Integrate lightweight sovereign analysis tools from OracleVision into PyBLOCK's
Bitcoin menu. Adds modular BIP-110 violation scanning, Mempool Glass composition
via getblocktemplate, block detail view, and optional launch of the full
OracleVision TUI. Detection logic is separated from UI for community extension.
- Replace all shell=True subprocess calls with Python-native processing
(nodeconnection.py, SPV/nodeconnection.py, SPV/ppi.py)
- Mask sensitive inputs (private keys, passwords, tokens) with getpass
- Add threading.Lock to block_explorer.py shared state
- Use json.loads() instead of fragile string splitting in apisnd.py
- Add path validation before file open in apisnd.py
- Replace random.randint with secrets.randbelow for mining nonces
- Fix destructive exception handlers in clone.py and feed.py
- Replace bare except clauses with specific exceptions + logging
- Remove unused imports (psutil, xmltodict, block_visualizer, base64, say)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace all dynamic .split() patterns in subprocess calls with safe
alternatives: shlex.split(), explicit list args, and _run_btc/_run_ln
helpers in PyBlock.py. Covers PyBlock, block_visualizer, clockscript,
lastblockdetail, mempoolclock, nodeconnection, and ai/context.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1. Shell injection in readHexBlock/readHexTx (PyBlock.py):
- Validate user input with hex-only regex before use
- Replace shell=True pipe chain with subprocess list + piped stdin
- Same fix for OP_RETURN loop TX decoding
2. Shell injection in weather commands (ppi.py):
- Replace curl shell commands with requests.get()
- User input (city, lang, unit) no longer touches shell
- Upgraded from HTTP to HTTPS
3. Runtime crash in SPV/spvblock.py:
- os.path.isfile() called with 2 args (TypeError)
- Fixed to use 'and' for two separate checks
4. Config files added to .gitignore:
- pybitblock/config/*.conf (RPC creds, API keys, tokens)
- pybitblock/SPV/config/*.conf
- *.log files
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New pybitblock/ai/ package integrating with Astrolexis AI Gateway
at https://api.astrolexis.space:
- client.py: API client for auth, top-up (Lightning), chat (SSE
streaming), and usage tracking
- context.py: Gathers Bitcoin/Lightning node data (via CLI, RPC,
or mempool.space API) for AI context injection
- ui.py: Terminal chat interface with conversation history,
Lightning top-up flow with QR codes, usage stats display,
and first-time token setup
Accessible from Main Menu as "I - AI Assistant". All queries go
through Astrolexis gateway — user pays in sats via Lightning.
Token stored in pyblocksettings.conf.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove 1000-sat Lightning invoice paywalls from LNBits, LNPay, and
OpenNode API integrations. All three now go directly to config setup
(same flow as TippinMe/TallyCoin which were already free).
Changes:
- Replace aaccPPiLNBits/LNPay/OpenNode() payment loops with direct
config-or-setup logic in both PyBlock.py and SPV/spvblock.py
- Change all menu labels from PAID/PREMIUM/LOCKED to FREE
- Remove LNURL file existence checks (lnbitSN.conf gates)
- Remove ~400 lines of payment invoice generation, QR display,
and payment polling code
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ColdCore was non-functional due to literal '$HOME' paths that never
expanded, making all file checks always fail. The upstream project
(jamesob/coldcore) is experimental/alpha and requires Coldcard
hardware, limiting its audience.
Removed: callColdCore() function, menu entry "I" (ColdCore), and
handlers from PyBlock.py, SPV/spvblock.py, and umbrel-app.yml.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The clock commit (8e27372) inadvertently reverted Rich Columns menus
(Bitcoin submenu, Lightning, API menus) back to plain ANSI format.
Restored from commit 3062a34 and reapplied clock changes on top:
- artist()/design() delegation to clock.run_clock()
- mainmenuControl unified clock launch
- menuSelection()/menuSelectionLN() using cfg singleton
- Settings D option with clockDisplaySettings()
- TUI startup using cfg.intro_mode
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Miner pool tag: shows who mined the last block (coinbase decode for local/remote, API for lite)
- Block weight meter: colored fullness bar (green/yellow/red)
- Block time histogram: sparkline of last 14 block intervals with color-coded speed + streak detection
- Peer count: network connections indicator with health coloring
- Moon phase: current lunar phase emoji + name
All toggleable via Settings → D (Clock Display Settings).
