@deeeed/metamask-harness 0.17.4 → 0.18.0

package/dist/commands/run.js

@@ -7,7 +7,6 @@ import { checkoutBusyOut, EXIT, usageOut, writeInteractiveProgress } from "./sha
 import {
   optionFlag,
   optionString,
-  requiredOption,
   resolveAdapter,
   runtimeOptionsFromCli,
   isRecord,
@@ -19,12 +18,13 @@ import {
   countRecipeNodes,
   emitHealViolation,
   executeWithHealBounds,
+  preflightRecipe,
   prepareHeal,
   recoverRunInfra,
   runRecipe,
   validateRunRecipeStatic
 } from "./run-engine.js";
-import { handleListExecutables } from "./list-executables.js";
+import { handleDescribeRecipe, handleListExecutables } from "./list-executables.js";
 import { applyDeviceTargeting } from "./device-target.js";
 import { getAdapterSurface } from "../adapters/surface.js";
 import { coreDependencyBlock } from "./core-readiness.js";
@@ -32,6 +32,7 @@ import { writeRunReport } from "./run-report.js";
 import { acquireCheckoutLock } from "../checkout-lock.js";
 import { JsonStreamWriter } from "../json-stream.js";
 import { formatRunDiagnosticsForHuman, readRunDiagnosticsDocument } from "../run-diagnostics.js";
+import { recipeTrustFailure } from "../recipe-security.js";
 async function handleRun(parsed) {
   const stream = new JsonStreamWriter("run", optionFlag(parsed.options, "jsonStream"));
   const restoreStdout = stream.isolateStdout();
@@ -41,6 +42,36 @@ async function handleRun(parsed) {
     stream.complete(exitCode === EXIT.ok ? "pass" : "fail", exitCode);
     return exitCode;
   } catch (error) {
+    const trustFailure = recipeTrustFailure(error);
+    if (trustFailure) {
+      if (stream.enabled) {
+        stream.error(trustFailure);
+        stream.complete("fail", EXIT.validation);
+      } else if (optionFlag(parsed.options, "json")) {
+        console.log(JSON.stringify({
+          schemaVersion: 1,
+          command: "run",
+          status: "fail",
+          error: trustFailure,
+          exitCode: EXIT.validation
+        }, null, 2));
+      } else {
+        console.error(`\u2717 mm-harness run: ${trustFailure.message}`);
+        const blocked = trustFailure.details?.blocked;
+        if (blocked?.length) {
+          console.error("  Restricted plan nodes:");
+          for (const node of blocked.slice(0, 10)) {
+            const implementation = node.implementation?.digest ? ` implementation=${node.implementation.kind ?? "custom"}@${node.implementation.digest}` : "";
+            console.error(
+              `  - ${node.nodeId}: ${node.action} [${node.capabilities.join(", ")}] source=${node.source}${implementation}`
+            );
+          }
+          if (blocked.length > 10) console.error(`  - \u2026 ${blocked.length - 10} more (use --json)`);
+        }
+        console.error(`  Next: ${trustFailure.userAction}`);
+      }
+      return EXIT.validation;
+    }
     const exitCode = error !== null && typeof error === "object" && "exitCode" in error && typeof error.exitCode === "number" ? error.exitCode : EXIT.runtime;
     stream.error({
       code: exitCode === EXIT.usage ? "CLI_USAGE_ERROR" : "RUN_FAILED",
@@ -54,6 +85,15 @@ async function handleRun(parsed) {
   }
 }
 async function handleRunInner({ positional, options }, stream) {
+  if (optionFlag(options, "describe") && (optionFlag(options, "list") || optionFlag(options, "plan"))) {
+    const message = "--describe cannot be combined with --list or --plan.";
+    const userAction = "choose one: mm-harness run --list, mm-harness run <recipe> --describe, or mm-harness run <recipe> --plan";
+    if (stream.enabled) {
+      stream.error({ code: "CLI_USAGE_ERROR", message, userAction });
+      return EXIT.usage;
+    }
+    return usageOut(optionFlag(options, "json"), "run", message, userAction);
+  }
   if (optionFlag(options, "list")) {
     if (stream.enabled) {
       const message = "--json-stream is for recipe execution; use run --list --json for discovery.";
@@ -64,6 +104,18 @@ async function handleRunInner({ positional, options }, stream) {
   }
   const targetRecipe = positional[0];
   if (!targetRecipe) throw usageError("run requires <recipe.json>.");
+  if (optionFlag(options, "describe")) {
+    if (stream.enabled) {
+      const message = "--json-stream is for recipe execution; use --describe --json for discovery.";
+      stream.error({
+        code: "JSON_STREAM_UNSUPPORTED_MODE",
+        message,
+        userAction: `mm-harness run ${shellQuote(targetRecipe)} --describe --json`
+      });
+      return EXIT.usage;
+    }
+    return handleDescribeRecipe(targetRecipe, options);
+  }
   if (optionFlag(options, "plan")) return handleRunPlan(targetRecipe, options, stream);
   const { adapter, target } = resolveAdapter(options);
   const json = optionFlag(options, "json");
@@ -86,9 +138,6 @@ async function handleRunInner({ positional, options }, stream) {
     return emitRunUsageError(jsonOutput, stream, adapter, targetRecipe, dtResult.code, dtResult.message, dtResult.userAction);
