Fix AlbyHub executable and switch Wallet Connections to official NWC logo

app/icons/nwc.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="128" height="120" fill="none"><g clip-path="url(#a)"><path fill="#472459" d="M127.2 65.67c-5.13 5.11-12.23 3.88-17.35-1.25l-41.4-41.6 19.4-19.47a11.35 11.35 0 0 1 18.4 3.37l21.58 56.22a2.5 2.5 0 0 1-.57 2.67l-13.63 13.57 13.58-13.51Z"/><path fill="url(#b)" d="m109.85 64.42-54.16-54.4a13.13 13.13 0 0 0-18.57-.05L3.87 43.07a13.13 13.13 0 0 0-.05 18.57l54.16 54.4a13.13 13.13 0 0 0 18.57.04l10.7-10.64 3.12-3.12-10-10.03a19.04 19.04 0 0 1-23.83-2.56l-6.8-6.85a2.46 2.46 0 0 1 0-3.5l3.35-3.32-8.4-8.46a3.67 3.67 0 0 1-.34-4.9 3.57 3.57 0 0 1 5.29-.23l8.51 8.56 6.68-6.63-8.41-8.46a3.67 3.67 0 0 1-.33-4.9 3.58 3.58 0 0 1 5.3-.24l8.5 8.57 3.36-3.34a2.47 2.47 0 0 1 3.5.01l6.8 6.84a19.03 19.03 0 0 1 2.41 23.86l10 10.03 5.69-5.67 8.16-8.12 17.4-17.31c-5.15 5.11-12.25 3.88-17.36-1.25Z"/></g><defs><linearGradient id="b" x1="63.6" x2="63.6" y1="6.15" y2="119.91" gradientUnits="userSpaceOnUse"><stop stop-color="#FFCA4A"/><stop offset="1" stop-color="#F7931A"/></linearGradient><clipPath id="a"><path fill="#fff" d="M0 0h128v119.91H0z"/></clipPath></defs></svg>

app/tests/test_wallet_connections.py

@@ -26,6 +26,8 @@ Tests cover:
 
 import json
 import re
+import shutil
+import subprocess
 import sys
 import tempfile
 import types
@@ -186,6 +188,13 @@ class FeatureRegistryTests(unittest.TestCase):
         self.assertIn(("80", "TCP"), ports)
         self.assertIn(("443", "TCP"), ports)
 
+    def test_wallet_connections_tile_icon_is_nwc(self):
+        repo_root = Path(__file__).resolve().parents[2]
+        hub_module = repo_root / "modules" / "core" / "sovran-hub.nix"
+        text = hub_module.read_text()
+        self.assertIn('{ name = "Wallet Connections"; unit = "albyhub.service"; type = "system"; icon = "nwc";', text)
+        self.assertIn('{ name = "Zeus Connect";       unit = "zeus-connect-setup.service"; type = "system"; icon = "zeus";', text)
+
     def test_service_map_points_to_albyhub(self):
         self.assertEqual(server.FEATURE_SERVICE_MAP["nwc-wallets"], "albyhub.service")
 
@@ -1096,6 +1105,18 @@ class LnurlHandlerAmountTests(unittest.TestCase):
 
 
 class NixPatchContractTests(unittest.TestCase):
+    @staticmethod
+    def _patched_albyhub_nix_expr(result_expr: str) -> str:
+        return (
+            "let flake = builtins.getFlake (toString ./.); "
+            "pkgs = import flake.inputs.nixpkgs { system = builtins.currentSystem; }; "
+            "patchedAlbyHub = pkgs.albyhub.overrideAttrs (old: { patches = (old.patches or []) ++ [ "
+            "./packages/albyhub/0001-private-route-hints.patch "
+            "./packages/albyhub/0002-isolated-invoice-app-id.patch "
+            "]; }); "
+            f"in {result_expr}"
+        )
+
     def test_nwc_module_uses_non_placeholder_albyhub_strategy(self):
         repo_root = Path(__file__).resolve().parents[2]
         module_path = repo_root / "modules" / "nwc-wallets.nix"
@@ -1108,6 +1129,61 @@ class NixPatchContractTests(unittest.TestCase):
         self.assertIn("AUTO_UNLOCK_PASSWORD", text)
         self.assertNotIn("AUTO_UNLOCK_PASSWORD_FILE", text)
 
