@agentlayer.tech/wallet 0.1.18 → 0.1.20

package/agent-wallet/scripts/install_agent_wallet.py

@@ -3,8 +3,10 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
 import os
+import platform
 import shutil
 import subprocess
 import sys
@@ -114,6 +116,21 @@ def _resolve_sealed_keys_path() -> Path:
     return _resolve_openclaw_home() / "sealed_keys.json"
 
 
+def _runtime_base_for(runtime_root: Path) -> Path:
+    resolved = runtime_root.expanduser().resolve()
+    if resolved.parent.name == "releases":
+        return resolved.parent.parent
+    return resolved.parent
+
+
+def _shared_runtime_root(runtime_root: Path) -> Path:
+    return _runtime_base_for(runtime_root) / "shared"
+
+
+def _shared_dependency_links_supported() -> bool:
+    return os.name != "nt"
+
+
 def _atomic_write_text(path: Path, content: str, *, mode: int = 0o600) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     fd, temp_path = tempfile.mkstemp(prefix=f".{path.name}.", dir=str(path.parent))
@@ -139,6 +156,21 @@ def _chmod_if_exists(path: Path, mode: int = 0o600) -> None:
         return
 
 
+def _sha256_text(parts: list[str]) -> str:
+    digest = hashlib.sha256()
+    for part in parts:
+        digest.update(part.encode("utf-8"))
+        digest.update(b"\0")
+    return digest.hexdigest()
+
+
+def _file_text_or_empty(path: Path) -> str:
+    try:
+        return path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return ""
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--config-path", default=str(_default_config_path()))
@@ -201,6 +233,9 @@ def _ignore_runtime_entries(_directory: str, names: list[str]) -> set[str]:
     keep_dist = ".openclaw" in directory.parts and "extensions" in directory.parts
     ignored: set[str] = set()
     for name in names:
+        if name == "pay-bridge" and directory.parts[-2:] == (".openclaw", "extensions"):
+            ignored.add(name)
+            continue
         if name == "dist" and keep_dist:
             continue
         if name in EXCLUDED_RUNTIME_DIR_NAMES:
@@ -269,6 +304,14 @@ def _sync_runtime_tree(source_root: Path, runtime_root: Path) -> dict[str, objec
 def _ensure_env_file(env_path: Path, env_example_path: Path) -> bool:
     if env_path.exists():
         return False
+    if not env_example_path.exists():
+        source_candidate = _package_root() / ".env.example"
+        if source_candidate.exists():
+            env_example_path = source_candidate
+        else:
+            raise SystemExit(
+                f"Missing env example template at '{env_example_path}'."
+            )
     env_path.parent.mkdir(parents=True, exist_ok=True)
     shutil.copyfile(env_example_path, env_path)
     _chmod_if_exists(env_path, 0o600)
@@ -363,8 +406,95 @@ def _ensure_python_wrapper(venv_path: Path) -> Path:
     return wrapper
 
