From 0de35271960dac4af6a83ee49d9edd6d606e6b3f Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Mon, 21 Sep 2026 07:29:47 +0000
Subject: [PATCH] chore: keep the internal view id out of the release banner
 (closes #375)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The debug/testnet banner appended the active view's internal id, so the
user saw text like "[TESTNET] (approve-tx)" — developer vocabulary, and on
the approval screen it sat directly above the carefully worded line stating
what is being authorized. The view id is now gated on the compile-time
DEBUG constant instead of isDebug(), so it survives only in a debug build.
A testnet or the runtime debug toggle still raises the banner, but without
the view id, which is what a release build shows.

Model: opus-4-8
---
 TODO.md                    | 10 ++++++++++
 src/popup/views/helpers.js |  7 ++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/TODO.md b/TODO.md
index b9b333e..6b5b595 100644
--- a/TODO.md
+++ b/TODO.md
@@ -45,6 +45,16 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-09-21: The debug/testnet banner no longer shows the internal view id to
+  the user in a release build
+  ([#375](https://git.eeqj.de/sneak/AutistMask/issues/375)). The banner appended
+  the active view's id (e.g. `[TESTNET] (approve-tx)`), which is developer
+  vocabulary sitting directly above the approval screen's carefully worded
+  authorization text. The suffix is now gated on the compile-time `DEBUG`
+  constant rather than `isDebug()`, so it survives only in a debug build; a
+  testnet or the runtime debug toggle still raises the banner but without the
+  view id.
+
 - 2026-08-30: An address no longer wraps, or is shortened to fit, in any of the
   common views ([#380](https://git.eeqj.de/sneak/AutistMask/issues/380)). The
   wallet list was the reported case: the address shared one row with the
diff --git a/src/popup/views/helpers.js b/src/popup/views/helpers.js
index 057739f..f1e5f9f 100644
--- a/src/popup/views/helpers.js
+++ b/src/popup/views/helpers.js
@@ -12,6 +12,7 @@
 // escapeHtml lives in src/shared/html.js, where the escape and the
 // reasoning behind it are; it is re-exported below so views keep importing
 // it from here.
+const { DEBUG } = require("../../shared/constants");
 const { escapeHtml } = require("../../shared/html");
 const { isDebug } = require("../../shared/log");
 const { formatUsd, getPrice } = require("../../shared/prices");
@@ -119,7 +120,11 @@ function updateDebugBanner(viewName) {
                 "background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
             document.body.prepend(banner);
         }
-        const suffix = viewName ? " (" + viewName + ")" : "";
+        // The view id is internal vocabulary; it helps while developing but
+        // means nothing to a user. Only a debug build appends it, gated on the
+        // compile-time DEBUG constant so a release build never shows it — not
+        // isDebug(), which is also true for a testnet or the runtime toggle.
+        const suffix = DEBUG && viewName ? " (" + viewName + ")" : "";
         if (debug && net.isTestnet) {
             banner.textContent = "DEBUG / INSECURE [TESTNET]" + suffix;
         } else if (net.isTestnet) {