@deeeed/metamask-harness 0.17.5 → 0.19.0

package/dist/recipe-security.js

@@ -0,0 +1,178 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir, realpath } from "node:fs/promises";
+import path from "node:path";
+const READ_ONLY_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
+  "metamask.wallet.fixture_status",
+  "metamask.wallet.list_accounts",
+  "metamask.wallet.read_state",
+  "metamask.perps.read_positions",
+  "metamask.perps.read_orders",
+  "metamask.perps.read_account",
+  "metamask.perps.assert_positions",
+  "metamask.perps.assert_orders"
+]);
+const APP_MUTATION_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
+  "metamask.wallet.setup",
+  "metamask.wallet.ensure_unlocked",
+  "metamask.wallet.select_account",
+  "metamask.perps.close_positions",
+  "metamask.perps.close_orders",
+  "metamask.perps.place_order",
+  "metamask.perps.ensure_positions",
+  "metamask.perps.ensure_orders",
+  "metamask.perps.start_state",
+  "metamask.perps.teardown_state"
+]);
+const EXTERNAL_MUTATION_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
+  "metamask.perps.close_positions",
+  "metamask.perps.close_orders",
+  "metamask.perps.place_order",
+  "metamask.perps.ensure_positions",
+  "metamask.perps.ensure_orders",
+  "metamask.perps.start_state",
+  "metamask.perps.teardown_state"
+]);
+function metaMaskActionExecutionCapabilities(action) {
+  const capabilities = [];
+  if (READ_ONLY_CUSTOM_ACTIONS.has(action)) capabilities.push("host-read-export");
+  if (APP_MUTATION_CUSTOM_ACTIONS.has(action)) capabilities.push("app-mutation");
+  if (EXTERNAL_MUTATION_CUSTOM_ACTIONS.has(action)) capabilities.push("external-mutation");
+  return capabilities.length > 0 ? capabilities : ["arbitrary-code"];
+}
+async function actionSourceIntegrity(manifestPath, tier, implementationRoot) {
+  const manifestRoot = path.dirname(manifestPath);
+  const actionRoot = implementationRoot ?? (tier === "task" ? path.join(manifestRoot, "actions") : path.join(path.dirname(manifestRoot), "actions"));
+  const resolveDigest = () => digestSourceInputs([
+    { label: "manifest", root: manifestRoot, inputs: [path.basename(manifestPath)] },
+    { label: "implementation", root: actionRoot, inputs: ["."], optional: true }
+  ]);
+  return { digest: await resolveDigest(), resolveDigest };
+}
+async function digestSourceInputs(sources) {
+  const entries = [];
+  for (const source of sources) {
+    let rootReal;
+    try {
+      rootReal = await realpath(source.root);
+    } catch (error) {
+      if (source.optional && isMissing(error)) continue;
+      throw error;
+    }
+    const visitedDirectories = /* @__PURE__ */ new Set();
+    for (const relativeInput of source.inputs) {
+      await collectDigestEntries(
+        source.root,
+        rootReal,
+        relativeInput,
+        source.label,
+        entries,
+        visitedDirectories
+      );
+    }
+  }
+  entries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+  const hash = createHash("sha256");
+  for (const entry of entries) {
+    hash.update(`${entry.name}\0${entry.bytes.length}\0`);
+    hash.update(entry.bytes);
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+async function collectDigestEntries(root, rootReal, relativePath, label, entries, visitedDirectories) {
+  const lexicalPath = path.join(root, relativePath);
+  const info = await lstat(lexicalPath);
+  const resolvedPath = await realpath(lexicalPath);
+  if (!isPathWithin(rootReal, resolvedPath)) {
+    throw new Error(`Action source ${relativePath} resolves outside its selected source root.`);
+  }
