@deeeed/metamask-harness 0.2.0

package/orchestration/manifest.json

@@ -0,0 +1,358 @@
+{
+  "schemaVersion": 1,
+  "description": "Orchestration feature surface: one entry per feature script. orchestration/doctor.mjs verifies every entry point exists, answers --help with exit 0, and that no orchestration script is missing from this manifest.",
+  "features": [
+    {
+      "id": "mobile/launch",
+      "entry": "orchestration/mobile/launch.sh",
+      "kind": "bash",
+      "purpose": "Mobile instance identity intake (port/simulator/adb/runtime-dir tuple) + prepare/preflight launch.",
+      "inputs": "--target --platform --preflight-mode --port|--watcher-port|--cdp-port --simulator --adb-serial --runtime-dir --wallet-setup/--no-wallet-setup --wallet-fixture --artifacts-dir; env WATCHER_PORT>METRO_PORT>CDP_PORT, IOS_SIMULATOR>SIM_UDID, ADB_SERIAL>ANDROID_SERIAL, RECIPE_RUNTIME_DIR, RECIPE_HARNESS_MOBILE_PREFLIGHT_MODE",
+      "outputs": "<artifacts>/summary.json, runtime-status.json, logs/prepare.log; exit 0/1/2"
+    },
+    {
+      "id": "mobile/live",
+      "entry": "orchestration/mobile/live.sh",
+      "kind": "bash",
+      "purpose": "Launch-then-verify chaining for one mobile slot run (verify gets --no-auto-start).",
+      "inputs": "--target --platform --preflight-mode --artifacts-dir --wallet-setup/--no-wallet-setup --wallet-fixture",
+      "outputs": "<artifacts>/summary.json + launch/ + verify/; exit 0/1/2"
+    },
+    {
+      "id": "mobile/inject",
+      "entry": "orchestration/mobile/inject.sh",
+      "kind": "bash",
+      "purpose": "Install the mobile harness overlay (delegate + snapshots; full mode adds the app bridge with backups).",
+      "inputs": "--target --allow-dirty-harness-paths --force-overlay --no-git-exclude; env RECIPE_HARNESS_ROOT, METAMASK_RUNNER_PROTOCOL_ROOT>FARMSLOT_ROOT",
+      "outputs": "<harness>/manifest.json + runner/ + scripts/ + backup store; exit 0/1/2"
+    },
+    {
+      "id": "mobile/cleanup",
+      "entry": "orchestration/mobile/cleanup.sh",
+      "kind": "bash",
+      "purpose": "Remove the mobile overlay; restore backed-up product files; remove recorded git excludes.",
+      "inputs": "--target --allow-managed-changes; env RECIPE_HARNESS_ROOT",
+      "outputs": "removes <harness>/ + backups; exit 0/1/2"
+    },
+    {
+      "id": "extension/launch",
+      "entry": "orchestration/extension/launch.sh",
+      "kind": "bash",
+      "purpose": "Run the caller-supplied prepare command for one slot, then confirm app-control readiness.",
+      "inputs": "--target --cdp-port --prepare-cmd --artifacts-dir; env RECIPE_HARNESS_EXTENSION_LAUNCH_CMD",
+      "outputs": "<artifacts>/summary.json, logs/{launch.log,extension-readiness.json}; exit 0/1/2"
+    },
+    {
+      "id": "extension/live",
+      "entry": "orchestration/extension/live.sh",
+      "kind": "bash",
+      "purpose": "Sequencer: builds the prepare command from the named feature scripts, then launch + verify.",
+      "inputs": "--target --cdp-port --launch-existing-dist|--start-watch|--prepare-cmd --dist-dir --chrome-user-data-dir --out --artifacts-dir; env RECIPE_HARNESS_CHROME_BIN, RECIPE_WALLET_FIXTURE, RECIPE_HARNESS_LIVE_KEEP",
+      "outputs": "<artifacts>/summary.json + launch/ + verify/ + logs/fixture-source.json; exit 0/1/2"
