Logoscore Weekly Update — 2026-11-02
Highlights
This week, technically
| Area | What changed | Status | PRs |
|---|---|---|---|
| Tor | tor_module runs Arti in its own process. Modules reach it with HTTP/2 requests over IPC, so TLS ends inside Logos. The SOCKS port on 127.0.0.1:9250 is on by default because the Bitcoin wallet’s peers need raw TCP. A failed exit is retried on a fresh circuit, and Tor now joins the network on Windows too. The Tor app shows status, join progress, usage and logs. The Zcash node and wallet core use it over IPC, and the Bitcoin node module uses it as its default proxy. Both wallets have a Network privacy block that explains what each option reveals | merged; not in the catalog | logos-tor-module#1–#5, logos-tor-ui#1, #2, logos-zcash-node-module#10, logos-zcash-wallet-core-module#19, logos-zcash-wallet-ui#12, logos-bitcoin-node-module#3, logos-bitcoin-wallet-backend#8, logos-bitcoin-wallet-ui#18, nix-bundle-lgx#25, logos-windows-ci#16 |
| Wallet data unlock | Each seed has one unlock key, which every holder of the seed can give: keystore, Keycard (after its PIN), Keycard Shell, or QR signer over one round trip. The QR scanner shows a request for that key only when the QR signer asks for it, so other modules can’t phish it. The signer manager unlocks each wallet once per session by its rule and hands each module keys of its own. The keystore index, tx history, Ethereum contacts and settings, and Bitcoin wallets and sends are sealed under those keys. Opening a wallet is now the user’s consent in the Signer app, with no password sent along. The account kit’s LockedBanner is in the Ethereum, Bitcoin and Uniswap apps, and the Keycard app shows locked wallets as Locked. The signer CLI gets the same calls for headless use | merged; not in the catalog | logos-signer-interface#7, #8, logos-signer-manager-module#12, #14, logos-evm-keystore-module#33, #35, logos-keycard-module#5, logos-keycard-shell-module#4, logos-qr-signer-module#4, #7, logos-qr-scanner-module#2, logos-qr-signer-ui#6, logos-evm-signer-ui#31, logos-evm-signer-cli#16, logos-account-kit#2, logos-evm-tx-sender-module#13, logos-eth-wallet-backend#37, logos-eth-wallet-ui#39, logos-uniswap-backend#14, logos-uniswap-ui#18, logos-bitcoin-wallet-core-module#14, #17, logos-bitcoin-wallet-backend#7, logos-bitcoin-wallet-ui#16, logos-bitcoin-wallet-cli#1, logos-keycard-ui#4 |
| Unlock fixes from hand tests | A Keycard send could be refused as “locked” while the Signer app showed the wallet unlocked. The manager now tries every signer that lists the account. A wallet added by an older build is re-added with its phrase instead of hanging in a pending state. The Signer app drops “Unlock in the keys app…”, which read as “unlock again”. The keys app now calls passwordless signing by its own name and adds a way to end it. “New keys” is offered only for a QR wallet | merged | logos-signer-manager-module#15, logos-evm-tx-sender-module#15, logos-evm-keystore-module#36, logos-evm-keystore-ui#23, #24, logos-evm-signer-ui#33, #35 |
| Keys app and keystore | The keystore moves to keystore/v2/, and the keys app offers to move an earlier version’s wallets in. The CLI relays the move headlessly, plus import_seed_wallet, preview_mnemonic, set_wallet_name and restore_unlock_root. A wallet can be renamed from its header, and each account gets its own name or none (also in QR Wallets). Recovery phrases are typed into a numbered grid, one word per field, in the keys app and the Zcash wallet. Finder’s .DS_Store is no longer flagged as possible key material | merged | logos-evm-keystore-module#37, #38, logos-evm-keystore-ui#21, #22, #25, logos-evm-keystore-cli#12, #13, logos-account-kit#3, logos-zcash-wallet-ui#13, logos-qr-signer-ui#4 |
| Package integrity | Before loading an installed package, Basecamp re-hashes its files against manifest.json and checks manifest.sig for signed packages. A failing required dependency blocks the module, and a failing optional one is skipped. Bundled modules and standalone mode are not checked. The package manager now hash-checks every install under every signature policy, reports extraction and staging failures accurately, and protects its reserved file names. liblgx hashes in 1 MiB chunks (523 → 230 ms on a 102 MB package), its init is thread-safe, and it skips lgpm’s .lgpm-source sidecar. The matching SDK change was reverted the same week: it needed a liblogos change that was dropped, and the check stays Basecamp-only | merged, not yet in a Basecamp release | logos-basecamp#533, logos-package-manager#52, #53, logos-package#50–#52, logos-cpp-sdk#181 (reverted in #182) |
