@deeeed/metamask-harness 0.25.0 → 0.25.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.25.1 - 2026-07-30
+
+### Fixed
+
+- Source-checkout dependency readiness works under restrictive caller umasks and uses an isolated npm cache instead of inheriting a broken global cache.
+
 ## 0.25.0 - 2026-07-30
 
 ### Added

package/adapters/shared/ensure-runner-deps.sh

@@ -10,9 +10,9 @@
 # Env:   FARMSLOT_ROOT / METAMASK_RUNNER_PROTOCOL_ROOT — optional local link target
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 RUNNER_DIR="${1:-}"
 if [ -z "$RUNNER_DIR" ]; then
-  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
   RUNNER_DIR="$(cd "$SCRIPT_DIR/../.." && pwd -P)"
 fi
 RUNNER_DIR="$(cd "$RUNNER_DIR" && pwd -P)"
@@ -23,59 +23,8 @@ if [ -z "$PROTOCOL_ROOT" ] && [ -f "$RUNNER_DIR/.farmslot-root" ]; then
 fi
 
 deps_ready() {
-  node --input-type=module - "$RUNNER_DIR" "$PROTOCOL_ROOT" <<'NODE'
-import fs from 'node:fs';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-
-const runnerDir = process.argv[2];
-const overrideRootInput = process.argv[3];
-const pkg = JSON.parse(fs.readFileSync(path.join(runnerDir, 'package.json'), 'utf8'));
-let dependencyVersionSatisfies;
-try {
-  const requireFromRunner = createRequire(path.join(runnerDir, 'package.json'));
-  const helperPath = requireFromRunner.resolve(
-    '@farmslot/recipe-harness/runtime/deps-readiness',
-  );
-  ({ dependencyVersionSatisfies } = await import(pathToFileURL(helperPath).href));
-  if (typeof dependencyVersionSatisfies !== 'function') process.exit(1);
-} catch {
-  process.exit(1);
-}
-let overrideRoot = null;
-if (overrideRootInput) {
-  try {
-    overrideRoot = fs.realpathSync(overrideRootInput);
-  } catch {
-    overrideRoot = null;
-  }
-}
-function isOverrideLink(packageDir) {
-  if (!overrideRoot) return false;
-  try {
-    if (!fs.lstatSync(packageDir).isSymbolicLink()) return false;
-    const resolved = fs.realpathSync(packageDir);
-    const relative = path.relative(overrideRoot, resolved);
-    return relative === '' || (
-      relative !== '..' &&
-      !relative.startsWith(`..${path.sep}`) &&
-      !path.isAbsolute(relative)
-    );
-  } catch {
-    return false;
-  }
-}
-const invalid = Object.entries(pkg.dependencies ?? {}).filter(([name, request]) => {
-  const packageDir = path.join(runnerDir, 'node_modules', ...name.split('/'));
-  const installedPath = path.join(packageDir, 'package.json');
-  if (!fs.existsSync(installedPath)) return true;
-  if (isOverrideLink(packageDir)) return false;
-  const installed = JSON.parse(fs.readFileSync(installedPath, 'utf8'));
-  return !dependencyVersionSatisfies(installed.version, request);
-});
-process.exit(invalid.length === 0 ? 0 : 1);
-NODE
+  node "$SCRIPT_DIR/runner-deps-ready.mjs" \
+    "$RUNNER_DIR" "$PROTOCOL_ROOT"
 }
 
 # Library actions import @deeeed/metamask-harness by package name; a source checkout
@@ -127,7 +76,9 @@ fi
 echo "mm-harness: installing runner dependencies via npm in $RUNNER_DIR" >&2
 (
   cd "$RUNNER_DIR"
-  npm install --ignore-scripts >&2
+  umask 022
+  npm_config_cache="${MM_HARNESS_NPM_CACHE:-${TMPDIR:-/tmp}/mm-harness-npm-cache-${UID:-$(id -u)}}" \
+    npm install --ignore-scripts >&2
 )
 
 # npm may replace the local protocol links with registry packages. Restore the

package/adapters/shared/runner-deps-ready.mjs

@@ -0,0 +1,64 @@
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const [runnerDir, overrideRootInput] = process.argv.slice(2);
+const pkg = JSON.parse(
+  fs.readFileSync(path.join(runnerDir, 'package.json'), 'utf8'),
+);
+
+let dependencyVersionSatisfies;
+try {
+  const requireFromRunner = createRequire(path.join(runnerDir, 'package.json'));
+  const helperPath = requireFromRunner.resolve(
+    '@farmslot/recipe-harness/runtime/deps-readiness',
+  );
+  ({ dependencyVersionSatisfies } = await import(pathToFileURL(helperPath).href));
+  if (typeof dependencyVersionSatisfies !== 'function') process.exit(1);
+} catch {
+  process.exit(1);
+}
+
+let overrideRoot = null;
+if (overrideRootInput) {
+  try {
+    overrideRoot = fs.realpathSync(overrideRootInput);
+  } catch {
+    overrideRoot = null;
+  }
+}
+
+function isOverrideLink(packageDir) {
+  if (!overrideRoot) return false;
+  try {
+    if (!fs.lstatSync(packageDir).isSymbolicLink()) return false;
+    const resolved = fs.realpathSync(packageDir);
+    const relative = path.relative(overrideRoot, resolved);
+    return (
+      relative === '' ||
+      (relative !== '..' &&
+        !relative.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(relative))
+    );
+  } catch {
+    return false;
+  }
+}
+
+const invalid = Object.entries(pkg.dependencies ?? {}).filter(
+  ([name, request]) => {
+    const packageDir = path.join(
+      runnerDir,
+      'node_modules',
+      ...name.split('/'),
+    );
+    const installedPath = path.join(packageDir, 'package.json');
+    if (!fs.existsSync(installedPath)) return true;
+    if (isOverrideLink(packageDir)) return false;
+    const installed = JSON.parse(fs.readFileSync(installedPath, 'utf8'));
+    return !dependencyVersionSatisfies(installed.version, request);
+  },
+);
+
+process.exit(invalid.length === 0 ? 0 : 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"