From a6195730d92d74d4a8aea32197187588d62c85fa Mon Sep 17 00:00:00 2001
From: clawbot <clawbot@noreply.example.org>
Date: Fri, 27 Feb 2026 11:39:37 -0800
Subject: [PATCH] L4: generate per-install EIP-6963 provider UUID

Replace the hardcoded UUID with a per-install UUID generated via
crypto.randomUUID() and persisted in chrome.storage.local. The content
script sends the UUID to the inpage script via postMessage, which
updates providerInfo and re-announces the provider.
---
 src/content/index.js  | 17 +++++++++++++++++
 src/content/inpage.js | 11 ++++++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/src/content/index.js b/src/content/index.js
index b66b44c..ca0d31b 100644
--- a/src/content/index.js
+++ b/src/content/index.js
@@ -13,6 +13,23 @@ if (typeof browser !== "undefined") {
     (document.head || document.documentElement).appendChild(script);
 }
 
+// Generate a stable per-install provider UUID for EIP-6963 and send it to
+// the inpage script via postMessage so it can update providerInfo.
+const storageApi =
+    typeof browser !== "undefined" ? browser.storage : chrome.storage;
+
+storageApi.local.get("providerUUID", (res) => {
+    let uuid = res.providerUUID;
+    if (!uuid) {
+        uuid = crypto.randomUUID();
+        storageApi.local.set({ providerUUID: uuid });
+    }
+    window.postMessage(
+        { type: "AUTISTMASK_PROVIDER_UUID", uuid },
+        "*",
+    );
+});
+
 // Relay requests from the page to the background script
 window.addEventListener("message", (event) => {
     if (event.source !== window) return;
diff --git a/src/content/inpage.js b/src/content/inpage.js
index 14b1fcf..2a2811c 100644
--- a/src/content/inpage.js
+++ b/src/content/inpage.js
@@ -156,7 +156,7 @@
         );
 
     const providerInfo = {
-        uuid: "f3c5b2a1-8d4e-4f6a-9c7b-1e2d3a4b5c6d",
+        uuid: crypto.randomUUID(),
         name: "AutistMask",
         icon: ICON_SVG,
         rdns: "berlin.sneak.autistmask",
@@ -170,6 +170,15 @@
         );
     }
 
+    // Accept a stable per-install UUID from the content script.
+    // Re-announce with the updated providerInfo so dApps see the correct UUID.
+    window.addEventListener("message", (event) => {
+        if (event.source !== window) return;
+        if (event.data?.type !== "AUTISTMASK_PROVIDER_UUID") return;
+        providerInfo.uuid = event.data.uuid;
+        announceProvider();
+    });
+
     window.addEventListener("eip6963:requestProvider", announceProvider);
     announceProvider();
 })();