@deeeed/metamask-harness 0.70.0 → 0.70.1

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 0.70.1 - 2026-10-02
+
+### Fixed
+
+- Detect forced Google Chrome sign-in (`BrowserSignin: 2`, `ForceBrowserSignin`) as managed: `plutil` returns these scalar policies only as raw values, so a Mac with only forced sign-in looked unmanaged and fell back to the managed Chrome.
+- Disable other user extensions in the slot browser before its start page (a dapp or the wallet home) loads; a browser started without a window gets a blank background window first.
+- Fail the launch, and stop the browser, when a slot browser started without a window cannot open its start window, instead of recording a browser with no window.
+- Start the library autolaunch browser on macOS without a startup window, load the wallet home into its window's blank tab (so it is the page a screenshot of the window shows) or a background window, and restore the operator's front app once, by pid, only if its own browser took it. Headful browser probes also start without a startup window.
+- Show doctor's managed-Chrome diagnostics next to any other browser warning.
+
 ## 0.70.0 - 2026-10-02
 
 ### Added

package/README.md

@@ -149,15 +149,22 @@ On a cold cache the probe can take up to about 80 seconds and
 shows a small (about 480×360) browser window; `doctor --adapter extension`
 runs the same probe.
 
-On a Mac whose Google Chrome is managed by policy (force-installed extensions
-in `/Library/Managed Preferences/…/com.google.Chrome.plist`, or forced
-sign-in), `auto` uses Chrome for Testing: it does not read those policies, so
-no forced extension can open windows in the slot. If Chrome for Testing does
-not start and paint there, the launch stops and names the two ways forward
-(`RECIPE_HARNESS_BROWSER=chrome`, accepting the forced extensions' windows, or
-a less loaded machine) instead of falling back to the managed Chrome. Doctor
-lists the forced extensions. A slot profile created on the managed Chrome keeps
-it, with a warning to reset the profile.
+On a Mac whose Google Chrome is managed by policy, `auto` uses Chrome for
+Testing, which does not read those policies, so no forced extension can open
+windows in the slot. Only MDM-managed preferences are read
+(`/Library/Managed Preferences/com.google.Chrome.plist` and its per-user
+copy under `/Library/Managed Preferences/<user>/`), not `defaults` a user set
+themselves; force-installed extensions (`ExtensionInstallForcelist`,
+`ExtensionSettings`) or forced sign-in (`BrowserSignin: 2`,
+`ForceBrowserSignin`) count as managed; a policy stored as a Data or Date
+value is treated as absent. If Chrome for Testing does not start
+and paint there, the launch stops with `BROWSER_UNLAUNCHABLE` rather than
+falling back to the managed Chrome; the way out is
+`RECIPE_HARNESS_BROWSER=chrome` (accepting that forced extensions may open
+windows that take the front), or a less loaded machine. Doctor lists the forced
+extension ids, with names where it can read them (best effort, read-only: the
+slot record, or the operator's own Chrome profile folders). A slot profile
+created on the managed Chrome keeps it, with a warning to reset the profile.
 
 A slot then keeps the kind of browser its profile was created with, until the
 profile is reset (`mm-harness fixtures set` or `fixtures reset`):

package/adapters/extension/launch-browser.cjs

@@ -223,7 +223,7 @@ try {
       }
     }
     if (loadsOverCdp) cdpLoad = loadExtensionOverCdp(browserPid);
-    else if (application) openBackgroundWindow(initialUrl);
+    else if (application) openBackgroundWindow(browserPid, initialUrl);
     owner = cdpLoad?.owner ?? ownerIdentity(browserPid);
     for (const problem of pruneExtraHomeTabs(cdpPort, args['extension-dir'])) {
       process.stderr.write(`[launch] home-tab pruning: ${problem}\n`);
@@ -283,14 +283,26 @@ try {
 }
 
