EdgeApp · j0ntz · Jul 3, 2026 · Jul 3, 2026 · Jul 3, 2026 · Jul 3, 2026
diff --git a/.gitignore b/.gitignore
@@ -127,3 +127,6 @@ yarn-error.log
 !.yarn/releases
 !.yarn/sdks
 !.yarn/versions
+
+# Maestro run output
+/maestro/screenshots
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,8 +2,16 @@
 
 ## Unreleased (develop)
 
+- added: Stealth Send: the send scene offers a "Recipient receives" asset selector and a Stealth Send toggle, turning the send into a live swap-to-address quote routed exclusively through the Houdini privacy provider, with linked You send/Recipient gets amounts, quote expiry countdown, and a destination tag row on memo-required chains.
+- added: The "Myself" recipient picker offers every asset a send can route to, not just the source asset, with same-asset wallets grouped at the top.
+- added: Swap-sends, stealth sends, and stealth swap-sends are titled separately in the transaction list and details. The two private flows do not display the recipient, but still show the exchange order details so a stuck order can be traced.
+- added: The send scene tells you when an amount is under the privacy provider's minimum before contacting them, and the Stealth toggle explains itself when an asset or amount cannot route privately.
+- added: Stealth Swap: a toggle on the swap amount-entry scene routes the swap through the Houdini privacy provider as a fixed, non-tappable provider.
+- added: Entering a recipient address from another chain now sets up the cross-chain send by itself. Pasting, typing, or scanning an address the sending wallet cannot read no longer reports an invalid address; Edge identifies the network it belongs to, or asks which one when the format is shared, and sets "Recipient receives" to match.
 - added: Remote enable/disable of gift card providers via the info server's giftCardInfo config, supporting whole-provider disabling for Phaze and Bitrefill and per-brand disabling for Phaze.
+- changed: Show fiat values on the Stealth Send amount rows.
 - changed: Reorganize the wallet list menu so Asset Settings is reached through Wallet Settings, and rename the Monero "Backend" card to "Server Settings".
+- fixed: Drop four destination chains the privacy provider does not serve, and correct the native-asset lookup that made six others unquotable.
 - fixed: Prevent imported Monero wallets from using the Edge LWS backend. Choosing to import now prompts the user to continue with a full node or configure a custom LWS server, matching the wallet settings rule.
 
 ## 4.49.0 (staging)

diff --git a/eslint.config.mjs b/eslint.config.mjs
@@ -34,7 +34,14 @@ export default [
       'react-native/no-raw-text': [
         'error',
         {
-          skip: ['B', 'EdgeText', 'Paragraph', 'SmallText', 'WarningText']
+          skip: [
+            'B',
+            'EdgeText',
+            'Paragraph',
+            'PositiveText',
+            'SmallText',
+            'WarningText'
+          ]
         }
       ],
       'react-native/sort-styles': 'off',
@@ -160,7 +167,7 @@ export default [
       'src/components/cards/StakingOptionCard.tsx',
       'src/components/cards/StakingReturnsCard.tsx',
       'src/components/cards/SupportCard.tsx',
-      'src/components/cards/SwapDetailsCard.tsx',
+
       'src/components/cards/TappableAccountCard.tsx',
       'src/components/cards/TappableCard.tsx',
       'src/components/cards/UnderlinedNumInputCard.tsx',
@@ -219,13 +226,11 @@ export default [
       'src/components/modals/PasswordReminderModal.tsx',
       'src/components/modals/PermissionsSettingModal.tsx',
 
-      'src/components/modals/RadioListModal.tsx',
       'src/components/modals/RawTextModal.tsx',
       'src/components/modals/ScamWarningModal.tsx',
-      'src/components/modals/ScanModal.tsx',
+
       'src/components/modals/StateProvinceListModal.tsx',
 
-      'src/components/modals/TextInputModal.tsx',
       'src/components/modals/TransferModal.tsx',
 
       'src/components/modals/WalletListSortModal.tsx',
@@ -255,10 +260,8 @@ export default [
 
       'src/components/rows/CryptoFiatAmountRow.tsx',
 
-      'src/components/rows/EdgeRow.tsx',
-
       'src/components/rows/PaymentMethodRow.tsx',
-      'src/components/rows/SwapProviderRow.tsx',
+
       'src/components/rows/TxCryptoAmountRow.tsx',
 
