perp-cli 0.9.7 → 0.11.0

package/dist/config.d.ts

@@ -5,6 +5,15 @@ export type Exchange = "pacifica" | "hyperliquid" | "lighter" | "aster";
  * Returns null if no key is configured.
  */
 export declare function tryLoadPrivateKey(exchange: Exchange, pkOverride?: string, walletName?: string): Promise<string | null>;
+/**
+ * Resolve an OWS wallet name to a signer-ready marker.
+ * Returns the OWS wallet name prefixed with "ows:" so callers can detect OWS mode.
+ */
+export declare function resolveOwsWallet(walletName: string): string | null;
+/** Check if a key string represents an OWS wallet reference. */
+export declare function isOwsKey(key: string): boolean;
+/** Extract OWS wallet name from an ows: prefixed key string. */
+export declare function getOwsWalletName(key: string): string;
 export declare function loadPrivateKey(exchange: Exchange, pkOverride?: string, walletName?: string): Promise<string>;
 export declare function parseSolanaKeypair(input: string): Keypair;
 export declare function isEvmPrivateKey(input: string): boolean;

package/dist/config.js

@@ -3,6 +3,8 @@ import bs58 from "bs58";
 import chalk from "chalk";
 import { resolve } from "path";
 import { existsSync, readFileSync } from "fs";
+import { createRequire } from "node:module";
+const _require = createRequire(import.meta.url);
 /**
  * Try to load a private key without throwing if none is found.
  * Returns null if no key is configured.
@@ -15,9 +17,40 @@ export async function tryLoadPrivateKey(exchange, pkOverride, walletName) {
         return null;
     }
 }
+/**
+ * Resolve an OWS wallet name to a signer-ready marker.
+ * Returns the OWS wallet name prefixed with "ows:" so callers can detect OWS mode.
+ */
+export function resolveOwsWallet(walletName) {
+    try {
+        const { getWallet } = _require("@open-wallet-standard/core");
+        getWallet(walletName); // throws if not found
+        return `ows:${walletName}`;
+    }
+    catch {
+        return null;
+    }
+}
+/** Check if a key string represents an OWS wallet reference. */
+export function isOwsKey(key) {
+    return key.startsWith("ows:");
+}
+/** Extract OWS wallet name from an ows: prefixed key string. */
+export function getOwsWalletName(key) {
+    return key.slice(4);
+}
 export async function loadPrivateKey(exchange, pkOverride, walletName) {
-    // 0. Wallet name override (--wallet flag)
+    // 0a. OWS wallet (--ows flag sets walletName with "ows:" prefix)
+    if (walletName?.startsWith("ows:")) {
+        return walletName; // pass through — adapters detect the ows: prefix
+    }
+    // 0b. Wallet name override (--wallet flag) — check OWS first, then local
     if (walletName) {
+        // Try OWS vault
+        const owsKey = resolveOwsWallet(walletName);
+        if (owsKey)
+            return owsKey;
+        // Fall back to local wallets
         const { getWalletKeyByName } = await import("./commands/wallet.js");
         const key = getWalletKeyByName(walletName);
         if (!key)
@@ -27,7 +60,20 @@ export async function loadPrivateKey(exchange, pkOverride, walletName) {
     // 1. CLI flag
     if (pkOverride)
         return pkOverride;
-    // 2. Exchange-specific env vars
+    // 2. OWS active wallet (highest priority after explicit flags)
+    try {
+        const { loadSettings } = await import("./settings.js");
+        const settings = loadSettings();
+        if (settings.owsActiveWallet) {
+            const owsKey = resolveOwsWallet(settings.owsActiveWallet);
+            if (owsKey)
+                return owsKey;
+        }
+    }
+    catch {
+        // settings module not available, skip
+    }
+    // 3. Exchange-specific env vars
     const envMap = {
         pacifica: ["PACIFICA_PRIVATE_KEY", "pk"],
         hyperliquid: ["HYPERLIQUID_PRIVATE_KEY", "HL_PRIVATE_KEY"],
@@ -38,10 +84,10 @@ export async function loadPrivateKey(exchange, pkOverride, walletName) {
         if (process.env[envVar])
             return process.env[envVar];
     }
-    // 3. Generic fallback
+    // 4. Generic fallback
     if (process.env.PRIVATE_KEY)
         return process.env.PRIVATE_KEY;
-    // 4. Active wallet from wallets.json
+    // 5. Legacy: Active wallet from wallets.json
     try {
         const { getActiveWalletKey } = await import("./commands/wallet.js");
         const walletKey = getActiveWalletKey(exchange);
@@ -56,12 +102,12 @@ export async function loadPrivateKey(exchange, pkOverride, walletName) {
     if (existsSync(keyFile)) {
         return readFileSync(keyFile, "utf-8").trim();
     }
-    throw new Error(`No private key configured for ${exchange}.\n\n` +
-        `  Quick start:  ${chalk.cyan("perp setup")}\n\n` +
+    throw new Error(`No wallet configured for ${exchange}.\n\n` +
+        `  Quick start:  ${chalk.cyan("perp wallet generate")}\n\n` +
         `  Or manually:\n` +
-        `    perp wallet set ${exchange} <key>\n` +
-        `    ${envMap[exchange][0]}=<key> (env var)\n` +
-        `    --private-key <key> (per-command)`);
+        `    perp wallet import <key>     Import key to OWS vault\n` +
+        `    perp wallet set ${exchange} <key>  Legacy: set env var\n` +
+        `    --private-key <key>          Per-command override`);
 }
 export function parseSolanaKeypair(input) {
     // Try base58 first