 // The first window of a browser started without one, opened in the background.
-function openBackgroundWindow(url) {
+// Without it the slot has no window at all, so a failure fails the launch:
+// the owned browser is stopped (its markers kept if it cannot be).
+function openBackgroundWindow(pid, url) {
   const result = spawnSync(process.execPath, [browserResolverPath, 'open-window', '--port', String(cdpPort), '--url', url], {
     encoding: 'utf8',
     timeout: 30_000,
   });
-  if (result.status !== 0) {
-    process.stderr.write(`[launch] could not open the start window: ${(result.stderr || result.error?.message || '').trim()}\n`);
+  if (result.status === 0) return;
+  const openError = (result.stderr || result.error?.message || `exit ${result.status}`).trim();
+  try {
+    stopProfileProcessesSync(args.profile, { extraPids: [pid] });
+  } catch (stopError) {
+    throw new Error(
+      `Chrome started but its start window could not be opened (${openError}), and stopping it failed: ${stopError.message}. ` +
+        `The launch markers for port ${cdpPort} and ${args.profile} are kept. Next: stop pid ${pid}, then rerun.`,
+    );
   }
+  clearDetachedLaunchUnproven(args.profile);
+  if (!activeValidationLease) clearValidationPortQuarantine(cdpPort, args.profile);
+  throw new Error(`Chrome started but its start window could not be opened: ${openError}. Next: inspect ${args['chrome-log']}, then rerun.`);
 }
 
 // live.sh passes the record its resolver just wrote (--browser-resolution);

package/adapters/shared/browser-cdp.cjs

@@ -428,12 +428,21 @@ async function openBackgroundWindow(send, url, timeoutMs) {
   return send('Target.createTarget', { url, newWindow: true, background: true }, undefined, timeoutMs);
 }
 
+const isBlankPage = (target) => target.type === 'page' && (target.url === 'about:blank' || target.url.startsWith('chrome://newtab') || target.url.startsWith('chrome://new-tab-page'));
+
+// A browser started without a window gets a blank background window, so the
+// first window never takes the operator's focus and nothing is navigated yet.
+async function ensureBackgroundWindow(send, remaining) {
+  const { targetInfos } = await send('Target.getTargets', {}, undefined, remaining());
+  if ((targetInfos || []).some((target) => target.type === 'page')) return;
+  await openBackgroundWindow(send, 'about:blank', remaining());
+}
+
 // Point the launch tab at `url` once the extension exists: the tab opened at
-// launch would otherwise show an error page for chrome-extension:// URLs. A
-// browser started without a window gets a background window instead.
+// launch would otherwise show an error page for chrome-extension:// URLs.
 async function openUrl(send, url, remaining) {
   const { targetInfos } = await send('Target.getTargets', {}, undefined, remaining());
-  const blank = targetInfos.find((target) => target.type === 'page' && (target.url === 'about:blank' || target.url.startsWith('chrome://newtab') || target.url.startsWith('chrome://new-tab-page')));
+  const blank = (targetInfos || []).find(isBlankPage);
   if (!blank) {
     await openBackgroundWindow(send, url, remaining());
     return;
@@ -489,12 +498,15 @@ async function loadUnpackedOverPort(port, extensionDir, {
     assertSameOwner(owner, { exec, timeoutMs: remaining() });
     step = 'Extensions.loadUnpacked';
     const loaded = await loadUnpackedExtension(client.send, extensionDir, { expectedId, timeoutMs: remaining() });
-    // The start page first: a browser started without a window gets its first
-    // window here, in the background, before isolation opens its tab.
-    step = 'opening the start page';
-    if (url) await openUrl(client.send, url, remaining);
+    // A browser started without a window gets a blank background window
+    // first; other extensions are disabled before the start page (a dapp, or
+    // the wallet home) loads in it.
+    step = 'opening a background window';
+    await ensureBackgroundWindow(client.send, remaining);
     step = 'isolating the wallet from other extensions';
     const otherExtensions = await isolateWalletExtension(client.send, loaded.id, { timeoutMs: remaining() });
+    step = 'opening the start page';
+    if (url) await openUrl(client.send, url, remaining);
     remaining();
     return { ...loaded, otherExtensions, owner };
   } catch (error) {
@@ -523,6 +535,8 @@ module.exports = {
   expectedExtensionId: (extensionDir) => extensionIdFromExtensionDir(extensionDir) || null,
   loadUnpackedExtension,
   loadUnpackedOverPort,
+  ensureBackgroundWindow,
   isolateWalletExtension,
   openBackgroundWindow,
+  openUrl,
 };

