@deeeed/metamask-harness 0.77.0 → 0.78.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## 0.78.0 - 2026-10-05
+
+### Changed
+
+- The browser process and CDP helpers moved to `@farmslot/adapter-web` (new dependency): `browser-resolver`, `browser-cdp`, `chrome-args`, `extension-id`, `macos-focus`, `playwright-cdp`, `validation-process-ownership` and `validation-launch-supervisor`. Their old paths under `adapters/shared/` and `adapters/extension/lib/` are gone; adapters, library actions, the Terminal launcher and `src/` require the package. Behaviour is unchanged.
+- **Upgrade note: stop running slot browsers before upgrading**: run `mm-harness stop --adapter extension --target <checkout>` once for each Extension checkout with a running browser. The browser identity names are Farmslot's now and the old runtime nonce is no longer accepted, so a browser started by an earlier version may not be recognised as owned (one found by its slot profile still is): `--farmslot-runtime-nonce=`, `.farmslot-detached-launch-unproven`, `/tmp/farmslot-browser-validation-<uid>`, and the probe cache `~/.cache/farmslot/browser-probe.json` (the old `~/.cache/mm-harness/browser-probe.json` and its lock directories are no longer read and can be deleted). The focus knobs are `FARMSLOT_FOCUS_HOLD` and `FARMSLOT_FOCUS_BROWSER` (were `MM_HARNESS_FOCUS_HOLD` / `MM_HARNESS_FOCUS_BROWSER`).
+- The Extension overlay vendors `@farmslot/adapter-web` into `<harness>/scripts/node_modules/` instead of flattening copies into `scripts/lib/`, and the harness source fingerprint covers the package sources, so a package upgrade refreshes installed overlays.
+
 ## 0.77.0 - 2026-10-04
 
 ### Changed

package/README.md

@@ -134,7 +134,7 @@ disabled, so the launch warns and records them with the run evidence.
 
 In `auto`, a launch with a new profile probe-launches Chrome for Testing the
 way the launcher starts it (headful, through Launch Services on macOS). The
-verdict lives in `~/.cache/mm-harness/browser-probe.json`: a crash is kept
+verdict lives in `~/.cache/farmslot/browser-probe.json`: a crash is kept
 until the OS build or browser changes; a probe that only timed out is retried
 after 30 minutes. Concurrent launches wait for one probe per browser build
 (a `<cache>.<key>.locks/` directory of numbered tickets next to the cache; a
@@ -144,7 +144,7 @@ file one duplicate probe is possible). Tickets are never removed by the
 harness: each probe adds two small files, and a crashed holder's unreleased
 ticket stays (it no longer blocks once its process is gone). To reclaim the
 space, remove the lock directories while no launch or doctor is running:
-`rm -r ~/.cache/mm-harness/browser-probe.json.*.locks`.
+`rm -r ~/.cache/farmslot/browser-probe.json.*.locks`.
 On a cold cache the probe can take up to about 80 seconds and
 shows a small (about 480×360) browser window; `doctor --adapter extension`
 runs the same probe.
@@ -205,8 +205,11 @@ On macOS the slot browser starts in the background with no startup window,
 and its first window opens over CDP as a background window. After the launch
 settles there is one focus check: only if the slot browser's own process is
 frontmost does the previously focused app get the front back, once
-(`MM_HARNESS_FOCUS_HOLD=0` turns this off). A click on the slot window right
-after launch can therefore be undone once.
+(`FARMSLOT_FOCUS_HOLD=0` turns this off). A click on the slot window right
+after launch can therefore be undone once. `FARMSLOT_FOCUS_HOLD` and
+`FARMSLOT_FOCUS_BROWSER` belong to `@farmslot/adapter-web`; the settle delay
+before that check, `MM_HARNESS_FOCUS_SETTLE_MS`, belongs to this harness's
+launchers.
 
 ```bash
 # Roll back to Chrome for Testing with a fresh slot profile (a profile Google
@@ -214,7 +217,7 @@ after launch can therefore be undone once.
 # RECIPE_HARNESS_BROWSER=cft set for later launches too: on a plain auto launch
 # the profile follows Chrome for Testing only until a probe proves it dies.
 RECIPE_HARNESS_BROWSER=cft mm-harness fixtures set
-rm ~/.cache/mm-harness/browser-probe.json        # forget probe verdicts
+rm ~/.cache/farmslot/browser-probe.json        # forget probe verdicts
 ```
 
 ### Remote feature flags

package/adapters/extension/build-handoff.cjs

@@ -4,8 +4,8 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { spawnSync } = require('node:child_process');
-const { connectBrowserViaCdp, evaluatePageViaCdp } = require('./lib/playwright-cdp.cjs');
-const { RUNTIME_IDENTITY_FILENAME, RUNTIME_NONCE_PREFIX } = require('./lib/chrome-args.cjs');
+const { connectBrowserViaCdp, evaluatePageViaCdp } = require('@farmslot/adapter-web/playwright-cdp');
+const { RUNTIME_IDENTITY_FILENAME, RUNTIME_NONCE_PREFIX } = require('@farmslot/adapter-web/chrome-args');
 const { stampRuntimeTitles } = require('./stamp-runtime-title.cjs');
 const { carryHarnessPin } = require('./pin-remote-flags.cjs');
 

