@deeeed/metamask-harness 0.84.0 → 0.86.0

package/library/actions/shared/console-assert.mjs

@@ -0,0 +1,174 @@
+// What every adapter's metamask.app.assert_no_console_errors shares: reading
+// a capture file from a launch mark, the launch window by the events' own
+// timestamps, the allowlist roots, judging the records and the two failures
+// (unallowlisted errors, capture not proven). Each adapter's action proves its
+// own capture and window, then calls these.
+
+import { closeSync, fstatSync, openSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+
+import {
+  allowlistMatch,
+  classifyConsoleRecord,
+  consoleRecords,
+  libraryRootsFromEnv,
+  loadConsoleAllowlist,
+  recordStamp,
+  withBundledLibraryRoot,
+} from './console-findings.mjs';
+
+// The capture from a recorded offset. A file now shorter than the offset, or
+// a different file, was replaced since: read it whole and say so, rather than
+// reading nothing.
+export function readFrom(file, mark) {
+  let fd;
+  try {
+    fd = openSync(file, 'r');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { text: '', reset: false };
+    throw error;
+  }
+  try {
+    // One open file: its size and inode are those of the content read.
+    const stat = fstatSync(fd);
+    const offset = Number(mark.offset ?? 0);
+    const reset = offset > stat.size || (mark.inode != null && mark.inode !== stat.ino);
+    return { text: readFileSync(fd).subarray(reset ? 0 : offset).toString('utf8'), reset };
+  } finally {
+    closeSync(fd);
+  }
+}
+
+// The mark a launch records before it can restart the app or browser, for
+// since "launch": { launchedAtMs, ... }. Without one the window is unknown, so the capture is
+// unproven.
+export function readLaunchMark(file, unavailable) {
+  const name = path.basename(file);
+  let text;
+  try {
+    text = readFileSync(file, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') throw unavailable(`no launch mark (${name}) for since: "launch"; relaunch with mm-harness launch, or set since: "start-of-log"`);
+    throw error;
+  }
+  let mark;
+  try {
+    mark = JSON.parse(text);
+  } catch (error) {
+    throw unavailable(`unreadable launch mark ${name} (${error.message}); relaunch with mm-harness launch`);
+  }
+  if (!Number.isFinite(mark?.launchedAtMs)) throw unavailable(`launch mark ${name} has no launch time; relaunch with mm-harness launch`);
+  return mark;
+}
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+// How far a stamp may still show ahead of `now` once the device clock offset
+// is applied (bridge latency, clock drift during the check).
+const SKEW_MS = 5 * 60 * 1000;
+
+function clockMs(clock) {
+  const [hours, minutes, seconds] = clock.split(':').map(Number);
+  return Math.round(((hours * 60 + minutes) * 60 + seconds) * 1000);
+}
+
+// The instant a time of day stands for when it is known to be close to `ref`:
+// the one within 12 hours of it.
+export function nearestInstant(clock, ref) {
+  const instant = ref - (ref % DAY_MS) + clockMs(clock);
+  if (instant - ref > DAY_MS / 2) return instant - DAY_MS;
+  if (ref - instant > DAY_MS / 2) return instant + DAY_MS;
+  return instant;
+}
+
+// The instant a record's UTC time of day stands for: the latest one not after
+// `now` (plus skew), since a logged event cannot be in the future. Captures
+// stamp only the time of day, so a stamp from before UTC midnight, or from an
+// app or browser console that outlived the launch by up to a day, reads as the
+// earlier day and falls before the launch. An event a whole day or more older
+// whose time of day falls between the launch and now still reads as inside
+// the window: it fails the check, never passes it.
+export function stampInstant(clock, now) {
+  const cutoff = now + SKEW_MS;
+  const instant = cutoff - (cutoff % DAY_MS) + clockMs(clock);
+  return instant > cutoff ? instant - DAY_MS : instant;
+}
+
+// Which records a window keeps: with sinceMs, none stamped (by the event's own
+// time) before it, the replay of an app or browser console that outlived the
+// launch; with device, no forwarder record from another device. Stamps come
+// from the device's clock, whose offset from the host's (device minus host)
+// is known only within [offset.min, offset.max]: the launch moves onto it by
+// the least offset and `now` by the greatest, so neither bound can drop a
+// fresh record. A record without a stamp stays.
+export function inWindow({ sinceMs = null, device = null, now = Date.now(), offset = { min: 0, max: 0 } }) {
+  return (record) => {
+    const stamp = recordStamp(record);
+    if (!stamp) return true;
+    if (device !== null && stamp.device !== null && stamp.device !== device) return false;
+    return sinceMs === null || stampInstant(stamp.clock, now + offset.max) >= sinceMs + offset.min;
+  };
+}
+
+// The action's own verdict (findings, or an unproven capture), not a crash.
+// The runner reports its message alone, so a run's trace shows the list rather
+// than a stack; anything else still surfaces with its stack.
+function verdict(message) {
+  return Object.assign(new Error(message), { verdict: true });
+}
+
+export function captureUnavailable(detail, subject = 'The app console') {
+  return verdict(`console capture unavailable: ${detail}. ${subject} was not proven to be captured, so its absence of errors proves nothing.`);
+}
+
+// Run an action entrypoint; a verdict fails it with its message only.
+export async function reportVerdict(run) {
+  try {
+    await run();
+  } catch (error) {
+    if (!error?.verdict) throw error;
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  }
+}
+
+export function consoleLevels(node) {
+  return new Set(Array.isArray(node.levels) && node.levels.length ? node.levels.map(String) : ['error', 'exception']);
+}
+
+// The bundled library's allowlist, then RECIPE_LIBRARY_PATH's, then the
+// node's allowlist_root.
+export function nodeAllowlist(node, env) {
+  const extra = typeof node.allowlist_root === 'string' ? [node.allowlist_root] : [];
+  return loadConsoleAllowlist(withBundledLibraryRoot([...libraryRootsFromEnv(env), ...extra]));
+}
+
+// Findings in the captured texts' records the window keeps, at the requested
+// levels (and accepted sources), grouped by signature and split by the
+// allowlist.
+export function judgeConsole(texts, { levels, allowlist, accept = () => true, keep = () => true }) {
+  const failing = new Map();
+  const allowlisted = new Map();
+  for (const text of texts) {
+    for (const record of consoleRecords(text)) {
+      if (!keep(record)) continue;
+      const finding = classifyConsoleRecord(record);
+      if (!finding || !levels.has(finding.level) || !accept(finding)) continue;
+      const match = allowlistMatch(finding, allowlist);
+      const bucket = match ? allowlisted : failing;
+      const key = `${finding.level}|${finding.source}|${finding.signature}`;
+      const entry = bucket.get(key) ?? { level: finding.level, source: finding.source, signature: finding.signature, example: finding.message, firstFrame: finding.firstFrame, count: 0, ...(match ? { reason: match.reason } : {}) };
+      entry.count += 1;
+      bucket.set(key, entry);
+    }
+  }
+  return { findings: [...failing.values()], allowlisted: [...allowlisted.values()] };
+}
+
+export function throwOnFindings(findings, allowlistProblems = []) {
+  if (findings.length === 0) return;
+  const list = findings.map((item) => `${item.level} [${item.source}] ${item.example} ×${item.count}`).join('\n  ');
+  // An entry the allowlist rejected may be the one meant to cover a finding.
+  const problems = allowlistProblems.length ? `\nallowlist entries not applied:\n  ${allowlistProblems.join('\n  ')}` : '';
+  throw verdict(`console errors not on the allowlist:\n  ${list}${problems}`);
+}

