OPL-4114: align Desktop Wallet Toolbox with official Sigma matrix by rohenaz · Pull Request #86 · bsv-blockchain/bsv-desktop

rohenaz · 2026-09-01T13:35:12Z

Summary

Refreshes the dependency upgrade proposed in #78 on current v2.8.4 master and aligns the packaged candidate with the exact versions used by the merged Sigma official-wallet matrix.

pins @bsv/wallet-toolbox exactly to 2.10.4
pins @bsv/sdk exactly to 2.4.2
pins legacy @bsv/wallet-toolbox-client exactly to 2.4.4 because Desktop still uses its deep legacy exports
retains both Wallet Toolbox proof-task deadlock fixes described in fix(deps): bump @bsv/wallet-toolbox to 2.10.1 for both proof-task deadlock fixes #78
declares Node.js 22+ and aligns pull-request CI to Node 22
makes test:stas:db preserve a Vitest failure after restoring the Electron native build
refreshes the npm lockfile and verifies one deduplicated SDK version across the dependency graph

Verification

npm test: 24/24 passed
npm run test:tokens: 58/58 passed
npm run test:stas:db: 32/32 passed; native Electron rebuild completed
npm run build: passed
exact dependency graph: SDK 2.4.2 / Toolbox 2.10.4 / legacy client 2.4.4
git diff --check: passed

Remaining gates and known risks

This does not claim that the packaged/manual OPL-4114 matrix or funded-chain acceptance has run.
npm install --package-lock-only --ignore-scripts reports 39 existing dependency advisories (5 low, 8 moderate, 20 high, 6 critical). Reachability and remediation are outside this narrowly scoped version-alignment PR.
Existing Vite bundle-size, dynamic-import, vendored sourcemap, and vm-browserify eval warnings remain unchanged.

Supersedes #78.

…dlock fixes 2.4.4 contains TWO self-deadlocks that stop proof fetching entirely. Both are the same mistake: a StorageKnex method drops the caller's transaction token, so its query asks the pool for a second connection while the caller's transaction holds the first. knex forces {min:1,max:1} on sqlite, so it can never be granted and the task dies after acquireConnectionTimeout with KnexTimeoutError: Timeout acquiring a connection. The pool is probably full. Are you missing a .transacting(trx) call? 1. getProvenOrRawTx(txid, trx) dropped trx on its findProvenTxs call. Fixed upstream by ef710c3 (bsv-blockchain/ts-stack#426), published in 2.6.0. 2. readSettings() took no trx at all, so verifyReadyForDatabaseAccess deadlocked on the same pool. Fixed by 4958767a5 (#444), published in 2.7.0. TaskCheckForProofs therefore fails before processing any request, which is why an affected wallet's proven_tx_reqs backlog sits at zero attempts -- the rows are never reached rather than tried and failed. Downstream this makes BEEF payment ancestry never terminate at a proven parent, so x-bsv-payment headers grow without bound until a Cloudflare-fronted origin refuses the request at its 32KB header cap -- after the wallet has already broadcast and paid. Observed on a real wallet running the released build: 2,532 monitor error events, 340 proof requests outstanding at 0 attempts, 433 unproven transactions. Applying the equivalent fix moved proven_tx_reqs completed 18 -> 119, outstanding 139 -> 38, and the payment header 33,058 -> 13,666 bytes, with a wallet Cloudflare had been refusing paying again. Verified by unpacking the published tarballs rather than trusting release notes: version getProvenOrRawTx readSettings 2.4.4 drops trx no trx param 2.6.2 trx forwarded no trx param 2.10.1 trx forwarded trx forwarded Landing 2.6.x would therefore have shipped only half the fix. @bsv/sdk moves ^2.2.0 -> ^2.4.0 because it has to: wallet-toolbox declares peerDependencies @bsv/sdk ^2.4.0 from 2.7.0 onwards, which is the same version that carries the readSettings fix, so the two cannot be separated. Checked that every other @bsv/* dependency accepts it -- amountinator, btms, btms-permission-module and message-box-client all ask for ^2.1.6. 2.10.1 also carries 96e888612, which raises minimumDesiredUTXOValue off the historic 32 satoshis. That mismatch against the 96-satoshi dust floor is the other half of the header-growth problem, so it lands here for free. @bsv/wallet-toolbox-client is deliberately left at 2.4.4. Its newer releases are bundled packages whose exports map blocks the deep '/out/src/...' paths this app imports across six files. That is a separate migration and unrelated to this defect, which lives in StorageKnex -- Electron main only. NOTE FOR DEVELOPERS: this raises the effective minimum Node for a local install to 22. @bsv/sdk 2.4.0, @bsv/wallet-toolbox 2.10.1 and better-sqlite3 all declare engines node >=22, and on Node 20 npm install now dies in the postinstall step (electron-builder install-app-deps -> @electron/rebuild, itself already requiring >=22.12.0 on master). Verified on Node 24.13.0. npm run build passes (renderer tsc + vite, electron tsc). Tests: 15/15 default, 58/58 test:tokens, 32/32 test:stas:db including the four migration tests that exercise StorageKnex over knex+sqlite.

Copilot

Pull request overview

This PR updates bsv-desktop’s core BSV stack dependencies to align the Electron wallet’s bundled toolchain with the official Sigma “official-wallet” version matrix, primarily by pinning @bsv/wallet-toolbox and its peer @bsv/sdk to specific versions and refreshing the lockfile.