package/adapters/extension/ensure-browser.sh

@@ -205,10 +205,10 @@ kill_profile_processes() {
 
 # Invalidate the old browser identity before signaling it. A concurrent quick
 # launch must fall through to process ownership while replacement is underway.
-node - "$SCRIPT_DIR/lib/chrome-args.cjs" "$AGENT_DIR" <<'NODE'
-const [modulePath, runtimeDir] = process.argv.slice(2);
+node - "$SCRIPT_DIR" "$AGENT_DIR" <<'NODE'
+const [scriptDir, runtimeDir] = process.argv.slice(2);
 try {
-  require(modulePath).removeRuntimeIdentity(runtimeDir);
+  require('node:module').createRequire(`${scriptDir}/`)('@farmslot/adapter-web/chrome-args').removeRuntimeIdentity(runtimeDir);
 } catch (error) {
   const detail = error instanceof Error ? error.message : String(error);
   throw new Error(
@@ -292,6 +292,7 @@ trap - EXIT
 exec node -e "
 const path = require('path');
 const fs = require('fs');
+const adapterWeb = (name) => require('module').createRequire(path.join('${SCRIPT_DIR}', 'package.json'))('@farmslot/adapter-web/' + name);
 const http = require('http');
 const { execFileSync } = require('child_process');
 let chromium; try { chromium = require('@playwright/test').chromium; } catch { chromium = require('playwright').chromium; }
@@ -303,9 +304,9 @@ const {
   removeRuntimeIdentity,
   runtimeIdentityArgs,
   writeRuntimeIdentity,
-} = require(path.join('${SCRIPT_DIR}', 'lib/chrome-args.cjs'));
-const { captureMacFrontmost, macBackgroundOpenArgs, restoreFrontmostIfOurs } = require(path.join('${SCRIPT_DIR}', 'lib/macos-focus.cjs'));
-const { stopProfileProcessesSync } = require(path.join('${SCRIPT_DIR}', 'lib/validation-process-ownership.cjs'));
+} = adapterWeb('chrome-args');
+const { captureMacFrontmost, macBackgroundOpenArgs, restoreFrontmostIfOurs } = adapterWeb('macos-focus');
+const { stopProfileProcessesSync } = adapterWeb('validation-process-ownership');
 const {
   CDP_LOAD_UNPACKED,
   HEADFUL,
@@ -315,10 +316,7 @@ const {
   waitForCdpOwner,
   playwrightChromiumExecutable,
   resolveBrowser,
-} = require([
-  path.join('${SCRIPT_DIR}', 'lib/browser-resolver.cjs'),
-  path.join('${SCRIPT_DIR}', '../shared/browser-resolver.cjs'),
-].find((candidate) => fs.existsSync(candidate)));
+} = adapterWeb('browser-resolver');
 
 const SLOT_ID = '${SLOT_ID}';
 const AGENT_DIR = '${AGENT_DIR}';
@@ -520,7 +518,7 @@ const releaseFocusHold = () => {
 
   // Set window title to slot ID (persists across SPA navigations)
   const { applyPersistentSlotTitle } = require(path.join('${SCRIPT_DIR}', 'lib/slot-title.cjs'));
-  const { evaluatePageViaCdp } = require(path.join('${SCRIPT_DIR}', 'lib/playwright-cdp.cjs'));
+  const { evaluatePageViaCdp } = adapterWeb('playwright-cdp');
   await evaluatePageViaCdp(page, applyPersistentSlotTitle, SLOT_ID);
 
   // Wait for runtime state to settle, then unlock if needed.
@@ -573,7 +571,7 @@ const releaseFocusHold = () => {
       await p.close().catch(() => {});
     }
   }
-  if (process.env.MM_HARNESS_FOCUS_BROWSER === '1') {
+  if (process.env.FARMSLOT_FOCUS_BROWSER === '1') {
     await page.bringToFront().catch(() => {});
   } else {
     const settleMs = Number(process.env.MM_HARNESS_FOCUS_SETTLE_MS);