package/library/actions/shared/console-collector.mjs

@@ -142,7 +142,7 @@ function originOf(url) {
   }
 }
 
-function fileSize(file) {
+export function fileSize(file) {
   try {
     return statSync(file).size;
   } catch {
@@ -214,15 +214,22 @@ export async function verifyCapture({ cdpPort, log, target: kind = 'page', appOr
   } catch (error) {
     return { ok: false, detail: `could not log the capture control line in the ${label} (${error.message})` };
   }
+  if (await controlLineReached(log, start, nonce, timeoutMs)) return { ok: true, detail: `control line from the ${label} reached ${path.basename(log)}` };
+  return { ok: false, detail: `the capture control line logged in the ${label} did not reach ${log} within ${timeoutMs}ms` };
+}
+
+// Does the control line carrying `nonce` reach `log`, past byte `start`,
+// within timeoutMs?
+export async function controlLineReached(log, start, nonce, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     if (existsSync(log)) {
       const text = readFileSync(log);
-      if (text.subarray(Math.min(start, text.length)).includes(nonce)) return { ok: true, detail: `control line from the ${label} reached ${path.basename(log)}` };
+      if (text.subarray(Math.min(start, text.length)).includes(nonce)) return true;
     }
     await new Promise((resolve) => setTimeout(resolve, 200));
   }
-  return { ok: false, detail: `the capture control line logged in the ${label} did not reach ${log} within ${timeoutMs}ms` };
+  return false;
 }
 
