@deeeed/metamask-harness 0.39.0 → 0.40.0

package/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 ## Unreleased
 
+## 0.40.0 - 2026-08-16
+
+- Remove Extension's public `metamask.perps.close_positions` and `metamask.perps.start_state` surfaces and its mutating `runner.action-validation` recipe; retain only state assertions it can prove without implicit readiness or unreceipted convergence.
+- Make guarded Extension custom-network setup wait for an unobscured account-menu hit point before opening network management.
+
+### Added
+
+- Add explicit Extension fullscreen/sidepanel launch selection and auto/show/hide recipe HUD policy.
+- Bind external-mutation runs to independently validated release, onboarding, balance-evidence, request, and preflight bytes plus the same-run visible wallet/runtime identity.
+- Add a packaged Perps market-filter release recipe with a deterministic market-list start state and every nonconditional category control.
+- Add official-compatible visible Extension Perps market-list/activity consistency assertions, plus source-dev-only background snapshot sampling and activity-to-history identity expectations.
+- Bind every live Extension action result to the selected CDP target and current browser runtime session.
+
+### Changed
+
+- Canonicalize durable Extension Perps release journeys under one discovered recipe ID each, with activity and funds flows scoped to Extension and explicit official/source-development and live-mutation boundaries.
+- Parameterize live values in the Extension Perps order-validation recipe and narrow existing market-details, activity-filter, and funds-preview claims to their asserted evidence.
+- Require an explicit flat market for non-submitting Extension order-form recipes and make live-price movement an opt-in source-development snapshot assertion.
+
+### Fixed
+
+- Trust only the current Perps-only funding registry plus the named frozen G005 digest; reject duplicate or aggregate-over-cap mutation operations and budgets, mutation-capable balance graphs, root-ref dependency shadowing, and non-visible or non-Home balance observations.
+- Bind trusted funding and onboarding evidence to exact emitted call graphs, successful node/action order, and reachable root PASS terminals while preserving Mobile's adapter-owned external-mutation consent boundary.
+- Stop advertising shared Perps clean-market convergence on Extension; its state helpers now expose only navigation and assertion inputs and reject ignored creation or cleanup parameters during planning.
+- Remove unsupported Extension send completion, Swap/Bridge submission, and generic activate-and-observe capabilities plus four non-executable Assets submit recipes; retain read-only, prepare, review, quote, and Mobile-owned live Swap planning.
+- Bind funded Extension Perps margin and TP/SL updates to the exact visible position size, enforce order caps against requested leveraged exposure before receipt publication, and default funded placements to one-times leverage.
+- Fail closed on visible and background Perps financial mutations without an identity-bound durable receipt, current visible funding minimum, runner-owned artifact/runtime, and exact dispatch-boundary provider/network; terminally record known non-dispatch instead of retrying the same claim.
+- Require approved visible wallet method and credential provenance plus a hash-bound emitted recipe, pass summary, artifact manifest, and exact reachable root-terminal PASS in funding evidence.
+- Require every funded visible position edit or close to recheck current funding, provider/network, and exact target state after receipt publication and immediately before its first pointer dispatch.
+- Invalidate funded-mutation wallet identity proof after account selection, reset, lock, unlock, setup, or any state-changing generic UI action until a complete fresh visible wallet import proof succeeds.
+- Keep Extension Perps state wrappers observation-only so they cannot place, close, or cancel implicitly outside a leaf action's funding authorization.
+- Preserve a final Perps navigation observation poll and require Side Panel convergence to one MetaMask product surface beside the explicitly requested dapp.
+- Require the canonical non-submitting Swap quote recipe to prove a positive reviewable quote instead of accepting a no-route state.
+- Refuse cleanup-bound custom-network setup when the target network already exists, preserving pre-existing wallet configuration.
+- Bind Android release-artifact action results to the verified native app process session and redact Mobile wallet-import identity proofs to a matched digest.
+- Distinguish obscured Perps controls from harmless edge intersections in visible layout proofs and include confirmation controls on funds surfaces.
+- Reject duplicate rendered market, watchlist, or activity identities during optional Extension consistency proofs.
+- Read Perps funds confirmation titles from their visible wallet-initiated header and support exact amount, token, network, percentage-control, and disabled-state assertions.
+- Wait for Basic Functionality consent to enable its confirmation before submitting the visible settings change.
+- Reach the Extension global wallet menu through the visible Home control before locking from headerless product routes.
+- Keep Extension surface transitions singular and route the sidepanel launcher's obscuration hit test through hardened raw CDP when its visible notification badge overlaps the button.
+- Namespace funded Perps claims by exact request and preflight bytes, persist identity-bound receipts before live pointer dispatch, and restrict over-cap order recovery to exact cleanup-only cancellation without upgrading placement success.
+- Relaunch intact Extension release artifacts without source dependency repair, and support exact receipt-bound close-only Perps cleanup with primary-card and balance reconciliation proof.
+- Validate Extension Perps activity filters against their singular route query while requiring the requested filter label to remain visible.
+- Make Extension `wallet.import method=ui` idempotent on an onboarded profile by visibly unlocking and selecting the exact derived account without fixture or background-state probes.
+
 ## 0.39.0 - 2026-08-14
 