+  const resolvedInfo = info.isSymbolicLink() ? await lstat(resolvedPath) : info;
+  if (resolvedInfo.isDirectory()) {
+    if (visitedDirectories.has(resolvedPath)) return;
+    visitedDirectories.add(resolvedPath);
+    for (const entry of await readdir(resolvedPath, { withFileTypes: true })) {
+      await collectDigestEntries(
+        root,
+        rootReal,
+        path.join(relativePath, entry.name),
+        label,
+        entries,
+        visitedDirectories
+      );
+    }
+    return;
+  }
+  if (!resolvedInfo.isFile()) return;
+  entries.push({
+    name: `${label}/${relativePath.split(path.sep).join("/")}`,
+    bytes: await readFile(resolvedPath)
+  });
+}
+function isPathWithin(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function isMissing(error) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}
+function explicitRecipeTrustOptions(values) {
+  const { sourceTrust, sourceKind, sourceName, sourceDigest, approvalDigest } = values;
+  const source = sourceTrust || sourceKind || sourceName || sourceDigest ? {
+    trust: sourceTrust ?? "unknown",
+    kind: sourceKind ?? "recipe-file",
+    ...sourceName ? { name: sourceName } : {},
+    ...sourceDigest ? { digest: sourceDigest } : {}
+  } : void 0;
+  return {
+    ...source ? { source } : {},
+    ...approvalDigest ? { approval: { planDigest: approvalDigest } } : {}
+  };
+}
+function recipeTrustFailure(error) {
+  if (!error || typeof error !== "object") return void 0;
+  const value = error;
+  if (typeof value.code !== "string" || !value.code.startsWith("RECIPE_") || typeof value.message !== "string" || typeof value.userAction !== "string") return void 0;
+  const failure = value.failure && typeof value.failure === "object" ? value.failure : void 0;
+  const blocked = Array.isArray(failure?.blocked) ? failure.blocked.flatMap((entry) => {
+    if (!entry || typeof entry !== "object") return [];
+    const node = entry;
+    if (typeof node.nodeId !== "string" || typeof node.action !== "string" || !Array.isArray(node.capabilities)) return [];
+    const origin = node.origin && typeof node.origin === "object" ? node.origin : void 0;
+    const adapterOrigin = node.adapterOrigin && typeof node.adapterOrigin === "object" ? node.adapterOrigin : void 0;
+    const implementation = adapterOrigin ? {
+      ...typeof adapterOrigin.kind === "string" ? { kind: adapterOrigin.kind } : {},
+      ...typeof adapterOrigin.trust === "string" ? { trust: adapterOrigin.trust } : {},
+      ...typeof adapterOrigin.digest === "string" ? { digest: adapterOrigin.digest } : {}
+    } : void 0;
+    return [{
+      nodeId: node.nodeId,
+      action: node.action,
+      capabilities: node.capabilities.filter(
+        (item) => typeof item === "string"
+      ),
+      source: typeof origin?.kind === "string" ? origin.kind : "unknown",
+      ...implementation && Object.keys(implementation).length > 0 ? { implementation } : {}
+    }];
+  }) : void 0;
+  const recipeDigest = typeof failure?.recipeDigest === "string" ? failure.recipeDigest : void 0;
+  const userAction = recipeDigest && (value.code === "RECIPE_TRUST_REQUIRED" || value.code === "RECIPE_APPROVAL_MISMATCH") && !value.userAction.includes("execution environment") ? `${value.userAction}; rerun with the same project root, artifact directory, and execution environment` : value.userAction;
+  return {
+    code: value.code,
+    message: value.message,
+    userAction,
+    ...failure ? {
+      details: {
+        // Farmslot reports the approved execution plan digest as
+        // recipeDigest in failures; approval input names it planDigest.
