@deeeed/metamask-harness 0.58.0 → 0.60.0

package/dist/adapters/extension/runtime-decision.js

@@ -11,7 +11,6 @@ import { recipeHarnessPath, recipeRuntimeDir, recipeWatchLogCandidates } from ".
 const WEBPACK_DIRECT_INPUTS = ["package.json", "yarn.lock", ".yarnrc.yml", ".tool-versions"];
 const WEBPACK_RECURSIVE_INPUTS = ["development/webpack"];
 const WEBPACK_CACHE_DIR = "node_modules/.cache/webpack";
-const WATCH_LOG_CANDIDATES = recipeWatchLogCandidates();
 function git(target, args) {
   try {
     return execFileSync("git", ["-C", target, ...args], {
@@ -95,7 +94,7 @@ function webpackCacheCheck(target) {
   return { cachePresent: true, status, hasBaseline: true };
 }
 function buildLogCheck(target, watchLog) {
-  const candidates = (watchLog ? [path.isAbsolute(watchLog) ? watchLog : path.join(target, watchLog)] : WATCH_LOG_CANDIDATES.map((rel) => path.join(target, rel))).filter((file) => fs.existsSync(file));
+  const candidates = (watchLog ? [path.isAbsolute(watchLog) ? watchLog : path.join(target, watchLog)] : recipeWatchLogCandidates().map((rel) => path.join(target, rel))).filter((file) => fs.existsSync(file));
   if (!candidates.length) return { status: "no-watch" };
   const newestFirst = [...candidates].sort((a, b) => fs.statSync(b).mtimeMs - fs.statSync(a).mtimeMs);
   const lines = fs.readFileSync(newestFirst[0], "utf8").split("\n");
@@ -314,6 +313,7 @@ function normalizedRuntimeManifest(file) {
       delete manifest._flags.remoteFeatureFlags;
       if (Object.keys(manifest._flags).length === 0) delete manifest._flags;
     }
+    delete manifest._harness;
     return JSON.stringify(manifest);
   } catch {
     return null;

package/dist/adapters/extension/runtime.js

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { importRecipeHarnessRuntimeBrowserExtension, importRecipeHarnessRuntimeCdp, recipeHarnessPath, recipeRuntimeDir, resolveLocalProtocolRoot, runnerDir } from "../../paths.js";
+import { poolFilesForHost } from "../resolve-slot-ports.js";
 import { profileProcessPids } from "./validation-process-ownership.js";
 const require2 = createRequire(import.meta.url);
 const { detachedLaunchUnprovenPath, hasDetachedLaunchUnproven, shellQuote } = require2(
@@ -543,9 +544,9 @@ function resolveExtensionSlot(projectRoot, requestedSlot) {
   }
   const poolsDir = path.join(protocolRoot, "pool");
   if (!fs.existsSync(poolsDir)) return null;
-  for (const file of fs.readdirSync(poolsDir)) {
-    if (!file.endsWith(".json") || file.includes(".bak")) continue;
-    const pool = JSON.parse(fs.readFileSync(path.join(poolsDir, file), "utf8"));
+  const pools = poolFilesForHost(poolsDir);
+  for (const { data } of [...pools.local, ...pools.other]) {
+    const pool = data;
     for (const rawSlot of pool.slots ?? []) {
       if (!rawSlot || typeof rawSlot !== "object") continue;
       const slot = rawSlot;

package/dist/adapters/extension/verify.js

@@ -0,0 +1,608 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import http from "node:http";
+import path from "node:path";
+import { readRuntimeContextField, resolveRuntimeContextPath } from "../../harness.js";
+import { recipeHarnessPath, recipeHarnessRoot, recipeRuntimeDir, runnerDir } from "../../paths.js";
+import { resolveExtensionSlotPorts } from "../slot-ports.js";
+const USAGE = "Usage: mm-harness verify --adapter extension -- [--target <metamask-extension>] [--out <recipes-dir>] [--cdp-port <port>] [--static-only] [--artifacts-dir <dir>]";
+const EXTENSION_ID_PATTERN = /^[a-p]{32}$/u;
+function parseExtensionVerifyArgs(argv) {
+  let target = process.cwd();
+  let out;
+  let cdpPort = "";
