feat(wallet-cli): headless auto-approval + document the gas-fee slot by sirtimid · Pull Request #9612 · MetaMask/core

sirtimid · 2026-07-22T16:49:14Z

Explanation

Makes the @metamask/wallet-cli daemon able to process a transaction end-to-end by completing the two consumer-side pieces a wired TransactionController needs at runtime. This makes the daemon transaction-capable; the user-facing mm send command is a separate follow-on.

TransactionController is wired into @metamask/wallet and its messenger delegates to GasFeeController and ApprovalController. A send flow currently dead-ends in the daemon in two ways, both fixed here.

Piece 1 — consume `GasFeeController`

The gasFeeController slot (clientId: 'cli') already exists in buildInstanceOptions — it was added when GasFeeController was wired upstream (#9527) because clientId is required. This PR finishes the consumer side:

Documents the slot in the buildInstanceOptions JSDoc slot list.
Relies on the wallet package's platform-agnostic production default for EIP1559APIEndpoint (the default is already the prod URL) rather than re-specifying the string in the CLI, so the endpoint stays centrally owned.

With GasFeeController wired and released, a daemon-hosted Wallet now resolves GasFeeController:fetchGasFeeEstimates instead of throwing A handler for ... has not been registered.

Piece 2 — headless auto-approval

ApprovalController:addRequest is awaited by transaction/signature flows. The daemon's showApprovalRequest is a no-op (it only signals "a request needs attention"; it does not resolve anything), so with no UI the awaiting call hangs forever.

subscribeToAutoApproval subscribes to ApprovalController:stateChanged and immediately accepts every pending request via ApprovalController:acceptRequest. The showApprovalRequest hook stays a no-op (there is no UI); the id isn't available to that hook, so acceptance goes through the messenger instead. An inFlight guard keeps accepting idempotent across the re-entrant/rapid state changes a single flow emits, and both sync throws and async rejections from an accept are logged and swallowed so one bad request can't crash the daemon or wedge the subscription. The subscription is installed in createWallet and torn down in its dispose path.

Security consideration — auto-approval is a conscious trust decision

Auto-approval means the daemon accepts every approval request without confirmation — transactions and signatures included. For a headless daemon this is the intended model: it is driven only by its owner's local CLI over a 0600, same-user Unix socket, so the trust boundary is the socket, not a per-request prompt. This is documented as the daemon's explicit trust model in subscribeToAutoApproval and the README, and flagged as not "safe by default" — a scoped/opt-in policy (config flag, or accepting only specific approval types) is deferred until the user-facing send command exists.

References

packages/wallet-cli/src/daemon/auto-approval.ts — the auto-approval subscription + trust model.
packages/wallet-cli/src/daemon/wallet-factory.ts — buildInstanceOptions slot docs; createWallet/teardown wiring.

Closes wallet-cli: make the daemon transaction-capable — consume GasFeeController + headless auto-approval #9512
Builds on feat(wallet-cli): wire the TransactionController slot in the daemon wallet #9509 (TransactionController slot) and feat(wallet)!: wire GasFeeController into default initialization #9527 (wire GasFeeController into @metamask/wallet)
Unblocks wallet-cli: add the mm send-transaction command #9513 (the mm send command), which is additionally gated on wallet-cli: make sendCommand retry idempotency-safe before mutating RPC ships #9511

Checklist

Tests cover both the gas slot and the auto-approval accept path (unit + real-Wallet integration); 100% coverage maintained.
build, package test, yarn lint:fix, yarn lint, changelog:validate pass.
Auto-approval trust model documented in code and README.
Teardown (dispose) unsubscribes the auto-approval listener.

🤖 Generated with Claude Code

Note

High Risk
The daemon unconditionally approves transactions and signatures with no per-request prompt; compromise of the local Unix socket trust boundary can move funds.

