@agentlayer.tech/wallet 0.1.33 → 0.1.35

package/claude-code/plugins/agent-wallet/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-wallet",
   "displayName": "Agent Wallet",
-  "version": "0.1.0",
+  "version": "0.1.35",
   "description": "Claude Code bridge for the existing AgentLayer wallet runtime. Connects to Solana, Bitcoin, and EVM wallets without creating a new one.",
   "author": {
     "name": "AgentLayer"

package/claude-code/plugins/agent-wallet/scripts/run_mcp.sh

@@ -10,13 +10,13 @@ PACKAGE_ROOT=${AGENT_WALLET_PACKAGE_ROOT:-${OPENCLAW_AGENT_WALLET_PACKAGE_ROOT:-
 # relative sibling paths below no longer resolve, so fall back to the codex
 # plugin copy inside the installed runtime package, which is always present.
 LOCAL_SERVER="$PLUGIN_ROOT/server.py"
-CODEX_SERVER="$PLUGIN_ROOT/../../codex/plugins/agent-wallet/server.py"
+CODEX_SERVER="$PLUGIN_ROOT/../../../codex/plugins/agent-wallet/server.py"
 RUNTIME_CODEX_DIR="$OPENCLAW_HOME/agent-wallet-runtime/current/codex/plugins/agent-wallet"
 
 if [ -f "$LOCAL_SERVER" ]; then
   SERVER_PY="$LOCAL_SERVER"
 elif [ -f "$CODEX_SERVER" ]; then
-  SERVER_PY=$(CDPATH= cd -- "$PLUGIN_ROOT/../../codex/plugins/agent-wallet" && pwd)/server.py
+  SERVER_PY=$(CDPATH= cd -- "$PLUGIN_ROOT/../../../codex/plugins/agent-wallet" && pwd)/server.py
 elif [ -f "$RUNTIME_CODEX_DIR/server.py" ]; then
   SERVER_PY=$(CDPATH= cd -- "$RUNTIME_CODEX_DIR" && pwd)/server.py
 else
@@ -37,7 +37,9 @@ else
 fi
 
 # Fail loudly (not -32000) if the resolved server cannot even be parsed.
-if ! "$PYTHON_BIN" -m py_compile "$SERVER_PY" 2>/dev/null; then
+# Use ast.parse (no bytecode written) so a read-only install dir cannot trigger
+# a false "runtime broken" error from py_compile failing to write __pycache__.
+if ! "$PYTHON_BIN" -c 'import sys, ast; ast.parse(open(sys.argv[1], encoding="utf-8").read())' "$SERVER_PY" 2>/dev/null; then
   "$PYTHON_BIN" - "$SERVER_PY" >&2 <<'PY'
 import json, sys
 print(json.dumps({

package/codex/plugins/agent-wallet/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-wallet",
-  "version": "0.1.0",
+  "version": "0.1.35",
   "description": "Codex plugin bridge for the AgentLayer wallet runtime.",
   "author": {
     "name": "AgentLayer"

package/codex/plugins/agent-wallet/scripts/run_mcp.sh

@@ -24,7 +24,9 @@ if [ ! -f "$PLUGIN_ROOT/server.py" ]; then
 fi
 
 # Fail loudly (not -32000) if the resolved server cannot even be parsed.
-if ! "$PYTHON_BIN" -m py_compile "$PLUGIN_ROOT/server.py" 2>/dev/null; then
+# Use ast.parse (no bytecode written) so a read-only install dir cannot trigger
+# a false "runtime broken" error from py_compile failing to write __pycache__.
+if ! "$PYTHON_BIN" -c 'import sys, ast; ast.parse(open(sys.argv[1], encoding="utf-8").read())' "$PLUGIN_ROOT/server.py" 2>/dev/null; then
   "$PYTHON_BIN" - "$PLUGIN_ROOT/server.py" >&2 <<'PY'
 import json, sys
 print(json.dumps({

package/codex/plugins/agent-wallet/server.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import copy
 import base64
 import hashlib
@@ -9,6 +10,7 @@ import json
 import os
 import subprocess
 import sys
+import threading
 import time
 from functools import lru_cache
 from pathlib import Path
@@ -71,6 +73,9 @@ selected_solana_network: str | None = None
 selected_evm_network: str | None = None
 selected_btc_network: str | None = None
 approval_preview_cache: dict[str, dict[str, Any]] = {}
+# Guards approval_preview_cache against races once wallet calls run concurrently
+# via asyncio.to_thread. Reentrant so prune helpers can be nested under writers.
+_approval_cache_lock = threading.RLock()
 
 
 class WalletCliError(RuntimeError):
@@ -94,6 +99,8 @@ def _openclaw_home() -> Path:
 
