@deeeed/metamask-harness 0.78.0 → 0.80.0

package/adapters/extension/launch-browser.cjs

@@ -1,59 +1,26 @@
 #!/usr/bin/env node
-// launch-browser.cjs — per-instance isolated detached Chrome spawn
+// launch-browser.cjs — the Extension's isolated detached Chrome launch
 //
-// Purpose:
-//   Spawns a detached Chrome bound to 127.0.0.1:<cdp-port> with its own
-//   profile and the runtime dist loaded as an unpacked extension: by
-//   --load-extension, or over CDP (Extensions.loadUnpacked) for branded Chrome,
-//   which ignores that flag. The browser choice comes from
-//   <runtime>/browser-resolution.json when it names --chrome-bin.
+// Runs @farmslot/adapter-web's launchBrowser with what MetaMask owns: the
+// build-handoff lock (no build swaps the dist mid-launch), home.html and its
+// "MetaMask" title, the harness runtime layouts that prove a browser is ours by
+// its --load-extension path, and the mm-harness rerun command.
 //
-// Inputs (flags, all required):
+// Inputs (flags, all required unless noted):
 //   --cdp-port <port> --chrome-bin <path> --profile <dir>
 //   --extension-dir <dist> --chrome-log <file> --chrome-pid <file>
-//   Env is sanitized for the child (DYLD_*, PYTHON*, BUNDLED_DEBUGPY_PATH).
+//   [--browser-resolution <resolver record>] [--start-url <url>]
+//   [--stop-only 1] [--reset-profile 1]
+//   MM_HARNESS_FOCUS_SETTLE_MS: wait before the one macOS focus check (default 1000).
 //
-// Outputs:
-//   <chrome-pid> pid file; <chrome-log> append-log;
-//   <runtime>/browser-resolution.json (browser, version, loading method, pid).
-//   Exit 0 — spawned; non-zero — invalid/missing args, missing chrome binary,
-//   or missing dist manifest (thrown error message on stderr).
-//
-// Never touches: the extension dist (read-only), anything outside the
-// profile/log/pid paths it was given.
+// Outputs: see launchBrowser. Exit 0 — launched (or released with --stop-only);
+// non-zero — invalid/missing args, missing chrome binary or dist manifest, or a
+// failed launch (thrown error message on stderr).
 'use strict';
 
-const fs = require('node:fs');
-const os = require('node:os');
 const path = require('node:path');
-const { execFileSync, spawn, spawnSync } = require('node:child_process');
-const { extensionIdFromExtensionDir } = require('@farmslot/adapter-web/extension-id');
-// The resolver CLI runs as a bounded child for CDP calls the launcher must not hang on.
-const browserResolverPath = require.resolve('@farmslot/adapter-web/browser-resolver');
-const { CDP_LOAD_UNPACKED, describeBrowser, extensionLaunchArgs, waitForCdpOwner } = require(browserResolverPath);
-const { profileProcessPids, stopProfileProcessesSync } = require('@farmslot/adapter-web/validation-process-ownership');
+const { launchBrowser } = require('@farmslot/adapter-web/launch-browser');
 const { acquireBuildHandoff } = require('./build-handoff.cjs');
-const {
-  automationRuntimeArgs,
-  clearDetachedLaunchUnproven,
-  clearValidationPortQuarantine,
-  createRuntimeIdentityNonce,
-  hasDetachedLaunchUnproven,
-  isolatedProfileArgs,
-  markDetachedLaunchUnproven,
-  markValidationPortLaunchUnproven,
-  remoteDebuggingArgs,
-  removeRuntimeIdentity,
-  runtimeIdentityArgs,
-  readValidationPortQuarantine,
-  validationLaunchQuarantineError,
-  writeRuntimeIdentity,
-} = require('@farmslot/adapter-web/chrome-args');
-const {
-  captureMacFrontmost,
-  macBackgroundOpenArgs,
-  restoreFrontmostIfOurs,
-} = require('@farmslot/adapter-web/macos-focus');
 
 if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log(
@@ -64,368 +31,28 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
 
 const args = parseArgs(process.argv.slice(2));
 const cdpPort = Number(args['cdp-port']);
-if (!Number.isInteger(cdpPort) || cdpPort <= 0) {
-  throw new Error(`Invalid --cdp-port: ${args['cdp-port'] || ''}`);
-}
-for (const key of ['chrome-bin', 'profile', 'extension-dir', 'chrome-log', 'chrome-pid']) {
-  if (!args[key]) throw new Error(`Missing --${key}`);
-}
-const runtimeDir = path.dirname(path.resolve(args['extension-dir']));
-// --stop-only releases the profile before the dist snapshot exists on a first
-// run, so launch-input validation applies only to a real launch.
