fix: a site allowed without Remember stays connected when the background worker idles (closes #526)

A connection allowed without "Remember my choice for this site" was held
in a module-level object in the background worker. Chrome stops the worker
after about 30 seconds idle, so the connection ended at the first idle
spell. Each such connection is now one item in the browser's session
storage, which outlives the worker but not the browser, read and written
through new wrappers in src/shared/browserApi.js. Settings now waits for
the background to end a removed site's connections before listing the
connected sites again. The Firefox manifest declares 115.0, the first
version with session storage, as its minimum.

Model: opus-5-5

tests/e2e/run.js

@@ -3861,10 +3861,8 @@ test("eth_requestAccounts approved returns the selected address (#183)", async (
         // all; this measures that the whole address is visible (#517).
         await assertAddressesFit(popup, "the connection prompt");
 
-        // Remembered, so the connection survives a background worker that MV3
-        // terminates after 30 seconds idle. The in-memory connectedSites map
-        // does not, and the sign and transaction tests below all require the
-        // origin to still be authorized.
+        // Remembered, because the sign and transaction tests below all
+        // require the origin to still be authorized.
         await popup.check("#approve-remember");
         await clickAndClose(popup, "#btn-approve");
 

tests/e2e/slowApproval.js

@@ -22,6 +22,11 @@
 // Before the approvals are raised it watches the worker stop on its own, so a
 // run in which something else keeps the worker running cannot pass.
 //
+// The site is connected without "Remember", and once the worker has stopped
+// the program requires the site still to be told the address: such a
+// connection used to be held in the worker's memory and ended with it
+// (https://git.eeqj.de/sneak/AutistMask/issues/526).
+//
 // The dApp page and the stub node are the loopback ones the Firefox suite also
 // uses (tests/e2e/dapp.js). The site is connected and the node chosen
 // through the extension's own screens, so nothing is written to its storage
@@ -311,8 +316,8 @@ async function main() {
         );
         await send("Target.closeTarget", { targetId: popup.targetId });
 
-        // The site, connected through the real prompt with "Remember", so
-        // the connection is stored rather than held by the worker.
+        // The site, connected through the real prompt without "Remember", so
+        // the connection is one that has to outlive the worker stopping below.
         const dapp = await openPage(node.url);
         await until("the injected provider", () =>
             dapp.evaluate("!!window.ethereum && !!window.__dapp"),
@@ -329,7 +334,7 @@ async function main() {
             inPrompt(shows("view-approve-site")),
         );
         await inPrompt(
-            "document.getElementById('approve-remember').checked = true",
+            "document.getElementById('approve-remember').checked = false",
         );
         // The prompt closes itself on the click.
         await inPrompt(click("btn-approve")).catch(() => {});
@@ -365,6 +370,20 @@ async function main() {
                 "s",
         );
 
+        // The site's request starts the worker again, and the new worker still
+        // has the connection allowed without "Remember"
+        // (https://git.eeqj.de/sneak/AutistMask/issues/526).
+        const stillConnected = await dapp.evaluate(
+            "window.ethereum.request({ method: 'eth_accounts' })",
+        );
+        check(
+            "a site allowed without Remember is still connected after the worker stopped",
+            Array.isArray(stillConnected) &&
+                stillConnected.length === 1 &&
+                getAddress(stillConnected[0]) === address,
+            "eth_accounts answered " + JSON.stringify(stillConnected),
+        );
+
         // A transaction approval and a signature approval, both open at once.
         await dapp.evaluate(
             "window.__dapp.start('tx', 'eth_sendTransaction', [" +