+  let artifactsDir;
+  let staticOnly = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    const needsValue = () => {
+      if (i + 1 >= argv.length) return void 0;
+      i += 1;
+      return argv[i];
+    };
+    switch (arg) {
+      case "--target": {
+        const value = needsValue();
+        if (value === void 0) return { kind: "error", message: "Missing value for --target", exitCode: 2 };
+        target = value;
+        break;
+      }
+      case "--out": {
+        const value = needsValue();
+        if (value === void 0) return { kind: "error", message: "Missing value for --out", exitCode: 2 };
+        out = value;
+        break;
+      }
+      case "--cdp-port": {
+        const value = needsValue();
+        if (value === void 0) return { kind: "error", message: "Missing value for --cdp-port", exitCode: 2 };
+        cdpPort = value;
+        break;
+      }
+      case "--artifacts-dir": {
+        const value = needsValue();
+        if (value === void 0) return { kind: "error", message: "Missing value for --artifacts-dir", exitCode: 2 };
+        artifactsDir = value;
+        break;
+      }
+      case "--static-only":
+        staticOnly = true;
+        break;
+      case "-h":
+      case "--help":
+        return { kind: "help", usage: USAGE };
+      default:
+        return { kind: "error", message: `Unknown arg: ${arg}`, exitCode: 2 };
+    }
+  }
+  if (cdpPort !== "" && !isNumericCdpPort(cdpPort)) {
+    return { kind: "error", message: `Invalid --cdp-port (must be numeric): ${cdpPort}`, exitCode: 2 };
+  }
+  return { kind: "options", options: { target, out, cdpPort, artifactsDir, staticOnly } };
+}
+function isNumericCdpPort(port) {
+  return port.length > 0 && /^[0-9]+$/u.test(port);
+}
+function resolveHarnessOut(target, out) {
+  if (!out) return void 0;
+  if (out.split(/[\\/]+/u).includes("..")) return void 0;
+  const root = path.resolve(target);
+  const resolved = path.resolve(root, out);
+  const relative = path.relative(root, resolved);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) return void 0;
+  let realRelative;
+  try {
+    realRelative = path.relative(fs.realpathSync(root), fs.realpathSync(resolved));
+  } catch (error) {
+    if (error.code === "ENOENT") return resolved;
+    throw error;
+  }
+  if (!realRelative || realRelative.startsWith("..") || path.isAbsolute(realRelative)) return void 0;
+  return resolved;
+}
+function classifyExtensionRuntimeOwner(liveMode, cdpReachable, readinessStatus) {
+  if (liveMode === "static-only") return "static-only";
+  if (liveMode === "missing-cdp") return "none";
+  if (!cdpReachable) return "none";
+  return readinessStatus === "pass" ? "compatible-external-or-harness" : "incompatible-external-or-stale";
+}
+function buildExtensionVerifySummary(input) {
+  const readiness = input.checks.find((check) => check.name === "live extension readiness");
+  const cdp = input.readinessReport?.cdp;
+  const cdpTarget = cdp ? {
+    selectedExtensionId: cdp.selectedExtensionId || null,
+    markerExtensionId: input.markerExtensionId,
+    markerMatched: cdp.markerMatched ?? null,
+    markerRepaired: cdp.markerRepaired ?? null,
+    extensionIds: cdp.extensionIds || [],
+    targetCount: cdp.targetCount ?? null,
+    browser: cdp.browser || input.cdpHolder?.browser || null
+  } : null;
+  return {
+    adapter: "extension",
+    status: input.status,
+    liveMode: input.liveMode,
+    runtimeClassification: {
+      runtimeOwner: classifyExtensionRuntimeOwner(
+        input.liveMode,
+        Boolean(input.cdpHolder?.cdpReachable),
+        readiness?.status
+      ),