+        ...recipeDigest ? { recipeDigest } : {},
+        ...typeof failure.trust === "string" ? { trust: failure.trust } : {},
+        ...blocked?.length ? { blocked } : {}
+      }
+    } : {}
+  };
+}
+export {
+  actionSourceIntegrity,
+  explicitRecipeTrustOptions,
+  metaMaskActionExecutionCapabilities,
+  recipeTrustFailure
+};

package/dist/run-diagnostics.js

@@ -0,0 +1,261 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { getAdapterSurface } from "./adapters/surface.js";
+import { runnerDir } from "./paths.js";
+import { ensureExtensionConsoleCapture } from "./adapters/extension/console-capture.js";
+const MAX_CAPTURE_BYTES = 512 * 1024;
+const MAX_FINDINGS = 20;
+const MAX_PREVIEW_CHARS = 320;
+function readRunDiagnosticsDocument(diagnosticsPath) {
+  if (typeof diagnosticsPath !== "string" || diagnosticsPath.length === 0) return null;
+  try {
+    const document = JSON.parse(fs.readFileSync(diagnosticsPath, "utf8"));
+    return isRunDiagnosticsDocument(document) ? document : null;
+  } catch {
+    return null;
+  }
+}
+function formatRunDiagnosticsForHuman(diagnostics, adapter) {
+  if (!diagnostics) {
+    return [adapter === "core" ? "N/A \u2014 Core is headless and has no application log source." : "UNAVAILABLE \u2014 application diagnostics could not be collected for this run."];
+  }
+  const status = diagnostics.status === "clean" ? "CLEAN" : diagnostics.status === "review" ? "REVIEW" : "UNAVAILABLE";
+  const lines = [`${status} \u2014 ${diagnostics.note}`];
+  for (const finding of diagnostics.findings) {
+    const count = finding.count > 1 ? ` \xD7${finding.count}` : "";
+    lines.push(`${finding.level.toUpperCase()}${count} \u2014 ${finding.preview}`);
+  }
+  return lines;
+}
+async function beginRunDiagnostics(adapter, projectRoot) {
+  const source = getAdapterSurface(adapter).appLogSource(projectRoot);
+  if (!source) return null;
+  const mobileIssueBuffer = adapter === "mobile" && armMobileIssueBuffer(projectRoot) ? { projectRoot } : void 0;
+  if (adapter === "extension") {
+    await ensureExtensionConsoleCapture(projectRoot).catch(() => void 0);
+  }
+  const stat = safeStat(source.path);
+  return {
+    source,
+    offset: stat?.size ?? 0,
+    ...stat ? { inode: stat.ino } : {},
+    ...mobileIssueBuffer ? { mobileIssueBuffer } : {}
+  };
+}
+function isRunDiagnosticsDocument(value) {
+  if (!isRecord(value) || value.schemaVersion !== 1 || value.scope !== "recipe-run-application") return false;
+  if (value.status !== "clean" && value.status !== "review" && value.status !== "unavailable") return false;
+  return typeof value.note === "string" && Array.isArray(value.findings);
+}
+function finishRunDiagnostics(baseline, result) {
+  if (!baseline) return result;
+  try {
+    const bufferedIssues = baseline.mobileIssueBuffer ? collectMobileIssueBuffer(baseline.mobileIssueBuffer.projectRoot) : void 0;
+    const diagnostics = collectRunDiagnostics(baseline, bufferedIssues);
+    const artifactsDir = path.dirname(result.summaryPath);
+    const diagnosticsPath = path.join(artifactsDir, "diagnostics.json");
+    fs.writeFileSync(diagnosticsPath, `${JSON.stringify(diagnostics, null, 2)}
+`);
+    indexDiagnosticArtifact(result.artifactManifestPath);
+    indexDiagnosticSummary(result.summaryPath, diagnostics);
+    return {
+      ...result,
+      diagnosticsPath,
+      sideFindings: {
+        status: diagnostics.status,
+        note: diagnostics.note,
+        counts: diagnostics.counts
+      }
+    };
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    console.warn(`WARN: run diagnostics were unavailable: ${detail}`);
+    return {
+      ...result,
+      sideFindings: {
+        status: "unavailable",
+        note: "Run diagnostics could not be collected; the recipe result is unchanged.",
