fix(perps-controller): handle revoked HyperLiquid agents and wallet-chain signing

[abretonc7s]

Explanation

Running 19.0.0 with an extension wallet (EIP-1193 accountSigner plus a HyperLiquid agent) showed three problems:

• A revoked agent wasn't detected. After a revoke, HyperLiquid can answer Must deposit before performing actions, not only User or API Wallet … does not exist. That answer now counts as a rejection only if extraAgents no longer lists the agent that signed that request. The answer is attributed by the request's own signature, inside a wallet binding per network and session. When it counts, the write returns KEYRING_LOCKED, the agent is dropped and onAgentRejected fires. Main-account signatures are never attributed to an agent.
• User-signed actions were signed for chain 1. PerpsAccountSigner gets an optional getChainId(), passed to the SDK as signatureChainId. Builder fee approvals, withdrawals and transfers are then signed on the wallet's chain. Without it nothing changes, so Mobile and Extension are unaffected.
• A refused builder fee approval was requested again. A permanent refusal (e.g. the builder's balance is too low) is now cached until disconnect, so there's no repeat prompt, and prepareTradingWallet returns the venue's message.

Also: getExchangeClient() initializes the provider's clients before returning one.

Validation

• Unit: new tests for each case, including network switches, reconnects and queued writes. 31 of them fail on main with the reported symptoms. Mutation checks on the attribution guards each fail a test. The package suite passes with coverage on Node 22 and 24.
• HyperLiquid testnet, through the core harness: 14 approve → trade → revoke → order cycles. This branch returns KEYRING_LOCKED and calls onAgentRejected. main returns the raw venue error. User-signed actions go out with signatureChainId 0x66eee (421614).

Known issues / follow-ups

• Whether extraAgents lists an unnamed agent is undocumented. The onAgentRejected docs ask hosts to approve named agents.
• validUntil is compared against the device clock.
• If re-init fails inside toggleTestnet(), the client service keeps the previous network's wallet. This is harmless today; the fix is a follow-up.
• Market data without a selected account needs a lazy exchange client. That's a separate change.

References

• Follows feat(perps-controller): sign without KeyringController and with a HyperLiquid agent #10559

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Changes HyperLiquid signing, agent eviction, and trading-wallet setup paths; mistakes could mis-classify venue errors or drop agents incorrectly, but behavior is heavily covered by new tests.

Overview
Fixes HyperLiquid trading setup and signing when hosts use an accountSigner plus an agent (typical extension wallets).

Revoked / expired agents: The provider now ties each L1 signature to the network and session wallet that created it, and links venue answers back to that signature via onExchangeRequest. A "Must deposit before performing actions" response is treated as agent rejection only when extraAgents no longer lists (or has expired) the agent that signed that request—not when the account is simply unfunded. Unknown-wallet errors are attributed to the request’s network, so a shared agent on mainnet and testnet is dropped only where the venue rejected it. Queued writes that sign after a network switch use the original wallet’s agent resolver.

User-signed actions: Optional PerpsAccountSigner.getChainId flows through the wallet adapter as SDK signatureChainId, so builder fee, withdraw, and transfer payloads can be signed on the connected chain instead of chain 1.

Builder fee: Permanent venue refusals (e.g. insufficient builder balance) are cached until disconnect—no repeat approval prompts; prepareTradingWallet can return the venue message without logging it as a generic setup failure.

Other: getExchangeClient() ensures the provider’s SDK clients (and agent wallet) are initialized first; subscription-created wallets use the same agent binding as the provider.

^{Reviewed by Cursor Bugbot for commit 88f7383. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0c63793. Configure here.}