 ### Added

package/adapters/extension/lib/playwright-cdp.cjs

@@ -1,5 +1,21 @@
 'use strict';
 
+const path = require('node:path');
+const { createRequire } = require('node:module');
+
+function loadChromium() {
+  const runtimeRequire = createRequire(path.join(process.cwd(), 'package.json'));
+  try {
+    return runtimeRequire('@playwright/test').chromium;
+  } catch {
+    return runtimeRequire('playwright').chromium;
+  }
+}
+
+async function connectBrowserViaCdp(endpoint) {
+  return loadChromium().connectOverCDP(endpoint);
+}
+
 function buildEvaluationExpression(callbackOrExpression, argument) {
   if (typeof callbackOrExpression === 'string') return callbackOrExpression;
   if (typeof callbackOrExpression !== 'function') {
@@ -31,4 +47,4 @@ async function evaluatePageViaCdp(page, callbackOrExpression, argument) {
   }
 }
 
-module.exports = { buildEvaluationExpression, evaluatePageViaCdp };
+module.exports = { buildEvaluationExpression, connectBrowserViaCdp, evaluatePageViaCdp };

package/adapters/extension/sidepanel-toggle.sh

@@ -7,7 +7,8 @@
 #
 # Inputs: subcommand (status|open|close|toggle|cycle, default status);
 #   --cdp-port <port> (required), --ext-id <id>, --agent-dir <dir>,
-#   --settle-ms <ms>; env REPO, CDP_PORT, EXT_ID, SETTLE_MS, AGENT_DIR.
+#   --settle-ms <ms>, --dapp-url <url>; env REPO, CDP_PORT, EXT_ID,
+#   SETTLE_MS, AGENT_DIR, EXTENSION_START_URL.
 # Outputs: status/progress lines on stdout.
 #   Exit 0 — action done; 1 — repo/args missing or action failed;
 #   2 — non-numeric port / CDP unreachable.
@@ -30,7 +31,7 @@ set -euo pipefail
 
 ACTION="${1:-status}"
 if [ "$ACTION" = "-h" ] || [ "$ACTION" = "--help" ]; then
-  echo "Usage: sidepanel-toggle.sh <status|open|close|toggle|cycle> --cdp-port <port> [--ext-id <id>] [--agent-dir <dir>] [--settle-ms <ms>]"
+  echo "Usage: sidepanel-toggle.sh <status|open|close|toggle|cycle> --cdp-port <port> [--ext-id <id>] [--agent-dir <dir>] [--settle-ms <ms>] [--dapp-url <url>]"
   exit 0
 fi
 shift || true
@@ -68,6 +69,7 @@ CDP_PORT="${CDP_PORT:-}"
 EXT_ID="${EXT_ID:-}"
 SETTLE_MS="${SETTLE_MS:-10000}"
 AGENT_DIR="${AGENT_DIR:-$SCRIPT_DIR}"
+DAPP_URL="${EXTENSION_START_URL:-https://metamask.github.io/test-dapp/}"
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -75,8 +77,9 @@ while [[ $# -gt 0 ]]; do
     --ext-id) EXT_ID="$2"; shift 2 ;;
     --agent-dir) AGENT_DIR="$2"; shift 2 ;;
     --settle-ms) SETTLE_MS="$2"; shift 2 ;;
+    --dapp-url) DAPP_URL="$2"; shift 2 ;;
     -h|--help)
-      echo "Usage: sidepanel-toggle.sh <status|open|close|toggle|cycle> --cdp-port <port> [--ext-id <id>] [--agent-dir <dir>] [--settle-ms <ms>]"
+      echo "Usage: sidepanel-toggle.sh <status|open|close|toggle|cycle> --cdp-port <port> [--ext-id <id>] [--agent-dir <dir>] [--settle-ms <ms>] [--dapp-url <url>]"
       exit 0
       ;;
     *) echo "unknown arg: $1" >&2; exit 1 ;;
@@ -91,6 +94,10 @@ if ! [[ "$CDP_PORT" =~ ^[0-9]+$ ]]; then
   echo "FAIL: CDP port \"$CDP_PORT\" must be numeric" >&2
   exit 2
 fi
+case "$DAPP_URL" in
+  http://*|https://*) ;;
+  *) echo "FAIL: --dapp-url must use http or https" >&2; exit 1 ;;
+esac
 if ! curl -s -m 3 "http://127.0.0.1:${CDP_PORT}/json/version" >/dev/null 2>&1; then
   echo "FAIL: CDP not reachable on port ${CDP_PORT}" >&2
   exit 2
@@ -105,7 +112,44 @@ focus_browser() {
 }
 
