@deeeed/metamask-harness 0.80.0 → 0.82.0

package/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 ## Unreleased
 
+## 0.82.0 - 2026-10-07
+
+### Added
+
+- Adapters a recipe library declares in `recipe-library.json` `adapters` (on `--library`, the `RECIPE_LIBRARY_PATH` you set or else the personal library, or `config set libraries.<name>`; never a task-local library, a sibling checkout or `<target>/.skills-cache`, which serve recipe discovery only) work as `--adapter <id>`: the command loads the plugin only when it selects it (the last `--adapter`, else the last `--platform`), composes it on the adapter it `extends` (a built-in or another plugin; a plugin that extends a built-in also offers the built-in's official actions, library actions and observers), runs its doctor checks after the shared ones (a check that throws is a required failure, `adapter-plugin:<id>:doctor`) and runs its in-code actions. `call <action> --adapter <id> --help` shows a plugin action's fields. `doctor --json` names each loaded plugin with its library and digest (`adapter-plugin:<id>`), and an approved plan (`--approve-plan`) binds that digest: every run on a plugin adapter carries it in `METAMASK_RECIPE_ADAPTER_PLUGIN`, so editing the plugin's module or a file beside it fails the old approval with `RECIPE_APPROVAL_MISMATCH`, whatever actions the recipe runs. A plugin's own manifest may declare official actions and observers for that plugin, but a plugin that extends it inherits only its custom actions: inherited official actions and observers come from the bundled library alone, and a parent manifest outside it that declares one fails with `ACTION_MANIFEST_INVALID` (a JSON envelope under `--json`), like any other action manifest the plugin can't use. A malformed `RECIPE_LIBRARY_PATH` never blocks a built-in adapter. A plugin may import from disk only its module's directory and the library's `actions/` (`RECIPE_SOURCE_INVALID` otherwise); a bare package it imports resolves from mm-harness's own install. Plugins need Node.js 22.15 or later. A refused plugin fails with `ADAPTER_SDK_UNSUPPORTED`, `ADAPTER_PLUGIN_INVALID`, `ADAPTER_PLUGIN_LOAD_FAILED`, `ADAPTER_ID_CONFLICT`, `ADAPTER_EXTENDS_UNKNOWN` or `RECIPE_SOURCE_INVALID`, exit 2. A plugin that extends nothing (or only other plugins) gets no Runway provisioning and no wallet fixture operations; one that extends a built-in keeps the built-in's (the terminal plugin keeps web-dapp's `fixtures init|sync|set`).
+
+### Changed
+
+- **BREAKING:** the built-in `terminal` adapter becomes the generic `web-dapp` built-in, and the Web Terminal becomes the `terminal` plugin of the `experimental-metamask-recipe-terminal` library (`recipe-library.json` `adapters.terminal`, `extends: web-dapp`). `--adapter terminal` needs a revision of that library that declares `adapters.terminal` (8b409b6 or later, on its `feat/console-allowlist` branch; the library's `main` does not declare it yet) on `RECIPE_LIBRARY_PATH`, as on the Terminal farm slots. A host without it (an older checkout, or none, as on macpro and mini today) refuses every `--adapter terminal` command: `--adapter must be mobile, extension, core, or web-dapp; received 'terminal'`. Update the library before this harness; the hooks, runtime dir (`temp/recipe/runtime/terminal`), doctor check ids, evidence names and action ids are unchanged.
+  - The plugin holds everything Hyperliquid: the venue policy (blocked and served hosts, link hosts, the launch probe, the testnet typed-data refusal, the start page and product routes, the injected wallet's start chain, the checkout dependencies and detection, the dev-server testnet variable), the signature-log rules, and the 7 `metamask.perps.*` venue actions with their manifest. They leave this package: `adapters/terminal/lib/mainnet-guard.mjs`, `adapters/terminal/policy.mjs`, `library/actions/terminal/perps/`.
+  - `web-dapp` keeps the generic parts (`adapters/web-dapp/`, `library/actions/web-dapp/`, `library/manifests/web-dapp.action-manifest.json`): launch, stop, verify, inject, cleanup, the wallet host, console capture, `ui.*`, `app.hud`, `metamask.app.*` and `metamask.wallet.*`. It reads the venue policy from the module in `RECIPE_WEB_DAPP_POLICY`, which the harness sets when it adopts an adapter that extends `web-dapp`; the leaf scripts no longer take `--policy-module`.
+  - `web-dapp` selected on its own has no venue: launch, verify and runtime status refuse, and doctor fails its required `web-dapp-venue-policy` check. The policy module is checked when it loads (every member web-dapp reads, and `policyVersion: 1`).
+  - Without `--adapter`, a Terminal checkout is no longer auto-detected, and `actions --matrix` has no `terminal` column: the loader imports a plugin only when a command selects it (the ADR trust boundary), so the plugin's detection runs once `--adapter terminal` selects it. Every farm hook passes `--adapter terminal`.
+  - `check diff` takes any registered or library-declared adapter for `--adapter`/`--platform` (it listed the built-ins).
+- Depend on `@farmslot/recipe-cli` 0.6.0 and `@farmslot/adapter-sdk` 0.5.0 (were 0.5.0 and 0.4.0), which carry recipe-library adapter plugins, adapter-aware trusted-mutation hooks and one environment scope for a run's ports (recipe-cli 0.6.0 also writes the task's acceptance ledger from a recipe's proof targets and warns at `run --plan` on command nodes whose exit code cannot prove the claim), and on `@farmslot/recipe-runner` 0.25.0 and `@farmslot/adapter-rn` 0.17.1 (were 0.24.0 and 0.17.0). `@farmslot/adapter-web` 0.3.1, `@farmslot/agent-runtime` 0.17.0 and `@farmslot/protocol` 0.34.0 are unchanged, and the install still holds one `@farmslot/recipe-runner`.
+- The Extension proof-runtime check no longer pins `--cdp-port`/`--watcher-port` itself: `run` and `call` run it, the observers and the execution in one environment scope, so every platform's runtime check and observers see the run's ports, its dev-server port names (`METRO_PORT`) and its platform environment. The performance observers read their ports from that environment (`PerformanceObserver.backend(target, env)`), and `self-test` opens the scope around its smoke runs.
+
+## 0.81.0 - 2026-10-07
+
+### Added
+
+- Core's headless `RewardsController:getPerpsDiscountForAccount` now asks the rewards API for the Perps fee discount, with the calls Mobile's RewardsController makes for the selected wallet fixture account: the opt-in check, `mobile-login` signed with personal_sign, then `/vip/fees`, and Mobile's discount math. Like Mobile, it logs in when the opt-in check itself fails, reads a 401 from login as not opted in, and gives each request 10 seconds. An account that never opted in, or an address outside the fixture, gets no discount (`null`). The session token stays in memory, and an error keeps only the HTTP status, never the response body. The backend defaults to UAT, as on Mobile dev builds; `CORE_PERPS_REWARDS_API_URL` selects another. `metamask.perps.quote_fees` reports `rewardsSource: "rewards-api"` with each call it answered; `rewards_discount_bips` still replaces the answer, to prove a discount the non-VIP fixture accounts cannot get.
+
+### Changed
+