package/dist/exchanges/aster.js

@@ -457,7 +457,8 @@ export class AsterAdapter {
         }
         if (!res.ok) {
             const text = await res.text();
-            throw new Error(`${method} ${path} failed (${res.status}): ${text.slice(0, 200)}`);
+            const clean = text.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim().slice(0, 120);
+            throw new Error(`${method} ${path} failed (${res.status}): ${clean}`);
         }
         return res.json();
     }

package/dist/exchanges/hyperliquid.d.ts

@@ -5,6 +5,7 @@ export declare class HyperliquidAdapter implements ExchangeAdapter {
     readonly name = "hyperliquid";
     readonly chain = "evm";
     readonly aliases: readonly ["hl"];
+    readonly isUnifiedAccount = true;
     private sdk;
     private _address;
     private _privateKey;

package/dist/exchanges/hyperliquid.js

@@ -4,6 +4,7 @@ export class HyperliquidAdapter {
     name = "hyperliquid";
     chain = "evm";
     aliases = ["hl"];
+    isUnifiedAccount = true;
     sdk;
     _address;
     _privateKey;
@@ -54,6 +55,7 @@ export class HyperliquidAdapter {
     /** Inject an external EVM signer. Call before init() to skip LocalEvmSigner creation. */
     setSigner(signer) {
         this._evmSigner = signer;
+        this._address = signer.getAddress();
     }
     async init() {
         // Suppress "WebSocket connected" noise from hyperliquid SDK
@@ -70,6 +72,9 @@ export class HyperliquidAdapter {
             this._evmSigner = await LocalEvmSigner.create(this._privateKey);
             this._address = this._evmSigner.getAddress();
         }
+        else if (this._evmSigner && !this._address) {
+            this._address = this._evmSigner.getAddress();
+        }
         // Build asset index map
         await this._loadAssetMap();
     }

package/dist/exchanges/interface.d.ts

@@ -66,6 +66,8 @@ export interface ExchangeAdapter {
     readonly name: string;
     readonly chain?: string;
     readonly aliases?: readonly string[];
+    /** True if perp and spot share the same balance (e.g., Hyperliquid). False if separate accounts (e.g., Lighter). */
+    readonly isUnifiedAccount?: boolean;
     init?(): Promise<void>;
     getMarkets(): Promise<ExchangeMarketInfo[]>;
     getOrderbook(symbol: string): Promise<{

package/dist/exchanges/lighter-spot.js

@@ -528,8 +528,11 @@ export class LighterSpotAdapter {
         for (const [k, v] of Object.entries(params))
             url.searchParams.set(k, v);
         const res = await fetch(url.toString());
-        if (!res.ok)
-            throw new Error(`GET ${path} failed (${res.status}): ${await res.text()}`);
+        if (!res.ok) {
+            const text = await res.text();
+            const clean = text.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim().slice(0, 120);
+            throw new Error(`GET ${path} failed (${res.status}): ${clean}`);
+        }
         return res.json();
     }
     async _restGetAuth(path, params) {

