@deeeed/metamask-harness 0.79.0 → 0.80.0

package/dist/task-view.js

@@ -22,9 +22,8 @@ import {
   subtaskPaths,
   WORKER_SIGNAL_FILE
 } from "@farmslot/protocol";
-import { readCommandJournal } from "./command-journal.js";
-import { resolveRuntimeContextPath } from "./harness.js";
-import { PREPARE_PROGRESS_ARTIFACT, recipeRuntimeDir } from "./paths.js";
+import { readCommandJournal, recipeRuntimeDir, resolveRuntimeContextPath } from "@farmslot/recipe-cli/harness";
+import { PREPARE_PROGRESS_ARTIFACT } from "./paths.js";
 import { parseLibraryPathEnv } from "./review/knowledge.js";
 const CHECKLIST_LABEL_LIMIT = 70;
 const TASK_SILENT_AFTER_MS = 10 * 60 * 1e3;

package/docs/CONTRIBUTING.md

@@ -180,7 +180,7 @@ test. Update `CHANGELOG.md` under `Unreleased` for user-visible behavior.
 
 When upgrading the protocol or runtime, align their transitive consumers before
 pinning them here. Farmslot's `workspace:*` dependencies become exact versions
-when packed, so `agent-runtime` and `expo-recipe` can retain older copies until
+when packed, so `agent-runtime` and `adapter-rn` can retain older copies until
 republished. Verify the complete install with
 `bash tests/contract/packaging-dist-install.test.sh` before releasing the harness.
 

package/docs/cli-contract.md

@@ -109,11 +109,11 @@ Every family checks its own golden directory: a golden no case writes fails the
 Each case runs under a safety cap, `GOLDENS_CASE_TIMEOUT` (default 600 s). A case that hits it reports `TIMEOUT <case>` and fails without being compared or written, so `--update` can never accept a truncated capture.
 
 Each family is a normal contract test (`tests/contract/goldens-<family>.test.sh`). `gd_init` (`tests/contract/goldens/lib.sh`) builds a sandbox on `ct_init`, and every case runs under `env -i`:
-- `gd_init` first unsets every inherited `MM_HARNESS_*`, `RECIPE_*`, `METAMASK_*` and `FARMSLOT_*` variable, plus device and port pins (`IOS_SIMULATOR`, `ADB_SERIAL`, `WATCHER_PORT`, `METRO_PORT`, `CDP_PORT`, `IDB_PATH`, `ANDROID_HOME`, …). A developer's `MM_HARNESS_BIN` or `MM_HARNESS_IDB_PATH` export therefore cannot redirect a case;
+- `gd_init` first unsets every inherited `MM_HARNESS_*`, `RECIPE_*`, `METAMASK_*` and `FARMSLOT_*` variable, plus device and port pins (`IOS_SIMULATOR`, `ADB_SERIAL`, `WATCHER_PORT`, `METRO_PORT`, `CDP_PORT`, `IDB_PATH`, `ANDROID_HOME`, …). A developer's `MM_HARNESS_BIN` or `RECIPE_RN_IDB_PATH` export therefore cannot redirect a case;
 - the environment is an allowlist: sandbox `HOME`, caches, config, `FARMSLOT_HOME`, `TZ=UTC`, no update probe, and only the variables the family sets itself;
 - every interpreter and tool the goldens launch is resolved to its real binary before `HOME` moves into the sandbox: `node` (`process.execPath`), `git` (`git --exec-path`), `bash` (`$BASH`) and `timeout`. The goldens need no Python. A tool that resolves to a script, the shape of an asdf/mise/volta/pyenv shim, fails the family up front with a message naming it. Each is checked to run with a sandboxed `HOME`;
 - `PATH` is pinned to the case stubs, the sandbox stubs, those real binaries, and `/usr/bin:/bin:/usr/sbin:/sbin`. Host tools (`idb`, `capture-helper`, a developer's Chrome) cannot change a golden;
-- device-tool discovery is pinned: `MM_HARNESS_IDB_PATH` and `MM_HARNESS_ADB_PATH` point at sandbox stubs, which discovery checks before any absolute Homebrew or pipx path;
+- device-tool discovery is pinned: `RECIPE_RN_IDB_PATH` and `RECIPE_RN_ADB_PATH` point at sandbox stubs, which discovery checks before any absolute Homebrew or pipx path;
 - localhost probes cannot reach a real server. `gd_reserve_ports` runs a Node port holder (`tests/contract/goldens/port-holder.mjs`) that holds ephemeral ports on `127.0.0.1` and `::1` and resets every connection it accepts, so Metro `/status` and CDP probes never get a response and nothing real can take the port mid-run. Each family exports the farm's slot port variables (`RECIPE_CDP_PORT`, `WATCHER_PORT`, `METRO_PORT`) set to those ports, so commands without an explicit port use them too. Goldens show them as `<PORT:NAME>`, rewritten only in port positions (`*port` keys, `:<port>`, `port <n>`/`PORT=<n>`, or a string that is exactly the port), so an unrelated equal number such as a 60000 ms timeout is never rewritten;
 - `tmux`, `xcrun` and `adb` are stubbed (`ct_init`, plus one booted simulator and one Android device for Mobile);
 - forbidden stubs record any call to `open`, `osascript`, `lsappinfo`, `screencapture`, `yarn`, `npx`, `npm`, `corepack`, `gh` and Chrome/Chromium, and the family fails if one is called. A browser stub answers only `--version`, and `npm` only `root -g` (install-source detection), with a sandbox path;