 @lru_cache(maxsize=1)
 def _openclaw_plugin_config() -> dict[str, Any]:
+    # Cached for the process lifetime: openclaw.json is read once per MCP server
+    # start. Edits to plugin config require restarting the bridge to take effect.
     config_path = _openclaw_home() / "openclaw.json"
     try:
         payload = json.loads(config_path.read_text(encoding="utf-8"))
@@ -212,9 +219,10 @@ def _approval_preview_tool_name(tool_name: str) -> str:
 
 def _prune_approval_preview_cache() -> None:
     now = time.time()
-    for key in list(approval_preview_cache):
-        if float(approval_preview_cache[key].get("expires_at") or 0) <= now:
-            approval_preview_cache.pop(key, None)
+    with _approval_cache_lock:
+        for key in list(approval_preview_cache):
+            if float(approval_preview_cache[key].get("expires_at") or 0) <= now:
+                approval_preview_cache.pop(key, None)
 
 
 def _cache_preview_for_approval(user_id: str, tool_name: str, payload: dict[str, Any]) -> None:
@@ -231,18 +239,35 @@ def _cache_preview_for_approval(user_id: str, tool_name: str, payload: dict[str,
     summary = data.get("confirmation_summary")
     if not isinstance(summary, dict):
         return
-    _prune_approval_preview_cache()
-    approval_preview_cache[_approval_cache_key(user_id, cache_tool_name)] = {
-        "digest": _preview_digest(data),
-        "expires_at": time.time() + PREVIEW_CACHE_TTL_SECONDS,
-        "preview": data,
-        "summary": summary,
-    }
+    with _approval_cache_lock:
+        _prune_approval_preview_cache()
+        approval_preview_cache[_approval_cache_key(user_id, cache_tool_name)] = {
+            "digest": _preview_digest(data),
+            "expires_at": time.time() + PREVIEW_CACHE_TTL_SECONDS,
+            "preview": data,
+            "summary": summary,
+        }
 
 
 def _latest_cached_preview(user_id: str, tool_name: str) -> dict[str, Any] | None:
-    _prune_approval_preview_cache()
-    return approval_preview_cache.get(_approval_cache_key(user_id, _approval_preview_tool_name(tool_name)))
+    with _approval_cache_lock:
+        _prune_approval_preview_cache()
+        return approval_preview_cache.get(_approval_cache_key(user_id, _approval_preview_tool_name(tool_name)))
+
+
+def _consume_cached_preview(user_id: str, tool_name: str) -> None:
+    """Drop the cached preview once a successful execute has consumed it.
+
+    Without this, a preview lingers for the full TTL and a duplicate execute
+    call could re-run the operation from stale approval context — the runtime's
+    single-use nonce registry cannot stop it, because the bridge runs each
+    invoke in a fresh subprocess (empty registry) and mints a new token per
+    execute. Requiring a fresh preview before the next execute is the safe rule.
+    """
+    with _approval_cache_lock:
+        approval_preview_cache.pop(
+            _approval_cache_key(user_id, _approval_preview_tool_name(tool_name)), None
+        )
 
 
 def _approval_token_preview_digest(token: str) -> str:
@@ -509,28 +534,55 @@ def _parse_cli_error(text: str) -> WalletCliError:
     )
 
