@deeeed/metamask-harness 0.36.0 → 0.38.0

package/adapters/extension/snapshot-dist.sh

@@ -9,9 +9,12 @@
 #
 # Inputs (flags):
 #   --dist <dir>           source dist (required, e.g. <repo>/dist/chrome)
+#   --target <dir>         absolute checkout containment root
+#   --runtime-root <dir>   absolute directory that owns the snapshot
 #   --runtime-dist <dir>   snapshot destination (required, recreated)
 #   --wait-iterations <n>  manifest wait loop length, 2s each (default 180)
 #   --summary <file>       optional standard summary.json
+#   --exact                preserve every source entry (release artifacts)
 #
 # Outputs:
 #   <runtime-dist>/ snapshot (excludes _metadata); optional --summary file
@@ -24,24 +27,32 @@
 set -euo pipefail
 
 DIST=""
+TARGET_ROOT=""
+RUNTIME_ROOT=""
 RUNTIME_DIST=""
 WAIT_ITERATIONS=180
 SUMMARY=""
+EXACT=false
 require_value() { [ "$#" -ge 2 ] || { echo "Missing value for $1" >&2; exit 2; }; }
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --dist) require_value "$@"; DIST="$2"; shift 2 ;;
+    --target) require_value "$@"; TARGET_ROOT="$2"; shift 2 ;;
+    --runtime-root) require_value "$@"; RUNTIME_ROOT="$2"; shift 2 ;;
     --runtime-dist) require_value "$@"; RUNTIME_DIST="$2"; shift 2 ;;
     --wait-iterations) require_value "$@"; WAIT_ITERATIONS="$2"; shift 2 ;;
     --summary) require_value "$@"; SUMMARY="$2"; shift 2 ;;
+    --exact) EXACT=true; shift ;;
     -h|--help)
-      echo "Usage: snapshot-dist.sh --dist <dir> --runtime-dist <dir> [--wait-iterations <n>] [--summary <file>]"
+      echo "Usage: snapshot-dist.sh --dist <dir> --target <dir> --runtime-root <dir> --runtime-dist <dir> [--wait-iterations <n>] [--summary <file>]"
       exit 0
       ;;
     *) echo "Unknown arg: $1" >&2; exit 2 ;;
   esac
 done
 [ -n "$DIST" ] || { echo "Missing --dist" >&2; exit 2; }
+[ -n "$TARGET_ROOT" ] || { echo "Missing --target" >&2; exit 2; }
+[ -n "$RUNTIME_ROOT" ] || { echo "Missing --runtime-root" >&2; exit 2; }
 [ -n "$RUNTIME_DIST" ] || { echo "Missing --runtime-dist" >&2; exit 2; }
 case "$WAIT_ITERATIONS" in ''|*[!0-9]*) echo "Invalid --wait-iterations (must be numeric): $WAIT_ITERATIONS" >&2; exit 2 ;; esac
 
@@ -73,8 +84,82 @@ done
 test -f "$DIST/manifest.json" || { echo "snapshot-dist: no manifest at $DIST/manifest.json" >&2; exit 1; }
 
 echo "[recipe-harness] snapshotting dist -> runtime-dist: $RUNTIME_DIST" >&2
-rm -rf "$RUNTIME_DIST" && mkdir -p "$RUNTIME_DIST" \
-  && rsync -a --delete --exclude _metadata "$DIST/" "$RUNTIME_DIST/" || exit 1
+node - "$DIST" "$TARGET_ROOT" "$RUNTIME_ROOT" "$RUNTIME_DIST" <<'NODE'
+const fs = require('node:fs');
+const path = require('node:path');
+
+const [sourceInput, targetInput, rootInput, destinationInput] = process.argv.slice(2);
+const source = path.resolve(sourceInput);
+const target = path.resolve(targetInput);
+const root = path.resolve(rootInput);
+const destination = path.resolve(destinationInput);
+
+function refuse(message) {
+  throw new Error(`snapshot-dist: ${message}`);
+}
+
+if (![targetInput, rootInput, destinationInput].every(path.isAbsolute)) {
+  refuse('--target, --runtime-root, and --runtime-dist must be absolute paths.');
+}
+const targetStat = fs.lstatSync(target, { throwIfNoEntry: false });
+if (!targetStat?.isDirectory() || targetStat.isSymbolicLink()) {
+  refuse(`target is not a regular directory: ${target}.`);
+}
+const rootRelative = path.relative(target, root);
+if (!rootRelative || rootRelative === '..' || rootRelative.startsWith(`..${path.sep}`) || path.isAbsolute(rootRelative)) {
+  refuse(`runtime root must be a child of ${target}.`);
+}
+const relative = path.relative(root, destination);
+if (!relative || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+  refuse(`runtime destination must be a child of ${root}.`);
+}
+if (
+  source === destination ||
+  source.startsWith(`${destination}${path.sep}`) ||
+  destination.startsWith(`${source}${path.sep}`)
+) {
+  refuse('source and runtime destination must be separate directory trees.');
+}
+
+function ensureDirectoryTree(base, relativePath) {
+  let current = base;
+  const components = relativePath.split(path.sep).filter(Boolean);
+  for (const component of components) {
+    current = path.join(current, component);
+    const stat = fs.lstatSync(current, { throwIfNoEntry: false });
+    if (!stat) {
+      fs.mkdirSync(current, { mode: 0o700 });
+      continue;
+    }
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      refuse(`runtime path contains an unsafe entry: ${current}.`);
+    }
+  }
+}
+
+ensureDirectoryTree(target, rootRelative);
+ensureDirectoryTree(root, path.relative(root, path.dirname(destination)));
+const realTarget = fs.realpathSync(target);
+const realRoot = fs.realpathSync(root);
+const realParent = fs.realpathSync(path.dirname(destination));
+if (
+  !realRoot.startsWith(`${realTarget}${path.sep}`) ||
+  (realParent !== realRoot && !realParent.startsWith(`${realRoot}${path.sep}`))
+) {
+  refuse(`runtime destination escapes ${root}.`);
+}
+const destinationStat = fs.lstatSync(destination, { throwIfNoEntry: false });
+if (destinationStat && (!destinationStat.isDirectory() || destinationStat.isSymbolicLink())) {
+  refuse(`runtime destination is not a regular directory: ${destination}.`);
+}
+if (destinationStat) fs.rmSync(destination, { recursive: true });
+fs.mkdirSync(destination, { mode: 0o700 });
+NODE
+if $EXACT; then
+  rsync -a --delete "$DIST/" "$RUNTIME_DIST/" || exit 1
+else
+  rsync -a --delete --exclude _metadata "$DIST/" "$RUNTIME_DIST/" || exit 1
+fi
 echo "[recipe-harness] runtime-dist snapshot complete" >&2
 