package/docs/feature-guard.md

@@ -0,0 +1,90 @@
+# Feature-loss guard
+
+While the platform phases move mm-harness code into Farmslot packages, nothing the frozen 0.76.0 release could do may get lost. Unit tests don't prove that. The guard has three parts, all run against real builds:
+
+| Part | Script | Proves | When |
+|---|---|---|---|
+| Inventory | `scripts/feature-inventory.mjs --check` | every 0.76.0 capability still exists, or is mapped in `tests/feature-inventory/changes.json` | every PR review, every release |
+| Live differential | `scripts/differential.mjs` | the same commands on the same real slots behave the same on 0.76.0 and on the PR build | every migration PR (report attached to the PR) |
+| Release smoke | `scripts/release-smoke.mjs` | the fixed real recipes pass on the canary Mac, recorded, and match the previous release | every release |
+
+The baseline is `@deeeed/metamask-harness@0.76.0` (da656404, before phase 2). The repo declares no dependency on it: `scripts/feature-guard/builds.mjs` installs it on first use, on each host, into `~/.cache/mm-harness-baseline/0.76.0` with npm's `--before` set just after 0.76.0's publish time, so every host resolves the dependency tree that release shipped with (the differential report prints each host's tree digest); it is never upgraded. The candidate is `npm pack` of the checkout, installed in `~/.cache/mm-harness-builds/<sha>`, so both sides are installed packages in sibling directories. Commands run as argv arrays, locally without a shell and remotely through one fixed ssh launcher with quoted arguments.
+
+## 1. Inventory
+
+```bash
+node scripts/feature-inventory.mjs --check            # this checkout, packed and installed, vs tests/feature-inventory/baseline-0.76.0.json
+node scripts/feature-inventory.mjs --check --bin <installed mm-harness>   # a published build
+```
+
+The inventory asks the build itself, so it stays valid while code moves between packages:
+
+- **CLI**: a public command refuses `<cmd> --feature-inventory-probe` as an unknown option, a removed one is refused as an unknown command. A flag exists when `<cmd> <flags…> --feature-inventory-canary --help` is refused only at the trailing canary (a lost flag is refused first; the canary proves the validator walked every flag before it, and `--help` keeps an accepted probe from running anything). An option value exists when `<cmd> <flag>=<value> --feature-inventory-canary --help` is refused only at the canary. Positional choices come from the "Valid values" an invalid positional is refused with. Candidates to probe are the union of the build's own command contract and the baseline's grammar, so moving `command-contract.ts` cannot hide a lost flag.
+- **Oracle check**: every probe reads presence from a refusal, so the run first proves the refusals are seen (a bogus command, flag and option value must each be refused, `--help` must succeed), and any probe result that is neither an acceptance nor a known refusal stops the run. A build that does not start, or a CLI whose wording changed (the contract moving into `@farmslot/recipe-cli`), fails loudly; update the patterns in `feature-inventory.mjs` in that PR.
+- **Hidden commands** (`self-test`, `ensure-ready`, `runtime-*`, `resolve-extension`, `completion-candidates`, `completions`) bypass the preflight validator. They are probed with a flag that has no value, which their own parsers reject before doing any work; a different result stops the run. If that parse ever changed, the probe would reach the command, inside the sandbox.
+- **Per adapter** (the `--adapter` choices): action ids, their schema fields and enum values, and observers (`actions --raw --json`); call short names (`call --list --json`); bundled recipes and their parameters (`run --list --json`); doctor check ids (`doctor --json`) against an empty target, plus a real checkout per `--checkout <adapter>=<dir>`.
+- **Environment variables**: a source scan of the package and every `@farmslot` package it depends on (a direct JS read, a name passed to a helper that reads env by parameter or listed next to an `env[<variable>]` access, or a shell expansion the script never assigns), the env inputs `adapters/manifest.json` documents, and every unset variable a Node process looked up while the probes ran (including a read-only `help review` per adapter) (`scripts/feature-guard/env-trace.mjs`, which sees names built at runtime). This is a floor: a name that is still present somewhere does not prove the same code path reads it; the differential covers behaviour.
+- **Package surface**: bins, exports, the package entry's export names, `files` entries that exist in the package, `adapters/manifest.json` features, every shipped script and module path under `adapters/` and `library/`, and the export subpaths and bins of the `@farmslot` dependencies (where moved code lands).
+
+Probes run in `scripts/feature-guard/sandbox.mjs`: a sandbox HOME and config, no inherited recipe libraries, inert device and process listings, and stubs that fail the inventory if a probe reaches a browser, launcher, package manager or `gh`.
+
+`--check` fails on a baseline key that is missing from the build unless `changes.json` covers it. Doctor contexts the run did not record (no `--checkout`) are reported as skipped. The baseline file is regenerated only when the probe logic changes, and always from the frozen 0.76.0 bin:
+
+```bash
+node scripts/feature-inventory.mjs --bin ~/.cache/mm-harness-baseline/0.76.0/node_modules/.bin/mm-harness \
+  --out tests/feature-inventory/baseline-0.76.0.json
+```
+
+### `changes.json`: consolidation is welcome
+
+The guard protects capabilities, not names. Merging or simplifying actions, commands or flags is fine when the capability survives. Each entry has an `id`, a `reason` and a `pr`:
+
+- `consolidated`: `from` (old keys, `*` allowed) → `to` (keys that must exist in the build), the `argumentMapping`, and a `differential` the differential's consolidated lane runs:
