Replace all dynamic .split() patterns in subprocess calls with safe
alternatives: shlex.split(), explicit list args, and _run_btc/_run_ln
helpers in PyBlock.py. Covers PyBlock, block_visualizer, clockscript,
lastblockdetail, mempoolclock, nodeconnection, and ai/context.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1. Shell injection in readHexBlock/readHexTx (PyBlock.py):
- Validate user input with hex-only regex before use
- Replace shell=True pipe chain with subprocess list + piped stdin
- Same fix for OP_RETURN loop TX decoding
2. Shell injection in weather commands (ppi.py):
- Replace curl shell commands with requests.get()
- User input (city, lang, unit) no longer touches shell
- Upgraded from HTTP to HTTPS
3. Runtime crash in SPV/spvblock.py:
- os.path.isfile() called with 2 args (TypeError)
- Fixed to use 'and' for two separate checks
4. Config files added to .gitignore:
- pybitblock/config/*.conf (RPC creds, API keys, tokens)
- pybitblock/SPV/config/*.conf
- *.log files
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Centralize bitcoin-cli subprocess calls into a single _run_cli()
function with nosemgrep annotation. The cli path is already
sanitized via shlex.split() before reaching this function.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add cyan separator lines (────) before and after AI responses
- Change prompt to 'pyblock>' in yellow to distinguish from AI text
- Balance shown below the closing separator in dim
- Add UTF-8 env vars to entrypoint.sh for ttyd/Docker contexts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rich Console renders to a StringIO buffer, then the result is
encoded as UTF-8 bytes and written directly to sys.stdout.buffer,
bypassing Python's stdout encoding which may not be UTF-8 in all
launch contexts (ttyd, Docker, pipes).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Reconfigure sys.stdout to UTF-8 when the ai module loads, ensuring
accented characters (á, é, ñ, ¡, ¿) render correctly regardless
of how PyBLOCK was launched.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Force Rich Console to use UTF-8 output encoding so Spanish
accented characters render correctly in the terminal.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use shlex.split() to safely parse bitcoincli path before passing
to subprocess.run(), same pattern as clock/data.py fix.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The status line after 'U' (usage) showed the old balance instead
of refreshing it from the API. Now calls get_balance() before
displaying the status line.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Major UX improvements inspired by KCode's terminal rendering:
- Continuous chat flow — no screen clearing between messages,
conversation scrolls naturally like a real chat
- Rich Markdown rendering for AI responses — proper tables,
code blocks with syntax highlighting, headers, bold, bullets
- Remove "Press Enter to continue" interruption from chat loop
- Compact status line showing balance + commands inline
- Ctrl+C returns to main menu cleanly
- Balance updates shown inline after each response
- Context refreshed on each query for up-to-date node data
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Client tries the public URL first (api.astrolexis.space), and
falls back to localhost:10400 on 404 or connection errors. This
handles CDN cache issues and provides resilience when the gateway
runs on the same machine as PyBLOCK.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
A function with yield is always a generator in Python, so
chat() with stream=False was returning a generator instead
of a dict. Split into chat() for non-streaming (returns dict)
and _stream_chat() for streaming (yields SSE chunks).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New pybitblock/ai/ package integrating with Astrolexis AI Gateway
at https://api.astrolexis.space:
- client.py: API client for auth, top-up (Lightning), chat (SSE
streaming), and usage tracking
- context.py: Gathers Bitcoin/Lightning node data (via CLI, RPC,
or mempool.space API) for AI context injection
- ui.py: Terminal chat interface with conversation history,
Lightning top-up flow with QR codes, usage stats display,
and first-time token setup
Accessible from Main Menu as "I - AI Assistant". All queries go
through Astrolexis gateway — user pays in sats via Lightning.
Token stored in pyblocksettings.conf.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove 1000-sat Lightning invoice paywalls from LNBits, LNPay, and
OpenNode API integrations. All three now go directly to config setup
(same flow as TippinMe/TallyCoin which were already free).
Changes:
- Replace aaccPPiLNBits/LNPay/OpenNode() payment loops with direct
config-or-setup logic in both PyBlock.py and SPV/spvblock.py
- Change all menu labels from PAID/PREMIUM/LOCKED to FREE
- Remove LNURL file existence checks (lnbitSN.conf gates)
- Remove ~400 lines of payment invoice generation, QR display,
and payment polling code
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ColdCore was non-functional due to literal '$HOME' paths that never
expanded, making all file checks always fail. The upstream project
(jamesob/coldcore) is experimental/alpha and requires Coldcard
hardware, limiting its audience.
Removed: callColdCore() function, menu entry "I" (ColdCore), and
handlers from PyBlock.py, SPV/spvblock.py, and umbrel-app.yml.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The clock commit (8e27372) inadvertently reverted Rich Columns menus
(Bitcoin submenu, Lightning, API menus) back to plain ANSI format.