+- **BREAKING:** Perps orders follow one rule on Mobile, Extension and Core (F21). Testnet orders need no funding proof, so `run` and `call metamask.perps.place_order --adapter extension` work without the four `--funding-*` files, as on Mobile. A mainnet order is allowed only from a synced fixture account, as a 1x isolated market order with `close_immediately: true` and `network: mainnet` declared, whose worst-case fill (one size step plus max slippage over the request) stays within $15; anything else is refused before dispatch with `PERPS_MAINNET_ORDER_REFUSED`. This newly guards Mobile mainnet orders, which had no check. `place_order` takes `close_immediately` (and Mobile takes `network`): from a flat market (no position or resting order), the action closes the opened position itself, on the account and network the rule allowed, and proves the market flat. Extension background market placements now prove their postcondition on current builds (positions carry a signed size, no side). On the Extension, a run without funding files runs its mutations in a fixture-policy lane with a run-owned execution ledger; the funding files remain the stricter release lane. Core keeps `CORE_PERPS_ALLOW_MAINNET_WRITES=1`. The fixture account derivation behind `metamask.wallet.list_accounts` moved to `library/actions/shared/wallet/fixture-accounts.mjs`, shared with the order rule.
+- Extension screenshots: a capture-helper that times out is killed with SIGKILL together with everything it started (the npm wrapper runs the native binary as a child). It can ignore SIGTERM and linger, making later captures hang. Before the next capture, this user's snapshot helpers orphaned by an earlier run (matched by executable and subcommand, including the configured path) are killed with their children; recording sessions and helpers whose harness is alive are left alone. A CDP fallback screenshot records `fallbackReason` (the capture-helper error) next to `fallbackFrom`, for `run`'s fallback listing in the next `@farmslot/recipe-cli` (deeeed/farmslot#829).
+- Extension `check diff` also runs `yarn verify-locales --quiet` when a file under `app/_locales/**` changed, moved or was deleted, and `yarn circular-deps:check` when any JS/TS file changed, moved or was deleted; otherwise each reports `skip`. `changedFiles` now lists deleted files and both sides of a rename (lint, format and tests still run on existing files only).
+- Help text only: the `help` quality guidance says to assert a test command's literal pass count with `assert_output`, since `jest -t` exits 0 when no test matches.
+- The Web Terminal's venue policy lives in one module, `adapters/terminal/policy.mjs`: the blocked and served Hyperliquid hosts, link hosts, the launch probe, the testnet typed-data refusal, the start page (`/order/BTC`), the injected wallet's start chain (42161), the checkout dependencies and the dev-server testnet variable. The launch, verify, doctor and the wallet host take it as an argument instead of naming the venue themselves; the leaf scripts `adapters/terminal/{launch,verify,wallet-host}.mjs` require `--policy-module <path>`, which the Terminal adapter passes. Behaviour is unchanged.
+- The Web Terminal's web3 part moves to `@farmslot/adapter-web/dapp` (`@farmslot/adapter-web` 0.3.0): the strict test wallet, the page script that logs the app's wallet requests (or injects the provider the wallet host answers), the wallet host's judgement of each request's frame and document, and the reading and assertion of the wallet request log behind `metamask.wallet.read_signatures` / `assert_signatures`. The exact-origin checks move to `@farmslot/adapter-web/origin`. The Terminal passes in its own parts: the Hyperliquid testnet refusal, the injected wallet's MetaMask identity, and the L1 and mainnet rules of the signature assertion. Log entries, refusals and action outputs are unchanged. The page's bindings are now `__farmslotWallet{Log,Request,Resolve}` and its marker `__farmslotDapp` (were `__mmTerminal*`).
+- Depend on `@farmslot/recipe-cli` 0.5.0 and `@farmslot/adapter-sdk` 0.4.0 (were 0.4.1 and 0.3.1), which carry the run and call engine and action discovery. `@farmslot/adapter-web` moves 0.2.0 → 0.3.1 (`./dapp` from 0.3.0, the probe fix in 0.3.1); `@farmslot/adapter-rn` 0.17.0, `@farmslot/recipe-runner` 0.24.0, `@farmslot/agent-runtime` 0.17.0 and `@farmslot/protocol` 0.34.0 are unchanged, so the install still holds one `@farmslot/recipe-runner`.
+- `run` and `call` move to `@farmslot/recipe-cli/harness` with their engine (recipe execution, preflight, bounded healing, recipe library resolution, static validation, network observation) and `describeManifestActions`, the action catalog entries they share with `actions`. mm-harness hands them one engine, `src/engine.ts`: the bundled `metamask` library, `src/manifest.ts`, the MetaMask action risk table, `createMetaMaskRunner`, funded mutations bound from the `--funding-*` flags, and the console classifier. Device targeting and the `fixture.file` plan step stay in mm-harness and are passed as command options. Flags, output and the CLI goldens are unchanged.
+- The Mobile and Extension proof-runtime checks (`MOBILE_SOURCE_NOT_LOADED`, `EXTENSION_RUNTIME_*`) move into `src/adapters/mobile/run.ts` and `src/adapters/extension/run.ts`, and the Mobile and Extension network backends into `src/adapters/{mobile,extension}/network-observer.ts`. Platforms declare network and performance observation through the SDK's `observation`; the performance observer stays in mm-harness and starts through `observation.performance.start`.
+- The Perps order rule (an order needs market, side and amount) runs in each platform's `actions.inputFindings` through `src/adapters/perps-order-inputs.ts`; `AdapterSurface` drops `actions.ensureChecksOnly` (the Extension passes it to the rule) and `observation` (now the SDK's). `src/metamask-action-validation.ts` is gone; the node loop is `@farmslot/recipe-cli`'s `validateActionInputs`.
+- Discovery moves to `@farmslot/recipe-cli/harness` and runs on `src/engine.ts`'s catalog: `actions` (lookup, search, categories, `--raw`, `--matrix`), `run --list`, `run <recipe> --describe` and `call --list`. `src/commands/manifest.ts` and `src/commands/list-executables.ts` are gone. Flags, `--json` output and the CLI goldens are unchanged. Two human-output changes:
+  - `actions --action <name>` (one match) and `call <action> --help` print the same action detail: the call form, description, source and adapter, risk, result cases, typed fields, up to two example calls, and the first example as a runnable call with its recipe node. The example calls now carry only the action's fields (no `next=done`, `cases` or `default`), shell-quoted, and use the full name when the short one is ambiguous. `actions --action` used to print a one-line catalog entry; `call --help` gains the risk, result cases and runnable example.
+  - The `actions --matrix` columns come from the registered platforms (same four, same order), and a capability no platform declares reads `across Mobile, Extension, Core, or Terminal` (was `across Mobile, Extension, or Core`).
+
+### Fixed
+
+- Browser probes stop when the resolver is stopped: `@farmslot/adapter-web` 0.3.1 (was 0.3.0) stops the probe browser and removes its profile when the resolver gets a signal (SIGTERM, SIGINT, SIGHUP, SIGQUIT); a probe browser left by a resolver killed with SIGKILL is reaped by the next probe.
+
 ## 0.80.0 - 2026-10-06
 
