@deeeed/metamask-harness 0.17.5 → 0.19.0

package/dist/harness.js

@@ -4,13 +4,9 @@ import path from "node:path";
 import { resolveLeafInvoke, shellLeafMissing, missingShellLeafMessage } from "./leaf-invoke.js";
 import { resolveExtensionSlotPorts } from "./adapters/slot-ports.js";
 import { recipeHarnessPath, recipeRuntimeDir, runnerDir } from "./paths.js";
-import { prepareMobile } from "./adapters/mobile/prepare.js";
-const HARNESS_ACTIONS = ["install", "verify", "cleanup", "live"];
+import { colorHumanMessage } from "./cli-color.js";
+const HARNESS_ACTIONS = ["install", "verify", "cleanup"];
 const ADAPTERS = ["mobile", "extension", "core"];
-function isValidAdapterAction(adapter, action) {
-  if (adapter === "core") return action === "install" || action === "verify" || action === "cleanup";
-  return true;
-}
 function harnessUsage() {
   console.error(`mm-harness \u2014 install and validate the MetaMask recipe runtime in a checkout.
 
@@ -50,6 +46,12 @@ function failureHint(adapter, action) {
   const helper = adapter === "mobile" ? "mm-harness launch ios   # or launch android" : "mm-harness launch";
   return `Read the error above for the specific cause. To (re)start the runtime, run: ${helper}`;
 }
+function successNext(adapter, action, target) {
+  const base = `--adapter ${adapter} --target ${shellQuote(target)}`;
+  if (action === "install") return `mm-harness verify ${base}`;
+  if (action === "cleanup") return `mm-harness install ${base}`;
+  return `mm-harness status --target ${shellQuote(target)} --json`;
+}
 function hasArg(args, needle) {
   return args.some((arg) => arg === needle || arg.startsWith(`${needle}=`));
 }
@@ -70,6 +72,7 @@ function parseHarnessArgs(args) {
   const forward = [];
   let adapter;
   let json = false;
+  let quiet = false;
   let separator = false;
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i];
@@ -85,6 +88,10 @@ function parseHarnessArgs(args) {
       json = true;
       continue;
     }
+    if (arg === "--quiet") {
+      quiet = true;
+      continue;
+    }
     if (arg === "--adapter" || arg === "--platform") {
       const value = args[i + 1];
       if (arg === "--adapter") {
@@ -115,7 +122,7 @@ function parseHarnessArgs(args) {
     }
     forward.push(arg);
   }
-  return { adapter, json, forward };
+  return { adapter, json, quiet, forward };
 }
 const ADAPTER_DETECT_NEXT = "cd into a MetaMask checkout or pass --target <path>, or force it with --adapter <mobile|extension|core>";
 function detectAdapter(target) {
@@ -161,7 +168,7 @@ function readRuntimeContextField(contextPath, field) {
   if (node === void 0 || node === null || node === "") return void 0;
   return String(node);
 }
-function applyExtensionRuntimeEnv(target, action, args) {
+function applyExtensionRuntimeEnv(target, args) {
   const contextPath = resolveRuntimeContextPath(target);
   const contextExists = fs.existsSync(contextPath);
   if (contextExists) {
@@ -174,19 +181,6 @@ function applyExtensionRuntimeEnv(target, action, args) {
       const extensionId = readRuntimeContextField(contextPath, "extensionId");
       if (extensionId) process.env.RECIPE_HARNESS_EXTENSION_ID = extensionId;
     }
-    if (process.env.RECIPE_RUNTIME_START_APPROVED === void 0) {
-      const approved = readRuntimeContextField(contextPath, "runtimeStart.approved");
-      if (approved === "true" || approved === "True" || approved === "1") process.env.RECIPE_RUNTIME_START_APPROVED = "1";
-      else if (approved === "false" || approved === "False" || approved === "0") process.env.RECIPE_RUNTIME_START_APPROVED = "0";
-    }
-    if (!process.env.RECIPE_RUNTIME_START_CMD) {
-      const command = readRuntimeContextField(contextPath, "runtimeStart.command");
-      if (command) process.env.RECIPE_RUNTIME_START_CMD = command;
-    }
-    if (!process.env.RECIPE_RUNTIME_READY_URL) {
