feat: transfer to spending from HW wallet by jvsena42 · Pull Request #616 · synonymdev/bitkit-ios

jvsena42 · 2026-07-06T09:18:29Z

This PR adds the watch-only Transfer to Spending flow for funding a Lightning channel from a paired Trezor, with the on-chain funding transaction signed on the device. It builds on the connect-hardware flow (#614) and is an iOS port of bitkit-android's transfer-to-spending flow (synonymdev/bitkit-android#1039).

Description

Adds the Amount → Sign With Your Device → Transaction Signed flow, entered from the Hardware Wallet detail screen's Transfer To Spending button, then handing off to the existing Funds in Transfer progress screen.
Sources the available amount and MAX from the device's native-segwit account balance, minus the LSP fee and a composed on-chain mining-fee reserve, while respecting the LSP receiving-cap limit.
Composes the funding transaction, signs it on the Trezor, broadcasts it, then records the actual mining fee, fee rate, and channel on the transfer activity.
Confirms the hardware-wallet transfer activity from watcher data without clobbering its existing transfer metadata.
Prevents the total balance from double-counting during the paid-order → pending-channel → ready-channel transition by resolving each transfer's channel via its funding transaction.
Shows the shared Spending intro before the first hardware transfer, then continues straight to the hardware amount flow on subsequent transfers.
Hardens the signing path: reconnects a known Bluetooth device before signing, clears a stale session on a signing timeout, and gives the Trezor Bridge signing call a longer read timeout so on-device confirmation doesn't time out at 30s.
Reuses the existing transfer machinery — spending-limit calculation, Blocktank order, channel watcher, and the Funds in Transfer screen — swapping only local signing for on-device signing.

Because iOS is Bluetooth-only in production, the Android USB/Bridge stale-session handling is limited to what the dev/E2E Bridge needs (the longer signing read timeout). The device-signing orchestration is extracted into a small HwFundingSigner collaborator so the transfer view model keeps only the coordination that reuses the shared machinery. v1 funds from the native-segwit account only; multi-address-type spend is out of scope.

QA Notes

OBS: driven on the Trezor Bridge emulator on regtest; please re-verify the full happy path and confirmation on a physical device.

Manual Tests

Automated Checks

Unit tests added: BitkitTests/HwFundingSignerTests.swift (9), BitkitTests/TransferViewModelHwTests.swift (5), BitkitTests/HwWalletManagerFundingTests.swift (4), and shared BitkitTests/HwTransferMocks.swift — cover the fee-reserve math (rate + both fallbacks), the reconnect/compose/sign/timeout orchestration and stale-session cleanup, the view model's error mapping and signing re-entrancy guard, and the native-segwit funding balance + funding-account resolution. 18/18 pass on the iPhone 16 simulator.
Build passes: xcodebuild -workspace Bitkit.xcodeproj/project.xcworkspace -scheme Bitkit -configuration Debug -destination 'platform=iOS Simulator,id=<iPhone 16>' ONLY_ACTIVE_ARCH=YES build (concrete simulator UDID + ONLY_ACTIVE_ARCH=YES because the Rust xcframeworks are arm64-only).
node scripts/validate-translations.js: 0 errors (run with glob resolved locally, since this checkout has no package.json).
SwiftFormat: clean on changed files.
No unit tests for the BalanceManager double-count fix or TransferService channel-resolution/activity marking: iOS's LightningService/BlocktankService/CoreService lack the protocol seams Android's repos have, so these are covered by the regtest E2E rather than isolated unit tests.
CI: standard build and test checks run by the PR bot.

Linked Issues/Tasks

Refs epic: Trezor Hardware Wallet UI #589 (epic: Trezor Hardware Wallet UI)
Stacked on feat: connect hardware flow #614
Ports synonymdev/bitkit-android#1039
Figma — Transfer to Spending from HW

Screenshot / Video

transfer-emulator.mov

close-channel.mov

jvsena42 · 2026-07-06T12:29:34Z

waiting for upstream branch merge

…s correctly set later by markOnchainActivityAsTransfer)

jvsena42 · 2026-07-07T11:05:26Z

draft for implement fixes

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e293b4920e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

jvsena42 · 2026-07-07T12:01:49Z

draft for check comments

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1d13e31089

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

…amont mid sign

jvsena42 · 2026-07-07T16:53:35Z

code re-checked and video updated

piotr-iohk · 2026-07-08T08:32:21Z

Manual QA — PR #616 retest (HW transfer to spending)

Retested on latest HEAD after follow-up fixes. Physical Trezor Safe 7, BLE, regtest (not Bridge emulator).

Attachments:
bitkit_logs_2026-07-08_08-12-00.zip

Verdict: request changes — one item left

Area	Previous	Retest
Happy path (sign → broadcast → in-transfer)	✅	✅ Still good
Duplicate activities after transfer	❌	✅ Fixed — single transfer row in Activity / home
BLE reconnect toast on sign screen	optional follow-up	✅ INFO toast `hardware__connect_error` for known BLE device (Android parity)
Cancel on device	❌	❌ Still shows generic Error toast

Everything from the earlier review looks addressed except cancel-on-device.

