@agentlayer.tech/wallet 0.1.47 → 0.1.49

package/.openclaw/extensions/agent-wallet/index.ts

@@ -18,6 +18,10 @@ const PREVIEW_BOUND_SWAP_TOOLS = new Set([
   "flash_trade_open_position",
   "flash_trade_close_position",
 ]);
+const AUTONOMOUS_BASE_SWAP_TOOLS = new Set([
+  "swap_evm_tokens",
+  "swap_evm_uniswap_tokens",
+]);
 const approvalPreviewCache = new Map();
 const WALLET_TOOL_ONLY_GUIDANCE =
   "Use this wallet tool instead of shelling out to solana CLI, spl-token CLI, curl, or exec. If it fails, surface the wallet-tool error and stop rather than falling back to terminal commands.";
@@ -127,6 +131,14 @@ function requiresApprovedPreviewPayload(toolName, params = null) {
   return PREVIEW_BOUND_SWAP_TOOLS.has(toolName);
 }
 
+function shouldLetBackendAuthorizeAutonomousBaseSwap(toolName, params, config) {
+  if (!AUTONOMOUS_BASE_SWAP_TOOLS.has(toolName)) return false;
+  if (String(params?.mode || "") !== "execute") return false;
+  if (typeof params?.approval_token === "string" && params.approval_token.trim()) return false;
+  const network = String(params?.network || config?.network || selectedEvmNetwork || "").trim().toLowerCase();
+  return network === "base";
+}
+
 function looksLikeApprovalContextError(message) {
   const text = String(message || "").toLowerCase();
   return (
@@ -516,6 +528,7 @@ async function attachApprovalForExecute(api, config, userId, toolName, effective
   }
 
   if (effectiveParams.approval_token) return null;
+  if (shouldLetBackendAuthorizeAutonomousBaseSwap(toolName, effectiveParams, config)) return null;
 
   throw new Error(APPROVAL_CONTEXT_MISSING_MESSAGE);
 }
@@ -697,6 +710,38 @@ const walletSessionToolDefinitions = [
       additionalProperties: false,
     },
   },
+  {
+    name: "agentlayer_autonomous_status",
+    description: "Return AgentLayer high-trust autonomous permission status. Currently supports only scope=base_swaps.",
+    parameters: { type: "object", properties: {}, additionalProperties: false },
+  },
+  {
+    name: "agentlayer_autonomous_approve",
+    description:
+      "Enable high-trust autonomous Base swaps. scope=base_swaps lets Base Velora/Uniswap swap execute calls run without per-transaction human approval until revoked. This does not cover transfers, withdrawals, lending, staking, bridges, Solana swaps, or non-Base networks.",
+    parameters: {
+      type: "object",
+      properties: {
+        scope: { type: "string", enum: ["base_swaps"] },
+        purpose: { type: "string" },
+        user_intent: { type: "boolean" },
+      },
+      required: ["scope", "purpose", "user_intent"],
+      additionalProperties: false,
+    },
+  },
+  {
+    name: "agentlayer_autonomous_revoke",
+    description: "Disable high-trust autonomous execution for a scope. Currently supports only scope=base_swaps.",
+    parameters: {
+      type: "object",
+      properties: {
+        scope: { type: "string", enum: ["base_swaps"] },
+      },
+      required: ["scope"],
+      additionalProperties: false,
+    },
+  },
   {
     name: "x402_search_services",
     description:

package/.openclaw/extensions/agent-wallet/openclaw.plugin.json

@@ -2,9 +2,12 @@
   "id": "agent-wallet",
   "name": "Agent Wallet",
   "description": "Official OpenClaw plugin bridge for the agent-wallet backends, including Solana, local BTC, and local EVM.",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "contracts": {
     "tools": [
+      "agentlayer_autonomous_approve",
+      "agentlayer_autonomous_revoke",
+      "agentlayer_autonomous_status",
       "close_empty_token_accounts",
       "flash_trade_close_position",
       "flash_trade_open_position",

package/.openclaw/extensions/agent-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentlayertech/agent-wallet-plugin",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "description": "OpenClaw plugin bridge for the AgentLayer wallet runtime.",
   "type": "module",
   "license": "SEE LICENSE IN ../../../LICENSE",

package/VERSION

@@ -1 +1 @@
-0.1.47
+0.1.49

package/agent-wallet/agent_wallet/__init__.py

@@ -2,7 +2,7 @@
 
 # Keep in sync with package.json, pyproject.toml, and the npm installer version.
 # scripts/check_release_version.mjs enforces this on release.
-__version__ = "0.1.47"
+__version__ = "0.1.49"
 
