- Replace all shell=True subprocess calls with Python-native processing
(nodeconnection.py, SPV/nodeconnection.py, SPV/ppi.py)
- Mask sensitive inputs (private keys, passwords, tokens) with getpass
- Add threading.Lock to block_explorer.py shared state
- Use json.loads() instead of fragile string splitting in apisnd.py
- Add path validation before file open in apisnd.py
- Replace random.randint with secrets.randbelow for mining nonces
- Fix destructive exception handlers in clone.py and feed.py
- Replace bare except clauses with specific exceptions + logging
- Remove unused imports (psutil, xmltodict, block_visualizer, base64, say)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace all dynamic .split() patterns in subprocess calls with safe
alternatives: shlex.split(), explicit list args, and _run_btc/_run_ln
helpers in PyBlock.py. Covers PyBlock, block_visualizer, clockscript,
lastblockdetail, mempoolclock, nodeconnection, and ai/context.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1. Shell injection in readHexBlock/readHexTx (PyBlock.py):
- Validate user input with hex-only regex before use
- Replace shell=True pipe chain with subprocess list + piped stdin
- Same fix for OP_RETURN loop TX decoding
2. Shell injection in weather commands (ppi.py):
- Replace curl shell commands with requests.get()
- User input (city, lang, unit) no longer touches shell
- Upgraded from HTTP to HTTPS
3. Runtime crash in SPV/spvblock.py:
- os.path.isfile() called with 2 args (TypeError)
- Fixed to use 'and' for two separate checks
4. Config files added to .gitignore:
- pybitblock/config/*.conf (RPC creds, API keys, tokens)
- pybitblock/SPV/config/*.conf
- *.log files
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove 1000-sat Lightning invoice paywalls from LNBits, LNPay, and
OpenNode API integrations. All three now go directly to config setup
(same flow as TippinMe/TallyCoin which were already free).
Changes:
- Replace aaccPPiLNBits/LNPay/OpenNode() payment loops with direct
config-or-setup logic in both PyBlock.py and SPV/spvblock.py
- Change all menu labels from PAID/PREMIUM/LOCKED to FREE
- Remove LNURL file existence checks (lnbitSN.conf gates)
- Remove ~400 lines of payment invoice generation, QR display,
and payment polling code
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ColdCore was non-functional due to literal '$HOME' paths that never
expanded, making all file checks always fail. The upstream project
(jamesob/coldcore) is experimental/alpha and requires Coldcard
hardware, limiting its audience.
Removed: callColdCore() function, menu entry "I" (ColdCore), and
handlers from PyBlock.py, SPV/spvblock.py, and umbrel-app.yml.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace ANSI escape code menus with Rich-styled components:
- PyBlock.py MainMenu(): Rich status bar, header panel with node info,
table-based menu with colored keys
- SPV/spvblock.py MainMenuCROPPED(): same Rich integration
- Use rich_prompt() for styled input
The main menu now renders with bordered panels, consistent styling,
and proper terminal-width adaptation via Rich.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When users type an unrecognized option, they now see a yellow
"Invalid option 'X'. Try again." message instead of silent no-op.
Applied to:
- PyBlock.py mainmenuControl() and bitcoincoremenuLocalControl()
- SPV/spvblock.py mainmenuLOCALcontrol()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add show_error(str(e)) before every logger.debug() call so users see
a red error message when operations fail, instead of silent failures:
- PyBlock.py: 31 instances of "Suppressed error" pattern
- SPV/spvblock.py: 186 instances of "spvblock" error pattern
Users now see "! Error: <message>" in red text before being returned
to the menu, while errors still log to pyblock.log for debugging.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- PyBlock.py MainMenu(): fetch BTC price from mempool.space API,
display status_bar() showing mode/block/price before menu header
- SPV/spvblock.py MainMenuCROPPED(): same status_bar integration
- Import shared.ui utilities in both files
The status bar shows at a glance: active mode (Local/Remote/Lite),
current block height, and USD price of Bitcoin.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- PyBlock.py: Update intro screen text and option label
- SPV/spvblock.py: Change all n="CROPPED" display labels to "LITE MODE"
- Internal config value 'cropped' in intro.conf unchanged for backward compat
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace cd-and-run shell patterns with list-based subprocess.run()
using cwd parameter for directory context:
- Phoenix macOS ARM installer
- Luxor CLI help
- Mempool CLI (2 instances)
- SatSale, Cashu, Warden, bpytop launchers
- Bija docker-compose
- Both SPV/spvblock.py and PyBlock.py
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace every `from X import *` with explicit named imports:
- SPV/spvblock.py: 11 star imports resolved
- SPV/ppi.py: 4 star imports resolved, duplicate import removed
- SPV/nodeconnection.py, SPV/sysinf.py, SPV/apisnd.py, SPV/donation.py
- mempoolclock.py, sysinf.py, apisnd.py, donation.py
Removed unused imports (art, nodeconnection in donation, logos in apisnd).
Zero star imports remain in the project.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace all uses of 'list' as a variable name for shell command strings
with 'cmd' to avoid shadowing Python's built-in list type.
Affects ppi.py, PyBlock.py, SPV/ppi.py, and SPV/spvblock.py.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Wrap socket operations in try/finally to ensure sock.close() on errors
- Add if __name__ == '__main__' guard to prevent execution on import
- Applied to both pybitblock/SHS.py and pybitblock/SPV/SHS.py
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace params=[] with params=None pattern to prevent shared state
between calls. Affects PyBlock.py, nodeconnection.py,
SPV/nodeconnection.py, and clockscriptREMOTE.py.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Replace open() without context managers with `with` statements across all modified files
- Change bare `except:` to `except Exception:` for safer exception handling
- Move Whale Alert API key from hardcoded to environment variable
- Use raw strings for ASCII art to prevent escape sequence issues
- Simplify image file handling in nodeconnection.py
- Convert unsafe shell subprocess calls to list-based format
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Major improvements across 7 areas:
- Add centralized Config singleton (config.py) replacing ~176 config
reloads per session with a single cached load
- Add logging framework (log.py) with RotatingFileHandler, replacing
silent except Exception: pass blocks with structured logging
- Refactor menu system (menu.py) with data-driven color selection,
eliminating ~1,370 lines of duplicate menu functions
- Create shared/ modules extracting 7 utility functions duplicated
between PyBlock.py and SPV/spvblock.py
- Clean dependencies: pin all versions, remove stdlib packages
(asyncio, threading), remove unused imports
- Improve Docker: pin ubuntu:24.04, add non-root user, use venv
- Improve CI: update to actions v4/v5, add test job before publish
- Fix entry point: wrap main loop in def main(), proper module import
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace insecure patterns that exposed the application to command injection,
arbitrary code execution, and data interception attacks.
- Replace os.popen/os.system with subprocess.run using argument lists
- Migrate pickle config serialization to JSON format
- Replace bare except: blocks with specific exception types
- Fix insecure HTTP URLs to HTTPS (opreturnbot.com, ascii.live)
- Replace shell curl commands with requests library calls
- Add migrate_config.py script for pickle-to-JSON config migration
- Convert existing SPV config files to JSON format
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