+  - `{ "kind": "cli", "where": "sandbox" | "slot", "adapter": …, "old": { "argv", "env" }, "new": { "argv", "env" } }`: the old invocation on 0.76.0 vs the mapped one on the PR build; equivalent normalized outcome passes.
+  - `{ "kind": "env", …same…, "names": [[old, new], …] }`: as `cli`, and the baseline must read each old variable and the build the new one (env trace; leave them unset).
+  - `{ "kind": "module", "old": [paths or specifiers], "new": [specifiers], "renamed": { old: new }, "names": [old names] }`: each new home exports every name the old module did (or, with `names`, the listed names when only part of the old module moved).
+  - `{ "kind": "script", "old": { "script", "args" }, "new": { "script", "args" } }`: a moved CLI script, run on both sides.
+- `dropped`: `keys` proven dead, with `evidence` (no caller in farms, skills, recipe libraries, docs).
+
+No shims: the PR that consolidates renames every caller (farm hooks, skills, recipes, docs) in the same change.
+
+## 2. Live differential
+
+```bash
+node scripts/differential.mjs \
+  --slot core=~/dev/metamask/core-6 \
+  --slot terminal=~/dev/metamask/va-mmcx-terminal-1 --slot-var terminal:cdpPort=9541 --slot-var terminal:appPort=9341 \
+  --slot-env terminal:TERMINAL_EXTENSION_CHECKOUT=<extension checkout with a dist> \
+  --slot-env terminal:RECIPE_WALLET_FIXTURE=<farm wallet fixture> \
+  --slot-env terminal:RECIPE_LIBRARY_PATH=perps=<dir>:terminal=<dir> \
+  --slot extension=macpro.local:/Users/deeeed/dev/metamask/metamask-extension-1 \
+  --slot-var extension:cdpPort=7661 --slot-var extension:watcherPort=9011 --slot-var extension:slot=macpro-mme-1 \
+  --slot mobile=macpro.local:/Users/deeeed/dev/metamask/metamask-mobile-5 \
+  --slot-var mobile:watcherPort=8065 --slot-var mobile:device=mm-5
+```
+
+Lanes (`--lanes`, default all):
+
+- `help`: `--help`, `--version` and `<cmd> --help` for every baseline command, sandboxed.
+- `slots`: per `--slot`, discovery (`actions --raw`, `call --list`, `run --list`, `doctor --json`) and the adapter's cases in `tests/differential/matrix.json`: the farm hook argv the goldens freeze, run on the real slot, plus real runs and calls (`live`), including a probe that requires the live transport (`cdp.target`), not only checkout metadata. The prelude gives both sides the same start; the whole baseline sequence runs before the candidate's. A slot on another host runs over ssh, with both builds installed there.
+- `consolidated`: the `changes.json` differentials.
+- `goldens`: the contract golden families run against each build from a copy of `tests/`, compared golden by golden.
+
+Captures are normalized (paths, versions, pids, timestamps, durations, epoch numbers, encrypted vaults) and compared per facet: exit code, stdout (JSON paths or text), stderr when stdout is empty, artifact files and tree. `volatile` paths in the matrix (product console warnings that arrive on the product's own timing) are masked but their keys still compared. Every remaining difference must match an entry in `tests/differential/intended.json` (`case` glob, optional `facet`, `paths` or `text`, `reason`, `pr`). The report lands in `evidence/differential/<sha>/report.md`, with `results.json` and every raw capture beside it; attach the report to the PR. Verdicts: PASS (exit 0), FAIL (exit 1: an unexplained difference or a lane error), INCOMPLETE (exit 3: a case was skipped, e.g. a consolidated proof without its `--slot`).
+
+What the normaliser deliberately masks, and so cannot catch: any semver under a key ending in `version` other than the harness's own, numbers under keys ending in `Ms`/`Seconds`/`duration`/`elapsed` (so a changed timeout value), epoch-millisecond numbers, and the `volatile` paths (a new product warning during a live run). Each varies run to run on real slots; the goldens freeze the static values.
+
+Machine rules: on macwork, headless only and no focus stealing (`TERMINAL_HEADLESS=1` is in the matrix). Headful runs and the Extension wallet popup fail while macwork's screen is locked (`Page.captureScreenshot` timeout). Mobile and the Extension run on free macpro or mini slots, never mini-mm-3. The differential stops and cleans the slot runtime it used; reinstall the farm's overlay afterwards if the slot is handed back to the farm.
+
+## 3. Release smoke
+
+```bash
+node scripts/release-smoke.mjs --version 0.79.0 <the same --slot flags>   # a published release -> ~/dev/metamask/mm-harness-smoke/0.79.0
+node scripts/release-smoke.mjs <the same --slot flags>                   # this checkout, packed -> .../0.79.0+<package digest>, compared with 0.79.0
+```
+
+`tests/release-smoke/*.json` is the fixed set: Mobile Perps smoke, Extension Perps smoke, Terminal wallet connect (`terminal.perps.ensure-session`), and a core `call`. All are read-only; the canary slots must hold the farm's testnet wallet fixture (the Terminal enforces testnet itself). Each runs its prelude (install or fixture sync, launch, wallet fixture), the recipe with `--record-video=full-run` (the Terminal adapter has no video; its trace is the record), then its after steps (stop). Runs are kept per build on the host in `~/dev/metamask/mm-harness-smoke/<version>` (published) , `<version>+<package digest>` (a packed checkout; commits that only touch repo tooling are the same build) or `<version>+local` (`--bin`), with the full artifact directory (summary, trace, video) per smoke; an `--only` run updates its smokes and keeps the others recorded for the same packed or published build (a `--bin` build keeps nothing: it can change in place). The run compares with the published run at the highest version not above its own. Verdicts: FAIL (exit 1) on a non-pass status, a missing trace or expected video, or a regression (status, or the node/action sequence of a passing run); INCOMPLETE (exit 3) when a smoke has not run for this build or has nothing to compare with (`--no-compare` marks the first recorded run).
+
+## CI
+
+Not wired yet. The inventory `--check` needs no slot and can run in CI on the packed build; the differential and the smoke set need real slots and stay in the review and release flow. The workflow change is proposed separately.

