@agentlayer.tech/wallet 0.1.90 → 0.1.92

package/agent-wallet/scripts/install_agent_wallet.py

@@ -7,13 +7,20 @@ import hashlib
 import json
 import os
 import platform
+import re
 import shutil
 import subprocess
 import sys
 import tempfile
+import urllib.error
+import urllib.request
 import venv
 from pathlib import Path
 
+WELCOME_INVITE_PATTERN = re.compile(r"^alw_[A-Za-z0-9_-]{43}$")
+DEFAULT_ONBOARDING_BIND_URL = "https://www.agent-layer.tech/api/onboarding/bind-wallet"
+ONBOARDING_HTTP_TIMEOUT_SECONDS = 5.0
+
 INCLUDED_RUNTIME_ROOT_FILES = [
     ".env.example",
     "AGENTS.md",
@@ -192,9 +199,16 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--network", default="mainnet")
     parser.add_argument("--rpc-url", default="")
     parser.add_argument("--rpc-urls", default="")
+    parser.add_argument("--invite", default="")
     parser.add_argument("--sign-only", action=argparse.BooleanOptionalAction, default=False)
     parser.add_argument("--sync-runtime", action=argparse.BooleanOptionalAction, default=True)
     parser.add_argument("--install-from-runtime", action=argparse.BooleanOptionalAction, default=False)
+    parser.add_argument(
+        "--configure-openclaw",
+        action=argparse.BooleanOptionalAction,
+        default=True,
+        help="Patch openclaw.json during install (disabled by the universal host orchestrator).",
+    )
     parser.add_argument("--skip-python-setup", action=argparse.BooleanOptionalAction, default=False)
     parser.add_argument("--skip-node-setup", action=argparse.BooleanOptionalAction, default=False)
     parser.add_argument("--dry-run", action=argparse.BooleanOptionalAction, default=False)
@@ -856,6 +870,149 @@ def _bootstrap_evm_wallet(
     }
 