 # Freshness guard: the loaded runtime-dist must match dist/chrome's git id. A

package/adapters/extension/verify.sh

@@ -344,14 +344,18 @@ let r = {};
 try { r = JSON.parse(fs.readFileSync(dir + "/runtime-decision.json", "utf8")); } catch {}
 const c = r.checks || {};
 const dist = c.dist || { status: "unknown" };
-const distMsg = dist.status === "fresh" ? "dist id matches HEAD; no uncommitted source."
+const distMsg = dist.source === "release-artifact"
+  ? ("release artifact " + (dist.manifestVersion || "?") + " sha256=" + (dist.artifactSha256 || "?") + " matches the loaded runtime snapshot.")
+  : dist.status === "fresh" ? "dist id matches HEAD; no uncommitted source."
   : dist.status === "stale" ? (dist.reason === "uncommitted-source"
       ? ((dist.modified ? dist.modified.length : "some") + " uncommitted source file(s); rebuild or commit.")
       : ("dist id " + (dist.distGitId || "?") + " != HEAD " + (dist.head || "?") + "; rebuild."))
   : dist.status === "no-build" ? "no dist/chrome build."
   : "no git id in dist or not a git checkout; cannot prove parity.";
 fs.writeFileSync(dir + "/dist-freshness.json", JSON.stringify({ ...dist, message: distMsg }));
-const bl = c.buildLog || { status: "unknown" };
+const bl = c.releaseArtifact?.status === "valid"
+  ? { status: "no-watch", source: "release-artifact" }
+  : (c.buildLog || { status: "unknown" });
 const blMsg = bl.status === "ok" ? "webpack compiled."
   : bl.status === "no-watch" ? "no webpack watch log; build-health n/a (e.g. one-shot build)."
   : bl.status === "building" ? "webpack has not reported a successful compile yet."

package/adapters/manifest.json

@@ -186,6 +186,14 @@
       "inputs": "--target --runtime-dist; optional --runtime-dir",
       "outputs": "home.html and sidepanel.html titles updated in the isolated runtime only; exit 0/1"
     },
+    {
+      "id": "extension/artifact-runtime-state",
+      "entry": "adapters/extension/artifact-runtime-state.cjs",
+      "kind": "node",
+      "purpose": "Record or clear the acquired release artifact identity bound to the loaded runtime snapshot.",
+      "inputs": "set|clear --target --runtime-dir; set also requires --source-dir --runtime-dist --provenance",
+      "outputs": "<runtime-dir>/extension-release-artifact.json or removal; exit 0/1/2"
+    },
     {
       "id": "extension/stop-viewers",
       "entry": "adapters/extension/stop-viewers.sh",
@@ -207,7 +215,7 @@
       "entry": "adapters/extension/snapshot-dist.sh",
       "kind": "bash",
       "purpose": "Runtime-dist snapshot (rsync, excludes _metadata) with from-git-id freshness guard.",
-      "inputs": "--dist --runtime-dist --wait-iterations --summary",
+      "inputs": "--dist --target --runtime-root --runtime-dist --wait-iterations --summary",
       "outputs": "<runtime-dist>/ snapshot; optional summary; exit 0/1/2"
     },
     {
@@ -226,6 +234,14 @@
       "inputs": "--cdp-port --chrome-bin --profile --extension-dir --chrome-log --chrome-pid",
       "outputs": "pid file + append-log; exit 0 / non-zero"
     },
+    {
+      "id": "extension/validation-process-ownership",
+      "entry": "adapters/extension/lib/validation-process-ownership.cjs",
+      "kind": "lib",
+      "purpose": "Resolve browser processes owned by one isolated Extension validation profile.",
+      "inputs": "profile path",
+      "outputs": "owned process identifiers"
+    },
     {
       "id": "extension/refresh-build",
       "entry": "adapters/extension/refresh-build.sh",