+    def test_nwc_module_uses_lib_getexe_for_albyhub_binary(self):
+        repo_root = Path(__file__).resolve().parents[2]
+        module_path = repo_root / "modules" / "nwc-wallets.nix"
+        text = module_path.read_text()
+        self.assertIn("exec ${lib.getExe patchedAlbyHub}", text)
+        self.assertNotIn("${patchedAlbyHub}/bin/hub", text)
+
+    def test_official_nwc_icon_asset_is_committed(self):
+        repo_root = Path(__file__).resolve().parents[2]
+        icon_path = repo_root / "app" / "icons" / "nwc.svg"
+        self.assertTrue(icon_path.exists())
+        text = icon_path.read_text()
+        self.assertIn("linearGradient", text)
+        self.assertIn("#F7931A", text)
+
+    def test_albyhub_main_program_via_nix_eval(self):
+        if shutil.which("nix") is None:
+            self.skipTest("nix not installed in this environment")
+        repo_root = Path(__file__).resolve().parents[2]
+        get_exe_expr = self._patched_albyhub_nix_expr("pkgs.lib.getExe patchedAlbyHub")
+        get_exe_result = subprocess.run(
+            [
+                "nix",
+                "eval",
+                "--raw",
+                "--impure",
+                "--expr",
+                get_exe_expr,
+            ],
+            check=True,
+            capture_output=True,
+            text=True,
+            cwd=repo_root,
+        )
+        exe_path = get_exe_result.stdout.strip()
+        self.assertIn("/nix/store/", exe_path)
+        self.assertTrue(exe_path.endswith("/bin/albyhub"))
+        self.assertNotIn("/bin/hub", exe_path)
+
+        main_program_result = subprocess.run(
+            [
+                "nix",
+                "eval",
+                "--raw",
+                "--impure",
+                "--expr",
+                self._patched_albyhub_nix_expr("patchedAlbyHub.meta.mainProgram"),
+            ],
+            check=True,
+            capture_output=True,
+            text=True,
+            cwd=repo_root,
+        )
+        self.assertEqual(main_program_result.stdout.strip(), "albyhub")
+
     def test_private_route_hint_patch_exact_change(self):
         repo_root = Path(__file__).resolve().parents[2]
         patch_path = repo_root / "packages" / "albyhub" / "0001-private-route-hints.patch"

docs/wallet-connections.md

@@ -80,9 +80,20 @@ No placeholder source/vendor hashes are used in the Wallet Connections module.
 | Service | User | Description |
 |---|---|---|
 | `albyhub.service` | `albyhub` | Headless Alby Hub NWC wallet server |
-| `nwc-lnurl.service` | `nwc-lnurl` | Dedicated LNURL discovery and callback service |
+| `nwc-lnurl.service` | `albyhub` | Dedicated LNURL discovery and callback service |
 | `albyhub-init.service` | `root` (oneshot) | Generates `unlock-password` once on first boot |
 
+`nwc-lnurl.service` runs as `albyhub` so it can traverse `/var/lib/albyhub` (0700) and read `/var/lib/albyhub/unlock-password` (0600) without weakening permissions.
+
+## Wallet Connections icon asset
+
+- Hub service icon identifier: `nwc` (feature name remains **Wallet Connections**)
+- Asset path in this repository: `app/icons/nwc.svg`
+- Official source: `https://raw.githubusercontent.com/getAlby/nostr-wallet-connect/5fb6831739c7e6b089cd7205e11910ef542432ad/public/images/nwc-logo.svg`
+- Upstream repository: `https://github.com/getAlby/nostr-wallet-connect`
+- Upstream license: Apache-2.0 (`https://github.com/getAlby/nostr-wallet-connect/blob/5fb6831739c7e6b089cd7205e11910ef542432ad/LICENSE`)
+- Attribution/redistribution note: Apache-2.0 permits redistribution; preserve upstream license notices in distributions.
+
 ## API
 
 Management (authenticated):

modules/core/sovran-hub.nix

@@ -61,7 +61,7 @@ let
         { label = "Server"; value = "tcp://127.0.0.1:50001 (Electrs)"; }
         { label = "Status"; value = "Auto-configured on first boot"; }
       ]; }
-      { name = "Wallet Connections"; unit = "albyhub.service"; type = "system"; icon = "zeus"; enabled = cfg.features."nwc-wallets"; category = "bitcoin-apps"; credentials = [
+      { name = "Wallet Connections"; unit = "albyhub.service"; type = "system"; icon = "nwc"; enabled = cfg.features."nwc-wallets"; category = "bitcoin-apps"; credentials = [
         { label = "Lightning Address Domain"; file = "/var/lib/domains/lightning"; }
       ]; }
       { name = "Mempool";            unit = "mempool.service";      type = "system"; icon = "mempool";      enabled = cfg.features.mempool;  category = "bitcoin-apps"; credentials = [

modules/nwc-wallets.nix

@@ -20,7 +20,7 @@ let
       ${pkgs.openssl}/bin/openssl rand -hex 32 > "$password_file"
     fi
     export AUTO_UNLOCK_PASSWORD="$(cat "$password_file")"
-    exec ${patchedAlbyHub}/bin/hub
+    exec ${lib.getExe patchedAlbyHub}
   '';
 in
 lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {