@deeeed/metamask-harness 0.25.0 → 0.26.0

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 0.26.0 - 2026-07-31
+
+### Added
+
+- Allow analytics event property assertions to use `$exists`, `$type`, and `$gt` predicates for dynamic runtime values.
+
+### Fixed
+
+- Avoid direct `globalThis.chrome` access when reading Extension Perps runtime state, so state preparation works with LavaMoat scuttling enabled.
+- Add a harness-owned non-test LavaMoat build mode for production-like Extension proof, while continuing to configure runtime snapshots with the validated Infura project ID. This avoids the placeholder credentials embedded by Extension `--test` builds.
+- Keep macOS awake for the lifetime of a harness-launched Extension browser so long live recipes are not invalidated by display-lock compositor suspension.
+- Retry post-interaction CDP settlement in an isolated world when navigation replaces the page context.
+
+## 0.25.1 - 2026-07-30
+
+### Fixed
+
+- Source-checkout dependency readiness works under restrictive caller umasks and uses an isolated npm cache instead of inheriting a broken global cache.
+
 ## 0.25.0 - 2026-07-30
 
 ### Added

package/adapters/extension/build-lavamoat.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# build-lavamoat.sh — one-shot production-like Extension build for live proof
+set -euo pipefail
+
+TARGET="$PWD"
+RUNTIME_DIR="temp/recipe/runtime"
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --target) [ "$#" -ge 2 ] || { echo "Missing value for $1" >&2; exit 2; }; TARGET="$2"; shift 2 ;;
+    --runtime-dir) [ "$#" -ge 2 ] || { echo "Missing value for $1" >&2; exit 2; }; RUNTIME_DIR="$2"; shift 2 ;;
+    -h|--help) echo "Usage: build-lavamoat.sh [--target <metamask-extension>] [--runtime-dir <relative path>]"; exit 0 ;;
+    *) echo "Unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+for _arn in "$SCRIPT_DIR/lib/activate-repo-node.sh" "$SCRIPT_DIR/../shared/activate-repo-node.sh"; do
+  [ -f "$_arn" ] && { # shellcheck disable=SC1090
+    . "$_arn"
+    break
+  }
+done
+unset _arn
+
+TARGET="$(cd "$TARGET" && pwd)"
+cd "$TARGET"
+if command -v require_repo_node >/dev/null 2>&1; then
+  require_repo_node "$TARGET"
+elif command -v activate_repo_node >/dev/null 2>&1; then
+  activate_repo_node "$TARGET"
+else
+  echo "build-lavamoat: activate-repo-node.sh missing from harness; run: mm-harness install" >&2
+  exit 1
+fi
+
+for pid_file in "$RUNTIME_DIR/webpack.pid" "$RUNTIME_DIR/recipe-harness-webpack.pid"; do
+  [ -f "$pid_file" ] || continue
+  pid="$(cat "$pid_file" 2>/dev/null || true)"
+  if [ -n "$pid" ] && kill -0 "$pid" >/dev/null 2>&1; then
+    echo "build-lavamoat: a webpack watcher already owns this checkout (pid $pid). Next: stop the slot watcher and retry." >&2
+    exit 1
+  fi
+  rm -f "$pid_file"
+done
+
+# A one-shot build has no watch health to report. Remove logs left by a dead
+# watcher so readiness does not mistake an old failure for the current build.
+rm -f "$RUNTIME_DIR/webpack.log" "$RUNTIME_DIR/recipe-harness-webpack.log"
+
+echo "[recipe-harness] clean non-test LavaMoat build"
+rm -rf node_modules/.cache/webpack
+yarn webpack:lavamoat:build
+test -f dist/chrome/manifest.json || {
+  echo "build-lavamoat: build completed without dist/chrome/manifest.json" >&2
+  exit 1
+}
+echo "[recipe-harness] non-test LavaMoat build completed"

package/adapters/extension/configure-runtime-manifest.cjs

@@ -0,0 +1,58 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const {
+  resolveExtensionInfuraProjectId,
+} = require('./lib/product-config.cjs');
+
+const usage =
+  'Usage: configure-runtime-manifest.cjs --target <checkout> --manifest <runtime manifest>';
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  process.stdout.write(`${usage}\n`);
+  process.exit(0);
+}
+
+function parseArgs(argv) {
+  const args = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const flag = argv[index];
+    if (!flag.startsWith('--') || index + 1 >= argv.length) {
+      throw new Error(usage);
+    }
+    args[flag.slice(2)] = argv[index + 1];
+    index += 1;
+  }
+  return args;
+}
+
+const args = parseArgs(process.argv.slice(2));
+if (!args.target || !args.manifest) {
+  throw new Error(usage);
+}
+
+const target = path.resolve(args.target);
+const manifestPath = path.resolve(args.manifest);
+const resolution = resolveExtensionInfuraProjectId(target, process.env);
+if (resolution.kind === 'not-required') {
+  process.stdout.write(
+    'Runtime manifest credentials are not required by this checkout.\n',
+  );
+  process.exit(0);
+}
+if (resolution.kind !== 'configured') {
+  throw new Error(
+    `Extension runtime has no usable INFURA_PROJECT_ID for ${target}. Next: run mm-harness doctor --adapter extension --target ${JSON.stringify(target)} --fix.`,
+  );
+}
+
+const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+manifest._flags ??= {};
+manifest._flags.testing ??= {};
+manifest._flags.testing.infuraProjectId = resolution.value;
+fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, {
+  mode: 0o600,
+});
+fs.chmodSync(manifestPath, 0o600);
+process.stdout.write('Configured runtime Infura credentials through manifest flags.\n');