 export function verifyPageCapture({ cdpPort, pageLog, appOrigin, timeoutMs }) {

package/library/actions/shared/console-findings.mjs

@@ -4,16 +4,18 @@
 // allowlist generator, and the recipe library's checks/console-guard.mjs
 // (which imports this file), so every caller judges an event the same way.
 //
-// Captures: console-tail.mjs logs (a "HH:MM:SS [label] [browser:<source>]
+// Captures: console-tail.mjs logs (a "HH:MM:SS.mmm [label] [browser:<source>]
 // LEVEL  text  (at [fn ]location)" record, the browser tag only on browser
 // Log entries, plus "│ "-prefixed continuation lines), Metro or
-// webpack logs (one line per record), and JSONL captures from a CDP watcher
+// webpack logs and the Mobile console forwarder's app-console.log (one line
+// per record), and JSONL captures from a CDP watcher
 // ({ kind: "console" | "exception" | "log", level, text, source | url }).
 //
-// Allowlist files: <recipe library>/diagnostics/console-allowlist.json
+// Allowlist files: <recipe library>/diagnostics/console-allowlist.json; this
+// package's own library (BUNDLED_LIBRARY_ROOT) is always read first.
 //   { "schemaVersion": 3,
 //     "entries": [{ "signature": "<sig of the first line>", "continuation": "<sig of the rest>",
-//                   "first_frame": "<sig of the location>", "source": "page|extension|browser|any",
+//                   "first_frame": "<sig of the location>", "source": "page|extension|browser|app|any",
 //                   "reason": "<why it is noise>", "temporary": true }] }
 // An entry matches one event (a first line and every line that continues it)
 // by string equality of each part, no patterns:
@@ -38,12 +40,13 @@
 
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 export const ALLOWLIST_RELATIVE_PATH = path.join('diagnostics', 'console-allowlist.json');
 // Requests the harness itself makes (the launch probe of the mainnet block).
 export const HARNESS_PROBE_MARK = 'mm-harness-probe=1';
 const HARNESS_PROBE_PARAM = 'mm-harness-probe';
-const SOURCES = new Set(['page', 'extension', 'browser', 'any']);
+const SOURCES = new Set(['page', 'extension', 'browser', 'app', 'any']);
 const SEVERITY = ['warning', 'error', 'exception'];
 
 // ---- severity -------------------------------------------------------------
@@ -212,6 +215,10 @@ function frameLocation(where) {
 }
 
 const RECORD_START = /^\d{2}:\d{2}:\d{2}(?:\.\d+)?\s+\[[^\]]+\]/u;
+// The adapter-rn console forwarder's " LEVEL  HH:MM:SS.mmm [console:<device>] "
+// head (Mobile app-console.log): its time and device name are the forwarder's,
+// never part of the message.
+const FORWARDER_HEAD = /^[A-Z]+\s{2,}(\d{2}:\d{2}:\d{2}\.\d{3}) \[console:([^\]]+)\]\s+/u;
 // "HH:MM:SS [label] [browser:<Log source>] LEVEL  ": every field before the
 // message comes from the collector; the browser tag only ever here.
 const RECORD_HEAD = /^\d{2}:\d{2}:\d{2}(?:\.\d+)?\s+\[([^\]]+)\]\s+(?:\[browser:([a-z-]+)\]\s+)?(?:([A-Z]+)\s{2,})?/u;
@@ -253,6 +260,18 @@ export function consoleRecords(text) {
   return records;
 }
 
