@agentlayer.tech/wallet 0.1.74 → 0.1.76

package/.openclaw/extensions/agent-wallet/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "agent-wallet",
   "name": "Agent Wallet",
   "description": "Official OpenClaw plugin bridge for the agent-wallet backends, including Solana, local BTC, and local EVM.",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "contracts": {
     "tools": [
       "agentlayer_autonomous_approve",

package/.openclaw/extensions/agent-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentlayertech/agent-wallet-plugin",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "description": "OpenClaw plugin bridge for the AgentLayer wallet runtime.",
   "type": "module",
   "license": "SEE LICENSE IN ../../../LICENSE",

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## Unreleased
 
+## v0.1.75 - 2026-07-11
+
+- Added a persistent, non-secret ownership registry for OpenClaw, Hermes,
+  Codex, and Claude Code integrations. Explicit installs are now distinguishable
+  from unrelated external plugins across runtime upgrades.
+
+- Fixed `wallet update` so managed framework integrations advance with the
+  verified `current` runtime. OpenClaw config and Hermes paths are repaired,
+  while Codex and Claude Code registrations and versioned caches are refreshed
+  through their host CLIs.
+
+- Added guarded adoption for legacy AgentLayer installs. Existing integrations
+  are adopted only when their registration and plugin manifests both identify
+  AgentLayer; unowned symlinks and external plugins remain untouched.
+
+- Added per-framework synchronization details to `wallet status` and
+  `wallet doctor`, including failed host registration and restart requirements.
+  npm-exec installs also refresh an already-installed stale global CLI without
+  making global installation mandatory.
+
+- Expanded installer regression coverage for managed upgrades, unmanaged
+  integration preservation, global CLI refresh, host registration, and
+  hermetic framework/npm homes.
+
+## v0.1.74 - 2026-07-10
+
 - Added a guarded npm beta-promotion workflow that acceptance-tests the exact
   registry artifact, verifies its integrity, rejects downgrades, serializes with
   publish jobs, and restores the previous `latest` tag if verification fails.

package/VERSION

@@ -1 +1 @@
-0.1.74
+0.1.76

package/agent-wallet/AGENTS.md

@@ -89,6 +89,7 @@ These instructions apply to the entire `agent-wallet/` tree.
   - installer scripts and README examples
 - When changing approval or signing behavior, update the runtime, adapter, CLI bridge, and smoke tests together.
 - If a change affects the OpenClaw bridge, update the TypeScript extension and the Python contract in the same change set.
+- Preserve the direct-upgrade floor and legacy removal policy documented in `UPGRADE_COMPATIBILITY.md`.
 
 ### Coding style
 - Follow existing Python style and type-hint usage.

package/agent-wallet/UPGRADE_COMPATIBILITY.md

@@ -0,0 +1,36 @@
+# Upgrade Compatibility
+
+The wallet installer supports direct upgrades from older production releases.
+Compatibility code is removed according to the minimum supported source
+version, not according to elapsed time or a fixed number of releases.
+
+## Supported Floor
+
+The current regression floor is `0.1.53`. CI must keep a direct upgrade fixture
+at that floor until the project explicitly raises it in release documentation.
+
+Raising the floor requires all of the following:
+
+- a documented migration path for users below the new floor
+- upgrade fixtures for the new floor and the latest stable release
+- support and telemetry evidence that the retired path is no longer material
+- a release note naming the removed compatibility behavior
+
+## Compatibility Paths
+
+| Path | Purpose | Removal condition |
+|---|---|---|
+| JavaScript boot-key fallback | Updates runtimes that predate the verified Python installer resolver. | The supported floor includes `resolve_boot_key_for_installer`, and direct-upgrade fixtures no longer require the fallback. |
+| Directory runtime-pointer migration | Converts pre-versioned `current/` directories into release entries. | The supported floor guarantees symlink-based runtime pointers. |
+| Hermes legacy adoption | Recognizes an AgentLayer plugin installed before the ownership registry. | The supported floor guarantees an `integrations.json` Hermes ownership entry. |
+| Codex legacy adoption | Recognizes a matching local marketplace registration and AgentLayer manifest. | The supported floor guarantees an `integrations.json` Codex ownership entry. |
+| Claude Code legacy adoption | Recognizes the AgentLayer marketplace and plugin manifest before registry ownership. | The supported floor guarantees an `integrations.json` Claude Code ownership entry. |
+
+## Safety Rules
+
+- Legacy adoption requires independent registration and manifest evidence.
+- Unknown or externally managed integrations are never adopted automatically.
+- Compatibility paths must not weaken boot-key, sealed-state, approval, or
+  signing validation.
+- Every retained path needs a direct-upgrade smoke test or an explicit fixture
+  showing why it remains necessary.