package/adapters/extension/inject.mjs

@@ -99,8 +99,10 @@ copyFile(path.join(runnerDir, 'adapters/extension/console-tail.mjs'), path.join(
 copyFile(path.join(runnerDir, 'adapters/extension/launch.sh'), path.join(harnessDir, 'scripts/launch.sh'));
 copyFile(path.join(runnerDir, 'adapters/extension/live.sh'), path.join(harnessDir, 'scripts/live.sh'));
 copyFile(path.join(runnerDir, 'adapters/extension/start-watch.sh'), path.join(harnessDir, 'scripts/start-watch.sh'));
+copyFile(path.join(runnerDir, 'adapters/extension/build-lavamoat.sh'), path.join(harnessDir, 'scripts/build-lavamoat.sh'));
 copyFile(path.join(runnerDir, 'adapters/extension/launch-webpack.cjs'), path.join(harnessDir, 'scripts/launch-webpack.cjs'));
 copyFile(path.join(runnerDir, 'adapters/extension/sync-webpack-dist.cjs'), path.join(harnessDir, 'scripts/sync-webpack-dist.cjs'));
+copyFile(path.join(runnerDir, 'adapters/extension/configure-runtime-manifest.cjs'), path.join(harnessDir, 'scripts/configure-runtime-manifest.cjs'));
 copyFile(path.join(runnerDir, 'adapters/extension/stamp-runtime-title.cjs'), path.join(harnessDir, 'scripts/stamp-runtime-title.cjs'));
 copyFile(path.join(runnerDir, 'adapters/extension/stop-viewers.sh'), path.join(harnessDir, 'scripts/stop-viewers.sh'));
 copyFile(path.join(runnerDir, 'adapters/extension/snapshot-dist.sh'), path.join(harnessDir, 'scripts/snapshot-dist.sh'));
@@ -127,6 +129,7 @@ copyFile(path.join(runnerDir, 'adapters/extension/lib/extension-id.cjs'), path.j
 copyFile(path.join(runnerDir, 'adapters/extension/lib/slot-title.cjs'), path.join(harnessDir, 'scripts/lib/slot-title.cjs'));
 copyFile(path.join(runnerDir, 'adapters/extension/lib/chrome-args.cjs'), path.join(harnessDir, 'scripts/lib/chrome-args.cjs'));
 copyFile(path.join(runnerDir, 'adapters/extension/lib/macos-focus.cjs'), path.join(harnessDir, 'scripts/lib/macos-focus.cjs'));
+copyFile(path.join(runnerDir, 'adapters/extension/lib/product-config.cjs'), path.join(harnessDir, 'scripts/lib/product-config.cjs'));
 makeExecutableTree(path.join(harnessDir, 'scripts'));
 fs.writeFileSync(path.join(harnessDir, 'installed-scripts.sha256'), `${dirContentHash(path.join(harnessDir, 'scripts'))}\n`);
 

package/adapters/extension/launch-browser.cjs

@@ -144,6 +144,13 @@ try {
   fs.closeSync(logFd);
 }
 fs.writeFileSync(args['chrome-pid'], `${browserPid}\n`);
+if (process.platform === 'darwin') {
+  const wake = spawn('caffeinate', ['-dimsu', '-w', String(browserPid)], {
+    detached: true,
+    stdio: 'ignore',
+  });
+  wake.unref();
+}
 if (process.env.MM_HARNESS_FOCUS_BROWSER !== '1') {
   restoreMacFrontmostProcess(previousFrontmostPid);
 }

package/adapters/extension/lib/product-config.cjs

@@ -0,0 +1,116 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+function isConfiguredInfuraId(value, placeholder) {
+  return (
+    value.length > 0 &&
+    value !== placeholder &&
+    value !== 'true' &&
+    value !== 'false' &&
+    value !== 'null'
+  );
+}
+
+function readConfigSnapshot(file) {
+  let descriptor;
+  try {
+    descriptor = fs.openSync(
+      file,
+      fs.constants.O_RDONLY |
+        fs.constants.O_NOFOLLOW |
+        fs.constants.O_NONBLOCK,
+    );
+  } catch (error) {
+    if (error.code === 'ENOENT') return { kind: 'missing' };
+    if (error.code === 'ELOOP') {
+      return { kind: 'invalid', reason: 'symlink' };
+    }
+    return { kind: 'invalid', reason: 'unreadable' };
+  }
+  try {
+    if (!fs.fstatSync(descriptor).isFile()) {
+      return { kind: 'invalid', reason: 'not-regular' };
+    }
+    return { kind: 'file', text: fs.readFileSync(descriptor, 'utf8') };
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function readInfuraProjectId(text) {
+  const lines = text.replace(/\r\n?/gu, '\n');
+  const pattern =
+    /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/gmu;
+  let result;
+  for (const match of lines.matchAll(pattern)) {
+    if (match[1] !== 'INFURA_PROJECT_ID') continue;
+    let value = (match[2] ?? '').trim();
+    const quote = value[0];
+    value = value.replace(/^(['"`])([\s\S]*)\1$/u, '$2');
+    if (quote === '"') {
+      value = value.replace(/\\n/gu, '\n').replace(/\\r/gu, '\r');
+    }
+    result = value;
+  }
+  return result;
+}
+
+function resolveExtensionInfuraProjectId(target, environment = process.env) {
+  const template = readConfigSnapshot(path.join(target, '.metamaskrc.dist'));
+  if (template.kind === 'missing') return { kind: 'not-required' };
+  if (template.kind === 'invalid') {
+    return {
+      kind: 'invalid-file',
+      name: '.metamaskrc.dist',
+      reason: template.reason,
+    };
+  }
+  const placeholder = readInfuraProjectId(template.text) ?? '';
+
+  if (environment.INFURA_PROJECT_ID !== undefined) {
+    const value = environment.INFURA_PROJECT_ID;
+    return isConfiguredInfuraId(value, placeholder)
+      ? { kind: 'configured', source: 'environment', value }
+      : { kind: 'invalid-value', source: 'environment' };
+  }
+
+  const production = readConfigSnapshot(path.join(target, '.metamaskprodrc'));
+  if (production.kind === 'invalid') {
+    return {
+      kind: 'invalid-file',
+      name: '.metamaskprodrc',
+      reason: production.reason,
+    };
+  }
+  if (production.kind === 'file') {
+    const value = readInfuraProjectId(production.text);
+    if (value !== undefined) {
+      return isConfiguredInfuraId(value, placeholder)
+        ? { kind: 'configured', source: '.metamaskprodrc', value }
+        : { kind: 'invalid-value', source: '.metamaskprodrc' };
+    }
+  }
+
+  const config = readConfigSnapshot(path.join(target, '.metamaskrc'));
+  if (config.kind === 'missing') {
+    return { kind: 'missing', name: '.metamaskrc' };
+  }
+  if (config.kind === 'invalid') {
+    return {
+      kind: 'invalid-file',
+      name: '.metamaskrc',
+      reason: config.reason,
+    };
+  }
+  const value = readInfuraProjectId(config.text) ?? '';
+  return isConfiguredInfuraId(value, placeholder)
+    ? { kind: 'configured', source: '.metamaskrc', value }
+    : { kind: 'invalid-value', source: '.metamaskrc' };
+}
+
+module.exports = {
+  readInfuraProjectId,
+  resolveExtensionInfuraProjectId,
+};

package/adapters/extension/lib/product-config.d.cts

@@ -0,0 +1,16 @@
+type ConfigName = '.metamaskrc.dist' | '.metamaskprodrc' | '.metamaskrc';
+type ConfigInvalidReason = 'symlink' | 'not-regular' | 'unreadable';
+type ConfigSource = 'environment' | '.metamaskprodrc' | '.metamaskrc';
+
+type ExtensionInfuraProjectIdResolution =
+  | { kind: 'configured'; source: ConfigSource; value: string }
+  | { kind: 'not-required' }
+  | { kind: 'invalid-file'; name: ConfigName; reason: ConfigInvalidReason }
+  | { kind: 'missing'; name: '.metamaskrc' }
+  | { kind: 'invalid-value'; source: ConfigSource };
+
+export function readInfuraProjectId(text: string): string | undefined;
+export function resolveExtensionInfuraProjectId(
+  target: string,
+  environment?: NodeJS.ProcessEnv,
+): ExtensionInfuraProjectIdResolution;

package/adapters/extension/live.sh

@@ -11,7 +11,7 @@
 # Inputs (flags / env):
 #   --target <metamask-extension> (default $PWD)
 #   --cdp-port <port> (optional; inferred from checkout context/pool when omitted)
-#   --launch-existing-dist | --start-watch | --prepare-cmd <cmd>
+#   --launch-existing-dist | --start-watch | --build-lavamoat | --prepare-cmd <cmd>
 #       (env RECIPE_HARNESS_EXTENSION_LAUNCH_CMD)
 #   --dist-dir <rel> (default dist/chrome), --chrome-user-data-dir <dir>,
 #   --remote-flag <KEY=VARIANT[,KEY=VARIANT...]> (pins manifest _flags into the
@@ -39,6 +39,7 @@ OUT=""
 PREPARE_CMD="${RECIPE_HARNESS_EXTENSION_LAUNCH_CMD:-}"
 LAUNCH_EXISTING_DIST=false
 START_WATCH=false
+BUILD_LAVAMOAT=false
 DIST_DIR="dist/chrome"
 CHROME_USER_DATA_DIR="${CHROME_USER_DATA_DIR:-}"
 REMOTE_FLAGS=""
@@ -53,14 +54,20 @@ while [ "$#" -gt 0 ]; do
     --launch-existing-dist) LAUNCH_EXISTING_DIST=true; shift ;;
     --start-url) [ "$#" -ge 2 ] || { echo "Missing value for $1" >&2; exit 2; }; START_URL="$2"; shift 2 ;;
     --start-watch|--start-test-watch) START_WATCH=true; LAUNCH_EXISTING_DIST=true; shift ;;
+    --build-lavamoat) BUILD_LAVAMOAT=true; LAUNCH_EXISTING_DIST=true; shift ;;
     --dist-dir) [ "$#" -ge 2 ] || { echo "Missing value for $1" >&2; exit 2; }; DIST_DIR="$2"; shift 2 ;;
     --chrome-user-data-dir) [ "$#" -ge 2 ] || { echo "Missing value for $1" >&2; exit 2; }; CHROME_USER_DATA_DIR="$2"; shift 2 ;;
     --remote-flag) [ "$#" -ge 2 ] || { echo "Missing value for $1" >&2; exit 2; }; REMOTE_FLAGS="$2"; shift 2 ;;
-    -h|--help) echo "Usage: live.sh [--target <metamask-extension>] [--out <recipes-dir>] [--cdp-port <port>] [--launch-existing-dist|--start-watch|--prepare-cmd <cmd>] [--dist-dir dist/chrome] [--remote-flag KEY=VARIANT] [--artifacts-dir <dir>]"; exit 0 ;;
+    -h|--help) echo "Usage: live.sh [--target <metamask-extension>] [--out <recipes-dir>] [--cdp-port <port>] [--launch-existing-dist|--start-watch|--build-lavamoat|--prepare-cmd <cmd>] [--dist-dir dist/chrome] [--remote-flag KEY=VARIANT] [--artifacts-dir <dir>]"; exit 0 ;;
     *) echo "Unknown arg: $1" >&2; exit 2 ;;
   esac
 done
 
+if $BUILD_LAVAMOAT && $START_WATCH; then
+  echo "--build-lavamoat cannot be combined with --start-watch" >&2
+  exit 2
+fi
+
 case "$CHROME_USER_DATA_DIR" in
   ""|/*) ;;
   *) CHROME_USER_DATA_DIR="$INVOCATION_DIR/$CHROME_USER_DATA_DIR" ;;
@@ -167,7 +174,9 @@ NODE
   quoted_profile="$(printf '%q' "$PROFILE_ABS")"
   quoted_seed_fixture="$(printf '%q' "$SCRIPT_DIR/seed-fixture.sh")"
   quoted_start_watch="$(printf '%q' "$SCRIPT_DIR/start-watch.sh")"
+  quoted_build_lavamoat="$(printf '%q' "$SCRIPT_DIR/build-lavamoat.sh")"
   quoted_snapshot_dist="$(printf '%q' "$SCRIPT_DIR/snapshot-dist.sh")"
+  quoted_configure_manifest="$(printf '%q' "$SCRIPT_DIR/configure-runtime-manifest.cjs")"
   quoted_stamp_title="$(printf '%q' "$SCRIPT_DIR/stamp-runtime-title.cjs")"
   quoted_chrome_launcher="$(printf '%q' "$SCRIPT_DIR/launch-browser.cjs")"
   quoted_fixture_state="$(printf '%q' "$FIXTURE_STATE_ABS")"
@@ -245,8 +254,12 @@ NODE
   if $START_WATCH; then
     prepare_parts+=("bash ${quoted_start_watch} --runtime-dir ${quoted_runtime_dir} --runner-bin ${quoted_runner}")
   fi
+  if $BUILD_LAVAMOAT; then
+    prepare_parts+=("bash ${quoted_build_lavamoat} --target ${quoted_target} --runtime-dir ${quoted_runtime_dir}")
+  fi
   prepare_parts+=("node ${quoted_chrome_launcher} --stop-only 1 --reset-profile 1 --chrome-bin ${quoted_chrome} --profile ${quoted_profile} --cdp-port ${CDP_PORT} --extension-dir ${quoted_runtime_dist} --chrome-log ${quoted_chrome_log} --chrome-pid ${quoted_chrome_pid}")
   prepare_parts+=("bash ${quoted_snapshot_dist} --dist ${quoted_dist} --runtime-dist ${quoted_runtime_dist}")
+  prepare_parts+=("node ${quoted_configure_manifest} --target ${quoted_target} --manifest ${quoted_runtime_dist}/manifest.json")
   prepare_parts+=("node ${quoted_stamp_title} --target ${quoted_target} --runtime-dist ${quoted_runtime_dist} --runtime-dir ${quoted_runtime_dir}")
   # Optional A/B feature-flag pinning: patch the ephemeral snapshot manifest so
   # manifest._flags wins over the fetched ClientConfigApi value. No-op unless
@@ -275,12 +288,13 @@ NODE
 fi
 
 if [ -n "$REMOTE_FLAGS" ] && [ "$REMOTE_FLAGS_APPLIED" != "true" ]; then
-  echo "[recipe-harness] WARN: --remote-flag '$REMOTE_FLAGS' had no effect: flag pinning only applies to the snapshot launch path (--launch-existing-dist/--start-watch without a custom --prepare-cmd)." >&2
+  echo "[recipe-harness] WARN: --remote-flag '$REMOTE_FLAGS' had no effect: flag pinning only applies to the snapshot launch path (--launch-existing-dist/--start-watch/--build-lavamoat without a custom --prepare-cmd)." >&2
 fi
 
 echo "Extension live validation command:"
 display_args=(mm-harness runtime-launch --adapter extension --target "$TARGET" --cdp-port "$CDP_PORT")
 $START_WATCH && display_args+=(--start-watch)
+$BUILD_LAVAMOAT && display_args+=(--build-lavamoat)
 [ -n "$REMOTE_FLAGS" ] && display_args+=(--remote-flag "$REMOTE_FLAGS")
 [ -n "$CHROME_USER_DATA_DIR" ] && display_args+=(--chrome-user-data-dir "$CHROME_USER_DATA_DIR")
 printf '  '
@@ -309,7 +323,7 @@ else
   echo "Skipping Extension live verify because launch failed; see $ARTIFACTS/launch/summary.json" >&2
 fi
 
-TARGET_FOR_SUMMARY="$TARGET" ARTIFACTS_FOR_SUMMARY="$ARTIFACTS" CDP_PORT_FOR_SUMMARY="$CDP_PORT" LAUNCH_STATUS="$launch_status" VERIFY_STATUS="$verify_status" LAUNCH_EXISTING_DIST="$LAUNCH_EXISTING_DIST" START_WATCH="$START_WATCH" node <<'NODE'
+TARGET_FOR_SUMMARY="$TARGET" ARTIFACTS_FOR_SUMMARY="$ARTIFACTS" CDP_PORT_FOR_SUMMARY="$CDP_PORT" LAUNCH_STATUS="$launch_status" VERIFY_STATUS="$verify_status" LAUNCH_EXISTING_DIST="$LAUNCH_EXISTING_DIST" START_WATCH="$START_WATCH" BUILD_LAVAMOAT="$BUILD_LAVAMOAT" node <<'NODE'
 const fs = require('fs');
 const path = require('path');
 const artifacts = process.env.ARTIFACTS_FOR_SUMMARY;
@@ -325,6 +339,7 @@ fs.writeFileSync(path.join(artifacts, 'summary.json'), `${JSON.stringify({
   cdpPort: process.env.CDP_PORT_FOR_SUMMARY,
   launchExistingDist: process.env.LAUNCH_EXISTING_DIST === 'true',
   startWatch: process.env.START_WATCH === 'true',
+  buildLavaMoat: process.env.BUILD_LAVAMOAT === 'true',
   launch: { exitCode: launchStatus, summaryPath: fs.existsSync(launchSummary) ? launchSummary : null },
   verify: { exitCode: verifyStatus, summaryPath: fs.existsSync(verifySummary) ? verifySummary : null },
   easyCommand: `mm-harness launch --verify --target <repo>`,

package/adapters/extension/reattach.sh

@@ -103,6 +103,7 @@ echo "[reattach] reusing loaded runtime-dist: $RUNTIME_DIST_ABS" >&2
 if [ -d "$DIST_ABS" ] && [ -d "$RUNTIME_DIST_ABS" ]; then
   echo "[reattach] refreshing loaded runtime-dist in place" >&2
   rsync -a --exclude _metadata "$DIST_ABS/" "$RUNTIME_DIST_ABS/" >&2
+  node "$SCRIPT_DIR/configure-runtime-manifest.cjs" --target "$TARGET" --manifest "$RUNTIME_DIST_ABS/manifest.json" >&2
   node "$SCRIPT_DIR/stamp-runtime-title.cjs" --target "$TARGET" --runtime-dist "$RUNTIME_DIST_ABS" --runtime-dir "$RUNTIME_DIR" >&2
 fi
 

package/adapters/extension/sync-webpack-dist.cjs

@@ -58,6 +58,23 @@ function syncRuntimeDist() {
     process.stderr.write(`runtime-dist sync failed: ${(result.stderr || result.stdout || `rsync exited ${result.status}`).trim()}\n`);
     return;
   }
+  const configure = spawnSync(
+    process.execPath,
+    [
+      path.join(__dirname, 'configure-runtime-manifest.cjs'),
+      '--target',
+      path.resolve(args.target),
+      '--manifest',
+      path.join(runtimeDist, 'manifest.json'),
+    ],
+    { encoding: 'utf8' },
+  );
+  if (configure.status !== 0) {
+    process.stderr.write(
+      `runtime-dist configuration failed: ${(configure.stderr || configure.stdout || `node exited ${configure.status}`).trim()}\n`,
+    );
+    return;
+  }
   stampRuntimeTitles({ target: path.resolve(args.target), runtimeDist });
   process.stdout.write(`runtime-dist updated after webpack compile (${new Date().toISOString()})\n`);
 }

package/adapters/manifest.json

@@ -119,7 +119,7 @@
       "entry": "adapters/extension/live.sh",
       "kind": "bash",
       "purpose": "Sequencer: builds the prepare command from the named feature scripts, then launch + verify.",
-      "inputs": "--target --cdp-port --launch-existing-dist|--start-watch|--prepare-cmd --dist-dir --chrome-user-data-dir --out --artifacts-dir; env RECIPE_HARNESS_CHROME_BIN, RECIPE_WALLET_FIXTURE, RECIPE_HARNESS_LIVE_KEEP",
+      "inputs": "--target --cdp-port --launch-existing-dist|--start-watch|--build-lavamoat|--prepare-cmd --dist-dir --chrome-user-data-dir --out --artifacts-dir; env RECIPE_HARNESS_CHROME_BIN, RECIPE_WALLET_FIXTURE, RECIPE_HARNESS_LIVE_KEEP",
       "outputs": "<artifacts>/summary.json + launch/ + verify/ + logs/fixture-source.json; exit 0/1/2"
     },
     {
@@ -138,6 +138,14 @@
       "inputs": "--target --runtime-dir --runner-bin --summary",
       "outputs": "<runtime-dir>/recipe-harness-webpack.{pid,log}; optional summary; exit 0/1/2"
     },
+    {
+      "id": "extension/build-lavamoat",
+      "entry": "adapters/extension/build-lavamoat.sh",
+      "kind": "bash",
+      "purpose": "Build a production-like Extension runtime with LavaMoat without enabling test-build fixture semantics.",
+      "inputs": "--target --runtime-dir",
+      "outputs": "dist/chrome; exit 0/1/2"
+    },
     {
       "id": "extension/launch-webpack",
       "entry": "adapters/extension/launch-webpack.cjs",
@@ -154,6 +162,14 @@
       "inputs": "--watcher-pid --watch-log --target --dist --runtime-dist --pid-file",
       "outputs": "runtime-dist updated in place after successful compile markers; exits with its watcher"
     },
+    {
+      "id": "extension/configure-runtime-manifest",
+      "entry": "adapters/extension/configure-runtime-manifest.cjs",
+      "kind": "node",
+      "purpose": "Inject the checkout's configured Infura project id into an isolated runtime manifest so Extension test builds cannot trigger browser-native authentication prompts.",
+      "inputs": "--target --manifest",
+      "outputs": "runtime manifest _flags.testing.infuraProjectId; exit 0/1"
+    },
     {
       "id": "extension/stamp-runtime-title",
       "entry": "adapters/extension/stamp-runtime-title.cjs",
@@ -402,6 +418,14 @@
       "inputs": "ensure-runner-deps.sh [RUNNER_DIR]; env FARMSLOT_ROOT / METAMASK_RUNNER_PROTOCOL_ROOT optional local link target",
       "outputs": "installed node_modules in RUNNER_DIR; exit 0 when deps ready"
     },
+    {
+      "id": "lib/runner-deps-ready",
+      "entry": "adapters/shared/runner-deps-ready.mjs",
+      "kind": "node",
+      "purpose": "Validate installed runner dependency versions, accepting only explicit local protocol-root links as development overrides.",
+      "inputs": "<runner-dir> [local-protocol-root]",
+      "outputs": "exit 0 when dependencies satisfy package.json; exit 1 otherwise"
+    },
     {
       "id": "lib/install-repo-deps",
       "entry": "adapters/shared/install-repo-deps.sh",

package/adapters/shared/ensure-runner-deps.sh

@@ -10,9 +10,9 @@
 # Env:   FARMSLOT_ROOT / METAMASK_RUNNER_PROTOCOL_ROOT — optional local link target
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 RUNNER_DIR="${1:-}"
 if [ -z "$RUNNER_DIR" ]; then
-  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
   RUNNER_DIR="$(cd "$SCRIPT_DIR/../.." && pwd -P)"
 fi
 RUNNER_DIR="$(cd "$RUNNER_DIR" && pwd -P)"
@@ -23,59 +23,8 @@ if [ -z "$PROTOCOL_ROOT" ] && [ -f "$RUNNER_DIR/.farmslot-root" ]; then
 fi
 
 deps_ready() {
-  node --input-type=module - "$RUNNER_DIR" "$PROTOCOL_ROOT" <<'NODE'
-import fs from 'node:fs';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-
-const runnerDir = process.argv[2];
-const overrideRootInput = process.argv[3];
-const pkg = JSON.parse(fs.readFileSync(path.join(runnerDir, 'package.json'), 'utf8'));
-let dependencyVersionSatisfies;
-try {
-  const requireFromRunner = createRequire(path.join(runnerDir, 'package.json'));
-  const helperPath = requireFromRunner.resolve(
-    '@farmslot/recipe-harness/runtime/deps-readiness',
-  );
-  ({ dependencyVersionSatisfies } = await import(pathToFileURL(helperPath).href));
-  if (typeof dependencyVersionSatisfies !== 'function') process.exit(1);
-} catch {
-  process.exit(1);
-}
-let overrideRoot = null;
-if (overrideRootInput) {
-  try {
-    overrideRoot = fs.realpathSync(overrideRootInput);
-  } catch {
-    overrideRoot = null;
-  }
-}
-function isOverrideLink(packageDir) {
-  if (!overrideRoot) return false;
-  try {
-    if (!fs.lstatSync(packageDir).isSymbolicLink()) return false;
-    const resolved = fs.realpathSync(packageDir);
-    const relative = path.relative(overrideRoot, resolved);
-    return relative === '' || (
-      relative !== '..' &&
-      !relative.startsWith(`..${path.sep}`) &&
-      !path.isAbsolute(relative)
-    );
-  } catch {
-    return false;
-  }
-}
-const invalid = Object.entries(pkg.dependencies ?? {}).filter(([name, request]) => {
-  const packageDir = path.join(runnerDir, 'node_modules', ...name.split('/'));
-  const installedPath = path.join(packageDir, 'package.json');
-  if (!fs.existsSync(installedPath)) return true;
-  if (isOverrideLink(packageDir)) return false;
-  const installed = JSON.parse(fs.readFileSync(installedPath, 'utf8'));
-  return !dependencyVersionSatisfies(installed.version, request);
-});
-process.exit(invalid.length === 0 ? 0 : 1);
-NODE
+  node "$SCRIPT_DIR/runner-deps-ready.mjs" \
+    "$RUNNER_DIR" "$PROTOCOL_ROOT"
 }
 
 # Library actions import @deeeed/metamask-harness by package name; a source checkout
@@ -127,7 +76,9 @@ fi
 echo "mm-harness: installing runner dependencies via npm in $RUNNER_DIR" >&2
 (
   cd "$RUNNER_DIR"
-  npm install --ignore-scripts >&2
+  umask 022
+  npm_config_cache="${MM_HARNESS_NPM_CACHE:-${TMPDIR:-/tmp}/mm-harness-npm-cache-${UID:-$(id -u)}}" \
+    npm install --ignore-scripts >&2
 )
 
 # npm may replace the local protocol links with registry packages. Restore the

package/adapters/shared/runner-deps-ready.mjs

@@ -0,0 +1,70 @@
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+if (process.argv.includes('--help') || process.argv.includes('-h')) {
+  console.log('Usage: runner-deps-ready.mjs <runner-dir> [local-protocol-root]');
+  process.exit(0);
+}
+
+const [runnerDir, overrideRootInput] = process.argv.slice(2);
+if (!runnerDir) process.exit(1);
+const pkg = JSON.parse(
+  fs.readFileSync(path.join(runnerDir, 'package.json'), 'utf8'),
+);
+
+let dependencyVersionSatisfies;
+try {
+  const requireFromRunner = createRequire(path.join(runnerDir, 'package.json'));
+  const helperPath = requireFromRunner.resolve(
+    '@farmslot/recipe-harness/runtime/deps-readiness',
+  );
+  ({ dependencyVersionSatisfies } = await import(pathToFileURL(helperPath).href));
+  if (typeof dependencyVersionSatisfies !== 'function') process.exit(1);
+} catch {
+  process.exit(1);
+}
+
+let overrideRoot = null;
+if (overrideRootInput) {
+  try {
+    overrideRoot = fs.realpathSync(overrideRootInput);
+  } catch {
+    overrideRoot = null;
+  }
+}
+
+function isOverrideLink(packageDir) {
+  if (!overrideRoot) return false;
+  try {
+    if (!fs.lstatSync(packageDir).isSymbolicLink()) return false;
+    const resolved = fs.realpathSync(packageDir);
+    const relative = path.relative(overrideRoot, resolved);
+    return (
+      relative === '' ||
+      (relative !== '..' &&
+        !relative.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(relative))
+    );
+  } catch {
+    return false;
+  }
+}
+
+const invalid = Object.entries(pkg.dependencies ?? {}).filter(
+  ([name, request]) => {
+    const packageDir = path.join(
+      runnerDir,
+      'node_modules',
+      ...name.split('/'),
+    );
+    const installedPath = path.join(packageDir, 'package.json');
+    if (!fs.existsSync(installedPath)) return true;
+    if (isOverrideLink(packageDir)) return false;
+    const installed = JSON.parse(fs.readFileSync(installedPath, 'utf8'));
+    return !dependencyVersionSatisfies(installed.version, request);
+  },
+);
+
+process.exit(invalid.length === 0 ? 0 : 1);

