@agentlayer.tech/wallet 0.1.37 → 0.1.44

package/agent-wallet/agent_wallet/providers/wdk_evm_local.py

@@ -26,6 +26,8 @@ LONG_RUNNING_POST_PATHS = {
     "/v1/evm/lido/claim_withdrawal/send",
     "/v1/evm/swap/quote",
     "/v1/evm/swap/send",
+    "/v1/evm/uniswap/swap/quote",
+    "/v1/evm/uniswap/swap/send",
     "/v1/evm/lifi/quote",
     "/v1/evm/lifi/send",
     "/v1/evm/transfer/send",

package/agent-wallet/agent_wallet/telemetry.py

@@ -0,0 +1,306 @@
+"""Anonymous, privacy-first adoption telemetry for the AgentLayer wallet.
+
+Why this exists: we want to know how many people use the wallet and through which
+host (Claude Code / Codex / Hermes / OpenClaw) — nothing more. It deliberately
+records NO PII: no wallet addresses, balances, amounts, tx hashes, tool
+arguments, or secrets. Only a random local install id, the host name, the
+invoked tool's registered name, the backend family, the plugin version, and a
+success flag.
+
+Design for a short-lived CLI subprocess:
+  - `record()` appends one JSON line to a local spool file. This is instant and
+    durable: a single small append is atomic on POSIX, and the event survives
+    even if this process exits before any network call completes.
+  - A throttled, best-effort flush claims the spool (atomic rename), POSTs each
+    event to the provider-gateway, and re-spools anything that failed. Because
+    durability lives in the spool, a killed flush never loses data — the next
+    invocation (or a longer-lived process) ships it.
+
+Everything here swallows its own errors. Telemetry must never slow down or break
+a wallet operation. Users opt out with AGENT_WALLET_NO_TELEMETRY=1.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import time
+import urllib.request
+import uuid
+from pathlib import Path
+from typing import Any
+
+from . import __version__
+from .config import DEFAULT_PROVIDER_GATEWAY_URL, resolve_openclaw_home
+
+ALLOWED_HOSTS = {"claude-code", "codex", "hermes", "openclaw"}
+
+SPOOL_NAME = "telemetry_spool.jsonl"
+ID_NAME = "telemetry_id"
+LAST_FLUSH_NAME = "telemetry_last_flush"
+
+# Keep the spool bounded if the gateway is unreachable for a long time.
+MAX_SPOOL_LINES = 500
+# Don't attempt a network flush more than this often (seconds), unless the spool
+# has grown past the soft cap below.
+FLUSH_THROTTLE_SECONDS = 20
+FLUSH_FORCE_LINES = 50
+# Tight network bounds: telemetry never blocks meaningfully.
+HTTP_TIMEOUT_SECONDS = 1.5
+MAX_EVENTS_PER_FLUSH = 100
+
+
+def _enabled() -> bool:
+    raw = os.getenv("AGENT_WALLET_NO_TELEMETRY", "").strip().lower()
+    return raw not in ("1", "true", "yes", "on")
+
+
+def _home() -> Path:
+    return resolve_openclaw_home()
+
+
+def _gateway_url() -> str:
+    url = os.getenv("PROVIDER_GATEWAY_URL", "").strip() or DEFAULT_PROVIDER_GATEWAY_URL
+    return url.rstrip("/")
+
+
+def _host() -> str:
+    host = os.getenv("AGENT_WALLET_HOST", "").strip().lower()
+    return host if host in ALLOWED_HOSTS else "unknown"
+
+
+def _install_id() -> str:
+    """Stable, random, non-identifying id for this install. Created once."""
+    path = _home() / ID_NAME
+    try:
+        existing = path.read_text(encoding="utf-8").strip()
+        if existing:
+            return existing
+    except OSError:
+        pass
+    new_id = uuid.uuid4().hex
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(new_id, encoding="utf-8")
+    except OSError:
+        pass
+    return new_id
+
+
+def record(
+    tool: str,
+    *,
+    backend: str = "",
+    ok: bool = True,
+    event: str = "tool_invoke",
+) -> None:
+    """Append an anonymous event to the spool and best-effort flush. Never raises."""
+    try:
+        if not _enabled():
+            return
+        payload = {
+            "event": event,
+            "install_id": _install_id(),
+            "host": _host(),
+            "tool": tool or "",
+            "backend": backend or "",
+            "plugin_version": __version__,
+            "ok": bool(ok),
+            "ts": int(time.time()),
+        }
+        _append_spool(payload)
+        _maybe_spawn_flush()
+    except Exception:
+        # Telemetry is never allowed to affect the wallet call.
+        pass
+
+
+# --- spool I/O --------------------------------------------------------------
+
+
+def _spool_path() -> Path:
+    return _home() / SPOOL_NAME
+
+
+def _append_spool(payload: dict[str, Any]) -> None:
+    path = _spool_path()
+    line = json.dumps(payload, separators=(",", ":")) + "\n"
+    path.parent.mkdir(parents=True, exist_ok=True)
+    # A single write of a short line is atomic across processes on POSIX.
+    with open(path, "a", encoding="utf-8") as fh:
+        fh.write(line)
+
+
+def _spool_line_count() -> int:
+    try:
+        with open(_spool_path(), "r", encoding="utf-8") as fh:
+            return sum(1 for _ in fh)
+    except OSError:
+        return 0
+
+
+def _should_flush_now() -> bool:
+    count = _spool_line_count()
+    if count == 0:
+        return False
+    if count >= FLUSH_FORCE_LINES:
+        return True
+    last_path = _home() / LAST_FLUSH_NAME
+    try:
+        last = float(last_path.read_text(encoding="utf-8").strip() or "0")
+    except (OSError, ValueError):
+        last = 0.0
+    return (time.time() - last) >= FLUSH_THROTTLE_SECONDS
+
+
+def _mark_flush_attempt() -> None:
+    try:
+        (_home() / LAST_FLUSH_NAME).write_text(str(time.time()), encoding="utf-8")
+    except OSError:
+        pass
+
+
+def _maybe_spawn_flush() -> None:
+    """Trigger a flush in a DETACHED subprocess that outlives this process.
+
+    A per-tool CLI invocation exits microseconds after recording, so a thread
+    would be killed mid-flush. A detached child (its own session, no wait) runs
+    the network call on its own time and re-spools failures reliably. Throttling
+    keeps this to roughly one spawn per FLUSH_THROTTLE_SECONDS, so most calls
+    just append to the spool and return.
+    """
+    if not _should_flush_now():
+        return
+    _mark_flush_attempt()
+    try:
+        subprocess.Popen(
+            [sys.executable, "-m", "agent_wallet.telemetry", "--flush"],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            stdin=subprocess.DEVNULL,
+            start_new_session=True,  # detach so parent exit doesn't kill it
+        )
+    except Exception:
+        pass
+
+
+def _pid_alive(pid: int) -> bool:
+    try:
+        os.kill(pid, 0)
+    except ProcessLookupError:
+        return False
+    except PermissionError:
+        return True  # exists but owned by another user
+    except OSError:
+        return True
+    return True
+
+
+def _claim_suffix_pid(path: Path) -> int | None:
+    # ...telemetry_spool.jsonl.flushing.<pid>
+    try:
+        return int(path.name.rsplit(".flushing.", 1)[1])
+    except (IndexError, ValueError):
+        return None
+
+
+def _flush() -> None:
+    """Claim the spool atomically, adopt dead-PID orphans, POST, re-spool failures."""
+    spool = _spool_path()
+    home = _home()
+    claim = spool.with_suffix(spool.suffix + f".flushing.{os.getpid()}")
+
+    claims: list[Path] = []
+    try:
+        os.rename(spool, claim)  # atomic; only one process wins the live spool
+        claims.append(claim)
+    except OSError:
+        pass  # nothing to flush, or another process claimed it
+
+    # Recover orphans left by a flush that died mid-run (crash/exit after the
+    # rename but before re-spooling). Only adopt claims whose PID is gone so we
+    # never steal a batch a live sibling is still working.
+    try:
+        for orphan in home.glob(SPOOL_NAME + ".flushing.*"):
+            if orphan == claim:
+                continue
+            pid = _claim_suffix_pid(orphan)
+            if pid is None or not _pid_alive(pid):
+                claims.append(orphan)
+    except OSError:
+        pass
+
+    if not claims:
+        return
+
+    lines: list[str] = []
+    for c in claims:
+        try:
+            lines.extend(c.read_text(encoding="utf-8").splitlines())
+        except OSError:
+            pass
+
+    # Bound a long backlog (gateway down for a while): keep the most recent.
+    if len(lines) > MAX_SPOOL_LINES:
+        lines = lines[-MAX_SPOOL_LINES:]
+
+    url = _gateway_url() + "/v1/telemetry"
+    failed: list[str] = []
+    sent = 0
+    for line in lines:
+        line = line.strip()
+        if not line:
+            continue
+        if sent >= MAX_EVENTS_PER_FLUSH:
+            failed.append(line)  # defer the rest to the next flush
+            continue
+        if _post(url, line):
+            sent += 1
+        else:
+            failed.append(line)
+
+    # Re-spool failures BEFORE removing claims: favors at-least-once delivery
+    # (a crash here re-sends, never drops). Successes are gone from the claims.
+    if failed:
+        try:
+            with open(spool, "a", encoding="utf-8") as fh:
+                fh.write("\n".join(failed) + "\n")
+        except OSError:
+            pass
+
+    for c in claims:
+        try:
+            c.unlink()
+        except OSError:
+            pass
+
+
+def _post(url: str, body: str) -> bool:
+    try:
+        req = urllib.request.Request(
+            url,
+            data=body.encode("utf-8"),
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        with urllib.request.urlopen(req, timeout=HTTP_TIMEOUT_SECONDS) as resp:
+            return 200 <= resp.status < 300
+    except Exception:
+        return False
+
+
+def _flush_main() -> int:
+    """Entry point for the detached flush subprocess (`-m agent_wallet.telemetry --flush`)."""
+    try:
+        _flush()
+    except Exception:
+        pass
+    return 0
+
+
+if __name__ == "__main__":
+    if "--flush" in sys.argv[1:]:
+        raise SystemExit(_flush_main())
+    raise SystemExit(0)