package/adapters/extension/inject.mjs

@@ -20,6 +20,7 @@
 // Never touches: product source files; anything outside the target's
 // harness dir and the target's .git/info/exclude.
 import fs from 'node:fs';
+import { createRequire } from 'node:module';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import process from 'node:process';
@@ -126,15 +127,9 @@ copyFile(path.join(runnerDir, 'adapters/shared/json-field.sh'), path.join(harnes
 copyFile(path.join(runnerDir, 'adapters/shared/tmux-session.sh'), path.join(harnessDir, 'scripts/lib/tmux-session.sh'));
 copyFile(path.join(runnerDir, 'adapters/shared/tmux-viewer.sh'), path.join(harnessDir, 'scripts/lib/tmux-viewer.sh'));
 copyFile(path.join(runnerDir, 'adapters/shared/log-tui.mjs'), path.join(harnessDir, 'scripts/lib/log-tui.mjs'));
-copyFile(path.join(runnerDir, 'adapters/shared/browser-resolver.cjs'), path.join(harnessDir, 'scripts/lib/browser-resolver.cjs'));
-copyFile(path.join(runnerDir, 'adapters/shared/browser-cdp.cjs'), path.join(harnessDir, 'scripts/lib/browser-cdp.cjs'));
-copyFile(path.join(runnerDir, 'adapters/extension/lib/extension-id.cjs'), path.join(harnessDir, 'scripts/lib/extension-id.cjs'));
-copyFile(path.join(runnerDir, 'adapters/extension/lib/playwright-cdp.cjs'), path.join(harnessDir, 'scripts/lib/playwright-cdp.cjs'));
+copyAdapterWeb(path.join(harnessDir, 'scripts/node_modules/@farmslot/adapter-web'));
 copyFile(path.join(runnerDir, 'adapters/extension/lib/slot-title.cjs'), path.join(harnessDir, 'scripts/lib/slot-title.cjs'));
-copyFile(path.join(runnerDir, 'adapters/extension/lib/chrome-args.cjs'), path.join(harnessDir, 'scripts/lib/chrome-args.cjs'));
-copyFile(path.join(runnerDir, 'adapters/extension/lib/macos-focus.cjs'), path.join(harnessDir, 'scripts/lib/macos-focus.cjs'));
 copyFile(path.join(runnerDir, 'adapters/extension/lib/product-config.cjs'), path.join(harnessDir, 'scripts/lib/product-config.cjs'));
-copyFile(path.join(runnerDir, 'adapters/extension/lib/validation-process-ownership.cjs'), path.join(harnessDir, 'scripts/lib/validation-process-ownership.cjs'));
 makeExecutableTree(path.join(harnessDir, 'scripts'));
 fs.writeFileSync(path.join(harnessDir, 'installed-scripts.sha256'), `${dirContentHash(path.join(harnessDir, 'scripts'))}\n`);
 
@@ -205,6 +200,14 @@ function refuseSymlinkDestination(root, rel) {
   }
 }
 
+// Overlay scripts run from the target checkout, which cannot resolve the runner's
+// packages; vendor @farmslot/adapter-web where they resolve it (scripts/node_modules).
+function copyAdapterWeb(dest) {
+  const packageJson = createRequire(path.join(runnerDir, 'package.json')).resolve('@farmslot/adapter-web/package.json');
+  copyFile(packageJson, path.join(dest, 'package.json'));
+  copyDir(path.join(path.dirname(packageJson), 'src'), path.join(dest, 'src'));
+}
+
 function copyFile(src, dest) {
   fs.mkdirSync(path.dirname(dest), { recursive: true });
   fs.copyFileSync(src, dest);

package/adapters/extension/launch-browser.cjs

@@ -27,14 +27,11 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { execFileSync, spawn, spawnSync } = require('node:child_process');
-const { extensionIdFromExtensionDir } = require('./lib/extension-id.cjs');
-// The installed overlay flattens shared helpers into scripts/lib/.
-const browserResolverPath = [
-  path.join(__dirname, 'lib/browser-resolver.cjs'),
-  path.join(__dirname, '../shared/browser-resolver.cjs'),
-].find((candidate) => fs.existsSync(candidate));
+const { extensionIdFromExtensionDir } = require('@farmslot/adapter-web/extension-id');
+// The resolver CLI runs as a bounded child for CDP calls the launcher must not hang on.
+const browserResolverPath = require.resolve('@farmslot/adapter-web/browser-resolver');
 const { CDP_LOAD_UNPACKED, describeBrowser, extensionLaunchArgs, waitForCdpOwner } = require(browserResolverPath);
-const { profileProcessPids, stopProfileProcessesSync } = require('./lib/validation-process-ownership.cjs');
+const { profileProcessPids, stopProfileProcessesSync } = require('@farmslot/adapter-web/validation-process-ownership');
 const { acquireBuildHandoff } = require('./build-handoff.cjs');
 const {
   automationRuntimeArgs,
@@ -51,12 +48,12 @@ const {
   readValidationPortQuarantine,
   validationLaunchQuarantineError,
   writeRuntimeIdentity,
-} = require('./lib/chrome-args.cjs');
+} = require('@farmslot/adapter-web/chrome-args');
 const {
   captureMacFrontmost,
   macBackgroundOpenArgs,
   restoreFrontmostIfOurs,
-} = require('./lib/macos-focus.cjs');
+} = require('@farmslot/adapter-web/macos-focus');
 
 if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log(
@@ -138,7 +135,7 @@ if (args['stop-only'] !== undefined) {
 
 const requestedProfileQuarantined = hasDetachedLaunchUnproven(args.profile);
 const portQuarantine = readValidationPortQuarantine(cdpPort);
-const validationPortLease = process.env.MM_HARNESS_VALIDATION_PORT_LEASE;
+const validationPortLease = process.env.FARMSLOT_VALIDATION_PORT_LEASE;
 const activeValidationLease = Boolean(
   portQuarantine?.profile === path.resolve(args.profile) &&
   portQuarantine.lease === validationPortLease &&

