v2.2.0
agent-wallet v2.2.0
New Features
Core
Multi-Chain Wallet Support
- EVM-compatible chains — Ethereum, BSC, Polygon, Base, Arbitrum, and any EVM chain
- TRON — Full transaction and message signing via secp256k1
Signing-Only Design
- Pure local signing; no network calls, no RPC dependencies
- Caller builds and broadcasts transactions; SDK handles signing only
signTransaction,signMessage,signRaw,signTypedDatavia unifiedBaseWalletinterface
Mnemonic & HD Wallet Support
- Derive wallets from BIP-39 mnemonic phrases via
AGENT_WALLET_MNEMONIC - Configurable account index via
AGENT_WALLET_MNEMONIC_ACCOUNT_INDEX - EVM derivation path:
m/44'/60'/0'/0/{index} - TRON derivation path:
m/44'/195'/0'/0/{index}
CAIP-2 Network Identifier
resolveWalletProvider({ network })accepts CAIP-2 strings:eip155,eip155:1,tron,tron:nile- Network parameter required for private key / mnemonic mode to determine chain type
Dual-Language SDK with Cross-Compatibility
- Python and TypeScript SDKs with identical API surface
- Same keystore format — files created by Python can be read by TypeScript and vice versa
- Same private key + same data = same signature, regardless of language
Dual ESM + CJS Build (TypeScript)
- TypeScript SDK ships both ESM (
dist/index.js) and CJS (dist/index.cjs) bundles - Full
exportsmap withimport,require, andtypesconditions - Compatible with both
importandrequire()consumers out of the box
EIP-712 Typed Data Signing
- Full structured data signing support (x402, Permit2, Uniswap, etc.)
- Available on both EVM and TRON wallets
Security
Keystore V3 Encryption
- Private keys encrypted at rest with scrypt (N=262144, r=8, p=1) + AES-128-CTR
- Keccak256 MAC verification for integrity checking
- Password discarded from memory after provider initialization
Password Strength Enforcement
- Minimum 8 characters, requiring uppercase, lowercase, digit, and special character
- Auto-generation of secure 16-character passwords when not provided
File-Level Security
- Directory permissions set to
0o700(owner only) - Encrypted files:
master.json(sentinel),id_*.json(private keys),cred_*.json(credentials) - No private keys ever transmitted over the network in local mode
CLI
Quick Start Command (start)
- One command to initialize wallet storage, set password, and create default wallets
agent-wallet start— auto-generates password + creates default EVM and TRON walletsagent-wallet start -p <password> -i tron— custom password + import private key- Idempotent: running again verifies password and shows existing wallets
Full Wallet Management
init— Initialize secrets directory and set master passwordadd— Add wallet with interactive prompts (key generation or import)list— List all wallets with type and address in table formatuse <id>— Set active wallet (default for signing commands)inspect <id>— Show wallet detailsremove <id>— Remove wallet and associated encrypted files
Signing Commands (Positional Arguments)
sign msg <message>— Sign arbitrary messagesign tx <payload>— Sign transaction (JSON)sign typed-data <data>— Sign EIP-712 typed data (JSON)
Password & Data Management
change-password— Re-encrypts all wallet files with new passwordreset— Delete all wallet data with double confirmation (-yto skip)
Environment Variable Support
AGENT_WALLET_PASSWORD— Master password (skips CLI prompt)AGENT_WALLET_DIR— Custom secrets directory pathAGENT_WALLET_PRIVATE_KEY— Private key hex for static wallet modeAGENT_WALLET_MNEMONIC— BIP-39 mnemonic for HD wallet derivationAGENT_WALLET_MNEMONIC_ACCOUNT_INDEX— HD derivation account index (default: 0)- Password priority:
-pflag > env var > interactive prompt > auto-generate
Global Options
-p/--password— Pass password inline (all commands that require authentication)-d/--dir— Custom secrets directory-w/--wallet— Specify wallet for signing (overrides active wallet)-y/--yes— Skip confirmation prompts (remove, reset)
SDK
Wallet Providers
resolveWalletProvider({ network })/resolve_wallet_provider(network)— Environment-driven factory; auto-selectsLocalWalletProviderorStaticWalletProviderbased on env varsnew LocalWalletProvider(secretsDir, password)— File-backed multi-wallet providernew StaticWalletProvider(wallet)— Single-wallet provider for private key / mnemonic mode
LocalWalletProvider Interface
listWallets()/list_wallets()— List all configured walletsgetWallet(id)/get_wallet(id)— Get wallet instance by IDgetActiveWallet()/get_active_wallet()— Get active walletsetActive(id)/set_active(id)— Set active wallet
WalletProvider (abstract base)
getActiveWallet()/get_active_wallet()— Get active wallet (implemented by all providers)
BaseWallet Interface
getAddress()/get_address()— Returns wallet addresssignTransaction(payload)/sign_transaction(payload)— Sign transactionsignMessage(msg)/sign_message(msg)— Sign arbitrary messagesignTypedData(data)/sign_typed_data(data)— Sign EIP-712 typed datasignRaw(raw)/sign_raw(raw)— Sign pre-serialized raw bytes
Error Handling
WalletError,WalletNotFoundError,DecryptionError,SigningError,NetworkError,UnsupportedOperationError- Helpful guidance messages (e.g., "Wallet not initialized. Run 'agent-wallet init' first.")