 
+def _cli_timeout_seconds() -> float:
+    """Parse the CLI timeout from env, falling back to 180s on bad values."""
+    raw = os.getenv("AGENT_WALLET_CODEX_TIMEOUT", "180")
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        return 180.0
+    return value if value > 0 else 180.0
+
+
 def _call_wallet_cli(command: str, extra_args: list[str]) -> dict[str, Any]:
     package_root = _resolve_package_root()
-    completed = subprocess.run(
-        [
-            _python_bin(package_root),
-            "-m",
-            "agent_wallet.openclaw_cli",
-            command,
-            *extra_args,
-        ],
-        cwd=str(package_root),
-        env=_cli_env(package_root),
-        text=True,
-        capture_output=True,
-        timeout=float(os.getenv("AGENT_WALLET_CODEX_TIMEOUT", "180")),
-        check=False,
-    )
+    timeout_seconds = _cli_timeout_seconds()
+    try:
+        completed = subprocess.run(
+            [
+                _python_bin(package_root),
+                "-m",
+                "agent_wallet.openclaw_cli",
+                command,
+                *extra_args,
+            ],
+            cwd=str(package_root),
+            env=_cli_env(package_root),
+            text=True,
+            capture_output=True,
+            timeout=timeout_seconds,
+            check=False,
+        )
+    except subprocess.TimeoutExpired as exc:
+        # Surface a clean, actionable message instead of the raw TimeoutExpired
+        # repr, which would echo the full argv (approval_token, config JSON).
+        raise WalletCliError(
+            f"agent-wallet CLI '{command}' timed out after {timeout_seconds:g}s. "
+            "Retry, or raise AGENT_WALLET_CODEX_TIMEOUT if the network is slow.",
+            code="timeout",
+        ) from exc
     if completed.returncode != 0:
         detail = completed.stderr.strip() or completed.stdout.strip()
         raise _parse_cli_error(detail)
+    # The CLI contract is a single JSON line on stdout. Parse the last non-empty
+    # line so a stray print/warning ahead of it from the runtime cannot break an
+    # otherwise-successful call.
+    stdout = completed.stdout.strip()
+    if not stdout:
+        return {}
+    last_line = stdout.splitlines()[-1].strip()
     try:
-        return json.loads(completed.stdout.strip() or "{}")
+        return json.loads(last_line)
     except json.JSONDecodeError as exc:
         raise WalletCliError(f"agent-wallet CLI returned invalid JSON: {exc}") from exc
 
@@ -824,26 +876,38 @@ async def _handle_set_wallet_backend(params: dict[str, Any]) -> dict[str, Any]:
 
     requested = params.get("backend", params.get("wallet"))
     backend = _normalize_wallet_backend(requested)
+    # Resolve the target network into a local first; only commit to the session
+    # globals after the validating wallet call succeeds, so a failed switch never
+    # leaves a stale backend paired with a freshly mutated network selection.
     if backend == "wdk_evm_local":
         implied = params.get("network") or selected_evm_network or _default_evm_network() or "ethereum"
-        selected_evm_network = _normalize_selectable_evm_network(implied)
+        resolved_network = _normalize_selectable_evm_network(implied)
     elif backend == "wdk_btc_local":
-        selected_btc_network = _normalize_btc_network(
+        resolved_network = _normalize_btc_network(
             params.get("network") or selected_btc_network or _default_btc_network()
         )
     else:
-        selected_solana_network = _normalize_solana_network(
+        resolved_network = _normalize_solana_network(
             params.get("network") or selected_solana_network or _default_solana_network()
         )
 
