@deeeed/metamask-harness 0.86.2 → 0.88.0

package/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 ## Unreleased
 
+## 0.88.0 - 2026-10-11
+
+### Added
+
+- Public `createProvider` and `providerHost` exports for shared recipe commands. The provider reuses MetaMask adapters and funding authorization, loads selected plugins from authorized libraries, and supplies run-owned mainnet cancellation and teardown for explicit runs through the existing abort helper. With the coordinated recipe-cli update, doctor, discovery and recipe previews validate funding policy without creating execution claims, artifact directories or mutation ledgers. Explicit execution still binds the funded plan. Run ownership uses `RECIPE_RUN_OWNER_PID`, preserving approval across invoking processes with the coordinated runner update.
+- Mainnet limit orders on Mobile and Extension `place_order`: Hyperliquid only, from `dev1` only, 1x isolated, at most $15 at the limit price (plus one size step), away from the live market price and sent post-only, with `network: mainnet`. Each one lasts one run: it is tracked before dispatch, and the run cancels whatever is still open when it ends, on success, failure or abort by signal (after a kill, the next run on the checkout), counting it gone only when the Hyperliquid API no longer lists it for the placing address, and writing order ID, cancel result and both reads to `<artifacts>/perps-mainnet-orders.json`. An order that cannot be proven cancelled, or that filled, fails the run with `PERPS_MAINNET_ORDER_LEFT_OPEN`. More than 1x or $15, another account, a `current_price` override, Core, and `ensure_*` opening state stay refused.
+- Extension `metamask.perps.set_network` (default `testnet`): `network=mainnet` switches Perps to mainnet for one run, and the run switches back to testnet at its end.
+
+### Changed
+
+- Pin the coordinated provider runtime: protocol 0.37.0, recipe-runner 0.28.5, recipe-cli 0.12.0, adapter-sdk 0.8.5, adapter-node 0.1.11, adapter-rn 0.19.9, adapter-web 0.6.9 and agent-runtime 0.17.5. Planning uses the read-only policy hook, and approval survives a new run owner while substantive inputs stay bound. Plan JSON now includes `executionPlan` and the `preflight.recipe` step; command context includes `runtimeConfigPath`. Human plans list resolved libraries and describe the artifact directory as "resolved at run time".
+- When capture interruption is the run's only failure, `run`/`call` report `CAPTURE_INTERRUPTED` as `retryable: true` with exit 4. The report links the partial video as "evidence incomplete (capture interrupted)", and proven acceptance criteria become `weak` with that note.
+- A Mobile recording that stopped mid-run but kept a partial video now fails as `CAPTURE_INTERRUPTED`, with the video published and its manifest entry's `interruption`. Previously, the run passed with `recorder.interrupted`. This covers capture-helper 0.3.1 on the emulator mirror and on-device screenrecord. With no video kept, capture-helper fails as `RECORDING_FAILED`; interrupted on-device screenrecord fails as `RECORDER_INTERRUPTED`.
+- `scripts/validate-release-report.mjs` requires `BLOCKED_ENVIRONMENT` and "evidence incomplete (capture interrupted)" when every cited run failed only on `CAPTURE_INTERRUPTED`. Retaining an interrupted attempt preserves a passing or product-failing retry's verdict.
+- On mainnet, `close_orders` cancels only orders the run placed, on Mobile and in the Extension's fixture-policy lane; any other order is refused before dispatch with `PERPS_MAINNET_ORDER_REFUSED`.
+
+### Fixed
+
+- Mobile launch readiness uses the shared adapter-rn matcher for physical Android bridge names. "Google Pixel 6a" matches the "Pixel 6a" device pin; whole-model boundaries and emulator rejection remain enforced. The published adapter-rn 0.19.7 dependency also applies this rule when checking the ready route.
+- Extension: a kept slot profile in which Chrome had disabled MetaMask (for example `disable_reasons: [16777216]`, `DISABLE_UNSUPPORTED_DEVELOPER_EXTENSION`, in `Default/Secure Preferences` on Chrome for Testing 147) no longer blocks every launch with `ERR_BLOCKED_BY_CLIENT`. `--load-extension` re-registers the build but keeps a persisted disable reason, so the launch now stops the profile's browser, clears the reason for the harness extension only (in `Preferences` and `Secure Preferences`, other extensions untouched) and logs the reasons it cleared. The reopen path (`ensure-browser.sh`) uses the same heal, which before rewrote only `Preferences` and re-enabled every extension. When readiness still finds MetaMask blocked, it names the reason (`MetaMask is disabled in the slot profile: DISABLE_UNSUPPORTED_DEVELOPER_EXTENSION`) instead of reporting a Chrome error page.
+
+## 0.87.0 - 2026-10-10
+
+### Changed
+
+- `--record-video=full-run` on a physical Android device records on the device with `adb shell screenrecord`, not a scrcpy window captured through capture-helper. macOS stopped the capture-helper stream whenever another capture-helper process exited (Farmslot's browser liveness check, `mm-harness doctor`, another slot's recording), so a Pixel 6a release run lost its full-run video with ScreenCaptureKit error -3805. screenrecord ends each file at 180 s: the recorder starts the next file as soon as one ends and joins them with ffmpeg, so a physical Android recording now needs ffmpeg at start (`FFMPEG_PATH` overrides). The roughly half-second gap at each restart is kept as a held frame, so video time stays on wall-clock time and the recording timeline stays tight; `videos/recipe-run.mp4.capture.json` lists each file's start, stop and offset. If the file being stopped at the end of the run fails (stopped while screenrecord was still starting), the earlier files are kept. Device files and pulled host files are removed and the device and host recorder processes stopped when the run ends, fails, or the harness gets SIGINT, SIGTERM or SIGHUP. The recipe HUD is drawn in the app, so it is in the video. Screens the app marks secure (FLAG_SECURE) record black, as with any capture of the device screen. Emulators keep the mirror. `METAMASK_RECIPE_MOBILE_ANDROID_RECORDER=screenrecord|mirror` forces either recorder (`mirror` keeps its single-file screenrecord fallback when the mirror is unavailable); any other value fails the run.
+- A Mobile recording that fails, or whose recorder cannot record when the run starts, now fails the run with a code. The `record.video` trace entry reads `RECORDING_FAILED: <cause>. The run has no video.` or, when capture stopped mid-run with nothing kept, `RECORDER_INTERRUPTED: <cause>. The run has no video.`, with `cause_class: "environment"`. Before, it carried the recorder's raw message (for capture-helper 0.3.0 an empty `capture-helper record failed (exit 1):`). A recording that stopped mid-run but kept a finalized partial file is published, and its manifest entry gains `recorder.interrupted` (`code: "RECORDER_INTERRUPTED"`, `cause`, and `coveredMs`, the video time up to the last captured frame, or `coverageUnavailableReason` when that cannot be measured); the run also prints a `WARN: RECORDER_INTERRUPTED` line. This covers capture-helper 0.3.1's `stream_interrupted` event on the emulator mirror (the MP4 and timing sidecar it finalized are kept; `cause` names the ScreenCaptureKit error, such as `SCStreamErrorDomain -3805`) and an on-device screenrecord that fails mid-run (the files finished before it are kept).
+- `mm-harness doctor`, `doctor --expect-live`, `--print-ready` and `doctor --fix` on Mobile check the recorder `run --record-video` would use for the selected device once the runtime is ready, and show it (`recorder` in `--json`, a `recorder:` line otherwise). A recorder that cannot record (no ffmpeg for on-device recording, capture-helper or scrcpy unusable with no fallback, simulator not booted) makes doctor report `ready: false` with that recorder's next step: `DOCTOR_CHECKS_FAILED` from `doctor`, `RECORDER_UNAVAILABLE` from `--expect-live --json`, `not-ready` from `--print-ready`, and `recorder` in `failed` from `--fix`. Before, doctor reported ready while every recording failed.
+
+### Fixed
+