package/agent-wallet/agent_wallet/wallet_layer/base.py

@@ -226,6 +226,38 @@ class AgentWalletBackend(ABC):
     ) -> dict[str, Any]:
         raise WalletBackendError(f"{self.name} does not support EVM LI.FI cross-chain swaps.")
 
+    async def get_uniswap_swap_quote(
+        self,
+        *,
+        token_in: str,
+        token_out: str,
+        amount_in_raw: str,
+        slippage_bps: int | None = None,
+    ) -> dict[str, Any]:
+        raise WalletBackendError(f"{self.name} does not support Uniswap swap quotes.")
+
+    async def preview_uniswap_swap(
+        self,
+        *,
+        token_in: str,
+        token_out: str,
+        amount_in_raw: str,
+        slippage_bps: int | None = None,
+    ) -> dict[str, Any]:
+        raise WalletBackendError(f"{self.name} does not support Uniswap swap previews.")
+
+    async def send_uniswap_swap(
+        self,
+        *,
+        token_in: str,
+        token_out: str,
+        amount_in_raw: str,
+        slippage_bps: int | None = None,
+        expected_quote_fingerprint: str | None = None,
+        minimum_output_amount_raw: str | None = None,
+    ) -> dict[str, Any]:
+        raise WalletBackendError(f"{self.name} does not support Uniswap swaps.")
+
     async def preview_evm_native_transfer(
         self,
         *,

package/agent-wallet/agent_wallet/wallet_layer/wdk_evm.py

@@ -1382,6 +1382,162 @@ class WdkEvmLocalWalletBackend(AgentWalletBackend):
             "source": "wdk-evm-wallet",
         }
 