+// The time a record's head carries (the UTC time of day, HH:MM:SS[.mmm], of
+// the event's own timestamp, as console-tail and the Mobile forwarder write
+// it) and, for a forwarder record, its device; null for a record without
+// either head.
+export function recordStamp(record) {
+  const trimmed = String(record.line ?? '').trim();
+  const forwarded = FORWARDER_HEAD.exec(trimmed);
+  if (forwarded) return { clock: forwarded[1], device: forwarded[2] };
+  // A console-tail record starts with its time (RECORD_START).
+  return record.start ? { clock: /^[\d:.]+/u.exec(trimmed)[0], device: null } : null;
+}
+
 function labelSource(label) {
   if (label.startsWith('dapp:')) return 'page';
   if (label.startsWith('extension:') || label === 'sw' || label.startsWith('page:')) return 'extension';
@@ -278,8 +297,10 @@ export function recordEvent(record) {
     // No recorded level: Metro/webpack output, or an unframed line.
     level = worst(lineLevel(trimmed), record.unframed ? 'error' : null);
     source = 'app';
+    const forwarded = FORWARDER_HEAD.exec(trimmed);
     const marker = /\b(?:EXCEPTION|ERROR|WARN(?:ING)?)\s{2,}/u.exec(trimmed);
-    message = (marker ? trimmed.slice(marker.index + marker[0].length) : trimmed).trim();
+    if (forwarded) message = trimmed.slice(forwarded[0].length).trim();
+    else message = (marker ? trimmed.slice(marker.index + marker[0].length) : trimmed).trim();
     raw = message;
   }
   const suffix = LOCATION_SUFFIX.exec(message);
@@ -403,7 +424,7 @@ const ALLOWLIST_SCHEMA_VERSION = 3;
 export function entryProblem(entry) {
   if (!entry || typeof entry.signature !== 'string' || !entry.signature || typeof entry.continuation !== 'string' ||
     !SOURCES.has(entry.source ?? 'any') || typeof entry.reason !== 'string' || !entry.reason.trim()) {
-    return 'needs signature, continuation ("" for none), source (page|extension|browser|any) and reason';
+    return 'needs signature, continuation ("" for none), source (page|extension|browser|app|any) and reason';
   }
   if (entry.first_frame !== undefined && typeof entry.first_frame !== 'string') return 'first_frame must be a string';
   if (signature(entry.signature) !== entry.signature) return `signature is not normalised (expected ${JSON.stringify(signature(entry.signature))})`;
@@ -464,8 +485,78 @@ export function loadConsoleAllowlist(libraryRoots = []) {
 }
 
 // The first entry equal to the event (by source and key), or null.
+// Known noise that one exact allowlist entry cannot cover: logged in volume
+// with a varying name, or with a stack that names build-specific chunk files.
+// Matched by pattern on the event's signature; each rule says why it is not a
+// finding, like an allowlist entry, and applies before every allowlist. Like
+// an entry, a rule is only for an error reproduced on the app's base build.
+export const BUILTIN_CONSOLE_RULES = Object.freeze([
+  {
+    id: 'ses-lockdown-intrinsics',
+    source: 'app',
+    pattern: /^(?:SES Removing unpermitted intrinsics|Removing intrinsics\.\S+|Tolerating undeletable intrinsics\.\S+ === undefined)$/u,
+    reason: "SES lockdown in MetaMask Mobile's Hermes build reports, at error level on every cold start, each unpermitted intrinsic it removes and each it cannot delete (seen on unchanged main, metamask-mobile b513a4b).",
+    link: 'https://github.com/endojs/endo/blob/master/packages/ses/docs/lockdown.md',
+  },
+  {
+    // Its stack names build-specific chunk files, so an exact entry would
+    // match one build only: the rule matches the message and ignores the stack.
+    id: 'extension-bearer-token-while-locked',
+    source: 'extension',
+    pattern: /^Error: getBearerToken - unable to proceed, wallet is locked$/u,
+    anyContinuation: true,
+    reason: 'Background services ask AuthenticationController.getBearerToken for a token while the Extension starts locked. Reproduced on unchanged main (metamask-extension a6765b12, macpro-mme-5, same wallet fixture and selected account as the feature slot).',
+    link: 'https://github.com/MetaMask/metamask-extension/issues/46688',
+  },
+  {
+    // Its stack names build-specific chunks; the rule pins the react-query
+    // hydrate frame it throws in and the messenger dispatch that calls it.
+    id: 'extension-money-query-mutations',
+    source: 'extension',
+    pattern: /^TypeError: Cannot read properties of undefined \(reading 'mutations'\)$/u,
+    continuationPattern: /^at hydrate \([^\n]*\)(?:\n[^\n]*)*?\nat SafeEventEmitter\.routeMessengerEventNotification \(/u,
+    reason: "The Money query adapter's messenger event notification hydrates a query cache entry that is not there and reads `mutations` on undefined. Reproduced on unchanged main (metamask-extension a6765b12, macpro-mme-5); app bug tracked in TAT-4063.",
+  },
+  {
+    // The message carries the Metro bundle URL and line, which change with
+    // every JS build; the rule pins the message and the failing function, in
+    // the Hermes form (?anon_<n>_name) the dev build logs. Another naming form
+    // does not match, so it fails rather than passes.
+    id: 'mobile-notifications-onchain-triggers',
+    source: 'app',
+    pattern: /^Failed to create On Chain triggers \{ message: "Failed to read wallet-activity subscriptions", stack: "Error: Failed to read wallet-activity subscriptions\\n {4}at \?anon_\d+_createOnChainTriggers \(/u,
+    reason: 'Mobile notifications fail on startup: createOnChainTriggers cannot read the wallet-activity subscriptions. Reproduced on unchanged main (metamask-mobile b513a4b, macpro-mm-4, same wallet fixture and selected account as the feature slot).',
+  },
+  {
+    id: 'mobile-notifications-enable',
+    source: 'app',
+    pattern: /^Unable to enable notifications \{ message: "Failed to create On Chain triggers", stack: "Error: Failed to create On Chain triggers\\n {4}at \?anon_\d+_createOnChainTriggers \(/u,
+    reason: 'Mobile notifications fail on startup: enabling them reports the createOnChainTriggers failure above. Reproduced on unchanged main (metamask-mobile b513a4b, macpro-mm-4).',
+  },
+].map((rule, index) => Object.freeze({ ...rule, file: 'builtin', index })));
+
+// A rule's match carries the event's key like an allowlist entry does, one
+// object per rule and key, so matches of the same event count together.
+const builtinMatches = new Map();
+
+function builtinRule(event) {
+  const { key } = event;
+  const rule = BUILTIN_CONSOLE_RULES.find((candidate) =>
+    candidate.source === event.source && candidate.pattern.test(key.signature) &&
+    (candidate.continuationPattern ? candidate.continuationPattern.test(key.continuation)
+      : candidate.anyContinuation || key.continuation === ''));
+  if (!rule) return null;
+  const id = `${rule.index}\n${key.signature}\n${key.continuation}\n${key.first_frame}`;
+  if (!builtinMatches.has(id)) {
+    builtinMatches.set(id, Object.freeze({ ...rule, signature: key.signature, continuation: key.continuation, first_frame: key.first_frame }));
+  }
+  return builtinMatches.get(id);
+}
+
 export function matchEntry(event, entries) {
   const { key } = event;
+  const rule = builtinRule(event);
+  if (rule) return rule;
   return entries.find((entry) =>
     (entry.source === 'any' || entry.source === event.source) &&
     entry.signature === key.signature &&
@@ -502,6 +593,16 @@ export function entryFor(event) {
 }
 export const allowlistEntryFor = entryFor;
 