   }
   if (recipeRunning(target)) return emitRunRecipeRunning(jsonOutput, stream, target);
-  if (optionString(options, "artifactsDir") === void 0 && runArgLooksLikeRecipeFile(targetRecipe)) {
-    requiredOption(options, "artifactsDir", "run requires --artifacts-dir <dir>.");
-  }
   stream.phase("validate");
   const validated = await validateRunRecipeStatic(targetRecipe, adapter, options);
   if (validated.usageError) {
@@ -115,7 +164,37 @@ async function handleRunInner({ positional, options }, stream) {
   if (depsBlock) {
     return emitRunUsageError(jsonOutput, stream, adapter, validated.recipeFile, depsBlock.code, depsBlock.message, depsBlock.userAction);
   }
-  const artifactsDir = requiredOption(options, "artifactsDir", "run requires --artifacts-dir <dir>.");
+  let artifactsDir;
+  try {
+    artifactsDir = resolveRunArtifactsDir(target, optionString(options, "artifactsDir"));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return emitRunUsageError(
+      jsonOutput,
+      stream,
+      adapter,
+      validated.recipeFile,
+      "ARTIFACT_DIR_INVALID",
+      message,
+      "set RECIPE_TASK_DIR/FARMSLOT_TASK_DIR inside the checkout or pass --artifacts-dir <path>"
+    );
+  }
+  const librarySources = validated.librarySources;
+  const runtimeOptions = {
+    ...runtimeOptionsFromCli(options),
+    ...librarySources ? { librarySources } : {},
+    stdoutIsMachineContract: machine,
+    onActionEvent: ({ nodeId, action, status }) => stream.node(nodeId, action, status)
+  };
+  stream.phase("authorize");
+  let preflightedExecution = await preflightRecipe(
+    adapter,
+    validated.recipeFile,
+    artifactsDir,
+    target,
+    optionString(options, "actionManifest"),
+    runtimeOptions
+  );
   const lock = acquireCheckoutLock(target, "run");
   if ("message" in lock) {
     const userAction = `wait for the current owner, or inspect ${lock.path} if its process has exited`;
@@ -135,18 +214,23 @@ async function handleRunInner({ positional, options }, stream) {
       return prepared;
     }
     const { state, heal } = prepared;
-    const librarySources = validated.librarySources;
-    const runtimeOptions = {
-      ...runtimeOptionsFromCli(options),
-      ...librarySources ? { librarySources } : {},
-      stdoutIsMachineContract: machine,
-      onActionEvent: ({ nodeId, action, status }) => stream.node(nodeId, action, status)
-    };
     stream.phase("execute");
     const { result, violation } = await executeWithHealBounds(
       // validated.recipeFile, not the raw arg: the arg may be a library recipe NAME
       // that only the resolver knows how to turn into a file.
-      () => runRecipe(adapter, validated.recipeFile, artifactsDir, target, optionString(options, "actionManifest"), runtimeOptions),
+      () => {
+        const execution = preflightedExecution;
+        preflightedExecution = void 0;
+        return runRecipe(
+          adapter,
+          validated.recipeFile,
+          artifactsDir,
+          target,
+          optionString(options, "actionManifest"),
+          runtimeOptions,
+          execution
+        );
+      },
       adapter,
       target,
       heal,
@@ -238,6 +322,20 @@ function formatDiagnosticLine(line, out) {
   const style = status === "CLEAN" ? "ok" : status === "ERROR" || status === "EXCEPTION" ? "err" : "warn";
   return `${out(style, status)}${match[2]}`;
 }
+function resolveRunArtifactsDir(target, explicit) {
+  if (explicit !== void 0) return path.resolve(explicit);
+  const taskDir = process.env.RECIPE_TASK_DIR || process.env.FARMSLOT_TASK_DIR;
+  if (taskDir) {
+    const resolvedTask = path.resolve(target, taskDir);
+    const relative = path.relative(path.resolve(target), resolvedTask);
+    if (!relative.startsWith(`..${path.sep}`) && relative !== "..") {
+      return path.join(resolvedTask, "artifacts");
+    }
+    throw new Error(`task directory must be inside the target checkout: ${taskDir}`);
+  }
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:.TZ]/gu, "");
+  return path.join(target, "temp", "recipe", "runs", `${stamp}-${process.pid}`);
+}
 function runArtifactInventory(manifestPathValue) {
   const manifestPath = path.resolve(String(manifestPathValue));
   const root = path.dirname(manifestPath);
@@ -468,9 +566,6 @@ function emitPlanUsageError(json, stream, adapter, recipeFile, code, message, us
   }
   return EXIT.usage;
 }
-function runArgLooksLikeRecipeFile(value) {
-  return path.isAbsolute(value) || value.includes("/") || value.includes(path.sep) || value.endsWith(".json") || fs.existsSync(path.resolve(value));
-}
 function emitRunRecipeRunning(json, stream, target, detail) {
   const message = detail ?? "a recipe is currently running \u2014 refusing to start while another recipe executes.";
   const userAction = `inspect the checkout state with: mm-harness status --target ${shellQuote(target)} --json; retry after the active recipe finishes`;

