Merge branch 'master' into fix/cjit-channel-false-match

Author: jvsena42

.agents/commands/release.md

@@ -1,5 +1,5 @@
 ---
-description: "Create a new release: bump version, create PR, run release workflow, tag, draft release"
+description: "Create a new release: bump version, create PR, build mainnet, tag, draft release"
 allowed_tools: Bash, Read, Edit, Write, Glob, Grep, AskUserQuestion, mcp__github__create_pull_request, mcp__github__list_pull_requests, mcp__github__pull_request_read, mcp__github__get_file_contents, mcp__github__update_pull_request
 ---
 
@@ -77,8 +77,6 @@ Cherry-pick the commits you need onto this branch now, then continue.
 ```
 Wait for the user to confirm they are done cherry-picking before proceeding.
 
-If the base is a tag that predates the release workflow changes, port the current release workflow support onto the release branch before proceeding. At minimum, the release branch/tag must contain the updated artifact naming in `.github/workflows/release.yml`, otherwise Step 7 will dispatch an old workflow and then look for an artifact name it cannot produce.
-
 Finalize changelog after the release branch contains all release commits:
 
 ```bash
@@ -204,66 +202,28 @@ gh release edit v{newVersionName} --notes-file /tmp/release-notes.md
 
 Print the path to the release notes file so the user can share it for review.
 
-### 7. Run Store Release Workflow
+### 7. Build Mainnet Release
 
 ```bash
-release_ref="v{newVersionName}"
-release_artifact_dir=".ai/release-artifacts-{newVersionName}"
-if ! git show "$release_ref:.github/workflows/release.yml" | grep -q 'bitkit-release-$build_number-$GITHUB_RUN_NUMBER'; then
-  echo "Release ref $release_ref does not contain the current release artifact naming." >&2
-  echo "Port the release workflow changes onto the release branch, retag, then rerun /release." >&2
-  exit 1
-fi
-dispatch_started_at="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
-gh workflow run release.yml --ref "$release_ref"
-run_id=""
-for attempt in {1..30}; do
-  run_id="$(gh run list \
-    --workflow release.yml \
-    --branch "$release_ref" \
-    --event workflow_dispatch \
-    --created ">=$dispatch_started_at" \
-    --limit 1 \
-    --json databaseId \
-    --jq '.[0].databaseId // empty')"
-  if [ -n "$run_id" ]; then
-    break
-  fi
-  sleep 5
-done
-if [ -z "$run_id" ]; then
-  echo "Failed to find release workflow run for $release_ref" >&2
-  exit 1
-fi
-gh run watch "$run_id" --exit-status
-workflow_run_url="$(gh run view "$run_id" --json url --jq .url)"
-run_number="$(gh run view "$run_id" --json number --jq .number)"
-rm -rf "$release_artifact_dir"
-mkdir -p "$release_artifact_dir"
-gh run download "$run_id" \
-  --name "bitkit-release-{newVersionCode}-${run_number}" \
-  --dir "$release_artifact_dir"
-if command -v sha256sum >/dev/null; then
-  (cd "$release_artifact_dir" && sha256sum -c SHA256SUMS.txt)
-else
-  (cd "$release_artifact_dir" && shasum -a 256 -c SHA256SUMS.txt)
-fi
+just release
 ```
 
-Expected APK path: `.ai/release-artifacts-{newVersionName}/bitkit-mainnet-release-{newVersionCode}-universal.apk`
-Expected AAB path: `.ai/release-artifacts-{newVersionName}/bitkit-mainnet-release-{newVersionCode}.aab`
-
-Verify both files exist. If the workflow fails or the artifact checksum verification fails, stop and report the error to the user.
+Expected APK path: `app/build/outputs/apk/mainnet/release/bitkit-mainnet-release-{newVersionCode}-universal.apk`
+Expected AAB path: `app/build/outputs/bundle/mainnetRelease/bitkit-mainnet-release-{newVersionCode}.aab`
+Expected native debug symbols path: `app/build/outputs/native-debug-symbols/mainnetRelease/native-debug-symbols-{newVersionCode}.zip`
 
-Store `workflow_run_url` for the summary.
+Verify all three files exist. The native debug symbols file must be from the same `just release` build as the APK/AAB. Keep the build-numbered filename, e.g. `native-debug-symbols-{newVersionCode}.zip`, so it matches the APK/AAB build number. `just release` resolves upstream native debug symbol artifacts from the Rust dependency packages, merges them into the final archive, and refuses placeholder symbols from stripped packaged `.so` files.
 