+// This package's recipe library. Its diagnostics/console-allowlist.json holds
+// known MetaMask noise and applies ahead of every other library's.
+export const BUNDLED_LIBRARY_ROOT = path.resolve(fileURLToPath(new URL('../../', import.meta.url)));
+
+// The allowlist roots to load: the bundled library first, then `roots`, each
+// directory once.
+export function withBundledLibraryRoot(roots = []) {
+  return [...new Set([BUNDLED_LIBRARY_ROOT, ...roots].map((root) => path.resolve(root)))];
+}
+
 // RECIPE_LIBRARY_PATH: "name=/path:name=/path" (or bare paths).
 export function libraryRootsFromEnv(env = process.env) {
   return String(env.RECIPE_LIBRARY_PATH ?? '')

package/library/actions/web-dapp/app/assert_no_console_errors.mjs

@@ -9,52 +9,21 @@
 // or MetaMask for the extension source) must reach that file; otherwise the
 // action fails as unavailable.
 
-import { closeSync, fstatSync, openSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 
-import {
-  allowlistMatch,
-  classifyConsoleRecord,
-  consoleRecords,
-  libraryRootsFromEnv,
-  loadConsoleAllowlist,
-} from '../../shared/console-findings.mjs';
+import { captureUnavailable, consoleLevels, judgeConsole, nodeAllowlist, readFrom, throwOnFindings } from '../../shared/console-assert.mjs';
 import { collectorOwnerMarker, collectorStatus, verifyCapture } from '../../shared/console-collector.mjs';
 import { isDirectRun, readBrowserState, runAdapter, webDappPolicy, webDappRuntimeDir } from '../platform/runtime.mjs';
 
 const LOGS = Object.freeze({ page: 'app-console.log', extension: 'extension-console.log' });
 