-    config = _effective_config_for_backend(backend)
-    payload = _invoke_tool(
+    config = _host_default_config()
+    config["backend"] = backend
+    config["network"] = resolved_network
+    payload = await asyncio.to_thread(
+        _invoke_tool,
         "get_evm_network" if backend == "wdk_evm_local" else "get_wallet_capabilities",
         {} if backend != "wdk_evm_local" else {"network": config["network"]},
         config,
     )
     if payload.get("ok") is False:
         raise RuntimeError(str(payload.get("error") or "set_wallet_backend failed"))
+    if backend == "wdk_evm_local":
+        selected_evm_network = resolved_network
+    elif backend == "wdk_btc_local":
+        selected_btc_network = resolved_network
+    else:
+        selected_solana_network = resolved_network
     selected_wallet_backend = backend
     return {
         "selected_backend": backend,
@@ -866,7 +930,7 @@ async def _handle_set_evm_network(params: dict[str, Any]) -> dict[str, Any]:
     network = _normalize_selectable_evm_network(params.get("network"))
     config = _effective_config_for_backend("wdk_evm_local")
     config["network"] = network
-    payload = _invoke_tool("get_evm_network", {"network": network}, config)
+    payload = await asyncio.to_thread(_invoke_tool, "get_evm_network", {"network": network}, config)
     if payload.get("ok") is False:
         raise RuntimeError(str(payload.get("error") or "set_evm_network failed"))
     selected_wallet_backend = "wdk_evm_local"
@@ -885,6 +949,30 @@ async def _handle_set_evm_network(params: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+def _invoke_wallet_tool_blocking(
+    tool_name: str,
+    config: dict[str, Any],
+    effective_params: dict[str, Any],
+) -> dict[str, Any]:
+    """Synchronous wallet invocation: approval attach + CLI subprocess + cache.
+
+    Runs off the event loop via ``asyncio.to_thread`` so a slow or hung wallet
+    call never freezes the MCP server (tools/list, read-only calls, and
+    cancellation stay responsive).
+    """
+    used_cache = _attach_approval_for_execute(tool_name, config, effective_params)
+    try:
+        payload = _invoke_tool(tool_name, effective_params, config)
+    except Exception as exc:
+        raise _normalize_approval_context_error(exc) from exc
+    _cache_preview_for_approval(_user_id(), tool_name, payload)
+    # A bridge-managed preview that was just executed successfully is single-use:
+    # drop it so a duplicate execute cannot silently re-run the operation.
+    if used_cache is not None and payload.get("ok") is not False:
+        _consume_cached_preview(_user_id(), tool_name)
+    return payload
+
+
 async def _handle_wallet_tool(tool_name: str, params: dict[str, Any]) -> dict[str, Any]:
     config = _base_config(params, tool_name=tool_name)
     backend = _normalize_wallet_backend(config.get("backend"))
@@ -893,30 +981,60 @@ async def _handle_wallet_tool(tool_name: str, params: dict[str, Any]) -> dict[st
         config["network"] = selected_evm_network
 
     effective_params = dict(params)
-    _attach_approval_for_execute(tool_name, config, effective_params)
-
-    try:
-        payload = _invoke_tool(tool_name, effective_params, config)
-    except Exception as exc:
-        raise _normalize_approval_context_error(exc) from exc
+    payload = await asyncio.to_thread(
+        _invoke_wallet_tool_blocking, tool_name, config, effective_params
+    )
 
-    _cache_preview_for_approval(_user_id(), tool_name, payload)
     if payload.get("ok") is False:
         raise RuntimeError(str(payload.get("error") or f"{tool_name} failed"))
     return payload.get("data", {})
 
 
+BASE_INSTRUCTIONS = (
+    "Use the local AgentLayer wallet runtime through explicit wallet tools. Keep wallet "
+    "secrets local. Preview writes first when supported, and execute only after explicit "
+    "user confirmation."
+)
+
+
+def _update_notice_instructions(base: str) -> str:
+    """Append a one-time update notice to ``base`` when a newer version exists.
+
+    Fully fail-open: any error (package not importable, malformed cache, etc.)
+    returns ``base`` unchanged so the server always starts. The network refresh
+    runs in a background daemon thread and only affects the *next* start; the
+    notice itself is decided synchronously from the cache.
+    """
+    try:
+        package_root_text = str(_resolve_package_root())
+        inserted = package_root_text not in sys.path
+        if inserted:
+            sys.path.insert(0, package_root_text)
+        try:
+            from agent_wallet import update_check
+
+            update_check.maybe_refresh_in_background()
+            notice = update_check.pending_notice(mark_shown=True)
+        finally:
+            if inserted:
+                try:
+                    sys.path.remove(package_root_text)
+                except ValueError:
+                    pass
+        if notice:
+            return f"{base}\n\n⚠️ UPDATE AVAILABLE: {notice}"
+    except Exception:
+        pass
+    return base
+
+
 def build_server():
     from fastmcp import FastMCP
     from fastmcp.tools import FunctionTool
 
     mcp = FastMCP(
         "Agent Wallet",
-        instructions=(
-            "Use the local AgentLayer wallet runtime through explicit wallet tools. Keep wallet "
-            "secrets local. Preview writes first when supported, and execute only after explicit "
-            "user confirmation."
-        ),
+        instructions=_update_notice_instructions(BASE_INSTRUCTIONS),
     )
 