package/adapters/extension/live.sh

@@ -245,8 +245,7 @@ NODE
   # launcher knows how to load the extension and the run evidence names it.
   # launch-browser.cjs starts a macOS .app through Launch Services, headful,
   # so the probe does too.
-  BROWSER_RESOLVER="$SCRIPT_DIR/lib/browser-resolver.cjs"
-  [ -f "$BROWSER_RESOLVER" ] || BROWSER_RESOLVER="$SCRIPT_DIR/../shared/browser-resolver.cjs"
+  BROWSER_RESOLVER="$(node -e 'process.stdout.write(require("node:module").createRequire(`${process.argv[1]}/`).resolve("@farmslot/adapter-web/browser-resolver"))' "$SCRIPT_DIR")"
   # A preserved profile keeps the browser recorded for it (auto never flips a
   # profile between builds); the resolver bounds itself (probe + watchdog).
   CHROME_PROBE_LOG="$ARTIFACTS/logs/chrome-probe.log"

package/adapters/extension/reattach.sh

@@ -119,9 +119,9 @@ CDP_PORT="$CDP_PORT" EXT_ID="$EXT_ID" TARGET="$TARGET" SCRIPT_DIR="$SCRIPT_DIR"
 let chromium; try { chromium = require('@playwright/test').chromium; } catch { chromium = require('playwright').chromium; }
 const fs = require('node:fs');
 const path = require('node:path');
-const { extensionIdFromManifestFile } = require(path.join(process.env.SCRIPT_DIR, 'lib/extension-id.cjs'));
+const { extensionIdFromManifestFile } = require('node:module').createRequire(`${process.env.SCRIPT_DIR}/`)('@farmslot/adapter-web/extension-id');
 const { readSlotId, applyPersistentSlotTitle } = require(path.join(process.env.SCRIPT_DIR, 'lib/slot-title.cjs'));
-const { evaluatePageViaCdp } = require(path.join(process.env.SCRIPT_DIR, 'lib/playwright-cdp.cjs'));
+const { evaluatePageViaCdp } = require('node:module').createRequire(`${process.env.SCRIPT_DIR}/`)('@farmslot/adapter-web/playwright-cdp');
 
 const port = process.env.CDP_PORT;
 const target = process.env.TARGET;
@@ -294,7 +294,7 @@ async function closePages(context, predicate) {
       if (!startUrl && (url.startsWith('http://') || url.startsWith('https://'))) return true;
       return false;
     });
-    if (process.env.MM_HARNESS_FOCUS_BROWSER === '1') {
+    if (process.env.FARMSLOT_FOCUS_BROWSER === '1') {
       await home.bringToFront().catch(() => {});
     }
   }

package/adapters/extension/sidepanel-toggle.sh

@@ -108,7 +108,7 @@ json_list() {
 }
 
 focus_browser() {
-  [ "${MM_HARNESS_FOCUS_BROWSER:-}" = "1" ]
+  [ "${FARMSLOT_FOCUS_BROWSER:-}" = "1" ]
 }
 
 find_sidepanel_id() {
@@ -162,7 +162,7 @@ resolve_ext_id() {
   manifest_id="$(
     SCRIPT_DIR="$SCRIPT_DIR" REPO="$REPO" RUNTIME_DIR="$RUNTIME_DIR" RUNTIME_DIST_DIR="$RUNTIME_DIST_DIR" node <<'NODE' 2>/dev/null || true
 const path = require('node:path');
-const { extensionIdFromManifestFile } = require(path.join(process.env.SCRIPT_DIR, 'lib/extension-id.cjs'));
+const { extensionIdFromManifestFile } = require('node:module').createRequire(`${process.env.SCRIPT_DIR}/`)('@farmslot/adapter-web/extension-id');
 const id = extensionIdFromManifestFile(path.join(process.env.REPO, process.env.RUNTIME_DIR, process.env.RUNTIME_DIST_DIR, 'manifest.json'));
 if (id) process.stdout.write(id);
 NODE
@@ -321,7 +321,7 @@ const path = require('node:path');
 const {
   connectBrowserViaCdp,
   evaluatePageViaCdp,
-} = require(path.join(process.env.SCRIPT_DIR, 'lib/playwright-cdp.cjs'));
+} = require('node:module').createRequire(`${process.env.SCRIPT_DIR}/`)('@farmslot/adapter-web/playwright-cdp');
 
 async function clickVisibleSafeHit(page, selector, successSelector, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
@@ -371,7 +371,7 @@ async function clickVisibleSafeHit(page, selector, successSelector, timeoutMs) {
       waitUntil: 'domcontentloaded',
       timeout: 15000,
     });
-    if (process.env.MM_HARNESS_FOCUS_BROWSER === '1') {
+    if (process.env.FARMSLOT_FOCUS_BROWSER === '1') {
       await page.bringToFront();
     }
     await clickVisibleSafeHit(

package/adapters/extension/wallet-fixture-state.cjs

@@ -20,8 +20,8 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const http = require('node:http');
 const path = require('node:path');
-const { extensionIdFromManifestKey } = require('./lib/extension-id.cjs');
-const { evaluatePageViaCdp } = require('./lib/playwright-cdp.cjs');
+const { extensionIdFromManifestKey } = require('@farmslot/adapter-web/extension-id');
+const { evaluatePageViaCdp } = require('@farmslot/adapter-web/playwright-cdp');
 
