feat(wallet-cli): Add wallet CLI with daemon support

[rekmarks]

Introduces an oclif CLI for @metamask/wallet. It is more or less a port of the Ocap Kernel equivalent.

Usage

First, cd packages/wallet-cli.

Then, to start the daemon:

yarn mm daemon start \
  --infura-project-id <YOUR_PROJECT_ID> \
  --password testpass \
  --srp 'test test test test test test test test test test test ball'

Try calling an available controller action:

yarn mm daemon call AccountsController:listAccounts

Actions params must be specified as a stringified JSON array:

yarn mm daemon call \
    KeyringController:signPersonalMessage \
    '[{"data": "0x48656c6c6f2c20776f726c6421", "from": "0xc6d5a3c98ec9073b54fa0969957bd582e8d874bf"}]'

When done, stop the daemon and clean up:

yarn mm daemon purge --force

Summary

• Create wallet-cli package scaffolded with oclif (mm binary)
• Implement daemon infrastructure for running a @metamask/wallet instance as a detached background process, communicating over JSON-RPC via Unix domain sockets
• Add daemon commands: start, stop, status, purge, call
• call command dispatches arbitrary messenger actions to the running daemon (e.g. mm daemon call AccountsController:listAccounts)
• Unit tests for all daemon modules (108 tests, 100% coverage on daemon code)

Persistence (closes #8682)

The Node-only SQLite persistence layer that previously lived in @metamask/wallet/persistence moves to @metamask/wallet-cli so the wallet package stays platform-agnostic. The daemon now persists controller state across restarts.

• Move KeyValueStore, loadState, and subscribeToChanges from packages/wallet/src/persistence/ to packages/wallet-cli/src/persistence/ along with their tests; relocate the better-sqlite3 + @types/better-sqlite3 deps and the prebuild-install block of the test-prep script.
• Drop the ./persistence subpath export from @metamask/wallet (breaking change — captured in its changelog).
• createWallet now opens a KeyValueStore at <dataDir>/wallet.db, hydrates the Wallet from loadState, wires subscribeToChanges against the wallet's messenger + controllerMetadata, and only imports the SRP on first run (detected by absence of a persisted KeyringController.vault).
• daemon-entry.ts closes the store during shutdown and during startup-failure cleanup (logged, idempotent with wallet.destroy()).
• On any post-construction failure (subscribeToChanges/importSecretRecoveryPhrase/etc.) the wallet is destroyed before the store closes so persistence handlers unsubscribe cleanly. On a first-run failure the on-disk database (wallet.db + -wal + -shm) is removed so a retry can't latch onto an orphaned partial vault.
• subscribeToChanges' controllerMetadata parameter is now Readonly<Record<string, Readonly<StateMetadataConstraint>>>, matching Wallet.controllerMetadata exactly.
• 161/161 wallet-cli tests pass at 100% line/branch/function/statement coverage.

On subsequent runs the persisted vault is reused and the SRP is unused; the wallet still starts locked (KeyringController.isUnlocked is persist: false), so unlocking it remains the caller's responsibility — a follow-up will wire that into the daemon.

---

Note

Medium Risk
Adds a new CLI + background daemon that can dispatch arbitrary @metamask/wallet messenger actions over a local Unix socket, which is operationally/security sensitive if socket permissions or secret handling are misconfigured. Most changes are additive and well-tested, but they introduce new process/spawn/shutdown and IPC behavior.

Overview
Introduces a new @metamask/wallet-cli package (oclif mm binary) that can start a detached wallet daemon and interact with it over newline-delimited JSON-RPC on a Unix domain socket.

Adds daemon lifecycle and IPC plumbing (ensureDaemon spawn/polling, startRpcSocketServer request handling + shutdown, client sendCommand/pingDaemon, PID/socket/log management) and CLI commands to start, stop, status, purge, and call arbitrary wallet messenger actions (with optional JSON-array params and timeouts).

Wires the new package into the monorepo (tsconfig refs, README/dependency graph, CODEOWNERS/teams ownership, ESLint exceptions, yarn workspace/export validation exceptions) and updates @metamask/wallet exports to expose importSecretRecoveryPhrase for CLI wallet bootstrapping.

^{Reviewed by Cursor Bugbot for commit 41a2397. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​inquirer/​confirm@​6.0.7 ⏵ 6.0.11	+1
	@​oclif/​core@​4.10.5

View full report

[rekmarks]

@SocketSecurity ignore npm/jake@10.9.4

Transitive via @oclif/core. Usage not suspicious.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8e1bd9d. Configure here.}