-// The capture from a recorded offset. A file now shorter than the offset, or
-// a different file, was replaced since: read it whole and say so, rather than
-// reading nothing.
-function readFrom(file, mark) {
-  let fd;
-  try {
-    fd = openSync(file, 'r');
-  } catch (error) {
-    if (error?.code === 'ENOENT') return { text: '', reset: false };
-    throw error;
-  }
-  try {
-    // One open file: its size and inode are those of the content read.
-    const stat = fstatSync(fd);
-    const offset = Number(mark.offset ?? 0);
-    const reset = offset > stat.size || (mark.inode != null && mark.inode !== stat.ino);
-    return { text: readFileSync(fd).subarray(reset ? 0 : offset).toString('utf8'), reset };
-  } finally {
-    closeSync(fd);
-  }
-}
-
-function unavailable(detail) {
-  return new Error(`console capture unavailable: ${detail}. The page console was not proven to be captured, so its absence of errors proves nothing.`);
-}
+const unavailable = (detail) => captureUnavailable(detail, 'The page console');
 
 export async function assertNoConsoleErrors(input, env = process.env, deps = {}) {
   const node = input.node ?? {};
   const projectRoot = input.context?.projectRoot;
   const sources = Array.isArray(node.sources) && node.sources.length ? node.sources.map(String) : ['page', 'browser'];
-  const levels = new Set(Array.isArray(node.levels) && node.levels.length ? node.levels.map(String) : ['error', 'exception']);
+  const levels = consoleLevels(node);
   const runtime = webDappRuntimeDir(projectRoot);
   const state = await readBrowserState(projectRoot);
   if (!state?.cdpPort || !state.appOrigin) throw unavailable('no slot browser state (browser.json)');
@@ -77,31 +46,21 @@ export async function assertNoConsoleErrors(input, env = process.env, deps = {})
     control[file] = result.detail;
   }
   const offsets = node.since === 'start-of-log' ? {} : state?.consoleOffsets ?? {};
-  const roots = [...libraryRootsFromEnv(env), ...(typeof node.allowlist_root === 'string' ? [node.allowlist_root] : [])];
-  const allowlist = loadConsoleAllowlist(roots);
-  const failing = new Map();
-  const allowlisted = new Map();
+  const allowlist = nodeAllowlist(node, env);
+  const texts = [];
   const offsetResets = [];
   for (const file of files) {
     const { text, reset } = readFrom(path.join(runtime, LOGS[file]), { offset: offsets[file] ?? 0, inode: offsets.inodes?.[file] });
     if (reset) offsetResets.push(file);
-    for (const record of consoleRecords(text)) {
-      const finding = classifyConsoleRecord(record);
-      if (!finding || !levels.has(finding.level) || !sources.includes(finding.source)) continue;
-      const match = allowlistMatch(finding, allowlist);
-      const bucket = match ? allowlisted : failing;
-      const key = `${finding.level}|${finding.source}|${finding.signature}`;
-      const entry = bucket.get(key) ?? { level: finding.level, source: finding.source, signature: finding.signature, example: finding.message, firstFrame: finding.firstFrame, count: 0, ...(match ? { reason: match.reason } : {}) };
-      entry.count += 1;
-      bucket.set(key, entry);
-    }
+    texts.push(text);
   }
+  const { findings, allowlisted } = judgeConsole(texts, { levels, allowlist, accept: (finding) => sources.includes(finding.source) });
   const output = {
     action: input.action,
     sources,
     levels: [...levels],
-    findings: [...failing.values()],
-    allowlisted: [...allowlisted.values()],
+    findings,
+    allowlisted,
     allowlistProblems: allowlist.problems,
     capture: { collector: capture.detail, control },
     // The recorded launch offset was past the end of a replaced capture
@@ -109,10 +68,7 @@ export async function assertNoConsoleErrors(input, env = process.env, deps = {})
     offsetResets,
     proofPath: `${webDappPolicy().adapterId}-console-capture`,
   };
-  if (failing.size > 0) {
-    const list = [...failing.values()].map((item) => `${item.level} [${item.source}] ${item.example} ×${item.count}`).join('\n  ');
-    throw new Error(`console errors not on the allowlist:\n  ${list}`);
-  }
+  throwOnFindings(findings, allowlist.problems);
   return output;
 }
 

package/library/actions/web-dapp/platform/hud.mjs

@@ -9,13 +9,6 @@ import { clearHudState, hudRenderExpression, nextHudState, readHudState, writeHu
 import { appOrigin, cdpPort, readBrowserState, webDappRuntimeDir } from './runtime.mjs';
 import { importRecipeHarnessRuntimeCdp } from '../../harness-exports.mjs';
 
