@farmslot/adapter-web 0.6.1 → 0.6.3

package/CHANGELOG.md

@@ -6,6 +6,18 @@ All notable changes to `@farmslot/adapter-web` are tracked here.
 
 - Active-development baseline; add user-facing changes here before release or package publication.
 
+## 0.6.3 - 2026-10-09
+
+- Fix: `launch-browser` stops waiting for its CDP listener once the browser it started has exited (`Chrome launched but did not expose an owned CDP listener on 127.0.0.1:<port>: the browser exited`), or once a process it did not launch holds the port (the same `Refusing to launch on CDP port <port>` refusal the pre-launch check gives, naming that pid). Either must hold for about a second, and a browser started through `open` counts as exited only once it has been seen, or after 5 s. The wait is now 30 s of wall-clock time; before, it was 300 polls: 30 s on an idle host, minutes on a loaded one. After the foreign refusal, once the browser this launch saw start is stopped, the launch markers are cleared, so a rerun on a free port is not refused as quarantined; if that browser was never seen, the markers stay and the refusal names the `rm` that clears them. An exit or a timeout keeps them, as before. A `ps` or `lsof` failure mid-wait now stops the browser before it is reported; if that stop fails too, one error names both failures and the pid to stop, and the markers are kept. Wait progress reports `seconds`, not `attempts`.
+- `web-dapp`'s testnet launch probes build their mainnet URLs in node and pass them into the page as JSON strings, so a venue policy's probe `httpPath` or `wsPath` containing a quote reads as blocked or reached instead of failing the launch with a page `SyntaxError`.
+- Fix: every process that loads the `web-dapp` venue policy fences its imports at run time. A `module.registerHooks` resolve hook refuses (`ADAPTER_PLUGIN_INVALID`) any import resolved from one of the policy's digested files (static, dynamic, or a `require` created for it) that lands outside them, at load or later while the process runs. Before, the host's source scan was the only check, so a leaf could load an outside file through an aliased `createRequire` (or another import the scan can't see) while the policy and plugin digests stayed unchanged. Loading the policy now needs Node.js 22.15 or later (`engines` says so). It fences imports, not code.
+- Publish with adapter-sdk 0.7.2 and recipe-runner 0.27.1 so consumers share one adapter-sdk and one recipe-runner copy.
+
+## 0.6.2 - 2026-10-08
+
+- Fix: `launch-browser` no longer builds its `node -e` CDP request from the port, path or target id. They reach the child as argv, `cdpHttp` takes only an integer port from 1 to 65535 and the paths it uses (`/json/list`, `/json/version`, `/json/close/<id>`), and closing duplicate home tabs skips, with a warning, a target id from `/json/list` that is not a CDP id (letters, digits, `-`). Before, a hostile or substituted local CDP endpoint could run code in that child through a crafted target id. `cdpHttp` and `pruneExtraHomeTabs` are exported for tests. ([#859](https://github.com/deeeed/farmslot/pull/859))
+- Publish with adapter-sdk 0.7.1 and recipe-runner 0.27.0 so consumers share one adapter-sdk and one recipe-runner copy.
+
 ## 0.6.1 - 2026-10-08
 
 - `web-dapp` refuses a headful launch while the macOS login session is locked (`SESSION_LOCKED`, with the unlock step), before starting, reusing or stopping a browser, as mm-harness does since its #363 (0.6.0 shipped `web-dapp` without it). `macosSessionLocked()`, `parseSessionLocked()`, `SESSION_LOCKED_MESSAGE` and `SESSION_LOCKED_USER_ACTION` are exported.

package/README.md

@@ -112,7 +112,7 @@ const binding = createWalletRequestBinding({
 
 `@farmslot/adapter-web/web-dapp` (ESM) is the lifecycle of a web app under test whose dev server the slot owns. `createWebDappAdapter({ id, signerModule, cli, hooks })` returns an `@farmslot/adapter-sdk` `PlatformAdapter`: launch, stop, runtime status, doctor checks, logs and the wallet request-log findings. It runs one slot browser per slot, and a wallet host attached to it over CDP that records the wallet requests (and, with `signer=injected`, answers them with the strict wallet from `dapp`).
 