 __all__ = [
     "config",

package/agent-wallet/agent_wallet/autonomous_permissions.py

@@ -0,0 +1,145 @@
+"""Persistent high-trust permission toggles for unattended wallet flows.
+
+This module is intentionally narrower than ``autonomous_session``.  It models
+the "CLI permissions" UX where a user grants a standing capability, not a
+budgeted policy envelope.  The first supported scope is Base swaps only.
+"""
+
+from __future__ import annotations
+
+import json
+import time
+from pathlib import Path
+from typing import Any
+
+from agent_wallet.approval import issue_approval_token
+from agent_wallet.config import resolve_openclaw_home
+from agent_wallet.file_ops import atomic_write_text, chmod_if_exists
+from agent_wallet.wallet_layer.base import WalletBackendError
+
+PERMISSION_VERSION = 1
+BASE_SWAP_SCOPE = "base_swaps"
+BASE_SWAP_NETWORK = "base"
+BASE_SWAP_TOOLS = frozenset({"swap_evm_tokens", "swap_evm_uniswap_tokens"})
+BASE_SWAP_ISSUER = "autonomous-permission:base-swaps"
+_PERMISSIONS_FILENAME = "autonomous_permissions.json"
+
+
+def _permissions_path() -> Path:
+    return resolve_openclaw_home() / _PERMISSIONS_FILENAME
+
+
+def _now() -> int:
+    return int(time.time())
+
+
+def _empty_record() -> dict[str, Any]:
+    return {"version": PERMISSION_VERSION, "scopes": {}}
+
+
+def _load_record() -> dict[str, Any]:
+    path = _permissions_path()
+    if not path.exists():
+        return _empty_record()
+    chmod_if_exists(path)
+    try:
+        record = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return _empty_record()
+    if not isinstance(record, dict) or int(record.get("version") or 0) != PERMISSION_VERSION:
+        return _empty_record()
+    scopes = record.get("scopes")
+    if not isinstance(scopes, dict):
+        record["scopes"] = {}
+    return record
+
+
+def _write_record(record: dict[str, Any]) -> None:
+    atomic_write_text(_permissions_path(), json.dumps(record, sort_keys=True, separators=(",", ":")))
+
+
+def _scope_status(record: dict[str, Any], scope: str) -> dict[str, Any]:
+    raw = (record.get("scopes") or {}).get(scope)
+    if not isinstance(raw, dict):
+        return {"scope": scope, "enabled": False}
+    return {
+        "scope": scope,
+        "enabled": bool(raw.get("enabled")),
+        "approved_at": raw.get("approved_at"),
+        "approved_by": raw.get("approved_by"),
+        "network": raw.get("network"),
+        "tools": raw.get("tools") or [],
+        "warning": raw.get("warning"),
+    }
+
+
+def status() -> dict[str, Any]:
+    """Return current high-trust autonomous permission status."""
+    record = _load_record()
+    base_swaps = _scope_status(record, BASE_SWAP_SCOPE)
+    return {
+        "active": bool(base_swaps.get("enabled")),
+        "scopes": {BASE_SWAP_SCOPE: base_swaps},
+        "permission_file": str(_permissions_path()),
+    }
+
+
+def approve_base_swaps(*, approved_by: str = "user") -> dict[str, Any]:
+    """Enable unattended Base swap execution for supported EVM swap tools."""
+    record = _load_record()
+    scopes = record.setdefault("scopes", {})
+    scopes[BASE_SWAP_SCOPE] = {
+        "enabled": True,
+        "approved_at": _now(),
+        "approved_by": str(approved_by or "user"),
+        "network": BASE_SWAP_NETWORK,
+        "tools": sorted(BASE_SWAP_TOOLS),
+        "warning": (
+            "High-trust permission: Base swap execute calls can run without "
+            "per-transaction human approval until revoked."
+        ),
+    }
+    _write_record(record)
+    return status()
+
+
+def revoke_base_swaps() -> dict[str, Any]:
+    """Disable unattended Base swap execution."""
+    record = _load_record()
+    scopes = record.setdefault("scopes", {})
+    existing = scopes.get(BASE_SWAP_SCOPE)
+    if isinstance(existing, dict):
+        existing["enabled"] = False
+        existing["revoked_at"] = _now()
+    else:
+        scopes[BASE_SWAP_SCOPE] = {"enabled": False, "revoked_at": _now()}
+    _write_record(record)
+    return status()
+
+
+def is_base_swap_approved() -> bool:
+    return bool(status()["scopes"][BASE_SWAP_SCOPE].get("enabled"))
+
+
+def authorize_base_swap(*, tool_name: str, network: str, summary: dict[str, Any]) -> str:
+    """Issue an internal approval token for one exact Base swap operation."""
+    if str(tool_name) not in BASE_SWAP_TOOLS:
+        raise WalletBackendError("Autonomous permission only covers Base swap tools.")
+    if str(network or "").strip().lower() != BASE_SWAP_NETWORK:
+        raise WalletBackendError("Autonomous Base swap permission only applies on network=base.")
+    if not is_base_swap_approved():
+        raise WalletBackendError(
+            "Autonomous Base swap permission is not enabled. Ask the user to run "
+            "agentlayer_autonomous_approve for scope=base_swaps first."
+        )
+    summary_network = str((summary or {}).get("network") or "").strip().lower()
+    if summary_network and summary_network != BASE_SWAP_NETWORK:
+        raise WalletBackendError("Autonomous Base swap summary is not bound to network=base.")
+    return issue_approval_token(
+        tool_name=tool_name,
+        network=BASE_SWAP_NETWORK,
+        summary=summary,
+        mainnet_confirmed=True,
+        ttl_seconds=120,
+        issued_by=BASE_SWAP_ISSUER,
+    )