-// --hud show draws in any mode; --hud auto (the default) only for a visible
-// browser. --hud hide never reaches this handler.
-export function hudVisible(policy, browserState) {
-  if (policy === 'show') return true;
-  return browserState?.browser?.headless !== true;
-}
-
 // Every CDP step is bounded: a busy tab must never stall the recipe.
 export function withDeadline(promise, timeoutMs, label) {
   let timer;
@@ -47,13 +40,13 @@ async function drawOnAppTabs(input, expression, timeoutMs = 3000) {
   return results;
 }
 
-export async function showAppHud(input, { hudPolicy = 'auto' } = {}) {
+// The HUD draws in a headless browser too; --hud hide never reaches this handler.
+export async function showAppHud(input) {
   const node = input.node ?? {};
   const projectRoot = input.context?.projectRoot;
   const nodeId = input.context?.nodeId ?? '';
   const browserState = projectRoot ? await readBrowserState(projectRoot) : null;
   if (!browserState) return { hud: false, skipped: true, reason: 'no slot browser yet' };
-  if (!hudVisible(hudPolicy, browserState)) return { hud: false, skipped: true, reason: 'headless browser (--hud show draws anyway)' };
   const runtimeDir = webDappRuntimeDir(projectRoot);
   let state = null;
   if (node.clear === true) {

package/library/actions/web-dapp/platform/page.mjs

@@ -9,8 +9,8 @@
 import { isAppUrl } from '@farmslot/adapter-web/origin';
 import { cdpListenerPids } from '@farmslot/adapter-web/web-dapp';
 
-import { HUD_ELEMENT, resolveSlowMo } from './adapter-web-lib.mjs';
-import { appOrigin, cdpPort, readBrowserState } from './runtime.mjs';
+import { readHudState, resolveSlowMo } from './adapter-web-lib.mjs';
+import { appOrigin, cdpPort, readBrowserState, webDappRuntimeDir } from './runtime.mjs';
 import { importRecipeHarnessRuntimeCdp } from '../../harness-exports.mjs';
 
 const { CdpSession, CdpWebPage, listCdpTargets, sleep } = await importRecipeHarnessRuntimeCdp();
@@ -72,32 +72,78 @@ export async function selectAppTarget(input) {
 // MetaMask pages run under LavaMoat scuttling, so main-world helpers (timers in
 // wait loops) are unavailable there; evaluate in an isolated world that shares
 // the DOM instead.
+//
+// A wallet screenshot carries the running recipe's HUD too: hud.json's current
+// step is drawn on the MetaMask page for the capture only, then removed. A
+// finished or absent state (--hud hide) draws nothing.
 class WalletSurfacePage extends CdpWebPage {
   evaluate(expression) {
     return this.evaluateInIsolatedWorld(expression, 'web-dapp-wallet-surface');
   }
-}
 
-// Number inputs ignore select(), so the generic setInput would append to a
-// prefilled value (the order form prefills the mid price). Clear the field with
-// the editor's selectAll command, as a user's Cmd+A would, type over the
-// selection and require the field to read back exactly that value.
-// Screenshots are evidence of the app, so the recipe HUD is hidden while one
-// is captured and shown again afterwards.
-export function hudVisibilityExpression(visible) {
-  return `(() => { const host = document.documentElement.querySelector(':scope > ${HUD_ELEMENT}'); if (!host) return false; host.style.visibility = ${JSON.stringify(visible ? '' : 'hidden')}; return true; })()`;
-}
-
-class AppPage extends CdpWebPage {
   async screenshot(context, relPath, metadata = {}) {
-    const hidden = await this.evaluate(hudVisibilityExpression(false)).catch(() => false);
+    const state = context?.projectRoot ? readHudState(webDappRuntimeDir(context.projectRoot)) : null;
+    const drawn = state?.current && !state.finished
+      ? await this.evaluate(walletHudExpression(state)).then((result) => result?.hud === true, () => false)
+      : false;
     try {
       return await super.screenshot(context, relPath, metadata);
     } finally {
-      if (hidden) await this.evaluate(hudVisibilityExpression(true)).catch(() => {});
+      if (drawn) await this.evaluate(walletHudExpression(null)).catch(() => {});
     }
   }
+}
 