-if (args['stop-only'] === undefined) {
-  if (!fs.existsSync(args['chrome-bin'])) throw new Error(`Chrome binary not found: ${args['chrome-bin']}`);
-  if (!fs.existsSync(path.join(args['extension-dir'], 'manifest.json'))) {
-    throw new Error(`Extension dist manifest not found: ${path.join(args['extension-dir'], 'manifest.json')}`);
-  }
-}
-
-// Isolation guard: a standalone launch must use a per-checkout profile, never a
-// shared (e.g. ~/.chrome-farmslot) or the OS-default browser profile. Farm dispatch
-// injects its own already-isolated profile via runtime-context, so this only trips
-// on a genuinely personal/shared path — protecting the user's browser data.
-assertIsolatedProfile(args.profile);
-if (args['reset-profile'] !== undefined) assertResettableProfile(args.profile, runtimeDir);
-
-fs.mkdirSync(args.profile, { recursive: true });
-fs.mkdirSync(path.dirname(args['chrome-log']), { recursive: true });
-fs.mkdirSync(path.dirname(args['chrome-pid']), { recursive: true });
-const releaseBuildHandoff = acquireBuildHandoff(runtimeDir);
-process.on('exit', releaseBuildHandoff);
-
-// Ownership guard: only ever take over a CDP endpoint we provably launched. A pid
-// on this port is ours iff its command line loads our --user-data-dir; anything
-// else is a browser this harness did not launch (possibly the user's personal
-// Chrome), so we refuse rather than kill it or attach to it.
-const listenerPids = cdpListenerPids(cdpPort);
-const foreignPids = listenerPids.filter((pid) => !processIsOwnedHarnessBrowser(pid, args.profile, args['extension-dir']));
-if (foreignPids.length > 0) {
-  throw new Error(
-    `Refusing to launch on CDP port ${cdpPort}: it is held by a browser this harness did not launch (pid ${foreignPids.join(', ')}). ` +
-    `Next: pick a free --cdp-port, or stop that browser.`,
-  );
-}
-const ownedPids = new Set(listenerPids);
-for (const pid of profileProcessPids(args.profile)) ownedPids.add(pid);
-const previousPid = readPidFile(args['chrome-pid']);
-if (previousPid !== null && processIsOwnedHarnessBrowser(previousPid, args.profile, args['extension-dir'])) ownedPids.add(previousPid);
-try {
-  removeRuntimeIdentity(runtimeDir);
-} catch (error) {
-  const detail = error instanceof Error ? error.message : String(error);
-  throw new Error(
-    `Failed to invalidate Extension runtime identity under ${runtimeDir}: ${detail}. ` +
-      'Next: remove the invalid runtime identity and fix owner permissions, then rerun: mm-harness launch --adapter extension --build',
-  );
-}
-stopProfileProcessesSync(args.profile, { extraPids: [...ownedPids] });
-if (args['reset-profile'] !== undefined) {
-  fs.rmSync(args.profile, { recursive: true, force: true });
-  fs.mkdirSync(args.profile, { recursive: true });
-}
-removeProfileSingletonLocks(args.profile);
-
-// --stop-only: release the profile (owned Chrome terminated, singleton locks
-// cleared) without launching. The prefill step needs the profile's LevelDB
-// unlocked BEFORE it writes; a prior run's Chrome would hold the lock and the
-// write fails with "Database is not open".