Overview
Enables end-to-end transaction capability in the headless wallet daemon by auto-accepting every pending ApprovalController request via a new subscribeToAutoApproval subscription on ApprovalController:stateChanged, so awaited addRequest calls no longer hang behind the no-op showApprovalRequest hook. Acceptance uses an in-flight guard and logs/swallows accept failures so re-entrant state updates and bad requests cannot wedge or crash the daemon.

createWallet installs the subscription before wallet.init and tears it down in dispose (shared runUnsubscribe helper alongside persistence). README and changelog document the explicit security model: anything on the 0600 same-user socket can move funds; scoped approval policy is deferred.

Also expands buildInstanceOptions JSDoc for the existing gasFeeController slot (clientId: 'cli', relying on wallet defaults for the production gas API URL).

^{Reviewed by Cursor Bugbot for commit 26e4183. Bugbot is set up for automated code reviews on this repo. Configure here.}

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- Import `Logger` type alias in `auto-approval.ts` instead of redeclaring the inline shape, making compatibility with `wallet-factory.ts` explicit - Fix misleading catch-block comment that implied a rethrow; the error is intentionally suppressed - Clarify `subscribeToApprovalStateChanged` docstring: root cause is the missing `ControllerStateChangedEvent` in `ApprovalControllerEvents`, not dynamic string widening as in the persistence layer; add TODO pointing at the upstream fix - Add dropped-Patch[]-parameter note to `ApprovalStateChangeHandler` - Extend `runUnsubscribe` failure log to note the subscription may remain live - Replace fragile 5x Promise.resolve() flush with setImmediate pattern - Add missing startup-failure test: subscribeToAutoApproval throws means persistence listener is still cleaned up, wallet destroyed, store closed - Extend auto-approval unsubscribe test to also assert wallet.destroy ran - Add 5 s per-test timeout to the auto-approval integration test - Split dense CHANGELOG entry into lead sentence + nested security note Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Complete the two consumer-side pieces a wired `TransactionController` needs to process a transaction end-to-end in the daemon: - Headless auto-approval: subscribe to `ApprovalController:stateChanged` and accept every pending request via `ApprovalController:acceptRequest`, so an awaited `addRequest` (raised by a transaction/signature flow) resolves instead of hanging on the headless daemon's no-op `showApprovalRequest`. The subscription is torn down in the `createWallet` `dispose` path. - Gas-fee slot: the `gasFeeController` slot (`clientId: 'cli'`) is already wired; document it in `buildInstanceOptions` and rely on the wallet package's production-default EIP-1559 endpoint rather than re-specifying it. The auto-approval trust model is documented in `subscribeToAutoApproval` and the README: the daemon accepts every approval without a per-request prompt, so the trust boundary is its `0600` same-user Unix socket. Closes #9512 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- Import `Logger` type alias in `auto-approval.ts` instead of redeclaring the inline shape, making compatibility with `wallet-factory.ts` explicit - Fix misleading catch-block comment that implied a rethrow; the error is intentionally suppressed - Clarify `subscribeToApprovalStateChanged` docstring: root cause is the missing `ControllerStateChangedEvent` in `ApprovalControllerEvents`, not dynamic string widening as in the persistence layer; add TODO pointing at the upstream fix - Add dropped-Patch[]-parameter note to `ApprovalStateChangeHandler` - Extend `runUnsubscribe` failure log to note the subscription may remain live - Replace fragile 5x Promise.resolve() flush with setImmediate pattern - Add missing startup-failure test: subscribeToAutoApproval throws means persistence listener is still cleaned up, wallet destroyed, store closed - Extend auto-approval unsubscribe test to also assert wallet.destroy ran - Add 5 s per-test timeout to the auto-approval integration test - Split dense CHANGELOG entry into lead sentence + nested security note Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The feat commit dropped the TODO when it replaced the old comment, but the future work (exposing approval requests over the daemon transport for proper user confirmation) is still planned. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Keep only the ordering rationale; the rest is already in the function name and its JSDoc. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Drop inline TODO that duplicated the JSDoc TODO in subscribeToApprovalStateChanged - Remove four in-test comments that restate their it() descriptions - Trim integration test comment block to only the non-obvious shouldShowRequest note Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace the long inline trust model with a one-paragraph summary and a reference to #9513 (the mm-send issue) for the planned scoped policy. Keep only the inFlight guard rationale and error-swallowing note, which are non-obvious implementation details an editor of this code needs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…then async rejection test Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

rekmarks

LGTM!