 
-def _ensure_python_runtime(venv_path: Path, package_root: Path) -> tuple[Path, bool]:
+def _python_runtime_fingerprint(package_root: Path, python_bin: Path) -> str:
+    version = f"{sys.version_info.major}.{sys.version_info.minor}"
+    return _sha256_text(
+        [
+            f"python-bin:{python_bin}",
+            f"python-version:{version}",
+            f"platform:{platform.system()}",
+            f"machine:{platform.machine()}",
+            _file_text_or_empty(package_root / "pyproject.toml"),
+        ]
+    )[:24]
+
+
+def _python_runtime_plan(
+    venv_path: Path,
+    package_root: Path,
+    runtime_root: Path,
+) -> dict[str, object]:
+    if _shared_dependency_links_supported():
+        fingerprint = _python_runtime_fingerprint(package_root, Path(sys.executable))
+        shared_root = _shared_runtime_root(runtime_root) / "python" / fingerprint
+        shared_venv_path = shared_root / "venv"
+        shared_wrapper = _venv_python_wrapper(shared_venv_path)
+        return {
+            "shared": True,
+            "fingerprint": fingerprint,
+            "shared_root": str(shared_root),
+            "venv_path": str(shared_venv_path),
+            "release_link_path": str(venv_path),
+            "python_bin": str(venv_path / shared_wrapper.relative_to(shared_venv_path)),
+            "action": "reuse" if shared_venv_path.exists() else "create",
+            "exists": shared_venv_path.exists(),
+        }
+    return {
+        "shared": False,
+        "fingerprint": None,
+        "shared_root": None,
+        "venv_path": str(venv_path),
+        "release_link_path": str(venv_path),
+        "python_bin": str(_venv_python_wrapper(venv_path)),
+        "action": "install",
+        "exists": _venv_python(venv_path).exists(),
+    }
+
+
+def _replace_with_directory_symlink(link_path: Path, target_path: Path) -> None:
+    target_resolved = target_path.resolve()
+    if link_path.is_symlink():
+        existing_target = link_path.resolve()
+        if existing_target == target_resolved:
+            return
+        link_path.unlink()
+    elif link_path.exists():
+        if link_path.is_dir():
+            shutil.rmtree(link_path)
+        else:
+            link_path.unlink()
+    link_path.parent.mkdir(parents=True, exist_ok=True)
+    link_path.symlink_to(target_resolved, target_is_directory=True)
+
+
+def _ensure_python_runtime(
+    venv_path: Path,
+    package_root: Path,
+    runtime_root: Path,
+) -> tuple[Path, bool, dict[str, object]]:
     created = False
+    plan = _python_runtime_plan(venv_path, package_root, runtime_root)
+    if bool(plan["shared"]):
+        shared_root = Path(str(plan["shared_root"]))
+        shared_venv_path = Path(str(plan["venv_path"]))
+        python_bin = _venv_python(shared_venv_path)
+        if not python_bin.exists():
+            venv.EnvBuilder(with_pip=True).create(shared_venv_path)
+            created = True
+            subprocess.run(
+                [str(python_bin), "-m", "pip", "install", "-e", str(package_root)],
+                check=True,
+            )
+        shared_wrapper = _ensure_python_wrapper(shared_venv_path)
+        _replace_with_directory_symlink(venv_path, shared_venv_path)
+        plan["action"] = "create" if created else "reuse"
+        plan["exists"] = True
+        return (
+            venv_path / shared_wrapper.relative_to(shared_venv_path),
+            created,
+            plan,
+        )
+
     python_bin = _venv_python(venv_path)
     if not python_bin.exists():
         venv.EnvBuilder(with_pip=True).create(venv_path)
@@ -374,10 +504,79 @@ def _ensure_python_runtime(venv_path: Path, package_root: Path) -> tuple[Path, b
         [str(python_bin), "-m", "pip", "install", "-e", str(package_root)],
         check=True,
     )
-    return _ensure_python_wrapper(venv_path), created
+    return (
+        _ensure_python_wrapper(venv_path),
+        created,
+        plan,
+    )
+
+
+def _node_version() -> str:
+    result = subprocess.run(
+        ["node", "--version"],
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return result.stdout.strip()
+
 
+def _node_runtime_fingerprint(project_root: Path) -> str:
+    return _sha256_text(
+        [
+            f"node-version:{_node_version()}",
+            f"platform:{platform.system()}",
+            f"machine:{platform.machine()}",
+            _file_text_or_empty(project_root / "package.json"),
+            _file_text_or_empty(project_root / "package-lock.json"),
+        ]
+    )[:24]
 
