From 24852c6789afe6d0fe24bc621cb462488fe21975 Mon Sep 17 00:00:00 2001
From: Shannon Sands <shannon.sands.1979@gmail.com>
Date: Fri, 27 Mar 2026 11:35:46 +1000
Subject: [PATCH] fix(wallet): auto-unlock keystore in wallet runtime for
 CLI/headless use

get_runtime() now calls ensure_unlocked(interactive=False) when the
keystore is initialized but locked, so HERMES_KEYSTORE_PASSPHRASE and
credential-store-cached passphrases work for wallet CLI commands without
requiring a separate unlock step.

Found during Linux sandbox testing where 'hermes wallet status' failed
with KeystoreLocked despite the env var being set.
---
 wallet/runtime.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/wallet/runtime.py b/wallet/runtime.py
index 3fac68320f85..711b6eade382 100644
--- a/wallet/runtime.py
+++ b/wallet/runtime.py
@@ -63,7 +63,11 @@ def get_runtime():
 
     ks = get_keystore()
     if not ks.is_unlocked:
-        return None, None
+        try:
+            if not ks.ensure_unlocked(interactive=False):
+                return None, None
+        except Exception:
+            return None, None
 
     mgr = WalletManager(ks, state_dir=_wallet_state_dir())
     wallet_cfg = _load_wallet_config()