+// The wallet-page HUD: a bar docked to the bottom edge that reserves its own
+// height (a spacer after the content and the body's bottom padding), as the
+// Extension's HUD does on MetaMask pages, so the request and its footer
+// buttons move up instead of being covered. Inert, aria-hidden, pointer-events
+// none. null removes it and restores the body padding.
+export const WALLET_HUD_ID = 'mm-harness-wallet-hud';
+
+export function walletHudExpression(state) {
+  const progress = state?.current?.progress;
+  const view = state ? {
+    badge: ['RUN', progress ? `${progress.current}/${progress.total}` : ''].filter(Boolean).join(' '),
+    intent: String(state.current?.intent ?? ''),
+  } : null;
+  return `(() => {
+    const view = ${JSON.stringify(view)};
+    const id = ${JSON.stringify(WALLET_HUD_ID)};
+    const old = document.getElementById(id);
+    if (old) {
+      document.body.style.paddingBottom = old.dataset.previousPadding || '';
+      old.remove();
+      document.getElementById(id + '-space')?.remove();
+    }
+    if (!view) return { hud: false, cleared: Boolean(old) };
+    const bar = document.createElement('div');
+    bar.id = id;
+    bar.setAttribute('aria-hidden', 'true');
+    bar.inert = true;
+    bar.dataset.previousPadding = document.body.style.paddingBottom;
+    Object.assign(bar.style, { position: 'fixed', left: '0', right: '0', bottom: '0', zIndex: '2147483647', pointerEvents: 'none', boxSizing: 'border-box', padding: '5px 8px', background: 'rgba(8, 10, 14, 0.9)', color: '#fff', font: '600 11px/1.3 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif', borderTop: '1px solid rgba(255,255,255,0.14)' });
+    const badge = document.createElement('span');
+    Object.assign(badge.style, { color: '#8ab4ff', fontSize: '9px', fontWeight: '800', marginRight: '6px' });
+    badge.textContent = view.badge;
+    bar.append(badge, view.intent);
+    document.body.append(bar);
+    const height = Math.ceil(bar.getBoundingClientRect().height);
+    const space = document.createElement('div');
+    space.id = id + '-space';
+    space.setAttribute('aria-hidden', 'true');
+    Object.assign(space.style, { display: 'block', height: height + 'px', pointerEvents: 'none' });
+    document.body.insertBefore(space, bar);
+    document.body.style.paddingBottom = height + 'px';
+    return { hud: true, docked: true, height };
+  })()`;
+}
+
+// Number inputs ignore select(), so the generic setInput would append to a
+// prefilled value (the order form prefills the mid price). Clear the field with
+// the editor's selectAll command, as a user's Cmd+A would, type over the
+// selection and require the field to read back exactly that value.
+class AppPage extends CdpWebPage {
   // A tab whose first load is still pending (a slow dev-server compile) has no
   // committed history entry yet; navigating away from it is still fine.
   async currentNavigationUrl() {

package/library/actions/web-dapp/platform/runtime.mjs

@@ -50,7 +50,7 @@ export async function runAdapter(callback) {
     const output = await callback(input);
     await writeFile(input.outputPath, `${JSON.stringify(output, null, 2)}\n`);
   } catch (error) {
-    process.stderr.write(`[${webDappAdapterId()}] ${input.action} failed: ${error?.stack ?? error}\n`);
+    process.stderr.write(`[${webDappAdapterId()}] ${input.action} failed: ${error?.verdict ? error.message : error?.stack ?? error}\n`);
     process.exitCode = 1;
   }
 }

package/library/diagnostics/console-allowlist.json

@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 3,
+  "entries": [
+    {
+      "signature": "Warning: Using UNSAFE_componentWillMount in strict mode is not recommended and may indicate bugs in your code. See https://reactjs.org/link/unsafe-component-lifecycles for details.",
+      "continuation": "* Move code with side effects to componentDidMount, and set initial state in the constructor.\nPlease update the following components: %s UnlockPageBase",
+      "first_frame": "chrome-extension://<extension>/vendor-node_modules_ra.js",
+      "source": "extension",
+      "reason": "React warns once per load that the Extension unlock page (UnlockPageBase) still uses UNSAFE_componentWillMount. Reproduced on unchanged main (metamask-extension a6765b12, macpro-mme-5, same wallet fixture and selected account as the feature slot).",
+      "link": "https://github.com/MetaMask/metamask-extension/blob/main/ui/pages/unlock-page/unlock-page.component.tsx"
+    }
+  ]
+}