iwa 0.0.66__tar.gz → 0.1.1__tar.gz

{iwa-0.0.66/src/iwa.egg-info → iwa-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iwa
-Version: 0.0.66
+Version: 0.1.1
 Summary: A secure, modular, and plugin-based framework for crypto agents and ops
 Requires-Python: <4.0,>=3.12
 Description-Content-Type: text/markdown

{iwa-0.0.66 → iwa-0.1.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "iwa"
-version = "0.0.66"
+version = "0.1.1"
 description = "A secure, modular, and plugin-based framework for crypto agents and ops"
 readme = "README.md"
 requires-python = ">=3.12,<4.0"
@@ -72,7 +72,7 @@ where = ["src"]
 
 [tool.ruff]
 line-length = 100
-target-version = "0.0.66"
+target-version = "0.1.1"
 fix = true
 
 [tool.ruff.lint]

{iwa-0.0.66 → iwa-0.1.1}/src/iwa/core/chain/interface.py

@@ -228,6 +228,7 @@ class ChainInterface:
             "connect timeout",
             "remote end closed",
             "broken pipe",
+            # Note: "too many open files" handled separately by _is_fd_exhaustion_error
         ]
         return any(signal in err_text for signal in connection_signals)
 
@@ -254,6 +255,21 @@ class ChainInterface:
         ]
         return any(signal in err_text for signal in server_error_signals)
 
+    def _is_fd_exhaustion_error(self, error: Exception) -> bool:
+        """Check if error is due to file descriptor exhaustion (OSError 24).
+
+        When FDs are exhausted, rotating RPCs makes things WORSE because it
+        creates more connections. Instead, we need to pause and let existing
+        connections drain before retrying.
+        """
+        err_text = str(error).lower()
+        fd_signals = [
+            "too many open files",
+            "oserror(24",
+            "errno 24",
+        ]
+        return any(signal in err_text for signal in fd_signals)
+
     def _is_gas_error(self, error: Exception) -> bool:
         """Check if error is related to gas limits or fees."""
         err_text = str(error).lower()
@@ -326,6 +342,9 @@ class ChainInterface:
         """Return True if the RPC at *index* is not in backoff."""
         return time.monotonic() >= self._rpc_backoff_until.get(index, 0.0)
 
+    # FD exhaustion backoff: wait for connections to drain
+    FD_EXHAUSTION_BACKOFF = 60.0  # Long pause to let FDs drain
+
     def _handle_rpc_error(self, error: Exception) -> Dict[str, Union[bool, int]]:
         """Handle RPC errors with smart rotation and retry logic."""
         result: Dict[str, Union[bool, int]] = {
@@ -335,10 +354,26 @@ class ChainInterface:
             "is_gas_error": self._is_gas_error(error),
             "is_tenderly_quota": self._is_tenderly_quota_exceeded(error),
             "is_quota_exceeded": self._is_quota_exceeded_error(error),
+            "is_fd_exhaustion": self._is_fd_exhaustion_error(error),
             "rotated": False,
             "should_retry": False,
         }
 
+        # FD exhaustion: DO NOT rotate (creates more connections), just pause
+        if result["is_fd_exhaustion"]:
+            logger.error(
+                f"[{self.chain.name}] FD EXHAUSTION detected (too many open files). "
+                f"Pausing all RPCs for {int(self.FD_EXHAUSTION_BACKOFF)}s to drain connections. "
+                f"NO rotation to avoid creating more connections."
+            )
+            # Mark ALL RPCs as in backoff to prevent any activity
+            for i in range(len(self.chain.rpcs) if self.chain.rpcs else 0):
+                self._mark_rpc_backoff(i, self.FD_EXHAUSTION_BACKOFF)
+            # Trigger global rate limit backoff
+            self._rate_limiter.trigger_backoff(seconds=self.FD_EXHAUSTION_BACKOFF)
+            result["should_retry"] = True  # Retry after backoff
+            return result
+
         if result["is_tenderly_quota"]:
             logger.error(
                 "TENDERLY QUOTA EXCEEDED! The virtual network has reached its limit. "

{iwa-0.0.66 → iwa-0.1.1}/src/iwa/core/services/safe.py

@@ -1,6 +1,6 @@
 """Safe service module."""
 