package/agent-wallet/agent_wallet/__init__.py

@@ -2,7 +2,7 @@
 
 # Keep in sync with package.json, pyproject.toml, and the npm installer version.
 # scripts/check_release_version.mjs enforces this on release.
-__version__ = "0.1.74"
+__version__ = "0.1.76"
 
 __all__ = [
     "config",

package/agent-wallet/agent_wallet/boot_key_recovery.py

@@ -29,10 +29,19 @@ def export_boot_key() -> str:
 
 
 def import_boot_key(value: str) -> dict:
-    """Write a recorded boot key into the OS keystore and verify the read-back."""
+    """Validate and write a recorded boot key, then verify the read-back."""
     key = str(value or "").strip()
     if not key:
         raise WalletBackendError("A non-empty boot key is required for import.")
+    from agent_wallet.sealed_keys import resolve_sealed_keys_path, unseal_keys
+
+    if resolve_sealed_keys_path().exists():
+        try:
+            unseal_keys(key)
+        except Exception as exc:
+            raise WalletBackendError(
+                "The supplied boot key does not unlock the existing sealed wallet state."
+            ) from exc
     store = resolve_keystore()
     store.set(BOOT_KEY_ITEM, key)
     if store.get(BOOT_KEY_ITEM) != key:

package/agent-wallet/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "agent-wallet",
   "name": "Agent Wallet",
   "description": "Plugin-friendly wallet backend for OpenClaw agents with safe wallet tools and runtime instructions across Solana, local BTC, and local EVM.",
-  "version": "0.1.74",
+  "version": "0.1.76",
   "skills": ["skills/wallet-operator"],
   "configSchema": {
     "type": "object",

package/agent-wallet/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openclaw-agent-wallet"
-version = "0.1.74"
+version = "0.1.76"
 description = "Plugin-friendly wallet backend for OpenClaw agents"
 requires-python = ">=3.10"
 dependencies = [