-- **Venue policy.** The app's venue (the hosts a testnet run blocks and serves, the typed data to refuse, the start page) comes from the adapter that `extends: 'web-dapp'`: its policy module goes to `RECIPE_WEB_DAPP_POLICY` through `bindWebDappPolicy(adapter)`. Bare web-dapp has no policy and refuses to launch. `fencePolicy` and `assertPolicyDigest` hold the module and what it imports to the files the plugin digest covers.
+- **Venue policy.** The app's venue (the hosts a testnet run blocks and serves, the typed data to refuse, the start page) comes from the adapter that `extends: 'web-dapp'`: its policy module goes to `RECIPE_WEB_DAPP_POLICY` through `bindWebDappPolicy(adapter)`. Bare web-dapp has no policy and refuses to launch. `fencePolicy` and `assertPolicyDigest` hold the module and what it imports to the files the plugin digest covers, and every process that loads the policy refuses, with a `module.registerHooks` resolve hook, any import resolved from one of those files (static, dynamic, or a `require` created for it) that lands outside them (Node.js 22.15 or later).
 - **Served network.** A policy that declares served hosts (`venueHosts().served`) has the wallet host wait for the app to request one of them, which proves the dev server serves testnet. A policy for an app whose page makes no venue request of its own (such as test-dapp-multichain, whose wallet traffic goes through the extension) opts out explicitly: `venueHosts()` returns `served: []` with `servedCheck: 'not-applicable'`. The check is then skipped, and `networkEnforcement.served` in `browser.json` and the `network-enforcement` entry of the wallet request log say `not-applicable`. An empty `served` without that opt-out keeps the check, which fails closed, so a policy that computes its served hosts can't lose the check by finding none. Listing served hosts and opting out together is refused. Mainnet blocking is enforced either way.
 - **Locked session.** A headful launch refuses while the macOS login session is locked (`SESSION_LOCKED`), before starting, reusing or stopping a browser: macOS stops painting visible windows, so screenshots, video and UI actions would stall. `macosSessionLocked()` reads `ioreg` (3 s bound; `null` off macOS or when unknown). A headless launch never probes.
 - **Signers.** `signer=injected` needs nothing. `signer=extension` belongs to the host: a signer module exports `signers.extension` with `prepareProfile` (load the extension, seed the profile; returns `{ browserArgs, secrets, state }` and may carry an `afterBrowserStart` step; both steps get `trackSecret` for key-material files), `confirm` (required with `prepareProfile`: without it the wallet host would close the wallet's own windows) and `readinessChecks`. `signers.injected.identity` sets the EIP-6963 identity the injected strict wallet presents. The module path (`signerModule`, `--signer-module` or `RECIPE_WEB_DAPP_SIGNER_MODULE`) is the one source: readiness, launch, verify and the wallet host all load it, and `createWebDappAdapter` throws if given an in-process `signers` object. With no signer requested, the signer is `extension` when a module is configured and `injected` otherwise, so a host whose module exports only `injected` sets the signer explicitly (`--signer injected` or `TERMINAL_SIGNER=injected`).

package/dist/launch-browser.d.cts

@@ -116,3 +116,22 @@ export function homeTabsToClose(targets: unknown[], { extensionId, homePage, def
     id: string;
     url: string;
 }[];
+/**
+ * GET a CDP HTTP path on 127.0.0.1. Returns the body, or null when the port or
+ * path is not one the launcher uses, or the request fails.
+ * @param {number} port
+ * @param {string} pathname `/json/list`, `/json/version` or `/json/close/<target id>`
+ * @returns {string | null}
+ */
+export function cdpHttp(port: number, pathname: string): string | null;
+/**
+ * Close the extra `homePage` tabs and stray blank tabs the browser on `port` has.
+ * @param {number} port CDP port on 127.0.0.1.
+ * @param {string} extensionDir The unpacked extension, for its id.
+ * @param {{ homePage?: string, defaultTitle?: string }} options
+ * @returns {string[]} What could not be done, one line each; empty when all went well.
+ */
+export function pruneExtraHomeTabs(port: number, extensionDir: string, { homePage, defaultTitle }: {
+    homePage?: string;
+    defaultTitle?: string;
+}): string[];