-from typing import TYPE_CHECKING, Dict, List, Optional, Tuple
+from typing import TYPE_CHECKING, List, Optional, Tuple
 
 from loguru import logger
 from safe_eth.eth import EthereumClient
@@ -35,7 +35,6 @@ class SafeService:
         """Initialize SafeService."""
         self.key_storage = key_storage
         self.account_service = account_service
-        self._client_cache: Dict[str, EthereumClient] = {}
 
     def create_safe(
         self,
@@ -100,15 +99,14 @@ class SafeService:
 
     def _get_ethereum_client(self, chain_name: str) -> EthereumClient:
         from iwa.core.chain import ChainInterfaces
+        from iwa.plugins.gnosis.safe import get_ethereum_client
 
         # Use ChainInterface which has proper RPC rotation and parsing
         chain_interface = ChainInterfaces().get(chain_name)
         rpc_url = chain_interface.current_rpc
 
-        if rpc_url not in self._client_cache:
-            self._client_cache[rpc_url] = EthereumClient(rpc_url)
-
-        return self._client_cache[rpc_url]
+        # Use shared cache to prevent FD exhaustion
+        return get_ethereum_client(rpc_url)
 
     def _deploy_safe_contract(
         self,
@@ -256,11 +254,8 @@ class SafeService:
                 continue
 
             for chain in account.chains:
-                from iwa.core.chain import ChainInterfaces
-
-                # Use ChainInterface which has proper RPC rotation and parsing
-                chain_interface = ChainInterfaces().get(chain)
-                ethereum_client = EthereumClient(chain_interface.current_rpc)
+                # Reuse cached EthereumClient to prevent FD exhaustion
+                ethereum_client = self._get_ethereum_client(chain)
 
                 code = ethereum_client.w3.eth.get_code(account.address)
 
@@ -375,7 +370,9 @@ class SafeService:
         if not safe_account or not isinstance(safe_account, StoredSafeAccount):
             raise ValueError(f"Safe account '{safe_address_or_tag}' not found.")
 
-        safe = SafeMultisig(safe_account, chain_name)
+        # Reuse cached EthereumClient to prevent FD exhaustion
+        ethereum_client = self._get_ethereum_client(chain_name)
+        safe = SafeMultisig(safe_account, chain_name, ethereum_client=ethereum_client)
         safe_tx = safe.build_tx(
             to=to,
             value=value,

{iwa-0.0.66 → iwa-0.1.1}/src/iwa/core/services/safe_executor.py

@@ -1,10 +1,10 @@
 """Safe transaction executor with retry logic and gas handling."""
 
 import time
-from typing import TYPE_CHECKING, Dict, List, Optional, Tuple
+from typing import TYPE_CHECKING, List, Optional, Tuple
 
 from loguru import logger
-from safe_eth.eth import EthereumClient, TxSpeed
+from safe_eth.eth import TxSpeed
 from safe_eth.safe import Safe
 from safe_eth.safe.safe_tx import SafeTx
 
@@ -56,7 +56,6 @@ class SafeTransactionExecutor:
         config = Config().core
         self.max_retries = max_retries or config.safe_tx_max_retries
         self.gas_buffer = gas_buffer or config.safe_tx_gas_buffer
-        self._client_cache: Dict[str, EthereumClient] = {}
 
     def execute_with_retry(
         self,
@@ -64,7 +63,7 @@ class SafeTransactionExecutor:
         safe_tx: SafeTx,
         signer_keys: List[str],
         operation_name: str = "safe_tx",
-    ) -> Tuple[bool, str, Optional[Dict]]:
+    ) -> Tuple[bool, str, Optional[dict]]:
         """Execute SafeTx with full retry mechanism.
 
         Args:
@@ -303,10 +302,11 @@ class SafeTransactionExecutor:
 
     def _recreate_safe_client(self, safe_address: str) -> Safe:
         """Recreate Safe with current (possibly rotated) RPC."""
+        from iwa.plugins.gnosis.safe import get_ethereum_client
+
         rpc_url = self.chain_interface.current_rpc
-        if rpc_url not in self._client_cache:
-            self._client_cache[rpc_url] = EthereumClient(rpc_url)
-        ethereum_client = self._client_cache[rpc_url]
+        # Use shared cache to prevent FD exhaustion
+        ethereum_client = get_ethereum_client(rpc_url)
         return Safe(safe_address, ethereum_client)
 
     def _is_nonce_error(self, error: Exception) -> bool:

{iwa-0.0.66 → iwa-0.1.1}/src/iwa/plugins/gnosis/cow/swap.py

@@ -29,6 +29,20 @@ warnings.filterwarnings(
 
 logger = configure_logger()
 