package/dist/adapters/extension/product-config.js

@@ -1,77 +1,40 @@
-import fs from "node:fs";
 import path from "node:path";
+import productConfig from "../../../adapters/extension/lib/product-config.cjs";
 import { shellQuote } from "../../commands/parse-args.js";
-function isConfiguredInfuraId(value, placeholder) {
-  return value.length > 0 && value !== placeholder && value !== "true" && value !== "false" && value !== "null";
-}
 function extensionProductConfigBlock(target) {
-  const template = path.join(target, ".metamaskrc.dist");
-  const templateSnapshot = readConfigSnapshot(template);
-  if (templateSnapshot.kind === "missing") return null;
-  if (templateSnapshot.kind === "invalid") {
-    return invalidConfigBlock(target, ".metamaskrc.dist", templateSnapshot.reason);
+  const resolution = productConfig.resolveExtensionInfuraProjectId(
+    target,
+    process.env
+  );
+  if (resolution.kind === "configured" || resolution.kind === "not-required") {
+    return null;
+  }
+  if (resolution.kind === "invalid-file") {
+    return invalidConfigBlock(target, resolution.name, resolution.reason);
   }
-  const placeholder = readInfuraProjectId(templateSnapshot.text) ?? "";
-  const configuredFromEnvironment = process.env.INFURA_PROJECT_ID;
-  if (configuredFromEnvironment !== void 0) {
-    if (isConfiguredInfuraId(configuredFromEnvironment, placeholder)) return null;
+  if (resolution.kind === "missing") {
+    return {
+      message: "Extension product configuration is required before launch: create .metamaskrc and set a non-placeholder INFURA_PROJECT_ID (the value is never displayed).",
+      userAction: `cd ${shellQuote(path.resolve(target))} && cp .metamaskrc.dist .metamaskrc && \${EDITOR:-vi} .metamaskrc`
+    };
+  }
+  if (resolution.source === "environment") {
     return {
       message: "Extension product configuration is blocked by an unusable exported INFURA_PROJECT_ID (the value is never displayed).",
       userAction: `unset INFURA_PROJECT_ID; cd ${shellQuote(path.resolve(target))} && cp -n .metamaskrc.dist .metamaskrc && \${EDITOR:-vi} .metamaskrc`
     };
   }
-  const productionConfig = readConfigSnapshot(path.join(target, ".metamaskprodrc"));
-  if (productionConfig.kind === "invalid") {
-    return invalidConfigBlock(target, ".metamaskprodrc", productionConfig.reason);
-  }
-  if (productionConfig.kind === "file") {
-    const value2 = readInfuraProjectId(productionConfig.text);
-    if (value2 !== void 0) {
-      if (isConfiguredInfuraId(value2, placeholder)) return null;
-      return {
-        message: "Extension product configuration is incomplete: .metamaskprodrc shadows .metamaskrc but does not contain a usable INFURA_PROJECT_ID (the value is never displayed).",
-        userAction: `cd ${shellQuote(path.resolve(target))} && \${EDITOR:-vi} .metamaskprodrc`
-      };
-    }
-  }
-  const config = path.join(target, ".metamaskrc");
-  const configSnapshot = readConfigSnapshot(config);
-  if (configSnapshot.kind === "missing") {
+  if (resolution.source === ".metamaskprodrc") {
     return {
-      message: "Extension product configuration is required before launch: create .metamaskrc and set a non-placeholder INFURA_PROJECT_ID (the value is never displayed).",
-      userAction: `cd ${shellQuote(path.resolve(target))} && cp .metamaskrc.dist .metamaskrc && \${EDITOR:-vi} .metamaskrc`
+      message: "Extension product configuration is incomplete: .metamaskprodrc shadows .metamaskrc but does not contain a usable INFURA_PROJECT_ID (the value is never displayed).",
+      userAction: `cd ${shellQuote(path.resolve(target))} && \${EDITOR:-vi} .metamaskprodrc`
     };
   }
-  if (configSnapshot.kind === "invalid") {
-    return invalidConfigBlock(target, ".metamaskrc", configSnapshot.reason);
-  }
-  const value = readInfuraProjectId(configSnapshot.text) ?? "";
-  if (isConfiguredInfuraId(value, placeholder)) return null;
   return {
     message: "Extension product configuration is incomplete: .metamaskrc must contain a non-placeholder INFURA_PROJECT_ID (the value is never displayed).",
     userAction: `cd ${shellQuote(path.resolve(target))} && \${EDITOR:-vi} .metamaskrc`
   };
 }
-function readConfigSnapshot(file) {
-  let descriptor;
-  try {
-    descriptor = fs.openSync(
-      file,
-      fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK
-    );
-  } catch (error) {
-    const code = error.code;
-    if (code === "ENOENT") return { kind: "missing" };
-    if (code === "ELOOP") return { kind: "invalid", reason: "symlink" };
-    return { kind: "invalid", reason: "unreadable" };
-  }
-  try {
-    if (!fs.fstatSync(descriptor).isFile()) return { kind: "invalid", reason: "not-regular" };
-    return { kind: "file", text: fs.readFileSync(descriptor, "utf8") };
-  } finally {
-    fs.closeSync(descriptor);
-  }
-}
 function invalidConfigBlock(target, name, reason) {
   const resolved = shellQuote(path.resolve(target));
   if (name === ".metamaskrc.dist") {
@@ -91,20 +54,6 @@ function invalidConfigBlock(target, name, reason) {
     userAction: `cd ${resolved} && rm ${name} && ${name === ".metamaskrc" ? "cp .metamaskrc.dist .metamaskrc && " : ""}\${EDITOR:-vi} ${name}`
   };
 }
-function readInfuraProjectId(text) {
-  const lines = text.replace(/\r\n?/gu, "\n");
-  const pattern = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/gmu;
-  let result;
-  for (const match of lines.matchAll(pattern)) {
-    if (match[1] !== "INFURA_PROJECT_ID") continue;
-    let value = (match[2] ?? "").trim();
-    const quote = value[0];
-    value = value.replace(/^(['"`])([\s\S]*)\1$/u, "$2");
-    if (quote === '"') value = value.replace(/\\n/gu, "\n").replace(/\\r/gu, "\r");
-    result = value;
-  }
-  return result;
-}
 export {
   extensionProductConfigBlock
 };