-### 8. Upload Workflow APK to Draft Release
+### 8. Upload APK and Native Symbols to Draft Release
 
 ```bash
 gh release upload v{newVersionName} \
-  .ai/release-artifacts-{newVersionName}/bitkit-mainnet-release-{newVersionCode}-universal.apk
+  app/build/outputs/apk/mainnet/release/bitkit-mainnet-release-{newVersionCode}-universal.apk \
+  app/build/outputs/native-debug-symbols/mainnetRelease/native-debug-symbols-{newVersionCode}.zip
 ```
 
+For the Play Store release, upload the AAB as usual, then upload `native-debug-symbols-{newVersionCode}.zip` for the exact version/build in Play Console: App bundle explorer → Downloads → Assets. Verify Play lists the native debug symbols after upload. Keep the release-built archive in GitHub releases or internal release storage; Play Console may only show delete/replace controls after upload, which is enough for release verification.
+
 ### 9. Return to Master
 
 ```bash
@@ -279,16 +239,15 @@ Version bump PR: {PR URL}
 Release branch: release-{newVersionName}
 Tag: v{newVersionName}
 Draft release: {release URL}
-Release workflow: {workflow run URL}
-Artifacts: .ai/release-artifacts-{newVersionName}
 APK uploaded: bitkit-mainnet-release-{newVersionCode}-universal.apk
+Native debug symbols uploaded: native-debug-symbols-{newVersionCode}.zip
 Store release notes: .ai/release-notes-{newVersionName}.md
 
 Next steps:
 - Share release notes with Jacobo for review
-- QA the workflow-built APK
-- Submit the workflow-built AAB to Play Store when QA passes
-- If patching the release branch: increment only versionCode, re-tag, rerun the release workflow, and re-upload
+- QA the APK
+- If patching the release branch: increment only versionCode, re-tag, rebuild, and re-upload
+- Submit to Play Store when QA passes
 - Publish the draft release on GitHub after store release
 - Merge release branch PR into master
 ```

.github/workflows/release-internal.yml

@@ -73,7 +73,11 @@ jobs:
           KEYSTORE_PASSWORD: ${{ secrets.INTERNAL_KEYSTORE_PASSWORD }}
           KEY_ALIAS: ${{ secrets.INTERNAL_KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.INTERNAL_KEY_PASSWORD }}
-        run: ./gradlew assembleMainnetRelease --no-daemon --stacktrace
+        run: |
+          set -euo pipefail
+          ./gradlew assembleMainnetRelease --no-daemon --stacktrace
+          ./gradlew :app:syncNativeDebugSymbolArtifacts --no-daemon --stacktrace
+          scripts/create-native-debug-symbols.sh
 
       - name: Verify native libraries are stripped
         run: |
@@ -124,18 +128,23 @@ jobs:
           artifact_dir="$RUNNER_TEMP/internal-release"
           mkdir -p "$artifact_dir"
           mapfile -d '' apk_paths < <(find app/build/outputs/apk/mainnet/release -name 'bitkit-mainnet-release-*.apk' -print0)
+          mapfile -d '' symbol_paths < <(find app/build/outputs/native-debug-symbols/mainnetRelease -name 'native-debug-symbols-*.zip' -print0)
           test "${#apk_paths[@]}" -gt 0
+          test "${#symbol_paths[@]}" -gt 0
 
           for apk_path in "${apk_paths[@]}"; do
             cp "$apk_path" "$artifact_dir/"
           done
+          for symbol_path in "${symbol_paths[@]}"; do
+            cp "$symbol_path" "$artifact_dir/"
+          done
 
           apk_file="$(basename "${apk_paths[0]}")"
           build_number="${apk_file#bitkit-mainnet-release-}"
           build_number="${build_number%%-*}"
           [[ "$build_number" =~ ^[0-9]+$ ]]
 
-          (cd "$artifact_dir" && sha256sum -- *.apk > SHA256SUMS.txt)
+          (cd "$artifact_dir" && sha256sum -- *.apk native-debug-symbols-*.zip > SHA256SUMS.txt)
           echo "artifact_name=bitkit-release-internal-$build_number-$GITHUB_RUN_NUMBER" >> "$GITHUB_OUTPUT"
           echo "artifact_dir=$artifact_dir" >> "$GITHUB_OUTPUT"
 