package/dist/commands/shared.js

@@ -1,6 +1,7 @@
 import { spawn, spawnSync } from "node:child_process";
 import path from "node:path";
 import { detectAdapter } from "../harness.js";
+import { colorHumanMessage } from "../cli-color.js";
 import { resolveLeafInvoke, shellLeafMissing } from "../leaf-invoke.js";
 const EXIT = { ok: 0, runtime: 1, usage: 2, infra: 3, bounded: 4, validation: 5 };
 function writeInteractiveProgress(json, message, {
@@ -8,7 +9,7 @@ function writeInteractiveProgress(json, message, {
   stream = process.stderr
 } = {}) {
   if (json || !stdoutIsTTY) return false;
-  stream.write(`${message}
+  stream.write(`${colorHumanMessage(message, { stream })}
 `);
   return true;
 }
@@ -147,6 +148,8 @@ function spawnScriptStreaming(script, args, cwd, options) {
     let settled = false;
     let didTimeout = false;
     let escalation;
+    let forwardedParentSignal;
+    let parentSignalFallback;
     const parentSignals = ["SIGINT", "SIGTERM"];
     const removeParentSignalHandlers = () => {
       for (const signal of parentSignals) process.removeListener(signal, parentSignalHandlers[signal]);
@@ -156,6 +159,7 @@ function spawnScriptStreaming(script, args, cwd, options) {
       settled = true;
       if (timer) clearTimeout(timer);
       if (escalation) clearTimeout(escalation);
+      if (parentSignalFallback) clearTimeout(parentSignalFallback);
       removeParentSignalHandlers();
       resolve(result);
     };
@@ -166,10 +170,22 @@ function spawnScriptStreaming(script, args, cwd, options) {
       } catch {
       }
     };
+    const exitFromForwardedSignal = () => {
+      if (!forwardedParentSignal) return;
+      const signal = forwardedParentSignal;
+      forwardedParentSignal = void 0;
+      if (parentSignalFallback) clearTimeout(parentSignalFallback);
+      process.kill(process.pid, signal);
+    };
     const parentSignalHandlers = Object.fromEntries(parentSignals.map((signal) => [signal, () => {
+      if (forwardedParentSignal) return;
+      forwardedParentSignal = signal;
       signalChildTree(signal);
       removeParentSignalHandlers();
-      process.kill(process.pid, signal);
+      parentSignalFallback = setTimeout(() => {
+        signalChildTree("SIGKILL");
+        exitFromForwardedSignal();
+      }, 1e3);
     }]));
     if (ownsProcessGroup) {
       for (const signal of parentSignals) process.once(signal, parentSignalHandlers[signal]);
@@ -205,6 +221,10 @@ function spawnScriptStreaming(script, args, cwd, options) {
       finish({ status: 1, output: message });
     });
     child.on("exit", () => {
+      if (forwardedParentSignal) {
+        exitFromForwardedSignal();
+        return;
+      }
       if (!didTimeout) return;
       signalChildTree("SIGKILL");
       finish({ status: 1, output, timedOut: true, timeoutMs: Number(timeoutMs) });

