feat(wallet-cli): headless auto-approval + document the gas-fee slot

[sirtimid]

Explanation

Makes the @metamask/wallet-cli daemon able to process a transaction end-to-end by completing the two consumer-side pieces a wired TransactionController needs at runtime. This makes the daemon transaction-capable; the user-facing mm send command is a separate follow-on.

TransactionController is wired into @metamask/wallet and its messenger delegates to GasFeeController and ApprovalController. A send flow currently dead-ends in the daemon in two ways, both fixed here.

Piece 1 — consume GasFeeController

The gasFeeController slot (clientId: 'cli') already exists in buildInstanceOptions — it was added when GasFeeController was wired upstream (#9527) because clientId is required. This PR finishes the consumer side:

• Documents the slot in the buildInstanceOptions JSDoc slot list.
• Relies on the wallet package's platform-agnostic production default for EIP1559APIEndpoint (the default is already the prod URL) rather than re-specifying the string in the CLI, so the endpoint stays centrally owned.

With GasFeeController wired and released, a daemon-hosted Wallet now resolves GasFeeController:fetchGasFeeEstimates instead of throwing A handler for ... has not been registered.

Piece 2 — headless auto-approval

ApprovalController:addRequest is awaited by transaction/signature flows. The daemon's showApprovalRequest is a no-op (it only signals "a request needs attention"; it does not resolve anything), so with no UI the awaiting call hangs forever.

subscribeToAutoApproval subscribes to ApprovalController:stateChanged and immediately accepts every pending request via ApprovalController:acceptRequest. The showApprovalRequest hook stays a no-op (there is no UI); the id isn't available to that hook, so acceptance goes through the messenger instead. An inFlight guard keeps accepting idempotent across the re-entrant/rapid state changes a single flow emits, and both sync throws and async rejections from an accept are logged and swallowed so one bad request can't crash the daemon or wedge the subscription. The subscription is installed in createWallet and torn down in its dispose path.

Security consideration — auto-approval is a conscious trust decision

Auto-approval means the daemon accepts every approval request without confirmation — transactions and signatures included. For a headless daemon this is the intended model: it is driven only by its owner's local CLI over a 0600, same-user Unix socket, so the trust boundary is the socket, not a per-request prompt. This is documented as the daemon's explicit trust model in subscribeToAutoApproval and the README, and flagged as not "safe by default" — a scoped/opt-in policy (config flag, or accepting only specific approval types) is deferred until the user-facing send command exists.

References

• packages/wallet-cli/src/daemon/auto-approval.ts — the auto-approval subscription + trust model.
• packages/wallet-cli/src/daemon/wallet-factory.ts — buildInstanceOptions slot docs; createWallet/teardown wiring.

Related

• Closes wallet-cli: make the daemon transaction-capable — consume GasFeeController + headless auto-approval #9512
• Builds on feat(wallet-cli): wire the TransactionController slot in the daemon wallet #9509 (TransactionController slot) and feat(wallet)!: wire GasFeeController into default initialization #9527 (wire GasFeeController into @metamask/wallet)
• Unblocks wallet-cli: add the mm send-transaction command #9513 (the mm send command), which is additionally gated on wallet-cli: make sendCommand retry idempotency-safe before mutating RPC ships #9511

Checklist

• Tests cover both the gas slot and the auto-approval accept path (unit + real-Wallet integration); 100% coverage maintained.
• build, package test, yarn lint:fix, yarn lint, changelog:validate pass.
• Auto-approval trust model documented in code and README.
• Teardown (dispose) unsubscribes the auto-approval listener.

🤖 Generated with Claude Code

---

Note

High Risk
Auto-approving every transaction and signature without user confirmation is a deliberate but security-sensitive behavior; compromise of the local Unix socket can move funds.

Overview
Adds subscribeToAutoApproval, which listens for ApprovalController:stateChanged and immediately calls ApprovalController:acceptRequest for every pending id so headless transaction/signature flows no longer hang on the no-op showApprovalRequest hook. An inFlight guard avoids duplicate accepts across re-entrant state updates; accept failures are logged and swallowed.

createWallet registers this subscription before wallet.init() and tears it down in dispose (via shared runUnsubscribe), including error paths when subscribe/unsubscribe throws.

Documents the daemon trust model (socket access implies fund movement; no per-request prompt) in README, CHANGELOG, and module JSDoc, and expands buildInstanceOptions JSDoc for the existing gasFeeController slot (clientId: 'cli', default gas API URL).

Unit tests cover the subscription behavior; integration tests assert a real wallet resolves addRequest without hanging.

^{Reviewed by Cursor Bugbot for commit 01ac4a7. Bugbot is set up for automated code reviews on this repo. Configure here.}