 const EOA_METHODS = [
   'personal_sign',

package/adapters/manifest.json

@@ -282,14 +282,6 @@
       "inputs": "--cdp-port --chrome-bin --profile --extension-dir --chrome-log --chrome-pid [--browser-resolution]",
       "outputs": "pid file + append-log + <runtime>/browser-resolution.json; exit 0 / non-zero"
     },
-    {
-      "id": "extension/validation-process-ownership",
-      "entry": "adapters/extension/lib/validation-process-ownership.cjs",
-      "kind": "lib",
-      "purpose": "Resolve browser processes owned by one isolated Extension validation profile.",
-      "inputs": "profile path",
-      "outputs": "owned process identifiers"
-    },
     {
       "id": "extension/refresh-build",
       "entry": "adapters/extension/refresh-build.sh",
@@ -506,22 +498,6 @@
       "inputs": "--target <checkout>",
       "outputs": "corepack yarn install output; exit 0/1/2"
     },
-    {
-      "id": "lib/browser-resolver",
-      "entry": "adapters/shared/browser-resolver.cjs",
-      "kind": "node",
-      "purpose": "Choose the extension browser (RECIPE_HARNESS_BROWSER=auto|cft|chrome|<path>; probe-launch Chrome for Testing, cached per machine and version, branded Chrome fallback) and load an unpacked extension over CDP for branded Chrome.",
-      "inputs": "resolve --target <checkout> [--launch-method spawn|launch-services] [--display headless|headful] [--recorded <file>] [--out <file>] [--json] | load-unpacked --port <cdp> --path <dist> --profile <dir> [--expect-id <id>] [--open-url <url>]; env RECIPE_HARNESS_BROWSER, RECIPE_HARNESS_CHROME_BIN, RECIPE_HARNESS_CHROME_CANDIDATES, RECIPE_HARNESS_BROWSER_CACHE",
-      "outputs": "executable path or resolution JSON on stdout; probe cache under ~/.cache/mm-harness; exit 0/1"
-    },
-    {
-      "id": "lib/browser-cdp",
-      "entry": "adapters/shared/browser-cdp.cjs",
-      "kind": "lib",
-      "purpose": "Browser-level CDP client with per-command deadlines; prove a CDP port belongs to a slot profile, load an unpacked extension (Extensions.loadUnpacked), audit for other user extensions.",
-      "inputs": "CDP port, extension dist, owning profile",
-      "outputs": "loaded extension id or an error; never loads into a browser it does not own"
-    },
     {
       "id": "lib/resolve-slot-ports",
       "entry": "adapters/shared/resolve-slot-ports.mjs",

package/adapters/shared/harness-source-fingerprint.mjs

@@ -7,11 +7,13 @@
 // what makes the runner the single source of truth: edit a runner adapter file and
 // the next launch refreshes every slot from it.
 //
-// stat-only (size + mtime) so it is cheap enough to run on every launch; no file
-// contents are read and no Date.now()/random is used (both would break determinism).
+// Source files count by size + mtime, so it is cheap enough to run on every launch;
+// the only file read is @farmslot/adapter-web's package.json, for its version. No
+// Date.now()/random is used (both would break determinism).
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
 
 export function harnessSourceFingerprint(runnerDir, adapter = 'extension') {
@@ -23,6 +25,18 @@ export function harnessSourceFingerprint(runnerDir, adapter = 'extension') {
   for (const rel of sourceDirs) {
     collect(path.join(runnerDir, rel), runnerDir, entries);
   }
+  // inject.mjs copies the browser helpers from @farmslot/adapter-web, so its sources
+  // are overlay inputs too; label them by package so the install location does not count.
+  if (adapter === 'extension') {
+    const packageJson = createRequire(path.join(runnerDir, 'package.json')).resolve('@farmslot/adapter-web/package.json');
+    const packageRoot = path.dirname(packageJson);
+    const packageEntries = [];
+    collect(path.join(packageRoot, 'src'), packageRoot, packageEntries);
+    entries.push(...packageEntries.map((entry) => `@farmslot/adapter-web/${entry}`));
+    // npm tarballs carry fixed mtimes, so an upgrade can keep every size and mtime:
+    // the version marks it.
+    entries.push(`@farmslot/adapter-web@${JSON.parse(fs.readFileSync(packageJson, 'utf8')).version}`);
+  }
   entries.sort();
   return crypto.createHash('sha256').update(entries.join('\n')).digest('hex');
 }

package/adapters/terminal/launch.mjs

@@ -46,7 +46,7 @@ import { hostResolverRules, venueHosts } from './lib/mainnet-guard.mjs';
 import { assertLaunchNetwork, devServerTestnetDiagnostic } from './lib/readiness.mjs';
 
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
-const macosFocus = createRequire(import.meta.url)('../extension/lib/macos-focus.cjs');
+const macosFocus = createRequire(import.meta.url)('@farmslot/adapter-web/macos-focus');
 const HARNESS_ROOT = path.resolve(SCRIPT_DIR, '../..');
 const FIXTURE_STATE_SCRIPT = path.join(HARNESS_ROOT, 'adapters/extension/wallet-fixture-state.cjs');
 
@@ -217,7 +217,7 @@ const FOCUS_OUTCOMES = {
   off: () => 'focus handling is off, or no app was captured before the launch',
 };
 