     async def _dispatch(tool_name: str, params: dict[str, Any] | None = None) -> dict[str, Any]:

package/codex/plugins/agent-wallet/skills/wallet-operator/SKILL.md

@@ -16,3 +16,4 @@ Rules:
 - On mainnet, restate the network, asset, amount, and destination before execute.
 - Do not ask the user for `approval_token`. The bridge manages approval binding internally.
 - If approval context is missing or stale, repeat preview instead of improvising.
+- Use `set_wallet_backend` to switch between Solana, EVM, and Bitcoin wallets within a session, and `set_evm_network` to pick ethereum or base.

package/hermes/plugins/agent_wallet/plugin.yaml

@@ -1,5 +1,5 @@
 name: agent-wallet
-version: 0.1.0
+version: 0.1.35
 description: Thin Hermes Agent bridge to the existing AgentLayer/OpenClaw wallet backend
 provides_tools:
   - agent_wallet_tools

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentlayer.tech/wallet",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "NPM installer for the OpenClaw Agent Wallet local runtime.",
   "type": "module",
   "repository": {
@@ -19,12 +19,16 @@
     "build:openclaw-plugins": "node scripts/manage_openclaw_plugin_packages.mjs build",
     "check:openclaw-plugins": "node scripts/manage_openclaw_plugin_packages.mjs check",
     "check:release-version": "node scripts/check_release_version.mjs",
+    "version:sync": "node scripts/sync_version.mjs",
+    "release:local": "node scripts/release_local.mjs",
     "test:npm-installer": "python3 agent-wallet/tests/smoke_npm_installer.py",
     "pack:dry-run": "npm pack --dry-run"
   },
   "files": [
     "bin/",
+    "VERSION",
     "scripts/check_release_version.mjs",
+    "scripts/version_targets.mjs",
     "setup.sh",
     "install-from-github.sh",
     "README.md",

package/scripts/check_release_version.mjs

@@ -1,26 +1,59 @@
 #!/usr/bin/env node
+// Verify the project version is consistent across every framework manifest and,
+// when run on a release tag, that the tag matches the canonical VERSION.
+//
+// Canonical source: the root VERSION file. All derived manifests (see
+// scripts/version_targets.mjs) must equal it — stamp them with
+// scripts/sync_version.mjs if this fails. Emits the resolved version and npm
+// dist-tag for the publish workflow.
 
 import fs from "node:fs";
 
-const packageJson = JSON.parse(fs.readFileSync("package.json", "utf8"));
-const pyproject = fs.readFileSync("agent-wallet/pyproject.toml", "utf8");
-const pyVersion = pyproject.match(/^version\s*=\s*"([^"]+)"/m)?.[1] || "";
-const packageVersion = packageJson.version;
-const refName = process.env.GITHUB_REF_NAME || process.argv[2] || "";
-const expectedFromTag = refName.startsWith("v") ? refName.slice(1) : "";
+import {
+  TARGETS,
+  VERSION_FILE,
+  npmTagFor,
+  readCanonicalVersion,
+  readTargetVersion,
+} from "./version_targets.mjs";
+
+const root = process.cwd();
 const errors = [];
 
-if (!packageVersion) {
-  errors.push("package.json version is missing");
+let canonical = "";
+try {
+  canonical = readCanonicalVersion(root);
+} catch {
+  errors.push(`${VERSION_FILE} is missing`);
 }
-if (!pyVersion) {
-  errors.push("agent-wallet/pyproject.toml version is missing");
+if (canonical === "") {
+  errors.push(`${VERSION_FILE} is empty`);
 }
-if (packageVersion && pyVersion && packageVersion !== pyVersion) {
-  errors.push(`version mismatch: package.json=${packageVersion}, pyproject=${pyVersion}`);
+
+if (canonical) {
+  for (const target of TARGETS) {
+    let actual = null;
+    try {
+      actual = readTargetVersion(root, target);
+    } catch {
+      errors.push(`${target.file} is missing`);
+      continue;
+    }
+    if (!actual) {
+      errors.push(`${target.file}: version field not found`);
+    } else if (actual !== canonical) {
+      errors.push(
+        `version mismatch: ${target.file}=${actual}, ${VERSION_FILE}=${canonical} ` +
+          `(run: npm run version:sync)`,
+      );
+    }
+  }
 }
-if (expectedFromTag && packageVersion !== expectedFromTag) {
-  errors.push(`tag/version mismatch: tag=${refName}, package.json=${packageVersion}`);
+
+const refName = process.env.GITHUB_REF_NAME || process.argv[2] || "";
+const expectedFromTag = refName.startsWith("v") ? refName.slice(1) : "";
+if (expectedFromTag && canonical && canonical !== expectedFromTag) {
+  errors.push(`tag/version mismatch: tag=${refName}, ${VERSION_FILE}=${canonical}`);
 }
 