package/dist/commands/status-probe.js

@@ -22,6 +22,9 @@ function routeToString(route) {
 function deriveWalletState(account, route) {
   const routeStr = (routeToString(route) ?? "").toLowerCase();
   if (routeStr.includes("onboard")) return "onboarding";
+  if (routeStr === "login" || routeStr === "lockscreen") {
+    return "locked";
+  }
   if (account !== null && account !== void 0 && typeof account === "object") return "unlocked";
   return "locked";
 }

package/dist/commands/status.js

@@ -104,6 +104,7 @@ function renderRuntimeStatus(runtime, out) {
   );
 }
 function nextForRuntime(launchHint, relaunchHint, runtime) {
+  if (runtime.nextAction) return runtime.nextAction;
   if (runtime.decision === "ready") return "mm-harness logs";
   if (runtime.decision === "relaunch") return launchHint;
   return relaunchHint;

package/dist/completions-cache.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { recipeRuntimePath } from "./paths.js";
-const COMPLETION_CACHE_VERSION = 1;
+const COMPLETION_CACHE_VERSION = 2;
 const COMPLETION_CACHE_TTL_MS = 6e4;
 function completionCachePath(projectRoot) {
   return recipeRuntimePath(projectRoot, ".completion-cache.json");

package/dist/doctor.js

@@ -155,12 +155,7 @@ function createDoctorReport(adapter, target, manifestValidation, actionManifestP
     requiredChecks,
     adapter,
     target,
-    runner: {
-      name: "@metamask/recipe-runner",
-      runnerDir,
-      actionManifestPath,
-      harnessPackage: "@farmslot/recipe-harness"
-    },
+    runner: runnerProvenance(actionManifestPath),
     compatibilityMode: mode,
     shape: repoShape(target),
     fixture: fixtureSummary(target, adapter),
@@ -169,6 +164,60 @@ function createDoctorReport(adapter, target, manifestValidation, actionManifestP
     manifestValidation: manifestValidation.summary
   };
 }
+function runnerInstallKind(runnerRoot, invokedPath, executablePath) {
+  const normalizedRoot = path.normalize(runnerRoot);
+  const nodeModulesSegment = `${path.sep}node_modules${path.sep}`;
+  const globalNodeModulesSegment = `${path.sep}lib${path.sep}node_modules${path.sep}`;
+  if (normalizedRoot.includes(globalNodeModulesSegment)) return "global-install";
+  const nodeModulesIndex = normalizedRoot.lastIndexOf(nodeModulesSegment);
+  if (nodeModulesIndex >= 0) {
+    const nodeModulesRoot = normalizedRoot.slice(
+      0,
+      nodeModulesIndex + nodeModulesSegment.length - 1
+    );
+    const invoked = path.resolve(invokedPath);
+    const projectBin = `${path.join(nodeModulesRoot, ".bin")}${path.sep}`;
+    if (invoked === path.resolve(executablePath) || invoked.startsWith(projectBin)) {
+      return "project-install";
+    }
+    return "global-install";
+  }
+  if (path.resolve(invokedPath) !== path.resolve(executablePath)) return "local-link";
+  return "source-checkout";
+}
+function runnerProvenance(actionManifestPath) {
+  const packagePath = path.join(runnerDir, "package.json");
+  const packageDocument = readJsonObject(packagePath);
+  const packageName = packageDocument.name;
+  const version = packageDocument.version;
+  if (packageName !== "@deeeed/metamask-harness") {
+    throw new Error(`Expected @deeeed/metamask-harness package name in ${packagePath}`);
+  }
+  if (typeof version !== "string" || !version) {
+    throw new Error(`Expected package version in ${packagePath}`);
+  }
+  const executablePath = path.resolve(
+    process.env.MM_HARNESS_EXECUTABLE ?? path.join(runnerDir, "bin/mm-harness")
+  );
+  const invokedPath = path.resolve(process.env.MM_HARNESS_INVOKED_AS ?? executablePath);
+  const installKind = runnerInstallKind(runnerDir, invokedPath, executablePath);
+  const packageSource = runnerDir.includes(`${path.sep}node_modules${path.sep}`) ? "node_modules" : "source-checkout";
+  return {
+    name: "@metamask/recipe-runner",
+    packageName,
+    version,
+    runnerDir,
+    packagePath,
+    packageSource,
+    installKind,
+    linked: installKind === "local-link",
+    global: installKind === "global-install",
+    invokedPath,
+    executablePath,
+    actionManifestPath,
+    harnessPackage: "@farmslot/recipe-harness"
+  };
+}
 function readJsonObject(file) {
   const value = readJson(file);
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -184,5 +233,6 @@ export {
   renderRuntimeContext,
   repoShape,
   requiredDoctorCheckSummary,
+  runnerInstallKind,
   runtimeContextSummary
 };