| Basecamp onboarding | At first run, new users pick “Let’s go” (GitHub and Logos Storage) or “Advanced setup”, which adds a Logos Storage start-up step. Existing users skip onboarding. The downloader starts only after a source is chosen. Under GitHub-only, storage_module is unloaded unless something else uses it. Settings use the same source names. The Package Manager’s storage banner recovers after a reload. The Package Manager uses one client per module, so startup calls are no longer refused | merged, not yet in a Basecamp release | logos-basecamp#525, logos-package-manager-ui#98, #99 |
| UI backends as core modules | A ui_qml app can opt in with "backend": "module". Its .rep backend is then built as a core module <app>_backend and shipped in the app’s own .lgx. The signed manifest names it (logos-package 0.7.0), and the view connects over a private channel with a one-time secret. Basecamp starts the backend when the app opens and shows a panel to reopen the app if the backend stops. The Package Manager is the first app on it. The ui-qml-backend template and a migration guide cover porting other apps | merged; other app ports not yet merged | logos-package#49, nix-bundle-lgx#24, logos-module-builder#281–#283, logos-view-module#6–#8, logos-view-module-runtime#46, logos-basecamp#529, #530, logos-package-manager-ui#100, #101, logos-package-downloader#56, logos-package-downloader-module#61, logos-tutorial#119 |
| Portable dev builds | nix run .#dev-portable (Basecamp) and .#ui-dev-portable (module builder) run an app under development in the portable build that users get, with QML hot reload | merged | logos-basecamp#528, logos-module-builder#280 |
| Module shutdown | Modules get 10 s in aboutToUnload() in every host: logos_host, ui-host and Basecamp’s in-process plugins. The SIGKILL window is now 12 s. A synced Zebra node needs 5–6 s to stop and used to be killed mid-shutdown | merged | logos-container-subprocess#15, logos-module-loader-qt#29, logos-view-module-runtime#47, logos-basecamp#532, logos-liblogos#245, logos-logoscore-cli#196, logos-plugin-qt#59, logos-tutorial#120 |
| logosctl | The logoscore binary is gone from the tree, and logosctl is the only one. logoscore-py drops its logoscore client. logosctl --timeout MS sets a deadline for every daemon call. Twelve more repos’ doc-tests drive logosctl | merged | logos-logoscore-cli#193, #197, logos-logoscore-py#36, e.g. logos-blockchain-module#122, logos-signer-manager-module#13; see appendix |
| Bitcoin wallet | Kyoto moves to bip157 0.8.1, which brings about 20 fixes from the Loupe security review. A first sync shows header progress, and “Synchronized” waits for the filter scan. Fixed a restored wallet that showed 0 BTC because a rescan that never reached the node was counted as done. Each account’s birthday now lives only in the wallet core, sealed in its wallet.json, and is asked for at first open. The keystore, signer manager and keys app no longer keep it. The bitcoind node moves to Bitcoin Core 31.2. Manage in Keystore uses the Accounts icon | merged | logos-bitcoin-wallet-core-module#19–#24, logos-bitcoin-wallet-ui#19–#21, logos-signer-interface#9, logos-signer-manager-module#16, logos-evm-keystore-module#39, logos-evm-keystore-ui#26, logos-bitcoin-core-nix#1, logos-bitcoind-module#1 |
| Zcash wallet | Server health is checked only for the network a wallet is open on. Cake Wallet and ZombieCash are added to the server presets. Wallets now get zcash_client_sqlite migrations on every open, not only at creation. Fixed the balance flipping on each new block and Shield clicks lost during balance updates. The wallet now says when its own node is still syncing. Each tip poll has a 60 s timeout over Tor. The node app is renamed Zcash Zebra Node, and quitting Basecamp no longer crashes zebrad_module | merged | logos-zcash-node-module#11, #12, logos-zcash-wallet-backend#6, #7, logos-zcash-wallet-core-module#20–#22, logos-zcash-wallet-ui#11, #14, #15, #17, logos-zebrad-ui#2, logos-zebrad-module#5, #6, logos-zebra-nix#6 |
| Release CI | Each PR to the catalog build-checks the submodules it changes, on every platform the submodule’s flake exposes, and uploads the unsigned .lgx as an artifact. The release action builds only the variants a flake exposes, so modules without a Windows build no longer get a red Windows leg | merged | logos-modules-release#129, logos-modules-release-action#30, #31 |
| Dependencies | Security-advisory updates for rustls, webpki and ctutils in the Zcash modules, and for rustls, webpki-roots and tokio in the Bitcoin modules. Monero v0.18.5.4. nimbus-eth1 v0.4.4 in the verified proxy, which brings batched eth_getProof and lets us drop our upstreamed patch. Many repos are relocked onto the module builder’s QtRO completion fix. App QML is now linted with logos-nix’s Qt | merged | logos-zcash-node-module#8, logos-zcash-wallet-core-module#18, logos-bitcoin-node-module#2, logos-bitcoin-wallet-core-module#18, logos-monero-nix#3, logos-verified-proxy-module#19; see appendix |
Blockers and asks
Appendix: merged PRs by repo
183 PRs merged across 76 repos, 2026-10-26 to 2026-11-01. Each repo name links to its merged PRs for the week.