 
+def _onboarding_bind_url() -> str:
+    return (
+        os.getenv("AGENTLAYER_ONBOARDING_BIND_URL", "").strip()
+        or DEFAULT_ONBOARDING_BIND_URL
+    )
+
+
+def _onboarding_error_code(payload: object, fallback: str) -> str:
+    if not isinstance(payload, dict):
+        return fallback
+    code = str(payload.get("error") or "").strip().lower()
+    allowed = {
+        "address_already_used",
+        "internal_error",
+        "invalid_base_address",
+        "invalid_invite",
+        "invite_already_bound",
+        "invite_expired",
+        "invite_revoked",
+        "request_too_large",
+    }
+    return code if code in allowed else fallback
+
+
+def _decode_onboarding_response(raw: bytes) -> object:
+    try:
+        return json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        return {}
+
+
+def _bind_welcome_invite(
+    invite: str,
+    address: str,
+    *,
+    api_url: str | None = None,
+    timeout_seconds: float = ONBOARDING_HTTP_TIMEOUT_SECONDS,
+    opener: object = urllib.request.urlopen,
+    attempts: int = 2,
+) -> dict[str, object]:
+    normalized_invite = invite.strip()
+    normalized_address = address.strip()
+    if not WELCOME_INVITE_PATTERN.fullmatch(normalized_invite):
+        return {"ok": False, "status": "invalid_invite", "retryable": False}
+    if not re.fullmatch(r"0x[0-9a-fA-F]{40}", normalized_address):
+        return {"ok": False, "status": "invalid_base_address", "retryable": False}
+
+    body = json.dumps({"address": normalized_address}).encode("utf-8")
+    request = urllib.request.Request(
+        api_url or _onboarding_bind_url(),
+        data=body,
+        method="POST",
+        headers={
+            "Authorization": f"Bearer {normalized_invite}",
+            "Content-Type": "application/json",
+            "Accept": "application/json",
+            "User-Agent": "AgentLayer-Wallet-Installer",
+        },
+    )
+    max_attempts = max(1, min(int(attempts), 3))
+    for attempt in range(max_attempts):
+        try:
+            with opener(request, timeout=timeout_seconds) as response:  # type: ignore[operator]
+                status_code = int(getattr(response, "status", 200))
+                payload = _decode_onboarding_response(response.read(65_536))
+            if status_code < 200 or status_code >= 300 or not isinstance(payload, dict):
+                if status_code >= 500 and attempt + 1 < max_attempts:
+                    continue
+                return {
+                    "ok": False,
+                    "status": _onboarding_error_code(payload, "service_error"),
+                    "retryable": status_code >= 500,
+                }
+            binding_status = str(payload.get("status") or "")
+            response_address = str(payload.get("address") or "")
+            if (
+                payload.get("ok") is not True
+                or binding_status not in {"bound", "already_bound"}
+                or response_address.lower() != normalized_address.lower()
+            ):
+                return {"ok": False, "status": "invalid_response", "retryable": True}
+            return {
+                "ok": True,
+                "status": binding_status,
+                "network": "base",
+                "address": response_address,
+            }
+        except urllib.error.HTTPError as exc:
+            payload = _decode_onboarding_response(exc.read(65_536))
+            if exc.code >= 500 and attempt + 1 < max_attempts:
+                continue
+            return {
+                "ok": False,
+                "status": _onboarding_error_code(payload, "service_error"),
+                "retryable": exc.code >= 500,
+            }
+        except (urllib.error.URLError, TimeoutError, OSError):
+            if attempt + 1 < max_attempts:
+                continue
+            return {"ok": False, "status": "network_error", "retryable": True}
+    return {"ok": False, "status": "network_error", "retryable": True}
+
+
+def _bind_invite_after_evm_onboard(
+    invite: str,
+    evm_onboard_result: dict[str, object] | None,
+    *,
+    api_url: str | None = None,
+    opener: object = urllib.request.urlopen,
+) -> dict[str, object] | None:
+    if not invite.strip():
+        return None
+    if not isinstance(evm_onboard_result, dict) or not evm_onboard_result.get("ok"):
+        return {"ok": False, "status": "pending_evm_wallet", "retryable": True}
+    address = str(evm_onboard_result.get("address") or "").strip()
+    if not address:
+        return {"ok": False, "status": "pending_evm_wallet", "retryable": True}
+    return _bind_welcome_invite(
+        invite,
+        address,
+        api_url=api_url,
+        opener=opener,
+    )
+
+
+def _invite_binding_warning(binding_result: dict[str, object]) -> str:
+    """Describe a failed invite bind without claiming it can always be retried."""
+    status = str(binding_result.get("status") or "unknown")
+    if status == "invite_already_bound":
+        return (
+            "warning: the welcome invite is already bound to a different Base "
+            "wallet and cannot be used with this wallet. Status: "
+            + status
+        )
+    if binding_result.get("retryable") is True:
+        return (
+            "warning: the welcome invite was not bound; the invite remains "
+            "available for a safe retry. Status: "
+            + status
+        )
+    return "warning: the welcome invite was not bound and cannot be retried. Status: " + status
+
+
 def main() -> None:
     args = build_parser().parse_args()
     source_package_root = Path(args.package_root).expanduser().resolve()
@@ -909,6 +1066,7 @@ def main() -> None:
         wdk_evm_root = source_wdk_evm_root
 
     install_config_script = package_root / "scripts" / "install_openclaw_local_config.py"
+    install_sealed_keys_script = package_root / "scripts" / "install_openclaw_sealed_keys.py"
     if args.install_from_runtime:
         default_source_env_path = source_package_root / ".env"
         default_source_venv_path = source_package_root / ".venv"
@@ -923,7 +1081,7 @@ def main() -> None:
     env_created = _ensure_env_file(env_path, env_example_path)
     boot_key_file_env_updated = _ensure_runtime_boot_key_file_env(env_path)
     flash_bridge_env = _ensure_flash_bridge_env(env_path, package_root)
-    config_created = _ensure_openclaw_config(config_path)
+    config_created = _ensure_openclaw_config(config_path) if args.configure_openclaw else False
 
