test(perps): add Farmslot headless recipe smoke

[abretonc7s]

Summary

Replaces the previous embedded Recipe v1 runner approach with a minimal headless consumer of the reusable Farmslot recipe harness.

This PR is intentionally stacked on #8893 (feat/perps-e2e-validation) and keeps MetaMask core changes narrow:

• add @farmslot/recipe-harness as a devDependency for @metamask/perps-controller
• add a package-local headless recipe + action manifest under packages/perps-controller/recipes/
• add yarn workspace @metamask/perps-controller recipe:controller-smoke
• ignore generated recipe artifacts / local agent state so pre-push lint does not scan local run output

The recipe uses the shared farmslot-recipe CLI and runs the existing PerpsController.trading.test.ts smoke suite, so it validates PerpsController public methods instead of embedding a custom runner or calling HyperLiquid directly from the recipe.

Farmslot dependency

Published and source-merged before opening this PR:

• @farmslot/protocol@0.5.0
• @farmslot/recipe-harness@0.1.0
• Farmslot publish PR: https://github.com/abretonc7s/farmslot/pull/123

Validation

• npm view @farmslot/protocol version -> 0.5.0
• npm view @farmslot/recipe-harness version -> 0.1.0
• yarn install --immutable
• yarn workspace @metamask/perps-controller recipe:controller-smoke
  • recipe status: pass
  • harness: @farmslot/recipe-harness@0.1.0
  • indexed Jest report: success: true, numFailedTests: 0, numTotalTests: 15
• yarn lint
• pre-push hook via normal git push

Independent review

• Claude review of core diff: APPROVE after removing fragile stderr/test-count assertion.
• Claude review of Farmslot publish PR Sync npm-shrinkwrap.json file #123: APPROVE, no blockers.

---

Note

Low Risk
Dev-only test harness and dependency wiring; no production controller or auth logic changes.

Overview
Adds a Farmslot headless recipe for @metamask/perps-controller so controller trading smoke can run via the shared farmslot-recipe CLI instead of a custom embedded runner.

The workspace wires @farmslot/recipe-harness as a dev dependency, a recipe:controller-smoke script, and package-local recipes/controller-smoke.recipe.json plus headless.action-manifest.json. The recipe runs PerpsController.trading.test.ts, checks exit code and Jest JSON (success, zero failures, minimum test count), and indexes the report under .recipe-artifacts/.

Repo hygiene: .gitignore entries for recipe output and local agent dirs; .yarnrc.yml preapproves @farmslot/* for the npm age gate; yarn.lock picks up the new packages.

^{Reviewed by Cursor Bugbot for commit 3811ad5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​farmslot/​recipe-harness@​0.1.0

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• @farmslot/recipe-harness@0.1.0
• ws@8.21.0

View full report

[abretonc7s]

@SocketSecurity ignore npm/@farmslot/recipe-harness@0.1.0
@SocketSecurity ignore npm/ws@8.21.0

Accepting these package-specific alerts for this PR after review:

• @farmslot/recipe-harness@0.1.0 was published from the merged Farmslot source PR https://github.com/abretonc7s/farmslot/pull/123 and independently reviewed. The flagged command adapter is the intended headless recipe primitive and only runs trusted repo-owned recipe files in this PR. Network-capable code is part of the generic harness runtime surface, but this MetaMask core recipe only declares/uses core actions (command, assert_exit_code, assert_json, index_artifacts, end). The package is dev-only for validation, not production runtime code.
• ws@8.21.0 is the maintained websocket package already used broadly in the ecosystem; this PR only dedupes existing ws ranges to the latest 8.x while adding the harness dependency.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3811ad5. Configure here.}

[cursor]

Scope wildcard bypasses age gate for all future packages

Medium Severity

The @farmslot/* wildcard in npmPreapprovedPackages bypasses the 3-day npmMinimalAgeGate for every package ever published under the @farmslot npm scope—not just the two packages actually used (@farmslot/recipe-harness and @farmslot/protocol). Unlike the other wildcarded scopes (@metamask, @lavamoat, @ts-bridge), @farmslot is a less-established third-party scope. Yarn supports listing specific package names here, which would limit the supply-chain exposure to only the packages this monorepo actually consumes.

^{Reviewed by Cursor Bugbot for commit 3811ad5. Configure here.}

[abretonc7s]

Closing this stacked PR as superseded. The intended final shape is now directly on #8893 so Core only needs one PR:

• removes the direct HyperLiquid e2e scripts
• keeps the reusable @farmslot/recipe-harness dependency
• replaces the recipe with a client-style smoke that calls PerpsController:* messenger actions, matching Mobile/Extension integration boundaries

Superseded by #8893.