 find_sidepanel_id() {
-  json_list | python3 -c "import json,sys; d=json.load(sys.stdin); ids=[t.get('id','') for t in d if t.get('type')=='page' and 'sidepanel.html' in t.get('url','')]; print(ids[0] if ids else '')"
+  local ext_id
+  ext_id="$(resolve_ext_id)"
+  json_list | EXT_ID="$ext_id" python3 -c "import json,os,sys; d=json.load(sys.stdin); ext=os.environ.get('EXT_ID',''); ids=[t.get('id','') for t in d if t.get('type')=='page' and t.get('url','').startswith('chrome-extension://'+ext+'/sidepanel.html')]; print(ids[0] if ids else '')"
+}
+
+find_dapp_id() {
+  json_list | DAPP_URL="$DAPP_URL" python3 -c "import json,os,sys; d=json.load(sys.stdin); wanted=os.environ['DAPP_URL'].rstrip('/'); ids=[t.get('id','') for t in d if t.get('type')=='page' and t.get('url','').rstrip('/')==wanted]; print(ids[0] if ids else '')"
+}
+
+surface_counts() {
+  local ext_id
+  ext_id="$(resolve_ext_id)"
+  json_list | EXT_ID="$ext_id" DAPP_URL="$DAPP_URL" python3 -c "import json,os,sys; d=json.load(sys.stdin); ext=os.environ.get('EXT_ID',''); wanted=os.environ['DAPP_URL'].rstrip('/'); pages=[t for t in d if t.get('type')=='page']; homes=sum(t.get('url','').startswith('chrome-extension://'+ext+'/home.html') for t in pages); panels=sum(t.get('url','').startswith('chrome-extension://'+ext+'/sidepanel.html') for t in pages); dapps=sum(t.get('url','').rstrip('/')==wanted for t in pages); products=sum(t.get('url','').startswith('chrome-extension://'+ext+'/') for t in pages); print(homes,panels,dapps,products)"
+}
+
+ensure_dapp_tab() {
+  [ -n "$(find_dapp_id)" ] && return 0
+  local encoded
+  encoded="$(DAPP_URL="$DAPP_URL" python3 -c "import os,urllib.parse; print(urllib.parse.quote(os.environ['DAPP_URL'], safe=''))")"
+  curl -fsS -X PUT "http://127.0.0.1:${CDP_PORT}/json/new?${encoded}" >/dev/null
+}
+
+ensure_home_page() {
+  local ext_id encoded home_ids first
+  ext_id="$(resolve_ext_id)"
+  [ -n "$ext_id" ] || { echo "FAIL: could not resolve extension id for CDP ${CDP_PORT}" >&2; return 1; }
+  home_ids="$(json_list | EXT_ID="$ext_id" python3 -c "import json,os,sys; d=json.load(sys.stdin); ext=os.environ.get('EXT_ID',''); print('\\n'.join(t.get('id','') for t in d if t.get('type')=='page' and t.get('url','').startswith('chrome-extension://'+ext+'/home.html')))" )"
+  if [ -n "$home_ids" ]; then
+    first=1
+    while IFS= read -r target_id; do
+      [ -n "$target_id" ] || continue
+      if [ "$first" -eq 1 ]; then first=0; continue; fi
+      curl -fsS "http://127.0.0.1:${CDP_PORT}/json/close/${target_id}" >/dev/null
+    done <<< "$home_ids"
+    return 0
+  fi
+  encoded="$(EXT_ID="$ext_id" python3 -c "import os,urllib.parse; print(urllib.parse.quote('chrome-extension://'+os.environ['EXT_ID']+'/home.html#/', safe=''))")"
+  curl -fsS -X PUT "http://127.0.0.1:${CDP_PORT}/json/new?${encoded}" >/dev/null
 }
 