       'src/components/scenes/ChangeMiningFeeScene.tsx',
@@ -372,7 +375,6 @@ export default [
 
       'src/components/themed/SceneHeader.tsx',
 
-      'src/components/themed/SearchFooter.tsx',
       'src/components/themed/SelectableRow.tsx',
 
       'src/components/themed/ShareButtons.tsx',
@@ -386,7 +388,6 @@ export default [
       'src/components/themed/TransactionListComponents.tsx',
 
       'src/components/themed/VectorIcon.tsx',
-      'src/components/themed/WalletList.tsx',
 
       'src/components/themed/WalletListErrorRow.tsx',
       'src/components/themed/WalletListHeader.tsx',

diff --git a/maestro/14-stealth/README.md b/maestro/14-stealth/README.md
@@ -0,0 +1,133 @@
+# Stealth Send and Stealth Swap flows
+
+Maestro coverage for the send-to-address swap UI. Every user-visible branch of
+the feature has a flow, and the pieces those flows are built from live in
+`../common/stealth-*.yaml` so a later session can drive one specific state
+without walking the whole thing by hand.
+
+## Running
+
+The whole suite, minus the two flows that spend money:
+
+```bash
+npm run maestro -- test --include-tags stealth maestro
+```
+
+One flow:
+
+```bash
+npm run maestro -- test maestro/14-stealth/stealth-private-quote.yaml
+```
+
+The two funded flows are tagged `stealth-spend` and nothing else, so the command
+above never triggers them. Run them deliberately, and in this order:
+
+```bash
+npm run maestro -- test maestro/14-stealth/stealth-execute-send.yaml
+npm run maestro -- test maestro/14-stealth/stealth-execute-swap.yaml
+```
+
+They run opposite directions, so the pair returns the funds to where they
+started and costs two spreads rather than emptying one wallet. Let the first
+one's deposit confirm before starting the second: a wallet with an unconfirmed
+outgoing transaction cannot quote a new send.
+
+Run flows ONE AT A TIME rather than as a tagged batch. A failing flow takes the
+maestro driver down with it, and every flow after it then reports
+`Failed to connect`, which reads as a suite-wide breakage instead of one bad
+flow.
+
+On a machine with more than one simulator booted, pin the device and the driver
+port, or the run may attach to the wrong one:
+
+```bash
+maestro --device <udid> --driver-host-port <port> test maestro/14-stealth
+```
+
+## Account expectations
+
+The flows read wallet names from env vars so they can point at whatever the
+signed-in account actually holds. Defaults assume the `edge-funds` roster
+account as of 2026-07-30:
+
+| Env var                    | Default      | Needs                                        |
+| -------------------------- | ------------ | -------------------------------------------- |
+| `STEALTH_SRC_WALLET`       | `My Stellar` | funded above 25 USD for the private branches |
+| `STEALTH_DEST_WALLET`      | `My Sonic`   | exists; no balance needed                    |
+| `STEALTH_AMOUNT`           | `158`        | worth more than 25 USD in source units       |
+| `STEALTH_BELOW_MIN_AMOUNT` | `80`         | worth between 10 and 25 USD                  |
+| `STEALTH_PIN_DIGIT`        | `0`          | the account's single repeated relogin digit  |
+| `STEALTH_MEMO_CHAIN`       | `Ripple`     | a memo-required destination chain            |
+
+Two preconditions the flows cannot check for you:
+
+- **The source wallet must have no unconfirmed outgoing transaction.** A pending
+  send blocks the next one, so the quote never arms and the flow fails on the
+  slider rather than on anything it is testing. Running the funded flows
+  back-to-back on one wallet hits this.
+- **Balances drift.** The amounts above are chosen against a live price; when the
+  source asset moves far enough, `STEALTH_AMOUNT` stops clearing 25 USD or