package/adapters/shared/browser-resolver.cjs

@@ -106,14 +106,24 @@ function managedChromePlists(env = process.env) {
   ];
 }
 
-// One policy key as JSON, or undefined when absent or unreadable.
+// One policy key, or undefined when absent or unreadable. `plutil -extract
+// … json` only extracts arrays and dictionaries; a scalar (BrowserSignin: 2,
+// ForceBrowserSignin: true) comes out with `raw`.
 function readPolicyKey(file, key) {
+  const extract = (format) => execFileSync('plutil', ['-extract', key, format, '-o', '-', file], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+    timeout: 5000,
+  });
   try {
-    return JSON.parse(execFileSync('plutil', ['-extract', key, 'json', '-o', '-', file], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 5000,
-    }));
+    return JSON.parse(extract('json'));
+  } catch {
+    // A scalar, or the key is absent: try it as a raw value.
+  }
+  try {
+    const raw = extract('raw').trim();
+    if (raw === 'true' || raw === 'false') return raw === 'true';
+    return /^-?\d+$/u.test(raw) ? Number(raw) : raw;
   } catch {
     return undefined;
   }
@@ -512,11 +522,12 @@ async function probeLaunch(executable, {
   let exited = null;
   try {
     const port = await freePort();
-    // A headful Launch Services probe starts like the slot browser: in the
-    // background with no startup window (Chrome activates itself when it opens
-    // one); renderCheck opens a background window. Like the launcher, it keeps
-    // a window that sits behind the operator's apps rendering.
-    const backgroundWindow = method === LAUNCH_SERVICES && display === HEADFUL;
+    // A headful probe starts like the slot browsers (the launchers and the
+    // library autolaunch): in the background with no startup window (Chrome
+    // activates itself when it opens one); renderCheck opens a background
+    // window. Like the launchers, it keeps a window behind the operator's apps
+    // rendering.
+    const backgroundWindow = display === HEADFUL;
     const args = [
       ...(display === HEADLESS ? ['--headless=new'] : ['--window-size=480,360']),
       `--user-data-dir=${profile}`,

package/dist/doctor.js

@@ -241,7 +241,7 @@ function extensionBrowserResolutionDoctorCheck(target) {
   if (result.status === 0) {
     const resolution = JSON.parse(result.stdout);
     const managed = resolution.managedChrome;
-    const managedNote = managed && !resolution.warning ? ` Google Chrome is managed by policy (${managed.forcedExtensions.length} forced extension${managed.forcedExtensions.length === 1 ? "" : "s"}: ${managed.forcedExtensions.map(({ id, name }) => name ? `${id} (${name})` : id).join(", ")}${managed.signinForced ? "; browser sign-in forced" : ""}); slots use Chrome for Testing.` : "";
+    const managedNote = managed && !resolution.warning?.includes("managed by policy") ? ` Google Chrome is managed by policy (${managed.forcedExtensions.length} forced extension${managed.forcedExtensions.length === 1 ? "" : "s"}: ${managed.forcedExtensions.map(({ id, name }) => name ? `${id} (${name})` : id).join(", ")}${managed.signinForced ? "; browser sign-in forced" : ""}); slots use Chrome for Testing.` : "";
     const probe = resolution.probe ? `; Chrome for Testing probe (${resolution.probe.launchMethod}, ${resolution.probe.display}${resolution.probe.cached ? ", cached" : ""}${resolution.probe.transient ? `, retried after ${resolution.probe.expiresAt}` : ""}): ${resolution.probe.reason}` : resolution.recordedFrom ? `; kept from the slot profile record ${resolution.recordedFrom}` : "";
     return {
       id: "extension-browser",

package/library/actions/extension/platform/cdp.mjs

@@ -373,6 +373,26 @@ const runnerRequire = createRequire(import.meta.url);
 const runnerRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../..');
 const browserResolver = runnerRequire(path.join(runnerRoot, 'adapters/shared/browser-resolver.cjs'));
 const { stopProfileProcessesSync } = runnerRequire(path.join(runnerRoot, 'adapters/extension/lib/validation-process-ownership.cjs'));
+const browserCdp = runnerRequire(path.join(runnerRoot, 'adapters/shared/browser-cdp.cjs'));
+const macosFocus = runnerRequire(path.join(runnerRoot, 'adapters/extension/lib/macos-focus.cjs'));
+
+// On macOS a browser that opens a window at startup activates itself, so the
+// autolaunched browser starts without one and gets its pages over CDP in the
+// background (as the extension launcher does).
+const startsWithoutWindow = () => process.platform === 'darwin';
+
+// One bounded browser-level CDP operation (the shared helpers in
+// browser-cdp.cjs never take the operator's focus).
+async function withBrowserCdp(port, fn) {
+  const deadline = Date.now() + 15000;
+  const remaining = () => Math.max(1, deadline - Date.now());
+  const client = await browserCdp.connectBrowserCdp(port, { timeoutMs: remaining() });
+  try {
+    return await fn(client.send, remaining);
+  } finally {
+    client.close();
+  }
+}
 