package/dist/exchanges/lighter.js

@@ -64,6 +64,7 @@ export class LighterAdapter {
     /** Inject an external EVM signer. Call before init() to skip LocalEvmSigner creation. */
     setSigner(signer) {
         this._evmSigner = signer;
+        this._address = signer.getAddress();
     }
     async init() {
         // Initialize EVM signer if not externally injected (skip if no key — read-only mode)
@@ -71,6 +72,9 @@ export class LighterAdapter {
             this._evmSigner = await LocalEvmSigner.create(this._evmKey);
             this._address = this._evmSigner.getAddress();
         }
+        else if (this._evmSigner && !this._address) {
+            this._address = this._evmSigner.getAddress();
+        }
         // Fetch account index from REST API (skip if no address — read-only mode)
         if (!this._address) {
             await this._refreshMarketMap();
@@ -961,8 +965,11 @@ export class LighterAdapter {
                 is_external_deposit: "true",
             }),
         });
-        if (!res.ok)
-            throw new Error(`createIntentAddress failed: ${await res.text()}`);
+        if (!res.ok) {
+            const text = await res.text();
+            const clean = text.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim().slice(0, 120);
+            throw new Error(`createIntentAddress failed: ${clean}`);
+        }
         return res.json();
     }
     /**
@@ -1035,8 +1042,11 @@ export class LighterAdapter {
         for (const [k, v] of Object.entries(params))
             url.searchParams.set(k, v);
         const res = await fetch(url.toString());
-        if (!res.ok)
-            throw new Error(`GET ${path} failed (${res.status}): ${await res.text()}`);
+        if (!res.ok) {
+            const text = await res.text();
+            const clean = text.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim().slice(0, 120);
+            throw new Error(`GET ${path} failed (${res.status}): ${clean}`);
+        }
         return res.json();
     }
     /** Generate a unique client order index (uint48). */

package/dist/guardrail/contracts.d.ts

@@ -0,0 +1,14 @@
+/**
+ * DEX contract whitelist for perp-guardrail policy executable.
+ * Keyed by CAIP-2 chain ID → array of allowed contract/program addresses.
+ */
+export declare const USDC_ADDRESSES: Record<string, string>;
+export declare const ALLOWED_CONTRACTS: Record<string, string[]>;
+export declare const ALLOWED_CHAINS: string[];
+export declare const DEFAULT_LIMITS: {
+    max_tx_usd: number;
+    max_daily_usd: number;
+    max_withdraw_usd: number;
+    max_daily_withdraw_usd: number;
+};
+export declare const DANGEROUS_SELECTORS: string[];