BLE reconnect INFO toast — ✅

When reconnect fails during HW transfer sign for a known BLE device, the app shows an INFO toast with hardware__connect_error instead of the ERROR reconnect copy used for USB — Android / #1062 parity. Confirmed on device and in logs (ble:4837BF24… reconnect failure @ 07:57:24).

Cancel on Trezor sign screen — still fix before merge

Repro: Transfer to Spending → Sign → Open Trezor Connect → cancel/decline on device.

Expected: silent no-op (Android / #1062); stay on sign screen, retry works.

Actual: generic Error toast still appears on device.

616-2.mp4

Note: Retry after cancel does work — I cancelled once, then signed successfully on the next attempt (c170d214… in logs). The blocker is UX only (spurious error toast), not flow breakage.

Logs (bitkit_foreground_2026-07-08_07-54-57.log, bitkit_foreground_2026-07-08_07-57-09.log):

[07:56:16] ERROR: App Error [BitkitCore.TrezorError.UserCancelled] - ServiceQueue: core
[07:56:16] PERF: signTxFromPsbt(...) took 12.09 seconds
...
[08:09:01] ERROR: App Error [BitkitCore.TrezorError.UserCancelled] - ServiceQueue: core
[08:09:01] PERF: signTxFromPsbt(...) took 22.51 seconds
[08:09:31] PERF: signTxFromPsbt(...) took 10.9 seconds   ← retry succeeded
[08:09:32] Created sent onchain activity for txid c170d214…

Why the partial fix doesn’t cover device: isTrezorUserCancellation() + TransferViewModel silent path were added, but ServiceQueue wraps core errors in AppError before they reach the view model. The helper only matches a direct TrezorError cast — on device the caught error is AppError(message: "App Error", debugMessage: "BitkitCore.TrezorError.UserCancelled"), so the check returns false → hwTransferError = .generic(...) → SpendingHwSign toast.

Unit tests pass because mocks throw raw TrezorError.UserCancelled; TrezorCancellationTests even asserts wrapped AppError returns false, which matches production failure.

Recommendation:

Extend isTrezorUserCancellation() to detect cancellation through AppError (e.g. parse debugMessage for TrezorError.UserCancelled / PinCancelled / PassphraseCancelled, or preserve/unpack the underlying error in AppError.init(error:) for TrezorError).
Add a unit test that wraps TrezorError.UserCancelled in AppError(error:) and asserts isTrezorUserCancellation() is true — mirrors what ServiceQueue actually throws on device.
Optionally add an integration-style TransferViewModelHwTests case where MockHwFunding.signError = AppError(error: TrezorError.UserCancelled) to guard the full path.

Recommendation: merge after cancel toast fix; duplicate-activity dedup, BLE reconnect INFO toast, and happy path look good on Safe 7 ✅

jvsena42 · 2026-07-08T10:17:19Z

Test after 3f799c2

deny-sign.mov

Thanks! I forgot I could test this flor from emulator

piotr-iohk · 2026-07-08T11:43:35Z

Manual QA — PR #616 retest (HW transfer to spending)

Retested on latest HEAD after cancel fix (3f799c20). Physical Trezor Safe 7, BLE, regtest.

Attachments:
bitkit_logs_2026-07-08_11-40-37.zip

Verdict: approve ✅

All items from earlier review pass on device.

Area	Status
Happy path (sign → broadcast → in-transfer)	✅ Two transfers completed (`a67804e3…`, `35260708…`)
Cancel on device	✅ Silent no-op; retry works
Duplicate activities	✅ Single transfer row in Activity / home
BLE reconnect INFO toast	✅ `hardware__connect_error` on known BLE reconnect miss

Cancel on device — fixed. Declined on Trezor twice; no generic Error toast. Logs show wrapped UserCancelled from ServiceQueue followed by the silent path:

[11:34:23] ERROR: App Error [BitkitCore.TrezorError.UserCancelled] - ServiceQueue: core
[11:34:23] INFO: Hardware transfer cancelled on device 'ble:DC67CFBD…'
[11:34:41] PERF: signTxFromPsbt(...) took 14.56 seconds   ← retry succeeded
[11:34:42] Created sent onchain activity for txid a67804e3…
...
[11:38:49] ERROR: App Error [BitkitCore.TrezorError.UserCancelled] - ServiceQueue: core
[11:38:49] INFO: Hardware transfer cancelled on device 'ble:DC67CFBD…'
[11:39:11] PERF: signTxFromPsbt(...) took 13.04 seconds   ← retry succeeded
[11:39:12] Created sent onchain activity for txid 35260708…

(bitkit_foreground_2026-07-08_11-30-58.log)

Contrast with pre-fix session in the same bundle (07-54-57.log @ 07:56:16): UserCancelled logged but no Hardware transfer cancelled on device line — matches the old generic-toast behaviour.