 ### Added

package/adapters/manifest.json

@@ -584,131 +584,115 @@
       "outputs": "numbered checkouts, saved preferences, and run summary"
     },
     {
-      "id": "terminal/launch",
-      "entry": "adapters/terminal/launch.mjs",
+      "id": "web-dapp/launch",
+      "entry": "adapters/web-dapp/launch.mjs",
       "kind": "node",
-      "purpose": "Start or reuse the Web Terminal slot browser (Chrome for Testing unless TERMINAL_CHROME_BIN; MetaMask extension with the fixture imported, or the injected strict wallet) and its wallet host. On macOS the browser starts through LaunchServices with no startup window; in testnet mode the venue SDK's mainnet hosts are unresolvable for the whole browser.",
+      "purpose": "Start or reuse the web-dapp slot browser (Chrome for Testing unless TERMINAL_CHROME_BIN; MetaMask extension with the fixture imported, or the injected strict wallet) and its wallet host. On macOS the browser starts through LaunchServices with no startup window; in testnet mode the hosts the venue policy blocks are unresolvable for the whole browser.",
       "inputs": "--target --cdp-port --app-port [--signer extension|injected] [--account] [--fresh-profile] [--headless|--headful] [--slow-mo] [--network mainnet --mainnet-confirmation REAL_FUNDS] [--json]; env TERMINAL_CHROME_BIN, TERMINAL_EXTENSION_DIR, TERMINAL_EXTENSION_CHECKOUT, RECIPE_WALLET_FIXTURE, TERMINAL_HEADLESS, TERMINAL_SLOW_MO, TERMINAL_WINDOW, TERMINAL_SCREEN",
-      "outputs": "<runtime>/terminal/browser.json + pid/log files; JSON on stdout; exit 0/1/2"
+      "outputs": "<runtime>/<adapter id>/browser.json + pid/log files; JSON on stdout; exit 0/1/2"
     },
     {
-      "id": "terminal/wallet-host",
-      "entry": "adapters/terminal/wallet-host.mjs",
+      "id": "web-dapp/wallet-host",
+      "entry": "adapters/web-dapp/wallet-host.mjs",
       "kind": "node",
-      "purpose": "Long-running CDP observer: opens the app tab blank, hooks it once per target, navigates it to the app and verifies the log binding before ready; logs every wallet request from the app top frame and every MetaMask confirmation shown; answers the injected strict wallet in injected mode (other frames and blank popups get 4100).",
+      "purpose": "Long-running CDP observer: opens the app tab blank, hooks it once per target, navigates it to the app and verifies the log binding before ready; logs every wallet request from the app top frame and every MetaMask confirmation shown; answers the injected strict wallet in injected mode (other frames and blank popups get 4100). The page script, the frame judgement and the strict wallet are @farmslot/adapter-web/dapp's; the venue policy (RECIPE_WEB_DAPP_POLICY) gives the testnet refusal, hosts, probe and start page.",
       "inputs": "--cdp-port --runtime-dir --signer --app-origin [--extension-id] [--target --account --start-chain] [--browser-app <.app>]",
-      "outputs": "<runtime>/terminal/wallet-requests.jsonl, wallet-host.ready"
+      "outputs": "<runtime>/<adapter id>/wallet-requests.jsonl, wallet-host.ready"
     },
     {
-      "id": "terminal/stop",
-      "entry": "adapters/terminal/stop.mjs",
+      "id": "web-dapp/stop",
+      "entry": "adapters/web-dapp/stop.mjs",
       "kind": "node",
-      "purpose": "Stop the terminal slot browser, wallet host and console collector and prove the CDP port is free.",
+      "purpose": "Stop the web-dapp slot browser, wallet host and console collector and prove the CDP port is free.",
       "inputs": "--target [--cdp-port]",
       "outputs": "JSON on stdout; exit 0/1"
     },
     {
-      "id": "terminal/inject",
-      "entry": "adapters/terminal/inject.mjs",
+      "id": "web-dapp/inject",
+      "entry": "adapters/web-dapp/inject.mjs",
       "kind": "node",
-      "purpose": "Terminal install: overlay marker, runtime dir and wallet fixture (0600); no product writes.",
+      "purpose": "web-dapp install: overlay marker, runtime dir and wallet fixture (0600); refuses a checkout the venue policy does not match; no product writes.",
       "inputs": "--target [--fixture] [--force]; env RECIPE_WALLET_FIXTURE",
-      "outputs": "<harness>/terminal/install.json, <runtime>/wallet-fixture.json; exit 0/1"
+      "outputs": "<harness>/<adapter id>/install.json, <runtime>/wallet-fixture.json; exit 0/1"
     },
     {
-      "id": "terminal/cleanup",
-      "entry": "adapters/terminal/cleanup.mjs",
+      "id": "web-dapp/cleanup",
+      "entry": "adapters/web-dapp/cleanup.mjs",
       "kind": "node",
-      "purpose": "Terminal cleanup: stop browser/host, remove terminal runtime state, overlay marker and installed fixture; profiles kept unless --reset-profile.",
+      "purpose": "web-dapp cleanup: stop browser/host, remove the slot's runtime state, overlay marker and installed fixture; profiles kept unless --reset-profile.",
       "inputs": "--target [--cdp-port] [--reset-profile]",
       "outputs": "JSON on stdout; exit 0/1"
     },
     {
-      "id": "terminal/verify",
-      "entry": "adapters/terminal/verify.mjs",
+      "id": "web-dapp/verify",
+      "entry": "adapters/web-dapp/verify.mjs",
       "kind": "node",
-      "purpose": "Read-only terminal slot readiness: checkout, deps, dev server, forced testnet, fixture, browser start probe, extension copy, CDP port.",
+      "purpose": "Read-only web-dapp slot readiness: checkout, deps, dev server, forced testnet, fixture, browser start probe, extension copy, CDP port.",
       "inputs": "--target [--cdp-port] [--watcher-port] [--signer] [--account] [--json]",
       "outputs": "readiness report; exit 0 ready / 1 not ready"
     },
     {
-      "id": "terminal/lib-cdp-client",
-      "entry": "adapters/terminal/lib/cdp-client.mjs",
+      "id": "web-dapp/lib-cdp-client",
+      "entry": "adapters/web-dapp/lib/cdp-client.mjs",