+      recipeControllable: readiness?.status === "pass",
+      startedByVerify: false
+    },
+    cleanupOwnership: {
+      mayStop: false,
+      reason: "extension verify inspects the supplied CDP runtime; wrapper/preflight ownership must be recorded by the caller before stopping processes"
+    },
+    gitStatus: input.gitStatus,
+    distFreshness: input.distFreshness,
+    runtimePolicy: {
+      runtimeReusePolicy: "reuse a running harness-compatible CDP target when possible; wrapper auto-start must use a cached/watch-only prepare path unless the human explicitly permits a rebuild"
+    },
+    fixtureStatus: input.fixtureStatus,
+    cdpHolder: input.cdpHolder,
+    ensureReady: input.ensureReady,
+    cdpTarget,
+    checks: input.checks,
+    generatedAt: input.generatedAt
+  };
+}
+function deriveDistFreshness(decision) {
+  const dist = decision.checks?.dist ?? { status: "unknown" };
+  const modified = dist.modified;
+  const message = dist.source === "release-artifact" ? `release artifact ${dist.manifestVersion ?? "?"} sha256=${dist.artifactSha256 ?? "?"} matches the loaded runtime snapshot.` : dist.status === "fresh" ? "dist id matches HEAD; no uncommitted source." : dist.status === "stale" ? dist.reason === "uncommitted-source" ? `${modified ? modified.length : "some"} uncommitted source file(s); rebuild or commit.` : `dist id ${dist.distGitId ?? "?"} != HEAD ${dist.head ?? "?"}; rebuild.` : dist.status === "no-build" ? "no dist/chrome build." : "no git id in dist or not a git checkout; cannot prove parity.";
+  return { ...dist, message };
+}
+function deriveBuildHealth(decision) {
+  const buildLog = decision.checks?.releaseArtifact?.status === "valid" ? { status: "no-watch", source: "release-artifact" } : decision.checks?.buildLog ?? { status: "unknown" };
+  const message = buildLog.status === "ok" ? "webpack compiled." : buildLog.status === "no-watch" ? "no webpack watch log; build-health n/a (e.g. one-shot build)." : buildLog.status === "building" ? "webpack has not reported a successful compile yet." : buildLog.status === "errors" ? buildLog.reason === "stale-cache" ? "webpack build failing on a stale cache (ENOENT on a deduped module). Run `mm-harness runtime-launch --adapter extension --target <repo> --cdp-port <port>` to auto-clear the cache and rebuild." : "webpack build has errors; fix the source/build before validating." : "build-health unknown.";
+  return { status: buildLog.status, reason: buildLog.reason, excerpt: buildLog.excerpt, message };
+}
+function extensionFixtureStatus(target, runtimeDir) {
+  const candidates = [
+    `${runtimeDir}/wallet-fixture.json`,
+    "test/e2e/seeder/withFixtures.js",
+    "test/e2e/fixtures",
+    "fixtures"
+  ].map((rel2) => path.join(target, rel2));
+  let found;
+  let stat;
+  for (const file of candidates) {
+    stat = fs.statSync(file, { throwIfNoEntry: false });
+    if (stat) {
+      found = file;
+      break;
+    }
+  }
+  const profileHints = [];
+  if (fs.existsSync(path.join(target, runtimeDir, "extension.id"))) {
+    profileHints.push({ path: `${runtimeDir}/extension.id`, type: "extension-id" });
+  }
+  if (!found || !stat) {
+    return {
+      status: "MISSING_FIXTURES",
+      message: "Fixture status: MISSING_FIXTURES. This run may depend on an inherited browser/profile state. Prefer a prepared debug profile or fixture seed before spending time repairing state manually.",
+      profileHints
+    };
+  }
+  const isFile = stat.isFile();
+  let sha256 = null;
+  let validJson = null;
+  let hasWalletPassword = false;
+  let mobileAccountShape = false;
+  const rel = path.relative(target, found);