+    def _normalize_uniswap_quote_payload(self, data: dict[str, Any], token_in: str, token_out: str, amount_in_raw: str) -> dict[str, Any]:
+        return {
+            "chain": self.chain,
+            "network": self.network,
+            "address": str(data.get("address") or ""),
+            "token_in": str(data.get("tokenIn") or token_in),
+            "token_out": str(data.get("tokenOut") or token_out),
+            "amount_in_raw": str(data.get("tokenInAmount") or amount_in_raw),
+            "amount_in_ui": str(data.get("inputAmountFormatted")) if data.get("inputAmountFormatted") is not None else None,
+            "estimated_output_amount_raw": str(data.get("outputAmount") or "0"),
+            "estimated_output_amount_ui": str(data.get("outputAmountFormatted")) if data.get("outputAmountFormatted") is not None else None,
+            "minimum_output_amount_raw": str(data.get("minimumOutputAmountRaw")) if data.get("minimumOutputAmountRaw") is not None else None,
+            "slippage_bps": int(data.get("slippageBps")) if data.get("slippageBps") is not None else None,
+            "protocol": str(data.get("protocol") or "uniswap"),
+            "routing": str(data.get("routing") or "CLASSIC"),
+            "permit_required": bool(data.get("permitRequired")),
+            "allowance": _normalize_swap_allowance(data.get("allowance")),
+            "router": str(data.get("router") or "").strip() or None,
+            "quote_fingerprint": str(data.get("quoteFingerprint") or "").strip() or None,
+            "gas_fee_usd": str(data.get("gasFeeUSD")) if data.get("gasFeeUSD") is not None else None,
+            "estimated_fee_wei": str(data.get("estimatedFeeWei")) if data.get("estimatedFeeWei") is not None else None,
+            "execution_supported": bool(data.get("executionSupported")) and not self.sign_only,
+            "token_in_metadata": _normalize_token_metadata(data.get("tokenInMetadata"), token_in),
+            "token_out_metadata": _normalize_token_metadata(data.get("tokenOutMetadata"), token_out),
+            "chain_id": int(data.get("chainId") or 0),
+            "source": "wdk-evm-wallet",
+        }
+
+    async def get_uniswap_swap_quote(
+        self,
+        *,
+        token_in: str,
+        token_out: str,
+        amount_in_raw: str,
+        slippage_bps: int | None = None,
+    ) -> dict[str, Any]:
+        resolved_address = await self.get_address()
+        body: dict[str, Any] = {
+            "walletId": self.wallet_id,
+            "address": resolved_address,
+            "accountIndex": self.account_index,
+            "network": self.network,
+            "tokenIn": token_in,
+            "tokenOut": token_out,
+            "tokenInAmount": amount_in_raw,
+        }
+        if slippage_bps is not None:
+            body["slippageBps"] = slippage_bps
+        data = await self.client.post("/v1/evm/uniswap/swap/quote", body)
+        return self._normalize_uniswap_quote_payload(data, token_in, token_out, amount_in_raw)
+
+    async def preview_uniswap_swap(
+        self,
+        *,
+        token_in: str,
+        token_out: str,
+        amount_in_raw: str,
+        slippage_bps: int | None = None,
+    ) -> dict[str, Any]:
+        resolved_address = await self.get_address()
+        body: dict[str, Any] = {
+            "walletId": self.wallet_id,
+            "address": resolved_address,
+            "accountIndex": self.account_index,
+            "network": self.network,
+            "tokenIn": token_in,
+            "tokenOut": token_out,
+            "tokenInAmount": amount_in_raw,
+        }
+        if slippage_bps is not None:
+            body["slippageBps"] = slippage_bps
+        data = await self.client.post("/v1/evm/uniswap/swap/quote", body)
+        payload = self._normalize_uniswap_quote_payload(data, token_in, token_out, amount_in_raw)
+        return {
+            **payload,
+            "asset_type": "evm-uniswap-swap",
+            "asset": "ERC20",
+            "wallet": self.wallet_id,
+            "from_address": resolved_address,
+            "input_amount_raw": payload["amount_in_raw"],
+            "input_amount_ui": payload["amount_in_ui"],
+            "swap_provider": payload["protocol"],
+            "route_plan": None,
+            "swap_transaction": {
+                "to": payload["router"],
+                "value": "0",
+                "data_hash": None,
+            },
+        }
+
+    async def send_uniswap_swap(
+        self,
+        *,
+        token_in: str,
+        token_out: str,
+        amount_in_raw: str,
+        slippage_bps: int | None = None,
+        expected_quote_fingerprint: str | None = None,
+        minimum_output_amount_raw: str | None = None,
+    ) -> dict[str, Any]:
+        if self.sign_only:
+            raise WalletBackendError("wdk_evm_local is configured as sign_only.")
+        body: dict[str, Any] = {
+            "walletId": self.wallet_id,
+            "accountIndex": self.account_index,
+            "network": self.network,
+            "tokenIn": token_in,
+            "tokenOut": token_out,
+            "tokenInAmount": amount_in_raw,
+        }
+        if slippage_bps is not None:
+            body["slippageBps"] = slippage_bps
+        if isinstance(expected_quote_fingerprint, str) and expected_quote_fingerprint.strip():
+            body["expectedQuoteFingerprint"] = expected_quote_fingerprint.strip()
+        if isinstance(minimum_output_amount_raw, str) and minimum_output_amount_raw.strip():
+            body["minimumTokenOutAmount"] = minimum_output_amount_raw.strip()
+        data = await self.client.post("/v1/evm/uniswap/swap/send", body)
+        result = dict(data.get("result") or {})
+        return {
+            "chain": self.chain,
+            "network": self.network,
+            "asset_type": "evm-uniswap-swap",
+            "asset": "ERC20",
+            "wallet": self.wallet_id,
+            "from_address": await self.get_address(),
+            "token_in": str(data.get("tokenIn") or token_in),
+            "token_out": str(data.get("tokenOut") or token_out),
+            "input_amount_raw": str(data.get("tokenInAmount") or amount_in_raw),
+            "input_amount_ui": str(data.get("inputAmountFormatted")) if data.get("inputAmountFormatted") is not None else None,
+            "estimated_output_amount_raw": str(data.get("outputAmount") or "0"),
+            "estimated_output_amount_ui": str(data.get("outputAmountFormatted")) if data.get("outputAmountFormatted") is not None else None,
+            "slippage_bps": int(data.get("slippageBps")) if data.get("slippageBps") is not None else None,
+            "minimum_output_amount_raw": str(data.get("minimumOutputAmountRaw")) if data.get("minimumOutputAmountRaw") is not None else None,
+            "swap_provider": str(data.get("protocol") or "uniswap"),
+            "routing": str(data.get("routing") or "CLASSIC"),
+            "quote_fingerprint": str(data.get("quoteFingerprint") or "").strip() or None,
+            "router": str(data.get("router") or "").strip() or None,
+            "allowance": _normalize_swap_allowance(data.get("allowance")),
+            "simulation": _normalize_swap_simulation(data.get("simulation")),
+            "swap_transaction": {
+                "to": str((data.get("swapTransaction") or {}).get("to") or "").strip() or None,
+                "value": str((data.get("swapTransaction") or {}).get("value") or "0"),
+                "data_hash": str((data.get("swapTransaction") or {}).get("dataHash") or "").strip() or None,
+            },
+            "token_in_metadata": _normalize_token_metadata(data.get("tokenInMetadata"), token_in),
+            "token_out_metadata": _normalize_token_metadata(data.get("tokenOutMetadata"), token_out),
+            "hash": result.get("hash"),
+            "approve_hash": result.get("approveHash"),
+            "reset_allowance_hash": result.get("resetAllowanceHash"),
+            "result": result,
+            "chain_id": int(data.get("chainId") or 0),
+            "broadcasted": True,
+            "confirmed": False,
+            "source": "wdk-evm-wallet",
+        }
+
     async def preview_evm_lifi_cross_chain_swap(
         self,
         *,

