@deeeed/metamask-harness 0.81.0 → 0.82.1

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## Unreleased
 
+## 0.82.1 - 2026-10-07
+
+### Fixed
+
+- Extension `check diff [--fix]` no longer fails when every changed file is one the repo's oxfmt config ignores (for example `package.json`, `yarn.lock` and regenerated LavaMoat policy JSON): oxfmt runs with `--no-error-on-unmatched-pattern`, so it checks nothing instead of exiting 2 with "Expected at least one target file". A real formatting problem in a file oxfmt does check still fails the gate.
+
+## 0.82.0 - 2026-10-07
+
+### Added
+
+- Adapters a recipe library declares in `recipe-library.json` `adapters` (on `--library`, the `RECIPE_LIBRARY_PATH` you set or else the personal library, or `config set libraries.<name>`; never a task-local library, a sibling checkout or `<target>/.skills-cache`, which serve recipe discovery only) work as `--adapter <id>`: the command loads the plugin only when it selects it (the last `--adapter`, else the last `--platform`), composes it on the adapter it `extends` (a built-in or another plugin; a plugin that extends a built-in also offers the built-in's official actions, library actions and observers), runs its doctor checks after the shared ones (a check that throws is a required failure, `adapter-plugin:<id>:doctor`) and runs its in-code actions. `call <action> --adapter <id> --help` shows a plugin action's fields. `doctor --json` names each loaded plugin with its library and digest (`adapter-plugin:<id>`), and an approved plan (`--approve-plan`) binds that digest: every run on a plugin adapter carries it in `METAMASK_RECIPE_ADAPTER_PLUGIN`, so editing the plugin's module or a file beside it fails the old approval with `RECIPE_APPROVAL_MISMATCH`, whatever actions the recipe runs. A plugin's own manifest may declare official actions and observers for that plugin, but a plugin that extends it inherits only its custom actions: inherited official actions and observers come from the bundled library alone, and a parent manifest outside it that declares one fails with `ACTION_MANIFEST_INVALID` (a JSON envelope under `--json`), like any other action manifest the plugin can't use. A malformed `RECIPE_LIBRARY_PATH` never blocks a built-in adapter. A plugin may import from disk only its module's directory and the library's `actions/` (`RECIPE_SOURCE_INVALID` otherwise); a bare package it imports resolves from mm-harness's own install. Plugins need Node.js 22.15 or later. A refused plugin fails with `ADAPTER_SDK_UNSUPPORTED`, `ADAPTER_PLUGIN_INVALID`, `ADAPTER_PLUGIN_LOAD_FAILED`, `ADAPTER_ID_CONFLICT`, `ADAPTER_EXTENDS_UNKNOWN` or `RECIPE_SOURCE_INVALID`, exit 2. A plugin that extends nothing (or only other plugins) gets no Runway provisioning and no wallet fixture operations; one that extends a built-in keeps the built-in's (the terminal plugin keeps web-dapp's `fixtures init|sync|set`).
+
+### Changed
+
+- **BREAKING:** the built-in `terminal` adapter becomes the generic `web-dapp` built-in, and the Web Terminal becomes the `terminal` plugin of the `experimental-metamask-recipe-terminal` library (`recipe-library.json` `adapters.terminal`, `extends: web-dapp`). `--adapter terminal` needs a revision of that library that declares `adapters.terminal` (8b409b6 or later, on its `feat/console-allowlist` branch; the library's `main` does not declare it yet) on `RECIPE_LIBRARY_PATH`, as on the Terminal farm slots. A host without it (an older checkout, or none, as on macpro and mini today) refuses every `--adapter terminal` command: `--adapter must be mobile, extension, core, or web-dapp; received 'terminal'`. Update the library before this harness; the hooks, runtime dir (`temp/recipe/runtime/terminal`), doctor check ids, evidence names and action ids are unchanged.
+  - The plugin holds everything Hyperliquid: the venue policy (blocked and served hosts, link hosts, the launch probe, the testnet typed-data refusal, the start page and product routes, the injected wallet's start chain, the checkout dependencies and detection, the dev-server testnet variable), the signature-log rules, and the 7 `metamask.perps.*` venue actions with their manifest. They leave this package: `adapters/terminal/lib/mainnet-guard.mjs`, `adapters/terminal/policy.mjs`, `library/actions/terminal/perps/`.
+  - `web-dapp` keeps the generic parts (`adapters/web-dapp/`, `library/actions/web-dapp/`, `library/manifests/web-dapp.action-manifest.json`): launch, stop, verify, inject, cleanup, the wallet host, console capture, `ui.*`, `app.hud`, `metamask.app.*` and `metamask.wallet.*`. It reads the venue policy from the module in `RECIPE_WEB_DAPP_POLICY`, which the harness sets when it adopts an adapter that extends `web-dapp`; the leaf scripts no longer take `--policy-module`.
+  - `web-dapp` selected on its own has no venue: launch, verify and runtime status refuse, and doctor fails its required `web-dapp-venue-policy` check. The policy module is checked when it loads (every member web-dapp reads, and `policyVersion: 1`).
+  - Without `--adapter`, a Terminal checkout is no longer auto-detected, and `actions --matrix` has no `terminal` column: the loader imports a plugin only when a command selects it (the ADR trust boundary), so the plugin's detection runs once `--adapter terminal` selects it. Every farm hook passes `--adapter terminal`.
+  - `check diff` takes any registered or library-declared adapter for `--adapter`/`--platform` (it listed the built-ins).
+- Depend on `@farmslot/recipe-cli` 0.6.0 and `@farmslot/adapter-sdk` 0.5.0 (were 0.5.0 and 0.4.0), which carry recipe-library adapter plugins, adapter-aware trusted-mutation hooks and one environment scope for a run's ports (recipe-cli 0.6.0 also writes the task's acceptance ledger from a recipe's proof targets and warns at `run --plan` on command nodes whose exit code cannot prove the claim), and on `@farmslot/recipe-runner` 0.25.0 and `@farmslot/adapter-rn` 0.17.1 (were 0.24.0 and 0.17.0). `@farmslot/adapter-web` 0.3.1, `@farmslot/agent-runtime` 0.17.0 and `@farmslot/protocol` 0.34.0 are unchanged, and the install still holds one `@farmslot/recipe-runner`.
+- The Extension proof-runtime check no longer pins `--cdp-port`/`--watcher-port` itself: `run` and `call` run it, the observers and the execution in one environment scope, so every platform's runtime check and observers see the run's ports, its dev-server port names (`METRO_PORT`) and its platform environment. The performance observers read their ports from that environment (`PerformanceObserver.backend(target, env)`), and `self-test` opens the scope around its smoke runs.
+
 ## 0.81.0 - 2026-10-07
 
