fix: run libsodium on WebAssembly under the extension CSP (closes #182)

libsodium ships a WASM build and a wasm2js translation in one file, tries
WASM first, and silently falls back if instantiation throws. Under a plain
script-src 'self' the fallback was taken on every popup load, announced by
nothing but an uncaught CompileError.

Measured on the vault's own Argon2id parameters (OPSLIMIT_INTERACTIVE,
MEMLIMIT_INTERACTIVE), node 22: WASM 141-198ms per derivation, wasm2js
3204-3660ms. The work factor is identical either way — it is set by the
ops and memory parameters, not by wall time — so the fallback bought no
security and cost about 3.5s on every operation that asks for the
password, which is every signature.

Both manifests now declare script-src 'self' 'wasm-unsafe-eval';
object-src 'self' for extension pages: an object under
content_security_policy.extension_pages for Chrome MV3, a bare string for
Firefox MV2. The keyword permits compiling WebAssembly and nothing else —
not eval() of strings, not inline script, not remote script — and reaching
it requires already executing script in an extension page. 'unsafe-eval'
is not granted.

The silence is what made this dangerous, so the fallback is now loud at
three levels: tests/manifest.test.js pins both policies to exactly that
token set, failing make check if the grant is dropped or if anything is
added beside it; tests/vaultBackend.test.js asserts the unit tests
exercise the WASM backend, with a self-validating check that libsodium
never swapped its fallback in; and the e2e suite compiles a WebAssembly
module inside the real popup under the real manifest, with the harness
allowlist entry that used to excuse the CompileError now deleted.

The runtime fallback itself is kept — a wallet that refuses to decrypt is
worse than a slow one — but vault.js now reports the backend and logs an
error when it is not WASM.

tests/e2e/harness.js

@@ -22,18 +22,12 @@ const EXT_PATH = path.join(REPO_ROOT, "dist", "chrome");
 // entry must name the issue that will remove it. This list is the one
 // concession in an otherwise zero-tolerance policy: an uncaught error is
 // how this harness caught issue #150 in the first place.
-const ALLOWED_ERRORS = [
-    {
-        // libsodium ships a WASM build and an asm.js fallback. The
-        // extension CSP (script-src 'self', with no wasm-unsafe-eval)
-        // refuses the WASM module on every popup load; libsodium catches
-        // it and falls back to asm.js, so the wallet works. Deciding
-        // which backend actually ships is issue #182, and this entry gets
-        // deleted when that lands.
-        issue: "#182",
-        pattern: /Refused to compile or instantiate WebAssembly module/,
-    },
-];
+//
+// Empty, and worth keeping that way. Its only entry was the WASM
+// CompileError libsodium provoked on every popup load, deleted with #182
+// when both manifests started allowing WASM; the run that used to need it
+// is now the run that proves the fix.
+const ALLOWED_ERRORS = [];
 
 function isAllowed(text) {
     return ALLOWED_ERRORS.some((a) => a.pattern.test(text));
@@ -247,6 +241,26 @@ async function visible(page, selector, timeout = 15000) {
     await page.waitForSelector(selector, { state: "visible", timeout });
 }
 
+// An empty WebAssembly module: magic number and version header, no
+// sections. Compiling it in the popup asks the one question that decides
+// libsodium's backend — may this realm compile WebAssembly — of the real
+// page under the real shipped manifest, which is the only place the
+// answer can be observed. Kept independent of src/shared/vault.js on
+// purpose: a bundle asked to grade itself proves less than an outside
+// observation of the same realm.
+const EMPTY_WASM_MODULE = [0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00];
+
+async function pageCompilesWasm(page) {
+    return page.evaluate(async (bytes) => {
+        try {
+            await WebAssembly.compile(new Uint8Array(bytes));
+            return true;
+        } catch (_) {
+            return false;
+        }
+    }, EMPTY_WASM_MODULE);
+}
+
 async function openPopup(ctx, popupUrl) {
     const page = await ctx.newPage();
     await page.goto(popupUrl);
@@ -285,5 +299,6 @@ module.exports = {
     launch,
     openAddressDetail,
     openPopup,
+    pageCompilesWasm,
     visible,
 };

tests/e2e/run.js

@@ -14,6 +14,7 @@ const {
     launch,
     openAddressDetail,
     openPopup,
+    pageCompilesWasm,
     visible,
 } = require("./harness");
 const { STUB_TOKEN, STUB_TX_HASH } = require("./network");
@@ -55,6 +56,27 @@ test("popup loads and reaches the welcome view", async (env) => {
     assert(title === "AutistMask", "unexpected popup title: " + title);
 });
 