package/dist/web-dapp/lib/policy-fence.d.mts

@@ -8,8 +8,17 @@ export function fencePolicy({ file, covered, scope }: {
     covered: any;
     scope: any;
 }): string;
-/** Refuse a policy whose files changed since mm-harness bound it (`digest`). */
-export function assertPolicyDigest(file: any, digest: any): void;
+/**
+ * Refuse a policy whose files changed since mm-harness bound it (`digest`).
+ * Returns the real paths of the files it digested.
+ */
+export function assertPolicyDigest(file: any, digest: any): any[];
+/**
+ * Before a process loads the policy at `file`: check its files against
+ * `digest` when the host bound one, and refuse, from then on, any import from
+ * those files that resolves outside them.
+ */
+export function fencePolicyImports(file: any, digest: any): void;
 export const POLICY_DIGEST_ENV: "RECIPE_WEB_DAPP_POLICY_DIGEST";
 export class PolicyFenceError extends Error {
     constructor(message: any);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farmslot/adapter-web",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Web platform adapter for Farmslot recipes: resolve and launch an isolated Chromium, own its CDP port, load unpacked extensions, and keep macOS focus.",
   "type": "commonjs",
   "exports": {
@@ -83,8 +83,8 @@
     "prepublishOnly": "node ../../scripts/quality/check-farmslot-package-readiness.mjs --publish --packages @farmslot/adapter-web"
   },
   "dependencies": {
-    "@farmslot/adapter-sdk": "0.7.1",
-    "@farmslot/recipe-runner": "0.27.0",
+    "@farmslot/adapter-sdk": "0.7.2",
+    "@farmslot/recipe-runner": "0.27.1",
     "ws": "^8.18.0"
   },
   "devDependencies": {
@@ -113,7 +113,7 @@
     "agentic-engineering"
   ],
   "engines": {
-    "node": ">=22.12.0"
+    "node": ">=22.15.0"
   },
   "files": [
     "README.md",