+    },
+    {
+      "id": "extension/start-watch",
+      "entry": "orchestration/extension/start-watch.sh",
+      "kind": "bash",
+      "purpose": "Harness-owned webpack watcher: cache clear, dual-writer refusal, compile-marker wait, baseline record.",
+      "inputs": "--target --runtime-dir --runner-bin --summary",
+      "outputs": "<runtime-dir>/recipe-harness-webpack.{pid,log}; optional summary; exit 0/1/2"
+    },
+    {
+      "id": "extension/console-tail",
+      "entry": "orchestration/extension/console-tail.mjs",
+      "kind": "node",
+      "purpose": "Live CDP stream of the running extension console (MV3 service worker + UI pages), re-attaching across service-worker churn; hosts the console tmux tab.",
+      "inputs": "--cdp-port [--log <file>]",
+      "outputs": "console lines on stdout, optional mirror to --log; exit 0/1/2"
+    },
+    {
+      "id": "extension/snapshot-dist",
+      "entry": "orchestration/extension/snapshot-dist.sh",
+      "kind": "bash",
+      "purpose": "Runtime-dist snapshot (rsync, excludes _metadata) with from-git-id freshness guard.",
+      "inputs": "--dist --runtime-dist --wait-iterations --summary",
+      "outputs": "<runtime-dist>/ snapshot; optional summary; exit 0/1/2"
+    },
+    {
+      "id": "extension/seed-fixture",
+      "entry": "orchestration/extension/seed-fixture.sh",
+      "kind": "bash",
+      "purpose": "Wallet fixture resolution chain + generate/prefill (pre-launch) and seed-cdp (post-launch) phases.",
+      "inputs": "resolve|prefill|seed-cdp; --target --cdp-port --fixture --state --profile --extension-dir --extension-id-file --out --source-out --fixture-script --summary; env RECIPE_WALLET_FIXTURE",
+      "outputs": "fixture path on stdout (resolve), provenance/state/parity JSON files; exit 0/1/2"
+    },
+    {
+      "id": "extension/launch-browser",
+      "entry": "orchestration/extension/launch-browser.cjs",
+      "kind": "node",
+      "purpose": "Low-level spawn primitive: detached Chrome with isolated profile, CDP on 127.0.0.1, unpacked dist.",
+      "inputs": "--cdp-port --chrome-bin --profile --extension-dir --chrome-log --chrome-pid",
+      "outputs": "pid file + append-log; exit 0 / non-zero"
+    },
+    {
+      "id": "extension/refresh-build",
+      "entry": "orchestration/extension/refresh-build.sh",
+      "kind": "bash",
+      "purpose": "One-shot rebuild for a frozen slot: yarn start, wait for entry points, kill watcher (fresh AND frozen).",
+      "inputs": "--repo --watcher-port --timeout --clean-timeout",
+      "outputs": "refreshed dist/chrome; exit 0/1/2"
+    },
+    {
+      "id": "extension/ensure-browser",
+      "entry": "orchestration/extension/ensure-browser.sh",
+      "kind": "bash",
+      "purpose": "Ensure the slot's Chromium is running against the existing dist/profile/port (kills + relaunches).",
+      "inputs": "--slot-id --repo --cdp-port --runtime-dir --watcher-port; env CHROME_USER_DATA_DIR, RECIPE_HARNESS_ROOT",
+      "outputs": "<runtime-dir>/{browser.pid,chromium.pid,extension.id}; exit 0/1"
+    },
+    {
+      "id": "extension/inject",
+      "entry": "orchestration/extension/inject.mjs",
+      "kind": "node",
+      "purpose": "Install the extension harness overlay (delegate, manifests, recipes, helper scripts).",