+- `mm-harness run --plan` now rejects a `metamask.perps.start_state` node that combines a Mobile `trading_state` with a `positions`, `orders` or `strategies` request other than `false`, or whose `positions` or `orders` block opens a position or order without a market and side (on the node or in the block) and an `amount` or `notional` in the block. Unresolved templates are still checked at run time.
+- Extension `metamask.analytics.set_consent` reads marketing consent from `optedInToMarketing` when the state has no `dataCollectionForMarketing` (Extension 13.51+), so its readback no longer fails with "Extension consent state did not contain boolean consent fields before the deadline".
+- Extension `ui.navigate page=perps` names a Perps home still loading at the deadline, with loading markers listed first in its visible test IDs: "Perps home stayed on its loading view (perps-view-loading visible) within the <n>ms budget" and "Next: check the Perps stream/provider, or raise timeout_ms".
+- Mobile Perps `start_state` and `teardown_state` keep the setup budget apart from bridge command limits. Before, one deadline covered unlock, account, navigation and cleanup, and every nested bridge command could use all of what was left. On a physical Pixel 6a, a market-details to home navigation took about 18 s of a 30 s clean-market setup. Later commands were cut to slivers (`press-test-id` after 1258 ms, `eval-async` after 315 ms) or refused, and every one was reported as `CDP_TIMEOUT`, which reads as a bridge failure. Now each phase runs on its own deadline inside the setup budget. Navigation phases get a slice (`navigation_timeout_ms`), and each bridge command gets its own limit (`cdp_timeout_ms`, default 15 s) capped by the phase deadline. A phase that runs out fails as `DOMAIN_SETUP_DEADLINE`, with the phase, its elapsed time and limit, and the setup's elapsed time and limit. A bridge command its action deadline refused or stopped fails as `ACTION_DEADLINE`, not `CDP_TIMEOUT`. Route waits, `ensure_mode` and account switching treat it as no answer yet: a route or mode wait still ends with its own timeout message, and an account switch the deadline cut short is reported as ambiguous. A command that hits its own limit keeps `CDP_TIMEOUT`, and its message now says `CDP_COMMAND_TIMEOUT` and gives the limit.
+- Mobile setup and navigation budgets depend on the device class. Emulators and simulators keep 30 s for setup and 15 s per navigation. A physical Android device (explicit non-`emulator-*` adb serial) gets 60 s and 30 s. `MM_HARNESS_MOBILE_SETUP_TIMEOUT_MS` and `MM_HARNESS_MOBILE_NAVIGATION_TIMEOUT_MS` override the defaults, and node `timeout_ms` and `navigation_timeout_ms` override both. The setups' live process timeout is raised to the setup budget plus 5 s, so the process timeout no longer races a 60 s setup. `start_state` and `teardown_state` schemas accept `navigation_timeout_ms` and `cdp_timeout_ms`.
+- A Hyperliquid `429 Too Many Requests` in a Perps action is now the typed error `RATE_LIMITED`, naming the call, the attempts and the backoff used. Farm runs share the testnet account and egress IP, so the venue rate-limits them; on Extension 13.52.0 QA (testnet run 46848-1009-223034) the $12 SOL setup order failed with `429 Too Many Requests - null` and Recipe Cook stopped the case, though nothing was placed.
+  - Reads retry up to 3 times with exponential backoff and jitter (between half and all of 1 s, 2 s, 4 s), then fail `RATE_LIMITED` with `Next: wait a minute and rerun`. No retry starts unless its backoff and another attempt as long as the last one end before the action deadline, and a retry still unanswered at the deadline fails there. The deadline is the inherited deadline on Mobile, and 5 s before the runner kills the live adapter process (`liveAdapterProcessTimeoutMs`) on Extension and Core. This covers Extension position, order, account, market, size-step and snapshot reads and the `compare_provider_market` venue read, Mobile controller position, order and strategy-order reads, and Core `read_positions`, `read_orders` and `read_account`.
+  - Extension background `metamask.perps.place_order` retries a 429 only when the dispatch itself got it (no accepted order) and, after the backoff, Hyperliquid's own info API (read from the harness, not the extension) shows no open order and no fill in that market since the first dispatch (open orders read first, so an order filling between the reads still shows), and for a market order no position on its side. Up to 3 retries, and only while the backoff and those reads (5 s at most) leave the postcondition its `timeout_ms` and 5 s before the process limit. The retry's own pre-dispatch checks are bounded by that deadline too; a retry that would reach the venue after it is not sent, the receipt becomes `not-dispatched`, and the error is still `RATE_LIMITED`. Every retry reruns the pre-dispatch checks (unchanged funding balance, provider and network, CDP target, bound account); the budget cap and the order rule are the first dispatch's.
+  - Every 429 on a dispatch goes into the receipt under `rateLimitedDispatches`, with its backoff and venue verification or the reason it was not retried. Without a retry the receipt stays `outcome-unknown` and the error is `RATE_LIMITED` with that reason and still `Next: do not rerun this mutation`: a venue read that fails or shows activity, a HIP-3 market, spent retries, the deadline, a 429 on the postcondition read after dispatch (never redispatched), and every other Extension mutation. Mobile placements keep no receipt and are not retried.
+- Mobile `metamask.perps.read_visible_state` counts the Perps home Recent activity rows (`perps-recent-activity-row-<n>`) and a market's recent trades rows (`perps-market-trades-row-<n>`) as activity. A populated home preview reported `activity: []` and failed `minimum_activity_count`.
+- Mobile `ui.wait_for expected=absent` no longer times out on a control that only a screen hidden in the navigation stack still mounts. The app's tree query also finds test IDs in screens a navigator keeps behind the focused one (the Activity screen's `activity-screen-aggregated-checkbox` under Perps home). A tree hit now counts as absent only when every match is on a provably hidden route (an inactive tab, or a stack screen that is neither modal-presented nor inheriting a modal presentation, with a screen above it that is not modal either) and a complete native observation, read within the wait's remaining time, does not show the test ID. The result then carries `hiddenRoute: true` and `nativeVisible: false`. A modal-family screen, and any screen under a sheet or transparent modal, is never treated as hidden, even when native accessibility omits its controls; a truncated or warned native observation, or a navigator the walk cannot read, keeps the control present. Present-waits are unchanged.
+- Extension `metamask.perps.read_snapshot` states that its `history` section is the funds ledger from `perpsGetUserHistory` (deposits, withdrawals and transfers), not trades or orders. Zero history items with trade rows on screen is expected; read those rows with `read_visible_state` activity.
+
+- Contributors: test leftovers that only run in a sandbox no longer outlive the suites. A server a test started detached in its temp dir (the `mobile-cdp-reliability` fake Metro server, the prepared analytics collector) named nothing of it, so neither the process-group kill nor `ct_cleanup` found it, and some ran for days. `tests/contract/run.sh` now kills a detached leftover that names a test's sandbox when the test ends. After the run, it kills anything still running in a sandbox (working directory), names it on a `LEAK <test> (after the run)` line, and fails the run. Before starting, the contract runner and the unit run's global setup reap an earlier run that was killed outright, and a SIGKILLed contract runner's remover stops what still runs in its sandboxes before removing them. The unit teardown also stops processes running in its TMPDIR. Eight contract tests that replaced `ct_init`'s EXIT trap now end in `ct_cleanup`, and `contract-cleanup` fails a test that drops it.
+
 ## 0.86.2 - 2026-10-09
 
