@deeeed/metamask-harness 0.38.0 → 0.38.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.38.1 - 2026-08-14
+
+### Fixed
+
+- Read release evidence through verified regular-file descriptors, escape generated Markdown safely, and keep UI waits out of dynamically constructed page expressions.
+
 ## 0.38.0 - 2026-08-14
 
 ### Added

package/library/actions/extension/perps/open_balance_action.mjs

@@ -13,12 +13,7 @@ runAdapter(async (input) => withExtensionPage(input, async (page) => {
   }
   await page.click(dataTestId('perps-balance-dropdown-balance'));
   const actionSelector = dataTestId(actionTestId);
-  const deadline = Date.now() + 10_000;
-  while (Date.now() <= deadline) {
-    const present = await page.evaluate(`(() => Boolean(document.querySelector(${JSON.stringify(actionSelector)})))()`);
-    if (present) break;
-    await new Promise((resolve) => setTimeout(resolve, 100));
-  }
+  await page.waitForSelector(actionSelector, { timeoutMs: 10_000 });
   await page.click(actionSelector);
   const expected = balanceAction === 'withdraw'
     ? ['perps-withdraw-page', 'perps-withdraw-container', 'perps-withdraw-view']

package/library/actions/extension/perps/select_market_filter.mjs

@@ -31,8 +31,9 @@ runAdapter(async (input) => withExtensionPage(input, async (page) => {
   });
   await page.click(dataTestId('filter-select-button'));
   const optionSelector = dataTestId(`filter-select-option-${option}`);
-  const found = await page.evaluate(`(() => Boolean(document.querySelector(${JSON.stringify(optionSelector)})))()`);
-  if (!found) {
+  try {
+    await page.waitForSelector(optionSelector, { timeoutMs: 2_000 });
+  } catch {
     throw new Error(`Perps market filter ${JSON.stringify(filter)} is not available in this release.`);
   }
   await page.click(optionSelector);

package/library/actions/extension/swap_bridge/submit_transaction.mjs

@@ -11,8 +11,8 @@ const selectors = {
   swap: dataTestId('bottom-nav-swaps'),
 };
 
-async function pause(page, timeoutMs = 200) {
-  await page.evaluate(`new Promise((resolve) => setTimeout(resolve, ${JSON.stringify(timeoutMs)}))`);
+async function pause(timeoutMs = 200) {
+  await new Promise((resolve) => setTimeout(resolve, timeoutMs));
 }
 
 async function activatePoint(page, point) {
@@ -66,14 +66,14 @@ async function openActivity(page, timeoutMs) {
     if (isActivityRoute(state.route) && await visible(page, selectors.swap) && Date.now() - lastResetAt >= 1000) {
       await activateSelector(page, selectors.swap);
       lastResetAt = Date.now();
-      await pause(page);
+      await pause();
       continue;
     }
     if (await visible(page, selectors.activity) && Date.now() - lastActivationAt >= 1000) {
       await activateSelector(page, selectors.activity);
       lastActivationAt = Date.now();
     }
-    await pause(page);
+    await pause();
   }
   throw new Error('Activity did not open after swap.');
 }
@@ -107,11 +107,11 @@ async function submittableQuote(page, timeoutMs) {
     const quote = await quoteState(page);
     if (/^(?:Get new quote|Refresh quote)$/iu.test(String(quote.cta)) && quote.ctaEnabled) {
       await page.click(selectors.cta);
-      await pause(page, 500);
+      await pause(500);
       continue;
     }
     if (/^(?:Swap|Bridge)$/iu.test(String(quote.cta)) && quote.ctaEnabled && !quote.loading) return quote;
-    await pause(page);
+    await pause();
   }
   throw new Error('Swap did not expose a fresh submittable quote.');
 }
@@ -186,7 +186,7 @@ runAdapter(async (input) => withExtensionPage(input, async (page) => {
       || quote.warning) {
       throw new Error(`Swap quote is not safe to submit: ${JSON.stringify(quote)}.`);
     }
-    await pause(page, 2000);
+    await pause(2000);
     quote = await submittableQuote(page, Math.min(timeoutMs, 60_000));
     if (!quote.sourceSymbol.toUpperCase().includes(sourceSymbol)
       || !quote.destinationSymbol.toUpperCase().includes(destinationSymbol)
@@ -210,14 +210,14 @@ runAdapter(async (input) => withExtensionPage(input, async (page) => {
     while (Date.now() < submissionDeadline) {
       if (await visible(page, selectors.warningProceed)) {
         await page.click(selectors.warningProceed);
-        await pause(page);
+        await pause();
         continue;
       }
       if (await visible(page, selectors.confirm)) {
         await page.click(selectors.confirm);
         confirmed = true;
         submitted = true;
-        await pause(page);
+        await pause();
         continue;
       }
       const state = await bodyState(page);
@@ -228,7 +228,7 @@ runAdapter(async (input) => withExtensionPage(input, async (page) => {
       if (submitted && (state.route === '' || state.route === '#/' || isActivityRoute(state.route) || /Processing|Transaction complete|submitted/iu.test(state.text))) {
         break;
       }
-      await pause(page);
+      await pause();
     }
     if (!submitted) {
       throw new Error('Swap submission did not reach a signed or submitted state.');
@@ -259,7 +259,7 @@ runAdapter(async (input) => withExtensionPage(input, async (page) => {
       if (row?.status === 'confirmed') return row;
       if (Date.now() - lastActivityRefresh >= 5000 && await visible(page, selectors.home)) {
         await page.click(selectors.home);
-        await pause(page, 500);
+        await pause(500);
         await openActivity(page, Math.min(10_000, Math.max(1, timeoutMs)));
         lastActivityRefresh = Date.now();
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"