.github/workflows/release.yml

@@ -74,7 +74,11 @@ jobs:
           KEYSTORE_PASSWORD: ${{ secrets.BITKIT_KEYSTORE_PASSWORD }}
           KEY_ALIAS: ${{ secrets.BITKIT_KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.BITKIT_KEY_PASSWORD }}
-        run: ./gradlew assembleMainnetRelease bundleMainnetRelease --no-daemon --stacktrace
+        run: |
+          set -euo pipefail
+          ./gradlew assembleMainnetRelease bundleMainnetRelease --no-daemon --stacktrace
+          ./gradlew :app:syncNativeDebugSymbolArtifacts --no-daemon --stacktrace
+          scripts/create-native-debug-symbols.sh
 
       - name: Verify native libraries are stripped
         run: |
@@ -148,22 +152,27 @@ jobs:
           mkdir -p "$artifact_dir"
           mapfile -d '' bundle_paths < <(find app/build/outputs/bundle/mainnetRelease -name 'bitkit-mainnet-release-*.aab' -print0)
           mapfile -d '' apk_paths < <(find app/build/outputs/apk/mainnet/release -name 'bitkit-mainnet-release-*.apk' -print0)
+          mapfile -d '' symbol_paths < <(find app/build/outputs/native-debug-symbols/mainnetRelease -name 'native-debug-symbols-*.zip' -print0)
           test "${#bundle_paths[@]}" -gt 0
           test "${#apk_paths[@]}" -gt 0
+          test "${#symbol_paths[@]}" -gt 0
 
           for bundle_path in "${bundle_paths[@]}"; do
             cp "$bundle_path" "$artifact_dir/"
           done
           for apk_path in "${apk_paths[@]}"; do
             cp "$apk_path" "$artifact_dir/"
           done
+          for symbol_path in "${symbol_paths[@]}"; do
+            cp "$symbol_path" "$artifact_dir/"
+          done
 
           apk_file="$(basename "${apk_paths[0]}")"
           build_number="${apk_file#bitkit-mainnet-release-}"
           build_number="${build_number%%-*}"
           [[ "$build_number" =~ ^[0-9]+$ ]]
 
-          (cd "$artifact_dir" && sha256sum -- *.aab *.apk > SHA256SUMS.txt)
+          (cd "$artifact_dir" && sha256sum -- *.aab *.apk native-debug-symbols-*.zip > SHA256SUMS.txt)
           echo "artifact_name=bitkit-release-$build_number-$GITHUB_RUN_NUMBER" >> "$GITHUB_OUTPUT"
           echo "artifact_dir=$artifact_dir" >> "$GITHUB_OUTPUT"
 

Justfile

@@ -173,7 +173,15 @@ build task="assembleDevDebug":
     {{ gradle }} {{ task }}
 
 release:
+    #!/usr/bin/env sh
+    set -eu
+    symbols_dir="app/build/outputs/native-debug-symbols/mainnetRelease"
+    rm -f "$symbols_dir"/native-debug-symbols*.zip
     NDK_VERSION={{ ndk_ver }} {{ gradle }} assembleMainnetRelease bundleMainnetRelease
+    NDK_VERSION={{ ndk_ver }} {{ gradle }} :app:syncNativeDebugSymbolArtifacts
+    scripts/create-native-debug-symbols.sh
+    symbols="$(find "$symbols_dir" -maxdepth 1 -name 'native-debug-symbols-*.zip' -type f | sort | tail -n 1)"
+    echo "Attach this exact file to GitHub releases, upload it to Play Console for this release, and verify Play lists it: $symbols"
 