 ### Added

package/adapters/manifest.json

@@ -584,115 +584,115 @@
       "outputs": "numbered checkouts, saved preferences, and run summary"
     },
     {
-      "id": "terminal/launch",
-      "entry": "adapters/terminal/launch.mjs",
+      "id": "web-dapp/launch",
+      "entry": "adapters/web-dapp/launch.mjs",
       "kind": "node",
-      "purpose": "Start or reuse the Web Terminal slot browser (Chrome for Testing unless TERMINAL_CHROME_BIN; MetaMask extension with the fixture imported, or the injected strict wallet) and its wallet host. On macOS the browser starts through LaunchServices with no startup window; in testnet mode the venue SDK's mainnet hosts are unresolvable for the whole browser.",
-      "inputs": "--target --cdp-port --app-port --policy-module [--signer extension|injected] [--account] [--fresh-profile] [--headless|--headful] [--slow-mo] [--network mainnet --mainnet-confirmation REAL_FUNDS] [--json]; env TERMINAL_CHROME_BIN, TERMINAL_EXTENSION_DIR, TERMINAL_EXTENSION_CHECKOUT, RECIPE_WALLET_FIXTURE, TERMINAL_HEADLESS, TERMINAL_SLOW_MO, TERMINAL_WINDOW, TERMINAL_SCREEN",
-      "outputs": "<runtime>/terminal/browser.json + pid/log files; JSON on stdout; exit 0/1/2"
+      "purpose": "Start or reuse the web-dapp slot browser (Chrome for Testing unless TERMINAL_CHROME_BIN; MetaMask extension with the fixture imported, or the injected strict wallet) and its wallet host. On macOS the browser starts through LaunchServices with no startup window; in testnet mode the hosts the venue policy blocks are unresolvable for the whole browser.",
+      "inputs": "--target --cdp-port --app-port [--signer extension|injected] [--account] [--fresh-profile] [--headless|--headful] [--slow-mo] [--network mainnet --mainnet-confirmation REAL_FUNDS] [--json]; env TERMINAL_CHROME_BIN, TERMINAL_EXTENSION_DIR, TERMINAL_EXTENSION_CHECKOUT, RECIPE_WALLET_FIXTURE, TERMINAL_HEADLESS, TERMINAL_SLOW_MO, TERMINAL_WINDOW, TERMINAL_SCREEN",
+      "outputs": "<runtime>/<adapter id>/browser.json + pid/log files; JSON on stdout; exit 0/1/2"
     },
     {
-      "id": "terminal/wallet-host",
-      "entry": "adapters/terminal/wallet-host.mjs",
+      "id": "web-dapp/wallet-host",
+      "entry": "adapters/web-dapp/wallet-host.mjs",
       "kind": "node",
-      "purpose": "Long-running CDP observer: opens the app tab blank, hooks it once per target, navigates it to the app and verifies the log binding before ready; logs every wallet request from the app top frame and every MetaMask confirmation shown; answers the injected strict wallet in injected mode (other frames and blank popups get 4100). The page script, the frame judgement and the strict wallet are @farmslot/adapter-web/dapp's; the host passes the testnet policy and the injected wallet's identity.",
-      "inputs": "--cdp-port --runtime-dir --signer --app-origin --policy-module [--extension-id] [--target --account --start-chain] [--browser-app <.app>]",
-      "outputs": "<runtime>/terminal/wallet-requests.jsonl, wallet-host.ready"
+      "purpose": "Long-running CDP observer: opens the app tab blank, hooks it once per target, navigates it to the app and verifies the log binding before ready; logs every wallet request from the app top frame and every MetaMask confirmation shown; answers the injected strict wallet in injected mode (other frames and blank popups get 4100). The page script, the frame judgement and the strict wallet are @farmslot/adapter-web/dapp's; the venue policy (RECIPE_WEB_DAPP_POLICY) gives the testnet refusal, hosts, probe and start page.",
+      "inputs": "--cdp-port --runtime-dir --signer --app-origin [--extension-id] [--target --account --start-chain] [--browser-app <.app>]",
+      "outputs": "<runtime>/<adapter id>/wallet-requests.jsonl, wallet-host.ready"
     },
     {
-      "id": "terminal/stop",
-      "entry": "adapters/terminal/stop.mjs",
+      "id": "web-dapp/stop",
+      "entry": "adapters/web-dapp/stop.mjs",
       "kind": "node",
-      "purpose": "Stop the terminal slot browser, wallet host and console collector and prove the CDP port is free.",
+      "purpose": "Stop the web-dapp slot browser, wallet host and console collector and prove the CDP port is free.",
       "inputs": "--target [--cdp-port]",
       "outputs": "JSON on stdout; exit 0/1"
     },
     {
-      "id": "terminal/inject",
-      "entry": "adapters/terminal/inject.mjs",
+      "id": "web-dapp/inject",
+      "entry": "adapters/web-dapp/inject.mjs",
       "kind": "node",
-      "purpose": "Terminal install: overlay marker, runtime dir and wallet fixture (0600); no product writes.",
+      "purpose": "web-dapp install: overlay marker, runtime dir and wallet fixture (0600); refuses a checkout the venue policy does not match; no product writes.",
       "inputs": "--target [--fixture] [--force]; env RECIPE_WALLET_FIXTURE",
-      "outputs": "<harness>/terminal/install.json, <runtime>/wallet-fixture.json; exit 0/1"
+      "outputs": "<harness>/<adapter id>/install.json, <runtime>/wallet-fixture.json; exit 0/1"
     },
     {
-      "id": "terminal/cleanup",
-      "entry": "adapters/terminal/cleanup.mjs",
+      "id": "web-dapp/cleanup",
+      "entry": "adapters/web-dapp/cleanup.mjs",
       "kind": "node",
-      "purpose": "Terminal cleanup: stop browser/host, remove terminal runtime state, overlay marker and installed fixture; profiles kept unless --reset-profile.",
+      "purpose": "web-dapp cleanup: stop browser/host, remove the slot's runtime state, overlay marker and installed fixture; profiles kept unless --reset-profile.",
       "inputs": "--target [--cdp-port] [--reset-profile]",
       "outputs": "JSON on stdout; exit 0/1"
     },
     {
-      "id": "terminal/verify",
-      "entry": "adapters/terminal/verify.mjs",
+      "id": "web-dapp/verify",
+      "entry": "adapters/web-dapp/verify.mjs",
       "kind": "node",
-      "purpose": "Read-only terminal slot readiness: checkout, deps, dev server, forced testnet, fixture, browser start probe, extension copy, CDP port.",
