@deeeed/metamask-harness 0.70.0 → 0.71.0

package/adapters/terminal/lib/page-script.mjs

@@ -0,0 +1,246 @@
+// Source of the script the wallet host evaluates in every app document before
+// page scripts. It reports each wallet request the app makes (method, EIP-712
+// primary type, domain/active chain, outcome; no params or signatures) through
+// a CDP binding, and in injected mode also provides the strict test wallet
+// announced over EIP-6963 as io.metamask. It installs itself only in the top
+// frame of a document on the exact app origin: the CDP preload also runs in
+// iframes and after the tab navigates elsewhere. Errors are logged as a code
+// and a fixed category, never as provider text.
+
+import { mainnetTypedDataReason } from './mainnet-guard.mjs';
+
+export const LOG_BINDING = '__mmTerminalWalletLog';
+export const REQUEST_BINDING = '__mmTerminalWalletRequest';
+export const RESOLVE_FN = '__mmTerminalWalletResolve';
+
+export const LOGGED_METHODS = Object.freeze([
+  'eth_requestAccounts',
+  'wallet_requestPermissions',
+  'wallet_revokePermissions',
+  'wallet_switchEthereumChain',
+  'wallet_addEthereumChain',
+  'eth_signTypedData',
+  'eth_signTypedData_v3',
+  'eth_signTypedData_v4',
+  'personal_sign',
+  'eth_sign',
+  'eth_sendTransaction',
+]);
+
+export const ERROR_CATEGORIES = Object.freeze({
+  4001: 'user-rejected',
+  4100: 'unauthorized',
+  4200: 'unsupported-method',
+  4900: 'disconnected',
+  4901: 'chain-disconnected',
+  4902: 'unrecognized-chain',
+  [-32602]: 'invalid-params',
+  [-32603]: 'internal',
+});
+
+function pageMain(config, mainnetTypedDataReason) {
+  if (window.top !== window || location.origin !== config.appOrigin) return;
+  if (window.__mmTerminalHarness) return;
+  // The wallet host's ready check reads this marker on the committed document:
+  // the preload ran, and the page's provider is wrapped (covers).
+  const wrapped = new WeakSet();
+  const harness = {
+    signer: config.signer,
+    network: config.network,
+    wrapped: 0,
+    wrapFailures: [],
+    covers: (provider) => Boolean(provider) && wrapped.has(provider),
+  };
+  window.__mmTerminalHarness = harness;
+  const logged = new Set(config.loggedMethods);
+  // Without the host's binding a wallet request would go unrecorded, so it is
+  // refused (fail closed) rather than passed through.
+  const unrecorded = () => Object.assign(
+    new Error('The harness wallet host is not attached to this document; the request was refused so it cannot go unrecorded.'),
+    { code: 4100 },
+  );
+  const hasBinding = (binding) => typeof window[binding] === 'function';
+  const report = (entry) => {
+    try {
+      window[config.logBinding](JSON.stringify(entry));
+    } catch {
+      // Binding unavailable (host detached): the request still proceeds.
+    }
+  };
+  const describe = (method, params) => {
+    const entry = { kind: 'request', method, t: Date.now(), url: location.pathname };
+    if (/^eth_signTypedData/.test(method)) {
+      try {
+        const raw = params?.[1];
+        const data = typeof raw === 'string' ? JSON.parse(raw) : raw;
+        entry.primaryType = data?.primaryType ?? null;
+        entry.domainName = data?.domain?.name ?? null;
+        entry.domainChainId = data?.domain?.chainId == null ? null : Number(BigInt(data.domain.chainId));
+      } catch {
+        entry.primaryType = null;
+      }
+    }
+    if (method === 'wallet_switchEthereumChain' || method === 'wallet_addEthereumChain') {
+      try {
+        entry.toChainId = Number.parseInt(params[0].chainId, 16);
+      } catch {
+        entry.toChainId = null;
+      }
+    }
+    return entry;
+  };
+  const wrap = (provider, source) => {
+    if (!provider || typeof provider.request !== 'function' || wrapped.has(provider)) return provider;
+    const original = provider.request.bind(provider);
+    const request = async (args) => {
+      const method = args?.method;
+      if (!logged.has(method)) return original(args);
+      if (!hasBinding(config.logBinding)) throw unrecorded();
+      const entry = { ...describe(method, args?.params), source };
+      // Testnet runs never let a mainnet Hyperliquid action reach the signer.
