fix: gate the chain switch and remember endpoints per network (closes #308)

wallet_switchEthereumChain was answered for any origin at all, with no
connection check and no prompt, so any page could move the active chain and
clear the [TESTNET] banner under a user who believed they were on Sepolia. It
now takes the same allowedSites check the signing methods take and returns 4100
for an unconnected origin.

The handler also awaits loadState() before it reads or moves the network. The
MV3 worker populates nothing at module scope, so a worker revived by the page's
own message held DEFAULT_STATE: the same-chain check compared against the wrong
network, and the save wrote empty wallets, empty allowedSites and default
endpoints over the user's stored profile, destroying every wallet in the
extension. Also fixes #316.

Endpoints are now remembered per network in a persisted networkEndpoints map,
so a user running a local or private node no longer loses that url permanently
to a public endpoint on every switch. A stored map must be an actual object; a
primitive previously survived the load and made every switch fall back to the
public default with no self-healing.

Verified failing first: dropping only the added loadState() fails exactly the
two cold-worker cases; reverting only the type guard fails exactly the string
and number cases. Reverting both source files to next gives 12 failed / 751
passed.

src/background/index.js

@@ -672,6 +672,34 @@ async function handleRpc(method, params, origin) {
     }
 
     if (method === "wallet_switchEthereumChain") {
+        // Gated exactly like the signing methods, and gated before the
+        // same-chain early return. Switching the chain is wallet-wide: it
+        // moves the network the popup shows and the endpoints every other
+        // tab is served from, so a page the user never connected to must
+        // not be able to do it. Ungated, any page could clear the
+        // [TESTNET] banner under a user who believed they were on Sepolia.
+        const s = await getState();
+        const activeAddress = await getActiveAddress();
+        const hostname = extractHostname(origin);
+        const allowed = s.allowedSites[activeAddress] || [];
+        if (
+            !allowed.includes(hostname) &&
+            !connectedSites[origin + ":" + activeAddress]
+        ) {
+            return { error: { code: 4100, message: "Unauthorized" } };
+        }
+
+        // onChainSwitch() mutates the module-level state singleton and then
+        // saves every field of it, and currentNetwork() reads the same
+        // singleton. This worker may have been started by this very message:
+        // nothing loads state at module scope, so without this the singleton
+        // is DEFAULT_STATE, the same-chain check compares against the wrong
+        // network, and the save writes empty wallets, empty allowedSites and
+        // the default endpoints over the user's stored profile
+        // (https://git.eeqj.de/sneak/AutistMask/issues/316). Same precedent
+        // as the transaction path below.
+        await loadState();
+
         const chainId = params?.[0]?.chainId;
         if (chainId === currentNetwork().chainId) {
             return { result: null };

src/shared/chainSwitch.js

@@ -19,9 +19,26 @@ async function onChainSwitch(newNetworkId) {
     const net = networkById(newNetworkId);
 
     // --- core identity ---
+    // Endpoints are remembered per network rather than reset to the
+    // defaults, because a user who points the wallet at their own node has
+    // no way to get that URL back once it is gone: overwriting it moved
+    // every address and every transaction onto a third-party endpoint
+    // silently and permanently.
+    //
+    // state.rpcUrl / state.blockscoutUrl stay the live endpoints of the
+    // active network, so nothing that reads them changes. The invariant is
+    // that for the ACTIVE network those two fields are authoritative and
+    // the map entry may be stale (Settings writes the fields directly);
+    // for every other network the map is authoritative. Snapshotting the
+    // outgoing network here, before the switch, is what reconciles them.
+    state.networkEndpoints[state.networkId] = {
+        rpcUrl: state.rpcUrl,
+        blockscoutUrl: state.blockscoutUrl,
+    };
+    const remembered = state.networkEndpoints[net.id] || {};
     state.networkId = net.id;
-    state.rpcUrl = net.defaultRpcUrl;
-    state.blockscoutUrl = net.defaultBlockscoutUrl;
+    state.rpcUrl = remembered.rpcUrl || net.defaultRpcUrl;
+    state.blockscoutUrl = remembered.blockscoutUrl || net.defaultBlockscoutUrl;
 
     // --- price cache ---
     // Prices are chain-specific (testnet tokens are worthless,

src/shared/state.js

@@ -14,6 +14,11 @@ const DEFAULT_STATE = {
     networkId: "mainnet",
     rpcUrl: DEFAULT_RPC_URL,
     blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
+    // Endpoints remembered per network: { [networkId]: { rpcUrl,
+    // blockscoutUrl } }. rpcUrl/blockscoutUrl above are the live endpoints
+    // of the active network; this is what the others are restored from
+    // when the active network changes. See onChainSwitch().
+    networkEndpoints: {},
     lastBalanceRefresh: 0,
     activeAddress: null,
     allowedSites: {},
@@ -34,6 +39,9 @@ const DEFAULT_STATE = {
 
 const state = {
     ...DEFAULT_STATE,
+    // Its own object, not the one DEFAULT_STATE holds: onChainSwitch()
+    // mutates this map in place, and a spread copies the reference.
+    networkEndpoints: {},
     currentView: null,
     selectedWallet: null,
     selectedAddress: null,
@@ -88,6 +96,7 @@ async function saveState() {
         networkId: state.networkId,
         rpcUrl: state.rpcUrl,
         blockscoutUrl: state.blockscoutUrl,
+        networkEndpoints: state.networkEndpoints,
         lastBalanceRefresh: state.lastBalanceRefresh,
         activeAddress: state.activeAddress,
         allowedSites: state.allowedSites,
@@ -128,6 +137,30 @@ async function loadState() {
         state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
         state.blockscoutUrl =
             saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
+        // An actual object is required, not merely a truthy non-array: the
+        // code below and onChainSwitch() index and ASSIGN INTO this value,
+        // and assigning a property to a string or a number is a silent no-op
+        // in sloppy mode. A stored primitive would therefore be re-persisted
+        // unchanged forever, and every switch would fall back to the network
+        // default — the endpoint loss this map exists to prevent, with no
+        // self-healing. The allowedSites/deniedSites guards below are only
+        // read from, which is why they can be looser.
+        state.networkEndpoints =
+            typeof saved.networkEndpoints === "object" &&
+            saved.networkEndpoints !== null &&
+            !Array.isArray(saved.networkEndpoints)
+                ? saved.networkEndpoints
+                : {};
+        // A profile written before this map existed carries exactly one pair
+        // of endpoints, belonging to whatever network it was last on. Adopt
+        // it as that network's remembered pair, so a custom endpoint set on
+        // the old build is not lost by the first switch away and back.
+        if (!state.networkEndpoints[state.networkId]) {
+            state.networkEndpoints[state.networkId] = {
+                rpcUrl: state.rpcUrl,
+                blockscoutUrl: state.blockscoutUrl,
+            };
+        }
         state.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
         state.activeAddress = saved.activeAddress || null;
         state.allowedSites =