package/scripts/validate-release-report.mjs

@@ -106,23 +106,20 @@ for (const entry of verdictCases) {
       ];
       for (const required of requiredDocuments) {
         const requiredPath = path.join(resolved, required);
-        if (!fs.existsSync(requiredPath)) {
+        const requiredDocument = readRegularJsonFile(requiredPath);
+        if (requiredDocument.status === 'missing') {
           errors.push(`${entry.id ?? '<missing-id>'} evidence directory is missing ${required}: ${resolved}`);
           continue;
         }
-        const requiredStat = fs.lstatSync(requiredPath);
-        if (requiredStat.isSymbolicLink() || !requiredStat.isFile()) {
+        if (requiredDocument.status === 'unsafe') {
           errors.push(`${entry.id ?? '<missing-id>'} evidence directory ${required} must be a regular file: ${resolved}`);
           continue;
         }
-        let document;
-        try {
-          document = JSON.parse(fs.readFileSync(requiredPath, 'utf8'));
-        } catch {
+        if (requiredDocument.status === 'invalid') {
           errors.push(`${entry.id ?? '<missing-id>'} evidence directory ${required} must contain valid JSON: ${resolved}`);
           continue;
         }
-        documents[required] = document;
+        documents[required] = requiredDocument.value;
       }
       if (documents['summary.json'] && entry.status === 'PASS' && documents['summary.json'].status !== 'pass') {
         errors.push(`${entry.id ?? '<missing-id>'} PASS evidence summary.json must have status pass: ${resolved}`);
@@ -216,6 +213,24 @@ function readJson(file, label) {
   }
 }
 
+function readRegularJsonFile(file) {
+  let descriptor;
+  try {
+    descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    if (!fs.fstatSync(descriptor).isFile()) return { status: 'unsafe' };
+    const contents = fs.readFileSync(descriptor, 'utf8');
+    try {
+      return { status: 'ok', value: JSON.parse(contents) };
+    } catch {
+      return { status: 'invalid' };
+    }
+  } catch (error) {
+    return { status: error?.code === 'ENOENT' ? 'missing' : 'unsafe' };
+  } finally {
+    if (descriptor !== undefined) fs.closeSync(descriptor);
+  }
+}
+
 function duplicates(values) {
   const seen = new Set();
   const repeated = new Set();
@@ -259,11 +274,10 @@ function readResolvedRecipes(root, resolution, caseId, validationErrors) {
     if (!fs.existsSync(artifactPath)) continue;
     const canonicalArtifact = fs.realpathSync(artifactPath);
     if (!canonicalArtifact.startsWith(`${canonicalRoot}${path.sep}`)) continue;
-    const stat = fs.lstatSync(artifactPath);
-    if (stat.isSymbolicLink() || !stat.isFile()) continue;
-    try {
-      recipes[digest] = JSON.parse(fs.readFileSync(artifactPath, 'utf8'));
-    } catch {
+    const recipe = readRegularJsonFile(artifactPath);
+    if (recipe.status === 'ok') {
+      recipes[digest] = recipe.value;
+    } else if (recipe.status === 'invalid') {
       validationErrors.push(`${caseId} evidence directory resolved recipe must contain valid JSON: ${artifactPath}`);
     }
   }
@@ -294,7 +308,7 @@ function renderMarkdown(verdicts, inventoryCases, counts, releaseStatus) {
 }
 
 function escapeTable(value) {
-  return String(value).replace(/\|/gu, '\\|').replace(/\s+/gu, ' ').trim();
+  return String(value).replace(/\\/gu, '\\\\').replace(/\|/gu, '\\|').replace(/\s+/gu, ' ').trim();
 }
 
 function parseArgs(argv) {