+      if (config.network === 'testnet' && /^eth_signTypedData/.test(method)) {
+        let reason = null;
+        try {
+          const raw = args?.params?.[1];
+          reason = mainnetTypedDataReason(typeof raw === 'string' ? JSON.parse(raw) : raw);
+        } catch {
+          reason = null;
+        }
+        if (reason) {
+          report({ ...entry, kind: 'refused-mainnet', reason, outcome: 'refused', errorCode: 4100 });
+          throw Object.assign(new Error('Refused: this test run is held to Hyperliquid testnet and the request signs a mainnet action.'), { code: 4100 });
+        }
+      }
+      try {
+        entry.activeChainId = Number.parseInt(await original({ method: 'eth_chainId' }), 16);
+      } catch {
+        entry.activeChainId = null;
+      }
+      const started = Date.now();
+      try {
+        const result = await original(args);
+        entry.outcome = /sign/i.test(method) ? 'signed' : 'approved';
+        entry.durationMs = Date.now() - started;
+        report(entry);
+        return result;
+      } catch (error) {
+        const code = Number.isInteger(error?.code) ? error.code : null;
+        entry.outcome = code === 4001 ? 'rejected' : 'error';
+        entry.errorCode = code;
+        entry.errorCategory = config.errorCategories[code] ?? 'other';
+        entry.durationMs = Date.now() - started;
+        report(entry);
+        throw error;
+      }
+    };
+    try {
+      provider.request = request;
+    } catch {
+      // Read-only property: define it instead (below).
+    }
+    if (provider.request !== request) {
+      try {
+        Object.defineProperty(provider, 'request', { value: request, configurable: true, writable: true });
+      } catch {
+        // Frozen provider: recorded below.
+      }
+    }
+    // A provider whose request could not be replaced would sign unrecorded.
+    if (provider.request !== request) {
+      harness.wrapFailures.push(source);
+      return provider;
+    }
+    wrapped.add(provider);
+    harness.wrapped += 1;
+    return provider;
+  };
+
+  if (config.signer === 'injected') {
+    const listeners = {};
+    const emit = (event, ...args) => (listeners[event] ?? []).forEach((fn) => {
+      try { fn(...args); } catch { /* listener errors stay in the app */ }
+    });
+    const pending = new Map();
+    let nextId = 1;
+    window[config.resolveFn] = (id, outcome) => {
+      const entry = pending.get(id);
+      if (!entry) return;
+      pending.delete(id);
+      if (outcome.error) entry.reject(Object.assign(new Error(outcome.error.message), { code: outcome.error.code }));
+      else entry.resolve(outcome.result);
+    };
+    let lastChain = null;
+    const provider = {
+      isMetaMask: true,
+      _metamask: { isUnlocked: async () => true },
+      request: ({ method, params }) => new Promise((resolve, reject) => {
+        if (!hasBinding(config.requestBinding)) {
+          reject(unrecorded());
+          return;
+        }
+        const id = nextId++;
+        pending.set(id, { resolve, reject });
+        window[config.requestBinding](JSON.stringify({ id, method, params }));
+      }).then((result) => {
+        if (method === 'wallet_switchEthereumChain' && params?.[0]?.chainId !== lastChain) {
+          lastChain = params[0].chainId;
+          emit('chainChanged', lastChain);
+        }
+        if (method === 'eth_chainId') lastChain = result;
+        if (method === 'eth_requestAccounts') emit('connect', { chainId: lastChain ?? '0x1' });
+        return result;
+      }),
+      on: (event, fn) => { (listeners[event] ??= []).push(fn); return provider; },
+      removeListener: (event, fn) => { listeners[event] = (listeners[event] ?? []).filter((f) => f !== fn); return provider; },
+      enable: () => provider.request({ method: 'eth_requestAccounts' }),
+    };
+    wrap(provider, 'injected-strict-wallet');
+    window.ethereum = provider;
+    const info = {
+      uuid: '5d1e5b4e-e2e0-4c3f-9a1d-000000000001',
+      name: 'MetaMask (strict test wallet)',
+      icon: "data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg'/>",
+      rdns: 'io.metamask',
+    };
+    const announce = () => window.dispatchEvent(new CustomEvent('eip6963:announceProvider', { detail: Object.freeze({ info, provider }) }));
+    window.addEventListener('eip6963:requestProvider', announce);
+    announce();
+    return;
+  }
+
+  // Extension mode: wrap whatever provider MetaMask injects, however the app
+  // reaches it (window.ethereum or an EIP-6963 announcement).