     python_bin = Path(sys.executable)
     venv_created = False
@@ -988,23 +1146,33 @@ def main() -> None:
     pending_env = _pending_env_names() if backend_enabled else []
     configured = False
     configure_stdout = ""
+    sealed_keys_result: dict[str, object] | None = None
     solana_onboard_result: dict[str, object] | None = None
     evm_onboard_result: dict[str, object] | None = None
+    invite_binding_result: dict[str, object] | None = None
     if backend_enabled and not pending_env and not args.dry_run:
-        result = subprocess.run(
-            _build_next_steps(
-                python_bin,
-                install_config_script,
-                args,
-                package_root=package_root,
-                extension_path=extension_path,
-            ),
+        sealed_result = subprocess.run(
+            [str(python_bin), str(install_sealed_keys_script)],
             capture_output=True,
             text=True,
             check=True,
         )
-        configured = True
-        configure_stdout = result.stdout
+        sealed_keys_result = json.loads(sealed_result.stdout)
+        if args.configure_openclaw:
+            result = subprocess.run(
+                _build_next_steps(
+                    python_bin,
+                    install_config_script,
+                    args,
+                    package_root=package_root,
+                    extension_path=extension_path,
+                ),
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            configured = True
+            configure_stdout = result.stdout
         solana_onboard_result = _bootstrap_solana_wallet(
             python_bin,
             package_root,
@@ -1027,6 +1195,21 @@ def main() -> None:
                 file=sys.stderr,
             )
 
+    if args.invite.strip():
+        if args.dry_run:
+            invite_binding_result = {
+                "ok": False,
+                "status": "skipped_dry_run",
+                "retryable": True,
+            }
+        else:
+            invite_binding_result = _bind_invite_after_evm_onboard(
+                args.invite,
+                evm_onboard_result,
+            )
+        if invite_binding_result and not invite_binding_result.get("ok"):
+            print(_invite_binding_warning(invite_binding_result), file=sys.stderr)
+
     print(
         json.dumps(
             {
@@ -1037,6 +1220,7 @@ def main() -> None:
                 "flash_bridge_env": flash_bridge_env,
                 "config_path": str(config_path),
                 "config_created": config_created,
+                "configure_openclaw": bool(args.configure_openclaw),
                 "package_root": str(package_root),
                 "extension_path": str(extension_path),
                 "wdk_btc_root": str(wdk_btc_root),
@@ -1051,8 +1235,10 @@ def main() -> None:
                 "runtime_sync": runtime_sync,
                 "configured": configured,
                 "pending_env": pending_env,
+                "sealed_keys": sealed_keys_result,
                 "solana_wallet": solana_onboard_result,
                 "evm_wallet": evm_onboard_result,
+                "invite_binding": invite_binding_result,
                 "next_configure_command": _build_next_steps(
                     python_bin,
                     install_config_script,

package/agent-wallet/scripts/install_openclaw_local_config.py

@@ -271,7 +271,10 @@ def _maybe_install_sealed_keys() -> str | None:
         updates["wdk_evm_wallet_password"] = secrets.token_urlsafe(24)
     if not updates:
         return None
-    return str(seal_keys(boot_key, {**existing, **updates}))
+    merged = {**existing, **updates}
+    if merged == existing:
+        return str(sealed_path)
+    return str(seal_keys(boot_key, merged))
 
 
 def _require_hardened_runtime_secrets(backend: str) -> str | None:

package/agent-wallet/scripts/install_openclaw_sealed_keys.py

@@ -94,15 +94,19 @@ def main() -> None:
             "and/or SOLANA_AGENT_PRIVATE_KEY in the environment."
         )
 
-    path = seal_keys(boot_key, secrets)
+    changed = not sealed_path.exists() or secrets != existing
+    path = seal_keys(boot_key, secrets) if changed else sealed_path
     print(
         json.dumps(
             {
                 "ok": True,
                 "path": str(path),
                 "stored_keys": sorted(secrets.keys()),
-                "updated_keys": sorted(set(updates.keys()) | set(generated_keys)),
+                "updated_keys": (
+                    sorted(set(updates.keys()) | set(generated_keys)) if changed else []
+                ),
                 "replaced": bool(args.replace),
+                "changed": changed,
             },
             indent=2,
         )

