@deeeed/metamask-harness 0.84.0 → 0.85.0

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 ## Unreleased
 
+## 0.85.0 - 2026-10-09
+
+### Added
+
+- `health.check` recipes for Mobile, Extension and Core: a read-only readiness check to run before ticket work. A failed precondition stops at a node named after its error (for example `WALLET_LOCKED`, `NOT_ON_HOME` or, on Mobile and Extension, `CONSOLE_ERRORS`), whose intent gives the recovery command. `mm-harness help` lists it under the target step.
+- `metamask.app.assert_no_console_errors` on Mobile and Extension, as on `web-dapp`: it fails on a console error or exception that no console allowlist covers, judging the events since the launch began by their own timestamps, and fails as unavailable unless the capture is proven (the slot's console forwarder or collector is running and a control line logged in the app or MetaMask reaches the log). `launch` records when it starts, and console lines replayed from before then (by an app runtime or browser the launch kept) are left out. Mobile reads `app-console.log`, which every launch now restarts empty along with the forwarder's replay cursor, and judges only the device the bridge selects; Extension reads `extension-console.log` from the offset `launch` records, and its collector now stamps each line with the event's own time (UTC, with milliseconds). Known app noise is accepted only when it also appears on the app's unchanged base build: the bundled library ships `diagnostics/console-allowlist.json` (the Extension unlock page's `UNSAFE_componentWillMount` warning), read ahead of other libraries' by these actions and by run diagnostics, and the classifier carries pattern rules for base-reproduced errors one exact entry cannot cover: Mobile's SES lockdown intrinsic reports and its notifications startup failure (`createOnChainTriggers`), whose message carries the bundle line; Extension's `getBearerToken` while locked (MetaMask/metamask-extension#46688) and the Money query adapter's `mutations` TypeError (TAT-4063), whose stacks name build-specific chunks. Allowlist entries can name the `app` source Mobile lines carry, and Mobile console lines match without the forwarder's time and device prefix.
+
+### Changed
+
+- **BREAKING:** `run --hud` takes `show` or `hide`, default `show`. `auto` is gone: the CLI refuses it as an invalid choice (`--hud must be show or hide; received 'auto'.`); drop the flag to get the default. The recipe HUD, each node's intent, now draws on every adapter that implements `app.hud`, headless browsers included. A headless web-dapp (Terminal) browser gets it where `auto` skipped it; Mobile and Extension already drew it by default. A Mobile release artifact still runs without it, since it has no dev bridge to draw with. `METAMASK_RECIPE_AUTO_HUD=0` stays the internal off switch for self-test, verify and the test sandboxes, and `--hud show` wins over it.
+- **BREAKING:** web-dapp `ui.screenshot` keeps the HUD in the capture (it hid it while capturing), so Terminal screenshot evidence shows the node's intent as Mobile and Extension evidence does. `--hud hide` is the way to a HUD-free screenshot.
+- A `surface=wallet` web-dapp `ui.screenshot` (the MetaMask confirmation window or side panel) shows the running node's intent too: the HUD is a bar docked to that MetaMask page's bottom edge for the capture only, which reserves its own height so the request and the footer buttons move up rather than being covered (pointer-events none), and is removed after it.
+- A run with the HUD off (`--hud hide`, a `call`, an untrusted source) first clears the HUD an earlier run left on the slot, so its screenshots never show a previous recipe's intent: web-dapp deletes `hud.json` (the wallet host redraws from it) and the drawn HUD on the app tabs; Extension removes the runner HUD from its pages. Nothing is launched to do it, `METAMASK_RECIPE_AUTO_HUD=0` skips it, and a failed clear prints one `WARN:` line on stderr.
+- Inside a checkout, every command resolves its adapter, target and slot once, through recipe-cli's context resolver, so `status`, `doctor`, `run` and the rest need no `--adapter`. The order is: flag, then the checkout's runtime binding, then its slot, then a unique detect match among the built-ins and the operator's library plugins (matched by their declared `detect`, before any plugin code loads).
+  - A checkout that more than one adapter matches stops with `ADAPTER_AMBIGUOUS` (exit 2) and lists the candidates. With no match, a command keeps its "could not detect the MetaMask repo type" error.
+  - `status`, `doctor`, `run`, `call` and discovery (`actions`, `run --list`/`--describe`, `call --list`) carry `context` in their `--json` envelopes (each value and its source), as does a command's own `USAGE` error once its context has resolved. Grammar refusals (raised before resolution), the task view (`status --task`/`--watch`) and the other commands' envelopes, `launch` on every adapter included, are unchanged. Human output adds one `context:` line on stderr when the adapter was not given by a flag.
+  - Terminal detection needs a recipe-terminal library that declares `detect` (recipe-terminal #8, 8a44aee); with an older library, pass `--adapter terminal`.