package/library/README.md

@@ -10,7 +10,9 @@
   That is the engine contract (the recipe engine spawns/imports them with the
   input env set) — a bare `import` outside the engine throws
   "Missing live adapter input path", which is expected, not a bug.
-- Actions load harness helpers ONLY through `actions/harness-exports.mjs` (the
+- Actions import the generic harness helpers (runtime paths, recording
+  snapshots) directly from `@farmslot/recipe-cli/harness`, and load the
+  MetaMask helpers ONLY through `actions/harness-exports.mjs` (the
   dist-preferring bridge) — never deep-import `src/` (published installs have no
   src/, and the entrypoint would close an import cycle through adapters.ts).
 - `recipes/` — runnable recipes (`mm-harness run <name-or-file>`).

package/library/actions/core/perps/_controller.mjs

@@ -5,9 +5,8 @@ import { readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 
-import { mnemonicToAccount, privateKeyToAccount } from 'viem/accounts';
-
 import { walletFixturePath } from '../../harness-exports.mjs';
+import { readFixtureAccounts } from '../wallet/_fixture-accounts.mjs';
 
 function controllerEntry(projectRoot) {
   return pathToFileURL(path.join(projectRoot, 'packages/perps-controller/src/index.ts')).href;
@@ -27,7 +26,7 @@ function messengerEntry(projectRoot) {
 // a persistent auto-reconnecting HyperLiquid WebSocket (HyperLiquidClientService
 // .initialize → wsTransport.ready()); these logs proved the order returns over
 // HTTP while that open socket kept the event loop alive — see disconnectAndExit.
-function buildInfrastructure(stubbed, input) {
+function buildInfrastructure(stubbed, input, rewardsSource) {
   const noop = () => undefined;
   const terminalApi = resolveTerminalApi(input);
   return {
@@ -69,153 +68,169 @@ function buildInfrastructure(stubbed, input) {
       removeItem: async () => undefined,
     },
     ...(terminalApi ? { terminalApi } : {}),
-    rewards: { getPerpsDiscountForAccount: async () => null },
+    rewards: {
+      getPerpsDiscountForAccount: (caipAccountId, baseFeeBips) =>
+        rewardsDiscount(rewardsSource.messenger, caipAccountId, baseFeeBips),
+    },
   };
 }
 
-// --- Account resolution from wallet-fixture.json ---
+// --- Rewards ---
 //
-// The core adapter resolves the signing account from the same wallet-fixture.json
-// that mobile/extension adapters use (recipeRuntimePath/wallet-fixture.json).
-// The fixture has the standard { accounts: [{ type, value, name }] } shape from
-// wallet-fixture.json.sample. The recipe node selects an account by name via
-// `account_name` (default "dev1"). The viem account derived from the fixture
-// entry is the authoritative source for both the address and signing key.
+// The clients answer the rewards dependency through the messenger's
+// RewardsController:getPerpsDiscountForAccount (extension perps-controller-init,
+// mobile mobileInfrastructure). Core has no RewardsController, so the handler
+// exists when the node supplies rewards_discount_bips, or when a driver
+// registers one on rootMessenger. Without a handler the answer is null: the
+// controller's "no discount known yet".
+//
+// The controller asks for the discount with the account's CAIP id, built from
+// the wallet's selected network (NetworkController:getState and
+// getNetworkClientById). A supplied discount therefore comes with the network a
+// fresh client wallet starts on, Ethereum mainnet; without one the headless
+// controller keeps having no NetworkController, as before.
 
