feat: offer Lista Hũ (Paraguay) in the recommended lists

Lista Hũ's CSV export is 4.6 MB and 24,000 rows, over the subscription
limits. Its API's unpaginated /api/v1/lista/ takes an added_from filter,
so the entry asks for reports since 2025-01-01 (about 1,800 rows and
575 KB). The parser learns the Spanish column names the site uses
(numero, tipo, desc, comentarios), and the plan (595, trunk 0, 8 or 9
digits) drops the foreign numbers people reported there rather than
storing them as +595. Catalog revision 2, signed.

Author: SysAdminDoc

CHANGELOG.md

@@ -109,6 +109,11 @@ All notable changes to CallShield will be documented in this file.
   sent, is still waiting to send, or didn't go out. Reported a number as
   spam by mistake? Tap Send not spam on that row and the correction goes out
   the same way. The list is kept on the phone only.
+- Recommended lists has Lista Hũ, Paraguay's community list, with the
+  reports made since January 2025. Its numbers are stored as +595 numbers
+  whatever country your phone is in, and ones from other countries that
+  people reported there are left out rather than misread. Lists that name
+  their columns in Spanish ("numero", "tipo", "comentarios") are read too.
 
 ## v1.11.0 (2026-09-30)
 

README.md

@@ -12,7 +12,7 @@
 <p align="center">
   <a href="https://github.com/SysAdminDoc/CallShield/releases/latest"><img src="https://img.shields.io/github/v/release/SysAdminDoc/CallShield?style=flat-square&color=a6e3a1" alt="Release"></a>
   <img src="https://img.shields.io/badge/Spam%20Numbers-51%2C362-f38ba8?style=flat-square" alt="51,362 Numbers">
-  <img src="https://img.shields.io/badge/JVM%20unit%20tests-1939-94e2d5?style=flat-square" alt="1939 JVM unit tests">
+  <img src="https://img.shields.io/badge/JVM%20unit%20tests-1940-94e2d5?style=flat-square" alt="1940 JVM unit tests">
   <img src="https://img.shields.io/badge/Android-10%2B-89b4fa?style=flat-square" alt="Android 10+">
   <img src="https://img.shields.io/badge/License-MIT-cba6f7?style=flat-square" alt="MIT License">
   <img src="https://img.shields.io/badge/API%20Keys-None-fab387?style=flat-square" alt="No required API keys">
@@ -290,7 +290,7 @@ The same test runs 5,000 real smishing reports sampled from the IMC 2025 dataset
 - Selective backup/restore for rules, non-secret settings, and opt-in logs, plus CSV log export and auto-cleanup (7/14/30/90 days)
 - Database sync every 6 hours, a trending-feed check every 30 minutes, and a daily digest notification
 - External blocklist subscriptions (Settings > External blocklists) take HTTPS CSV, TXT or JSON number lists of up to 1 MB and 20,000 rows. Each list is fetched again once a day, or on the interval it declares in its header (`# Expires: 12 hours`, or `"expires": "12h"` in JSON), never more often than every six hours and at least weekly. A download that comes back empty or with under half the list's numbers isn't applied in the background. The list keeps its last good copy and says why on its row. Each row shows the list's name, the host it comes from, how many numbers it holds and when it last updated, and TalkBack reads it as one item. A row's switch turns its list off or on. Tapping the list's name does nothing. Removing a list takes its numbers out straight away, and Undo puts both back without downloading the list again
-- The same card opens with Recommended lists for places the bundled database barely covers: OpenCallShield (Colombia, MIT), SpamChile (Chile, GPL-2.0) and Turkish Spam Numbers (Turkey, GPL-3.0). Each row shows the country and a link to the license next to Add, and nothing is downloaded until you tap it. Adding one fetches it straight from its own repository. None of them is folded into CallShield's database. Each list declares its country's number plan, so a number written the local way (`3131918305`, `03395051735` or `00573390714583` in the Colombian list) is stored as +57 whatever country your phone is in. That holds for the same link typed in by hand, too. The catalog ships in the app and a signed copy is refreshed on every sync, so a list can be added between releases
+- The same card opens with Recommended lists for places the bundled database barely covers: OpenCallShield (Colombia, MIT), SpamChile (Chile, GPL-2.0), Turkish Spam Numbers (Turkey, GPL-3.0) and Lista Hũ (Paraguay, CC BY-NC-SA 4.0, reports since January 2025, since the whole list is past the size limit). Each row shows the country and a link to the license next to Add, and nothing is downloaded until you tap it. Adding one fetches it straight from its own repository. None of them is folded into CallShield's database. Each list declares its country's number plan, so a number written the local way (`3131918305`, `03395051735` or `00573390714583` in the Colombian list) is stored as +57 whatever country your phone is in. That holds for the same link typed in by hand, too. The catalog ships in the app and a signed copy is refreshed on every sync, so a list can be added between releases
 - If GitHub is blocked where you live, Settings > Feed mirror takes a second address for the protection data. CallShield asks GitHub first, then the mirror, then falls back to the copy bundled with the app. For ten minutes after GitHub couldn't be reached at all, the mirror goes first. One tap fills in jsDelivr (`https://cdn.jsdelivr.net/gh/SysAdminDoc/CallShield@master/`), which serves the same files and can run up to 12 hours behind. Mirrored files go through the same signature check, so a mirror can't alter the data, though it can hold back updates. [data/README.md](data/README.md#mirrors-and-recovery) covers running your own
 - Two Quick Settings tiles (protection on or off, and Expecting a call), app shortcuts and a home screen widget
 - Protection test validates all layers and permissions, including checker errors and deadline cutoffs
@@ -532,12 +532,12 @@ RELEASE_KEY_PASSWORD=...
 ## Testing
 
 ```bash
-./gradlew testDebugUnitTest   # 1939 tests
+./gradlew testDebugUnitTest   # 1940 tests
 ./gradlew connectedDebugAndroidTest -Pandroid.testInstrumentationRunnerArguments.class=com.sysadmindoc.callshield.platform.TargetSdkBehaviorSmokeTest
 ./gradlew verifyPipelineTests # Cloudflare Worker (node) + data-pipeline and translation checks (python)
 ```
 