package/dist/adapters/extension/runtime-decision.js

@@ -169,6 +169,8 @@ function runtimeDistCheck(target) {
       "home.html",
       "--exclude",
       "sidepanel.html",
+      "--exclude",
+      "manifest.json",
       "--out-format=%n",
       `${dist}${path.sep}`,
       `${runtimeDist}${path.sep}`
@@ -182,6 +184,9 @@ function runtimeDistCheck(target) {
     const loaded = path.join(runtimeDist, name);
     if (normalizedRuntimeHtml(source) !== normalizedRuntimeHtml(loaded)) modified.push(name);
   }
+  if (normalizedRuntimeManifest(path.join(dist, "manifest.json")) !== normalizedRuntimeManifest(path.join(runtimeDist, "manifest.json"))) {
+    modified.push("manifest.json");
+  }
   const boundedModified = [...new Set(modified)].slice(0, 10);
   return boundedModified.length > 0 ? { status: "stale", modified: boundedModified } : { status: "fresh" };
 }
@@ -193,6 +198,25 @@ function normalizedRuntimeHtml(file) {
     return `<title>${base}</title>`;
   });
 }
+function normalizedRuntimeManifest(file) {
+  if (!fs.existsSync(file)) return null;
+  try {
+    const manifest = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (manifest?._flags?.testing) {
+      delete manifest._flags.testing.infuraProjectId;
+      if (Object.keys(manifest._flags.testing).length === 0) {
+        delete manifest._flags.testing;
+      }
+    }
+    if (manifest?._flags) {
+      delete manifest._flags.remoteFeatureFlags;
+      if (Object.keys(manifest._flags).length === 0) delete manifest._flags;
+    }
+    return JSON.stringify(manifest);
+  } catch {
+    return null;
+  }
+}
 function distCheck(target) {
   const manifestPath = path.join(target, "dist/chrome/manifest.json");
   if (!fs.existsSync(manifestPath)) return { status: "no-build" };

package/dist/commands/launch/extension.js

@@ -222,10 +222,10 @@ async function extensionRebuild(target) {
   fs.mkdirSync(path.dirname(rebuildLog), { recursive: true });
   fs.writeFileSync(rebuildLog, "");
   const liveScript = recipeHarnessPath(target, "extension", "scripts", "live.sh");
-  const liveArgs = ["--target", target, "--start-watch"];
+  const liveArgs = ["--target", target, "--build-lavamoat"];
   if (process.env.CDP_PORT) liveArgs.push("--cdp-port", process.env.CDP_PORT);
   if (process.env.EXTENSION_START_URL) liveArgs.push("--start-url", process.env.EXTENSION_START_URL);
-  console.error(colorHumanMessage(`\u2192 extension quick relaunch \u2014 webpack :${process.env.WATCHER_PORT ?? "default"} \xB7 CDP :${process.env.CDP_PORT ?? "default"} (output streams below)`));
+  console.error(colorHumanMessage(`\u2192 extension quick relaunch \u2014 production-like LavaMoat build \xB7 CDP :${process.env.CDP_PORT ?? "default"} (output streams below)`));
   const result = await spawnScriptStreaming(liveScript, liveArgs, target);
   if (result.output) {
     try {

package/dist/commands/parse-args.js

@@ -23,6 +23,7 @@ function parseArgs(argv, command) {
     "jsonStream",
     "launchExistingDist",
     "startWatch",
+    "buildLavamoat",
     "record",
     "plan",
     "list",

package/dist/commands/runtime-launch.js

@@ -9,7 +9,8 @@ import {
   optionString,
   parsePort,
   shellQuote,
-  targetPath
+  targetPath,
+  usageError
 } from "./parse-args.js";
 async function handleRuntimeLaunch({ options }) {
   const adapter = adapterOption(options);
@@ -24,6 +25,11 @@ async function handleRuntimeLaunch({ options }) {
     optionString(options, "artifactsDir") ?? recipeHarnessPath(target, "extension", "runtime-launch", (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/gu, ""))
   );
   const startWatch = optionFlag(options, "startWatch");
+  const buildLavaMoat = optionFlag(options, "buildLavamoat");
+  if (startWatch && buildLavaMoat) {
+    throw usageError("runtime-launch accepts only one of --start-watch or --build-lavamoat.");
+  }
+  const mode = buildLavaMoat ? "build-lavamoat" : startWatch ? "start-watch" : "existing-dist";
   const liveScript = recipeHarnessPath(target, "extension", "scripts", "live.sh");
   const command = [
     "bash",
@@ -32,7 +38,7 @@ async function handleRuntimeLaunch({ options }) {
     target,
     "--cdp-port",
     String(cdpPort),
-    startWatch ? "--start-watch" : "--launch-existing-dist",
+    `--${mode}`,
     "--artifacts-dir",
     artifactsDir
   ];
@@ -46,7 +52,7 @@ async function handleRuntimeLaunch({ options }) {
       cdpPort,
       artifactsDir,
       reason: "harness_live_script_missing",
-      fix: `Run mm-harness install --adapter extension --target ${shellQuote(target)}, then rerun: ${runtimeLaunchCommand(target, cdpPort, chromeUserDataDir)}`,
+      fix: `Run mm-harness install --adapter extension --target ${shellQuote(target)}, then rerun: ${runtimeLaunchCommand(target, cdpPort, chromeUserDataDir, mode)}`,
       command
     });
     printRuntimeLaunchReport(report2, optionFlag(options, "json"));
@@ -55,14 +61,15 @@ async function handleRuntimeLaunch({ options }) {
   fs.mkdirSync(artifactsDir, { recursive: true });
   const jsonMode = optionFlag(options, "json");
   if (!jsonMode) {
-    console.error(`recipe: runtime-launch starting (cdp=${cdpPort}${startWatch ? ", clean webpack build" : ", existing dist"})`);
+    const detail = mode === "build-lavamoat" ? "production-like LavaMoat build" : mode === "start-watch" ? "test webpack watcher" : "existing dist";
+    console.error(`recipe: runtime-launch starting (cdp=${cdpPort}, ${detail})`);
   } else {
     console.error(JSON.stringify({
       schemaVersion: 1,
       type: "progress",
       command: "rebuild",
       phase: "runtime-launch",
-      message: startWatch ? "clean webpack build starting" : "launching existing dist",
+      message: mode === "build-lavamoat" ? "production-like LavaMoat build starting" : mode === "start-watch" ? "test webpack watcher starting" : "launching existing dist",
       cdpPort
     }));
   }
@@ -102,16 +109,16 @@ async function handleRuntimeLaunch({ options }) {
     launchLogPath: fs.existsSync(launchLogPath) ? launchLogPath : void 0,
     verifySummaryPath: fs.existsSync(verifySummaryPath) ? verifySummaryPath : void 0,
     reason,
-    fix: `Read ${failurePath}, fix the first error, then rerun: ${runtimeLaunchCommand(target, cdpPort, chromeUserDataDir, startWatch)}`,
+    fix: `Read ${failurePath}, fix the first error, then rerun: ${runtimeLaunchCommand(target, cdpPort, chromeUserDataDir, mode)}`,
     command,
     exitCode: result.status ?? 1
   });
   printRuntimeLaunchReport(report, optionFlag(options, "json"));
   return 1;
 }
-function runtimeLaunchCommand(target, cdpPort, chromeUserDataDir, startWatch = false) {
+function runtimeLaunchCommand(target, cdpPort, chromeUserDataDir, mode = "existing-dist") {
   const base = `mm-harness runtime-launch --adapter extension --target ${shellQuote(target)} --cdp-port ${cdpPort}`;
-  const withMode = startWatch ? `${base} --start-watch` : base;
+  const withMode = mode === "existing-dist" ? base : `${base} --${mode}`;
   return chromeUserDataDir ? `${withMode} --chrome-user-data-dir ${shellQuote(chromeUserDataDir)}` : withMode;
 }
 function runtimeLaunchReport(status, fields) {