-      const readyUrl = readRuntimeContextField(contextPath, "runtimeStart.readyUrl");
-      if (readyUrl) process.env.RECIPE_RUNTIME_READY_URL = readyUrl;
-    }
   } else {
     delete process.env.RECIPE_RUNTIME_CONTEXT;
   }
@@ -200,11 +194,6 @@ function applyExtensionRuntimeEnv(target, action, args) {
       result = [...result, "--cdp-port", cdpPort];
     }
   }
-  if (action === "live" && !hasArg(result, "--prepare-cmd")) {
-    if (process.env.RECIPE_RUNTIME_START_APPROVED === "1" && process.env.RECIPE_RUNTIME_START_CMD) {
-      result = [...result, "--prepare-cmd", process.env.RECIPE_RUNTIME_START_CMD];
-    }
-  }
   return result;
 }
 function resolveEntry(base, candidates, mode) {
@@ -281,81 +270,6 @@ Next: mm-harness install --platform core --target ${target}`
   );
   return { command, prefixArgs: [] };
 }
-async function handleMobileLive(target, forwardArgs, json, autoDetected) {
-  const platform = argValue(forwardArgs, "--platform") ?? "ios";
-  const watcherPortStr = argValue(forwardArgs, "--watcher-port") ?? process.env.WATCHER_PORT;
-  const watcherPort = watcherPortStr ? parseInt(watcherPortStr, 10) : void 0;
-  const start = Date.now();
-  if (!json) {
-    const detected = autoDetected ? ", auto-detected" : "";
-    console.error(`\u2192 live (mobile${detected}) \u2014 target: ${target}`);
-  }
-  const prepResult = await prepareMobile(target, { platform, json, watcherPort });
-  if (prepResult.status !== 0) {
-    const elapsed2 = ((Date.now() - start) / 1e3).toFixed(1);
-    if (json) {
-      console.log(
-        harnessSummary("live", "mobile", target, "fail", prepResult.status, autoDetected, {
-          code: "MOBILE_PREPARE_FAILED",
-          message: `mobile prepare failed (exit ${prepResult.status})`,
-          userAction: failureHint("mobile", "live")
-        })
-      );
-    } else {
-      console.error(
-        `\u2717 live mobile failed (exit ${prepResult.status}, ${elapsed2}s)
-  ${failureHint("mobile", "live")}`
-      );
-    }
-    return prepResult.status;
-  }
-  const installedVerify = path.join(recipeHarnessPath(target, "mobile"), "scripts", "verify.sh");
-  const verifySh = fs.existsSync(installedVerify) ? installedVerify : resolveEntry(runnerDir, ["adapters/mobile/verify.sh", "scripts/mobile/verify.sh"], "file");
-  const verifyArgs = hasArg(forwardArgs, "--no-auto-start") ? [...forwardArgs] : ["--no-auto-start", ...forwardArgs];
-  if (shellLeafMissing(verifySh)) {
-    const message = missingShellLeafMessage(verifySh);
-    if (json) {
-      console.log(
-        harnessSummary("live", "mobile", target, "fail", 1, autoDetected, {
-          code: "HARNESS_SPAWN_FAILED",
-          message,
-          userAction: failureHint("mobile", "live")
-        })
-      );
-    } else {
-      console.error(`\u2717 ${message}`);
-    }
-    return 1;
-  }
-  const { bin: verifyBin, args: verifySpawnArgs } = resolveLeafInvoke(verifySh, verifyArgs);
-  const result = spawnSync(verifyBin, verifySpawnArgs, {
-    stdio: json ? ["inherit", 2, "inherit"] : "inherit",
-    env: process.env
-  });
-  const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
-  const exitCode = result.status ?? 1;
-  if (json) {
-    console.log(
-      harnessSummary(
-        "live",
-        "mobile",
-        target,
-        exitCode === 0 ? "pass" : "fail",
-        exitCode,
-        autoDetected,
-        exitCode === 0 ? void 0 : { code: "MOBILE_VERIFY_FAILED", message: `mobile live verify failed (exit ${exitCode})`, userAction: failureHint("mobile", "live") }
-      )
-    );
-  } else if (exitCode === 0) {
-    console.error(`\u2713 live mobile passed (${elapsed}s)`);
-  } else {
-    console.error(
-      `\u2717 live mobile failed (exit ${exitCode}, ${elapsed}s)
-  ${failureHint("mobile", "live")}`
-    );
-  }
-  return exitCode;
-}
 async function handleHarness(argv) {