+        counts: { total: 0, warning: 0, error: 0, exception: 0 }
+      }
+    };
+  }
+}
+function collectRunDiagnostics(baseline, bufferedIssues) {
+  const stat = safeStat(baseline.source.path);
+  const source = {
+    label: baseline.source.label,
+    path: baseline.source.path,
+    startOffset: baseline.offset,
+    endOffset: stat?.size ?? baseline.offset,
+    bytesRead: 0,
+    truncated: false,
+    inAppBuffer: bufferedIssues === void 0 ? "n/a" : bufferedIssues === null ? "unavailable" : "collected"
+  };
+  let text = "";
+  if (stat) {
+    const sameFile = baseline.inode === void 0 || baseline.inode === stat.ino;
+    const startOffset = sameFile && stat.size >= baseline.offset ? baseline.offset : 0;
+    const available = Math.max(0, stat.size - startOffset);
+    const bytesToRead = Math.min(available, MAX_CAPTURE_BYTES);
+    source.startOffset = startOffset;
+    source.endOffset = stat.size;
+    source.bytesRead = bytesToRead;
+    source.truncated = available > MAX_CAPTURE_BYTES;
+    if (bytesToRead > 0) text = readSlice(baseline.source.path, startOffset, bytesToRead);
+  }
+  const allFindings = dedupeFindings(
+    [
+      ...text.split(/\r?\n/u).map(classifyLine).filter((finding) => finding !== null),
+      ...(bufferedIssues ?? []).map(classifyBufferedIssue).filter((finding) => finding !== null)
+    ]
+  );
+  const findings = allFindings.slice(0, MAX_FINDINGS);
+  const counts = countFindings(allFindings);
+  const status = counts.total > 0 ? "review" : stat || bufferedIssues !== void 0 && bufferedIssues !== null ? "clean" : "unavailable";
+  const note = counts.total > 0 ? `Observed ${counts.total} distinct application warning/error event(s) during the recipe run; relation to the task is not determined.` : status === "clean" ? "No application warnings or errors were emitted during the recipe run." : "Application diagnostics were unavailable for this run.";
+  return {
+    schemaVersion: 1,
+    scope: "recipe-run-application",
+    status,
+    nonBlocking: true,
+    note,
+    source,
+    counts,
+    findings
+  };
+}
+function classifyLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return null;
+  let level = null;
+  if (/\bEXCEPTION\s{2,}|\b(?:Uncaught|UnhandledPromiseRejection|FATAL EXCEPTION)\b/iu.test(trimmed)) {
+    level = "exception";
+  } else if (/^(?:ERROR\s{2,}|\[error\]\s*)/iu.test(trimmed) || /\]\s+ERROR\s{2,}/u.test(trimmed)) {
+    level = "error";
+  } else if (/^(?:WARN(?:ING)?\s{2,}|\[warn(?:ing)?\]\s*)/iu.test(trimmed) || /\]\s+WARN(?:ING)?\s{2,}/u.test(trimmed)) {
+    level = "warning";
+  }
+  if (!level) return null;
+  return makeFinding(level, trimmed);
+}
+function classifyBufferedIssue(value) {
+  if (!isRecord(value) || typeof value.text !== "string") return null;
+  const rawLevel = String(value.level ?? "").toLowerCase();
+  const level = rawLevel === "warn" || rawLevel === "warning" ? "warning" : rawLevel === "error" ? "error" : rawLevel === "exception" ? "exception" : null;
+  return level ? makeFinding(level, value.text) : null;
+}
+function makeFinding(level, text) {
+  const preview = redactPreview(text.trim());
+  const identity = preview.replace(/\b\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?\b/gu, "[TIME]").replace(/\[(?:sw|page:[^\]]+|console:[^\]]+)\]/gu, "[APP]").replace(/^(?:(?:WARN(?:ING)?|ERROR|EXCEPTION|\[TIME\]|\[APP\])\s*)+/u, "");
+  return {
+    level,
+    fingerprint: createHash("sha256").update(`${level}|${identity}`).digest("hex").slice(0, 12),
+    preview
+  };
+}
+function armMobileIssueBuffer(projectRoot) {
+  const armed = runMobileIssueCommand(projectRoot, "issues-arm");
+  if (!armed) return false;
+  return runMobileIssueCommand(projectRoot, "issues-collect") !== null;
+}
+function collectMobileIssueBuffer(projectRoot) {
