@deeeed/metamask-harness 0.39.0 → 0.40.0

package/dist/commands/parse-args.js

@@ -196,6 +196,7 @@ function parsePort(value, errorMessage) {
 }
 function runtimeOptionsFromCli(options) {
   const recordVideo = options.recordVideo;
+  const hud = optionString(options, "hud");
   const trust = explicitRecipeTrustOptions({
     sourceTrust: optionString(options, "sourceTrust"),
     sourceKind: optionString(options, "sourceKind"),
@@ -210,6 +211,11 @@ function runtimeOptionsFromCli(options) {
     slot: optionString(options, "slot"),
     validationRuntimeDir: optionString(options, "validationRuntimeDir"),
     recordVideo: recordVideo === "full-run" ? "full-run" : false,
+    autoHud: hud === "show" ? true : hud === "hide" ? false : void 0,
+    fundingRequest: optionString(options, "fundingRequest"),
+    fundingPreflight: optionString(options, "fundingPreflight"),
+    fundingReleaseProof: optionString(options, "fundingReleaseProof"),
+    fundingBalanceProof: optionString(options, "fundingBalanceProof"),
     ...trust
   };
 }

package/dist/commands/run-engine.js

@@ -23,8 +23,15 @@ import {
 } from "../paths.js";
 import { captureHelperSupportsRecordSessionSnapshots } from "../recording-target.js";
 import { startRecipeRecording, stopRecipeRecording } from "../run-recording.js";
-import { validateMetaMaskActionInputs } from "../metamask-action-validation.js";
+import {
+  resolveMetaMaskParameterValue,
+  validateMetaMaskActionInputs
+} from "../metamask-action-validation.js";
 import { gitLibraryProvenance } from "../library-provenance.js";
+import {
+  authorizeTrustedMutationPlan,
+  loadTrustedMutationBase
+} from "../funding-execution-context.js";
 import {
   beginRunDiagnostics,
   finishRunDiagnostics
@@ -139,9 +146,18 @@ async function resolveRecipeExecution(adapter, recipe, artifactsDir, projectRoot
   );
   const { createMetaMaskRunner } = await import("../runner.js");
   const recipeDocument = runtimeRecipeDocument(recipe, absoluteRecipePath);
+  const trustedMutation = await loadTrustedMutationBase({
+    fundingRequest: runtimeOptions.fundingRequest,
+    fundingPreflight: runtimeOptions.fundingPreflight,
+    fundingReleaseProof: runtimeOptions.fundingReleaseProof,
+    fundingBalanceProof: runtimeOptions.fundingBalanceProof,
+    artifactsDir: absoluteArtifactsDir,
+    projectRoot,
+    rootRecipe: recipeDocument
+  });
   const suppressHudForLifecycleTiming = adapter === "mobile" && mobileRecipeRequiresUninterruptedLifecycleTiming(recipeDocument);
   const suppressHudForOpaqueMobile = adapter === "mobile" && process.env.METAMASK_RECIPE_MOBILE_OPAQUE_RUNTIME === "1";
-  const runner = await createMetaMaskRunner(adapter, manifest, {
+  const runnerOptions = {
     quietStdout: runtimeOptions.stdoutIsMachineContract === true,
     suppressLibraryResolutionLogs: runtimeOptions.suppressLibraryResolutionLogs,
     autoHud: suppressHudForLifecycleTiming || suppressHudForOpaqueMobile ? false : trust.source && trust.source.trust !== "trusted" ? false : runtimeOptions.autoHud,
@@ -151,28 +167,41 @@ async function resolveRecipeExecution(adapter, recipe, artifactsDir, projectRoot
     // task-local adapter. Inherited gateway provenance remains authoritative,
     // so an untrusted worker cannot promote itself with CLI flags.
     trustTaskActions: (trust.source?.trust ?? "trusted") === "trusted"
+  };
+  let runner = await createMetaMaskRunner(adapter, manifest, {
+    ...runnerOptions,
+    trustedMutation
   });
   const useFramedExtensionRecording = adapter === "extension" && recordVideo === "full-run" && trust.source?.trust !== "untrusted" && trust.source?.trust !== "unknown" && captureHelperSupportsRecordSessionSnapshots(projectRoot);
+  const runRequest = {
+    ...absoluteRecipePath ? { recipePath: absoluteRecipePath } : { recipeDocument: recipe },
+    artifactsDir: absoluteArtifactsDir,
+    projectRoot,
+    inheritProcessEnv: false,
+    env: {
+      ...recipeProcessEnvironment(),
+      ...recipeRunEnv(adapter, runtimeOptions),
+      METAMASK_RECIPE_ACTION_SOURCE_MAP: actionSourceMap(actionSources)
+    },
+    recordVideo: useFramedExtensionRecording ? false : recordVideo,
+    ...trust,
+    ...librarySources ? { librarySources } : {},
+    adapter,
+    ...runtimeOptions.params ? { params: runtimeOptions.params } : {}
+  };
+  if (trustedMutation) {
+    const executionPlan = await runner.preflight(runRequest);
+    const authorizedMutation = await authorizeTrustedMutationPlan(trustedMutation, executionPlan);
+    runner = await createMetaMaskRunner(adapter, manifest, {
+      ...runnerOptions,
+      trustedMutation: authorizedMutation
+    });
+  }
   return {
     runner,
     absoluteArtifactsDir,
     useFramedExtensionRecording,
-    runRequest: {
-      ...absoluteRecipePath ? { recipePath: absoluteRecipePath } : { recipeDocument: recipe },