       "kind": "lib",
       "purpose": "Browser-level CDP client with flattened target sessions for the wallet host.",
       "inputs": "CdpClient.connect(url)",
       "outputs": "send/on"
     },
     {
-      "id": "terminal/lib-page-script",
-      "entry": "adapters/terminal/lib/page-script.mjs",
-      "kind": "lib",
-      "purpose": "Page script source: wallet request logging and the injected strict provider (EIP-6963 io.metamask).",
-      "inputs": "pageScriptSource({ signer, appOrigin })",
-      "outputs": "script source string"
-    },
-    {
-      "id": "terminal/lib-strict-wallet",
-      "entry": "adapters/terminal/lib/strict-wallet.mjs",
-      "kind": "lib",
-      "purpose": "EIP-1193 strict test wallet enforcing typed-data chainId == active chain.",
-      "inputs": "createStrictWallet({ account, chainId })",
-      "outputs": "request()"
-    },
-    {
-      "id": "terminal/lib-processes",
-      "entry": "adapters/terminal/lib/processes.mjs",
+      "id": "web-dapp/lib-processes",
+      "entry": "adapters/web-dapp/lib/processes.mjs",
       "kind": "lib",
       "purpose": "Pid-file process stop with owner-marker checks (--mm-harness-owner=<kind>-<id>, exact token; live foreign pids kept and reported, dead ones dropped), process-group termination, CDP port release check.",
-      "inputs": "stopTerminalBrowser(target, { cdpPort }), stopConsoleCollector(target), ownerMarker(kind, runtimeDir), ownsProcess(kind, pid, runtimeDir)",
+      "inputs": "stopWebDappBrowser(target, { cdpPort }), stopConsoleCollector(target), ownerMarker(kind, runtimeDir), ownsProcess(kind, pid, runtimeDir)",
       "outputs": "stopped processes"
     },
     {
-      "id": "terminal/lib-readiness",
-      "entry": "adapters/terminal/lib/readiness.mjs",
+      "id": "web-dapp/lib-readiness",
+      "entry": "adapters/web-dapp/lib/readiness.mjs",
       "kind": "lib",
-      "purpose": "Terminal slot readiness checks shared by verify, doctor and the surface.",
-      "inputs": "terminalReadiness({ target, appPort, cdpPort, signer }), assertLaunchNetwork(target, { network, mainnetConfirmation }), devServerTestnetDiagnostic(target, { appPort }) (advisory)",
+      "purpose": "web-dapp slot readiness checks shared by verify, doctor and the surface.",
+      "inputs": "webDappReadiness({ policy, target, appPort, cdpPort, signer }), assertLaunchNetwork(target, { network, mainnetConfirmation }), devServerTestnetDiagnostic(target, { appPort, variable }) (advisory)",
       "outputs": "checks[]"
     },
     {
-      "id": "terminal/lib-display",
-      "entry": "adapters/terminal/lib/display.mjs",
+      "id": "web-dapp/lib-display",
+      "entry": "adapters/web-dapp/lib/display.mjs",
       "kind": "lib",
       "purpose": "Headless/headful and slow-mo resolution, per-slot window placement and the profile zoom that keeps the desktop layout.",
       "inputs": "resolveHeadless, resolveSlowMo, windowPlacement, writeProfileZoom",
       "outputs": "browser display args"
     },
     {
-      "id": "terminal/lib-hud",
-      "entry": "adapters/terminal/lib/hud.mjs",
+      "id": "web-dapp/lib-hud",
+      "entry": "adapters/web-dapp/lib/hud.mjs",
       "kind": "lib",
       "purpose": "Recipe HUD state (<runtime>/hud.json) and the page expression that draws it on the app origin only.",
       "inputs": "nextHudState, hudRenderExpression",
       "outputs": "HUD state, expression source"
     },
     {
-      "id": "terminal/lib-origin",
-      "entry": "adapters/terminal/lib/origin.mjs",
+      "id": "web-dapp/lib-blocked-hosts",
+      "entry": "adapters/web-dapp/lib/blocked-hosts.mjs",
       "kind": "lib",
-      "purpose": "Exact app-origin and app top-frame checks for targets, wallet requests and log entries.",
-      "inputs": "isAppUrl(url, appOrigin), isAppTopFrameContext(context, { targetId, appOrigin })",
-      "outputs": "boolean"
+      "purpose": "Testnet enforcement mechanics: the host-resolver rule that makes the policy's blocked hosts unresolvable, and the canonical host check the wallet host's request block uses.",
+      "inputs": "hostResolverRules(hosts), hostOf(url), isBlockedUrl(url, hosts)",
+      "outputs": "launch switch, booleans"
     },
     {
-      "id": "terminal/lib-mainnet-guard",
-      "entry": "adapters/terminal/lib/mainnet-guard.mjs",
+      "id": "web-dapp/lib-policy",
+      "entry": "adapters/web-dapp/lib/policy.mjs",
       "kind": "lib",
-      "purpose": "Testnet enforcement: the venue endpoint hosts (from the venue SDK, @metamask/perps-controller and the app source in the checkout), the browser's host-resolver block, and the mainnet typed-data classifier used by the page script and the wallet host.",
-      "inputs": "venueHosts(checkout), hostResolverRules(hosts), isMainnetVenueUrl(url, hosts), mainnetTypedDataReason(data)",
-      "outputs": "host list, launch switch, refusal reason"
+      "purpose": "The venue policy of the adapter that extends web-dapp (e.g. the Terminal plugin's), loaded from the module RECIPE_WEB_DAPP_POLICY names; the host sets it when it binds that adapter.",
+      "inputs": "env RECIPE_WEB_DAPP_POLICY",
+      "outputs": "webDappPolicy(), webDappAdapterId()"
     },
     {
-      "id": "terminal/surface",
-      "entry": "src/adapters/terminal/surface.ts",
+      "id": "web-dapp/surface",
+      "entry": "src/adapters/web-dapp/surface.ts",
       "kind": "module",
-      "purpose": "Terminal adapter surface (runtime status, browser stop, logs, hints).",
-      "inputs": "terminalSurface",
+      "purpose": "The web-dapp adapter surface (runtime status, browser stop, logs, hints) and bindWebDappPolicy, which binds the venue policy of the adapter that extends it.",
+      "inputs": "webDappSurface",
       "outputs": "AdapterSurface"
     }
   ]