+  `STEALTH_BELOW_MIN_AMOUNT` stops sitting between the two floors, and the
+  private branches quietly test the wrong thing. Both are worth re-checking
+  before reading a failure as a regression.
+
+`stealth-send.yaml`, `stealth-swap.yaml` and `stealth-qr-payment-uri.yaml`
+request no quote, so they need no balance at all.
+
+## The flows
+
+| Flow                                | Branch it drives                                                     |
+| ----------------------------------- | -------------------------------------------------------------------- |
+| `stealth-send.yaml`                 | Send scene controls before address entry, plus a memo-chain tag row   |
+| `stealth-swap.yaml`                 | Exchange scene toggle card                                            |
+| `stealth-qr-payment-uri.yaml`       | scanned payment URI, cross-chain, amount on the recipient side        |
+| `stealth-myself-picker.yaml`        | own-wallet destinations grouped same-asset first                      |
+| `stealth-cross-asset-quote.yaml`    | plain Swap & Send on a transparent route                              |
+| `stealth-private-quote.yaml`        | the toggle invalidating a held quote and refetching a private route    |
+| `stealth-below-private-minimum.yaml`| the toggle refusing under the private floor, with no request sent      |
+| `stealth-tx-details.yaml`           | a completed stealth transaction's identity rows                        |
+| `stealth-execute-send.yaml`         | **spends** a private Stealth Send to the success scene                 |
+| `stealth-execute-swap.yaml`         | **spends** a Stealth Swap from the Exchange scene                      |
+
+## Composing your own
+
+Each subflow states its env contract in its header. A walk that needs a live
+private quote on a pair the suite does not cover is five `runFlow` steps:
+
+```yaml
+- runFlow:
+    file: ../common/stealth-launch.yaml
+- runFlow:
+    file: ../common/stealth-open-send.yaml
+    env:
+      WALLET: My Tron 2
+- runFlow:
+    file: ../common/stealth-pick-myself.yaml
+    env:
+      DEST_WALLET: My Litecoin (new)
+- runFlow:
+    file: ../common/stealth-set-amount.yaml
+    env:
+      ROW: You send
+      AMOUNT: '120'
+- runFlow:
+    file: ../common/stealth-toggle.yaml
+- runFlow:
+    file: ../common/stealth-await-quote.yaml
+```
+
+Two things bite when writing these by hand:
+
+- **The confirm slider is a pan gesture.** A coordinate swipe across the track
+  does nothing at all. `stealth-slide-to-confirm.yaml` swipes from the thumb by
+  id, which is the only form that completes it.
+- **Notification cards float over the bottom of every scene**, including the
+  slider and the amount rows. `stealth-launch.yaml` swipes them away; skip it
+  and later taps land on a card instead of the control underneath.
+
+## Assertions
+
+These flows are for driving the app to a state, not for asserting behavior. Each
+one asserts only what it must to gate the next step (that a scene arrived, that
+a quote settled, that the slider is live). Behavioral claims belong in the unit
+tests and in `src/docs/stealth-send-swap.md`.
diff --git a/maestro/14-stealth/stealth-below-private-minimum.yaml b/maestro/14-stealth/stealth-below-private-minimum.yaml
@@ -0,0 +1,40 @@
+# Below the private floor the toggle refuses, client-side.
+#
+# The provider serves no private route under 25 USD, so an order under it is
+# pre-empted before a request goes out rather than sent and refused. The toggle
+# stays off and the card explains the floor. The transparent route is still
+# available at the same amount, which is what keeps a plain Swap & Send working
+# in the band between the two floors.
+appId: ${APP_ID}
+env:
+  APP_ID: ${MAESTRO_APP_ID || 'co.edgesecure.app'}