-The suite is **1939 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
+The suite is **1940 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
 
 Two GitHub workflows run without building the app. **Validation** runs the Worker and
 pipeline suites on every push except report-only ones (`run-pipeline-tests.ps1 -CorrectnessOnly`),
@@ -574,7 +574,7 @@ language in [issue #7](https://github.com/SysAdminDoc/CallShield/issues/7).
 | Community API | Cloudflare Workers |
 | URL Safety | Local spam-domain data, with optional PhishTank and OpenPhish |
 | Verification | Local Gradle, lint, and release-artifact checks |
-| Tests | 1939 JVM unit tests (JUnit) |
+| Tests | 1940 JVM unit tests (JUnit) |
 | Strings | 1779 string resources and 48 plural groups (translation-ready) |
 | Accessibility | 100+ content descriptions, 48dp touch targets |
 | Min SDK | 29 (Android 10) |

app/src/main/java/com/sysadmindoc/callshield/data/ExternalBlocklistParser.kt

@@ -55,9 +55,10 @@ internal object ExternalBlocklistParser {
     const val MAX_SUBSCRIPTION_BYTES = 1L * 1024L * 1024L
     const val MAX_SUBSCRIPTION_ROWS = 20_000
 
-    private val numberFields = setOf("number", "phone", "phone_number", "phoneNumber", "msisdn")
-    private val typeFields = setOf("type", "category", "label")
-    private val descriptionFields = setOf("description", "comment", "name", "reason")
+    // Spanish names too: Lista Hũ (Paraguay) exports "numero", "tipo" and "desc" or "Comentarios".
+    private val numberFields = setOf("number", "phone", "phone_number", "phoneNumber", "msisdn", "numero")
+    private val typeFields = setOf("type", "category", "label", "tipo")
+    private val descriptionFields = setOf("description", "comment", "name", "reason", "desc", "descripcion", "comentario", "comentarios")
     private val arrayFields = setOf("numbers", "blocklist", "entries", "data")
 
     private const val EXPIRES_HEADER_LINES = 50

app/src/test/java/com/sysadmindoc/callshield/data/ExternalBlocklistParserTest.kt

@@ -1,5 +1,6 @@
 package com.sysadmindoc.callshield.data
 
+import com.sysadmindoc.callshield.data.model.ListNumberPlan
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertTrue
 import org.junit.Test
@@ -75,6 +76,39 @@ class ExternalBlocklistParserTest {
         assertEquals("IRS spoof", parsed.numbers.first().description)
     }
 