 resolve_ext_id() {
@@ -172,6 +216,20 @@ wait_for_sidepanel() {
   done
 }
 
+wait_for_surface_invariant() {
+  local expected="$1" start deadline now home_count panel_count dapp_count product_count
+  start="$(now_ms)"
+  deadline=$((start + SETTLE_MS))
+  while :; do
+    read -r home_count panel_count dapp_count product_count <<< "$(surface_counts)"
+    if [ "$expected" = "fullscreen" ] && [ "$home_count" -eq 1 ] && [ "$panel_count" -eq 0 ] && [ "$product_count" -eq 1 ]; then return 0; fi
+    if [ "$expected" = "sidepanel" ] && [ "$home_count" -eq 0 ] && [ "$panel_count" -eq 1 ] && [ "$dapp_count" -eq 1 ] && [ "$product_count" -eq 1 ]; then return 0; fi
+    now="$(now_ms)"
+    [ "$now" -lt "$deadline" ] || return 1
+    sleep 0.2
+  done
+}
+
 print_targets() {
   json_list | python3 -c "import json,sys; d=json.load(sys.stdin); [print(f'  {t.get(\"type\",\"?\")[:18]:18s} {t.get(\"url\",\"\")[:100]}') for t in d]"
 }
@@ -179,7 +237,7 @@ print_targets() {
 activate_dapp_tab() {
   local target_id
   target_id="$(
-    json_list | python3 -c "import json,sys; d=json.load(sys.stdin); pages=[t for t in d if t.get('type')=='page']; target=next((t for t in pages if t.get('url','').startswith('http://') or t.get('url','').startswith('https://')), None); print(target.get('id','') if target else '')"
+    json_list | DAPP_URL="$DAPP_URL" python3 -c "import json,os,sys; d=json.load(sys.stdin); wanted=os.environ['DAPP_URL'].rstrip('/'); pages=[t for t in d if t.get('type')=='page']; target=next((t for t in pages if t.get('url','').rstrip('/')==wanted), None); print(target.get('id','') if target else '')"
   )"
   if [ -n "$target_id" ] && focus_browser; then
     curl -s "http://127.0.0.1:${CDP_PORT}/json/activate/${target_id}" >/dev/null || true
@@ -191,7 +249,7 @@ cleanup_sidepanel_tabs() {
   ext_id="$(resolve_ext_id)"
   [ -n "$ext_id" ] || return 0
   close_ids="$(
-    json_list | EXT_ID="$ext_id" python3 -c "import json,os,sys; d=json.load(sys.stdin); ext=os.environ.get('EXT_ID',''); has_panel=any(t.get('type')=='page' and t.get('url','').startswith('chrome-extension://'+ext+'/') and 'sidepanel.html' in t.get('url','') for t in d); has_dapp=any(t.get('type')=='page' and (t.get('url','').startswith('http://') or t.get('url','').startswith('https://')) for t in d); print('\\n'.join(t.get('id','') for t in d if has_panel and has_dapp and t.get('type')=='page' and t.get('url','').startswith('chrome-extension://'+ext+'/') and 'home.html' in t.get('url','')))"
+    json_list | EXT_ID="$ext_id" DAPP_URL="$DAPP_URL" python3 -c "import json,os,sys; d=json.load(sys.stdin); ext=os.environ.get('EXT_ID',''); wanted=os.environ['DAPP_URL'].rstrip('/'); has_panel=any(t.get('type')=='page' and t.get('url','').startswith('chrome-extension://'+ext+'/sidepanel.html') for t in d); has_dapp=any(t.get('type')=='page' and t.get('url','').rstrip('/')==wanted for t in d); print('\\n'.join(t.get('id','') for t in d if has_panel and has_dapp and t.get('type')=='page' and t.get('url','').startswith('chrome-extension://'+ext+'/home.html')))"
   )"
   if [ -n "$close_ids" ]; then
     while IFS= read -r target_id; do
@@ -202,6 +260,18 @@ cleanup_sidepanel_tabs() {
   activate_dapp_tab
 }
 
+dedupe_sidepanel_tabs() {
+  local ext_id sidepanel_ids first
+  ext_id="$(resolve_ext_id)"
+  sidepanel_ids="$(json_list | EXT_ID="$ext_id" python3 -c "import json,os,sys; d=json.load(sys.stdin); ext=os.environ.get('EXT_ID',''); print('\\n'.join(t.get('id','') for t in d if t.get('type')=='page' and t.get('url','').startswith('chrome-extension://'+ext+'/sidepanel.html')))" )"
+  first=1
+  while IFS= read -r target_id; do
+    [ -n "$target_id" ] || continue
+    if [ "$first" -eq 1 ]; then first=0; continue; fi
+    curl -fsS "http://127.0.0.1:${CDP_PORT}/json/close/${target_id}" >/dev/null
+  done <<< "$sidepanel_ids"
+}
+
 status_sidepanel() {
   local sp
   sp="$(find_sidepanel_id)"
@@ -217,15 +287,22 @@ close_sidepanel() {
   sp="$(find_sidepanel_id)"
   if [ -z "$sp" ]; then
     echo "[sidepanel] already closed"
+    ensure_home_page
+    wait_for_surface_invariant fullscreen || { echo "FAIL: fullscreen surface did not converge to one Home target" >&2; return 1; }
     return 0
   fi
   curl -s "http://127.0.0.1:${CDP_PORT}/json/close/${sp}" >/dev/null
+  ensure_home_page
+  wait_for_surface_invariant fullscreen || { echo "FAIL: fullscreen surface did not converge to one Home target" >&2; return 1; }
   echo "[sidepanel] closed target ${sp}"
 }
 
 open_sidepanel() {
+  ensure_dapp_tab
   if [ -n "$(find_sidepanel_id)" ]; then
+    dedupe_sidepanel_tabs
     cleanup_sidepanel_tabs
+    wait_for_surface_invariant sidepanel || { echo "FAIL: sidepanel surface did not converge to one panel and a dapp host" >&2; return 1; }
     echo "[sidepanel] already open"
     return 0
   fi
@@ -239,13 +316,54 @@ open_sidepanel() {
     exit 4
   fi
 