package/dist/harness.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { resolveLeafInvoke, shellLeafMissing, missingShellLeafMessage } from "./leaf-invoke.js";
 import { resolveExtensionSlotPorts } from "./adapters/slot-ports.js";
 import { recipeHarnessPath, recipeRuntimeDir, runnerDir } from "./paths.js";
+import { colorHumanMessage } from "./cli-color.js";
 const HARNESS_ACTIONS = ["install", "verify", "cleanup"];
 const ADAPTERS = ["mobile", "extension", "core"];
 function harnessUsage() {
@@ -332,7 +333,7 @@ async function handleHarness(argv) {
   }
   if (!json && !quiet) {
     const detected = autoDetected ? ", auto-detected" : "";
-    console.error(`\u2192 ${harnessAction} (${adapter}${detected}) \u2014 target: ${target}`);
+    console.error(colorHumanMessage(`\u2192 ${harnessAction} (${adapter}${detected}) \u2014 target: ${target}`));
   }
   const start = Date.now();
   if (shellLeafMissing(dispatch.command)) {
@@ -396,11 +397,11 @@ async function handleHarness(argv) {
       )
     );
   } else if (exitCode === 0) {
-    console.error(`\u2713 ${harnessAction} ${adapter} passed (${seconds}s)
-  Next: ${successNext(adapter, harnessAction, target)}`);
+    console.error(colorHumanMessage(`\u2713 ${harnessAction} ${adapter} passed (${seconds}s)
+  Next: ${successNext(adapter, harnessAction, target)}`));
   } else {
-    console.error(`\u2717 ${harnessAction} ${adapter} failed (exit ${exitCode}, ${seconds}s)
-  ${failureHint(adapter, harnessAction)}`);
+    console.error(colorHumanMessage(`\u2717 ${harnessAction} ${adapter} failed (exit ${exitCode}, ${seconds}s)
+  ${failureHint(adapter, harnessAction)}`));
   }
   return exitCode;
 }

package/dist/heal-bounds.js

@@ -45,7 +45,7 @@ async function ensureOverlay(adapter, target, heal, state, json) {
     });
     code = result.status ?? 1;
   } else {
-    code = await handleHarness(["install", "--platform", adapter, "--target", target, ...json ? ["--json"] : []]);
+    code = await handleHarness(["install", "--platform", adapter, "--target", target, "--quiet"]);
   }
   if (code !== 0 || !overlayPresent(target, adapter)) {
     return { ok: false, error: `runtime overlay install failed (exit ${code})` };