+  - `status` accepts `--adapter` and `--platform` (it refused them with `CLI_UNKNOWN_OPTION`).
+  - The slot comes from mm-harness's own pool resolution (the configured Farmslot root, else the nearest Farmslot checkout's `pool/`) unless `FARMSLOT_POOL_DIR` or `FARMSLOT_ROOT` names one, so a slot checkout beside a Farmslot checkout resolves its slot, and its ports fill `--cdp-port`/`--watcher-port`, with no env.
+  - Commands no longer detect the adapter themselves: status, doctor, check, provision, prepare, help, task init, `verify`'s overlay, debug, logs, fixtures, review and domain all read the resolved one. `check` still refuses `--platform ios|android`.
+  - `review` and `domain` scope to the resolved adapter when review covers it (mobile, extension, core, terminal), else run unscoped. Only an explicit `--adapter` that names another adapter is refused.
+- Depend on `@farmslot/recipe-cli` 0.11.0 and `@farmslot/adapter-sdk` 0.8.0 (were 0.10.0 and 0.7.1) for the context resolver (deeeed/farmslot#864), on `@farmslot/recipe-runner` 0.28.0, `@farmslot/protocol` 0.35.0 and `@farmslot/agent-runtime` 0.17.1 (were 0.27.0, 0.34.0 and 0.17.0), and on `@farmslot/adapter-web` 0.6.4, `@farmslot/adapter-rn` 0.19.3 and `@farmslot/adapter-node` 0.1.6 (were 0.6.2, 0.19.1 and 0.1.4). With them, a web-dapp launch stops waiting for CDP when its browser dies (deeeed/farmslot#865). The install holds one `@farmslot/adapter-sdk` and one `@farmslot/recipe-runner`.
+- Help lists the selectable adapters (the registered ones, then those the operator's libraries and the invocation's `--library` entries declare) wherever it names `--adapter` or `--platform`, instead of a fixed `mobile|extension|core|terminal`.
+- **BREAKING:** Mobile `verify` takes `--watcher-port` (the public `verify` grammar accepted it; the Mobile leaf refused it) and reads `RECIPE_WATCHER_PORT`: the Metro port is `--watcher-port`, then `RECIPE_WATCHER_PORT`, then `WATCHER_PORT`, then the slot's `.js.env`. With no port env set, a checkout the slot pool maps gets the pool slot's port through `WATCHER_PORT`, so that port now wins over the checkout's `.js.env` `WATCHER_PORT`.
+- **BREAKING:** A `RECIPE_RUNTIME_CONTEXT` that belongs to another checkout no longer sets the Extension slot's ports (`CDP_PORT`, `WATCHER_PORT`, `SLOT_ID`), Extension `verify`'s `RECIPE_SLOT_ID` and `RECIPE_HARNESS_EXTENSION_ID` (it reads the checkout's own context instead), or the Mobile provision slot (simulator, slot id). It counts when its `repoRoot` is the checkout's Git top level (so a clone nested inside another checkout never takes that checkout's context), or, without a `repoRoot`, when the file sits inside the checkout: the rule recipe-cli applies to the runtime binding. A context outside every checkout that names no `repoRoot` used to be authoritative; an orchestrator that keeps the file elsewhere sets `repoRoot`.
+- Contributors: `bash tests/contract/run.sh` runs half the cores' worth of tests at once (`-j N`), each in its own process group, `TMPDIR` and output file, and prints each test's duration and the 15 slowest. A test gets 60 s (`CONTRACT_TEST_TIMEOUT`, or `# contract: timeout=<s>` in its header) and fails as `timed out`; what it leaves running is killed and named on a `LEAK` line; a test that rebuilds `dist/` declares `# contract: serial`. An unfiltered run over `CONTRACT_BUDGET` (180 s) fails, and a stopped run first lets each running test clean up (its EXIT trap reaps the leaves its CLI detached), then kills every process group left in the test's tree. A process a test leaves behind can no longer stall the run.
+- Contributors: `yarn test:goldens` runs its families through `run.sh` and fails over `GOLDENS_BUDGET` (120 s); a golden case gets 60 s (`GOLDENS_CASE_TIMEOUT`, was 600 s). Docs: CONTRIBUTING and cli-contract describe both.
+- Contributors: `AGENTS.md` has a `## Test speed` section: the default and CI suite must take 5 minutes or less (the contract and goldens runs check their own budgets; build and unit are not checked), and a new or changed test uses no fixed waits of 1 s or more, moves to `tests/live/` when it takes over 5 s (a golden case over 30 s), tears down every background process, and never rebuilds `dist/` under concurrent readers.
+- Site: the platform map (`site/platform.html`) is a static page instead of the zoomable canvas. It shows the five layers (Libraries, MetaMask preset, Adapters, CLI, Engine) with their packages, one `mm-harness run` traced through them, and who changes what. It renders from `file://` (no `fetch`), so `site/assets/platform.json` is removed.
+
+### Fixed
+
+- Extension reopen (`adapters/extension/ensure-browser.sh`) no longer builds its `node -e` script or its `python3` profile cleanup from the slot id, checkout, runtime, profile, extension and runner paths, CDP port, webpack pid or wallet fixture path. The scripts are fixed text and get those values as argv. Before, a checkout path with an apostrophe (`/tmp/Arthur's checkout`) broke the reopen script's syntax and silently skipped the profile cleanup, and a crafted value could change the code the reopen ran.
+
 ## 0.84.0 - 2026-10-08
 