+  const isWalletFixture = rel === `${runtimeDir}/wallet-fixture.json`;
+  if (isFile) {
+    const bytes = fs.readFileSync(found);
+    sha256 = crypto.createHash("sha256").update(bytes).digest("hex");
+    if (found.endsWith(".json")) {
+      try {
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        validJson = true;
+        const accounts = Array.isArray(parsed.accounts) ? parsed.accounts : [];
+        hasWalletPassword = typeof parsed.password === "string" && parsed.password.length > 0;
+        mobileAccountShape = accounts.some((account) => account?.type === "mnemonic") && accounts.filter((account) => account?.type === "privateKey").length >= 2;
+      } catch {
+        validJson = false;
+      }
+    }
+  }
+  const status = validJson === false ? "STALE_OR_INVALID" : isWalletFixture && hasWalletPassword ? "READY" : "PROFILE_HINTS";
+  return {
+    status,
+    path: rel,
+    type: isFile ? "file" : "directory",
+    sha256,
+    modifiedAt: stat.mtime.toISOString(),
+    profileHints,
+    hasWalletPassword,
+    mobileAccountShape,
+    message: validJson === false ? `Fixture status: STALE_OR_INVALID (${rel}). Fix before relying on a clean sandbox.` : status === "READY" ? `Fixture status: READY (${rel}).` : `Fixture status: PROFILE_HINTS (${rel}); no Mobile-shaped wallet fixture was found for automatic account parity validation.`
+  };
+}
+function capture(command, args) {
+  try {
+    return execFileSync(command, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function getCdpJson(port, route) {
+  return new Promise((resolve) => {
+    const request = http.get(`http://127.0.0.1:${port}${route}`, { timeout: 1e3 }, (response) => {
+      let data = "";
+      response.on("data", (chunk) => {
+        data += chunk;
+      });
+      response.on("end", () => {
+        try {
+          resolve(JSON.parse(data));
+        } catch {
+          resolve(null);
+        }
+      });
+    });
+    request.on("timeout", () => {
+      request.destroy();
+      resolve(null);
+    });
+    request.on("error", () => resolve(null));
+  });
+}
+async function cdpHolder(port) {
+  const pid = capture("lsof", [`-iTCP:${port}`, "-sTCP:LISTEN", "-t"]).split("\n")[0] ?? "";
+  const command = /^[0-9]+$/u.test(pid) ? capture("ps", ["-p", pid, "-o", "command="]) : "";
+  const version = await getCdpJson(port, "/json/version");
+  const targets = await getCdpJson(port, "/json/list");
+  const extensionTargets = Array.isArray(targets) ? targets.filter((target) => String(target.url || "").startsWith("chrome-extension://")).length : 0;
+  return {
+    port,
+    listening: Boolean(pid),
+    pid: pid || null,
+    command: command || null,
+    cdpReachable: Boolean(version),
+    browser: version?.Browser || null,
+    targetCount: Array.isArray(targets) ? targets.length : null,
+    extensionTargets
+  };
+}
+function spawnToFiles(command, args, options) {
+  const open = (file) => {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    return fs.openSync(file, "w");
+  };
+  const outFd = options.stdout === void 0 ? "ignore" : open(options.stdout);
+  const errFd = options.stderr === void 0 || options.stderr === "ignore" ? "ignore" : options.stderr === "stdout" ? outFd : open(options.stderr);
+  try {
+    const result = spawnSync(command, args, {
+      cwd: options.cwd,
+      env: process.env,
+      stdio: ["ignore", outFd, errFd]
+    });
+    if (result.error) {
+      if (typeof errFd === "number") fs.writeSync(errFd, `${result.error.message}
+`);
+      return 127;
+    }
+    return result.status ?? 1;
+  } finally {