-if (args['stop-only'] !== undefined) {
-  process.exit(0);
-}
-
-const requestedProfileQuarantined = hasDetachedLaunchUnproven(args.profile);
-const portQuarantine = readValidationPortQuarantine(cdpPort);
-const validationPortLease = process.env.FARMSLOT_VALIDATION_PORT_LEASE;
-const activeValidationLease = Boolean(
-  portQuarantine?.profile === path.resolve(args.profile) &&
-  portQuarantine.lease === validationPortLease &&
-  /^[a-f0-9]{64}$/u.test(validationPortLease || ''),
-);
-if (requestedProfileQuarantined || (portQuarantine && !activeValidationLease)) {
-  throw validationLaunchQuarantineError(
-    cdpPort,
-    portQuarantine?.profile || (requestedProfileQuarantined ? args.profile : undefined),
-    requestedProfileQuarantined ? args.profile : undefined,
-  );
-}
-
-const initialUrl = args['start-url'] || extensionHomeUrl(args['extension-dir']) || 'chrome://extensions/';
-const browser = launchBrowserResolution(args['browser-resolution'], args['chrome-bin']);
-const loadsOverCdp = browser.extensionLoading === CDP_LOAD_UNPACKED;
-let cdpLoad = null;
-let owner = null;
-const runtimeNonce = createRuntimeIdentityNonce();
-const startedAt = Date.now();
-const chromeArgs = [
-  `--user-data-dir=${args.profile}`,
-  // Debug-port trio (address + port + scoped allow-origins) from the shared module,
-  // so the DevTools origin allow-list can never drift away from the port.
-  ...remoteDebuggingArgs(cdpPort),
-  '--no-first-run',
-  '--disable-first-run-ui',
-  ...automationRuntimeArgs(),
-  ...runtimeIdentityArgs(runtimeNonce),
-  ...isolatedProfileArgs(),
-  '--disable-default-apps',
-  '--disable-popup-blocking',
-  '--disable-extensions-file-access-check',
-  '--disable-extensions-content-verification',
-  '--disable-features=ExtensionContentVerification,DisableLoadExtensionCommandLineSwitch',
-  ...extensionLaunchArgs(args['extension-dir'], browser.extensionLoading),
-];
-// Initial tab: caller's dapp URL when provided, else the extension home. The
-// extension home avoids leaving disposable chrome://newtab/ or extensions
-// manager tabs in the operator's slot browser. On macOS the browser starts
-// through Launch Services in the background with no startup window (Chrome
-// activates itself when it opens one), and the first window is opened over
-// CDP as a background window. A CDP-loaded extension does not exist yet at
-// startup, so its window is opened after the load.
-const application = process.platform === 'darwin' ? macApplicationForExecutable(args['chrome-bin']) : null;
-if (application) chromeArgs.push('--no-startup-window');
-else chromeArgs.push(loadsOverCdp ? 'about:blank' : initialUrl);
-const logFd = fs.openSync(args['chrome-log'], 'a');
-const previousFrontmost = captureMacFrontmost();
-let browserPid;
-try {
-  try {
-    if (application) {
-      beginDetachedLaunch(cdpPort, args.profile, activeValidationLease);
-      execFileSync('open', macBackgroundOpenArgs(application, chromeArgs), {
-        env: sanitizedChildEnv(),
-        stdio: ['ignore', logFd, logFd],
-      });
-      browserPid = waitForOwnedCdpPid(cdpPort, args.profile, args['extension-dir']);
-      if (browserPid === null) {
-        stopProfileProcessesSync(args.profile, { waitForAppearanceMs: 400 });
-        throw new Error(
-          `Chrome launched but did not expose an owned CDP listener on 127.0.0.1:${cdpPort}. ` +
-            `Next: inspect ${args['chrome-log']}, then rerun: mm-harness launch --adapter extension --build`,