-  CDP_PORT="$CDP_PORT" EXT_ID="$ext_id" SCRIPT_DIR="$SCRIPT_DIR" node <<'NODE'
-const { chromium } = require('playwright');
+CDP_PORT="$CDP_PORT" EXT_ID="$ext_id" SCRIPT_DIR="$SCRIPT_DIR" node <<'NODE'
+const path = require('node:path');
+const {
+  connectBrowserViaCdp,
+  evaluatePageViaCdp,
+} = require(path.join(process.env.SCRIPT_DIR, 'lib/playwright-cdp.cjs'));
+
+async function clickVisibleSafeHit(page, selector, successSelector, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (await page.locator(successSelector).isVisible().catch(() => false)) return;
+    const candidate = page.locator(selector);
+    const count = await candidate.count();
+    if (count > 1) throw new Error(`expected one visible ${selector} control, found ${count}`);
+    if (count === 1 && await candidate.isVisible().catch(() => false)) {
+      try {
+        const point = await evaluatePageViaCdp(page, (candidateSelector) => {
+          const matches = [...document.querySelectorAll(candidateSelector)];
+          if (matches.length !== 1) return null;
+          const [element] = matches;
+          const rect = element.getBoundingClientRect();
+          const points = [
+            [rect.left + rect.width / 2, rect.top + rect.height / 2],
+            [rect.left + rect.width / 4, rect.top + rect.height / 2],
+            [rect.left + rect.width * 3 / 4, rect.top + rect.height / 2],
+            [rect.left + rect.width / 2, rect.top + rect.height / 4],
+            [rect.left + rect.width / 2, rect.top + rect.height * 3 / 4],
+          ];
+          const safe = points.find(([x, y]) => {
+            const hit = document.elementFromPoint(x, y);
+            return hit === element || Boolean(hit && element.contains(hit));
+          });
+          return safe ? { x: safe[0], y: safe[1] } : null;
+        }, selector);
+        if (point) await page.mouse.click(point.x, point.y);
+      } catch (error) {
+        if (!/detached|not attached|execution context was destroyed/iu.test(String(error?.message || error))) throw error;
+      }
+    }
+    await page.waitForTimeout(50);
+  }
+  throw new Error(`visible ${selector} control did not activate within ${timeoutMs}ms`);
+}
 
 (async () => {
   const port = process.env.CDP_PORT;
   const extId = process.env.EXT_ID;
-  const browser = await chromium.connectOverCDP(`http://127.0.0.1:${port}`);
+  const browser = await connectBrowserViaCdp(`http://127.0.0.1:${port}`);
   const context = browser.contexts()[0];
   const page = await context.newPage();
   try {
@@ -256,11 +374,13 @@ const { chromium } = require('playwright');
     if (process.env.MM_HARNESS_FOCUS_BROWSER === '1') {
       await page.bringToFront();
     }
-    const menu = page.locator('[data-testid="account-options-menu-button"]');
-    await menu.waitFor({ state: 'visible', timeout: 15000 });
-    await menu.click({ timeout: 5000 });
+    await clickVisibleSafeHit(
+      page,
+      '[data-testid="account-options-menu-button"]',
+      '[data-testid="global-menu-toggle-view"]',
+      5000,
+    );
     const toggle = page.locator('[data-testid="global-menu-toggle-view"]');
-    await toggle.waitFor({ state: 'visible', timeout: 10000 });
     await toggle.click({ timeout: 5000 });
   } finally {
     if (!page.isClosed()) await page.close();
@@ -277,7 +397,9 @@ const { chromium } = require('playwright');
 NODE
 
   if wait_for_sidepanel; then
+    dedupe_sidepanel_tabs
     cleanup_sidepanel_tabs
+    wait_for_surface_invariant sidepanel || { echo "FAIL: sidepanel surface did not converge to one panel and a dapp host" >&2; return 1; }
     echo "[sidepanel] opened"
     return 0
   fi