+      "inputs": "--target --no-git-exclude; env RECIPE_HARNESS_ROOT, METAMASK_RUNNER_DIR, METAMASK_RUNNER_PROTOCOL_ROOT>FARMSLOT_ROOT",
+      "outputs": "<harness>/{manifest.json,action-manifest.json,runner/,scripts/}; exit 0/2/non-zero"
+    },
+    {
+      "id": "extension/cleanup",
+      "entry": "orchestration/extension/cleanup.mjs",
+      "kind": "node",
+      "purpose": "Remove the extension overlay and exactly the recorded git-exclude entries.",
+      "inputs": "--target; env RECIPE_HARNESS_ROOT",
+      "outputs": "removes <harness>/extension; exit 0/2"
+    },
+    {
+      "id": "extension/sidepanel-toggle",
+      "entry": "orchestration/extension/sidepanel-toggle.sh",
+      "kind": "bash",
+      "purpose": "Window-mode control for the extension instance: chrome.sidePanel status/open/close/toggle/cycle over the instance's CDP port.",
+      "inputs": "<status|open|close|toggle|cycle> --cdp-port --ext-id --agent-dir --settle-ms; env REPO, CDP_PORT, EXT_ID, SETTLE_MS, AGENT_DIR",
+      "outputs": "status/progress on stdout; exit 0/1/2"
+    },
+    {
+      "id": "extension/pin-remote-flags",
+      "entry": "orchestration/extension/pin-remote-flags.cjs",
+      "kind": "lib",
+      "purpose": "Pin A/B remote feature-flag variants into an extension manifest _flags before runtime-dist launch.",
+      "inputs": "<manifest.json> <KEY=VARIANT[,KEY=VARIANT...]>",
+      "outputs": "rewrites manifest._flags.remoteFeatureFlags; exit 0 / throw"
+    },
+    {
+      "id": "extension/readiness",
+      "entry": "orchestration/extension/readiness.mjs",
+      "kind": "node",
+      "purpose": "Health probe for one extension instance: dist entry files + live CDP target, repairs <runtime-dir>/extension.id.",
+      "inputs": "--target --cdp-port --json; env RECIPE_RUNTIME_DIR",
+      "outputs": "readiness report on stdout; exit 0 ready / non-zero"
+    },
+    {
+      "id": "extension/wallet-fixture-state",
+      "entry": "orchestration/extension/wallet-fixture-state.cjs",
+      "kind": "node",
+      "purpose": "Instance wallet state: generate deterministic state from a fixture, prefill the Chrome profile, seed/validate over CDP.",
+      "inputs": "generate|prefill-profile|seed-cdp + flags per usage(); env RECIPE_RUNTIME_DIR",
+      "outputs": "--out/--state JSON files; exit 0/1/2"
+    },
+    {
+      "id": "extension/extension-id",
+      "entry": "orchestration/extension/extension-id.ts",
+      "kind": "module",
+      "purpose": "Deterministic CRX id resolution from the loaded dist manifest key (TS module used by the runner CLI).",
+      "inputs": "resolveExtensionId(target)",
+      "outputs": "extension id string"
+    },
+    {
+      "id": "extension/ensure-ready",
+      "entry": "orchestration/extension/ensure-ready.ts",
+      "kind": "module",
+      "purpose": "Ensure the extension runtime is attachable (TS module used by the runner CLI).",
+      "inputs": "ensureExtensionReady(...)",
+      "outputs": "readiness result"
+    },
+    {
+      "id": "extension/runtime",
+      "entry": "orchestration/extension/runtime.ts",
+      "kind": "module",
+      "purpose": "Extension runtime prepare/health over CDP (TS module used by the runner CLI).",
+      "inputs": "prepareExtensionRuntime/checkExtensionRuntimeHealth",
