feat(wallet-cli): wire the TransactionController slot in the daemon wallet by sirtimid · Pull Request #9509 · MetaMask/core

sirtimid · 2026-07-14T19:30:13Z

Explanation

TransactionController was wired into @metamask/wallet in #8975, which left the daemon's wallet factory with a stubbed slot: // TODO(#8975): add the transactionController slot once it is wired. Until now the daemon still constructed the controller (it runs during wallet.init()), but only with the controller's implicit defaults, because buildInstanceOptions passed no transactionController options.

This PR populates that slot so the daemon's transaction configuration is explicit and reviewable alongside the other wired slots.

What changed

buildInstanceOptions now sets:

transactionController: {
  disableSwaps: true,
  hooks: {},
},

disableSwaps: true — the headless CLI has no swaps feature, so the swaps-specific post-processing a full wallet client runs would only produce data nothing reads. This mirrors mobile's choice; the extension keeps swaps enabled because it ships the full Swaps UI.
hooks: {} — no CLI-specific transaction hooks. The controller's built-in publish path already broadcasts through the wired NetworkController provider (the default publish hook returns an undefined hash, and the controller then falls back to its own network-client broadcast), and the remaining hooks (metrics, notifications, gas-fee tokens) are client-UI concerns the daemon has no equivalent for.
Every other option (getPermittedAccounts, isSimulationEnabled, trace, …) is left at the controller's default.

This is a configuration change only — no new command surface. Mutating RPC (sign/send) hardening remains future work (see the retry-idempotency note in the wallet-cli plan).

Client references for the `disableSwaps` posture

Extension (disableSwaps: false): app/scripts/wallet-init/instance-options/transaction-controller.ts
Mobile (disableSwaps: true): app/core/Engine/wallet-init/instance-options/transaction-controller.ts

References

Wires the consumer side of feat(wallet): add TransactionController to wallet package #8975.

Follow-ups (making the daemon able to send)

This PR only wires the controller's config slot. The path to an actual send:

Wire GasFeeController into @metamask/wallet default initialization #9510 — wire GasFeeController into @metamask/wallet (upstream)
wallet-cli: make the daemon transaction-capable — consume GasFeeController + headless auto-approval #9512 — daemon transaction-capable: consume GasFeeController + headless auto-approval
wallet-cli: make sendCommand retry idempotency-safe before mutating RPC ships #9511 — make sendCommand retry idempotency-safe (mutating-RPC prerequisite)
wallet-cli: add the mm send-transaction command #9513 — add the mm send-transaction command

Testing

Unit (wallet-factory.test.ts): asserts the wired slot values.
Integration (wallet-factory.integration.test.ts): the real Wallet path constructs and runs with the new options.
Gates: full test suite at 100% coverage, dep-subtree build/type-check, ESLint, oxfmt, changelog validation — all green.

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, CHANGELOG.md) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for affected packages, highlighting breaking changes as necessary
I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes (n/a — no breaking changes)