package/adapters/shared/log-tui.mjs

@@ -236,7 +236,7 @@ async function watchLog(options) {
       renderCompact({ label, logPath, events, quiet: mode === 'quiet' });
       if (mode !== 'quiet') {
         const elapsed = Math.round((Date.now() - started) / 1000);
-        process.stderr.write(`${color('label', 'mm-harness', { stream: process.stderr })} ${color('dim', '|', { stream: process.stderr })} ${color('ok', `build complete (${elapsed}s)`, { stream: process.stderr })}\n`);
+        process.stderr.write(`${color('label', 'mm-harness', { stream: process.stderr })} ${color('dim', '|', { stream: process.stderr })} ${color('ok', `${label} complete (${elapsed}s)`, { stream: process.stderr })}\n`);
       }
       return 0;
     }

package/dist/adapters/extension/artifact-integrity.js

@@ -0,0 +1,38 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+function extensionTreeSha256(root) {
+  const resolvedRoot = path.resolve(root);
+  const rootStat = fs.lstatSync(resolvedRoot);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
+    throw new Error(`Extension artifact root must be a regular directory: ${resolvedRoot}`);
+  }
+  const digest = createHash("sha256");
+  walk(resolvedRoot, "");
+  return digest.digest("hex");
+  function walk(directory, relativeDirectory) {
+    const entries = fs.readdirSync(directory, { withFileTypes: true }).sort((left, right) => Buffer.compare(Buffer.from(left.name), Buffer.from(right.name)));
+    for (const entry of entries) {
+      const absolute = path.join(directory, entry.name);
+      const relative = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
+      const stat = fs.lstatSync(absolute);
+      if (stat.isSymbolicLink()) {
+        throw new Error(`Extension artifact tree contains a symbolic link: ${relative}`);
+      }
+      if (stat.isDirectory()) {
+        digest.update(`directory\0${relative}\0`);
+        walk(absolute, relative);
+        continue;
+      }
+      if (!stat.isFile()) {
+        throw new Error(`Extension artifact tree contains an unsupported entry: ${relative}`);
+      }
+      digest.update(`file\0${relative}\0${stat.size}\0`);
+      digest.update(fs.readFileSync(absolute));
+      digest.update("\0");
+    }
+  }
+}
+export {
+  extensionTreeSha256
+};

package/dist/adapters/extension/extension-id.js

@@ -1,6 +1,8 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { recipeRuntimeDir } from "../../paths.js";
+import { releaseArtifactState, runtimeDistCheck } from "./runtime-decision.js";
 const DIST_MANIFEST = "dist/chrome/manifest.json";
 function extensionIdFromKey(keyBase64) {
   const der = Buffer.from(keyBase64, "base64");
@@ -12,8 +14,8 @@ function extensionIdFromKey(keyBase64) {
   }
   return id;
 }
-function idFromDistManifest(target) {
-  const manifestPath = path.join(target, DIST_MANIFEST);
+function idFromManifest(manifestPath) {
+  if (!manifestPath) return null;
   if (!fs.existsSync(manifestPath)) return null;
   try {
     const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
@@ -39,7 +41,24 @@ async function cdpExtensionIds(cdpPort) {
 }
 async function resolveExtensionId(target, options = {}) {
   const resolved = path.resolve(target);
-  const fromKey = idFromDistManifest(resolved);
+  const runtimeSnapshot = runtimeDistCheck(resolved, releaseArtifactState(resolved));
+  const releaseArtifact = runtimeSnapshot.source === "release-artifact";
+  if (releaseArtifact && runtimeSnapshot.status !== "fresh") {
+    return {
+      adapter: "extension",
+      target: resolved,
+      extensionId: null,
+      source: "none",
+      verified: false
+    };
+  }
+  const manifestPath = releaseArtifact ? runtimeSnapshot.status === "fresh" ? path.join(
+    resolved,
+    recipeRuntimeDir(),
+    process.env.RECIPE_RUNTIME_DIST_DIR || "runtime-dist",
+    "manifest.json"
+  ) : null : path.join(resolved, DIST_MANIFEST);
+  const fromKey = idFromManifest(manifestPath);
   let cdpIds = null;
   if (options.cdpPort) cdpIds = await cdpExtensionIds(options.cdpPort);
   if (fromKey) {
@@ -47,7 +66,7 @@ async function resolveExtensionId(target, options = {}) {
       adapter: "extension",
       target: resolved,
       extensionId: fromKey,
-      source: "manifest-key",
+      source: releaseArtifact ? "release-manifest-key" : "manifest-key",
       verified: cdpIds ? cdpIds.includes(fromKey) : null
     };
   }