package/agent-wallet/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "agent-wallet",
   "name": "Agent Wallet",
   "description": "Plugin-friendly wallet backend for OpenClaw agents with safe wallet tools and runtime instructions across Solana, local BTC, and local EVM.",
-  "version": "0.1.37",
+  "version": "0.1.44",
   "skills": ["skills/wallet-operator"],
   "configSchema": {
     "type": "object",

package/agent-wallet/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openclaw-agent-wallet"
-version = "0.1.37"
+version = "0.1.44"
 description = "Plugin-friendly wallet backend for OpenClaw agents"
 requires-python = ">=3.10"
 dependencies = [

package/agent-wallet/scripts/bootstrap_openclaw_evm.py

@@ -137,8 +137,25 @@ def _auto_start_local_service(
     wdk_wallet_root: Path,
     config_path: Path,
 ) -> dict[str, object]:
-    if _service_is_healthy(service_url):
-        return {"started": False, "already_healthy": True}
+    # Restart a running-but-stale daemon (old code in memory after a release) by
+    # comparing its /health version to the on-disk launcher version. Idempotent:
+    # steady state is a no-op. See agent_wallet.evm_user_wallets for the shared
+    # health/version/stop helpers.
+    from agent_wallet.evm_user_wallets import (
+        _read_on_disk_service_version,
+        _service_health,
+        _stop_local_service,
+    )
+
+    restarted = False
+    health = _service_health(service_url)
+    if health is not None:
+        expected_version = _read_on_disk_service_version(wdk_wallet_root)
+        running_version = str(health.get("version") or "").strip()
+        if expected_version is None or running_version == expected_version:
+            return {"started": False, "already_healthy": True}
+        _stop_local_service(service_url)
+        restarted = True
 