+      "outputs": "runtime state"
+    },
+    {
+      "id": "extension/runtime-decision",
+      "entry": "orchestration/extension/runtime-decision.ts",
+      "kind": "module",
+      "purpose": "Cache/deps baseline + readiness decision (TS module used by the runner CLI).",
+      "inputs": "decideExtensionReadiness(...)",
+      "outputs": "decision record"
+    },
+    {
+      "id": "mobile/runtime-decision",
+      "entry": "orchestration/mobile/runtime-decision.ts",
+      "kind": "module",
+      "purpose": "Mobile deps + Metro bundle readiness decision (parity with extension runtime-decision).",
+      "inputs": "decideMobileReadiness(...)",
+      "outputs": "decision record"
+    },
+    {
+      "id": "mobile/deps-markers",
+      "entry": "orchestration/mobile/deps-markers.ts",
+      "kind": "module",
+      "purpose": "MetaMask Mobile product/native marker tables for harness deps-readiness.",
+      "inputs": "mobileProductMarkers(platform?)",
+      "outputs": "marker path list"
+    },
+    {
+      "id": "core/inject",
+      "entry": "orchestration/core/inject.sh",
+      "kind": "bash",
+      "purpose": "Headless core adapter install: overlay metadata + runner delegate only (no product writes).",
+      "inputs": "--target; env RECIPE_HARNESS_ROOT, METAMASK_RUNNER_PROTOCOL_ROOT>FARMSLOT_ROOT",
+      "outputs": "<harness>/core/{manifest.json,action-manifest.json,runner/}; exit 0/1/2"
+    },
+    {
+      "id": "core/cleanup",
+      "entry": "orchestration/core/cleanup.sh",
+      "kind": "bash",
+      "purpose": "Remove the core overlay dir (idempotent; nothing to restore).",
+      "inputs": "--target; env RECIPE_HARNESS_ROOT",
+      "outputs": "removes <harness>/core; exit 0/2"
+    },
+    {
+      "id": "lib/harness-path",
+      "entry": "orchestration/lib/harness-path.sh",
+      "kind": "lib",
+      "purpose": "THE one sourceable lib: harness root/dir + runtime dir resolution with path validation.",
+      "inputs": "env RECIPE_HARNESS_ROOT, RECIPE_RUNTIME_DIR (validated relative paths)",
+      "outputs": "harness_root / harness_dir / recipe_runtime_dir functions"
+    },
+    {
+      "id": "lib/hash-helpers",
+      "entry": "orchestration/lib/hash-helpers.sh",
+      "kind": "lib",
+      "purpose": "Overlay file hash markers (digest_file/digest_stdin/hash_path) for safe re-install/cleanup.",
+      "inputs": "TARGET env var (hash_path)",
+      "outputs": "sha256 digests on stdout"
+    },
+    {
+      "id": "lib/json-field",
+      "entry": "orchestration/lib/json-field.sh",
+      "kind": "lib",
+      "purpose": "read_runtime_context_field: dotted-path JSON reader for harness scripts.",
+      "inputs": "json path + dotted field",
+      "outputs": "field value on stdout"
+    },
+    {
+      "id": "lib/recipe-paths",
+      "entry": "orchestration/lib/recipe-paths.mjs",
+      "kind": "lib",
+      "purpose": "ESM mirror of harness-path defaults/validation for node scripts.",
+      "inputs": "env RECIPE_HARNESS_ROOT, RECIPE_RUNTIME_DIR",
+      "outputs": "recipeHarnessRoot()/recipeRuntimeDir() exports"
+    },
+    {
+      "id": "lib/activate-repo-node",
+      "entry": "orchestration/lib/activate-repo-node.sh",
+      "kind": "lib",
+      "purpose": "Manager-agnostic Node pin from .nvmrc / .tool-versions for non-interactive yarn/webpack spawns (tmux, nohup).",
