feat: vendor and censor the phishing blocklist at build time (closes #219)

src/background/index.js

@@ -27,14 +27,9 @@ const {
     TX_STAGE_NONCE,
 } = require("../shared/approvalVerify");
 const { prepareApprovalTx } = require("../shared/approvalTx");
-const {
-    isPhishingDomain,
-    refreshPhishingListOnSchedule,
-    initPhishingList,
-} = require("../shared/phishingDomains");
+const { isPhishingDomain } = require("../shared/phishingDomains");
 const {
     BALANCE_REFRESH_ALARM,
-    PHISHING_REFRESH_ALARM,
     BALANCE_REFRESH_PERIOD_MINUTES,
     ensureRecurringAlarms,
     registerAlarmHandlers,
@@ -1052,26 +1047,20 @@ async function backgroundRefresh() {
     await saveState();
 }
 
-// Both recurring jobs run off alarms, not timers. On Chrome MV3 this file is
+// The recurring job runs off an alarm, not a timer. On Chrome MV3 this file is
 // a service worker that the browser terminates after about 30 seconds idle,
 // so a setInterval would only ever survive until the first idle period and
 // module-level state does not outlive it. Alarms are held by the browser and
 // wake the worker to deliver them.
 registerAlarmHandlers({
     [BALANCE_REFRESH_ALARM]: backgroundRefresh,
-    // The scheduled refresh, which restores persisted state on a freshly
-    // revived worker and then fetches unconditionally. The freshness guards
-    // belong to the startup path; applying them here would make the tick skip
-    // itself.
-    [PHISHING_REFRESH_ALARM]: refreshPhishingListOnSchedule,
 });
 
 // Everything the background context needs re-established on start. This runs
 // on a fresh install, on browser startup, and on every revival of a
 // terminated worker, so it must be idempotent: ensureRecurringAlarms() only
-// creates alarms that are missing or carrying a stale period, and
-// initPhishingList() fetches only when the persisted timestamps say the list
-// is stale.
+// creates alarms that are missing or carrying a stale period, and only clears
+// retired ones that are still registered.
 //
 // On a fresh install the top-level call and the onInstalled listener both run,
 // close enough together that both could see an alarm missing and create it.
@@ -1082,10 +1071,7 @@ let backgroundJobsRun = null;
 
 function startBackgroundJobs() {
     if (backgroundJobsRun) return backgroundJobsRun;
-    backgroundJobsRun = Promise.all([
-        ensureRecurringAlarms(),
-        initPhishingList(),
-    ])
+    backgroundJobsRun = ensureRecurringAlarms()
         .catch((err) => {
             // An alarm that failed to schedule means a recurring job silently
             // never runs again; it must not be an unhandled rejection.