Merge feature/shamir-secret-sharing-o2a into main

[bakaxbaka]

Summary

Take-over of PR #16 to address the bugs flagged by Devin Review and Codex on this branch.

Devin Review (posted to GitHub)

• main.py — _fetch_test_transaction_data_helper was always returning None because the Blockstream /block/{hash} endpoint only returns block metadata (no tx field). Added the missing /block/{hash}/txids request that matches the existing iteration loop (each entry is then used as a txid string in /tx/{txid}). The same pattern is already used by _fetch_block_data (with /txs) elsewhere in main.py. Without this fix, /test_manual_recovery always returned the "Could not fetch suitable test transaction data" error.
• main.py:2107 — int(r_hex, 16) TypeError. Already fixed in the prior commit b2b0919 on this branch (kept verified).

Codex review

• nonce_reuse_analysis.py (and the three sister scripts find_nonce_collision.py, bitcoin_nonce_attack.py, bitcoin_nonce_advanced.py) — parse_transaction / extract_signatures_from_raw_tx / extract_all_signatures read the input-count varint immediately after the version. SegWit transactions place a 0x00 marker + 0x01 flag between the version and the input count, so the parser silently misinterpreted the marker as "zero inputs" (or, worse, fell off the end of the buffer on the next reads). Detect the optional marker/flag pair and skip it before parsing the input count. Verified against constructed legacy + SegWit fixtures locally.

Cleanup

• Removed ten accidentally-committed zero/near-zero-byte files at the repo root (=0.15.0, =0.17.0, ..., =6.0). Those were the result of an earlier session running pip install <pkg>>=... unquoted, which the shell parsed as a stderr redirection into a file literally named =.... The branch's existing .gitignore already excludes the =* pattern, so these were stale artifacts.

Not addressed (yet)

• The Devin Review web-app indicates 5 additional findings beyond the inline ones, but the link (https://app.devin.ai/review/bakaxbaka/cryptoautopilot/pull/16) currently 500s on me, so I haven't been able to read them. Happy to take another pass once they're available or pasted into the chat.

Review & Testing Checklist for Human

• Hit /test_manual_recovery against the live Flask app and confirm it now reaches the inner loop instead of immediately returning the "could not fetch" error message. The endpoint still depends on a recent block actually containing a k-reuse signature pair, so a "no k-reuse found" response is normal — the regression was that the loop body was never executed at all.
• Run any of the standalone analyzers (python nonce_reuse_analysis.py, python find_nonce_collision.py, etc.) against a SegWit transaction hex you care about and confirm signatures are reported (or at least that the parser no longer silently returns [] on legacy + SegWit inputs).
• Sanity-check that the deletion of the =* files does not break any tooling — they were empty (or in one case a bit of pip stderr) and were not referenced anywhere in the repo.

Notes

• CodeQL checks (Analyze python/javascript-typescript/java-kotlin) were already failing on b2b0919 for setup-related reasons (no Python source detected, etc.); this commit doesn't change that and the failures are unrelated to the bugs above.
• The int(r_hex, 16) TypeError fix from b2b0919 is left in place, since it correctly turns the resulting r lookup into an int-keyed dict.

Link to Devin session: https://app.devin.ai/sessions/d7a8f4ccb9424d6e89a5891fe764ad1f
Requested by: @bakaxbaka

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle SegWit marker when parsing inputs

The transaction parser assumes the byte immediately after the version is the varint-encoded input count. In SegWit transactions the version is followed by the 0x00/0x01 marker and flag before the input count, so this code interprets the marker as the input count and the whole structure becomes misaligned. For any modern SegWit transaction, parse_transaction will either return zero signatures or raise when offsets run past the buffer, so the nonce analysis silently fails. Detect the SegWit marker/flag and skip them before calling parse_varint.

Useful? React with 👍 / 👎.