+  SRC_WALLET: ${STEALTH_SRC_WALLET || 'My Stellar'}
+  DEST_WALLET: ${STEALTH_DEST_WALLET || 'My Sonic'}
+  # Worth more than the 10 USD transparent floor and less than the 25 USD
+  # private one, in the source wallet's own denomination:
+  AMOUNT: ${STEALTH_BELOW_MIN_AMOUNT || '80'}
+tags:
+  - stealth
+---
+- runFlow:
+    file: ../common/stealth-launch.yaml
+- runFlow:
+    file: ../common/stealth-open-send.yaml
+    env:
+      WALLET: ${SRC_WALLET}
+- runFlow:
+    file: ../common/stealth-pick-myself.yaml
+    env:
+      DEST_WALLET: ${DEST_WALLET}
+- runFlow:
+    file: ../common/stealth-set-amount.yaml
+    env:
+      ROW: 'You send'
+      AMOUNT: ${AMOUNT}
+- runFlow:
+    file: ../common/stealth-await-quote.yaml
+
+- runFlow:
+    file: ../common/stealth-toggle.yaml
+- assertVisible: 'Private routing needs at least.*'
+- takeScreenshot: maestro/screenshots/stealth-below-min-01-toggle-refused
diff --git a/maestro/14-stealth/stealth-cross-asset-quote.yaml b/maestro/14-stealth/stealth-cross-asset-quote.yaml
@@ -0,0 +1,35 @@
+# A plain cross-asset Swap & Send: no privacy requested, so a transparent
+# (single-exchange) route is acceptable and the order clears the lower floor.
+#
+# Ends on a live quote with the slider armed. Nothing is sent.
+appId: ${APP_ID}
+env:
+  APP_ID: ${MAESTRO_APP_ID || 'co.edgesecure.app'}
+  SRC_WALLET: ${STEALTH_SRC_WALLET || 'My Stellar'}
+  DEST_WALLET: ${STEALTH_DEST_WALLET || 'My Sonic'}
+  AMOUNT: ${STEALTH_AMOUNT || '158'}
+tags:
+  - stealth
+---
+- runFlow:
+    file: ../common/stealth-launch.yaml
+- runFlow:
+    file: ../common/stealth-open-send.yaml
+    env:
+      WALLET: ${SRC_WALLET}
+- runFlow:
+    file: ../common/stealth-pick-myself.yaml
+    env:
+      DEST_WALLET: ${DEST_WALLET}
+- runFlow:
+    file: ../common/stealth-set-amount.yaml
+    env:
+      ROW: 'You send'
+      AMOUNT: ${AMOUNT}
+- runFlow:
+    file: ../common/stealth-await-quote.yaml
+# The edited side owns the guarantee, and each row states which it is in its
+# own title. Asserting both catches a regression that swaps or drops them.
+- assertVisible: 'You send \(Guaranteed\)'
+- assertVisible: 'Recipient gets \(Estimated\)'
+- takeScreenshot: maestro/screenshots/stealth-cross-asset-01-standard-quote
diff --git a/maestro/14-stealth/stealth-execute-send.yaml b/maestro/14-stealth/stealth-execute-send.yaml
@@ -0,0 +1,44 @@
+# Executes a private cross-asset Stealth Send end to end, to the success scene.
+#
+# THIS SPENDS FUNDS. It carries the `stealth-spend` tag ONLY, so a run of the
+# rest of the suite by the `stealth` tag never triggers it. See README.md in
+# this directory for how to invoke it deliberately.
+#
+# Sending to one of the account's own wallets keeps the principal inside the
+# account, so the cost is the route's spread plus network fees.
+appId: ${APP_ID}
+env:
+  APP_ID: ${MAESTRO_APP_ID || 'co.edgesecure.app'}
+  SRC_WALLET: ${STEALTH_SRC_WALLET || 'My Stellar'}
+  DEST_WALLET: ${STEALTH_DEST_WALLET || 'My Sonic'}
+  AMOUNT: ${STEALTH_AMOUNT || '158'}
+tags:
+  - stealth-spend
+---
+- runFlow:
+    file: ../common/stealth-launch.yaml
+- runFlow:
+    file: ../common/stealth-open-send.yaml
+    env:
+      WALLET: ${SRC_WALLET}
+- runFlow:
+    file: ../common/stealth-pick-myself.yaml
+    env:
+      DEST_WALLET: ${DEST_WALLET}
+- runFlow:
+    file: ../common/stealth-set-amount.yaml
+    env:
+      ROW: 'You send'
+      AMOUNT: ${AMOUNT}
+- runFlow:
+    file: ../common/stealth-toggle.yaml
+- runFlow:
+    file: ../common/stealth-await-quote.yaml
+    env:
+      LABEL: 'Slide to send stealthily'
+- runFlow:
+    file: ../common/stealth-slide-to-confirm.yaml
+- extendedWaitUntil:
+    visible: 'Transaction Details'
+    timeout: 90000
+- takeScreenshot: maestro/screenshots/stealth-execute-01-success