+  const result = runMobileIssueCommand(projectRoot, "issues-collect");
+  return isRecord(result) && Array.isArray(result.entries) ? result.entries : null;
+}
+function runMobileIssueCommand(projectRoot, command) {
+  const bridge = path.join(runnerDir, "adapters", "mobile", "bridge-runtime", "cdp-bridge.cjs");
+  const result = spawnSync(process.execPath, [bridge, command], {
+    cwd: projectRoot,
+    env: { ...process.env, APP_ROOT: projectRoot, CDP_TIMEOUT: "5000" },
+    encoding: "utf8",
+    timeout: 1e4
+  });
+  if (result.status !== 0) return null;
+  try {
+    return JSON.parse(result.stdout.trim());
+  } catch {
+    return null;
+  }
+}
+function redactPreview(value) {
+  return value.replace(/\b(Bearer)\s+\S+/giu, "$1 [REDACTED]").replace(/\b(api[-_]?key|password|passphrase|mnemonic|seed(?:Phrase)?|privateKey|secret|token|authorization|vault)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|\S+)/giu, "$1=[REDACTED]").replace(/\b(?:0x)?[a-f0-9]{64,}\b/giu, "[REDACTED_HEX]").replace(/(https?:\/\/[^\s?]+)\?\S+/giu, "$1?[REDACTED_QUERY]").slice(0, MAX_PREVIEW_CHARS);
+}
+function dedupeFindings(findings) {
+  const byFingerprint = /* @__PURE__ */ new Map();
+  for (const finding of findings) {
+    const existing = byFingerprint.get(finding.fingerprint);
+    if (existing) existing.count += 1;
+    else byFingerprint.set(finding.fingerprint, { ...finding, count: 1 });
+  }
+  return [...byFingerprint.values()];
+}
+function countFindings(findings) {
+  const counts = { total: findings.length, warning: 0, error: 0, exception: 0 };
+  for (const finding of findings) counts[finding.level] += 1;
+  return counts;
+}
+function readSlice(filePath, offset, length) {
+  const fd = fs.openSync(filePath, "r");
+  try {
+    const buffer = Buffer.alloc(length);
+    const bytesRead = fs.readSync(fd, buffer, 0, length, offset);
+    return buffer.subarray(0, bytesRead).toString("utf8");
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+function safeStat(filePath) {
+  try {
+    return fs.statSync(filePath);
+  } catch {
+    return null;
+  }
+}
+function indexDiagnosticArtifact(manifestPath) {
+  const manifest = readJsonRecord(manifestPath);
+  if (!manifest) return;
+  const artifacts = Array.isArray(manifest.artifacts) ? manifest.artifacts : [];
+  manifest.artifacts = [
+    ...artifacts.filter((artifact) => !isRecord(artifact) || artifact.path !== "diagnostics.json"),
+    {
+      path: "diagnostics.json",
+      type: "json",
+      label: "Run-scoped application diagnostics",
+      category: "diagnostic"
+    }
+  ];
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+}
+function indexDiagnosticSummary(summaryPath, diagnostics) {
+  const summary = readJsonRecord(summaryPath);
+  if (!summary) return;
+  summary.sideFindings = {
+    status: diagnostics.status,
+    nonBlocking: true,
+    counts: diagnostics.counts,
+    diagnosticsPath: "diagnostics.json"
+  };
+  fs.writeFileSync(summaryPath, `${JSON.stringify(summary, null, 2)}
+`);
+}
+function readJsonRecord(filePath) {
+  try {
+    const value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    return isRecord(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export {
+  beginRunDiagnostics,
+  collectRunDiagnostics,
+  finishRunDiagnostics,
+  formatRunDiagnosticsForHuman,
+  readRunDiagnosticsDocument
+};

package/dist/run-recording.js

@@ -10,7 +10,7 @@ async function startRecipeRecording(adapter, projectRoot, artifactsDir, options)
   if (!options.record) return void 0;
   if (process.platform !== "darwin") {
     console.error(
-      "WARN: --record uses capture-helper and is currently supported only on macOS; continuing without video."
+      "WARN: --record-video uses capture-helper and is currently supported only on macOS; continuing without video."