 // Same browser choice as the live launcher (RECIPE_HARNESS_BROWSER /
 // RECIPE_HARNESS_CHROME_BIN); branded Chrome loads the dist over CDP. This
@@ -491,6 +511,7 @@ export async function launchExistingDistRuntime(input, port) {
   const profileExisted = await canAccess(path.join(profileDir, 'Local State'));
   const browser = await resolveChromeBinary(projectRoot, profileExisted ? browserRecord : null);
   const loadsOverCdp = browser.extensionLoading === browserResolver.CDP_LOAD_UNPACKED;
+  const previousFrontmost = macosFocus.captureMacFrontmost();
   const stdoutFd = openSync(path.join(logsDir, 'chrome.log'), 'a');
   const stderrFd = openSync(path.join(logsDir, 'chrome.log'), 'a');
   let child;
@@ -508,7 +529,7 @@ export async function launchExistingDistRuntime(input, port) {
       '--disable-extensions-content-verification',
       '--disable-features=ExtensionContentVerification,DisableLoadExtensionCommandLineSwitch',
       ...browserResolver.extensionLaunchArgs(runtimeDist, browser.extensionLoading),
-      'chrome://extensions/',
+      startsWithoutWindow() ? '--no-startup-window' : 'chrome://extensions/',
     ], {
       cwd: projectRoot,
       detached: true,
@@ -534,7 +555,10 @@ export async function launchExistingDistRuntime(input, port) {
   try {
     await retryJsonGet(`http://127.0.0.1:${port}/json/version`, 45000);
     const owner = browserResolver.waitForCdpOwner(port, profileDir);
+    // The CDP load opens a background window itself; otherwise open one here.
+    // Without it the browser has no window, so a failure fails the launch.
     const cdpLoad = loadsOverCdp ? await browserResolver.loadUnpackedOverPort(port, runtimeDist, { profile: profileDir }) : null;
+    if (!loadsOverCdp && startsWithoutWindow()) await withBrowserCdp(port, browserCdp.ensureBackgroundWindow);
     launchedBrowser = {
       ...browser,
       launch: {
@@ -582,6 +606,8 @@ export async function launchExistingDistRuntime(input, port) {
     }
     throw error;
   }
+  // One check, at most one restore, only if this launch's browser holds the front.
+  macosFocus.restoreFrontmostIfOurs(previousFrontmost, [launchedBrowser.launch.pid]);
 
   await writeFile(path.join(runtimeRoot, 'runtime.json'), `${JSON.stringify({
     port,
@@ -618,17 +644,16 @@ function extensionIdFromAnyTarget(targets) {
   return null;
 }
 
-async function openExtensionHomePage(port, extensionId) {
+// The wallet home goes into the launch's blank tab (so it is the window's
+// selected page, and what a native screenshot of the window captures), or a
+// background window when there is no blank tab; never a foreground one.
+export async function openExtensionHomePage(port, extensionId) {
   const url = `chrome-extension://${extensionId}/home.html`;
-  const endpoint = `http://127.0.0.1:${port}/json/new?${encodeURIComponent(url)}`;
-  let response = await fetch(endpoint, { method: 'PUT' });
-  if (response.status === 405 || response.status === 404) {
-    response = await fetch(endpoint);
-  }
-  if (!response.ok) {
-    throw new Error(`Failed to open extension home page ${url}: HTTP ${response.status}`);
+  try {
+    return await withBrowserCdp(port, (send, remaining) => browserCdp.openUrl(send, url, remaining));
+  } catch (error) {
+    throw new Error(`Failed to open extension home page ${url}: ${error.message}`);
   }
-  return response.json();
 }
 
 async function ensureExtensionTarget(input, port) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.70.0",
+  "version": "0.70.1",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"