanAdam Soltys2026-06-243-14/+124
| | | | | | | | | | | | | | | Remove the periodic full re-scan entirely — the WS and the frontier poll keep the balance current, and refreshLive's _reconcileHeld catches spends of held coins. The only gap (a deposit to a reused old address) is now handled explicitly: Settings → Rescan opens a paginated list of every known address, each with its own Rescan button (wallet.rescanAddress re-queries just that one). Replaces the full 'Rescan wallet' button. This sharply cuts recurring REST volume (the main rate-limit driver). Trade-off: when the socket is down, a pending tx's confirmed badge in History may lag until the WS reconnects or you rescan — the balance itself stays correct via reconcile. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Drop beforeinstallprompt preventDefault to silence its console warningAdam Soltys2026-06-241-1/+3
| | | | | | | | preventDefault() without a following prompt() makes Chrome log a 'Banner not shown' warning. Modern Chrome shows no auto-banner to suppress, so we just stash the event for our own install link without preventing the default. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Make pending receives fast: cut REST load, surface live/polling stateAdam Soltys2026-06-243-8/+34
| | | | | | | | | | | | | | | | | | | Incoming deposits show instantly when the mempool.space WebSocket is healthy (_ingestWs updates immediately). The lag came from the socket being starved: a 20s frontier poll plus a full wallet re-scan every 120s generated enough REST volume to trip mempool's per-IP rate limit (the 429/CORS errors), which in turn degraded the socket — a feedback loop. - While the socket is live, skip the periodic full scan entirely (the WS pushes confirmations and block events) and poll the frontier only every ~25s as a half-open-socket safety net — near-zero recurring REST. - While the socket is down, poll the frontier every ~6s (was 20s) so receives still show quickly, and keep the 120s reconcile scan. - Refresh the frontier on WS (re)connect to catch deposits that landed while disconnected. - Surface a Live/Polling badge on the balance card so a stuck socket is visible. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Allow gifting the whole balance (no-change sweep) via MaxAdam Soltys2026-06-243-22/+75
| | | | | | | | | | | | A gift PSBT commits a sender change output (>= dust), so the entered amount always needed gift + 294 — making it impossible to gift the entire balance. Add a Max toggle on the gift form that builds a no-change sweep: all inputs SIGHASH_NONE, no change output, so the recipient gets the whole balance minus their claim fee. previewGift/buildClaimTx now treat a zero-output PSBT as zero change. A specific-amount gift that can't keep a dust change now points the user to Max instead of failing with a confusing 'not enough funds'. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Balance, claim button, and gift-recipient backup verificationAdam Soltys2026-06-242-10/+64
| | | | | | | | | | | | - Spendable headline no longer counts pending incoming receives: compute it from UTXOs (confirmed coins + our own unconfirmed change, minus gift locks) so a pending spend still debits immediately but a pending receive shows only on the PENDING line (new pendingIncoming getter). - Claim button shows the fee in parens in slightly smaller font, no dot. - Gift recipients now get the same "Verify backup" / "Skip verification" flow as new-wallet creation instead of a single "I've written it down" button. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* Paginate History: cap inline gifts at 3, transactions at 10Adam Soltys2026-06-242-23/+73
| | | | | | | | | Outstanding gifts no longer dominate the History page — show at most 3 inline with a 'View all gifts (N)' button that opens a paginated gift-only list. Transactions paginate 10 per page with prev/next controls. Both reuse a shared pager helper; the all-gifts sub-view resets when leaving the History tab. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-15 16:35:06 +0000