-      artifactsDir: absoluteArtifactsDir,
-      projectRoot,
-      inheritProcessEnv: false,
-      env: {
-        ...recipeProcessEnvironment(),
-        ...recipeRunEnv(adapter, runtimeOptions),
-        METAMASK_RECIPE_ACTION_SOURCE_MAP: actionSourceMap(actionSources)
-      },
-      recordVideo: useFramedExtensionRecording ? false : recordVideo,
-      ...trust,
-      ...librarySources ? { librarySources } : {},
-      adapter,
-      ...runtimeOptions.params ? { params: runtimeOptions.params } : {}
-    }
+    runRequest
   };
 }
 function runtimeRecipeDocument(recipe, absoluteRecipePath) {
@@ -201,8 +230,7 @@ function recipeProcessEnvironment() {
 }
 function executionLibrarySources(sources, invocationTrust) {
   return sources?.map((source) => {
-    if (source.name === "metamask" || source.provenance?.trust === "trusted")
-      return source;
+    if (source.name === "metamask") return source;
     return {
       ...source,
       provenance: {
@@ -347,7 +375,7 @@ async function validateRecipeAdapterAware(adapter, recipe, manifest, librarySour
   );
   const findings = [
     ...withManifest.findings,
-    ...validateMetaMaskActionInputs(recipe, adapter)
+    ...validateMetaMaskActionInputs(recipe, adapter, params)
   ];
   if (withManifest.status === "valid" && isRecord(recipe) && libraryResolution) {
     try {
@@ -376,10 +404,26 @@ async function validateRecipeAdapterAware(adapter, recipe, manifest, librarySour
             dependency.document,
             manifest,
             validationOptions
-          ).findings,
-          ...validateMetaMaskActionInputs(dependency.document, adapter)
+          ).findings
         );
       }
+      const validateDependencyInstances = (document, parentParams) => {
+        if (!isRecord(document) || !isRecord(document.workflow) || !isRecord(document.workflow.nodes)) return;
+        for (const rawNode of Object.values(document.workflow.nodes)) {
+          const node = resolveMetaMaskParameterValue(rawNode, parentParams);
+          if (!isRecord(node) || node.action !== "call" || typeof node.ref !== "string") continue;
+          const dependency = dependencies.recipes.get(protocol.normalizeRecipeRef(node.ref));
+          if (!dependency) continue;
+          const supplied = isRecord(node.params) ? node.params : {};
+          const childParams = protocol.applyRecipeParamDefaults(
+            supplied,
+            isRecord(dependency.document) ? dependency.document.paramsSchema : void 0
+          );
+          findings.push(...validateMetaMaskActionInputs(dependency.document, adapter, childParams));
+          validateDependencyInstances(dependency.document, childParams);
+        }
+      };
+      validateDependencyInstances(recipe, params ?? {});
     } catch (error) {
       const resolutionError = error instanceof harness.RecipeResolutionError ? error : void 0;
       if (!resolutionError) throw error;
@@ -429,13 +473,19 @@ function effectiveLibrarySources(librarySources) {
 }
 async function listRunnableRecipes(adapter, librarySources) {
   const harness = await importRecipeHarness();
+  const sources = effectiveLibrarySources(librarySources);
   const resolution = await harness.loadRecipeLibraries(
-    effectiveLibrarySources(librarySources),
+    sources,
     {
       adapter
     }
   );
-  return [...resolution.recipes.values()].map(
+  const protocol = await importRecipeProtocol();
+  const { manifest } = await resolveActionManifest(adapter, void 0, sources);
+  const externalRecipeIds = new Set(resolution.recipes.keys());
+  return [...resolution.recipes.values()].filter((recipe) => protocol.validateRecipeWithManifest(recipe.document, manifest, {
+    externalRecipeIds
+  }).status === "valid").map(
     (recipe) => recipeSummary(recipe.ref, adapter, recipe.document, recipe)
   ).sort((left, right) => left.name.localeCompare(right.name));
 }
@@ -630,20 +680,6 @@ async function validateRunRecipeStatic(recipeArg, adapter, options, params = {})
     findings.push(
       ...protocol.validateRecipeParams(effectiveParams, recipe.paramsSchema).findings
     );
-    const workflow = isRecord(recipe.workflow) ? recipe.workflow : void 0;
-    const nodes = workflow && isRecord(workflow.nodes) ? workflow.nodes : void 0;
-    if (adapter === "extension" && nodes) {
-      for (const [nodeId, node] of Object.entries(nodes)) {
-        if (isRecord(node) && node.action === "metamask.perps.start_state" && node.page === false) {
-          findings.push({
-            severity: "error",
-            code: "recipe.extension-perps-start-page",
-            path: `workflow.nodes.${nodeId}.page`,
-            message: "Extension metamask.perps.start_state must enter Perps; omit page or provide a string target instead of false"
-          });
-        }
-      }
-    }
   }
   const validation = manifestOk ? await validateRecipeAdapterAware(
     adapter,