 ### Fixed
@@ -15,6 +61,7 @@
 
 ### Fixed
 
+- Mobile `metamask.perps.start_state` refuses `trading_state` combined with an explicit `positions`, `orders` or `strategies` request (anything but `false`). The policy sets all three itself, so the request was dropped without a word: `trading_state=preserve` with `positions: { state: "open", notional: 11, leverage: 2 }` passed with `positions: { skipped: true }` and opened nothing. A later isolated-margin prerequisite then read zero positions. The action now fails before unlock, naming the ignored keys. Omit `trading_state` to apply the request, or put the request in its own `start_state` node. Profile defaults are still replaced by the policy, and `false` is still accepted.
 - Mobile route waits (`navigate` and `waitForRoute` in the action library) now end at the calling action's deadline. Before, once a Perps `start_state` or `teardown_state` ran out of budget, the bridge refused each new `get-route` with `CDP_TIMEOUT`. The waits took that refusal for a target transition and kept polling for up to 30 s more on their own 15 s windows. They could not see a route that did arrive, and failed with "did not start before its action deadline: get-route". On a physical Pixel 6a this showed up as `CDP_TIMEOUT` in clean-market setup and teardown, while one `get-route` took 0.1 to 0.5 s. Both now stop at the deadline. A route that never matched fails with the expected route, the last route read and the limit applied; a recovery cut short by the deadline fails with its last bridge error.
 