package/dist/guardrail/contracts.js

@@ -0,0 +1,72 @@
+/**
+ * DEX contract whitelist for perp-guardrail policy executable.
+ * Keyed by CAIP-2 chain ID → array of allowed contract/program addresses.
+ */
+// ── Pacifica (Solana) ──
+const PACIFICA_MAINNET = [
+    "PCFA5iYgmqK6MqPhWNKg7Yv7auX7VZ4Cx7T1eJyrAMH", // Pacifica program
+    "9Gdmhq4Gv1LnNMp7aiS1HSVd7pNnXNMsbuXALCQRmGjY", // Central state
+    "72R843XwZxqWhsJceARQQTTbYtWy6Zw9et2YV4FpRHTa", // Vault
+    "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", // USDC mint
+    "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA", // SPL Token
+    "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL", // Associated Token
+    "11111111111111111111111111111111", // System Program
+    "CCTPV2vPZJS2u2BBsUoscuikbYjnpFmbFsvVuJdgUMQe", // CCTP V2 Token Messenger
+    "CCTPV2Sm4AdWt5296sk4P66VBZ7bEhcARwFaaS9YPbeC", // CCTP V2 Message Transmitter
+];
+const PACIFICA_TESTNET = [
+    "peRPsYCcB1J9jvrs29jiGdjkytxs8uHLmSPLKKP9ptm", // Testnet program
+    "2zPRq1Qvdq5A4Ld6WsH7usgCge4ApZRYfhhf5VAjfXxv", // Testnet central state
+    "5SDFdHZGTZbyRYu54CgmRkCGnPHC5pYaN27p7XGLqnBs", // Testnet vault
+    "USDPqRbLidFGufty2s3oizmDEKdqx7ePTqzDMbf5ZKM", // Testnet USDC
+    "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA",
+    "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL",
+    "11111111111111111111111111111111",
+];
+// ── Hyperliquid (Arbitrum + HyperCore) ──
+const HYPERLIQUID_CONTRACTS = [
+    "0xb21D281DEdb17AE5B501F6AA8256fe38C4e45757", // CctpForwarder (HyperCore)
+];
+// ── CCTP V2 (shared across EVM chains) ──
+const CCTP_V2_EVM = [
+    "0x28b5a0e9C621a5BadaA536219b3a228C8168cf5d", // TokenMessengerV2
+    "0x81D40F21F12A8F0E3252Bccb954D722d4c464B64", // MessageTransmitterV2
+];
+// ── USDC addresses ──
+export const USDC_ADDRESSES = {
+    "eip155:1": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", // Ethereum
+    "eip155:42161": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831", // Arbitrum
+    "eip155:8453": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", // Base
+};
+// ── Complete whitelist by CAIP-2 chain ──
+export const ALLOWED_CONTRACTS = {
+    // Solana mainnet
+    "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp": PACIFICA_MAINNET,
+    // Solana devnet
+    "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1": PACIFICA_TESTNET,
+    // Arbitrum (Hyperliquid deposits + CCTP)
+    "eip155:42161": [...HYPERLIQUID_CONTRACTS, ...CCTP_V2_EVM, USDC_ADDRESSES["eip155:42161"]],
+    // Hyperliquid signing domain (phantom chain for typed data)
+    "eip155:1337": [], // no contract calls, only typed data signing
+    // Base (CCTP bridge + USDC)
+    "eip155:8453": [...CCTP_V2_EVM, USDC_ADDRESSES["eip155:8453"]],
+    // Lighter (ZK rollup)
+    "eip155:304": [], // signing-based, no direct contract interaction
+    "eip155:300": [], // Lighter testnet
+    // Ethereum mainnet (CCTP + USDC)
+    "eip155:1": [...CCTP_V2_EVM, USDC_ADDRESSES["eip155:1"]],
+};
+// ── Allowed chain IDs (all chains our DEXes operate on) ──
+export const ALLOWED_CHAINS = Object.keys(ALLOWED_CONTRACTS);
+// ── Default guardrail limits ──
+export const DEFAULT_LIMITS = {
+    max_tx_usd: 1000,
+    max_daily_usd: 5000,
+    max_withdraw_usd: 500,
+    max_daily_withdraw_usd: 2000,
+};
+// ── Common blocked selectors ──
+export const DANGEROUS_SELECTORS = [
+    "0x095ea7b3", // approve(address,uint256) — unlimited token approvals
+    "0x23b872dd", // transferFrom(address,address,uint256)
+];

package/dist/guardrail/perp-guardrail.d.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * perp-guardrail — OWS Policy Engine custom executable.
+ *
+ * Protocol:
+ *   stdin  → PolicyContext JSON (from OWS engine)
+ *   stdout → PolicyResult JSON  {"allow": bool, "reason"?: string}
+ *
+ * Validates:
+ *   1. Contract address whitelist (per chain)
+ *   2. Per-transaction USD amount limit
+ *   3. Daily cumulative spending limit
+ *   4. Withdrawal limits (per-tx and daily)
+ *   5. Blocked function selectors (e.g. approve)
+ *   6. Allowed trading symbols
+ *
+ * Configuration is read from PolicyContext.policy_config:
+ *   { max_tx_usd, max_daily_usd, max_withdraw_usd, max_daily_withdraw_usd,
+ *     allowed_symbols?, block_selectors?, allowed_contracts?, allowed_chains? }
+ */
+export {};