+    @Test
+    fun parseReadsListaHuSpanishFieldNames() {
+        val paraguay = ListNumberPlan("PY", "595", "0", listOf(8, 9))
+        val json =
+            ExternalBlocklistParser.parse(
+                rawUrl = "https://listahu.org/api/v1/lista/?added_from=2025-01-01",
+                rawLabel = "Lista Hũ",
+                body =
+                    """
+                    [
+                      {"id": 22601, "numero": "595992856745", "tipo": "Estafa", "screenshot": "https://listahu.org/media/x.jpg",
+                       "desc": "Se hace pasar por un banco", "check": false, "added": "2026-10-09T11:17:41-03:00", "votsi": 0, "votno": 0},
+                      {"id": 22600, "numero": "0981234567", "tipo": "SPAM", "desc": ""}
+                    ]
+                    """.trimIndent(),
+                normalizeNumber = { paraguay.toInternational(it) ?: it },
+            )
+        val csv =
+            ExternalBlocklistParser.parse(
+                rawUrl = "https://listahu.org/descargar/csv/",
+                rawLabel = "Lista Hũ",
+                body = "\"#\",\"Numero\",\"Tipo\",\"Comentarios\",\"Captura\",\"Fecha_Denuncia\"\n" +
+                    "1,\"595985843100\",\"SPAM\",\"Llamadas grabadas\",\"https://listahu.org/media/d2.jpg\",\"2015-02-16 09:37\"\n",
+                normalizeNumber = { paraguay.toInternational(it) ?: it },
+            )
+
+        assertEquals(listOf("+595992856745", "+595981234567"), json.numbers.map { it.number })
+        assertEquals("Estafa", json.numbers.first().type)
+        assertEquals("Se hace pasar por un banco", json.numbers.first().description)
+        assertEquals(listOf("+595985843100"), csv.numbers.map { it.number })
+        assertEquals("Llamadas grabadas", csv.numbers.single().description)
+    }
+
     @Test
     fun parseRejectsUnsupportedUrlsAndOversizedBodies() {
         val badScheme =

data/README.md

@@ -312,6 +312,11 @@ a list, append its entry, raise `revision`, run `python scripts/feed_signing.py
 sign` and commit the file with its `.sig`. A list must fit the subscription
 limits (1 MB, 20,000 rows) and must never become a database source.
 
+Lista Hũ's full export is 4.6 MB, so its entry asks the site's API for the
+reports since a fixed date (`added_from=2025-01-01`, about 575 KB in October
+2026, growing about 25 KB a month). Move the date forward a year, raise
+`revision` and sign again before the response nears 1 MB, around 2028.
+
 `spam_numbers.txt` is signed the same way for anyone who takes the list
 without the app. It's written with the shards, holds every number whose
 sources allow redistribution (range prefixes stay out, since Saracroche's are

data/list_catalog.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "revision": 1,
+  "revision": 2,
   "lists": [
     {
       "id": "opencallshield-co",
@@ -49,6 +49,23 @@
       "license_url": "https://github.com/symbuzzer/Turkish-Spam-Numbers/blob/main/LICENSE",
       "format": "txt",
       "enabled_by_default": false
+    },
+    {
+      "id": "listahu-py",
+      "name": "Lista Hũ",
+      "country": "PY",
+      "calling_code": "595",
+      "trunk_prefix": "0",
+      "national_lengths": [
+        8,
+        9
+      ],
+      "url": "https://listahu.org/api/v1/lista/?added_from=2025-01-01",
+      "homepage": "https://listahu.org",
+      "license": "CC BY-NC-SA 4.0",
+      "license_url": "https://creativecommons.org/licenses/by-nc-sa/4.0/",
+      "format": "json",
+      "enabled_by_default": false
     }
   ]
 }

data/list_catalog.json.sig

@@ -1 +1 @@
-MEUCIQDedmAXpdKK44hh1b1dt+fyM/2S21Y3J68Njb31mjAWFAIgaeL0mJyjXw22fgs5lJRryEqjKpNhoige9Xj3XjofVxA=
+MEUCIQDApNLnC6PdbNlxfTDMloLUAN33Q8FpYxnAu5lIFQhTgwIgd+Pgy9mZDYp21D9KTFriKhKDK4QuI49ogAuj5NC+854=