+# Module-level session for connection pooling (avoids FD leak)
+_session: requests.Session | None = None
+
+
+def _get_session() -> requests.Session:
+    """Get or create the module-level HTTP session."""
+    global _session
+    if _session is None:
+        from iwa.core.http import create_retry_session
+
+        _session = create_retry_session()
+    return _session
+
+
 if TYPE_CHECKING:
     from cowdao_cowpy.common.chains import Chain
     from cowdao_cowpy.cow.swap import CompletedOrder
@@ -97,13 +111,14 @@ class CowSwap:
         logger.info(f"Checking order status for UID: {order.uid}")
 
         sleep_between_retries = 15
+        session = _get_session()
+        loop = asyncio.get_event_loop()
 
         while True:
             try:
-                # Use a thread executor for blocking requests.get
-                loop = asyncio.get_event_loop()
+                # Use a thread executor for blocking HTTP request
                 response = await loop.run_in_executor(
-                    None, lambda: requests.get(order.url, timeout=60)
+                    None, lambda s=session: s.get(order.url, timeout=60)
                 )
             except Exception as e:
                 logger.warning(f"Error checking order status: {e}")

{iwa-0.0.66 → iwa-0.1.1}/src/iwa/plugins/gnosis/safe.py

@@ -1,6 +1,6 @@
 """Gnosis Safe interaction."""
 
-from typing import Callable, Optional
+from typing import Callable, Dict, Optional
 
 from safe_eth.eth import EthereumClient
 from safe_eth.eth.constants import NULL_ADDRESS
@@ -12,6 +12,46 @@ from iwa.core.utils import configure_logger
 
 logger = configure_logger()
 
+# Shared EthereumClient cache to prevent FD leaks
+# Limited to MAX_CACHED_CLIENTS to avoid unbounded growth during RPC rotations
+_ethereum_client_cache: Dict[str, EthereumClient] = {}
+MAX_CACHED_CLIENTS = 3  # Keep only recent clients to limit FD usage
+
+
+def _cleanup_old_clients(keep_url: str) -> None:
+    """Remove oldest cached clients to stay under limit."""
+    global _ethereum_client_cache
+    while len(_ethereum_client_cache) >= MAX_CACHED_CLIENTS:
+        # Remove oldest entry (first key in dict, preserves insertion order in Python 3.7+)
+        for old_url in list(_ethereum_client_cache.keys()):
+            if old_url != keep_url:
+                old_client = _ethereum_client_cache.pop(old_url)
+                # Try to close any underlying HTTP session
+                if hasattr(old_client, "w3") and hasattr(old_client.w3, "provider"):
+                    provider = old_client.w3.provider
+                    if hasattr(provider, "_request_kwargs"):
+                        session = provider._request_kwargs.get("session")
+                        if session and hasattr(session, "close"):
+                            try:
+                                session.close()
+                            except Exception:
+                                pass
+                logger.debug(f"Evicted EthereumClient for {old_url} from cache")
+                break
+
+
+def get_ethereum_client(rpc_url: str) -> EthereumClient:
+    """Get a cached EthereumClient for the given RPC URL.
+
+    Reuses existing clients to prevent file descriptor exhaustion.
+    Limited to MAX_CACHED_CLIENTS to prevent unbounded cache growth
+    during RPC rotations.
+    """
+    if rpc_url not in _ethereum_client_cache:
+        _cleanup_old_clients(rpc_url)
+        _ethereum_client_cache[rpc_url] = EthereumClient(rpc_url)
+    return _ethereum_client_cache[rpc_url]
+
 
 class SafeMultisig:
     """Class to interact with Gnosis Safe multisig wallets.
@@ -20,17 +60,32 @@ class SafeMultisig:
     checking owners, thresholds, and building/sending multi-signature transactions.
     """
 
-    def __init__(self, safe_account: StoredSafeAccount, chain_name: str):
-        """Initialize the SafeMultisig instance."""
+    def __init__(
+        self,
+        safe_account: StoredSafeAccount,
+        chain_name: str,
+        ethereum_client: Optional[EthereumClient] = None,
+    ):
+        """Initialize the SafeMultisig instance.
+
+        Args:
+            safe_account: The Safe account to interact with.
+            chain_name: The chain name (e.g., 'gnosis').
+            ethereum_client: Optional pre-existing EthereumClient.
+                If not provided, uses a shared cached client.
+
+        """
         # Normalize chain comparison to be case-insensitive
         normalized_chains = [c.lower() for c in safe_account.chains]
         if chain_name.lower() not in normalized_chains:
             raise ValueError(f"Safe account is not deployed on chain: {chain_name}")
 