 ### Changed

package/adapters/extension/console-tail.mjs

@@ -90,10 +90,14 @@ function out(event, destination = null) {
   }
 }
 
-function stamp() {
-  const d = new Date();
-  const p = (n) => String(n).padStart(2, '0');
-  return `${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+// A record's time: the UTC time of day of the event's own timestamp (CDP
+// Runtime.Timestamp, ms since the epoch), as the Mobile console forwarder
+// writes it, or of the write when the event carries none. Events the browser
+// replays when a collector attaches keep their own time, so
+// metamask.app.assert_no_console_errors can leave out those from before a
+// launch.
+function stamp(timestamp) {
+  return new Date(Number.isFinite(timestamp) ? timestamp : Date.now()).toISOString().slice(11, 23);
 }
 
 function shortLabel(target) {
@@ -160,7 +164,7 @@ function emitConsole(label, params, destination) {
   const level = String(params.type || 'log').toUpperCase();
   const text = (params.args || []).map(previewArg).join(' ');
   const [first, ...rest] = text.split('\n');
-  out(`${stamp()} [${label}] ${level}  ${first}${atSuffix(frameText(params.stackTrace?.callFrames?.[0]))}${rest.length ? `\n${rest.join('\n')}` : ''}`, destination);
+  out(`${stamp(params.timestamp)} [${label}] ${level}  ${first}${atSuffix(frameText(params.stackTrace?.callFrames?.[0]))}${rest.length ? `\n${rest.join('\n')}` : ''}`, destination);
 }
 
 function emitException(label, params, destination) {
@@ -172,7 +176,7 @@ function emitException(label, params, destination) {
     'uncaught exception';
   const frame = frameText(d.stackTrace?.callFrames?.[0]) || frameText({ url: d.url, lineNumber: d.lineNumber, columnNumber: d.columnNumber });
   const [first, ...rest] = String(text).split('\n');
-  out(`${stamp()} [${label}] EXCEPTION  ${first}${atSuffix(frame)}${rest.length ? `\n${rest.join('\n')}` : ''}`, destination);
+  out(`${stamp(params.timestamp)} [${label}] EXCEPTION  ${first}${atSuffix(frame)}${rest.length ? `\n${rest.join('\n')}` : ''}`, destination);
 }
 
 // Browser log entries (network failures, interventions, deprecations) are
@@ -186,7 +190,7 @@ function emitLogEntry(label, params, destination) {
   // A Log entry's location is its URL as is: a line number appended to a URL
   // could not be told apart from the URL's own text.
   const where = e.url ? e.url : frameText(e.stackTrace?.callFrames?.[0]);
-  out(`${stamp()} [${label}] [browser:${source}] ${level}  ${e.text || ''}${atSuffix(where)}`, destination);
+  out(`${stamp(e.timestamp)} [${label}] [browser:${source}] ${level}  ${e.text || ''}${atSuffix(where)}`, destination);
 }
 
 function handleMessage(label, destination, data) {

package/adapters/extension/ensure-browser.sh

@@ -235,9 +235,10 @@ echo "[cleanup] Reusing profile ${PROFILE}"
 # shutdowns; --load-extension re-advertises the path but does not flip it back,
 # leaving MV3 service workers inert).
 if [ -f "${PROFILE}/Default/Preferences" ]; then
-  python3 -c "
+  python3 - "${PROFILE}/Default/Preferences" 2>/dev/null <<'PY' && echo "[cleanup] Cleared crash recovery state + re-enabled extensions"
 import json
-pf = '${PROFILE}/Default/Preferences'
+import sys
+pf = sys.argv[1]
 prefs = json.load(open(pf))
 prefs['profile'] = prefs.get('profile', {})
 prefs['profile']['exit_type'] = 'Normal'
@@ -248,7 +249,7 @@ for ext_id, ext_prefs in ext_settings.items():
         ext_prefs['state'] = 1
         ext_prefs.pop('disable_reasons', None)
 json.dump(prefs, open(pf, 'w'))
-" 2>/dev/null && echo "[cleanup] Cleared crash recovery state + re-enabled extensions"
+PY
 fi
 