+      "inputs": "activate_repo_node [target-dir]; tries asdf, fnm, mise, nvm, then matching node on PATH",
+      "outputs": "REPO_NODE_BIN, REPO_NODE_PATH_PREFIX; prepends bin dir to PATH; exit 0/1/2"
+    },
+    {
+      "id": "lib/ensure-runner-deps",
+      "entry": "orchestration/lib/ensure-runner-deps.sh",
+      "kind": "lib",
+      "purpose": "Idempotent install of runner npm deps (@farmslot/recipe-harness) for cloned checkouts with no node_modules; uses npm so parent product .yarnrc.yml does not block install.",
+      "inputs": "ensure-runner-deps.sh [RUNNER_DIR]; env FARMSLOT_ROOT / METAMASK_RUNNER_PROTOCOL_ROOT optional local link target",
+      "outputs": "installed node_modules in RUNNER_DIR; exit 0 when deps ready"
+    },
+    {
+      "id": "lib/resolve-farmslot-ports",
+      "entry": "orchestration/lib/resolve-farmslot-ports.sh",
+      "kind": "lib",
+      "purpose": "Resolve CDP + watcher ports from farmslot pool JSON by repo path, else 6660+N / 9010+N.",
+      "inputs": "resolve_extension_runtime_ports <repo>",
+      "outputs": "CDP_PORT / WATCHER_PORT / SLOT_ID lines on stdout"
+    },
+    {
+      "id": "lib/path-defaults",
+      "entry": "orchestration/lib/path-defaults.json",
+      "kind": "data",
+      "purpose": "Single source for the default harness root and runtime dir.",
+      "inputs": "none",
+      "outputs": "recipeHarnessRoot / recipeRuntimeDir defaults"
+    },
+    {
+      "id": "lib/cli-color",
+      "entry": "orchestration/lib/cli-color.mjs",
+      "kind": "lib",
+      "purpose": "Shared ANSI styling for recipe CLI human output (NO_COLOR / TTY aware).",
+      "inputs": "import { color, colorLogEvent, ... }",
+      "outputs": "styled strings for home, logs, and progress views"
+    },
+    {
+      "id": "lib/cli-home",
+      "entry": "orchestration/lib/cli-home.mjs",
+      "kind": "lib",
+      "purpose": "Recipe CLI home screen and ports output for mm-recipe / mme-recipe wrappers.",
+      "inputs": "--adapter extension|mobile --target --cdp-port --watcher-port [--harness-stale] [--json]",
+      "outputs": "human home/ports screen or JSON payload on stdout"
+    },
+    {
+      "id": "lib/cli-ux",
+      "entry": "orchestration/lib/cli-ux.sh",
+      "kind": "lib",
+      "purpose": "Shared bash UX helpers: progress, log-tui watch, failure playbooks, harness stale warnings.",
+      "inputs": "sourced by bin/mm-recipe and bin/mme-recipe",
+      "outputs": "recipe_progress / recipe_watch_rebuild_log / recipe_failure_playbook functions"
+    },
+    {
+      "id": "lib/cli-version",
+      "entry": "orchestration/lib/cli-version.mjs",
+      "kind": "node",
+      "purpose": "Detect stale installed harness scripts vs the active runner revision.",
+      "inputs": "check --runner-root --manifest [--installed-sha] [--json]",
+      "outputs": "stale boolean + details on stdout/stderr; exit 0"
+    },
+    {
+      "id": "lib/log-tui",
+      "entry": "orchestration/lib/log-tui.mjs",
+      "kind": "node",
+      "purpose": "Compact build-log UX: last N significant events plus pointer to full log.",
+      "inputs": "watch|tail|events --log <path> [--events <n>] [--mode compact|full|quiet] [--json]",
+      "outputs": "compact TUI on stderr/stdout; watch exits 0 on success pattern / 1 on failure"