package/dist/guardrail/perp-guardrail.js

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+/**
+ * perp-guardrail — OWS Policy Engine custom executable.
+ *
+ * Protocol:
+ *   stdin  → PolicyContext JSON (from OWS engine)
+ *   stdout → PolicyResult JSON  {"allow": bool, "reason"?: string}
+ *
+ * Validates:
+ *   1. Contract address whitelist (per chain)
+ *   2. Per-transaction USD amount limit
+ *   3. Daily cumulative spending limit
+ *   4. Withdrawal limits (per-tx and daily)
+ *   5. Blocked function selectors (e.g. approve)
+ *   6. Allowed trading symbols
+ *
+ * Configuration is read from PolicyContext.policy_config:
+ *   { max_tx_usd, max_daily_usd, max_withdraw_usd, max_daily_withdraw_usd,
+ *     allowed_symbols?, block_selectors?, allowed_contracts?, allowed_chains? }
+ */
+import { ALLOWED_CONTRACTS, ALLOWED_CHAINS, DEFAULT_LIMITS } from "./contracts.js";
+function deny(reason) {
+    return { allow: false, reason };
+}
+function allow() {
+    return { allow: true };
+}
+function weiToUsd(weiStr, ethPriceUsd) {
+    const wei = BigInt(weiStr || "0");
+    const ethValue = Number(wei) / 1e18;
+    return ethValue * ethPriceUsd;
+}
+// Well-known EVM function selectors
+const KNOWN_SELECTORS = {
+    "0x095ea7b3": "approve",
+    "0x23b872dd": "transferFrom",
+    "0xa9059cbb": "transfer",
+    "0x3ccfd60b": "withdraw",
+    "0x2e1a7d4d": "withdraw(uint256)",
+    "0xd0e30db0": "deposit",
+};
+function isWithdrawTx(data) {
+    if (!data || data === "0x")
+        return false;
+    const selector = data.slice(0, 10).toLowerCase();
+    return selector === "0x3ccfd60b" || selector === "0x2e1a7d4d";
+}
+function evaluate(ctx) {
+    const config = ctx.policy_config ?? {};
+    const maxTxUsd = config.max_tx_usd ?? DEFAULT_LIMITS.max_tx_usd;
+    const maxDailyUsd = config.max_daily_usd ?? DEFAULT_LIMITS.max_daily_usd;
+    const maxWithdrawUsd = config.max_withdraw_usd ?? maxTxUsd;
+    const maxDailyWithdrawUsd = config.max_daily_withdraw_usd ?? maxDailyUsd;
+    const contracts = config.allowed_contracts ?? ALLOWED_CONTRACTS;
+    const chains = config.allowed_chains ?? ALLOWED_CHAINS;
+    const ethPrice = config.eth_price_usd ?? 3500;
+    const blockSelectors = config.block_selectors ?? [];
+    // 1. Chain check
+    if (!chains.includes(ctx.chain_id)) {
+        return deny(`chain ${ctx.chain_id} not in allowed list`);
+    }
+    // 2. Contract whitelist (skip for signing-only chains like eip155:1337, eip155:304)
+    const chainContracts = contracts[ctx.chain_id];
+    if (chainContracts && chainContracts.length > 0 && ctx.transaction.to) {
+        const target = ctx.transaction.to.toLowerCase();
+        const allowed = chainContracts.map(a => a.toLowerCase());
+        if (!allowed.includes(target)) {
+            return deny(`contract ${ctx.transaction.to} not whitelisted for ${ctx.chain_id}`);
+        }
+    }
+    // 3. Blocked function selectors (e.g. approve, transferFrom)
+    if (blockSelectors.length > 0 && ctx.transaction.data && ctx.transaction.data !== "0x") {
+        const selector = ctx.transaction.data.slice(0, 10).toLowerCase();
+        if (blockSelectors.map(s => s.toLowerCase()).includes(selector)) {
+            const name = KNOWN_SELECTORS[selector] || selector;
+            return deny(`function ${name} is blocked by policy`);
+        }
+    }
+    // 4. Per-transaction amount
+    if (ctx.transaction.value && ctx.transaction.value !== "0") {
+        const txUsd = weiToUsd(ctx.transaction.value, ethPrice);
+        if (txUsd > maxTxUsd) {
+            return deny(`tx value $${txUsd.toFixed(2)} exceeds limit $${maxTxUsd}`);
+        }
+    }
+    // 5. Withdrawal-specific limits
+    if (isWithdrawTx(ctx.transaction.data)) {
+        if (ctx.transaction.value && ctx.transaction.value !== "0") {
+            const withdrawUsd = weiToUsd(ctx.transaction.value, ethPrice);
+            if (withdrawUsd > maxWithdrawUsd) {
+                return deny(`withdrawal $${withdrawUsd.toFixed(2)} exceeds per-tx limit $${maxWithdrawUsd}`);
+            }
+        }
+        // Daily withdrawal check uses same daily_total (OWS tracks cumulative)
+        if (ctx.spending.daily_total && ctx.spending.daily_total !== "0") {
+            const dailyUsd = weiToUsd(ctx.spending.daily_total, ethPrice);
+            if (dailyUsd > maxDailyWithdrawUsd) {
+                return deny(`daily withdrawals $${dailyUsd.toFixed(2)} exceeds limit $${maxDailyWithdrawUsd}`);
+            }
+        }
+    }
+    // 6. Daily spending limit (all operations)
+    if (ctx.spending.daily_total && ctx.spending.daily_total !== "0") {
+        const dailyUsd = weiToUsd(ctx.spending.daily_total, ethPrice);
+        if (dailyUsd > maxDailyUsd) {
+            return deny(`daily spending $${dailyUsd.toFixed(2)} exceeds limit $${maxDailyUsd}`);
+        }
+    }
+    return allow();
+}
+// ── Main: read stdin, evaluate, write stdout ──
+async function main() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(chunk);
+    }
+    const input = Buffer.concat(chunks).toString("utf-8").trim();
+    if (!input) {
+        process.stdout.write(JSON.stringify(deny("empty stdin")));
+        process.exit(0);
+    }
+    let ctx;
+    try {
+        ctx = JSON.parse(input);
+    }
+    catch {
+        process.stdout.write(JSON.stringify(deny("invalid JSON on stdin")));
+        process.exit(0);
+    }
+    const result = evaluate(ctx);
+    process.stdout.write(JSON.stringify(result));
+    process.exit(0);
+}
+main().catch((e) => {
+    process.stdout.write(JSON.stringify(deny(`internal error: ${e instanceof Error ? e.message : String(e)}`)));
+    process.exit(0);
+});