 # Readiness gate: wait until webpack emits a loadable background entry before
@@ -289,10 +290,13 @@ echo "[reopen] ${SLOT_ID} — CDP:${CDP_PORT:-off}"
 cd "${REPO}"
 
 trap - EXIT
-exec node -e "
+# The reopen script is fixed text; paths, ids and ports reach it as argv, never as source.
+IFS= read -r -d '' REOPEN_SCRIPT <<'NODE' || true
+const [SCRIPT_DIR, SLOT_ID, AGENT_DIR, EXTENSION, REPO, RUNNER_BIN, PROFILE, cdpPortArg, webpackPidArg, WALLET_FIXTURE] =
+  process.argv.slice(1);
 const path = require('path');
 const fs = require('fs');
-const adapterWeb = (name) => require('module').createRequire(path.join('${SCRIPT_DIR}', 'package.json'))('@farmslot/adapter-web/' + name);
+const adapterWeb = (name) => require('module').createRequire(path.join(SCRIPT_DIR, 'package.json'))('@farmslot/adapter-web/' + name);
 const http = require('http');
 const { execFileSync } = require('child_process');
 let chromium; try { chromium = require('@playwright/test').chromium; } catch { chromium = require('playwright').chromium; }
@@ -318,15 +322,9 @@ const {
   resolveBrowser,
 } = adapterWeb('browser-resolver');
 
-const SLOT_ID = '${SLOT_ID}';
-const AGENT_DIR = '${AGENT_DIR}';
-const EXTENSION = '${EXTENSION}';
-const REPO = '${REPO}';
-const RUNNER_BIN = '${RUNNER_BIN}';
-const PROFILE = '${PROFILE}';
-const CDP_PORT = '${CDP_PORT}' || null;
-const WEBPACK_PID = '${WEBPACK_PID}' || null;
-const walletFixture = JSON.parse(fs.readFileSync('${WALLET_FIXTURE}', 'utf8'));
+const CDP_PORT = cdpPortArg || null;
+const WEBPACK_PID = webpackPidArg || null;
+const walletFixture = JSON.parse(fs.readFileSync(WALLET_FIXTURE, 'utf8'));
 const PASSWORD = walletFixture.password;
 
 if (!PASSWORD) {
@@ -522,8 +520,8 @@ const releaseFocusHold = () => {
   await evaluatePageViaCdp(page, applyPersistentSlotTitle, { slotId: SLOT_ID, defaultTitle: 'MetaMask' });
 
   // Wait for runtime state to settle, then unlock if needed.
-  const unlockSelector = '[data-testid=\"unlock-password\"]';
-  const homeSelector = '[data-testid=\"account-menu-icon\"]';
+  const unlockSelector = '[data-testid="unlock-password"]';
+  const homeSelector = '[data-testid="account-menu-icon"]';
   let detectedState = 'unknown';
   for (let i = 0; i < 15; i++) {
     if (await page.locator(homeSelector).count()) {
@@ -544,7 +542,7 @@ const releaseFocusHold = () => {
   if (detectedState === 'locked') {
     console.log('[reopen] Unlocking wallet...');
     await page.fill(unlockSelector, PASSWORD);
-    await page.click('[data-testid=\"unlock-submit\"]');
+    await page.click('[data-testid="unlock-submit"]');
     await page.waitForSelector(homeSelector, { timeout: 30000 });
     console.log('[reopen] Unlocked');
   } else if (detectedState === 'onboarding') {
@@ -611,4 +609,5 @@ const releaseFocusHold = () => {
   console.error(e);
   process.exit(1);
 });
-"
+NODE
+exec node -e "$REOPEN_SCRIPT" "$SCRIPT_DIR" "$SLOT_ID" "$AGENT_DIR" "$EXTENSION" "$REPO" "$RUNNER_BIN" "$PROFILE" "$CDP_PORT" "$WEBPACK_PID" "$WALLET_FIXTURE"

package/adapters/mobile/start-console-forwarder.sh

@@ -72,7 +72,15 @@ if [ -f "$PID_FILE" ]; then
   rm -f "$PID_FILE"
 fi
 
+# Each launch starts a fresh log. The replay cursor goes with it: it marks
+# lines as written that are no longer in the file, such as the relaunched
+# app's first lines the previous forwarder wrote, so the new forwarder replays
+# the app runtime's console buffer into the new log instead of skipping them.
+# A runtime the launch kept replays lines from before the launch too;
+# metamask.app.assert_no_console_errors leaves those out by their own time
+# against the mark each launch attempt records (app-console.launch.json).
 : > "$APP_LOG_FILE"
+rm -f "$APP_LOG_FILE.forwarder-state.json"
 pid="$(node "$SCRIPT_DIR/launch-console-forwarder.cjs" \
   --port "$PORT" \
   --out "$APP_LOG_FILE" \

package/adapters/shared/resolve-slot-ports-core.mjs

@@ -198,15 +198,57 @@ function mergeKvLayers(...layers) {
   return Object.keys(result).length ? formatKvLines(result) : '';
 }
 
