Commit Graph
30 Commits
Author SHA1 Message Date
clawbot 79fec8551f fix: add reverse ENS lookups for all displayed addresses (closes #22)
check / check (push) Successful in 22s
Previously, ENS reverse lookups were only performed for the single
counterparty address (from or to depending on direction). This meant
contract interaction targets and the non-counterparty side of
transactions never got ENS names resolved.

Now both from and to addresses are collected for ENS resolution,
ensuring all displayed addresses show their ENS names when available.
2026-02-27 14:26:04 -08:00
clawbot 4fdbc5adae fmt: prettier format content/index.js
check / check (push) Successful in 21s
2026-02-27 14:10:37 -08:00
clawbot 34e29d7659 fix: re-render wallet list after deletion by calling showSettingsView
check / check (push) Successful in 21s
2026-02-27 14:02:44 -08:00
clawbot 8893f5dce7 refactor: delete-wallet-confirm as standalone full view
check / check (push) Successful in 22s
Replace the inline confirmation div at the bottom of Settings with a
proper full-screen view (view-delete-wallet-confirm). This fixes the
issue where the confirmation was offscreen on the 360x600 popup.

- New view with back button, title, warning text, password input,
  and red-text Confirm Delete button
- Dedicated flash area for password errors
- New deleteWallet.js module with init/show pattern
- Added delete-wallet-confirm to VIEWS array in helpers.js
- Removed old inline confirmation HTML and logic from settings
2026-02-27 13:58:58 -08:00
clawbot 2bffa91045 fix: reduce contract info well margins to prevent address wrapping
check / check (push) Successful in 22s
2026-02-27 13:54:19 -08:00
clawbot 2b0b889b01 fix: use wallet.encryptedSecret not wallet.encrypted for password verify
check / check (push) Successful in 22s
2026-02-27 13:52:08 -08:00
clawbot 5936199676 fix: place color dot next to address, not title, matching convention
check / check (push) Successful in 22s
2026-02-27 13:03:43 -08:00
clawbot f2e44ff4ab fix: use windows.create() for tx/sign approval popups instead of openPopup()
check / check (push) Successful in 22s
action.openPopup() is unreliable when called from the background script
during an async message handler — it requires a user gesture context.
tx and sign approvals are triggered programmatically by dApp RPC calls,
not by user clicking the toolbar icon, so openPopup() fails silently.

Use windows.create() directly for tx/sign approvals, matching the
standard extension pattern (used by MetaMask and others). Site-connection
approvals retain openPopup() since they can fall back to the user
clicking the toolbar icon.

Also updates popup window dimensions to 360x600 to match the standard
popup viewport specified in README.

Closes #4
2026-02-27 12:57:55 -08:00
clawbot 107c243f65 fix: use consistent [x] delete buttons, add inline rename
check / check (push) Successful in 8s
- Delete buttons now use [x] with border, matching token and site
  removal patterns in settings
- Wallet names are click-to-rename (inline input), matching the
  home view rename UX
2026-02-27 12:53:46 -08:00
clawbot 655b90c7df feat: add wallet deletion from settings (closes #13)
- Per-wallet [delete] links in settings wallet list
- Monochrome styling throughout, no red/danger colors
- Password confirmation modal with warning text
- Cleans up site permissions for deleted addresses
- Switches to first remaining wallet or shows welcome if none left
2026-02-27 12:53:46 -08:00
clawbot 34cd72be88 fix: rework wallet deletion per review feedback
- Remove all red/danger styling, use standard monochrome colors
- Add wallet picker dropdown instead of relying on selectedWallet
- Fix encryptedSecret field name (was wallet.encrypted)
- Populate dropdown when settings view opens
- Confirmation modal uses standard border styling
2026-02-27 12:53:46 -08:00
clawbot 3b419c7517 fix: add missing TOKEN_BY_ADDRESS import in addressToken view
check / check (push) Successful in 22s
2026-02-27 12:50:26 -08:00
clawbot 8b7d73cc35 fix: pass UUID approval ID as string, not parseInt (closes #4)
check / check (push) Successful in 22s
The approval ID was changed from sequential integers to crypto.randomUUID()
strings for security, but the popup still called parseInt() on it, which
converted the UUID to NaN. This caused every approval lookup to fail,
preventing the confirmation popup from displaying pending tx/sign requests.
2026-02-27 12:34:23 -08:00
clawbot 3fd3e30f44 fix: label swap methods as "Swap" in tx lists, remove unused variable
check / check (push) Successful in 23s
- Map known DEX methods (execute, swap, multicall, etc.) to "Swap"
  label instead of raw method name like "Execute"
- Remove unused displayData variable in transactionDetail.js

Addresses review feedback on PR #10.
2026-02-27 12:31:25 -08:00
clawbot 8332570758 fix: increase well horizontal margin to mx-4 per review
check / check (push) Successful in 22s
2026-02-27 12:27:23 -08:00
clawbot 7b004ddda4 fix: rework contract info well per review feedback
check / check (push) Successful in 22s
- Remove border, add rounded corners and horizontal margin
- Each attribute on its own line (key: value format)
- Move well below send/receive buttons
- Add project/token URL from tokenlist when available
- Import TOKEN_BY_ADDRESS for URL lookup
2026-02-27 12:26:24 -08:00
clawbot 91eefa1667 fix: use grey well for contract address display in address-token view
check / check (push) Successful in 22s
- Replace border-b styling with bg-hover + dashed border for visual
  distinction from wallet address
- Rename label from "Token Contract" to "Contract Address"
- Addresses feedback on #9
2026-02-27 12:15:35 -08:00
clawbot 909543e943 fix(L5): truncate token name/symbol from RPC responses
Limits token name to 64 chars and symbol to 12 chars to prevent
storage of excessively long values from malicious contracts.
2026-02-27 11:58:19 -08:00
clawbot 04a34d1a5e fix(L4): generate EIP-6963 provider UUID at install time
UUID is generated once via crypto.randomUUID(), persisted in
chrome.storage.local, and sent from the content script to the
inpage script via postMessage.
2026-02-27 11:58:19 -08:00
clawbot 98f68adb11 fix(L3): isUnlocked() returns false when no accounts exposed
_metamask.isUnlocked() now checks provider.selectedAddress instead of
always returning true.
2026-02-27 11:58:19 -08:00
clawbot 31b22c1325 style: format README.md and RULES.md with Prettier
check / check (push) Successful in 21s
2026-02-27 11:39:44 -08:00
clawbot eec96f9054 security: clear decrypted secrets after use (best-effort)
check / check (push) Successful in 21s
2026-02-27 11:36:56 -08:00
clawbot f13cd0fd47 security: add TODO comments for password plaintext over runtime.sendMessage 2026-02-27 11:36:19 -08:00
clawbot b478d9efa9 security: validate sender URL for popup-only messages 2026-02-27 11:35:42 -08:00
clawbot d59ebfd461 security: derive RPC origin from sender instead of trusting msg.origin 2026-02-27 11:35:31 -08:00
clawbot 13e2bdb0b0 security: add prominent danger warning for eth_sign requests 2026-02-27 11:35:21 -08:00
clawbot 95314ff229 security: replace predictable sequential approval IDs with crypto.randomUUID() 2026-02-27 11:34:48 -08:00
clawbot 1237cf8491 security: increase minimum password length from 8 to 12 characters 2026-02-27 11:34:32 -08:00
clawbot afc4868001 docs: document Blockscout as third external service in README
check / check (push) Failing after 13s
2026-02-27 03:25:02 -08:00
clawbot a6017ce32c docs: add agent-protection notice to RULES.md 2026-02-27 03:25:01 -08:00