-/**
- * Load wallet-fixture.json and return the named account entry.
- * Returns null if the fixture file does not exist.
- *
- * @param projectRoot - Absolute path to the project root.
- * @param accountName - The `name` field to match in fixture.accounts.
- */
-async function loadFixtureAccount(projectRoot, accountName) {
-  const fixturePath = walletFixturePath(projectRoot);
-  let raw;
+const REWARDS_DISCOUNT_ACTION = 'RewardsController:getPerpsDiscountForAccount';
+
+async function rewardsDiscount(rootMessenger, caipAccountId, baseFeeBips) {
+  if (!rootMessenger) return null;
   try {
-    raw = await readFile(fixturePath, 'utf8');
+    return await rootMessenger.call(REWARDS_DISCOUNT_ACTION, caipAccountId, baseFeeBips);
   } catch (error) {
-    if (error?.code === 'ENOENT') return null;
+    if (String(error?.message ?? '').includes(`${REWARDS_DISCOUNT_ACTION} has not been registered`)) return null;
     throw error;
   }
-  const fixture = JSON.parse(raw);
-  if (!Array.isArray(fixture.accounts) || fixture.accounts.length === 0) {
-    throw new Error(`wallet-fixture.json at ${fixturePath} has no accounts array.`);
-  }
-  const entry = fixture.accounts.find((a) => a?.name === accountName);
-  if (!entry) {
-    const names = fixture.accounts.map((a) => a?.name).filter(Boolean).join(', ');
-    throw new Error(
-      `wallet-fixture.json has no account named "${accountName}". Available: ${names}.`,
-    );
-  }
-  if (typeof entry.value !== 'string' || entry.value.trim().length === 0) {
-    throw new Error(`wallet-fixture.json account "${accountName}" has no value.`);
-  }
-  if (entry.type !== 'mnemonic' && entry.type !== 'privateKey') {
-    throw new Error(
-      `wallet-fixture.json account "${accountName}" type must be mnemonic or privateKey, got "${entry.type}".`,
-    );
-  }
-  return entry;
 }
 
 /**
- * Derive a viem account from a wallet-fixture account entry.
- * Mnemonics use BIP-44 account index 0 (MetaMask default derivation).
- * Private keys are accepted with or without a 0x prefix.
+ * The rewards discount a node supplies, in basis points (0-10000), or undefined.
+ *
+ * @param input - Adapter input (node.rewards_discount_bips).
  */
-function viemAccountFromFixtureEntry(entry) {
-  if (entry.type === 'mnemonic') {
-    return mnemonicToAccount(entry.value.trim(), { addressIndex: 0 });
-  }
-  // privateKey
-  const raw = entry.value.trim();
-  const normalized = raw.startsWith('0x') ? raw : `0x${raw}`;
-  if (!/^0x[0-9a-fA-F]{64}$/u.test(normalized)) {
-    throw new Error(
-      `wallet-fixture.json privateKey account "${entry.name}" is not a 32-byte hex key.`,
-    );
+export function requestedRewardsDiscountBips(input) {
+  const raw = optionalParam(input.node, 'rewards_discount_bips', 'rewardsDiscountBips');
+  if (raw === undefined) return undefined;
+  const bips = Number(raw);
+  if (!Number.isInteger(bips) || bips < 0 || bips > 10000) {
+    throw new Error(`rewards_discount_bips must be an integer from 0 through 10000; got ${raw}.`);
   }
-  return privateKeyToAccount(normalized);
+  return bips;
 }
 