package/dist/adapters/mobile/release-artifact.js

@@ -89,6 +89,70 @@ function assertAndroidReleaseArtifactRuntime(identity, deps = defaultDeps) {
   const adb = resolveAdb(deps);
   assertInstalledAndroidReleaseArtifact(identity, deps, adb);
 }
+function readAndroidNativeRuntimeIdentity(identity, deps = defaultDeps) {
+  assertAndroidReleaseArtifactRuntime(identity, deps);
+  const adb = resolveAdb(deps);
+  const buildFingerprint = runChecked(deps, adb, [
+    "-s",
+    identity.deviceSerial,
+    "shell",
+    "getprop",
+    "ro.build.fingerprint"
+  ]).trim();
+  if (!/^[A-Za-z0-9._+:/=-]{1,512}$/u.test(buildFingerprint)) {
+    throw new Error(`Android device ${identity.deviceSerial} returned an invalid build fingerprint.`);
+  }
+  const bootId = runChecked(deps, adb, [
+    "-s",
+    identity.deviceSerial,
+    "shell",
+    "cat",
+    "/proc/sys/kernel/random/boot_id"
+  ]).trim().toLowerCase();
+  if (!/^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/u.test(bootId)) {
+    throw new Error(`Android device ${identity.deviceSerial} returned an invalid boot ID.`);
+  }
+  const pids = runChecked(deps, adb, [
+    "-s",
+    identity.deviceSerial,
+    "shell",
+    "pidof",
+    identity.packageId
+  ]).trim().split(/\s+/u).filter(Boolean);
+  if (pids.length !== 1 || !/^\d+$/u.test(pids[0])) {
+    throw new Error(`Android package ${identity.packageId} must have exactly one running app process on ${identity.deviceSerial}.`);
+  }
+  const pid = pids[0];
+  const processStat = runChecked(deps, adb, [
+    "-s",
+    identity.deviceSerial,
+    "shell",
+    "cat",
+    `/proc/${pid}/stat`
+  ]).trim();
+  const close = processStat.lastIndexOf(") ");
+  const processFields = close === -1 ? [] : processStat.slice(close + 2).trim().split(/\s+/u);
+  const startTimeTicks = processFields[19] ?? "";
+  if (!/^\d+$/u.test(startTimeTicks)) {
+    throw new Error(`Android package ${identity.packageId} returned an invalid process start time on ${identity.deviceSerial}.`);
+  }
+  const payload = {
+    schemaVersion: 1,
+    platform: "android",
+    deviceSerial: identity.deviceSerial,
+    buildFingerprint,
+    bootId,
+    packageId: identity.packageId,
+    versionName: identity.versionName,
+    versionCode: identity.versionCode,
+    sha256: identity.sha256,
+    appProcess: { pid, startTimeTicks }
+  };
+  return {
+    ...payload,
+    runtimeSessionId: createHash("sha256").update(JSON.stringify(payload)).digest("hex")
+  };
+}
 async function relaunchAndroidReleaseArtifactRuntime(identity, deps = defaultDeps) {
   assertAndroidReleaseArtifactRuntime(identity, deps);
   const adb = resolveAdb(deps);
@@ -291,5 +355,6 @@ const defaultDeps = {
 export {
   assertAndroidReleaseArtifactRuntime,
   installAndroidReleaseArtifact,
+  readAndroidNativeRuntimeIdentity,
   relaunchAndroidReleaseArtifactRuntime
 };

package/dist/adapters.js

@@ -1,4 +1,5 @@
 import http from "node:http";
+import { createHash } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { compatibilityMode, fixtureSummary, repoShape } from "./doctor.js";
@@ -45,7 +46,6 @@ const LIVE_ONLY_ACTIONS = /* @__PURE__ */ new Set([
   "metamask.assets.import_custom_token",
   "metamask.assets.prepare_send",
   "metamask.assets.review_send",
-  "metamask.assets.finish_send",
   "metamask.assets.set_custom_gas",
   "metamask.assets.select_network_scope",
   "metamask.wallet.lock",
@@ -66,6 +66,7 @@ const LIVE_ONLY_ACTIONS = /* @__PURE__ */ new Set([
   "metamask.perps.edit_margin",
   "metamask.perps.update_position_tpsl",
   "metamask.perps.read_funds_confirmation",
+  "metamask.perps.assert_visible_consistency",
   "metamask.swap_bridge.read_visible_state",
   "metamask.swap_bridge.select_assets",
   "metamask.swap_bridge.set_amount",
@@ -164,7 +165,7 @@ async function semanticResult(platform, action, node, context, forceLive = false
         ...output,
         credentialSource: credentials.source,
         credentialSourceName: credentials.sourceName,
-        expectedAddress: credentials.expectedAddress
+        expectedIdentitySha256: createHash("sha256").update(credentials.expectedAddress).digest("hex")
       }
     };
   }
@@ -261,7 +262,6 @@ function createMetaMaskSemanticAdapters(platform, declaredCustomActions = [], pr
     ...platform === "extension" ? [
       "metamask.assets.prepare_send",
       "metamask.assets.review_send",
-      "metamask.assets.finish_send",
       "metamask.assets.set_custom_gas",
       "metamask.assets.select_network_scope"
     ] : [],
@@ -278,25 +278,26 @@ function createMetaMaskSemanticAdapters(platform, declaredCustomActions = [], pr
     ...platform === "extension" ? [
       "metamask.perps.open_position_action",
       "metamask.perps.edit_margin",
-      "metamask.perps.update_position_tpsl"
+      "metamask.perps.update_position_tpsl",
+      "metamask.perps.assert_visible_consistency"
     ] : [],
     "metamask.swap_bridge.read_visible_state",
     "metamask.swap_bridge.select_assets",
     "metamask.swap_bridge.set_amount",
     "metamask.swap_bridge.set_max_amount",
     "metamask.swap_bridge.set_slippage",
-    "metamask.swap_bridge.submit_transaction",
+    ...platform === "mobile" ? ["metamask.swap_bridge.submit_transaction"] : [],
     ...platform === "extension" ? ["metamask.settings.set_basic_functionality"] : [],
     "metamask.perps.read_positions",
     "metamask.perps.ensure_positions",
     "metamask.perps.assert_positions",
     "metamask.perps.place_order",
-    "metamask.perps.close_positions",
+    ...platform === "mobile" || platform === "core" ? ["metamask.perps.close_positions"] : [],
     "metamask.perps.read_orders",
     "metamask.perps.close_orders",
     "metamask.perps.ensure_orders",
     "metamask.perps.assert_orders",
-    "metamask.perps.start_state",
+    ...platform === "mobile" || platform === "core" ? ["metamask.perps.start_state"] : [],
     "metamask.perps.teardown_state",
     "metamask.perps.capture_performance",
     ...platform === "extension" || platform === "core" ? ["metamask.perps.read_snapshot"] : [],

