traderclaw-cli 1.0.85 → 1.0.87

package/bin/installer-step-engine.mjs

@@ -2214,21 +2214,38 @@ export class InstallerStepEngine {
   }
 
   buildSetupHandoff() {
-    const args = ["setup", "--url", this.options.orchestratorUrl || "https://api.traderclaw.ai"];
-    if (this.options.lane !== "event-driven") {
-      args.push("--skip-gateway-registration");
+    // Shell-safe single-quote wrapper: wraps value in '…' and escapes any embedded single quotes.
+    const shQuote = (v) => `'${String(v).replace(/'/g, "'\\''")}'`;
+
+    const cliName = this.modeConfig.cliName;
+    const orchestratorUrl = this.options.orchestratorUrl || "https://api.traderclaw.ai";
+    const apiKey = String(this.options.apiKey || "").trim();
+
+    // Build args in the user-facing convention:
+    //   traderclaw setup --api-key '…' --url '…' [--gateway-base-url '…'] [--skip-gateway-registration] [--referral-code '…']
+    const parts = [cliName, "setup"];
+
+    if (apiKey) {
+      parts.push("--api-key", shQuote(apiKey));
     }
+
+    parts.push("--url", shQuote(orchestratorUrl));
+
     const gatewayBaseUrl = this.options.gatewayBaseUrl || this.state.detected.funnelUrl || "";
     if (this.options.lane === "event-driven" && gatewayBaseUrl) {
-      args.push("--gateway-base-url", gatewayBaseUrl);
+      parts.push("--gateway-base-url", shQuote(gatewayBaseUrl));
+    }
+
+    if (this.options.lane !== "event-driven") {
+      parts.push("--skip-gateway-registration");
     }
 
     const ref = String(this.options.referralCode || "").trim();
     if (ref) {
-      args.push("--referral-code", ref);
+      parts.push("--referral-code", shQuote(ref));
     }
 
-    const command = [this.modeConfig.cliName, ...args].join(" ");
+    const command = parts.join(" ");
     const docs =
       "https://docs.traderclaw.ai/docs/installation#troubleshooting-session-expired-auth-errors-or-the-agent-logged-out";
     return {
@@ -2236,11 +2253,13 @@ export class InstallerStepEngine {
       command,
       title: "Ready to launch your agentic trading desk",
       message:
-        "Core install is complete. Final setup is intentionally handed off to your VPS shell so sensitive wallet prompts stay private. " +
-        "After setup, if the bot reports wallet proof / session errors: configure TRADERCLAW_WALLET_PRIVATE_KEY for the OpenClaw gateway service (systemd), not only in SSH — see " +
+        "Core install is complete. Run the command below in your VPS shell to complete authentication. " +
+        "The wallet private key is intentionally omitted — if your account has a linked wallet, traderclaw setup will prompt for it securely in the terminal (hidden input, key is never saved or sent). " +
+        "For automation or non-interactive environments use --wallet-private-key or the TRADERCLAW_WALLET_PRIVATE_KEY env var instead. " +
+        "After setup, configure TRADERCLAW_WALLET_PRIVATE_KEY for the OpenClaw gateway service (systemd) so the bot can sign challenges at runtime — not only in your SSH session. See " +
         docs,
       hint:
-        "Run the command in terminal, answer setup prompts, then restart gateway. If Telegram startup checks all fail, open the troubleshooting link in the message above.",
+        "Run the command in your terminal. If wallet proof is required, you will be prompted for the private key with hidden input. Then restart the gateway.",
       restartCommand: "openclaw gateway restart",
     };
   }

package/bin/openclaw-trader.mjs

@@ -214,6 +214,79 @@ async function confirm(question) {
   return answer.toLowerCase() === "y" || answer.toLowerCase() === "yes";
 }
 