 ## 0.86.1 - 2026-10-09
@@ -24,6 +71,8 @@
 - Extension `metamask.perps.close_visible_position cleanup_only=true` reconciles the final balance against the margin the close releases. With no placement receipt, the baseline is the available balance read while the position is still open. That baseline excludes the position's margin, so a clean full close went over the $1 tolerance and left an `outcome-unknown` receipt. A 0.11 SOL testnet close moved $524.42 to $536.45 and failed this way. The action now reads the close modal's "You'll receive" amount before dispatch and records it in the receipt as `closeReleaseBaseUnits`. It then checks the final balance against baseline + receive, with the same tolerance. If the amount is not visible, the action refuses before publishing a receipt or clicking. Closes backed by a placement receipt still reconcile against the pre-order balance. Cleanup output adds `releaseBaseUnits` and `expectedBalanceAfterBaseUnits`.
 - Mobile `metamask.perps.read_visible_state` on iOS sees Perps Text test IDs. iOS accessibility lists React Native Text as a StaticText with no identifier, so a visible Lite market price (`perps-market-header-price`) failed `require_features: ["price"]`. On a non-opaque iOS run, `ui.visible` now reads each mounted `perps-` Text's test ID, string and size over the dev bridge. It gives that test ID to the on-screen StaticText with the same label and size, when exactly one test ID matches. Offscreen StaticText stays unbound, and so does a same-text twin of another size (the collapsed header price). Other Text, such as a revealed Secret Recovery Phrase word, is not read. This reaches every iOS `ui.visible` consumer: `ui.locators`, native-navigation test-ID waits, `readVisiblePerpsTestIds`, `configure_order`, and the assets and swap-bridge `read_visible_state`. Opaque runtimes and Android are unchanged. A non-opaque run with Metro down pays one bridge attempt (at most 2 s) per observation and gets a `ui.visible` warning; a read over 500 Texts is truncated with a warning.
 - An empty `METAMASK_RECIPE_MOBILE_BRIDGE_SCRIPT` means the bundled `cdp-bridge.cjs` everywhere the TypeScript side spawns the Mobile bridge, as `run` and the action library already treated it. `launch`'s feature-flag reads and pins (and `doctor`'s) and the `status` live probe read the variable with `??`. An empty value made them check for a script named `""`, so they reported no runtime and never spawned a bridge. All TypeScript callers now share one `mobileBridgeScript()`; the action library keeps the same rule in its own `bridgeScript()` because it cannot import `src/`.
+- Contributors: `tests/contract/run.sh` stopped by SIGTERM signals every running test at once, from one process listing, and its main loop no longer delays the trap by a `sleep`. A runner SIGKILLed 0.3 s after its SIGTERM used to leave most running tests (and their `timeout` parents) going until their own time limit, and `/tmp/contract-run.*` behind; now each test gets its SIGTERM and cleans up, and the directory goes once they have.
+- Contributors: a unit run's teardown also stops what the processes naming its TMPDIR started (a wrapper's child need not name it), so it no longer orphans them. The `feature-guard-run-capture` timeout test times out only once bash has set its EXIT trap, instead of hoping bash starts within 3 s; it no longer fails on a loaded machine and runs in under a second.
 
 ## 0.86.0 - 2026-10-09
 

package/adapters/extension/ensure-browser.sh

@@ -230,12 +230,9 @@ cleanup_stale_profile_locks
 rm -f "${AGENT_DIR}/browser.pid" "${AGENT_DIR}/extension.id" "${AGENT_DIR}/launcher.pid"
 echo "[cleanup] Reusing profile ${PROFILE}"
 
-# Clear crash recovery state + re-enable any previously-disabled extensions
-# (profile Preferences persists extensions.settings.<id>.state=0 after unsafe
-# shutdowns; --load-extension re-advertises the path but does not flip it back,
-# leaving MV3 service workers inert).
+# Clear crash recovery state left by an unsafe shutdown.
 if [ -f "${PROFILE}/Default/Preferences" ]; then
-  python3 - "${PROFILE}/Default/Preferences" 2>/dev/null <<'PY' && echo "[cleanup] Cleared crash recovery state + re-enabled extensions"
+  python3 - "${PROFILE}/Default/Preferences" 2>/dev/null <<'PY' && echo "[cleanup] Cleared crash recovery state"
 import json
 import sys
 pf = sys.argv[1]
@@ -243,14 +240,13 @@ prefs = json.load(open(pf))
 prefs['profile'] = prefs.get('profile', {})
 prefs['profile']['exit_type'] = 'Normal'
 prefs['profile']['exited_cleanly'] = True
-ext_settings = prefs.get('extensions', {}).get('settings', {})
-for ext_id, ext_prefs in ext_settings.items():
-    if isinstance(ext_prefs, dict) and ext_prefs.get('state') != 1:
-        ext_prefs['state'] = 1
-        ext_prefs.pop('disable_reasons', None)
 json.dump(prefs, open(pf, 'w'))
 PY
 fi
+# Re-enable MetaMask when the profile kept it disabled: --load-extension
+# re-advertises the path but does not lift a persisted disable reason, leaving
+# every extension page blocked and the MV3 service worker inert.
+node "${SCRIPT_DIR}/profile-extension-state.cjs" --profile "${PROFILE}" --extension-dir "${EXTENSION}"
 