package/adapters/{terminal → web-dapp}/cleanup.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-// cleanup.mjs — `mm-harness cleanup --adapter terminal`: stop the slot browser
-// and wallet host, then remove the terminal runtime state and the installed
+// cleanup.mjs — `mm-harness cleanup --adapter <web-dapp adapter>`: stop the slot
+// browser and wallet host, then remove the slot's runtime state and the installed
 // wallet fixture. Browser profiles are kept unless --reset-profile.
 //
 // Inputs: --target <checkout> [--cdp-port <port>] [--reset-profile]
@@ -13,16 +13,16 @@ import { fileURLToPath } from 'node:url';
 
 import { recipeHarnessPath } from '@farmslot/recipe-cli/harness';
 import { walletFixturePath } from '../../library/actions/harness-exports.mjs';
-import { terminalRuntimeDir } from '../../library/actions/terminal/platform/runtime.mjs';
-import { stopConsoleCollector, stopTerminalBrowser } from './lib/processes.mjs';
+import { webDappPolicy, webDappRuntimeDir } from '../../library/actions/web-dapp/platform/runtime.mjs';
+import { stopConsoleCollector, stopWebDappBrowser } from './lib/processes.mjs';
 
 const usage = 'Usage: cleanup.mjs --target <checkout> [--cdp-port <port>] [--reset-profile]';
 
-export async function cleanupTerminalRuntime({ target, cdpPort, resetProfile = false }) {
+export async function cleanupWebDappRuntime({ target, cdpPort, resetProfile = false }) {
   const root = path.resolve(target);
-  const stop = await stopTerminalBrowser(root, { cdpPort });
+  const stop = await stopWebDappBrowser(root, { cdpPort });
   await stopConsoleCollector(root);
-  const runtime = terminalRuntimeDir(root);
+  const runtime = webDappRuntimeDir(root);
   const removed = [];
   if (existsSync(runtime)) {
     for (const entry of readdirSync(runtime)) {
@@ -31,7 +31,7 @@ export async function cleanupTerminalRuntime({ target, cdpPort, resetProfile = f
       removed.push(entry);
     }
   }
-  const overlay = recipeHarnessPath(root, 'terminal');
+  const overlay = recipeHarnessPath(root, webDappPolicy().adapterId);
   if (existsSync(overlay)) {
     rmSync(overlay, { recursive: true, force: true });
     removed.push(path.relative(root, overlay));
@@ -56,7 +56,7 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
   };
   const rawPort = value('--cdp-port') ?? process.env.RECIPE_CDP_PORT ?? process.env.CDP_PORT;
   try {
-    const result = await cleanupTerminalRuntime({
+    const result = await cleanupWebDappRuntime({
       target: value('--target') ?? process.cwd(),
       cdpPort: rawPort ? Number(rawPort) : undefined,
       resetProfile: argv.includes('--reset-profile'),

