(feat) (openai/gpt-5.5, reviewed T, tested T) add wallet create and link commands

Author: paoloanzn

cli/src/index.ts

@@ -16,6 +16,9 @@ import { getOctokit } from "./github/auth.js";
 import { getLocalGithubRepo } from "./github/repo.js";
 import { getRepoSecretMetadata, setRepoSecret } from "./github/secrets.js";
 import { getRepoVariableMetadata, setRepoVariable } from "./github/vars.js";
+import { createWallet } from "./wallet/create.js";
+import { DEFAULT_PRIVATE_KEY_SECRET_NAME, linkWallet } from "./wallet/link.js";
+import { walletFilePath } from "./wallet/store.js";
 
 const COMMAND_NAME = "fcf";
 const COMMAND_DESCRIPTION = "FCF CLI tool.";
@@ -42,6 +45,7 @@ function buildProgram(): Command {
     addRegisterCommand(program);
     addKeysSyncCommand(program);
     addListCommand(program);
+    addWalletCommand(program);
     const githubCommand = program.command("github");
     addGithubWhoamiCommand(githubCommand);
     addGithubSecretsCommand(githubCommand);
@@ -50,6 +54,33 @@ function buildProgram(): Command {
     return program;
 }
 
+function addWalletCommand(program: Command): void {
+    const walletCommand = program.command("wallet");
+
+    walletCommand
+        .command("create")
+        .option("--force", "overwrite existing local wallet")
+        .action((opts) => {
+            try {
+                const wallet = createWallet({ force: Boolean(opts.force) });
+                console.log(`wallet created: ${wallet.address}`);
+                console.log(`saved: ${walletFilePath()}`);
+            } catch (err) { die(err); }
+        });
+
+    // set FCF_PRIVATE_KEY in the active github repo -> used after `wallet create`
+    walletCommand
+        .command("link")
+        .option("--secret-name <name>", "GitHub Actions private key secret name", DEFAULT_PRIVATE_KEY_SECRET_NAME)
+        .action(async (opts) => {
+            try {
+                const wallet = await linkWallet({ secretName: opts.secretName });
+                console.log(`wallet linked: ${wallet.address}`);
+                console.log(`secret set: ${opts.secretName}`);
+            } catch (err) { die(err); }
+        });
+}
+
 // spawns the github action workflow file that runs the `register` command
 function addInitCommand(program: Command): void {
     program

cli/src/wallet/create.ts

@@ -0,0 +1,19 @@
+import { privateKeyToAccount, generatePrivateKey } from "viem/accounts";
+
+import { readLocalWallet, saveLocalWallet, type StoredWallet, walletFilePath } from "./store.js";
+
+export type CreateWalletOptions = {
+    force: boolean;
+}
+
+export function createWallet(options: CreateWalletOptions): StoredWallet {
+    if (readLocalWallet() && !options.force) {
+        throw new Error(`wallet already exists at ${walletFilePath()}; use --force to overwrite`);
+    }
+
+    const privateKey = generatePrivateKey();
+    const account = privateKeyToAccount(privateKey);
+    const wallet = { address: account.address, privateKey, createdAt: new Date().toISOString() };
+    saveLocalWallet(wallet);
+    return wallet;
+}

cli/src/wallet/link.ts

@@ -0,0 +1,19 @@
+import { getOctokit } from "@/github/auth.js";
+import { getLocalGithubRepo } from "@/github/repo.js";
+import { setRepoSecret } from "@/github/secrets.js";
+import { getLocalWallet, type StoredWallet } from "./store.js";
+
+export const DEFAULT_PRIVATE_KEY_SECRET_NAME = "FCF_PRIVATE_KEY";
+
+export type LinkWalletOptions = {
+    secretName: string;
+}
+
+export async function linkWallet(options: LinkWalletOptions): Promise<StoredWallet> {
+    const wallet = getLocalWallet();
+    const octokit = await getOctokit();
+    const repo = await getLocalGithubRepo(octokit);
+
+    await setRepoSecret(octokit, repo.repoName, repo.repoOwnerName, options.secretName, wallet.privateKey);
+    return wallet;
+}