-      "inputs": "--policy-module --target [--cdp-port] [--watcher-port] [--signer] [--account] [--json]",
+      "purpose": "Read-only web-dapp slot readiness: checkout, deps, dev server, forced testnet, fixture, browser start probe, extension copy, CDP port.",
+      "inputs": "--target [--cdp-port] [--watcher-port] [--signer] [--account] [--json]",
       "outputs": "readiness report; exit 0 ready / 1 not ready"
     },
     {
-      "id": "terminal/lib-cdp-client",
-      "entry": "adapters/terminal/lib/cdp-client.mjs",
+      "id": "web-dapp/lib-cdp-client",
+      "entry": "adapters/web-dapp/lib/cdp-client.mjs",
       "kind": "lib",
       "purpose": "Browser-level CDP client with flattened target sessions for the wallet host.",
       "inputs": "CdpClient.connect(url)",
       "outputs": "send/on"
     },
     {
-      "id": "terminal/lib-processes",
-      "entry": "adapters/terminal/lib/processes.mjs",
+      "id": "web-dapp/lib-processes",
+      "entry": "adapters/web-dapp/lib/processes.mjs",
       "kind": "lib",
       "purpose": "Pid-file process stop with owner-marker checks (--mm-harness-owner=<kind>-<id>, exact token; live foreign pids kept and reported, dead ones dropped), process-group termination, CDP port release check.",
-      "inputs": "stopTerminalBrowser(target, { cdpPort }), stopConsoleCollector(target), ownerMarker(kind, runtimeDir), ownsProcess(kind, pid, runtimeDir)",
+      "inputs": "stopWebDappBrowser(target, { cdpPort }), stopConsoleCollector(target), ownerMarker(kind, runtimeDir), ownsProcess(kind, pid, runtimeDir)",
       "outputs": "stopped processes"
     },
     {
-      "id": "terminal/lib-readiness",
-      "entry": "adapters/terminal/lib/readiness.mjs",
+      "id": "web-dapp/lib-readiness",
+      "entry": "adapters/web-dapp/lib/readiness.mjs",
       "kind": "lib",
-      "purpose": "Terminal slot readiness checks shared by verify, doctor and the surface.",
-      "inputs": "terminalReadiness({ policy, target, appPort, cdpPort, signer }), assertLaunchNetwork(target, { network, mainnetConfirmation }), devServerTestnetDiagnostic(target, { appPort, variable }) (advisory)",
+      "purpose": "web-dapp slot readiness checks shared by verify, doctor and the surface.",
+      "inputs": "webDappReadiness({ policy, target, appPort, cdpPort, signer }), assertLaunchNetwork(target, { network, mainnetConfirmation }), devServerTestnetDiagnostic(target, { appPort, variable }) (advisory)",
       "outputs": "checks[]"
     },
     {
-      "id": "terminal/lib-display",
-      "entry": "adapters/terminal/lib/display.mjs",
+      "id": "web-dapp/lib-display",
+      "entry": "adapters/web-dapp/lib/display.mjs",
       "kind": "lib",
       "purpose": "Headless/headful and slow-mo resolution, per-slot window placement and the profile zoom that keeps the desktop layout.",
       "inputs": "resolveHeadless, resolveSlowMo, windowPlacement, writeProfileZoom",
       "outputs": "browser display args"
     },
     {
-      "id": "terminal/lib-hud",
-      "entry": "adapters/terminal/lib/hud.mjs",
+      "id": "web-dapp/lib-hud",
+      "entry": "adapters/web-dapp/lib/hud.mjs",
       "kind": "lib",
       "purpose": "Recipe HUD state (<runtime>/hud.json) and the page expression that draws it on the app origin only.",
       "inputs": "nextHudState, hudRenderExpression",
       "outputs": "HUD state, expression source"
     },
     {
-      "id": "terminal/lib-mainnet-guard",
-      "entry": "adapters/terminal/lib/mainnet-guard.mjs",
+      "id": "web-dapp/lib-blocked-hosts",
+      "entry": "adapters/web-dapp/lib/blocked-hosts.mjs",
       "kind": "lib",
-      "purpose": "Testnet enforcement: the venue endpoint hosts (from the venue SDK, @metamask/perps-controller and the app source in the checkout), the browser's host-resolver block, and the mainnet typed-data classifier used by the page script and the wallet host.",
-      "inputs": "venueHosts(checkout), hostResolverRules(hosts), isMainnetVenueUrl(url, hosts), mainnetTypedDataReason(data), TESTNET_TYPED_DATA_POLICY",
-      "outputs": "host list, launch switch, refusal reason"
+      "purpose": "Testnet enforcement mechanics: the host-resolver rule that makes the policy's blocked hosts unresolvable, and the canonical host check the wallet host's request block uses.",
+      "inputs": "hostResolverRules(hosts), hostOf(url), isBlockedUrl(url, hosts)",
+      "outputs": "launch switch, booleans"
     },
     {
-      "id": "terminal/policy",
-      "entry": "adapters/terminal/policy.mjs",
+      "id": "web-dapp/lib-policy",
+      "entry": "adapters/web-dapp/lib/policy.mjs",
       "kind": "lib",
-      "purpose": "The Web Terminal's venue policy: blocked and served venue hosts, link hosts, the launch probe, the testnet typed-data refusal, the start page, the injected wallet's start chain, the checkout dependencies and the dev-server testnet variable. launch, verify, doctor and the wallet host take it as an argument (--policy-module for the leaf processes).",
-      "inputs": "policy.venueHosts(checkout)",
-      "outputs": "policy"
+      "purpose": "The venue policy of the adapter that extends web-dapp (e.g. the Terminal plugin's), loaded from the module RECIPE_WEB_DAPP_POLICY names; the host sets it when it binds that adapter.",
+      "inputs": "env RECIPE_WEB_DAPP_POLICY",
+      "outputs": "webDappPolicy(), webDappAdapterId()"
     },
     {
-      "id": "terminal/surface",
-      "entry": "src/adapters/terminal/surface.ts",
+      "id": "web-dapp/surface",
+      "entry": "src/adapters/web-dapp/surface.ts",
       "kind": "module",
-      "purpose": "Terminal adapter surface (runtime status, browser stop, logs, hints).",
-      "inputs": "terminalSurface",
+      "purpose": "The web-dapp adapter surface (runtime status, browser stop, logs, hints) and bindWebDappPolicy, which binds the venue policy of the adapter that extends it.",
+      "inputs": "webDappSurface",
       "outputs": "AdapterSurface"
     }
   ]