+    },
+    {
+      "id": "lib/open-debug",
+      "entry": "orchestration/lib/open-debug.mjs",
+      "kind": "node",
+      "purpose": "Open human-facing debugger UIs for extension CDP or mobile Metro runtimes.",
+      "inputs": "--adapter extension|mobile [--cdp-port|--port] [--target page|worker] [--json] [--no-open]",
+      "outputs": "debug URL/report on stdout; exit 0/1"
+    },
+    {
+      "id": "lib/progress",
+      "entry": "orchestration/lib/progress.mjs",
+      "kind": "node",
+      "purpose": "Structured progress events for long recipe CLI operations (emit/done).",
+      "inputs": "emit|done --verb --phase|--status --message [--elapsed-ms] [--json]",
+      "outputs": "human or JSONL progress line on stderr"
+    },
+    {
+      "id": "lib/cli-commands",
+      "entry": "orchestration/lib/cli-commands.mjs",
+      "kind": "lib",
+      "purpose": "Single source of truth for recipe CLI command/flag completion metadata.",
+      "inputs": "dump|describe|flags|args|global-flags --adapter extension|mobile|shim",
+      "outputs": "completion tokens on stdout for shell scripts"
+    },
+    {
+      "id": "compat-overlays/mobile",
+      "entry": "orchestration/compat-overlays/mobile",
+      "kind": "compat-overlay",
+      "purpose": "Historical-commit replay support: reversible source overlays (e.g. rn81-message-event-source.patch) applied manually/via the recipe-harness skill so pre-RN-0.81 mobile checkouts boot and bridge under the current toolchain.",
+      "inputs": "manual `git apply` in the historical product checkout (no in-repo apply logic)",
+      "outputs": "patched historical checkout (reversible via git apply -R); overlay path recorded in eval evidence"
+    }
+  ]
+}

package/orchestration/mobile/cleanup.sh

@@ -0,0 +1,192 @@
+#!/usr/bin/env bash
+# cleanup.sh — remove the mobile harness overlay from a checkout
+#
+# Purpose:
+#   Restores backed-up product files (full installs), removes exactly the
+#   .git/info/exclude entries the install recorded, then deletes the harness
+#   dir and backup store. Metadata-only installs remove metadata alone.
+#
+# Inputs (flags / env):
+#   --target <metamask-mobile> (default $PWD)
+#   --allow-managed-changes   skip the managed-hash refusal
+#   env RECIPE_HARNESS_ROOT
+#
+# Outputs:
+#   Removes <harness>/ and backup dir; restores managed product paths.
+#   Exit 0 — cleaned; 1 — no backup state / changed managed paths refusal /
+#   missing backup; 2 — bad args.
+#
+# Never touches: product files other than the recorded managed paths;
+# .git/info/exclude lines it did not record; product-local cache dirs.
+set -euo pipefail
+
+TARGET="$PWD"
+ALLOW_MANAGED_CHANGES=false
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --target) TARGET="$2"; shift 2 ;;
+    --allow-managed-changes) ALLOW_MANAGED_CHANGES=true; shift ;;
+    -h|--help) echo "Usage: cleanup.sh [--target <metamask-mobile>] [--allow-managed-changes]"; exit 0 ;;
+    *) echo "Unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TARGET="$(cd "$TARGET" && pwd)"
+# shellcheck disable=SC1091
+. "$SCRIPT_DIR/../lib/hash-helpers.sh"
+# shellcheck disable=SC1091
+for _hp in "$SCRIPT_DIR/../lib/harness-path.sh"; do
+  [ -f "$_hp" ] && { . "$_hp"; break; }
+done
+unset _hp