-def _ensure_node_runtime(npm_bin: str, project_root: Path) -> dict[str, object]:
+
+def _node_runtime_plan(project_root: Path, runtime_root: Path) -> dict[str, object]:
+    package_json = project_root / "package.json"
+    package_lock = project_root / "package-lock.json"
+    command = ["npm", "ci"] if package_lock.exists() else ["npm", "install"]
+    if _shared_dependency_links_supported():
+        fingerprint = _node_runtime_fingerprint(project_root)
+        shared_project_root = _shared_runtime_root(runtime_root) / "node" / project_root.name / fingerprint
+        shared_node_modules = shared_project_root / "node_modules"
+        return {
+            "project_root": str(project_root),
+            "package_json": str(package_json),
+            "package_lock": str(package_lock) if package_lock.exists() else None,
+            "command": command,
+            "shared": True,
+            "fingerprint": fingerprint,
+            "shared_root": str(shared_project_root),
+            "node_modules_path": str(shared_node_modules),
+            "release_link_path": str(project_root / "node_modules"),
+            "action": "reuse" if shared_node_modules.exists() else "create",
+            "exists": shared_node_modules.exists(),
+        }
+    return {
+        "project_root": str(project_root),
+        "package_json": str(package_json),
+        "package_lock": str(package_lock) if package_lock.exists() else None,
+        "command": command,
+        "shared": False,
+        "fingerprint": None,
+        "shared_root": None,
+        "node_modules_path": str(project_root / "node_modules"),
+        "release_link_path": str(project_root / "node_modules"),
+        "action": "install",
+        "exists": (project_root / "node_modules").exists(),
+    }
+
+
+def _copy_if_exists(source: Path, target: Path) -> None:
+    if not source.exists():
+        return
+    target.parent.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(source, target)
+
+
+def _ensure_node_runtime(npm_bin: str, project_root: Path, runtime_root: Path) -> dict[str, object]:
     package_json = project_root / "package.json"
     if not package_json.exists():
         raise SystemExit(f"Missing package.json for Node runtime at '{project_root}'.")
@@ -391,14 +590,30 @@ def _ensure_node_runtime(npm_bin: str, project_root: Path) -> dict[str, object]:
     env["NPM_CONFIG_CACHE"] = cache_dir
     env["npm_config_cache"] = cache_dir
     Path(cache_dir).expanduser().mkdir(parents=True, exist_ok=True)
+    plan = _node_runtime_plan(project_root, runtime_root)
+    if bool(plan["shared"]):
+        shared_project_root = Path(str(plan["shared_root"]))
+        shared_node_modules = Path(str(plan["node_modules_path"]))
+        created = False
+        if not shared_node_modules.exists():
+            shared_project_root.mkdir(parents=True, exist_ok=True)
+            _copy_if_exists(package_json, shared_project_root / "package.json")
+            _copy_if_exists(package_lock, shared_project_root / "package-lock.json")
+            _copy_if_exists(project_root / ".npmrc", shared_project_root / ".npmrc")
+            subprocess.run(command, cwd=shared_project_root, check=True, env=env)
+            created = True
+        _replace_with_directory_symlink(project_root / "node_modules", shared_node_modules)
+        plan["cache_dir"] = cache_dir
+        plan["created"] = created
+        plan["action"] = "create" if created else "reuse"
+        plan["exists"] = True
+        return plan
+
     subprocess.run(command, cwd=project_root, check=True, env=env)
-    return {
-        "project_root": str(project_root),
-        "package_json": str(package_json),
-        "package_lock": str(package_lock) if package_lock.exists() else None,
-        "command": command,
-        "cache_dir": cache_dir,
-    }
+    plan["cache_dir"] = cache_dir
+    plan["created"] = True
+    plan["exists"] = True
+    return plan
 
 
 def _pending_env_names() -> list[str]:
@@ -523,13 +738,28 @@ def main() -> None:
     python_bin = Path(sys.executable)
     venv_created = False
     existing_wrapper = _venv_python_wrapper(venv_path)
+    python_runtime: dict[str, object] = {
+        "shared": False,
+        "fingerprint": None,
+        "shared_root": None,
+        "venv_path": str(venv_path),
+        "release_link_path": str(venv_path),
+        "python_bin": str(_venv_python_wrapper(venv_path)),
+        "action": "skipped",
+        "exists": existing_wrapper.exists(),
+    }
     if args.skip_python_setup and args.install_from_runtime and existing_wrapper.exists():
         python_bin = existing_wrapper
     elif not args.skip_python_setup:
         if not args.dry_run:
-            python_bin, venv_created = _ensure_python_runtime(venv_path, package_root)
+            python_bin, venv_created, python_runtime = _ensure_python_runtime(
+                venv_path,
+                package_root,
+                runtime_root,
+            )
         else:
-            python_bin = _venv_python_wrapper(venv_path)
+            python_runtime = _python_runtime_plan(venv_path, package_root, runtime_root)
+            python_bin = Path(str(python_runtime["python_bin"]))
 
     node_runtime = {
         "skipped": bool(args.skip_node_setup),
@@ -545,17 +775,22 @@ def main() -> None:
         if args.dry_run:
             node_runtime["projects"] = [
                 {
-                    "project_root": str(project_root),
+                    **_node_runtime_plan(project_root, runtime_root),
                     "command": [
                         args.npm_bin,
                         "ci" if (project_root / "package-lock.json").exists() else "install",
                     ],
+                    "cache_dir": (
+                        os.environ.get("OPENCLAW_AGENT_WALLET_NPM_CACHE")
+                        or str(_resolve_openclaw_home() / "npm-cache")
+                    ),
+                    "created": False,
                 }
                 for project_root in node_projects
             ]
         else:
             node_runtime["projects"] = [
-                _ensure_node_runtime(args.npm_bin, project_root)
+                _ensure_node_runtime(args.npm_bin, project_root, runtime_root)
                 for project_root in node_projects
             ]
 