Also fixes negative countdown timer (clamp to 0) and countdown row tracking bug.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New clock/ package replaces the old design() polling loop with a
flicker-free ANSI cursor-positioned renderer. Features include:
countdown timer, epoch/halving progress bar, fee rate indicator,
hashrate sparkline, matrix mining animation, odometer digit transition,
heartbeat pulse, zen mode, UTC time display, fireworks on milestone
blocks, generative hash art, and configurable sound modes.
All features are toggleable via Settings → D (Clock Display Settings).
Also fixes hardcoded config paths in menuSelection(), menuSelectionLN(),
and TUI startup to use the cfg singleton instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Major improvements to callColdCore():
- Fix $HOME path bug: use os.path.expanduser() for all paths
- Rich status panel showing: Bitcoin CLI, ColdCore install, wallet file
- Step-by-step setup guide with Rich panels when public.txt missing
- Auto-create ~/.pyblock directory with confirmation
- Show wallet balances from bitcoin-cli before launching
- Install ColdCore to ~/.pyblock/coldcore with --depth 1
- Proper error handling with show_error()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PyBlock.py has a local function console() (bitcoin-cli console).
The Rich Console import was shadowing it. Renamed to rich_console.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace the flat 25-item single-column ANSI menu with Rich Columns
organized by category:
- BLOCKCHAIN: Console, Info, Run Numbers, Latest, Moscow Time, Genesis
- MONITORING: Mempool, Unconfirmed, Visualizer, Block/Node/Mempool/Peers
- TOOLS: Decode HEX, QR, Tx Confirm, Search, OP_RETURN, Misc, ColdCore
- STATS & MINING: Stats, Hashrate, CLI/OwnNode Miner, Vanity, Wallet
Each category has its own color (orange, cyan, green, yellow) and
header. Much easier to scan and find features.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New block_viz.py replacing the old asciimatics-based block_visualizer:
- Colorful transaction treemap (purple→blue→green→yellow→red fee scale)
- Block info panel: height, hash, pool, tx count, size, weight, fees
- Top 8 fee transactions table with color-coded fee rates
- Fee distribution histogram with 8 color-coded buckets
- Works with bitcoin-cli and mempool.space API
- Interactive navigation: prev/next/latest/goto block
- Launch standalone: python3 block_viz.py [height]
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- artist(): catch KeyboardInterrupt explicitly so Ctrl+C breaks the
block display loop and returns to caller
- main(): change KeyboardInterrupt handler from sys.exit(0) to
continue, which loops back to menuSelection()
Users can now press Ctrl+C to exit any screen and return to the menu.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When bitcoincli is empty, go straight to Lite Mode instead of trying
remote mode (which also fails without tls/macaroon). Also validate
remote mode has tls configured before attempting connection.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
codecs is used in 10+ places for macaroon encoding but was previously
available only via star imports that were removed in the security audit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
intro.conf can contain either a plain string ("A"/"B"/"C") or a dict
with keys like fullbtclnd/fullbtc. Handle both formats when detecting
the mode for TUI launch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move SPV.spvblock import inside the functions that call
MainMenuCROPPED() instead of top-level, preventing circular
dependency issues when SPV modules load before PyBlock globals.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This function was previously available via the removed star import
'from SPV.spvblock import *'. Add explicit import so Lite Mode
fallback and mode C selection work correctly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When bitcoincli is empty in bclock.conf, instead of crashing with
PermissionError, MainMenu now:
1. Falls back to RPC remote mode if ip_port/rpcuser are configured
2. Redirects to Lite Mode (MainMenuCROPPED) if nothing is configured
Also simplified the fatal error handler in main() to show the error
message visibly before exiting.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When bclock.conf has an empty bitcoincli path, catch the PermissionError
and redirect to introINIT() with a helpful error message instead of
crashing with 'Fatal error: Permission denied'.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New pybitblock/tui/ package providing a modern terminal UI:
Structure:
tui/app.py - Main Textual App with CSS layout, auto-refresh
tui/screens/ - Screen classes (main_menu.py with keybindings)
tui/widgets/ - StatusBar widget with reactive block/price data
tui/workers/ - Async data fetchers (block height, price, fees, mempool)
Features:
- Persistent status bar with mode, block height, BTC price
- Side panel showing live fee estimates (fast/medium/slow)
- Keyboard navigation (A=PyBLOCK, B=Bitcoin, L=Lightning, etc.)