+if ! command -v harness_root >/dev/null 2>&1; then
+  echo "mm-harness: shared lib orchestration/lib/harness-path.sh not found; reinstall the runner." >&2
+  exit 1
+fi
+HARNESS_DIR="$(harness_dir "$TARGET" mobile)"
+if GIT_BACKUP_PATH="$(git -C "$TARGET" rev-parse --git-path recipe-harness/mobile/backup 2>/dev/null)"; then
+  case "$GIT_BACKUP_PATH" in
+    /*) BACKUP_DIR="$GIT_BACKUP_PATH" ;;
+    *) BACKUP_DIR="$TARGET/$GIT_BACKUP_PATH" ;;
+  esac
+else
+  BACKUP_DIR="$HARNESS_DIR/backup-store"
+fi
+if [ ! -f "$BACKUP_DIR/state.env" ] && [ -f "$HARNESS_DIR/backup/state.env" ]; then
+  BACKUP_DIR="$HARNESS_DIR/backup"
+fi
+STATE_FILE="$BACKUP_DIR/state.env"
+
+remove_recorded_git_exclude_entries() {
+  local tracking_file="$1"
+  [ -s "$tracking_file" ] || return 0
+  local git_dir exclude_file tmp_file
+  if ! git_dir="$(git -C "$TARGET" rev-parse --git-dir 2>/dev/null)"; then
+    return 0
+  fi
+  case "$git_dir" in
+    /*) ;;
+    *) git_dir="$TARGET/$git_dir" ;;
+  esac
+  exclude_file="$git_dir/info/exclude"
+  [ -f "$exclude_file" ] || return 0
+  # Remove only the lines THIS install recorded, one occurrence per distinct
+  # ledger entry (the appended copy is the last match), so a pre-existing
+  # duplicate copy or a stale/duplicate ledger entry never drops a line we did
+  # not add this run.
+  tmp_file="$(mktemp)"
+  awk '
+    NR==FNR { if (length($0)) want[$0]=1; next }
+    { lines[++n]=$0; if ($0 in want) last[$0]=n }
+    END { for (k in last) drop[last[k]]=1; for (i=1;i<=n;i++) if (!(i in drop)) print lines[i] }
+  ' "$tracking_file" "$exclude_file" > "$tmp_file"
+  mv "$tmp_file" "$exclude_file"
+}
+
+if [ -f "$HARNESS_DIR/manifest.json" ] && node -e '
+    const fs = require("fs");
+    const manifest = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+    process.exit(manifest.installMode === "product-owned" ? 0 : 1);
+  ' "$HARNESS_DIR/manifest.json" 2>/dev/null; then
+  remove_recorded_git_exclude_entries "$HARNESS_DIR/added-git-exclude"
+  rm -rf "$HARNESS_DIR"
+  echo "Cleaned mobile recipe harness metadata from $TARGET (product-owned in-app bridge files left untouched)"
+  exit 0
+fi
+
+if [ ! -f "$STATE_FILE" ]; then
+  if [ -f "$HARNESS_DIR/manifest.json" ] && node -e '
+    const fs = require("fs");
+    const manifest = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+    process.exit(manifest.installMode === "product-owned" ? 0 : 1);
+  ' "$HARNESS_DIR/manifest.json" 2>/dev/null; then
+    remove_recorded_git_exclude_entries "$HARNESS_DIR/added-git-exclude"
+    rm -rf "$HARNESS_DIR"
+    echo "Cleaned mobile recipe harness metadata from $TARGET (product-owned in-app bridge files left untouched)"
+    exit 0
+  fi
+  echo "No mobile harness backup found at $STATE_FILE" >&2
+  exit 1
+fi
+
+while IFS= read -r _line || [ -n "$_line" ]; do
+  [[ "$_line" =~ ^[[:space:]]*(#|$) ]] && continue
+  _key="${_line%%=*}"
+  _val="${_line#*=}"
+  case "$_key" in
+    AGENTIC_SERVICE_EXISTED|PACKAGE_JSON_EXISTED|NAVIGATION_SERVICE_EXISTED|APP_TSX_EXISTED) ;;
+    *) continue ;;
+  esac
+  export "$_key=$_val"
+done < "$STATE_FILE"
+unset _line _key _val
+
+HASH_FILE="$BACKUP_DIR/managed-hashes.tsv"
+
+verify_managed_paths_unchanged() {
+  if [ ! -f "$HASH_FILE" ]; then
+    cat >&2 <<EOF
+Refusing cleanup: no managed hash file found at $HASH_FILE.