package/adapters/{terminal → web-dapp}/cleanup.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-// cleanup.mjs — `mm-harness cleanup --adapter terminal`: stop the slot browser
-// and wallet host, then remove the terminal runtime state and the installed
+// cleanup.mjs — `mm-harness cleanup --adapter <web-dapp adapter>`: stop the slot
+// browser and wallet host, then remove the slot's runtime state and the installed
 // wallet fixture. Browser profiles are kept unless --reset-profile.
 //
 // Inputs: --target <checkout> [--cdp-port <port>] [--reset-profile]
@@ -13,16 +13,16 @@ import { fileURLToPath } from 'node:url';
 
 import { recipeHarnessPath } from '@farmslot/recipe-cli/harness';
 import { walletFixturePath } from '../../library/actions/harness-exports.mjs';
-import { terminalRuntimeDir } from '../../library/actions/terminal/platform/runtime.mjs';
-import { stopConsoleCollector, stopTerminalBrowser } from './lib/processes.mjs';
+import { webDappPolicy, webDappRuntimeDir } from '../../library/actions/web-dapp/platform/runtime.mjs';
+import { stopConsoleCollector, stopWebDappBrowser } from './lib/processes.mjs';
 
 const usage = 'Usage: cleanup.mjs --target <checkout> [--cdp-port <port>] [--reset-profile]';
 
-export async function cleanupTerminalRuntime({ target, cdpPort, resetProfile = false }) {
+export async function cleanupWebDappRuntime({ target, cdpPort, resetProfile = false }) {
   const root = path.resolve(target);
-  const stop = await stopTerminalBrowser(root, { cdpPort });
+  const stop = await stopWebDappBrowser(root, { cdpPort });
   await stopConsoleCollector(root);
-  const runtime = terminalRuntimeDir(root);
+  const runtime = webDappRuntimeDir(root);
   const removed = [];
   if (existsSync(runtime)) {
     for (const entry of readdirSync(runtime)) {
@@ -31,7 +31,7 @@ export async function cleanupTerminalRuntime({ target, cdpPort, resetProfile = f
       removed.push(entry);
     }
   }
-  const overlay = recipeHarnessPath(root, 'terminal');
+  const overlay = recipeHarnessPath(root, webDappPolicy().adapterId);
   if (existsSync(overlay)) {
     rmSync(overlay, { recursive: true, force: true });
     removed.push(path.relative(root, overlay));
@@ -56,7 +56,7 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
   };
   const rawPort = value('--cdp-port') ?? process.env.RECIPE_CDP_PORT ?? process.env.CDP_PORT;
   try {
-    const result = await cleanupTerminalRuntime({
+    const result = await cleanupWebDappRuntime({
       target: value('--target') ?? process.cwd(),
       cdpPort: rawPort ? Number(rawPort) : undefined,
       resetProfile: argv.includes('--reset-profile'),