package/dist/live-adapter-contract.js

@@ -1,8 +1,12 @@
-import { access, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { access, mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import { build } from "esbuild";
+import { init, parse } from "es-module-lexer";
 import { resolveRequiredLocalProtocolRoot, runnerDir } from "./paths.js";
 import { corePnpNodeOptions } from "./commands/core-readiness.js";
 function actionFileStem(action) {
@@ -31,13 +35,17 @@ function candidateFamilies(action) {
   const families = [family];
   return [...new Set(families)];
 }
-function candidatePaths(platform, action) {
+function candidatePaths(platform, action, runtimeEnv = process.env) {
   const stems = candidateStems(action);
   const families = candidateFamilies(action);
-  const roots = [
-    process.env.METAMASK_RECIPE_LIVE_ADAPTER_DIR,
+  const declaredRoot = declaredActionRoot(
+    runtimeEnv.METAMASK_RECIPE_ACTION_SOURCE_MAP ?? process.env.METAMASK_RECIPE_ACTION_SOURCE_MAP,
+    action
+  );
+  const roots = [...new Set((declaredRoot ? [declaredRoot] : [
+    runtimeEnv.METAMASK_RECIPE_LIVE_ADAPTER_DIR ?? process.env.METAMASK_RECIPE_LIVE_ADAPTER_DIR,
     path.join(runnerDir, "library/actions")
-  ].filter(Boolean);
+  ]).filter((entry) => Boolean(entry)))];
   const files = [];
   for (const root of roots) {
     for (const family of families) {
@@ -49,6 +57,16 @@ function candidatePaths(platform, action) {
   }
   return files;
 }
+function declaredActionRoot(raw, action) {
+  if (!raw) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    const root = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed[action] : void 0;
+    return typeof root === "string" && root.length > 0 ? root : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function pushCandidateFiles(files, root, platform, family, stem) {
   files.push(path.join(root, platform, family, `${stem}.mjs`));
   files.push(path.join(root, "shared", family, `${stem}.mjs`));
@@ -74,8 +92,16 @@ function runProcess(command, args, options) {
     const child = spawn(command, args, {
       cwd: options.cwd,
       env: options.env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: [options.stdin == null ? "ignore" : "pipe", "pipe", "pipe"]
     });
+    if (options.stdin != null) {
+      child.stdin.on("error", (error) => {
+        if (error.code === "EPIPE" || settled) return;
+        settled = true;
+        reject(error);
+      });
+      child.stdin.end(options.stdin);
+    }
     let stdout = "";
     let stderr = "";
     child.stdout.on("data", (chunk) => {
@@ -106,6 +132,79 @@ function runProcess(command, args, options) {
     });
   });
 }
+async function prepareLiveAdapterScript({
+  platform,
+  action,
+  implementationRoot,
+  allowRuntimeImports = false
+}) {
+  const entryPath = await firstExecutablePath(
+    candidatePaths(platform, action, {
+      METAMASK_RECIPE_ACTION_SOURCE_MAP: JSON.stringify({ [action]: implementationRoot })
+    })
+  );
+  if (!entryPath) return null;
+  const rootReal = await realpath(implementationRoot);
+  const entryReal = await realpath(entryPath);
+  if (!isPathWithin(rootReal, entryReal)) {
+    throw new Error(`Live adapter ${entryPath} resolves outside ${implementationRoot}.`);
+  }
+  const result = await build({
+    entryPoints: [entryReal],
+    bundle: true,
+    write: false,
+    platform: "node",
+    format: "esm",
+    target: `node${process.versions.node.split(".")[0]}`,
+    legalComments: "none",
+    sourcemap: false,
+    banner: { js: `process.argv[1] = ${JSON.stringify(entryReal)};` },
+    plugins: [bindImportMetaUrls()],
+    logLevel: "silent"
+  });
+  const output = result.outputFiles[0];
+  if (!output) throw new Error(`Bundling live adapter ${entryReal} produced no executable output.`);
+  const sourceText = output.text;
+  await init;
+  const [imports] = parse(sourceText);
+  if (!allowRuntimeImports && imports.some((entry) => entry.d >= 0)) {
+    const error = new Error(
+      `Live adapter ${entryReal} contains a runtime dynamic import that cannot be bound to the approved bundle. Replace it with a static import so its implementation bytes are included in the plan digest.`
+    );
+    Object.assign(error, {
+      code: "RECIPE_TRUST_UNBOUND_IMPORT",
