Electrum

Merge pull request #10791 from SomberNight/202608_wallet_sign_message2

wallet: sign_message: strip whitespaces in GUis, do not strip in CLI

wallet: sign_message: strip whitespaces in GUIs, do not strip in CLI

- stripping whitespaces leads to better UX for GUIs IMO, but it's counter-productive for CLI
- our previous behaviour was unintentionally inconsistent:
- qt stripped the message in both sign and verify
- qml stripped the message in verify but not in sign (until #10787)
- cli stripped the message in both sign and verify
- qml also stripped the signature in verify, which was not done anywhere else
- now this code is de-duped, and the default becomes stripping both message and signature; with the CLI explicitly opting out of that

ref https://github.com/spesmilo/electrum/issues/4327
closes https://github.com/spesmilo/electrum/pull/10787
closes https://github.com/spesmilo/electrum/pull/10788

wallet: decrypt_message: nicer error msg if pubkey is unrelated

qt: main_window: use TaskThread for each of sign/verify/encrypt/decrypt

To make them homogeneous.
Also note: window.on_error handles UserFacingException, which the wallet methods can now raise.

wallet: sign_message: force kwargs

wallet: sign_message: consolidate checks from UIs

wallet: decrypt_message: consolidate checks from UIs

wallet: refactor: add encrypt_message method, consolidated from UIs

wallet: refactor: add verify_message method, consolidated from UIs

qt: main_window: add type hints to sign/verify, encrypt/decrypt

coldcard: fix get_soft_device_id() discarding its return value

qml: strip whitespace from message before signing, as in qt gui

The qt gui strips leading/trailing whitespace from the message (and
address) both when signing and when verifying (see #4327). The qml gui
already strips in verifyMessage (qedaemon.py), but not in signMessage:
a message with leading/trailing whitespace signed in the qml gui would
produce a signature that fails verification even in the same dialog.

Strip in signMessage too, replicating the qt gui behaviour.

related: https://github.com/spesmilo/electrum/issues/4327
related: https://github.com/btclib-org/btclib/issues/200

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

config: don't save "hidden wallet" paths in CURRENT_WALLET cv

otherwise if the android app is launched and the last opened wallet was a hidden wallet, it would get automatically opened

similarly, don't add it into the recents list (though that's not exposed in qml atm)

lnrouter: liquidity hints: add extra penalty if amt near cannot_send

We guide LNPathFinder away from channels where there is a known cannot_send amount just barely above the HTLC value.

Somewhat follows 6a97e74ce82b9e2055b1ccf31f43288c9becfa02, as before that commit, we were often (unintentionally) blacklisting chans with liquidity failures but now we allow retrying them.
Without current change, the liqudity-based penalty would disallow sending an HTLC over the the known "cannot_send" but it would basically not distinguish between 0.999*cannot_send and 0. Instead, just as a completely naive bandaid, I propose penalising HTLC values greater than 80% of the known cannot_send.

lnwallet: don't blacklist htlc failures without channel update

The lightning spec changed so that htlc failures don't have to include
a channel_update message anymore (https://github.com/lightning/bolts/pull/1173).
We shouldn't blacklist a channel for not including a channel_update
if the error code signals a liquidity issue (TEMPORARY_CHANNEL_FAILURE), instead
it is sufficient to just record the liquidity hint and try with a smaller
part.

hww/qt: followup 898a4c270

Also make the other attribute private

trezor: drop session after closing it

Set `TrezorClientBase._session = None` after closing a session
(e.g. after session timeout) so the next session access will prompt
for the pin on the device instead of throwing an `InvalidSessionError`
when trying to access the device.