+    if (typeof outFd === "number") fs.closeSync(outFd);
+    if (typeof errFd === "number" && errFd !== outFd) fs.closeSync(errFd);
+  }
+}
+function readJsonFile(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function gitStatusSummary(target, harnessRootExclude) {
+  const runGit = (args) => {
+    try {
+      return execFileSync("git", ["-C", target, ...args], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const statusShort = runGit(["status", "--short", "--", ".", `:(exclude)${harnessRootExclude}`]);
+  const dirty = statusShort ? statusShort.split("\n").filter(Boolean) : [];
+  return {
+    branch: runGit(["branch", "--show-current"]),
+    head: runGit(["rev-parse", "--short", "HEAD"]),
+    dirtyCount: dirty.length,
+    dirtyPreview: dirty.slice(0, 25)
+  };
+}
+function utcStamp(date) {
+  return `${date.toISOString().replace(/[-:]/gu, "").split(".")[0]}Z`;
+}
+const defaultIo = {
+  out: (line) => process.stdout.write(`${line}
+`),
+  err: (line) => process.stderr.write(`${line}
+`)
+};
+async function runExtensionVerify(argv, io = defaultIo) {
+  const parsed = parseExtensionVerifyArgs(argv);
+  if (parsed.kind === "help") {
+    io.out(parsed.usage);
+    return 0;
+  }
+  if (parsed.kind === "error") {
+    io.err(parsed.message);
+    return parsed.exitCode;
+  }
+  const { staticOnly } = parsed.options;
+  const target = path.resolve(parsed.options.target);
+  if (!fs.existsSync(target)) {
+    io.err(`Refusing extension verify: target checkout does not exist: ${target}`);
+    io.err("  Next: pass --target <metamask-extension checkout>");
+    return 1;
+  }
+  const runtimeDir = recipeRuntimeDir();
+  const harnessRoot = recipeHarnessRoot();
+  const harnessRel = `${harnessRoot}/extension`;
+  const harnessDir = recipeHarnessPath(target, "extension");
+  const runnerBin = path.join(harnessDir, "runner/bin/mm-harness");
+  let smokeRecipe = path.join(harnessDir, "runner/recipes/extension/runner/smoke.recipe.json");
+  if (parsed.options.out) {
+    const outAbs = resolveHarnessOut(target, parsed.options.out);
+    if (!outAbs) {
+      io.err(`extension verify: --out '${parsed.options.out}' did not resolve to a safe path under the target.`);
+      return 2;
+    }
+    const canonical = path.join(outAbs, "extension/runner/smoke.recipe.json");
+    const legacy = path.join(outAbs, "runner/smoke.extension.recipe.json");
+    if (fs.existsSync(canonical) && fs.existsSync(legacy)) {
+      io.err(`extension verify: --out '${parsed.options.out}' declares runner.smoke for extension in both canonical and legacy paths.`);
+      io.err(`Next: Remove ${legacy} and rerun verification.`);
+      return 2;
+    }
+    if (fs.existsSync(canonical)) {
+      smokeRecipe = canonical;
+    } else if (fs.existsSync(legacy)) {
+      smokeRecipe = legacy;
+    } else {
+      io.err(`extension verify: --out '${parsed.options.out}' has no extension runner.smoke recipe.`);
+      io.err(`Next: Add extension/runner/smoke.recipe.json under ${outAbs} or omit --out.`);
+      return 2;
+    }
+  }
+  const artifacts = parsed.options.artifactsDir ? path.resolve(parsed.options.artifactsDir) : path.join(harnessDir, "verify", utcStamp(/* @__PURE__ */ new Date()));
+  fs.mkdirSync(path.join(artifacts, "logs"), { recursive: true });
+  const extensionIdFile = path.join(target, runtimeDir, "extension.id");
+  const installedScripts = path.join(harnessDir, "scripts");
+  const readinessMjs = [
+    path.join(installedScripts, "readiness.mjs"),
+    path.join(runnerDir, "adapters/extension/readiness.mjs")
+  ].find((candidate) => fs.existsSync(candidate));
+  if (!readinessMjs) {