-        from iwa.core.chain import ChainInterfaces
+        if ethereum_client is None:
+            from iwa.core.chain import ChainInterfaces
+
+            chain_interface = ChainInterfaces().get(chain_name.lower())
+            ethereum_client = get_ethereum_client(chain_interface.current_rpc)
 
-        chain_interface = ChainInterfaces().get(chain_name.lower())
-        ethereum_client = EthereumClient(chain_interface.current_rpc)
         self.multisig = Safe(safe_account.address, ethereum_client)
         self.ethereum_client = ethereum_client
 

{iwa-0.0.66 → iwa-0.1.1}/src/iwa/plugins/gnosis/tests/test_cow.py

@@ -175,19 +175,18 @@ async def test_check_cowswap_order_success(cowswap):
     mock_order = MagicMock()
     mock_order.url = "http://api/order"
 
-    with patch("requests.get") as mock_get:
-        mock_get.return_value.status_code = 200
-        mock_get.return_value.json.return_value = {
-            "status": "fulfilled",
-            "executedSellAmount": "100",
-            "executedBuyAmount": "90",
-        }
-
-        # Need to mock loop.run_in_executor since check_cowswap_order uses it
-        # Or just let it run if requests.get is mocked?
-        # check_cowswap_order calls loop.run_in_executor(None, lambda: requests.get(...))
-        # This will run the lambda in a thread. The mock should work.
-
+    mock_response = MagicMock()
+    mock_response.status_code = 200
+    mock_response.json.return_value = {
+        "status": "fulfilled",
+        "executedSellAmount": "100",
+        "executedBuyAmount": "90",
+    }
+
+    mock_session = MagicMock()
+    mock_session.get.return_value = mock_response
+
+    with patch("iwa.plugins.gnosis.cow.swap._get_session", return_value=mock_session):
         result = await cowswap.check_cowswap_order(mock_order)
 
         assert result == {
@@ -203,10 +202,14 @@ async def test_check_cowswap_order_expired(cowswap):
     mock_order = MagicMock()
     mock_order.url = "http://api/order"
 
-    with patch("requests.get") as mock_get:
-        mock_get.return_value.status_code = 200
-        mock_get.return_value.json.return_value = {"status": "expired"}
+    mock_response = MagicMock()
+    mock_response.status_code = 200
+    mock_response.json.return_value = {"status": "expired"}
+
+    mock_session = MagicMock()
+    mock_session.get.return_value = mock_response
 
+    with patch("iwa.plugins.gnosis.cow.swap._get_session", return_value=mock_session):
         result = await cowswap.check_cowswap_order(mock_order)
         assert result is None
 
@@ -217,20 +220,20 @@ async def test_check_cowswap_order_timeout(cowswap):
     mock_order = MagicMock()
     mock_order.url = "http://api/order"
 
-    with patch("requests.get") as mock_get:
-        mock_get.return_value.status_code = 200
-        # Order is always open
-        mock_get.return_value.json.return_value = {
-            "status": "open",
-            "executedSellAmount": "0",
-            "validTo": 1000,
-        }
-
-        # Mock time to start at 900 and then jump to 1100 to trigger timeout
-        with patch("time.time") as mock_time:
-            mock_time.side_effect = [900, 1100]
-            # Speed up retry sleep (asyncio.sleep)
-            with patch("asyncio.sleep", new_callable=AsyncMock):
-                result = await cowswap.check_cowswap_order(mock_order)
-                assert result is None
-                assert mock_time.call_count >= 2
+    mock_response = MagicMock()
+    mock_response.status_code = 200
+    # Order is always open, validTo = 1000
+    mock_response.json.return_value = {
+        "status": "open",
+        "executedSellAmount": "0",
+        "validTo": 1000,
+    }
+
+    mock_session = MagicMock()
+    mock_session.get.return_value = mock_response
+
+    with patch("iwa.plugins.gnosis.cow.swap._get_session", return_value=mock_session):
+        # Mock time to return >1060 (validTo + 60) to trigger timeout on first check
+        with patch("iwa.plugins.gnosis.cow.swap.time.time", return_value=1100):
+            result = await cowswap.check_cowswap_order(mock_order)
+            assert result is None