package/library/actions/extension/perps/perps.mjs

@@ -709,10 +709,8 @@ async function readPerpsRuntimeState(page) {
     const request = hooks.submitRequestToBackground;
     const reduxState = hooks.store?.getState?.() || {};
     const cleanState = (await hooks.getCleanAppState?.()) || hooks.getState?.() || {};
-    const persisted = await globalThis.chrome?.storage?.local?.get?.('data');
-    // Extension flattens PerpsController state into state.metamask via ComposableObservableStore.getFlatState().
     const metamask = reduxState.metamask || cleanState.metamask || {};
-    const nestedPerps = persisted?.data?.PerpsController || metamask.PerpsController || cleanState.PerpsController || cleanState.perps || {};
+    const nestedPerps = metamask.PerpsController || cleanState.PerpsController || cleanState.perps || {};
     return {
       available: typeof request === 'function',
       activeProvider: metamask.activeProvider || nestedPerps.activeProvider || 'hyperliquid',

package/library/actions/shared/analytics/assert_events.mjs

@@ -27,20 +27,75 @@ function nonNegativeInteger(value, name, fallback) {
   return parsed;
 }
 
+const PROPERTY_MATCHERS = new Set(['$exists', '$type', '$gt']);
+
+function validatePropertyExpectation(value, key) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return;
+  const keys = Object.keys(value);
+  const matcherKeys = keys.filter((entry) => entry.startsWith('$'));
+  if (matcherKeys.length === 0) return;
+  if (matcherKeys.length !== keys.length) {
+    throw new Error(`Property matcher for "${key}" cannot mix matcher and literal keys.`);
+  }
+  const unsupported = matcherKeys.filter((entry) => !PROPERTY_MATCHERS.has(entry));
+  if (unsupported.length > 0) {
+    throw new Error(`Unsupported property matcher for "${key}": ${unsupported.join(', ')}.`);
+  }
+  if ('$exists' in value && typeof value.$exists !== 'boolean') {
+    throw new Error(`$exists matcher for "${key}" must be boolean.`);
+  }
+  if (
+    '$type' in value &&
+    !['string', 'number', 'boolean', 'object', 'array'].includes(value.$type)
+  ) {
+    throw new Error(`$type matcher for "${key}" is invalid.`);
+  }
+  if ('$gt' in value && !isNumericValue(value.$gt)) {
+    throw new Error(`$gt matcher for "${key}" must be numeric.`);
+  }
+}
+
+function isNumericValue(value) {
+  return (
+    (typeof value === 'number' && Number.isFinite(value)) ||
+    (typeof value === 'string' && value.trim() !== '' && Number.isFinite(Number(value)))
+  );
+}
+
+function matchesValue(got, want) {
+  if (want !== null && typeof want === 'object' && !Array.isArray(want)) {
+    const matcherKeys = Object.keys(want).filter((entry) => entry.startsWith('$'));
+    if (matcherKeys.length > 0) {
+      if ('$exists' in want && (got !== undefined) !== want.$exists) return false;
+      if ('$type' in want) {
+        const actualType = got === null ? 'null' : Array.isArray(got) ? 'array' : typeof got;
+        if (actualType !== want.$type) return false;
+      }
+      if ('$gt' in want) {
+        if (!isNumericValue(got) || Number(got) <= Number(want.$gt)) {
+          return false;
+        }
+      }
+      return true;
+    }
+  }
+  if (want !== null && typeof want === 'object') {
+    return JSON.stringify(got) === JSON.stringify(want);
+  }
+  // Segment serialises numbers inconsistently across clients.
+  if (typeof want === 'number' && typeof got === 'string' && got.trim() !== '') {
+    return Number(got) === want;
+  }
+  if (typeof got === 'number' && typeof want === 'string' && want.trim() !== '') {
+    return got === Number(want);
+  }
+  return Object.is(got, want);
+}
+
 function matchesProperties(actual, expected) {
   return Object.entries(expected).every(([key, want]) => {
     const got = actual?.[key];
-    if (want !== null && typeof want === 'object') {
-      return JSON.stringify(got) === JSON.stringify(want);
-    }
-    // Segment serialises numbers inconsistently across clients.
-    if (typeof want === 'number' && typeof got === 'string' && got.trim() !== '') {
-      return Number(got) === want;
-    }
-    if (typeof got === 'number' && typeof want === 'string' && want.trim() !== '') {
-      return got === Number(want);
-    }
-    return Object.is(got, want);
+    return matchesValue(got, want);
   });
 }
 
@@ -66,6 +121,9 @@ function expectationsFrom(input) {
     if (hasCount && hasBounds) {
       throw new Error(`expect entry for "${entry.event}" sets both count and min/max; pick one.`);
     }
+    for (const [key, value] of Object.entries(entry.properties ?? {})) {
+      validatePropertyExpectation(value, key);
+    }
     const expectation = {
       event: entry.event,
       properties: entry.properties ?? null,

package/library/manifests/extension.action-manifest.json

@@ -2875,7 +2875,7 @@
                 },
                 "properties": {
                   "type": "object",
-                  "description": "Subset match on event properties; only events matching all of them are counted."
+                  "description": "Subset match on event properties; values may be exact or use $exists, $type, and $gt predicates."
                 }
               },
               "required": [

package/library/manifests/mobile.action-manifest.json

@@ -2997,7 +2997,7 @@
                 },
                 "properties": {
                   "type": "object",
-                  "description": "Subset match on event properties; only events matching all of them are counted."
+                  "description": "Subset match on event properties; values may be exact or use $exists, $type, and $gt predicates."
                 }
               },
               "required": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"
@@ -22,7 +22,7 @@
     "@farmslot/agent-runtime": "^0.4.0",
     "@farmslot/handoff": "^0.3.1",
     "@farmslot/protocol": "^0.14.0",
-    "@farmslot/recipe-harness": "^0.10.3",
+    "@farmslot/recipe-harness": "^0.10.4",
     "commander": "^12.0.0",
     "es-module-lexer": "2.3.1",
     "esbuild": "0.28.1",