Restored from commit 3062a34 and reapplied clock changes on top:
- artist()/design() delegation to clock.run_clock()
- mainmenuControl unified clock launch
- menuSelection()/menuSelectionLN() using cfg singleton
- Settings D option with clockDisplaySettings()
- TUI startup using cfg.intro_mode
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Use shlex.split() instead of str.split() for bitcoin-cli commands
to prevent command injection via crafted config values
- Remove partial threading.Lock usage that only guarded writes but
not reads, relying on Python's GIL for atomic attribute assignment
- Remove unused threading import (Lock)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The hash_art() function was hardcoding pad based on 80 columns.
Now accepts term_width parameter and the renderer passes the
real terminal width for proper centering.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Miner pool tag: shows who mined the last block (coinbase decode for local/remote, API for lite)
- Block weight meter: colored fullness bar (green/yellow/red)
- Block time histogram: sparkline of last 14 block intervals with color-coded speed + streak detection
- Peer count: network connections indicator with health coloring
- Moon phase: current lunar phase emoji + name
All toggleable via Settings → D (Clock Display Settings).
Also fixes negative countdown timer (clamp to 0) and countdown row tracking bug.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New clock/ package replaces the old design() polling loop with a
flicker-free ANSI cursor-positioned renderer. Features include:
countdown timer, epoch/halving progress bar, fee rate indicator,
hashrate sparkline, matrix mining animation, odometer digit transition,
heartbeat pulse, zen mode, UTC time display, fireworks on milestone
blocks, generative hash art, and configurable sound modes.
All features are toggleable via Settings → D (Clock Display Settings).
Also fixes hardcoded config paths in menuSelection(), menuSelectionLN(),
and TUI startup to use the cfg singleton instead.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Config now reads these env vars (with priority over config files):
Bitcoin Core:
BITCOIN_RPC_HOST, BITCOIN_RPC_PORT, BITCOIN_RPC_USER, BITCOIN_RPC_PASS
BITCOIN_CLI_PATH
Lightning (LND):
LND_HOST, LND_GRPC_PORT, LND_TLS_CERT_PATH, LND_MACAROON_PATH
LND_CLI_PATH
Mode:
PYBLOCK_MODE (A=Bitcoin+Lightning, B=Bitcoin, C=Lite)
When env vars are set, config files are auto-generated for consistency.
This enables zero-config deployment on Umbrel where credentials are
injected via docker-compose environment.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bring back the Panel borders for sysinfo, status bar, header, and menu
but use style='on default' which inherits the terminal's background
color instead of Rich's default dark gray. border_style='dim' keeps
the borders subtle.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Tables pad columns with spaces that show a different background color.
Switch sysinfo and menu to console.print() with markup strings instead,
which render with the terminal's native background color.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace Panel() wrappers with plain text output for status_bar and
header — Panels create a visible background box that clashes with
dark terminal themes. Error/warning panels kept as-is since they
should visually stand out.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Use transparent backgrounds instead of forced dark grays in panels
- Replace ░ block chars with ─ dashes for progress bar empty space
- Set console highlight=False to prevent unwanted auto-styling
- Remove pyblock.dim style from panels (used default dim instead)
Rich elements now blend seamlessly with the terminal's own background.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- artist(): catch KeyboardInterrupt explicitly so Ctrl+C breaks the
block display loop and returns to caller
- main(): change KeyboardInterrupt handler from sys.exit(0) to
continue, which loops back to menuSelection()
Users can now press Ctrl+C to exit any screen and return to the menu.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When bitcoincli is empty, go straight to Lite Mode instead of trying
remote mode (which also fails without tls/macaroon). Also validate
remote mode has tls configured before attempting connection.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
codecs is used in 10+ places for macaroon encoding but was previously
available only via star imports that were removed in the security audit.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace mount/remove_children pattern (async issues, duplicate IDs)
with a single persistent #section-view Static widget that gets its
content updated via .update(). All sections now render correctly:
- Dashboard: summary table + latest blocks (fetched async from API)
- Bitcoin/Lightning/Platforms/Settings: info panels
- M key: return to main menu
Also added fetch_latest_blocks() and fetch_hashrate() data workers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Each menu key now loads real content:
- A (Dashboard): block height, price, hashrate, difficulty, mempool
stats, and latest 5 blocks table — all from mempool.space API
- B (Bitcoin): submenu with blockchain features
- L (Lightning): channel management overview
- P (Platforms): API integrations list
- S (Settings): current mode and config info
- M: return to main menu from any section
New data fetchers: fetch_latest_blocks(), fetch_hashrate(),
fetch_mempool_info() expanded.
