fix(evm-wallet-experiment): use node -e for COMMS_PARAMS and ENTROPY JSON construction

Replace ad-hoc shell string interpolation for COMMS_PARAMS (relay
address, allowedWsHosts) and ENTROPY with node -e + env vars. The
old pattern was vulnerable to JSON injection if RELAY_ADDR contained
double-quote characters, and was inconsistent with the rest of the
scripts' JSON construction discipline.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sirtimid

packages/evm-wallet-experiment/scripts/setup-away.sh

@@ -234,21 +234,16 @@ if [[ -n "$RELAY_ADDR" ]]; then
 else
   info "Initializing remote comms (direct QUIC on port $QUIC_PORT)..."
 fi
-COMMS_PARAMS="{\"directListenAddresses\":[\"/ip4/0.0.0.0/udp/${QUIC_PORT}/quic-v1\"]"
-if [[ -n "$RELAY_ADDR" ]]; then
-  COMMS_PARAMS="${COMMS_PARAMS},\"relays\":[\"${RELAY_ADDR}\"]"
-  # Extract the relay host (IP or hostname) for the ws:// allowlist.
-  # Plain ws:// to public IPs is denied by default; allowedWsHosts permits it.
-  RELAY_HOST=$(echo "$RELAY_ADDR" | node -e "
-    const addr = require('fs').readFileSync('/dev/stdin','utf8').trim();
-    const m = addr.match(/\\/(?:ip4|ip6|dns4|dns6)\\/([^\\/]+)/);
-    if (m) process.stdout.write(m[1]);
-  ")
-  if [[ -n "$RELAY_HOST" ]]; then
-    COMMS_PARAMS="${COMMS_PARAMS},\"allowedWsHosts\":[\"${RELAY_HOST}\"]"
-  fi
-fi
-COMMS_PARAMS="${COMMS_PARAMS}}"
+COMMS_PARAMS=$(QUIC="$QUIC_PORT" RELAY="$RELAY_ADDR" node -e "
+  const p = { directListenAddresses: ['/ip4/0.0.0.0/udp/' + process.env.QUIC + '/quic-v1'] };
+  const relay = process.env.RELAY;
+  if (relay) {
+    p.relays = [relay];
+    const m = relay.match(/\\/(?:ip4|ip6|dns4|dns6)\\/([^\\/]+)/);
+    if (m) p.allowedWsHosts = [m[1]];
+  }
+  process.stdout.write(JSON.stringify(p));
+")
 daemon_exec initRemoteComms "$COMMS_PARAMS" >/dev/null
 ok "Remote comms initialized"
 
@@ -415,7 +410,10 @@ info "Initializing throwaway keyring..."
 # is unavailable inside vats). The entropy is passed to the keyring vat which uses
 # it as the private key for the throwaway account.
 ENTROPY="0x$(node -e "process.stdout.write(require('crypto').randomBytes(32).toString('hex'))")"
-daemon_qm --quiet "$ROOT_KREF" initializeKeyring "[{\"type\":\"throwaway\",\"entropy\":\"$ENTROPY\"}]" >/dev/null
+INIT_ARGS=$(ENTROPY="$ENTROPY" node -e "
+  process.stdout.write(JSON.stringify([{ type: 'throwaway', entropy: process.env.ENTROPY }]));
+")
+daemon_qm --quiet "$ROOT_KREF" initializeKeyring "$INIT_ARGS" >/dev/null
 ok "Throwaway keyring initialized"
 
 info "Verifying accounts..."

packages/evm-wallet-experiment/scripts/setup-home.sh

@@ -253,21 +253,16 @@ if [[ -n "$RELAY_ADDR" ]]; then
 else
   info "Initializing remote comms (direct QUIC on port $QUIC_PORT)..."
 fi
-COMMS_PARAMS="{\"directListenAddresses\":[\"/ip4/0.0.0.0/udp/${QUIC_PORT}/quic-v1\"]"
-if [[ -n "$RELAY_ADDR" ]]; then
-  COMMS_PARAMS="${COMMS_PARAMS},\"relays\":[\"${RELAY_ADDR}\"]"
-  # Extract the relay host (IP or hostname) for the ws:// allowlist.
-  # Plain ws:// to public IPs is denied by default; allowedWsHosts permits it.
-  RELAY_HOST=$(echo "$RELAY_ADDR" | node -e "
-    const addr = require('fs').readFileSync('/dev/stdin','utf8').trim();
-    const m = addr.match(/\\/(?:ip4|ip6|dns4|dns6)\\/([^\\/]+)/);
-    if (m) process.stdout.write(m[1]);
-  ")
-  if [[ -n "$RELAY_HOST" ]]; then
-    COMMS_PARAMS="${COMMS_PARAMS},\"allowedWsHosts\":[\"${RELAY_HOST}\"]"
-  fi
-fi
-COMMS_PARAMS="${COMMS_PARAMS}}"
+COMMS_PARAMS=$(QUIC="$QUIC_PORT" RELAY="$RELAY_ADDR" node -e "
+  const p = { directListenAddresses: ['/ip4/0.0.0.0/udp/' + process.env.QUIC + '/quic-v1'] };
+  const relay = process.env.RELAY;
+  if (relay) {
+    p.relays = [relay];
+    const m = relay.match(/\\/(?:ip4|ip6|dns4|dns6)\\/([^\\/]+)/);
+    if (m) p.allowedWsHosts = [m[1]];
+  }
+  process.stdout.write(JSON.stringify(p));
+")
 daemon_exec initRemoteComms "$COMMS_PARAMS" >/dev/null
 ok "Remote comms initialized"