+    io.err(`extension verify: readiness.mjs missing next to ${installedScripts}; reinstall the runner.`);
+    return 1;
+  }
+  const refreshExtensionId = () => {
+    if (fs.existsSync(extensionIdFile)) {
+      process.env.RECIPE_HARNESS_EXTENSION_ID = fs.readFileSync(extensionIdFile, "utf8").replace(/\s+/gu, "");
+    } else {
+      delete process.env.RECIPE_HARNESS_EXTENSION_ID;
+    }
+  };
+  const contextPath = resolveRuntimeContextPath(target);
+  const contextExtensionId = fs.existsSync(contextPath) ? readRuntimeContextField(contextPath, "extensionId") : void 0;
+  if (contextExtensionId !== void 0 && EXTENSION_ID_PATTERN.test(contextExtensionId)) {
+    fs.mkdirSync(path.dirname(extensionIdFile), { recursive: true });
+    fs.writeFileSync(extensionIdFile, `${contextExtensionId}
+`);
+    process.env.RECIPE_HARNESS_EXTENSION_ID = contextExtensionId;
+  } else {
+    refreshExtensionId();
+  }
+  let cdpPort = parsed.options.cdpPort;
+  if (!cdpPort) {
+    resolveExtensionSlotPorts(target);
+    cdpPort = process.env.CDP_PORT ?? "";
+    if (cdpPort !== "" && !isNumericCdpPort(cdpPort)) {
+      io.err(`Invalid inferred --cdp-port (must be numeric): ${cdpPort}`);
+      return 2;
+    }
+  }
+  let status = "pass";
+  const checks = [];
+  const checkFile = (rel) => {
+    const ok = fs.existsSync(path.join(target, rel));
+    checks.push({ name: rel, status: ok ? "pass" : "fail" });
+    if (!ok) status = "fail";
+  };
+  checkFile(`${harnessRel}/manifest.json`);
+  checkFile(`${harnessRel}/action-manifest.json`);
+  checkFile(`${harnessRel}/runner/bin/mm-harness`);
+  checkFile(`${harnessRel}/runner/manifests/extension.action-manifest.json`);
+  const decisionLog = path.join(artifacts, "logs/runtime-decision.json");
+  const decisionCode = spawnToFiles(runnerBin, ["runtime-decision", "--adapter", "extension", "--target", target, "--json"], {
+    stdout: decisionLog,
+    stderr: "ignore"
+  });
+  if (decisionCode !== 0) fs.writeFileSync(decisionLog, "{}");
+  const decisionRaw = fs.readFileSync(decisionLog, "utf8");
+  if (decisionRaw === "" || decisionRaw.replace(/\n+$/u, "") === "{}") {
+    io.err("recipe-harness verify: runtime-decision returned empty/{} \u2014 dist-freshness and build-health cannot be derived from the runner and will degrade to WARN (runtime-proof gate NOT fully validated). Check the runner/build state.");
+  }
+  const distFreshnessLog = path.join(artifacts, "logs/dist-freshness.json");
+  const buildHealthLog = path.join(artifacts, "logs/build-health.json");
+  try {
+    const decision = readJsonFile(decisionLog) ?? {};
+    fs.writeFileSync(distFreshnessLog, JSON.stringify(deriveDistFreshness(decision)));
+    fs.writeFileSync(buildHealthLog, JSON.stringify(deriveBuildHealth(decision)));
+  } catch {
+    fs.writeFileSync(distFreshnessLog, '{"status":"unknown","message":"dist-freshness probe error"}');
+    fs.writeFileSync(buildHealthLog, '{"status":"unknown","message":"build-health probe error"}');
+  }
+  const readField = (file, key) => {
+    const value = readJsonFile(file)?.[key];
+    return value === void 0 || value === null ? "" : String(value);
+  };
+  const distStatus = readField(distFreshnessLog, "status");
+  io.err(`dist-freshness: ${distStatus || "unknown"} \u2014 ${readField(distFreshnessLog, "message")}`);
+  if (distStatus === "fresh") {
+    checks.push({ name: "dist-freshness", status: "pass" });
+  } else if (distStatus === "stale") {
+    if (!staticOnly) {
+      checks.push({ name: "dist-freshness", status: "fail", detail: "see logs/dist-freshness.json" });
+      status = "fail";
+    } else {