package/agent-wallet/agent_wallet/autonomous_policy.py

@@ -0,0 +1,305 @@
+"""Autonomous execution policy engine for agent wallets.
+
+The default execute path in :mod:`agent_wallet` is human-in-the-loop: the
+host issues an approval token (see :mod:`agent_wallet.approval`) *after* a
+person reviews the preview summary.  This module adds an opt-in alternative
+that lets an operation execute **without a human confirming each transaction**
+— but only when it passes a deterministic risk gate that the operator
+configures up front.
+
+The design mirrors the "programmable controls set in advance" model used by
+Coinbase AgentKit / CDP Agentic Wallets (session caps, per-transaction
+limits, allow-lists) and the ``WalletProvider`` guard pattern: a thin policy
+layer wraps the existing execute path instead of replacing it.
+
+Key safety properties:
+
+* **Deny by default.** A freshly constructed :class:`AutonomousSessionConfig`
+  approves nothing.  Every capability (tool, network, recipient, spend
+  amount, mainnet access) must be explicitly enabled.
+* **Same downstream verification.** When the gate passes, the engine issues
+  the *exact same* signed approval token the host would issue — only the
+  ``issued_by`` field differs (``"autonomous-policy"``).  Nothing downstream
+  has to change or trust a new code path.
+* **Bounded sessions.** Spend limits (reusing :class:`SpendingLedger`),
+  operation counts, and a session TTL bound the blast radius of a
+  compromised or misbehaving agent.
+
+This module performs *no* network or signing I/O and has no dependency on a
+live wallet backend, so it is cheap to unit-test in isolation.
+"""
+
+from __future__ import annotations
+
+import threading
+import time
+from dataclasses import dataclass, field
+from typing import Callable
+
+from agent_wallet.approval import issue_approval_token
+from agent_wallet.spending_limits import SpendingConfig, SpendingLedger
+from agent_wallet.wallet_layer.base import WalletBackendError
+
+#: Issuer label stamped onto autonomously-approved tokens so audit logs can
+#: distinguish them from host/human approvals.
+AUTONOMOUS_ISSUER = "autonomous-policy"
+
+#: Networks treated as "real money" and therefore gated behind
+#: ``allow_mainnet`` regardless of the per-tool allow-list.
+MAINNET_NETWORKS = frozenset({"mainnet", "mainnet-beta", "ethereum", "base", "arbitrum", "optimism", "polygon"})
+
+TokenIssuer = Callable[..., str]
+
+
+def _norm_network(network: str) -> str:
+    return str(network or "").strip().lower()
+
+
+def _norm_addr(address: str | None) -> str:
+    """Normalize an address for allow-list comparison.
+
+    EVM ``0x`` addresses are case-insensitive, so they are lower-cased.
+    Other addresses (e.g. base58 Solana keys) are compared verbatim.
+    """
+    value = str(address or "").strip()
+    if value.lower().startswith("0x"):
+        return value.lower()
+    return value
+
+
+@dataclass(frozen=True)
+class AutonomousSessionConfig:
+    """Up-front authorization envelope for a single autonomous session.
+
+    All capabilities are off by default.  A session that is not ``enabled``,
+    or whose allow-lists are empty, approves nothing.
+    """
+
+    enabled: bool = False
+    allowed_tools: frozenset[str] = frozenset()
+    allowed_networks: frozenset[str] = frozenset()
+    #: Mainnet is gated separately from the network allow-list so an operator
+    #: cannot enable "real money" execution by accident.
+    allow_mainnet: bool = False
+    #: Destination addresses / program ids the agent may interact with.
+    allowed_recipients: frozenset[str] = frozenset()
+    #: Escape hatch for flows where the destination is not known in advance
+    #: (e.g. router-built swaps).  Spend caps and simulation still apply.
+    allow_any_recipient: bool = False
+    #: Require a passing simulation/dry-run before approving.  Strongly
+    #: recommended; this is the autonomous analogue of a human eyeballing
+    #: the preview.
+    require_simulation: bool = True
+    #: Reused spend ledger configuration (per-tx / hourly / daily / rate).
+    spending: SpendingConfig = SpendingConfig()
+    #: Maximum number of operations the session may approve (0 = unlimited).
+    max_operations: int = 0
+    #: Session lifetime in seconds (0 = no expiry).
+    session_ttl_seconds: int = 0
+    #: TTL applied to each issued approval token.
+    approval_ttl_seconds: int = 120