     );
     return void 0;
   }

package/dist/runner.js

@@ -6,6 +6,9 @@ import {
 } from "./adapters/mobile/source-freshness.js";
 import { resolveMetaMaskMobileLifecycleTarget } from "./app-lifecycle.js";
 import { loadMetaMaskExtensionActionManifest, loadMetaMaskMobileActionManifest } from "./manifest.js";
+import {
+  prepareLiveAdapterScript
+} from "./live-adapter-contract.js";
 import { createMetaMaskRecordingTargetProvider } from "./recording-target.js";
 import { importRecipeHarness, importRecipeHarnessAppLifecycle, importRecipeHarnessRuntimeCdp, importRecipeHarnessRuntimeReactNativeBridge, runnerDir } from "./paths.js";
 async function createMetaMaskMobileRunner(options = {}) {
@@ -29,10 +32,17 @@ async function createMetaMaskRunner(adapter, actionManifest, options = {}) {
   const { createCdpWebUiTransport } = await importRecipeHarnessRuntimeCdp();
   const { createReactNativeBridgeUiTransport } = await importRecipeHarnessRuntimeReactNativeBridge();
   const { createAppLifecycleAdapters } = await importRecipeHarnessAppLifecycle();
-  const actions = [
-    ...actionManifest.supported_official_actions,
-    ...(actionManifest.custom_actions ?? []).map((entry) => entry.name)
-  ];
+  const customActions = (actionManifest.custom_actions ?? []).map(
+    (entry) => typeof entry === "string" ? entry : entry.name
+  );
+  const actionSources = options.actionSources ? new Map([...options.actionSources].map(([action, source]) => [action, { ...source }])) : void 0;
+  const preparedLiveAdapters = await prepareLiveAdapterImplementations(
+    adapter,
+    customActions,
+    actionSources,
+    options.trustTaskActions
+  );
+  const actions = [...actionManifest.supported_official_actions, ...customActions];
   const declaredActions = new Set(actions);
   const core = createStandardCoreAdapters({ actions });
   const projectOwnedOfficialActions = /* @__PURE__ */ new Set(["app.status", "app.lifecycle"]);
@@ -41,7 +51,7 @@ async function createMetaMaskRunner(adapter, actionManifest, options = {}) {
     transport: createMetaMaskUiTransport(adapter, {
       createCdpWebUiTransport,
       createReactNativeBridgeUiTransport
-    })
+    }, preparedLiveAdapters)
   });
   const existing = new Set([...core, ...ui].map((entry) => entry.action));
   const lifecycle = mobileSourceAwareLifecycleAdapters(
@@ -51,19 +61,37 @@ async function createMetaMaskRunner(adapter, actionManifest, options = {}) {
       targetProvider: { resolveTarget: resolveMetaMaskMobileLifecycleTarget }
     })
   );
-  const custom = createMetaMaskAdapters(adapter).filter(
+  const custom = createMetaMaskAdapters(
+    adapter,
+    customActions,
+    preparedLiveAdapters
+  ).filter(
     (entry) => declaredActions.has(entry.action) && !existing.has(entry.action) && !lifecycle.some((lifecycleEntry) => lifecycleEntry.action === entry.action)
   );
-  const autoHudDisabled = process.env.METAMASK_RECIPE_AUTO_HUD === "0" || process.env.METAMASK_RECIPE_AUTO_HUD === "false";
-  const logger = options.quietStdout ? new console.Console(process.stderr) : console;
+  const autoHudDisabled = options.autoHud === false || process.env.METAMASK_RECIPE_AUTO_HUD === "0" || process.env.METAMASK_RECIPE_AUTO_HUD === "false";
+  const logger = deduplicateLibraryResolutionLogs(
+    options.quietStdout ? new console.Console(process.stderr) : console,
+    options.suppressLibraryResolutionLogs
+  );
   return createRecipeRunner({
     actionManifest,
-    adapters: [...core, ...ui, ...lifecycle, ...custom],
+    adapters: withActionProgress(
+      [...core, ...ui, ...lifecycle, ...custom].map((entry) => ({
+        ...entry,
+        ...adapterSecurity(entry.action, actionSources, options.trustTaskActions)
+      })),
+      options.onActionEvent
+    ),
     logger,
     recording: {
       targetProvider: createMetaMaskRecordingTargetProvider(adapter)
     },
     runner: runnerProvenance(),
+    defaultSource: {
+      kind: "operator",
+      trust: "trusted",
+      name: "@deeeed/metamask-harness"
+    },
     hud: autoHudDisabled ? false : {
       enabled: true,