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- Import `Logger` type alias in `auto-approval.ts` instead of redeclaring the inline shape, making compatibility with `wallet-factory.ts` explicit - Fix misleading catch-block comment that implied a rethrow; the error is intentionally suppressed - Clarify `subscribeToApprovalStateChanged` docstring: root cause is the missing `ControllerStateChangedEvent` in `ApprovalControllerEvents`, not dynamic string widening as in the persistence layer; add TODO pointing at the upstream fix - Add dropped-Patch[]-parameter note to `ApprovalStateChangeHandler` - Extend `runUnsubscribe` failure log to note the subscription may remain live - Replace fragile 5x Promise.resolve() flush with setImmediate pattern - Add missing startup-failure test: subscribeToAutoApproval throws means persistence listener is still cleaned up, wallet destroyed, store closed - Extend auto-approval unsubscribe test to also assert wallet.destroy ran - Add 5 s per-test timeout to the auto-approval integration test - Split dense CHANGELOG entry into lead sentence + nested security note Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

## Explanation Adds the user-facing `mm wallet send` command that sends a transaction end-to-end through the daemon-hosted `TransactionController`, closing MetaMask#9513. This is the CLI surface on top of the daemon's transaction capability (MetaMask#9512 / MetaMask#9612): it collects transaction parameters, dispatches them to the daemon, waits for the broadcast, and reports the resulting transaction hash. Send a transaction. `--value` is in ether; select the network with `--network-client-id` or `--chain-id`; the sender defaults to the selected account. The command previews the resolved plan and asks for confirmation before broadcasting, then prints the transaction hash: Because the daemon auto-approves the confirmation prompt — or your explicit `--yes` — is the only boundary before funds move; use `--dry-run` first if unsure. Gas is estimated automatically unless overridden with `--gas` / `--max-fee-per-gas` / `--max-priority-fee-per-gas` / `--gas-price` (each a `0x`-prefixed hex quantity). ### Dedicated `sendTransaction` RPC handler `TransactionController:addTransaction` returns a `Result` shaped like `{ transactionMeta, result }`, where `result` is a `Promise<hash>` that resolves once the transaction is signed and broadcast. That promise is **not JSON-serializable**, so it cannot travel back over the daemon's generic `call` dispatch. The daemon therefore exposes a dedicated `sendTransaction` handler (`src/daemon/send-transaction.ts`) that, server-side: 1. resolves the network client — from `networkClientId`, or from `chainId` via `NetworkController:findNetworkClientIdByChainId`; 2. resolves the sender — the provided `--from`, or the selected account; 3. calls `addTransaction(txParams, { networkClientId, origin: 'metamask', isInternal: true })` (internal, so it skips origin/permitted-account validation and is auto-approved by the headless daemon); 4. **awaits the broadcast** and re-reads the live record so the returned status reflects the post-broadcast state (`submitted`), not the `unapproved` creation snapshot; 5. returns a serializable `{ transactionHash, transactionId, status }`. Params are validated with superstruct at the daemon boundary (exactly one of `networkClientId` / `chainId`; `0x` address and hex quantities). ### The `mm wallet send` command A thin client over that handler (`src/commands/wallet/send.ts`): ```sh ➜ wallet-cli: yarn mm wallet send --help Send a transaction through the daemon-hosted TransactionController. Estimates gas automatically unless overridden, signs, broadcasts, and prints the resulting transaction hash. The daemon auto-approves, so the confirmation boundary is this command. USAGE $ mm wallet send --to <value> [--value <value>] [--from <value>] [--data <value>] [--network-client-id <value>] [--chain-id <value>] [--gas <value>] [--max-fee-per-gas <value>] [--max-priority-fee-per-gas <value>] [--gas-price <value>] [--dry-run] [-y] [-t <value>] FLAGS -t, --timeout=<value> Response timeout in milliseconds -y, --yes Skip the confirmation prompt and broadcast immediately. --chain-id=<value> Chain ID (0x-prefixed hex) to resolve to a network client. Provide