package/adapters/{terminal → web-dapp}/inject.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-// inject.mjs — `mm-harness install --adapter terminal`: prepare the slot runtime
-// directory and install the wallet fixture the terminal actions read.
+// inject.mjs — `mm-harness install --adapter <web-dapp adapter>`: prepare the slot
+// runtime directory and install the wallet fixture the web-dapp actions read.
 //
-// Inputs: --target <terminal checkout> [--fixture <wallet-fixture.json>] [--force]
+// Inputs: --target <checkout> [--fixture <wallet-fixture.json>] [--force]
 //   env RECIPE_WALLET_FIXTURE (fixture source when --fixture is absent)
-// Outputs: <target>/<harness root>/terminal/install.json (overlay marker),
-//   <target>/<runtime>/terminal/ (0700), <runtime>/wallet-fixture.json (0600);
+// Outputs: <target>/<harness root>/<adapter id>/install.json (overlay marker),
+//   <target>/<runtime>/<adapter id>/ (0700), <runtime>/wallet-fixture.json (0600);
 //   JSON summary on stdout (account names only). Exit 0 installed; 1 failure; 2 usage.
 // Never touches: product source files; never prints key material.
 
@@ -15,16 +15,16 @@ import { fileURLToPath } from 'node:url';
 
 import { recipeHarnessPath, recipeRuntimeDir } from '@farmslot/recipe-cli/harness';
 import { walletFixturePath } from '../../library/actions/harness-exports.mjs';
-import { terminalRuntimeDir } from '../../library/actions/terminal/platform/runtime.mjs';
-import { isTerminalCheckout } from './lib/readiness.mjs';
+import { webDappPolicy, webDappRuntimeDir } from '../../library/actions/web-dapp/platform/runtime.mjs';
 
-const usage = 'Usage: inject.mjs --target <terminal checkout> [--fixture <wallet-fixture.json>] [--force]';
+const usage = 'Usage: inject.mjs --target <checkout> [--fixture <wallet-fixture.json>] [--force]';
 
-export function installTerminalRuntime({ target, fixture, force = false }) {
+export function installWebDappRuntime({ target, fixture, force = false }) {
   const root = path.resolve(target);
-  if (!isTerminalCheckout(root)) throw new Error(`${root} is not a Web Terminal checkout (needs next + src/features/perpetuals).`);
+  const { adapterId, checkout } = webDappPolicy();
+  if (!checkout.matches(root)) throw new Error(`${root} is not a ${checkout.name} checkout (needs ${checkout.needs}).`);
   mkdirSync(path.join(root, recipeRuntimeDir()), { recursive: true, mode: 0o700 });
-  mkdirSync(terminalRuntimeDir(root), { recursive: true, mode: 0o700 });
+  mkdirSync(webDappRuntimeDir(root), { recursive: true, mode: 0o700 });
   const destination = walletFixturePath(root);
   let fixtureAction = 'kept';
   if (fixture && (force || !existsSync(destination))) {
@@ -39,9 +39,9 @@ export function installTerminalRuntime({ target, fixture, force = false }) {
   const accounts = existsSync(destination)
     ? JSON.parse(readFileSync(destination, 'utf8')).accounts.map((account) => account?.name).filter(Boolean)
     : [];
-  const marker = { schemaVersion: 1, adapter: 'terminal', installedAt: new Date().toISOString(), fixture: fixtureAction };
+  const marker = { schemaVersion: 1, adapter: adapterId, installedAt: new Date().toISOString(), fixture: fixtureAction };
   // The overlay directory is the install marker run/call auto-ensure checks.
-  const overlay = recipeHarnessPath(root, 'terminal');
+  const overlay = recipeHarnessPath(root, adapterId);
   mkdirSync(overlay, { recursive: true, mode: 0o700 });
   writeFileSync(path.join(overlay, 'install.json'), `${JSON.stringify(marker, null, 2)}\n`, { mode: 0o600 });
   return { status: fixtureAction === 'missing' ? 'fail' : 'pass', target: root, fixture: fixtureAction, fixturePath: destination, accounts };
@@ -58,7 +58,7 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
     return index >= 0 ? argv[index + 1] : undefined;
   };
   try {
-    const result = installTerminalRuntime({
+    const result = installWebDappRuntime({
       target: value('--target') ?? process.cwd(),
       fixture: value('--fixture') ?? process.env.RECIPE_WALLET_FIXTURE,
       force: argv.includes('--force'),

package/adapters/{terminal → web-dapp}/launch.mjs

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
-// launch.mjs — start (or reuse) the terminal slot browser and its wallet host.
+// launch.mjs — start (or reuse) the web-dapp slot browser and its wallet host.
 //
 // Purpose:
 //   One Chromium-family browser per slot, bound to 127.0.0.1:<cdp-port>, with a
-//   profile under <runtime>/terminal/. signer=extension loads the slot's copy of
+//   profile under <runtime>/<adapter id>/. signer=extension loads the slot's copy of
 //   the MetaMask extension and imports the fixture account through the Extension
 //   adapter's fixture flow (wallet-fixture-state.cjs generate → prefill-profile →
 //   seed-cdp). signer=injected loads no extension; the wallet host provides the
 //   strict test wallet. Either way wallet-host.mjs then records wallet requests.
 //
-// Inputs (flags): --target <terminal checkout> --cdp-port <port> --app-port <port>
+// Inputs (flags): --target <checkout> --cdp-port <port> --app-port <port>
 //   [--signer extension|injected] [--account <fixture name>] [--fresh-profile]
 //   [--headless | --headful] [--slow-mo <ms>] [--start-chain <id>] [--json]
-//   [--network mainnet --mainnet-confirmation REAL_FUNDS] (required unless the slot
-//   dev server is known to force Hyperliquid testnet)
+//   [--network mainnet --mainnet-confirmation REAL_FUNDS] (testnet otherwise,
+//   enforced in the browser from the venue policy)
 //   env: TERMINAL_CHROME_BIN, TERMINAL_EXTENSION_DIR,
 //   TERMINAL_EXTENSION_CHECKOUT, TERMINAL_EXTENSION_NODE, RECIPE_WALLET_FIXTURE,
 //   TERMINAL_HEADLESS, TERMINAL_SLOW_MO, TERMINAL_WINDOW, TERMINAL_SCREEN
 //   The browser is headful by default, in a window placed per slot (see
 //   lib/display.mjs); --headless or TERMINAL_HEADLESS=1 hides it.
-// Outputs: <runtime>/terminal/browser.json (+ pid files, logs); JSON summary on stdout.
+// Outputs: <runtime>/<adapter id>/browser.json (+ pid files, logs); JSON summary on stdout.
 //   Exit 0 ready; 1 launch/seed failure; 2 usage.
 // Never prints: mnemonics, private keys, the wallet password.
 