🤖 Generated with Claude Code

…allet The `TransactionController` is now wired in `@metamask/wallet` (#8975), so populate the previously-stubbed `transactionController` instance-options slot in the daemon's wallet factory instead of relying on the controller's implicit defaults. The headless daemon has no swaps surface, so swaps-specific processing is disabled (matching mobile), and no client-UI hooks are supplied — the controller's built-in publish path broadcasts through the wired `NetworkController` provider, and every other option is left at its default. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…etaMask#9612) ## Explanation Makes the `@metamask/wallet-cli` daemon able to process a transaction end-to-end by completing the two consumer-side pieces a wired `TransactionController` needs at runtime. This makes the daemon transaction-*capable*; the user-facing `mm send` command is a separate follow-on. `TransactionController` is wired into `@metamask/wallet` and its messenger delegates to `GasFeeController` and `ApprovalController`. A send flow currently dead-ends in the daemon in two ways, both fixed here. ### Piece 1 — consume `GasFeeController` The `gasFeeController` slot (`clientId: 'cli'`) already exists in `buildInstanceOptions` — it was added when `GasFeeController` was wired upstream (MetaMask#9527) because `clientId` is required. This PR finishes the consumer side: - Documents the slot in the `buildInstanceOptions` JSDoc slot list. - Relies on the wallet package's platform-agnostic **production default** for `EIP1559APIEndpoint` (the default is already the prod URL) rather than re-specifying the string in the CLI, so the endpoint stays centrally owned. With `GasFeeController` wired and released, a daemon-hosted `Wallet` now resolves `GasFeeController:fetchGasFeeEstimates` instead of throwing `A handler for ... has not been registered`. ### Piece 2 — headless auto-approval `ApprovalController:addRequest` is **awaited** by transaction/signature flows. The daemon's `showApprovalRequest` is a no-op (it only signals "a request needs attention"; it does not resolve anything), so with no UI the awaiting call hangs forever. `subscribeToAutoApproval` subscribes to `ApprovalController:stateChanged` and immediately accepts every pending request via `ApprovalController:acceptRequest`. The `showApprovalRequest` hook stays a no-op (there is no UI); the id isn't available to that hook, so acceptance goes through the messenger instead. An `inFlight` guard keeps accepting idempotent across the re-entrant/rapid state changes a single flow emits, and both sync throws and async rejections from an accept are logged and swallowed so one bad request can't crash the daemon or wedge the subscription. The subscription is installed in `createWallet` and torn down in its `dispose` path. ### Security consideration — auto-approval is a conscious trust decision Auto-approval means the daemon **accepts every approval request without confirmation** — transactions and signatures included. For a headless daemon this is the intended model: it is driven only by its owner's local CLI over a `0600`, same-user Unix socket, so the trust boundary is the socket, not a per-request prompt. This is documented as the daemon's explicit trust model in `subscribeToAutoApproval` and the README, and flagged as **not "safe by default"** — a scoped/opt-in policy (config flag, or accepting only specific approval types) is deferred until the user-facing send command exists. ## References - `packages/wallet-cli/src/daemon/auto-approval.ts` — the auto-approval subscription + trust model. - `packages/wallet-cli/src/daemon/wallet-factory.ts` — `buildInstanceOptions` slot docs; `createWallet`/`teardown` wiring. ## Related - Closes MetaMask#9512 - Builds on MetaMask#9509 (TransactionController slot) and MetaMask#9527 (wire `GasFeeController` into `@metamask/wallet`) - Unblocks MetaMask#9513 (the `mm` send command), which is additionally gated on MetaMask#9511 ## Checklist - [x] Tests cover both the gas slot and the auto-approval accept path (unit + real-`Wallet` integration); 100% coverage maintained. - [x] `build`, package `test`, `yarn lint:fix`, `yarn lint`, `changelog:validate` pass. - [x] Auto-approval trust model documented in code and README. - [x] Teardown (`dispose`) unsubscribes the auto-approval listener. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **High Risk** > The daemon unconditionally approves transactions and signatures with no per-request prompt; compromise of the local Unix socket trust boundary can move funds. > > **Overview** > Enables end-to-end transaction capability in the headless wallet daemon by **auto-accepting every pending `ApprovalController` request** via a new `subscribeToAutoApproval` subscription on `ApprovalController:stateChanged`, so awaited `addRequest` calls no longer hang behind the no-op `showApprovalRequest` hook. Acceptance uses an **in-flight guard** and logs/swallows accept failures so re-entrant state updates and bad requests cannot wedge or crash the daemon. > > `createWallet` installs the subscription before `wallet.init` and tears it down in `dispose` (shared `runUnsubscribe` helper alongside persistence). **README and changelog** document the explicit security model: anything on the `0600` same-user socket can move funds; scoped approval policy is deferred. > > Also expands **`buildInstanceOptions` JSDoc** for the existing `gasFeeController` slot (`clientId: 'cli'`, relying on wallet defaults for the production gas API URL). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 26e4183. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