-        );
-      }
-    } else {
-      beginDetachedLaunch(cdpPort, args.profile, activeValidationLease);
-      const child = spawn(args['chrome-bin'], chromeArgs, {
-        detached: true,
-        env: sanitizedChildEnv(),
-        stdio: ['ignore', logFd, logFd],
-      });
-      child.unref();
-      browserPid = waitForOwnedCdpPid(cdpPort, args.profile, args['extension-dir']);
-      if (browserPid === null) {
-        stopProfileProcessesSync(args.profile, { extraPids: child.pid ? [child.pid] : [] });
-        throw new Error(
-          `Chrome launched but did not expose an owned CDP listener on 127.0.0.1:${cdpPort}. ` +
-            `Next: inspect ${args['chrome-log']}, then rerun: mm-harness launch --adapter extension --build`,
-        );
-      }
-    }
-    if (loadsOverCdp) cdpLoad = loadExtensionOverCdp(browserPid);
-    else if (application) openBackgroundWindow(browserPid, initialUrl);
-    owner = cdpLoad?.owner ?? ownerIdentity(browserPid);
-    for (const problem of pruneExtraHomeTabs(cdpPort, args['extension-dir'])) {
-      process.stderr.write(`[launch] home-tab pruning: ${problem}\n`);
-    }
-  } finally {
-    fs.closeSync(logFd);
-  }
-  fs.writeFileSync(args['chrome-pid'], `${browserPid}\n`);
-  writeBrowserResolution(runtimeDir, {
-    ...browser,
-    launch: {
-      pid: browserPid,
-      cdpPort,
-      startedAt: new Date(startedAt).toISOString(),
-      ...(owner ? { profile: owner.profile, processStartedAt: owner.startedAt } : {}),
-      ...(cdpLoad ? { extensionId: cdpLoad.id, otherExtensions: cdpLoad.otherExtensions } : {}),
-    },
-  });
-  try {
-    writeRuntimeIdentity(runtimeDir, {
-      port: cdpPort,
-      pid: browserPid,
-      startedAt,
-      nonce: runtimeNonce,
-    });
-    clearDetachedLaunchUnproven(args.profile);
-    if (!activeValidationLease) {
-      clearValidationPortQuarantine(cdpPort, args.profile);
-    }
-  } catch (error) {
-    terminatePids([browserPid]);
-    fs.rmSync(args['chrome-pid'], { force: true });
-    const detail = error instanceof Error ? error.message : String(error);
-    throw new Error(
-      `Failed to persist Extension runtime identity under ${runtimeDir}: ${detail}. ` +
-        'Next: fix owner write permissions for the runtime directory, then rerun: mm-harness launch --adapter extension --build',
-    );
-  }
-  if (process.platform === 'darwin') {
-    const wake = spawn('caffeinate', ['-dims', '-w', String(browserPid)], {
-      detached: true,
-      stdio: 'ignore',
-    });
-    wake.unref();
-    // Let the first window settle before the one focus check below.
-    const settleMs = Number(process.env.MM_HARNESS_FOCUS_SETTLE_MS);
-    const waitSec = Number.isFinite(settleMs) && settleMs >= 0 ? settleMs / 1000 : 1;
-    if (waitSec > 0) spawnSync('sleep', [String(waitSec)]);
-  }
-} finally {
-  // One check, at most one restore, and only if OUR browser (this launch's
-  // CDP owner pid) holds the front; any other app in front is left alone.
-  if (browserPid) {
-    const outcome = restoreFrontmostIfOurs(previousFrontmost, [Number(browserPid)]);
-    if (outcome === 'restored') process.stderr.write(`[launch] focus: the slot browser took the front; restored ${previousFrontmost.name}\n`);
-  }
-}
-
-// The first window of a browser started without one, opened in the background.
-// Without it the slot has no window at all, so a failure fails the launch:
-// the owned browser is stopped (its markers kept if it cannot be).