 if (errors.length > 0) {
@@ -30,13 +63,10 @@ if (errors.length > 0) {
   process.exit(1);
 }
 
-const npmTag = packageVersion.includes("-") ? "beta" : "latest";
-console.log(`release_version=${packageVersion}`);
+const npmTag = npmTagFor(canonical);
+console.log(`release_version=${canonical}`);
 console.log(`npm_tag=${npmTag}`);
 
 if (process.env.GITHUB_OUTPUT) {
-  fs.appendFileSync(
-    process.env.GITHUB_OUTPUT,
-    `release_version=${packageVersion}\nnpm_tag=${npmTag}\n`,
-  );
+  fs.appendFileSync(process.env.GITHUB_OUTPUT, `release_version=${canonical}\nnpm_tag=${npmTag}\n`);
 }

package/scripts/version_targets.mjs

@@ -0,0 +1,60 @@
+// Single source of truth for the project version.
+//
+// The root VERSION file is canonical. Every other manifest below is a *derived*
+// target that must carry the exact same version. These targets are stamped by
+// scripts/sync_version.mjs and verified by scripts/check_release_version.mjs, so
+// they should never be edited by hand.
+
+import fs from "node:fs";
+import path from "node:path";
+
+export const VERSION_FILE = "VERSION";
+
+// kind -> regex capturing (prefix)(version)(suffix). Non-global on purpose: we
+// only ever replace the first (top-level) occurrence in each file.
+const PATTERNS = {
+  json: /("version"\s*:\s*")([^"]*)(")/,
+  toml: /^(version\s*=\s*")([^"]*)(")/m,
+  pyinit: /^(__version__\s*=\s*")([^"]*)(")/m,
+  yaml: /^(version:\s*)(\S+)(.*)$/m,
+};
+
+// Every place the version lives, across all agent frameworks and packages.
+export const TARGETS = [
+  { file: "package.json", kind: "json" },
+  { file: "agent-wallet/pyproject.toml", kind: "toml" },
+  { file: "agent-wallet/agent_wallet/__init__.py", kind: "pyinit" },
+  { file: ".openclaw/extensions/agent-wallet/package.json", kind: "json" },
+  { file: "agent-wallet/openclaw.plugin.json", kind: "json" },
+  { file: ".openclaw/extensions/agent-wallet/openclaw.plugin.json", kind: "json" },
+  { file: "codex/plugins/agent-wallet/.codex-plugin/plugin.json", kind: "json" },
+  { file: "claude-code/plugins/agent-wallet/.claude-plugin/plugin.json", kind: "json" },
+  { file: "hermes/plugins/agent_wallet/plugin.yaml", kind: "yaml" },
+  { file: "wdk-btc-wallet/package.json", kind: "json" },
+  { file: "wdk-evm-wallet/package.json", kind: "json" },
+];
+
+export function readCanonicalVersion(root) {
+  return fs.readFileSync(path.join(root, VERSION_FILE), "utf8").trim();
+}
+
+export function readTargetVersion(root, target) {
+  const content = fs.readFileSync(path.join(root, target.file), "utf8");
+  const match = content.match(PATTERNS[target.kind]);
+  return match ? match[2] : null;
+}
+
+export function stampTarget(root, target, version) {
+  const filePath = path.join(root, target.file);
+  const content = fs.readFileSync(filePath, "utf8");
+  const pattern = PATTERNS[target.kind];
+  if (!pattern.test(content)) {
+    throw new Error(`No version field found in ${target.file}`);
+  }
+  const updated = content.replace(pattern, (_m, prefix, _old, suffix) => `${prefix}${version}${suffix}`);
+  fs.writeFileSync(filePath, updated);
+}
+
+export function npmTagFor(version) {
+  return version.includes("-") ? "beta" : "latest";
+}

