@deeeed/metamask-harness 0.72.0 → 0.73.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## 0.73.0 - 2026-10-03
+
+### Changed
+
+- Recipe discovery runs on `@farmslot/recipe-cli`: `run --list` and recipe completion candidates use its readiness rule, and `run --describe` and recipe assistance use its call-graph composition. mm-harness still supplies the view and the policy: only the requested adapter's libraries are loaded, and readiness is judged against the MetaMask manifest `run` executes, so a broken recipe for another platform no longer matters and team manifests follow the same rules as `run --plan`. Flags and output are unchanged; the discovery goldens prove it.
+- Move to the Farmslot release that ships `@farmslot/recipe-cli`: `@farmslot/protocol` 0.34.0, `@farmslot/recipe-harness` 0.22.1, `@farmslot/recipe-cli` 0.1.1, `@farmslot/agent-runtime` 0.16.0 and `@farmslot/expo-recipe` 0.13.1, all on one protocol and one recipe-harness copy. With recipe-harness 0.22, a library's `recipes/terminal/` folder counts as the terminal variant of its plain ids, so `run --list --adapter terminal` with the terminal library also lists `perps.manage-position` and its siblings; the `terminal.perps.*` ids are unchanged.
+
 ## 0.72.0 - 2026-10-03
 
 ### Added

package/dist/commands/run-engine.js

@@ -30,6 +30,8 @@ import {
   validateMetaMaskActionInputs
 } from "../metamask-action-validation.js";
 import { gitLibraryProvenance } from "../library-provenance.js";
+import { runnableLibraryRecipes } from "../discovery.js";
+import { recipeComposition } from "@farmslot/recipe-cli";
 import {
   captureExecutionProvenance,
   executionProvenanceDrift,
@@ -710,35 +712,7 @@ function effectiveLibrarySources(librarySources) {
   return librarySources && librarySources.length > 0 ? librarySources : [{ name: "metamask", root: path.resolve(runnerDir, "library") }];
 }
 async function listRunnableRecipes(adapter, librarySources) {
-  const harness = await importRecipeHarness();
-  const sources = effectiveLibrarySources(librarySources);
-  const resolution = await harness.loadRecipeLibraries(
-    sources,
-    {
-      adapter
-    }
-  );
-  const protocol = await importRecipeProtocol();
-  const { manifest } = await resolveActionManifest(adapter, void 0, sources);
-  const externalRecipeIds = new Set(resolution.recipes.keys());
-  const validRefs = new Set([...resolution.recipes.values()].filter((recipe) => protocol.validateRecipeWithManifest(recipe.document, manifest, {
-    externalRecipeIds
-  }).status === "valid").map((recipe) => recipe.ref));
-  return [...resolution.recipes.values()].filter((recipe) => {
-    if (!validRefs.has(recipe.ref)) return false;
-    try {
-      const dependencies = harness.resolveRecipeDependencies({
-        rootRef: recipe.ref,
-        root: recipe.document,
-        rootSource: recipe.provenance,
-        recipes: resolution.recipes
-      });
-      return [...dependencies.recipes.keys()].every((ref) => validRefs.has(ref));
-    } catch (error) {
-      if (error instanceof harness.RecipeResolutionError) return false;
-      throw error;
-    }
-  }).map(
+  return (await runnableLibraryRecipes(adapter, effectiveLibrarySources(librarySources))).map(
     (recipe) => recipeSummary(recipe.ref, adapter, recipe.document, recipe)
   ).sort((left, right) => left.name.localeCompare(right.name));
 }
@@ -822,42 +796,6 @@ function recipeParameters(document) {
     };
   });
 }
-function recipeComposition(recipe, recipes) {
-  const actions = /* @__PURE__ */ new Set();
-  const nestedRecipes = /* @__PURE__ */ new Set();
-  const unresolvedRecipes = /* @__PURE__ */ new Set();
-  const visitedRecipes = /* @__PURE__ */ new Set();
-  const visitNode = (value) => {
-    if (!isRecord(value) || typeof value.action !== "string") return;
-    if (value.action !== "call") {
-      actions.add(value.action);
-      return;
-    }
-    if (typeof value.ref !== "string") return;
-    nestedRecipes.add(value.ref);
-    const dependency = recipes.get(value.ref);
-    if (!dependency) {
-      unresolvedRecipes.add(value.ref);
-      return;
-    }
-    if (visitedRecipes.has(value.ref)) return;
-    visitedRecipes.add(value.ref);
-    visitRecipe(dependency.document);
-  };
-  const visitWorkflow = (value) => {
-    if (!isRecord(value)) return;
-    if (isRecord(value.nodes)) Object.values(value.nodes).forEach(visitNode);
-  };
-  const visitRecipe = (document) => {
-    visitWorkflow(document.workflow);
-  };
-  visitRecipe(recipe);
-  return {
-    actions: [...actions].sort(),
-    nestedRecipes: [...nestedRecipes].sort(),
-    unresolvedRecipes: [...unresolvedRecipes].sort()
-  };
-}
 async function validateRunRecipeStatic(recipeArg, adapter, options, params = {}) {
   let librarySources = await resolveMetaMaskLibrarySources(
     optionStrings(options, "library")
@@ -1492,7 +1430,6 @@ export {
   preflightRecipe,
   prepareHeal,
   prepareRuntimeIfNeeded,
-  recipeComposition,
   resolveMetaMaskLibrarySources,
   resolveRunRecipeArg,
   runOneNode,

