feat: enable gas account for private send(OK-59993)

[weatherstar]

OK-59993

---

Summary

• Enable Gas Account (OneKey-sponsored network fee) for Private Send transactions, gated by the new backend scenario privateSend (OK-59993)
• Remove the three client-side gates that forced Private Send to be user-paid (estimate request flag, confirm-page payer selection, background sponsor-state stripping)
• Thread the sponsored-fee flag into Private Send swap history so the history detail modal shows the sponsored badge

Intent & Context

Per OK-59993, Private Send should participate in Gas Account sponsorship: request gasAccountEnabled on /estimate-fee with a dedicated scenario=privateSend (coordinated with the backend team), and when a valid quote comes back, show the sponsored UI and select Gas Account for submit.

Private Send rides the normal TxConfirm page (single deposit transfer to the provider's payin address, built via the internal-swap pipeline), so all Gas Account infrastructure — estimate request, quote state machine, sponsored UI, quote-expiry ticker, 90212 deep retry, Refresh/Fallback/Hint error strategies — was already live on this path. It was only switched off by explicit gates, with a code comment noting Private Send was "user-paid by contract". This PR removes that restriction now that the contract is changing.

Design Decisions

• Dedicated scenario privateSend (as suggested in the Jira ticket) instead of reusing swap: added to GAS_ACCOUNT_SCENARIOS and resolved in resolveGasAccountScenario from transferPayload.isPrivateSend. The branch must run before the swap branch because Private Send sets isInternalSwap: true.
• Megafuel stays disabled for Private Send (minimal-change decision): megafuel is an independent BNB-chain sponsor with no Private Send contract on the backend. sponsorDisabledForPrivateSend was renamed to megafuelDisabledForPrivateSend and scoped to megafuel-only branches; the effective-payer fallback now only forces user when serverPayer === 'megafuel'.
• Safe to ship before the backend: until the backend adds privateSend to its L3 scenario gate, estimate-fee returns gasAccountScenarioReason=scenario_unknown, Gas Account simply stays off, and Private Send remains user-paid (plus a console.error telemetry line). No hard dependency ordering.
• Quote binding is unaffected: a Gas Account quote binds to a single tx (payloadHash + locked nonce), and Private Send is always exactly one deposit transfer, so the background strip condition narrows to isMultiTxs only.

Changes Detail

• packages/shared/types/fee.ts — add 'privateSend' to GAS_ACCOUNT_SCENARIOS (frontend contract enum, backend lands via coordinated PR)
• packages/kit/src/hooks/useSignatureConfirm.ts — resolve gasAccountScenario from transferPayload.isPrivateSend before the internal-swap branch
• packages/kit/src/views/SignatureConfirm/components/TxFee/TxFeeInfo.tsx — request gasAccountEnabled for Private Send; keep megafuel disabled (renamed gate variable); stop resetting Gas Account UI state for Private Send
• packages/kit-bg/src/services/ServiceSend.ts — batchSignAndSendTransaction no longer strips gasAccountUiState/gasAccountSubmitId for Private Send (single-tx); batch flows still strip
• packages/kit/src/views/Send/pages/SendAmountInput/SendAmountInputContainer.tsx — thread isNetworkFeeSponsored from send success data into the Private Send history item (swapInfo.isFreeNetworkFee) so SwapHistoryDetailModal shows the sponsored badge
• Tests: useSignatureConfirm.test.tsx expectation updated to privateSend; two new ServiceSend tests pin the pass-through for single-tx Private Send and the strip for multi-tx batches

Risk Assessment

• Risk Level: Medium
• Affected Platforms: Extension / Mobile / Desktop / Web
• Risk Areas: The UI gates (TxFeeInfo) and the background strip (ServiceSend) must stay consistent — they are both changed in this PR, and a regression on either side would show a "0 network fee" badge while broadcasting user-paid (or vice versa). Megafuel behavior for Private Send is intentionally unchanged; regressions would surface on BNB-chain sponsored transfers.

Test plan

• yarn jest packages/kit/src/hooks/useSignatureConfirm.test.tsx packages/kit-bg/src/services/ServiceSend.broadcastDeadline.test.ts (34 passed)
• yarn agent:check --profile commit (lint/format/tsc all green)
• With backend privateSend scenario enabled: Private Send on an eligible EVM chain shows the sponsored coupon ("0 Network Fee") and "Send free" confirm button; broadcast carries quoteId + isPrivateSend and the fee is not deducted
• Quote expiry on the confirm page triggers a silent re-estimate and re-enables confirm
• 90212 admission-overload error shows the "Retrying in Ns" countdown; Cancel aborts the retry loop
• Fallback-class errors (e.g. 40212) flip back to user-paid re-estimate and Private Send still succeeds
• History detail of a sponsored Private Send shows the sponsored network fee badge
• Regression: normal send / swap Gas Account flows and BNB megafuel flows unchanged; multi-tx batch still user-paid

[sidmorizon]

@codex review

[sidmorizon]

@codex security review

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: fb4348eb89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[originalix]

Automated code review found blocking issues

@weatherstar

Reviewed commit 54626ee7c436. This report always reflects the latest reviewed changes.

Review summary

This PR extends the Private Send sponsorship path across the foreground confirmation flow and the background broadcast service. main now resolves a dedicated privateSend Gas Account scenario, keeps a single-transaction quote alive through the handoff into bg, disables Megafuel for this scenario, and records the final sponsorship result in Private Send history while leaving batch handling and non-Private Send scenarios unchanged. The overall design stays within the existing fee-estimation, retry, and history boundaries, but the sponsor-selection state machine still diverges between display state and submit wiring when the backend prefers Megafuel, so the new path is not complete on those networks.

What needs attention: Verify that the Private Send Megafuel override keeps display payer, selectedPayer, and idempotencyKey aligned so an eligible Gas Account quote is actually submitted.

Issues to address

• P1 · Private Send never selects Gas Account when the backend still prefers Megafuel
  • Impact: The new Private Send path explicitly disables Megafuel, but the follow-up selection logic still derives selectedPayer from the raw backend payer and megafuelEligible fields. On networks where the fee service returns a Gas Account quote together with payer='megafuel', the UI clears Megafuel for display yet keeps selectedPayer='user', so submit drops the quote and broadcasts as user-paid.
  • Suggested action: Derive nextSelectedPayer from the post-filtered sponsor state for Private Send. Once Megafuel is suppressed for this scenario, an eligible Gas Account quote should select gasAccount and keep its idempotencyKey so the broadcast path actually uses the sponsored submit flow.

Validation gaps

• git diff --check origin/x...HEAD returned clean for the reviewed files.
• Focused Jest suites were not executed because node_modules is missing in this workspace.
• GitHub review/comment coverage was not fetched here, so any inline suggestion still needs duplicate-checking before posting.