package/src/launch-browser.cjs

@@ -33,6 +33,7 @@ const {
   clearDetachedLaunchUnproven,
   clearValidationPortQuarantine,
   createRuntimeIdentityNonce,
+  detachedLaunchUnprovenPath,
   hasDetachedLaunchUnproven,
   isolatedProfileArgs,
   markDetachedLaunchUnproven,
@@ -41,7 +42,9 @@ const {
   remoteDebuggingArgs,
   removeRuntimeIdentity,
   runtimeIdentityArgs,
+  shellQuote,
   validationLaunchQuarantineError,
+  validationPortQuarantinePath,
   writeRuntimeIdentity,
 } = require('./chrome-args.cjs');
 const { extensionIdFromExtensionDir } = require('./extension-id.cjs');
@@ -159,12 +162,7 @@ function runLaunch(opts, acquireLock) {
   // Chrome), so we refuse rather than kill it or attach to it.
   const listenerPids = cdpListenerPids(cdpPort);
   const foreignPids = listenerPids.filter((pid) => !ownedBrowser(pid));
-  if (foreignPids.length > 0) {
-    throw new Error(
-      `Refusing to launch on CDP port ${cdpPort}: it is held by a browser this harness did not launch (pid ${foreignPids.join(', ')}). ` +
-        `Next: pick a free --cdp-port, or stop that browser.`,
-    );
-  }
+  if (foreignPids.length > 0) throw foreignPortError(cdpPort, foreignPids);
   const ownedPids = new Set(listenerPids);
   for (const pid of profileProcessPids(profile)) ownedPids.add(pid);
   const previousPid = readPidFile(opts.chromePid);
@@ -246,11 +244,57 @@ function runLaunch(opts, acquireLock) {
     process.platform === 'darwin' ? macApplicationForExecutable(opts.chromeBin) : null;
   if (application) chromeArgs.push('--no-startup-window');
   else chromeArgs.push(loadsOverCdp ? 'about:blank' : initialUrl);
-  const ownedListenerMissing = () =>
-    new Error(
-      `Chrome launched but did not expose an owned CDP listener on 127.0.0.1:${cdpPort}. ` +
+  // The wait ended without an owned listener: a foreign process took the port,
+  // the browser exited, or it never listened in time.
+  const ownedListenerMissing = (waited) => {
+    if (waited.foreignPids && waited.seen) return foreignPortError(cdpPort, waited.foreignPids);
+    if (waited.foreignPids) {
+      // This launch's browser was never seen, so its markers stay (see
+      // awaitOwnedListener): a free port alone would be refused as quarantined.
+      const markers = [detachedLaunchUnprovenPath(profile)];
+      if (!activeValidationLease) markers.push(validationPortQuarantinePath(cdpPort));
+      return foreignPortError(
+        cdpPort,
+        waited.foreignPids,
+        `this launch's browser never showed up, so its launch state stays quarantined. ` +
+          `Confirm no browser uses ${profile}, run: rm -- ${markers.map(shellQuote).join(' ')}, ` +
+          `then pick a free --cdp-port, or stop that browser.`,
+      );
+    }
+    const exited = waited.exited ? ': the browser exited' : '';
+    return new Error(
+      `Chrome launched but did not expose an owned CDP listener on 127.0.0.1:${cdpPort}${exited}. ` +
         `Next: inspect ${opts.chromeLog}, then ${rerun}`,
     );
+  };
+  // Any outcome but an owned listener stops what this launch started, a ps or
+  // lsof failure mid-wait included. The launch markers stay until ownership is
+  // proven, except when a foreign process took the port from a browser this
+  // launch saw start and has now stopped: then nothing is left to quarantine,
+  // and the refusal's hint (a free port) works as given.
+  const awaitOwnedListener = (stopOptions, firstSightingMs) => {
+    let waited;
+    try {
+      waited = waitForOwnedCdpPid(cdpPort, ownedBrowser, profile, opts.progress, firstSightingMs);
+    } catch (error) {
+      try {
+        stopProfileProcessesSync(profile, stopOptions);
+      } catch (stopError) {
+        const pids = stopOptions.extraPids ?? [];
+        const target = pids.length > 0 ? `pid ${pids.join(', ')}` : `the browser using ${profile}`;
+        throw new Error(
+          `Waiting for the CDP listener failed (${error.message}), and stopping the browser failed: ${stopError.message}. ` +
+            `The launch markers for port ${cdpPort} and ${profile} are kept. Next: stop ${target}, then ${rerun}`,
+          { cause: error },
+        );
+      }
+      throw error;
+    }
+    if (waited.pid !== undefined) return waited.pid;
+    stopProfileProcessesSync(profile, stopOptions);
+    if (waited.foreignPids && waited.seen) clearLaunchMarkers();
+    throw ownedListenerMissing(waited);
+  };
   const logFd = fs.openSync(opts.chromeLog, 'a');
   const previousFrontmost = captureMacFrontmost();
   let browserPid;
@@ -263,11 +307,8 @@ function runLaunch(opts, acquireLock) {
           env: sanitizedChildEnv(),
           stdio: ['ignore', logFd, logFd],
         });
-        browserPid = waitForOwnedCdpPid(cdpPort, ownedBrowser, opts.progress);
-        if (browserPid === null) {
-          stopProfileProcessesSync(profile, { waitForAppearanceMs: 400 });
-          throw ownedListenerMissing();
-        }
+        // `open` can return before the browser shows up in ps.
+        browserPid = awaitOwnedListener({ waitForAppearanceMs: 400 }, 5000);
       } else {
         const child = spawn(opts.chromeBin, chromeArgs, {
           detached: true,
@@ -275,11 +316,8 @@ function runLaunch(opts, acquireLock) {
           stdio: ['ignore', logFd, logFd],
         });
         child.unref();
-        browserPid = waitForOwnedCdpPid(cdpPort, ownedBrowser, opts.progress);
-        if (browserPid === null) {
-          stopProfileProcessesSync(profile, { extraPids: child.pid ? [child.pid] : [] });
-          throw ownedListenerMissing();
-        }
+        // spawn returns after exec, so the browser is in ps at once.
+        browserPid = awaitOwnedListener({ extraPids: child.pid ? [child.pid] : [] }, 0);
       }
       if (loadsOverCdp)
         cdpLoad = loadExtensionOverCdp(opts, browserPid, initialUrl, clearLaunchMarkers);
@@ -501,23 +539,56 @@ function macApplicationForExecutable(executable) {
   return null;
 }
 