 # Readiness gate: wait until webpack emits a loadable background entry before
 # freezing dist/chrome. The entry differs by manifest version — MV3 emits

package/adapters/extension/inject.mjs

@@ -96,6 +96,7 @@ fs.rmSync(path.join(harnessDir, 'runner/library.json'), { force: true });
 // package's source layout.
 copyFile(path.join(runnerDir, 'adapters/extension/launch-browser.cjs'), path.join(harnessDir, 'scripts/launch-browser.cjs'));
 copyFile(path.join(runnerDir, 'adapters/extension/build-handoff.cjs'), path.join(harnessDir, 'scripts/build-handoff.cjs'));
+copyFile(path.join(runnerDir, 'adapters/extension/profile-extension-state.cjs'), path.join(harnessDir, 'scripts/profile-extension-state.cjs'));
 copyFile(path.join(runnerDir, 'adapters/extension/console-tail.mjs'), path.join(harnessDir, 'scripts/console-tail.mjs'));
 copyFile(path.join(runnerDir, 'adapters/extension/launch.sh'), path.join(harnessDir, 'scripts/launch.sh'));
 copyFile(path.join(runnerDir, 'adapters/extension/live.sh'), path.join(harnessDir, 'scripts/live.sh'));

package/adapters/extension/launch-browser.cjs

@@ -4,7 +4,9 @@
 // Runs @farmslot/adapter-web's launchBrowser with what MetaMask owns: the
 // build-handoff lock (no build swaps the dist mid-launch), home.html and its
 // "MetaMask" title, the harness runtime layouts that prove a browser is ours by
-// its --load-extension path, and the mm-harness rerun command.
+// its --load-extension path, and the mm-harness rerun command. A real launch
+// into a kept profile first clears a stale disable mark Chrome left on MetaMask
+// (profile-extension-state.cjs), which --load-extension alone does not lift.
 //
 // Inputs (flags, all required unless noted):
 //   --cdp-port <port> --chrome-bin <path> --profile <dir>
@@ -21,6 +23,7 @@
 const path = require('node:path');
 const { launchBrowser } = require('@farmslot/adapter-web/launch-browser');
 const { acquireBuildHandoff } = require('./build-handoff.cjs');
+const { clearExtensionDisable, extensionDisableReasons } = require('./profile-extension-state.cjs');
 
 if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log(
@@ -33,7 +36,7 @@ const args = parseArgs(process.argv.slice(2));
 const cdpPort = Number(args['cdp-port']);
 // Checked here so the error echoes the flag as typed.
 if (!Number.isInteger(cdpPort) || cdpPort <= 0) throw new Error(`Invalid --cdp-port: ${args['cdp-port'] || ''}`);
-launchBrowser({
+const options = {
   cdpPort,
   chromeBin: args['chrome-bin'],
   profile: args.profile,
@@ -48,11 +51,35 @@ launchBrowser({
   homePage: 'home.html',
   defaultTitle: 'MetaMask',
   extensionOwnerRoot: harnessOwnerRootFromExtensionDir,
-  acquireRuntimeLock: acquireBuildHandoff,
+  acquireRuntimeLock: acquireLaunchLock,
   rerunCommand: 'mm-harness launch --adapter extension --build',
   // Unset or invalid falls back to the package default (1000 ms).
   focusSettleMs: Number(process.env.MM_HARNESS_FOCUS_SETTLE_MS),
-});
+};
+launchBrowser(options);
+
+// The build-handoff lock, taken once launchBrowser has checked its inputs and
+// before it stops or starts a browser. A real launch into a profile that keeps
+// MetaMask disabled first releases the profile through launchBrowser's own
+// ownership checks (Chrome rewrites its prefs from memory on exit), then clears
+// the mark. The lock is already held, so that stop does not take it again.
+function acquireLaunchLock(runtimeDir) {
+  const release = acquireBuildHandoff(runtimeDir);
+  try {
+    if (
+      !options.stopOnly &&
+      !options.resetProfile &&
+      extensionDisableReasons(options.profile, options.extensionDir).length > 0
+    ) {
+      launchBrowser({ ...options, stopOnly: true, acquireRuntimeLock: undefined });
+      clearExtensionDisable(options.profile, options.extensionDir);
+    }
+  } catch (error) {
+    release();
+    throw error;
+  }
+  return release;
+}
 
 function parseArgs(argv) {
   const parsed = {};