@@ -597,6 +832,7 @@ def main() -> None:
                 "install_from_runtime": bool(args.install_from_runtime),
                 "python_bin": str(python_bin),
                 "venv_created": venv_created,
+                "python_runtime": python_runtime,
                 "node_runtime": node_runtime,
                 "runtime_sync": runtime_sync,
                 "configured": configured,

package/agent-wallet/scripts/install_openclaw_local_config.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import argparse
 import json
 import os
-import shutil
+import secrets
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
@@ -49,15 +49,6 @@ OPTIONAL_TOOLS = [
     "flash_trade_close_position",
 ]
 
-PAY_BRIDGE_PLUGIN_ID = "pay-bridge"
-PAY_BRIDGE_TOOLS = [
-    "pay_status",
-    "pay_wallet_info",
-    "pay_search_services",
-    "pay_get_service_endpoints",
-    "pay_api_request",
-]
-
 X402_TOOLS = [
     "x402_search_services",
     "x402_get_service_details",
@@ -104,13 +95,6 @@ def _default_extension_path() -> Path:
     return _repo_root() / ".openclaw" / "extensions" / "agent-wallet"
 
 
-def _default_pay_bridge_extension_path() -> Path:
-    runtime_root = _trusted_runtime_root()
-    if runtime_root is not None:
-        return runtime_root / ".openclaw" / "extensions" / PAY_BRIDGE_PLUGIN_ID
-    return _repo_root() / ".openclaw" / "extensions" / PAY_BRIDGE_PLUGIN_ID
-
-
 def _default_package_root() -> Path:
     runtime_root = _trusted_runtime_root()
     if runtime_root is not None:
@@ -133,14 +117,6 @@ def _default_python_bin() -> str:
     return sys.executable
 
 
-def _default_pay_binary() -> str:
-    explicit = os.getenv("OPENCLAW_PAY_BINARY", "").strip()
-    if explicit:
-        return explicit
-    resolved = shutil.which("pay")
-    return resolved or "pay"
-
-
 def _default_user_id() -> str:
     return f"{os.getenv('USER', 'openclaw-user')}-local"
 
@@ -178,10 +154,8 @@ def build_parser() -> argparse.ArgumentParser:
         default=True,
     )
     parser.add_argument("--extension-path", default=str(_default_extension_path()))
-    parser.add_argument("--pay-bridge-extension-path", default=str(_default_pay_bridge_extension_path()))
     parser.add_argument("--package-root", default=str(_default_package_root()))
     parser.add_argument("--python-bin", default=_default_python_bin())
-    parser.add_argument("--pay-binary", default=_default_pay_binary())
     parser.add_argument("--write-master-key", action=argparse.BooleanOptionalAction, default=False)
     return parser
 
@@ -191,12 +165,15 @@ def _collect_sealed_secret_updates() -> dict[str, str]:
     master_key = os.getenv("AGENT_WALLET_MASTER_KEY", "").strip()
     approval_secret = os.getenv("AGENT_WALLET_APPROVAL_SECRET", "").strip()
     private_key = os.getenv("SOLANA_AGENT_PRIVATE_KEY", "").strip()
+    evm_wallet_password = os.getenv("WDK_EVM_WALLET_PASSWORD", "").strip()
     if master_key:
         updates["master_key"] = master_key
     if approval_secret:
         updates["approval_secret"] = approval_secret
     if private_key:
         updates["private_key"] = private_key
+    if evm_wallet_password:
+        updates["wdk_evm_wallet_password"] = evm_wallet_password
     return updates
 
 
@@ -205,10 +182,12 @@ def _maybe_install_sealed_keys() -> str | None:
     if not boot_key:
         return None
     updates = _collect_sealed_secret_updates()
-    if not updates:
-        return None
     sealed_path = resolve_sealed_keys_path()
     existing = unseal_keys(boot_key) if sealed_path.exists() else {}
+    if "wdk_evm_wallet_password" not in existing and "wdk_evm_wallet_password" not in updates:
+        updates["wdk_evm_wallet_password"] = secrets.token_urlsafe(24)
+    if not updates:
+        return None
     return str(seal_keys(boot_key, {**existing, **updates}))
 