Dashboard loads async via run_worker(thread=True) with live
content replacement in the center panel.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
MainMenuScreen was a Textual Screen mounted inside a Vertical container,
which doesn't render. Create MainMenu as a Static widget instead:
- New tui/widgets/main_menu.py with Panel+Table menu
- Move keybindings (A/B/L/P/S/Q) to the App level
- Menu now renders correctly in the content area
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
intro.conf can contain either a plain string ("A"/"B"/"C") or a dict
with keys like fullbtclnd/fullbtc. Handle both formats when detecting
the mode for TUI launch.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move SPV.spvblock import inside the functions that call
MainMenuCROPPED() instead of top-level, preventing circular
dependency issues when SPV modules load before PyBlock globals.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This function was previously available via the removed star import
'from SPV.spvblock import *'. Add explicit import so Lite Mode
fallback and mode C selection work correctly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When bitcoincli is empty in bclock.conf, instead of crashing with
PermissionError, MainMenu now:
1. Falls back to RPC remote mode if ip_port/rpcuser are configured
2. Redirects to Lite Mode (MainMenuCROPPED) if nothing is configured
Also simplified the fatal error handler in main() to show the error
message visibly before exiting.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When bclock.conf has an empty bitcoincli path, catch the PermissionError
and redirect to introINIT() with a helpful error message instead of
crashing with 'Fatal error: Permission denied'.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use Text.from_markup() instead of Text() for the CPU/Memory progress
bars so Rich markup tags ([green], [dim]) are interpreted as styles
rather than displayed as literal text.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace run_in_thread (not available in Textual 0.89) with
run_worker(fn, thread=True) + call_from_thread for UI updates.
The TUI now launches correctly and fetches live data (block height,
BTC price, fee estimates) on startup and every 30 seconds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New pybitblock/tui/ package providing a modern terminal UI:
Structure:
tui/app.py - Main Textual App with CSS layout, auto-refresh
tui/screens/ - Screen classes (main_menu.py with keybindings)
tui/widgets/ - StatusBar widget with reactive block/price data
tui/workers/ - Async data fetchers (block height, price, fees, mempool)
Features:
- Persistent status bar with mode, block height, BTC price
- Side panel showing live fee estimates (fast/medium/slow)
- Keyboard navigation (A=PyBLOCK, B=Bitcoin, L=Lightning, etc.)
- Auto-refresh every 30 seconds via async workers
- Dark theme with Bitcoin-inspired color scheme
- CSS-based responsive layout
Launch: python3 PyBlock.py --tui
Fallback: python3 PyBlock.py (original CLI mode)
Added textual>=0.89 to requirements.txt.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Error messages now render as styled Rich panels with colored borders:
- Errors: red border panel with "Error" title
- Warnings: yellow border panel with "Warning" title
- Success: green checkmark prefix
Falls back to ANSI output if Rich is not importable.
This affects all 217+ error display points across both PyBlock.py and
SPV/spvblock.py automatically since they all call show_error().
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace ANSI escape code menus with Rich-styled components:
- PyBlock.py MainMenu(): Rich status bar, header panel with node info,
table-based menu with colored keys
- SPV/spvblock.py MainMenuCROPPED(): same Rich integration
- Use rich_prompt() for styled input
The main menu now renders with bordered panels, consistent styling,
and proper terminal-width adaptation via Rich.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace ANSI-coded system info with Rich table showing:
- CPU: color bar (green/yellow/red based on load) + percentage
- Memory: color bar + percentage
Falls back to original ANSI output if Rich is not available.
This change affects every screen in the app since sysinfo() is called
on most menu renders.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When users type an unrecognized option, they now see a yellow
"Invalid option 'X'. Try again." message instead of silent no-op.
Applied to:
- PyBlock.py mainmenuControl() and bitcoincoremenuLocalControl()
- SPV/spvblock.py mainmenuLOCALcontrol()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add show_error(str(e)) before every logger.debug() call so users see
a red error message when operations fail, instead of silent failures:
- PyBlock.py: 31 instances of "Suppressed error" pattern
- SPV/spvblock.py: 186 instances of "spvblock" error pattern
Users now see "! Error: <message>" in red text before being returned
to the menu, while errors still log to pyblock.log for debugging.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- PyBlock.py MainMenu(): fetch BTC price from mempool.space API,
display status_bar() showing mode/block/price before menu header
- SPV/spvblock.py MainMenuCROPPED(): same status_bar integration
- Import shared.ui utilities in both files
The status bar shows at a glance: active mode (Local/Remote/Lite),
current block height, and USD price of Bitcoin.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- PyBlock.py: Update intro screen text and option label
- SPV/spvblock.py: Change all n="CROPPED" display labels to "LITE MODE"
- Internal config value 'cropped' in intro.conf unchanged for backward compat
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