-function openBackgroundWindow(pid, url) {
-  const result = spawnSync(process.execPath, [browserResolverPath, 'open-window', '--port', String(cdpPort), '--url', url], {
-    encoding: 'utf8',
-    timeout: 30_000,
-  });
-  if (result.status === 0) return;
-  const openError = (result.stderr || result.error?.message || `exit ${result.status}`).trim();
-  try {
-    stopProfileProcessesSync(args.profile, { extraPids: [pid] });
-  } catch (stopError) {
-    throw new Error(
-      `Chrome started but its start window could not be opened (${openError}), and stopping it failed: ${stopError.message}. ` +
-        `The launch markers for port ${cdpPort} and ${args.profile} are kept. Next: stop pid ${pid}, then rerun.`,
-    );
-  }
-  clearDetachedLaunchUnproven(args.profile);
-  if (!activeValidationLease) clearValidationPortQuarantine(cdpPort, args.profile);
-  throw new Error(`Chrome started but its start window could not be opened: ${openError}. Next: inspect ${args['chrome-log']}, then rerun.`);
-}
-
-// live.sh passes the record its resolver just wrote (--browser-resolution);
-// reuse it when it names the same binary. A direct --chrome-bin without it is
-// the caller's own explicit choice and is recorded as such, whatever an older
-// record of this profile says.
-function launchBrowserResolution(file, chromeBin) {
-  if (!file) return explicitResolution(chromeBin);
-  try {
-    const recorded = JSON.parse(fs.readFileSync(file, 'utf8'));
-    if (recorded && recorded.bin === chromeBin && typeof recorded.extensionLoading === 'string') {
-      const { launch: _previousLaunch, ...resolution } = recorded;
-      return resolution;
-    }
-  } catch {
-    // No resolver record for this launch; fall through to a direct description.
-  }
-  return explicitResolution(chromeBin);
-}
-
-function explicitResolution(chromeBin) {
-  return { schemaVersion: 2, ...describeBrowser(chromeBin), source: '--chrome-bin', mode: 'explicit', selection: 'explicit', resolvedAt: new Date().toISOString() };
-}
-
-function writeBrowserResolution(runtime, resolution) {
-  fs.writeFileSync(path.join(runtime, 'browser-resolution.json'), `${JSON.stringify(resolution, null, 2)}\n`);
-}
-
-function loadExtensionOverCdp(pid) {
-  const result = spawnSync(process.execPath, [
-    browserResolverPath,
-    'load-unpacked',
-    '--port', String(cdpPort),
-    '--path', args['extension-dir'],
-    '--profile', args.profile,
-    '--open-url', initialUrl,
-  ], { encoding: 'utf8', timeout: 130_000 });
-  if (result.status === 0) {
-    const loaded = JSON.parse(result.stdout);
-    process.stderr.write(`[launch] extension ${loaded.id} loaded over CDP\n`);
-    for (const entry of loaded.otherExtensions?.disabled ?? []) {
-      process.stderr.write(`[launch] disabled ${entry.id} (${entry.name}) in the slot profile\n`);
-    }
-    for (const entry of loaded.otherExtensions?.policyPinned ?? []) {
-      process.stderr.write(`[launch] WARN: enterprise policy keeps ${entry.id} (${entry.name}) enabled in the slot profile\n`);
-    }
-    return loaded;
-  }
-  // Ownership was proven; once the browser is stopped the launch markers would
-  // only quarantine a port and profile that nothing holds. If it cannot be
-  // stopped, the markers stay and both failures are reported.
-  const loadError = (result.stderr || result.error?.message || '').trim();
-  try {
-    stopProfileProcessesSync(args.profile, { extraPids: [pid] });
-  } catch (stopError) {
-    throw new Error(
-      `Chrome started but the extension did not load over CDP (${loadError}), and stopping it failed: ${stopError.message}. ` +
-        `The launch markers for port ${cdpPort} and ${args.profile} are kept. Next: stop pid ${pid}, then rerun.`,
-    );
-  }
-  clearDetachedLaunchUnproven(args.profile);
-  if (!activeValidationLease) clearValidationPortQuarantine(cdpPort, args.profile);
-  throw new Error(
-    `Chrome started but the extension did not load over CDP: ${loadError}. ` +
-      `Next: inspect ${args['chrome-log']}, or rerun with RECIPE_HARNESS_BROWSER=cft to use Chrome for Testing.`,
-  );
-}
-
-// Identity of the browser that holds the profile (pid + start time), recorded
-// so run evidence can later prove it names this exact process.
