[dendisuhubdy]

Four wallet fixes from the chain-21 network experiment, one commit each. All are client-only: no node, RPC or chain change.

#141: rand no longer exits 1 after a successful submit

• As soon as rand_sendTransaction returns a hash, rand prints submitted <kind> <hash> on stderr, before waiting. <kind> is the node's own action.kind, and a plain bundle is transfer. It goes to stderr so stdout contracts such as order <hash> and $(rand address) don't change. faucet keeps its existing submitted mint … line on stdout.
• The commit wait (wait_for_transaction) and the receipt wait (wait_for_receipt) retry status polls that time out, are reset, or get a node error. The retry delay starts at 0.5 s and doubles up to 5 s, until the wait's deadline.
• If the wait never sees the commit, it ends with the new ConfirmationUnknown error and rand exits 4. The message says "submitted, confirmation unknown" and gives the hash, the last poll's failure, and a rand tx <hash> hint. A rejection is still exit 1.
• All commands use the same wait path: send, token create/mint/burn, program deploy/call/invoke, bond, bridge, multisig, perps, governance bundle-less actions, and faucet.
• New global flag --wait-timeout <SECS> / RAND_WAIT_TIMEOUT.
• A rescan or height read that fails after the commit was seen now says the transaction committed.
• Exit codes (0/1/2/3/4) are documented in docs/cli.md.

#142: token create --initial / --fixed-supply take display units

• Both flags now read display units at --decimals, the same as token mint --amount. --initial-units / --fixed-supply-units take base units; clap refuses a flag together with its -units twin.
• On success, token create echoes minted <display> <SYMBOL> (<N> units) to <rand1…>.
• This is a behaviour change, recorded in the CHANGELOG's Unreleased (v0.8.3) section. Updated docs/cli.md, docs/tokens.md and docs/shielded.md.

#147: the scan no longer reveals which leaves are the wallet's

• leaf_page now reads rand_getCommitments(cursor, 500) and nothing else. The request sequence depends only on the cursor and the tree size, and ownership is decided locally after each page arrives.

• Removed the heads/chunk path: rand_getScanLeaves reads, fetch_chunks, heads_page, may_be_ours, and RpcClient::{with_scan_chunk, scan_chunk}.

• --scan-chunk is still accepted (now hidden) and ignored, with a warning.

• Fixed the docs: docs/shielded.md's scanning bullet (it claimed the scan "reveals nothing about which leaves are yours"), the rand_getScanLeaves section and changelog in docs/rpc.md, and the --scan-chunk row in docs/cli.md.

• Measured byte cost (test a_scan_reads_the_same_full_pages_for_every_wallet_and_measures_their_cost). Setup: 2 000 leaves with chain 21's 1 860-byte envelope; the wallet owns 6 leaves spread over 4 of the 8 chunks of 256 leaves.

  read	bytes	per leaf
  full pages (the new scan)	7 769 996	3 885
  heads only	3 439 991	1 720
  old path: heads + the 4 owned chunks read in full	7 231 597	—

  So a full row costs 2.26× a head. That is the whole increase for a wallet whose notes fell in no chunk. For this test's wallet, whose old scan already read half the envelopes, the increase is 1.07×.

#148: --proxy <URL> / RAND_PROXY

• Enabled reqwest's socks feature. Cargo.lock is unchanged because reqwest 0.12.28 proxies through hyper-util, which is already a dependency.
• Accepted schemes: socks5h:// (Tor: socks5h://127.0.0.1:9050), socks5://, http://, https://. Any other scheme is refused.
• rand sets the proxy as the process default before any client exists, so every RPC client and every remote prover goes through it: --prover, prover pair, and the trusted pool.
• An explicit proxy turns off the HTTP(S)_PROXY environment variables. If the proxy is down, the request fails; nothing falls back to a direct connection.
• Added a Tor recipe to docs/cli.md (the repo has no docs/wallet.md) and a line to docs/shielded.md.

Tests

New tests:

• rand send exits 1 after a successful submit when a status poll times out #141: 6 unit tests in lib.rs:

  • a failing poll (dropped, stalled, or -32603) is retried until the commit;
  • a stalled, dropped, erroring or pending wait ends in ConfirmationUnknown;
  • a rejection after a failed poll is still a failure;
  • the receipt wait retries;
  • the --wait-timeout override wins;
  • the submitted line uses the node's kind names.

  Also 2 CLI tests: a faucet whose polls fail exits 4 with the hash, and a rejection exits 1; perp order prints submitted perp_order <hash> before exit 4. I updated create_token_keeps_the_pending_key_when_a_call_after_the_send_fails, which now expects ConfirmationUnknown (the authority key is still kept).

• token create --initial / --fixed-supply read base units; every other token amount is display units #142: a unit test for the amount helper, the parse test extended to the -units flags, and 2 new CLI refusal cases.

• Privacy: wallet scan fetches commitments only for matching leaves, revealing owned leaf indices to the RPC #147: two_wallets_make_identical_requests_whatever_they_own: a wallet that owns every kind of leaf and one that owns none produce identical request logs (every method, every parameter), with only fixed-size pages and no heads read. Plus the 2 000-leaf measurement test above, which also checks that the two wallets' request logs are identical.

• Privacy: client has no SOCKS5/Tor proxy support (--proxy) #148: a minimal SOCKS5 stub. Tests: the RPC client and the remote prover each reach their server only through the stub; a dead proxy fails the call; the scheme check; and rand --proxy / RAND_PROXY end to end, including a dead proxy that leaves the node untouched.

Commands run (niced, 4 build jobs, RAYON_NUM_THREADS=4):

• cargo test -p randprotocol-client --no-fail-fast: 347 passed, 0 failed, 2 ignored (the 2 are wallet_flow's existing #[ignore]d tests). Per binary: lib 248, rand bin 26, cli_perp 12, cli_rpc 29, cli_scripts 3, cli_token_bridge 9, rpc_methods 10, wallet_flow 10 + 2 ignored (real-node end-to-end with proving, 1 101 s), doc-tests 0
• cargo clippy --no-deps -p randprotocol-client --all-targets -- -D warnings: clean.
• cargo check -p randprotocol-node --all-targets: clean.

I did not run the full workspace suite.

Closes #141
Closes #142
Closes #147
Closes #148

🤖 Generated with Claude Code

https://claude.ai/code/session_01GFs5h141Ct6RTGGrCTQ1vy

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!