Recommendation: merge #616.

jvsena42 added 13 commits July 3, 2026 14:11

feat: Hw funding models

176ce3b

feat: funding methods

f5a674e

feat: reconnect hardening

7ca7a39

feat: transfer viewmodel methods

6ff0299

feat: transfer activity methods

af75113

fix: balance double counting

e48bad9

feat: UI logic

2c4a140

feat: navigation

93e760a

feat: localization and asets

75ba1f0

test: transfer tests

b7b520b

refactor: make code more testable

f4725fa

refactor: extract HW methods from transfer viewmodel

a522880

fix: add longer read time-out

63be3e7

jvsena42 self-assigned this Jul 6, 2026

jvsena42 added this to the 2.4.0 milestone Jul 6, 2026

jvsena42 mentioned this pull request Jul 6, 2026

epic: Trezor Hardware Wallet UI #589

Open

9 tasks

jvsena42 added 4 commits July 6, 2026 07:23

doc: update changelog entry

2a63fa9

Merge branch 'feat/hw-wallet-connect' into feat/hw-transfer-to-spending

8122f44

Merge branch 'feat/hw-wallet-connect' into feat/hw-transfer-to-spending

61cb584

fix: increase timout for /call messages

d9feafa

Merge branch 'feat/hw-wallet-connect' into feat/hw-transfer-to-spending

09a148e

Base automatically changed from feat/hw-wallet-connect to master July 6, 2026 18:11

jvsena42 added 6 commits July 6, 2026 16:55

Merge branch 'master' into feat/hw-transfer-to-spending

c6f5c14

fix: display availability error on amount screen

3b9d131

fix: stop storing the SCID in the activity's channelId; pass nil (it'…

1a682b7

…s correctly set later by markOnchainActivityAsTransfer)

fix: handle compose error

f553e8f

fix: mark activity as transfer atomically

cdd13d7

fix: improve send marx calc for hardware wallets

102f858

jvsena42 marked this pull request as ready for review July 6, 2026 21:11

This comment was marked as outdated.

Sign in to view

jvsena42 marked this pull request as draft July 7, 2026 11:05

auto-merge was automatically disabled July 7, 2026 11:05
Pull request was converted to draft

jvsena42 added 3 commits July 7, 2026 08:05

fix: handle user cancelation error

6a5a667

test: device cancelation tests

99f05b7

fix: collapse HW activities duplicates

e293b49

jvsena42 marked this pull request as ready for review July 7, 2026 11:16

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread Bitkit/Views/Transfer/Hardware/SpendingAmountHw.swift Outdated

Comment thread Bitkit/Views/Transfer/Hardware/SpendingHwSign.swift

Comment thread Bitkit/ViewModels/TransferViewModel.swift

Comment thread Bitkit/Managers/BalanceManager.swift

jvsena42 added 3 commits July 7, 2026 08:52

fix: fallback to cached channelId on order fetch error

eff5dcf

fix: rerun HW limits on Blocktank info

f215db5

fix: cancel hwSignTask on abandonment

cdf4112

jvsena42 marked this pull request as draft July 7, 2026 12:01

fix: port android warmup logic and reconnect toast

1d13e31

jvsena42 marked this pull request as ready for review July 7, 2026 16:12

greptile-apps Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread Bitkit/ViewModels/HwFundingSigner.swift

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread Bitkit/Managers/TrezorManager.swift

Comment thread Bitkit/Views/Transfer/Hardware/SpendingHwSign.swift Outdated

jvsena42 added 2 commits July 7, 2026 13:22

fix: bump the iOS broadcast timeout to 120s to match Android's budget

ee780fa

fix: disable order mutating controls while signing to prevent change …

2484d8d

…amont mid sign

jvsena42 requested a review from piotr-iohk July 7, 2026 16:44

fix: validate rezer cancelaition error from inderlying error

3f799c2

piotr-iohk approved these changes Jul 8, 2026

View reviewed changes

jvsena42 enabled auto-merge July 8, 2026 11:44

jvsena42 merged commit 01d5d5b into master Jul 8, 2026
11 checks passed

jvsena42 deleted the feat/hw-transfer-to-spending branch July 8, 2026 12:05

Uh oh!

Conversation

jvsena42 commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

QA Notes

Manual Tests

Automated Checks

Linked Issues/Tasks

Screenshot / Video

Uh oh!

jvsena42 commented Jul 6, 2026

Uh oh!

This comment was marked as outdated.

jvsena42 commented Jul 7, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jvsena42 commented Jul 7, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

jvsena42 commented Jul 7, 2026

Uh oh!

piotr-iohk commented Jul 8, 2026

Manual QA — PR #616 retest (HW transfer to spending)

Verdict: request changes — one item left

BLE reconnect INFO toast — ✅

Cancel on Trezor sign screen — still fix before merge

Uh oh!

jvsena42 commented Jul 8, 2026

Uh oh!

piotr-iohk commented Jul 8, 2026

Manual QA — PR #616 retest (HW transfer to spending)

Verdict: approve ✅

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jvsena42 commented Jul 6, 2026 •

edited

Loading