       display: {
@@ -76,6 +104,108 @@ async function createMetaMaskRunner(adapter, actionManifest, options = {}) {
     }
   });
 }
+function deduplicateLibraryResolutionLogs(logger, suppress = false) {
+  const seen = /* @__PURE__ */ new Set();
+  return {
+    info(message) {
+      if (message.startsWith("Recipe libraries:")) {
+        if (suppress) return;
+        if (seen.has(message)) return;
+        seen.add(message);
+      }
+      logger.info(message);
+    },
+    warn(message) {
+      logger.warn(message);
+    },
+    error(message) {
+      logger.error(message);
+    }
+  };
+}
+async function prepareLiveAdapterImplementations(platform, actions, sources, trustTaskActions = false) {
+  const prepared = /* @__PURE__ */ new Map();
+  if (!sources) return prepared;
+  await Promise.all(actions.map(async (action) => {
+    const source = sources.get(action);
+    if (!source?.implementationRoot || source.tier === "official") return;
+    const executable = await prepareLiveAdapterScript({
+      platform,
+      action,
+      implementationRoot: source.implementationRoot,
+      allowRuntimeImports: source.tier === "canonical" || source.trust === "trusted" || source.tier === "task" && trustTaskActions
+    });
+    if (!executable) return;
+    prepared.set(action, executable);
+    source.digest = executable.sourceDigest;
+    source.resolveDigest = void 0;
+  }));
+  return prepared;
+}
+function adapterSecurity(action, sources, trustTaskActions = false) {
+  const source = sources?.get(action);
+  if (source?.tier === "task") {
+    return {
+      source: {
+        kind: "custom-adapter",
+        trust: trustTaskActions ? "trusted" : "untrusted",
+        name: source.name,
+        path: source.manifestPath,
+        ...source.digest ? { digest: source.digest } : {}
+      },
+      ...source.resolveDigest ? { resolveSourceDigest: source.resolveDigest } : {}
+    };
+  }
+  if (source && source.tier !== "official") {
+    return {
+      source: {
+        kind: source.tier === "canonical" ? "bundled" : "custom-adapter",
+        trust: source.trust ?? (source.tier === "canonical" ? "trusted" : "unknown"),
+        name: source.name,
+        path: source.manifestPath,
+        ...source.digest ? { digest: source.digest } : {}
+      },
+      ...source.resolveDigest ? { resolveSourceDigest: source.resolveDigest } : {}
+    };
+  }
+  return {
+    source: {
+      kind: "bundled",
+      trust: "trusted",
+      name: "@deeeed/metamask-harness"
+    }
+  };
+}
+function withActionProgress(adapters, onActionEvent) {
+  if (!onActionEvent) return adapters;
+  return adapters.map((entry) => ({
+    ...entry,
+    async execute(node, context) {
+      const event = { nodeId: context.nodeId, action: entry.action };
+      const reportProgress = !isAutomaticHudProgress(entry.action, node, context.nodeId);
+      if (reportProgress) onActionEvent({ ...event, status: "running" });
+      try {
+        const result = await entry.execute(node, context);
+        if (reportProgress) {
+          onActionEvent({ ...event, status: "passed" });
+        }
+        return result;
+      } catch (error) {
+        if (reportProgress) onActionEvent({ ...event, status: "failed" });
+        throw error;
+      }
+    }
+  }));
+}
+function isAutomaticHudProgress(action, node, nodeId) {
+  if (action !== "app.hud" || node === null || typeof node !== "object" || Array.isArray(node)) {
+    return false;
+  }
+  const payload = node;
+  if (typeof payload.action_name === "string") return true;
+  const progress = payload.progress;
+  return nodeId === "recipe-complete" && progress !== null && typeof progress === "object" && !Array.isArray(progress) && progress.complete === true;
+}
 function mobileSourceAwareLifecycleAdapters(adapter, lifecycle) {
   if (adapter !== "mobile") return lifecycle;
   return lifecycle.map((entry) => ({
@@ -116,5 +246,6 @@ export {
   createMetaMaskExtensionRunner,
   createMetaMaskMobileRunner,
   createMetaMaskRunner,
+  isAutomaticHudProgress,
   mobileSourceAwareLifecycleAdapters
 };