   const action = argv[0];
   if (!action || action === "-h" || action === "--help") {
@@ -368,12 +282,14 @@ async function handleHarness(argv) {
     return 2;
   }
   const harnessAction = action;
-  const { adapter: parsedAdapter, json, forward } = parseHarnessArgs(argv.slice(1));
+  const { adapter: parsedAdapter, json, quiet, forward } = parseHarnessArgs(argv.slice(1));
   const rawTarget = argValue(forward, "--target");
   const target = path.resolve(rawTarget ?? process.cwd());
   const adapter = parsedAdapter ?? detectAdapter(target);
   if (!adapter || !isAdapter(adapter)) {
-    if (json) {
+    if (quiet) {
+      return 2;
+    } else if (json) {
       const detectError = adapter ? { code: "UNSUPPORTED_PLATFORM", message: `unsupported platform: ${adapter}`, userAction: "pass --adapter <mobile|extension|core> to specify a supported adapter" } : { code: "ADAPTER_DETECTION_FAILED", message: `could not detect the MetaMask repo type for ${target}`, userAction: ADAPTER_DETECT_NEXT };
       console.log(harnessSummary(harnessAction, void 0, target, "fail", 2, false, detectError));
     } else {
@@ -387,36 +303,19 @@ async function handleHarness(argv) {
     }
     return 2;
   }
-  if (!isValidAdapterAction(adapter, harnessAction)) {
-    if (json) {
-      console.log(
-        harnessSummary(harnessAction, adapter, target, "fail", 2, parsedAdapter === void 0, {
-          code: "UNSUPPORTED_ACTION",
-          message: `${harnessAction} is not supported for ${adapter} (core supports install, verify, cleanup).`,
-          userAction: "run mm-harness doctor to see which actions are supported for this adapter"
-        })
-      );
-    } else {
-      console.error(
-        `\u2717 ${harnessAction} is not supported for ${adapter} (core supports install, verify, cleanup).`
-      );
-    }
-    return 2;
-  }
   const autoDetected = parsedAdapter === void 0;
   let forwardArgs = hasArg(forward, "--target") ? [...forward] : ["--target", target, ...forward];
   if (harnessAction === "install" && hasArg(forward, "--runway")) {
     return handleRunwayInstall(adapter, target, forward, json);
   }
-  if (adapter === "extension" && (harnessAction === "live" || harnessAction === "verify")) {
-    forwardArgs = applyExtensionRuntimeEnv(target, harnessAction, forwardArgs);
-  }
-  if (adapter === "mobile" && harnessAction === "live") {
-    return handleMobileLive(target, forwardArgs, json, autoDetected);
+  if (adapter === "extension" && harnessAction === "verify") {
+    forwardArgs = applyExtensionRuntimeEnv(target, forwardArgs);
   }
   const dispatch = resolveHarnessDispatch(adapter, harnessAction, target);
   if ("error" in dispatch) {
-    if (json) {
+    if (quiet) {
+      return 1;
+    } else if (json) {
       console.log(
         harnessSummary(harnessAction, adapter, target, "fail", 1, autoDetected, {
           code: "DISPATCH_UNAVAILABLE",
@@ -432,14 +331,16 @@ async function handleHarness(argv) {
     }
     return 1;
   }
-  if (!json) {
+  if (!json && !quiet) {
     const detected = autoDetected ? ", auto-detected" : "";
-    console.error(`\u2192 ${harnessAction} (${adapter}${detected}) \u2014 target: ${target}`);
+    console.error(colorHumanMessage(`\u2192 ${harnessAction} (${adapter}${detected}) \u2014 target: ${target}`));
   }
   const start = Date.now();
   if (shellLeafMissing(dispatch.command)) {
     const message = missingShellLeafMessage(dispatch.command);
-    if (json) {
+    if (quiet) {
+      return 1;
+    } else if (json) {
       console.log(
         harnessSummary(harnessAction, adapter, target, "fail", 1, autoDetected, {
           code: "HARNESS_SPAWN_FAILED",
@@ -459,12 +360,14 @@ async function handleHarness(argv) {
   const result = spawnSync(dispatchBin, dispatchArgs, {
     // Default: stream child output verbatim (byte-identical to the skill path).