+// Whether a runtime context belongs to the checkout at `repo` (recipe-cli's
+// binding rule): its repoRoot is the checkout's Git top level, so a clone
+// nested inside another checkout never takes that checkout's context; without
+// a repoRoot, the file sits inside that top level. An orchestrator may keep the
+// file elsewhere as long as it names the checkout. Twin of recipe-cli's
+// runtimeContextOwned: this module stays dependency-free for the shell paths
+// that load it, so the rule is repeated here rather than imported.
+export function ownsRuntimeContext(file, repo) {
+  let repoRoot;
+  try {
+    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    repoRoot = typeof value?.repoRoot === 'string' ? value.repoRoot : undefined;
+  } catch {
+    return false;
+  }
+  if (repoRoot === undefined) return within(gitTopLevel(repo), file);
+  try {
+    return fs.realpathSync(repoRoot) === fs.realpathSync(gitTopLevel(repo));
+  } catch {
+    // A path that does not exist owns nothing.
+    return false;
+  }
+}
+
+function gitTopLevel(dir) {
+  try {
+    return execFileSync('git', ['-C', dir, 'rev-parse', '--show-toplevel'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    // Not a Git checkout: the directory is its own root.
+    return dir;
+  }
+}
+
+function within(outer, inner) {
+  try {
+    const relative = path.relative(fs.realpathSync(outer), fs.realpathSync(inner));
+    return !(relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative));
+  } catch {
+    // A path that does not exist owns nothing.
+    return false;
+  }
+}
+
 function extensionRuntimeContextPath(repo) {
   const repoRoot = path.resolve(repo);
   const envCtx = process.env.RECIPE_RUNTIME_CONTEXT;
-  if (envCtx) {
-    // Farmslot may manage runtime context outside the checkout. Treat the
-    // explicit environment override as authoritative; containment is not a
-    // security boundary and silently dropping it selects the wrong port.
-    return path.resolve(envCtx);
-  }
+  // Another checkout's context would set this checkout's ports.
+  if (envCtx && ownsRuntimeContext(path.resolve(envCtx), repoRoot)) return path.resolve(envCtx);
   return path.join(repoRoot, recipeRuntimeDir(), 'agentic-runtime.json');
 }
 

package/dist/adapters/extension/actions.js

@@ -43,6 +43,11 @@ const extensionActions = {
       }
     })
   }),
+  // The HUD lives only in the extension pages' DOM.
+  async clearHud() {
+    const { clearExtensionHud } = await import("../../../library/actions/extension/platform/cdp.mjs");
+    await clearExtensionHud();
+  },
   trustedMutation: true,
   // ensure_positions and ensure_orders only check state here.
   inputFindings: (nodeId, node) => [

package/dist/adapters/extension/console-capture.js

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import path from "node:path";
 import { recipeRuntimePath } from "@farmslot/recipe-cli/harness";
 import { verifyCapture } from "../../../library/actions/shared/console-collector.mjs";
 import { ensureConsoleCollector } from "../console-capture.js";
@@ -10,6 +11,21 @@ function extensionCaptureFiles(target) {
     pidFile: recipeRuntimePath(target, "console-tail.pid")
   };
 }
+const EXTENSION_CONSOLE_LAUNCH_FILE = "extension-console.launch.json";
+function recordConsoleLaunchIn(runtimeDir) {
+  const log = path.join(runtimeDir, "extension-console.log");
+  const stat = fs.existsSync(log) ? fs.statSync(log) : null;
+  fs.mkdirSync(runtimeDir, { recursive: true });
+  const launchedAtMs = Date.now();
+  fs.writeFileSync(
+    path.join(runtimeDir, EXTENSION_CONSOLE_LAUNCH_FILE),
+    `${JSON.stringify({ offset: stat?.size ?? 0, inode: stat?.ino ?? null, launchedAtMs, recordedAt: new Date(launchedAtMs).toISOString() })}
+`
+  );
+}
+function recordExtensionConsoleLaunch(target) {
+  recordConsoleLaunchIn(path.dirname(extensionCaptureFiles(target).extensionLog));
+}
 function extensionCdpPort() {
   return process.env.CDP_PORT ?? process.env.RECIPE_CDP_PORT;
 }
@@ -37,8 +53,10 @@ async function verifyExtensionConsoleControl(capture) {
   return verifyCapture({ cdpPort: capture.cdpPort, log: capture.extensionLog, target: "extension", extensionId });
 }
 export {
+  EXTENSION_CONSOLE_LAUNCH_FILE,
   ensureExtensionConsoleCapture,
   extensionCaptureFiles,
   extensionCdpPort,
+  recordExtensionConsoleLaunch,
   verifyExtensionConsoleControl
 };