+/**
+ * Prompt for the wallet private key with hidden input (no echo) when running in a TTY.
+ * Falls back to a visible prompt with a warning if raw mode is unavailable.
+ * Returns an empty string if the user presses Enter with no input.
+ */
+async function promptWalletPrivateKeyHidden() {
+  const isTTY = process.stdin.isTTY && process.stdout.isTTY;
+  if (!isTTY) return "";
+
+  print("  Your trading wallet private key is required to prove ownership of the linked wallet.");
+  print("  It is used only to sign a one-time challenge locally — it is NEVER sent to any server");
+  print("  and is NEVER written to openclaw.json or any file.");
+  print("  For automation, use --wallet-private-key or the TRADERCLAW_WALLET_PRIVATE_KEY env var instead.\n");
+
+  return new Promise((resolve) => {
+    let input = "";
+    let rawEnabled = false;
+
+    const cleanup = () => {
+      try {
+        if (rawEnabled && process.stdin.isTTY) {
+          process.stdin.setRawMode(false);
+        }
+      } catch {
+        // ignore
+      }
+      process.stdin.pause();
+      process.stdin.removeAllListeners("data");
+      process.stdin.removeAllListeners("end");
+    };
+
+    try {
+      process.stdin.setRawMode(true);
+      rawEnabled = true;
+    } catch {
+      // raw mode unavailable — fall through to visible prompt
+    }
+
+    if (rawEnabled) {
+      process.stdout.write("  Wallet private key (hidden, press Enter when done): ");
+      process.stdin.resume();
+      process.stdin.setEncoding("utf8");
+
+      process.stdin.on("data", (ch) => {
+        if (ch === "\r" || ch === "\n") {
+          process.stdout.write("\n");
+          cleanup();
+          resolve(input.trim());
+        } else if (ch === "\u0003") {
+          // Ctrl-C
+          process.stdout.write("\n");
+          cleanup();
+          resolve("");
+        } else if (ch === "\u007f" || ch === "\b") {
+          // backspace
+          if (input.length > 0) input = input.slice(0, -1);
+        } else {
+          input += ch;
+        }
+      });
+
+      process.stdin.once("end", () => {
+        cleanup();
+        resolve(input.trim());
+      });
+    } else {
+      // Raw mode unavailable; warn and fall back to visible prompt.
+      printWarn("  Note: terminal does not support hidden input — key will be visible as you type.");
+      prompt("  Wallet private key", "").then((val) => resolve(val.trim()));
+    }
+  });
+}
+
 async function httpRequest(url, opts = {}) {
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), opts.timeout ?? 10000);
@@ -640,10 +713,14 @@ async function establishSession(orchestratorUrl, pluginConfig, walletPrivateKeyI
 
   if (challenge.walletProofRequired) {
     printWarn("  Wallet proof required — this account already has a wallet.");
-    const walletPrivateKey = getRuntimeWalletPrivateKey(walletPrivateKeyInput);
+    let walletPrivateKey = getRuntimeWalletPrivateKey(walletPrivateKeyInput);
+    if (!walletPrivateKey) {
+      walletPrivateKey = await promptWalletPrivateKeyHidden();
+    }
     if (!walletPrivateKey) {
       printError(`  Wallet private key not available. Cannot prove wallet ownership.`);
       printError(`  Provide it via --wallet-private-key or env ${WALLET_PRIVATE_KEY_ENV} for local signing.`);
+      printError(`  If running interactively (TTY), you will be prompted automatically when proof is required.`);
       printSessionTroubleshootingHint();
       throw new Error("Wallet proof required but no private key configured.");
     }
@@ -2138,11 +2215,11 @@ function wizardHtml(defaults) {
         </div>
         <div style="margin-top:12px;" id="llmOauthBlock" class="hidden">
           <p class="muted" style="margin-bottom:12px;">
-            OAuth here is fully guided. After you choose OAuth, we start OpenClaw login automatically. Use the sign-in button below, then complete ChatGPT in this browser. You should not need to copy any code.
+            OAuth here is fully guided. After you choose OAuth, we start OpenClaw login automatically. Use the sign-in button below, then complete ChatGPT in this browser. If the redirect does not land automatically, you will be asked to paste the callback URL.
           </p>
           <div class="oauth-guide">
             <p class="muted" style="margin-top:0;">
-              <strong>Important:</strong> Complete the ChatGPT sign-in in this browser, then return to this tab. The wizard detects the result automatically.
+              <strong>Important:</strong> Complete the ChatGPT sign-in in this browser, then return to this tab. If the redirect does not finish on its own, paste the callback URL using the box below.
             </p>
             <p class="muted" style="margin-top:4px;font-size:13px;color:#7a8ba8;">
               <strong>Remote VPS?</strong> Forward port <code>1455</code> alongside the wizard port:
@@ -2152,13 +2229,13 @@ function wizardHtml(defaults) {
               <li class="oauth-step pending" id="oauthStepPrepare">Preparing ChatGPT sign-in...</li>
               <li class="oauth-step pending" id="oauthStepOpen">Open ChatGPT sign-in in this browser.</li>
               <li class="oauth-step pending" id="oauthStepComplete">Finish ChatGPT approval, then return here.</li>
-              <li class="oauth-step pending" id="oauthStepVerify">We detect completion automatically.</li>
+              <li class="oauth-step pending" id="oauthStepVerify">If the redirect does not complete, paste the callback URL below.</li>
             </ol>
             <div class="oauth-actions">
               <a id="oauthOpenUrlBtn" class="secondary" href="#" target="_blank" rel="noopener noreferrer" style="display:inline-block;padding:10px 14px;border-radius:8px;background:#2d7dff;color:#fff;text-decoration:none;font-weight:600;opacity:.55;pointer-events:none;">Open ChatGPT sign-in</a>
               <button type="button" id="oauthRetryBtn" class="secondary hidden">Try sign-in again</button>
             </div>
-            <p id="oauthFlowStatus" class="muted" style="margin-top:8px;" aria-live="polite">Choose OAuth and wait a moment. We will prepare your sign-in automatically.</p>
+            <p id="oauthFlowStatus" class="muted" style="margin-top:8px;" aria-live="polite">Choose OAuth and wait a moment. We will prepare your sign-in link.</p>
             <div id="oauthFallbackPaste" class="hidden" style="margin-top:12px;padding:12px;background:#111827;border:1px solid #334a87;border-radius:8px;">
               <p class="muted" style="margin:0 0 8px;font-size:13px;color:#ffcc70;">
                 <strong>Redirect didn't reach us?</strong> Copy the full URL from the error page in your browser (it starts with <code>http://localhost:1455/auth/callback?code=…</code>) and paste it below.
@@ -2448,7 +2525,7 @@ function wizardHtml(defaults) {
         setOauthStep(oauthStepOpen, "pending");
         setOauthStep(oauthStepComplete, "pending");
         setOauthStep(oauthStepVerify, "pending");
-        setOauthStatus("Choose OAuth and wait a moment. We will prepare your sign-in automatically.");
+        setOauthStatus("Choose OAuth and wait a moment. We will prepare your sign-in link.");
       }
 