-/**
- * Resolve the account name to use for signing.
- * Precedence: node.account_name → node.account (if not an address) → "dev1".
- */
-function resolveAccountName(input) {
-  const explicit = input.node?.account_name;
-  if (typeof explicit === 'string' && explicit.trim().length > 0) return explicit.trim();
-  // node.account can be either a name ("dev1") or an address ("0x...").
-  // If it looks like an address, ignore it here — the address will be derived
-  // from the fixture signer instead.
-  const nodeAccount = input.node?.account;
-  if (
-    typeof nodeAccount === 'string' &&
-    nodeAccount.trim().length > 0 &&
-    !/^0x[0-9a-fA-F]{40}$/u.test(nodeAccount.trim())
-  ) {
-    return nodeAccount.trim();
-  }
-  return 'dev1';
+const REWARDS_NETWORK_ACTIONS = ['NetworkController:getState', 'NetworkController:getNetworkClientById'];
+
+function registerRewardsHandler(rootMessenger, childMessenger, discountBips) {
+  if (discountBips === undefined) return;
+  rootMessenger.registerActionHandler(REWARDS_DISCOUNT_ACTION, async () => discountBips);
+  rootMessenger.registerActionHandler('NetworkController:getState', () => ({
+    selectedNetworkClientId: 'mainnet',
+  }));
+  rootMessenger.registerActionHandler('NetworkController:getNetworkClientById', (networkClientId) => {
+    if (networkClientId !== 'mainnet') throw new Error(`No network client with id ${networkClientId}.`);
+    return { configuration: { chainId: '0x1' } };
+  });
+  rootMessenger.delegate({ actions: REWARDS_NETWORK_ACTIONS, messenger: childMessenger });
+}
+
+// --- Account selection from wallet-fixture.json ---
+//
+// The core adapter reads the same wallet-fixture.json the mobile/extension
+// adapters use (recipeRuntimePath/wallet-fixture.json), expanded the way
+// list_accounts shows it (dev1..devN from a mnemonic with count N). A node
+// selects an account by name (`account_name`, or a non-address `account`) or by
+// 0x address (`account`, `address`, `userAddress`); dev1 when it names none.
+// An unknown name is refused, and an address is never swapped for another
+// account: one outside the fixture is read as given, and cannot sign.
+
+const ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/u;
+
+function trimmedString(value) {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
 }
 
 /**
- * Resolve the viem signer and EVM address for writes.
- * The wallet fixture account selected by name is the only signing source.
+ * Resolve the account a node selects.
  *
- * @param input - Adapter input (context.projectRoot, node.account_name).
- * @returns { account: ViemAccount, address: string }
+ * @param input - Adapter input (context.projectRoot, node account fields).
+ * @returns { name, address, signer } — name and signer are null for an address outside the fixture.
  */
-async function resolveSignerFromFixture(input) {
+export async function selectAccount(input) {
+  const node = input.node ?? {};
   const projectRoot = input.context?.projectRoot;
-  const accountName = resolveAccountName(input);
+  const accountField = trimmedString(node.account);
+  const names = [trimmedString(node.account_name), accountField && !ADDRESS_PATTERN.test(accountField) ? accountField : undefined]
+    .filter((value) => value !== undefined);
+  const addresses = [node.account, node.address, node.userAddress]
+    .map(trimmedString)
+    .filter((value) => value !== undefined && ADDRESS_PATTERN.test(value));
+  if (new Set(names).size > 1) {
+    throw new Error(`core perps account selectors disagree: ${[...new Set(names)].join(' vs ')}; select one account.`);
+  }
+  if (new Set(addresses.map((value) => value.toLowerCase())).size > 1) {
+    throw new Error(`core perps account selectors disagree: ${addresses.join(' vs ')}; select one account.`);
+  }
+  const [name] = names;
+  const [address] = addresses;
+  const loaded = projectRoot ? await readFixtureAccounts(projectRoot) : null;
 
-  if (projectRoot) {
-    const entry = await loadFixtureAccount(projectRoot, accountName);
-    if (entry) {
-      const account = viemAccountFromFixtureEntry(entry);
-      return { account, address: account.address };
-    }
+  if (!loaded) {
+    if (!name && address) return { name: null, address, signer: null };
+    throw new Error(
+      `core perps account "${name ?? 'dev1'}" needs a wallet fixture at ` +
+      `${projectRoot ? walletFixturePath(projectRoot) : 'the checkout'}; ` +
+      'a read-only action can name a 0x address via account= instead.\n' +
+      'Next: run mm-harness fixtures set',
+    );
   }
 
-  throw new Error(
-    `core perps writes require wallet-fixture.json account "${accountName}". ` +
-    `Next: run mm-harness fixtures set`,
-  );
+  const available = loaded.accounts.map((account) => account.name).join(', ');
+  const byName = (wanted) => loaded.accounts.find((account) => account.name === wanted);
+  if (name) {
+    const matches = loaded.accounts.filter((account) => account.name === name);
+    if (matches.length > 1) {
+      throw new Error(`wallet fixture has ${matches.length} accounts named "${name}"; rename one in ${loaded.fixturePath}.`);
+    }
+    const [match] = matches;
+    if (!match) {
+      throw new Error(`wallet fixture has no account named "${name}". Available: ${available}.`);
+    }
+    if (address && match.address.toLowerCase() !== address.toLowerCase()) {
+      throw new Error(`fixture account "${name}" is ${match.address}, not ${address}; select one of them.`);
+    }
+    return match;
+  }
+  if (address) {
+    return loaded.accounts.find((account) => account.address.toLowerCase() === address.toLowerCase()) ??
+      { name: null, address, signer: null };
+  }
+  const fallback = byName('dev1');
+  if (!fallback) {
+    throw new Error(`wallet fixture has no account named "dev1" (the default). Available: ${available}; pass account=<name>.`);
+  }
+  return fallback;
 }
 