 install:
     {{ gradle }} installDevDebug

README.md

@@ -180,6 +180,22 @@ To build the mainnet flavor for release run:
 just release
 ```
 
+`just release` builds the mainnet APK, Play Store AAB, resolves upstream native debug symbol artifacts, and validates the native debug symbols archive.
+
+Release artifacts:
+
+- APK: `app/build/outputs/apk/mainnet/release/`
+- AAB: `app/build/outputs/bundle/mainnetRelease/`
+- Native debug symbols: `app/build/outputs/native-debug-symbols/mainnetRelease/native-debug-symbols-{versionCode}.zip`
+
+The native debug symbols archive must come from the same `just release` build as the APK/AAB being published. Keep the build-numbered filename, e.g. `native-debug-symbols-182.zip`, so it matches the APK/AAB build number. Native Rust dependencies publish stripped release AARs for app size and separate `native-debug-symbols` classifier artifacts for crash symbolication; `just release` merges those upstream symbol artifacts into the final archive and refuses placeholder symbols from stripped packaged `.so` files.
+
+For Play Store releases, upload the AAB as usual, then upload `native-debug-symbols-{versionCode}.zip` for that exact version/build in Play Console: App bundle explorer → Downloads → Assets. Verify Play lists the native debug symbols after upload.
+
+Keep the release-built `native-debug-symbols-{versionCode}.zip` in GitHub releases or internal release storage. Play Console may only show delete/replace controls after upload, which is enough for release verification.
+
+For GitHub releases, attach `native-debug-symbols-{versionCode}.zip` alongside the APK so native crashes from GitHub-distributed builds can be symbolicated later.
+
 #### Android App Bundle (AAB)
 
 `just release` builds both the mainnet APK and Play Store AAB. AAB is generated in `app/build/outputs/bundle/mainnetRelease/`.

app/build.gradle.kts

@@ -1,6 +1,9 @@
 import com.android.build.gradle.internal.api.BaseVariantOutputImpl
 import com.android.build.gradle.internal.tasks.FinalizeBundleTask
 import io.gitlab.arturbosch.detekt.Detekt
+import org.gradle.api.artifacts.MinimalExternalModuleDependency
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.Sync
 import org.gradle.api.tasks.testing.logging.TestExceptionFormat
 import org.gradle.api.tasks.testing.logging.TestLogEvent
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
@@ -232,7 +235,7 @@ android {
             )
             signingConfig = signingConfigs.getByName("release")
             ndk {
-                debugSymbolLevel = "SYMBOL_TABLE"
+                debugSymbolLevel = "FULL"
                 // noinspection ChromeOsAbiSupport
                 abiFilters += listOf("armeabi-v7a", "arm64-v8a")
             }
@@ -318,6 +321,31 @@ composeCompiler {
     reportsDestination = layout.buildDirectory.dir("compose_compiler")
 }
 
+val nativeDebugSymbols by configurations.creating {
+    isCanBeConsumed = false
+    isCanBeResolved = true
+}
+
+fun Provider<MinimalExternalModuleDependency>.nativeDebugSymbolsArtifact(): String {
+    val dependency = get()
+    val version = dependency.versionConstraint.requiredVersion
+        .ifBlank { dependency.versionConstraint.preferredVersion }
+
+    require(version.isNotBlank()) {
+        "Native debug symbols dependency '${dependency.module}' must declare an explicit version."
+    }
+
+    return "${dependency.module.group}:${dependency.module.name}:$version:native-debug-symbols@zip"
+}
+
+val syncNativeDebugSymbolArtifacts by tasks.registering(Sync::class) {
+    group = "build"
+    description = "Downloads native debug symbol archives for release native dependencies."
+
+    from(nativeDebugSymbols)
+    into(layout.buildDirectory.dir("intermediates/native-debug-symbol-artifacts"))
+}
+
 dependencies {
     implementation(fileTree("libs") { include("*.aar", "*.jar") })
     implementation(libs.jna) { artifact { type = "aar" } }
@@ -343,6 +371,9 @@ dependencies {
     implementation(libs.bitkit.core)
     implementation(libs.paykit)
     implementation(libs.vss.client)
+    nativeDebugSymbols(libs.bitkit.core.nativeDebugSymbolsArtifact())
+    nativeDebugSymbols(libs.ldk.node.android.nativeDebugSymbolsArtifact())
+    nativeDebugSymbols(libs.vss.client.nativeDebugSymbolsArtifact())
     // Firebase
     implementation(platform(libs.firebase.bom))
     implementation(libs.firebase.messaging)

app/src/main/java/to/bitkit/models/HwWallet.kt

@@ -4,6 +4,8 @@ import androidx.compose.runtime.Immutable
 import androidx.compose.runtime.Stable
 import com.synonym.bitkitcore.Activity
 import kotlinx.collections.immutable.ImmutableList
+import kotlinx.collections.immutable.ImmutableSet
+import kotlinx.collections.immutable.persistentSetOf
 import kotlinx.serialization.Serializable
 