- Auto-refresh every 30 seconds via async workers
- Dark theme with Bitcoin-inspired color scheme
- CSS-based responsive layout
Launch: python3 PyBlock.py --tui
Fallback: python3 PyBlock.py (original CLI mode)
Added textual>=0.89 to requirements.txt.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace ANSI escape code menus with Rich-styled components:
- PyBlock.py MainMenu(): Rich status bar, header panel with node info,
table-based menu with colored keys
- SPV/spvblock.py MainMenuCROPPED(): same Rich integration
- Use rich_prompt() for styled input
The main menu now renders with bordered panels, consistent styling,
and proper terminal-width adaptation via Rich.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When users type an unrecognized option, they now see a yellow
"Invalid option 'X'. Try again." message instead of silent no-op.
Applied to:
- PyBlock.py mainmenuControl() and bitcoincoremenuLocalControl()
- SPV/spvblock.py mainmenuLOCALcontrol()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add show_error(str(e)) before every logger.debug() call so users see
a red error message when operations fail, instead of silent failures:
- PyBlock.py: 31 instances of "Suppressed error" pattern
- SPV/spvblock.py: 186 instances of "spvblock" error pattern
Users now see "! Error: <message>" in red text before being returned
to the menu, while errors still log to pyblock.log for debugging.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- PyBlock.py MainMenu(): fetch BTC price from mempool.space API,
display status_bar() showing mode/block/price before menu header
- SPV/spvblock.py MainMenuCROPPED(): same status_bar integration
- Import shared.ui utilities in both files
The status bar shows at a glance: active mode (Local/Remote/Lite),
current block height, and USD price of Bitcoin.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- PyBlock.py: Update intro screen text and option label
- SPV/spvblock.py: Change all n="CROPPED" display labels to "LITE MODE"
- Internal config value 'cropped' in intro.conf unchanged for backward compat
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace cd-and-run shell patterns with list-based subprocess.run()
using cwd parameter for directory context:
- Phoenix macOS ARM installer
- Luxor CLI help
- Mempool CLI (2 instances)
- SatSale, Cashu, Warden, bpytop launchers
- Bija docker-compose
- Both SPV/spvblock.py and PyBlock.py
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace all uses of 'list' as a variable name for shell command strings
with 'cmd' to avoid shadowing Python's built-in list type.
Affects ppi.py, PyBlock.py, SPV/ppi.py, and SPV/spvblock.py.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- PyBlock.py: Replace 14 star imports with explicit named imports,
remove unused `from art import *` and `from SPV.spvblock import *`
- ppi.py: Replace star imports, remove unused art/nodeconnection imports,
remove duplicate `import requests` and dead lnpay_py comments
- nodeconnection.py: Replace star imports, remove unused art import
This improves code clarity, prevents namespace pollution, and makes
dependencies between modules explicit and traceable.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace params=[] with params=None pattern to prevent shared state
between calls. Affects PyBlock.py, nodeconnection.py,
SPV/nodeconnection.py, and clockscriptREMOTE.py.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Major improvements across 7 areas:
- Add centralized Config singleton (config.py) replacing ~176 config
reloads per session with a single cached load
- Add logging framework (log.py) with RotatingFileHandler, replacing
silent except Exception: pass blocks with structured logging
- Refactor menu system (menu.py) with data-driven color selection,
eliminating ~1,370 lines of duplicate menu functions
- Create shared/ modules extracting 7 utility functions duplicated
between PyBlock.py and SPV/spvblock.py
- Clean dependencies: pin all versions, remove stdlib packages
(asyncio, threading), remove unused imports
- Improve Docker: pin ubuntu:24.04, add non-root user, use venv
- Improve CI: update to actions v4/v5, add test job before publish
- Fix entry point: wrap main loop in def main(), proper module import
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace insecure patterns that exposed the application to command injection,
arbitrary code execution, and data interception attacks.
- Replace os.popen/os.system with subprocess.run using argument lists
- Migrate pickle config serialization to JSON format
- Replace bare except: blocks with specific exception types
- Fix insecure HTTP URLs to HTTPS (opreturnbot.com, ascii.live)
- Replace shell curl commands with requests library calls
- Add migrate_config.py script for pickle-to-JSON config migration
- Convert existing SPV config files to JSON format
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