     // --json: route child output to our stderr so stdout carries only the summary.
-    stdio: json ? ["inherit", 2, "inherit"] : "inherit",
+    stdio: quiet ? "ignore" : json ? ["inherit", 2, "inherit"] : "inherit",
     env: process.env
   });
   const seconds = ((Date.now() - start) / 1e3).toFixed(1);
   if (result.error) {
-    if (json) {
+    if (quiet) {
+      return 1;
+    } else if (json) {
       console.log(
         harnessSummary(harnessAction, adapter, target, "fail", 1, autoDetected, {
           code: "HARNESS_SPAWN_FAILED",
@@ -479,7 +382,9 @@ async function handleHarness(argv) {
     return 1;
   }
   const exitCode = result.status ?? 1;
-  if (json) {
+  if (quiet) {
+    return exitCode;
+  } else if (json) {
     console.log(
       harnessSummary(
         harnessAction,
@@ -492,10 +397,11 @@ async function handleHarness(argv) {
       )
     );
   } else if (exitCode === 0) {
-    console.error(`\u2713 ${harnessAction} ${adapter} passed (${seconds}s)`);
+    console.error(colorHumanMessage(`\u2713 ${harnessAction} ${adapter} passed (${seconds}s)
+  Next: ${successNext(adapter, harnessAction, target)}`));
   } else {
-    console.error(`\u2717 ${harnessAction} ${adapter} failed (exit ${exitCode}, ${seconds}s)
-  ${failureHint(adapter, harnessAction)}`);
+    console.error(colorHumanMessage(`\u2717 ${harnessAction} ${adapter} failed (exit ${exitCode}, ${seconds}s)
+  ${failureHint(adapter, harnessAction)}`));
   }
   return exitCode;
 }
@@ -522,8 +428,10 @@ async function handleRunwayInstall(adapter, target, forward, json) {
     resolveOnly: hasArg(forward, "--resolve-only"),
     rerunCommand
   });
+  const next = result.status === "pass" && adapter === "mobile" && result.resolveOnly !== true ? `mm-harness launch ${String(result.platform ?? "ios")} --adapter mobile --target ${shellQuote(target)}` : void 0;
+  const output = next ? { ...result, next } : result;
   if (json) {
-    console.log(JSON.stringify(result, null, 2));
+    console.log(JSON.stringify(output, null, 2));
   } else if (result.status === "pass") {
     const cache = typeof result.cache === "object" && result.cache ? result.cache : void 0;
     const simulator = typeof result.simulator === "object" && result.simulator ? result.simulator : void 0;
@@ -534,6 +442,7 @@ async function handleRunwayInstall(adapter, target, forward, json) {
       const action = result.skipped ? "already provisioned" : "installed Runway app";
       console.error(`\u2713 ${action} for ${adapter} ${result.platform ?? ""} simulator=${simulator?.name ?? "unknown"} cache=${cache?.status ?? "skip"}`);
     }
+    if (next) console.error(`  Next: ${next}`);
   } else {
     console.error(`\u2717 mm-harness install --runway: ${result.error?.message ?? "runway install failed"}
   Next: ${result.error?.userAction ?? rerunCommand}`);
@@ -576,9 +485,10 @@ function harnessSummary(action, adapter, target, status, exitCode, autoDetected,
     status,
     exitCode,
     // Error contract: every --json failure carries a stable machine code + human
-    // message (CLI-SPEC.md §5.1). userAction is included when present so callers
+    // message. userAction is included when present so callers
     // can surface the reachable escape without parsing the human message.