-// Best effort, so a short budget: a browser that never proves ownership (a
-// stub without a SingletonLock, say) costs seconds, not the full default.
-function ownerIdentity(pid) {
-  try {
-    const identity = waitForCdpOwner(cdpPort, args.profile, { timeoutMs: 15000 });
-    return identity.pid === pid ? identity : null;
-  } catch (error) {
-    process.stderr.write(`[launch] could not record the browser identity: ${error.message}\n`);
-    return null;
-  }
-}
-
-function sanitizedChildEnv() {
-  return {
-    ...process.env,
-    BUNDLED_DEBUGPY_PATH: undefined,
-    PYTHONHOME: undefined,
-    PYTHONPATH: undefined,
-    DYLD_LIBRARY_PATH: undefined,
-    DYLD_FALLBACK_LIBRARY_PATH: undefined,
-    DYLD_INSERT_LIBRARIES: undefined,
-  };
-}
-
-function beginDetachedLaunch(port, profile, activeLease) {
-  try {
-    if (!activeLease) markValidationPortLaunchUnproven(port, profile);
-    markDetachedLaunchUnproven(profile);
-  } catch (error) {
-    if (error.code === 'EEXIST') {
-      const quarantine = readValidationPortQuarantine(port);
-      throw validationLaunchQuarantineError(port, quarantine?.profile || profile);
-    }
-    throw error;
-  }
-}
-
-function macApplicationForExecutable(executable) {
-  let current = path.resolve(executable);
-  while (current !== path.dirname(current)) {
-    if (current.endsWith('.app')) return current;
-    current = path.dirname(current);
-  }
-  return null;
-}
-
-function waitForOwnedCdpPid(port, profile, extensionDir) {
-  for (let i = 0; i < 300; i += 1) {
-    const pid = cdpListenerPids(port).find((candidate) =>
-      processIsOwnedHarnessBrowser(candidate, profile, extensionDir),
-    );
-    if (pid !== undefined) return pid;
-    spawnSync('sleep', ['0.1']);
-  }
-  return null;
-}
+// Checked here so the error echoes the flag as typed.
+if (!Number.isInteger(cdpPort) || cdpPort <= 0) throw new Error(`Invalid --cdp-port: ${args['cdp-port'] || ''}`);
+launchBrowser({
+  cdpPort,
+  chromeBin: args['chrome-bin'],
+  profile: args.profile,
+  extensionDir: args['extension-dir'],
+  runtimeDir: args['extension-dir'] ? path.dirname(path.resolve(args['extension-dir'])) : '',
+  chromeLog: args['chrome-log'],
+  chromePid: args['chrome-pid'],
+  browserResolution: args['browser-resolution'],
+  startUrl: args['start-url'],
+  stopOnly: args['stop-only'] !== undefined,
+  resetProfile: args['reset-profile'] !== undefined,
+  homePage: 'home.html',
+  defaultTitle: 'MetaMask',
+  extensionOwnerRoot: harnessOwnerRootFromExtensionDir,
+  acquireRuntimeLock: acquireBuildHandoff,
+  rerunCommand: 'mm-harness launch --adapter extension --build',
+  // Unset or invalid falls back to the package default (1000 ms).