 /** A paired hardware wallet tracked as a watch-only balance. */
@@ -16,6 +18,7 @@ data class HwWallet(
     val isConnected: Boolean,
     val balanceSats: ULong,
     val activities: ImmutableList<Activity>,
+    val deviceIds: ImmutableSet<String> = persistentSetOf(id),
 )
 
 /** Serializable per-device balance snapshot carried by [BalanceState]. */

app/src/main/java/to/bitkit/repositories/HwWalletRepo.kt

@@ -9,6 +9,7 @@ import com.synonym.bitkitcore.WatcherEvent
 import kotlinx.collections.immutable.ImmutableList
 import kotlinx.collections.immutable.persistentListOf
 import kotlinx.collections.immutable.toImmutableList
+import kotlinx.collections.immutable.toImmutableSet
 import kotlinx.coroutines.CoroutineDispatcher
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.SupervisorJob
@@ -40,6 +41,7 @@ import to.bitkit.models.safe
 import to.bitkit.models.toAccountType
 import to.bitkit.models.toAddressType
 import to.bitkit.models.toCoreNetwork
+import to.bitkit.utils.AppError
 import to.bitkit.utils.Logger
 import javax.inject.Inject
 import javax.inject.Singleton
@@ -109,6 +111,34 @@ class HwWalletRepo @Inject constructor(
 
     fun cancelPairingCode() = trezorRepo.cancelPairingCode()
 
+    /**
+     * Removes a paired hardware wallet: stops its watchers and forgets every device entry
+     * that tracks the same wallet. The same physical device paired over both bluetooth and
+     * usb is stored once per transport but shares an xpub-derived identity, so forgetting a
+     * single id would leave the tile reappearing through the other transport.
+     */
+    suspend fun removeDevice(deviceId: String): Result<Unit> = withContext(ioDispatcher) {
+        runCatching {
+            val knownDevices = hwWalletStore.loadKnownDevices()
+            val target = knownDevices.find { it.id == deviceId }
+            val ids = when (target) {
+                null -> setOf(deviceId)
+                else -> knownDevices.filter { it.walletKey == target.walletKey }.map { it.id }.toSet()
+            }
+            activeWatchers.toList()
+                .filter { it.toDeviceId() in ids }
+                .forEach {
+                    if (!stopActiveWatcher(it)) throw AppError("Failed to stop hardware wallet watcher '$it'")
+                }
+            val failures = ids.mapNotNull { trezorRepo.forgetDevice(it).exceptionOrNull() }
+            val remaining = hwWalletStore.loadKnownDevices().map { it.id }.toSet()
+            failures.firstOrNull()?.let { throw it }
+            check(ids.none { it in remaining }) { "Hardware wallet '$deviceId' still present after removal" }
+        }.onFailure {
+            watcherSyncRequests.tryEmit(Unit)
+        }
+    }
+
     val wallets: StateFlow<ImmutableList<HwWallet>> = combine(
         hwWalletStore.data,
         trezorRepo.state,
@@ -135,11 +165,16 @@ class HwWalletRepo @Inject constructor(
                     activities = deviceWatchers
                         .toMergedActivities()
                         .toImmutableList(),
+                    deviceIds = ids.toImmutableSet(),
                 )
             }
             .toImmutableList()
     }.stateIn(scope, SharingStarted.Eagerly, persistentListOf())
 
+    val walletsLoaded: StateFlow<Boolean> = hwWalletStore.data
+        .map { true }
+        .stateIn(scope, SharingStarted.Eagerly, false)
+
     val totalSats: StateFlow<ULong> = wallets
         .map { wallets -> wallets.fold(0uL) { acc, wallet -> acc + wallet.balanceSats } }
         .stateIn(scope, SharingStarted.Eagerly, 0uL)

app/src/main/java/to/bitkit/repositories/TrezorRepo.kt

@@ -652,11 +652,15 @@ class TrezorRepo @Inject constructor(
             TrezorDebugLog.log("FORGET", "Clearing credentials...")
             trezorTransport.clearDeviceCredential(deviceId)
             val clearCredentialsResult = runCatching { trezorService.clearCredentials(deviceId) }
-            val updated = _state.value.knownDevices.filter { it.id != deviceId }
+            val knownDevices = (_state.value.knownDevices + loadKnownDevices()).distinctBy { it.id }
+            val updated = knownDevices.filter { it.id != deviceId }
             saveKnownDevices(updated)
             _state.update { it.copy(knownDevices = updated.toImmutableList()) }
-            disconnectResult.getOrThrow()
             clearCredentialsResult.getOrThrow()
+            disconnectResult.onFailure {
+                TrezorDebugLog.log("FORGET", "Ignored disconnect failure: ${it.message}")
+                Logger.warn("Ignored disconnect failure while forgetting device '$deviceId'", it, context = TAG)
+            }
             TrezorDebugLog.log("FORGET", "Device forgotten successfully")
             Logger.info("Forgot device: '$deviceId'", context = TAG)
         }.onFailure { e ->