fix: run libsodium on WebAssembly under the extension CSP (closes #182)

2026-08-12 10:30:15 +02:00
parent ba35282092
commit bf1dbec87c
9 changed files with 323 additions and 23 deletions
--- a/TODO.md
+++ b/TODO.md
@@ -51,6 +51,11 @@ undefined identifiers, which is how
  Ethereum mainnet ERC-20s — with `TOKENS` in `src/shared/tokenList.js` named as
  the authoritative set
  ([#239](https://git.eeqj.de/sneak/AutistMask/issues/239)).
+- 2026-08-11: libsodium runs on WebAssembly in the shipped builds —
+  `'wasm-unsafe-eval'` added to both manifest CSPs after measuring the wasm2js
+  fallback at 20x the Argon2id cost, pinned in both directions by
+  `tests/manifest.test.js` and observed in the real popup by the e2e suite
+  ([#182](https://git.eeqj.de/sneak/AutistMask/issues/182)).
 - 2026-08-11: Known-symbol spoof verification became a Settings toggle
  (`hideSpoofedSymbols`), on by default, governing the transaction-history
  filter and the fraud-contract learning it feeds