-    ...status === "fail" && error ? { error } : {}
+    ...status === "fail" && error ? { error } : {},
+    ...status === "pass" && adapter ? { next: successNext(adapter, action, target) } : {}
   });
 }
 export {

package/dist/heal-bounds.js

@@ -7,6 +7,10 @@ import { EXIT } from "./commands/shared.js";
 function newHealState() {
   return { recovered: [], mutations: [], attemptedRecoveries: [] };
 }
+function conciseFailureForHuman(output) {
+  const errors = output.split(/\r?\n/u).map((line) => /^(?:[A-Za-z]*Error):\s*(.+)$/u.exec(line.trim())?.[1]).filter((line) => Boolean(line));
+  return errors.at(-1) ?? output.trim();
+}
 function parseHeal(options, fallback) {
   const value = options.heal;
   if (value === void 0) return fallback;
@@ -45,7 +49,7 @@ async function ensureOverlay(adapter, target, heal, state, json) {
     });
     code = result.status ?? 1;
   } else {
-    code = await handleHarness(["install", "--platform", adapter, "--target", target, ...json ? ["--json"] : []]);
+    code = await handleHarness(["install", "--platform", adapter, "--target", target, "--quiet"]);
   }
   if (code !== 0 || !overlayPresent(target, adapter)) {
     return { ok: false, error: `runtime overlay install failed (exit ${code})` };
@@ -103,7 +107,7 @@ function checkHealBounds(target, output, state) {
     return {
       code: "SAME_RECOVERY_TWICE",
       exitCode: EXIT.bounded,
-      message: "same recovery already failed once this invocation \u2014 refusing to loop.",
+      message: state.recovered.length > 0 ? "one recovery already succeeded this invocation \u2014 bounded policy refuses a second recovery." : "one recovery was already attempted this invocation \u2014 refusing to loop.",
       originalError
     };
   }
@@ -113,6 +117,7 @@ export {
   RECOVERY_CODE,
   checkHealBounds,
   classifyFailure,
+  conciseFailureForHuman,
   ensureOverlay,
   newHealState,
   parseHeal,

package/dist/json-stream.js

@@ -0,0 +1,57 @@
+class JsonStreamWriter {
+  enabled;
+  command;
+  completed = false;
+  writeLine;
+  constructor(command, enabled, output = process.stdout) {
+    this.command = command;
+    this.enabled = enabled;
+    const write = output.write.bind(output);
+    this.writeLine = (line) => {
+      write(`${line}
+`);
+    };
+  }
+  isolateStdout() {
+    if (!this.enabled) return () => void 0;
+    const original = process.stdout.write;
+    const redirect = ((chunk, encoding, callback) => process.stderr.write(chunk, encoding, callback));
+    process.stdout.write = redirect;
+    return () => {
+      if (process.stdout.write === redirect) process.stdout.write = original;
+    };
+  }
+  emit(event, fields = {}) {
+    if (!this.enabled || this.completed) return;
+    this.writeLine(JSON.stringify({
+      schemaVersion: 1,
+      command: this.command,
+      event,
+      ...fields,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    }));
+  }
+  phase(phase, fields = {}) {
+    this.emit("phase", { phase, ...fields });
+  }
+  node(nodeId, action, status) {
+    this.emit("node", { nodeId, action, status });
+  }
+  mutation(mutation) {
+    this.emit("mutation", { mutation });
+  }
+  recovery(code) {
+    this.emit("recovery", { code });
+  }
+  error(error) {
+    this.emit("error", { error });
+  }
+  complete(status, exitCode, fields = {}) {
+    if (!this.enabled || this.completed) return;
+    this.emit("complete", { status, exitCode, ...fields });
+    this.completed = true;
+  }
+}
+export {