package/adapters/extension/profile-extension-state.cjs

@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+// profile-extension-state.cjs — the harness extension's disable mark in a slot profile
+//
+// Chrome keeps extensions.settings.<id>.disable_reasons across relaunches, and
+// --load-extension re-registers the unpacked build without clearing them, so a
+// reason recorded once (for example DISABLE_UNSUPPORTED_DEVELOPER_EXTENSION)
+// blocks every MetaMask page (ERR_BLOCKED_BY_CLIENT) on each later launch.
+// Chrome stores extensions.settings in Default/Secure Preferences or
+// Default/Preferences depending on the version, so both are read.
+//
+// clearExtensionDisable drops disable_reasons and a non-enabled legacy state
+// from this extension's entry only (matched by its manifest-key id or its load
+// path); other extensions are never touched. A file is rewritten atomically and
+// only when it changes; a missing or unreadable file is left alone. Chrome must
+// not be running on the profile: it rewrites its prefs from memory on exit. The
+// Secure Preferences MAC is left stale; Chrome accepts the edited entry.
+//
+// CLI: profile-extension-state.cjs --profile <dir> --extension-dir <dist>
+// Clears and prints one line when it did. Exit 0 — cleared or nothing to clear;
+// non-zero — bad args or an unwritable prefs file.
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { extensionIdFromExtensionDir } = require('@farmslot/adapter-web/extension-id');
+
+const PREFS_FILES = ['Secure Preferences', 'Preferences'];
+
+// Names from Chromium extensions/browser/disable_reason.h (Chrome 147).
+const DISABLE_REASONS = {
+  [1 << 0]: 'DISABLE_USER_ACTION',
+  [1 << 1]: 'DISABLE_PERMISSIONS_INCREASE',
+  [1 << 2]: 'DISABLE_RELOAD',
+  [1 << 3]: 'DISABLE_UNSUPPORTED_REQUIREMENT',
+  [1 << 4]: 'DISABLE_SIDELOAD_WIPEOUT',
+  [1 << 5]: 'DEPRECATED_DISABLE_UNKNOWN_FROM_SYNC',
+  [1 << 8]: 'DISABLE_NOT_VERIFIED',
+  [1 << 9]: 'DISABLE_GREYLIST',
+  [1 << 10]: 'DISABLE_CORRUPTED',
+  [1 << 11]: 'DISABLE_REMOTE_INSTALL',
+  [1 << 13]: 'DISABLE_EXTERNAL_EXTENSION',
+  [1 << 14]: 'DISABLE_UPDATE_REQUIRED_BY_POLICY',
+  [1 << 15]: 'DISABLE_CUSTODIAN_APPROVAL_REQUIRED',
+  [1 << 16]: 'DISABLE_BLOCKED_BY_POLICY',
+  [1 << 19]: 'DISABLE_REINSTALL',
+  [1 << 20]: 'DISABLE_NOT_ALLOWLISTED',
+  [1 << 21]: 'DEPRECATED_DISABLE_NOT_ASH_KEEPLISTED',
+  [1 << 22]: 'DISABLE_PUBLISHED_IN_STORE_REQUIRED_BY_POLICY',
+  [1 << 23]: 'DISABLE_UNSUPPORTED_MANIFEST_VERSION',
+  [1 << 24]: 'DISABLE_UNSUPPORTED_DEVELOPER_EXTENSION',
+  [1 << 25]: 'DISABLE_UNKNOWN',
+  [1 << 26]: 'DISABLE_BLOCKED_BY_CLOUD_POLICY_CHECK',
+};
+
+// Chrome 147 stores a list of single-bit reasons; older builds one bitmask.
+function disableReasonNames(value) {
+  const names = [];
+  for (const reason of Array.isArray(value) ? value : [value]) {
+    if (!Number.isInteger(reason)) continue;
+    for (let bit = 0; bit < 31; bit += 1) {
+      const flag = 1 << bit;
+      if (reason & flag) names.push(DISABLE_REASONS[flag] || `DISABLE_REASON_${flag}`);
+    }
+  }
+  return names;
+}
+
+// Why this entry is disabled; empty when it is not.
+function entryDisableNames(entry) {
+  const names = disableReasonNames(entry.disable_reasons);
+  if (entry.state !== undefined && entry.state !== 1) names.push(`state=${JSON.stringify(entry.state)}`);
+  return names;
+}
+
+function readPrefs(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+// This extension's entries in one prefs document, with why each is disabled.
+function ownDisabledEntries(prefs, extensionDir) {
+  const settings = prefs?.extensions?.settings;
+  if (!settings || typeof settings !== 'object') return [];
+  const extensionId = extensionIdFromExtensionDir(extensionDir);
+  const loadPath = path.resolve(extensionDir);
+  return Object.entries(settings)
+    .filter(([id, entry]) =>
+      entry &&
+      typeof entry === 'object' &&
+      ((extensionId && id === extensionId) ||
+        (typeof entry.path === 'string' && path.isAbsolute(entry.path) && path.resolve(entry.path) === loadPath)))
+    .map(([id, entry]) => ({ id, entry, names: entryDisableNames(entry) }))
+    .filter(({ names }) => names.length > 0);
+}
+
+function prefsFiles(profile) {
+  return PREFS_FILES.map((name) => path.join(profile, 'Default', name));
+}
+
+/** Why the profile keeps this extension disabled; empty when it does not. */
+function extensionDisableReasons(profile, extensionDir) {
+  const names = prefsFiles(profile).flatMap((file) =>
+    ownDisabledEntries(readPrefs(file), extensionDir).flatMap(({ names: entryNames }) => entryNames));
+  return [...new Set(names)];
+}
+
+/** Re-enable this extension in a stopped profile; returns the reasons cleared. */
+function clearExtensionDisable(profile, extensionDir, log = (line) => process.stderr.write(`${line}\n`)) {
+  const cleared = new Set();
+  const ids = new Set();
+  for (const file of prefsFiles(profile)) {
+    const prefs = readPrefs(file);
+    const disabled = ownDisabledEntries(prefs, extensionDir);
+    if (disabled.length === 0) continue;
+    for (const { id, entry, names } of disabled) {
+      delete entry.disable_reasons;
+      if (entry.state !== 1) delete entry.state;
+      ids.add(id);
+      for (const name of names) cleared.add(name);
+    }
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(prefs), { mode: fs.statSync(file).mode & 0o777 });
+    fs.renameSync(tmp, file);
+  }
+  if (cleared.size > 0) {
+    log(`[profile] Re-enabled MetaMask (${[...ids].join(', ')}) in ${profile}; cleared: ${[...cleared].join(', ')}`);
+  }
+  return [...cleared];
+}
+
+module.exports = { clearExtensionDisable, disableReasonNames, extensionDisableReasons };
+
+if (require.main === module) {
+  const usage = 'Usage: profile-extension-state.cjs --profile <dir> --extension-dir <dist>';
+  if (process.argv.includes('--help') || process.argv.includes('-h')) {
+    console.log(usage);
+    process.exit(0);
+  }
+  const args = {};
+  const argv = process.argv.slice(2);
+  for (let i = 0; i < argv.length; i += 2) {
+    if (!['--profile', '--extension-dir'].includes(argv[i]) || i + 1 >= argv.length) {
+      console.error(usage);
+      process.exit(2);
+    }
+    args[argv[i].slice(2)] = argv[i + 1];
+  }
+  if (!args.profile || !args['extension-dir']) {
+    console.error(usage);
+    process.exit(2);
+  }
+  clearExtensionDisable(args.profile, args['extension-dir'], (line) => console.log(line));
+}