+
+    def normalized(self) -> "AutonomousSessionConfig":
+        """Return a copy with networks/recipients normalized for matching."""
+        return AutonomousSessionConfig(
+            enabled=self.enabled,
+            allowed_tools=frozenset(str(t).strip() for t in self.allowed_tools),
+            allowed_networks=frozenset(_norm_network(n) for n in self.allowed_networks),
+            allow_mainnet=self.allow_mainnet,
+            allowed_recipients=frozenset(_norm_addr(a) for a in self.allowed_recipients),
+            allow_any_recipient=self.allow_any_recipient,
+            require_simulation=self.require_simulation,
+            spending=self.spending,
+            max_operations=self.max_operations,
+            session_ttl_seconds=self.session_ttl_seconds,
+            approval_ttl_seconds=self.approval_ttl_seconds,
+        )
+
+
+@dataclass(frozen=True)
+class OperationRequest:
+    """A single execute request submitted to the policy gate."""
+
+    tool_name: str
+    network: str
+    #: The confirmation summary that will be bound into the approval token.
+    #: It must be the same object the downstream verifier reconstructs.
+    summary: dict
+    #: Normalized notional spend used for limit accounting.  Callers should
+    #: pass the outflow in the wallet's smallest unit (lamports/wei).  Use 0
+    #: for read-shaped or zero-value operations, or ``None`` when the amount
+    #: could not be determined (the session layer treats unknown spend as a
+    #: hard denial whenever spend caps are configured).
+    spend_amount: int | None = 0
+    #: Destination address or program id, if known.
+    recipient: str | None = None
+    #: Whether a simulation/dry-run already succeeded for this operation.
+    simulated: bool = False
+
+
+@dataclass(frozen=True)
+class AutonomousDecision:
+    """Outcome of a policy evaluation."""
+
+    approved: bool
+    reason: str
+    rule: str | None = None
+    approval_token: str | None = None
+
+
+@dataclass
+class _SessionState:
+    started_at: float
+    operations: int = 0
+
+
+class AutonomousPolicyEngine:
+    """Deterministic risk gate that programmatically issues approval tokens.
+
+    Construct one engine per autonomous session.  Call :meth:`evaluate` for a
+    non-raising decision, or :meth:`authorize` to get a token back (raising
+    :class:`WalletBackendError` on denial, matching the rest of the wallet
+    layer's error contract).
+
+    ``token_issuer`` is injectable so tests can run without a sealed approval
+    secret; in production it defaults to the real
+    :func:`agent_wallet.approval.issue_approval_token`.
+    """
+
+    def __init__(
+        self,
+        config: AutonomousSessionConfig,
+        *,
+        token_issuer: TokenIssuer = issue_approval_token,
+        ledger: SpendingLedger | None = None,
+        clock: Callable[[], float] = time.time,
+        started_at: float | None = None,
+        operations_used: int = 0,
+    ) -> None:
+        self.config = config.normalized()
+        self._issuer = token_issuer
+        self._ledger = ledger if ledger is not None else SpendingLedger(self.config.spending)
+        self._clock = clock
+        self._lock = threading.Lock()
+        # ``started_at`` / ``operations_used`` are injectable so a session can
+        # be rehydrated from a persisted record across processes.
+        self._state = _SessionState(
+            started_at=clock() if started_at is None else started_at,
+            operations=int(operations_used),
+        )
+
+    # -- public API ----------------------------------------------------------
+
+    def evaluate(self, op: OperationRequest) -> AutonomousDecision:
+        """Evaluate *op* against the session policy without raising.
+
+        On approval the returned decision carries a freshly issued, signed
+        approval token bound to ``op.tool_name`` / ``op.network`` /
+        ``op.summary``.
+        """
+        cfg = self.config
+        network = _norm_network(op.network)
+
+        with self._lock:
+            # 1. Master switch.
+            if not cfg.enabled:
+                return self._deny("autonomous execution is disabled for this session", "enabled")
+
+            # 2. Session lifetime.
+            if cfg.session_ttl_seconds > 0:
+                age = self._clock() - self._state.started_at
+                if age > cfg.session_ttl_seconds:
+                    return self._deny(
+                        f"autonomous session expired ({age:.0f}s > {cfg.session_ttl_seconds}s)",
+                        "session_ttl",
+                    )
+
+            # 3. Operation budget.
+            if cfg.max_operations > 0 and self._state.operations >= cfg.max_operations:
+                return self._deny(
+                    f"autonomous operation budget exhausted ({cfg.max_operations} ops)",
+                    "max_operations",
+                )
+
+            # 4. Tool allow-list.
+            if op.tool_name not in cfg.allowed_tools:
+                return self._deny(f"tool '{op.tool_name}' is not autonomously allowed", "allowed_tools")
+
+            # 5. Network allow-list.
+            if network not in cfg.allowed_networks:
+                return self._deny(f"network '{network}' is not autonomously allowed", "allowed_networks")
+
+            # 6. Mainnet gate (separate from the network allow-list).
+            if network in MAINNET_NETWORKS and not cfg.allow_mainnet:
+                return self._deny(
+                    f"mainnet network '{network}' requires allow_mainnet for autonomous execution",
+                    "allow_mainnet",
+                )
+
+            # 7. Recipient allow-list.
+            if not cfg.allow_any_recipient:
+                recipient = _norm_addr(op.recipient)
+                if not recipient:
+                    return self._deny("operation has no recipient and allow_any_recipient is false", "recipient")
+                if recipient not in cfg.allowed_recipients:
+                    return self._deny(f"recipient '{op.recipient}' is not on the allow-list", "recipient")
+
+            # 8. Mandatory simulation.
+            if cfg.require_simulation and not op.simulated:
+                return self._deny("operation has no passing simulation and require_simulation is true", "simulation")
+
+            # 9. Spend limits (per-tx / rate / hourly / daily). Records on pass.
+            try:
+                self._ledger.check_and_record(int(op.spend_amount or 0))
+            except WalletBackendError as exc:
+                return self._deny(str(exc), "spending")
+
+            # 10. Issue the same signed token the host path would issue.
+            try:
+                token = self._issuer(
+                    tool_name=op.tool_name,
+                    network=op.network,
+                    summary=op.summary,
+                    mainnet_confirmed=network in MAINNET_NETWORKS and cfg.allow_mainnet,
+                    ttl_seconds=cfg.approval_ttl_seconds,
+                    issued_by=AUTONOMOUS_ISSUER,
+                )
+            except Exception as exc:  # noqa: BLE001 - surface issuer failures verbatim
+                return self._deny(f"approval token issuance failed: {exc}", "issuer")
+
+            self._state.operations += 1
+            return AutonomousDecision(
+                approved=True,
+                reason="approved by autonomous policy",
+                rule="approved",
+                approval_token=token,
+            )
+
+    def authorize(self, op: OperationRequest) -> str:
+        """Like :meth:`evaluate` but return the token or raise on denial."""
+        decision = self.evaluate(op)
+        if not decision.approved or not decision.approval_token:
+            raise WalletBackendError(f"autonomous policy denied operation: {decision.reason}")
+        return decision.approval_token
+
+    def snapshot(self) -> dict:
+        """Return a JSON-serializable view of session state for auditing."""
+        with self._lock:
+            return {
+                "enabled": self.config.enabled,
+                "operations": self._state.operations,
+                "max_operations": self.config.max_operations,
+                "started_at": self._state.started_at,
+                "session_ttl_seconds": self.config.session_ttl_seconds,
+                "allow_mainnet": self.config.allow_mainnet,
+            }
+
+    def export_spend(self) -> list[tuple[float, int]]:
+        """Return the spend ledger entries so they can be persisted."""
+        return self._ledger.export()
+
+    # -- internal ------------------------------------------------------------
+
+    @staticmethod
+    def _deny(reason: str, rule: str) -> AutonomousDecision:
+        return AutonomousDecision(approved=False, reason=reason, rule=rule)