package/dist/index.js

@@ -10,7 +10,7 @@ config();
 import { Command } from "commander";
 import chalk from "chalk";
 import { Keypair } from "@solana/web3.js";
-import { tryLoadPrivateKey, parseSolanaKeypair } from "./config.js";
+import { tryLoadPrivateKey, parseSolanaKeypair, isOwsKey, getOwsWalletName } from "./config.js";
 import { PacificaAdapter } from "./exchanges/pacifica.js";
 import { HyperliquidAdapter } from "./exchanges/hyperliquid.js";
 import { resolveExchangeName } from "./exchanges/registry.js";
@@ -21,6 +21,7 @@ import { registerManageCommands } from "./commands/manage.js";
 // stream commands removed — WS feeds still used by dashboard/event-stream internally
 import { registerArbCommands } from "./commands/arb.js";
 import { registerWalletCommands } from "./commands/wallet.js";
+import { registerOwsCommands } from "./commands/ows.js";
 import { registerBridgeCommands } from "./commands/bridge.js";
 // deposit + withdraw merged into funds
 import { registerFundsCommands } from "./commands/funds.js";
@@ -60,6 +61,8 @@ program
     .option("--ndjson", "Output newline-delimited JSON (one object per line for streaming)")
     .option("--dry-run", "Simulate trades without executing (log as simulated)")
     .option("-w, --wallet <name>", "Use a specific wallet by name (from 'perp wallet list')")
+    .option("--ows <name>", "Use an OWS (Open Wallet Standard) wallet by name")
+    .option("--ows-key <token>", "OWS API key token (ows_key_...) for policy-gated agent access")
     .option("--dex <name>", "HIP-3 deployed perp dex name (Hyperliquid only)")
     .configureOutput({
     writeErr: (str) => {
@@ -90,8 +93,10 @@ function getExchange() {
 }
 async function getAdapter() {
     const opts = program.opts();
-    const walletName = opts.wallet;
-    // Skip cache when --wallet is specified (different wallet = different account)
+    const owsName = opts.ows;
+    const owsKeyToken = opts.owsKey || process.env.OWS_API_KEY;
+    const walletName = owsName ? `ows:${owsName}` : opts.wallet;
+    // Skip cache when --wallet/--ows is specified (different wallet = different account)
     if (!walletName && _adapter)
         return _adapter;
     const exchange = resolveExchangeAlias(opts.exchange);
@@ -99,6 +104,10 @@ async function getAdapter() {
     const isTestnet = network === "testnet";
     // Try to load key — null means no key configured (read-only mode)
     const pk = await tryLoadPrivateKey(exchange, opts.privateKey, walletName);
+    // OWS wallet detected — use OWS signers instead of raw keys
+    if (pk && isOwsKey(pk)) {
+        return _initWithOws(exchange, getOwsWalletName(pk), isTestnet, opts, owsKeyToken);
+    }
     switch (exchange) {
         case "pacifica": {
             const keypair = pk ? parseSolanaKeypair(pk) : Keypair.generate();
@@ -170,6 +179,44 @@ async function getAdapter() {
     }
     return _adapter;
 }
+/** Initialize adapter with OWS wallet signer injection. */
+async function _initWithOws(exchange, owsWalletName, isTestnet, opts, owsKeyToken) {
+    const { OwsEvmSigner } = await import("./signer/ows-evm.js");
+    const { OwsSolanaSigner } = await import("./signer/ows-solana.js");
+    // If an OWS API key token is provided, use it as passphrase → routes through policy engine
+    const passphrase = owsKeyToken || "";
+    switch (exchange) {