package/dist/discovery.js

@@ -0,0 +1,15 @@
+import { assessRecipe } from "@farmslot/recipe-cli";
+import {
+  loadRecipeLibraries
+} from "@farmslot/recipe-harness";
+import { resolveActionManifest } from "./manifest.js";
+async function runnableLibraryRecipes(adapter, sources) {
+  const resolution = await loadRecipeLibraries(sources, { adapter });
+  const { manifest } = await resolveActionManifest(adapter, void 0, sources);
+  return [...resolution.recipes.values()].filter(
+    (recipe) => assessRecipe({ resolution, manifest }, recipe).length === 0
+  );
+}
+export {
+  runnableLibraryRecipes
+};

package/dist/recipe-assistance-context.js

@@ -4,7 +4,8 @@ import { loadRecipeLibraries, resolveRecipeDependencies, rootResolutionRef } fro
 import { isSensitiveKey } from "./command-journal.js";
 import { resolveActionManifest } from "./manifest.js";
 import { describeManifestActions } from "./commands/manifest.js";
-import { recipeComposition, resolveMetaMaskLibrarySources, validateRunRecipeStatic } from "./commands/run-engine.js";
+import { recipeComposition } from "@farmslot/recipe-cli";
+import { resolveMetaMaskLibrarySources, validateRunRecipeStatic } from "./commands/run-engine.js";
 import { CliError, isRecord, optionStrings } from "./commands/parse-args.js";
 import { EXIT } from "./commands/shared.js";
 import { MAX_ADVICE_STATE_BYTES } from "./recipe-assistance-rubric.js";

package/docs/CONTRIBUTING.md

@@ -12,6 +12,7 @@ bin/mm-harness
   -> src/                         typed CLI and product decisions
   -> @farmslot/agent-runtime     checklist state
   -> @farmslot/handoff           scrubbed learning capture/share
+  -> @farmslot/recipe-cli        recipe discovery: libraries, runnable checks, composition
   -> @farmslot/recipe-harness    generic execution, UI transports, evidence
   -> @farmslot/protocol          schemas
   -> adapters/                   focused host/browser/device leaves
@@ -24,6 +25,7 @@ bin/mm-harness
 | `@farmslot/protocol` | recipe and evidence schemas |
 | `@farmslot/agent-runtime` | task-local checklist state and terminal contracts |
 | `@farmslot/handoff` | learning assembly, scrubbing, validation, approval, and publication |
+| `@farmslot/recipe-cli` | recipe discovery: library resolution, runnable checks, composition |
 | `@farmslot/recipe-harness` | generic execution, recovery, traces, artifacts, `ui.*` |
 | `mm-harness` | MetaMask runtime control, diagnostics, durable domain actions |
 | skills/checklists | task workflow and proof expectations |