-function waitForOwnedCdpPid(port, ownedBrowser, progress) {
-  const attempts = 300;
-  for (let i = 0; i < attempts; i += 1) {
-    const pid = cdpListenerPids(port).find(ownedBrowser);
-    if (pid !== undefined) return pid;
-    // Every 50 attempts (about 5 s): enough to show the wait is moving.
-    if (i > 0 && i % 50 === 0) {
+function foreignPortError(port, pids, next = 'pick a free --cdp-port, or stop that browser.') {
+  return new Error(
+    `Refusing to launch on CDP port ${port}: it is held by a browser this harness did not launch (pid ${pids.join(', ')}). ` +
+      `Next: ${next}`,
+  );
+}
+
+// Polls for the launched browser's own CDP listener for up to 30 s: `{ pid }`
+// once it appears, `{}` when the time is up. Stops early with `{ foreignPids }`
+// once only processes it did not launch hold the port (the browser can no
+// longer bind it), or with `{ exited: true }` once no process holds the
+// profile. Either must hold for a second, so a brief ps/lsof gap is not taken
+// for a failure. "Exited" counts only once a profile process has been seen, or
+// after `firstSightingMs` with none. `seen` says whether one was.
+function waitForOwnedCdpPid(port, ownedBrowser, profile, progress, firstSightingMs) {
+  const budgetMs = 30_000;
+  const confirmMs = 1000;
+  const startedAt = Date.now();
+  let seen = false;
+  let exitedSince = null;
+  let foreignSince = null;
+  let reportedAt = startedAt;
+  while (Date.now() - startedAt < budgetMs) {
+    const listeners = cdpListenerPids(port);
+    const pid = listeners.find(ownedBrowser);
+    if (pid !== undefined) return { pid };
+    const now = Date.now();
+    if (profileProcessPids(profile).length > 0) {
+      seen = true;
+      exitedSince = null;
+    } else if (seen || now - startedAt >= firstSightingMs) {
+      exitedSince ??= now;
+    }
+    if (exitedSince !== null && now - exitedSince >= confirmMs) return { exited: true, seen };
+    foreignSince = listeners.length > 0 ? (foreignSince ?? now) : null;
+    if (foreignSince !== null && now - foreignSince >= confirmMs)
+      return { foreignPids: listeners, seen };
+    // About every 5 s: enough to show the wait is moving.
+    if (now - reportedAt >= 5000) {
+      reportedAt = now;
       progress({
         waitingFor: `an owned CDP listener on 127.0.0.1:${port}`,
-        current: i,
-        total: attempts,
-        unit: 'attempts',
+        current: Math.round((now - startedAt) / 1000),
+        total: budgetMs / 1000,
+        unit: 'seconds',
       });
     }
     spawnSync('sleep', ['0.1']);
   }
-  return null;
+  return { seen };
 }
 
 function assertIsolatedProfile(profile) {
@@ -643,25 +714,39 @@ function extensionPageUrl(extensionDir, page) {
   return id ? `chrome-extension://${id}/${page}` : '';
 }
 