-// The one focus check after a launch (shared macos-focus.cjs): the app in
+// The one focus check after a launch (@farmslot/adapter-web/macos-focus): the app in
 // front before the launch gets the front back, once, by its pid, only if one
 // of this slot's browser processes (by owner marker, never by bundle) is in
 // front.

package/adapters/terminal/wallet-host.mjs

@@ -36,7 +36,7 @@ import { isAppTopFrameContext, isAppUrl as isExactAppUrl } from './lib/origin.mj
 import { LOG_BINDING, REQUEST_BINDING, RESOLVE_FN, pageScriptSource } from './lib/page-script.mjs';
 import { createStrictWallet } from './lib/strict-wallet.mjs';
 
-const { captureMacFrontmost, macFocusDisabled } = createRequire(import.meta.url)('../extension/lib/macos-focus.cjs');
+const { captureMacFrontmost, macFocusDisabled } = createRequire(import.meta.url)('@farmslot/adapter-web/macos-focus');
 
 function usage() {
   return 'Usage: wallet-host.mjs --cdp-port <port> --runtime-dir <dir> --signer <extension|injected> --app-origin <url> [--network testnet|mainnet] [--mainnet-hosts <h1,h2>] [--testnet-hosts <h1,h2>] [--extension-id <id>] [--target <checkout> --account <name> --start-chain <id>] [--observe-focus 1] [--window x,y,w,h] [--start-path <path>] [--mm-harness-owner=<marker>]';

package/dist/adapters/extension/doctor-checks.js

@@ -3,7 +3,7 @@ import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
-import { recipeRuntimeDir, runnerDir } from "../../paths.js";
+import { recipeRuntimeDir } from "../../paths.js";
 function extensionBrowserDoctorCheck(target) {
   const requireFromTarget = createRequire(path.join(path.resolve(target), "package.json"));
   for (const packageName of ["@playwright/test", "playwright"]) {
@@ -31,7 +31,7 @@ function extensionBrowserDoctorCheck(target) {
   };
 }
 function extensionBrowserResolutionDoctorCheck(target) {
-  const resolver = path.join(runnerDir, "adapters/shared/browser-resolver.cjs");
+  const resolver = createRequire(import.meta.url).resolve("@farmslot/adapter-web/browser-resolver");
   const runtime = path.join(path.resolve(target), recipeRuntimeDir());
   const record = path.join(runtime, "browser-resolution.json");
   let profile = process.env.CHROME_USER_DATA_DIR || path.join(runtime, process.env.RECIPE_CHROME_PROFILE_NAME || "chrome-profile");

package/dist/adapters/extension/launched-browser.js

@@ -11,7 +11,7 @@ function readRecord(file) {
     return null;
   }
 }
-const browserCdp = createRequire(import.meta.url)("../../../adapters/shared/browser-cdp.cjs");
+const browserCdp = createRequire(import.meta.url)("@farmslot/adapter-web/browser-cdp");
 function verifyLaunch(record, cdpPort) {
   const launch = isRecord(record.launch) ? record.launch : {};
   const pid = Number(launch.pid);

package/dist/adapters/extension/runtime.js

@@ -6,8 +6,8 @@ import { importRecipeHarnessRuntimeBrowserExtension, importRecipeHarnessRuntimeC
 import { poolFilesForHost } from "../resolve-slot-ports.js";
 import { profileProcessPids } from "./validation-process-ownership.js";
 const require2 = createRequire(import.meta.url);
-const { detachedLaunchUnprovenPath, hasDetachedLaunchUnproven, shellQuote } = require2(
-  "../../../adapters/extension/lib/chrome-args.cjs"
+const { RUNTIME_NONCE_PREFIX, detachedLaunchUnprovenPath, hasDetachedLaunchUnproven, shellQuote } = require2(
+  "@farmslot/adapter-web/chrome-args"
 );
 const {
   CdpSession,
@@ -697,7 +697,7 @@ ${result.stderr}`);
   };
 }
 async function startValidationLaunchSupervisor(cdpPort) {
-  const supervisorPath = path.join(runnerDir, "adapters/extension/lib/validation-launch-supervisor.cjs");
+  const supervisorPath = require2.resolve("@farmslot/adapter-web/validation-launch-supervisor");
   const child = spawn(process.execPath, [supervisorPath, String(cdpPort)], {
     cwd: runnerDir,
     env: process.env,
@@ -972,7 +972,7 @@ async function browserEchoesRuntimeNonce(cdpPort, nonce) {
       2e3
     );
     if (!Array.isArray(result.arguments)) return false;
-    const expected = `--mm-harness-runtime-nonce=${nonce}`;
+    const expected = `${RUNTIME_NONCE_PREFIX}${nonce}`;
     return result.arguments.filter((argument) => argument === expected).length === 1;
   } catch {
     return false;

package/dist/adapters/extension/validation-process-ownership.js

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 const require2 = createRequire(import.meta.url);
 const processOwnership = require2(
-  "../../../adapters/extension/lib/validation-process-ownership.cjs"
+  "@farmslot/adapter-web/validation-process-ownership"
 );
 const { profileProcessPids, stopProfileProcesses, stopProfileProcessesSync } = processOwnership;
 export {