package/adapters/{terminal → web-dapp}/inject.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-// inject.mjs — `mm-harness install --adapter terminal`: prepare the slot runtime
-// directory and install the wallet fixture the terminal actions read.
+// inject.mjs — `mm-harness install --adapter <web-dapp adapter>`: prepare the slot
+// runtime directory and install the wallet fixture the web-dapp actions read.
 //
-// Inputs: --target <terminal checkout> [--fixture <wallet-fixture.json>] [--force]
+// Inputs: --target <checkout> [--fixture <wallet-fixture.json>] [--force]
 //   env RECIPE_WALLET_FIXTURE (fixture source when --fixture is absent)
-// Outputs: <target>/<harness root>/terminal/install.json (overlay marker),
-//   <target>/<runtime>/terminal/ (0700), <runtime>/wallet-fixture.json (0600);
+// Outputs: <target>/<harness root>/<adapter id>/install.json (overlay marker),
+//   <target>/<runtime>/<adapter id>/ (0700), <runtime>/wallet-fixture.json (0600);
 //   JSON summary on stdout (account names only). Exit 0 installed; 1 failure; 2 usage.
 // Never touches: product source files; never prints key material.
 
@@ -15,16 +15,16 @@ import { fileURLToPath } from 'node:url';
 
 import { recipeHarnessPath, recipeRuntimeDir } from '@farmslot/recipe-cli/harness';
 import { walletFixturePath } from '../../library/actions/harness-exports.mjs';
-import { terminalRuntimeDir } from '../../library/actions/terminal/platform/runtime.mjs';
-import { isTerminalCheckout } from './lib/readiness.mjs';
+import { webDappPolicy, webDappRuntimeDir } from '../../library/actions/web-dapp/platform/runtime.mjs';
 
-const usage = 'Usage: inject.mjs --target <terminal checkout> [--fixture <wallet-fixture.json>] [--force]';
+const usage = 'Usage: inject.mjs --target <checkout> [--fixture <wallet-fixture.json>] [--force]';
 
-export function installTerminalRuntime({ target, fixture, force = false }) {
+export function installWebDappRuntime({ target, fixture, force = false }) {
   const root = path.resolve(target);
-  if (!isTerminalCheckout(root)) throw new Error(`${root} is not a Web Terminal checkout (needs next + src/features/perpetuals).`);
+  const { adapterId, checkout } = webDappPolicy();
+  if (!checkout.matches(root)) throw new Error(`${root} is not a ${checkout.name} checkout (needs ${checkout.needs}).`);
   mkdirSync(path.join(root, recipeRuntimeDir()), { recursive: true, mode: 0o700 });
-  mkdirSync(terminalRuntimeDir(root), { recursive: true, mode: 0o700 });
+  mkdirSync(webDappRuntimeDir(root), { recursive: true, mode: 0o700 });
   const destination = walletFixturePath(root);
   let fixtureAction = 'kept';
   if (fixture && (force || !existsSync(destination))) {
@@ -39,9 +39,9 @@ export function installTerminalRuntime({ target, fixture, force = false }) {
   const accounts = existsSync(destination)
     ? JSON.parse(readFileSync(destination, 'utf8')).accounts.map((account) => account?.name).filter(Boolean)
     : [];
-  const marker = { schemaVersion: 1, adapter: 'terminal', installedAt: new Date().toISOString(), fixture: fixtureAction };
+  const marker = { schemaVersion: 1, adapter: adapterId, installedAt: new Date().toISOString(), fixture: fixtureAction };
   // The overlay directory is the install marker run/call auto-ensure checks.
-  const overlay = recipeHarnessPath(root, 'terminal');
+  const overlay = recipeHarnessPath(root, adapterId);
   mkdirSync(overlay, { recursive: true, mode: 0o700 });
   writeFileSync(path.join(overlay, 'install.json'), `${JSON.stringify(marker, null, 2)}\n`, { mode: 0o600 });
   return { status: fixtureAction === 'missing' ? 'fail' : 'pass', target: root, fixture: fixtureAction, fixturePath: destination, accounts };
@@ -58,7 +58,7 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
     return index >= 0 ? argv[index + 1] : undefined;
   };
   try {
-    const result = installTerminalRuntime({
+    const result = installWebDappRuntime({
       target: value('--target') ?? process.cwd(),
       fixture: value('--fixture') ?? process.env.RECIPE_WALLET_FIXTURE,
       force: argv.includes('--force'),

