Skywire Development Update — October 14, 2026

The fourteenth of October made skywire.conf the real source of truth for a visor’s settings: every config generation flag gained a variable there, every live setting change made through the CLI, the hypervisor or the settings page is now saved back to the exact file the config was generated from, and Windows installs, whose settings file had been silently ignored, now read it. SkyDNS became usable for HTTPS to mesh names, asks for a password once instead of failing when it lacks the privilege to create its network interface, and now shares the resolving proxy’s warm routes, which took repeated page requests from several seconds each to under half a second. The resolving proxies gained explicit choices for traffic that is not bound for the mesh, LinuxOnTab can now be served beside the desk and opened from it, and on the Skycoin side the node learned to serve the web wallet as an installable app with its password kept in the browser, while the skycoin.com site was rebuilt on a current toolchain and is deployed by release again.

Skywire: skywire.conf as the Source of Truth

5663 stopped the visor guessing which skywire.conf to write live changes back to. It used to write only when its config sat at the package path and the system file existed, so a development visor built from a local file never saved a live change, and a custom settings path could have changes written to a stale system file. Config generation now records the absolute path of the file it read, and the visor writes there and nowhere else. 5664 then made every live setting change reach that file, not only config set and the hypervisor’s own list; dedicated commands such as route calc, tp public, hv ui disable and resolver up had written only the JSON, which the next autoconfig undid. Three live settings without a variable gained one, and a regeneration now keeps transports saved with tp add --persist. 5666 pointed the settings page and cli visor skyenv at that recorded file, since on a development visor they had shown a file that does not exist.

5660 gave every remaining config generation flag a variable, including the wallet options, cascade, external apps and disabled apps, and made a regeneration keep the keyring and the resolver’s per-domain rules; a new test fails whenever a flag reads no variable. 5667 added variables for the remaining visor settings, among them the log hook level, the pty SSH listener, dmsgscp and stats retention, and fixed the dmsg session count set from the hypervisor UI being lost at the next start because it changed a copy the config never wrote. 5645 added a --resolver-ca flag and matching variable for the resolvers’ HTTPS interception, which had no variable at all, so every autoconfig wrote the resolvers back without it and a visor that regenerates its config at start lost HTTPS over mesh names on every restart. 5651 fixed its test on Windows, where the generated paths carry backslashes.

5669 found that Windows installs got a PowerShell form of the settings template, which the parser does not read, so every setting in that file was ignored, and the template had also fallen about sixty variables behind. Every system now gets the one template, and the parser, the settings page and autoconfig’s editor also read the PowerShell form so existing Windows files take effect. It was tested on Linux and with a Windows build, but not run on Windows. 5665 removed the ui_server config block, which started a second network graph at boot that no deployment used, on a port two deployment hosts use for the Skycoin explorer; tp viz --visor still starts the graph on demand. 5668 made the CLI show a refusal sent back by a running visor as it was sent, rather than wrapping every error in a hint asking whether skywire is running.

Skywire: SkyDNS Gets HTTPS and Warm Routes

5652 fixed the mesh gateway, which terminated HTTPS on port 443 and then dialed the peer on 443 too, where nothing listens, so every HTTPS link through it failed, including on Android and the VPN router. It now dials the peer’s plain HTTP port, as the resolving proxies already do. SkyDNS also gained a certificate authority option so it can serve HTTPS at all, and skywire.conf can now turn it on and hand it the same authority the resolvers use. That change has not yet been run end to end on a Linux host.

5654 stopped SkyDNS failing outright when the visor lacks the capability to create a network interface. It now runs one privileged setup step through a password prompt, as the VPN apps already do, creating a persistent interface owned by the visor’s user, routing the mesh range into it and pointing the dmsg and skynet zones at it, after which it opens that interface with no privilege. The interface outlives the app, so later starts do not ask again. 5658 fixed a lint failure that change caused on platforms where the setup step always returns an error. 5653 let the development loop reapply that capability to the freshly built binary after each build, where a narrowly scoped rule allows it, and 5656 made the external app launcher actually run an in-tree app as its own process when asked, which it had silently ignored, so an app can pick up the binary’s file capabilities.

5655 carried SkyDNS and mesh gateway dials through the visor’s own resolving proxy where one is published, instead of setting up a fresh route for each connection. A browser opens many connections per page, and each had waited two to seven seconds; on a development visor, repeated requests to node.skycoin.com went from that to 0.40 to 0.46 seconds. Across forty random online visors SkyDNS reached thirty-two against thirty-four through the SOCKS client, and the ones SkyDNS missed also failed through the resolver directly. 5659 fixed the SOCKS client re-reading the visor’s published resolvers only while it had none, so a first answer holding dmsg but not yet skynet meant every skynet name went to the exit and was refused until the next connect cycle. It now re-reads at most once a minute regardless.