+// The empirical half of #182. The manifest change is only a claim about
+// what the CSP permits; this is the observation. Two things have to hold
+// together, and the run covers both: the popup realm compiles WASM (here),
+// and no WASM refusal or abort is recorded anywhere in the run — the
+// harness allowlist that used to excuse exactly that error is now empty,
+// so a recurrence fails whichever test it lands in rather than being
+// tolerated. Since libsodium's WASM module is embedded in the bundle and
+// needs no fetch, a realm that compiles WASM is a realm where libsodium
+// takes the WASM path, and the next test drives a real vault encryption
+// through it.
+test("the popup compiles WebAssembly under the shipped CSP (#182)", async (env) => {
+    const ok = await pageCompilesWasm(env.page);
+    assert(
+        ok,
+        "the popup refused to compile WebAssembly. The shipped manifest CSP " +
+            "has lost 'wasm-unsafe-eval', so libsodium is back on its wasm2js " +
+            "fallback and every password derivation costs roughly 20x what it " +
+            "should — see the backend note in src/shared/vault.js",
+    );
+});
+
 test("wallet creation through the UI reaches the main view", async (env) => {
     await createWallet(env.page);
     const addrCount = await env.page

tests/manifest.test.js

@@ -0,0 +1,108 @@
+// The shipped Content Security Policy, pinned in both directions.
+//
+// This is the anti-regression check for #182. libsodium decides its
+// backend by trying to compile WebAssembly and catching the failure, so a
+// CSP that refuses WASM demotes the vault to the wasm2js translation —
+// roughly 20x slower per Argon2id derivation — and says so only in a
+// console message nobody reads. Dropping 'wasm-unsafe-eval' from either
+// manifest therefore has to fail a check, not a log line.
+//
+// It is equally a check against loosening. 'wasm-unsafe-eval' is granted
+// deliberately and narrowly (see the backend note in src/shared/vault.js);
+// 'unsafe-eval', 'unsafe-inline' and any remote script source are not, and
+// an exact match on the token set is what keeps the next edit from
+// smuggling one in alongside.
+//
+// build.js copies these files to dist/<target>/manifest.json verbatim, so
+// what is asserted here is what ships.
+
+const fs = require("fs");
+const path = require("path");
+
+const MANIFEST_DIR = path.join(__dirname, "..", "manifest");
+
+const EXPECTED_SCRIPT_SRC = ["'self'", "'wasm-unsafe-eval'"];
+const EXPECTED_OBJECT_SRC = ["'self'"];
+
+const FORBIDDEN_SOURCES = [
+    "'unsafe-eval'",
+    "'unsafe-inline'",
+    "http:",
+    "https:",
+    "data:",
+    "blob:",
+    "*",
+];
+
+function readManifest(name) {
+    return JSON.parse(
+        fs.readFileSync(path.join(MANIFEST_DIR, name + ".json"), "utf8"),
+    );
+}
+
+// "script-src 'self'; object-src 'self'" -> { "script-src": ["'self'"], ... }
+function parseCsp(policy) {
+    const directives = {};
+    for (const part of policy.split(";")) {
+        const tokens = part.trim().split(/\s+/).filter(Boolean);
+        if (tokens.length === 0) continue;
+        directives[tokens[0]] = tokens.slice(1);
+    }
+    return directives;
+}
+
+function assertPolicy(policy) {
+    const directives = parseCsp(policy);
+    expect(Object.keys(directives).sort()).toEqual([
+        "object-src",
+        "script-src",
+    ]);
+    expect(directives["script-src"].slice().sort()).toEqual(
+        EXPECTED_SCRIPT_SRC,
+    );
+    expect(directives["object-src"].slice().sort()).toEqual(
+        EXPECTED_OBJECT_SRC,
+    );
+    for (const source of FORBIDDEN_SOURCES) {
+        expect(directives["script-src"]).not.toContain(source);
+        expect(directives["object-src"]).not.toContain(source);
+    }
+}
+
+describe("shipped Content Security Policy", () => {
+    // MV3 takes an object and applies extension_pages to the popup and the
+    // background service worker, which is where libsodium runs.
+    test("chrome MV3 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("chrome").content_security_policy;
+        expect(typeof csp).toBe("object");
+        expect(Object.keys(csp)).toEqual(["extension_pages"]);
+        assertPolicy(csp.extension_pages);
+    });
+
+    // MV2 takes the policy as a bare string. Firefox does not require
+    // 'wasm-unsafe-eval' for MV2 today — enforcement is report-only and
+    // Bugzilla 1770909 is still open — so this is future-proofing, not a
+    // mandate. It does not weaken anything under either baseline: Gecko's
+    // real MV2 default (extensions.webextensions.default-content-security-
+    // policy) is `script-src 'self' 'wasm-unsafe-eval';` with no object-src
+    // at all, so this string leaves script-src unchanged and ADDS
+    // object-src 'self', constraining <object>/<embed> sources that were
+    // previously unrestricted. Against MDN's documented MV2 default
+    // (`script-src 'self'; object-src 'self';`) it is a one-token loosening,
+    // identical to Chrome. Same policy, different manifest shape.
+    test("firefox MV2 allows WASM and nothing else beyond 'self'", () => {
+        const csp = readManifest("firefox").content_security_policy;
+        expect(typeof csp).toBe("string");
+        assertPolicy(csp);
+    });
+
+    // The two targets share one codebase and one crypto path; a policy
+    // that drifts apart between them means one of the two builds is
+    // running a backend nothing tests.
+    test("both targets ship the same policy", () => {
+        const chrome =
+            readManifest("chrome").content_security_policy.extension_pages;
+        const firefox = readManifest("firefox").content_security_policy;
+        expect(firefox).toBe(chrome);
+    });
+});