+  JsonStreamWriter
+};

package/dist/live-adapter-contract.js

@@ -1,8 +1,12 @@
-import { access, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { access, mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import { pathToFileURL } from "node:url";
+import { build } from "esbuild";
+import { init, parse } from "es-module-lexer";
 import { resolveRequiredLocalProtocolRoot, runnerDir } from "./paths.js";
 import { corePnpNodeOptions } from "./commands/core-readiness.js";
 function actionFileStem(action) {
@@ -31,13 +35,17 @@ function candidateFamilies(action) {
   const families = [family];
   return [...new Set(families)];
 }
-function candidatePaths(platform, action) {
+function candidatePaths(platform, action, runtimeEnv = process.env) {
   const stems = candidateStems(action);
   const families = candidateFamilies(action);
-  const roots = [
-    process.env.METAMASK_RECIPE_LIVE_ADAPTER_DIR,
+  const declaredRoot = declaredActionRoot(
+    runtimeEnv.METAMASK_RECIPE_ACTION_SOURCE_MAP ?? process.env.METAMASK_RECIPE_ACTION_SOURCE_MAP,
+    action
+  );
+  const roots = [...new Set((declaredRoot ? [declaredRoot] : [
+    runtimeEnv.METAMASK_RECIPE_LIVE_ADAPTER_DIR ?? process.env.METAMASK_RECIPE_LIVE_ADAPTER_DIR,
     path.join(runnerDir, "library/actions")
-  ].filter(Boolean);
+  ]).filter((entry) => Boolean(entry)))];
   const files = [];
   for (const root of roots) {
     for (const family of families) {
@@ -46,29 +54,26 @@ function candidatePaths(platform, action) {
       }
       pushDomainDispatcherFiles(files, root, platform, family);
     }
-    for (const candidateStem of stems) {
-      pushFlatCandidateFiles(files, root, platform, candidateStem);
-    }
   }
   return files;
 }
-function pushCandidateFiles(files, root, platform, family, stem) {
-  for (const extension of ["mjs", "js", "sh"]) {
-    files.push(path.join(root, platform, family, `${stem}.${extension}`));
-    files.push(path.join(root, "shared", family, `${stem}.${extension}`));
+function declaredActionRoot(raw, action) {
+  if (!raw) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    const root = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed[action] : void 0;
+    return typeof root === "string" && root.length > 0 ? root : void 0;
+  } catch {
+    return void 0;
   }
 }
-function pushDomainDispatcherFiles(files, root, platform, family) {
-  for (const extension of ["mjs", "js", "sh"]) {
-    files.push(path.join(root, platform, family, `${family}.${extension}`));
-    files.push(path.join(root, "shared", family, `${family}.${extension}`));
-  }
+function pushCandidateFiles(files, root, platform, family, stem) {
+  files.push(path.join(root, platform, family, `${stem}.mjs`));
+  files.push(path.join(root, "shared", family, `${stem}.mjs`));
 }
-function pushFlatCandidateFiles(files, root, platform, stem) {
-  for (const extension of ["mjs", "js", "sh"]) {
-    files.push(path.join(root, platform, `${stem}.${extension}`));
-    files.push(path.join(root, "shared", `${stem}.${extension}`));
-  }
+function pushDomainDispatcherFiles(files, root, platform, family) {
+  files.push(path.join(root, platform, family, `${family}.mjs`));
+  files.push(path.join(root, "shared", family, `${family}.mjs`));
 }
 async function firstExecutablePath(paths) {
   for (const file of paths) {
@@ -87,8 +92,16 @@ function runProcess(command, args, options) {
     const child = spawn(command, args, {
       cwd: options.cwd,