iwa-0.1.1/src/iwa/plugins/gnosis/tests/test_safe.py

@@ -0,0 +1,187 @@
+"""Tests for Safe module."""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from iwa.core.models import StoredSafeAccount
+from iwa.plugins.gnosis.safe import (
+    MAX_CACHED_CLIENTS,
+    SafeMultisig,
+    _ethereum_client_cache,
+    get_ethereum_client,
+)
+
+
+@pytest.fixture
+def mock_settings():
+    """Mock settings."""
+    # secrets is no longer used in this module, so we don't need to patch it here
+    yield None
+
+
+@pytest.fixture
+def mock_safe_eth():
+    """Mock safe_eth module."""
+    with (
+        patch("iwa.plugins.gnosis.safe.EthereumClient") as mock_client,
+        patch("iwa.plugins.gnosis.safe.Safe") as mock_safe,
+    ):
+        yield mock_client, mock_safe
+
+
+@pytest.fixture
+def safe_account():
+    """Mock safe account."""
+    return StoredSafeAccount(
+        address="0x1234567890123456789012345678901234567890",
+        owners=["0x1234567890123456789012345678901234567890"],
+        threshold=1,
+        chains=["gnosis"],
+        tag="mysafe",
+        signers=[],
+    )
+
+
+def test_init(safe_account, mock_settings, mock_safe_eth):
+    """Test initialization."""
+    with patch("iwa.core.chain.ChainInterfaces") as mock_ci_cls:
+        mock_ci = mock_ci_cls.return_value
+        mock_ci.get.return_value.current_rpc = "http://rpc"
+        ms = SafeMultisig(safe_account, "gnosis")
+        assert ms.multisig is not None
+        mock_safe_eth[0].assert_called_with("http://rpc")  # EthereumClient init
+        mock_safe_eth[1].assert_called()  # Safe init
+
+
+def test_init_invalid_chain(safe_account, mock_settings, mock_safe_eth):
+    """Test initialization with invalid chain."""
+    with pytest.raises(ValueError, match="not deployed on chain"):
+        SafeMultisig(safe_account, "ethereum")
+
+
+def test_getters(safe_account, mock_settings, mock_safe_eth):
+    """Test safe property getters."""
+    ms = SafeMultisig(safe_account, "gnosis")
+    mock_safe_instance = mock_safe_eth[1].return_value
+
+    mock_safe_instance.retrieve_owners.return_value = ["0x1"]
+    assert ms.get_owners() == ["0x1"]
+
+    mock_safe_instance.retrieve_threshold.return_value = 2
+    assert ms.get_threshold() == 2
+
+    mock_safe_instance.retrieve_nonce.return_value = 5
+    assert ms.get_nonce() == 5
+
+    mock_safe_instance.retrieve_all_info.return_value = {"info": "test"}
+    assert ms.retrieve_all_info() == {"info": "test"}
+
+
+def test_build_tx(safe_account, mock_settings, mock_safe_eth):
+    """Test build_multisig_tx."""
+    ms = SafeMultisig(safe_account, "gnosis")
+    mock_safe_instance = mock_safe_eth[1].return_value
+    mock_safe_instance.build_multisig_tx.return_value = "0xTx"
+
+    tx = ms.build_tx("0xTo", 100)
+    assert tx == "0xTx"
+
+    mock_safe_instance.build_multisig_tx.assert_called()
+
+
+def test_send_tx(safe_account, mock_settings, mock_safe_eth):
+    """Test send_multisig_tx."""
+    ms = SafeMultisig(safe_account, "gnosis")
+
+    # Mock build_tx just in case (though it delegates)
+    # Actually we can let it delegate to mock_safe_instance which returns "0xSafeTx"
+    mock_safe_instance = mock_safe_eth[1].return_value
+    mock_safe_instance.build_multisig_tx.return_value = "0xSafeTx"
+
+    callback = MagicMock(return_value="0xHash")
+
+    tx_hash = ms.send_tx("0xTo", 100, callback)
+    assert tx_hash == "0xHash"
+
+    callback.assert_called_with("0xSafeTx")
+
+
+class TestEthereumClientCache:
+    """Tests for EthereumClient caching to prevent FD exhaustion."""
+
+    def setup_method(self):
+        """Clear cache before each test."""
+        _ethereum_client_cache.clear()
+
+    def test_cache_reuses_client(self):
+        """Test that the same RPC URL returns the same cached client."""
+        with patch("iwa.plugins.gnosis.safe.EthereumClient") as mock_client_cls:
+            mock_client_cls.return_value = MagicMock()
+
+            client1 = get_ethereum_client("https://rpc1.example.com")
+            client2 = get_ethereum_client("https://rpc1.example.com")
+
+            assert client1 is client2
+            # Should only create one instance
+            assert mock_client_cls.call_count == 1
+
+    def test_cache_different_urls(self):
+        """Test that different URLs create different clients."""
+        with patch("iwa.plugins.gnosis.safe.EthereumClient") as mock_client_cls:
+            mock_client_cls.side_effect = lambda url: MagicMock(url=url)
+
+            client1 = get_ethereum_client("https://rpc1.example.com")
+            client2 = get_ethereum_client("https://rpc2.example.com")
+
+            assert client1 is not client2
+            assert mock_client_cls.call_count == 2
+
+    def test_cache_limit_enforced(self):
+        """Test that cache is limited to MAX_CACHED_CLIENTS."""
+        with patch("iwa.plugins.gnosis.safe.EthereumClient") as mock_client_cls:
+            # Create mock clients with closeable sessions
+            def create_mock_client(url):
+                client = MagicMock(url=url)
+                client.w3 = MagicMock()
+                client.w3.provider = MagicMock()
+                client.w3.provider._request_kwargs = {"session": MagicMock()}
+                return client
+
+            mock_client_cls.side_effect = create_mock_client
+
+            # Create more clients than the limit
+            urls = [f"https://rpc{i}.example.com" for i in range(MAX_CACHED_CLIENTS + 2)]
+            for url in urls:
+                get_ethereum_client(url)
+
+            # Cache should not exceed limit
+            assert len(_ethereum_client_cache) <= MAX_CACHED_CLIENTS
+
+    def test_cache_evicts_oldest(self):
+        """Test that oldest entries are evicted when limit is reached."""
+        with patch("iwa.plugins.gnosis.safe.EthereumClient") as mock_client_cls:
+
+            def create_mock_client(url):
+                client = MagicMock(url=url)
+                client.w3 = MagicMock()
+                client.w3.provider = MagicMock()
+                client.w3.provider._request_kwargs = {"session": MagicMock()}
+                return client
+
+            mock_client_cls.side_effect = create_mock_client
+
+            # Fill cache to limit
+            first_url = "https://first.example.com"
+            get_ethereum_client(first_url)
+            for i in range(1, MAX_CACHED_CLIENTS):
+                get_ethereum_client(f"https://rpc{i}.example.com")
+
+            assert first_url in _ethereum_client_cache
+
+            # Add one more - should evict the first
+            get_ethereum_client("https://new.example.com")
+
+            # First URL should be evicted
+            assert first_url not in _ethereum_client_cache
+            assert "https://new.example.com" in _ethereum_client_cache

