feat(wallet-cli): headless auto-approval + document the gas-fee slot

[sirtimid]

Explanation

Makes the @metamask/wallet-cli daemon able to process a transaction end-to-end by completing the two consumer-side pieces a wired TransactionController needs at runtime. This makes the daemon transaction-capable; the user-facing mm send command is a separate follow-on.

TransactionController is wired into @metamask/wallet and its messenger delegates to GasFeeController and ApprovalController. A send flow currently dead-ends in the daemon in two ways, both fixed here.

Piece 1 — consume GasFeeController

The gasFeeController slot (clientId: 'cli') already exists in buildInstanceOptions — it was added when GasFeeController was wired upstream (#9527) because clientId is required. This PR finishes the consumer side:

• Documents the slot in the buildInstanceOptions JSDoc slot list.
• Relies on the wallet package's platform-agnostic production default for EIP1559APIEndpoint (the default is already the prod URL) rather than re-specifying the string in the CLI, so the endpoint stays centrally owned.

With GasFeeController wired and released, a daemon-hosted Wallet now resolves GasFeeController:fetchGasFeeEstimates instead of throwing A handler for ... has not been registered.

Piece 2 — headless auto-approval

ApprovalController:addRequest is awaited by transaction/signature flows. The daemon's showApprovalRequest is a no-op (it only signals "a request needs attention"; it does not resolve anything), so with no UI the awaiting call hangs forever.

subscribeToAutoApproval subscribes to ApprovalController:stateChanged and immediately accepts every pending request via ApprovalController:acceptRequest. The showApprovalRequest hook stays a no-op (there is no UI); the id isn't available to that hook, so acceptance goes through the messenger instead. An inFlight guard keeps accepting idempotent across the re-entrant/rapid state changes a single flow emits, and both sync throws and async rejections from an accept are logged and swallowed so one bad request can't crash the daemon or wedge the subscription. The subscription is installed in createWallet and torn down in its dispose path.

Security consideration — auto-approval is a conscious trust decision

Auto-approval means the daemon accepts every approval request without confirmation — transactions and signatures included. For a headless daemon this is the intended model: it is driven only by its owner's local CLI over a 0600, same-user Unix socket, so the trust boundary is the socket, not a per-request prompt. This is documented as the daemon's explicit trust model in subscribeToAutoApproval and the README, and flagged as not "safe by default" — a scoped/opt-in policy (config flag, or accepting only specific approval types) is deferred until the user-facing send command exists.

References

• packages/wallet-cli/src/daemon/auto-approval.ts — the auto-approval subscription + trust model.
• packages/wallet-cli/src/daemon/wallet-factory.ts — buildInstanceOptions slot docs; createWallet/teardown wiring.

Related

• Closes wallet-cli: make the daemon transaction-capable — consume GasFeeController + headless auto-approval #9512
• Builds on feat(wallet-cli): wire the TransactionController slot in the daemon wallet #9509 (TransactionController slot) and feat(wallet)!: wire GasFeeController into default initialization #9527 (wire GasFeeController into @metamask/wallet)
• Unblocks wallet-cli: add the mm send-transaction command #9513 (the mm send command), which is additionally gated on wallet-cli: make sendCommand retry idempotency-safe before mutating RPC ships #9511

Checklist

• Tests cover both the gas slot and the auto-approval accept path (unit + real-Wallet integration); 100% coverage maintained.
• build, package test, yarn lint:fix, yarn lint, changelog:validate pass.
• Auto-approval trust model documented in code and README.
• Teardown (dispose) unsubscribes the auto-approval listener.

🤖 Generated with Claude Code

---

Note

High Risk
Auto-approves every transaction and signature without user confirmation; anyone who can reach the daemon socket can move funds, which is an intentional but security-critical design choice.

Overview
The wallet daemon can now finish transaction and signature flows that await ApprovalController:addRequest, which previously hung forever because showApprovalRequest is a no-op with no UI.

subscribeToAutoApproval listens for ApprovalController:stateChanged and calls ApprovalController:acceptRequest for every pending id. An in-flight set avoids double-accept on re-entrant state updates; accept failures are logged and swallowed so one bad request cannot wedge the daemon. createWallet installs the subscription before wallet.init and tears it down in dispose via a shared runUnsubscribe helper alongside persistence.

Security: the daemon auto-approves all requests (transactions and signatures) with no per-request prompt; the documented trust boundary is the 0600 same-user Unix socket. README and CHANGELOG call this out; scoped approval policy is deferred.

Also documents the existing gasFeeController slot (clientId: 'cli') in buildInstanceOptions JSDoc so gas estimation is clearly part of the daemon’s wired stack.

^{Reviewed by Cursor Bugbot for commit 8f95983. Bugbot is set up for automated code reviews on this repo. Configure here.}