E.g. when trying to sign a tx after the session timed out:
```
80.64 | I | plugins.trezor.clientbase.TrezorClientBase | timed out
80.64 | I | plugins.trezor.clientbase.TrezorClientBase | clear session: <electrum.plugins.trezor.clientbase.TrezorClientBase object at 0x7f24cd34f080>
80.64 | I | plugins.trezor.clientbase.TrezorClientBase | locking: <trezorlib.protocol_v1.TrezorClientV1 object at 0x7f24cd34e160>
80.90 | I | plugins.trezor.clientbase.TrezorClientBase | closing: SessionV1(id=d5e6015e501acf4b10b3a3e50f1f9307768e434330568e7d5e7b1babed066438)
112.83 | I | plugin.DeviceMgr | getting client for keystore
112.83 | I | plugin.DeviceMgr | end client for keystore
113.10 | I | plugin.DeviceMgr | getting client for keystore
113.10 | I | plugin.DeviceMgr | end client for keystore
113.11 | E | gui.qt.main_window.[trezor] | on_error
Traceback (most recent call last):
File "/var/home/user/code/code_vm/electrum/electrum/gui/common_qt/util.py", line 165, in run
result = task.task()
File "/var/home/user/code/code_vm/electrum/electrum/wallet.py", line 2822, in sign_transaction
k.sign_transaction(tmp_tx, password)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
File "/var/home/user/code/code_vm/electrum/electrum/plugins/trezor/trezor.py", line 100, in sign_transaction
self.plugin.sign_transaction(self, tx, prev_tx)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
File "/var/home/user/code/code_vm/electrum/electrum/plugin.py", line 1000, in wrapper
return run_in_hwd_thread(partial(func, *args, **kwargs))
File "/var/home/user/code/code_vm/electrum/electrum/plugin.py", line 993, in run_in_hwd_thread
return fut.result()
~~~~~~~~~~^^
File "/usr/lib64/python3.14/concurrent/futures/_base.py", line 454, in result
return self.__get_result()
~~~~~~~~~~~~~~~~~^^
File "/usr/lib64/python3.14/concurrent/futures/_base.py", line 396, in __get_result
raise self._exception
File "/usr/lib64/python3.14/concurrent/futures/thread.py", line 86, in run
result = ctx.run(self.task)
File "/usr/lib64/python3.14/concurrent/futures/thread.py", line 73, in run
return fn(*args, **kwargs)
File "/var/home/user/code/code_vm/electrum/electrum/plugins/trezor/trezor.py", line 344, in sign_transaction
signatures, _ = client.sign_tx(self.get_coin_name(),
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
inputs, outputs,
^^^^^^^^^^^^^^^^
...<3 lines>...
serialize=False,
^^^^^^^^^^^^^^^^
prev_txes=prev_tx)
^^^^^^^^^^^^^^^^^^
File "/var/home/user/code/code_vm/electrum/electrum/plugin.py", line 1000, in wrapper
return run_in_hwd_thread(partial(func, *args, **kwargs))
File "/var/home/user/code/code_vm/electrum/electrum/plugin.py", line 990, in run_in_hwd_thread
return func()
File "/var/home/user/code/code_vm/electrum/electrum/plugins/trezor/clientbase.py", line 356, in sign_tx
return trezorlib.btc.sign_tx(self.session, *args, **kwargs)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/home/user/code/code_vm/electrum/env/lib64/python3.14/site-packages/trezorlib/tools.py", line 379, in wrapper
result = self.func(session, *args, **kwargs)
File "/var/home/user/code/code_vm/electrum/env/lib64/python3.14/site-packages/trezorlib/btc.py", line 329, in sign_tx
res = session.call(signtx, expect=messages.TxRequest)
File "/var/home/user/code/code_vm/electrum/env/lib64/python3.14/site-packages/trezorlib/client.py", line 113, in call
raise exceptions.InvalidSessionError(self.id)
trezorlib.exceptions.InvalidSessionError: b'\xd5\xe6\x01^P\x1a\xcfK\x10\xb3\xa3\xe5\x0f\x1f\x93\x07v\x8eCC0V\x8e}^{\x1b\xab\xed\x06d8'
```

test_lnwallet: add unittest for unchanged channel update from failed htlc

Tests that a TEMPORARY_CHANNEL_FAILURE whose channel update leaves the
policy unchanged does not blacklist the channel (the liquidity hint is
sufficient), while other failure codes still blacklist.

lnwallet: rename flag in handle_error_code_from_failed_htlc

As with the previous commit it is not strictly updating anything
when returning (False, True), so calling the second return value
`handled` instead of `updated` might be less misleading.

lnwallet: don't blacklist chan on unchanged channel update

Stop blacklisting a channel for 1h if they send us a
`TEMPORARY_CHANNEL_FAILURE` containing a channel update we already
know about.

If our channel db is up-to-date it is quite likely they will send
us a channel policy we already know about. However it might just
mean that the htlc we sent exceeds their available liquidity.
For this purpose we already record liquidity hints in `LNPathFinder`
so future attempts through this channel will consider this limitation,
no need to blacklist the whole channel for 1h and render it unusable for us.

lnrouter: LiquidityHints: add note about thread-safety

and maybe make reading the LiquidAmounts thread-safe(?) without actually locking

lnrouter: (trivial) rename LiquidityHintItem -> LiquidAmount

lnrouter: add note about can_pay() false positives for concurrent MPP routes

lnrouter: use separate timestamp per liquidity hint value

Use a separate timestamp for each value in a `LiquidityHint`
instead of a single shared one for all values.

Fixes:
1. We send 1M sat, failure, record cannot_send = 1M
2. Two hours pass, hint expired (shared ts reset)
3. We send 10k, update_can_send resets the shared ts
> cannot_send is active again, even though it is outdated
> We won't try sending >1M sat through the channel until the
process is restarted and the in-memory data is gone.

The setter method comparisons now also use the value from the getter
to prevent an expired larger value from blocking a new smaller one.

lnrouter: LiquidityHints: add comment to update_liquidity_hints