Replace all dynamic .split() patterns in subprocess calls with safe
alternatives: shlex.split(), explicit list args, and _run_btc/_run_ln
helpers in PyBlock.py. Covers PyBlock, block_visualizer, clockscript,
lastblockdetail, mempoolclock, nodeconnection, and ai/context.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace every `from X import *` with explicit named imports:
- SPV/spvblock.py: 11 star imports resolved
- SPV/ppi.py: 4 star imports resolved, duplicate import removed
- SPV/nodeconnection.py, SPV/sysinf.py, SPV/apisnd.py, SPV/donation.py
- mempoolclock.py, sysinf.py, apisnd.py, donation.py
Removed unused imports (art, nodeconnection in donation, logos in apisnd).
Zero star imports remain in the project.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace all uses of 'list' as a variable name for shell command strings
with 'cmd' to avoid shadowing Python's built-in list type.
Affects ppi.py, PyBlock.py, SPV/ppi.py, and SPV/spvblock.py.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Replace open() without context managers with `with` statements across all modified files
- Change bare `except:` to `except Exception:` for safer exception handling
- Move Whale Alert API key from hardcoded to environment variable
- Use raw strings for ASCII art to prevent escape sequence issues
- Simplify image file handling in nodeconnection.py
- Convert unsafe shell subprocess calls to list-based format
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Major improvements across 7 areas:
- Add centralized Config singleton (config.py) replacing ~176 config
reloads per session with a single cached load
- Add logging framework (log.py) with RotatingFileHandler, replacing
silent except Exception: pass blocks with structured logging
- Refactor menu system (menu.py) with data-driven color selection,
eliminating ~1,370 lines of duplicate menu functions
- Create shared/ modules extracting 7 utility functions duplicated
between PyBlock.py and SPV/spvblock.py
- Clean dependencies: pin all versions, remove stdlib packages
(asyncio, threading), remove unused imports
- Improve Docker: pin ubuntu:24.04, add non-root user, use venv
- Improve CI: update to actions v4/v5, add test job before publish
- Fix entry point: wrap main loop in def main(), proper module import
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace insecure patterns that exposed the application to command injection,
arbitrary code execution, and data interception attacks.
- Replace os.popen/os.system with subprocess.run using argument lists
- Migrate pickle config serialization to JSON format
- Replace bare except: blocks with specific exception types
- Fix insecure HTTP URLs to HTTPS (opreturnbot.com, ascii.live)
- Replace shell curl commands with requests library calls
- Add migrate_config.py script for pickle-to-JSON config migration
- Convert existing SPV config files to JSON format
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