+// The CDP HTTP paths the launcher reads: the target list, the version, or one
+// target to close. CDP target ids are hex or UUIDs.
+const CDP_HTTP_PATH = /^\/json\/(?:list|version|close\/[A-Za-z0-9-]+)$/u;
+const CDP_TARGET_ID = /^[A-Za-z0-9-]+$/u;
+// A child node keeps cdpHttp synchronous. The port and path reach it as argv,
+// never as script source, so a path cannot change what it runs.
+const CDP_HTTP_SCRIPT = `
+const http = require('http');
+const [port, pathname] = process.argv.slice(1);
+http.get({ host: '127.0.0.1', port: Number(port), path: pathname }, (res) => {
+  let body = '';
+  res.on('data', (chunk) => { body += chunk; });
+  res.on('end', () => {
+    process.stdout.write(body);
+    process.exitCode = res.statusCode === 200 ? 0 : 1;
+  });
+}).on('error', () => process.exit(1));
+`;
+
+/**
+ * GET a CDP HTTP path on 127.0.0.1. Returns the body, or null when the port or
+ * path is not one the launcher uses, or the request fails.
+ * @param {number} port
+ * @param {string} pathname `/json/list`, `/json/version` or `/json/close/<target id>`
+ * @returns {string | null}
+ */
 function cdpHttp(port, pathname) {
-  const result = spawnSync(
-    process.execPath,
-    [
-      '-e',
-      `
-    const http = require('http');
-    http.get('http://127.0.0.1:${Number(port)}${pathname}', (res) => {
-      let body = '';
-      res.on('data', (chunk) => { body += chunk; });
-      res.on('end', () => {
-        process.stdout.write(body);
-        process.exitCode = res.statusCode === 200 ? 0 : 1;
-      });
-    }).on('error', () => process.exit(1));
-  `,
-    ],
-    { encoding: 'utf8', timeout: 4000 },
-  );
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  if (typeof pathname !== 'string' || !CDP_HTTP_PATH.test(pathname)) return null;
+  const result = spawnSync(process.execPath, ['-e', CDP_HTTP_SCRIPT, String(port), pathname], {
+    encoding: 'utf8',
+    timeout: 4000,
+  });
   if (result.status !== 0) return null;
   return result.stdout;
 }
@@ -710,6 +795,13 @@ function homeTabsToClose(targets, { extensionId, homePage, defaultTitle }) {
 // readiness converges home tabs again, so a pruning failure must not fail the
 // launch. Every failure is returned so the launch log says why a duplicate tab
 // survived instead of hiding it.
+/**
+ * Close the extra `homePage` tabs and stray blank tabs the browser on `port` has.
+ * @param {number} port CDP port on 127.0.0.1.
+ * @param {string} extensionDir The unpacked extension, for its id.
+ * @param {{ homePage?: string, defaultTitle?: string }} options
+ * @returns {string[]} What could not be done, one line each; empty when all went well.
+ */
 function pruneExtraHomeTabs(port, extensionDir, { homePage, defaultTitle }) {
   if (!homePage) return [];
   const extensionId = extensionIdFromExtensionDir(extensionDir);
@@ -725,10 +817,17 @@ function pruneExtraHomeTabs(port, extensionDir, { homePage, defaultTitle }) {
   if (!Array.isArray(targets)) return ['/json/list did not return a target list'];
   const problems = [];
   for (const target of homeTabsToClose(targets, { extensionId, homePage, defaultTitle })) {
-    if (cdpHttp(port, `/json/close/${target.id}`) === null)
+    // The id comes from the endpoint's own response: close only a CDP-shaped one.
+    if (!CDP_TARGET_ID.test(target.id)) {
+      problems.push(
+        `skipped target with an invalid id: ${JSON.stringify(target.id)} (${target.url})`,
+      );
+      continue;
+    }
+    if (cdpHttp(port, `/json/close/${encodeURIComponent(target.id)}`) === null)
       problems.push(`could not close ${target.url} (${target.id})`);
   }
   return problems;
 }
 