+  focusSettleMs: Number(process.env.MM_HARNESS_FOCUS_SETTLE_MS),
+});
 
 function parseArgs(argv) {
   const parsed = {};
@@ -439,216 +66,15 @@ function parseArgs(argv) {
   return parsed;
 }
 
-function assertIsolatedProfile(profile) {
-  const resolved = path.resolve(profile);
-  const home = os.homedir();
-  const osDefaults = [
-    path.join(home, 'Library/Application Support/Google/Chrome'),
-    path.join(home, 'Library/Application Support/Chromium'),
-    path.join(home, 'Library/Application Support/Microsoft Edge'),
-    path.join(home, '.config/google-chrome'),
-    path.join(home, '.config/chromium'),
-    path.join(home, '.config/microsoft-edge'),
-  ];
-  const underDefault = (dir) => resolved === dir || resolved.startsWith(`${dir}${path.sep}`);
-  if (resolved === home || resolved.includes(`${path.sep}.chrome-farmslot`) || osDefaults.some(underDefault)) {
-    throw new Error(
-      `Refusing to launch: --profile ${resolved} is a shared or default browser profile; ` +
-      `standalone launches must use a per-checkout profile under the harness runtime dir.`,
-    );
-  }
-}
-
-function assertResettableProfile(profile, expectedRuntimeDir) {
-  const resolved = path.resolve(profile);
-  const runtime = path.resolve(expectedRuntimeDir);
-  if (!resolved.startsWith(`${runtime}${path.sep}`)) {
-    throw new Error(`Refusing to reset --profile ${resolved}: it must be a dedicated child of ${runtime}.`);
-  }
-  const runtimeStat = fs.lstatSync(runtime);
-  if (!runtimeStat.isDirectory() || runtimeStat.isSymbolicLink()) {
-    throw new Error(`Refusing to reset --profile: runtime directory is not a regular directory: ${runtime}.`);
-  }
-  let current = runtime;
-  for (const segment of path.relative(runtime, resolved).split(path.sep)) {
-    current = path.join(current, segment);
-    if (!fs.existsSync(current)) break;
-    const stat = fs.lstatSync(current);
-    if (stat.isSymbolicLink() || !stat.isDirectory()) {
-      throw new Error(`Refusing to reset --profile: path contains an unsafe entry: ${current}.`);
-    }
-  }
-}
-
-// Proof of ownership: a process is ours iff its command line loads the exact
-// --user-data-dir we launch with. If the process can't be inspected we treat it
-// as NOT ours (fail safe — never assume ownership of an opaque process).
-function processIsOwnedHarnessBrowser(pid, profile, extensionDir) {
-  const command = processCommand(pid);
-  if (!command) return false;
-  if (command.includes(`--user-data-dir=${profile}`)) return true;
-  const ownerRoot = harnessOwnerRootFromExtensionDir(extensionDir);
-  return Boolean(ownerRoot && command.includes(`--load-extension=${ownerRoot}`));
-}
-
+// The overlay's live dist and the runtime snapshot both sit under a harness
+// runtime root; a browser loading an extension from there is ours.
 function harnessOwnerRootFromExtensionDir(extensionDir) {
-  const resolved = path.resolve(extensionDir);
   for (const marker of [
     `${path.sep}temp${path.sep}recipe${path.sep}harness${path.sep}extension${path.sep}live${path.sep}`,
     `${path.sep}temp${path.sep}recipe${path.sep}runtime${path.sep}runtime-dist`,
   ]) {
-    const markerIndex = resolved.indexOf(marker);
-    if (markerIndex !== -1) return resolved.slice(0, markerIndex + marker.length);
+    const markerIndex = extensionDir.indexOf(marker);
+    if (markerIndex !== -1) return extensionDir.slice(0, markerIndex + marker.length);
   }
   return null;
 }
-
-function processCommand(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return null;
-  try {
-    return execFileSync('ps', ['-ww', '-o', 'command=', '-p', String(pid)], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    });
-  } catch {
-    return null;
-  }
-}
-
-function readPidFile(file) {
-  if (!fs.existsSync(file)) return null;
-  const pid = Number.parseInt(fs.readFileSync(file, 'utf8').trim(), 10);
-  return Number.isInteger(pid) && pid > 0 ? pid : null;
-}
-
-function cdpListenerPids(port) {
-  try {
-    return execFileSync('lsof', ['-nP', `-iTCP:${port}`, '-sTCP:LISTEN', '-t'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    })