package/adapters/extension/readiness.mjs

@@ -366,13 +366,32 @@ function findPageTarget(targets, selectedExtensionId, preferredPagePath = '') {
   return extensionPages.reduce((best, current) => (score(current) > score(best) ? current : best), extensionPages[0]);
 }
 
+// A disable reason the slot profile kept on MetaMask blocks every extension
+// page (ERR_BLOCKED_BY_CLIENT); name it instead of the symptom. The profile is
+// the one the launch recorded for this browser.
+function blockedExtensionMessage(target, symptom) {
+  let reasons = [];
+  try {
+    const record = JSON.parse(fs.readFileSync(path.join(target, recipeRuntimeDir(), 'browser-resolution.json'), 'utf8'));
+    const profile = record?.launch?.profile;
+    if (typeof profile === 'string' && profile) {
+      const { extensionDisableReasons } = require('./profile-extension-state.cjs');
+      reasons = extensionDisableReasons(profile, extensionBuildRoot(target));
+    }
+  } catch {
+    return symptom;
+  }
+  if (reasons.length === 0) return symptom;
+  return `MetaMask is disabled in the slot profile: ${reasons.join(', ')}. Next: mm-harness launch --adapter extension --build`;
+}
+
 async function inspectCdp(target, cdpPort, expectedExtensionId, expectedServiceWorker, extensionPagePath) {
   const version = await httpJson(`http://127.0.0.1:${cdpPort}/json/version`);
   let targets = await httpJson(`http://127.0.0.1:${cdpPort}/json/list`);
   if (!Array.isArray(targets)) throw new Error('/json/list did not return an array');
   let { extensionIds, selectedExtensionId } = chooseExtensionId(targets, expectedExtensionId, expectedServiceWorker);
   if (!selectedExtensionId) {
-    throw new Error('CDP is reachable but no chrome-extension:// targets are present');
+    throw new Error(blockedExtensionMessage(target, 'CDP is reachable but no chrome-extension:// targets are present'));
   }
   let pageTarget = findPageTarget(targets, selectedExtensionId, extensionPagePath);
   let openedPage = false;
@@ -422,7 +441,7 @@ async function inspectCdp(target, cdpPort, expectedExtensionId, expectedServiceW
         ui.hasStartupError ||
         ui.hasErrorBoundary
       ) {
-        throw Object.assign(new Error('MetaMask extension page loaded Chrome error UI'), {
+        throw Object.assign(new Error(blockedExtensionMessage(target, 'MetaMask extension page loaded Chrome error UI')), {
           report: { cdp: { browser: version.Browser || 'unknown', selectedExtensionId, ui } },
         });
       }

package/adapters/manifest.json

@@ -250,6 +250,14 @@
       "inputs": "--cdp-port --chrome-bin --profile --extension-dir --chrome-log --chrome-pid [--browser-resolution] [--start-url] [--stop-only 1] [--reset-profile 1]",
       "outputs": "pid file + append-log + <runtime>/browser-resolution.json; exit 0 / non-zero"
     },
+    {
+      "id": "extension/profile-extension-state",
+      "entry": "adapters/extension/profile-extension-state.cjs",
+      "kind": "node",
+      "purpose": "Clear a stale Chrome disable mark (disable_reasons / non-enabled state) on the harness extension only, in a stopped slot profile's Preferences and Secure Preferences; decode the reasons for readiness errors.",
+      "inputs": "--profile --extension-dir",
+      "outputs": "rewrites <profile>/Default/{Preferences,Secure Preferences} only when the extension was disabled; one line naming the cleared reasons; exit 0 / non-zero"
+    },
     {
       "id": "extension/refresh-build",
       "entry": "adapters/extension/refresh-build.sh",

package/adapters/mobile/wait-for-bridge.cjs

@@ -14,6 +14,7 @@ const {
   describeRequested,
   describeTargets,
   hasMatchingRoute,
+  manufacturerNameMatches,
 } = require('@farmslot/adapter-rn/bridge-runtime/lib/match-bridge-target.cjs');
 const {
   rankRuntimeCandidates,
@@ -179,9 +180,14 @@ function snapshotMatchesRequest(snapshot, platform, env) {
     if (snapshot.platform && snapshot.platform !== 'android') return false;
     const androidName =
       env.ANDROID_TARGET_DEVICE_NAME || env.ANDROID_DEVICE || '';
-    return androidName
-      ? deviceName === androidName || deviceName.startsWith(`${androidName} -`)
-      : snapshot.platform === 'android';
+    const adbSerial = env.ADB_SERIAL || env.ANDROID_SERIAL || '';
+    if (!androidName) return snapshot.platform === 'android';
+    if (deviceName === androidName || deviceName.startsWith(`${androidName} -`)) {
+      return true;
+    }
+    // Metro names the target "Pixel 6a - 17 - API 37", but the bridge snapshot
+    // of a physical device carries the manufacturer: "Google Pixel 6a".
+    return manufacturerNameMatches(deviceName, androidName, adbSerial);
   }
   return !platform;
 }