-module.exports = { launchBrowser, homeTabsToClose };
+module.exports = { launchBrowser, homeTabsToClose, cdpHttp, pruneExtraHomeTabs };

package/src/web-dapp/lib/policy-fence.mjs

@@ -6,11 +6,23 @@
 // paths or node built-ins. The digest of those files goes in
 // RECIPE_WEB_DAPP_POLICY_DIGEST, and a process that loads the policy with it
 // set refuses files that changed since.
+//
+// The source scan only lists the files to digest; it can miss an import (an
+// aliased require, say, in a branch only a leaf takes). So a process that loads
+// the policy also fences its imports at run time, as the plugin loader does: a
+// resolve hook refuses any import resolved from those files that lands outside
+// them, while the process runs. It fences imports, not code: it is no sandbox
+// for code the plugin digest already covers. It goes by the importing file, as
+// the plugin loader does, so a require created for another path, Module
+// internals, or a CommonJS request Node answers from its cache without
+// resolving again pass it; and a process that loads two policies lets a file
+// both digests cover import the files of either.
 
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
-import { isBuiltin } from 'node:module';
+import nodeModule, { isBuiltin } from 'node:module';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 export const POLICY_DIGEST_ENV = 'RECIPE_WEB_DAPP_POLICY_DIGEST';
 
@@ -116,13 +128,60 @@ export function fencePolicy({ file, covered, scope }) {
   return digestFiles(policyClosure(file, allowed));
 }
 
-/** Refuse a policy whose files changed since mm-harness bound it (`digest`). */
+/**
+ * Refuse a policy whose files changed since mm-harness bound it (`digest`).
+ * Returns the real paths of the files it digested.
+ */
 export function assertPolicyDigest(file, digest) {
-  const now = digestFiles(policyClosure(file, () => {}));
-  if (now !== digest) {
+  const files = policyClosure(file, () => {});
+  if (digestFiles(files) !== digest) {
     throw new Error(
       `web-dapp venue policy ${file} or a file it imports changed since the host bound it.\n` +
         'Next: rerun the command, so it binds and checks the policy again.',
     );
   }
+  return files;
+}
+
+// The real paths of the files of each policy this process loaded.
+const fenced = [];
+let hookInstalled = false;
+
+/**
+ * Before a process loads the policy at `file`: check its files against
+ * `digest` when the host bound one, and refuse, from then on, any import from
+ * those files that resolves outside them.
+ */
+export function fencePolicyImports(file, digest) {
+  if (typeof nodeModule.registerHooks !== 'function') {
+    throw new Error(
+      `web-dapp needs Node.js 22.15 or later (module.registerHooks fences the venue policy's imports); this is ${process.version}.`,
+    );
+  }
+  fenced.push(new Set(digest ? assertPolicyDigest(file, digest) : policyClosure(file, () => {})));
+  if (hookInstalled) return;
+  nodeModule.registerHooks({
+    resolve(specifier, context, nextResolve) {
+      const parent = realPath(context.parentURL);
+      const owners = parent === undefined ? [] : fenced.filter((files) => files.has(parent));
+      if (owners.length === 0 || isBuiltin(specifier)) return nextResolve(specifier, context);
+      const result = nextResolve(specifier, context);
+      const target = realPath(result.url);
+      if (target !== undefined && owners.some((files) => files.has(target))) return result;
+      throw new PolicyFenceError(
+        `web-dapp venue policy file ${parent} imports '${specifier}', which resolves to ${target ?? result.url}: outside the policy files the host digested.`,
+      );
+    },
+  });
+  hookInstalled = true;
+}
+
+// The real path behind a file: URL; undefined for another scheme or a missing file.
+function realPath(url) {
+  if (!url?.startsWith('file:')) return undefined;
+  try {
+    return fs.realpathSync(fileURLToPath(url));
+  } catch {
+    return undefined;
+  }
 }

package/src/web-dapp/lib/policy.mjs

@@ -7,7 +7,7 @@
 import { createRequire } from 'node:module';
 import path from 'node:path';
 