package/dist/command-contract.js

@@ -31,6 +31,12 @@ const RECIPE_RUNTIME = {
   "--source-digest": value(),
   "--approve-plan": value()
 };
+const RUN_FUNDING = {
+  "--funding-request": value(),
+  "--funding-preflight": value(),
+  "--funding-release-proof": value(),
+  "--funding-balance-proof": value()
+};
 const RUNWAY = {
   "--branch": value(),
   "--default-branch": value(),
@@ -158,10 +164,11 @@ const PUBLIC_COMMAND_CONTRACTS = {
     variadic: { label: "key=value", pattern: /^[^=\s]+=.*/u }
   },
   run: {
-    options: options(HELP, JSON, JSON_STREAM, TARGET, ADAPTER, MOBILE_PLATFORM, DEVICE, RUNTIME_PORTS, RECIPE_RUNTIME, {
+    options: options(HELP, JSON, JSON_STREAM, TARGET, ADAPTER, MOBILE_PLATFORM, DEVICE, RUNTIME_PORTS, RECIPE_RUNTIME, RUN_FUNDING, {
       "--list": bool(),
       "--plan": bool(),
-      "--describe": bool()
+      "--describe": bool(),
+      "--hud": value(["auto", "show", "hide"])
     }),
     positionals: [{ label: "recipe" }],
     minimumPositionals: 1,
@@ -232,6 +239,7 @@ const PUBLIC_COMMAND_CONTRACTS = {
       "--verify": bool(),
       "--runway": bool(),
       "--watch": bool(),
+      "--surface": value(["fullscreen", "sidepanel"]),
       "--sidepanel": bool(),
       "--fullscreen": bool(),
       "--url": value(),

package/dist/commands/call.js

@@ -208,16 +208,19 @@ async function handleCall(argv) {
   const artifactsDir = optionString(options, "artifactsDir") ?? defaultCallArtifactsDir(target, resolvedAction, args);
   recordCommandEvidence(artifactsDir);
   const requestedRuntimeOptions = runtimeOptionsFromCli(options);
+  const inheritedSource = process.env.FARMSLOT_RECIPE_SOURCE_TRUST || process.env.FARMSLOT_RECIPE_SOURCE_KIND || process.env.FARMSLOT_RECIPE_SOURCE_NAME || process.env.FARMSLOT_RECIPE_SOURCE_DIGEST;
   const callRuntimeOptions = {
     ...requestedRuntimeOptions,
     ...librarySources ? { librarySources } : {},
     autoHud: false,
     suppressLibraryResolutionLogs: true,
     stdoutIsMachineContract: json,
-    source: requestedRuntimeOptions.source ?? {
-      kind: "operator",
-      trust: "trusted",
-      name: "mm-harness call"
+    ...requestedRuntimeOptions.source ? { source: requestedRuntimeOptions.source } : inheritedSource ? {} : {
+      source: {
+        kind: "operator",
+        trust: "trusted",
+        name: "mm-harness call"
+      }
     }
   };
   let preflightedExecution;