     if not _is_local_service_url(service_url):
         raise SystemExit(
@@ -178,6 +195,7 @@ def _auto_start_local_service(
             return {
                 "started": True,
                 "already_healthy": False,
+                "restarted": restarted,
                 "pid": process.pid,
                 "log_path": str(log_path),
             }

package/claude-code/plugins/agent-wallet/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-wallet",
   "displayName": "Agent Wallet",
-  "version": "0.1.37",
+  "version": "0.1.44",
   "description": "Claude Code bridge for the existing AgentLayer wallet runtime. Connects to Solana, Bitcoin, and EVM wallets without creating a new one.",
   "author": {
     "name": "AgentLayer"

package/claude-code/plugins/agent-wallet/README.md

@@ -30,7 +30,36 @@ Primary design rules:
 
 ## Installation
 
-### Automated (recommended)
+### From inside Claude Code (no terminal needed)
+
+The plugin ships in a git marketplace at the repo root, so you can install it —
+and its backend runtime — without leaving the CLI. Two commands, then restart:
+
+```text
+/plugin marketplace add lopushok9/Agent-Layer
+/plugin install agent-wallet@agentlayer
+```
+
+Restart Claude Code (or `/reload-plugins`). On the next session start a
+`SessionStart` hook runs `scripts/bootstrap_backend.sh`, a thin bridge to the
+npm installer (`npx @agentlayer.tech/wallet install --yes`). The marketplace only
+copies this MCP bridge into Claude Code's cache; the bootstrap step lays down the
+Python backend runtime (venv + `agent_wallet` + `server.py`) that the bridge
+talks to, with the wallet configured out of the box. It is idempotent and a
+no-op once the backend is healthy.
+
+- `/wallet-setup` — install (or repair) the backend explicitly instead of
+  waiting for the hook (requires `/reload-plugins` first so the command is
+  registered).
+- `AGENT_WALLET_AUTO_BOOTSTRAP=0` — opt out of the auto-install: the
+  `SessionStart` hook then only reminds you to run `/wallet-setup` instead of
+  installing the backend itself.
+
+For near-zero typed commands, pre-register the marketplace in
+`.claude/settings.json` with `extraKnownMarketplaces` + `enabledPlugins` so
+Claude Code prompts to install on trust.
+
+### Automated via npm
 
 ```bash
 npx @agentlayer.tech/wallet install --yes

package/claude-code/plugins/agent-wallet/commands/wallet-setup.md

@@ -0,0 +1,24 @@
+---
+description: Install or repair the AgentLayer wallet backend runtime without leaving Claude Code.
+allowed-tools: Bash(sh:*), Bash(npx:*)
+---
+
+Install (or repair) the AgentLayer wallet backend that this plugin bridges to.
+
+Run the bootstrap bridge to the npm installer:
+
+```
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/bootstrap_backend.sh" install
+```
+
+Then report the outcome to the user:
+
+- If it succeeded, tell them the backend is installed and that they should
+  restart Claude Code (or reload the `agent-wallet` plugin) so the wallet tools
+  become available.
+- If it failed because Node.js or Python is missing, relay the exact requirement
+  (Node.js 18+, Python >= 3.10 with venv) and the manual fallback command from
+  the script output.
+
+Do not pass or generate any secrets. The npm installer manages the local wallet
+keys and sealed secrets under `OPENCLAW_HOME` on its own.

package/claude-code/plugins/agent-wallet/hooks/hooks.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 300,
+            "command": "sh -c 'if [ \"${AGENT_WALLET_AUTO_BOOTSTRAP:-1}\" = \"1\" ]; then \"${CLAUDE_PLUGIN_ROOT}/scripts/bootstrap_backend.sh\" install >&2; else \"${CLAUDE_PLUGIN_ROOT}/scripts/bootstrap_backend.sh\" check >/dev/null 2>&1 || echo \"AgentLayer wallet backend is not installed. Run /wallet-setup to install it.\"; fi'"
+          }
+        ]
+      }
+    ]
+  }
+}