package/dist/commands/launch/extension.js

@@ -34,7 +34,7 @@ import { readExtensionPinnedFlags } from "../../adapters/extension/feature-flags
 import { sameFeatureFlags } from "../../feature-flags.js";
 const { CdpSession } = await importRecipeHarnessRuntimeCdp();
 const { RUNTIME_IDENTITY_FILENAME, RUNTIME_NONCE_PREFIX } = createRequire(import.meta.url)(
-  path.join(runnerDir, "adapters/extension/lib/chrome-args.cjs")
+  "@farmslot/adapter-web/chrome-args"
 );
 function extensionDepsBlock(target) {
   if (!fs.existsSync(path.join(target, "package.json"))) return null;

package/docs/cli-contract.md

@@ -90,22 +90,11 @@ These are real farm bugs. The goldens freeze the current rejections, so fixing e
 | Mobile templates `dev.md`, `dev-interactive.md`, `fix-bug.md`, `review-pr.md` | `mark complete --status blocked --outcome partial --reason …` exits 2 | `mark blocked --reason "<why>"` | `task/mark-invalid-status-outcome`, `task/mark-blocked` |
 | Docs | `launch --build-lavamoat` (only `runtime-launch` has it); `run --target <recipe-file>` | `runtime-launch --build-lavamoat`; `run <recipe-file> --target <repo>` | — |
 
-## Terminal adapter: TODO
-
-#298 merged the `terminal` adapter (`fd1c77e`). Discovery already reflects it (`discovery/actions-matrix`, the adapter hint in `help`). **Follow-up, not in this PR:** freeze its farm hooks once a stub browser replaces the LaunchServices launch of a visible Chrome for Testing (the goldens must never start a real browser). Add `tests/contract/goldens-terminal.test.sh` covering the `va-mmcx-terminal-farm` hooks:
-
-- [ ] `run <recipe> --adapter terminal --artifacts-dir <d> --target <repo> --slot <s> --cdp-port <p> --watcher-port <p> --json`
-- [ ] `actions --raw --adapter terminal --json`
-- [ ] `doctor --adapter terminal --target <repo> --cdp-port <p> --watcher-port <p> --json`
-- [ ] `install --adapter terminal --target <repo>`
-- [ ] `verify --adapter terminal --target <repo> -- --cdp-port <p> --watcher-port <p> --account <a>`
-- [ ] `cleanup --adapter terminal --target <repo> -- --cdp-port <p>`
-- [ ] `launch --adapter terminal --target <repo> --cdp-port <p> --watcher-port <p> --signer extension --account <a>` (use the stub browser from #298's `tests/fixtures/terminal-stub-browser.mjs`)
-- [ ] `stop --adapter terminal --target <repo>` with `RECIPE_CDP_PORT`
-- [ ] `run terminal.perps.<name> k=v… --adapter terminal --target <t> --cdp-port <p> --watcher-port <p> --plan` (recipe-terminal `checks/plan-recipes.mjs`)
-- [ ] runtime layout of `temp/recipe/runtime/terminal/` (`browser.pid` is watched by the farm)
-- [ ] discovery: add `terminal` to the per-adapter loop in `goldens-discovery.test.sh` (`actions --raw`, `actions`, `run --list`, `call --list`)
-- [ ] recipe-terminal `console-guard.mjs` imports the harness's `library/actions/shared/console-findings.mjs` and `tests/fixtures/console-allowlist-vectors.json`: freeze both paths and the exported surface
+## Terminal adapter
+
+`goldens-terminal` freezes the `va-mmcx-terminal-farm` hooks with their exact argv (`recipe_action_manifest`, `recipe_doctor`, `recipe_harness_{install,verify,cleanup}`, `recipe_run`, the browser `boot`/`shutdown` resources and `teardown`), against a fresh fixture slot: no slot dev server, no Extension dist, and the farm's wallet fixture outside the slot, so `install` copies it in. `launch` is frozen on its cold path: it refuses at the missing dist before any browser starts. The slot's CDP port is the one port no port holder reserves: a farm slot with no browser has it free, and the Terminal's port checks probe it. `goldens-discovery` covers `terminal` in its per-adapter loop, so `terminal/actions-raw` and `discovery/actions-raw-terminal` freeze the same manifest and change together.
+
+Outside this boundary: a successful `launch` and the `temp/recipe/runtime/terminal/` layout (`browser.pid`), recipes and actions from the farm's `RECIPE_LIBRARY_PATH` libraries, `run terminal.perps.<name> --plan`, and the recipe-terminal `console-guard.mjs` import paths.
 