package/dist/adapters/extension/actions.js

@@ -20,7 +20,8 @@ const extensionActions = {
     "metamask.perps.update_position_tpsl",
     "metamask.perps.assert_visible_consistency",
     "metamask.settings.set_basic_functionality",
-    "metamask.perps.read_snapshot"
+    "metamask.perps.read_snapshot",
+    "metamask.perps.set_network"
   ],
   liveNeedsCdpPort: true,
   cdpTarget: { transport: "chrome-extension-cdp", probePath: "json/version" },

package/dist/adapters/extension/run.js

@@ -45,6 +45,12 @@ const extensionRun = {
     return async () => refuseLockedSession(json, options) ?? ensureExtensionProofRuntime(target, heal, state, json, { onRecovery });
   },
   launchedBrowser: (target, artifactsDir, cdpPort) => launchedBrowser(target, artifactsDir, cdpPort),
+  // Cancel the mainnet limit orders the run opened and switch Perps back to
+  // testnet after a start_state network=mainnet; a failure fails the run.
+  async teardown(projectRoot, env) {
+    const { cancelRunMainnetOrders } = await import("../perps-mainnet-cleanup.js");
+    await cancelRunMainnetOrders(projectRoot, env, "teardown");
+  },
   browserProvenance: (browser) => ({
     browser: browser.browser,
     browser_version: browser.version,

package/dist/adapters/mobile/action-inputs.js

@@ -0,0 +1,20 @@
+const POLICY_KEYS = ["positions", "orders", "strategies"];
+function isTemplate(value) {
+  return typeof value === "string" && value.includes("{{");
+}
+function mobileActionInputFindings(nodeId, node) {
+  const policy = node.trading_state;
+  if (node.action !== "metamask.perps.start_state" || typeof policy !== "string" || isTemplate(policy)) return [];
+  const dropped = POLICY_KEYS.filter((key) => node[key] !== void 0 && node[key] !== false && !isTemplate(node[key]));
+  if (dropped.length === 0) return [];
+  const keys = dropped.join(", ");
+  return [{
+    severity: "error",
+    code: "recipe.invalid_param",
+    path: `workflow.nodes.${nodeId}.trading_state`,
+    message: `metamask.perps.start_state trading_state=${policy} sets positions, orders and strategies itself, so the requested ${keys} would be ignored. Omit trading_state to apply ${keys}, or request ${keys} in a separate metamask.perps.start_state node.`
+  }];
+}
+export {
+  mobileActionInputFindings
+};

package/dist/adapters/mobile/actions.js

@@ -1,5 +1,7 @@
+import { liveAdapterProcessTimeoutMs } from "@farmslot/recipe-cli/harness";
 import { manifestPath } from "../../paths.js";
 import { perpsOrderInputFindings } from "../perps-order-inputs.js";
+import { mobileActionInputFindings } from "./action-inputs.js";
 const NATIVE_PROVIDER_UI_ACTIONS = /* @__PURE__ */ new Set([
   "ui.press",
   "ui.key_press",
@@ -13,6 +15,8 @@ const NATIVE_PROVIDER_UI_ACTIONS = /* @__PURE__ */ new Set([
   "ui.screenshot",
   "ui.capture_surface"
 ]);
+const MOBILE_SETUP_ACTIONS = /* @__PURE__ */ new Set(["metamask.perps.start_state", "metamask.perps.teardown_state"]);
+const SETUP_EXIT_ALLOWANCE_MS = 5e3;
 const mobileActions = {
   manifestPath: () => manifestPath("mobile"),
   semantic: [
@@ -49,9 +53,22 @@ const mobileActions = {
   }),
   wrap: async (adapters) => (await import("./runtime-identity.js")).withMobileNativeRuntimeIdentity(adapters),
   lifecycle: async (adapters) => (await import("./lifecycle.js")).mobileSourceAwareLifecycleAdapters(adapters),
+  // A Perps setup resolves its own budget (device-class default unless the node
+  // sets timeout_ms). Its process must outlive that budget so the setup, not the
+  // process timeout, reports which phase ran out.
+  liveProcessNode: async (action, node, env) => {
+    if (!MOBILE_SETUP_ACTIONS.has(action) || node.live_adapter_timeout_ms != null) return node;
+    const { mobileSetupTimeoutMs } = await import("../../../library/actions/mobile/platform/bridge.mjs");
+    const needed = mobileSetupTimeoutMs({ node, context: { env } }) + SETUP_EXIT_ALLOWANCE_MS;
+    return needed > liveAdapterProcessTimeoutMs(node) ? { ...node, live_adapter_timeout_ms: needed } : node;
+  },
   // ensure_positions and ensure_orders with an open or present state place an order.
-  inputFindings: (nodeId, node) => perpsOrderInputFindings(nodeId, node, { ensureChecksOnly: false })
+  inputFindings: (nodeId, node) => [
+    ...mobileActionInputFindings(nodeId, node),
+    ...perpsOrderInputFindings(nodeId, node, { ensureChecksOnly: false })
+  ]
 };
 export {
+  SETUP_EXIT_ALLOWANCE_MS,
   mobileActions
 };