package/wdk-btc-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wdk-btc-wallet",
-  "version": "0.1.0",
+  "version": "0.1.35",
   "private": true,
   "type": "module",
   "description": "Separate BTC-only wallet service built on Tether WDK.",

package/wdk-evm-wallet/README.md

@@ -18,8 +18,8 @@ Current scope:
 - fetch ERC-20 balances
 - fetch ERC-20 token metadata (`name`, `symbol`, `decimals`)
 - fetch fee-rate suggestions
-- fetch read-only Velora swap quotes for supported mainnet ERC-20 pairs
-- execute Velora ERC-20 swaps on supported mainnet networks through the local wallet account
+- fetch read-only Velora swap quotes for supported mainnet ERC-20 and native ETH pairs
+- execute Velora ERC-20 and native ETH swaps on supported mainnet networks through the local wallet account
 - fetch Aave V3 account data on supported mainnet networks
 - fetch Aave V3 reserve catalog on supported mainnet networks
 - fetch Aave V3 per-reserve user positions on supported mainnet networks
@@ -177,7 +177,7 @@ Local security note:
 - unlocked seed phrases live only in memory
 - explicit `lock` or process restart clears the in-memory unlocked state
 - seed reveal is password-gated and separate from normal agent operations
-- Velora swap support is currently limited to `ethereum` and `base` ERC-20 pairs
+- Velora swap support is currently limited to `ethereum` and `base` ERC-20 and native ETH pairs
 - the underlying WDK Velora package is still beta; test swap execution carefully before relying on it
 - Aave V3 support is currently limited to `ethereum` and `base`
 - Aave `supply` and `repay` may perform pool-scoped ERC-20 approvals; if a send fails after approval, the service attempts to restore the original allowance

package/wdk-evm-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wdk-evm-wallet",
-  "version": "0.1.0",
+  "version": "0.1.35",
   "private": true,
   "type": "module",
   "description": "Separate EVM wallet service built on Tether WDK.",

package/wdk-evm-wallet/src/wdk_evm_wallet.js

@@ -246,6 +246,21 @@ function normalizeEvmTokenAddressAllowingNative(value, fieldName) {
   return normalizeAddress(address, fieldName).toLowerCase();
 }
 
+function normalizeVeloraTokenAddress(value, fieldName) {
+  const raw = assertNonEmptyString(value, fieldName);
+  const alias = raw.toLowerCase();
+  if (
+    alias === "native" ||
+    alias === "eth" ||
+    alias === "ethereum" ||
+    isZeroAddress(raw) ||
+    isVeloraNativeTokenAddress(raw)
+  ) {
+    return VELORA_NATIVE_TOKEN_ADDRESS;
+  }
+  return normalizeAddress(raw, fieldName);
+}
+
 function normalizeLifiOutputTokenAddress(value, destinationChainId, fieldName) {
   const raw = assertNonEmptyString(value, fieldName);
   const alias = raw.toLowerCase();
@@ -380,8 +395,8 @@ function normalizeX402ExactTypedData({ domain, types, primaryType, message }, ru
 
 function buildSwapRequest({ tokenIn, tokenOut, tokenInAmount }) {
   const swapRequest = {
-    tokenIn: normalizeAddress(tokenIn, "tokenIn"),
-    tokenOut: normalizeAddress(tokenOut, "tokenOut"),
+    tokenIn: normalizeVeloraTokenAddress(tokenIn, "tokenIn"),
+    tokenOut: normalizeVeloraTokenAddress(tokenOut, "tokenOut"),
     tokenInAmount: assertPositiveBigIntString(tokenInAmount, "tokenInAmount"),
   };
   assertDistinctAddresses(swapRequest.tokenIn, "tokenIn", swapRequest.tokenOut, "tokenOut");