 ## Running the goldens
 
@@ -152,7 +141,7 @@ The goldens need the harness to be a git checkout: `execution-provenance.json` `
 1. Absolute paths: the sandbox becomes `<SANDBOX>`, the repo `<REPO>`, the real `$HOME` `<HOME>`, the node binary and its prefix `<NODE>`/`<NODE_PREFIX>`, and `os.tmpdir()` `<TMP>`. Both `/var` and `/private/var` spellings are covered. Ports from `gd_reserve_ports` become `<PORT:NAME>` in port positions only: numbers under `*port` keys, and in text after `:`, `port `, `port=` or `PORT=`, or a string that is exactly the port (`^<port>$`; `60000 ms` is left alone).
 2. UUIDs become `<UUID>`. Git object ids (40 hex, or a short hex value under a `*head`/`*gitRef`/`*commit` key) become `<GIT_REF>`. ISO-8601 timestamps become `<TIMESTAMP>`, and compact stamps in names `<STAMP>`. Path-derived slot ids `local-<adapter>-<8 hex>` become `local-<adapter>-<HASH>`.
 3. The package version becomes `<HARNESS_VERSION>`. Any other `x.y.z` under a key ending in `version` becomes `<VERSION>`.
-4. Numbers under volatile keys: `*pid` becomes `<PID>`, `*port` `<PORT>`, `*At`/`*Time`/`*timestamp`/`mtime*` `<TIMESTAMP>`, and `*Ms`/`duration*`/`elapsed*` `<DURATION>`. Values inside `schema` and `examples` subtrees (static manifest content) are never rewritten.
+4. Numbers under volatile keys: `*pid` becomes `<PID>`, `inode` `<INODE>`, `*port` `<PORT>`, `*At`/`*Time`/`*timestamp`/`mtime*` `<TIMESTAMP>`, and `*Ms`/`duration*`/`elapsed*` `<DURATION>`. Values inside `schema` and `examples` subtrees (static manifest content) are never rewritten.
 5. `invocationDigest` becomes `<DIGEST>`: it hashes `recipe-invocation.json`, which carries sandbox paths and timestamps and is frozen itself in normalised form. `runner.sourceFingerprint` becomes `<FINGERPRINT>`: it hashes the harness source tree, so any harness edit changes it. A `status` holding `git status --porcelain` output (provenance `runner.status` and `libraries[].status`, empty when clean) becomes `<GIT_STATUS>`. Content-only digests (recipe and dependency digests) stay frozen.
 6. Durations in text (`0.3s`, `123ms`) become `<DURATION>`.
 

package/library/actions/extension/platform/cdp.mjs

@@ -19,7 +19,6 @@ import { closeSync, openSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
 
 import {
   importRecipeHarnessRuntimeBrowserExtension,
@@ -370,11 +369,10 @@ function autolaunchEnabled(input) {
 }
 
 const runnerRequire = createRequire(import.meta.url);
-const runnerRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../..');
-const browserResolver = runnerRequire(path.join(runnerRoot, 'adapters/shared/browser-resolver.cjs'));
-const { stopProfileProcessesSync } = runnerRequire(path.join(runnerRoot, 'adapters/extension/lib/validation-process-ownership.cjs'));
-const browserCdp = runnerRequire(path.join(runnerRoot, 'adapters/shared/browser-cdp.cjs'));
-const macosFocus = runnerRequire(path.join(runnerRoot, 'adapters/extension/lib/macos-focus.cjs'));
+const browserResolver = runnerRequire('@farmslot/adapter-web/browser-resolver');
+const { stopProfileProcessesSync } = runnerRequire('@farmslot/adapter-web/validation-process-ownership');
+const browserCdp = runnerRequire('@farmslot/adapter-web/browser-cdp');
+const macosFocus = runnerRequire('@farmslot/adapter-web/macos-focus');
 
 // On macOS a browser that opens a window at startup activates itself, so the
 // autolaunched browser starts without one and gets its pages over CDP in the
@@ -382,7 +380,7 @@ const macosFocus = runnerRequire(path.join(runnerRoot, 'adapters/extension/lib/m
 const startsWithoutWindow = () => process.platform === 'darwin';
 
 // One bounded browser-level CDP operation (the shared helpers in
-// browser-cdp.cjs never take the operator's focus).
+// @farmslot/adapter-web/browser-cdp never take the operator's focus).
 async function withBrowserCdp(port, fn) {
   const deadline = Date.now() + 15000;
   const remaining = () => Math.max(1, deadline - Date.now());

package/library/actions/terminal/platform/page.mjs

@@ -1,7 +1,7 @@
 // Select the CDP page a terminal UI action drives: the app tab (default) or the
 // MetaMask wallet surface (side panel / notification / popup) that shows the
 // pending dapp request. Pages are never brought to front unless
-// MM_HARNESS_FOCUS_BROWSER=1, as in the Extension adapter: Page.bringToFront
+// FARMSLOT_FOCUS_BROWSER=1, as in the Extension adapter: Page.bringToFront
 // activates the browser on macOS and takes the operator's keyboard focus. The
 // app tab is the only tab of its window (the wallet host closes the others),
 // so it stays the window's active tab and keeps painting without it.
@@ -199,7 +199,7 @@ export function slowMoFor(browserState, env = process.env) {
 }
 
 export function focusBrowserRequested(env = process.env) {
-  return env.MM_HARNESS_FOCUS_BROWSER === '1';
+  return env.FARMSLOT_FOCUS_BROWSER === '1';
 }
 
 // Defence in depth before a wallet confirmation: the app port is still served

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.77.0",
+  "version": "0.78.0",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"
@@ -21,6 +21,7 @@
     "check:syntax": "find . -name '*.mjs' -print0 | xargs -0 -n1 node --check"
   },
   "dependencies": {
+    "@farmslot/adapter-web": "0.1.0",
     "@farmslot/agent-runtime": "0.16.0",
     "@farmslot/expo-recipe": "0.13.1",
     "@farmslot/handoff": "^0.3.1",