@deeeed/metamask-harness 0.17.3 → 0.17.4

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## 0.17.4 - 2026-07-15
+
+### Fixed
+
+- Removed file replacement races from Extension title stamping and incremental webpack-log reads.
+- Validated passive registry versions before caching them and documented the intentional persistence boundary for untrusted application-console transcripts.
+
 ## 0.17.3 - 2026-07-15
 
 ### Added

package/adapters/extension/console-tail.mjs

@@ -75,7 +75,11 @@ const cooldown = new Map();
 // Chrome CDP WebSocket (127.0.0.1:<cdpPort>) — a trusted-local endpoint.
 function out(line, destination = null) {
   process.stdout.write(`${line}\n`);
-  if (destination) appendFileSync(destination, `${line}\n`);
+  if (destination) {
+    // This file is explicitly an untrusted application-console transcript; it is never executed or parsed as configuration.
+    // codeql[js/http-to-file-access]
+    appendFileSync(destination, `${line}\n`);
+  }
 }
 
 function stamp() {

package/adapters/extension/stamp-runtime-title.cjs

@@ -12,15 +12,24 @@ function stampRuntimeTitles({ target, runtimeDist, runtimeDir = process.env.RECI
   const stamped = [];
   for (const name of ['home.html', 'sidepanel.html']) {
     const file = path.join(runtimeDist, name);
-    if (!fs.existsSync(file)) continue;
-    const source = fs.readFileSync(file, 'utf8');
-    const next = source.replace(/<title>([^<]*)<\/title>/iu, (_match, title) => {
-      const base = String(title || 'MetaMask').replace(/^.+?\s+[—–-]\s+/u, '') || 'MetaMask';
-      return `<title>${slotId} — ${base}</title>`;
-    });
-    if (next === source) continue;
-    fs.writeFileSync(file, next);
-    stamped.push(name);
+    let fd;
+    try {
+      fd = fs.openSync(file, 'r+');
+      const source = fs.readFileSync(fd, 'utf8');
+      const next = source.replace(/<title>([^<]*)<\/title>/iu, (_match, title) => {
+        const base = String(title || 'MetaMask').replace(/^.+?\s+[—–-]\s+/u, '') || 'MetaMask';
+        return `<title>${slotId} — ${base}</title>`;
+      });
+      if (next === source) continue;
+      const bytes = Buffer.from(next, 'utf8');
+      fs.writeSync(fd, bytes, 0, bytes.length, 0);
+      fs.ftruncateSync(fd, bytes.length);
+      stamped.push(name);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    } finally {
+      if (fd !== undefined) fs.closeSync(fd);
+    }
   }
   return { slotId, stamped };
 }

package/adapters/extension/sync-webpack-dist.cjs

@@ -67,26 +67,28 @@ function poll() {
     removeOwnPidFile();
     process.exit(0);
   }
+  let fd;
   try {
-    const size = fs.statSync(watchLog).size;
+    fd = fs.openSync(watchLog, 'r');
+    const size = fs.fstatSync(fd).size;
     if (size < offset) {
       offset = 0;
       carry = '';
     }
     if (size > offset) {
       const length = size - offset;
-      const fd = fs.openSync(watchLog, 'r');
       const chunk = Buffer.alloc(length);
-      fs.readSync(fd, chunk, 0, length, offset);
-      fs.closeSync(fd);
-      offset = size;
-      const text = carry + chunk.toString('utf8');
+      const bytesRead = fs.readSync(fd, chunk, 0, length, offset);
+      offset += bytesRead;
+      const text = carry + chunk.subarray(0, bytesRead).toString('utf8');
       const lines = text.split(/\r?\n/u);
       carry = lines.pop() || '';
       if (lines.some((line) => compilePattern.test(line))) syncRuntimeDist();
     }
   } catch (error) {
     if (error?.code !== 'ENOENT') process.stderr.write(`runtime-dist sync monitor: ${error.message}\n`);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
   }
   timer = setTimeout(poll, 250);
 }

package/adapters/shared/update-check-worker.mjs

@@ -5,6 +5,12 @@ import path from 'node:path';
 const [cacheFile, timeoutText, endpoint] = process.argv.slice(2);
 const timeoutMs = Number.parseInt(timeoutText ?? '', 10);
 
+function stableVersion(value) {
+  const match = /^(\d{1,6})\.(\d{1,6})\.(\d{1,6})$/u.exec(value);
+  if (!match) return null;
+  return `${Number(match[1])}.${Number(match[2])}.${Number(match[3])}`;
+}
+
 async function main() {
   if (!cacheFile || !endpoint || !Number.isInteger(timeoutMs) || timeoutMs < 1) return;
   const controller = new AbortController();
@@ -14,6 +20,8 @@ async function main() {
     if (!response.ok) return;
     const data = await response.json();
     if (!data || typeof data.latest !== 'string' || data.latest.length === 0) return;
+    const latest = stableVersion(data.latest);
+    if (!latest) return;
     let lastCheck = Date.now();
     try {
       const cached = JSON.parse(fs.readFileSync(cacheFile, 'utf8'));
@@ -23,7 +31,7 @@ async function main() {
     }
     fs.mkdirSync(path.dirname(cacheFile), { recursive: true });
     const temporary = `${cacheFile}.${process.pid}.tmp`;
-    fs.writeFileSync(temporary, JSON.stringify({ lastCheck, latest: data.latest }));
+    fs.writeFileSync(temporary, JSON.stringify({ lastCheck, latest }));
     fs.renameSync(temporary, cacheFile);
   } catch {
     // Passive checks are intentionally silent; the explicit update command teaches failures.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.17.3",
+  "version": "0.17.4",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"