tests/vaultBackend.test.js

@@ -0,0 +1,52 @@
+// The unit tests must exercise the libsodium backend that actually ships
+// (#182). Before this, they could not: node compiles WebAssembly happily,
+// the extension CSP refused it, and so the browser silently ran the
+// wasm2js translation while every test ran the WASM build.
+//
+// With 'wasm-unsafe-eval' in both manifests the two agree, and these tests
+// hold that agreement in place from the node side. tests/manifest.test.js
+// holds up the CSP end of it, and the end-to-end suite observes the real
+// popup.
+
+const { cryptoBackend } = require("../src/shared/vault");
+
+// The module libsodium-wrappers-sumo itself requires and drives. Not a new
+// dependency: it is inspected here, never used to perform crypto, because
+// it is the only thing that can say which backend is loaded.
+const SODIUM_CORE = "libsodium-sumo";
+
+describe("libsodium backend", () => {
+    test("this realm compiles WebAssembly, so the tests run the WASM build", async () => {
+        await expect(cryptoBackend()).resolves.toBe("wasm");
+    });
+
+    test("libsodium did not swap in the wasm2js fallback", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        // useBackupModule is the entry point to the fallback; taking it
+        // replaces the module's exports with the translation's, and the
+        // entry point goes with them. Still present after ready means the
+        // WASM module is the one in place. The test below is what keeps
+        // that inference honest.
+        expect(typeof core.useBackupModule).toBe("function");
+    });
+
+    // Deliberately last, and deliberately destructive: it takes the
+    // fallback, which replaces the loaded module for the rest of this
+    // file. Jest gives each test file its own module registry, so nothing
+    // outside sees it.
+    //
+    // Without this, the check above would be a claim about libsodium's
+    // internals with nothing holding it to account: if a future version
+    // kept useBackupModule on the fallback module too, the marker would
+    // quietly become true in both backends and the test would pass while
+    // measuring nothing. Forcing the fallback and watching the marker
+    // disappear is what makes its presence mean something.
+    test("the fallback marker distinguishes the two backends", async () => {
+        const core = require(SODIUM_CORE);
+        await require("libsodium-wrappers-sumo").ready;
+        expect(typeof core.useBackupModule).toBe("function");
+        await core.useBackupModule();
+        expect(typeof core.useBackupModule).toBe("undefined");
+    });
+});