+      checks.push({ name: "dist-freshness", status: "warn", detail: "stale (static-only); see logs/dist-freshness.json" });
+    }
+  } else {
+    checks.push({ name: "dist-freshness", status: "warn", detail: `${distStatus || "unknown"}; see logs/dist-freshness.json` });
+  }
+  const buildStatus = readField(buildHealthLog, "status");
+  io.err(`build-health: ${buildStatus || "unknown"} \u2014 ${readField(buildHealthLog, "message")}`);
+  if (buildStatus === "ok" || buildStatus === "no-watch") {
+    checks.push({ name: "build-health", status: "pass" });
+  } else if (buildStatus === "errors") {
+    if (!staticOnly) {
+      checks.push({ name: "build-health", status: "fail", detail: "see logs/build-health.json" });
+      status = "fail";
+    } else {
+      checks.push({ name: "build-health", status: "warn", detail: "build errors (static-only); see logs/build-health.json" });
+    }
+  } else if (buildStatus === "building") {
+    checks.push({ name: "build-health", status: "warn", detail: "still compiling; see logs/build-health.json" });
+  } else {
+    checks.push({ name: "build-health", status: "warn", detail: `${buildStatus || "unknown"}; see logs/build-health.json` });
+  }
+  let liveMode = "static-only";
+  let fixtureStatus = null;
+  let holder = null;
+  if (!staticOnly) {
+    fixtureStatus = extensionFixtureStatus(target, runtimeDir);
+    fs.writeFileSync(path.join(artifacts, "logs/fixture-status.json"), `${JSON.stringify(fixtureStatus)}
+`);
+    io.err(fixtureStatus.message || fixtureStatus.status);
+    checks.push({ name: "fixture/profile status", status: fixtureStatus.status === "READY" ? "pass" : "warn" });
+    if (!cdpPort) {
+      fs.writeFileSync(
+        path.join(artifacts, "logs/live-missing-cdp.log"),
+        "Live extension verify could not infer a checkout CDP port. Run from a prepared slot checkout or pass --cdp-port.\n"
+      );
+      checks.push({
+        name: "live runtime CDP port",
+        status: "fail",
+        detail: "missing CDP port (checkout-scoped inference failed)"
+      });
+      status = "fail";
+      liveMode = "missing-cdp";
+    } else {
+      liveMode = "live";
+      holder = await cdpHolder(cdpPort);
+      fs.writeFileSync(path.join(artifacts, "logs/cdp-holder.json"), `${JSON.stringify(holder)}
+`);
+      const ensureReadyLog = path.join(artifacts, "logs/extension-ensure-ready.json");
+      const ensureReadyCode = spawnToFiles(
+        runnerBin,
+        ["ensure-ready", "--adapter", "extension", "--target", target, "--cdp-port", cdpPort, "--json"],
+        { stdout: ensureReadyLog, stderr: "stdout" }
+      );
+      if (ensureReadyCode === 0) {
+        checks.push({ name: "home-tab convergence", status: "pass", detail: "see logs/extension-ensure-ready.json" });
+        refreshExtensionId();
+      } else {
+        checks.push({ name: "home-tab convergence", status: "fail", detail: "see logs/extension-ensure-ready.json" });
+        reportEnsureReadyFailure(ensureReadyLog, io);
+        status = "fail";
+      }
+      const readinessLog = path.join(artifacts, "logs/extension-readiness.json");
+      const readinessCode = spawnToFiles(
+        process.execPath,
+        [readinessMjs, "--target", target, "--cdp-port", cdpPort, "--json"],
+        { stdout: readinessLog, stderr: "stdout" }
+      );
+      if (readinessCode === 0) {
+        checks.push({ name: "live extension readiness", status: "pass" });
+        refreshExtensionId();
+      } else {
+        checks.push({ name: "live extension readiness", status: "fail", detail: "see logs/extension-readiness.json" });
+        status = "fail";