-      .split(/\s+/u)
-      .map((value) => Number.parseInt(value, 10))
-      .filter((pid) => Number.isInteger(pid) && pid > 0);
-  } catch (error) {
-    if (error.status === 1) return [];
-    throw error;
-  }
-}
-
-function terminatePids(pids) {
-  const unique = [...new Set(pids)].filter((pid) => pid !== process.pid);
-  for (const pid of unique) signalPid(pid, 'SIGTERM');
-  for (let i = 0; i < 10 && unique.some(processRespondsToSignal); i += 1) {
-    spawnSync('sleep', ['0.2']);
-  }
-  for (const pid of unique) {
-    if (processRespondsToSignal(pid)) signalPid(pid, 'SIGKILL');
-  }
-}
-
-function signalPid(pid, signal) {
-  try {
-    process.kill(pid, signal);
-    return true;
-  } catch (error) {
-    if (error.code === 'ESRCH') return false;
-    throw error;
-  }
-}
-
-function processRespondsToSignal(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    if (error.code === 'ESRCH') return false;
-    throw error;
-  }
-}
-
-function removeProfileSingletonLocks(profile) {
-  for (const name of ['SingletonLock', 'SingletonSocket', 'SingletonCookie']) {
-    const file = path.join(profile, name);
-    if (fs.existsSync(file)) fs.rmSync(file, { force: true });
-  }
-}
-
-function extensionHomeUrl(extensionDir) {
-  const id = extensionIdFromExtensionDir(extensionDir);
-  return id ? `chrome-extension://${id}/home.html` : '';
-}
-
-function cdpHttp(port, pathname) {
-  const result = spawnSync(process.execPath, ['-e', `
-    const http = require('http');
-    http.get('http://127.0.0.1:${Number(port)}${pathname}', (res) => {
-      let body = '';
-      res.on('data', (chunk) => { body += chunk; });
-      res.on('end', () => {
-        process.stdout.write(body);
-        process.exitCode = res.statusCode === 200 ? 0 : 1;
-      });
-    }).on('error', () => process.exit(1));
-  `], { encoding: 'utf8', timeout: 4000 });
-  if (result.status !== 0) return null;
-  return result.stdout;
-}
-
-// Best effort by design: CDP ownership is already proven and ensure-ready
-// converges home tabs again during verify, so a pruning failure must not fail
-// the launch. Every failure is returned so the launch log says why a duplicate
-// tab survived instead of hiding it.
-function pruneExtraHomeTabs(port, extensionDir) {
-  const id = extensionIdFromExtensionDir(extensionDir);
-  if (!id) return ['extension id unavailable; skipped'];
-  const raw = cdpHttp(port, '/json/list');
-  if (raw === null) return [`GET http://127.0.0.1:${port}/json/list failed`];
-  let targets;
-  try {
-    targets = JSON.parse(raw);
-  } catch (error) {
-    return [`/json/list returned malformed JSON: ${error.message}`];
-  }
-  if (!Array.isArray(targets)) return ['/json/list did not return a target list'];
-  const problems = [];
-  const close = (target) => {
-    if (cdpHttp(port, `/json/close/${target.id}`) === null) problems.push(`could not close ${target.url} (${target.id})`);
-  };
-  const homes = targets.filter((target) => (
-    target &&
-    target.type === 'page' &&
-    typeof target.id === 'string' &&
-    typeof target.url === 'string' &&
-    target.url.includes(`chrome-extension://${id}/`) &&
-    target.url.includes('/home.html')
-  ));
-  const strays = targets.filter((target) => (
-    target &&
-    target.type === 'page' &&
-    typeof target.id === 'string' &&
-    typeof target.url === 'string' &&
-    (
-      target.url === 'about:blank' ||
-      target.url === 'chrome://newtab/' ||
-      target.url.startsWith('chrome://new-tab-page')
-    )
-  ));
-  if (homes.length === 0) return problems;
-  const keeper = homes.find((target) => (
-    typeof target.title === 'string' &&
-    target.title.trim() !== '' &&
-    target.title.trim() !== 'MetaMask'
-  )) ?? homes[0];
-  if (homes.length > 1) {
-    for (const extra of homes) {
-      if (keeper && extra.id === keeper.id) continue;
-      close(extra);
-    }
-  }
-  for (const stray of strays) {
-    if (keeper && stray.id === keeper.id) continue;
-    close(stray);
-  }
-  return problems;
-}