 /**
- * Resolve the account address for reads (no signing required).
- * Prefer the wallet fixture account; explicit node addresses support read-only calls.
+ * Resolve the viem signer and EVM address for writes: a fixture account,
+ * selected by name or by its address.
+ *
+ * @param input - Adapter input (context.projectRoot, node account fields).
+ * @returns { account: ViemAccount, address: string }
  */
-async function requireAccountAddress(input) {
-  const projectRoot = input.context?.projectRoot;
-  const accountName = resolveAccountName(input);
-
-  if (projectRoot) {
-    // No try/catch: loadFixtureAccount returns null when no fixture is present
-    // (the only recoverable case) and THROWS on a malformed / missing-named /
-    // empty / bad-type fixture. Those must fail loudly — swallowing them would
-    // let a read silently run against a different address than the writes use.
-    const entry = await loadFixtureAccount(projectRoot, accountName);
-    if (entry) {
-      const account = viemAccountFromFixtureEntry(entry);
-      return account.address;
-    }
-  }
-
-  // Read-only calls may name an address directly.
-  const fromNode = input.node?.account ?? input.node?.address ?? input.node?.userAddress;
-  const address = String(fromNode ?? '').trim();
-  if (!/^0x[0-9a-fA-F]{40}$/u.test(address)) {
+async function resolveSignerFromFixture(input) {
+  const selected = await selectAccount(input);
+  if (!selected.signer) {
     throw new Error(
-      `core perps reads require a wallet-fixture.json with account "${accountName}", ` +
-      `or a 0x EVM address via node.account.`,
+      `core perps writes sign with a wallet-fixture.json account; ${selected.address} is not one of them.\n` +
+      'Next: pass account=<fixture account name>, or an address listed by metamask.wallet.list_accounts',
     );
   }
-  return address;
+  return { account: selected.signer, address: selected.address };
+}
+
+/** The address a read acts on (no signing required). */
+async function requireAccountAddress(input) {
+  return (await selectAccount(input)).address;
 }
 
 let cached = null;
@@ -275,13 +290,15 @@ export async function getCoreController(input) {
   const network = resolveNetwork(input);
   const terminalApi = resolveTerminalApi(input);
   const terminalApiKey = JSON.stringify(terminalApi ?? null);
+  const rewardsDiscountBips = requestedRewardsDiscountBips(input);
 
   if (
     cached &&
     cached.projectRoot === projectRoot &&
     cached.network === network &&
     cached.accountAddress.toLowerCase() === accountAddress.toLowerCase() &&
-    cached.terminalApiKey === terminalApiKey
+    cached.terminalApiKey === terminalApiKey &&
+    cached.rewardsDiscountBips === rewardsDiscountBips
   ) {
     return { ...cached, accountAddress };
   }
@@ -307,7 +324,8 @@ export async function getCoreController(input) {
   );
 
   const stubbed = new Set();
-  const infrastructure = buildInfrastructure(stubbed, input);
+  const rewardsSource = {};
+  const infrastructure = buildInfrastructure(stubbed, input, rewardsSource);
 
   // Root + child messenger pair, mirroring the real app wiring (and the core
   // repo's own test harness in
@@ -323,6 +341,8 @@ export async function getCoreController(input) {
     parent: rootMessenger,
   });
   registerSelectedAccountHandler(rootMessenger, messenger, accountAddress);
+  registerRewardsHandler(rootMessenger, messenger, rewardsDiscountBips);
+  rewardsSource.messenger = rootMessenger;
 
   // Default testnet. Mainnet only on explicit node.network: "mainnet" — mainnet
   // reads are safe; mainnet mutations use real funds (gated in getCoreControllerWithSigner).
@@ -365,6 +385,7 @@ export async function getCoreController(input) {
     network,
     accountAddress,
     terminalApiKey,
+    rewardsDiscountBips,
   };
   return { ...cached, accountAddress };
 }
@@ -450,6 +471,9 @@ function registerSignerHandlers(rootMessenger, childMessenger, account) {
           'KeyringController:signTypedMessage received no typed data to sign.',
         );
       }
+      if (msgParams?.from && String(msgParams.from).toLowerCase() !== account.address.toLowerCase()) {
+        throw new Error(`KeyringController:signTypedMessage asked to sign for ${msgParams.from}; the selected account is ${account.address}.`);
+      }
       const { domain, types, primaryType, message } = typedData;
       // Strip the EIP712Domain entry if present: viem derives the domain types
       // from `domain` itself and rejects a duplicate EIP712Domain in `types`.
@@ -486,16 +510,16 @@ function registerSignerHandlers(rootMessenger, childMessenger, account) {
  * @returns { controller, projectRoot, network, accountAddress, signerAddress }.
  */
 export async function getCoreControllerWithSigner(input) {
-  const requestedName = input.node?.account_name ?? input.node?.account;
-  if (requestedName !== undefined && (
-    typeof requestedName !== 'string' || !requestedName.trim() ||
-    /^0x[0-9a-fA-F]{40}$/u.test(requestedName.trim())
-  )) {
+  // A selection given only as empty values must not quietly sign as dev1.
+  const selectors = ['account_name', 'account', 'address', 'userAddress'].filter((key) => input.node?.[key] != null);
+  if (selectors.length > 0 && selectors.every((key) => trimmedString(input.node[key]) === undefined)) {
     throw new Error(
-      'Core signing requires a non-empty fixture account name, not an address.\n' +
-      'Next: pass account=<reserved-fixture-name>; use addresses only for read-only actions.',
+      'Core signing requires a non-empty fixture account name or address.\n' +
+      'Next: pass account=<fixture account name>, or omit it to sign as dev1.',
     );
   }
+  // Refuse an account that cannot sign before any controller I/O.
+  const { account, address: signerAddress } = await resolveSignerFromFixture(input);
   const base = await getCoreController(input);
   const { controller, messenger: childMessenger, rootMessenger, accountAddress } = base;
   if (!rootMessenger || !childMessenger) {
@@ -517,7 +541,6 @@ export async function getCoreControllerWithSigner(input) {
     );
   }
 