package/bin/lib/evm-daemon.mjs

@@ -0,0 +1,375 @@
+// Best-effort stop of the wdk-evm-wallet daemon that belongs to the wallet
+// home being updated. The installer never trusts /health alone: the reported
+// PID must also own the local listening socket and run from a wdk-evm-wallet
+// working directory. Every failure is advisory and leaves the process alone.
+import fs from "node:fs";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const DEFAULT_SERVICE_URL = "http://127.0.0.1:8081";
+const STOP_TIMEOUT_MS = 10000;
+const KILL_TIMEOUT_MS = 5000;
+const LOCAL_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+
+function healthUrl(serviceUrl) {
+  return `${String(serviceUrl).replace(/\/+$/, "")}/health`;
+}
+
+function expandHome(value, env = process.env) {
+  const raw = String(value || "").trim();
+  const home = String(env.HOME || os.homedir()).trim() || os.homedir();
+  if (raw === "~") return home;
+  if (raw.startsWith("~/")) return path.join(home, raw.slice(2));
+  return raw;
+}
+
+export function daemonTakeoverDisabled(env = process.env) {
+  return ["1", "true", "yes", "on"].includes(
+    String(env.OPENCLAW_EVM_DISABLE_DAEMON_TAKEOVER || "").trim().toLowerCase(),
+  );
+}
+
+export function isLoopbackServiceUrl(serviceUrl) {
+  try {
+    const parsed = new URL(serviceUrl);
+    return parsed.protocol === "http:" && LOCAL_HOSTS.has(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+
+export function expectedDataDirFor(env = process.env) {
+  const configured = String(env.WDK_EVM_DATA_DIR || "").trim();
+  if (configured) return path.resolve(expandHome(configured, env));
+  const home = expandHome(env.OPENCLAW_HOME || path.join(env.HOME || os.homedir(), ".openclaw"), env);
+  return path.resolve(home, "wdk-evm-wallet");
+}
+
+function samePath(left, right) {
+  if (!left || !right) return false;
+  try {
+    return path.resolve(expandHome(left)) === path.resolve(expandHome(right));
+  } catch {
+    return false;
+  }
+}
+
+function readJsonFile(pathname) {
+  try {
+    return { present: true, valid: true, value: JSON.parse(fs.readFileSync(pathname, "utf8")) };
+  } catch (error) {
+    if (error?.code === "ENOENT") return { present: false, valid: true, value: null };
+    return { present: true, valid: false, value: null };
+  }
+}
+
+function readServiceOwner(dataDir) {
+  return readJsonFile(path.join(dataDir, "service-owner.json"));
+}
+
+function runLsof(args, env = process.env) {
+  const result = spawnSync("lsof", args, {
+    encoding: "utf8",
+    timeout: 5000,
+    env,
+  });
+  if (result.error) return null;
+  // lsof uses status 1 when no rows match. That is a valid empty result.
+  if (![0, 1].includes(result.status)) return null;
+  return String(result.stdout || "");
+}
+
+function parsePids(raw) {
+  return [...new Set(
+    String(raw || "")
+      .split(/\s+/)
+      .filter((token) => /^\d+$/.test(token))
+      .map((token) => Number(token))
+      .filter((pid) => Number.isInteger(pid) && pid > 0),
+  )];
+}
+
+export function inspectDaemonProcess(pid, port, env = process.env) {
+  const listenerOutput = runLsof(
+    ["-nP", "-t", "-iTCP:" + String(port), "-sTCP:LISTEN"],
+    env,
+  );
+  const cwdOutput = runLsof(["-a", "-p", String(pid), "-d", "cwd", "-Fn"], env);
+  if (listenerOutput === null || cwdOutput === null) {
+    return { available: false, listenerPids: [], cwd: "" };
+  }
+  const cwd = cwdOutput
+    .split(/\r?\n/)
+    .find((line) => line.startsWith("n"))
+    ?.slice(1)
+    .trim() || "";
+  return {
+    available: true,
+    listenerPids: parsePids(listenerOutput),
+    cwd,
+  };
+}
+
+function cwdLooksLikeEvmDaemon(cwd) {
+  if (!cwd) return false;
+  try {
+    return path.basename(path.resolve(cwd)) === "wdk-evm-wallet";
+  } catch {
+    return false;
+  }
+}
+
+function ownerMatches({ ownerState, health, pid, port, expectedDataDir }) {