+      }
+      const manifestCode = spawnToFiles(runnerBin, ["actions", "--raw", "--adapter", "extension"], {
+        cwd: target,
+        stdout: path.join(artifacts, "logs/runner-manifest.json"),
+        stderr: path.join(artifacts, "logs/runner-manifest.err")
+      });
+      if (manifestCode === 0) {
+        checks.push({ name: "runner manifest", status: "pass" });
+      } else {
+        checks.push({ name: "runner manifest", status: "fail", detail: "see logs/runner-manifest.err" });
+        status = "fail";
+      }
+      const smokeCode = spawnToFiles(
+        runnerBin,
+        [
+          "run",
+          smokeRecipe,
+          "--adapter",
+          "extension",
+          "--target",
+          target,
+          "--cdp-port",
+          cdpPort,
+          "--artifacts-dir",
+          path.join(artifacts, "runner-smoke"),
+          "--json"
+        ],
+        { cwd: target, stdout: path.join(artifacts, "logs/runner-smoke.log"), stderr: "stdout" }
+      );
+      if (smokeCode === 0) {
+        checks.push({ name: "runner v1 smoke", status: "pass" });
+      } else {
+        checks.push({ name: "runner v1 smoke", status: "fail", detail: "see logs/runner-smoke.log" });
+        status = "fail";
+      }
+    }
+  }
+  const isGitCheckout = spawnToFiles("git", ["-C", target, "rev-parse", "--git-dir"], {}) === 0;
+  if (isGitCheckout) {
+    spawnToFiles("git", ["-C", target, "status", "--short", "--", ".", `:(exclude)${harnessRoot}`], {
+      stdout: path.join(artifacts, "logs/product-diff-excluding-harness.log"),
+      stderr: "stdout"
+    });
+  }
+  let markerExtensionId = null;
+  try {
+    const value = fs.readFileSync(extensionIdFile, "utf8").trim();
+    if (EXTENSION_ID_PATTERN.test(value)) markerExtensionId = value;
+  } catch {
+  }
+  const summary = buildExtensionVerifySummary({
+    status,
+    liveMode,
+    gitStatus: gitStatusSummary(target, harnessRoot),
+    distFreshness: readJsonFile(distFreshnessLog),
+    fixtureStatus: readJsonFile(path.join(artifacts, "logs/fixture-status.json")),
+    cdpHolder: readJsonFile(path.join(artifacts, "logs/cdp-holder.json")),
+    ensureReady: readJsonFile(path.join(artifacts, "logs/extension-ensure-ready.json")),
+    readinessReport: readJsonFile(path.join(artifacts, "logs/extension-readiness.json")),
+    markerExtensionId,
+    checks,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  fs.writeFileSync(path.join(artifacts, "summary.json"), `${JSON.stringify(summary, null, 2)}
+`);
+  fs.writeFileSync(
+    path.join(artifacts, "artifact-manifest.json"),
+    `${JSON.stringify({ artifacts: fs.readdirSync(artifacts).map((name) => ({ path: name })) }, null, 2)}
+`
+  );
+  io.out(`Extension harness verify ${status}: ${path.join(artifacts, "summary.json")}`);
+  return status === "pass" ? 0 : 1;
+}
+function reportEnsureReadyFailure(file, io) {
+  const report = readJsonFile(file);
+  if (!report) return;
+  const code = report.health?.errorCode;
+  const findings = Array.isArray(report.health?.findings) ? report.health.findings : [];
+  if (code) {
+    const finding = findings[0] ?? "Extension UI is not interactive.";
+    io.err(finding.startsWith(`${code}:`) ? finding : `${code}: ${finding}`);
+  } else if (findings[0]) {
+    io.err(findings[0]);
+  }
+  if (report.health?.userAction) io.err(`Next: ${report.health.userAction}`);
+}
+export {
+  buildExtensionVerifySummary,
+  classifyExtensionRuntimeOwner,
+  deriveBuildHealth,
+  deriveDistFreshness,
+  extensionFixtureStatus,
+  isNumericCdpPort,
+  parseExtensionVerifyArgs,
+  resolveHarnessOut,
+  runExtensionVerify
+};