{iwa-0.0.66 → iwa-0.1.1}/src/iwa/plugins/olas/importer.py

@@ -598,6 +598,15 @@ class OlasServiceImporter:
             content = file_path.read_text().strip()
             keystore = json.loads(content)
 
+            # Handle operate format: keystore is stringified inside "private_key"
+            if "private_key" in keystore and isinstance(keystore["private_key"], str):
+                try:
+                    inner_keystore = json.loads(keystore["private_key"])
+                    if "crypto" in inner_keystore and "address" in inner_keystore:
+                        keystore = inner_keystore
+                except json.JSONDecodeError:
+                    pass  # Not a nested keystore, continue with original
+
             # Validate it's a keystore
             if "crypto" not in keystore or "address" not in keystore:
                 return None

{iwa-0.0.66 → iwa-0.1.1}/src/iwa/plugins/olas/plugin.py

@@ -67,10 +67,10 @@ class OlasPlugin(Plugin):
 
         """
         try:
-            from safe_eth.eth import EthereumClient
             from safe_eth.safe import Safe
 
             from iwa.core.chain import ChainInterfaces
+            from iwa.plugins.gnosis.safe import get_ethereum_client
 
             try:
                 chain_interface = ChainInterfaces().get(chain_name)
@@ -79,7 +79,8 @@ class OlasPlugin(Plugin):
             except ValueError:
                 return None, None  # Chain not supported/configured
 
-            ethereum_client = EthereumClient(chain_interface.current_rpc)
+            # Reuse cached EthereumClient to prevent FD exhaustion
+            ethereum_client = get_ethereum_client(chain_interface.current_rpc)
             safe = Safe(safe_address, ethereum_client)
             owners = safe.retrieve_owners()
             return owners, True