Changes:

Pin @bsv/sdk to 2.4.2 and @bsv/wallet-toolbox to 2.10.4 in package.json.
Refresh package-lock.json to reflect the pinned versions and updated transitive dependency graph.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Pins the primary BSV SDK/toolbox dependencies to the specified versions.
package-lock.json	Updates the resolved dependency graph to match the new pinned versions (including updated transitive packages).

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

rohenaz · 2026-09-01T14:02:56Z

+    "@bsv/sdk": "2.4.2",
    "@bsv/uhrp-react": "^1.0.6",
-    "@bsv/wallet-toolbox": "^2.4.4",
+    "@bsv/wallet-toolbox": "2.10.4",
    "@bsv/wallet-toolbox-client": "^2.4.4",


Fixed in a25eb50: the legacy client is pinned exactly to 2.4.4 and the lockfile is refreshed.

rohenaz · 2026-09-01T13:57:36Z

@sirdeggen This is ready for upstream review. The independent audit's dependency blocker is fixed at a25eb50: SDK 2.4.2, Wallet Toolbox 2.10.4, and legacy toolbox-client 2.4.4 are pinned exactly; Node 22+ is declared; the STAS script now preserves test failure. Default 24/24, token 58/58, STAS/SQLite 32/32, and the full build pass. Remaining gates are packaged/manual and funded-chain acceptance.

Copilot

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

rohenaz · 2026-09-01T14:02:56Z

+  "engines": {
+    "node": ">=22"
+  },


Fixed in eea1012: pull-request CI now runs only Node 22, matching the declared runtime floor and upgraded dependencies.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/push.yaml:15

The workflow update to a Node 22-only matrix is a good time to also bump the GitHub Actions used here: actions/checkout@v2 and especially actions/setup-node@v1 are very old and have been subject to deprecation/runtime transitions on GitHub-hosted runners. Updating them reduces the risk of CI suddenly breaking even though the repo is now pinned to a modern Node runtime.

        node-version: [22.x]
    steps:
    - uses: actions/checkout@v2
    - name: Use Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@v1

rohenaz · 2026-09-01T14:19:04Z

Follow-up at 6795328: the Node 22 workflow now uses actions/checkout@v4, actions/setup-node@v4 with npm caching, and lockfile-faithful npm ci instead of caching node_modules and conditionally running npm install. Fresh npm ci, default 24/24 tests, renderer/Electron build, and diff check pass locally. @sirdeggen the branch remains ready for maintainer review.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

rohenaz · 2026-09-01T14:26:26Z

Packaged-bundle smoke is now complete at 6795328: fresh npm ci produced one deduplicated SDK 2.4.2 graph with Wallet Toolbox 2.10.4 and toolbox-client 2.4.4; unsigned/ad-hoc ARM64 app-directory packaging succeeded; deep strict signature verification passed; the packaged Mach-O executed under Electron-as-Node (41.2.0 arm64); and the renderer/main/package entries are present in app.asar. No install, publish, production wallet, or funded-chain mutation was performed. Remaining gates are maintainer review/merge and explicitly funded-chain acceptance.

rohenaz · 2026-09-02T14:42:02Z

Closing this. It was a rebase of #78 done for our own interoperability testing and it drifted into CI and version-policy changes that are not ours to make. Deferring to #78.

Imran Munir and others added 2 commits September 1, 2026 09:32

fix(deps): align Wallet Toolbox with official Sigma matrix

1e63ffc

Copilot AI lite review requested due to automatic review settings September 1, 2026 13:35

rohenaz mentioned this pull request Sep 1, 2026

fix(deps): bump @bsv/wallet-toolbox to 2.10.1 for both proof-task deadlock fixes #78

Merged

Copilot started reviewing on behalf of rohenaz September 1, 2026 13:35 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

fix(deps): lock Desktop wallet compatibility matrix

a25eb50

Copilot AI review requested due to automatic review settings September 1, 2026 13:54

Copilot started reviewing on behalf of rohenaz September 1, 2026 13:55 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

fix(ci): align Desktop checks with Node 22

eea1012

Copilot AI review requested due to automatic review settings September 1, 2026 14:02

Copilot started reviewing on behalf of rohenaz September 1, 2026 14:03 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

ci: update Node 22 workflow actions

6795328

Copilot AI review requested due to automatic review settings September 1, 2026 14:19

Copilot started reviewing on behalf of rohenaz September 1, 2026 14:19 View session

rohenaz force-pushed the codex/opl4114-wallet-toolbox-2.10.4 branch from a838ac3 to 6795328 Compare September 1, 2026 14:19

Copilot AI reviewed Sep 1, 2026

View reviewed changes

rohenaz closed this Sep 2, 2026

rohenaz deleted the codex/opl4114-wallet-toolbox-2.10.4 branch September 2, 2026 14:42

Navigation Menu

Uh oh!

OPL-4114: align Desktop Wallet Toolbox with official Sigma matrix - #86

OPL-4114: align Desktop Wallet Toolbox with official Sigma matrix#86
rohenaz wants to merge 5 commits into
bsv-blockchain:masterfrom
rohenaz:codex/opl4114-wallet-toolbox-2.10.4

rohenaz commented Sep 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

rohenaz Sep 1, 2026

Uh oh!

rohenaz commented Sep 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

rohenaz Sep 1, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

rohenaz commented Sep 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

rohenaz commented Sep 1, 2026

Uh oh!

rohenaz commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

rohenaz commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Remaining gates and known risks

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

rohenaz Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

rohenaz commented Sep 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

rohenaz Sep 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

rohenaz commented Sep 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

rohenaz commented Sep 1, 2026

Uh oh!

rohenaz commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rohenaz commented Sep 1, 2026 •

edited

Loading