package/dist/adapters/extension/fixtures.js

@@ -4,6 +4,7 @@ import { colorHumanMessage, EXIT, shellQuote, spawnScriptStreaming } from "@farm
 import { FIXTURE_STREAM_TIMEOUT_MS } from "../../commands/fixtures.js";
 import { sameFeatureFlags } from "../../feature-flags.js";
 import { runnerDir } from "../../paths.js";
+import { recordExtensionConsoleLaunch } from "./console-capture.js";
 import { readExtensionPinnedFlags } from "./feature-flags.js";
 import { releaseArtifactState } from "./runtime-decision.js";
 async function applyExtensionFixture({
@@ -96,6 +97,7 @@ async function applyExtensionFixture({
   }
   process.stderr.write(`${colorHumanMessage(`\u2192 fixtures ${action} extension \u2014 resetting and seeding the slot-owned profile from the existing build\u2026`)}
 `);
+  recordExtensionConsoleLaunch(target);
   const liveScript = path.join(runnerDir, "adapters/extension/live.sh");
   const args = ["--target", target, "--launch-existing-dist", "--launch-only", "--reset-profile"];
   const flagKeys = Object.keys(fixtureFlags);

package/dist/adapters/extension/overlay.js

@@ -1,13 +1,14 @@
-import { readRuntimeContextField, resolveRuntimeContextPath } from "@farmslot/recipe-cli/harness";
+import { readRuntimeContextField, recipeRuntimeDir, resolveRuntimeContextPath } from "@farmslot/recipe-cli/harness";
 import fs from "node:fs";
+import path from "node:path";
+import { ownsRuntimeContext } from "../../../adapters/shared/resolve-slot-ports-core.mjs";
 import { resolveExtensionSlotPorts } from "../slot-ports.js";
 function hasArg(args, needle) {
   return args.some((arg) => arg === needle || arg.startsWith(`${needle}=`));
 }
 function applyExtensionRuntimeEnv(target, args) {
-  const contextPath = resolveRuntimeContextPath(target);
-  const contextExists = fs.existsSync(contextPath);
-  if (contextExists) {
+  const contextPath = [resolveRuntimeContextPath(target), path.join(target, recipeRuntimeDir(), "agentic-runtime.json")].find((file) => fs.existsSync(file) && ownsRuntimeContext(file, target));
+  if (contextPath) {
     process.env.RECIPE_RUNTIME_CONTEXT = contextPath;
     if (!process.env.RECIPE_SLOT_ID) {
       const slotId = readRuntimeContextField(contextPath, "slotId");

package/dist/adapters/extension/runtime.js

@@ -4,6 +4,7 @@ import fs from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { importRecipeHarnessRuntimeBrowserExtension, importRecipeHarnessRuntimeCdp, resolveFarmslotPoolDir, runnerDir } from "../../paths.js";
+import { recordExtensionConsoleLaunch } from "./console-capture.js";
 import { poolFilesForHost } from "../resolve-slot-ports.js";
 import { macosSessionLocked, SESSION_LOCKED_MESSAGE, SESSION_LOCKED_USER_ACTION } from "../../../adapters/shared/session-lock.mjs";
 import { profileProcessPids } from "./validation-process-ownership.js";
@@ -666,6 +667,7 @@ async function launchLockedValidationBrowser(options) {
   fs.mkdirSync(validationProfileRoot, { recursive: true });
   fs.mkdirSync(validationArtifactsRoot, { recursive: true });
   assertNoQuarantinedValidationProfiles(validationProfileRoot);
+  recordExtensionConsoleLaunch(options.projectRoot);
   await stopOwnedCdpListener(options.cdpPort, [
     validationRuntimePath,
     path.join(options.projectRoot, recipeRuntimeDir())

package/dist/adapters/mobile/launch.js

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import path from "node:path";
 import { recipeRuntimePath, EXIT, str, writeInteractiveProgress } from "@farmslot/recipe-cli/harness";
 import { applyDeviceTargeting } from "../../commands/device-target.js";
 import { launchMobile } from "../../commands/launch/mobile.js";
@@ -49,6 +50,14 @@ function metroLaunchEvidence(target) {
     if (descriptor !== void 0) fs.closeSync(descriptor);
   }
 }
+function recordMobileConsoleLaunch(target) {
+  const file = recipeRuntimePath(target, "app-console.launch.json");
+  const launchedAtMs = Date.now();
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify({ launchedAtMs, recordedAt: new Date(launchedAtMs).toISOString() })}
+`);
+}
+const markedLaunches = /* @__PURE__ */ new WeakSet();
 const mobileLaunchProfile = {
   refuseFlags({ platformTarget }) {
     if (!platformTarget) {
@@ -104,7 +113,14 @@ const mobileLaunchProfile = {
   },
   nativeInputs: ["ios", "android", "package.json", "yarn.lock"],
   rebuildCommand: ({ platformTarget }) => `mm-harness launch ${platformTarget} --build`,
-  compose: ({ target, platformTarget, machine, remoteFlagRequest }, tier, restartApp, clearMetro) => launchMobile(target, platformTarget, tier, machine, restartApp, clearMetro, remoteFlagRequest?.flags),
+  compose: (launch, tier, restartApp, clearMetro) => {
+    const { target, platformTarget, machine, remoteFlagRequest } = launch;
+    if (restartApp || !markedLaunches.has(launch)) {
+      markedLaunches.add(launch);
+      recordMobileConsoleLaunch(target);
+    }
+    return launchMobile(target, platformTarget, tier, machine, restartApp, clearMetro, remoteFlagRequest?.flags);
+  },
   classify(_launch, output) {
     if (output.includes("open-device: Android device is locked.")) {
       return {
@@ -187,5 +203,6 @@ const mobileLaunchProfile = {
   evidence: metroLaunchEvidence
 };
 export {
-  mobileLaunchProfile
+  mobileLaunchProfile,
+  recordMobileConsoleLaunch
 };