package/adapters/{terminal → web-dapp}/launch.mjs

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
-// launch.mjs — start (or reuse) the terminal slot browser and its wallet host.
+// launch.mjs — start (or reuse) the web-dapp slot browser and its wallet host.
 //
 // Purpose:
 //   One Chromium-family browser per slot, bound to 127.0.0.1:<cdp-port>, with a
-//   profile under <runtime>/terminal/. signer=extension loads the slot's copy of
+//   profile under <runtime>/<adapter id>/. signer=extension loads the slot's copy of
 //   the MetaMask extension and imports the fixture account through the Extension
 //   adapter's fixture flow (wallet-fixture-state.cjs generate → prefill-profile →
 //   seed-cdp). signer=injected loads no extension; the wallet host provides the
 //   strict test wallet. Either way wallet-host.mjs then records wallet requests.
 //
-// Inputs (flags): --target <terminal checkout> --cdp-port <port> --app-port <port>
+// Inputs (flags): --target <checkout> --cdp-port <port> --app-port <port>
 //   [--signer extension|injected] [--account <fixture name>] [--fresh-profile]
 //   [--headless | --headful] [--slow-mo <ms>] [--start-chain <id>] [--json]
-//   [--network mainnet --mainnet-confirmation REAL_FUNDS] (required unless the slot
-//   dev server is known to force Hyperliquid testnet)
+//   [--network mainnet --mainnet-confirmation REAL_FUNDS] (testnet otherwise,
+//   enforced in the browser from the venue policy)
 //   env: TERMINAL_CHROME_BIN, TERMINAL_EXTENSION_DIR,
 //   TERMINAL_EXTENSION_CHECKOUT, TERMINAL_EXTENSION_NODE, RECIPE_WALLET_FIXTURE,
 //   TERMINAL_HEADLESS, TERMINAL_SLOW_MO, TERMINAL_WINDOW, TERMINAL_SCREEN
 //   The browser is headful by default, in a window placed per slot (see
 //   lib/display.mjs); --headless or TERMINAL_HEADLESS=1 hides it.
-// Outputs: <runtime>/terminal/browser.json (+ pid files, logs); JSON summary on stdout.
+// Outputs: <runtime>/<adapter id>/browser.json (+ pid files, logs); JSON summary on stdout.
 //   Exit 0 ready; 1 launch/seed failure; 2 usage.
 // Never prints: mnemonics, private keys, the wallet password.
 
@@ -29,20 +29,21 @@ import { createRequire } from 'node:module';
 import { appendFileSync, chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
+import { fileURLToPath } from 'node:url';
 
 import {
   fixtureEntry,
   loadWalletFixture,
   resolveSigner,
-  terminalRuntimeDir,
   viemAccountFromEntry,
-} from '../../library/actions/terminal/platform/runtime.mjs';
+  webDappPolicy,
+  webDappRuntimeDir,
+} from '../../library/actions/web-dapp/platform/runtime.mjs';
 import { CdpClient, browserWebSocketUrl } from './lib/cdp-client.mjs';
 import { clearHudState } from './lib/hud.mjs';
 import { browserDisplayArgs, resolveHeadless, resolveSlowMo, windowPlacement, writeProfileZoom } from './lib/display.mjs';
-import { cdpListenerPids, ownedBrowserPids, ownerMarker, ownsProcess, pidAlive, stopTerminalBrowser, terminate } from './lib/processes.mjs';
-import { hostResolverRules } from './lib/mainnet-guard.mjs';
+import { cdpListenerPids, ownedBrowserPids, ownerMarker, ownsProcess, pidAlive, stopWebDappBrowser, terminate } from './lib/processes.mjs';
+import { hostResolverRules } from './lib/blocked-hosts.mjs';
 import { assertLaunchNetwork, devServerTestnetDiagnostic } from './lib/readiness.mjs';
 
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
@@ -51,7 +52,7 @@ const HARNESS_ROOT = path.resolve(SCRIPT_DIR, '../..');
 const FIXTURE_STATE_SCRIPT = path.join(HARNESS_ROOT, 'adapters/extension/wallet-fixture-state.cjs');
 
 function usage() {
-  return 'Usage: launch.mjs --target <checkout> --cdp-port <port> --app-port <port> --policy-module <venue policy module> [--signer extension|injected] [--account <name>] [--fresh-profile] [--headless | --headful] [--slow-mo <ms>] [--network testnet|mainnet --mainnet-confirmation REAL_FUNDS] [--start-chain <id>] [--json]';
+  return 'Usage: launch.mjs --target <checkout> --cdp-port <port> --app-port <port> [--signer extension|injected] [--account <name>] [--fresh-profile] [--headless | --headful] [--slow-mo <ms>] [--network testnet|mainnet --mainnet-confirmation REAL_FUNDS] [--start-chain <id>] [--json]';
 }
 
 export function parseLaunchArgs(argv) {
@@ -67,7 +68,7 @@ export function parseLaunchArgs(argv) {
     args[flag.slice(2)] = argv[index + 1];
     index += 1;
   }
-  for (const key of ['target', 'cdp-port', 'app-port', 'policy-module']) {
+  for (const key of ['target', 'cdp-port', 'app-port']) {
     if (!args[key]) throw Object.assign(new Error(`Missing --${key}\n${usage()}`), { exitCode: 2 });
   }
   args.signer = resolveSigner(args.signer);
@@ -76,7 +77,7 @@ export function parseLaunchArgs(argv) {
 }
 
 function log(message) {
-  process.stderr.write(`[terminal/launch] ${message}\n`);
+  process.stderr.write(`[${webDappPolicy().adapterId}/launch] ${message}\n`);
 }
 