this or --network-client-id, not both. --data=<value> Calldata as a 0x-prefixed hex string (for contract calls) --dry-run Resolve the network client and sender and validate params, but do not broadcast. --from=<value> Sender address (0x-prefixed). Defaults to the selected account. --gas=<value> Gas limit override, as a 0x-prefixed hex quantity --gas-price=<value> Legacy gasPrice override, as a 0x-prefixed hex wei quantity --max-fee-per-gas=<value> maxFeePerGas override, as a 0x-prefixed hex wei quantity --max-priority-fee-per-gas=<value> maxPriorityFeePerGas override, as a 0x-prefixed hex wei quantity --network-client-id=<value> Network client to send on. Provide this or --chain-id, not both. --to=<value> (required) Recipient address (0x-prefixed) --value=<value> [default: 0] Amount to send, in ether (e.g. 0.01). Defaults to 0. EXAMPLES $ mm wallet send --to 0xRecipient --value 0.01 --chain-id 0x1 $ mm wallet send --to 0xRecipient --value 0.01 --network-client-id mainnet --yes $ mm wallet send --to 0xContract --data 0xabcdef --value 0 --chain-id 0x1 --dry-run ``` ## Testing - Unit tests for the handler (network/sender resolution, internal submit, dry-run, broadcast + live status, param validation) and the command (arg parsing, preview/confirm/abort, `--yes`, `--dry-run`, error surfaces); **100% coverage maintained**. - **Real-chain e2e** (`tests/wallet-send.e2e.test.ts`): boots a local `anvil` node, adds it as a custom network, and drives the built `mm` CLI to sign, broadcast, and mine a real transaction (asserts receipt `status: 0x1` and a recipient balance increase). It is **skip-if-absent**; CI installs `anvil` for it only when `packages/wallet-cli/` changed. See `packages/wallet-cli/tests/README.md`. - `build`, package `test`, `test:e2e`, `yarn lint`, `changelog:validate` pass. ## References - Closes MetaMask#9513 - Builds on MetaMask#9512 / MetaMask#9611 (daemon transaction-capable) and MetaMask#9509 (the `TransactionController` slot); the mutating-RPC safety prerequisite MetaMask#9511 landed in MetaMask#9608. - `packages/wallet-cli/src/daemon/send-transaction.ts`, `src/commands/wallet/send.ts`, `tests/wallet-send.e2e.test.ts`. > [!NOTE] > Stacked on `sirtimid/wallet-cli-daemon-transaction-capable` (MetaMask#9612); this PR is based on that branch so the diff is scoped. Once MetaMask#9612 merges, this will be rebased onto `main` and retargeted. ## Checklist - [x] Tests cover the handler and command (unit) plus a real-chain broadcast (e2e); 100% coverage maintained. - [x] `build`, `test`, `test:e2e`, `yarn lint:fix`, `yarn lint`, `changelog:validate` pass. - [x] Confirmation prompt (`--yes` to skip) and `--dry-run` gate a real, irreversible send. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **High Risk** > Adds an irreversible on-chain send path through a headless daemon that auto-approves transactions; mistakes in confirmation, `--yes`, or timeout/retry behavior could move real funds despite CLI safeguards. > > **Overview** > Introduces **`mm wallet send`** so users can broadcast through the daemon-hosted `TransactionController`, with ether `--value`, network selection via `--network-client-id` or `--chain-id`, optional gas overrides, **`--dry-run`**, and an interactive preview (or **`--yes`** to skip). > > Because `addTransaction`'s broadcast promise cannot cross JSON-RPC, the daemon gains a dedicated **`sendTransaction`** handler that resolves network/sender, submits as internal/auto-approved, awaits the hash, and returns `{ transactionHash, transactionId, status }` (with **`dryRun`** for preview-only). > > The CLI dry-runs before confirm, then pins the resolved **`from`** / **`networkClientId`** on broadcast; it validates RPC results, uses a longer default broadcast timeout with duplicate-send warnings on timeout, and documents that the daemon still auto-approves—so the command prompt is the main fund-moving gate. > > **CI/testing:** wallet-cli e2e installs **anvil** via `@metamask/foundryup`, sets **`MM_E2E_REQUIRE_ANVIL`**, adds a real-chain send e2e (anvil + custom network), shares daemon cleanup helpers, and updates knip/README/changelog accordingly. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0f0e34f. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Erik Marks <25517051+rekmarks@users.noreply.github.com>