+        case "pacifica": {
+            const pacNetwork = (isTestnet ? "testnet" : "mainnet");
+            const settings = loadSettings();
+            const builderCode = process.env.PACIFICA_BUILDER_CODE || settings.referralCodes.pacifica || "PERPCLI";
+            const dummyKeypair = Keypair.generate();
+            _pacificaAdapter = new PacificaAdapter(dummyKeypair, pacNetwork, builderCode, true);
+            _pacificaAdapter.setSigner(OwsSolanaSigner.create(owsWalletName, passphrase));
+            _adapter = _pacificaAdapter;
+            return _adapter;
+        }
+        case "hyperliquid": {
+            _hlAdapter = new HyperliquidAdapter(undefined, isTestnet);
+            if (opts.dex)
+                _hlAdapter.setDex(opts.dex);
+            _hlAdapter.setSigner(OwsEvmSigner.create(owsWalletName, passphrase));
+            await _hlAdapter.init();
+            _adapter = _hlAdapter;
+            return _adapter;
+        }
+        case "lighter": {
+            const { LighterAdapter } = await import("./exchanges/lighter.js");
+            _lighterAdapter = new LighterAdapter("", isTestnet);
+            _lighterAdapter.setSigner(OwsEvmSigner.create(owsWalletName, passphrase));
+            await _lighterAdapter.init();
+            _adapter = _lighterAdapter;
+            return _adapter;
+        }
+        default:
+            throw new Error(`Unknown exchange: ${exchange}`);
+    }
+}
 // Sync wrapper for commands that need adapter (lazy init)
 function getAdapterSync() {
     if (!_adapter)
@@ -201,6 +248,7 @@ registerManageCommands(program, getAdapter, isJson, getPacificaAdapter);
 // stream commands removed
 registerArbCommands(program, isJson, getAdapterForExchange);
 registerWalletCommands(program, isJson);
+registerOwsCommands(program, isJson);
 registerBridgeCommands(program, isJson);
 registerFundsCommands(program, getAdapter, isJson, () => program.opts().network);
 // alert commands removed
@@ -632,6 +680,7 @@ if (rawArgs.length === 0 || (!hasSubcommand && !rawArgs.includes("-h") && !rawAr
             const hasEnvKey = !!(process.env.PRIVATE_KEY || process.env.PACIFICA_PRIVATE_KEY ||
                 process.env.HL_PRIVATE_KEY || process.env.HYPERLIQUID_PRIVATE_KEY ||
                 process.env.LIGHTER_PRIVATE_KEY);
+            const hasOwsWallet = !!settings.owsActiveWallet;
             // ── ASCII banner ──
             const banner = [
                 "",
@@ -645,9 +694,10 @@ if (rawArgs.length === 0 || (!hasSubcommand && !rawArgs.includes("-h") && !rawAr
                 chalk.gray(`  4 exchanges · 19 strategies · v${_pkg.version}`),
             ];
             console.log(banner.join("\n"));
-            if (!status.hasWallets && !hasEnvKey && !settings.defaultExchange) {
+            if (!status.hasWallets && !hasEnvKey && !hasOwsWallet && !settings.defaultExchange) {
                 // Fresh install — onboarding
                 console.log(chalk.yellow.bold("\n  ⚡ Get started:\n"));
+                console.log(`    ${chalk.cyan("perp wallet generate")}            create OWS encrypted wallet`);
                 console.log(`    ${chalk.cyan("perp setup")}                      setup wizard`);
                 console.log(chalk.gray(`\n  Explore without a wallet:`));
                 console.log(`    ${chalk.green("perp market mid BTC")}            quick price check`);