@@ -35,14 +35,15 @@ import {
   fixtureEntry,
   loadWalletFixture,
   resolveSigner,
-  terminalRuntimeDir,
   viemAccountFromEntry,
-} from '../../library/actions/terminal/platform/runtime.mjs';
+  webDappPolicy,
+  webDappRuntimeDir,
+} from '../../library/actions/web-dapp/platform/runtime.mjs';
 import { CdpClient, browserWebSocketUrl } from './lib/cdp-client.mjs';
 import { clearHudState } from './lib/hud.mjs';
 import { browserDisplayArgs, resolveHeadless, resolveSlowMo, windowPlacement, writeProfileZoom } from './lib/display.mjs';
-import { cdpListenerPids, ownedBrowserPids, ownerMarker, ownsProcess, pidAlive, stopTerminalBrowser, terminate } from './lib/processes.mjs';
-import { hostResolverRules, venueHosts } from './lib/mainnet-guard.mjs';
+import { cdpListenerPids, ownedBrowserPids, ownerMarker, ownsProcess, pidAlive, stopWebDappBrowser, terminate } from './lib/processes.mjs';
+import { hostResolverRules } from './lib/blocked-hosts.mjs';
 import { assertLaunchNetwork, devServerTestnetDiagnostic } from './lib/readiness.mjs';
 
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
@@ -76,7 +77,7 @@ export function parseLaunchArgs(argv) {
 }
 
 function log(message) {
-  process.stderr.write(`[terminal/launch] ${message}\n`);
+  process.stderr.write(`[${webDappPolicy().adapterId}/launch] ${message}\n`);
 }
 
 function browserStarts(bin) {
@@ -113,7 +114,7 @@ export async function resolveBrowser(env = process.env, candidates = chromeForTe
     if (!existsSync(explicit)) throw new Error(`TERMINAL_CHROME_BIN does not exist: ${explicit}`);
     return { bin: explicit, version: browserStarts(explicit), source: 'TERMINAL_CHROME_BIN' };
   }
-  if (env.RECIPE_HARNESS_CHROME_BIN) log(`ignoring RECIPE_HARNESS_CHROME_BIN (${env.RECIPE_HARNESS_CHROME_BIN}) for the terminal; set TERMINAL_CHROME_BIN to override Chrome for Testing`);
+  if (env.RECIPE_HARNESS_CHROME_BIN) log(`ignoring RECIPE_HARNESS_CHROME_BIN (${env.RECIPE_HARNESS_CHROME_BIN}) for the ${webDappPolicy().adapterId}; set TERMINAL_CHROME_BIN to override Chrome for Testing`);
   const bin = candidates.find((candidate) => existsSync(candidate));
   if (bin) return { bin, version: browserStarts(bin), source: 'chrome-for-testing' };
   throw new Error(
@@ -344,7 +345,9 @@ function writePrivateFile(file, text) {
 // which waits for a cold dev-server compile.
 export const LAUNCH_TIMEOUTS = Object.freeze({ browserStartMs: 90000, hostReadyMs: 180000 });
 
-export async function launchTerminalBrowser(args, env = process.env, { timeouts = LAUNCH_TIMEOUTS } = {}) {
+// The venue policy comes from RECIPE_WEB_DAPP_POLICY (webDappPolicy), as for every web-dapp leaf.
+export async function launchWebDappBrowser(args, env = process.env, { timeouts = LAUNCH_TIMEOUTS } = {}) {
+  const policy = webDappPolicy(env);
   const target = path.resolve(args.target);
   const cdpPort = Number(args['cdp-port']);
   const appPort = Number(args['app-port']);
@@ -353,16 +356,16 @@ export async function launchTerminalBrowser(args, env = process.env, { timeouts
   // browser: the SDK's mainnet venue hosts are unresolvable for the whole
   // browser, and the wallet host blocks, logs and refuses anything mainnet.
   const network = assertLaunchNetwork(target, { network: args.network, mainnetConfirmation: args['mainnet-confirmation'] });
-  const venues = network === 'testnet' ? venueHosts(target) : { mainnet: [], testnet: [] };
-  const mainnetHosts = venues.mainnet;
+  const venues = network === 'testnet' ? policy.venueHosts(target) : { blocked: [], served: [] };
+  const mainnetHosts = venues.blocked;
   // What the running browser enforces; a browser enforcing anything else is
   // never reused (its resolver rules are fixed at start).
-  const enforcementFingerprint = createHash('sha256').update(JSON.stringify({ network, mainnetHosts, testnetHosts: venues.testnet })).digest('hex').slice(0, 16);
-  const devServer = network === 'testnet' ? devServerTestnetDiagnostic(target, { appPort }) : null;
+  const enforcementFingerprint = createHash('sha256').update(JSON.stringify({ network, mainnetHosts, testnetHosts: venues.served })).digest('hex').slice(0, 16);
+  const devServer = network === 'testnet' ? devServerTestnetDiagnostic(target, { appPort, variable: policy.testnetVariable }) : null;
   if (devServer && !(devServer.known && devServer.forced)) {
     log(`WARN dev server testnet check: ${devServer.detail} (advisory; the browser enforces testnet itself)`);
   }
-  const runtime = terminalRuntimeDir(target);
+  const runtime = webDappRuntimeDir(target);
   mkdirSync(runtime, { recursive: true, mode: 0o700 });
   chmodSync(runtime, 0o700);
   const stateFile = path.join(runtime, 'browser.json');
@@ -392,7 +395,7 @@ export async function launchTerminalBrowser(args, env = process.env, { timeouts
     if (previous.slowMoMs !== slowMoMs) writePrivateFile(stateFile, `${JSON.stringify(state, null, 2)}\n`);
     return { ...state, reused: true };
   }
-  await stopTerminalBrowser(target, { cdpPort, log });
+  await stopWebDappBrowser(target, { cdpPort, log });
 