Skywire: Choosing Where Non-Mesh Traffic Goes

5646 added a none upstream for the resolving proxies, as a default or a per-domain rule, which refuses destinations that are not mesh names, so a browser can be pointed at the mesh without its ordinary traffic leaving on the host’s own address. 5647 made direct work as a default upstream too, where it had been dialed as a SOCKS server named “direct”, and documented all three choices. 5648 then found that a resolver dialing directly connected to the loopback placeholder it hands back during name resolution instead of the original host, so every clearnet name failed; it now rebuilds the original host and port first. 5649 updated two tests that had only passed because of that bug.

Skywire: Proxy Fixes

5671 let a visor open its own forwarded ports through its own proxy, which failed with host unreachable while other visors reached them fine, because self-dials were served only from the service registry. 5678 fixed proxy test scrambling the SOCKS client’s arguments when it restored them through a map, which once left a client that refused to start; the snapshot is now written back unchanged and the client restarted. 5679 made the automatic exit picker also complete a TLS handshake through a candidate exit before accepting it, after a new browser visor kept an exit for half an hour that passed a plain HTTP fetch but failed HTTPS and connections by address.

Skywire: LinuxOnTab Beside the Desk

5674 added hv serve --lot, which serves a LinuxOnTab checkout with the cross-origin isolation headers it needs, so the guest can use the tab visor as its network without a separate proxy, along with a guide that was followed in a browser on a fresh desk through to a guest fetching its exit’s address. 5680 added a linux app to the desk menu that opens it in a desk window, plus link parameters that open it as soon as the desk is up. 5681 fixed the browser module being written beside the binary under a hardened systemd unit with no home directory, where the write failed and every desk got a 404; it now goes to the unit’s own cache or state directory.

Skywire: Documentation, CI and Dependencies

5650 linked the host bridge page from the desk, the dashboard and the CLI help, and made the README link every one of the repository’s more than two hundred documents. 5662 rewrote the README’s comparison of which Skywire to run and extended the resolving proxy guide to cover SkyDNS and resolver HTTPS. 5670 added guides on how the browser visor is built, every form of a mesh address, and publishing a site, noting that browsers refuse a certificate for the long hex name. 5672 fixed stale claims found in a read-only audit of the documentation and listed nine variables the template had been missing. 5657 stopped each merge cancelling the previous commit’s test run and filtered the README badges to the development branch, which had shown red for runs that never failed.

5673 updated every Go module to its latest version, including seventeen forks that had fallen behind and a Skycoin version with the web wallet option, keeping go-fuse back for 32-bit builds. 5675 moved the Docker and F-Droid builds to Go 1.27.2, which that update required. 5676 and 5677 picked up the Skycoin wallet password changes described below.

Skycoin: The Node Serves the Web Wallet

skycoin#3106 let a Skycoin node started with -web-wallet serve the embedded web wallet at the root of its web interface in place of the GUI, keeping keys in the browser and using the API of the node that served it, and made the wallet an installable progressive web app with a service worker. skycoin#3108 then moved the wallet’s password into the browser too: a password set in the wallet’s settings encrypts the stored wallets and puts them behind a lock screen, and a forgotten password can only be answered by erasing the browser’s wallets and restoring them from their seeds. The node-side wallet credentials added hours earlier were removed. skycoin#3107 added the cipher import to the template the node command is generated from, skycoin#3109 made the service worker manifest reproducible by zeroing the build time Angular writes into it, and skycoin#3110 fixed a change detection check on the new password page.

Skycoin: Fixes and Dependency Updates

skycoin#3104 fixed signTransaction failing with “wallet doesn’t exist” outside the node’s wallet directory, because it loaded the wallet as a local file before sending the same name to the node; it now asks the node. skycoin#3099 combined four dependency updates for the explorer, GUI, web wallet and DEX client, aligning every Angular package on one version and rebuilding the committed bundles. skycoin#3100 kept the explorer’s end-to-end tests working under WebdriverIO 10, which fails a selector that matches more than one element, and skycoin#3105 combined three small source-map updates.

Skycoin: skycoin.com Rebuilt

skycoin.com#62 moved the skycoin.com site from a toolchain several major versions old onto Vite, React 19 and Node 24, prerendering all 270 pages across six languages to static HTML. Its old deployment pipeline had stopped deploying anything, and every page but the home page returned 404 when loaded directly. A tagged release now publishes the site, which the server installs on a timer while keeping three releases for rollback. The content is unchanged and will be revised separately. skycoin.com#63 stopped the home page’s hero animation redrawing while hidden or scrolled away, which had cost about thirty percent of a core, and fixed five pages that failed to hydrate.