+  let current = window.ethereum ? wrap(window.ethereum, 'window.ethereum') : undefined;
+  try {
+    Object.defineProperty(window, 'ethereum', {
+      configurable: true,
+      get: () => current,
+      set: (value) => { current = wrap(value, 'window.ethereum'); },
+    });
+  } catch {
+    // A non-configurable window.ethereum is still wrapped by the poll below.
+  }
+  window.addEventListener('eip6963:announceProvider', (event) => {
+    wrap(event.detail?.provider, `eip6963:${event.detail?.info?.rdns ?? 'unknown'}`);
+  }, true);
+  let polls = 0;
+  const poll = setInterval(() => {
+    if (window.ethereum) wrap(window.ethereum, 'window.ethereum');
+    if (++polls > 200) clearInterval(poll);
+  }, 50);
+}
+
+export function pageScriptSource({ signer, appOrigin, network = 'testnet' }) {
+  const origin = new URL(appOrigin).origin;
+  const config = {
+    signer,
+    network,
+    appOrigin: origin,
+    errorCategories: ERROR_CATEGORIES,
+    loggedMethods: LOGGED_METHODS,
+    logBinding: LOG_BINDING,
+    requestBinding: REQUEST_BINDING,
+    resolveFn: RESOLVE_FN,
+  };
+  return `(${pageMain.toString()})(${JSON.stringify(config)}, ${mainnetTypedDataReason.toString()});`;
+}

package/adapters/terminal/lib/processes.mjs

@@ -0,0 +1,187 @@
+// Stop the terminal slot browser and wallet host by their pid files and prove
+// the slot CDP port is released. A pid is signalled only when its command line
+// carries this slot's owner marker for that process kind. A pid file naming a
+// dead process is removed; one naming a live process without the marker is
+// kept and reported, never signalled.
+
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import net from 'node:net';
+import path from 'node:path';
+
+import { terminalRuntimeDir } from '../../../library/actions/terminal/platform/runtime.mjs';
+
+export function pidAlive(pid) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return false;
+  try {
+    process.kill(Number(pid), 0);
+    return true;
+  } catch (error) {
+    return error.code === 'EPERM';
+  }
+}
+
+function groupAlive(pgid) {
+  try {
+    process.kill(-pgid, 0);
+    return true;
+  } catch (error) {
+    return error.code === 'EPERM';
+  }
+}
+
+function readPid(file) {
+  if (!existsSync(file)) return null;
+  const pid = Number(readFileSync(file, 'utf8').trim());
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+
+function psField(pid, field) {
+  try {
+    return execFileSync('ps', ['-ww', '-o', `${field}=`, '-p', String(pid)], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+  } catch {
+    return '';
+  }
+}
+
+export function processCommand(pid) {
+  return pidAlive(pid) ? psField(pid, 'command') : '';
+}
+
+// Each process the slot starts carries `--mm-harness-owner=<kind>-<id>`, where
+// <id> is derived from the canonical runtime dir. Ownership is that exact
+// argument, compared as a whole whitespace-free token, so a runtime dir that
+// shares a prefix with this one (".../terminal backup", ".../terminal2")
+// never matches.
+export const OWNER_FLAG = '--mm-harness-owner';
+export const OWNER_KINDS = Object.freeze(['browser', 'wallet-host', 'console-collector']);
+
+export function ownerMarker(kind, runtimeDir) {
+  if (!OWNER_KINDS.includes(kind)) throw new Error(`unknown terminal process kind ${kind}`);
+  const id = createHash('sha256').update(path.resolve(runtimeDir)).digest('hex').slice(0, 32);
+  return `${OWNER_FLAG}=${kind}-${id}`;
+}
+
+export function ownsProcess(kind, pid, runtimeDir, command = processCommand(pid)) {
+  if (!command) return false;
+  return command.split(/\s+/u).includes(ownerMarker(kind, runtimeDir));
+}
+
+export function portFree(port) {
+  return new Promise((resolve) => {
+    const socket = net.connect({ host: '127.0.0.1', port }, () => {
+      socket.destroy();
+      resolve(false);
+    });
+    socket.on('error', () => resolve(true));
+  });
+}
+
+// Browsers and hosts are spawned detached, each leading its own process group.