-  const { account, address: signerAddress } = await resolveSignerFromFixture(input);
   registerSignerHandlers(rootMessenger, childMessenger, account);
 
   // Bring up the active provider. placeOrder/closePosition call
@@ -741,7 +764,7 @@ export function redactOrder(order) {
   };
 }
 
-// --- Adapter IO (mirrors the live-adapter contract in src/live-adapter-contract.ts) ---
+// --- Adapter IO (mirrors the live-adapter contract in @farmslot/recipe-cli/harness live-adapter-contract) ---
 
 async function loadInput() {
   const inputPath = process.argv[2] || process.env.METAMASK_RECIPE_ADAPTER_INPUT;
@@ -766,7 +789,7 @@ const fmtError = (e) => e?.stack ?? e?.message ?? String(e);
  * wsTransport.ready(). Orders themselves go over the HTTP ExchangeClient and
  * RETURN normally, but that open WebSocket keeps the Node event loop alive, so
  * the adapter process never exits. The runner only resolves on the child's
- * `close` event (src/live-adapter-contract.ts runProcess), so it waits out
+ * `close` event (@farmslot/recipe-cli/harness live-adapter-contract runProcess), so it waits out
  * live_adapter_timeout_ms, SIGTERMs the child, and reports `fail` even though
  * the trade filled and the output was computed. READ adapters use the
  * standalone HTTP-only InfoClient (utils/standaloneInfoClient) — no WebSocket —

package/library/actions/core/perps/quote_fees.mjs

@@ -0,0 +1,58 @@
+// Quote an order's fees through the controller's calculateFees: the preview the
+// clients show, with the rewards and subscription sources the fee resolver uses.
+// Read-only: nothing is signed or placed.
+
+import {
+  configuredSymbols,
+  getCoreController,
+  isDirectRun,
+  optionalBooleanParam,
+  optionalParam,
+  requestedRewardsDiscountBips,
+  runAdapter,
+} from './_controller.mjs';
+
+const ORDER_TYPES = ['market', 'limit'];
+
+export async function quoteFees(input) {
+  const symbols = configuredSymbols(input, []);
+  if (symbols.length !== 1) {
+    throw new Error(`metamask.perps.quote_fees requires exactly one market; got ${JSON.stringify(symbols)}.`);
+  }
+  const orderType = (optionalParam(input.node, 'order_type', 'orderType') ?? 'market').toLowerCase();
+  if (!ORDER_TYPES.includes(orderType)) {
+    throw new Error(`metamask.perps.quote_fees order_type must be ${ORDER_TYPES.join(' or ')}; got ${orderType}.`);
+  }
+  const isMaker = optionalBooleanParam(input.node, 'is_maker', 'isMaker');
+  const amount = optionalParam(input.node, 'amount');
+  if (amount !== undefined && !(Number(amount) > 0)) {
+    throw new Error(`metamask.perps.quote_fees amount must be a positive USD notional; got ${amount}.`);
+  }
+
+  const { controller, accountAddress, network } = await getCoreController(input);
+  // calculateFees routes to the active provider, which init() brings up.
+  await controller.init();
+  const fees = await controller.calculateFees({
+    symbol: symbols[0],
+    orderType,
+    ...(isMaker === undefined ? {} : { isMaker }),
+    ...(amount === undefined ? {} : { amount }),
+  });
+  return {
+    action: input.action,
+    source: 'perps-controller-calculateFees',
+    network,
+    account: accountAddress,
+    market: symbols[0],
+    orderType,
+    isMaker: isMaker ?? null,
+    amount: amount ?? null,
+    rewardsDiscountBips: requestedRewardsDiscountBips(input) ?? null,
+    // Core has no RewardsController: a discount here is the one the node supplied.
+    rewardsSource: requestedRewardsDiscountBips(input) === undefined ? null : 'node.rewards_discount_bips',
+    fees,
+    proofPath: 'perps-controller-calculateFees',
+  };
+}
+
+if (isDirectRun(import.meta.url)) runAdapter(quoteFees);