sirtimid added a commit that referenced this pull request Jul 22, 2026

docs(wallet-cli): point changelog entry at PR #9612

3bd65df

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sirtimid added a commit that referenced this pull request Jul 23, 2026

docs(wallet-cli): point changelog entry at PR #9612

cce0512

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sirtimid force-pushed the sirtimid/wallet-cli-daemon-transaction-capable branch from 3bd65df to 09b4bb2 Compare July 23, 2026 08:49

sirtimid marked this pull request as ready for review July 23, 2026 08:50

sirtimid requested review from a team as code owners July 23, 2026 08:50

sirtimid temporarily deployed to default-branch July 23, 2026 08:50 — with GitHub Actions Inactive

sirtimid and others added 9 commits July 23, 2026 16:26

docs(wallet-cli): point changelog entry at PR #9612

12c4c70

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(wallet-cli): trim over-verbose inline comment on auto-approval setup

1aea676

Keep only the ordering rationale; the rest is already in the function name and its JSDoc. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(wallet-cli): remove redundant parens in type cast assertion

0118faf

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(wallet-cli): consolidate duplicate wallet bump entries and streng…

26e4183

…then async rejection test Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sirtimid force-pushed the sirtimid/wallet-cli-daemon-transaction-capable branch from 8f95983 to 26e4183 Compare July 23, 2026 13:34

sirtimid mentioned this pull request Jul 23, 2026

feat(wallet-cli): add the mm wallet send command #9636

Merged

3 tasks

rekmarks approved these changes Jul 24, 2026

View reviewed changes

sirtimid added this pull request to the merge queue Jul 24, 2026

Merged via the queue into main with commit a0e11fb Jul 24, 2026
427 checks passed

sirtimid deleted the sirtimid/wallet-cli-daemon-transaction-capable branch July 24, 2026 11:04

sirtimid added a commit that referenced this pull request Jul 24, 2026

docs(wallet-cli): point changelog entry at PR #9612

ee49cea

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Navigation Menu

Uh oh!

Uh oh!

feat(wallet-cli): headless auto-approval + document the gas-fee slot - #9612

feat(wallet-cli): headless auto-approval + document the gas-fee slot#9612
sirtimid merged 9 commits into
mainfrom
sirtimid/wallet-cli-daemon-transaction-capable

sirtimid commented Jul 22, 2026 •

edited by cursor Bot

Loading

Uh oh!

rekmarks left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

sirtimid commented Jul 22, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Piece 1 — consume GasFeeController

Piece 2 — headless auto-approval

Security consideration — auto-approval is a conscious trust decision

References

Related

Checklist

Uh oh!

rekmarks left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sirtimid commented Jul 22, 2026 •

edited by cursor Bot

Loading

Piece 1 — consume `GasFeeController`