package/bin/lib/boot-key.mjs

@@ -0,0 +1,185 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+function readEnv(pathname) {
+  try {
+    const result = {};
+    for (const line of fs.readFileSync(pathname, "utf8").split(/\r?\n/)) {
+      const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+      if (match) result[match[1]] = match[2];
+    }
+    return result;
+  } catch (error) {
+    if (error?.code === "ENOENT") return {};
+    throw error;
+  }
+}
+
+function readText(pathname) {
+  try {
+    return fs.readFileSync(pathname, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return "";
+    throw error;
+  }
+}
+
+function writeSecret(pathname, value) {
+  fs.mkdirSync(path.dirname(pathname), { recursive: true });
+  fs.writeFileSync(pathname, `${String(value || "").trim()}\n`, { mode: 0o600 });
+  try {
+    fs.chmodSync(pathname, 0o600);
+  } catch {
+    // Best effort on filesystems without POSIX modes.
+  }
+}
+
+export function createBootKeyManager({
+  runtimeBase,
+  openclawHome,
+  currentRuntimeRoot,
+  resolveVenvPython,
+  expandHome,
+  bridgeTimeoutMs,
+  env = process.env,
+}) {
+  const defaultFile = path.join(runtimeBase, "boot-key");
+
+  function currentKey() {
+    const root = currentRuntimeRoot();
+    if (!root) return "";
+    return readEnv(path.join(root, "agent-wallet", ".env")).AGENT_WALLET_BOOT_KEY || "";
+  }
+
+  function configuredFileKey() {
+    const value = String(env.AGENT_WALLET_BOOT_KEY_FILE || "").trim();
+    return value ? readText(path.resolve(expandHome(value))).trim() : "";
+  }
+
+  function ensureFile() {
+    const configured = String(env.AGENT_WALLET_BOOT_KEY_FILE || "").trim();
+    const keyFile = configured ? path.resolve(expandHome(configured)) : defaultFile;
+    if (readText(keyFile).trim()) return { path: keyFile, status: "existing" };
+    const key = String(env.AGENT_WALLET_BOOT_KEY || "").trim() || configuredFileKey() || currentKey();
+    if (!key) return { path: keyFile, status: "missing" };
+    writeSecret(keyFile, key);
+    return { path: keyFile, status: "created" };
+  }
+
+  function readKeystore() {
+    const root = currentRuntimeRoot();
+    if (!root) return "";
+    const python = resolveVenvPython(root);
+    if (!python) return "";
+    try {
+      const result = spawnSync(
+        python,
+        ["-c", "from agent_wallet.config import read_boot_key_from_keystore as r; print(r())"],
+        {
+          cwd: path.join(root, "agent-wallet"),
+          encoding: "utf8",
+          timeout: bridgeTimeoutMs,
+          env: { ...env, OPENCLAW_HOME: openclawHome },
+        },
+      );
+      return result.status === 0 ? String(result.stdout || "").trim() : "";
+    } catch {
+      return "";
+    }
+  }
+
+  function resolveFromRuntime() {
+    const root = currentRuntimeRoot();
+    if (!root) return { supported: false, key: "" };
+    const python = resolveVenvPython(root);
+    if (!python) return { supported: false, key: "" };
+    try {
+      const result = spawnSync(
+        python,
+        ["-c", "from agent_wallet.config import resolve_boot_key_for_installer as r; print(r())"],
+        {
+          cwd: path.join(root, "agent-wallet"),
+          encoding: "utf8",
+          timeout: bridgeTimeoutMs,
+          env: { ...env, OPENCLAW_HOME: openclawHome },
+        },
+      );
+      return result.status === 0
+        ? { supported: true, key: String(result.stdout || "").trim() }
+        : { supported: false, key: "" };
+    } catch {
+      return { supported: false, key: "" };
+    }
+  }
+
+  function resolveLegacy() {
+    for (const [source, key] of [
+      ["legacy_keystore", readKeystore()],
+      ["current_runtime_env", currentKey()],
+      ["configured_file", configuredFileKey()],
+      ["default_file", readText(defaultFile).trim()],
+    ]) {
+      if (key) return { key, source };
+    }
+    return { key: "", source: "none" };
+  }
+
+  function provision(releaseRoot, bootKey) {
+    const key = String(bootKey || "").trim();
+    if (!key) return false;
+    const python = resolveVenvPython(releaseRoot);
+    if (!python) return false;
+    try {
+      const result = spawnSync(
+        python,
+        ["-m", "agent_wallet.openclaw_cli", "boot-key-import", "--key-stdin"],
+        {
+          cwd: path.join(releaseRoot, "agent-wallet"),
+          input: key,
+          encoding: "utf8",
+          timeout: bridgeTimeoutMs,
+          env: { ...env, OPENCLAW_HOME: openclawHome },
+        },
+      );
+      return result.status === 0;
+    } catch {
+      return false;
+    }
+  }
+
+  function verifyWithRuntime(releaseRoot) {
+    const sealedPath = path.join(openclawHome, "sealed_keys.json");
+    if (!fs.existsSync(sealedPath)) return { ok: true, required: false };
+    const key = String(env.AGENT_WALLET_BOOT_KEY || "").trim();
+    if (!key) return { ok: false, required: true, error: "no verified boot key is available" };
+    const python =
+      env.AGENT_WALLET_PYTHON ||
+      env.OPENCLAW_AGENT_WALLET_PYTHON ||
+      resolveVenvPython(releaseRoot);
+    if (!python) {
+      if (String(env.AGENT_WALLET_VERIFY_DISABLE || "") === "1") {
+        return { ok: true, required: true, skipped: true };
+      }
+      return { ok: false, required: true, error: "staged Python runtime is unavailable" };
+    }
+    const result = spawnSync(
+      python,
+      [
+        "-c",
+        "from agent_wallet.sealed_keys import unseal_keys; import os; unseal_keys(os.environ['AGENT_WALLET_BOOT_KEY']); print('ok')",
+      ],
+      {
+        cwd: path.join(releaseRoot, "agent-wallet"),
+        encoding: "utf8",
+        timeout: bridgeTimeoutMs,
+        env: { ...env, OPENCLAW_HOME: openclawHome },
+      },
+    );
+    return result.status === 0
+      ? { ok: true, required: true }
+      : { ok: false, required: true, error: "selected boot key does not unlock sealed wallet state" };
+  }
+
+  return { ensureFile, resolveFromRuntime, resolveLegacy, provision, verifyWithRuntime };
+}