+// When the pid leads its group the whole group is signalled and waited for,
+// so children that outlive the leader (renderers, a child ignoring SIGTERM)
+// are killed too; otherwise only the pid.
+export async function terminate(pid, graceMs = 8000) {
+  if (!pidAlive(pid)) return false;
+  const group = Number(psField(pid, 'pgid')) === pid;
+  const alive = () => (group ? groupAlive(pid) : pidAlive(pid));
+  const signal = (name) => {
+    try {
+      process.kill(group ? -pid : pid, name);
+    } catch {
+      // Already gone.
+    }
+  };
+  signal('SIGTERM');
+  const deadline = Date.now() + graceMs;
+  while (alive() && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 200));
+  if (alive()) {
+    signal('SIGKILL');
+    const killDeadline = Date.now() + 5000;
+    while (alive() && Date.now() < killDeadline) await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  return true;
+}
+
+// The console collector a run started (src/adapters/terminal/console-capture.ts)
+// outlives browser relaunches inside the run; stop and cleanup end it.
+export async function stopConsoleCollector(target, { log = () => {}, runtimeDir } = {}) {
+  const runtime = runtimeDir ?? terminalRuntimeDir(target);
+  const pidFile = path.join(runtime, 'console-tail.pid');
+  const pid = readPid(pidFile);
+  if (!pid) return { stopped: null };
+  if (ownsProcess('console-collector', pid, runtime)) {
+    await terminate(pid, 3000);
+    rmSync(pidFile, { force: true });
+    log(`stopped console collector pid ${pid}`);
+    return { stopped: pid };
+  }
+  if (pidAlive(pid)) {
+    log(`console collector pid ${pid} is alive but is not this slot's collector; left it alone`);
+    return { stopped: null, foreign: pid };
+  }
+  rmSync(pidFile, { force: true });
+  return { stopped: null, stale: pid };
+}
+
+// Every live process that proves it is a browser on this slot's profiles,
+// found by command line: a browser started through LaunchServices has no
+// child handle, and its pid is only known once it owns the CDP port.
+export function ownedBrowserPids(runtimeDir) {
+  const runtime = path.resolve(runtimeDir);
+  let lines = '';
+  try {
+    // `--` ends pgrep's options: the pattern itself starts with dashes.
+    lines = execFileSync('pgrep', ['-f', '--', ownerMarker('browser', runtime)], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch {
+    return [];
+  }
+  return lines.split('\n').map(Number).filter((pid) => pid > 0 && ownsProcess('browser', pid, runtime));
+}
+
+export function cdpListenerPids(port) {
+  try {
+    return execFileSync('lsof', ['-nP', `-iTCP:${port}`, '-sTCP:LISTEN', '-t'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      .split('\n').map(Number).filter((pid) => pid > 0);
+  } catch {
+    return [];
+  }
+}
+
+export async function stopTerminalBrowser(target, { cdpPort, log = () => {}, runtimeDir } = {}) {
+  const runtime = runtimeDir ?? terminalRuntimeDir(target);
+  const stopped = [];
+  const stale = [];
+  const foreign = [];
+  for (const name of ['wallet-host', 'browser']) {
+    const pidFile = path.join(runtime, `${name}.pid`);
+    const pid = readPid(pidFile);
+    if (pid && ownsProcess(name, pid, runtime)) {
+      if (await terminate(pid)) {
+        stopped.push({ name, pid });
+        log(`stopped ${name} pid ${pid}`);
+      }
+      rmSync(pidFile, { force: true });
+    } else if (pid && pidAlive(pid)) {
+      foreign.push({ name, pid });
+      log(`${name} pid ${pid} is alive but is not this slot's ${name}; left it and its pid file alone`);
+    } else {
+      if (pid) stale.push({ name, pid });
+      rmSync(pidFile, { force: true });
+    }
+  }
+  rmSync(path.join(runtime, 'wallet-host.ready'), { force: true });
+  rmSync(path.join(runtime, 'browser.json'), { force: true });
+  let free = null;
+  if (cdpPort) {
+    const deadline = Date.now() + 10000;
+    free = await portFree(cdpPort);
+    while (!free && Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, 250));
+      free = await portFree(cdpPort);
+    }
+    if (!free) throw new Error(`CDP port ${cdpPort} is still in use after stopping the terminal browser; another process owns it.`);
+  }
+  return { stopped, stale, foreign, cdpPortFree: free };
+}