package/dist/commands/launch/index.js

@@ -37,6 +37,10 @@ import { acquireCheckoutLock } from "../../checkout-lock.js";
 import { JsonStreamWriter } from "../../json-stream.js";
 import { ensureExtensionConsoleCapture } from "../../adapters/extension/console-capture.js";
 import { extensionProductConfigBlock } from "../../adapters/extension/product-config.js";
+import {
+  releaseArtifactState,
+  runtimeDistCheck
+} from "../../adapters/extension/runtime-decision.js";
 const LAUNCH_BOOLEANS = /* @__PURE__ */ new Set([
   "build",
   "watch",
@@ -124,13 +128,41 @@ async function handleLaunchLocked(argv, stream) {
   const wantWatch = flag(options, "watch");
   const wantRunway = flag(options, "runway");
   const wantClearMetro = flag(options, "clearMetro");
+  const requestedSurface = str(options, "surface");
+  const legacySidepanel = flag(options, "sidepanel");
+  const legacyFullscreen = flag(options, "fullscreen");
   if (wantRunway && adapter !== "mobile") {
     return launchUsage(jsonOutput, stream, "runway is mobile-only.", "drop --runway for the extension");
   }
   if (wantClearMetro && adapter !== "mobile") {
     return launchUsage(jsonOutput, stream, "--clear-metro is mobile-only.", "drop --clear-metro for the extension");
   }
-  const displayMode = flag(options, "sidepanel") && !flag(options, "fullscreen") ? "sidepanel" : "fullscreen";
+  if (requestedSurface !== void 0 && requestedSurface !== "fullscreen" && requestedSurface !== "sidepanel") {
+    return launchUsage(
+      jsonOutput,
+      stream,
+      `--surface must be fullscreen or sidepanel (got: ${requestedSurface}).`,
+      "pass --surface fullscreen or --surface sidepanel"
+    );
+  }
+  if (legacySidepanel && legacyFullscreen) {
+    return launchUsage(
+      jsonOutput,
+      stream,
+      "--sidepanel and --fullscreen conflict.",
+      "pass exactly one Extension surface"
+    );
+  }
+  const legacySurface = legacySidepanel ? "sidepanel" : legacyFullscreen ? "fullscreen" : void 0;
+  if (requestedSurface && legacySurface && requestedSurface !== legacySurface) {
+    return launchUsage(
+      jsonOutput,
+      stream,
+      `--surface ${requestedSurface} conflicts with --${legacySurface}.`,
+      "pass one consistent Extension surface"
+    );
+  }
+  const displayMode = requestedSurface ?? legacySurface ?? "fullscreen";
   for (const portFlag of ["cdpPort", "watcherPort"]) {
     const value = str(options, portFlag);
     if (value !== void 0 && !/^\d+$/u.test(value)) {
@@ -189,7 +221,11 @@ async function handleLaunchLocked(argv, stream) {
   }
   stream.phase("healthcheck");
   if (adapter === "extension") {
-    const willBuild = wantWatch || tier === "build" || !await extensionRuntimeReusable(target);
+    const artifact = releaseArtifactState(target);
+    const reusable = !wantWatch && tier !== "build" && await extensionRuntimeReusable(target, artifact);
+    const verifiedReleaseReuse = artifact.status === "valid" && reusable;
+    const verifiedReleaseLaunch = !wantWatch && tier !== "build" && artifact.status === "valid" && runtimeDistCheck(target, artifact).status === "fresh";
+    const willBuild = !reusable;
     if (willBuild) {
       const productConfigBlock = extensionProductConfigBlock(target);
       if (productConfigBlock) {
@@ -202,7 +238,7 @@ async function handleLaunchLocked(argv, stream) {
         });
       }
     }
-    const depsBlock = extensionDepsBlock(target);
+    const depsBlock = verifiedReleaseReuse || verifiedReleaseLaunch ? null : extensionDepsBlock(target);
     if (depsBlock) {
       if (heal === "off") {
         return launchUsage(jsonOutput, stream, depsBlock.message, depsBlock.userAction);
@@ -498,6 +534,22 @@ async function executeComposition(adapter, mobileTarget, tier, wantWatch, target
   return launchExtension(target, tier, wantWatch, displayMode);
 }
 async function finishLaunch(jsonOutput, machine, stream, adapter, mobileTarget, tier, displayMode, target, state, wantWatch, wantVerify, sidepanelRecoveryAllowed = true) {
+  if (adapter === "extension" && displayMode === "fullscreen") {
+    const sidepanelSh = path.join(runnerDir, "adapters/extension/sidepanel-toggle.sh");
+    const sidepanelArgs = ["close"];
+    if (process.env.CDP_PORT) sidepanelArgs.push("--cdp-port", process.env.CDP_PORT);
+    const fullscreen = spawnScript(sidepanelSh, sidepanelArgs, target, machine, { REPO: target });
+    if (fullscreen.status !== 0) {
+      return launchFail(jsonOutput, stream, adapter, mobileTarget, tier, state, target, {
+        code: "FULLSCREEN_OPEN_FAILED",
+        message: "app launched but restoring the fullscreen Extension surface failed.",
+        recoverable: false,
+        userAction: `bash adapters/extension/sidepanel-toggle.sh close --cdp-port ${process.env.CDP_PORT ?? "<CDP_PORT>"}`,
+        exitCode: EXIT.runtime,
+        originalError: fullscreen.output.trim() || void 0
+      });
+    }
+  }
   if (adapter === "extension" && displayMode === "sidepanel") {
     const sidepanelSh = path.join(runnerDir, "adapters/extension/sidepanel-toggle.sh");
     const sidepanelArgs = ["open"];