 function browserStarts(bin) {
@@ -113,7 +114,7 @@ export async function resolveBrowser(env = process.env, candidates = chromeForTe
     if (!existsSync(explicit)) throw new Error(`TERMINAL_CHROME_BIN does not exist: ${explicit}`);
     return { bin: explicit, version: browserStarts(explicit), source: 'TERMINAL_CHROME_BIN' };
   }
-  if (env.RECIPE_HARNESS_CHROME_BIN) log(`ignoring RECIPE_HARNESS_CHROME_BIN (${env.RECIPE_HARNESS_CHROME_BIN}) for the terminal; set TERMINAL_CHROME_BIN to override Chrome for Testing`);
+  if (env.RECIPE_HARNESS_CHROME_BIN) log(`ignoring RECIPE_HARNESS_CHROME_BIN (${env.RECIPE_HARNESS_CHROME_BIN}) for the ${webDappPolicy().adapterId}; set TERMINAL_CHROME_BIN to override Chrome for Testing`);
   const bin = candidates.find((candidate) => existsSync(candidate));
   if (bin) return { bin, version: browserStarts(bin), source: 'chrome-for-testing' };
   throw new Error(
@@ -344,9 +345,9 @@ function writePrivateFile(file, text) {
 // which waits for a cold dev-server compile.
 export const LAUNCH_TIMEOUTS = Object.freeze({ browserStartMs: 90000, hostReadyMs: 180000 });
 
-// `policy`: the venue policy (adapters/terminal/policy.mjs).
-export async function launchTerminalBrowser(args, env = process.env, { timeouts = LAUNCH_TIMEOUTS, policy } = {}) {
-  if (!policy?.module) throw new Error('launchTerminalBrowser needs the venue policy (adapters/terminal/policy.mjs).');
+// The venue policy comes from RECIPE_WEB_DAPP_POLICY (webDappPolicy), as for every web-dapp leaf.
+export async function launchWebDappBrowser(args, env = process.env, { timeouts = LAUNCH_TIMEOUTS } = {}) {
+  const policy = webDappPolicy(env);
   const target = path.resolve(args.target);
   const cdpPort = Number(args['cdp-port']);
   const appPort = Number(args['app-port']);
@@ -364,7 +365,7 @@ export async function launchTerminalBrowser(args, env = process.env, { timeouts
   if (devServer && !(devServer.known && devServer.forced)) {
     log(`WARN dev server testnet check: ${devServer.detail} (advisory; the browser enforces testnet itself)`);
   }
-  const runtime = terminalRuntimeDir(target);
+  const runtime = webDappRuntimeDir(target);
   mkdirSync(runtime, { recursive: true, mode: 0o700 });
   chmodSync(runtime, 0o700);
   const stateFile = path.join(runtime, 'browser.json');
@@ -394,7 +395,7 @@ export async function launchTerminalBrowser(args, env = process.env, { timeouts
     if (previous.slowMoMs !== slowMoMs) writePrivateFile(stateFile, `${JSON.stringify(state, null, 2)}\n`);
     return { ...state, reused: true };
   }
-  await stopTerminalBrowser(target, { cdpPort, log });
+  await stopWebDappBrowser(target, { cdpPort, log });
 
   const browser = await resolveBrowser(env);
   const profile = path.join(runtime, `profile-${signer}-${args.account.replace(/[^A-Za-z0-9_-]/gu, '_')}`);
@@ -545,7 +546,6 @@ export async function launchTerminalBrowser(args, env = process.env, { timeouts
       '--account', args.account,
       '--start-chain', String(args['start-chain'] ?? policy.startChain),
       '--network', network,
-      '--policy-module', policy.module,
       ownerMarker('wallet-host', runtime),
     ];
     if (network === 'testnet') hostArgs.push('--mainnet-hosts', mainnetHosts.join(','), '--testnet-hosts', venues.served.join(','));
@@ -598,7 +598,7 @@ export async function launchTerminalBrowser(args, env = process.env, { timeouts
   } catch (error) {
     if (started) {
       log(`launch failed, stopping what it started: ${String(error?.message ?? error).split('\n')[0]}`);
-      await stopTerminalBrowser(target, { cdpPort, log }).catch((stopError) => log(`rollback incomplete: ${stopError.message}`));
+      await stopWebDappBrowser(target, { cdpPort, log }).catch((stopError) => log(`rollback incomplete: ${stopError.message}`));
       for (const pid of ownedBrowserPids(runtime)) await terminate(pid, 3000);
     }
     throw error;
@@ -621,8 +621,7 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
     process.exit(0);
   }
   try {
-    const { policy } = await import(pathToFileURL(path.resolve(args['policy-module'])).href);
-    const state = await launchTerminalBrowser(args, process.env, { policy });
+    const state = await launchWebDappBrowser(args);
     process.stdout.write(`${JSON.stringify({ status: 'pass', ...state }, null, args.json ? 0 : 2)}\n`);
   } catch (error) {
     const message = String(error?.stderr ?? '').trim() || error.message;

package/adapters/web-dapp/lib/blocked-hosts.mjs

@@ -0,0 +1,24 @@
+// Testnet enforcement mechanics for the web-dapp slot browser: the hosts a
+// venue policy blocks become unresolvable for the whole browser (pages,
+// workers, WebSockets), and the wallet host fails and logs each request it
+// sees to one of them. Which hosts is the venue policy's (venueHosts).
+
+// A URL's host as the network sees it: lowercase, no trailing dot. null when
+// it does not parse.
+export function hostOf(url) {
+  try {
+    return new URL(String(url)).hostname.toLowerCase().replace(/\.$/u, '');
+  } catch {
+    return null;
+  }
+}
+
+export function isBlockedUrl(url, hosts) {
+  const host = hostOf(url);
+  return host !== null && hosts.includes(host);
+}
+
+export function hostResolverRules(hosts) {
+  // The host and its fully qualified form (trailing dot) alike.
+  return `--host-resolver-rules=${hosts.flatMap((host) => [`MAP ${host} ~NOTFOUND`, `MAP ${host}. ~NOTFOUND`]).join(', ')}`;
+}

package/adapters/{terminal → web-dapp}/lib/cdp-client.mjs

@@ -1,5 +1,5 @@
 // Minimal browser-level Chrome DevTools Protocol client with flattened target
-// sessions, for the long-running terminal wallet host. Page-level UI actions use
+// sessions, for the long-running web-dapp wallet host. Page-level UI actions use
 // @farmslot/recipe-runner/runtime/cdp instead.
 