+Re-run mobile harness install from the current runner to refresh safety metadata, or restore manually.
+EOF
+    exit 1
+  fi
+  local rel expected actual conflicts=0
+  while IFS=$'\t' read -r rel expected; do
+    [ -n "$rel" ] || continue
+    actual="$(hash_path "$rel")"
+    if [ "$actual" != "$expected" ]; then
+      echo "Refusing cleanup: managed harness path changed after install: $rel" >&2
+      echo "  expected: $expected" >&2
+      echo "  actual:   $actual" >&2
+      conflicts=1
+    fi
+  done < "$HASH_FILE"
+  if [ "$conflicts" != "0" ]; then
+    cat >&2 <<EOF
+Cleanup would restore backups over files that changed after harness install.
+Save/stash those changes, rerun harness install to refresh managed hashes, or restore manually.
+EOF
+    exit 1
+  fi
+}
+
+if [ "$ALLOW_MANAGED_CHANGES" != "true" ]; then
+  verify_managed_paths_unchanged
+else
+  echo "Allowing cleanup over changed managed harness paths."
+fi
+
+restore_path() {
+  local rel="$1"
+  local existed="$2"
+  local target_path="$TARGET/$rel"
+  local backup_path="$BACKUP_DIR/$rel"
+  if [ "$existed" = "1" ]; then
+    if [ ! -e "$backup_path" ]; then
+      echo "Missing backup for $rel at $backup_path" >&2
+      exit 1
+    fi
+    rm -rf "$target_path"
+    mkdir -p "$(dirname "$target_path")"
+    cp -a "$backup_path" "$target_path"
+  else
+    rm -rf "$target_path"
+  fi
+}
+
+restore_path "app/dev-tools/AgenticService" "${AGENTIC_SERVICE_EXISTED:-0}"
+if [ "${PACKAGE_JSON_EXISTED+x}" = "x" ]; then
+  restore_path "package.json" "$PACKAGE_JSON_EXISTED"
+fi
+restore_path "app/core/NavigationService/NavigationService.ts" "${NAVIGATION_SERVICE_EXISTED:-0}"
+restore_path "app/components/Nav/App/App.tsx" "${APP_TSX_EXISTED:-0}"
+
+remove_recorded_git_exclude_entries "$BACKUP_DIR/added-git-exclude"
+
+# Leave any product-local cache dirs alone: they are owned by the product
+# checkout, not the harness.
+rm -rf "$HARNESS_DIR"
+rm -rf "$BACKUP_DIR"
+echo "Cleaned mobile recipe harness from $TARGET"

package/orchestration/mobile/deps-markers.ts

@@ -0,0 +1,21 @@
+/** MetaMask Mobile product markers for deps-readiness partial checks. */
+export const MOBILE_PRODUCT_MARKERS = [
+  'node_modules/.yarn-state.yml',
+  'app/core/InpageBridgeWeb3.js',
+  'docs/assets/termsOfUse.html',
+  'app/util/termsOfUse/termsOfUseContent.ts',
+  'node_modules/.bin/anvil',
+];
+
+export const MOBILE_IOS_NATIVE_MARKERS = ['ios/Podfile.lock'];
+export const MOBILE_ANDROID_NATIVE_MARKERS = ['android/gradle.properties'];
+
+export function mobileProductMarkers(platform?: string): string[] {
+  const markers = [...MOBILE_PRODUCT_MARKERS];
+  const resolved = (platform ?? process.env.PLATFORM ?? process.env.RECIPE_HARNESS_PLATFORM ?? '')
+    .trim()
+    .toLowerCase();
+  if (resolved === 'ios') markers.push(...MOBILE_IOS_NATIVE_MARKERS);
+  else if (resolved === 'android') markers.push(...MOBILE_ANDROID_NATIVE_MARKERS);
+  return markers;
+}