package/docs/cli-contract.md

@@ -122,10 +122,10 @@ Each case runs under a safety cap, `GOLDENS_CASE_TIMEOUT` (default 600 s). A cas
 Each family is a normal contract test (`tests/contract/goldens-<family>.test.sh`). `gd_init` (`tests/contract/goldens/lib.sh`) builds a sandbox on `ct_init`, and every case runs under `env -i`:
 - `gd_init` first unsets every inherited `MM_HARNESS_*`, `RECIPE_*`, `METAMASK_*` and `FARMSLOT_*` variable, plus device and port pins (`IOS_SIMULATOR`, `ADB_SERIAL`, `WATCHER_PORT`, `METRO_PORT`, `CDP_PORT`, `IDB_PATH`, `ANDROID_HOME`, …). A developer's `MM_HARNESS_BIN` or `MM_HARNESS_IDB_PATH` export therefore cannot redirect a case;
 - the environment is an allowlist: sandbox `HOME`, caches, config, `FARMSLOT_HOME`, `TZ=UTC`, no update probe, and only the variables the family sets itself;
-- every interpreter and tool the goldens launch is resolved to its real binary before `HOME` moves into the sandbox: `node` (`process.execPath`), `python3` (`sys.executable`, for the test shell's port holder only), `git` (`git --exec-path`), `bash` (`$BASH`) and `timeout`. A tool that resolves to a script, the shape of an asdf/mise/volta/pyenv shim, fails the family up front with a message naming it. Each is checked to run with a sandboxed `HOME`;
+- every interpreter and tool the goldens launch is resolved to its real binary before `HOME` moves into the sandbox: `node` (`process.execPath`), `git` (`git --exec-path`), `bash` (`$BASH`) and `timeout`. The goldens need no Python. A tool that resolves to a script, the shape of an asdf/mise/volta/pyenv shim, fails the family up front with a message naming it. Each is checked to run with a sandboxed `HOME`;
 - `PATH` is pinned to the case stubs, the sandbox stubs, those real binaries, and `/usr/bin:/bin:/usr/sbin:/sbin`. Host tools (`idb`, `capture-helper`, a developer's Chrome) cannot change a golden;
 - device-tool discovery is pinned: `MM_HARNESS_IDB_PATH` and `MM_HARNESS_ADB_PATH` point at sandbox stubs, which discovery checks before any absolute Homebrew or pipx path;
-- localhost probes cannot reach a real server. `gd_reserve_ports` holds ephemeral ports that are bound but never listened on (`127.0.0.1` and `::1`), so Metro `/status` and CDP probes cannot connect (on macOS they time out rather than being refused) and nothing real can take the port mid-run. Each family exports the farm's slot port variables (`RECIPE_CDP_PORT`, `WATCHER_PORT`, `METRO_PORT`) set to those ports, so commands without an explicit port use them too. Goldens show them as `<PORT:NAME>`, rewritten only in port positions (`*port` keys, `:<port>`, `port <n>`/`PORT=<n>`, or an argument that is exactly the port), so an unrelated equal number such as a 60000 ms timeout is never rewritten;
+- localhost probes cannot reach a real server. `gd_reserve_ports` runs a Node port holder (`tests/contract/goldens/port-holder.mjs`) that holds ephemeral ports on `127.0.0.1` and `::1` and resets every connection it accepts, so Metro `/status` and CDP probes never get a response and nothing real can take the port mid-run. Each family exports the farm's slot port variables (`RECIPE_CDP_PORT`, `WATCHER_PORT`, `METRO_PORT`) set to those ports, so commands without an explicit port use them too. Goldens show them as `<PORT:NAME>`, rewritten only in port positions (`*port` keys, `:<port>`, `port <n>`/`PORT=<n>`, or a string that is exactly the port), so an unrelated equal number such as a 60000 ms timeout is never rewritten;
 - `tmux`, `xcrun` and `adb` are stubbed (`ct_init`, plus one booted simulator and one Android device for Mobile);
 - forbidden stubs record any call to `open`, `osascript`, `lsappinfo`, `screencapture`, `yarn`, `npx`, `npm`, `corepack`, `gh` and Chrome/Chromium, and the family fails if one is called. A browser stub answers only `--version`, and `npm` only `root -g` (install-source detection), with a sandbox path;
 - inert stubs on the case PATH only: `lsof`, `pgrep` and `pkill` find nothing, `ps` passes per-pid queries (`-p`, the CLI identifying its own processes) and lists an empty host for table listings, and `watchman` and `caffeinate` are no-ops. `stop` cannot see or signal a real process or touch a host daemon;
@@ -149,7 +149,7 @@ The goldens need the harness to be a git checkout: `execution-provenance.json` `
 