 import WebSocket from 'ws';

package/adapters/{terminal → web-dapp}/lib/display.mjs

@@ -1,5 +1,5 @@
 // How the slot browser is shown: headful (default) or headless, where its
-// window sits on screen, the page zoom that keeps the terminal's desktop layout
+// window sits on screen, the page zoom that keeps the app's desktop layout
 // inside that window, and the optional slow-mo between UI actions.
 
 import { execFileSync } from 'node:child_process';

package/adapters/{terminal → web-dapp}/lib/hud.mjs

@@ -1,4 +1,4 @@
-// Recipe HUD for the terminal app tab: state handling and the page expression
+// Recipe HUD for the web-dapp app tab: state handling and the page expression
 // that draws it.
 //
 // The overlay is an <mm-harness-hud> element under <html> (outside <body>) with

package/adapters/web-dapp/lib/policy.mjs

@@ -0,0 +1,79 @@
+// The venue policy of the adapter that extends web-dapp (e.g. the Terminal
+// plugin's plugins/terminal/policy.mjs): what web-dapp's launch, wallet host,
+// readiness and actions know about the app's venue. mm-harness sets its module
+// path in RECIPE_WEB_DAPP_POLICY when it binds such an adapter, so every
+// web-dapp leaf process and live action it starts reads the same policy.
+
+import { createRequire } from 'node:module';
+import path from 'node:path';
+
+export const POLICY_ENV = 'RECIPE_WEB_DAPP_POLICY';
+// The policy contract this web-dapp reads; a policy declares the version it was written for.
+export const POLICY_VERSION = 1;
+let loaded;
+
+// Every member web-dapp reads, checked once when the policy loads: a missing or mistyped
+// member fails here, naming the module, instead of deep in a launch or an assertion (a
+// missing signatureLog would silently drop the venue's L1 and mainnet rules).
+const MEMBERS = {
+  adapterId: 'string',
+  checkout: 'object',
+  venueHosts: 'function',
+  linkHosts: 'array',
+  probe: 'object',
+  startChain: 'number',
+  refuseTypedData: 'object',
+  signatureLog: 'object',
+  startPath: 'string',
+  pagePath: 'function',
+  dependencies: 'array',
+  testnetVariable: 'string',
+  module: 'string',
+};
+
+function checkPolicy(policy, file) {
+  const problems = [];
+  if (!policy || typeof policy !== 'object') problems.push('exports no policy object');
+  else {
+    if (policy.policyVersion !== POLICY_VERSION) problems.push(`policyVersion is ${policy.policyVersion ?? 'missing'}, this web-dapp reads ${POLICY_VERSION}`);
+    for (const [name, type] of Object.entries(MEMBERS)) {
+      const value = policy[name];
+      const ok = type === 'array' ? Array.isArray(value) : type === 'object' ? value !== null && typeof value === 'object' : typeof value === type;
+      if (!ok) problems.push(`${name} must be ${type === 'array' || type === 'object' ? `an ${type}` : `a ${type}`}`);
+    }
+    const { checkout, refuseTypedData, signatureLog } = policy;
+    if (checkout && typeof checkout.matches !== 'function') problems.push('checkout.matches must be a function');
+    for (const name of ['name', 'label', 'needs']) if (checkout && typeof checkout[name] !== 'string') problems.push(`checkout.${name} must be a string`);
+    if (refuseTypedData && typeof refuseTypedData.reason !== 'function') problems.push('refuseTypedData.reason must be a function');
+    for (const name of ['kind', 'message']) if (refuseTypedData && typeof refuseTypedData[name] !== 'string') problems.push(`refuseTypedData.${name} must be a string`);
+    // The venue's request-log rules: both maps are required (empty only on purpose), so a
+    // policy cannot drop its L1 or mainnet rules by omission.
+    for (const name of ['typedDataClasses', 'forbiddenEntries']) {
+      if (signatureLog && (signatureLog[name] === null || typeof signatureLog[name] !== 'object')) problems.push(`signatureLog.${name} must be an object`);
+    }
+  }
+  if (problems.length) {
+    throw new Error(`web-dapp venue policy ${file}: ${problems.join('; ')}.\nNext: update the library that declares the adapter to a revision written for this mm-harness.`);
+  }
+  return policy;
+}
+
+export function webDappPolicy(env = process.env) {
+  const file = env[POLICY_ENV];
+  if (!file) {
+    throw new Error(
+      'web-dapp needs a venue policy: select an adapter that extends it.\n' +
+      'Next: put the library that declares it on RECIPE_LIBRARY_PATH and pass its id, e.g. --adapter terminal.',
+    );
+  }
+  if (loaded?.file !== file) {
+    // The policy module uses node built-ins only and has no top-level await, so it loads synchronously.
+    loaded = { file, policy: checkPolicy(createRequire(import.meta.url)(path.resolve(file)).policy, file) };
+  }
+  return loaded.policy;
+}
+
+// The bound adapter's id, for names and paths; web-dapp's own when none is bound.
+export function webDappAdapterId(env = process.env) {
+  return env[POLICY_ENV] ? webDappPolicy(env).adapterId : 'web-dapp';
+}