 
@@ -255,17 +234,14 @@ def main() -> None:
     allow = plugins.setdefault("allow", [])
     if args.plugin_id not in allow:
         allow.append(args.plugin_id)
-    if PAY_BRIDGE_PLUGIN_ID not in allow:
-        allow.append(PAY_BRIDGE_PLUGIN_ID)
+    allow[:] = [item for item in allow if item != "pay-bridge"]
 
     load = plugins.setdefault("load", {})
     paths = load.setdefault("paths", [])
     extension_path_text = str(Path(args.extension_path).expanduser().resolve())
     if extension_path_text not in paths:
         paths.append(extension_path_text)
-    pay_bridge_extension_path_text = str(Path(args.pay_bridge_extension_path).expanduser().resolve())
-    if pay_bridge_extension_path_text not in paths:
-        paths.append(pay_bridge_extension_path_text)
+    paths[:] = [item for item in paths if "extensions/pay-bridge" not in str(item)]
 
     entries = plugins.setdefault("entries", {})
     effective_network = _normalize_network(args.backend, args.network)
@@ -318,25 +294,19 @@ def main() -> None:
         "enabled": True,
         "config": plugin_config,
     }
-    existing_pay_entry = entries.get(PAY_BRIDGE_PLUGIN_ID) if isinstance(entries.get(PAY_BRIDGE_PLUGIN_ID), dict) else {}
-    existing_pay_config = (
-        dict(existing_pay_entry.get("config"))
-        if isinstance(existing_pay_entry.get("config"), dict)
-        else {}
-    )
-    pay_bridge_config = {
-        **existing_pay_config,
-        "payBinary": args.pay_binary.strip() or _default_pay_binary(),
-        "requireHttps": bool(existing_pay_config.get("requireHttps", True)),
-    }
-    entries[PAY_BRIDGE_PLUGIN_ID] = {
-        "enabled": True,
-        "config": pay_bridge_config,
-    }
+    entries.pop("pay-bridge", None)
 
     tools = data.setdefault("tools", {})
     also_allow = tools.setdefault("alsoAllow", [])
-    for tool_name in OPTIONAL_TOOLS + PAY_BRIDGE_TOOLS + X402_TOOLS:
+    removed_pay_tools = {
+        "pay_status",
+        "pay_wallet_info",
+        "pay_search_services",
+        "pay_get_service_endpoints",
+        "pay_api_request",
+    }
+    also_allow[:] = [tool_name for tool_name in also_allow if tool_name not in removed_pay_tools]
+    for tool_name in OPTIONAL_TOOLS + X402_TOOLS:
         if tool_name not in also_allow:
             also_allow.append(tool_name)
 
@@ -352,7 +322,6 @@ def main() -> None:
                 "config_path": str(config_path),
                 "backup_path": str(backup_path),
                 "extension_path": extension_path_text,
-                "pay_bridge_extension_path": pay_bridge_extension_path_text,
                 "python_bin": args.python_bin,
                 "package_root": plugin_config["packageRoot"],
                 "plugin_id": args.plugin_id,

package/agent-wallet/scripts/install_openclaw_sealed_keys.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import argparse
 import json
 import os
+import secrets as py_secrets
 import sys
 from pathlib import Path
 
@@ -49,12 +50,15 @@ def _collect_secret_updates() -> dict[str, str]:
     master_key = os.getenv("AGENT_WALLET_MASTER_KEY", "").strip()
     approval_secret = os.getenv("AGENT_WALLET_APPROVAL_SECRET", "").strip()
     private_key = os.getenv("SOLANA_AGENT_PRIVATE_KEY", "").strip()
+    evm_wallet_password = os.getenv("WDK_EVM_WALLET_PASSWORD", "").strip()
     if master_key:
         updates["master_key"] = master_key
     if approval_secret:
         updates["approval_secret"] = approval_secret
     if private_key:
         updates["private_key"] = private_key
+    if evm_wallet_password:
+        updates["wdk_evm_wallet_password"] = evm_wallet_password
     return updates
 
 
@@ -80,6 +84,10 @@ def main() -> None:
     sealed_path = resolve_sealed_keys_path()
     existing = unseal_keys(boot_key) if sealed_path.exists() and not args.replace else {}
     secrets = {**existing, **updates}
+    generated_keys: list[str] = []
+    if "wdk_evm_wallet_password" not in secrets:
+        secrets["wdk_evm_wallet_password"] = py_secrets.token_urlsafe(24)
+        generated_keys.append("wdk_evm_wallet_password")
     if not secrets:
         raise SystemExit(
             "No secrets provided. Set AGENT_WALLET_MASTER_KEY, AGENT_WALLET_APPROVAL_SECRET, "
@@ -93,7 +101,7 @@ def main() -> None:
                 "ok": True,
                 "path": str(path),
                 "stored_keys": sorted(secrets.keys()),
-                "updated_keys": sorted(updates.keys()),
+                "updated_keys": sorted(set(updates.keys()) | set(generated_keys)),
                 "replaced": bool(args.replace),
             },
             indent=2,