       env: options.env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: [options.stdin == null ? "ignore" : "pipe", "pipe", "pipe"]
     });
+    if (options.stdin != null) {
+      child.stdin.on("error", (error) => {
+        if (error.code === "EPIPE" || settled) return;
+        settled = true;
+        reject(error);
+      });
+      child.stdin.end(options.stdin);
+    }
     let stdout = "";
     let stderr = "";
     child.stdout.on("data", (chunk) => {
@@ -119,10 +132,82 @@ function runProcess(command, args, options) {
     });
   });
 }
+async function prepareLiveAdapterScript({
+  platform,
+  action,
+  implementationRoot,
+  allowRuntimeImports = false
+}) {
+  const entryPath = await firstExecutablePath(
+    candidatePaths(platform, action, {
+      METAMASK_RECIPE_ACTION_SOURCE_MAP: JSON.stringify({ [action]: implementationRoot })
+    })
+  );
+  if (!entryPath) return null;
+  const rootReal = await realpath(implementationRoot);
+  const entryReal = await realpath(entryPath);
+  if (!isPathWithin(rootReal, entryReal)) {
+    throw new Error(`Live adapter ${entryPath} resolves outside ${implementationRoot}.`);
+  }
+  const result = await build({
+    entryPoints: [entryReal],
+    bundle: true,
+    write: false,
+    platform: "node",
+    format: "esm",
+    target: `node${process.versions.node.split(".")[0]}`,
+    legalComments: "none",
+    sourcemap: false,
+    banner: { js: `process.argv[1] = ${JSON.stringify(entryReal)};` },
+    plugins: [bindImportMetaUrls()],
+    logLevel: "silent"
+  });
+  const output = result.outputFiles[0];
+  if (!output) throw new Error(`Bundling live adapter ${entryReal} produced no executable output.`);
+  const sourceText = output.text;
+  await init;
+  const [imports] = parse(sourceText);
+  if (!allowRuntimeImports && imports.some((entry) => entry.d >= 0)) {
+    const error = new Error(
+      `Live adapter ${entryReal} contains a runtime dynamic import that cannot be bound to the approved bundle. Replace it with a static import so its implementation bytes are included in the plan digest.`
+    );
+    Object.assign(error, {
+      code: "RECIPE_TRUST_UNBOUND_IMPORT",
+      userAction: "replace the computed import with a static import, or promote the adapter into an explicitly trusted engineer-owned library"
+    });
+    throw error;
+  }
+  return {
+    action,
+    platform,
+    entryPath: entryReal,
+    sourceText,
+    sourceDigest: `sha256:${createHash("sha256").update(sourceText).digest("hex")}`
+  };
+}
+function bindImportMetaUrls() {
+  return {
+    name: "bind-import-meta-urls",
+    setup(buildContext) {
+      buildContext.onLoad({ filter: /\.[cm]?[jt]sx?$/ }, async (args) => {
+        const contents = await readFile(args.path, "utf8");
+        if (!contents.includes("import.meta.url")) return void 0;
+        const extension = path.extname(args.path);
+        const loader = extension === ".ts" || extension === ".mts" || extension === ".cts" ? "ts" : extension === ".tsx" ? "tsx" : extension === ".jsx" ? "jsx" : "js";
+        return {
+          contents: contents.replaceAll(
+            "import.meta.url",
+            JSON.stringify(pathToFileURL(args.path).href)
+          ),
+          loader
+        };
+      });
+    }
+  };
+}
 function commandFor(file, projectRoot, platform) {
-  if (file.endsWith(".sh")) return { command: "bash", args: [file] };
   const needsTsx = platform === "core" || importsSourceTypescript(file);
-  if (!needsTsx && (file.endsWith(".mjs") || file.endsWith(".js"))) {