   const browser = await resolveBrowser(env);
   const profile = path.join(runtime, `profile-${signer}-${args.account.replace(/[^A-Za-z0-9_-]/gu, '_')}`);
@@ -541,11 +544,11 @@ export async function launchTerminalBrowser(args, env = process.env, { timeouts
       '--app-origin', appOrigin,
       '--target', target,
       '--account', args.account,
-      '--start-chain', String(args['start-chain'] ?? 42161),
+      '--start-chain', String(args['start-chain'] ?? policy.startChain),
       '--network', network,
       ownerMarker('wallet-host', runtime),
     ];
-    if (network === 'testnet') hostArgs.push('--mainnet-hosts', mainnetHosts.join(','), '--testnet-hosts', venues.testnet.join(','));
+    if (network === 'testnet') hostArgs.push('--mainnet-hosts', mainnetHosts.join(','), '--testnet-hosts', venues.served.join(','));
     if (extension?.id) hostArgs.push('--extension-id', extension.id);
     if (guardFocus) hostArgs.push('--observe-focus', '1');
     if (launchMethod === LAUNCH_SERVICES) hostArgs.push('--window', [windowBounds.x, windowBounds.y, windowBounds.width, windowBounds.height].join(','));
@@ -568,7 +571,7 @@ export async function launchTerminalBrowser(args, env = process.env, { timeouts
       signer,
       network,
       networkEnforcement: network === 'testnet'
-        ? { mode: 'enforced', mainnetHosts, testnetHosts: venues.testnet, fingerprint: enforcementFingerprint, layers: ['host-resolver-rules', 'cdp-fetch-block', 'wallet-refusal', 'served-network-check'] }
+        ? { mode: 'enforced', mainnetHosts, testnetHosts: venues.served, fingerprint: enforcementFingerprint, layers: ['host-resolver-rules', 'cdp-fetch-block', 'wallet-refusal', 'served-network-check'] }
         : { mode: 'disabled', reason: 'network=mainnet with mainnet_confirmation=REAL_FUNDS', fingerprint: enforcementFingerprint },
       devServerDiagnostic: devServer,
       consoleOffsets,
@@ -595,7 +598,7 @@ export async function launchTerminalBrowser(args, env = process.env, { timeouts
   } catch (error) {
     if (started) {
       log(`launch failed, stopping what it started: ${String(error?.message ?? error).split('\n')[0]}`);
-      await stopTerminalBrowser(target, { cdpPort, log }).catch((stopError) => log(`rollback incomplete: ${stopError.message}`));
+      await stopWebDappBrowser(target, { cdpPort, log }).catch((stopError) => log(`rollback incomplete: ${stopError.message}`));
       for (const pid of ownedBrowserPids(runtime)) await terminate(pid, 3000);
     }
     throw error;
@@ -618,7 +621,7 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
     process.exit(0);
   }
   try {
-    const state = await launchTerminalBrowser(args);
+    const state = await launchWebDappBrowser(args);
     process.stdout.write(`${JSON.stringify({ status: 'pass', ...state }, null, args.json ? 0 : 2)}\n`);
   } catch (error) {
     const message = String(error?.stderr ?? '').trim() || error.message;

package/adapters/web-dapp/lib/blocked-hosts.mjs

@@ -0,0 +1,24 @@
+// Testnet enforcement mechanics for the web-dapp slot browser: the hosts a
+// venue policy blocks become unresolvable for the whole browser (pages,
+// workers, WebSockets), and the wallet host fails and logs each request it
+// sees to one of them. Which hosts is the venue policy's (venueHosts).
+
+// A URL's host as the network sees it: lowercase, no trailing dot. null when
+// it does not parse.
+export function hostOf(url) {
+  try {
+    return new URL(String(url)).hostname.toLowerCase().replace(/\.$/u, '');
+  } catch {
+    return null;
+  }
+}
+
+export function isBlockedUrl(url, hosts) {
+  const host = hostOf(url);
+  return host !== null && hosts.includes(host);
+}
+
+export function hostResolverRules(hosts) {
+  // The host and its fully qualified form (trailing dot) alike.
+  return `--host-resolver-rules=${hosts.flatMap((host) => [`MAP ${host} ~NOTFOUND`, `MAP ${host}. ~NOTFOUND`]).join(', ')}`;
+}

package/adapters/{terminal → web-dapp}/lib/cdp-client.mjs

@@ -1,5 +1,5 @@
 // Minimal browser-level Chrome DevTools Protocol client with flattened target
-// sessions, for the long-running terminal wallet host. Page-level UI actions use
+// sessions, for the long-running web-dapp wallet host. Page-level UI actions use
 // @farmslot/recipe-runner/runtime/cdp instead.
 
 import WebSocket from 'ws';

package/adapters/{terminal → web-dapp}/lib/display.mjs

@@ -1,5 +1,5 @@
 // How the slot browser is shown: headful (default) or headless, where its
-// window sits on screen, the page zoom that keeps the terminal's desktop layout
+// window sits on screen, the page zoom that keeps the app's desktop layout
 // inside that window, and the optional slow-mo between UI actions.
 
 import { execFileSync } from 'node:child_process';

package/adapters/{terminal → web-dapp}/lib/hud.mjs

@@ -1,4 +1,4 @@
-// Recipe HUD for the terminal app tab: state handling and the page expression
+// Recipe HUD for the web-dapp app tab: state handling and the page expression
 // that draws it.
 //
 // The overlay is an <mm-harness-hud> element under <html> (outside <body>) with