+  if (!ownerState.valid) return false;
+  if (!ownerState.present) return true;
+  const owner = ownerState.value;
+  if (!owner || typeof owner !== "object") return false;
+  return (
+    Number(owner.pid) === pid &&
+    Number(owner.port) === port &&
+    samePath(owner.data_dir, expectedDataDir) &&
+    String(owner.instance_id || "") === String(health.instanceId || "")
+  );
+}
+
+export function classifyDaemonHealth(
+  health,
+  {
+    expectedDataDir,
+    port,
+    inspection = { available: false, listenerPids: [], cwd: "" },
+    ownerState = { present: false, valid: true, value: null },
+  } = {},
+) {
+  if (!health || typeof health !== "object") {
+    return { stoppable: false, reason: "not_running", pid: 0 };
+  }
+  if (health.service !== "wdk-evm-wallet") {
+    return { stoppable: false, reason: "foreign_service", pid: 0 };
+  }
+  const reportedDataDir = String(health.dataDir || "").trim();
+  if (!reportedDataDir || !samePath(reportedDataDir, expectedDataDir)) {
+    return { stoppable: false, reason: "foreign_vault", pid: 0 };
+  }
+  const pid = typeof health.pid === "number" ? health.pid : Number.NaN;
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return { stoppable: false, reason: "no_pid", pid: 0 };
+  }
+  if (!inspection.available) {
+    return { stoppable: false, reason: "process_inspection_unavailable", pid };
+  }
+  if (!inspection.listenerPids.includes(pid)) {
+    return { stoppable: false, reason: "pid_not_listener", pid };
+  }
+  if (!cwdLooksLikeEvmDaemon(inspection.cwd)) {
+    return { stoppable: false, reason: "foreign_process", pid };
+  }
+  if (!ownerMatches({ ownerState, health, pid, port, expectedDataDir })) {
+    return { stoppable: false, reason: "owner_mismatch", pid };
+  }
+  return { stoppable: true, reason: "stoppable", pid };
+}
+
+export function readDaemonHealth(serviceUrl, timeoutMs = 1500) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (value) => {
+      if (!settled) {
+        settled = true;
+        resolve(value);
+      }
+    };
+    const request = http.get(healthUrl(serviceUrl), { timeout: timeoutMs }, (response) => {
+      if (response.statusCode !== 200) {
+        response.resume();
+        done(null);
+        return;
+      }
+      let raw = "";
+      response.setEncoding("utf8");
+      response.on("data", (chunk) => {
+        raw += chunk;
+      });
+      response.on("end", () => {
+        try {
+          done(JSON.parse(raw));
+        } catch {
+          done(null);
+        }
+      });
+    });
+    request.on("timeout", () => {
+      request.destroy();
+      done(null);
+    });
+    request.on("error", () => done(null));
+  });
+}
+
+function processExists(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+
+function processIsSignalable(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function processStillMatches(pid, port, expectedDataDir, ownerState, env) {
+  const inspection = inspectDaemonProcess(pid, port, env);
+  if (
+    !inspection.available ||
+    !inspection.listenerPids.includes(pid) ||
+    !cwdLooksLikeEvmDaemon(inspection.cwd)
+  ) {
+    return false;
+  }
+  if (!ownerState.valid || !ownerState.present) return false;
+  const owner = ownerState.value;
+  return (
+    Number(owner?.pid) === pid &&
+    Number(owner?.port) === port &&
+    samePath(owner?.data_dir, expectedDataDir)
+  );
+}
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+async function waitForExit(pid, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!processExists(pid)) return true;
+    await sleep(300);
+  }
+  return !processExists(pid);
+}
+
+export async function stopLocalEvmDaemon({ serviceUrl, env = process.env } = {}) {
+  if (daemonTakeoverDisabled(env)) {
+    return { attempted: false, stopped: false, reason: "takeover_disabled", pid: 0 };
+  }
+  const url =
+    String(env.WDK_EVM_SERVICE_URL || serviceUrl || DEFAULT_SERVICE_URL).trim() ||