package/dist/adapters/mobile/provision.js

@@ -4,7 +4,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { resolveSlotPortsByRepo } from "../../../adapters/shared/resolve-slot-ports-core.mjs";
+import { ownsRuntimeContext, resolveSlotPortsByRepo } from "../../../adapters/shared/resolve-slot-ports-core.mjs";
 const RUNWAY_IOS_METADATA = {
   artifactName: "ios-app-main-dev-expo",
   workflow: "expo-dev-build.yml",
@@ -177,8 +177,10 @@ function fail(target, platform, code, message, rerunCommand, slot) {
   };
 }
 function readSlotContext(target, runtimeDir) {
+  const envContext = process.env.RECIPE_RUNTIME_CONTEXT;
   const candidates = [
-    process.env.RECIPE_RUNTIME_CONTEXT,
+    // Another checkout's context would name its slot and simulator.
+    envContext && ownsRuntimeContext(envContext, target) ? envContext : void 0,
     runtimeContextPath(target, runtimeDir),
     path.join(target, recipeRuntimeDir(), "agentic-runtime.json"),
     path.join(target, "temp/recipe/runtime/agentic-runtime.json"),

package/dist/adapters/mobile/run.js

@@ -57,7 +57,8 @@ const mobileRun = {
     // matches its target against it.
     RECIPE_RN_EXPLICIT_PLATFORM: process.env.RECIPE_RN_EXPLICIT_PLATFORM
   }),
-  // An installed release artifact is opaque: no harness HUD inside it.
+  // An installed release artifact is opaque: it has no dev bridge and no
+  // AgentStepHud, so there is nothing to draw the HUD with.
   autoHud: () => process.env.METAMASK_RECIPE_MOBILE_OPAQUE_RUNTIME !== "1",
   // Always clear a HUD step the engine left on-device (a failed run strands
   // the FAIL banner). Best-effort — never masks the run's real outcome.

package/dist/adapters/mobile/verify.js

@@ -4,7 +4,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { runnerDir } from "../../paths.js";
-const USAGE = "Usage: mm-harness verify --adapter mobile -- [--target <metamask-mobile>] [--artifacts-dir <dir>] [--static-only] [--platform ios|android] [--preflight-mode fast|auto|default|rebuild-native|clean] [--no-auto-start]";
+const USAGE = "Usage: mm-harness verify --adapter mobile -- [--target <metamask-mobile>] [--artifacts-dir <dir>] [--static-only] [--platform ios|android] [--watcher-port <port>] [--preflight-mode fast|auto|default|rebuild-native|clean] [--no-auto-start]";
 const ENV_FILES = [".js.env", ".env", ".env.local"];
 const PREFLIGHT_MODES = ["fast", "auto", "default", "rebuild-native", "clean"];
 const AUTO_START_TRUE = ["1", "true", "TRUE", "True", "yes", "YES", "Yes", "on", "ON", "On"];
@@ -36,6 +36,7 @@ function parseMobileVerifyArgs(argv, env = process.env) {
   let platform = env.RECIPE_HARNESS_PLATFORM || env.PLATFORM || "ios";
   let preflightMode = env.RECIPE_HARNESS_MOBILE_PREFLIGHT_MODE || "fast";
   let autoStart = env.RECIPE_HARNESS_MOBILE_AUTO_START ?? "false";
+  let watcherPort;
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     const needsValue = () => {
@@ -65,6 +66,12 @@ function parseMobileVerifyArgs(argv, env = process.env) {
         platform = value;
         break;
       }
+      case "--watcher-port": {
+        const value = needsValue();
+        if (value === void 0) return { kind: "error", message: "Missing value for --watcher-port", exitCode: 2 };
+        watcherPort = value;
+        break;
+      }
       case "--preflight-mode": {
         const value = needsValue();
         if (value === void 0) return { kind: "error", message: "Missing value for --preflight-mode", exitCode: 2 };
@@ -101,7 +108,8 @@ function parseMobileVerifyArgs(argv, env = process.env) {
       staticOnly,
       platform,
       preflightMode,
-      autoStart: AUTO_START_TRUE.includes(autoStart)
+      autoStart: AUTO_START_TRUE.includes(autoStart),
+      ...watcherPort === void 0 ? {} : { watcherPort }
     }
   };
 }
@@ -141,8 +149,8 @@ function buildMobileVerifySummary(input) {
     generatedAt: input.generatedAt
   };
 }
-function resolveWatcherPort(target, env = process.env) {
-  const explicit = env.WATCHER_PORT || "";
+function resolveWatcherPort(target, env = process.env, flag) {
+  const explicit = flag || env.RECIPE_WATCHER_PORT || env.WATCHER_PORT || "";
   if (explicit) return explicit;
   for (const file of ENV_FILES) {
     const full = path.join(target, file);
@@ -299,7 +307,7 @@ async function runMobileVerify(argv, io = defaultIo) {
     io.err(parsed.message);
     return parsed.exitCode;
   }
-  const { staticOnly, platform, preflightMode, autoStart } = parsed.options;
+  const { staticOnly, platform, preflightMode, autoStart, watcherPort } = parsed.options;
   const target = path.resolve(parsed.options.target);
   if (!fs.existsSync(target)) {
     io.err(`Refusing mobile verify: target checkout does not exist: ${target}`);
@@ -344,9 +352,9 @@ async function runMobileVerify(argv, io = defaultIo) {
   let fixtureStatus = null;
   let portHolder = null;
   if (!staticOnly) {
-    const port = resolveWatcherPort(target);
+    const port = resolveWatcherPort(target, process.env, watcherPort);
     if (!isNumericWatcherPort(port)) {
-      io.err(`Refusing mobile verify: resolved watcher port is not numeric: '${port}' (check WATCHER_PORT)`);
+      io.err(`Refusing mobile verify: resolved watcher port is not numeric: '${port}' (check --watcher-port, RECIPE_WATCHER_PORT or WATCHER_PORT)`);
       return 2;
     }
     let deviceTarget = mobileDeviceTarget(target, platform, process.env);