## Explanation Adds the user-facing `mm wallet send` command that sends a transaction end-to-end through the daemon-hosted `TransactionController`, closing MetaMask#9513. This is the CLI surface on top of the daemon's transaction capability (MetaMask#9512 / MetaMask#9612): it collects transaction parameters, dispatches them to the daemon, waits for the broadcast, and reports the resulting transaction hash. Send a transaction. `--value` is in ether; select the network with `--network-client-id` or `--chain-id`; the sender defaults to the selected account. The command previews the resolved plan and asks for confirmation before broadcasting, then prints the transaction hash: Because the daemon auto-approves the confirmation prompt — or your explicit `--yes` — is the only boundary before funds move; use `--dry-run` first if unsure. Gas is estimated automatically unless overridden with `--gas` / `--max-fee-per-gas` / `--max-priority-fee-per-gas` / `--gas-price` (each a `0x`-prefixed hex quantity). ### Dedicated `sendTransaction` RPC handler `TransactionController:addTransaction` returns a `Result` shaped like `{ transactionMeta, result }`, where `result` is a `Promise<hash>` that resolves once the transaction is signed and broadcast. That promise is **not JSON-serializable**, so it cannot travel back over the daemon's generic `call` dispatch. The daemon therefore exposes a dedicated `sendTransaction` handler (`src/daemon/send-transaction.ts`) that, server-side: 1. resolves the network client — from `networkClientId`, or from `chainId` via `NetworkController:findNetworkClientIdByChainId`; 2. resolves the sender — the provided `--from`, or the selected account; 3. calls `addTransaction(txParams, { networkClientId, origin: 'metamask', isInternal: true })` (internal, so it skips origin/permitted-account validation and is auto-approved by the headless daemon); 4. **awaits the broadcast** and re-reads the live record so the returned status reflects the post-broadcast state (`submitted`), not the `unapproved` creation snapshot; 5. returns a serializable `{ transactionHash, transactionId, status }`. Params are validated with superstruct at the daemon boundary (exactly one of `networkClientId` / `chainId`; `0x` address and hex quantities). ### The `mm wallet send` command A thin client over that handler (`src/commands/wallet/send.ts`): ```sh ➜ wallet-cli: yarn mm wallet send --help Send a transaction through the daemon-hosted TransactionController. Estimates gas automatically unless overridden, signs, broadcasts, and prints the resulting transaction hash. The daemon auto-approves, so the confirmation boundary is this command. USAGE $ mm wallet send --to <value> [--value <value>] [--from <value>] [--data <value>] [--network-client-id <value>] [--chain-id <value>] [--gas <value>] [--max-fee-per-gas <value>] [--max-priority-fee-per-gas <value>] [--gas-price <value>] [--dry-run] [-y] [-t <value>] FLAGS -t, --timeout=<value> Response timeout in milliseconds -y, --yes Skip the confirmation prompt and broadcast immediately. --chain-id=<value> Chain ID (0x-prefixed hex) to resolve to a network client. Provide this or --network-client-id, not both. --data=<value> Calldata as a 0x-prefixed hex string (for contract calls) --dry-run Resolve the network client and sender and validate params, but do not broadcast. --from=<value> Sender address (0x-prefixed). Defaults to the selected account. --gas=<value> Gas limit override, as a 0x-prefixed hex quantity --gas-price=<value> Legacy gasPrice override, as a 0x-prefixed hex wei quantity --max-fee-per-gas=<value> maxFeePerGas override, as a 0x-prefixed hex wei quantity --max-priority-fee-per-gas=<value> maxPriorityFeePerGas override, as a 0x-prefixed hex wei quantity --network-client-id=<value> Network client to send on. Provide this or --chain-id, not both. --to=<value> (required) Recipient address (0x-prefixed) --value=<value> [default: 0] Amount to send, in ether (e.g. 0.01). Defaults to 0. EXAMPLES $ mm wallet send --to 0xRecipient --value 0.01 --chain-id 0x1 $ mm wallet send --to 0xRecipient --value 0.01 --network-client-id mainnet --yes $ mm wallet send --to 0xContract --data 0xabcdef --value 0 --chain-id 0x1 --dry-run ``` ## Testing - Unit tests for the handler (network/sender resolution, internal submit, dry-run, broadcast + live status, param validation) and the command (arg parsing, preview/confirm/abort, `--yes`, `--dry-run`, error surfaces); **100% coverage maintained**. - **Real-chain e2e** (`tests/wallet-send.e2e.test.ts`): boots a local `anvil` node, adds it as a custom network, and drives the built `mm` CLI to sign, broadcast, and mine a real transaction (asserts receipt `status: 0x1` and a recipient balance increase). It is **skip-if-absent**; CI installs `anvil` for it only when `packages/wallet-cli/` changed. See `packages/wallet-cli/tests/README.md`. - `build`, package `test`, `test:e2e`, `yarn lint`, `changelog:validate` pass. ## References - Closes MetaMask#9513 - Builds on MetaMask#9512 / MetaMask#9611 (daemon transaction-capable) and MetaMask#9509 (the `TransactionController` slot); the mutating-RPC safety prerequisite MetaMask#9511 landed in MetaMask#9608. - `packages/wallet-cli/src/daemon/send-transaction.ts`, `src/commands/wallet/send.ts`, `tests/wallet-send.e2e.test.ts`. > [!NOTE] > Stacked on `sirtimid/wallet-cli-daemon-transaction-capable` (MetaMask#9612); this PR is based on that branch so the diff is scoped. Once MetaMask#9612 merges, this will be rebased onto `main` and retargeted. ## Checklist - [x] Tests cover the handler and command (unit) plus a real-chain broadcast (e2e); 100% coverage maintained. - [x] `build`, `test`, `test:e2e`, `yarn lint:fix`, `yarn lint`, `changelog:validate` pass. - [x] Confirmation prompt (`--yes` to skip) and `--dry-run` gate a real, irreversible send. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **High Risk** > Adds an irreversible on-chain send path through a headless daemon that auto-approves transactions; mistakes in confirmation, `--yes`, or timeout/retry behavior could move real funds despite CLI safeguards. > > **Overview** > Introduces **`mm wallet send`** so users can broadcast through the daemon-hosted `TransactionController`, with ether `--value`, network selection via `--network-client-id` or `--chain-id`, optional gas overrides, **`--dry-run`**, and an interactive preview (or **`--yes`** to skip). > > Because `addTransaction`'s broadcast promise cannot cross JSON-RPC, the daemon gains a dedicated **`sendTransaction`** handler that resolves network/sender, submits as internal/auto-approved, awaits the hash, and returns `{ transactionHash, transactionId, status }` (with **`dryRun`** for preview-only). > > The CLI dry-runs before confirm, then pins the resolved **`from`** / **`networkClientId`** on broadcast; it validates RPC results, uses a longer default broadcast timeout with duplicate-send warnings on timeout, and documents that the daemon still auto-approves—so the command prompt is the main fund-moving gate. > > **CI/testing:** wallet-cli e2e installs **anvil** via `@metamask/foundryup`, sets **`MM_E2E_REQUIRE_ANVIL`**, adds a real-chain send e2e (anvil + custom network), shares daemon cleanup helpers, and updates knip/README/changelog accordingly. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0f0e34f. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Erik Marks <25517051+rekmarks@users.noreply.github.com>