+    DEFAULT_SERVICE_URL;
+  if (!isLoopbackServiceUrl(url)) {
+    return { attempted: false, stopped: false, reason: "non_local_service_url", pid: 0 };
+  }
+
+  const parsed = new URL(url);
+  const port = Number(parsed.port || 80);
+  const expectedDataDir = expectedDataDirFor(env);
+  const health = await readDaemonHealth(url);
+  const reportedPid = Number(health?.pid || 0);
+  const inspection =
+    Number.isInteger(reportedPid) && reportedPid > 0
+      ? inspectDaemonProcess(reportedPid, port, env)
+      : { available: false, listenerPids: [], cwd: "" };
+  const ownerState = readServiceOwner(expectedDataDir);
+  const verdict = classifyDaemonHealth(health, {
+    expectedDataDir,
+    port,
+    inspection,
+    ownerState,
+  });
+  if (!verdict.stoppable) {
+    return { attempted: false, stopped: false, reason: verdict.reason, pid: verdict.pid };
+  }
+  if (!processIsSignalable(verdict.pid)) {
+    return { attempted: false, stopped: false, reason: "pid_not_signalable", pid: verdict.pid };
+  }
+  // Close the remaining PID-reuse window as much as portable macOS/Linux APIs
+  // allow by rechecking the listener immediately before the signal.
+  const finalInspection = inspectDaemonProcess(verdict.pid, port, env);
+  if (
+    !finalInspection.available ||
+    !finalInspection.listenerPids.includes(verdict.pid) ||
+    !cwdLooksLikeEvmDaemon(finalInspection.cwd)
+  ) {
+    return { attempted: false, stopped: false, reason: "identity_changed", pid: verdict.pid };
+  }
+  try {
+    process.kill(verdict.pid, "SIGTERM");
+  } catch (error) {
+    return {
+      attempted: true,
+      stopped: false,
+      reason: `signal_failed:${error?.code || "unknown"}`,
+      pid: verdict.pid,
+    };
+  }
+  if (await waitForExit(verdict.pid, STOP_TIMEOUT_MS)) {
+    return { attempted: true, stopped: true, reason: "stopped", pid: verdict.pid };
+  }
+
+  // A hard stop is only allowed when the exact same owned process still owns
+  // the socket. Missing owner evidence or any identity change fails closed.
+  if (!processStillMatches(verdict.pid, port, expectedDataDir, ownerState, env)) {
+    return { attempted: true, stopped: false, reason: "still_running_unverified", pid: verdict.pid };
+  }
+  try {
+    process.kill(verdict.pid, "SIGKILL");
+  } catch (error) {
+    if (error?.code !== "ESRCH") {
+      return {
+        attempted: true,
+        stopped: false,
+        reason: `kill_failed:${error?.code || "unknown"}`,
+        pid: verdict.pid,
+      };
+    }
+  }
+  const stopped = await waitForExit(verdict.pid, KILL_TIMEOUT_MS);
+  return {
+    attempted: true,
+    stopped,
+    reason: stopped ? "killed" : "still_running",
+    pid: verdict.pid,
+  };
+}
+
+// The install and rollback paths are synchronous. Run the bounded async stop
+// worker in a short-lived subprocess rather than making the CLI lifecycle async.
+export function stopLocalEvmDaemonSync({ env = process.env } = {}) {
+  const fallback = { attempted: false, stopped: false, reason: "subprocess_failed", pid: 0 };
+  try {
+    const result = spawnSync(process.execPath, [fileURLToPath(import.meta.url), "--stop"], {
+      encoding: "utf8",
+      timeout: STOP_TIMEOUT_MS + KILL_TIMEOUT_MS + 5000,
+      env,
+    });
+    if (result.status !== 0 || !result.stdout) return fallback;
+    return JSON.parse(result.stdout.trim());
+  } catch {
+    return fallback;
+  }
+}
+
+if (
+  process.argv[1] &&
+  fileURLToPath(import.meta.url) === process.argv[1] &&
+  process.argv.includes("--stop")
+) {
+  stopLocalEvmDaemon()
+    .then((result) => {
+      process.stdout.write(JSON.stringify(result));
+      process.exit(0);
+    })
+    .catch(() => {
+      process.stdout.write(
+        JSON.stringify({ attempted: false, stopped: false, reason: "worker_failed", pid: 0 }),
+      );
+      process.exit(0);
+    });
+}