cli/src/wallet/store.ts

@@ -0,0 +1,78 @@
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+
+import { getAddress, isAddress } from "viem";
+
+export type StoredWallet = {
+    address: `0x${string}`;
+    privateKey: `0x${string}`;
+    createdAt: string;
+}
+
+type WalletState = {
+    local?: StoredWallet;
+}
+
+export function walletFilePath(): string {
+    if (process.env.FCF_CONFIG_HOME) return join(resolve(process.env.FCF_CONFIG_HOME), "wallet.json");
+    if (process.env.XDG_CONFIG_HOME) return join(resolve(process.env.XDG_CONFIG_HOME), "fcf", "wallet.json");
+    return join(homedir(), ".config", "fcf", "wallet.json");
+}
+
+export function readLocalWallet(): StoredWallet | undefined {
+    return readWalletState().local;
+}
+
+export function getLocalWallet(): StoredWallet {
+    const wallet = readLocalWallet();
+    if (!wallet) throw new Error(`wallet not found at ${walletFilePath()}; run fcf wallet create`);
+    return wallet;
+}
+
+export function saveLocalWallet(wallet: StoredWallet): void {
+    const state = readWalletState();
+    state.local = wallet;
+    writeWalletState(state);
+}
+
+function readWalletState(): WalletState {
+    try {
+        return parseWalletState(JSON.parse(readFileSync(walletFilePath(), "utf8")));
+    } catch (err: any) {
+        if (err?.code === "ENOENT") return {};
+        throw err;
+    }
+}
+
+function writeWalletState(state: WalletState): void {
+    const filePath = walletFilePath();
+    mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
+
+    const tmpPath = `${filePath}.${process.pid}.tmp`;
+    writeFileSync(tmpPath, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+    renameSync(tmpPath, filePath);
+    chmodSync(filePath, 0o600);
+}
+
+function parseWalletState(value: any): WalletState {
+    const state: WalletState = {};
+    if (value?.local !== undefined) state.local = parseStoredWallet(value.local);
+    return state;
+}
+
+function parseStoredWallet(value: any): StoredWallet {
+    if (!isAddress(value?.address)) throw new Error(`invalid wallet file: local.address`);
+    if (!isPrivateKey(value?.privateKey)) throw new Error(`invalid wallet file: local.privateKey`);
+    if (typeof value?.createdAt !== "string") throw new Error(`invalid wallet file: local.createdAt`);
+
+    return {
+        address: getAddress(value.address),
+        privateKey: value.privateKey,
+        createdAt: value.createdAt,
+    };
+}
+
+function isPrivateKey(value: unknown): value is `0x${string}` {
+    return typeof value === "string" && /^0x[0-9a-fA-F]{64}$/.test(value);
+}

cli/test/wallet.test.ts

@@ -0,0 +1,30 @@
+import { mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { test, expect } from "vitest";
+
+import { createWallet } from "@/wallet/create.js";
+import { readLocalWallet, walletFilePath } from "@/wallet/store.js";
+
+test("creates and stores a local wallet", () => {
+    const previousConfigHome = process.env.FCF_CONFIG_HOME;
+    const configHome = mkdtempSync(join(tmpdir(), "fcf-wallet-"));
+    process.env.FCF_CONFIG_HOME = configHome;
+
+    try {
+        const wallet = createWallet({ force: false });
+        const filePath = walletFilePath();
+
+        expect(wallet.address).toMatch(/^0x[0-9a-fA-F]{40}$/);
+        expect(wallet.privateKey).toMatch(/^0x[0-9a-fA-F]{64}$/);
+        expect(readLocalWallet()).toEqual(wallet);
+        expect(JSON.parse(readFileSync(filePath, "utf8")).local.privateKey).toBe(wallet.privateKey);
+        expect(statSync(filePath).mode & 0o777).toBe(0o600);
+        expect(() => createWallet({ force: false })).toThrow("wallet already exists");
+    } finally {
+        if (previousConfigHome === undefined) delete process.env.FCF_CONFIG_HOME;
+        else process.env.FCF_CONFIG_HOME = previousConfigHome;
+        rmSync(configHome, { recursive: true, force: true });
+    }
+});