sirtimid and others added 2 commits July 14, 2026 21:28

docs(wallet-cli): correct changelog PR link to #9509

4ff0e4c

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sirtimid marked this pull request as ready for review July 14, 2026 19:31

sirtimid requested review from a team as code owners July 14, 2026 19:31

sirtimid temporarily deployed to default-branch July 14, 2026 19:31 — with GitHub Actions Inactive

Merge branch 'main' into sirtimid/wallet-cli-transaction-controller

0f8d304

rekmarks approved these changes Jul 14, 2026

View reviewed changes

sirtimid added this pull request to the merge queue Jul 14, 2026

Merged via the queue into main with commit dce810b Jul 14, 2026
421 checks passed

sirtimid deleted the sirtimid/wallet-cli-transaction-controller branch July 14, 2026 19:50

This was referenced Jul 22, 2026

fix(wallet-cli): retry sendCommand only on ECONNREFUSED #9608

Merged

feat(wallet-cli): headless auto-approval + document the gas-fee slot #9612

Merged

feat(wallet-cli): add the mm wallet send command #9636

Merged

Navigation Menu

Uh oh!

Uh oh!

feat(wallet-cli): wire the TransactionController slot in the daemon wallet - #9509

feat(wallet-cli): wire the TransactionController slot in the daemon wallet#9509
sirtimid merged 3 commits into
mainfrom
sirtimid/wallet-cli-transaction-controller

sirtimid commented Jul 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

sirtimid commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

What changed

Client references for the disableSwaps posture

References

Follow-ups (making the daemon able to send)

Testing

Checklist

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sirtimid commented Jul 14, 2026 •

edited

Loading

Client references for the `disableSwaps` posture