 `tests/contract/goldens/normalize.mjs` is the only normaliser. It rewrites only volatile values:
 
-1. Absolute paths: the sandbox becomes `<SANDBOX>`, the repo `<REPO>`, the real `$HOME` `<HOME>`, the node binary and its prefix `<NODE>`/`<NODE_PREFIX>`, and `os.tmpdir()` `<TMP>`. Both `/var` and `/private/var` spellings are covered. Ports from `gd_reserve_ports` become `<PORT:NAME>` in port positions only: numbers under `*port` keys, and in text after `:`, `port `, `port=` or `PORT=`, or a whole string equal to the port.
+1. Absolute paths: the sandbox becomes `<SANDBOX>`, the repo `<REPO>`, the real `$HOME` `<HOME>`, the node binary and its prefix `<NODE>`/`<NODE_PREFIX>`, and `os.tmpdir()` `<TMP>`. Both `/var` and `/private/var` spellings are covered. Ports from `gd_reserve_ports` become `<PORT:NAME>` in port positions only: numbers under `*port` keys, and in text after `:`, `port `, `port=` or `PORT=`, or a string that is exactly the port (`^<port>$`; `60000 ms` is left alone).
 2. UUIDs become `<UUID>`. Git object ids (40 hex, or a short hex value under a `*head`/`*gitRef`/`*commit` key) become `<GIT_REF>`. ISO-8601 timestamps become `<TIMESTAMP>`, and compact stamps in names `<STAMP>`. Path-derived slot ids `local-<adapter>-<8 hex>` become `local-<adapter>-<HASH>`.
 3. The package version becomes `<HARNESS_VERSION>`. Any other `x.y.z` under a key ending in `version` becomes `<VERSION>`.
 4. Numbers under volatile keys: `*pid` becomes `<PID>`, `*port` `<PORT>`, `*At`/`*Time`/`*timestamp`/`mtime*` `<TIMESTAMP>`, and `*Ms`/`duration*`/`elapsed*` `<DURATION>`. Values inside `schema` and `examples` subtrees (static manifest content) are never rewritten.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.72.0",
+  "version": "0.73.0",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"
@@ -21,11 +21,12 @@
     "check:syntax": "find . -name '*.mjs' -print0 | xargs -0 -n1 node --check"
   },
   "dependencies": {
-    "@farmslot/agent-runtime": "0.15.1",
-    "@farmslot/expo-recipe": "0.12.2",
+    "@farmslot/agent-runtime": "0.16.0",
+    "@farmslot/expo-recipe": "0.13.1",
     "@farmslot/handoff": "^0.3.1",
-    "@farmslot/protocol": "0.33.0",
-    "@farmslot/recipe-harness": "0.21.1",
+    "@farmslot/protocol": "0.34.0",
+    "@farmslot/recipe-cli": "0.1.1",
+    "@farmslot/recipe-harness": "0.22.1",
     "agent-device": "0.19.3",
     "commander": "^12.0.0",
     "es-module-lexer": "2.3.1",