-import { assertPolicyDigest, POLICY_DIGEST_ENV } from './policy-fence.mjs';
+import { fencePolicyImports, POLICY_DIGEST_ENV } from './policy-fence.mjs';
 
 export const POLICY_ENV = 'RECIPE_WEB_DAPP_POLICY';
 // The policy contract this web-dapp reads; a policy declares the version it was written for.
@@ -90,8 +90,9 @@ export function webDappPolicy(env = process.env) {
   }
   const digest = env[POLICY_DIGEST_ENV];
   if (loaded?.file !== file || loaded.digest !== digest) {
-    // The digest mm-harness took when it bound the policy: refuse files that changed since.
-    if (digest) assertPolicyDigest(file, digest);
+    // The digest mm-harness took when it bound the policy: refuse files that changed since,
+    // and imports from them that leave them.
+    fencePolicyImports(file, digest);
     // The policy module uses node built-ins only and has no top-level await, so it loads synchronously.
     loaded = {
       file,

package/src/web-dapp/wallet-host.mjs

@@ -636,16 +636,24 @@ if (network === 'testnet') {
   // resolver rule, WebSocket through the resolver rule).
   const { probe } = policy;
   const host = mainnetHosts.includes(probe.host) ? probe.host : mainnetHosts[0];
+  // The probe URLs are built here and spliced in as JSON strings, so the
+  // policy's probe paths cannot change the page expression. The host is the
+  // policy's probe host only when --mainnet-hosts lists it.
+  const httpUrl = JSON.stringify(`https://${host}${probe.httpPath}?${PROBE_MARK}`);
+  const resolverUrl = JSON.stringify(
+    `https://${host}:${RESOLVER_PROBE_PORT}${probe.httpPath}?${PROBE_MARK}`,
+  );
+  const wsUrl = JSON.stringify(`wss://${host}${probe.wsPath}?${PROBE_MARK}`);
   const httpProbe = await evaluate(
-    `fetch('https://${host}${probe.httpPath}?${PROBE_MARK}', { method: 'POST', headers: { 'content-type': 'application/json' }, body: ${JSON.stringify(probe.httpBody)} }).then(() => 'reached', () => 'blocked')`,
+    `fetch(${httpUrl}, { method: 'POST', headers: { 'content-type': 'application/json' }, body: ${JSON.stringify(probe.httpBody)} }).then(() => 'reached', () => 'blocked')`,
     20000,
   );
   const resolverProbe = await evaluate(
-    `fetch('https://${host}:${RESOLVER_PROBE_PORT}${probe.httpPath}?${PROBE_MARK}', { method: 'POST' }).then(() => 'reached', () => 'blocked')`,
+    `fetch(${resolverUrl}, { method: 'POST' }).then(() => 'reached', () => 'blocked')`,
     20000,
   );
   const wsProbe = await evaluate(
-    `new Promise((resolve) => { const socket = new WebSocket('wss://${host}${probe.wsPath}?${PROBE_MARK}'); const done = (value) => { try { socket.close(); } catch {} resolve(value); }; socket.onopen = () => done('reached'); socket.onerror = () => done('blocked'); setTimeout(() => done('timeout'), 10000); })`,
+    `new Promise((resolve) => { const socket = new WebSocket(${wsUrl}); const done = (value) => { try { socket.close(); } catch {} resolve(value); }; socket.onopen = () => done('reached'); socket.onerror = () => done('blocked'); setTimeout(() => done('timeout'), 10000); })`,
     20000,
   );
   if (httpProbe !== 'blocked' || resolverProbe !== 'blocked' || wsProbe !== 'blocked') {