       (function initLlmAuthDefaults() {
@@ -2521,7 +2598,7 @@ function wizardHtml(defaults) {
               setOauthStep(oauthStepComplete, "error");
               setOauthStep(oauthStepVerify, "error");
               setOauthStatus(
-                "Automatic OAuth session expired. This flow requires the wizard and OpenClaw on the same machine and the same browser. Click Try sign-in again.",
+                "OAuth session expired. This flow requires the wizard and OpenClaw on the same machine and browser. Click Try sign-in again.",
                 true,
               );
             } else {
@@ -2541,7 +2618,7 @@ function wizardHtml(defaults) {
               const elapsed = oauthFlowStartedAtMs > 0 ? Math.floor((Date.now() - oauthFlowStartedAtMs) / 1000) : 0;
               if (elapsed >= 90) {
                 setOauthStatus(
-                  "Still waiting for callback. Keep using this same browser on this same machine. If you opened OAuth on another computer, this automatic flow cannot complete.",
+                  "Still waiting for the callback. Make sure you are using this same browser and the 1455 port is forwarded (ssh -L 1455:127.0.0.1:1455). If the redirect does not land, paste the localhost:1455/auth/callback?… URL using the box below.",
                   true,
                 );
                 if (oauthRetryBtn) oauthRetryBtn.classList.remove("hidden");
@@ -2576,7 +2653,7 @@ function wizardHtml(defaults) {
           setOauthStep(oauthStepComplete, "error");
           setOauthStep(oauthStepVerify, "error");
           setOauthStatus(
-            errorText + " Automatic mode only works on the same machine and browser. Click Try sign-in again.",
+            errorText + " Make sure you are using the same browser and the 1455 port is forwarded. Click Try sign-in again.",
             true,
           );
           setOauthOpenButton("");
@@ -3102,7 +3179,7 @@ function wizardHtml(defaults) {
           setOauthStep(oauthStepOpen, "done");
           setOauthStep(oauthStepComplete, "active");
           setOauthStep(oauthStepVerify, "active");
-          setOauthStatus("Complete ChatGPT approval in this browser, then return here. We detect completion automatically.");
+          setOauthStatus("After approval, return here. If the tab does not finish, paste the localhost:1455/auth/callback?… URL using the box below.");
           showFallbackPasteAfterDelay(15_000);
         });
       }
@@ -4091,7 +4168,11 @@ Setup options:
   --api-key, -k      API key (skip interactive prompt)
   --url, -u          Orchestrator URL (skip interactive prompt)
   --user-id          External user ID for signup
-  --wallet-private-key  Optional base58 private key for wallet proof flow (runtime only, never saved)
+  --wallet-private-key  Base58 private key for wallet proof (runtime only, never saved to disk).
+                        Optional: when omitted in a TTY session, traderclaw will prompt for it
+                        interactively with hidden input if the server requires wallet proof.
+                        Required when running non-interactively (scripts, CI) — use env
+                        TRADERCLAW_WALLET_PRIVATE_KEY for cleaner shell history.
   --gateway-base-url, -g  Gateway public HTTPS URL for orchestrator callbacks
   --gateway-token, -t     Gateway bearer token (defaults to API key)
   --telegram-recipient    Telegram @username or chat id (aliases: --forward-telegram-chat-id, --telegram-chat-id)
@@ -4107,7 +4188,8 @@ Gateway subcommands:
   gateway ensure-persistent   Linux: enable loginctl linger and systemd --user unit for OpenClaw gateway
 
 Login options:
-  --wallet-private-key <k>  Base58 key for wallet proof when the server requires it (runtime only)
+  --wallet-private-key <k>  Base58 key for wallet proof (runtime only, never saved). Optional in a
+                            TTY session — traderclaw will prompt with hidden input if proof is needed.
   --force-reauth       Clear refresh token and run full API challenge (use after logout or to rotate session)
 
 Config subcommands:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "traderclaw-cli",
-  "version": "1.0.85",
+  "version": "1.0.87",
   "description": "Global TraderClaw CLI (install --wizard, setup, precheck). Installs solana-traderclaw as a dependency for OpenClaw plugin files.",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "solana-traderclaw": "^1.0.85"
+    "solana-traderclaw": "^1.0.87"
   },
   "keywords": [
     "traderclaw",