package/dist/adapters/web-dapp/actions.js

@@ -9,7 +9,7 @@ const webDappActions = {
     "app.performance_assert"
   ],
   cdpTarget: { transport: "chrome-cdp", probePath: "json/version" },
-  ui: (harness, { hudPolicy }) => ({
+  ui: (harness) => ({
     base: harness.createCdpWebUiTransport({
       async withPage(input, callback) {
         const { withAppPage } = await import("../../../library/actions/web-dapp/platform/page.mjs");
@@ -30,14 +30,16 @@ const webDappActions = {
     async execute(action, node, context, standard) {
       if (action === "app.hud") {
         const { showAppHud } = await import("../../../library/actions/web-dapp/platform/hud.mjs");
-        return showAppHud(
-          { action, node, context: { nodeId: context.nodeId, projectRoot: context.projectRoot } },
-          { hudPolicy }
-        );
+        return showAppHud({ action, node, context: { nodeId: context.nodeId, projectRoot: context.projectRoot } });
       }
       return standard();
     }
   }),
+  // Deletes hud.json (the wallet host redraws from it) and the HUD on the app tabs.
+  async clearHud(projectRoot) {
+    const { showAppHud } = await import("../../../library/actions/web-dapp/platform/hud.mjs");
+    await showAppHud({ node: { clear: true }, context: { nodeId: "hud-clear", projectRoot } });
+  },
   // ensure_positions and ensure_orders with an open or present state place an order.
   inputFindings: (nodeId, node) => perpsOrderInputFindings(nodeId, node, { ensureChecksOnly: false })
 };

package/dist/adapters.js

@@ -90,7 +90,9 @@ const LIVE_ONLY_APP_ACTIONS = /* @__PURE__ */ new Set([
   "app.network_capture",
   "app.network_assert",
   "app.performance_capture",
-  "app.performance_assert"
+  "app.performance_assert",
+  // Proves a capture of the running app; a static result would pass on no evidence.
+  "metamask.app.assert_no_console_errors"
 ]);
 function requiresLiveAdapter(platform, action) {
   return LIVE_ONLY_ACTIONS.has(action) || Boolean(getAdapterSurface(platform).actions.liveOnly?.includes(action)) || LIVE_ONLY_WALLET_ACTIONS.has(action) || LIVE_ONLY_FEATURE_FLAG_ACTIONS.has(action) || LIVE_ONLY_APP_ACTIONS.has(action);
@@ -290,7 +292,7 @@ function createMetaMaskSemanticAdapters(platform, declaredCustomActions = [], pr
     )
   );
 }
-function createMetaMaskUiTransport(platform, harness, preparedLiveAdapters, { hudPolicy = "auto" } = {}) {
+function createMetaMaskUiTransport(platform, harness, preparedLiveAdapters) {
   const ui = getAdapterSurface(platform).actions.ui;
   if (!ui) {
     return {
@@ -301,7 +303,7 @@ function createMetaMaskUiTransport(platform, harness, preparedLiveAdapters, { hu
       }
     };
   }
-  const { base, execute } = ui(harness, { hudPolicy });
+  const { base, execute } = ui(harness, { hudPolicy: "show" });
   async function standard(action, node, context) {
     if (action === "ui.navigate") {
       const live = await runLiveFirst(