+      userAction: "replace the computed import with a static import, or promote the adapter into an explicitly trusted engineer-owned library"
+    });
+    throw error;
+  }
+  return {
+    action,
+    platform,
+    entryPath: entryReal,
+    sourceText,
+    sourceDigest: `sha256:${createHash("sha256").update(sourceText).digest("hex")}`
+  };
+}
+function bindImportMetaUrls() {
+  return {
+    name: "bind-import-meta-urls",
+    setup(buildContext) {
+      buildContext.onLoad({ filter: /\.[cm]?[jt]sx?$/ }, async (args) => {
+        const contents = await readFile(args.path, "utf8");
+        if (!contents.includes("import.meta.url")) return void 0;
+        const extension = path.extname(args.path);
+        const loader = extension === ".ts" || extension === ".mts" || extension === ".cts" ? "ts" : extension === ".tsx" ? "tsx" : extension === ".jsx" ? "jsx" : "js";
+        return {
+          contents: contents.replaceAll(
+            "import.meta.url",
+            JSON.stringify(pathToFileURL(args.path).href)
+          ),
+          loader
+        };
+      });
+    }
+  };
+}
 function commandFor(file, projectRoot, platform) {
   const needsTsx = platform === "core" || importsSourceTypescript(file);
   if (!needsTsx) {
@@ -158,8 +257,8 @@ function importsSourceTypescriptFrom(file, visited) {
   }
   return false;
 }
-async function resolveLiveAdapter(platform, action) {
-  return firstExecutablePath(candidatePaths(platform, action));
+async function resolveLiveAdapter(platform, action, runtimeEnv) {
+  return firstExecutablePath(candidatePaths(platform, action, runtimeEnv));
 }
 const CORE_WORKSPACE_PACKAGES = [
   "@metamask/base-controller",
@@ -191,8 +290,8 @@ async function platformAdapterEnv(platform, projectRoot, tempDir) {
     NODE_OPTIONS: corePnpNodeOptions(projectRoot, process.env.NODE_OPTIONS)
   };
 }
-async function runLiveAdapterScript({ platform, action, node, context }) {
-  const script = await resolveLiveAdapter(platform, action);
+async function runLiveAdapterScript({ platform, action, node, context, prepared }) {
+  const script = prepared?.entryPath ?? await resolveLiveAdapter(platform, action, context?.env);
   if (!script) return null;
   const tempDir = await mkdtemp(path.join(os.tmpdir(), "mm-harness-live-adapter-"));
   const inputPath = path.join(tempDir, "input.json");
@@ -211,7 +310,7 @@ async function runLiveAdapterScript({ platform, action, node, context }) {
   };
   await writeFile(inputPath, `${JSON.stringify(input, null, 2)}
 `);
-  const command = commandFor(script, context.projectRoot, platform);
+  const command = prepared ? commandForPrepared(context.projectRoot, platform) : commandFor(script, context.projectRoot, platform);
   const platformEnv = await platformAdapterEnv(platform, context.projectRoot, tempDir);
   const result = await runProcess(command.command, [...command.args, inputPath], {
     cwd: context.projectRoot,
@@ -222,7 +321,8 @@ async function runLiveAdapterScript({ platform, action, node, context }) {
       METAMASK_RECIPE_ADAPTER_INPUT: inputPath,
       METAMASK_RECIPE_ADAPTER_OUTPUT: outputPath
     },
-    timeoutMs: Number(node.live_adapter_timeout_ms ?? node.timeout_ms ?? 6e4)
+    timeoutMs: Number(node.live_adapter_timeout_ms ?? node.timeout_ms ?? 6e4),
+    ...prepared ? { stdin: prepared.sourceText } : {}
   });
   try {
     if (result.timedOut) {
@@ -244,7 +344,27 @@ async function runLiveAdapterScript({ platform, action, node, context }) {
     await rm(tempDir, { recursive: true, force: true });
   }
 }
+function commandForPrepared(projectRoot, platform) {
+  if (platform !== "core") {
+    return { command: process.execPath, args: ["--input-type=module", "-"] };
+  }
+  const tsxBin = resolveTsxBin(projectRoot);
+  if (!tsxBin) {
+    const error = new Error(
+      `this action imports TypeScript from the checkout but no tsx runtime was found.
+  Next: run 'yarn install' in ${projectRoot}`
+    );
+    error.exitCode = 2;
+    throw error;
+  }
+  return { command: tsxBin, args: ["--input-type=module", "-"] };
+}
+function isPathWithin(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
 export {
+  prepareLiveAdapterScript,
   resolveLiveAdapter,
   runLiveAdapterScript
 };