+  if (!needsTsx) {
     return { command: process.execPath, args: [file] };
   }
   const tsxBin = resolveTsxBin(projectRoot);
@@ -165,15 +250,15 @@ function importsSourceTypescriptFrom(file, visited) {
     const specifier = match[1] ?? "";
     if (specifier.endsWith(".ts")) return true;
     if (!specifier.startsWith(".")) continue;
-    if (!specifier.endsWith(".mjs") && !specifier.endsWith(".js")) continue;
+    if (!specifier.endsWith(".mjs")) continue;
     if (importsSourceTypescriptFrom(path.resolve(path.dirname(absolute), specifier), visited)) {
       return true;
     }
   }
   return false;
 }
-async function resolveLiveAdapter(platform, action) {
-  return firstExecutablePath(candidatePaths(platform, action));
+async function resolveLiveAdapter(platform, action, runtimeEnv) {
+  return firstExecutablePath(candidatePaths(platform, action, runtimeEnv));
 }
 const CORE_WORKSPACE_PACKAGES = [
   "@metamask/base-controller",
@@ -205,8 +290,8 @@ async function platformAdapterEnv(platform, projectRoot, tempDir) {
     NODE_OPTIONS: corePnpNodeOptions(projectRoot, process.env.NODE_OPTIONS)
   };
 }
-async function runLiveAdapterScript({ platform, action, node, context }) {
-  const script = await resolveLiveAdapter(platform, action);
+async function runLiveAdapterScript({ platform, action, node, context, prepared }) {
+  const script = prepared?.entryPath ?? await resolveLiveAdapter(platform, action, context?.env);
   if (!script) return null;
   const tempDir = await mkdtemp(path.join(os.tmpdir(), "mm-harness-live-adapter-"));
   const inputPath = path.join(tempDir, "input.json");
@@ -225,7 +310,7 @@ async function runLiveAdapterScript({ platform, action, node, context }) {
   };
   await writeFile(inputPath, `${JSON.stringify(input, null, 2)}
 `);
-  const command = commandFor(script, context.projectRoot, platform);
+  const command = prepared ? commandForPrepared(context.projectRoot, platform) : commandFor(script, context.projectRoot, platform);
   const platformEnv = await platformAdapterEnv(platform, context.projectRoot, tempDir);
   const result = await runProcess(command.command, [...command.args, inputPath], {
     cwd: context.projectRoot,
@@ -236,7 +321,8 @@ async function runLiveAdapterScript({ platform, action, node, context }) {
       METAMASK_RECIPE_ADAPTER_INPUT: inputPath,
       METAMASK_RECIPE_ADAPTER_OUTPUT: outputPath
     },
-    timeoutMs: Number(node.live_adapter_timeout_ms ?? node.timeout_ms ?? 6e4)
+    timeoutMs: Number(node.live_adapter_timeout_ms ?? node.timeout_ms ?? 6e4),
+    ...prepared ? { stdin: prepared.sourceText } : {}
   });
   try {
     if (result.timedOut) {
@@ -258,7 +344,27 @@ async function runLiveAdapterScript({ platform, action, node, context }) {
     await rm(tempDir, { recursive: true, force: true });
   }
 }
+function commandForPrepared(projectRoot, platform) {
+  if (platform !== "core") {
+    return { command: process.execPath, args: ["--input-type=module", "-"] };
+  }
+  const tsxBin = resolveTsxBin(projectRoot);
+  if (!tsxBin) {
+    const error = new Error(
+      `this action imports TypeScript from the checkout but no tsx runtime was found.
+  Next: run 'yarn install' in ${projectRoot}`
+    );
+    error.exitCode = 2;
+    throw error;
+  }
+  return { command: tsxBin, args: ["--input-type=module", "-"] };
+}
+function isPathWithin(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
 export {
+  prepareLiveAdapterScript,
   resolveLiveAdapter,
   runLiveAdapterScript
 };