package/dist/mcp-server.js

@@ -878,11 +878,11 @@ server.tool("explain_command", "Explain what a perp CLI command does, its parame
         else if (category === "wallet") {
             explanation = {
                 command,
-                description: { show: "Show configured wallets with public addresses", list: "List configured wallets", balance: "Check on-chain USDC/SOL/ETH balances", generate: "Generate a new wallet keypair", import: "Import an existing private key", set: "Set private key for an exchange", use: "Set active wallet", remove: "Remove a wallet", rename: "Rename a wallet" }[sub] || `Wallet: ${sub}`,
+                description: { show: "Show configured wallets with public addresses", list: "List all wallets (OWS vault + legacy)", balance: "Check on-chain USDC/SOL/ETH balances", generate: "Generate a new OWS wallet (encrypted, multi-chain)", import: "Import key into OWS vault", migrate: "Migrate legacy wallets to OWS encrypted vault", set: "Set private key for an exchange (legacy)", use: "Set active wallet (OWS or legacy)", remove: "Remove a wallet", rename: "Rename a wallet", ows: "OWS vault management (create, list, info, delete)" }[sub] || `Wallet: ${sub}`,
                 parameters: [],
-                risks: sub === "generate" ? ["Store the private key securely — it cannot be recovered"] : sub === "remove" ? ["Wallet will be removed — ensure you have the private key backed up"] : [],
+                risks: sub === "generate" ? ["Save the mnemonic securely — it cannot be recovered. Keys are stored in ~/.ows/ encrypted vault."] : sub === "remove" ? ["Wallet will be removed — ensure you have backups"] : [],
                 category: "read",
-                relatedCommands: ["perp wallet show", "perp wallet balance"],
+                relatedCommands: ["perp wallet list", "perp wallet balance", "perp wallet ows list"],
             };
         }
         else if (category === "backtest") {
@@ -1124,17 +1124,19 @@ server.resource("cli_schema", "perp://schema", { mimeType: "application/json", d
                 },
             },
             wallet: {
-                description: "Wallet management",
+                description: "Wallet management (OWS encrypted vault + legacy)",
                 subcommands: {
                     show: { usage: "perp wallet show", description: "Show configured wallets with public addresses" },
-                    list: { usage: "perp wallet list", description: "List wallets" },
+                    list: { usage: "perp wallet list", description: "List all wallets (OWS vault + legacy)" },
                     balance: { usage: "perp wallet balance [name]", description: "On-chain balances" },
-                    generate: { usage: "perp wallet generate solana|evm", description: "Generate new wallet" },
-                    import: { usage: "perp wallet import solana|evm <privateKey>", description: "Import existing private key" },
-                    set: { usage: "perp wallet set <exchange> <key>", description: "Set private key for exchange" },
-                    use: { usage: "perp wallet use <name> [exchange]", description: "Set active wallet" },
+                    generate: { usage: "perp wallet generate [name]", description: "Generate new OWS wallet (encrypted, multi-chain)" },
+                    import: { usage: "perp wallet import <privateKey>", description: "Import key into OWS vault" },
+                    migrate: { usage: "perp wallet migrate", description: "Migrate legacy wallets to OWS vault" },
+                    set: { usage: "perp wallet set <exchange> <key>", description: "Set private key for exchange (legacy)" },
+                    use: { usage: "perp wallet use <name>", description: "Set active wallet (OWS or legacy)" },
                     remove: { usage: "perp wallet remove <name>", description: "Remove a wallet" },
                     rename: { usage: "perp wallet rename <oldName> <newName>", description: "Rename a wallet" },
+                    ows: { usage: "perp wallet ows <sub>", description: "OWS vault: create, list, info, delete, policy, key, fund, pay, setup" },
                 },
             },
             history: {